Edit tour

Windows Analysis Report
DHLIN00178.exe

Overview

General Information

Sample Name:	DHLIN00178.exe
Analysis ID:	829130
MD5:	66fdf2df4fc8601124df76c284f797e1
SHA1:	88031f2f9bfbf3eb0b069c68fd4ed4ee288daf9f
SHA256:	e07a149d14fc37367e7331342d07dc45aec9ef7bbce780ea636c5d04f6c26f3f
Tags:	DHLexesigned
Infos:

Detection

GuLoader

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Yara detected Generic Downloader

Tries to detect virtualization through RDTSC time measurements

Uses 32bit PE files

PE file does not import any functions

Sample file is different than original file name gathered from version info

Drops PE files

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Binary contains a suspicious time stamp

Detected potential crypto function

PE / OLE file has an invalid certificate

PE file contains more sections than normal

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64

DHLIN00178.exe (PID: 5488 cmdline: C:\Users\user\Desktop\DHLIN00178.exe MD5: 66FDF2DF4FC8601124DF76C284F797E1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://blog.malwarebytes.com/scams/2020/08/sba-phishing-scams-from-malware-to-advanced-social-engineering/ https://blog.morphisec.com/guloader-the-rat-downloader https://blog.vincss.net/2020/05/re014-guloader-antivm-techniques.html https://cert-agid.gov.it/news/malware/tecniche-per-semplificare-lanalisi-del-malware-guloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Pointberegningernes241\Chaiselongs\Whatchamacallits76\querciflorae\System.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.821986246.0000000009D81000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: DHLIN00178.exe

Virustotal: Detection: 12%

Perma Link

Source: DHLIN00178.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: DHLIN00178.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: /_/artifacts/obj/manual.System/net6.0-Release/System.pdbSHA256n source: DHLIN00178.exe, 00000000.00000003.302938136.000000000285D000.00000004.00000020.00020000.00000000.sdmp, System.dll.0.dr
Source:	Binary string: maintenanceservice.pdb@ 0%P% source: DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Cryptography.X509Certificates\net6.0-windows-Release\System.Security.Cryptography.X509Certificates.pdb source: DHLIN00178.exe, 00000000.00000003.301912869.000000000285D000.00000004.00000020.00020000.00000000.sdmp, System.Security.Cryptography.X509Certificates.dll.0.dr
Source:	Binary string: /_/artifacts/obj/manual.System/net6.0-Release/System.pdb source: DHLIN00178.exe, 00000000.00000003.302938136.000000000285D000.00000004.00000020.00020000.00000000.sdmp, System.dll.0.dr
Source:	Binary string: System.Security.Cryptography.X509Certificates.ni.pdb source: DHLIN00178.exe, 00000000.00000003.301912869.000000000285D000.00000004.00000020.00020000.00000000.sdmp, System.Security.Cryptography.X509Certificates.dll.0.dr
Source:	Binary string: E:\Builds\221\N2\HO_SE_g_2016_r_0\Sources\SolutionExplorer\target\nar\bin\x86-Windows-msvc\release\SolutionExplorerCLI.pdb source: DHLIN00178.exe, 00000000.00000003.301192260.0000000002857000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr
Source:	Binary string: maintenanceservice.pdb source: DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr

Source: C:\Users\user\Desktop\DHLIN00178.exe	Code function: 0_2_004062DD FindFirstFileA,FindClose,	0_2_004062DD
Source: C:\Users\user\Desktop\DHLIN00178.exe	Code function: 0_2_004057A2 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004057A2
Source: C:\Users\user\Desktop\DHLIN00178.exe	Code function: 0_2_00402765 FindFirstFileA,	0_2_00402765

Source: C:\Users\user\Desktop\DHLIN00178.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache	Jump to behavior
Source: C:\Users\user\Desktop\DHLIN00178.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\DHLIN00178.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\DHLIN00178.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\DHLIN00178.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\DHLIN00178.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

Yara detected Generic Downloader

Source: Yara match

File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Pointberegningernes241\Chaiselongs\Whatchamacallits76\querciflorae\System.dll, type: DROPPED

Source: DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp, DHLIN00178.exe, 00000000.00000003.303404197.0000000002850000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp, DHLIN00178.exe, 00000000.00000003.303404197.0000000002850000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp, DHLIN00178.exe, 00000000.00000003.303404197.0000000002850000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: DHLIN00178.exe, 00000000.00000003.301192260.0000000002857000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp, DHLIN00178.exe, 00000000.00000003.303404197.0000000002850000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp, DHLIN00178.exe, 00000000.00000003.303404197.0000000002850000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp, DHLIN00178.exe, 00000000.00000003.303404197.0000000002850000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp, DHLIN00178.exe, 00000000.00000003.303404197.0000000002850000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp, DHLIN00178.exe, 00000000.00000003.303404197.0000000002850000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: DHLIN00178.exe, 00000000.00000003.303404197.0000000002850000.00000004.00000020.00020000.00000000.sdmp, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp, DHLIN00178.exe, 00000000.00000003.303404197.0000000002850000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: DHLIN00178.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: DHLIN00178.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp, DHLIN00178.exe, 00000000.00000003.303404197.0000000002850000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp, DHLIN00178.exe, 00000000.00000003.303404197.0000000002850000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp, DHLIN00178.exe, 00000000.00000003.303404197.0000000002850000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: DHLIN00178.exe, 00000000.00000003.301192260.0000000002857000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: DHLIN00178.exe	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: DHLIN00178.exe	String found in binary or memory: http://s.symcd.com06
Source: DHLIN00178.exe, 00000000.00000003.301192260.0000000002857000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: DHLIN00178.exe, 00000000.00000003.301192260.0000000002857000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://s2.symcb.com0
Source: DHLIN00178.exe, 00000000.00000003.301192260.0000000002857000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: DHLIN00178.exe, 00000000.00000003.301192260.0000000002857000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: DHLIN00178.exe, 00000000.00000003.301192260.0000000002857000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://sv.symcd.com0&
Source: DHLIN00178.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: DHLIN00178.exe, 00000000.00000003.301192260.0000000002857000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: DHLIN00178.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: DHLIN00178.exe, 00000000.00000003.301192260.0000000002857000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: DHLIN00178.exe, 00000000.00000003.301192260.0000000002857000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: DHLIN00178.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp, DHLIN00178.exe, 00000000.00000003.303404197.0000000002850000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: DHLIN00178.exe, 00000000.00000003.301192260.0000000002857000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://www.nero.com
Source: DHLIN00178.exe, 00000000.00000003.301192260.0000000002857000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: DHLIN00178.exe, 00000000.00000003.301192260.0000000002857000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: DHLIN00178.exe, 00000000.00000003.301912869.000000000285D000.00000004.00000020.00020000.00000000.sdmp, System.Security.Cryptography.X509Certificates.dll.0.dr	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: DHLIN00178.exe, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: DHLIN00178.exe, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: DHLIN00178.exe	String found in binary or memory: https://d.symcb.com/rpa0.
Source: DHLIN00178.exe, 00000000.00000003.302938136.000000000285D000.00000004.00000020.00020000.00000000.sdmp, DHLIN00178.exe, 00000000.00000003.301912869.000000000285D000.00000004.00000020.00020000.00000000.sdmp, System.Security.Cryptography.X509Certificates.dll.0.dr, System.dll.0.dr	String found in binary or memory: https://github.com/dotnet/runtime
Source: DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr	String found in binary or memory: https://mozilla.org0
Source: DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp, DHLIN00178.exe, 00000000.00000003.303404197.0000000002850000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0

Source: C:\Users\user\Desktop\DHLIN00178.exe

Code function: 0_2_0040523F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040523F

Source: DHLIN00178.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: System.Security.Cryptography.X509Certificates.dll.0.dr

Static PE information: No import functions for PE file found

Source: DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemaintenanceservice.exe0 vs DHLIN00178.exe
Source: DHLIN00178.exe, 00000000.00000003.302938136.000000000285D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.dll@ vs DHLIN00178.exe
Source: DHLIN00178.exe, 00000000.00000003.303404197.0000000002850000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepkcs11-helper-1.dll" vs DHLIN00178.exe
Source: DHLIN00178.exe, 00000000.00000003.301912869.000000000285D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Cryptography.X509Certificates.dll@ vs DHLIN00178.exe
Source: DHLIN00178.exe, 00000000.00000000.297999604.0000000000469000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBrankningens.exeDVarFileInfo$ vs DHLIN00178.exe
Source: DHLIN00178.exe, 00000000.00000003.301192260.0000000002857000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSolutionExplorerCLI.dll vs DHLIN00178.exe
Source: DHLIN00178.exe	Binary or memory string: OriginalFilenameBrankningens.exeDVarFileInfo$ vs DHLIN00178.exe

Source: C:\Users\user\Desktop\DHLIN00178.exe

Code function: 0_2_00403235 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403235

Source: C:\Users\user\Desktop\DHLIN00178.exe	Code function: 0_2_00406666		0_2_00406666
Source: C:\Users\user\Desktop\DHLIN00178.exe	Code function: 0_2_72DD1A98		0_2_72DD1A98

Source: DHLIN00178.exe

Static PE information: invalid certificate

Source: percentile.dll.0.dr	Static PE information: Number of sections : 19 > 10
Source: libdatrie-1.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: libpkcs11-helper-1.dll.0.dr	Static PE information: Number of sections : 12 > 10

Source: System.dll.0.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: C:\Users\user\Desktop\DHLIN00178.exe

Process Stats: CPU usage > 98%

Source: DHLIN00178.exe

Virustotal: Detection: 12%

Source: C:\Users\user\Desktop\DHLIN00178.exe

File read: C:\Users\user\Desktop\DHLIN00178.exe

Jump to behavior

Source: DHLIN00178.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\DHLIN00178.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\DHLIN00178.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\DHLIN00178.exe

0_2_00403235

Source: C:\Users\user\Desktop\DHLIN00178.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto

Jump to behavior

Source: C:\Users\user\Desktop\DHLIN00178.exe

File created: C:\Users\user\AppData\Local\Temp\nstE049.tmp

Jump to behavior

Source: classification engine

Classification label: mal64.troj.evad.winEXE@1/10@0/0

Source: C:\Users\user\Desktop\DHLIN00178.exe

Code function: 0_2_00402138 CoCreateInstance,MultiByteToWideChar,

0_2_00402138

Source: C:\Users\user\Desktop\DHLIN00178.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\DHLIN00178.exe

Code function: 0_2_004044FA GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_004044FA

Source: DHLIN00178.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: /_/artifacts/obj/manual.System/net6.0-Release/System.pdbSHA256n source: DHLIN00178.exe, 00000000.00000003.302938136.000000000285D000.00000004.00000020.00020000.00000000.sdmp, System.dll.0.dr
Source:	Binary string: maintenanceservice.pdb@ 0%P% source: DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Cryptography.X509Certificates\net6.0-windows-Release\System.Security.Cryptography.X509Certificates.pdb source: DHLIN00178.exe, 00000000.00000003.301912869.000000000285D000.00000004.00000020.00020000.00000000.sdmp, System.Security.Cryptography.X509Certificates.dll.0.dr
Source:	Binary string: /_/artifacts/obj/manual.System/net6.0-Release/System.pdb source: DHLIN00178.exe, 00000000.00000003.302938136.000000000285D000.00000004.00000020.00020000.00000000.sdmp, System.dll.0.dr
Source:	Binary string: System.Security.Cryptography.X509Certificates.ni.pdb source: DHLIN00178.exe, 00000000.00000003.301912869.000000000285D000.00000004.00000020.00020000.00000000.sdmp, System.Security.Cryptography.X509Certificates.dll.0.dr
Source:	Binary string: E:\Builds\221\N2\HO_SE_g_2016_r_0\Sources\SolutionExplorer\target\nar\bin\x86-Windows-msvc\release\SolutionExplorerCLI.pdb source: DHLIN00178.exe, 00000000.00000003.301192260.0000000002857000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr
Source:	Binary string: maintenanceservice.pdb source: DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.821986246.0000000009D81000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\DHLIN00178.exe

Code function: 0_2_72DD2F60 push eax; ret

0_2_72DD2F8E

Source: libdatrie-1.dll.0.dr	Static PE information: section name: .xdata
Source: libpkcs11-helper-1.dll.0.dr	Static PE information: section name: .xdata
Source: maintenanceservice2.exe.0.dr	Static PE information: section name: .00cfg
Source: percentile.dll.0.dr	Static PE information: section name: .xdata
Source: percentile.dll.0.dr	Static PE information: section name: /4
Source: percentile.dll.0.dr	Static PE information: section name: /19
Source: percentile.dll.0.dr	Static PE information: section name: /31
Source: percentile.dll.0.dr	Static PE information: section name: /45
Source: percentile.dll.0.dr	Static PE information: section name: /57
Source: percentile.dll.0.dr	Static PE information: section name: /70
Source: percentile.dll.0.dr	Static PE information: section name: /81
Source: percentile.dll.0.dr	Static PE information: section name: /92

Source: System.Security.Cryptography.X509Certificates.dll.0.dr

Static PE information: 0xF15766E0 [Tue Apr 22 20:30:24 2098 UTC]

Source: C:\Users\user\Desktop\DHLIN00178.exe

Code function: 0_2_72DD1A98 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_72DD1A98

Source: C:\Users\user\Desktop\DHLIN00178.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Maattet\SolutionExplorerCLI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DHLIN00178.exe	File created: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DHLIN00178.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Pointberegningernes241\Chaiselongs\Whatchamacallits76\querciflorae\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DHLIN00178.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Stingily\Nebularise\stormagasiners\libpkcs11-helper-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DHLIN00178.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Stingily\Nebularise\stormagasiners\maintenanceservice2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DHLIN00178.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Pointberegningernes241\Chaiselongs\Whatchamacallits76\querciflorae\libdatrie-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DHLIN00178.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Mandslinien\Characterizable\Senilitetstegnet\percentile.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DHLIN00178.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Maattet\System.Security.Cryptography.X509Certificates.dll	Jump to dropped file

Source: C:\Users\user\Desktop\DHLIN00178.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHLIN00178.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHLIN00178.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\DHLIN00178.exe

RDTSC instruction interceptor: First address: 000000000A51D8C7 second address: 000000000A51D8C7 instructions: 0x00000000 rdtsc 0x00000002 test bh, dh 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F87A501B604h 0x00000008 test ch, ch 0x0000000a inc ebp 0x0000000b cmp cl, dl 0x0000000d inc ebx 0x0000000e rdtsc

Source: C:\Users\user\Desktop\DHLIN00178.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Maattet\SolutionExplorerCLI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DHLIN00178.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Stingily\Nebularise\stormagasiners\libpkcs11-helper-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DHLIN00178.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Stingily\Nebularise\stormagasiners\maintenanceservice2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DHLIN00178.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Pointberegningernes241\Chaiselongs\Whatchamacallits76\querciflorae\libdatrie-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DHLIN00178.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Mandslinien\Characterizable\Senilitetstegnet\percentile.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DHLIN00178.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Maattet\System.Security.Cryptography.X509Certificates.dll	Jump to dropped file

Source: C:\Users\user\Desktop\DHLIN00178.exe	Code function: 0_2_004062DD FindFirstFileA,FindClose,	0_2_004062DD
Source: C:\Users\user\Desktop\DHLIN00178.exe	Code function: 0_2_004057A2 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004057A2
Source: C:\Users\user\Desktop\DHLIN00178.exe	Code function: 0_2_00402765 FindFirstFileA,	0_2_00402765

Source: C:\Users\user\Desktop\DHLIN00178.exe	API call chain: ExitProcess graph end node			graph_0-4818
Source: C:\Users\user\Desktop\DHLIN00178.exe	API call chain: ExitProcess graph end node			graph_0-4657

Source: C:\Users\user\Desktop\DHLIN00178.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache	Jump to behavior
Source: C:\Users\user\Desktop\DHLIN00178.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\DHLIN00178.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\DHLIN00178.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\DHLIN00178.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\DHLIN00178.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\Users\user\Desktop\DHLIN00178.exe

Code function: 0_2_72DD1A98 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_72DD1A98

Source: C:\Users\user\Desktop\DHLIN00178.exe

0_2_00403235

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	Path Interception	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Access Token Manipulation	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Clipboard Data	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Timestomp	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
DHLIN00178.exe	8%	ReversingLabs	Win32.Trojan.Generic
DHLIN00178.exe	12%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Maattet\SolutionExplorerCLI.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Maattet\SolutionExplorerCLI.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Maattet\System.Security.Cryptography.X509Certificates.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Maattet\System.Security.Cryptography.X509Certificates.dll	0%	Virustotal	Browse

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.0.DHLIN00178.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223491		Download File
0.2.DHLIN00178.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223491		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://mozilla.org0	0%	URL Reputation	safe
https://mozilla.org0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nsis.sf.net/NSIS_Error	DHLIN00178.exe	false		high
http://nsis.sf.net/NSIS_ErrorError	DHLIN00178.exe	false		high
https://aka.ms/dotnet-warnings/	DHLIN00178.exe, 00000000.00000003.301912869.000000000285D000.00000004.00000020.00020000.00000000.sdmp, System.Security.Cryptography.X509Certificates.dll.0.dr	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	DHLIN00178.exe, 00000000.00000003.301192260.0000000002857000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	false		high
http://www.symauth.com/cps0(	DHLIN00178.exe, 00000000.00000003.301192260.0000000002857000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	false		high
http://www.symauth.com/rpa00	DHLIN00178.exe, 00000000.00000003.301192260.0000000002857000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	false		high
https://mozilla.org0	DHLIN00178.exe, 00000000.00000003.303732226.0000000002855000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.thawte.com0	DHLIN00178.exe, 00000000.00000003.301192260.0000000002857000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	false	URL Reputation: safe	unknown
http://www.nero.com	DHLIN00178.exe, 00000000.00000003.301192260.0000000002857000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	false		high
https://github.com/dotnet/runtime	DHLIN00178.exe, 00000000.00000003.302938136.000000000285D000.00000004.00000020.00020000.00000000.sdmp, DHLIN00178.exe, 00000000.00000003.301912869.000000000285D000.00000004.00000020.00020000.00000000.sdmp, System.Security.Cryptography.X509Certificates.dll.0.dr, System.dll.0.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	829130
Start date and time:	2023-03-17 21:01:32 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	DHLIN00178.exe
Detection:	MAL
Classification:	mal64.troj.evad.winEXE@1/10@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 63.3% (good quality ratio 62%) Quality average: 89.2% Quality standard deviation: 21.4%
HCA Information:	Successful, ratio: 100% Number of executed functions: 52 Number of non-executed functions: 29
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
21:02:27	API Interceptor	1x Sleep call for process: DHLIN00178.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Maattet\System.Security.Cryptography.X509Certificates.dll	HCM152611.exe	Get hash	malicious	FormBook, GuLoader	Browse
	HCM152611.exe	Get hash	malicious	GuLoader	Browse
	Pepsico LLC RFQ Information.exe	Get hash	malicious	GuLoader	Browse
	Magpie.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Maattet\SolutionExplorerCLI.dll	EXFZCd3tg9.exe	Get hash	malicious	FormBook, GuLoader	Browse
	EXFZCd3tg9.exe	Get hash	malicious	GuLoader	Browse
	Company Profile.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Company Profile.exe	Get hash	malicious	GuLoader	Browse
	Company Profile.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Company Profile.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Maattet\Dystonia.Fis116

Download File

Process:	C:\Users\user\Desktop\DHLIN00178.exe
File Type:	ASCII text, with very long lines (53810), with no line terminators
Category:	dropped
Size (bytes):	53810
Entropy (8bit):	2.6910915446582364
Encrypted:	false
SSDEEP:	768:m5Bw4mEWCEEEEE87pG5nZpb+fPM3kgjx/6yE2xNLXnF+yB54yLvBkhBYq7oP8n5j:mlUnZpxU6xRLM2Lclp5weok
MD5:	7FB8B546EC10F0822FC0B4089E560733
SHA1:	2CEFF57E58D87662C329D3F1978CCBC6FCEB16DF
SHA-256:	6D868BCFDE2ECCB7EBD58E727C3DC32434DA3F21E0EF80AEA2C89E5F5A7F3642
SHA-512:	3F25762F1393CB4C9538B6005F00B8E122C029F05E542229D17EE6D761F0A91954C2CA79426650A8F1DE0310CB850E8E27AC2A713764BEB2719EBDE17A4CC59B
Malicious:	false
Reputation:	low
Preview:	00000F005B001A1A00004C00000054000000E300E9E90033000000DDDDDD00000000005C5C000000006700003A000054005D00000036363600004F4F00006D6D0000FFFFFFFFFF009E000086868600F30000A6A6A6A6000001000000141414140018000000262600303000B800000000008300202000660048008600000000F2F2F200000C00000000CF000000060600000030300078008700001C00BA00000000000000F3F300CB00C6C6C6C60050000000F000E3E300D1D1D100D9009A9A0000240000EDED00010000000000007070700000004B4B00000026003700A600363636000000420000A1000000C200BDBDBD005C5C002C000000F7000000000000007E7E7E7E7E00001E1E00ED00004C004C0000AB00002C2C007F7F0000007C00000E0000B40000BFBFBFBF000000AE000000000000888800FCFCFCFC005151000000C6C6C6007777770000CBCBCBCBCBCBCBCBCB0000DCDC00000000000097970000646400121200AE000000DA001C003F3F00000000CCCC0000333333008080808080800000000032009B9B0023232300004A000000A0A0A000000F0F00FF00008B00E7E7004400E5E50000E3E3E3E3E300202000000020007900001F1F0000007300000D00A100FAFA0003000072000000005A5A00E2E200B7B7B7B700000000002300A6A600720000002B005D000000838383

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Maattet\Skrddersjlenes.Nou

Download File

Process:	C:\Users\user\Desktop\DHLIN00178.exe
File Type:	data
Category:	dropped
Size (bytes):	260228
Entropy (8bit):	7.296059267389181
Encrypted:	false
SSDEEP:	3072:Frjq0MSUGUC72zwV6xCFAGSsIb0N1YK+S6RSojl8XfHtc9LtR866+Tq8oD7xYCBs:F0ZGUCT/Ib0NKSogfNc3HnW8oDHtswe
MD5:	3AE902DED608BA446C2B6FF0804D96BE
SHA1:	D3B6BF0FFA9F017DACA457F4569A04AA086CD263
SHA-256:	377721BE18CEB08A0D3181A3C375C08F5B918FE7CB0509046AB911C9030CDB95
SHA-512:	FECA207CF6E38A4DC94A266F02D84E86BDE14C6EC5F6859EADC38369955103BD707B97D09DEBEAD7CB5600D99E0A9043AF234FDBA221B674041844E926934FE8
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Maattet\SolutionExplorerCLI.dll

Download File

Process:	C:\Users\user\Desktop\DHLIN00178.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75248
Entropy (8bit):	6.149004775364808
Encrypted:	false
SSDEEP:	1536:GmY7dQU8l75gS4SqQR27YZW1cwvbTxUd6Rw:GmacliS49QR27YZW1vn2dWw
MD5:	3A03B61FA01DCDFF3E595D279F159D6E
SHA1:	94900C28C23AD01D311C389A0813277CFB30345C
SHA-256:	4F4D6511BEC955B4E8A30371ED743EA5EBC87CEB0BF93FE21F0A378AA2C05A01
SHA-512:	0D04D3486911DFE0439449554E90FB68B4D85EEE025A9B89910C306DE33CBFDBBEF1ABCAC5D4CD3B3CC1B1F445B7C67DC341C9363C9B127810ABD0498EC94AC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: EXFZCd3tg9.exe, Detection: malicious, Browse Filename: EXFZCd3tg9.exe, Detection: malicious, Browse Filename: Company Profile.exe, Detection: malicious, Browse Filename: Company Profile.exe, Detection: malicious, Browse Filename: Company Profile.exe, Detection: malicious, Browse Filename: Company Profile.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........T..:..:..:....:.....:..;..:..]..:..]...:..]..:..]...:..u...:..u..:....:..u...:.Rich.:.........PE..L...w..U...........!.....:..........dG.......P...............................@.......p....@.................................<...P.... .......................0.......P..8............................R..@............P..............(Q..H............text...!8.......:.................. ..`.rdata......P.......>..............@..@.data...............................@....rsrc........ ......................@..@.reloc.. ....0......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Maattet\System.Security.Cryptography.X509Certificates.dll

Download File

Process:	C:\Users\user\Desktop\DHLIN00178.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	485488
Entropy (8bit):	6.710350474742332
Encrypted:	false
SSDEEP:	6144:1E5AW+0VyAaOKxFf8r6S2rGjF0KAmdHCKsCZcufvh7OzxQxQ5JVIRVrk:KGWlaOKC2a0tmFChCOFeqLIRpk
MD5:	84D7B1FB924AEEFCF4A2C7A687FE2EF1
SHA1:	A2C2C7DE9096328A3FEF0C7FCEA262A294C0807B
SHA-256:	32A54C24B18B3C087E06F4F19885FB410304AB4AF2263154020D3F5CDCE36D99
SHA-512:	E75F91DA415B15CA0B19519179021FD88C0FC68FE4EF2A68B899B121BD511C04AECCB58101318C86CB0458D7310208C358DBB9155A02D62DE73C04128ECC5934
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: HCM152611.exe, Detection: malicious, Browse Filename: HCM152611.exe, Detection: malicious, Browse Filename: Pepsico LLC RFQ Information.exe, Detection: malicious, Browse Filename: Magpie.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....fW..........." .........................................................`............`...@......@............... ...........................................1...D..p$...P.......0..T...............................................................H............text.............................. ..`.data...wy.......z..................@....reloc.......P.......:..............@..B............................................0...........................T.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...................y.........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Mandslinien\Characterizable\Senilitetstegnet\percentile.dll

Download File

Process:	C:\Users\user\Desktop\DHLIN00178.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	102577
Entropy (8bit):	5.075179901575448
Encrypted:	false
SSDEEP:	768:t9H5uXFjJeEoPsznZgkZNhFdS2E0fVnSdNPfZ5+uKIu7aQzTgp37CtHRMX6NX0:tJ5wJeEoU9g0Nhav09nahfYxDRx0
MD5:	3144FDFEC817D0AC6FE3F4642B70328B
SHA1:	756C3513DC10CF00B517C72B2D3AB3E20895A46C
SHA-256:	BF17F5B38DCF35B55B1E0FAD462D4095ABAAA4CD8F1EDBDC8657C0249EF5D4D3
SHA-512:	012D9A3B88BA5D5090E8B47B49FE50E518489AB05FAAC6A1A0743F29A369B7D67F39B8E113B34740607137F2D67D75116DBE2A76E8E1DBE699BA4973F8037684
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...rL.`.<........& ...$.....6......P................................................U....`... .........................................Y....................P..................`............................A..(....................................................text...............................`.P`.data...p....0....... ..............@.P..rdata..p....@......."..............@.`@.pdata.......P.......*..............@.0@.xdata..l....`......................@.0@.bss.........p........................`..edata..Y............0..............@.0@.idata...............2..............@.0..CRT....X............6..............@.@..tls.................8..............@.@..reloc..`............:..............@.0B/4...................<..............@.PB/19.....C............@..............@..B/31..........`......................@..B/45.............. ..................@..B/57.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Pointberegningernes241\Chaiselongs\Whatchamacallits76\querciflorae\System.dll

Download File

Process:	C:\Users\user\Desktop\DHLIN00178.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49768
Entropy (8bit):	5.650496280667822
Encrypted:	false
SSDEEP:	768:4vuoy1c6A2ZX8TRNH5JVbOd502zq1TntV5fljM:4vuoO3ZX8Q5jzC35NjM
MD5:	BCC32F5B608C99F89508921B6333B329
SHA1:	5F70BB4A3A812C399D8D2A2954C9A715574CFF61
SHA-256:	5D4FF9A8E3B3CA26F53CD2CC4C557C5F2074A431B9CD029AE7F7A7B8902FA3C1
SHA-512:	99C7623BCA873C75A3B804C815DF178ACC88E043A36473C785216CD26DC73F0525FE336F17F0F2C8CA6473FBD407A953D4650D093C52440D93ECF07C1440FAB6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Pointberegningernes241\Chaiselongs\Whatchamacallits76\querciflorae\System.dll, Author: Joe Security
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ....................................`.....................................O.......................h$.............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......P ......................`.......................................BSJB............v4.0.30319......l...$;..#~...;...R..#Strings....4.......#US.8.......#GUID...H.......#Blob............T.........3................................/......................=.....=....J=...=......V...}.....h.. ..... ..... ..J.. ..... ..... ..... ..1.. ..j.. .., AF..a.AF.....R..e..=.................;.....;.....;..)..;..1..;..9..;..A..;..I..;..Q..;..Y..;..a..;..i..;..q..;..y..;.....; ....;.....;..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Pointberegningernes241\Chaiselongs\Whatchamacallits76\querciflorae\libdatrie-1.dll

Download File

Process:	C:\Users\user\Desktop\DHLIN00178.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	36029
Entropy (8bit):	5.699900454607003
Encrypted:	false
SSDEEP:	768:Hm5z53y6m/LHlM6GnPGUvMrsztd/sLLhF3VI:a53y6Gy6GuU5d/OhF3G
MD5:	8A54723090530190EB11AFCD5B702B1B
SHA1:	DFA923EC796A754BD21C4F9E504305848A4CB1B2
SHA-256:	738F67F45FAA07CC387BAF390604EE4CE709CBE7C223D9A043EE06F7CB360D5B
SHA-512:	E0D310458C8259112E07B153EDC86FDFF29E1B09648FED8D163D44DEB3BEE1545E7AD37BB00E9255DF6514844B21A829750848DA42F85FA77BEF376CE09750CF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...........<.....&".....R..........0..........h.....................................^........ .................................................................................`...............................(....................................................text...HP.......R..................`.P`.data........p.......V..............@.P..rdata...............X..............@.`@.pdata...............b..............@.0@.xdata...............j..............@.0@.bss.... .............................`..edata...............r..............@.0@.idata...............v..............@.0..CRT....X............~..............@.@..tls................................@.@..reloc..`...........................@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Stingily\Nebularise\stormagasiners\libpkcs11-helper-1.dll

Download File

Process:	C:\Users\user\Desktop\DHLIN00178.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	130344
Entropy (8bit):	6.2622011397185
Encrypted:	false
SSDEEP:	3072:tKInqqVjbm+1Vi5R6QQU7k1TAH1OobTrWHEE+jFpCOx:tVzjvi5R6QQU7k1TAH1OobTrWHExFpdx
MD5:	2455841538BA8A502398C18781CC3CEB
SHA1:	86CFD513FEE46EBC2C35225B27372679BE6ADA91
SHA-256:	F37BE7BD8C46D58CA931810536C8A2BEC36D06FF3281740FE0AD177F022AC781
SHA-512:	BC1DCDDE074150616DED7EAACC3FC44BDD2487EB5E550172F5EA46432AA76F19443A9FD6CEF61577B7803C1B083FFCBCEAF9ADC3114A97B547A78C2654F757E3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................&"....."....................\d.............................P......z.....`... .................................................X....0..................x....@.............................. ..(.......................P............................text...8!......."..................`.P`.data........@.......&..............@.`..rdata...^...P...`...(..............@.`@.pdata..............................@.0@.xdata..............................@.0@.bss..................................`..edata..............................@.0@.idata..X...........................@.0..CRT....X...........................@.@..tls....h.... ......................@.`..rsrc........0......................@.0..reloc.......@......................@.0B................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Stingily\Nebularise\stormagasiners\maintenanceservice2.exe

Download File

Process:	C:\Users\user\Desktop\DHLIN00178.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	227256
Entropy (8bit):	6.388677533277947
Encrypted:	false
SSDEEP:	6144:ue/rKQgYva3o4vj272BNvIJuQlf2qIHL2:uYrK4a3PvKw7ufg2
MD5:	49A2E97304EF8E044EEBD7ACCAD37E11
SHA1:	7D0F26591C8BD4CAB1718E323B65706CBEA5DE7A
SHA-256:	83EAFBF165642C563CD468D12BC85E3A9BAEDE084E5B18F99466E071149FD15F
SHA-512:	AC206C5EF6F373A0005902D09110A95A7F5FB4F524653D30C3A65182717272FE244694A6698D40884BEA243B2CA00D7741CED796DF7AE8C633F513B8C6FCD6C8
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...J..b.........."......:.....................@....................................Y.....`..................................................................`..h....X..........................................(....P..............(...h............................text....9.......:.................. ..`.rdata.......P.......>..............@..@.data....!...0......................@....pdata..h....`.......*..............@..@.00cfg...............D..............@..@.tls.................F..............@....rsrc................H..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\DHLIN00178.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.854901984552606
Encrypted:	false
SSDEEP:	192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
MD5:	0063D48AFE5A0CDC02833145667B6641
SHA1:	E7EB614805D183ECB1127C62DECB1A6BE1B4F7A8
SHA-256:	AC9DFE3B35EA4B8932536ED7406C29A432976B685CC5322F94EF93DF920FEDE7
SHA-512:	71CBBCAEB345E09306E368717EA0503FE8DF485BE2E95200FEBC61BCD8BA74FB4211CD263C232F148C0123F6C6F2E3FD4EA20BDECC4070F5208C35C6920240F0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ir.-.D.-.D.-.D...J..D.-.E.>.D......D.y0t.).D.N1n.,.D..3@.,.D.Rich-.D.........PE..L......]...........!..... ..........!).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...h....@.......(..............@....reloc..\|....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.477730016942703
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	DHLIN00178.exe
File size:	888192
MD5:	66fdf2df4fc8601124df76c284f797e1
SHA1:	88031f2f9bfbf3eb0b069c68fd4ed4ee288daf9f
SHA256:	e07a149d14fc37367e7331342d07dc45aec9ef7bbce780ea636c5d04f6c26f3f
SHA512:	a1fc53925d4fd04a81d2d7dc8bb26ed15fef14e9cd38945fbba55ef7b67a13b67c9527ed7c5388f9ed9013c287df67f343248bb4261838f389d34f42959c3720
SSDEEP:	12288:AwFjJnKlHcG+glWs89TbTjb8E5UcKcZnY4UKwp7hVOZCbgjvwhaD:A6jklHcGtlF89TbfccUNEZCbgjV
TLSH:	4715CFD7B845528CE9B99EB3712B1C2213701FBA662C104D76CC329D09FD1627EDE86E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.w.F......F...v...F...@...F.Rich..F.........PE..L......].................`..........52.......p....@

File Icon


Icon Hash:	6e8d166f696a6661

Static PE Info

General

Entrypoint:	0x403235
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5DF6D4E3 [Mon Dec 16 00:50:43 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e9c0657252137ac61c1eeeba4c021000

Authenticode Signature

Signature Valid:	false
Signature Issuer:	E=Misbehadden@Anstdsstenenes.Sta, OU="Seksdageslb Tredjebehandles ", O=Konfirmeres, L=Bondues, S=Hauts-de-France, C=FR
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	5/26/2022 11:04:34 PM 5/25/2025 11:04:34 PM
Subject Chain	E=Misbehadden@Anstdsstenenes.Sta, OU="Seksdageslb Tredjebehandles ", O=Konfirmeres, L=Bondues, S=Hauts-de-France, C=FR
Version:	3
Thumbprint MD5:	EF5809104A07E21FDB714DE7D3F4CB3B
Thumbprint SHA-1:	E5B83F0AF141BAF75894E4585A5133459235BDBF
Thumbprint SHA-256:	AC8EC8BCA9EDDE54EDCCFD81C53BCAB60DEB5C8F53E2C46EB232990CA73252D7
Serial:	7D95432F108C131FEDA31C4FE788119FC24ED14C

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004070A0h]
call dword ptr [0040709Ch]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042370Ch], eax
je 00007F87A4B6F1F3h
push ebx
call 00007F87A4B722DBh
cmp eax, ebx
je 00007F87A4B6F1E9h
push 00000C00h
call eax
mov esi, 00407298h
push esi
call 00007F87A4B72257h
push esi
call dword ptr [00407098h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F87A4B6F1CDh
push 0000000Ah
call 00007F87A4B722AFh
push 00000008h
call 00007F87A4B722A8h
push 00000006h
mov dword ptr [00423704h], eax
call 00007F87A4B7229Ch
cmp eax, ebx
je 00007F87A4B6F1F1h
push 0000001Eh
call eax
test eax, eax
je 00007F87A4B6F1E9h
or byte ptr [0042370Fh], 00000040h
push ebp
call dword ptr [00407040h]
push ebx
call dword ptr [00407284h]
mov dword ptr [004237D8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041ECC8h
call dword ptr [00407178h]
push 00409188h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7430	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x36000	0x34260	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xd6b18	0x2268
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x294	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5f7d	0x6000	False	0.6680094401041666	data	6.466064816043304	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x123e	0x1400	False	0.4275390625	data	4.989734782278587	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1a818	0x400	False	0.638671875	data	5.130817636118804	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x24000	0x12000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x36000	0x34260	0x34400	False	0.20456414473684212	data	4.299804646716883	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x36208	0x33828	Device independent bitmap graphic, 199 x 512 x 32, image size 203776, resolution 3779 x 3779 px/m	English	United States
RT_DIALOG	0x69a30	0x100	data	English	United States
RT_DIALOG	0x69b30	0x11c	data	English	United States
RT_DIALOG	0x69c50	0xc4	data	English	United States
RT_DIALOG	0x69d18	0x60	data	English	United States
RT_GROUP_ICON	0x69d78	0x14	data	English	United States
RT_VERSION	0x69d90	0x190	data	English	United States
RT_MANIFEST	0x69f20	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	GetTempPathA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetEnvironmentVariableA, Sleep, GetTickCount, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GetWindowsDirectoryA, SetFileAttributesA, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, GetExitCodeProcess, WaitForSingleObject, CompareFileTime, SetFileTime, GetFileAttributesA, SetCurrentDirectoryA, MoveFileA, GetFullPathNameA, GetShortPathNameA, SearchPathA, CloseHandle, lstrcmpiA, CreateThread, GlobalLock, lstrcmpA, DeleteFileA, FindFirstFileA, FindNextFileA, FindClose, SetFilePointer, GetPrivateProfileStringA, WritePrivateProfileStringA, MulDiv, MultiByteToWideChar, FreeLibrary, LoadLibraryExA, GetModuleHandleA, GlobalAlloc, GlobalFree, ExpandEnvironmentStringsA
USER32.dll	GetSystemMenu, SetClassLongA, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, LoadImageA, CreateDialogParamA, SetTimer, SetWindowTextA, SetForegroundWindow, ShowWindow, SetWindowLongA, SendMessageTimeoutA, FindWindowExA, IsWindow, AppendMenuA, TrackPopupMenu, CreatePopupMenu, DrawTextA, EndPaint, DestroyWindow, wsprintfA, PostQuitMessage
GDI32.dll	SelectObject, SetTextColor, SetBkMode, CreateFontIndirectA, CreateBrushIndirect, DeleteObject, GetDeviceCaps, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExA, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, SHFileOperationA
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExA, RegOpenKeyExA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, RegEnumValueA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Report size exceeds maximum size, go to the download page of this report and download PCAP to see all network behavior.

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: DHLIN00178.exePID: 5488, Parent PID: 3324

General

Target ID:	0
Start time:	21:02:27
Start date:	17/03/2023
Path:	C:\Users\user\Desktop\DHLIN00178.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\DHLIN00178.exe
Imagebase:	0x400000
File size:	888192 bytes
MD5 hash:	66FDF2DF4FC8601124DF76C284F797E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.821986246.0000000009D81000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: DHLIN00178.exePID: 5488, Parent PID: 3324COMMON

Execution Graph

Execution Coverage:	20.4%
Dynamic/Decrypted Code Coverage:	13.4%
Signature Coverage:	17.1%
Total number of Nodes:	1516
Total number of Limit Nodes:	42

Executed Functions

Function 00403235 Relevance: 87.9, APIs: 32, Strings: 18, Instructions: 366
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			_entry_() {
				signed int _t42;
				intOrPtr* _t47;
				CHAR* _t51;
				char* _t53;
				CHAR* _t55;
				void* _t59;
				intOrPtr _t61;
				int _t63;
				int _t66;
				signed int _t67;
				int _t68;
				signed int _t70;
				void* _t94;
				signed int _t110;
				void* _t113;
				void* _t118;
				intOrPtr* _t119;
				char _t122;
				signed int _t141;
				signed int _t142;
				int _t150;
				void* _t151;
				intOrPtr* _t153;
				CHAR* _t156;
				CHAR* _t157;
				void* _t159;
				char* _t160;
				void* _t163;
				void* _t164;
				char _t189;

				 *(_t164 + 0x18) = 0;
				 *((intOrPtr*)(_t164 + 0x10)) = "Error writing temporary file. Make sure your temp folder is valid.";
				 *(_t164 + 0x20) = 0;
				 *(_t164 + 0x14) = 0x20;
				SetErrorMode(0x8001); // executed
				_t42 = GetVersion() & 0xbfffffff;
				 *0x42370c = _t42;
				if(_t42 != 6) {
					_t119 = E00406372(0);
					if(_t119 != 0) {
						 *_t119(0xc00);
					}
				}
				_t156 = "UXTHEME";
				do {
					E00406304(_t156); // executed
					_t156 =  &(_t156[lstrlenA(_t156) + 1]);
				} while ( *_t156 != 0);
				E00406372(0xa);
				 *0x423704 = E00406372(8);
				_t47 = E00406372(6);
				if(_t47 != 0) {
					_t47 =  *_t47(0x1e);
					if(_t47 != 0) {
						 *0x42370f =  *0x42370f | 0x00000040;
					}
				}
				__imp__#17(_t159);
				__imp__OleInitialize(0); // executed
				 *0x4237d8 = _t47;
				SHGetFileInfoA(0x41ecc8, 0, _t164 + 0x38, 0x160, 0); // executed
				E00405FDA(0x422f00, "NSIS Error");
				_t51 = GetCommandLineA();
				_t160 = "\"C:\\Users\\alfons\\Desktop\\DHLIN00178.exe\"";
				E00405FDA(_t160, _t51);
				 *0x423700 = 0x400000;
				_t53 = _t160;
				if("\"C:\\Users\\alfons\\Desktop\\DHLIN00178.exe\"" == 0x22) {
					 *(_t164 + 0x14) = 0x22;
					_t53 =  &M00429001;
				}
				_t55 = CharNextA(E0040599D(_t53,  *(_t164 + 0x14)));
				 *(_t164 + 0x1c) = _t55;
				while(1) {
					_t122 =  *_t55;
					_t172 = _t122;
					if(_t122 == 0) {
						break;
					}
					__eflags = _t122 - 0x20;
					if(_t122 != 0x20) {
						L13:
						__eflags =  *_t55 - 0x22;
						 *(_t164 + 0x14) = 0x20;
						if( *_t55 == 0x22) {
							_t55 =  &(_t55[1]);
							__eflags = _t55;
							 *(_t164 + 0x14) = 0x22;
						}
						__eflags =  *_t55 - 0x2f;
						if( *_t55 != 0x2f) {
							L25:
							_t55 = E0040599D(_t55,  *(_t164 + 0x14));
							__eflags =  *_t55 - 0x22;
							if(__eflags == 0) {
								_t55 =  &(_t55[1]);
								__eflags = _t55;
							}
							continue;
						} else {
							_t55 =  &(_t55[1]);
							__eflags =  *_t55 - 0x53;
							if( *_t55 != 0x53) {
								L20:
								__eflags =  *_t55 - ((( *0x409183 << 0x00000008 |  *0x409182) << 0x00000008 |  *0x409181) << 0x00000008 | "NCRC");
								if( *_t55 != ((( *0x409183 << 0x00000008 |  *0x409182) << 0x00000008 |  *0x409181) << 0x00000008 | "NCRC")) {
									L24:
									__eflags =  *((intOrPtr*)(_t55 - 2)) - ((( *0x40917b << 0x00000008 |  *0x40917a) << 0x00000008 |  *0x409179) << 0x00000008 | " /D=");
									if( *((intOrPtr*)(_t55 - 2)) == ((( *0x40917b << 0x00000008 |  *0x40917a) << 0x00000008 |  *0x409179) << 0x00000008 | " /D=")) {
										 *((char*)(_t55 - 2)) = 0;
										__eflags =  &(_t55[2]);
										E00405FDA("C:\\Users\\alfons\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto",  &(_t55[2]));
										L30:
										_t157 = "C:\\Users\\alfons\\AppData\\Local\\Temp\\";
										GetTempPathA(0x400, _t157);
										_t59 = E00403204(_t172);
										_t173 = _t59;
										if(_t59 != 0) {
											L33:
											DeleteFileA("1033"); // executed
											_t61 = E00402DC4(_t175,  *(_t164 + 0x20)); // executed
											 *((intOrPtr*)(_t164 + 0x10)) = _t61;
											if(_t61 != 0) {
												L43:
												E0040371D();
												__imp__OleUninitialize();
												_t185 =  *((intOrPtr*)(_t164 + 0x10));
												if( *((intOrPtr*)(_t164 + 0x10)) == 0) {
													__eflags =  *0x4237b4;
													if( *0x4237b4 == 0) {
														L67:
														_t63 =  *0x4237cc;
														__eflags = _t63 - 0xffffffff;
														if(_t63 != 0xffffffff) {
															 *(_t164 + 0x14) = _t63;
														}
														ExitProcess( *(_t164 + 0x14));
													}
													_t66 = OpenProcessToken(GetCurrentProcess(), 0x28, _t164 + 0x18);
													__eflags = _t66;
													_t150 = 2;
													if(_t66 != 0) {
														LookupPrivilegeValueA(0, "SeShutdownPrivilege", _t164 + 0x24);
														 *(_t164 + 0x38) = 1;
														 *(_t164 + 0x44) = _t150;
														AdjustTokenPrivileges( *(_t164 + 0x2c), 0, _t164 + 0x28, 0, 0, 0);
													}
													_t67 = E00406372(4);
													__eflags = _t67;
													if(_t67 == 0) {
														L65:
														_t68 = ExitWindowsEx(_t150, 0x80040002);
														__eflags = _t68;
														if(_t68 != 0) {
															goto L67;
														}
														goto L66;
													} else {
														_t70 =  *_t67(0, 0, 0, 0x25, 0x80040002);
														__eflags = _t70;
														if(_t70 == 0) {
															L66:
															E0040140B(9);
															goto L67;
														}
														goto L65;
													}
												}
												E004056F6( *((intOrPtr*)(_t164 + 0x10)), 0x200010);
												ExitProcess(2);
											}
											if( *0x423720 == 0) {
												L42:
												 *0x4237cc =  *0x4237cc | 0xffffffff;
												 *(_t164 + 0x18) = E004037F7( *0x4237cc);
												goto L43;
											}
											_t153 = E0040599D(_t160, 0);
											if(_t153 < _t160) {
												L39:
												_t182 = _t153 - _t160;
												 *((intOrPtr*)(_t164 + 0x10)) = "Error launching installer";
												if(_t153 < _t160) {
													_t151 = E00405661(_t185);
													lstrcatA(_t157, "~nsu");
													if(_t151 != 0) {
														lstrcatA(_t157, "A");
													}
													lstrcatA(_t157, ".tmp");
													_t162 = "C:\\Users\\alfons\\Desktop";
													if(lstrcmpiA(_t157, "C:\\Users\\alfons\\Desktop") != 0) {
														_push(_t157);
														if(_t151 == 0) {
															E00405644();
														} else {
															E004055C7();
														}
														SetCurrentDirectoryA(_t157);
														_t189 = "C:\\Users\\alfons\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto"; // 0x43
														if(_t189 == 0) {
															E00405FDA("C:\\Users\\alfons\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto", _t162);
														}
														E00405FDA(0x424000,  *(_t164 + 0x1c));
														_t137 = "A";
														_t163 = 0x1a;
														 *0x424400 = "A";
														do {
															E00405FFC(0, 0x41e8c8, _t157, 0x41e8c8,  *((intOrPtr*)( *0x423714 + 0x120)));
															DeleteFileA(0x41e8c8);
															if( *((intOrPtr*)(_t164 + 0x10)) != 0 && CopyFileA("C:\\Users\\alfons\\Desktop\\DHLIN00178.exe", 0x41e8c8, 1) != 0) {
																E00405DB9(_t137, 0x41e8c8, 0);
																E00405FFC(0, 0x41e8c8, _t157, 0x41e8c8,  *((intOrPtr*)( *0x423714 + 0x124)));
																_t94 = E00405679(0x41e8c8);
																if(_t94 != 0) {
																	CloseHandle(_t94);
																	 *((intOrPtr*)(_t164 + 0x10)) = 0;
																}
															}
															 *0x424400 =  *0x424400 + 1;
															_t163 = _t163 - 1;
														} while (_t163 != 0);
														E00405DB9(_t137, _t157, 0);
													}
													goto L43;
												}
												 *_t153 = 0;
												_t154 = _t153 + 4;
												if(E00405A60(_t182, _t153 + 4) == 0) {
													goto L43;
												}
												E00405FDA("C:\\Users\\alfons\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto", _t154);
												E00405FDA("C:\\Users\\alfons\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto\\Mandslinien\\Characterizable\\Senilitetstegnet", _t154);
												 *((intOrPtr*)(_t164 + 0x10)) = 0;
												goto L42;
											}
											_t110 = (( *0x40915b << 0x00000008 |  *0x40915a) << 0x00000008 |  *0x409159) << 0x00000008 | " _?=";
											while( *_t153 != _t110) {
												_t153 = _t153 - 1;
												if(_t153 >= _t160) {
													continue;
												}
												goto L39;
											}
											goto L39;
										}
										GetWindowsDirectoryA(_t157, 0x3fb);
										lstrcatA(_t157, "\\Temp");
										_t113 = E00403204(_t173);
										_t174 = _t113;
										if(_t113 != 0) {
											goto L33;
										}
										GetTempPathA(0x3fc, _t157);
										lstrcatA(_t157, "Low");
										SetEnvironmentVariableA("TEMP", _t157);
										SetEnvironmentVariableA("TMP", _t157);
										_t118 = E00403204(_t174);
										_t175 = _t118;
										if(_t118 == 0) {
											goto L43;
										}
										goto L33;
									}
									goto L25;
								}
								_t141 = _t55[4];
								__eflags = _t141 - 0x20;
								if(_t141 == 0x20) {
									L23:
									_t15 = _t164 + 0x20;
									 *_t15 =  *(_t164 + 0x20) | 0x00000004;
									__eflags =  *_t15;
									goto L24;
								}
								__eflags = _t141;
								if(_t141 != 0) {
									goto L24;
								}
								goto L23;
							}
							_t142 = _t55[1];
							__eflags = _t142 - 0x20;
							if(_t142 == 0x20) {
								L19:
								 *0x4237c0 = 1;
								goto L20;
							}
							__eflags = _t142;
							if(_t142 != 0) {
								goto L20;
							}
							goto L19;
						}
					} else {
						goto L12;
					}
					do {
						L12:
						_t55 =  &(_t55[1]);
						__eflags =  *_t55 - 0x20;
					} while ( *_t55 == 0x20);
					goto L13;
				}
				goto L30;
			}

0x00403245
0x00403249
0x00403251
0x00403255
0x0040325a
0x00403266
0x0040326f
0x00403274
0x00403277
0x0040327e
0x00403285
0x00403285
0x0040327e
0x00403287
0x0040328c
0x0040328d
0x00403299
0x0040329d
0x004032a3
0x004032b1
0x004032b6
0x004032bd
0x004032c1
0x004032c5
0x004032c7
0x004032c7
0x004032c5
0x004032cf
0x004032d6
0x004032dc
0x004032f2
0x00403302
0x00403307
0x0040330d
0x00403314
0x00403320
0x0040332a
0x0040332c
0x0040332e
0x00403333
0x00403333
0x00403343
0x00403349
0x00403412
0x00403412
0x00403414
0x00403416
0x00000000
0x00000000
0x00403352
0x00403355
0x0040335d
0x0040335d
0x00403360
0x00403365
0x00403367
0x00403367
0x00403368
0x00403368
0x0040336d
0x00403370
0x00403402
0x00403407
0x0040340c
0x0040340f
0x00403411
0x00403411
0x00403411
0x00000000
0x00403376
0x00403376
0x00403377
0x0040337a
0x00403392
0x004033bd
0x004033bf
0x004033d2
0x004033fd
0x00403400
0x0040341e
0x00403421
0x0040342a
0x0040342f
0x00403435
0x00403440
0x00403442
0x00403447
0x00403449
0x004034a1
0x004034a6
0x004034b0
0x004034b7
0x004034bb
0x0040354f
0x0040354f
0x00403554
0x0040355a
0x0040355f
0x00403683
0x00403689
0x00403705
0x00403705
0x0040370a
0x0040370d
0x0040370f
0x0040370f
0x00403717
0x00403717
0x00403699
0x004036a1
0x004036a3
0x004036a4
0x004036b1
0x004036c4
0x004036cc
0x004036d0
0x004036d0
0x004036d8
0x004036dd
0x004036e4
0x004036f2
0x004036f4
0x004036fa
0x004036fc
0x00000000
0x00000000
0x00000000
0x004036e6
0x004036ec
0x004036ee
0x004036f0
0x004036fe
0x00403700
0x00000000
0x00403700
0x00000000
0x004036f0
0x004036e4
0x0040356e
0x00403575
0x00403575
0x004034c7
0x0040353f
0x0040353f
0x0040354b
0x00000000
0x0040354b
0x004034d0
0x004034d4
0x0040350a
0x0040350a
0x0040350c
0x00403514
0x00403586
0x00403588
0x0040358f
0x00403597
0x00403597
0x004035a2
0x004035a7
0x004035b6
0x004035ba
0x004035bb
0x004035c4
0x004035bd
0x004035bd
0x004035bd
0x004035ca
0x004035d0
0x004035d6
0x004035de
0x004035de
0x004035ec
0x004035f1
0x00403603
0x0040360b
0x00403611
0x0040361d
0x00403623
0x0040362d
0x00403643
0x00403654
0x0040365a
0x00403661
0x00403664
0x0040366a
0x0040366a
0x00403661
0x0040366e
0x00403674
0x00403674
0x00403679
0x00403679
0x00000000
0x004035b6
0x00403516
0x00403518
0x00403523
0x00000000
0x00000000
0x0040352b
0x00403536
0x0040353b
0x00000000
0x0040353b
0x004034ff
0x00403501
0x00403505
0x00403508
0x00000000
0x00000000
0x00000000
0x00403508
0x00000000
0x00403501
0x00403451
0x0040345d
0x00403462
0x00403467
0x00403469
0x00000000
0x00000000
0x00403471
0x00403479
0x0040348a
0x00403492
0x00403494
0x00403499
0x0040349b
0x00000000
0x00000000
0x00000000
0x0040349b
0x00000000
0x00403400
0x004033c1
0x004033c4
0x004033c7
0x004033cd
0x004033cd
0x004033cd
0x004033cd
0x00000000
0x004033cd
0x004033c9
0x004033cb
0x00000000
0x00000000
0x00000000
0x004033cb
0x0040337c
0x0040337f
0x00403382
0x00403388
0x00403388
0x00000000
0x00403388
0x00403384
0x00403386
0x00000000
0x00000000
0x00000000
0x00403386
0x00000000
0x00000000
0x00000000
0x00403357
0x00403357
0x00403357
0x00403358
0x00403358
0x00000000
0x00403357
0x00000000

APIs

SetErrorMode.KERNELBASE ref: 0040325A
GetVersion.KERNEL32 ref: 00403260
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403293
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 004032CF
OleInitialize.OLE32(00000000), ref: 004032D6
SHGetFileInfoA.SHELL32(0041ECC8,00000000,?,00000160,00000000,?,00000006,00000008,0000000A), ref: 004032F2
GetCommandLineA.KERNEL32(00422F00,NSIS Error,?,00000006,00000008,0000000A), ref: 00403307
CharNextA.USER32(00000000,"C:\Users\user\Desktop\DHLIN00178.exe",00000020,"C:\Users\user\Desktop\DHLIN00178.exe",00000000,?,00000006,00000008,0000000A), ref: 00403343
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000006,00000008,0000000A), ref: 00403440
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 00403451
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 0040345D
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403471
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403479
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 0040348A
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 00403492
DeleteFileA.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 004034A6

Part of subcall function 00406372: GetModuleHandleA.KERNEL32(?,?,?,004032A8,0000000A), ref: 00406384
Part of subcall function 00406372: GetProcAddress.KERNEL32(00000000,?), ref: 0040639F

Part of subcall function 004037F7: lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto,1033,Sepad149: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Sepad149: Installing,00000000,00000002,766DFA90), ref: 004038E7
Part of subcall function 004037F7: lstrcmpiA.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto,1033,Sepad149: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Sepad149: Installing,00000000), ref: 004038FA
Part of subcall function 004037F7: GetFileAttributesA.KERNEL32(Call), ref: 00403905
Part of subcall function 004037F7: LoadImageA.USER32 ref: 0040394E
Part of subcall function 004037F7: RegisterClassA.USER32 ref: 0040398B

Part of subcall function 0040371D: CloseHandle.KERNEL32(000002C0,00403554,?,?,00000006,00000008,0000000A), ref: 00403728

OleUninitialize.OLE32(?,?,00000006,00000008,0000000A), ref: 00403554
ExitProcess.KERNEL32 ref: 00403575
GetCurrentProcess.KERNEL32(00000028,?,00000006,00000008,0000000A), ref: 00403692
OpenProcessToken.ADVAPI32(00000000), ref: 00403699
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004036B1
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 004036D0
ExitWindowsEx.USER32(00000002,80040002), ref: 004036F4
ExitProcess.KERNEL32 ref: 00403717

Part of subcall function 004056F6: MessageBoxIndirectA.USER32 ref: 00405751

Strings

.tmp, xrefs: 0040359C
Error launching installer, xrefs: 0040350C
C:\Users\user\Desktop\DHLIN00178.exe, xrefs: 00403632
", xrefs: 00403368
\Temp, xrefs: 00403457
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto, xrefs: 00403425, 00403526, 004035D0, 004035D9
C:\Users\user\AppData\Local\Temp\, xrefs: 00403435, 0040343A, 00403450, 0040345C, 0040346B, 00403478, 00403484, 0040348C, 00403585, 00403596, 004035A1, 004035AD, 004035BA, 004035C9, 00403678
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Mandslinien\Characterizable\Senilitetstegnet, xrefs: 00403531
TMP, xrefs: 0040348D
C:\Users\user\Desktop, xrefs: 004035A7, 004035AC, 004035D8
1033, xrefs: 004034A1
UXTHEME, xrefs: 00403287, 0040328C, 00403292
Low, xrefs: 00403473
SeShutdownPrivilege, xrefs: 004036AB
"C:\Users\user\Desktop\DHLIN00178.exe", xrefs: 0040330D, 00403313, 004034CA
NSIS Error, xrefs: 004032F8
TEMP, xrefs: 00403485
~nsu, xrefs: 00403580

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: Process$ExitFile$EnvironmentHandlePathTempTokenVariableWindowslstrcatlstrlen$AddressAdjustAttributesCharClassCloseCommandCurrentDeleteDirectoryErrorImageIndirectInfoInitializeLineLoadLookupMessageModeModuleNextOpenPrivilegePrivilegesProcRegisterUninitializeValueVersionlstrcmpi
String ID: "$"C:\Users\user\Desktop\DHLIN00178.exe"$.tmp$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Mandslinien\Characterizable\Senilitetstegnet$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\DHLIN00178.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3776617018-1571161429
Opcode ID: 47f0f4bfed41ce18027c3f7b4cd283128f530326f184dcc79bdceb26c856a261
Instruction ID: 70de6b230954929a2c0fab4aa6e61a8dc1a32ac2bd4530e0982157a086cffda4
Opcode Fuzzy Hash: 47f0f4bfed41ce18027c3f7b4cd283128f530326f184dcc79bdceb26c856a261
Instruction Fuzzy Hash: 62C1F6706086526AE7216F759D49B2F3EA8EB81706F04453FF541B61E2CB7C8E05CB2E

Uniqueness

Uniqueness Score: -1.00%

Function 0040523F Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E0040523F(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				struct tagRECT _v24;
				void* _v32;
				signed int _v36;
				int _v40;
				int _v44;
				signed int _v48;
				int _v52;
				void* _v56;
				void* _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t87;
				struct HWND__* _t89;
				long _t90;
				int _t95;
				int _t96;
				long _t99;
				void* _t102;
				intOrPtr _t113;
				void* _t121;
				intOrPtr _t124;
				struct HWND__* _t128;
				int _t150;
				int _t153;
				long _t157;
				struct HWND__* _t161;
				struct HMENU__* _t163;
				long _t165;
				void* _t166;
				char* _t167;
				char* _t168;
				int _t169;

				_t87 =  *0x422ee4; // 0x10444
				_t157 = _a8;
				_t150 = 0;
				_v8 = _t87;
				if(_t157 != 0x110) {
					__eflags = _t157 - 0x405;
					if(_t157 == 0x405) {
						_t121 = CreateThread(0, 0, E004051D3, GetDlgItem(_a4, 0x3ec), 0,  &_a8); // executed
						FindCloseChangeNotification(_t121);
					}
					__eflags = _t157 - 0x111;
					if(_t157 != 0x111) {
						L17:
						__eflags = _t157 - 0x404;
						if(_t157 != 0x404) {
							L25:
							__eflags = _t157 - 0x7b;
							if(_t157 != 0x7b) {
								goto L20;
							}
							_t89 = _v8;
							__eflags = _a12 - _t89;
							if(_a12 != _t89) {
								goto L20;
							}
							_t90 = SendMessageA(_t89, 0x1004, _t150, _t150);
							__eflags = _t90 - _t150;
							_a12 = _t90;
							if(_t90 <= _t150) {
								L36:
								return 0;
							}
							_t163 = CreatePopupMenu();
							AppendMenuA(_t163, _t150, 1, E00405FFC(_t150, _t157, _t163, _t150, 0xffffffe1));
							_t95 = _a16;
							__eflags = _a16 - 0xffffffff;
							_t153 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v24);
								_t95 = _v24.left;
								_t153 = _v24.top;
							}
							_t96 = TrackPopupMenu(_t163, 0x180, _t95, _t153, _t150, _a4, _t150);
							__eflags = _t96 - 1;
							if(_t96 == 1) {
								_t165 = 1;
								__eflags = 1;
								_v56 = _t150;
								_v44 = 0x41fd08;
								_v40 = 0x1000;
								_a4 = _a12;
								do {
									_a4 = _a4 - 1;
									_t99 = SendMessageA(_v8, 0x102d, _a4,  &_v64);
									__eflags = _a4 - _t150;
									_t165 = _t165 + _t99 + 2;
								} while (_a4 != _t150);
								OpenClipboard(_t150);
								EmptyClipboard();
								_t102 = GlobalAlloc(0x42, _t165);
								_a4 = _t102;
								_t166 = GlobalLock(_t102);
								do {
									_v44 = _t166;
									_t167 = _t166 + SendMessageA(_v8, 0x102d, _t150,  &_v64);
									 *_t167 = 0xd;
									_t168 = _t167 + 1;
									 *_t168 = 0xa;
									_t166 = _t168 + 1;
									_t150 = _t150 + 1;
									__eflags = _t150 - _a12;
								} while (_t150 < _a12);
								GlobalUnlock(_a4);
								SetClipboardData(1, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						__eflags =  *0x422ecc - _t150; // 0x0
						if(__eflags == 0) {
							ShowWindow( *0x423708, 8);
							__eflags =  *0x4237ac - _t150;
							if( *0x4237ac == _t150) {
								_t113 =  *0x41f4e0; // 0x63a064
								E00405101( *((intOrPtr*)(_t113 + 0x34)), _t150);
							}
							E00404041(1);
							goto L25;
						}
						 *0x41f0d8 = 2;
						E00404041(0x78);
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E004040CF(_t157, _a12, _a16);
						}
						ShowWindow( *0x422ed0, _t150);
						ShowWindow(_v8, 8);
						E0040409D(_v8);
						goto L17;
					}
				}
				_v48 = _v48 | 0xffffffff;
				_v36 = _v36 | 0xffffffff;
				_t169 = 2;
				_v56 = _t169;
				_v52 = 0;
				_v44 = 0;
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				_t124 =  *0x423714;
				_a12 =  *((intOrPtr*)(_t124 + 0x5c));
				_a8 =  *((intOrPtr*)(_t124 + 0x60));
				 *0x422ed0 = GetDlgItem(_a4, 0x403);
				 *0x422ec8 = GetDlgItem(_a4, 0x3ee);
				_t128 = GetDlgItem(_a4, 0x3f8);
				 *0x422ee4 = _t128;
				_v8 = _t128;
				E0040409D( *0x422ed0);
				 *0x422ed4 = E0040498E(4);
				 *0x422eec = 0;
				GetClientRect(_v8,  &_v24);
				_v48 = _v24.right - GetSystemMetrics(_t169);
				SendMessageA(_v8, 0x101b, 0,  &_v56); // executed
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000); // executed
				if(_a12 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a12);
					SendMessageA(_v8, 0x1026, 0, _a12);
				}
				if(_a8 >= _t150) {
					SendMessageA(_v8, 0x1024, _t150, _a8);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00404068(_a4);
				if(( *0x42371c & 0x00000003) != 0) {
					ShowWindow( *0x422ed0, _t150);
					if(( *0x42371c & 0x00000002) != 0) {
						 *0x422ed0 = _t150;
					} else {
						ShowWindow(_v8, 8);
					}
					E0040409D( *0x422ec8);
				}
				_t161 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t161, 0x401, _t150, 0x75300000);
				if(( *0x42371c & 0x00000004) != 0) {
					SendMessageA(_t161, 0x409, _t150, _a8);
					SendMessageA(_t161, 0x2001, _t150, _a12);
				}
				goto L36;
			}

0x00405245
0x0040524d
0x00405250
0x00405258
0x0040525b
0x004053ea
0x004053f0
0x0040540d
0x00405414
0x00405414
0x00405420
0x00405426
0x00405448
0x00405448
0x0040544e
0x004054a3
0x004054a3
0x004054a6
0x00000000
0x00000000
0x004054a8
0x004054ab
0x004054ae
0x00000000
0x00000000
0x004054b8
0x004054be
0x004054c0
0x004054c3
0x004055c0
0x00000000
0x004055c0
0x004054d2
0x004054de
0x004054e7
0x004054ee
0x004054f2
0x004054f5
0x004054fe
0x00405504
0x00405507
0x00405507
0x00405517
0x0040551d
0x00405520
0x0040552b
0x0040552b
0x0040552c
0x0040552f
0x00405536
0x0040553d
0x00405545
0x00405545
0x00405553
0x00405559
0x0040555c
0x0040555c
0x00405563
0x00405569
0x00405572
0x00405579
0x00405582
0x00405584
0x00405587
0x00405596
0x00405598
0x0040559b
0x0040559c
0x0040559f
0x004055a0
0x004055a1
0x004055a1
0x004055a9
0x004055b4
0x004055ba
0x004055ba
0x00000000
0x00405520
0x00405450
0x00405456
0x00405484
0x00405486
0x0040548c
0x0040548e
0x00405497
0x00405497
0x0040549e
0x00000000
0x0040549e
0x0040545a
0x00405464
0x00000000
0x00405428
0x00405428
0x0040542e
0x00405469
0x00000000
0x00405470
0x00405437
0x0040543e
0x00405443
0x00000000
0x00405443
0x00405426
0x00405261
0x00405265
0x0040526d
0x00405271
0x00405274
0x00405277
0x0040527a
0x0040527d
0x0040527e
0x0040527f
0x00405298
0x0040529b
0x004052a5
0x004052b4
0x004052bc
0x004052c4
0x004052c9
0x004052cc
0x004052d8
0x004052e1
0x004052ea
0x0040530c
0x00405312
0x00405323
0x00405328
0x00405336
0x00405344
0x00405344
0x00405349
0x00405357
0x00405357
0x0040535c
0x0040535f
0x00405364
0x00405370
0x00405379
0x00405386
0x00405395
0x00405388
0x0040538d
0x0040538d
0x004053a1
0x004053a1
0x004053b5
0x004053be
0x004053c7
0x004053d7
0x004053e3
0x004053e3
0x00000000

APIs

GetDlgItem.USER32 ref: 0040529E
GetDlgItem.USER32 ref: 004052AD
GetClientRect.USER32 ref: 004052EA
GetSystemMetrics.USER32 ref: 004052F1
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405312
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405323
SendMessageA.USER32(?,00001001,00000000,?), ref: 00405336
SendMessageA.USER32(?,00001026,00000000,?), ref: 00405344
SendMessageA.USER32(?,00001024,00000000,?), ref: 00405357
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405379
ShowWindow.USER32(?,00000008), ref: 0040538D
GetDlgItem.USER32 ref: 004053AE
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004053BE
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004053D7
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004053E3
GetDlgItem.USER32 ref: 004052BC

Part of subcall function 0040409D: SendMessageA.USER32(00000028,?,00000001,00403ECD), ref: 004040AB

GetDlgItem.USER32 ref: 004053FF
CreateThread.KERNELBASE ref: 0040540D
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00405414
ShowWindow.USER32(00000000), ref: 00405437
ShowWindow.USER32(?,00000008), ref: 0040543E
ShowWindow.USER32(00000008), ref: 00405484
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004054B8
CreatePopupMenu.USER32 ref: 004054C9
AppendMenuA.USER32 ref: 004054DE
GetWindowRect.USER32 ref: 004054FE
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405517
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405553
OpenClipboard.USER32(00000000), ref: 00405563
EmptyClipboard.USER32 ref: 00405569
GlobalAlloc.KERNEL32(00000042,?), ref: 00405572
GlobalLock.KERNEL32 ref: 0040557C
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405590
GlobalUnlock.KERNEL32(00000000), ref: 004055A9
SetClipboardData.USER32 ref: 004055B4
CloseClipboard.USER32 ref: 004055BA

Strings

Sepad149: Installing, xrefs: 0040552F

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendChangeClientDataEmptyFindLockMetricsNotificationOpenSystemThreadTrackUnlock
String ID: Sepad149: Installing
API String ID: 4154960007-2190826614
Opcode ID: 5e248db37e798cb99e868fa2efa30f8b142e25c36e83f8749ee739c671aa7136
Instruction ID: b9a96890980d2d8b9797d0de0d5ce2eab2fec2a682b8a0b11cb6d69254f0e8d6
Opcode Fuzzy Hash: 5e248db37e798cb99e868fa2efa30f8b142e25c36e83f8749ee739c671aa7136
Instruction Fuzzy Hash: C4A15CB1900208BFDB119FA0DD89AAE7FB9FB48355F00403AFA05B61A0C7B55E51DF69

Uniqueness

Uniqueness Score: -1.00%

Function 72DD1A98 Relevance: 25.1, APIs: 13, Strings: 1, Instructions: 591
stringlibrarymemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E72DD1A98() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				CHAR* _v24;
				CHAR* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				CHAR* _v48;
				signed int _v52;
				void* _v56;
				intOrPtr _v60;
				CHAR* _t207;
				signed int _t210;
				void* _t212;
				void* _t214;
				CHAR* _t216;
				void* _t224;
				struct HINSTANCE__* _t225;
				struct HINSTANCE__* _t226;
				struct HINSTANCE__* _t228;
				signed short _t230;
				struct HINSTANCE__* _t233;
				struct HINSTANCE__* _t235;
				void* _t236;
				char* _t237;
				void* _t248;
				signed char _t249;
				signed int _t250;
				void* _t254;
				struct HINSTANCE__* _t256;
				void* _t257;
				signed int _t259;
				intOrPtr _t260;
				char* _t263;
				signed int _t268;
				signed int _t271;
				signed int _t273;
				void* _t276;
				void* _t280;
				struct HINSTANCE__* _t282;
				intOrPtr _t285;
				void _t286;
				signed int _t287;
				signed int _t299;
				signed int _t300;
				intOrPtr _t303;
				void* _t304;
				signed int _t308;
				signed int _t311;
				signed int _t314;
				signed int _t315;
				signed int _t316;
				intOrPtr _t319;
				intOrPtr* _t320;
				CHAR* _t321;
				CHAR* _t323;
				CHAR* _t324;
				struct HINSTANCE__* _t325;
				void* _t327;
				signed int _t328;
				void* _t329;

				_t282 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				_v8 = 0;
				_v40 = 0;
				_t329 = 0;
				_v52 = 0;
				_v44 = 0;
				_t207 = E72DD1215();
				_v24 = _t207;
				_v28 = _t207;
				_v48 = E72DD1215();
				_t320 = E72DD123B();
				_v56 = _t320;
				_v12 = _t320;
				while(1) {
					_t210 = _v32;
					_v60 = _t210;
					if(_t210 != _t282 && _t329 == _t282) {
						break;
					}
					_t319 =  *_t320;
					_t285 = _t319;
					_t212 = _t285 - _t282;
					if(_t212 == 0) {
						_t37 =  &_v32;
						 *_t37 = _v32 | 0xffffffff;
						__eflags =  *_t37;
						L20:
						_t214 = _v60 - _t282;
						if(_t214 == 0) {
							 *_v28 =  *_v28 & 0x00000000;
							__eflags = _t329 - _t282;
							if(_t329 == _t282) {
								_t254 = GlobalAlloc(0x40, 0x14a4); // executed
								_t329 = _t254;
								 *(_t329 + 0x810) = _t282;
								 *(_t329 + 0x814) = _t282;
							}
							_t286 = _v36;
							_t47 = _t329 + 8; // 0x8
							_t216 = _t47;
							_t48 = _t329 + 0x408; // 0x408
							_t321 = _t48;
							 *_t329 = _t286;
							 *_t216 =  *_t216 & 0x00000000;
							 *(_t329 + 0x808) = _t282;
							 *_t321 =  *_t321 & 0x00000000;
							_t287 = _t286 - _t282;
							__eflags = _t287;
							 *(_t329 + 0x80c) = _t282;
							 *(_t329 + 4) = _t282;
							if(_t287 == 0) {
								__eflags = _v28 - _v24;
								if(_v28 == _v24) {
									goto L42;
								}
								_t327 = 0;
								GlobalFree(_t329);
								_t329 = E72DD12FE(_v24);
								__eflags = _t329 - _t282;
								if(_t329 == _t282) {
									goto L42;
								} else {
									goto L35;
								}
								while(1) {
									L35:
									_t248 =  *(_t329 + 0x14a0);
									__eflags = _t248 - _t282;
									if(_t248 == _t282) {
										break;
									}
									_t327 = _t329;
									_t329 = _t248;
									__eflags = _t329 - _t282;
									if(_t329 != _t282) {
										continue;
									}
									break;
								}
								__eflags = _t327 - _t282;
								if(_t327 != _t282) {
									 *(_t327 + 0x14a0) = _t282;
								}
								_t249 =  *(_t329 + 0x810);
								__eflags = _t249 & 0x00000008;
								if((_t249 & 0x00000008) == 0) {
									_t250 = _t249 | 0x00000002;
									__eflags = _t250;
									 *(_t329 + 0x810) = _t250;
								} else {
									_t329 = E72DD1534(_t329);
									 *(_t329 + 0x810) =  *(_t329 + 0x810) & 0xfffffff5;
								}
								goto L42;
							} else {
								_t299 = _t287 - 1;
								__eflags = _t299;
								if(_t299 == 0) {
									L31:
									lstrcpyA(_t216, _v48);
									L32:
									lstrcpyA(_t321, _v24);
									goto L42;
								}
								_t300 = _t299 - 1;
								__eflags = _t300;
								if(_t300 == 0) {
									goto L32;
								}
								__eflags = _t300 != 1;
								if(_t300 != 1) {
									goto L42;
								}
								goto L31;
							}
						} else {
							if(_t214 == 1) {
								_t256 = _v16;
								if(_v40 == _t282) {
									_t256 = _t256 - 1;
								}
								 *(_t329 + 0x814) = _t256;
							}
							L42:
							_v12 = _v12 + 1;
							_v28 = _v24;
							L59:
							if(_v32 != 0xffffffff) {
								_t320 = _v12;
								continue;
							}
							break;
						}
					}
					_t257 = _t212 - 0x23;
					if(_t257 == 0) {
						__eflags = _t320 - _v56;
						if(_t320 <= _v56) {
							L17:
							__eflags = _v44 - _t282;
							if(_v44 != _t282) {
								L43:
								_t259 = _v32 - _t282;
								__eflags = _t259;
								if(_t259 == 0) {
									_t260 = _t319;
									while(1) {
										__eflags = _t260 - 0x22;
										if(_t260 != 0x22) {
											break;
										}
										_t320 = _t320 + 1;
										__eflags = _v44 - _t282;
										_v12 = _t320;
										if(_v44 == _t282) {
											_v44 = 1;
											L162:
											_v28 =  &(_v28[1]);
											 *_v28 =  *_t320;
											L58:
											_t328 = _t320 + 1;
											__eflags = _t328;
											_v12 = _t328;
											goto L59;
										}
										_t260 =  *_t320;
										_v44 = _t282;
									}
									__eflags = _t260 - 0x2a;
									if(_t260 == 0x2a) {
										_v36 = 2;
										L57:
										_t320 = _v12;
										_v28 = _v24;
										_t282 = 0;
										__eflags = 0;
										goto L58;
									}
									__eflags = _t260 - 0x2d;
									if(_t260 == 0x2d) {
										L151:
										_t303 =  *_t320;
										__eflags = _t303 - 0x2d;
										if(_t303 != 0x2d) {
											L154:
											_t263 = _t320 + 1;
											__eflags =  *_t263 - 0x3a;
											if( *_t263 != 0x3a) {
												goto L162;
											}
											__eflags = _t303 - 0x2d;
											if(_t303 == 0x2d) {
												goto L162;
											}
											_v36 = 1;
											L157:
											_v12 = _t263;
											__eflags = _v28 - _v24;
											if(_v28 <= _v24) {
												 *_v48 =  *_v48 & 0x00000000;
											} else {
												 *_v28 =  *_v28 & 0x00000000;
												lstrcpyA(_v48, _v24);
											}
											goto L57;
										}
										_t263 = _t320 + 1;
										__eflags =  *_t263 - 0x3e;
										if( *_t263 != 0x3e) {
											goto L154;
										}
										_v36 = 3;
										goto L157;
									}
									__eflags = _t260 - 0x3a;
									if(_t260 != 0x3a) {
										goto L162;
									}
									goto L151;
								}
								_t268 = _t259 - 1;
								__eflags = _t268;
								if(_t268 == 0) {
									L80:
									_t304 = _t285 + 0xffffffde;
									__eflags = _t304 - 0x55;
									if(_t304 > 0x55) {
										goto L57;
									}
									switch( *((intOrPtr*)(( *(_t304 + 0x72dd2259) & 0x000000ff) * 4 +  &M72DD21CD))) {
										case 0:
											__eax = _v24;
											__edi = _v12;
											while(1) {
												__edi = __edi + 1;
												_v12 = __edi;
												__cl =  *__edi;
												__eflags = __cl - __dl;
												if(__cl != __dl) {
													goto L132;
												}
												L131:
												__eflags =  *(__edi + 1) - __dl;
												if( *(__edi + 1) != __dl) {
													L136:
													 *__eax =  *__eax & 0x00000000;
													__eax = E72DD1224(_v24);
													__ebx = __eax;
													goto L97;
												}
												L132:
												__eflags = __cl;
												if(__cl == 0) {
													goto L136;
												}
												__eflags = __cl - __dl;
												if(__cl == __dl) {
													__edi = __edi + 1;
													__eflags = __edi;
												}
												__cl =  *__edi;
												 *__eax =  *__edi;
												__eax = __eax + 1;
												__edi = __edi + 1;
												_v12 = __edi;
												__cl =  *__edi;
												__eflags = __cl - __dl;
												if(__cl != __dl) {
													goto L132;
												}
												goto L131;
											}
										case 1:
											_v8 = 1;
											goto L57;
										case 2:
											_v8 = _v8 | 0xffffffff;
											goto L57;
										case 3:
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v16 = _v16 + 1;
											goto L85;
										case 4:
											__eflags = _v20;
											if(_v20 != 0) {
												goto L57;
											}
											_v12 = _v12 - 1;
											__ebx = E72DD1215();
											 &_v12 = E72DD1A36( &_v12);
											__eax = E72DD1429(__edx, __eax, __edx, __ebx);
											goto L97;
										case 5:
											L105:
											_v20 = _v20 + 1;
											goto L57;
										case 6:
											_push(7);
											goto L123;
										case 7:
											_push(0x19);
											goto L143;
										case 8:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L107;
										case 9:
											_push(0x15);
											goto L143;
										case 0xa:
											_push(0x16);
											goto L143;
										case 0xb:
											_push(0x18);
											goto L143;
										case 0xc:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L118;
										case 0xd:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L109;
										case 0xe:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L111;
										case 0xf:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L122;
										case 0x10:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L113;
										case 0x11:
											_push(3);
											goto L123;
										case 0x12:
											_push(0x17);
											L143:
											_pop(__ebx);
											goto L98;
										case 0x13:
											__eax =  &_v12;
											__eax = E72DD1A36( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											__eflags = __ebx - 0xb;
											if(__ebx < 0xb) {
												__ebx = __ebx + 0xa;
											}
											goto L97;
										case 0x14:
											__ebx = 0xffffffff;
											goto L98;
										case 0x15:
											__eax = 0;
											__eflags = 0;
											goto L116;
										case 0x16:
											__ecx = 0;
											__eflags = 0;
											goto L91;
										case 0x17:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L120;
										case 0x18:
											_t270 =  *(_t329 + 0x814);
											__eflags = _t270 - _v16;
											if(_t270 > _v16) {
												_v16 = _t270;
											}
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v36 - 3 = _t270 - (_v36 == 3);
											if(_t270 != _v36 == 3) {
												L85:
												_v40 = 1;
											}
											goto L57;
										case 0x19:
											L107:
											__ecx = 0;
											_v8 = 2;
											__ecx = 1;
											goto L91;
										case 0x1a:
											L118:
											_push(5);
											goto L123;
										case 0x1b:
											L109:
											__ecx = 0;
											_v8 = 3;
											__ecx = 1;
											goto L91;
										case 0x1c:
											L111:
											__ecx = 0;
											__ecx = 1;
											goto L91;
										case 0x1d:
											L122:
											_push(6);
											goto L123;
										case 0x1e:
											L113:
											_push(2);
											goto L123;
										case 0x1f:
											__eax =  &_v12;
											__eax = E72DD1A36( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											goto L97;
										case 0x20:
											L116:
											_v52 = _v52 + 1;
											_push(3);
											_pop(__ecx);
											goto L91;
										case 0x21:
											L120:
											_push(4);
											L123:
											_pop(__ecx);
											L91:
											__edi = _v16;
											__edx =  *(0x72dd305c + __ecx * 4);
											__eax =  ~__eax;
											asm("sbb eax, eax");
											_v40 = 1;
											__edi = _v16 << 5;
											__eax = __eax & 0x00008000;
											__edi = (_v16 << 5) + __esi;
											__eax = __eax | __ecx;
											__eflags = _v8;
											 *(__edi + 0x818) = __eax;
											if(_v8 < 0) {
												L93:
												__edx = 0;
												__edx = 1;
												__eflags = 1;
												L94:
												__eflags = _v8 - 1;
												 *(__edi + 0x828) = __edx;
												if(_v8 == 1) {
													__eax =  &_v12;
													__eax = E72DD1A36( &_v12);
													__eax = __eax + 1;
													__eflags = __eax;
													_v8 = __eax;
												}
												__eax = _v8;
												 *((intOrPtr*)(__edi + 0x81c)) = _v8;
												_t136 = _v16 + 0x41; // 0x41
												_t136 = _t136 << 5;
												__eax = 0;
												__eflags = 0;
												 *((intOrPtr*)((_t136 << 5) + __esi)) = 0;
												 *((intOrPtr*)(__edi + 0x830)) = 0;
												 *((intOrPtr*)(__edi + 0x82c)) = 0;
												L97:
												__eflags = __ebx;
												if(__ebx == 0) {
													goto L57;
												}
												L98:
												__eflags = _v20;
												_v40 = 1;
												if(_v20 != 0) {
													L103:
													__eflags = _v20 - 1;
													if(_v20 == 1) {
														__eax = _v16;
														__eax = _v16 << 5;
														__eflags = __eax;
														 *(__eax + __esi + 0x82c) = __ebx;
													}
													goto L105;
												}
												_v16 = _v16 << 5;
												_t144 = __esi + 0x830; // 0x830
												__edi = (_v16 << 5) + _t144;
												__eax =  *__edi;
												__eflags = __eax - 0xffffffff;
												if(__eax <= 0xffffffff) {
													L101:
													__eax = GlobalFree(__eax);
													L102:
													 *__edi = __ebx;
													goto L103;
												}
												__eflags = __eax - 0x19;
												if(__eax <= 0x19) {
													goto L102;
												}
												goto L101;
											}
											__eflags = __edx;
											if(__edx > 0) {
												goto L94;
											}
											goto L93;
										case 0x22:
											goto L57;
									}
								}
								_t271 = _t268 - 1;
								__eflags = _t271;
								if(_t271 == 0) {
									_v16 = _t282;
									goto L80;
								}
								__eflags = _t271 != 1;
								if(_t271 != 1) {
									goto L162;
								}
								__eflags = _t285 - 0x6e;
								if(__eflags > 0) {
									_t308 = _t285 - 0x72;
									__eflags = _t308;
									if(_t308 == 0) {
										_push(4);
										L74:
										_pop(_t273);
										L75:
										__eflags = _v8 - 1;
										if(_v8 != 1) {
											_t96 = _t329 + 0x810;
											 *_t96 =  *(_t329 + 0x810) &  !_t273;
											__eflags =  *_t96;
										} else {
											 *(_t329 + 0x810) =  *(_t329 + 0x810) | _t273;
										}
										_v8 = 1;
										goto L57;
									}
									_t311 = _t308 - 1;
									__eflags = _t311;
									if(_t311 == 0) {
										_push(0x10);
										goto L74;
									}
									__eflags = _t311 != 0;
									if(_t311 != 0) {
										goto L57;
									}
									_push(0x40);
									goto L74;
								}
								if(__eflags == 0) {
									_push(8);
									goto L74;
								}
								_t314 = _t285 - 0x21;
								__eflags = _t314;
								if(_t314 == 0) {
									_v8 =  ~_v8;
									goto L57;
								}
								_t315 = _t314 - 0x11;
								__eflags = _t315;
								if(_t315 == 0) {
									_t273 = 0x100;
									goto L75;
								}
								_t316 = _t315 - 0x31;
								__eflags = _t316;
								if(_t316 == 0) {
									_t273 = 1;
									goto L75;
								}
								__eflags = _t316 != 0;
								if(_t316 != 0) {
									goto L57;
								}
								_push(0x20);
								goto L74;
							} else {
								_v32 = _t282;
								_v36 = _t282;
								goto L20;
							}
						}
						__eflags =  *((char*)(_t320 - 1)) - 0x3a;
						if( *((char*)(_t320 - 1)) != 0x3a) {
							goto L17;
						}
						__eflags = _v32 - _t282;
						if(_v32 == _t282) {
							goto L43;
						}
						goto L17;
					}
					_t276 = _t257 - 5;
					if(_t276 == 0) {
						__eflags = _v44 - _t282;
						if(_v44 != _t282) {
							goto L43;
						} else {
							__eflags = _v36 - 3;
							_v32 = 1;
							_v8 = _t282;
							_v20 = _t282;
							_v16 = (0 | _v36 == 0x00000003) + 1;
							_v40 = _t282;
							goto L20;
						}
					}
					_t280 = _t276 - 1;
					if(_t280 == 0) {
						__eflags = _v44 - _t282;
						if(_v44 != _t282) {
							goto L43;
						} else {
							_v32 = 2;
							_v8 = _t282;
							_v20 = _t282;
							goto L20;
						}
					}
					if(_t280 != 0x16) {
						goto L43;
					} else {
						_v32 = 3;
						_v8 = 1;
						goto L20;
					}
				}
				GlobalFree(_v56);
				GlobalFree(_v24);
				GlobalFree(_v48);
				if(_t329 == _t282 ||  *(_t329 + 0x80c) != _t282) {
					L182:
					return _t329;
				} else {
					_t224 =  *_t329 - 1;
					if(_t224 == 0) {
						_t187 = _t329 + 8; // 0x8
						_t323 = _t187;
						__eflags =  *_t323;
						if( *_t323 != 0) {
							_t225 = GetModuleHandleA(_t323);
							__eflags = _t225 - _t282;
							 *(_t329 + 0x808) = _t225;
							if(_t225 != _t282) {
								L171:
								_t192 = _t329 + 0x408; // 0x408
								_t324 = _t192;
								_t226 = E72DD15C2( *(_t329 + 0x808), _t324);
								__eflags = _t226 - _t282;
								 *(_t329 + 0x80c) = _t226;
								if(_t226 == _t282) {
									__eflags =  *_t324 - 0x23;
									if( *_t324 == 0x23) {
										_t195 = _t329 + 0x409; // 0x409
										_t230 = E72DD12FE(_t195);
										__eflags = _t230 - _t282;
										if(_t230 != _t282) {
											__eflags = _t230 & 0xffff0000;
											if((_t230 & 0xffff0000) == 0) {
												 *(_t329 + 0x80c) = GetProcAddress( *(_t329 + 0x808), _t230 & 0x0000ffff);
											}
										}
									}
								}
								__eflags = _v52 - _t282;
								if(_v52 != _t282) {
									L178:
									_t324[lstrlenA(_t324)] = 0x41;
									_t228 = E72DD15C2( *(_t329 + 0x808), _t324);
									__eflags = _t228 - _t282;
									if(_t228 != _t282) {
										L166:
										 *(_t329 + 0x80c) = _t228;
										goto L182;
									}
									__eflags =  *(_t329 + 0x80c) - _t282;
									L180:
									if(__eflags != 0) {
										goto L182;
									}
									L181:
									_t205 = _t329 + 4;
									 *_t205 =  *(_t329 + 4) | 0xffffffff;
									__eflags =  *_t205;
									goto L182;
								} else {
									__eflags =  *(_t329 + 0x80c) - _t282;
									if( *(_t329 + 0x80c) != _t282) {
										goto L182;
									}
									goto L178;
								}
							}
							_t233 = LoadLibraryA(_t323);
							__eflags = _t233 - _t282;
							 *(_t329 + 0x808) = _t233;
							if(_t233 == _t282) {
								goto L181;
							}
							goto L171;
						}
						_t188 = _t329 + 0x408; // 0x408
						_t235 = E72DD12FE(_t188);
						 *(_t329 + 0x80c) = _t235;
						__eflags = _t235 - _t282;
						goto L180;
					}
					_t236 = _t224 - 1;
					if(_t236 == 0) {
						_t185 = _t329 + 0x408; // 0x408
						_t237 = _t185;
						__eflags =  *_t237;
						if( *_t237 == 0) {
							goto L182;
						}
						_t228 = E72DD12FE(_t237);
						L165:
						goto L166;
					}
					if(_t236 != 1) {
						goto L182;
					}
					_t81 = _t329 + 8; // 0x8
					_t283 = _t81;
					_t325 = E72DD12FE(_t81);
					 *(_t329 + 0x808) = _t325;
					if(_t325 == 0) {
						goto L181;
					}
					 *(_t329 + 0x84c) =  *(_t329 + 0x84c) & 0x00000000;
					 *((intOrPtr*)(_t329 + 0x850)) = E72DD1224(_t283);
					 *(_t329 + 0x83c) =  *(_t329 + 0x83c) & 0x00000000;
					 *((intOrPtr*)(_t329 + 0x848)) = 1;
					 *((intOrPtr*)(_t329 + 0x838)) = 1;
					_t90 = _t329 + 0x408; // 0x408
					_t228 =  *(_t325->i + E72DD12FE(_t90) * 4);
					goto L165;
				}
			}

0x72dd1aa0
0x72dd1aa3
0x72dd1aa6
0x72dd1aa9
0x72dd1aac
0x72dd1aaf
0x72dd1ab2
0x72dd1ab4
0x72dd1ab7
0x72dd1aba
0x72dd1abf
0x72dd1ac2
0x72dd1aca
0x72dd1ad2
0x72dd1ad4
0x72dd1ad7
0x72dd1adf
0x72dd1adf
0x72dd1ae4
0x72dd1ae7
0x00000000
0x00000000
0x72dd1af1
0x72dd1af3
0x72dd1af8
0x72dd1afa
0x72dd1b8b
0x72dd1b8b
0x72dd1b8b
0x72dd1b8f
0x72dd1b92
0x72dd1b94
0x72dd1bb6
0x72dd1bb9
0x72dd1bbb
0x72dd1bc4
0x72dd1bca
0x72dd1bcc
0x72dd1bd2
0x72dd1bd2
0x72dd1bd8
0x72dd1bdb
0x72dd1bdb
0x72dd1bde
0x72dd1bde
0x72dd1be4
0x72dd1be6
0x72dd1be9
0x72dd1bef
0x72dd1bf2
0x72dd1bf2
0x72dd1bf4
0x72dd1bfa
0x72dd1bfd
0x72dd1c21
0x72dd1c24
0x00000000
0x00000000
0x72dd1c27
0x72dd1c29
0x72dd1c37
0x72dd1c3a
0x72dd1c3c
0x00000000
0x00000000
0x00000000
0x00000000
0x72dd1c3e
0x72dd1c3e
0x72dd1c3e
0x72dd1c44
0x72dd1c46
0x00000000
0x00000000
0x72dd1c48
0x72dd1c4a
0x72dd1c4c
0x72dd1c4e
0x00000000
0x00000000
0x00000000
0x72dd1c4e
0x72dd1c50
0x72dd1c52
0x72dd1c54
0x72dd1c54
0x72dd1c5a
0x72dd1c60
0x72dd1c62
0x72dd1c76
0x72dd1c76
0x72dd1c78
0x72dd1c64
0x72dd1c6a
0x72dd1c6d
0x72dd1c6d
0x00000000
0x72dd1bff
0x72dd1bff
0x72dd1bff
0x72dd1c00
0x72dd1c08
0x72dd1c0c
0x72dd1c12
0x72dd1c16
0x00000000
0x72dd1c16
0x72dd1c02
0x72dd1c02
0x72dd1c03
0x00000000
0x00000000
0x72dd1c05
0x72dd1c06
0x00000000
0x00000000
0x00000000
0x72dd1c06
0x72dd1b96
0x72dd1b97
0x72dd1ba0
0x72dd1ba3
0x72dd1bb0
0x72dd1bb0
0x72dd1ba5
0x72dd1ba5
0x72dd1c7e
0x72dd1c81
0x72dd1c84
0x72dd1cf6
0x72dd1cfa
0x72dd1adc
0x00000000
0x72dd1adc
0x00000000
0x72dd1cfa
0x72dd1b94
0x72dd1b00
0x72dd1b03
0x72dd1b66
0x72dd1b69
0x72dd1b7a
0x72dd1b7a
0x72dd1b7d
0x72dd1c89
0x72dd1c8c
0x72dd1c8c
0x72dd1c8e
0x72dd2033
0x72dd2045
0x72dd2045
0x72dd2047
0x00000000
0x00000000
0x72dd2037
0x72dd2038
0x72dd203b
0x72dd203e
0x72dd20ba
0x72dd20c1
0x72dd20c6
0x72dd20c9
0x72dd1cf2
0x72dd1cf2
0x72dd1cf2
0x72dd1cf3
0x00000000
0x72dd1cf3
0x72dd2040
0x72dd2042
0x72dd2042
0x72dd2049
0x72dd204b
0x72dd20ae
0x72dd1ce7
0x72dd1cea
0x72dd1ced
0x72dd1cf0
0x72dd1cf0
0x00000000
0x72dd1cf0
0x72dd204d
0x72dd204f
0x72dd2055
0x72dd2055
0x72dd2057
0x72dd205a
0x72dd206d
0x72dd206d
0x72dd2070
0x72dd2073
0x00000000
0x00000000
0x72dd2075
0x72dd2078
0x00000000
0x00000000
0x72dd207a
0x72dd2081
0x72dd2081
0x72dd2087
0x72dd208a
0x72dd20a6
0x72dd208c
0x72dd2095
0x72dd2098
0x72dd2098
0x00000000
0x72dd208a
0x72dd205c
0x72dd205f
0x72dd2062
0x00000000
0x00000000
0x72dd2064
0x00000000
0x72dd2064
0x72dd2051
0x72dd2053
0x00000000
0x00000000
0x00000000
0x72dd2053
0x72dd1c94
0x72dd1c94
0x72dd1c95
0x72dd1dde
0x72dd1dde
0x72dd1de5
0x72dd1de8
0x00000000
0x00000000
0x72dd1df5
0x00000000
0x72dd1fdb
0x72dd1fde
0x72dd1fe1
0x72dd1fe1
0x72dd1fe2
0x72dd1fe5
0x72dd1fe7
0x72dd1fe9
0x00000000
0x00000000
0x72dd1feb
0x72dd1feb
0x72dd1fee
0x72dd2000
0x72dd2003
0x72dd2006
0x72dd200c
0x00000000
0x72dd200c
0x72dd1ff0
0x72dd1ff0
0x72dd1ff2
0x00000000
0x00000000
0x72dd1ff4
0x72dd1ff6
0x72dd1ff8
0x72dd1ff8
0x72dd1ff8
0x72dd1ff9
0x72dd1ffb
0x72dd1ffd
0x72dd1fe1
0x72dd1fe2
0x72dd1fe5
0x72dd1fe7
0x72dd1fe9
0x00000000
0x00000000
0x00000000
0x72dd1fe9
0x00000000
0x72dd1e3c
0x00000000
0x00000000
0x72dd1e48
0x00000000
0x00000000
0x72dd1e2f
0x72dd1e33
0x72dd1e37
0x00000000
0x00000000
0x72dd1fad
0x72dd1fb1
0x00000000
0x00000000
0x72dd1fb7
0x72dd1fbf
0x72dd1fc6
0x72dd1fce
0x00000000
0x00000000
0x72dd1f15
0x72dd1f15
0x00000000
0x00000000
0x72dd1e51
0x00000000
0x00000000
0x72dd202b
0x00000000
0x00000000
0x72dd1f1d
0x72dd1f1f
0x72dd1f1f
0x00000000
0x00000000
0x72dd201b
0x00000000
0x00000000
0x72dd201f
0x00000000
0x00000000
0x72dd2027
0x00000000
0x00000000
0x72dd1f64
0x72dd1f66
0x72dd1f66
0x00000000
0x00000000
0x72dd1f2f
0x72dd1f31
0x72dd1f31
0x00000000
0x00000000
0x72dd1f41
0x72dd1f43
0x72dd1f43
0x00000000
0x00000000
0x72dd1f72
0x72dd1f74
0x72dd1f74
0x00000000
0x00000000
0x72dd1f4c
0x72dd1f4e
0x72dd1f4e
0x00000000
0x00000000
0x72dd1f53
0x00000000
0x00000000
0x72dd2023
0x72dd202d
0x72dd202d
0x00000000
0x00000000
0x72dd1f7d
0x72dd1f81
0x72dd1f86
0x72dd1f89
0x72dd1f8a
0x72dd1f8d
0x72dd1f93
0x72dd1f93
0x00000000
0x00000000
0x72dd2013
0x00000000
0x00000000
0x72dd1f57
0x72dd1f57
0x00000000
0x00000000
0x72dd1e58
0x72dd1e58
0x00000000
0x00000000
0x72dd1f6b
0x72dd1f6d
0x72dd1f6d
0x00000000
0x00000000
0x72dd1dfc
0x72dd1e02
0x72dd1e05
0x72dd1e07
0x72dd1e07
0x72dd1e0a
0x72dd1e0e
0x72dd1e1b
0x72dd1e1d
0x72dd1e23
0x72dd1e23
0x72dd1e23
0x00000000
0x00000000
0x72dd1f20
0x72dd1f20
0x72dd1f22
0x72dd1f29
0x00000000
0x00000000
0x72dd1f67
0x72dd1f67
0x00000000
0x00000000
0x72dd1f32
0x72dd1f32
0x72dd1f34
0x72dd1f3b
0x00000000
0x00000000
0x72dd1f44
0x72dd1f44
0x72dd1f46
0x00000000
0x00000000
0x72dd1f75
0x72dd1f75
0x00000000
0x00000000
0x72dd1f4f
0x72dd1f4f
0x00000000
0x00000000
0x72dd1f9b
0x72dd1f9f
0x72dd1fa4
0x72dd1fa7
0x00000000
0x00000000
0x72dd1f59
0x72dd1f59
0x72dd1f5c
0x72dd1f5e
0x00000000
0x00000000
0x72dd1f6e
0x72dd1f6e
0x72dd1f77
0x72dd1f77
0x72dd1e5a
0x72dd1e5a
0x72dd1e5d
0x72dd1e64
0x72dd1e66
0x72dd1e68
0x72dd1e6f
0x72dd1e72
0x72dd1e77
0x72dd1e79
0x72dd1e7b
0x72dd1e7f
0x72dd1e85
0x72dd1e8b
0x72dd1e8b
0x72dd1e8d
0x72dd1e8d
0x72dd1e8e
0x72dd1e8e
0x72dd1e92
0x72dd1e98
0x72dd1e9a
0x72dd1e9e
0x72dd1ea3
0x72dd1ea3
0x72dd1ea5
0x72dd1ea5
0x72dd1ea8
0x72dd1eab
0x72dd1eb4
0x72dd1eb7
0x72dd1eba
0x72dd1eba
0x72dd1ebc
0x72dd1ebf
0x72dd1ec5
0x72dd1ecb
0x72dd1ecb
0x72dd1ecd
0x00000000
0x00000000
0x72dd1ed3
0x72dd1ed3
0x72dd1ed7
0x72dd1ede
0x72dd1f02
0x72dd1f02
0x72dd1f06
0x72dd1f08
0x72dd1f0b
0x72dd1f0b
0x72dd1f0e
0x72dd1f0e
0x00000000
0x72dd1f06
0x72dd1ee3
0x72dd1ee6
0x72dd1ee6
0x72dd1eed
0x72dd1eef
0x72dd1ef2
0x72dd1ef9
0x72dd1efa
0x72dd1f00
0x72dd1f00
0x00000000
0x72dd1f00
0x72dd1ef4
0x72dd1ef7
0x00000000
0x00000000
0x00000000
0x72dd1ef7
0x72dd1e87
0x72dd1e89
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x72dd1df5
0x72dd1c9b
0x72dd1c9b
0x72dd1c9c
0x72dd1ddb
0x00000000
0x72dd1ddb
0x72dd1ca2
0x72dd1ca3
0x00000000
0x00000000
0x72dd1ca9
0x72dd1cac
0x72dd1da0
0x72dd1da0
0x72dd1da3
0x72dd1db8
0x72dd1dba
0x72dd1dba
0x72dd1dbb
0x72dd1dbe
0x72dd1dc1
0x72dd1dcd
0x72dd1dcd
0x72dd1dcd
0x72dd1dc3
0x72dd1dc3
0x72dd1dc3
0x72dd1dd3
0x00000000
0x72dd1dd3
0x72dd1da5
0x72dd1da5
0x72dd1da6
0x72dd1db4
0x00000000
0x72dd1db4
0x72dd1da9
0x72dd1daa
0x00000000
0x00000000
0x72dd1db0
0x00000000
0x72dd1db0
0x72dd1cb2
0x72dd1d9c
0x00000000
0x72dd1d9c
0x72dd1cb8
0x72dd1cb8
0x72dd1cbb
0x72dd1ce4
0x00000000
0x72dd1ce4
0x72dd1cbd
0x72dd1cbd
0x72dd1cc0
0x72dd1cda
0x00000000
0x72dd1cda
0x72dd1cc2
0x72dd1cc2
0x72dd1cc5
0x72dd1cd4
0x00000000
0x72dd1cd4
0x72dd1cc8
0x72dd1cc9
0x00000000
0x00000000
0x72dd1ccb
0x00000000
0x72dd1b83
0x72dd1b83
0x72dd1b86
0x00000000
0x72dd1b86
0x72dd1b7d
0x72dd1b6b
0x72dd1b6f
0x00000000
0x00000000
0x72dd1b71
0x72dd1b74
0x00000000
0x00000000
0x00000000
0x72dd1b74
0x72dd1b05
0x72dd1b08
0x72dd1b3e
0x72dd1b41
0x00000000
0x72dd1b47
0x72dd1b49
0x72dd1b4d
0x72dd1b54
0x72dd1b5b
0x72dd1b5e
0x72dd1b61
0x00000000
0x72dd1b61
0x72dd1b41
0x72dd1b0a
0x72dd1b0b
0x72dd1b26
0x72dd1b29
0x00000000
0x72dd1b2f
0x72dd1b2f
0x72dd1b36
0x72dd1b39
0x00000000
0x72dd1b39
0x72dd1b29
0x72dd1b10
0x00000000
0x72dd1b16
0x72dd1b16
0x72dd1b1d
0x00000000
0x72dd1b1d
0x72dd1b10
0x72dd1d09
0x72dd1d0e
0x72dd1d13
0x72dd1d17
0x72dd21c6
0x72dd21cc
0x72dd1d29
0x72dd1d2b
0x72dd1d2c
0x72dd20f1
0x72dd20f1
0x72dd20f4
0x72dd20f7
0x72dd2114
0x72dd211a
0x72dd211c
0x72dd2122
0x72dd2139
0x72dd2139
0x72dd2139
0x72dd2146
0x72dd214c
0x72dd214f
0x72dd2155
0x72dd2157
0x72dd215a
0x72dd215c
0x72dd2163
0x72dd2168
0x72dd216b
0x72dd216d
0x72dd2172
0x72dd2184
0x72dd2184
0x72dd2172
0x72dd216b
0x72dd215a
0x72dd218a
0x72dd218d
0x72dd2197
0x72dd219f
0x72dd21ab
0x72dd21b1
0x72dd21b4
0x72dd20e6
0x72dd20e6
0x00000000
0x72dd20e6
0x72dd21ba
0x72dd21c0
0x72dd21c0
0x00000000
0x00000000
0x72dd21c2
0x72dd21c2
0x72dd21c2
0x72dd21c2
0x00000000
0x72dd218f
0x72dd218f
0x72dd2195
0x00000000
0x00000000
0x00000000
0x72dd2195
0x72dd218d
0x72dd2125
0x72dd212b
0x72dd212d
0x72dd2133
0x00000000
0x00000000
0x00000000
0x72dd2133
0x72dd20f9
0x72dd2100
0x72dd2106
0x72dd210c
0x00000000
0x72dd210c
0x72dd1d32
0x72dd1d33
0x72dd20d0
0x72dd20d0
0x72dd20d6
0x72dd20d9
0x00000000
0x00000000
0x72dd20e0
0x72dd20e5
0x00000000
0x72dd20e5
0x72dd1d3a
0x00000000
0x00000000
0x72dd1d40
0x72dd1d40
0x72dd1d49
0x72dd1d4e
0x72dd1d54
0x00000000
0x00000000
0x72dd1d5a
0x72dd1d67
0x72dd1d6d
0x72dd1d77
0x72dd1d7d
0x72dd1d85
0x72dd1d95
0x00000000
0x72dd1d95

APIs

Part of subcall function 72DD1215: GlobalAlloc.KERNEL32(00000040,72DD1233,?,72DD12CF,-72DD404B,72DD11AB,-000000A0), ref: 72DD121D

GlobalAlloc.KERNELBASE(00000040,000014A4), ref: 72DD1BC4
lstrcpyA.KERNEL32(00000008,?), ref: 72DD1C0C
lstrcpyA.KERNEL32(00000408,?), ref: 72DD1C16
GlobalFree.KERNEL32 ref: 72DD1C29
GlobalFree.KERNEL32 ref: 72DD1D09
GlobalFree.KERNEL32 ref: 72DD1D0E
GlobalFree.KERNEL32 ref: 72DD1D13
GlobalFree.KERNEL32 ref: 72DD1EFA
lstrcpyA.KERNEL32(?,?), ref: 72DD2098
GetModuleHandleA.KERNEL32(00000008), ref: 72DD2114
LoadLibraryA.KERNEL32(00000008), ref: 72DD2125
GetProcAddress.KERNEL32(?,?), ref: 72DD217E
lstrlenA.KERNEL32(00000408), ref: 72DD2198

Strings

Nhv, xrefs: 72DD217E

Memory Dump Source

Source File: 00000000.00000002.843796267.0000000072DD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 72DD0000, based on PE: true

Associated: 00000000.00000002.843788448.0000000072DD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.843803253.0000000072DD3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.843809174.0000000072DD5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72dd0000_DHLIN00178.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID: Nhv
API String ID: 245916457-1159304218
Opcode ID: 27ce9acf34ebd0d809d80c7423cde0c748d0312baf75c40b5fc0a2c31865b11d
Instruction ID: 7ad70d771de810cc7409a2cc1bd8b65f7237ab106cd3b18d23b2f346fe30c54f
Opcode Fuzzy Hash: 27ce9acf34ebd0d809d80c7423cde0c748d0312baf75c40b5fc0a2c31865b11d
Instruction Fuzzy Hash: 83229A71904A0A9FCB118FBCC9847ADBBF5FB05325F60992FD196B2384E7749582CB50

Uniqueness

Uniqueness Score: -1.00%

Function 004057A2 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E004057A2(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				signed int _v16;
				struct _WIN32_FIND_DATAA _v336;
				signed int _t40;
				char* _t53;
				signed int _t55;
				signed int _t58;
				signed int _t64;
				signed int _t66;
				void* _t68;
				signed char _t69;
				CHAR* _t71;
				void* _t72;
				CHAR* _t73;
				char* _t76;

				_t69 = _a8;
				_t73 = _a4;
				_v8 = _t69 & 0x00000004;
				_t40 = E00405A60(__eflags, _t73);
				_v16 = _t40;
				if((_t69 & 0x00000008) != 0) {
					_t66 = DeleteFileA(_t73); // executed
					asm("sbb eax, eax");
					_t68 =  ~_t66 + 1;
					 *0x4237a8 =  *0x4237a8 + _t68;
					return _t68;
				}
				_a4 = _t69;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E00405FDA(0x420d10, _t73);
					__eflags = _a4;
					if(_a4 == 0) {
						E004059B9(_t73);
					} else {
						lstrcatA(0x420d10, "\*.*");
					}
					__eflags =  *_t73;
					if( *_t73 != 0) {
						L10:
						lstrcatA(_t73, 0x409014);
						L11:
						_t71 =  &(_t73[lstrlenA(_t73)]);
						_t40 = FindFirstFileA(0x420d10,  &_v336);
						__eflags = _t40 - 0xffffffff;
						_v12 = _t40;
						if(_t40 == 0xffffffff) {
							L29:
							__eflags = _a4;
							if(_a4 != 0) {
								_t32 = _t71 - 1;
								 *_t32 =  *(_t71 - 1) & 0x00000000;
								__eflags =  *_t32;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t76 =  &(_v336.cFileName);
							_t53 = E0040599D( &(_v336.cFileName), 0x3f);
							__eflags =  *_t53;
							if( *_t53 != 0) {
								__eflags = _v336.cAlternateFileName;
								if(_v336.cAlternateFileName != 0) {
									_t76 =  &(_v336.cAlternateFileName);
								}
							}
							__eflags =  *_t76 - 0x2e;
							if( *_t76 != 0x2e) {
								L19:
								E00405FDA(_t71, _t76);
								__eflags = _v336.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t55 = E0040575A(__eflags, _t73, _v8);
									__eflags = _t55;
									if(_t55 != 0) {
										E00405101(0xfffffff2, _t73);
									} else {
										__eflags = _v8 - _t55;
										if(_v8 == _t55) {
											 *0x4237a8 =  *0x4237a8 + 1;
										} else {
											E00405101(0xfffffff1, _t73);
											E00405DB9(_t72, _t73, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E004057A2(__eflags, _t73, _a8);
									}
								}
								goto L27;
							}
							_t64 =  *((intOrPtr*)(_t76 + 1));
							__eflags = _t64;
							if(_t64 == 0) {
								goto L27;
							}
							__eflags = _t64 - 0x2e;
							if(_t64 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t76 + 2));
							if( *((char*)(_t76 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t58 = FindNextFileA(_v12,  &_v336);
							__eflags = _t58;
						} while (_t58 != 0);
						_t40 = FindClose(_v12);
						goto L29;
					}
					__eflags =  *0x420d10 - 0x5c;
					if( *0x420d10 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t40;
					if(_t40 == 0) {
						L31:
						__eflags = _a4;
						if(_a4 == 0) {
							L39:
							return _t40;
						}
						__eflags = _v16;
						if(_v16 != 0) {
							_t40 = E004062DD(_t73);
							__eflags = _t40;
							if(_t40 == 0) {
								goto L39;
							}
							E00405972(_t73);
							_t40 = E0040575A(__eflags, _t73, _v8 | 0x00000001);
							__eflags = _t40;
							if(_t40 != 0) {
								return E00405101(0xffffffe5, _t73);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L33;
							}
							E00405101(0xfffffff1, _t73);
							return E00405DB9(_t72, _t73, 0);
						}
						L33:
						 *0x4237a8 =  *0x4237a8 + 1;
						return _t40;
					}
					__eflags = _t69 & 0x00000002;
					if((_t69 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}

0x004057ac
0x004057b1
0x004057ba
0x004057bd
0x004057c5
0x004057c8
0x004057cb
0x004057d3
0x004057d5
0x004057d6
0x00000000
0x004057d6
0x004057e1
0x004057e4
0x004057e4
0x004057e4
0x004057e8
0x004057fb
0x00405802
0x00405807
0x0040580b
0x0040581b
0x0040580d
0x00405813
0x00405813
0x00405820
0x00405823
0x0040582e
0x00405834
0x00405839
0x00405849
0x0040584b
0x00405851
0x00405854
0x00405857
0x0040590f
0x0040590f
0x00405913
0x00405915
0x00405915
0x00405915
0x00405915
0x00000000
0x00000000
0x00000000
0x00000000
0x0040585d
0x0040585d
0x00405866
0x0040586c
0x00405871
0x00405874
0x00405876
0x0040587a
0x0040587c
0x0040587c
0x0040587a
0x0040587f
0x00405882
0x00405895
0x00405897
0x0040589c
0x004058a3
0x004058be
0x004058c3
0x004058c5
0x004058e9
0x004058c7
0x004058c7
0x004058ca
0x004058de
0x004058cc
0x004058cf
0x004058d7
0x004058d7
0x004058ca
0x004058a5
0x004058ab
0x004058ad
0x004058b3
0x004058b3
0x004058ad
0x00000000
0x004058a3
0x00405884
0x00405887
0x00405889
0x00000000
0x00000000
0x0040588b
0x0040588d
0x00000000
0x00000000
0x0040588f
0x00405893
0x00000000
0x00000000
0x00000000
0x004058ee
0x004058f8
0x004058fe
0x004058fe
0x00405909
0x00000000
0x00405909
0x00405825
0x0040582c
0x00000000
0x00000000
0x00000000
0x004057ea
0x004057ea
0x004057ec
0x00405919
0x0040591b
0x0040591e
0x0040596f
0x0040596f
0x0040596f
0x00405920
0x00405923
0x0040592e
0x00405933
0x00405935
0x00000000
0x00000000
0x00405938
0x00405944
0x00405949
0x0040594b
0x00000000
0x00405966
0x0040594d
0x00405950
0x00000000
0x00000000
0x00405955
0x00000000
0x0040595c
0x00405925
0x00405925
0x00000000
0x00405925
0x004057f2
0x004057f5
0x00000000
0x00000000
0x00000000
0x004057f5

APIs

DeleteFileA.KERNELBASE(?,?,766DFA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004057CB
lstrcatA.KERNEL32(00420D10,\*.*,00420D10,?,?,766DFA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405813
lstrcatA.KERNEL32(?,00409014,?,00420D10,?,?,766DFA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405834
lstrlenA.KERNEL32(?,?,00409014,?,00420D10,?,?,766DFA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040583A
FindFirstFileA.KERNEL32(00420D10,?,?,?,00409014,?,00420D10,?,?,766DFA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040584B
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004058F8
FindClose.KERNEL32(00000000), ref: 00405909

Strings

\*.*, xrefs: 0040580D
"C:\Users\user\Desktop\DHLIN00178.exe", xrefs: 004057A2
C:\Users\user\AppData\Local\Temp\, xrefs: 004057AF

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\DHLIN00178.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1769916053
Opcode ID: 9534ed492e479d78e2508825cc8aff22a23d0aad2da830bd7208bf437f0dd8c3
Instruction ID: d5f8e1a5a2f38c4268bcbec4acbb3c578bb2518a62eabdffbc14051f19ad4651
Opcode Fuzzy Hash: 9534ed492e479d78e2508825cc8aff22a23d0aad2da830bd7208bf437f0dd8c3
Instruction Fuzzy Hash: F251E171900A18BADB21BB228C45BAF7A79DF42724F14807BF841B51D2D77C8942DEAD

Uniqueness

Uniqueness Score: -1.00%

Function 00402138 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139
comCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00402138() {
				signed int _t55;
				void* _t59;
				intOrPtr* _t63;
				intOrPtr _t64;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t73;
				intOrPtr* _t75;
				intOrPtr* _t78;
				intOrPtr* _t80;
				intOrPtr* _t82;
				intOrPtr* _t84;
				int _t87;
				intOrPtr* _t95;
				signed int _t105;
				signed int _t109;
				void* _t111;

				 *(_t111 - 0x10) = E00402B2C(0xfffffff0);
				 *(_t111 - 0xc) = E00402B2C(0xffffffdf);
				 *((intOrPtr*)(_t111 - 0x44)) = E00402B2C(2);
				 *((intOrPtr*)(_t111 - 0x40)) = E00402B2C(0xffffffcd);
				 *((intOrPtr*)(_t111 - 0x4c)) = E00402B2C(0x45);
				_t55 =  *(_t111 - 0x24);
				 *(_t111 - 0x88) = _t55 & 0x00000fff;
				_t105 = _t55 & 0x00008000;
				_t109 = _t55 >> 0x0000000c & 0x00000007;
				 *(_t111 - 0x3c) = _t55 >> 0x00000010 & 0x0000ffff;
				if(E004059DF( *(_t111 - 0xc)) == 0) {
					E00402B2C(0x21);
				}
				_t59 = _t111 + 8;
				__imp__CoCreateInstance(0x407410, _t87, 1, 0x407400, _t59); // executed
				if(_t59 < _t87) {
					L15:
					 *((intOrPtr*)(_t111 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t63 =  *((intOrPtr*)(_t111 + 8));
					_t64 =  *((intOrPtr*)( *_t63))(_t63, 0x407420, _t111 - 0x1c);
					 *((intOrPtr*)(_t111 - 8)) = _t64;
					if(_t64 >= _t87) {
						_t67 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)(_t111 - 8)) =  *((intOrPtr*)( *_t67 + 0x50))(_t67,  *(_t111 - 0xc));
						if(_t105 == _t87) {
							_t84 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t84 + 0x24))(_t84, "C:\\Users\\alfons\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto\\Mandslinien\\Characterizable\\Senilitetstegnet");
						}
						if(_t109 != _t87) {
							_t82 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t82 + 0x3c))(_t82, _t109);
						}
						_t69 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t69 + 0x34))(_t69,  *(_t111 - 0x3c));
						_t95 =  *((intOrPtr*)(_t111 - 0x40));
						if( *_t95 != _t87) {
							_t80 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t80 + 0x44))(_t80, _t95,  *(_t111 - 0x88));
						}
						_t71 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t71 + 0x2c))(_t71,  *((intOrPtr*)(_t111 - 0x44)));
						_t73 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t73 + 0x1c))(_t73,  *((intOrPtr*)(_t111 - 0x4c)));
						if( *((intOrPtr*)(_t111 - 8)) >= _t87) {
							 *((intOrPtr*)(_t111 - 8)) = 0x80004005;
							if(MultiByteToWideChar(_t87, _t87,  *(_t111 - 0x10), 0xffffffff,  *(_t111 - 0xc), 0x400) != 0) {
								_t78 =  *((intOrPtr*)(_t111 - 0x1c));
								 *((intOrPtr*)(_t111 - 8)) =  *((intOrPtr*)( *_t78 + 0x18))(_t78,  *(_t111 - 0xc), 1);
							}
						}
						_t75 =  *((intOrPtr*)(_t111 - 0x1c));
						 *((intOrPtr*)( *_t75 + 8))(_t75);
					}
					_t65 =  *((intOrPtr*)(_t111 + 8));
					 *((intOrPtr*)( *_t65 + 8))(_t65);
					if( *((intOrPtr*)(_t111 - 8)) >= _t87) {
						_push(0xfffffff4);
					} else {
						goto L15;
					}
				}
				E00401423();
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t111 - 4));
				return 0;
			}

0x00402141
0x0040214b
0x00402155
0x0040215f
0x0040216a
0x0040216d
0x00402187
0x0040218d
0x00402193
0x00402196
0x004021a0
0x004021a4
0x004021a4
0x004021a9
0x004021ba
0x004021c2
0x0040229b
0x0040229b
0x004022a2
0x004021c8
0x004021c8
0x004021d7
0x004021db
0x004021de
0x004021e4
0x004021f2
0x004021f5
0x004021f7
0x00402202
0x00402202
0x00402207
0x00402209
0x00402210
0x00402210
0x00402213
0x0040221c
0x0040221f
0x00402224
0x00402226
0x00402233
0x00402233
0x00402236
0x0040223f
0x00402242
0x0040224b
0x00402251
0x00402258
0x00402271
0x00402273
0x00402281
0x00402281
0x00402271
0x00402284
0x0040228a
0x0040228a
0x0040228d
0x00402293
0x00402299
0x004022ae
0x00000000
0x00000000
0x00000000
0x00402299
0x004022a4
0x004029bb
0x004029c7

APIs

CoCreateInstance.OLE32(00407410,?,00000001,00407400,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021BA
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00407400,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402269

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Mandslinien\Characterizable\Senilitetstegnet, xrefs: 004021FA

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Mandslinien\Characterizable\Senilitetstegnet
API String ID: 123533781-775441338
Opcode ID: 99e8bc42a3757380f2283ffcafc7e5a6c536564db9f2e77a1d72e4738346444a
Instruction ID: 364dec1ee03e4b34996bd20462589a1769652030a90c2beac7f749610b7a86d9
Opcode Fuzzy Hash: 99e8bc42a3757380f2283ffcafc7e5a6c536564db9f2e77a1d72e4738346444a
Instruction Fuzzy Hash: 30511871E00209AFCB00DFE4C988A9D7BB5FF48314F2085AAF515EB2D1DB799941CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00406666 Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00406666() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M00406F09))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4)); // executed
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8)); // executed
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406666
0x00406666
0x0040666b
0x004066e2
0x004066e9
0x004066f3
0x00406cd2
0x00406cd2
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00406d48
0x00406d48
0x00406d4e
0x00406d4e
0x00000000
0x00406d23
0x00406d23
0x00406d27
0x00406ed6
0x00000000
0x00406ed6
0x00406d33
0x00406d3a
0x00406d42
0x00406d45
0x00000000
0x00406d45
0x0040666d
0x0040666d
0x00406671
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x00406692
0x00406699
0x0040669c
0x004066a7
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b6
0x004066d4
0x004066d6
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068fb
0x004068fe
0x004068a1
0x004068a7
0x00000000
0x00000000
0x00000000
0x00406900
0x0040687c
0x00406880
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689e
0x00000000
0x0040689e
0x004066b8
0x004066b8
0x004066bb
0x004066c1
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067aa
0x004067ad
0x00406724
0x00406724
0x0040672a
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406837
0x0040683a
0x004067b8
0x004067bc
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067da
0x004067da
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406845
0x00406845
0x00406848
0x0040684b
0x0040684f
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00406a11
0x00406a11
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00406736
0x00000000
0x00000000
0x00000000
0x004067b3
0x004066ff
0x00406703
0x00406e70
0x00406eec
0x00406ef4
0x00406efb
0x00406efd
0x00406f04
0x00406f08
0x00406f08
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x00406721
0x00000000
0x00406721
0x004067ad
0x004066b6
0x004064ea
0x004064ea
0x004064f3
0x00406f01
0x00406f01
0x00000000
0x00406f01
0x004064f9
0x00000000
0x00406504
0x00000000
0x00000000
0x0040650d
0x00406510
0x00406513
0x00406517
0x00000000
0x00000000
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406563
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00000000
0x00406e55
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00000000
0x00406e64
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406905
0x00406909
0x00406927
0x0040692a
0x00406931
0x00406934
0x00406937
0x0040693a
0x0040693d
0x00406940
0x00406942
0x00406949
0x0040694a
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406955
0x0040695a
0x00000000
0x0040695a
0x0040690b
0x0040690e
0x00406911
0x0040691b
0x00000000
0x00000000
0x0040696f
0x00406973
0x00406996
0x00406999
0x0040699c
0x004069a6
0x00406975
0x00406975
0x00406978
0x0040697b
0x0040697e
0x0040698b
0x0040698e
0x0040698e
0x00000000
0x00000000
0x004069b2
0x004069b6
0x00000000
0x00000000
0x004069bc
0x004069c0
0x00000000
0x00000000
0x004069c6
0x004069c8
0x004069cc
0x004069cc
0x004069cf
0x004069d3
0x00000000
0x00000000
0x00406a23
0x00406a27
0x00406a2e
0x00406a31
0x00406a34
0x00406a3e
0x00000000
0x00406a3e
0x00406a29
0x00000000
0x00000000
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00406a64
0x00406a64
0x00406a67
0x00406a6a
0x00406a6d
0x00406a6d
0x00406a70
0x00406a77
0x00406a7c
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x0040695d
0x0040695d
0x00406960
0x00000000
0x00000000
0x00406c9c
0x00406ca0
0x00406cc2
0x00406cc5
0x00406ccf
0x00000000
0x00406ccf
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00000000
0x00000000
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00406d90
0x00406d90
0x00000000
0x00406d90
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00406cb3
0x00406cb3
0x00406cb6
0x00000000
0x00000000
0x00406e4a
0x00406e4d
0x00000000
0x00000000
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aa6
0x00406aa9
0x00406ab0
0x00406ab3
0x00406ac1
0x00000000
0x00000000
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00000000
0x00406da6
0x00406da6
0x00406daa
0x00406ee2
0x00000000
0x00406ee2
0x00406db0
0x00406db3
0x00406db6
0x00406dba
0x00406dbd
0x00406dc3
0x00406dc5
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dce
0x00406dce
0x00406dd2
0x00406e32
0x00406e35
0x00406e3a
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e42
0x00000000
0x00406e42
0x00406dd4
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406e0e
0x00406e11
0x00406e14
0x00406e17
0x00406e1b
0x00406e1d
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406dff
0x00406e04
0x00406e06
0x00406e09
0x00406e09
0x00406e24
0x00406e2b
0x00000000
0x00406e2d
0x00000000
0x00406e2d
0x00000000
0x00406ac9
0x00406acc
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x00000000
0x00000000
0x004069d6
0x004069d6
0x004069da
0x00406ea0
0x00000000
0x00406ea0
0x004069e0
0x004069e3
0x004069e6
0x004069e9
0x004069eb
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0c
0x00406a0f
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00000000
0x00406c97
0x00406c95
0x00406eca
0x00000000
0x00000000
0x004064f9

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42b921e85d89c0e117f5f9f4e0d0c16e752254418a7148ec341c06b29f841c9
Instruction ID: 4f714145f5a313d6319dbd2ae6a602097e3dd159542c3e152d0bb7460fb66c8d
Opcode Fuzzy Hash: b42b921e85d89c0e117f5f9f4e0d0c16e752254418a7148ec341c06b29f841c9
Instruction Fuzzy Hash: 25F17571D00229CBDF28CFA8C8946ADBBB0FF44305F25856ED856BB281D7395A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 004062DD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004062DD(CHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileA(_a4, 0x421558); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x421558;
			}

0x004062e8
0x004062f1
0x00000000
0x004062fe
0x004062f4
0x00000000

APIs

FindFirstFileA.KERNELBASE(766DFA90,00421558,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,00405AA3,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,766DFA90,?,C:\Users\user\AppData\Local\Temp\,004057C2,?,766DFA90,C:\Users\user\AppData\Local\Temp\), ref: 004062E8
FindClose.KERNEL32(00000000), ref: 004062F4

Strings

C:\Users\user\AppData\Local\Temp\nsb19E8.tmp, xrefs: 004062DD

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp
API String ID: 2295610775-3314497343
Opcode ID: 78efce08eb58f860d58d9cc4337d862744689776f4b13788d4bc070c197dd51e
Instruction ID: 9f0851c2fc9ceccd35e24d87c19841e9ead441a619ffea6187f1505ec1ede2b7
Opcode Fuzzy Hash: 78efce08eb58f860d58d9cc4337d862744689776f4b13788d4bc070c197dd51e
Instruction Fuzzy Hash: B1D012319090207BC30117386E0C85B7A599B553317228A77F967F12F0C7388C7696E9

Uniqueness

Uniqueness Score: -1.00%

Function 00403B94 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00403B94(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				signed int _t39;
				struct HWND__* _t49;
				signed int _t68;
				struct HWND__* _t74;
				signed int _t87;
				struct HWND__* _t92;
				signed int _t100;
				int _t104;
				signed int _t116;
				signed int _t117;
				int _t118;
				signed int _t123;
				struct HWND__* _t126;
				struct HWND__* _t127;
				int _t128;
				long _t131;
				int _t133;
				int _t134;
				void* _t135;
				void* _t143;

				_t116 = _a8;
				if(_t116 == 0x110 || _t116 == 0x408) {
					_t35 = _a12;
					_t126 = _a4;
					__eflags = _t116 - 0x110;
					 *0x41fcf0 = _t35;
					if(_t116 == 0x110) {
						 *0x423708 = _t126;
						 *0x41fd04 = GetDlgItem(_t126, 1);
						_t92 = GetDlgItem(_t126, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x41ecd0 = _t92;
						E00404068(_t126);
						SetClassLongA(_t126, 0xfffffff2,  *0x422ee8); // executed
						 *0x422ecc = E0040140B(4);
						_t35 = 1;
						__eflags = 1;
						 *0x41fcf0 = 1;
					}
					_t123 =  *0x4091dc; // 0x0
					_t134 = 0;
					_t131 = (_t123 << 6) +  *0x423740;
					__eflags = _t123;
					if(_t123 < 0) {
						L34:
						E004040B4(0x40b);
						while(1) {
							_t37 =  *0x41fcf0; // 0x1
							 *0x4091dc =  *0x4091dc + _t37;
							_t131 = _t131 + (_t37 << 6);
							_t39 =  *0x4091dc; // 0x0
							__eflags = _t39 -  *0x423744;
							if(_t39 ==  *0x423744) {
								E0040140B(1);
							}
							__eflags =  *0x422ecc - _t134; // 0x0
							if(__eflags != 0) {
								break;
							}
							__eflags =  *0x4091dc -  *0x423744; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t117 =  *(_t131 + 0x14);
							E00405FFC(_t117, _t126, _t131, 0x42b800,  *((intOrPtr*)(_t131 + 0x24)));
							_push( *((intOrPtr*)(_t131 + 0x20)));
							_push(0xfffffc19);
							E00404068(_t126);
							_push( *((intOrPtr*)(_t131 + 0x1c)));
							_push(0xfffffc1b);
							E00404068(_t126);
							_push( *((intOrPtr*)(_t131 + 0x28)));
							_push(0xfffffc1a);
							E00404068(_t126);
							_t49 = GetDlgItem(_t126, 3);
							__eflags =  *0x4237ac - _t134;
							_v32 = _t49;
							if( *0x4237ac != _t134) {
								_t117 = _t117 & 0x0000fefd | 0x00000004;
								__eflags = _t117;
							}
							ShowWindow(_t49, _t117 & 0x00000008); // executed
							EnableWindow( *(_t135 + 0x30), _t117 & 0x00000100); // executed
							E0040408A(_t117 & 0x00000002);
							_t118 = _t117 & 0x00000004;
							EnableWindow( *0x41ecd0, _t118);
							__eflags = _t118 - _t134;
							if(_t118 == _t134) {
								_push(1);
							} else {
								_push(_t134);
							}
							EnableMenuItem(GetSystemMenu(_t126, _t134), 0xf060, ??);
							SendMessageA( *(_t135 + 0x38), 0xf4, _t134, 1);
							__eflags =  *0x4237ac - _t134;
							if( *0x4237ac == _t134) {
								_push( *0x41fd04);
							} else {
								SendMessageA(_t126, 0x401, 2, _t134);
								_push( *0x41ecd0);
							}
							E0040409D();
							E00405FDA(0x41fd08, E00403B75());
							E00405FFC(0x41fd08, _t126, _t131,  &(0x41fd08[lstrlenA(0x41fd08)]),  *((intOrPtr*)(_t131 + 0x18)));
							SetWindowTextA(_t126, 0x41fd08); // executed
							_push(_t134);
							_t68 = E00401389( *((intOrPtr*)(_t131 + 8)));
							__eflags = _t68;
							if(_t68 != 0) {
								continue;
							} else {
								__eflags =  *_t131 - _t134;
								if( *_t131 == _t134) {
									continue;
								}
								__eflags =  *(_t131 + 4) - 5;
								if( *(_t131 + 4) != 5) {
									DestroyWindow( *0x422ed8); // executed
									 *0x41f4e0 = _t131;
									__eflags =  *_t131 - _t134;
									if( *_t131 <= _t134) {
										goto L58;
									}
									_t74 = CreateDialogParamA( *0x423700,  *_t131 +  *0x422ee0 & 0x0000ffff, _t126,  *(0x4091e0 +  *(_t131 + 4) * 4), _t131); // executed
									__eflags = _t74 - _t134;
									 *0x422ed8 = _t74;
									if(_t74 == _t134) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t131 + 0x2c)));
									_push(6);
									E00404068(_t74);
									GetWindowRect(GetDlgItem(_t126, 0x3fa), _t135 + 0x10);
									ScreenToClient(_t126, _t135 + 0x10);
									SetWindowPos( *0x422ed8, _t134,  *(_t135 + 0x20),  *(_t135 + 0x20), _t134, _t134, 0x15);
									_push(_t134);
									E00401389( *((intOrPtr*)(_t131 + 0xc)));
									__eflags =  *0x422ecc - _t134; // 0x0
									if(__eflags != 0) {
										goto L61;
									}
									ShowWindow( *0x422ed8, 8); // executed
									E004040B4(0x405);
									goto L58;
								}
								__eflags =  *0x4237ac - _t134;
								if( *0x4237ac != _t134) {
									goto L61;
								}
								__eflags =  *0x4237a0 - _t134;
								if( *0x4237a0 != _t134) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x422ed8);
						 *0x423708 = _t134;
						EndDialog(_t126,  *0x41f0d8);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t131 - _t134;
							if( *_t131 == _t134) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t87 = E00401389( *((intOrPtr*)(_t131 + 0x10)));
						__eflags = _t87;
						if(_t87 == 0) {
							goto L33;
						}
						SendMessageA( *0x422ed8, 0x40f, 0, 1);
						__eflags =  *0x422ecc - _t134; // 0x0
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t126 = _a4;
					_t134 = 0;
					if(_t116 == 0x47) {
						SetWindowPos( *0x41fce8, _t126, 0, 0, 0, 0, 0x13);
					}
					if(_t116 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x41fce8,  ~(_a12 - 1) & _t116);
					}
					if(_t116 != 0x40d) {
						__eflags = _t116 - 0x11;
						if(_t116 != 0x11) {
							__eflags = _t116 - 0x111;
							if(_t116 != 0x111) {
								L26:
								return E004040CF(_t116, _a12, _a16);
							}
							_t133 = _a12 & 0x0000ffff;
							_t127 = GetDlgItem(_t126, _t133);
							__eflags = _t127 - _t134;
							if(_t127 == _t134) {
								L13:
								__eflags = _t133 - 1;
								if(_t133 != 1) {
									__eflags = _t133 - 3;
									if(_t133 != 3) {
										_t128 = 2;
										__eflags = _t133 - _t128;
										if(_t133 != _t128) {
											L25:
											SendMessageA( *0x422ed8, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x4237ac - _t134;
										if( *0x4237ac == _t134) {
											_t100 = E0040140B(3);
											__eflags = _t100;
											if(_t100 != 0) {
												goto L26;
											}
											 *0x41f0d8 = 1;
											L21:
											_push(0x78);
											L22:
											E00404041();
											goto L26;
										}
										E0040140B(_t128);
										 *0x41f0d8 = _t128;
										goto L21;
									}
									__eflags =  *0x4091dc - _t134; // 0x0
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t133);
								goto L22;
							}
							SendMessageA(_t127, 0xf3, _t134, _t134);
							_t104 = IsWindowEnabled(_t127);
							__eflags = _t104;
							if(_t104 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t126, _t134, _t134);
						return 1;
					} else {
						DestroyWindow( *0x422ed8);
						 *0x422ed8 = _a12;
						L58:
						if( *0x420d08 == _t134) {
							_t143 =  *0x422ed8 - _t134; // 0x1043e
							if(_t143 != 0) {
								ShowWindow(_t126, 0xa); // executed
								 *0x420d08 = 1;
							}
						}
						L61:
						return 0;
					}
				}
			}

0x00403b9d
0x00403ba6
0x00403ce7
0x00403ceb
0x00403cef
0x00403cf1
0x00403cf6
0x00403d01
0x00403d0c
0x00403d11
0x00403d13
0x00403d15
0x00403d18
0x00403d1d
0x00403d2b
0x00403d38
0x00403d3f
0x00403d3f
0x00403d40
0x00403d40
0x00403d45
0x00403d4b
0x00403d52
0x00403d58
0x00403d5a
0x00403d9a
0x00403d9f
0x00403da4
0x00403da4
0x00403da9
0x00403db2
0x00403db4
0x00403db9
0x00403dbf
0x00403dc3
0x00403dc3
0x00403dc8
0x00403dce
0x00000000
0x00000000
0x00403dd9
0x00403ddf
0x00000000
0x00000000
0x00403de8
0x00403df0
0x00403df5
0x00403df8
0x00403dfe
0x00403e03
0x00403e06
0x00403e0c
0x00403e11
0x00403e14
0x00403e1a
0x00403e22
0x00403e28
0x00403e2e
0x00403e32
0x00403e39
0x00403e39
0x00403e39
0x00403e43
0x00403e55
0x00403e61
0x00403e66
0x00403e70
0x00403e76
0x00403e78
0x00403e7d
0x00403e7a
0x00403e7a
0x00403e7a
0x00403e8d
0x00403ea5
0x00403ea7
0x00403ead
0x00403ec2
0x00403eaf
0x00403eb8
0x00403eba
0x00403eba
0x00403ec8
0x00403ed9
0x00403eea
0x00403ef1
0x00403ef7
0x00403efb
0x00403f00
0x00403f02
0x00000000
0x00403f08
0x00403f08
0x00403f0a
0x00000000
0x00000000
0x00403f10
0x00403f14
0x00403f39
0x00403f3f
0x00403f45
0x00403f47
0x00000000
0x00000000
0x00403f6d
0x00403f73
0x00403f75
0x00403f7a
0x00000000
0x00000000
0x00403f80
0x00403f83
0x00403f86
0x00403f9d
0x00403fa9
0x00403fc2
0x00403fc8
0x00403fcc
0x00403fd1
0x00403fd7
0x00000000
0x00000000
0x00403fe1
0x00403fec
0x00000000
0x00403fec
0x00403f16
0x00403f1c
0x00000000
0x00000000
0x00403f22
0x00403f28
0x00000000
0x00000000
0x00000000
0x00403f2e
0x00403f02
0x00403ff9
0x00404005
0x0040400c
0x00000000
0x00403d5c
0x00403d5c
0x00403d5f
0x00403d92
0x00403d92
0x00403d94
0x00000000
0x00000000
0x00000000
0x00403d94
0x00403d61
0x00403d65
0x00403d6a
0x00403d6c
0x00000000
0x00000000
0x00403d7c
0x00403d84
0x00000000
0x00403d8a
0x00403bb8
0x00403bb8
0x00403bbc
0x00403bc1
0x00403bd0
0x00403bd0
0x00403bd9
0x00403be2
0x00403bed
0x00403bed
0x00403bf9
0x00403c15
0x00403c18
0x00403c2b
0x00403c31
0x00403cd4
0x00000000
0x00403cdd
0x00403c37
0x00403c44
0x00403c46
0x00403c48
0x00403c67
0x00403c67
0x00403c6a
0x00403c6f
0x00403c72
0x00403c82
0x00403c83
0x00403c85
0x00403cbb
0x00403cce
0x00000000
0x00403cce
0x00403c87
0x00403c8d
0x00403ca6
0x00403cab
0x00403cad
0x00000000
0x00000000
0x00403caf
0x00403c9b
0x00403c9b
0x00403c9d
0x00403c9d
0x00000000
0x00403c9d
0x00403c90
0x00403c95
0x00000000
0x00403c95
0x00403c74
0x00403c7a
0x00000000
0x00000000
0x00403c7c
0x00000000
0x00403c7c
0x00403c6c
0x00000000
0x00403c6c
0x00403c52
0x00403c59
0x00403c5f
0x00403c61
0x00000000
0x00000000
0x00000000
0x00403c61
0x00403c1d
0x00000000
0x00403bfb
0x00403c01
0x00403c0b
0x00404012
0x00404018
0x0040401a
0x00404020
0x00404025
0x0040402b
0x0040402b
0x00404020
0x00404035
0x00000000
0x00404035
0x00403bf9

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403BD0
ShowWindow.USER32(?), ref: 00403BED
DestroyWindow.USER32 ref: 00403C01
SetWindowLongA.USER32 ref: 00403C1D
GetDlgItem.USER32 ref: 00403C3E
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403C52
IsWindowEnabled.USER32(00000000), ref: 00403C59
GetDlgItem.USER32 ref: 00403D07
GetDlgItem.USER32 ref: 00403D11
KiUserCallbackDispatcher.NTDLL(?,000000F2,?,0000001C,000000FF), ref: 00403D2B
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403D7C
GetDlgItem.USER32 ref: 00403E22
ShowWindow.USER32(00000000,?), ref: 00403E43
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403E55
EnableWindow.USER32(?,?), ref: 00403E70
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403E86
EnableMenuItem.USER32 ref: 00403E8D
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403EA5
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403EB8
lstrlenA.KERNEL32(Sepad149: Installing,?,Sepad149: Installing,00000000), ref: 00403EE2
SetWindowTextA.USER32(?,Sepad149: Installing), ref: 00403EF1
ShowWindow.USER32(?,0000000A), ref: 00404025

Strings

Sepad149: Installing, xrefs: 00403ED2, 00403ED8, 00403EEF

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$CallbackDispatcherEnableMenuUser$DestroyEnabledLongSystemTextlstrlen
String ID: Sepad149: Installing
API String ID: 3906175533-2190826614
Opcode ID: e57483be0e8f0953cc8724a3e8c8ea21599a840bb85b0af5ee6d9011d8646a3c
Instruction ID: ba3e3afbb1df49eb3663f2526bbc67ab17a8ece20d2805bf2467eb782e73bce3
Opcode Fuzzy Hash: e57483be0e8f0953cc8724a3e8c8ea21599a840bb85b0af5ee6d9011d8646a3c
Instruction Fuzzy Hash: FEC1AEB2604205BBDB206F61ED49D2B7A6CFB85706F40443EF641B11F1C779A942EB2E

Uniqueness

Uniqueness Score: -1.00%

Function 004037F7 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E004037F7(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t17;
				void* _t25;
				void* _t27;
				int _t28;
				void* _t31;
				int _t34;
				int _t35;
				intOrPtr _t36;
				int _t39;
				char _t57;
				CHAR* _t59;
				signed char _t63;
				CHAR* _t74;
				intOrPtr _t76;
				CHAR* _t81;

				_t76 =  *0x423714;
				_t17 = E00406372(2);
				_t84 = _t17;
				if(_t17 == 0) {
					_t74 = 0x41fd08;
					"1033" = 0x30;
					 *0x42a001 = 0x78;
					 *0x42a002 = 0;
					E00405EC1(_t71, __eflags, 0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x41fd08, 0);
					__eflags =  *0x41fd08; // 0x53
					if(__eflags == 0) {
						E00405EC1(_t71, __eflags, 0x80000003, ".DEFAULT\\Control Panel\\International",  &M00407362, 0x41fd08, 0);
					}
					lstrcatA("1033", _t74);
				} else {
					E00405F38("1033",  *_t17() & 0x0000ffff);
				}
				E00403ABC(_t71, _t84);
				_t80 = "C:\\Users\\alfons\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto";
				 *0x4237a0 =  *0x42371c & 0x00000020;
				 *0x4237bc = 0x10000;
				if(E00405A60(_t84, "C:\\Users\\alfons\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto") != 0) {
					L16:
					if(E00405A60(_t92, _t80) == 0) {
						E00405FFC(0, _t74, _t76, _t80,  *((intOrPtr*)(_t76 + 0x118))); // executed
					}
					_t25 = LoadImageA( *0x423700, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x422ee8 = _t25;
					if( *((intOrPtr*)(_t76 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t27 = E00403ABC(_t71, __eflags);
							__eflags =  *0x4237c0;
							if( *0x4237c0 != 0) {
								_t28 = E004051D3(_t27, 0);
								__eflags = _t28;
								if(_t28 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x422ecc; // 0x0
								if(__eflags == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x41fce8, 5); // executed
							_t34 = E00406304("RichEd20"); // executed
							__eflags = _t34;
							if(_t34 == 0) {
								E00406304("RichEd32");
							}
							_t81 = "RichEdit20A";
							_t35 = GetClassInfoA(0, _t81, 0x422ea0);
							__eflags = _t35;
							if(_t35 == 0) {
								GetClassInfoA(0, "RichEdit", 0x422ea0);
								 *0x422ec4 = _t81;
								RegisterClassA(0x422ea0);
							}
							_t36 =  *0x422ee0; // 0x0
							_t39 = DialogBoxParamA( *0x423700, _t36 + 0x00000069 & 0x0000ffff, 0, E00403B94, 0); // executed
							E00403747(E0040140B(5), 1);
							return _t39;
						}
						L22:
						_t31 = 2;
						return _t31;
					} else {
						_t71 =  *0x423700;
						 *0x422ea4 = E00401000;
						 *0x422eb0 =  *0x423700;
						 *0x422eb4 = _t25;
						 *0x422ec4 = 0x4091f4;
						if(RegisterClassA(0x422ea0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoA(0x30, 0,  &_v16, 0);
						 *0x41fce8 = CreateWindowExA(0x80, 0x4091f4, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x423700, 0);
						goto L21;
					}
				} else {
					_t71 =  *(_t76 + 0x48);
					_t86 = _t71;
					if(_t71 == 0) {
						goto L16;
					}
					_t74 = 0x4226a0;
					E00405EC1(_t71, _t86,  *((intOrPtr*)(_t76 + 0x44)), _t71,  *((intOrPtr*)(_t76 + 0x4c)) +  *0x423758, 0x4226a0, 0);
					_t57 =  *0x4226a0; // 0x43
					if(_t57 == 0) {
						goto L16;
					}
					if(_t57 == 0x22) {
						_t74 = 0x4226a1;
						 *((char*)(E0040599D(0x4226a1, 0x22))) = 0;
					}
					_t59 = lstrlenA(_t74) + _t74 - 4;
					if(_t59 <= _t74 || lstrcmpiA(_t59, ?str?) != 0) {
						L15:
						E00405FDA(_t80, E00405972(_t74));
						goto L16;
					} else {
						_t63 = GetFileAttributesA(_t74);
						if(_t63 == 0xffffffff) {
							L14:
							E004059B9(_t74);
							goto L15;
						}
						_t92 = _t63 & 0x00000010;
						if((_t63 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x004037fd
0x00403806
0x0040380d
0x0040380f
0x00403823
0x00403835
0x0040383c
0x00403843
0x00403849
0x0040384e
0x00403854
0x00403867
0x00403867
0x00403872
0x00403811
0x0040381c
0x0040381c
0x00403877
0x00403881
0x0040388a
0x0040388f
0x004038a0
0x00403927
0x0040392f
0x00403938
0x00403938
0x0040394e
0x00403954
0x00403962
0x004039e3
0x004039eb
0x004039f5
0x004039fa
0x00403a00
0x00403a8a
0x00403a8f
0x00403a91
0x00403aad
0x00000000
0x00403aad
0x00403a93
0x00403a99
0x00403aa1
0x00403aa1
0x00000000
0x00403a99
0x00403a0e
0x00403a19
0x00403a1e
0x00403a20
0x00403a27
0x00403a27
0x00403a32
0x00403a3a
0x00403a3c
0x00403a3e
0x00403a47
0x00403a4a
0x00403a50
0x00403a50
0x00403a56
0x00403a6f
0x00403a80
0x00000000
0x00403a85
0x004039ed
0x004039ef
0x00000000
0x00403964
0x00403964
0x00403970
0x0040397a
0x00403980
0x00403985
0x00403994
0x00403ab2
0x00403ab2
0x00000000
0x00403ab2
0x004039a3
0x004039de
0x00000000
0x004039de
0x004038a6
0x004038a6
0x004038a9
0x004038ab
0x00000000
0x00000000
0x004038b5
0x004038c5
0x004038ca
0x004038d1
0x00000000
0x00000000
0x004038d5
0x004038d7
0x004038e4
0x004038e4
0x004038ec
0x004038f2
0x0040391a
0x00403922
0x00000000
0x00403904
0x00403905
0x0040390e
0x00403914
0x00403915
0x00000000
0x00403915
0x00403910
0x00403912
0x00000000
0x00000000
0x00000000
0x00403912
0x004038f2

APIs

Part of subcall function 00406372: GetModuleHandleA.KERNEL32(?,?,?,004032A8,0000000A), ref: 00406384
Part of subcall function 00406372: GetProcAddress.KERNEL32(00000000,?), ref: 0040639F

lstrcatA.KERNEL32(1033,Sepad149: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Sepad149: Installing,00000000,00000002,766DFA90,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\DHLIN00178.exe",00000000), ref: 00403872
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto,1033,Sepad149: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Sepad149: Installing,00000000,00000002,766DFA90), ref: 004038E7
lstrcmpiA.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto,1033,Sepad149: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Sepad149: Installing,00000000), ref: 004038FA
GetFileAttributesA.KERNEL32(Call), ref: 00403905
LoadImageA.USER32 ref: 0040394E

Part of subcall function 00405F38: wsprintfA.USER32 ref: 00405F45

RegisterClassA.USER32 ref: 0040398B
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 004039A3
CreateWindowExA.USER32 ref: 004039D8
ShowWindow.USER32(00000005,00000000), ref: 00403A0E
GetClassInfoA.USER32 ref: 00403A3A
GetClassInfoA.USER32 ref: 00403A47
RegisterClassA.USER32 ref: 00403A50
DialogBoxParamA.USER32 ref: 00403A6F

Strings

.exe, xrefs: 004038F4
RichEd32, xrefs: 00403A22
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto, xrefs: 00403881, 00403889, 00403921, 00403927, 00403937
C:\Users\user\AppData\Local\Temp\, xrefs: 004037FC
RichEd20, xrefs: 00403A14
1033, xrefs: 00403817, 0040386D
.DEFAULT\Control Panel\International, xrefs: 0040385D
RichEdit, xrefs: 00403A41
Call, xrefs: 004038B5, 004038BD, 004038CA, 00403914, 0040391A
_Nb, xrefs: 0040396A, 004039D2
RichEdit20A, xrefs: 00403A32, 00403A38
Control Panel\Desktop\ResourceLocale, xrefs: 0040382B
"C:\Users\user\Desktop\DHLIN00178.exe", xrefs: 004037FB
Sepad149: Installing, xrefs: 00403823, 00403829, 0040384E, 00403857, 0040386C

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\DHLIN00178.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$Sepad149: Installing$_Nb
API String ID: 1975747703-3668354665
Opcode ID: a2a89361b445a099ea431d97f26b4be8e8633abf330fc856fce069af7e92bfea
Instruction ID: cc9ff768997195dfc6b08b7ed0d0e3ca7810037f4103f2fdd35eeb1d807c43ce
Opcode Fuzzy Hash: a2a89361b445a099ea431d97f26b4be8e8633abf330fc856fce069af7e92bfea
Instruction Fuzzy Hash: 1961C4B07442007EE620AF659D45F2B3AACEB4475AB40447EF941B22E2D7BC9D02DA2D

Uniqueness

Uniqueness Score: -1.00%

Function 00402DC4 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E00402DC4(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				signed int _t50;
				void* _t53;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				signed int _t65;
				signed int _t70;
				signed int _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				signed int _t85;
				signed int _t87;
				void* _t89;
				signed int _t90;
				signed int _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = "C:\\Users\\alfons\\Desktop\\DHLIN00178.exe";
				 *0x423710 = _t43 + 0x3e8; // executed
				GetModuleFileNameA(0, "C:\\Users\\alfons\\Desktop\\DHLIN00178.exe", 0x400); // executed
				_t89 = E00405B73(_t91, 0x80000000, 3);
				_v16 = _t89;
				 *0x409018 = _t89;
				if(_t89 == 0xffffffff) {
					return "Error launching installer";
				}
				_t92 = "C:\\Users\\alfons\\Desktop";
				E00405FDA("C:\\Users\\alfons\\Desktop", _t91);
				E00405FDA(0x42b000, E004059B9(_t92));
				_t50 = GetFileSize(_t89, 0);
				__eflags = _t50;
				 *0x41e8c4 = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00402D60(1);
					__eflags =  *0x423718 - _t82;
					if( *0x423718 == _t82) {
						goto L29;
					}
					__eflags = _v8 - _t82;
					if(_v8 == _t82) {
						L28:
						_t53 = GlobalAlloc(0x40, _v24); // executed
						_t94 = _t53;
						E004031ED( *0x423718 + 0x1c);
						_push(_v24);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff); // executed
						_t57 = E00402FFB(); // executed
						__eflags = _t57 - _v24;
						if(_t57 == _v24) {
							__eflags = _v44 & 0x00000001;
							 *0x423714 = _t94;
							 *0x42371c =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x423720 =  *0x423720 + 1;
								__eflags =  *0x423720;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
								__eflags = _t85;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
							 *(_t94 + 0x3c) = _t60;
							E00405B2E(0x423740, _t94 + 4, 0x40);
							__eflags = 0;
							return 0;
						}
						goto L29;
					}
					E004031ED( *0x4128b8);
					_t65 = E004031D7( &_a4, 4);
					__eflags = _t65;
					if(_t65 == 0) {
						goto L29;
					}
					__eflags = _v12 - _a4;
					if(_v12 != _a4) {
						goto L29;
					}
					goto L28;
				} else {
					do {
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~( *0x423718) & 0x00007e00) + 0x200;
						__eflags = _t93 - _t70;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E004031D7(0x40a8b8, _t90);
						__eflags = _t71;
						if(_t71 == 0) {
							E00402D60(1);
							L29:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x423718;
						if( *0x423718 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402D60(0);
							}
							goto L20;
						}
						E00405B2E( &_v44, 0x40a8b8, 0x1c);
						_t77 = _v44;
						__eflags = _t77 & 0xfffffff0;
						if((_t77 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v40 - 0xdeadbeef;
						if(_v40 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v28 - 0x74736e49;
						if(_v28 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v32 - 0x74666f73;
						if(_v32 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v36 - 0x6c6c754e;
						if(_v36 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t77;
						_t87 =  *0x4128b8; // 0xd6b11
						 *0x4237c0 =  *0x4237c0 | _a4 & 0x00000002;
						_t80 = _v20;
						__eflags = _t80 - _t93;
						 *0x423718 = _t87;
						if(_t80 > _t93) {
							goto L29;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v8 = _v8 + 1;
							_t24 = _t80 - 4; // 0x409194
							_t93 = _t24;
							__eflags = _t90 - _t93;
							if(_t90 > _t93) {
								_t90 = _t93;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t93 -  *0x41e8c4; // 0xd8d80
						if(__eflags < 0) {
							_v12 = E00406429(_v12, 0x40a8b8, _t90);
						}
						 *0x4128b8 =  *0x4128b8 + _t90;
						_t93 = _t93 - _t90;
						__eflags = _t93;
					} while (_t93 != 0);
					_t82 = 0;
					__eflags = 0;
					goto L24;
				}
			}

0x00402dcc
0x00402dcf
0x00402dd2
0x00402dd5
0x00402ddb
0x00402dec
0x00402df1
0x00402e04
0x00402e09
0x00402e0c
0x00402e12
0x00000000
0x00402e14
0x00402e1f
0x00402e25
0x00402e36
0x00402e3d
0x00402e43
0x00402e45
0x00402e4a
0x00402e4c
0x00402f37
0x00402f39
0x00402f3e
0x00402f45
0x00000000
0x00000000
0x00402f47
0x00402f4a
0x00402f6e
0x00402f73
0x00402f79
0x00402f84
0x00402f89
0x00402f8c
0x00402f8d
0x00402f8e
0x00402f90
0x00402f95
0x00402f98
0x00402fab
0x00402faf
0x00402fb7
0x00402fbc
0x00402fbe
0x00402fbe
0x00402fbe
0x00402fc6
0x00402fc6
0x00402fc9
0x00402fca
0x00402fca
0x00402fcd
0x00402fcf
0x00402fcf
0x00402fcf
0x00402fd9
0x00402fdf
0x00402fed
0x00402ff2
0x00000000
0x00402ff2
0x00000000
0x00402f98
0x00402f52
0x00402f5d
0x00402f62
0x00402f64
0x00000000
0x00000000
0x00402f69
0x00402f6c
0x00000000
0x00000000
0x00000000
0x00402e52
0x00402e57
0x00402e5c
0x00402e60
0x00402e67
0x00402e6c
0x00402e6e
0x00402e70
0x00402e70
0x00402e74
0x00402e79
0x00402e7b
0x00402fa3
0x00402f9a
0x00000000
0x00402f9a
0x00402e81
0x00402e88
0x00402f04
0x00402f08
0x00402f0c
0x00402f11
0x00000000
0x00402f08
0x00402e91
0x00402e96
0x00402e99
0x00402e9e
0x00000000
0x00000000
0x00402ea0
0x00402ea7
0x00000000
0x00000000
0x00402ea9
0x00402eb0
0x00000000
0x00000000
0x00402eb2
0x00402eb9
0x00000000
0x00000000
0x00402ebb
0x00402ec2
0x00000000
0x00000000
0x00402ec4
0x00402eca
0x00402ed3
0x00402ed9
0x00402edc
0x00402ede
0x00402ee4
0x00000000
0x00000000
0x00402eea
0x00402eee
0x00402ef6
0x00402ef6
0x00402ef9
0x00402ef9
0x00402efc
0x00402efe
0x00402f00
0x00402f00
0x00000000
0x00402efe
0x00402ef0
0x00402ef4
0x00000000
0x00000000
0x00000000
0x00402f12
0x00402f12
0x00402f18
0x00402f24
0x00402f24
0x00402f27
0x00402f2d
0x00402f2d
0x00402f2d
0x00402f35
0x00402f35
0x00000000
0x00402f35

APIs

GetTickCount.KERNEL32 ref: 00402DD5
GetModuleFileNameA.KERNELBASE(00000000,C:\Users\user\Desktop\DHLIN00178.exe,00000400), ref: 00402DF1

Part of subcall function 00405B73: GetFileAttributesA.KERNELBASE(00000003,00402E04,C:\Users\user\Desktop\DHLIN00178.exe,80000000,00000003), ref: 00405B77
Part of subcall function 00405B73: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B99

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\DHLIN00178.exe,C:\Users\user\Desktop\DHLIN00178.exe,80000000,00000003), ref: 00402E3D
GlobalAlloc.KERNELBASE(00000040,00000020), ref: 00402F73

Strings

Error launching installer, xrefs: 00402E14
C:\Users\user\Desktop\DHLIN00178.exe, xrefs: 00402DDB, 00402DEA, 00402DFE, 00402E1E
C:\Users\user\Desktop, xrefs: 00402E1F, 00402E24, 00402E2A
soft, xrefs: 00402EB2
"C:\Users\user\Desktop\DHLIN00178.exe", xrefs: 00402DC4
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402F9A
Null, xrefs: 00402EBB
Inst, xrefs: 00402EA9
C:\Users\user\AppData\Local\Temp\, xrefs: 00402DCB

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\DHLIN00178.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\DHLIN00178.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-88945626
Opcode ID: 52488c0a69c855c3c7aeff43e56c4eb2efc08dbfe116725fd41c71e14f125889
Instruction ID: 90621c4e807be281ea96420bab05d42ad29c2ea1f6fd119d4e9c070f99f8684f
Opcode Fuzzy Hash: 52488c0a69c855c3c7aeff43e56c4eb2efc08dbfe116725fd41c71e14f125889
Instruction Fuzzy Hash: 1A51F771A00216ABDF209F61DE89B9E7BB8EB54355F50403BF900B72C1C6BC9E4197AD

Uniqueness

Uniqueness Score: -1.00%

Function 00405FFC Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E00405FFC(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				struct _ITEMIDLIST* _v8;
				char _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				signed char _v28;
				signed int _t38;
				CHAR* _t39;
				signed int _t41;
				char _t52;
				char _t53;
				char _t55;
				char _t57;
				void* _t65;
				char* _t66;
				signed int _t80;
				intOrPtr _t86;
				char _t88;
				void* _t89;
				CHAR* _t90;
				void* _t92;
				signed int _t97;
				signed int _t99;
				void* _t100;

				_t92 = __esi;
				_t89 = __edi;
				_t65 = __ebx;
				_t38 = _a8;
				if(_t38 < 0) {
					_t86 =  *0x422edc; // 0x63baa6
					_t38 =  *(_t86 - 4 + _t38 * 4);
				}
				_push(_t65);
				_push(_t92);
				_push(_t89);
				_t66 = _t38 +  *0x423758;
				_t39 = 0x4226a0;
				_t90 = 0x4226a0;
				if(_a4 >= 0x4226a0 && _a4 - 0x4226a0 < 0x800) {
					_t90 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t88 =  *_t66;
					if(_t88 == 0) {
						break;
					}
					__eflags = _t90 - _t39 - 0x400;
					if(_t90 - _t39 >= 0x400) {
						break;
					}
					_t66 = _t66 + 1;
					__eflags = _t88 - 4;
					_a8 = _t66;
					if(__eflags >= 0) {
						if(__eflags != 0) {
							 *_t90 = _t88;
							_t90 =  &(_t90[1]);
							__eflags = _t90;
						} else {
							 *_t90 =  *_t66;
							_t90 =  &(_t90[1]);
							_t66 = _t66 + 1;
						}
						continue;
					}
					_t41 =  *((char*)(_t66 + 1));
					_t80 =  *_t66;
					_t97 = (_t41 & 0x0000007f) << 0x00000007 | _t80 & 0x0000007f;
					_v24 = _t80;
					_v28 = _t80 | 0x00000080;
					_v16 = _t41;
					_v20 = _t41 | 0x00000080;
					_t66 = _a8 + 2;
					__eflags = _t88 - 2;
					if(_t88 != 2) {
						__eflags = _t88 - 3;
						if(_t88 != 3) {
							__eflags = _t88 - 1;
							if(_t88 == 1) {
								__eflags = (_t41 | 0xffffffff) - _t97;
								E00405FFC(_t66, _t90, _t97, _t90, (_t41 | 0xffffffff) - _t97);
							}
							L42:
							_t90 =  &(_t90[lstrlenA(_t90)]);
							_t39 = 0x4226a0;
							continue;
						}
						__eflags = _t97 - 0x1d;
						if(_t97 != 0x1d) {
							__eflags = (_t97 << 0xa) + 0x424000;
							E00405FDA(_t90, (_t97 << 0xa) + 0x424000);
						} else {
							E00405F38(_t90,  *0x423708);
						}
						__eflags = _t97 + 0xffffffeb - 7;
						if(_t97 + 0xffffffeb < 7) {
							L33:
							E00406244(_t90);
						}
						goto L42;
					}
					_t52 =  *0x42370c;
					__eflags = _t52;
					_t99 = 2;
					if(_t52 >= 0) {
						L13:
						_a8 = 1;
						L14:
						__eflags =  *0x4237a4;
						if( *0x4237a4 != 0) {
							_t99 = 4;
						}
						__eflags = _t80;
						if(__eflags >= 0) {
							__eflags = _t80 - 0x25;
							if(_t80 != 0x25) {
								__eflags = _t80 - 0x24;
								if(_t80 == 0x24) {
									GetWindowsDirectoryA(_t90, 0x400);
									_t99 = 0;
								}
								while(1) {
									__eflags = _t99;
									if(_t99 == 0) {
										goto L30;
									}
									_t53 =  *0x423704;
									_t99 = _t99 - 1;
									__eflags = _t53;
									if(_t53 == 0) {
										L26:
										_t55 = SHGetSpecialFolderLocation( *0x423708,  *(_t100 + _t99 * 4 - 0x18),  &_v8);
										__eflags = _t55;
										if(_t55 != 0) {
											L28:
											 *_t90 =  *_t90 & 0x00000000;
											__eflags =  *_t90;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v8, _t90);
										_v12 = _t55;
										__imp__CoTaskMemFree(_v8);
										__eflags = _v12;
										if(_v12 != 0) {
											goto L30;
										}
										goto L28;
									}
									__eflags = _a8;
									if(_a8 == 0) {
										goto L26;
									}
									_t57 =  *_t53( *0x423708,  *(_t100 + _t99 * 4 - 0x18), 0, 0, _t90); // executed
									__eflags = _t57;
									if(_t57 == 0) {
										goto L30;
									}
									goto L26;
								}
								goto L30;
							}
							GetSystemDirectoryA(_t90, 0x400);
							goto L30;
						} else {
							E00405EC1((_t80 & 0x0000003f) +  *0x423758, __eflags, 0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t80 & 0x0000003f) +  *0x423758, _t90, _t80 & 0x00000040); // executed
							__eflags =  *_t90;
							if( *_t90 != 0) {
								L31:
								__eflags = _v16 - 0x1a;
								if(_v16 == 0x1a) {
									lstrcatA(_t90, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L33;
							}
							E00405FFC(_t66, _t90, _t99, _t90, _v16);
							L30:
							__eflags =  *_t90;
							if( *_t90 == 0) {
								goto L33;
							}
							goto L31;
						}
					}
					__eflags = _t52 - 0x5a04;
					if(_t52 == 0x5a04) {
						goto L13;
					}
					__eflags = _v16 - 0x23;
					if(_v16 == 0x23) {
						goto L13;
					}
					__eflags = _v16 - 0x2e;
					if(_v16 == 0x2e) {
						goto L13;
					} else {
						_a8 = _a8 & 0x00000000;
						goto L14;
					}
				}
				 *_t90 =  *_t90 & 0x00000000;
				if(_a4 == 0) {
					return _t39;
				}
				return E00405FDA(_a4, _t39);
			}

0x00405ffc
0x00405ffc
0x00405ffc
0x00406002
0x00406007
0x00406009
0x00406018
0x00406018
0x00406020
0x00406021
0x00406022
0x00406023
0x00406026
0x0040602e
0x00406030
0x00406047
0x0040604a
0x0040604a
0x00406221
0x00406221
0x00406225
0x00000000
0x00000000
0x00406057
0x0040605d
0x00000000
0x00000000
0x00406063
0x00406064
0x00406067
0x0040606a
0x00406214
0x0040621e
0x00406220
0x00406220
0x00406216
0x00406218
0x0040621a
0x0040621b
0x0040621b
0x00000000
0x00406214
0x00406070
0x00406074
0x00406084
0x0040608b
0x0040608e
0x00406096
0x00406099
0x004060a0
0x004060a1
0x004060a4
0x004061c1
0x004061c4
0x004061f4
0x004061f7
0x004061fc
0x00406200
0x00406200
0x00406205
0x0040620b
0x0040620d
0x00000000
0x0040620d
0x004061c6
0x004061c9
0x004061de
0x004061e5
0x004061cb
0x004061d2
0x004061d2
0x004061ed
0x004061f0
0x004061b9
0x004061ba
0x004061ba
0x00000000
0x004061f0
0x004060aa
0x004060b1
0x004060b3
0x004060b4
0x004060ce
0x004060ce
0x004060d5
0x004060d5
0x004060dc
0x004060e0
0x004060e0
0x004060e1
0x004060e3
0x0040611c
0x0040611f
0x0040612f
0x00406132
0x0040613a
0x00406140
0x00406140
0x0040619f
0x0040619f
0x004061a1
0x00000000
0x00000000
0x00406144
0x0040614b
0x0040614c
0x0040614e
0x00406168
0x00406176
0x0040617c
0x0040617e
0x0040619c
0x0040619c
0x0040619c
0x00000000
0x0040619c
0x00406184
0x0040618d
0x00406190
0x00406196
0x0040619a
0x00000000
0x00000000
0x00000000
0x0040619a
0x00406150
0x00406153
0x00000000
0x00000000
0x00406162
0x00406164
0x00406166
0x00000000
0x00000000
0x00000000
0x00406166
0x00000000
0x0040619f
0x00406127
0x00000000
0x004060e5
0x00406100
0x00406105
0x00406108
0x004061a8
0x004061a8
0x004061ac
0x004061b4
0x004061b4
0x00000000
0x004061ac
0x00406112
0x004061a3
0x004061a3
0x004061a6
0x00000000
0x00000000
0x00000000
0x004061a6
0x004060e3
0x004060b6
0x004060ba
0x00000000
0x00000000
0x004060bc
0x004060c0
0x00000000
0x00000000
0x004060c2
0x004060c6
0x00000000
0x004060c8
0x004060c8
0x00000000
0x004060c8
0x004060c6
0x0040622b
0x00406235
0x00406241
0x00406241
0x00000000

APIs

GetSystemDirectoryA.KERNEL32 ref: 00406127
GetWindowsDirectoryA.KERNEL32(Call,00000400,?,Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll,00000000,00405139,Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll,00000000), ref: 0040613A
SHGetSpecialFolderLocation.SHELL32(00405139,00000000,?,Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll,00000000,00405139,Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll,00000000), ref: 00406176
SHGetPathFromIDListA.SHELL32(00000000,Call), ref: 00406184
CoTaskMemFree.OLE32(00000000), ref: 00406190
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004061B4
lstrlenA.KERNEL32(Call,?,Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll,00000000,00405139,Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll,00000000,00000000,004168C0,00000000), ref: 00406206

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll, xrefs: 00406021
Software\Microsoft\Windows\CurrentVersion, xrefs: 004060F6
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004061AE
Call, xrefs: 00406026, 004060F3, 004060F4, 004060F5, 00406111, 00406126, 00406139, 00406155, 00406180, 004061B3, 004061B9, 004061D1, 004061E4, 004061FF, 00406205, 0040620D, 00406237

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-3536162791
Opcode ID: f9d0b1cf2701d91d5acd79df49d905e61aa9589697f689ea0562d06cd488d680
Instruction ID: f6f0e3a74e6b455581cb0d86726a6c3d239f08f65b325d122068a3aaf356d786
Opcode Fuzzy Hash: f9d0b1cf2701d91d5acd79df49d905e61aa9589697f689ea0562d06cd488d680
Instruction Fuzzy Hash: F4610571A00115ABEF20AF64DC84B7A3BA4DB55314F12417FEA03BA2D2C23C4962DB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E00401759(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				CHAR* _t83;
				void* _t85;

				_t75 = __ebx;
				_t82 = E00402B2C(0x31);
				 *(_t85 - 8) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x34) & 0x00000007;
				_t33 = E004059DF(_t82);
				_push(_t82);
				_t83 = "Call";
				if(_t33 == 0) {
					lstrcatA(E00405972(E00405FDA(_t83, "C:\\Users\\alfons\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto\\Mandslinien\\Characterizable\\Senilitetstegnet")), ??);
				} else {
					E00405FDA();
				}
				E00406244(_t83);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E004062DD(_t83);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x28);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E00405B4E(_t83);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E00405B73(_t83, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 0xc) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E00405101(0xffffffe2,  *(_t85 - 8));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x4237a8;
						goto L32;
					} else {
						E00405FDA(0x409be8, 0x424000);
						E00405FDA(0x424000, _t83);
						E00405FFC(_t75, 0x409be8, _t83, "C:\Users\alfons\AppData\Local\Temp\nsb19E8.tmp\System.dll",  *((intOrPtr*)(_t85 - 0x20)));
						E00405FDA(0x424000, 0x409be8);
						_t62 = E004056F6("C:\Users\alfons\AppData\Local\Temp\nsb19E8.tmp\System.dll",  *(_t85 - 0x34) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x4237a8 =  &( *0x4237a8->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(_t83);
								_push(0xfffffffa);
								E00405101();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E00405101(0xffffffea,  *(_t85 - 8)); // executed
				 *0x4237d4 =  *0x4237d4 + 1;
				_push(_t75);
				_push(_t75);
				_push( *(_t85 - 0xc));
				_push( *((intOrPtr*)(_t85 - 0x2c)));
				_t43 = E00402FFB(); // executed
				 *0x4237d4 =  *0x4237d4 - 1;
				__eflags =  *(_t85 - 0x28) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x28) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 0xc), _t85 - 0x28, _t75, _t85 - 0x28); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x24)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x24)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t85 - 0xc)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E00405FFC(_t75, _t80, _t83, _t83, 0xffffffee);
					} else {
						E00405FFC(_t75, _t80, _t83, _t83, 0xffffffe9);
						lstrcatA(_t83,  *(_t85 - 8));
					}
					_push(0x200010);
					_push(_t83);
					E004056F6();
					goto L29;
				}
				goto L33;
			}

0x00401759
0x00401760
0x00401769
0x0040176c
0x0040176f
0x00401774
0x00401775
0x0040177c
0x00401798
0x0040177e
0x0040177f
0x0040177f
0x0040179e
0x004017a8
0x004017a8
0x004017ac
0x004017af
0x004017b4
0x004017b6
0x004017b8
0x004017bd
0x004017bd
0x004017c8
0x004017c8
0x004017d9
0x004017db
0x004017db
0x004017dc
0x004017dc
0x004017df
0x004017e2
0x004017e5
0x004017e5
0x004017ec
0x004017fb
0x00401800
0x00401803
0x00401806
0x00000000
0x00000000
0x00401808
0x0040180b
0x00401865
0x0040186a
0x004015b0
0x00402783
0x00402783
0x004029b8
0x004029bb
0x004029bb
0x00000000
0x0040180d
0x00401813
0x0040181e
0x0040182b
0x00401836
0x0040184c
0x0040184c
0x0040184f
0x00000000
0x00401855
0x00401855
0x00401856
0x00401873
0x004029c1
0x004029c1
0x004029c1
0x00401858
0x00401858
0x00401859
0x00401492
0x0040234e
0x0040234e
0x0040234e
0x00401856
0x0040184f
0x004029c3
0x004029c7
0x004029c7
0x00401883
0x00401888
0x0040188e
0x0040188f
0x00401890
0x00401893
0x00401896
0x0040189b
0x004018a1
0x004018a5
0x004018a7
0x004018af
0x004018bb
0x004018a9
0x004018a9
0x004018ad
0x00000000
0x00000000
0x004018ad
0x004018c4
0x004018ca
0x004018cc
0x00000000
0x004018d2
0x004018d2
0x004018d5
0x004018ed
0x004018d7
0x004018da
0x004018e3
0x004018e3
0x004018f2
0x004018f7
0x00402349
0x00000000
0x00402349
0x00000000

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Mandslinien\Characterizable\Senilitetstegnet,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Mandslinien\Characterizable\Senilitetstegnet,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00405FDA: lstrcpynA.KERNEL32(?,?,00000400,00403307,00422F00,NSIS Error,?,00000006,00000008,0000000A), ref: 00405FE7

Part of subcall function 00405101: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll,00000000,004168C0,00000000,?,?,?,?,?,?,?,?,?,0040312B,00000000,?), ref: 0040513A
Part of subcall function 00405101: lstrlenA.KERNEL32(0040312B,Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll,00000000,004168C0,00000000,?,?,?,?,?,?,?,?,?,0040312B,00000000), ref: 0040514A
Part of subcall function 00405101: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll,0040312B,0040312B,Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll,00000000,004168C0,00000000), ref: 0040515D
Part of subcall function 00405101: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll), ref: 0040516F
Part of subcall function 00405101: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405195
Part of subcall function 00405101: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051AF
Part of subcall function 00405101: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051BD

Strings

C:\Users\user\AppData\Local\Temp\nsb19E8.tmp, xrefs: 004017A3, 00401812, 00401830
C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll, xrefs: 00401826, 00401842
Call, xrefs: 00401775, 0040177E, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Mandslinien\Characterizable\Senilitetstegnet, xrefs: 00401786

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Mandslinien\Characterizable\Senilitetstegnet$C:\Users\user\AppData\Local\Temp\nsb19E8.tmp$C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll$Call
API String ID: 1941528284-2638277615
Opcode ID: 3398521465f4744d5abe34836e8d3ca427fef63b03b80e7ecba10af39f1564d3
Instruction ID: a8f8d2e71aafd7953ecb4fd9af401e61999b8e286ce35665580707d8cc6a98aa
Opcode Fuzzy Hash: 3398521465f4744d5abe34836e8d3ca427fef63b03b80e7ecba10af39f1564d3
Instruction Fuzzy Hash: BC41D371A0451ABACB107FA5DC45D9F3AB9EF05329B20823BF411F10E1C63C8A419B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405101 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405101(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x422ee4; // 0x10444
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x4237d4;
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E00405FFC(0, _t39, 0x41f4e8, 0x41f4e8, _a4);
					}
					_t26 = lstrlenA(0x41f4e8);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x422ec8, 0x41f4e8); // executed
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x41f4e8;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0); // executed
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52); // executed
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0); // executed
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x41f4e8)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x41f4e8, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

0x00405107
0x00405113
0x00405116
0x0040511c
0x00405128
0x0040512b
0x0040512e
0x00405134
0x00405134
0x0040513a
0x00405142
0x00405145
0x00405162
0x00405166
0x0040516f
0x0040516f
0x00405179
0x00405182
0x0040518e
0x00405195
0x00405199
0x0040519c
0x004051af
0x004051bd
0x004051bd
0x004051c1
0x004051c3
0x004051c6
0x00000000
0x004051c6
0x00405147
0x0040514f
0x00405157
0x0040515d
0x00000000
0x0040515d
0x00405157
0x00405145
0x004051d0

APIs

lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll,00000000,004168C0,00000000,?,?,?,?,?,?,?,?,?,0040312B,00000000,?), ref: 0040513A
lstrlenA.KERNEL32(0040312B,Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll,00000000,004168C0,00000000,?,?,?,?,?,?,?,?,?,0040312B,00000000), ref: 0040514A
lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll,0040312B,0040312B,Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll,00000000,004168C0,00000000), ref: 0040515D
SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll), ref: 0040516F
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405195
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051AF
SendMessageA.USER32(?,00001013,?,00000000), ref: 004051BD

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll, xrefs: 00405121, 00405133, 00405139, 0040515C, 00405168

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll
API String ID: 2531174081-4096140356
Opcode ID: 624fe4a610ab20420a1f4b6733ac8ea3133b8c284db2b2603e432234c565fffb
Instruction ID: da75402713979d4bf34db42cde910fb2485d85a1008762fbb7bcbbad6d42931f
Opcode Fuzzy Hash: 624fe4a610ab20420a1f4b6733ac8ea3133b8c284db2b2603e432234c565fffb
Instruction Fuzzy Hash: BB219A71E00108BADF119FA4CD84ADFBFB9EF05354F04807AF404A6291C6798E419FA8

Uniqueness

Uniqueness Score: -1.00%

Function 004055C7 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004055C7(CHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x40737c;
				_v36.Group = 0x40737c;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x40736c;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryA(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityA(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x004055d2
0x004055d6
0x004055d9
0x004055df
0x004055e3
0x004055e7
0x004055ef
0x004055f6
0x004055fc
0x00405603
0x0040560a
0x00405612
0x00405614
0x00000000
0x00405614
0x0040561e
0x00405625
0x0040563b
0x00000000
0x00000000
0x00000000
0x0040563d
0x00405641

APIs

CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040560A
GetLastError.KERNEL32 ref: 0040561E
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405633
GetLastError.KERNEL32 ref: 0040563D

Strings

C:\Users\user\Desktop, xrefs: 004055C7
|s@, xrefs: 004055CD
ls@, xrefs: 004055FC
C:\Users\user\AppData\Local\Temp\, xrefs: 004055ED

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$ls@$|s@
API String ID: 3449924974-148832918
Opcode ID: 6494dcf4892d125dd91232f43a5d02422eac6eb6da40cea13db3a7c62baa9568
Instruction ID: d76da5e920ef4cf84c76b5f8b6eadacb43d526ba9f765b2b55af8eda6d007f2e
Opcode Fuzzy Hash: 6494dcf4892d125dd91232f43a5d02422eac6eb6da40cea13db3a7c62baa9568
Instruction Fuzzy Hash: 90010871C04219EAEF019BA1CC447EFBBB8EB14355F00853AD905B6290E779A605CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00406304 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406304(intOrPtr _a4) {
				char _v292;
				int _t10;
				struct HINSTANCE__* _t14;
				void* _t16;
				void* _t21;

				_t10 = GetSystemDirectoryA( &_v292, 0x104);
				if(_t10 > 0x104) {
					_t10 = 0;
				}
				if(_t10 == 0 ||  *((char*)(_t21 + _t10 - 0x121)) == 0x5c) {
					_t16 = 1;
				} else {
					_t16 = 0;
				}
				_t5 = _t16 + 0x409014; // 0x5c
				wsprintfA(_t21 + _t10 - 0x120, "%s%s.dll", _t5, _a4);
				_t14 = LoadLibraryExA( &_v292, 0, 8); // executed
				return _t14;
			}

0x0040631b
0x00406324
0x00406326
0x00406326
0x0040632a
0x0040633c
0x00406336
0x00406336
0x00406336
0x00406340
0x00406354
0x00406368
0x0040636f

APIs

GetSystemDirectoryA.KERNEL32 ref: 0040631B
wsprintfA.USER32 ref: 00406354
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406368

Strings

UXTHEME, xrefs: 0040630D
%s%s.dll, xrefs: 0040634E
\, xrefs: 0040632C

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: c1c6f81e5f0925475fc46656834228b64d6aad10adaabf52e6c46f27d1be3297
Instruction ID: 15cbb93803340843acffe9ced60e7e2f3372dd006ff9664fb566d465880257e2
Opcode Fuzzy Hash: c1c6f81e5f0925475fc46656834228b64d6aad10adaabf52e6c46f27d1be3297
Instruction Fuzzy Hash: C8F09C30900116ABDB159768DD0DFFB365CEB08309F14057AB986E11D1D574E9258B99

Uniqueness

Uniqueness Score: -1.00%

Function 00402FFB Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00402FFB(int _a4, intOrPtr _a8, intOrPtr _a12, int _a16, signed char _a19) {
				signed int _v8;
				int _v12;
				long _v16;
				intOrPtr _v20;
				char _v84;
				void* _t59;
				intOrPtr _t69;
				long _t70;
				void* _t71;
				intOrPtr _t81;
				intOrPtr _t86;
				long _t89;
				signed int _t90;
				int _t91;
				int _t92;
				intOrPtr _t93;
				void* _t94;
				void* _t95;

				_t90 = _a16;
				_t86 = _a12;
				_v12 = _t90;
				if(_t86 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_t81 = _t86;
				if(_t86 == 0) {
					_t81 = 0x4168c0;
				}
				_t56 = _a4;
				if(_a4 >= 0) {
					E004031ED( *0x423778 + _t56);
				}
				if(E004031D7( &_a16, 4) == 0) {
					L33:
					_push(0xfffffffd);
					goto L34;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t86 == 0) {
							while(_a16 > 0) {
								_t91 = _v12;
								if(_a16 < _t91) {
									_t91 = _a16;
								}
								if(E004031D7(0x4128c0, _t91) == 0) {
									goto L33;
								} else {
									if(E00405C1A(_a8, 0x4128c0, _t91) == 0) {
										L28:
										_push(0xfffffffe);
										L34:
										_pop(_t59);
										return _t59;
									}
									_v8 = _v8 + _t91;
									_a16 = _a16 - _t91;
									continue;
								}
							}
							L43:
							return _v8;
						}
						if(_a16 < _t90) {
							_t90 = _a16;
						}
						if(E004031D7(_t86, _t90) != 0) {
							_v8 = _t90;
							goto L43;
						} else {
							goto L33;
						}
					}
					_v16 = GetTickCount();
					E00406497(0x40a830);
					_t13 =  &_a16;
					 *_t13 = _a16 & 0x7fffffff;
					_a4 = _a16;
					if( *_t13 <= 0) {
						goto L43;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t92 = 0x4000;
						if(_a16 < 0x4000) {
							_t92 = _a16;
						}
						if(E004031D7(0x4128c0, _t92) == 0) {
							goto L33;
						}
						_a16 = _a16 - _t92;
						 *0x40a848 = 0x4128c0;
						 *0x40a84c = _t92;
						while(1) {
							 *0x40a850 = _t81;
							 *0x40a854 = _v12; // executed
							_t69 = E004064B7(0x40a830); // executed
							_v20 = _t69;
							if(_t69 < 0) {
								break;
							}
							_t93 =  *0x40a850; // 0x4168c0
							_t94 = _t93 - _t81;
							_t70 = GetTickCount();
							_t89 = _t70;
							if(( *0x4237d4 & 0x00000001) != 0 && (_t70 - _v16 > 0xc8 || _a16 == 0)) {
								wsprintfA( &_v84, "... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t95 = _t95 + 0xc;
								E00405101(0,  &_v84); // executed
								_v16 = _t89;
							}
							if(_t94 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L43;
							} else {
								if(_a12 != 0) {
									_v8 = _v8 + _t94;
									_v12 = _v12 - _t94;
									_t81 =  *0x40a850; // 0x4168c0
									L23:
									if(_v20 != 1) {
										continue;
									}
									goto L43;
								}
								_t71 = E00405C1A(_a8, _t81, _t94); // executed
								if(_t71 == 0) {
									goto L28;
								}
								_v8 = _v8 + _t94;
								goto L23;
							}
						}
						_push(0xfffffffc);
						goto L34;
					}
					goto L33;
				}
			}

0x00403003
0x00403007
0x0040300a
0x0040300f
0x00403011
0x00403011
0x00403018
0x0040301c
0x00403020
0x00403022
0x00403022
0x00403027
0x0040302c
0x00403037
0x00403037
0x00403049
0x0040318e
0x0040318e
0x00000000
0x0040304f
0x00403053
0x00403179
0x004031c2
0x00403193
0x00403199
0x0040319b
0x0040319b
0x004031ac
0x00000000
0x004031ae
0x004031ba
0x00403173
0x00403173
0x00403190
0x00403190
0x00000000
0x00403190
0x004031bc
0x004031bf
0x00000000
0x004031bf
0x004031ac
0x004031cd
0x00000000
0x004031cd
0x0040317e
0x00403180
0x00403180
0x0040318c
0x004031ca
0x00000000
0x00000000
0x00000000
0x00000000
0x0040318c
0x00403064
0x00403067
0x0040306c
0x0040306c
0x00403076
0x00403079
0x00000000
0x00000000
0x00000000
0x00000000
0x0040307f
0x0040307f
0x0040307f
0x00403087
0x00403089
0x00403089
0x0040309a
0x00000000
0x00000000
0x004030a0
0x004030a3
0x004030a9
0x004030af
0x004030b7
0x004030bd
0x004030c2
0x004030c9
0x004030cc
0x00000000
0x00000000
0x004030d2
0x004030d8
0x004030da
0x004030e7
0x004030e9
0x00403117
0x0040311d
0x00403126
0x0040312b
0x0040312b
0x00403130
0x00403167
0x00000000
0x00000000
0x00000000
0x00403132
0x00403136
0x0040314b
0x0040314e
0x00403151
0x00403157
0x0040315b
0x00000000
0x00000000
0x00000000
0x00403161
0x0040313d
0x00403144
0x00000000
0x00000000
0x00403146
0x00000000
0x00403146
0x00403130
0x0040316f
0x00000000
0x0040316f
0x00000000
0x0040307f

APIs

GetTickCount.KERNEL32 ref: 00403059
GetTickCount.KERNEL32 ref: 004030DA
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00403107
wsprintfA.USER32 ref: 00403117

Strings

... %d%%, xrefs: 00403111

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: 28484a559e18d06ed43ef22bfdd21feadbb4bbad1a21b96adf7a711402a84214
Instruction ID: eed10709806649b2ce9ecdbe6bed08e8f554dc741dea3641cf9b2fc180d08aa2
Opcode Fuzzy Hash: 28484a559e18d06ed43ef22bfdd21feadbb4bbad1a21b96adf7a711402a84214
Instruction Fuzzy Hash: A7515E71901219ABDB10EF65D904A9F3BB8AF48756F14413BFD10BB2C0C7789E51CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00405BA2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405BA2(char _a4, intOrPtr _a6, CHAR* _a8) {
				char _t11;
				signed int _t12;
				int _t15;
				signed int _t17;
				void* _t20;
				CHAR* _t21;

				_t21 = _a4;
				_t20 = 0x64;
				while(1) {
					_t11 =  *0x4093b4; // 0x61736e
					_t20 = _t20 - 1;
					_a4 = _t11;
					_t12 = GetTickCount();
					_t17 = 0x1a;
					_a6 = _a6 + _t12 % _t17;
					_t15 = GetTempFileNameA(_a8,  &_a4, 0, _t21); // executed
					if(_t15 != 0) {
						break;
					}
					if(_t20 != 0) {
						continue;
					}
					 *_t21 =  *_t21 & 0x00000000;
					return _t15;
				}
				return _t21;
			}

0x00405ba6
0x00405bac
0x00405bad
0x00405bad
0x00405bb2
0x00405bb3
0x00405bb6
0x00405bc0
0x00405bcd
0x00405bd0
0x00405bd8
0x00000000
0x00000000
0x00405bdc
0x00000000
0x00000000
0x00405bde
0x00000000
0x00405bde
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00405BB6
GetTempFileNameA.KERNELBASE(?,?,00000000,?,?,00000006,00000008,0000000A), ref: 00405BD0

Strings

nsa, xrefs: 00405BAD
"C:\Users\user\Desktop\DHLIN00178.exe", xrefs: 00405BA2
C:\Users\user\AppData\Local\Temp\, xrefs: 00405BA5

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\DHLIN00178.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-3717959805
Opcode ID: 4f71c4811bd2189c67125445424a5cfd250d6f6759894b34be1bee502b12972b
Instruction ID: 2f7af396f84d097035df83fe1d719984909df90e6a6ed76a9758152acb097983
Opcode Fuzzy Hash: 4f71c4811bd2189c67125445424a5cfd250d6f6759894b34be1bee502b12972b
Instruction Fuzzy Hash: B9F082367082086BEB108F5ADC04B9B7BA8DF91750F14803BFA08DA291D6B4B9548B69

Uniqueness

Uniqueness Score: -1.00%

Function 72DD16DB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E72DD16DB(void* __edx, void* __edi, void* __esi, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void _v36;
				char _v88;
				struct HINSTANCE__* _t37;
				intOrPtr _t42;
				void* _t48;
				void* _t49;
				void* _t50;
				void* _t54;
				intOrPtr _t57;
				signed int _t61;
				signed int _t63;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t76;

				_t76 = __esi;
				_t68 = __edi;
				_t67 = __edx;
				 *0x72dd405c = _a8;
				 *0x72dd4060 = _a16;
				 *0x72dd4064 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x72dd4038, E72DD1556);
				_push(1); // executed
				_t37 = E72DD1A98(); // executed
				_t54 = _t37;
				if(_t54 == 0) {
					L28:
					return _t37;
				} else {
					if( *((intOrPtr*)(_t54 + 4)) != 1) {
						E72DD22AF(_t54);
					}
					E72DD22F1(_t67, _t54);
					_t57 =  *((intOrPtr*)(_t54 + 4));
					if(_t57 == 0xffffffff) {
						L14:
						if(( *(_t54 + 0x810) & 0x00000004) == 0) {
							if( *((intOrPtr*)(_t54 + 4)) == 0) {
								_t37 = E72DD24D8(_t54);
							} else {
								_push(_t76);
								_push(_t68);
								_t61 = 8;
								_t13 = _t54 + 0x818; // 0x818
								memcpy( &_v36, _t13, _t61 << 2);
								_t42 = E72DD156B(_t54,  &_v88);
								 *(_t54 + 0x834) =  *(_t54 + 0x834) & 0x00000000;
								_t18 = _t54 + 0x818; // 0x818
								_t72 = _t18;
								 *((intOrPtr*)(_t54 + 0x820)) = _t42;
								 *_t72 = 3;
								E72DD24D8(_t54);
								_t63 = 8;
								_t37 = memcpy(_t72,  &_v36, _t63 << 2);
							}
						} else {
							E72DD24D8(_t54);
							_t37 = GlobalFree(E72DD1266(E72DD1559(_t54)));
						}
						if( *((intOrPtr*)(_t54 + 4)) != 1) {
							_t37 = E72DD249E(_t54);
							if(( *(_t54 + 0x810) & 0x00000040) != 0 &&  *_t54 == 1) {
								_t37 =  *(_t54 + 0x808);
								if(_t37 != 0) {
									_t37 = FreeLibrary(_t37);
								}
							}
							if(( *(_t54 + 0x810) & 0x00000020) != 0) {
								_t37 = E72DD14E2( *0x72dd4058);
							}
						}
						if(( *(_t54 + 0x810) & 0x00000002) != 0) {
							goto L28;
						} else {
							return GlobalFree(_t54);
						}
					}
					_t48 =  *_t54;
					if(_t48 == 0) {
						if(_t57 != 1) {
							goto L14;
						}
						E72DD2CC3(_t54);
						L12:
						_t54 = _t48;
						L13:
						goto L14;
					}
					_t49 = _t48 - 1;
					if(_t49 == 0) {
						L8:
						_t48 = E72DD2A38(_t57, _t54); // executed
						goto L12;
					}
					_t50 = _t49 - 1;
					if(_t50 == 0) {
						E72DD26B2(_t54);
						goto L13;
					}
					if(_t50 != 1) {
						goto L14;
					}
					goto L8;
				}
			}

0x72dd16db
0x72dd16db
0x72dd16db
0x72dd16e5
0x72dd16ed
0x72dd16fa
0x72dd1708
0x72dd170b
0x72dd170d
0x72dd1712
0x72dd1717
0x72dd1836
0x72dd1836
0x72dd171d
0x72dd1721
0x72dd1724
0x72dd1729
0x72dd172b
0x72dd1731
0x72dd1737
0x72dd1767
0x72dd176e
0x72dd1792
0x72dd17dd
0x72dd1794
0x72dd1794
0x72dd1795
0x72dd179b
0x72dd179c
0x72dd17a6
0x72dd17a9
0x72dd17ae
0x72dd17b5
0x72dd17b5
0x72dd17bc
0x72dd17c2
0x72dd17c8
0x72dd17d5
0x72dd17d6
0x72dd17d9
0x72dd1770
0x72dd1771
0x72dd1786
0x72dd1786
0x72dd17e7
0x72dd17ea
0x72dd17f7
0x72dd17fe
0x72dd1806
0x72dd1809
0x72dd1809
0x72dd1806
0x72dd1816
0x72dd181e
0x72dd1823
0x72dd1816
0x72dd182b
0x00000000
0x72dd182d
0x00000000
0x72dd182e
0x72dd182b
0x72dd173b
0x72dd173e
0x72dd175c
0x00000000
0x00000000
0x72dd175f
0x72dd1764
0x72dd1764
0x72dd1766
0x00000000
0x72dd1766
0x72dd1740
0x72dd1741
0x72dd1749
0x72dd174a
0x00000000
0x72dd174a
0x72dd1743
0x72dd1744
0x72dd1752
0x00000000
0x72dd1752
0x72dd1747
0x00000000
0x00000000
0x00000000
0x72dd1747

APIs

Part of subcall function 72DD1A98: GlobalFree.KERNEL32 ref: 72DD1D09
Part of subcall function 72DD1A98: GlobalFree.KERNEL32 ref: 72DD1D0E
Part of subcall function 72DD1A98: GlobalFree.KERNEL32 ref: 72DD1D13

GlobalFree.KERNEL32 ref: 72DD1786
FreeLibrary.KERNEL32(?), ref: 72DD1809
GlobalFree.KERNEL32 ref: 72DD182E

Part of subcall function 72DD22AF: GlobalAlloc.KERNEL32(00000040,?), ref: 72DD22E0

Part of subcall function 72DD26B2: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,72DD1757,00000000), ref: 72DD2782

Part of subcall function 72DD156B: wsprintfA.USER32 ref: 72DD1599

Strings

, xrefs: 72DD180F

Memory Dump Source

Source File: 00000000.00000002.843796267.0000000072DD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 72DD0000, based on PE: true

Associated: 00000000.00000002.843788448.0000000072DD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.843803253.0000000072DD3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.843809174.0000000072DD5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72dd0000_DHLIN00178.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 426eea7bc02a97e8733cc22059c308cd22dabd6ae761046bb2bb9f219144cae3
Instruction ID: f5b2e7d8e5cfec702a98ab74314c5cccd82115db0c27a665cf47f4860421f1d4
Opcode Fuzzy Hash: 426eea7bc02a97e8733cc22059c308cd22dabd6ae761046bb2bb9f219144cae3
Instruction Fuzzy Hash: B1419271540A05EBCB019F7CC988B953BACFF05324F14A46BE946BA296DB78D045CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 0040243D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040243D(void* __eax, int __ebx, intOrPtr __edx) {
				void* _t18;
				void* _t19;
				int _t22;
				long _t23;
				int _t28;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t35;
				void* _t37;
				void* _t40;

				_t31 = __edx;
				_t28 = __ebx;
				_t35 =  *((intOrPtr*)(_t37 - 0x24));
				_t32 = __eax;
				 *(_t37 - 0x10) =  *(_t37 - 0x20);
				 *(_t37 - 0x4c) = E00402B2C(2);
				_t18 = E00402B2C(0x11);
				 *(_t37 - 4) = 1;
				_t19 = E00402BBC(_t40, _t32, _t18, 2); // executed
				 *(_t37 + 8) = _t19;
				if(_t19 != __ebx) {
					_t22 = 0;
					if(_t35 == 1) {
						E00402B2C(0x23);
						_t22 = lstrlenA(0x409be8) + 1;
					}
					if(_t35 == 4) {
						 *0x409be8 = E00402B0A(3);
						 *((intOrPtr*)(_t37 - 0x44)) = _t31;
						_t22 = _t35;
					}
					if(_t35 == 3) {
						_t22 = E00402FFB( *((intOrPtr*)(_t37 - 0x28)), _t28, 0x409be8, 0xc00); // executed
					}
					_t23 = RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x4c), _t28,  *(_t37 - 0x10), 0x409be8, _t22); // executed
					if(_t23 == 0) {
						 *(_t37 - 4) = _t28;
					}
					_push( *(_t37 + 8));
					RegCloseKey();
				}
				 *0x4237a8 =  *0x4237a8 +  *(_t37 - 4);
				return 0;
			}

0x0040243d
0x0040243d
0x0040243d
0x00402440
0x00402447
0x00402451
0x00402454
0x0040245d
0x00402464
0x0040246b
0x0040246e
0x00402474
0x0040247e
0x00402482
0x0040248d
0x0040248d
0x00402491
0x0040249b
0x004024a1
0x004024a4
0x004024a4
0x004024a8
0x004024b4
0x004024b4
0x004024c5
0x004024cd
0x004024cf
0x004024cf
0x004024d2
0x004025a9
0x004025a9
0x004029bb
0x004029c7

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,00000023,00000011,00000002), ref: 00402488
RegSetValueExA.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,00000000,00000011,00000002), ref: 004024C5
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,00000000,00000011,00000002), ref: 004025A9

Strings

C:\Users\user\AppData\Local\Temp\nsb19E8.tmp, xrefs: 00402479, 0040249B, 004024AF, 004024BA

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp
API String ID: 2655323295-3314497343
Opcode ID: edd33fe483ba84759b99ae37b3b6bbb98728847c3150981f6fed721a845609ff
Instruction ID: 8e9ea0cf859de5a6fe7672b5a81e2234dbec8cc7450cb22075f11fbb1059ccd6
Opcode Fuzzy Hash: edd33fe483ba84759b99ae37b3b6bbb98728847c3150981f6fed721a845609ff
Instruction Fuzzy Hash: 42119072E00218BEEB01AFA58E49EAE7BB8FB48314F20443BF504B71C1C6B85D419B58

Uniqueness

Uniqueness Score: -1.00%

Function 0040206A Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E0040206A(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t26;
				void* _t27;
				struct HINSTANCE__* _t30;
				CHAR* _t32;
				intOrPtr* _t33;
				void* _t34;

				_t27 = __ebx;
				asm("sbb eax, 0x4237d8");
				 *(_t34 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x4237a8 =  *0x4237a8 +  *(_t34 - 4);
					return 0;
				}
				_t32 = E00402B2C(0xfffffff0);
				 *(_t34 + 8) = E00402B2C(1);
				if( *((intOrPtr*)(_t34 - 0x24)) == __ebx) {
					L3:
					_t18 = LoadLibraryExA(_t32, _t27, 8); // executed
					_t30 = _t18;
					if(_t30 == _t27) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t33 = GetProcAddress(_t30,  *(_t34 + 8));
					if(_t33 == _t27) {
						E00405101(0xfffffff7,  *(_t34 + 8));
					} else {
						 *(_t34 - 4) = _t27;
						if( *((intOrPtr*)(_t34 - 0x2c)) == _t27) {
							 *_t33( *((intOrPtr*)(_t34 - 8)), 0x400, 0x424000, 0x40a828, 0x409000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t34 - 0x2c)));
							if( *_t33() != 0) {
								 *(_t34 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t34 - 0x28)) == _t27 && E00403797(_t30) != 0) {
						FreeLibrary(_t30);
					}
					goto L16;
				}
				_t26 = GetModuleHandleA(_t32); // executed
				_t30 = _t26;
				if(_t30 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x0040206a
0x0040206a
0x0040206f
0x00402076
0x00402131
0x004022a4
0x004022a4
0x004029b8
0x004029bb
0x004029c7
0x004029c7
0x00402085
0x0040208f
0x00402092
0x004020a1
0x004020a5
0x004020ab
0x004020af
0x0040212a
0x00000000
0x0040212a
0x004020b1
0x004020ba
0x004020be
0x00402102
0x004020c0
0x004020c3
0x004020c6
0x004020f6
0x004020c8
0x004020cb
0x004020d4
0x004020d6
0x004020d6
0x004020d4
0x004020c6
0x0040210a
0x0040211f
0x0040211f
0x00000000
0x0040210a
0x00402095
0x0040209b
0x0040209f
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00402095

Part of subcall function 00405101: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll,00000000,004168C0,00000000,?,?,?,?,?,?,?,?,?,0040312B,00000000,?), ref: 0040513A
Part of subcall function 00405101: lstrlenA.KERNEL32(0040312B,Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll,00000000,004168C0,00000000,?,?,?,?,?,?,?,?,?,0040312B,00000000), ref: 0040514A
Part of subcall function 00405101: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll,0040312B,0040312B,Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll,00000000,004168C0,00000000), ref: 0040515D
Part of subcall function 00405101: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll), ref: 0040516F
Part of subcall function 00405101: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405195
Part of subcall function 00405101: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051AF
Part of subcall function 00405101: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051BD

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 004020A5
GetProcAddress.KERNEL32(00000000,?), ref: 004020B5
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040211F

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 9df56e7d61f173b7ce09018b28e1b31a2cbc0ab7774ce8c4a93682e38e80f95d
Instruction ID: 97d835e61fc7e0b97890b4be7664cc53dce4a02014942e479506a03d8351e840
Opcode Fuzzy Hash: 9df56e7d61f173b7ce09018b28e1b31a2cbc0ab7774ce8c4a93682e38e80f95d
Instruction Fuzzy Hash: 4521D871A00214BBCF117FA4CE8DAAE79B4AB44319F20413BFA01B62D0C6FD9981D65E

Uniqueness

Uniqueness Score: -1.00%

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E004015BB(char __ebx, void* __eflags) {
				void* _t13;
				int _t19;
				char _t21;
				void* _t22;
				char _t23;
				signed char _t24;
				char _t26;
				CHAR* _t28;
				char* _t32;
				void* _t33;

				_t26 = __ebx;
				_t28 = E00402B2C(0xfffffff0);
				_t13 = E00405A0B(_t28);
				_t30 = _t13;
				if(_t13 != __ebx) {
					do {
						_t32 = E0040599D(_t30, 0x5c);
						_t21 =  *_t32;
						 *_t32 = _t26;
						 *((char*)(_t33 + 0xb)) = _t21;
						if(_t21 != _t26) {
							L5:
							_t22 = E00405644(_t28);
						} else {
							_t39 =  *((intOrPtr*)(_t33 - 0x2c)) - _t26;
							if( *((intOrPtr*)(_t33 - 0x2c)) == _t26 || E00405661(_t39) == 0) {
								goto L5;
							} else {
								_t22 = E004055C7(_t28); // executed
							}
						}
						if(_t22 != _t26) {
							if(_t22 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
							} else {
								_t24 = GetFileAttributesA(_t28); // executed
								if((_t24 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						_t23 =  *((intOrPtr*)(_t33 + 0xb));
						 *_t32 = _t23;
						_t30 = _t32 + 1;
					} while (_t23 != _t26);
				}
				if( *((intOrPtr*)(_t33 - 0x30)) == _t26) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00405FDA("C:\\Users\\alfons\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto\\Mandslinien\\Characterizable\\Senilitetstegnet", _t28);
					_t19 = SetCurrentDirectoryA(_t28); // executed
					if(_t19 == 0) {
						 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
					}
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t33 - 4));
				return 0;
			}

0x004015bb
0x004015c2
0x004015c5
0x004015ca
0x004015ce
0x004015d0
0x004015d8
0x004015da
0x004015dc
0x004015e0
0x004015e3
0x004015fb
0x004015fc
0x004015e5
0x004015e5
0x004015e8
0x00000000
0x004015f3
0x004015f4
0x004015f4
0x004015e8
0x00401603
0x0040160a
0x00401617
0x00401617
0x0040160c
0x0040160d
0x00401615
0x00000000
0x00000000
0x00401615
0x0040160a
0x0040161a
0x0040161d
0x0040161f
0x00401620
0x004015d0
0x00401627
0x00401652
0x004022a4
0x00401629
0x0040162b
0x00401636
0x0040163c
0x00401644
0x0040164a
0x0040164a
0x00401644
0x004029bb
0x004029c7

APIs

Part of subcall function 00405A0B: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,?,00405A77,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,766DFA90,?,C:\Users\user\AppData\Local\Temp\,004057C2,?,766DFA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A19
Part of subcall function 00405A0B: CharNextA.USER32(00000000), ref: 00405A1E
Part of subcall function 00405A0B: CharNextA.USER32(00000000), ref: 00405A32

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D

Part of subcall function 004055C7: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040560A

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Mandslinien\Characterizable\Senilitetstegnet,00000000,00000000,000000F0), ref: 0040163C

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Mandslinien\Characterizable\Senilitetstegnet, xrefs: 00401631

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Mandslinien\Characterizable\Senilitetstegnet
API String ID: 1892508949-775441338
Opcode ID: 5cfa9deb3d8257745ad8f4e180157ca1595cadb6213feee14bfc4c3bdc9c1bf4
Instruction ID: 3a09c20382928311ba1d31a626229d1df209b5e1cddac7105c79dbf72218ebe6
Opcode Fuzzy Hash: 5cfa9deb3d8257745ad8f4e180157ca1595cadb6213feee14bfc4c3bdc9c1bf4
Instruction Fuzzy Hash: B4112731508141EBCB212FB94D4197F36B0EA96325F28453FE4D2B23E2D63D49429A3F

Uniqueness

Uniqueness Score: -1.00%

Function 00405EC1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00405EC1(void* __ecx, void* __eflags, intOrPtr _a4, int _a8, char* _a12, char* _a16, signed int _a20) {
				int _v8;
				long _t21;
				long _t24;
				char* _t30;

				asm("sbb eax, eax");
				_v8 = 0x400;
				_t21 = E00405E60(__eflags, _a4, _a8,  ~_a20 & 0x00000100 | 0x00020019,  &_a20); // executed
				_t30 = _a16;
				if(_t21 != 0) {
					L4:
					 *_t30 =  *_t30 & 0x00000000;
				} else {
					_t24 = RegQueryValueExA(_a20, _a12, 0,  &_a8, _t30,  &_v8); // executed
					_t21 = RegCloseKey(_a20); // executed
					_t30[0x3ff] = _t30[0x3ff] & 0x00000000;
					if(_t24 != 0 || _a8 != 1 && _a8 != 2) {
						goto L4;
					}
				}
				return _t21;
			}

0x00405ecf
0x00405ed1
0x00405ee9
0x00405eee
0x00405ef3
0x00405f30
0x00405f30
0x00405ef5
0x00405f07
0x00405f12
0x00405f18
0x00405f22
0x00000000
0x00000000
0x00405f22
0x00405f35

APIs

RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,00000400,Call,?,?,?,?,00000002,Call,?,00406105,80000002), ref: 00405F07
RegCloseKey.KERNELBASE(?,?,00406105,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,?,Skipped: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll), ref: 00405F12

Strings

Call, xrefs: 00405EC4, 00405EF8

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: abfb1157869b45efbda80eaac2ce6d2ce1cd77193e8e6ff114ced4d7fd94e931
Instruction ID: 897067c620da28adabf34c96f4b8630bfa599ba4fb7ce992f063a5310404d611
Opcode Fuzzy Hash: abfb1157869b45efbda80eaac2ce6d2ce1cd77193e8e6ff114ced4d7fd94e931
Instruction Fuzzy Hash: 6D015A7251020AABEF22CF61CC09FDB3BACEF55364F004026FA55A2190D278DA54CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00406A9B Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E00406A9B() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M00406F09))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4)); // executed
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8)); // executed
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00406a9b
0x00406a9b
0x00406a9b
0x00406a9b
0x00406aa1
0x00406aa5
0x00406aa9
0x00406ab3
0x00406ac1
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00406dce
0x00406dce
0x00406dd2
0x00000000
0x00000000
0x00406dd4
0x00406ddd
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df5
0x00406e0e
0x00406e11
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406e06
0x00406e09
0x00406e09
0x00406e2b
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dce
0x00406dd2
0x00000000
0x00000000
0x00000000
0x00406e2d
0x00406e2d
0x00406da6
0x00406daa
0x00406ee2
0x00406ee2
0x00406eec
0x00406ef4
0x00406efb
0x00406efd
0x00406f04
0x00406f08
0x00406f08
0x00406db0
0x00406db6
0x00406dbd
0x00406dc5
0x00406dc5
0x00406dc8
0x00000000
0x00406dc8
0x00406e32
0x00406e3f
0x00406e42
0x00406d4e
0x00406d4e
0x00406d4e
0x004064ea
0x004064ea
0x004064ea
0x004064f3
0x00000000
0x00000000
0x004064f9
0x004064f9
0x00000000
0x00406500
0x00406504
0x00000000
0x00000000
0x0040650a
0x0040650d
0x00406510
0x00406513
0x00406517
0x00000000
0x00000000
0x0040651d
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406563
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406565
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00406e55
0x00000000
0x00406e55
0x004065af
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d1
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065d9
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00406e64
0x00000000
0x00406e64
0x0040661f
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d23
0x00406d27
0x00406ed6
0x00406ed6
0x00000000
0x00406ed6
0x00406d2d
0x00406d33
0x00406d3a
0x00406d42
0x00406d45
0x00406d48
0x00406d48
0x00406d4e
0x00406d4e
0x00000000
0x00000000
0x00406666
0x00406666
0x00406668
0x0040666b
0x004066dc
0x004066dc
0x004066df
0x004066e2
0x004066e9
0x004066f3
0x00000000
0x004066f3
0x0040666d
0x0040666d
0x00406671
0x00406674
0x00406676
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x0040668e
0x00406692
0x00406699
0x0040669c
0x004066a3
0x004066a7
0x004066af
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b3
0x004066b6
0x004066d4
0x004066d4
0x004066d6
0x00000000
0x004066b8
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c3
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x00000000
0x004066cf
0x00000000
0x00406905
0x00406905
0x00406909
0x00406927
0x00406927
0x0040692a
0x00406931
0x00406934
0x00406937
0x0040693a
0x0040693d
0x00406940
0x00406942
0x00406949
0x0040694a
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406955
0x0040695a
0x00000000
0x0040695a
0x0040690b
0x0040690b
0x0040690e
0x00406911
0x0040691b
0x00000000
0x00000000
0x0040696f
0x0040696f
0x00406973
0x00406996
0x00406999
0x0040699c
0x004069a6
0x00406975
0x00406975
0x00406978
0x0040697b
0x0040697e
0x0040698b
0x0040698e
0x0040698e
0x00000000
0x00000000
0x004069b2
0x004069b2
0x004069b6
0x00000000
0x00000000
0x004069bc
0x004069bc
0x004069c0
0x00000000
0x00000000
0x004069c6
0x004069c6
0x004069c8
0x004069cc
0x004069cc
0x004069cf
0x004069d3
0x00000000
0x00000000
0x00406a23
0x00406a23
0x00406a27
0x00406a2e
0x00406a2e
0x00406a31
0x00406a34
0x00406a3e
0x00000000
0x00406a3e
0x00406a29
0x00406a29
0x00000000
0x00000000
0x00406a4a
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00406a64
0x00406a64
0x00406a67
0x00406a6a
0x00406a6d
0x00406a6d
0x00406a70
0x00406a77
0x00406a7c
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406703
0x00406e70
0x00406e70
0x00000000
0x00406e70
0x00406709
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x0040671e
0x00406721
0x00406724
0x00406724
0x00406727
0x0040672a
0x00000000
0x00000000
0x00406730
0x00406730
0x00406736
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406767
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679a
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067a3
0x004067aa
0x004067ad
0x00000000
0x004067b3
0x004067b3
0x00000000
0x004067b3
0x00000000
0x004067b8
0x004067b8
0x004067bc
0x00406e7c
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067d7
0x004067da
0x004067dd
0x004067dd
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406800
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682b
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406830
0x00406837
0x0040683a
0x00000000
0x0040683c
0x0040683c
0x00000000
0x0040683c
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406841
0x00000000
0x00000000
0x0040687c
0x0040687c
0x00406880
0x00406e88
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689b
0x0040689e
0x004068a1
0x004068a1
0x004068a7
0x00406845
0x00406845
0x00406848
0x00000000
0x00406848
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c4
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068ef
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068f4
0x004068fb
0x004068fe
0x00000000
0x00406900
0x00406900
0x00000000
0x00406900
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x0040695d
0x0040695d
0x00406960
0x00000000
0x00000000
0x00406c9c
0x00406c9c
0x00406ca0
0x00406cc2
0x00406cc2
0x00406cc5
0x00406ccf
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406ca2
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00000000
0x00000000
0x00406d59
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00406d90
0x00406d90
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00406da4
0x00406d5f
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00406cb3
0x00406cb3
0x00406cb6
0x00000000
0x00000000
0x00406e4a
0x00406e4a
0x00406e4d
0x00406d4e
0x00406d4e
0x00406d4e
0x00000000
0x00406d54
0x00000000
0x00406a84
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00406da4
0x00000000
0x00000000
0x00000000
0x00406ac9
0x00406ac9
0x00406acc
0x00406b02
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b62
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x0040684b
0x0040684b
0x0040684f
0x00406e94
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00000000
0x00000000
0x004069d6
0x004069d6
0x004069da
0x00406ea0
0x00406ea0
0x00000000
0x00406ea0
0x004069e0
0x004069e0
0x004069e3
0x004069e6
0x004069e9
0x004069eb
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0c
0x00406a0f
0x00406a11
0x00406a11
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00406c97
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00406c95
0x00406eca
0x00406eca
0x00000000
0x00000000
0x004064f9
0x00406f01
0x00406f01
0x00000000
0x00406f01
0x00406d4e
0x00406dce
0x00406d97

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03e86151e03bba78afe16222fe9d5ebe1cb7bbef763218a955a86232309b7881
Instruction ID: 81ce818a04e0c3cc04ce684d9a2a9ddfd009c22adec174195ca66df60ea86fc9
Opcode Fuzzy Hash: 03e86151e03bba78afe16222fe9d5ebe1cb7bbef763218a955a86232309b7881
Instruction Fuzzy Hash: 69A14271E00229DBDF28CFA8C8446ADBBB1FF44305F15842AD916BB281C7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406C9C Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406C9C() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00406F09))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4)); // executed
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406c9c
0x00406c9c
0x00406ca0
0x00406cc5
0x00406ccf
0x00000000
0x00406ca2
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406caf
0x00406cb3
0x00406cb3
0x00406cb6
0x00406d90
0x00406d90
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00406dce
0x00406dd2
0x00406e32
0x00406e35
0x00406e3a
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e42
0x00406d4e
0x00406d4e
0x00406d4e
0x004064ea
0x004064ea
0x004064ea
0x004064f3
0x00000000
0x00000000
0x004064f9
0x00000000
0x00406504
0x00000000
0x00000000
0x0040650d
0x00406510
0x00406513
0x00406517
0x00000000
0x00000000
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406563
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00000000
0x00406e55
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00000000
0x00406e64
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d23
0x00406d27
0x00406ed6
0x00000000
0x00406ed6
0x00406d33
0x00406d3a
0x00406d42
0x00406d45
0x00406d48
0x00406d48
0x00000000
0x00000000
0x00406666
0x00406668
0x0040666b
0x004066dc
0x004066df
0x004066e2
0x004066e9
0x004066f3
0x00000000
0x004066f3
0x0040666d
0x00406671
0x00406674
0x00406676
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x0040668e
0x00406692
0x00406699
0x0040669c
0x004066a3
0x004066a7
0x004066af
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b3
0x004066b6
0x004066d4
0x004066d6
0x00000000
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c3
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x00000000
0x004066cf
0x00000000
0x00406905
0x00406909
0x00406927
0x0040692a
0x00406931
0x00406934
0x00406937
0x0040693a
0x0040693d
0x00406940
0x00406942
0x00406949
0x0040694a
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406955
0x0040695a
0x00000000
0x0040695a
0x0040690b
0x0040690e
0x00406911
0x0040691b
0x00000000
0x00000000
0x0040696f
0x00406973
0x00406996
0x00406999
0x0040699c
0x004069a6
0x00406975
0x00406975
0x00406978
0x0040697b
0x0040697e
0x0040698b
0x0040698e
0x0040698e
0x00000000
0x00000000
0x004069b2
0x004069b6
0x00000000
0x00000000
0x004069bc
0x004069c0
0x00000000
0x00000000
0x004069c6
0x004069c8
0x004069cc
0x004069cc
0x004069cf
0x004069d3
0x00000000
0x00000000
0x00406a23
0x00406a27
0x00406a2e
0x00406a31
0x00406a34
0x00406a3e
0x00000000
0x00406a3e
0x00406a29
0x00000000
0x00000000
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00406a64
0x00406a64
0x00406a67
0x00406a6a
0x00406a6d
0x00406a6d
0x00406a70
0x00406a77
0x00406a7c
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406703
0x00406e70
0x00000000
0x00406e70
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x0040671e
0x00406721
0x00406724
0x00406724
0x00406727
0x0040672a
0x00000000
0x00000000
0x00406730
0x00406736
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406767
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679a
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067a3
0x004067aa
0x004067ad
0x00000000
0x004067b3
0x00000000
0x004067b3
0x00000000
0x004067b8
0x004067b8
0x004067bc
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067d7
0x004067da
0x004067dd
0x004067dd
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406800
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682b
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406830
0x00406837
0x0040683a
0x00000000
0x0040683c
0x00000000
0x0040683c
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406841
0x00000000
0x00000000
0x0040687c
0x0040687c
0x00406880
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689b
0x0040689e
0x004068a1
0x004068a1
0x004068a7
0x00406845
0x00406845
0x00406848
0x00000000
0x00406848
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c4
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068ef
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068f4
0x004068fb
0x004068fe
0x00000000
0x00406900
0x00000000
0x00406900
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x0040695d
0x0040695d
0x00406960
0x00406cd2
0x00406cd2
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00000000
0x00406d89
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00000000
0x00000000
0x00406e4a
0x00406e4d
0x00406d4e
0x00406d4e
0x00000000
0x00000000
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aa6
0x00406aa9
0x00406ab0
0x00406ab3
0x00406ac1
0x00000000
0x00000000
0x00000000
0x00000000
0x00406da6
0x00406da6
0x00406daa
0x00406ee2
0x00000000
0x00406ee2
0x00406db0
0x00406db3
0x00406db6
0x00406dba
0x00406dbd
0x00406dc3
0x00406dc5
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dcb
0x00000000
0x00000000
0x00406ac9
0x00406acc
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x0040684b
0x0040684b
0x0040684f
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00000000
0x00000000
0x004069d6
0x004069d6
0x004069da
0x00406ea0
0x00000000
0x00406ea0
0x004069e0
0x004069e3
0x004069e6
0x004069e9
0x004069eb
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0c
0x00406a0f
0x00406a11
0x00406a11
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00406c95
0x00406eca
0x00406eec
0x00406ef2
0x00406ef4
0x00406efb
0x00406efd
0x00406f04
0x00406f08
0x00000000
0x004064f9
0x00406f01
0x00406f01
0x00000000
0x00406f01
0x00406d4e
0x00406dd4
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df5
0x00406e0e
0x00406e11
0x00406e14
0x00406e17
0x00406e1b
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406dff
0x00406e04
0x00406e06
0x00406e09
0x00406e09
0x00406e2b
0x00000000
0x00406e2d
0x00000000
0x00406e2d
0x00406e2b
0x00000000
0x00406ca0

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48eeb96149e0d88395d78aa931bb38ded32ae5716a52e0a7ec155fc571e56ba0
Instruction ID: 08e1f0bd3e012b2653e952fb076f5459688999f8fa16d8000732ef154d800f7e
Opcode Fuzzy Hash: 48eeb96149e0d88395d78aa931bb38ded32ae5716a52e0a7ec155fc571e56ba0
Instruction Fuzzy Hash: 53912370E00229CBEF28CF98C8547ADBBB1FF44305F15816AD956BB281C7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004069B2 Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004069B2() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M00406F09))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4)); // executed
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8)); // executed
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x004069b2
0x004069b2
0x004069b6
0x00406a6d
0x00406a70
0x00406a7c
0x0040695d
0x0040695d
0x00406960
0x00406cd2
0x00406cd2
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00406d48
0x00406d48
0x00406d4e
0x00406d4e
0x00000000
0x00406d23
0x00406d23
0x00406d27
0x00406ed6
0x00000000
0x00406ed6
0x00406d33
0x00406d3a
0x00406d42
0x00406d45
0x00000000
0x00406d45
0x004069bc
0x004069c0
0x00406f01
0x00406f01
0x00406f04
0x00406f08
0x00406f08
0x004069c6
0x004069cc
0x004069cf
0x004069d3
0x004069d6
0x004069da
0x00406ea0
0x00406eec
0x00406ef4
0x00406efb
0x00406efd
0x00000000
0x00406efd
0x004069e0
0x004069e3
0x004069e9
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0f
0x00406a11
0x00406a11
0x00406a14
0x00406a14
0x00406a14
0x004064ea
0x004064ea
0x004064f3
0x00000000
0x00000000
0x004064f9
0x00000000
0x00406504
0x00000000
0x00000000
0x0040650d
0x00406510
0x00406513
0x00406517
0x00000000
0x00000000
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406563
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00000000
0x00406e55
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00000000
0x00406e64
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406666
0x00406668
0x0040666b
0x004066dc
0x004066df
0x004066e2
0x004066e9
0x004066f3
0x00000000
0x004066f3
0x0040666d
0x00406671
0x00406674
0x00406676
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x0040668e
0x00406692
0x00406699
0x0040669c
0x004066a3
0x004066a7
0x004066af
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b3
0x004066b6
0x004066d4
0x004066d6
0x00000000
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c3
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x00000000
0x004066cf
0x00000000
0x00406905
0x00406909
0x00406927
0x0040692a
0x00406931
0x00406934
0x00406937
0x0040693a
0x0040693d
0x00406940
0x00406942
0x00406949
0x0040694a
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406955
0x0040695a
0x00000000
0x0040695a
0x0040690b
0x0040690e
0x00406911
0x0040691b
0x00000000
0x00000000
0x0040696f
0x00406973
0x00406996
0x00406999
0x0040699c
0x004069a6
0x00406975
0x00406975
0x00406978
0x0040697b
0x0040697e
0x0040698b
0x0040698e
0x0040698e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a23
0x00406a27
0x00406a2e
0x00406a31
0x00406a34
0x00406a3e
0x00000000
0x00406a3e
0x00406a29
0x00000000
0x00000000
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00406a64
0x00406a64
0x00406a67
0x00406a6a
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406703
0x00406e70
0x00000000
0x00406e70
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x0040671e
0x00406721
0x00406724
0x00406724
0x00406727
0x0040672a
0x00000000
0x00000000
0x00406730
0x00406736
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406767
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679a
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067a3
0x004067aa
0x004067ad
0x00000000
0x004067b3
0x00000000
0x004067b3
0x00000000
0x004067b8
0x004067b8
0x004067bc
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067d7
0x004067da
0x004067dd
0x004067dd
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406800
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682b
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406830
0x00406837
0x0040683a
0x00000000
0x0040683c
0x00000000
0x0040683c
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406841
0x00000000
0x00000000
0x0040687c
0x0040687c
0x00406880
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689b
0x0040689e
0x004068a1
0x004068a1
0x004068a7
0x00406845
0x00406845
0x00406848
0x00000000
0x00406848
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c4
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068ef
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068f4
0x004068fb
0x004068fe
0x00000000
0x00406900
0x00000000
0x00406900
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c9c
0x00406ca0
0x00406cc2
0x00406cc5
0x00406ccf
0x00000000
0x00406ccf
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00000000
0x00000000
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00406d90
0x00406d90
0x00000000
0x00406d90
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00406cb3
0x00406cb3
0x00406cb6
0x00000000
0x00000000
0x00406e4a
0x00406e4d
0x00000000
0x00000000
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aa6
0x00406aa9
0x00406ab0
0x00406ab3
0x00406ac1
0x00000000
0x00000000
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00000000
0x00406da6
0x00406da6
0x00406daa
0x00406ee2
0x00000000
0x00406ee2
0x00406db0
0x00406db3
0x00406db6
0x00406dba
0x00406dbd
0x00406dc3
0x00406dc5
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dce
0x00406dce
0x00406dd2
0x00406e32
0x00406e35
0x00406e3a
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e42
0x00000000
0x00406e42
0x00406dd4
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406e0e
0x00406e11
0x00406e14
0x00406e17
0x00406e1b
0x00406e1d
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406dff
0x00406e04
0x00406e06
0x00406e09
0x00406e09
0x00406e24
0x00406e2b
0x00000000
0x00406e2d
0x00000000
0x00406e2d
0x00000000
0x00406ac9
0x00406acc
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x0040684b
0x0040684b
0x0040684f
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00000000
0x00406c97
0x00406c95
0x00406eca
0x00000000
0x00000000
0x004064f9

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a29bcf112b88c1b93ae01eb1cff818f8e5d0edf1da40eda35da1d05f3be857d
Instruction ID: f9b0e14a80994b8e3cce9b061f2e265d206a391058c15f1564a8a9ac8da356b6
Opcode Fuzzy Hash: 1a29bcf112b88c1b93ae01eb1cff818f8e5d0edf1da40eda35da1d05f3be857d
Instruction Fuzzy Hash: 80814571D04229DFDF24CFA8C8847ADBBB1FB44305F25816AD816BB281C7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004064B7 Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004064B7(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M00406F09))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8); // executed
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12); // executed
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

0x004064c7
0x004064ce
0x004064d4
0x004064da
0x00000000
0x004064de
0x004064ea
0x004064ea
0x004064ea
0x004064f3
0x00000000
0x00000000
0x004064f9
0x00000000
0x00406500
0x00406504
0x00000000
0x00000000
0x0040650d
0x00406510
0x00406513
0x00406515
0x00406517
0x00000000
0x00000000
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406560
0x00406563
0x0040658b
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406565
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657d
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00000000
0x00406e55
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d4
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065d9
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f6
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00000000
0x00406e64
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663c
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce4
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d1a
0x00406d21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d23
0x00406d23
0x00406d27
0x00406ed6
0x00000000
0x00406ed6
0x00406d33
0x00406d3a
0x00406d42
0x00406d42
0x00406d42
0x00406d45
0x00406d48
0x00406d48
0x00000000
0x00000000
0x00406666
0x00406668
0x0040666b
0x004066dc
0x004066df
0x004066e2
0x004066e9
0x004066f3
0x00000000
0x004066f3
0x0040666d
0x00406671
0x00406674
0x00406676
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x0040668e
0x00406692
0x00406699
0x0040669c
0x004066a3
0x004066a7
0x004066af
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b3
0x004066b6
0x004066d4
0x004066d6
0x00000000
0x004066d6
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c3
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x00000000
0x00000000
0x00406905
0x00406909
0x00406927
0x0040692a
0x00406931
0x00406934
0x00406937
0x0040693a
0x0040693d
0x00406940
0x00406942
0x00406949
0x0040694a
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406955
0x0040695a
0x00000000
0x0040695a
0x0040690b
0x0040690e
0x00406911
0x0040691b
0x00000000
0x00000000
0x0040696f
0x00406973
0x00406996
0x00406999
0x0040699c
0x004069a6
0x00406975
0x00406975
0x00406978
0x0040697b
0x0040697e
0x0040698b
0x0040698e
0x0040698e
0x00000000
0x00000000
0x004069b2
0x004069b6
0x00000000
0x00000000
0x004069bc
0x004069c0
0x00000000
0x00000000
0x004069c6
0x004069c8
0x004069cc
0x004069cc
0x004069cf
0x004069d3
0x00000000
0x00000000
0x00406a23
0x00406a27
0x00406a2e
0x00406a31
0x00406a34
0x00406a3e
0x00000000
0x00406a3e
0x00406a29
0x00000000
0x00000000
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00406a64
0x00406a64
0x00406a67
0x00406a6a
0x00406a6d
0x00406a6d
0x00406a70
0x00406a77
0x00406a7c
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406703
0x00406e70
0x00000000
0x00406e70
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x0040671e
0x00406721
0x00406724
0x00406724
0x00406727
0x0040672a
0x00000000
0x00000000
0x00406730
0x00406736
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406767
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679a
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067a3
0x004067aa
0x004067ad
0x00000000
0x004067b3
0x00000000
0x004067b3
0x00000000
0x004067b8
0x004067b8
0x004067bc
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067d7
0x004067da
0x004067dd
0x004067dd
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406800
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682b
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406830
0x00406837
0x0040683a
0x00000000
0x0040683c
0x00000000
0x0040683c
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406841
0x00000000
0x00000000
0x0040687c
0x0040687c
0x00406880
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689b
0x0040689e
0x004068a1
0x004068a1
0x004068a7
0x00406845
0x00406845
0x00406848
0x00000000
0x00406848
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c4
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068ef
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068f4
0x004068fb
0x004068fe
0x00000000
0x00406900
0x00000000
0x00406900
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x0040695d
0x0040695d
0x00406960
0x00000000
0x00000000
0x00406c9c
0x00406ca0
0x00406cc2
0x00406cc5
0x00406ccf
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00000000
0x00000000
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00406d90
0x00406d90
0x00000000
0x00406d90
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00406cb3
0x00406cb3
0x00406cb6
0x00000000
0x00000000
0x00406e4a
0x00406e4d
0x00000000
0x00000000
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aa6
0x00406aa9
0x00406ab0
0x00406ab3
0x00406ac1
0x00000000
0x00000000
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00000000
0x00406da6
0x00406da6
0x00406daa
0x00406ee2
0x00000000
0x00406ee2
0x00406db0
0x00406db3
0x00406db6
0x00406dba
0x00406dbd
0x00406dc3
0x00406dc5
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dce
0x00406dce
0x00406dd2
0x00406e32
0x00406e35
0x00406e3a
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e42
0x00406d4e
0x00406d4e
0x00000000
0x00406d4e
0x00406dd4
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406e0e
0x00406e11
0x00406e14
0x00406e17
0x00406e1b
0x00406e1d
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406dff
0x00406e04
0x00406e06
0x00406e09
0x00406e09
0x00406e24
0x00406e2b
0x00000000
0x00406e2d
0x00000000
0x00406e2d
0x00000000
0x00406ac9
0x00406acc
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x0040684b
0x0040684b
0x0040684f
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00000000
0x00000000
0x004069d6
0x004069d6
0x004069da
0x00406ea0
0x00000000
0x00406ea0
0x004069e0
0x004069e3
0x004069e6
0x004069e9
0x004069eb
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0c
0x00406a0f
0x00406a11
0x00406a11
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00406c95
0x00406eca
0x00406eec
0x00406ef2
0x00406ef4
0x00406efb
0x00000000
0x00000000
0x004064f9
0x00406f01
0x00406f01
0x00000000

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec6a1127f337a9cd102a75f31ecac58d5a9bcb7082b0f725788ddd98255f1a75
Instruction ID: 64fae73fcf261b5a29c0697abf595a3f572636c651b32177eb72ec05398ad39b
Opcode Fuzzy Hash: ec6a1127f337a9cd102a75f31ecac58d5a9bcb7082b0f725788ddd98255f1a75
Instruction Fuzzy Hash: 39817831D04229DBEF24CFA8D8447ADBBB0FB44305F21816AD856BB2C1C7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406905 Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406905() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M00406F09))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4)); // executed
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8)); // executed
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406905
0x00406905
0x00406909
0x0040692a
0x00406931
0x00406937
0x0040693d
0x0040694f
0x00406955
0x0040695a
0x00000000
0x0040690b
0x00406911
0x00406cd2
0x00406cd2
0x00406cd2
0x00406cd5
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00406d23
0x00406d27
0x00406ed6
0x00406eec
0x00406ef4
0x00406efb
0x00406efd
0x00406f04
0x00406f08
0x00406f08
0x00406d33
0x00406d3a
0x00406d42
0x00406d45
0x00406d48
0x00406d48
0x00406d4e
0x00406d4e
0x004064ea
0x004064ea
0x004064ea
0x004064f3
0x00000000
0x00000000
0x004064f9
0x00000000
0x00406504
0x00000000
0x00000000
0x0040650d
0x00406510
0x00406513
0x00406517
0x00000000
0x00000000
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406563
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00000000
0x00406e55
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00000000
0x00406e64
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406666
0x00406668
0x0040666b
0x004066dc
0x004066df
0x004066e2
0x004066e9
0x004066f3
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x0040666d
0x00406671
0x00406674
0x00406676
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x0040668e
0x00406692
0x00406699
0x0040669c
0x004066a3
0x004066a7
0x004066af
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b3
0x004066b6
0x004066d4
0x004066d6
0x00000000
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c3
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x00000000
0x004066cf
0x00000000
0x00000000
0x00000000
0x0040696f
0x00406973
0x00406996
0x00406999
0x0040699c
0x004069a6
0x00406975
0x00406975
0x00406978
0x0040697b
0x0040697e
0x0040698b
0x0040698e
0x0040698e
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00000000
0x004069b2
0x004069b6
0x00000000
0x00000000
0x004069bc
0x004069c0
0x00000000
0x00000000
0x004069c6
0x004069c8
0x004069cc
0x004069cc
0x004069cf
0x004069d3
0x00000000
0x00000000
0x00406a23
0x00406a27
0x00406a2e
0x00406a31
0x00406a34
0x00406a3e
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406cd2
0x00406a29
0x00000000
0x00000000
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00406a64
0x00406a64
0x00406a67
0x00406a6a
0x00406a6d
0x00406a6d
0x00406a70
0x00406a77
0x00406a7c
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406703
0x00406e70
0x00000000
0x00406e70
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x0040671e
0x00406721
0x00406724
0x00406724
0x00406727
0x0040672a
0x00000000
0x00000000
0x00406730
0x00406736
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406767
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679a
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067a3
0x004067aa
0x004067ad
0x00000000
0x004067b3
0x00000000
0x004067b3
0x00000000
0x004067b8
0x004067b8
0x004067bc
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067d7
0x004067da
0x004067dd
0x004067dd
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406800
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682b
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406830
0x00406837
0x0040683a
0x00000000
0x0040683c
0x00000000
0x0040683c
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406841
0x00000000
0x00000000
0x0040687c
0x0040687c
0x00406880
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689b
0x0040689e
0x004068a1
0x004068a1
0x004068a7
0x00406845
0x00406845
0x00406848
0x00000000
0x00406848
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c4
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068ef
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068f4
0x004068fb
0x004068fe
0x00000000
0x00406900
0x00000000
0x00406900
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x0040695d
0x0040695d
0x00406960
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00000000
0x00406c9c
0x00406ca0
0x00406cc2
0x00406cc5
0x00406ccf
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406cd2
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00000000
0x00000000
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00406d90
0x00406d90
0x00000000
0x00406d90
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00406cb3
0x00406cb3
0x00406cb6
0x00000000
0x00000000
0x00406e4a
0x00406e4d
0x00406d4e
0x00000000
0x00000000
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aa6
0x00406aa9
0x00406ab0
0x00406ab3
0x00406ac1
0x00000000
0x00000000
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00000000
0x00406da6
0x00406da6
0x00406daa
0x00406ee2
0x00000000
0x00406ee2
0x00406db0
0x00406db3
0x00406db6
0x00406dba
0x00406dbd
0x00406dc3
0x00406dc5
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dce
0x00406dce
0x00406dd2
0x00406e32
0x00406e35
0x00406e3a
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e42
0x00406d4e
0x00406d4e
0x00000000
0x00406d54
0x00406d4e
0x00406dd4
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406e0e
0x00406e11
0x00406e14
0x00406e17
0x00406e1b
0x00406e1d
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406dff
0x00406e04
0x00406e06
0x00406e09
0x00406e09
0x00406e24
0x00406e2b
0x00000000
0x00406e2d
0x00000000
0x00406e2d
0x00000000
0x00406ac9
0x00406acc
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x0040684b
0x0040684b
0x0040684f
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00000000
0x00000000
0x004069d6
0x004069d6
0x004069da
0x00406ea0
0x00000000
0x00406ea0
0x004069e0
0x004069e3
0x004069e6
0x004069e9
0x004069eb
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0c
0x00406a0f
0x00406a11
0x00406a11
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00406c95
0x00406eca
0x00000000
0x00000000
0x004064f9
0x00406f01
0x00406f01
0x00000000
0x00406f01
0x00406d4e
0x00406cd5
0x00406cd2
0x00000000
0x00406909

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ab0f5182b65f417a428d3e5ace57518a098f994e057f816ecf8909cd511bbd
Instruction ID: 51e77fe0f08f8d7ba03d7e1561fc41eb13955110d3fdee4e61b85cd17e52ee3e
Opcode Fuzzy Hash: e7ab0f5182b65f417a428d3e5ace57518a098f994e057f816ecf8909cd511bbd
Instruction Fuzzy Hash: C4712371D04229DBEF28CF98C8447ADBBB1FB44305F15806AD806BB281D7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406A23 Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406A23() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M00406F09))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4)); // executed
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8)); // executed
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406a23
0x00406a23
0x00406a27
0x00406a34
0x00406a3e
0x00000000
0x00406a29
0x00406a29
0x00406a64
0x00406a67
0x00406a6a
0x00406a6d
0x00406a6d
0x00406a70
0x00406a77
0x00406a7c
0x0040695d
0x00406960
0x00406cd2
0x00406cd2
0x00406cd2
0x00406cd5
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00406d23
0x00406d27
0x00406ed6
0x00406eec
0x00406ef4
0x00406efb
0x00406efd
0x00406f04
0x00406f08
0x00406f08
0x00406d33
0x00406d3a
0x00406d42
0x00406d45
0x00406d48
0x00406d48
0x00406d4e
0x00406d4e
0x004064ea
0x004064ea
0x004064ea
0x004064f3
0x00000000
0x00000000
0x004064f9
0x00000000
0x00406504
0x00000000
0x00000000
0x0040650d
0x00406510
0x00406513
0x00406517
0x00000000
0x00000000
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406563
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00000000
0x00406e55
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00406cd2
0x00406cd2
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00000000
0x00406e64
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406666
0x00406668
0x0040666b
0x004066dc
0x004066df
0x004066e2
0x004066e9
0x004066f3
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406cd2
0x0040666d
0x00406671
0x00406674
0x00406676
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x0040668e
0x00406692
0x00406699
0x0040669c
0x004066a3
0x004066a7
0x004066af
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b3
0x004066b6
0x004066d4
0x004066d6
0x00000000
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c3
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x00000000
0x004066cf
0x00000000
0x00406905
0x00406909
0x00406927
0x0040692a
0x00406931
0x00406934
0x00406937
0x0040693a
0x0040693d
0x00406940
0x00406942
0x00406949
0x0040694a
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406955
0x0040695a
0x00000000
0x0040695a
0x0040690b
0x0040690e
0x00406911
0x0040691b
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00000000
0x0040696f
0x00406973
0x00406996
0x00406999
0x0040699c
0x004069a6
0x00406975
0x00406975
0x00406978
0x0040697b
0x0040697e
0x0040698b
0x0040698e
0x0040698e
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00000000
0x004069b2
0x004069b6
0x00000000
0x00000000
0x004069bc
0x004069c0
0x00000000
0x00000000
0x004069c6
0x004069c8
0x004069cc
0x004069cc
0x004069cf
0x004069d3
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406703
0x00406e70
0x00000000
0x00406e70
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x0040671e
0x00406721
0x00406724
0x00406724
0x00406727
0x0040672a
0x00000000
0x00000000
0x00406730
0x00406736
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406767
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679a
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067a3
0x004067aa
0x004067ad
0x00000000
0x004067b3
0x00000000
0x004067b3
0x00000000
0x004067b8
0x004067b8
0x004067bc
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067d7
0x004067da
0x004067dd
0x004067dd
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406800
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682b
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406830
0x00406837
0x0040683a
0x00000000
0x0040683c
0x00000000
0x0040683c
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406841
0x00000000
0x00000000
0x0040687c
0x0040687c
0x00406880
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689b
0x0040689e
0x004068a1
0x004068a1
0x004068a7
0x00406845
0x00406845
0x00406848
0x00000000
0x00406848
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c4
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068ef
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068f4
0x004068fb
0x004068fe
0x00000000
0x00406900
0x00000000
0x00406900
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c9c
0x00406ca0
0x00406cc2
0x00406cc5
0x00406ccf
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406cd2
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00000000
0x00000000
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00406d90
0x00406d90
0x00000000
0x00406d90
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00406cb3
0x00406cb3
0x00406cb6
0x00000000
0x00000000
0x00406e4a
0x00406e4d
0x00406d4e
0x00000000
0x00000000
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aa6
0x00406aa9
0x00406ab0
0x00406ab3
0x00406ac1
0x00000000
0x00000000
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00000000
0x00406da6
0x00406da6
0x00406daa
0x00406ee2
0x00000000
0x00406ee2
0x00406db0
0x00406db3
0x00406db6
0x00406dba
0x00406dbd
0x00406dc3
0x00406dc5
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dce
0x00406dce
0x00406dd2
0x00406e32
0x00406e35
0x00406e3a
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e42
0x00406d4e
0x00406d4e
0x00000000
0x00406d54
0x00406d4e
0x00406dd4
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406e0e
0x00406e11
0x00406e14
0x00406e17
0x00406e1b
0x00406e1d
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406dff
0x00406e04
0x00406e06
0x00406e09
0x00406e09
0x00406e24
0x00406e2b
0x00000000
0x00406e2d
0x00000000
0x00406e2d
0x00000000
0x00406ac9
0x00406acc
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x0040684b
0x0040684b
0x0040684f
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00000000
0x00000000
0x004069d6
0x004069d6
0x004069da
0x00406ea0
0x00000000
0x00406ea0
0x004069e0
0x004069e3
0x004069e6
0x004069e9
0x004069eb
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0c
0x00406a0f
0x00406a11
0x00406a11
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00406c95
0x00406eca
0x00000000
0x00000000
0x004064f9
0x00406f01
0x00406f01
0x00000000
0x00406f01
0x00406d4e
0x00406cd5
0x00406cd2
0x00000000
0x00406a27

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d154c6f6c8b8bff782c781b6862f01632ca8036cc5e59350156e3961b0956316
Instruction ID: 3517892101dd69bd75e64738494877d03a8317e446f0652336487a17687a2cae
Opcode Fuzzy Hash: d154c6f6c8b8bff782c781b6862f01632ca8036cc5e59350156e3961b0956316
Instruction Fuzzy Hash: 53712571E04229DFEF28CF98C844BADBBB1FB44305F15806AD816BB281D7789996DF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040696F Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040696F() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00406F09))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4)); // executed
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00000000
0x0040696f
0x0040696f
0x00406973
0x0040699c
0x004069a6
0x00406975
0x0040697e
0x0040698b
0x0040698e
0x00406cd2
0x00406cd2
0x00406cd5
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00406d23
0x00406d27
0x00406ed6
0x00406eec
0x00406ef4
0x00406efb
0x00406efd
0x00406f04
0x00406f08
0x00406f08
0x00406d33
0x00406d3a
0x00406d42
0x00406d45
0x00406d48
0x00406d48
0x00406d4e
0x00406d4e
0x004064ea
0x004064ea
0x004064ea
0x004064f3
0x00000000
0x00000000
0x004064f9
0x00000000
0x00406504
0x00000000
0x00000000
0x0040650d
0x00406510
0x00406513
0x00406517
0x00000000
0x00000000
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406563
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00000000
0x00406e55
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00406cd2
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00000000
0x00406e64
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406666
0x00406668
0x0040666b
0x004066dc
0x004066df
0x004066e2
0x004066e9
0x004066f3
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406cd2
0x0040666d
0x00406671
0x00406674
0x00406676
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x0040668e
0x00406692
0x00406699
0x0040669c
0x004066a3
0x004066a7
0x004066af
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b3
0x004066b6
0x004066d4
0x004066d6
0x00000000
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c3
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x00000000
0x004066cf
0x00000000
0x00406905
0x00406909
0x00406927
0x0040692a
0x00406931
0x00406934
0x00406937
0x0040693a
0x0040693d
0x00406940
0x00406942
0x00406949
0x0040694a
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406955
0x0040695a
0x00000000
0x0040695a
0x0040690b
0x0040690e
0x00406911
0x0040691b
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00000000
0x00000000
0x00000000
0x004069b2
0x004069b6
0x00000000
0x00000000
0x004069bc
0x004069c0
0x00000000
0x00000000
0x004069c6
0x004069c8
0x004069cc
0x004069cc
0x004069cf
0x004069d3
0x00000000
0x00000000
0x00406a23
0x00406a27
0x00406a2e
0x00406a31
0x00406a34
0x00406a3e
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406cd2
0x00406a29
0x00000000
0x00000000
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00406a64
0x00406a64
0x00406a67
0x00406a6a
0x00406a6d
0x00406a6d
0x00406a70
0x00406a77
0x00406a7c
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406703
0x00406e70
0x00000000
0x00406e70
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x0040671e
0x00406721
0x00406724
0x00406724
0x00406727
0x0040672a
0x00000000
0x00000000
0x00406730
0x00406736
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406767
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679a
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067a3
0x004067aa
0x004067ad
0x00000000
0x004067b3
0x00000000
0x004067b3
0x00000000
0x004067b8
0x004067b8
0x004067bc
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067d7
0x004067da
0x004067dd
0x004067dd
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406800
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682b
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406830
0x00406837
0x0040683a
0x00000000
0x0040683c
0x00000000
0x0040683c
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406841
0x00000000
0x00000000
0x0040687c
0x0040687c
0x00406880
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689b
0x0040689e
0x004068a1
0x004068a1
0x004068a7
0x00406845
0x00406845
0x00406848
0x00000000
0x00406848
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c4
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068ef
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068f4
0x004068fb
0x004068fe
0x00000000
0x00406900
0x00000000
0x00406900
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x0040695d
0x0040695d
0x00406960
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00000000
0x00406c9c
0x00406ca0
0x00406cc2
0x00406cc5
0x00406ccf
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406cd2
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00000000
0x00000000
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00406d90
0x00406d90
0x00000000
0x00406d90
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00406cb3
0x00406cb3
0x00406cb6
0x00000000
0x00000000
0x00406e4a
0x00406e4d
0x00406d4e
0x00000000
0x00000000
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aa6
0x00406aa9
0x00406ab0
0x00406ab3
0x00406ac1
0x00000000
0x00000000
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00000000
0x00406da6
0x00406da6
0x00406daa
0x00406ee2
0x00000000
0x00406ee2
0x00406db0
0x00406db3
0x00406db6
0x00406dba
0x00406dbd
0x00406dc3
0x00406dc5
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dce
0x00406dce
0x00406dd2
0x00406e32
0x00406e35
0x00406e3a
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e42
0x00406d4e
0x00406d4e
0x00000000
0x00406d54
0x00406d4e
0x00406dd4
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406e0e
0x00406e11
0x00406e14
0x00406e17
0x00406e1b
0x00406e1d
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406dff
0x00406e04
0x00406e06
0x00406e09
0x00406e09
0x00406e24
0x00406e2b
0x00000000
0x00406e2d
0x00000000
0x00406e2d
0x00000000
0x00406ac9
0x00406acc
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x0040684b
0x0040684b
0x0040684f
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00000000
0x00000000
0x004069d6
0x004069d6
0x004069da
0x00406ea0
0x00000000
0x00406ea0
0x004069e0
0x004069e3
0x004069e6
0x004069e9
0x004069eb
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0c
0x00406a0f
0x00406a11
0x00406a11
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00406c95
0x00406eca
0x00000000
0x00000000
0x004064f9
0x00406f01
0x00406f01
0x00000000
0x00406f01
0x00406d4e
0x00406cd5
0x00406cd2

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90803f23476dcfb414c0400bb9d8b7cdb0b3ca45f440242c86af8c4d62fdd6e9
Instruction ID: 34c5161cf4e4322df4c522de15ced9ded486b5ca7425d8c28145854c0c0886a7
Opcode Fuzzy Hash: 90803f23476dcfb414c0400bb9d8b7cdb0b3ca45f440242c86af8c4d62fdd6e9
Instruction Fuzzy Hash: 29714571D04229DBEF28CF98C844BADBBB1FB44305F15806AD816BB281C7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040254C Relevance: 4.5, APIs: 3, Instructions: 47
registryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040254C(int* __ebx, intOrPtr __edx, char* __esi) {
				void* _t9;
				int _t10;
				long _t13;
				int* _t16;
				intOrPtr _t21;
				void* _t22;
				char* _t24;
				void* _t26;
				void* _t29;

				_t24 = __esi;
				_t21 = __edx;
				_t16 = __ebx;
				_t9 = E00402B6C(_t29, 0x20019); // executed
				_t22 = _t9;
				_t10 = E00402B0A(3);
				 *((intOrPtr*)(_t26 - 0x10)) = _t21;
				 *__esi = __ebx;
				if(_t22 == __ebx) {
					 *((intOrPtr*)(_t26 - 4)) = 1;
				} else {
					 *(_t26 + 8) = 0x3ff;
					if( *((intOrPtr*)(_t26 - 0x24)) == __ebx) {
						_t13 = RegEnumValueA(_t22, _t10, __esi, _t26 + 8, __ebx, __ebx, __ebx, __ebx);
						__eflags = _t13;
						if(_t13 != 0) {
							 *((intOrPtr*)(_t26 - 4)) = 1;
						}
					} else {
						RegEnumKeyA(_t22, _t10, __esi, 0x3ff);
					}
					_t24[0x3ff] = _t16;
					_push(_t22);
					RegCloseKey();
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t26 - 4));
				return 0;
			}

0x0040254c
0x0040254c
0x0040254c
0x00402551
0x00402558
0x0040255a
0x00402562
0x00402565
0x00402567
0x00402783
0x0040256d
0x00402575
0x00402578
0x00402591
0x00402597
0x00402599
0x0040259b
0x0040259b
0x0040257a
0x0040257e
0x0040257e
0x004025a2
0x004025a8
0x004025a9
0x004025a9
0x004029bb
0x004029c7

APIs

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 0040257E
RegEnumValueA.ADVAPI32 ref: 00402591
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,00000000,00000011,00000002), ref: 004025A9

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 095019f322b6c40d92cef5b4465a19737fb82d48870a7b4a86778a7d8ee6d3d7
Instruction ID: 35fd857a3e442691b1a787247be78dd7b49a46040516f967143c2ea575d22cfd
Opcode Fuzzy Hash: 095019f322b6c40d92cef5b4465a19737fb82d48870a7b4a86778a7d8ee6d3d7
Instruction Fuzzy Hash: 5801B1B1905204FFE7119F659E89ABF7ABCEB40344F10443EF402B62C0D6B85E019669

Uniqueness

Uniqueness Score: -1.00%

Function 72DD2921 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {

				 *0x72dd4038 = _a4;
				if(_a8 == 1) {
					VirtualProtect(0x72dd404c, 4, 0x40, 0x72dd403c); // executed
					 *0x72dd404c = 0xc2;
					 *0x72dd403c = 0;
					 *0x72dd4044 = 0;
					 *0x72dd4058 = 0;
					 *0x72dd4048 = 0;
					 *0x72dd4040 = 0;
					 *0x72dd4050 = 0;
					 *0x72dd404e = 0;
				}
				return 1;
			}

0x72dd292a
0x72dd292f
0x72dd293f
0x72dd2947
0x72dd294e
0x72dd2953
0x72dd2958
0x72dd295d
0x72dd2962
0x72dd2967
0x72dd296c
0x72dd296c
0x72dd2974

APIs

VirtualProtect.KERNELBASE(72DD404C,00000004,00000040,72DD403C), ref: 72DD293F

Strings

`ghv@Mhv, xrefs: 72DD293F

Memory Dump Source

Source File: 00000000.00000002.843796267.0000000072DD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 72DD0000, based on PE: true

Associated: 00000000.00000002.843788448.0000000072DD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.843803253.0000000072DD3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.843809174.0000000072DD5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72dd0000_DHLIN00178.jbxd

Similarity

API ID: ProtectVirtual
String ID: `ghv@Mhv
API String ID: 544645111-2667177705
Opcode ID: 02e10082436f22c02e778cbe366b387dea45de7c7e541e0d24fab8046138b39b
Instruction ID: 566f7486d04f0f8e0ba5e7211b02e89432b1abc0167a44797219a3f6ac1485ff
Opcode Fuzzy Hash: 02e10082436f22c02e778cbe366b387dea45de7c7e541e0d24fab8046138b39b
Instruction Fuzzy Hash: 9DF092B3988A81DEC361CF6AD44C7253FE4A318254BB18DAFE59CE7241E37440488F19

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x423750;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x422eec =  *0x422eec + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x422eec, 0x7530,  *0x422ed4), 0); // executed
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 42208f6ee167e53754ec85f902deef064f05172097489c9424a2864a03bb7ea4
Instruction ID: 3754a530b6758dc8908f2ef617aa9c280200ea706ec51d0fb7e67c491179f4d9
Opcode Fuzzy Hash: 42208f6ee167e53754ec85f902deef064f05172097489c9424a2864a03bb7ea4
Instruction Fuzzy Hash: A3012831724210ABE7294B389D04B2A369CE710328F11823BF811F72F1D6B8DC02DB4D

Uniqueness

Uniqueness Score: -1.00%

Function 00401E8F Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401EAD
EnableWindow.USER32(00000000,00000000), ref: 00401EB8

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: a913115b0b618877984699264344b8a1880e6ceeac658a5775d41212f4eb71b2
Instruction ID: ea2ebfb6392eb1d35c1d77cf7a204b1acfca181ccf64587d83a13520139c7bad
Opcode Fuzzy Hash: a913115b0b618877984699264344b8a1880e6ceeac658a5775d41212f4eb71b2
Instruction Fuzzy Hash: C8E012B2A08210DFD715DFA8AA859AE77B4FB84325F10493BE102F12D1D7B85940965D

Uniqueness

Uniqueness Score: -1.00%

Function 0040156F Relevance: 3.0, APIs: 2, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040156F(void* __ebx, int __edx) {
				int _t3;
				void* _t8;
				struct HWND__* _t10;
				struct HWND__* _t11;
				void* _t16;

				_t8 = __ebx;
				_t10 =  *0x422ed0; // 0x1044a
				if(_t10 != __ebx) {
					ShowWindow(_t10, __edx); // executed
					_t3 =  *(_t16 - 0x34);
				}
				_t11 =  *0x422ee4; // 0x10444
				if(_t11 != _t8) {
					ShowWindow(_t11, _t3); // executed
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t16 - 4));
				return 0;
			}

0x0040156f
0x0040156f
0x0040157d
0x00401581
0x00401583
0x00401583
0x00401586
0x0040158e
0x00401596
0x00401596
0x004029bb
0x004029c7

APIs

ShowWindow.USER32(0001044A), ref: 00401581
ShowWindow.USER32(00010444), ref: 00401596

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 01b8f08c91b687540e8bb59e961ce2b0c28ac7e6e5880a628e7803932cc216c7
Instruction ID: 9b4c08dd34b2d0c6cc2545b51cfcf00afa42d444c9e8f3eecf44a84becef43f7
Opcode Fuzzy Hash: 01b8f08c91b687540e8bb59e961ce2b0c28ac7e6e5880a628e7803932cc216c7
Instruction Fuzzy Hash: 7BE086B6B10100BBCB24CF54EE8087E73AAEB84310750053FE502F3290C2B49D418B58

Uniqueness

Uniqueness Score: -1.00%

Function 00406372 Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406372(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x409240);
				_t5 = GetModuleHandleA( *(_t10 + 0x409240));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x409244));
				}
				_t5 = E00406304(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x0040637a
0x0040637d
0x00406384
0x0040638c
0x00406398
0x00000000
0x0040639f
0x0040638f
0x00406396
0x00000000
0x004063a7
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,?,?,004032A8,0000000A), ref: 00406384
GetProcAddress.KERNEL32(00000000,?), ref: 0040639F

Part of subcall function 00406304: GetSystemDirectoryA.KERNEL32 ref: 0040631B
Part of subcall function 00406304: wsprintfA.USER32 ref: 00406354
Part of subcall function 00406304: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406368

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: b4adfc3f0f4b19c213d1a711131d711d9af4f575b66eeead30b066e316f5e6c0
Instruction ID: 5c1bd2d9329a739c8a877d318ed38f6c7ac4115b407851283e1fe7e546b0050a
Opcode Fuzzy Hash: b4adfc3f0f4b19c213d1a711131d711d9af4f575b66eeead30b066e316f5e6c0
Instruction Fuzzy Hash: 85E08C32A08210ABD7106B709D0493B72E89B85700302483EFE0AF2191D738EC21AAA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405B73 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00405B73(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x00405b77
0x00405b84
0x00405b99
0x00405b9f

APIs

GetFileAttributesA.KERNELBASE(00000003,00402E04,C:\Users\user\Desktop\DHLIN00178.exe,80000000,00000003), ref: 00405B77
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B99

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 3bf94be8ffed2da7c2b8ff60cd5efa52f63dfdc5f5010c3a9122643b4e997265
Instruction ID: 2f873e3f3c43f12a3908621a4267836d753c9203ad123c8b10a06e7f93ada197
Opcode Fuzzy Hash: 3bf94be8ffed2da7c2b8ff60cd5efa52f63dfdc5f5010c3a9122643b4e997265
Instruction Fuzzy Hash: C7D09E31658201EFEF098F20DD16F2EBBA2EB84B00F10962CB642944E0D6715815AB16

Uniqueness

Uniqueness Score: -1.00%

Function 00405B4E Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405B4E(CHAR* _a4) {
				signed char _t3;
				signed char _t7;

				_t3 = GetFileAttributesA(_a4); // executed
				_t7 = _t3;
				if(_t7 != 0xffffffff) {
					SetFileAttributesA(_a4, _t3 & 0x000000fe);
				}
				return _t7;
			}

0x00405b53
0x00405b59
0x00405b5e
0x00405b67
0x00405b67
0x00405b70

APIs

GetFileAttributesA.KERNELBASE(?,?,00405766,?,?,00000000,00405949,?,?,?,?), ref: 00405B53
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405B67

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 724933c4db900905a8c2715ee946fd38794509a16b0cd5d1c9e98f984372ebec
Instruction ID: bc9e1bfcb83978c8760ec7414183e34ad4d98f7a4e3f8d166b670055928ff6f8
Opcode Fuzzy Hash: 724933c4db900905a8c2715ee946fd38794509a16b0cd5d1c9e98f984372ebec
Instruction Fuzzy Hash: BCD01272908025AFC2102728EE0C89BBFA5DB543B17058B71FD65A22F0D7305C529AAA

Uniqueness

Uniqueness Score: -1.00%

Function 00405644 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405644(CHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryA(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x0040564a
0x00405652
0x00000000
0x00405658
0x00000000

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00403228,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 0040564A
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 00405658

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 6853200a5fdab59dd982fbc96a9ce2e8b021ac935e945b0af5f1b11de4538164
Instruction ID: fc3bbe6b068c7ca676e2af9f6a434936c7df2cd1c21a2d5f2b74ac8b5b27fed5
Opcode Fuzzy Hash: 6853200a5fdab59dd982fbc96a9ce2e8b021ac935e945b0af5f1b11de4538164
Instruction Fuzzy Hash: 0BC08C30688101AADA002B308D08B073A55AB20340F608836600AE00F0CA32A600DD3F

Uniqueness

Uniqueness Score: -1.00%

Function 72DD2A38 Relevance: 1.6, APIs: 1, Instructions: 143
fileCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E72DD2A38(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				void* _t28;
				void* _t29;
				void* _t33;
				void* _t37;
				void* _t40;
				void* _t45;
				void* _t49;
				signed int _t56;
				void* _t61;
				void* _t70;
				intOrPtr _t72;
				signed int _t77;
				intOrPtr _t79;
				intOrPtr _t80;
				void* _t81;
				void* _t87;
				void* _t88;
				void* _t89;
				void* _t90;
				intOrPtr _t93;
				intOrPtr _t94;

				if( *0x72dd4040 != 0 && E72DD297D(_a4) == 0) {
					 *0x72dd4044 = _t93;
					if( *0x72dd403c != 0) {
						_t93 =  *0x72dd403c;
					} else {
						E72DD2F60(E72DD2977(), __ecx);
						 *0x72dd403c = _t93;
					}
				}
				_t28 = E72DD29AB(_a4);
				_t94 = _t93 + 4;
				if(_t28 <= 0) {
					L9:
					_t29 = E72DD299F();
					_t72 = _a4;
					_t79 =  *0x72dd4048;
					 *((intOrPtr*)(_t29 + _t72)) = _t79;
					 *0x72dd4048 = _t72;
					E72DD2999();
					_t33 = CreateFileA(??, ??, ??, ??, ??, ??, ??); // executed
					 *0x72dd401c = _t33;
					 *0x72dd4020 = _t79;
					if( *0x72dd4040 != 0 && E72DD297D( *0x72dd4048) == 0) {
						 *0x72dd403c = _t94;
						_t94 =  *0x72dd4044;
					}
					_t80 =  *0x72dd4048;
					_a4 = _t80;
					 *0x72dd4048 =  *((intOrPtr*)(E72DD299F() + _t80));
					_t37 = E72DD298B(_t80);
					_pop(_t81);
					if(_t37 != 0) {
						_t40 = E72DD29AB(_t81);
						if(_t40 > 0) {
							_push(_t40);
							_push(E72DD29B6() + _a4 + _v8);
							_push(E72DD29C0());
							if( *0x72dd4040 <= 0 || E72DD297D(_a4) != 0) {
								_pop(_t88);
								_pop(_t45);
								__eflags =  *((intOrPtr*)(_t88 + _t45)) - 2;
								if(__eflags == 0) {
								}
								asm("loop 0xfffffff5");
							} else {
								_pop(_t89);
								_pop(_t49);
								 *0x72dd403c =  *0x72dd403c +  *(_t89 + _t49) * 4;
								asm("loop 0xffffffeb");
							}
						}
					}
					_t107 =  *0x72dd4048;
					if( *0x72dd4048 == 0) {
						 *0x72dd403c = 0;
					}
					E72DD29E4(_t107, _a4,  *0x72dd401c,  *0x72dd4020);
					return _a4;
				}
				_push(E72DD29B6() + _a4);
				_t56 = E72DD29BC();
				_v8 = _t56;
				_t77 = _t28;
				_push(_t68 + _t56 * _t77);
				_t70 = E72DD29C8();
				_t87 = E72DD29C4();
				_t90 = E72DD29C0();
				_t61 = _t77;
				if( *((intOrPtr*)(_t90 + _t61)) == 2) {
					_push( *((intOrPtr*)(_t70 + _t61)));
				}
				_push( *((intOrPtr*)(_t87 + _t61)));
				asm("loop 0xfffffff1");
				goto L9;
			}

0x72dd2a48
0x72dd2a59
0x72dd2a66
0x72dd2a7a
0x72dd2a68
0x72dd2a6d
0x72dd2a72
0x72dd2a72
0x72dd2a66
0x72dd2a83
0x72dd2a88
0x72dd2a8e
0x72dd2ad2
0x72dd2ad2
0x72dd2ad7
0x72dd2adc
0x72dd2ae2
0x72dd2ae4
0x72dd2aea
0x72dd2af7
0x72dd2af9
0x72dd2afe
0x72dd2b0b
0x72dd2b1e
0x72dd2b24
0x72dd2b2a
0x72dd2b2b
0x72dd2b31
0x72dd2b3d
0x72dd2b43
0x72dd2b4b
0x72dd2b4c
0x72dd2b4f
0x72dd2b5a
0x72dd2b5c
0x72dd2b68
0x72dd2b6e
0x72dd2b76
0x72dd2ba2
0x72dd2ba3
0x72dd2ba5
0x72dd2ba9
0x72dd2ba9
0x72dd2bb0
0x72dd2b86
0x72dd2b86
0x72dd2b87
0x72dd2b95
0x72dd2b9e
0x72dd2b9e
0x72dd2b76
0x72dd2b5a
0x72dd2bb2
0x72dd2bb9
0x72dd2bbb
0x72dd2bbb
0x72dd2bd4
0x72dd2be2
0x72dd2be2
0x72dd2a99
0x72dd2a9a
0x72dd2a9f
0x72dd2aa3
0x72dd2aa8
0x72dd2abc
0x72dd2abd
0x72dd2abe
0x72dd2ac0
0x72dd2ac5
0x72dd2ac7
0x72dd2ac7
0x72dd2aca
0x72dd2ad0
0x00000000

APIs

CreateFileA.KERNELBASE(00000000), ref: 72DD2AF7

Memory Dump Source

Source File: 00000000.00000002.843796267.0000000072DD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 72DD0000, based on PE: true

Associated: 00000000.00000002.843788448.0000000072DD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.843803253.0000000072DD3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.843809174.0000000072DD5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72dd0000_DHLIN00178.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5fd430f34f94f3f009ad7ebd594dafbafbfff0242620dd3f02f803bd9b5ee80c
Instruction ID: 61e255d6ef73414316c727a1987c2e25ff8ac893df68ec1a81e2d6fdd2c9a672
Opcode Fuzzy Hash: 5fd430f34f94f3f009ad7ebd594dafbafbfff0242620dd3f02f803bd9b5ee80c
Instruction Fuzzy Hash: BE417E73584A04DFDB21DFA9D88CB697B78EB04324F70886BE405E7346E6389481CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00402631 Relevance: 1.6, APIs: 1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402631(intOrPtr __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				intOrPtr _t27;
				intOrPtr _t33;
				void* _t38;
				void* _t41;

				_t33 = __edx;
				 *((intOrPtr*)(_t38 - 8)) = __ebx;
				_t27 = E00402B0A(2);
				_t41 = _t27 - 1;
				 *((intOrPtr*)(_t38 - 0x10)) = _t33;
				 *((intOrPtr*)(_t38 - 0xc)) = _t27;
				if(_t41 < 0) {
					L24:
					 *0x4237a8 =  *0x4237a8 +  *(_t38 - 4);
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *((intOrPtr*)(__ebp - 0xc)) = 0x3ff;
					}
					if( *__esi == __bl) {
						L21:
						__esi =  *((intOrPtr*)(__ebp - 8));
						goto L22;
					} else {
						 *((char*)(__ebp + 0xb)) = __bl;
						 *(__ebp - 0x1c) = E00405F51(__ecx, __esi);
						if( *((intOrPtr*)(__ebp - 0xc)) <= __ebx) {
							goto L21;
						} else {
							__esi =  *((intOrPtr*)(__ebp - 8));
							while(1) {
								__eax = __ebp - 0x15;
								__eax = E00405BEB( *(__ebp - 0x1c), __ebp - 0x15, 1); // executed
								if(__eax == 0) {
									break;
								}
								if( *((intOrPtr*)(__ebp - 0x28)) != __ebx) {
									 *(__ebp - 0x15) & 0x000000ff = E00405F38(__edi,  *(__ebp - 0x15) & 0x000000ff);
								} else {
									if( *((char*)(__ebp + 0xb)) == 0xd ||  *((char*)(__ebp + 0xb)) == 0xa) {
										__al =  *(__ebp - 0x15);
										if( *((intOrPtr*)(__ebp + 0xb)) == __al || __al != 0xd && __al != 0xa) {
											__eax = SetFilePointer( *(__ebp - 0x1c), 0xffffffff, __ebx, 1);
										} else {
											 *((char*)(__esi + __edi)) = __al;
											__esi = __esi + 1;
										}
										break;
									} else {
										__al =  *(__ebp - 0x15);
										 *((char*)(__esi + __edi)) = __al;
										__esi = __esi + 1;
										 *((char*)(__ebp + 0xb)) = __al;
										if(__al == __bl) {
											break;
										} else {
											if(__esi <  *((intOrPtr*)(__ebp - 0xc))) {
												continue;
											} else {
												break;
											}
										}
									}
								}
								goto L25;
							}
							L22:
							 *((char*)(__esi + __edi)) = __bl;
							if(_t41 == 0) {
								 *(_t38 - 4) = 1;
							}
							goto L24;
						}
					}
				}
				L25:
				return 0;
			}

0x00402631
0x00402633
0x00402636
0x0040263b
0x0040263f
0x00402642
0x00402645
0x004029b8
0x004029bb
0x0040264b
0x0040264b
0x00402652
0x00402654
0x00402654
0x00402659
0x004026e1
0x004026e1
0x00000000
0x0040265f
0x00402660
0x0040266b
0x0040266e
0x00000000
0x00402670
0x00402670
0x00402673
0x00402673
0x0040267c
0x00402683
0x00000000
0x00000000
0x00402688
0x004026b1
0x0040268a
0x0040268e
0x004026bb
0x004026c1
0x004026d9
0x004026cb
0x004026cb
0x004026ce
0x004026ce
0x00000000
0x00402696
0x00402696
0x00402699
0x0040269c
0x0040269f
0x004026a2
0x00000000
0x004026a4
0x004026a7
0x00000000
0x004026a9
0x00000000
0x004026a9
0x004026a7
0x004026a2
0x0040268e
0x00000000
0x00402688
0x004026e4
0x004026e4
0x004015b0
0x00402783
0x00402783
0x00000000
0x004015b0
0x0040266e
0x00402659
0x004029c1
0x004029c7

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: wsprintf
String ID:
API String ID: 2111968516-0
Opcode ID: 366e3e88ed94c459e0a2c565d96ad95acb986587cc084f2d6ef043885af1d26a
Instruction ID: 3a2c95f3f261f3e7b92da62a1208cffd6d7f8b014e901ac2ca999815bcbce589
Opcode Fuzzy Hash: 366e3e88ed94c459e0a2c565d96ad95acb986587cc084f2d6ef043885af1d26a
Instruction Fuzzy Hash: 2D21C770C0428AAADF219F644A456BFBB709B11318F14447FE891B63D1C1BD9981CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040166A Relevance: 1.5, APIs: 1, Instructions: 38
fileCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E0040166A() {
				int _t7;
				void* _t13;
				void* _t15;
				void* _t20;

				_t18 = E00402B2C(0xffffffd0);
				_t16 = E00402B2C(0xffffffdf);
				E00402B2C(0x13);
				_t7 = MoveFileA(_t4, _t5); // executed
				if(_t7 == 0) {
					if( *((intOrPtr*)(_t20 - 0x2c)) == _t13 || E004062DD(_t18) == 0) {
						 *((intOrPtr*)(_t20 - 4)) = 1;
					} else {
						E00405DB9(_t15, _t18, _t16);
						_push(0xffffffe4);
						goto L5;
					}
				} else {
					_push(0xffffffe3);
					L5:
					E00401423();
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t20 - 4));
				return 0;
			}

0x00401673
0x0040167c
0x0040167e
0x00401685
0x0040168d
0x00401699
0x00402783
0x004016ad
0x004016af
0x004016b4
0x00000000
0x004016b4
0x0040168f
0x0040168f
0x004022a4
0x004022a4
0x004022a4
0x004029bb
0x004029c7

APIs

MoveFileA.KERNEL32 ref: 00401685

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 72a301eb428ce366fab0a6ba72113071e0df53c1d82ea09ee4a171c26df99c33
Instruction ID: 640e453824712c844145895a5cc0ad612f484d8213667f841ebeaca416f2c8de
Opcode Fuzzy Hash: 72a301eb428ce366fab0a6ba72113071e0df53c1d82ea09ee4a171c26df99c33
Instruction Fuzzy Hash: 81F09031A08210A7CB117FBA9E4DD9F2AA49F42328B20027BB511B22D1D6BC850186AF

Uniqueness

Uniqueness Score: -1.00%

Function 004026EF Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E004026EF(intOrPtr __edx, void* __eflags) {
				long _t7;
				long _t9;
				LONG* _t11;
				void* _t13;
				intOrPtr _t14;
				void* _t17;
				void* _t19;

				_t14 = __edx;
				_push(ds);
				if(__eflags != 0) {
					_t7 = E00402B0A(2);
					_pop(_t13);
					 *((intOrPtr*)(_t19 - 0x10)) = _t14;
					_t9 = SetFilePointer(E00405F51(_t13, _t17), _t7, _t11,  *(_t19 - 0x28)); // executed
					if( *((intOrPtr*)(_t19 - 0x30)) >= _t11) {
						_push(_t9);
						E00405F38();
					}
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x004026ef
0x004026ef
0x004026f0
0x004026f8
0x004026fd
0x004026fe
0x0040270d
0x00402716
0x0040295e
0x00402960
0x00402960
0x00402716
0x004029bb
0x004029c7

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 0040270D

Part of subcall function 00405F38: wsprintfA.USER32 ref: 00405F45

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: a9d8ee2bd697c9ca0f2ad565d07bdf8e6e2528e0a7b3e3f739defcc45e62caf5
Instruction ID: f53dea761aa5693b03f4aeaa9096613f160725ff62c28ab2a383c2bfee997f34
Opcode Fuzzy Hash: a9d8ee2bd697c9ca0f2ad565d07bdf8e6e2528e0a7b3e3f739defcc45e62caf5
Instruction Fuzzy Hash: 5AE0EDB1A04215BBD702AB95AE89DBE776CEB44315F10043BF201F11C1C67D4941966E

Uniqueness

Uniqueness Score: -1.00%

Function 00405E8E Relevance: 1.5, APIs: 1, Instructions: 24
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E8E(void* __eflags, intOrPtr _a4, char* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E00405DE5(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegCreateKeyExA(_t7, _a8, 0, 0, 0, _a12, 0, _a16, 0); // executed
					return _t8;
				}
				_t9 = 6;
				return _t9;
			}

0x00405e98
0x00405ea1
0x00405eb7
0x00000000
0x00405eb7
0x00405ea5
0x00000000

APIs

RegCreateKeyExA.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402BDD,00000000,?,?), ref: 00405EB7

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c5562a190e42d8950a0f575b3a357be24d756bd6a7e1ac790deddfd4386432da
Instruction ID: 95beb03159e1ed36dc188c03c0911f4594c5194c551a9f11594fd4679c6f4357
Opcode Fuzzy Hash: c5562a190e42d8950a0f575b3a357be24d756bd6a7e1ac790deddfd4386432da
Instruction Fuzzy Hash: 23E0ECB2014109BEEF095F90ED0ADBB371DEB04315F00492EFA06E4090E7B5A920AA75

Uniqueness

Uniqueness Score: -1.00%

Function 00405C1A Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C1A(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405c1e
0x00405c2e
0x00405c36
0x00000000
0x00405c3d
0x00000000
0x00405c3f

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,00000020,?,004031B8,00000000,004128C0,00000020,004128C0,00000020,000000FF,00000004,00000000), ref: 00405C2E

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: c136fe23a15198738cdde8d9ae5bd390bad499becbb6fab094427491a2b8e812
Instruction ID: 28dd51bc99cbbe9e43bc3b4155210361b58306b45153a5fd00399a3e640b4bcc
Opcode Fuzzy Hash: c136fe23a15198738cdde8d9ae5bd390bad499becbb6fab094427491a2b8e812
Instruction Fuzzy Hash: 3AE0EC3261835AABEF249E559C01EEB7B6CEB05360F044472FD15E6150D231E8219FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405BEB Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405BEB(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405bef
0x00405bff
0x00405c07
0x00000000
0x00405c0e
0x00000000
0x00405c10

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004031EA,00000000,00000000,00403047,000000FF,00000004,00000000,00000000,00000000), ref: 00405BFF

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1302354f14da4ac18fdfad316f10263800e98e90a47707ba9ec6b51f8bbd6d6c
Instruction ID: 7d11c2845e787d99b8eae26fbbcce04266139d1862b3a193897eab19ac9c5e73
Opcode Fuzzy Hash: 1302354f14da4ac18fdfad316f10263800e98e90a47707ba9ec6b51f8bbd6d6c
Instruction Fuzzy Hash: 72E0E632558759ABDF106E559C00AEB775CEB45754F004832FE15E3150D231E8519BE9

Uniqueness

Uniqueness Score: -1.00%

Function 00405E60 Relevance: 1.5, APIs: 1, Instructions: 19
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E60(void* __eflags, intOrPtr _a4, char* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E00405DE5(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegOpenKeyExA(_t7, _a8, 0, _a12, _a16); // executed
					return _t8;
				}
				_t9 = 6;
				return _t9;
			}

0x00405e6a
0x00405e71
0x00405e84
0x00000000
0x00405e84
0x00405e75
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(00000000,?,00000000,?,?,?,?,?,00405EEE,?,?,?,?,00000002,Call), ref: 00405E84

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 688c0e3dac6200a4dcf5f70578aed2939ff3afbafb421f65443b8838c7a2b092
Instruction ID: 31d842323d9a2f535784a2c12e989c9eb1b9f9f44251d53ba3eec0f14c414acf
Opcode Fuzzy Hash: 688c0e3dac6200a4dcf5f70578aed2939ff3afbafb421f65443b8838c7a2b092
Instruction Fuzzy Hash: 75D0EC3204420DBADF115F90ED05FAB371DEB14355F004522FE05A4090D2769520AA55

Uniqueness

Uniqueness Score: -1.00%

Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040159D() {
				int _t5;
				void* _t11;
				int _t14;

				_t5 = SetFileAttributesA(E00402B2C(0xfffffff0),  *(_t11 - 0x30)); // executed
				_t14 = _t5;
				if(_t14 == 0) {
					 *((intOrPtr*)(_t11 - 4)) = 1;
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t11 - 4));
				return 0;
			}

0x004015a8
0x004015ae
0x004015b0
0x00402783
0x00402783
0x004029bb
0x004029c7

APIs

SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A8

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 52ed5338fe7084c51df6a432a079bc0890c4fcb1f0414dd7c874e83e8d0644f6
Instruction ID: d5005c83e4bc13d794db0995845c4037c46dc405a88debeb1123cd551caf7fcc
Opcode Fuzzy Hash: 52ed5338fe7084c51df6a432a079bc0890c4fcb1f0414dd7c874e83e8d0644f6
Instruction Fuzzy Hash: F5D05BB2B08200EBCB11DFE8EF08A5E77B5EB54325F204577E101F21D1D2B88641975A

Uniqueness

Uniqueness Score: -1.00%

Function 004040B4 Relevance: 1.5, APIs: 1, Instructions: 9
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004040B4(int _a4) {
				struct HWND__* _t2;
				long _t3;

				_t2 =  *0x422ed8; // 0x1043e
				if(_t2 != 0) {
					_t3 = SendMessageA(_t2, _a4, 0, 0); // executed
					return _t3;
				}
				return _t2;
			}

0x004040b4
0x004040bb
0x004040c6
0x00000000
0x004040c6
0x004040cc

APIs

SendMessageA.USER32(0001043E,00000000,00000000,00000000), ref: 004040C6

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 875450fc840247aea6e73403ee44149e02d5474b467ece0a28835bfda1230da9
Instruction ID: d19a9dbcf4508c1e9b2ca47d0762ffb16ec5c10abf7e35186d5f4f0c6b5da105
Opcode Fuzzy Hash: 875450fc840247aea6e73403ee44149e02d5474b467ece0a28835bfda1230da9
Instruction Fuzzy Hash: F9C04C71754201BAEA319B50DD49F0777586750B00F5584257314F60D1C6B4E451D62D

Uniqueness

Uniqueness Score: -1.00%

Function 004031ED Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004031ED(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x409018, _a4, 0, 0); // executed
				return _t2;
			}

0x004031fb
0x00403201

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402F89,?), ref: 004031FB

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 5ff25966693df5c3ccda7a99ea4025cbe7cf73b83d997e6322396513365c8623
Instruction ID: 8831d3de15784b4579c3d7b303db9b45d0c358e109056f74ce618eb3ecc3c243
Opcode Fuzzy Hash: 5ff25966693df5c3ccda7a99ea4025cbe7cf73b83d997e6322396513365c8623
Instruction Fuzzy Hash: 74B01231544200BFDB214F00DE05F057B21A790700F10C030B344780F082712460EB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040409D Relevance: 1.5, APIs: 1, Instructions: 6
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040409D(int _a4) {
				long _t2;

				_t2 = SendMessageA( *0x423708, 0x28, _a4, 1); // executed
				return _t2;
			}

0x004040ab
0x004040b1

APIs

SendMessageA.USER32(00000028,?,00000001,00403ECD), ref: 004040AB

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3bdb3c033a7d800f3f5983e71921b41162ac414239058931643885a1338ef954
Instruction ID: 7b5ccc39adf6f72de5191684d4495c6b43ffe58f78915606d69c4a7e6f44d702
Opcode Fuzzy Hash: 3bdb3c033a7d800f3f5983e71921b41162ac414239058931643885a1338ef954
Instruction Fuzzy Hash: F3B092B5684200BAEE224B40DD09F457EA2E7A4702F008024B300240B0C6B200A1DB19

Uniqueness

Uniqueness Score: -1.00%

Function 0040408A Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040408A(int _a4) {
				int _t2;

				_t2 = EnableWindow( *0x41fd04, _a4); // executed
				return _t2;
			}

0x00404094
0x0040409a

APIs

KiUserCallbackDispatcher.NTDLL(?,00403E66), ref: 00404094

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 12c11760972377b051275edfb0549e2da63da5a0a3d5c66f9a0e944dd115ee42
Instruction ID: 627edf876ec6fe827e8ded8b6e0f84c3e1bff33d3b07c91bc4a796ca35ff40dd
Opcode Fuzzy Hash: 12c11760972377b051275edfb0549e2da63da5a0a3d5c66f9a0e944dd115ee42
Instruction Fuzzy Hash: CAA00176808101ABCB029B50FF09D9ABF62ABA5705B028435E65694174C7325865FF1A

Uniqueness

Uniqueness Score: -1.00%

Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 19
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004014D6(intOrPtr __edx) {
				long _t3;
				void* _t7;
				intOrPtr _t10;
				void* _t13;

				_t10 = __edx;
				_t3 = E00402B0A(_t7);
				 *((intOrPtr*)(_t13 - 0x10)) = _t10;
				if(_t3 <= 1) {
					_t3 = 1;
				}
				Sleep(_t3); // executed
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t13 - 4));
				return 0;
			}

0x004014d6
0x004014d7
0x004014e0
0x004014e3
0x004014e7
0x004014e7
0x004014e9
0x004029bb
0x004029c7

APIs

Sleep.KERNELBASE(00000000), ref: 004014E9

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d9f52a12c88ee283977d5920e0d6ef8e8d30f27bfac36a8745942db4e2d1bc55
Instruction ID: 7b2de1959f7787123af4a7ca0670908521d01be6578697f59b2e727061aca9c4
Opcode Fuzzy Hash: d9f52a12c88ee283977d5920e0d6ef8e8d30f27bfac36a8745942db4e2d1bc55
Instruction Fuzzy Hash: CAD05EB3B142019BDB10DFB8AE8445F73F8E7503157604837D502F2191E2B8D9028668

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004044FA Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E004044FA(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				CHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				CHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				signed char* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed char _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				CHAR* _t146;
				intOrPtr _t147;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed char* _t160;
				struct HWND__* _t165;
				struct HWND__* _t166;
				int _t168;
				unsigned int _t197;
				void* _t205;

				_t156 = __edx;
				_t82 =  *0x41f4e0; // 0x63a064
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xa) + 0x424000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E004056DA(0x3fb, _t146);
					E00406244(_t146);
				}
				_t166 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E004056DA(0x3fb, _t146);
							if(E00405A60(_t185, _t146) == 0) {
								_v8 = 1;
							}
							E00405FDA(0x41ecd8, _t146);
							_t87 = E00406372(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E00405FDA(0x41ecd8, _t146);
								_t89 = E00405A0B(0x41ecd8);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 =  *_t89 & 0x00000000;
								}
								if(GetDiskFreeSpaceA(0x41ecd8,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t168 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x41ecd8) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x41ecd8,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E004059B9(0x41ecd8);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160 - 1;
									 *_t159 = 0x5c;
									if(_t159 != 0x41ecd8) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t168 = 0x400;
								L36:
								_t95 = E0040498E(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								_t147 =  *0x422edc; // 0x63baa6
								if( *((intOrPtr*)(_t147 + 0x10)) != _t158) {
									E00404976(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextA(_a4, _t168, 0x41ecc8);
									} else {
										E004048B1(_t168, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x4237c4 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t168) != 0) {
									_v8 = _t158;
								}
								E0040408A(0 | _v8 == _t158);
								if(_v8 == _t158) {
									_t205 =  *0x41fcf8 - _t158; // 0x0
									if(_t205 == 0) {
										E00404453();
									}
								}
								 *0x41fcf8 = _t158;
								goto L53;
							}
						}
						_t185 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t166;
							_v72 = 0x41fd08;
							_v60 = E0040484B;
							_v56 = _t146;
							_v68 = E00405FFC(_t146, 0x41fd08, _t166, 0x41f0e0, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderA(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405972(_t146);
								_t125 =  *((intOrPtr*)( *0x423714 + 0x11c));
								if( *((intOrPtr*)( *0x423714 + 0x11c)) != 0 && _t146 == "C:\\Users\\alfons\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto") {
									E00405FFC(_t146, 0x41fd08, _t166, 0, _t125);
									if(lstrcmpiA(0x4226a0, 0x41fd08) != 0) {
										lstrcatA(_t146, 0x4226a0);
									}
								}
								 *0x41fcf8 =  *0x41fcf8 + 1;
								SetDlgItemTextA(_t166, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					} else {
						_a8 = 0x40f;
						goto L12;
					}
				} else {
					_t165 = GetDlgItem(_t166, 0x3fb);
					if(E004059DF(_t146) != 0 && E00405A0B(_t146) == 0) {
						E00405972(_t146);
					}
					 *0x422ed8 = _t166;
					SetWindowTextA(_t165, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00404068(_t166);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00404068(_t166);
					E0040409D(_t165);
					_t138 = E00406372(7);
					if(_t138 == 0) {
						L53:
						return E004040CF(_a8, _a12, _a16);
					} else {
						 *_t138(_t165, 1);
						goto L8;
					}
				}
			}

0x004044fa
0x00404500
0x00404506
0x00404513
0x00404521
0x00404524
0x0040452c
0x00404532
0x00404532
0x0040453e
0x00404541
0x004045af
0x004045b6
0x0040468d
0x00404694
0x004046a3
0x004046a3
0x004046a7
0x004046b1
0x004046be
0x004046c0
0x004046c0
0x004046ce
0x004046d5
0x004046dc
0x004046df
0x00404716
0x00404718
0x0040471e
0x00404723
0x00404727
0x00404729
0x00404729
0x00404745
0x00000000
0x00404747
0x0040474a
0x00404758
0x0040475e
0x0040475f
0x00404762
0x00404765
0x00000000
0x00404765
0x004046e1
0x004046e3
0x004046e7
0x00000000
0x00000000
0x00000000
0x00000000
0x004046e9
0x004046e9
0x004046f6
0x004046fb
0x00000000
0x00000000
0x004046ff
0x00404701
0x00404701
0x00404709
0x0040470b
0x0040470e
0x00404711
0x00404714
0x00000000
0x00000000
0x00000000
0x00000000
0x00404714
0x00404771
0x0040477b
0x0040477e
0x00404781
0x00404788
0x00404788
0x0040478a
0x0040478a
0x0040478f
0x00404791
0x00404799
0x004047a0
0x004047a2
0x004047ad
0x004047ad
0x004047a2
0x004047b4
0x004047bd
0x004047c7
0x004047cf
0x004047ea
0x004047d1
0x004047da
0x004047da
0x004047cf
0x004047ef
0x004047f4
0x004047f9
0x00404802
0x00404802
0x0040480b
0x0040480d
0x0040480d
0x00404819
0x00404821
0x00404823
0x00404829
0x0040482b
0x0040482b
0x00404829
0x00404830
0x00000000
0x00404830
0x004046df
0x00404696
0x0040469d
0x00000000
0x00000000
0x00000000
0x0040469d
0x004045bc
0x004045c5
0x004045df
0x004045e4
0x004045ee
0x004045f5
0x00404601
0x00404604
0x00404607
0x0040460e
0x00404616
0x00404619
0x0040461d
0x00404624
0x0040462c
0x00404686
0x0040462e
0x0040462f
0x00404636
0x00404640
0x00404648
0x00404655
0x00404669
0x0040466d
0x0040466d
0x00404669
0x00404672
0x0040467f
0x0040467f
0x0040462c
0x00000000
0x004045e4
0x004045d2
0x00000000
0x004045d8
0x004045d8
0x00000000
0x004045d8
0x00404543
0x00404550
0x00404559
0x00404566
0x00404566
0x0040456d
0x00404573
0x0040457c
0x0040457f
0x00404582
0x0040458a
0x0040458d
0x00404590
0x00404596
0x0040459d
0x004045a4
0x00404836
0x00404848
0x004045aa
0x004045ad
0x00000000
0x004045ad
0x004045a4

APIs

GetDlgItem.USER32 ref: 00404549
SetWindowTextA.USER32(00000000,?), ref: 00404573
SHBrowseForFolderA.SHELL32(?,0041F0E0,?), ref: 00404624
CoTaskMemFree.OLE32(00000000), ref: 0040462F
lstrcmpiA.KERNEL32(Call,Sepad149: Installing,00000000,?,?), ref: 00404661
lstrcatA.KERNEL32(?,Call), ref: 0040466D
SetDlgItemTextA.USER32 ref: 0040467F

Part of subcall function 004056DA: GetDlgItemTextA.USER32 ref: 004056ED

Part of subcall function 00406244: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\DHLIN00178.exe",766DFA90,C:\Users\user\AppData\Local\Temp\,00000000,00403210,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 0040629C
Part of subcall function 00406244: CharNextA.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004062A9
Part of subcall function 00406244: CharNextA.USER32(?,"C:\Users\user\Desktop\DHLIN00178.exe",766DFA90,C:\Users\user\AppData\Local\Temp\,00000000,00403210,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 004062AE
Part of subcall function 00406244: CharPrevA.USER32(?,?,766DFA90,C:\Users\user\AppData\Local\Temp\,00000000,00403210,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 004062BE

GetDiskFreeSpaceA.KERNEL32(0041ECD8,?,?,0000040F,?,0041ECD8,0041ECD8,?,00000001,0041ECD8,?,?,000003FB,?), ref: 0040473D
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404758

Part of subcall function 004048B1: lstrlenA.KERNEL32(Sepad149: Installing,Sepad149: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004047CC,000000DF,00000000,00000400,?), ref: 0040494F
Part of subcall function 004048B1: wsprintfA.USER32 ref: 00404957
Part of subcall function 004048B1: SetDlgItemTextA.USER32 ref: 0040496A

Strings

Call, xrefs: 0040465B, 00404660, 0040466B
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto, xrefs: 0040464A
Sepad149: Installing, xrefs: 004045F7, 0040465A
A, xrefs: 0040461D

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto$Call$Sepad149: Installing
API String ID: 2624150263-1273059291
Opcode ID: 0f165c49e2d917f5e6a894268aac4f35a0a20fd2ca942178d6907e18a15d5205
Instruction ID: a574bab901635a86c0a25b0ea1efcbf713871747dcedb108b051a9d89a4042ab
Opcode Fuzzy Hash: 0f165c49e2d917f5e6a894268aac4f35a0a20fd2ca942178d6907e18a15d5205
Instruction Fuzzy Hash: E9A16FB1900219ABDB11EFA5CD41AAFB7B8EF85315F10843BF601B62D1D77C8A418F69

Uniqueness

Uniqueness Score: -1.00%

Function 00402765 Relevance: 1.5, APIs: 1, Instructions: 29
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E00402765(char __ebx, char* __edi, char* __esi) {
				void* _t19;

				if(FindFirstFileA(E00402B2C(2), _t19 - 0x1c8) != 0xffffffff) {
					E00405F38(__edi, _t6);
					_push(_t19 - 0x19c);
					_push(__esi);
					E00405FDA();
				} else {
					 *__edi = __ebx;
					 *__esi = __ebx;
					 *((intOrPtr*)(_t19 - 4)) = 1;
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x0040277d
0x00402791
0x0040279c
0x0040279d
0x004028d6
0x0040277f
0x0040277f
0x00402781
0x00402783
0x00402783
0x004029bb
0x004029c7

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402774

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 7aadfe7274229bb714756b7137abee653a08c846199b04a25fb503983604493c
Instruction ID: 2655497eb84a062ae037f6c25fa5e5de2408fe63ae01e39025771dd9bbe68540
Opcode Fuzzy Hash: 7aadfe7274229bb714756b7137abee653a08c846199b04a25fb503983604493c
Instruction Fuzzy Hash: 3BF0A0B2644101AAD701EBB49A49AEEB768EB11324F60417BE241F21C1D2BC89459B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00404A6D Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489
windowmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00404A6D(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				long _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed char* _v32;
				int _v36;
				signed int _v44;
				int _v48;
				signed int* _v60;
				signed char* _v64;
				signed int _v68;
				long _v72;
				void* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t203;
				void* _t205;
				intOrPtr _t206;
				intOrPtr _t208;
				long _t212;
				signed int _t216;
				signed int _t227;
				void* _t230;
				void* _t231;
				int _t237;
				long _t242;
				long _t243;
				signed int _t244;
				signed int _t250;
				signed int _t252;
				signed char _t253;
				signed char _t259;
				void* _t264;
				void* _t266;
				signed char* _t284;
				signed char _t285;
				long _t287;
				long _t290;
				void* _t291;
				signed int _t300;
				signed int _t308;
				void* _t309;
				void* _t310;
				signed char* _t316;
				int _t320;
				int _t321;
				signed int* _t322;
				int _t323;
				long _t324;
				signed int _t325;
				long _t327;
				int _t328;
				signed int _t329;
				void* _t331;

				_v12 = GetDlgItem(_a4, 0x3f9);
				_v8 = GetDlgItem(_a4, 0x408);
				_t331 = SendMessageA;
				_v24 =  *0x423748;
				_v28 =  *0x423714 + 0x94;
				_t320 = 0x10;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t298 = _a16;
					} else {
						_a12 = 0;
						_t298 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t298;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t298 + 4)) == 0x408) {
							if(( *0x42371d & 0x00000002) != 0) {
								L41:
								if(_v16 != 0) {
									_t242 = _v16;
									if( *((intOrPtr*)(_t242 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, 0,  *(_t242 + 0x5c));
									}
									_t243 = _v16;
									if( *((intOrPtr*)(_t243 + 8)) == 0xfffffe6a) {
										_t298 = _v24;
										_t244 =  *(_t243 + 0x5c);
										if( *((intOrPtr*)(_t243 + 0xc)) != 2) {
											 *(_t244 * 0x418 + _t298 + 8) =  *(_t244 * 0x418 + _t298 + 8) & 0xffffffdf;
										} else {
											 *(_t244 * 0x418 + _t298 + 8) =  *(_t244 * 0x418 + _t298 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t298 = 0 | _a8 != 0x00000413;
								_t250 = E004049BB(_v8, _a8 != 0x413);
								_t325 = _t250;
								if(_t325 >= 0) {
									_t99 = _v24 + 8; // 0x8
									_t298 = _t250 * 0x418 + _t99;
									_t252 =  *_t298;
									if((_t252 & 0x00000010) == 0) {
										if((_t252 & 0x00000040) == 0) {
											_t253 = _t252 ^ 0x00000001;
										} else {
											_t259 = _t252 ^ 0x00000080;
											if(_t259 >= 0) {
												_t253 = _t259 & 0x000000fe;
											} else {
												_t253 = _t259 | 0x00000001;
											}
										}
										 *_t298 = _t253;
										E0040117D(_t325);
										_a12 = _t325 + 1;
										_a16 =  !( *0x42371c) >> 0x00000008 & 0x00000001;
										_a8 = 0x40f;
									}
								}
								goto L41;
							}
							_t298 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageA(_v8, 0x200, 0, 0);
							}
							if(_a8 == 0x40b) {
								_t230 =  *0x41fcec; // 0x0
								if(_t230 != 0) {
									ImageList_Destroy(_t230);
								}
								_t231 =  *0x41fd00; // 0x0
								if(_t231 != 0) {
									GlobalFree(_t231);
								}
								 *0x41fcec = 0;
								 *0x41fd00 = 0;
								 *0x423780 = 0;
							}
							if(_a8 != 0x40f) {
								L88:
								if(_a8 == 0x420 && ( *0x42371d & 0x00000001) != 0) {
									_t321 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t321);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t321);
								}
								goto L91;
							} else {
								E004011EF(_t298, 0, 0);
								_t203 = _a12;
								if(_t203 != 0) {
									if(_t203 != 0xffffffff) {
										_t203 = _t203 - 1;
									}
									_push(_t203);
									_push(8);
									E00404A3B();
								}
								if(_a16 == 0) {
									L75:
									E004011EF(_t298, 0, 0);
									_t205 =  *0x41fd00; // 0x0
									_v36 = _t205;
									_t206 =  *0x423748;
									_v64 = 0xf030;
									_v24 = 0;
									if( *0x42374c <= 0) {
										L86:
										InvalidateRect(_v8, 0, 1);
										_t208 =  *0x422edc; // 0x63baa6
										if( *((intOrPtr*)(_t208 + 0x10)) != 0) {
											E00404976(0x3ff, 0xfffffffb, E0040498E(5));
										}
										goto L88;
									}
									_t322 = _t206 + 8;
									do {
										_t212 =  *((intOrPtr*)(_v36 + _v24 * 4));
										if(_t212 != 0) {
											_t300 =  *_t322;
											_v72 = _t212;
											_v76 = 8;
											if((_t300 & 0x00000001) != 0) {
												_v76 = 9;
												_v60 =  &(_t322[4]);
												_t322[0] = _t322[0] & 0x000000fe;
											}
											if((_t300 & 0x00000040) == 0) {
												_t216 = (_t300 & 0x00000001) + 1;
												if((_t300 & 0x00000010) != 0) {
													_t216 = _t216 + 3;
												}
											} else {
												_t216 = 3;
											}
											_v68 = (_t216 << 0x0000000b | _t300 & 0x00000008) + (_t216 << 0x0000000b | _t300 & 0x00000008) | _t300 & 0x00000020;
											SendMessageA(_v8, 0x1102, (_t300 >> 0x00000005 & 0x00000001) + 1, _v72);
											SendMessageA(_v8, 0x110d, 0,  &_v76);
										}
										_v24 = _v24 + 1;
										_t322 =  &(_t322[0x106]);
									} while (_v24 <  *0x42374c);
									goto L86;
								} else {
									_t323 = E004012E2( *0x41fd00);
									E00401299(_t323);
									_t227 = 0;
									_t298 = 0;
									if(_t323 <= 0) {
										L74:
										SendMessageA(_v12, 0x14e, _t298, 0);
										_a16 = _t323;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v28 + _t227 * 4)) != 0) {
											_t298 = _t298 + 1;
										}
										_t227 = _t227 + 1;
									} while (_t227 < _t323);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L91;
						} else {
							_t237 = SendMessageA(_v12, 0x147, 0, 0);
							if(_t237 == 0xffffffff) {
								goto L91;
							}
							_t324 = SendMessageA(_v12, 0x150, _t237, 0);
							if(_t324 == 0xffffffff ||  *((intOrPtr*)(_v28 + _t324 * 4)) == 0) {
								_t324 = 0x20;
							}
							E00401299(_t324);
							SendMessageA(_a4, 0x420, 0, _t324);
							_a12 = _a12 | 0xffffffff;
							_a16 = 0;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					_v36 = 0;
					 *0x423780 = _a4;
					_v20 = 2;
					 *0x41fd00 = GlobalAlloc(0x40,  *0x42374c << 2);
					_t264 = LoadImageA( *0x423700, 0x6e, 0, 0, 0, 0);
					 *0x41fcf4 =  *0x41fcf4 | 0xffffffff;
					_v16 = _t264;
					 *0x41fcfc = SetWindowLongA(_v8, 0xfffffffc, E00405075);
					_t266 = ImageList_Create(_t320, _t320, 0x21, 6, 0);
					 *0x41fcec = _t266;
					ImageList_AddMasked(_t266, _v16, 0xff00ff);
					SendMessageA(_v8, 0x1109, 2,  *0x41fcec);
					if(SendMessageA(_v8, 0x111c, 0, 0) < _t320) {
						SendMessageA(_v8, 0x111b, _t320, 0);
					}
					DeleteObject(_v16);
					_t327 = 0;
					do {
						_t272 =  *((intOrPtr*)(_v28 + _t327 * 4));
						if( *((intOrPtr*)(_v28 + _t327 * 4)) != 0) {
							if(_t327 != 0x20) {
								_v20 = 0;
							}
							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, 0, E00405FFC(0, _t327, _t331, 0, _t272)), _t327);
						}
						_t327 = _t327 + 1;
					} while (_t327 < 0x21);
					_t328 = _a16;
					_push( *((intOrPtr*)(_t328 + 0x30 + _v20 * 4)));
					_push(0x15);
					E00404068(_a4);
					_push( *((intOrPtr*)(_t328 + 0x34 + _v20 * 4)));
					_push(0x16);
					E00404068(_a4);
					_t329 = 0;
					_v16 = 0;
					if( *0x42374c <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t316 = _v24 + 8;
						_v32 = _t316;
						do {
							_t284 =  &(_t316[0x10]);
							if( *_t284 != 0) {
								_v64 = _t284;
								_t285 =  *_t316;
								_v88 = _v16;
								_t308 = 0x20;
								_v84 = 0xffff0002;
								_v80 = 0xd;
								_v68 = _t308;
								_v44 = _t329;
								_v72 = _t285 & _t308;
								if((_t285 & 0x00000002) == 0) {
									if((_t285 & 0x00000004) == 0) {
										_t287 = SendMessageA(_v8, 0x1100, 0,  &_v88);
										_t309 =  *0x41fd00; // 0x0
										 *(_t309 + _t329 * 4) = _t287;
									} else {
										_v16 = SendMessageA(_v8, 0x110a, 3, _v16);
									}
								} else {
									_v80 = 0x4d;
									_v48 = 1;
									_t290 = SendMessageA(_v8, 0x1100, 0,  &_v88);
									_t310 =  *0x41fd00; // 0x0
									_v36 = 1;
									 *(_t310 + _t329 * 4) = _t290;
									_t291 =  *0x41fd00; // 0x0
									_v16 =  *(_t291 + _t329 * 4);
								}
							}
							_t329 = _t329 + 1;
							_t316 =  &(_v32[0x418]);
							_v32 = _t316;
						} while (_t329 <  *0x42374c);
						if(_v36 != 0) {
							L20:
							if(_v20 != 0) {
								E0040409D(_v8);
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E0040409D(_v12);
								L91:
								return E004040CF(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x00404a8b
0x00404a93
0x00404a9b
0x00404aa1
0x00404ab9
0x00404abc
0x00404abd
0x00404cea
0x00404cf1
0x00404d05
0x00404cf3
0x00404cf5
0x00404cf8
0x00404cf9
0x00404d00
0x00404d00
0x00404d11
0x00404d1f
0x00404d22
0x00404d38
0x00404dad
0x00404db0
0x00404db2
0x00404dbc
0x00404dca
0x00404dca
0x00404dcc
0x00404dd6
0x00404ddc
0x00404ddf
0x00404de2
0x00404dfd
0x00404de4
0x00404dee
0x00404dee
0x00404de2
0x00404dd6
0x00000000
0x00404db0
0x00404d3d
0x00404d48
0x00404d4d
0x00404d54
0x00404d59
0x00404d5d
0x00404d68
0x00404d68
0x00404d6c
0x00404d70
0x00404d74
0x00404d87
0x00404d76
0x00404d76
0x00404d7d
0x00404d83
0x00404d7f
0x00404d7f
0x00404d7f
0x00404d7d
0x00404d8b
0x00404d8d
0x00404da0
0x00404da3
0x00404da6
0x00404da6
0x00404d70
0x00000000
0x00404d5d
0x00404d3f
0x00404d46
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404e00
0x00404e00
0x00404e07
0x00404e78
0x00404e80
0x00404e88
0x00404e88
0x00404e91
0x00404e93
0x00404e9a
0x00404e9d
0x00404e9d
0x00404ea3
0x00404eaa
0x00404ead
0x00404ead
0x00404eb3
0x00404eb9
0x00404ebf
0x00404ebf
0x00404ecc
0x00405022
0x00405029
0x00405046
0x0040504c
0x0040505e
0x0040505e
0x00000000
0x00404ed2
0x00404ed4
0x00404ed9
0x00404ede
0x00404ee3
0x00404ee5
0x00404ee5
0x00404ee6
0x00404ee7
0x00404ee9
0x00404ee9
0x00404ef1
0x00404f32
0x00404f34
0x00404f39
0x00404f44
0x00404f47
0x00404f4c
0x00404f53
0x00404f56
0x00404ff8
0x00404ffe
0x00405004
0x0040500c
0x0040501d
0x0040501d
0x00000000
0x0040500c
0x00404f5c
0x00404f5f
0x00404f65
0x00404f6a
0x00404f6c
0x00404f6e
0x00404f74
0x00404f7b
0x00404f80
0x00404f87
0x00404f8a
0x00404f8a
0x00404f91
0x00404f9d
0x00404fa1
0x00404fa3
0x00404fa3
0x00404f93
0x00404f95
0x00404f95
0x00404fc3
0x00404fcf
0x00404fde
0x00404fde
0x00404fe0
0x00404fe3
0x00404fec
0x00000000
0x00404ef3
0x00404efe
0x00404f01
0x00404f06
0x00404f08
0x00404f0c
0x00404f1c
0x00404f26
0x00404f28
0x00404f2b
0x00000000
0x00000000
0x00000000
0x00000000
0x00404f0e
0x00404f0e
0x00404f14
0x00404f16
0x00404f16
0x00404f17
0x00404f18
0x00000000
0x00404f0e
0x00404ef1
0x00404ecc
0x00404e0f
0x00000000
0x00404e25
0x00404e2f
0x00404e34
0x00000000
0x00000000
0x00404e46
0x00404e4b
0x00404e57
0x00404e57
0x00404e59
0x00404e68
0x00404e6a
0x00404e6e
0x00404e71
0x00000000
0x00404e71
0x00404e0f
0x00404ac3
0x00404ac6
0x00404ac9
0x00404ad9
0x00404aec
0x00404af7
0x00404afd
0x00404b0b
0x00404b1e
0x00404b23
0x00404b2e
0x00404b37
0x00404b4d
0x00404b5d
0x00404b69
0x00404b69
0x00404b6e
0x00404b74
0x00404b76
0x00404b79
0x00404b7e
0x00404b83
0x00404b85
0x00404b85
0x00404ba5
0x00404ba5
0x00404ba7
0x00404ba8
0x00404bad
0x00404bb3
0x00404bb7
0x00404bbc
0x00404bc4
0x00404bc8
0x00404bcd
0x00404bd2
0x00404bda
0x00404bdd
0x00404cac
0x00404cbf
0x00000000
0x00404be3
0x00404be6
0x00404be9
0x00404bec
0x00404bec
0x00404bf1
0x00404bfa
0x00404bfd
0x00404c01
0x00404c04
0x00404c07
0x00404c10
0x00404c19
0x00404c1c
0x00404c1f
0x00404c22
0x00404c60
0x00404c83
0x00404c85
0x00404c8b
0x00404c62
0x00404c71
0x00404c71
0x00404c24
0x00404c27
0x00404c35
0x00404c3f
0x00404c41
0x00404c47
0x00404c4e
0x00404c51
0x00404c59
0x00404c59
0x00404c22
0x00404c91
0x00404c92
0x00404c9e
0x00404c9e
0x00404caa
0x00404cc5
0x00404cc8
0x00404ce5
0x00000000
0x00404cca
0x00404ccf
0x00404cd8
0x00405060
0x00405072
0x00405072
0x00404cc8
0x00000000
0x00404caa
0x00404bdd

APIs

GetDlgItem.USER32 ref: 00404A84
GetDlgItem.USER32 ref: 00404A91
GlobalAlloc.KERNEL32(00000040,?), ref: 00404AE0
LoadImageA.USER32 ref: 00404AF7
SetWindowLongA.USER32 ref: 00404B11
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404B23
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404B37
SendMessageA.USER32(?,00001109,00000002), ref: 00404B4D
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404B59
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404B69
DeleteObject.GDI32(00000110), ref: 00404B6E
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404B99
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404BA5
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C3F
SendMessageA.USER32(?,0000110A,00000003,00000110), ref: 00404C6F

Part of subcall function 0040409D: SendMessageA.USER32(00000028,?,00000001,00403ECD), ref: 004040AB

SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C83
GetWindowLongA.USER32 ref: 00404CB1
SetWindowLongA.USER32 ref: 00404CBF
ShowWindow.USER32(?,00000005), ref: 00404CCF
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404DCA
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404E2F
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404E44
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404E68
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404E88
ImageList_Destroy.COMCTL32(00000000), ref: 00404E9D
GlobalFree.KERNEL32 ref: 00404EAD
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404F26
SendMessageA.USER32(?,00001102,?,?), ref: 00404FCF
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404FDE
InvalidateRect.USER32(?,00000000,00000001), ref: 00404FFE
ShowWindow.USER32(?,00000000), ref: 0040504C
GetDlgItem.USER32 ref: 00405057
ShowWindow.USER32(00000000), ref: 0040505E

Strings

, xrefs: 00405036
N, xrefs: 00404D08
M, xrefs: 00404C27

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 6c91a6865aeac2cc1bc81da0427ec232e576c845fbda25fe1dd31a6c378936cd
Instruction ID: 966653e8360bab3e2fc21879108ab338c3bc3285e0cd99f232f5bc98bb3d6c0f
Opcode Fuzzy Hash: 6c91a6865aeac2cc1bc81da0427ec232e576c845fbda25fe1dd31a6c378936cd
Instruction Fuzzy Hash: 86025CB0900209AFDB10DF64DC45AAE7BB9FB84314F10813AFA15BA2E0D7799E41DF58

Uniqueness

Uniqueness Score: -1.00%

Function 004041D3 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004041D3(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				intOrPtr _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t103;
				signed int _t106;
				intOrPtr _t107;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L11:
						__eflags = _a8 - 0x4e;
						if(_a8 != 0x4e) {
							__eflags = _a8 - 0x40b;
							if(_a8 == 0x40b) {
								 *0x41ecd4 =  *0x41ecd4 + 1;
								__eflags =  *0x41ecd4;
							}
							L25:
							_t110 = _a16;
							L26:
							return E004040CF(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						__eflags =  *((intOrPtr*)(_t110 + 8)) - 0x70b;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b) {
							__eflags =  *((intOrPtr*)(_t110 + 0xc)) - 0x201;
							if( *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
								_t100 =  *((intOrPtr*)(_t110 + 0x1c));
								_t109 =  *((intOrPtr*)(_t110 + 0x18));
								_v12 = _t100;
								__eflags = _t100 - _t109 - 0x800;
								_v16 = _t109;
								_v8 = 0x4226a0;
								if(_t100 - _t109 < 0x800) {
									SendMessageA(_t52, 0x44b, 0,  &_v16);
									SetCursor(LoadCursorA(0, 0x7f02));
									_push(1);
									E00404477(_a4, _v8);
									SetCursor(LoadCursorA(0, 0x7f00));
									_t110 = _a16;
								}
							}
						}
						__eflags =  *((intOrPtr*)(_t110 + 8)) - 0x700;
						if( *((intOrPtr*)(_t110 + 8)) != 0x700) {
							goto L26;
						} else {
							__eflags =  *((intOrPtr*)(_t110 + 0xc)) - 0x100;
							if( *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
								goto L26;
							}
							__eflags =  *((intOrPtr*)(_t110 + 0x10)) - 0xd;
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x423708, 0x111, 1, 0);
							}
							__eflags =  *((intOrPtr*)(_t110 + 0x10)) - 0x1b;
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x423708, 0x10, 0, 0);
							}
							return 1;
						}
					}
					__eflags = _a12 >> 0x10;
					if(_a12 >> 0x10 != 0) {
						goto L25;
					}
					__eflags =  *0x41ecd4; // 0x0
					if(__eflags != 0) {
						goto L25;
					}
					_t103 =  *0x41f4e0; // 0x63a064
					_t25 = _t103 + 0x14; // 0x63a078
					_t112 = _t25;
					__eflags =  *_t112 & 0x00000020;
					if(( *_t112 & 0x00000020) == 0) {
						goto L25;
					}
					_t106 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
					__eflags = _t106;
					 *_t112 = _t106;
					E0040408A(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
					E00404453();
					goto L11;
				} else {
					_t98 = _a16;
					_t113 =  *(_t98 + 0x30);
					if(_t113 < 0) {
						_t107 =  *0x422edc; // 0x63baa6
						_t113 =  *(_t107 - 4 + _t113 * 4);
					}
					_push( *((intOrPtr*)(_t98 + 0x34)));
					_t114 = _t113 +  *0x423758;
					_push(0x22);
					_a16 =  *_t114;
					_v12 = _v12 & 0x00000000;
					_t115 = _t114 + 1;
					_v16 = _t115;
					_v8 = E0040419E;
					E00404068(_a4);
					_push( *((intOrPtr*)(_t98 + 0x38)));
					_push(0x23);
					E00404068(_a4);
					CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
					E0040408A( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
					_t99 = GetDlgItem(_a4, 0x3e8);
					E0040409D(_t99);
					SendMessageA(_t99, 0x45b, 1, 0);
					_t86 =  *( *0x423714 + 0x68);
					if(_t86 < 0) {
						_t86 = GetSysColor( ~_t86);
					}
					SendMessageA(_t99, 0x443, 0, _t86);
					SendMessageA(_t99, 0x445, 0, 0x4010000);
					SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
					 *0x41ecd4 = 0;
					SendMessageA(_t99, 0x449, _a16,  &_v16);
					 *0x41ecd4 = 0;
					return 0;
				}
			}

0x004041e3
0x004042f5
0x00404308
0x00404364
0x00404364
0x00404368
0x0040442e
0x00404435
0x00404437
0x00404437
0x00404437
0x0040443d
0x0040443d
0x00404440
0x00000000
0x00404447
0x00404376
0x00404378
0x0040437b
0x00404382
0x00404384
0x0040438b
0x0040438d
0x00404390
0x00404393
0x00404398
0x0040439e
0x004043a1
0x004043a8
0x004043b6
0x004043ce
0x004043d0
0x004043d8
0x004043e7
0x004043e9
0x004043e9
0x004043a8
0x0040438b
0x004043ec
0x004043f3
0x00000000
0x004043f5
0x004043f5
0x004043fc
0x00000000
0x00000000
0x004043fe
0x00404402
0x00404413
0x00404413
0x00404415
0x00404419
0x00404427
0x00404427
0x00000000
0x0040442b
0x004043f3
0x00404310
0x00404313
0x00000000
0x00000000
0x0040431b
0x00404321
0x00000000
0x00000000
0x00404327
0x0040432d
0x0040432d
0x00404330
0x00404333
0x00000000
0x00000000
0x00404356
0x00404356
0x00404358
0x0040435a
0x0040435f
0x00000000
0x004041e9
0x004041e9
0x004041ec
0x004041f1
0x004041f3
0x00404202
0x00404202
0x00404209
0x0040420c
0x0040420e
0x00404213
0x0040421c
0x00404222
0x0040422e
0x00404231
0x0040423a
0x0040423f
0x00404242
0x00404247
0x0040425e
0x00404265
0x00404278
0x0040427b
0x00404290
0x00404297
0x0040429c
0x004042a1
0x004042a1
0x004042b0
0x004042bf
0x004042d1
0x004042d6
0x004042e6
0x004042e8
0x00000000
0x004042ee

APIs

CheckDlgButton.USER32 ref: 0040425E
GetDlgItem.USER32 ref: 00404272
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 00404290
GetSysColor.USER32(?), ref: 004042A1
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 004042B0
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 004042BF
lstrlenA.KERNEL32(?), ref: 004042C2
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004042D1
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004042E6
GetDlgItem.USER32 ref: 00404348
SendMessageA.USER32(00000000), ref: 0040434B
GetDlgItem.USER32 ref: 00404376
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004043B6
LoadCursorA.USER32 ref: 004043C5
SetCursor.USER32(00000000), ref: 004043CE
LoadCursorA.USER32 ref: 004043E4
SetCursor.USER32(00000000), ref: 004043E7
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404413
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404427

Strings

N, xrefs: 00404364
Call, xrefs: 004043A1

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: aedf8a6b2f60594d9aa2a20867b53785746c99fe12f07fbfb1ee765dbd043f7e
Instruction ID: a86fe1b261e308fa50e110e5a31abfd90c360c5de8850f7aae14d0f145b03158
Opcode Fuzzy Hash: aedf8a6b2f60594d9aa2a20867b53785746c99fe12f07fbfb1ee765dbd043f7e
Instruction Fuzzy Hash: 1561A0B1A00209BBEB109F61DD45F6A7B69FB84705F008036FB01BA2D1C7B8A951CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x423714;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, 0x422f00, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x423708;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00422F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a5e12e9d17b50a3f423cea0afacbb368398e6ec861f9ad0eaee1311db9104a5d
Instruction ID: e0713781b635691343a74aeb4589e3ea90c77733c460a74728c978b7faf409cc
Opcode Fuzzy Hash: a5e12e9d17b50a3f423cea0afacbb368398e6ec861f9ad0eaee1311db9104a5d
Instruction Fuzzy Hash: A7419C71804249AFCF058FA4CD459BFBFB9FF44310F00812AF561AA2A0C738AA50DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405C49 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 129
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C49(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t12;
				long _t24;
				char* _t31;
				int _t37;
				void* _t38;
				intOrPtr* _t39;
				long _t42;
				CHAR* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t52;
				void* _t53;

				_t38 = __ecx;
				_t44 =  *(_t52 + 0x14);
				 *0x421a98 = 0x4c554e;
				if(_t44 == 0) {
					L3:
					_t12 = GetShortPathNameA( *(_t52 + 0x1c), 0x421e98, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						_t37 = wsprintfA(0x421698, "%s=%s\r\n", 0x421a98, 0x421e98);
						_t53 = _t52 + 0x10;
						E00405FFC(_t37, 0x400, 0x421e98, 0x421e98,  *((intOrPtr*)( *0x423714 + 0x128)));
						_t12 = E00405B73(0x421e98, 0xc0000000, 4);
						_t48 = _t12;
						 *(_t53 + 0x18) = _t48;
						if(_t48 != 0xffffffff) {
							_t42 = GetFileSize(_t48, 0);
							_t6 = _t37 + 0xa; // 0xa
							_t46 = GlobalAlloc(0x40, _t42 + _t6);
							if(_t46 == 0 || E00405BEB(_t48, _t46, _t42) == 0) {
								L18:
								return CloseHandle(_t48);
							} else {
								if(E00405AD8(_t38, _t46, "[Rename]\r\n") != 0) {
									_t49 = E00405AD8(_t38, _t21 + 0xa, 0x4093b8);
									if(_t49 == 0) {
										_t48 =  *(_t53 + 0x18);
										L16:
										_t24 = _t42;
										L17:
										E00405B2E(_t24 + _t46, 0x421698, _t37);
										SetFilePointer(_t48, 0, 0, 0);
										E00405C1A(_t48, _t46, _t42 + _t37);
										GlobalFree(_t46);
										goto L18;
									}
									_t39 = _t46 + _t42;
									_t31 = _t39 + _t37;
									while(_t39 > _t49) {
										 *_t31 =  *_t39;
										_t31 = _t31 - 1;
										_t39 = _t39 - 1;
									}
									_t24 = _t49 - _t46 + 1;
									_t48 =  *(_t53 + 0x18);
									goto L17;
								}
								lstrcpyA(_t46 + _t42, "[Rename]\r\n");
								_t42 = _t42 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E00405B73(_t44, 0, 1));
					_t12 = GetShortPathNameA(_t44, 0x421a98, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						goto L3;
					}
				}
				return _t12;
			}

0x00405c49
0x00405c52
0x00405c59
0x00405c6d
0x00405c95
0x00405ca0
0x00405ca4
0x00405cc4
0x00405ccb
0x00405cd5
0x00405ce2
0x00405ce7
0x00405cec
0x00405cf0
0x00405cff
0x00405d01
0x00405d0e
0x00405d12
0x00405dad
0x00000000
0x00405d28
0x00405d35
0x00405d59
0x00405d5d
0x00405d7c
0x00405d80
0x00405d80
0x00405d82
0x00405d8b
0x00405d96
0x00405da1
0x00405da7
0x00000000
0x00405da7
0x00405d5f
0x00405d62
0x00405d6d
0x00405d69
0x00405d6b
0x00405d6c
0x00405d6c
0x00405d74
0x00405d76
0x00000000
0x00405d76
0x00405d40
0x00405d46
0x00000000
0x00405d46
0x00405d12
0x00405cf0
0x00405c6f
0x00405c7a
0x00405c83
0x00405c87
0x00000000
0x00000000
0x00405c87
0x00405db8

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00405DDA,?,?), ref: 00405C7A
GetShortPathNameA.KERNEL32 ref: 00405C83

Part of subcall function 00405AD8: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D33,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405AE8
Part of subcall function 00405AD8: lstrlenA.KERNEL32(00000000,?,00000000,00405D33,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B1A

GetShortPathNameA.KERNEL32 ref: 00405CA0
wsprintfA.USER32 ref: 00405CBE
GetFileSize.KERNEL32(00000000,00000000,00421E98,C0000000,00000004,00421E98,?,?,?,?,?), ref: 00405CF9
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405D08
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D40
SetFilePointer.KERNEL32(004093B8,00000000,00000000,00000000,00000000,00421698,00000000,-0000000A,004093B8,00000000,[Rename],00000000,00000000,00000000), ref: 00405D96
GlobalFree.KERNEL32 ref: 00405DA7
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405DAE

Part of subcall function 00405B73: GetFileAttributesA.KERNELBASE(00000003,00402E04,C:\Users\user\Desktop\DHLIN00178.exe,80000000,00000003), ref: 00405B77
Part of subcall function 00405B73: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B99

Strings

[Rename], xrefs: 00405D28, 00405D3A
%s=%s, xrefs: 00405CB4

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %s=%s$[Rename]
API String ID: 2171350718-1727408572
Opcode ID: 442663d250bfdbc290f8e971c6720eb5308fb07ccd41dbdaaacc117d0e8b41e7
Instruction ID: 6ce2b9c5035192946699426d8eaee961ce023100f281e1c8236941499ee81097
Opcode Fuzzy Hash: 442663d250bfdbc290f8e971c6720eb5308fb07ccd41dbdaaacc117d0e8b41e7
Instruction Fuzzy Hash: 19311331605B19ABD6207B659C4CFAB3A6CDF45714F14003BFA01FA2D2E67CA8018EBD

Uniqueness

Uniqueness Score: -1.00%

Function 72DD24D8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E72DD24D8(intOrPtr* _a4) {
				char _v80;
				int _v84;
				intOrPtr _v88;
				short _v92;
				intOrPtr* _t28;
				void* _t30;
				intOrPtr _t31;
				signed int _t43;
				void* _t44;
				intOrPtr _t45;
				void* _t48;

				_t44 = E72DD1215();
				_t28 = _a4;
				_t45 =  *((intOrPtr*)(_t28 + 0x814));
				_v88 = _t45;
				_t48 = (_t45 + 0x41 << 5) + _t28;
				do {
					if( *((intOrPtr*)(_t48 - 4)) >= 0) {
					}
					_t43 =  *(_t48 - 8) & 0x000000ff;
					if(_t43 <= 7) {
						switch( *((intOrPtr*)(_t43 * 4 +  &M72DD2626))) {
							case 0:
								 *_t44 = 0;
								goto L17;
							case 1:
								__eax =  *__eax;
								if(__ecx > __ebx) {
									_v84 = __ecx;
									__ecx =  *(0x72dd307c + __edx * 4);
									__edx = _v84;
									__ecx = __ecx * __edx;
									asm("sbb edx, edx");
									__edx = __edx & __ecx;
									__eax = __eax &  *(0x72dd309c + __edx * 4);
								}
								_push(__eax);
								goto L15;
							case 2:
								__eax = E72DD1429(__edx,  *__eax,  *((intOrPtr*)(__eax + 4)), __edi);
								goto L16;
							case 3:
								__eax = lstrcpynA(__edi,  *__eax,  *0x72dd405c);
								goto L17;
							case 4:
								__ecx =  *0x72dd405c;
								__edx = __ecx - 1;
								__eax = WideCharToMultiByte(__ebx, __ebx,  *__eax, __ecx, __edi, __edx, __ebx, __ebx);
								__eax =  *0x72dd405c;
								 *((char*)(__eax + __edi - 1)) = __bl;
								goto L17;
							case 5:
								__ecx =  &_v80;
								_push(0x27);
								_push(__ecx);
								_push( *__eax);
								__imp__StringFromGUID2();
								__eax =  &_v92;
								__eax = WideCharToMultiByte(__ebx, __ebx,  &_v92,  &_v92, __edi,  *0x72dd405c, __ebx, __ebx);
								goto L17;
							case 6:
								_push( *__esi);
								L15:
								__eax = wsprintfA(__edi, 0x72dd4000);
								L16:
								__esp = __esp + 0xc;
								goto L17;
						}
					}
					L17:
					_t30 =  *(_t48 + 0x14);
					if(_t30 != 0 && ( *_a4 != 2 ||  *((intOrPtr*)(_t48 - 4)) > 0)) {
						GlobalFree(_t30);
					}
					_t31 =  *((intOrPtr*)(_t48 + 0xc));
					if(_t31 != 0) {
						if(_t31 != 0xffffffff) {
							if(_t31 > 0) {
								E72DD12D1(_t31 - 1, _t44);
								goto L26;
							}
						} else {
							E72DD1266(_t44);
							L26:
						}
					}
					_v88 = _v88 - 1;
					_t48 = _t48 - 0x20;
				} while (_v88 >= 0);
				return GlobalFree(_t44);
			}

0x72dd24e4
0x72dd24e6
0x72dd24f0
0x72dd24f6
0x72dd2500
0x72dd2504
0x72dd2509
0x72dd2509
0x72dd2511
0x72dd2518
0x72dd251e
0x00000000
0x72dd2525
0x00000000
0x00000000
0x72dd252c
0x72dd2530
0x72dd2533
0x72dd2537
0x72dd253e
0x72dd2542
0x72dd2548
0x72dd254a
0x72dd254c
0x72dd254c
0x72dd2553
0x00000000
0x00000000
0x72dd255c
0x00000000
0x00000000
0x72dd256c
0x00000000
0x00000000
0x72dd2598
0x72dd25a0
0x72dd25aa
0x72dd25ac
0x72dd25b1
0x00000000
0x00000000
0x72dd2574
0x72dd2578
0x72dd257a
0x72dd257b
0x72dd257d
0x72dd258d
0x72dd2594
0x00000000
0x00000000
0x72dd25b7
0x72dd25b9
0x72dd25bf
0x72dd25c5
0x72dd25c5
0x00000000
0x00000000
0x72dd251e
0x72dd25c8
0x72dd25c8
0x72dd25cd
0x72dd25de
0x72dd25de
0x72dd25e4
0x72dd25e9
0x72dd25ee
0x72dd25fa
0x72dd25ff
0x00000000
0x72dd2604
0x72dd25f0
0x72dd25f1
0x72dd2605
0x72dd2605
0x72dd25ee
0x72dd2606
0x72dd260a
0x72dd260d
0x72dd2625

APIs

Part of subcall function 72DD1215: GlobalAlloc.KERNEL32(00000040,72DD1233,?,72DD12CF,-72DD404B,72DD11AB,-000000A0), ref: 72DD121D

GlobalFree.KERNEL32 ref: 72DD25DE
GlobalFree.KERNEL32 ref: 72DD2618

Strings

{v@uv, xrefs: 72DD257D

Memory Dump Source

Source File: 00000000.00000002.843796267.0000000072DD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 72DD0000, based on PE: true

Associated: 00000000.00000002.843788448.0000000072DD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.843803253.0000000072DD3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.843809174.0000000072DD5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72dd0000_DHLIN00178.jbxd

Similarity

API ID: Global$Free$Alloc
String ID: {v@uv
API String ID: 1780285237-3152101019
Opcode ID: efcb4a89d12ac99ef9b3aa35357725c43a90aebb5478a6000371fe6c8fc709c6
Instruction ID: 0047a85408892c0ac88b0e78e66b74e2ecb122f3cfaf0454aa01f4e33fb113b9
Opcode Fuzzy Hash: efcb4a89d12ac99ef9b3aa35357725c43a90aebb5478a6000371fe6c8fc709c6
Instruction Fuzzy Hash: 2E41BD72544A40EFD3028F58CCA8E3A7BBAEB85314B60496FF542A6201E735A904DF61

Uniqueness

Uniqueness Score: -1.00%

Function 72DD22F1 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E72DD22F1(void* __edx, intOrPtr _a4) {
				signed int _v4;
				signed int _v8;
				void* _t38;
				signed int _t39;
				void* _t40;
				void* _t43;
				void* _t48;
				signed int* _t50;
				signed char* _t51;

				_v8 = 0 |  *((intOrPtr*)(_a4 + 0x814)) > 0x00000000;
				while(1) {
					_t9 = _a4 + 0x818; // 0x818
					_t51 = (_v8 << 5) + _t9;
					_t38 = _t51[0x18];
					if(_t38 == 0) {
						goto L9;
					}
					_t48 = 0x1a;
					if(_t38 == _t48) {
						goto L9;
					}
					if(_t38 != 0xffffffff) {
						if(_t38 <= 0 || _t38 > 0x19) {
							_t51[0x18] = _t48;
						} else {
							_t38 = E72DD12AD(_t38 - 1);
							L10:
						}
						goto L11;
					} else {
						_t38 = E72DD123B();
						L11:
						_t43 = _t38;
						_t13 =  &(_t51[8]); // 0x820
						_t50 = _t13;
						if(_t51[4] >= 0) {
						}
						_t39 =  *_t51 & 0x000000ff;
						_t51[0x1c] = _t51[0x1c] & 0x00000000;
						_v4 = _t39;
						if(_t39 > 7) {
							L27:
							_t40 = GlobalFree(_t43);
							if(_v8 == 0) {
								return _t40;
							}
							if(_v8 !=  *((intOrPtr*)(_a4 + 0x814))) {
								_v8 = _v8 + 1;
							} else {
								_v8 = _v8 & 0x00000000;
							}
							continue;
						} else {
							switch( *((intOrPtr*)(_t39 * 4 +  &M72DD247E))) {
								case 0:
									 *_t50 =  *_t50 & 0x00000000;
									goto L27;
								case 1:
									__eax = E72DD12FE(__ebx);
									goto L20;
								case 2:
									 *__ebp = E72DD12FE(__ebx);
									_a4 = __edx;
									goto L27;
								case 3:
									__eax = E72DD1224(__ebx);
									 *(__esi + 0x1c) = __eax;
									L20:
									 *__ebp = __eax;
									goto L27;
								case 4:
									 *0x72dd405c =  *0x72dd405c +  *0x72dd405c;
									__edi = GlobalAlloc(0x40,  *0x72dd405c +  *0x72dd405c);
									 *0x72dd405c = MultiByteToWideChar(0, 0, __ebx,  *0x72dd405c, __edi,  *0x72dd405c);
									if(_v4 != 5) {
										 *(__esi + 0x1c) = __edi;
										 *__ebp = __edi;
									} else {
										__eax = GlobalAlloc(0x40, 0x10);
										_push(__eax);
										 *(__esi + 0x1c) = __eax;
										_push(__edi);
										 *__ebp = __eax;
										__imp__CLSIDFromString();
										__eax = GlobalFree(__edi);
									}
									goto L27;
								case 5:
									if( *__ebx != 0) {
										__eax = E72DD12FE(__ebx);
										 *__edi = __eax;
									}
									goto L27;
								case 6:
									__esi =  *(__esi + 0x18);
									__esi = __esi - 1;
									__esi = __esi *  *0x72dd405c;
									__esi = __esi +  *0x72dd4064;
									__eax = __esi + 0xc;
									 *__edi = __esi + 0xc;
									asm("cdq");
									__eax = E72DD1429(__edx, __esi + 0xc, __edx, __esi);
									goto L27;
							}
						}
					}
					L9:
					_t38 = E72DD1224(0x72dd4034);
					goto L10;
				}
			}

0x72dd2306
0x72dd230a
0x72dd2315
0x72dd2315
0x72dd231c
0x72dd2321
0x00000000
0x00000000
0x72dd2325
0x72dd2328
0x00000000
0x00000000
0x72dd232d
0x72dd2338
0x72dd2348
0x72dd233f
0x72dd2341
0x72dd2357
0x72dd2357
0x00000000
0x72dd232f
0x72dd232f
0x72dd2358
0x72dd235c
0x72dd235e
0x72dd235e
0x72dd2361
0x72dd2361
0x72dd2369
0x72dd236c
0x72dd2373
0x72dd2377
0x72dd2446
0x72dd2447
0x72dd2452
0x72dd247d
0x72dd247d
0x72dd2462
0x72dd246e
0x72dd2464
0x72dd2464
0x72dd2464
0x00000000
0x72dd237d
0x72dd237d
0x00000000
0x72dd2384
0x00000000
0x00000000
0x72dd238d
0x00000000
0x00000000
0x72dd239b
0x72dd239e
0x00000000
0x00000000
0x72dd23a7
0x72dd23ac
0x72dd23af
0x72dd23b0
0x00000000
0x00000000
0x72dd23bd
0x72dd23c8
0x72dd23d7
0x72dd23e2
0x72dd2405
0x72dd2408
0x72dd23e4
0x72dd23e8
0x72dd23ee
0x72dd23ef
0x72dd23f2
0x72dd23f3
0x72dd23f6
0x72dd23fd
0x72dd23fd
0x00000000
0x00000000
0x72dd2410
0x72dd2413
0x72dd241f
0x72dd2421
0x00000000
0x00000000
0x72dd2424
0x72dd2427
0x72dd2428
0x72dd242f
0x72dd2436
0x72dd2439
0x72dd243b
0x72dd243e
0x00000000
0x00000000
0x72dd237d
0x72dd2377
0x72dd234d
0x72dd2352
0x00000000
0x72dd2352

APIs

GlobalFree.KERNEL32 ref: 72DD2447

Part of subcall function 72DD1224: lstrcpynA.KERNEL32(00000000,?,72DD12CF,-72DD404B,72DD11AB,-000000A0), ref: 72DD1234

GlobalAlloc.KERNEL32(00000040,?), ref: 72DD23C2
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 72DD23D7
GlobalAlloc.KERNEL32(00000040,00000010), ref: 72DD23E8
CLSIDFromString.OLE32(00000000,00000000), ref: 72DD23F6
GlobalFree.KERNEL32 ref: 72DD23FD

Strings

@uv, xrefs: 72DD23F6

Memory Dump Source

Source File: 00000000.00000002.843796267.0000000072DD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 72DD0000, based on PE: true

Associated: 00000000.00000002.843788448.0000000072DD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.843803253.0000000072DD3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.843809174.0000000072DD5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72dd0000_DHLIN00178.jbxd

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
String ID: @uv
API String ID: 3730416702-666577103
Opcode ID: 15c9bf0c57b968d9a32109d1aa19d40607897a8d0fcbfcb07b4b1e7ff81382b3
Instruction ID: 3c6899e5f6ec9fff5411d150f6882c64a516610eef6d465de7789b005275428c
Opcode Fuzzy Hash: 15c9bf0c57b968d9a32109d1aa19d40607897a8d0fcbfcb07b4b1e7ff81382b3
Instruction Fuzzy Hash: C4419D71508B01DFD3118F29C848B2A7BE8FB40321F20881FE9C6E6252E774E555CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00406244 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406244(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E004059DF(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E0040599D("*?|<>/\":", _t5))) == 0) {
							E00405B2E(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x00406246
0x0040624e
0x00406262
0x00406262
0x00406268
0x00406275
0x00406275
0x00406276
0x00406278
0x0040627c
0x0040627e
0x00406287
0x00406289
0x004062a3
0x004062ab
0x004062ab
0x004062b0
0x004062b2
0x004062b4
0x004062b8
0x004062b9
0x004062bc
0x004062c4
0x004062c6
0x004062ca
0x00000000
0x00000000
0x004062d0
0x004062d5
0x00000000
0x00000000
0x00000000
0x004062d5
0x004062da

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\DHLIN00178.exe",766DFA90,C:\Users\user\AppData\Local\Temp\,00000000,00403210,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 0040629C
CharNextA.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004062A9
CharNextA.USER32(?,"C:\Users\user\Desktop\DHLIN00178.exe",766DFA90,C:\Users\user\AppData\Local\Temp\,00000000,00403210,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 004062AE
CharPrevA.USER32(?,?,766DFA90,C:\Users\user\AppData\Local\Temp\,00000000,00403210,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 004062BE

Strings

*?|<>/":, xrefs: 0040628C
"C:\Users\user\Desktop\DHLIN00178.exe", xrefs: 00406280
C:\Users\user\AppData\Local\Temp\, xrefs: 00406245

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\DHLIN00178.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-862258624
Opcode ID: 6ae2be844214803d006e8a2b4c6c3a53132e84b4cb1e19317121ab57d6ea06c4
Instruction ID: 98a55a52ac5494643caf5fd5857683424a9a77f1076ac2e6562e20d377716777
Opcode Fuzzy Hash: 6ae2be844214803d006e8a2b4c6c3a53132e84b4cb1e19317121ab57d6ea06c4
Instruction Fuzzy Hash: EE11E25180879029EB3226344C40B7B7F988F5B760F2904FFE9D6722C2D67C5C52876E

Uniqueness

Uniqueness Score: -1.00%

Function 004040CF Relevance: 12.1, APIs: 8, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004040CF(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t39;
				long _t41;
				void* _t44;
				signed char _t50;
				long* _t54;

				if(_a4 + 0xfffffecd > 5) {
					L18:
					return 0;
				}
				_t54 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t54 == 0 || _t54[2] > 1 || _t54[4] > 2) {
					goto L18;
				} else {
					_t50 = _t54[5];
					if((_t50 & 0xffffffe0) != 0) {
						goto L18;
					}
					_t39 =  *_t54;
					if((_t50 & 0x00000002) != 0) {
						_t39 = GetSysColor(_t39);
					}
					if((_t54[5] & 0x00000001) != 0) {
						SetTextColor(_a8, _t39);
					}
					SetBkMode(_a8, _t54[4]);
					_t41 = _t54[1];
					_v16.lbColor = _t41;
					if((_t54[5] & 0x00000008) != 0) {
						_t41 = GetSysColor(_t41);
						_v16.lbColor = _t41;
					}
					if((_t54[5] & 0x00000004) != 0) {
						SetBkColor(_a8, _t41);
					}
					if((_t54[5] & 0x00000010) != 0) {
						_v16.lbStyle = _t54[2];
						_t44 = _t54[3];
						if(_t44 != 0) {
							DeleteObject(_t44);
						}
						_t54[3] = CreateBrushIndirect( &_v16);
					}
					return _t54[3];
				}
			}

0x004040e1
0x00404197
0x00000000
0x00404197
0x004040f2
0x004040f6
0x00000000
0x00404110
0x00404110
0x00404119
0x00000000
0x00000000
0x0040411b
0x00404127
0x0040412a
0x0040412a
0x00404130
0x00404136
0x00404136
0x00404142
0x00404148
0x0040414f
0x00404152
0x00404155
0x00404157
0x00404157
0x0040415f
0x00404165
0x00404165
0x0040416f
0x00404174
0x00404177
0x0040417c
0x0040417f
0x0040417f
0x0040418f
0x0040418f
0x00000000
0x00404192

APIs

GetWindowLongA.USER32 ref: 004040EC
GetSysColor.USER32(00000000), ref: 0040412A
SetTextColor.GDI32(?,00000000), ref: 00404136
SetBkMode.GDI32(?,?), ref: 00404142
GetSysColor.USER32(?), ref: 00404155
SetBkColor.GDI32(?,?), ref: 00404165
DeleteObject.GDI32(?), ref: 0040417F
CreateBrushIndirect.GDI32(?), ref: 00404189

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 85c1166dd3296ad08f2f8f2b617086cce748397ee5d912704cef396037712cfd
Instruction ID: 778babcb3f3cb4702814cedc7f3687c69535c8aec6342fb1ab2b401637f1774e
Opcode Fuzzy Hash: 85c1166dd3296ad08f2f8f2b617086cce748397ee5d912704cef396037712cfd
Instruction Fuzzy Hash: 8A21C7715047049BC7309F78DC4CB5BBBF8AF91710B048A2AEA96A62E0D334E884CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004049BB Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004049BB(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x004049c9
0x004049d6
0x004049dc
0x00404a1a
0x00404a1a
0x00404a29
0x00404a30
0x00000000
0x00404a32
0x004049de
0x004049ed
0x004049f5
0x004049f8
0x00404a0a
0x00404a10
0x00404a17
0x00000000
0x00404a17
0x00000000

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004049D6
GetMessagePos.USER32 ref: 004049DE
ScreenToClient.USER32 ref: 004049F8
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404A0A
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404A30

Strings

f, xrefs: 00404A0C

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b655f89ca4bb62ef2ecf269f26a72b4f16410e1a4a94cceed0b0bba942de31e0
Instruction ID: 78e79842b3afbaa1123eb4bc953d8a824fe30bd623f786c3032228cde2642f29
Opcode Fuzzy Hash: b655f89ca4bb62ef2ecf269f26a72b4f16410e1a4a94cceed0b0bba942de31e0
Instruction Fuzzy Hash: DA018071D40218BAEB00DB94DC81BFEBBB8AB45B11F10412BBA00B61D0C7B469418BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402CDD Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402CDD(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x4128b8; // 0xd6b11
					_t11 =  *0x41e8c4; // 0xd8d80
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfA( &_v68, "verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}

0x00402cea
0x00402cf8
0x00402cfe
0x00402cfe
0x00402d0c
0x00402d0e
0x00402d14
0x00402d1b
0x00402d1d
0x00402d1d
0x00402d33
0x00402d43
0x00402d55
0x00402d55
0x00402d5d

APIs

SetTimer.USER32 ref: 00402CF8
MulDiv.KERNEL32(000D6B11,00000064,000D8D80), ref: 00402D23
wsprintfA.USER32 ref: 00402D33
SetWindowTextA.USER32(?,?), ref: 00402D43
SetDlgItemTextA.USER32 ref: 00402D55

Strings

verifying installer: %d%%, xrefs: 00402D2D

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: be9cfeef7a30176cc4b43e70d30b18a0c7ce5305aee0f330691da59d71d99e6c
Instruction ID: 989b2dafafbc5add767bef13d928cf85595003a1ad1b8b7172a09c7de12a9e27
Opcode Fuzzy Hash: be9cfeef7a30176cc4b43e70d30b18a0c7ce5305aee0f330691da59d71d99e6c
Instruction Fuzzy Hash: 3801EC71A40209ABEF20AF60DD49FAE3769EB04305F008039FA06AA1D0D7B599558F59

Uniqueness

Uniqueness Score: -1.00%

Function 004027A3 Relevance: 9.1, APIs: 6, Instructions: 86
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E004027A3(void* __ebx) {
				void* _t26;
				long _t31;
				void* _t45;
				void* _t49;
				void* _t51;
				void* _t54;
				void* _t55;
				void* _t56;

				_t45 = __ebx;
				 *((intOrPtr*)(_t56 - 0xc)) = 0xfffffd66;
				_t50 = E00402B2C(0xfffffff0);
				 *(_t56 - 0x4c) = _t23;
				if(E004059DF(_t50) == 0) {
					E00402B2C(0xffffffed);
				}
				E00405B4E(_t50);
				_t26 = E00405B73(_t50, 0x40000000, 2);
				 *(_t56 + 8) = _t26;
				if(_t26 != 0xffffffff) {
					_t31 =  *0x423718;
					 *(_t56 - 0x1c) = _t31;
					_t49 = GlobalAlloc(0x40, _t31);
					if(_t49 != _t45) {
						E004031ED(_t45);
						E004031D7(_t49,  *(_t56 - 0x1c));
						_t54 = GlobalAlloc(0x40,  *(_t56 - 0x2c));
						 *(_t56 - 0x10) = _t54;
						if(_t54 != _t45) {
							_push( *(_t56 - 0x2c));
							_push(_t54);
							_push(_t45);
							_push( *((intOrPtr*)(_t56 - 0x30)));
							E00402FFB();
							while( *_t54 != _t45) {
								_t47 =  *_t54;
								_t55 = _t54 + 8;
								 *(_t56 - 0x48) =  *_t54;
								E00405B2E( *((intOrPtr*)(_t54 + 4)) + _t49, _t55, _t47);
								_t54 = _t55 +  *(_t56 - 0x48);
							}
							GlobalFree( *(_t56 - 0x10));
						}
						E00405C1A( *(_t56 + 8), _t49,  *(_t56 - 0x1c));
						GlobalFree(_t49);
						_push(_t45);
						_push(_t45);
						_push( *(_t56 + 8));
						_push(0xffffffff);
						 *((intOrPtr*)(_t56 - 0xc)) = E00402FFB();
					}
					CloseHandle( *(_t56 + 8));
				}
				_t51 = 0xfffffff3;
				if( *((intOrPtr*)(_t56 - 0xc)) < _t45) {
					_t51 = 0xffffffef;
					DeleteFileA( *(_t56 - 0x4c));
					 *((intOrPtr*)(_t56 - 4)) = 1;
				}
				_push(_t51);
				E00401423();
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t56 - 4));
				return 0;
			}

0x004027a3
0x004027a5
0x004027b1
0x004027b4
0x004027be
0x004027c2
0x004027c2
0x004027c8
0x004027d5
0x004027dd
0x004027e0
0x004027e6
0x004027f4
0x004027f9
0x004027fd
0x00402800
0x00402809
0x00402815
0x00402819
0x0040281c
0x0040281e
0x00402821
0x00402822
0x00402823
0x00402826
0x00402845
0x0040282d
0x00402832
0x0040283a
0x0040283d
0x00402842
0x00402842
0x0040284c
0x0040284c
0x00402859
0x0040285f
0x00402865
0x00402866
0x00402867
0x0040286a
0x00402871
0x00402871
0x00402877
0x00402877
0x00402882
0x00402883
0x00402887
0x0040288b
0x00402891
0x00402891
0x00402898
0x004022a4
0x004029bb
0x004029c7

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004027F7
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 00402813
GlobalFree.KERNEL32 ref: 0040284C
GlobalFree.KERNEL32 ref: 0040285F
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 00402877
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040288B

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: d8962bc5da80a952d71843fdd2bcaf86795e36f6a6ef68a6a5081b931e868eb5
Instruction ID: ec0d33f595d451752a188c19515fdbd8f87975fde9c964b970e1a5072f162152
Opcode Fuzzy Hash: d8962bc5da80a952d71843fdd2bcaf86795e36f6a6ef68a6a5081b931e868eb5
Instruction Fuzzy Hash: 7D219C72C00124BBCF213FA5CD49DAE7F79EF09364B10823AF520762E0C67959419FA9

Uniqueness

Uniqueness Score: -1.00%

Function 004048B1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E004048B1(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				signed int _t22;
				void* _t29;
				void* _t31;
				void* _t32;
				void* _t41;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				signed int _t51;
				signed int _t53;

				_t21 = _a16;
				_t51 = _a12;
				_t41 = 0xffffffdc;
				if(_t21 == 0) {
					_push(0x14);
					_pop(0);
					_t22 = _t51;
					if(_t51 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t41 = 0xffffffdd;
					}
					if(_t51 < 0x400) {
						_t41 = 0xffffffde;
					}
					if(_t51 < 0xffff3333) {
						_t50 = 0x14;
						asm("cdq");
						_t22 = 1 / _t50 + _t51;
					}
					_t23 = _t22 & 0x00ffffff;
					_t53 = _t22 >> 0;
					_t43 = 0xa;
					_t47 = ((_t22 & 0x00ffffff) + _t23 * 4 + (_t22 & 0x00ffffff) + _t23 * 4 >> 0) % _t43;
				} else {
					_t53 = (_t21 << 0x00000020 | _t51) >> 0x14;
					_t47 = 0;
				}
				_t29 = E00405FFC(_t41, _t47, _t53,  &_v36, 0xffffffdf);
				_t31 = E00405FFC(_t41, _t47, _t53,  &_v68, _t41);
				_t32 = E00405FFC(_t41, _t47, 0x41fd08, 0x41fd08, _a8);
				wsprintfA(_t32 + lstrlenA(0x41fd08), "%u.%u%s%s", _t53, _t47, _t31, _t29);
				return SetDlgItemTextA( *0x422ed8, _a4, 0x41fd08);
			}

0x004048b7
0x004048bc
0x004048c4
0x004048c5
0x004048d2
0x004048da
0x004048db
0x004048dd
0x004048df
0x004048e1
0x004048e4
0x004048e4
0x004048eb
0x004048f1
0x004048f1
0x004048f8
0x004048ff
0x00404902
0x00404905
0x00404905
0x00404909
0x00404919
0x0040491b
0x0040491e
0x004048c7
0x004048c7
0x004048ce
0x004048ce
0x00404926
0x00404931
0x00404947
0x00404957
0x00404973

APIs

lstrlenA.KERNEL32(Sepad149: Installing,Sepad149: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004047CC,000000DF,00000000,00000400,?), ref: 0040494F
wsprintfA.USER32 ref: 00404957
SetDlgItemTextA.USER32 ref: 0040496A

Strings

%u.%u%s%s, xrefs: 00404939
Sepad149: Installing, xrefs: 00404941, 00404946, 0040494C, 00404960

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$Sepad149: Installing
API String ID: 3540041739-3440464719
Opcode ID: 12f6fa3731befb5ff2bd286decedb689321e5faf0d4acc7877b9e8059f00797d
Instruction ID: 99a67daf6c97d227f7cf07030b4f4762c36886faa54bbd44db56b2f9a5a008fd
Opcode Fuzzy Hash: 12f6fa3731befb5ff2bd286decedb689321e5faf0d4acc7877b9e8059f00797d
Instruction Fuzzy Hash: 4F110D7350812937DB00656D9C45EEF328CDF85374F254637FA25F21D1EA78DC1252A8

Uniqueness

Uniqueness Score: -1.00%

Function 72DD1837 Relevance: 7.7, APIs: 5, Instructions: 194
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E72DD1837(signed int __edx, void* __eflags, void* _a8, void* _a16) {
				void* _v8;
				signed int _v12;
				signed int _v20;
				signed int _v24;
				char _v52;
				void _t45;
				void _t46;
				signed int _t47;
				signed int _t48;
				signed int _t57;
				signed int _t58;
				signed int _t59;
				signed int _t60;
				signed int _t61;
				void* _t67;
				void* _t68;
				void* _t69;
				void* _t70;
				void* _t71;
				signed int _t77;
				void* _t81;
				signed int _t83;
				signed int _t85;
				signed int _t87;
				signed int _t90;
				void* _t101;

				_t85 = __edx;
				 *0x72dd405c = _a8;
				_t77 = 0;
				 *0x72dd4060 = _a16;
				_v12 = 0;
				_v8 = E72DD123B();
				_t90 = E72DD12FE(_t42);
				_t87 = _t85;
				_t81 = E72DD123B();
				_a8 = _t81;
				_t45 =  *_t81;
				if(_t45 != 0x7e && _t45 != 0x21) {
					_a16 = E72DD123B();
					_t77 = E72DD12FE(_t74);
					_v12 = _t85;
					GlobalFree(_a16);
					_t81 = _a8;
				}
				_t46 =  *_t81;
				_t101 = _t46 - 0x2f;
				if(_t101 > 0) {
					_t47 = _t46 - 0x3c;
					__eflags = _t47;
					if(_t47 == 0) {
						__eflags =  *((char*)(_t81 + 1)) - 0x3c;
						if( *((char*)(_t81 + 1)) != 0x3c) {
							__eflags = _t87 - _v12;
							if(__eflags > 0) {
								L56:
								_t48 = 0;
								__eflags = 0;
								L57:
								asm("cdq");
								L58:
								_t90 = _t48;
								_t87 = _t85;
								L59:
								E72DD1429(_t85, _t90, _t87,  &_v52);
								E72DD1266( &_v52);
								GlobalFree(_v8);
								return GlobalFree(_a8);
							}
							if(__eflags < 0) {
								L49:
								__eflags = 0;
								L50:
								_t48 = 1;
								goto L57;
							}
							__eflags = _t90 - _t77;
							if(_t90 < _t77) {
								goto L49;
							}
							goto L56;
						}
						_t85 = _t87;
						_t48 = E72DD2EF0(_t90, _t77, _t85);
						goto L58;
					}
					_t57 = _t47 - 1;
					__eflags = _t57;
					if(_t57 == 0) {
						__eflags = _t90 - _t77;
						if(_t90 != _t77) {
							goto L56;
						}
						__eflags = _t87 - _v12;
						if(_t87 != _v12) {
							goto L56;
						}
						goto L49;
					}
					_t58 = _t57 - 1;
					__eflags = _t58;
					if(_t58 == 0) {
						__eflags =  *((char*)(_t81 + 1)) - 0x3e;
						if( *((char*)(_t81 + 1)) != 0x3e) {
							__eflags = _t87 - _v12;
							if(__eflags < 0) {
								goto L56;
							}
							if(__eflags > 0) {
								goto L49;
							}
							__eflags = _t90 - _t77;
							if(_t90 <= _t77) {
								goto L56;
							}
							goto L49;
						}
						__eflags =  *((char*)(_t81 + 2)) - 0x3e;
						_t85 = _t87;
						_t59 = _t90;
						_t83 = _t77;
						if( *((char*)(_t81 + 2)) != 0x3e) {
							_t48 = E72DD2F10(_t59, _t83, _t85);
						} else {
							_t48 = E72DD2F40(_t59, _t83, _t85);
						}
						goto L58;
					}
					_t60 = _t58 - 0x20;
					__eflags = _t60;
					if(_t60 == 0) {
						_t90 = _t90 ^ _t77;
						_t87 = _t87 ^ _v12;
						goto L59;
					}
					_t61 = _t60 - 0x1e;
					__eflags = _t61;
					if(_t61 == 0) {
						__eflags =  *((char*)(_t81 + 1)) - 0x7c;
						if( *((char*)(_t81 + 1)) != 0x7c) {
							_t90 = _t90 | _t77;
							_t87 = _t87 | _v12;
							goto L59;
						}
						__eflags = _t90 | _t87;
						if((_t90 | _t87) != 0) {
							goto L49;
						}
						__eflags = _t77 | _v12;
						if((_t77 | _v12) != 0) {
							goto L49;
						}
						goto L56;
					}
					__eflags = _t61 == 0;
					if(_t61 == 0) {
						_t90 =  !_t90;
						_t87 =  !_t87;
					}
					goto L59;
				}
				if(_t101 == 0) {
					L21:
					__eflags = _t77 | _v12;
					if((_t77 | _v12) != 0) {
						_v24 = E72DD2D80(_t90, _t87, _t77, _v12);
						_v20 = _t85;
						_t48 = E72DD2E30(_t90, _t87, _t77, _v12);
						_t81 = _a8;
					} else {
						_v24 = _v24 & 0x00000000;
						_v20 = _v20 & 0x00000000;
						_t48 = _t90;
						_t85 = _t87;
					}
					__eflags =  *_t81 - 0x2f;
					if( *_t81 != 0x2f) {
						goto L58;
					} else {
						_t90 = _v24;
						_t87 = _v20;
						goto L59;
					}
				}
				_t67 = _t46 - 0x21;
				if(_t67 == 0) {
					_t48 = 0;
					__eflags = _t90 | _t87;
					if((_t90 | _t87) != 0) {
						goto L57;
					}
					goto L50;
				}
				_t68 = _t67 - 4;
				if(_t68 == 0) {
					goto L21;
				}
				_t69 = _t68 - 1;
				if(_t69 == 0) {
					__eflags =  *((char*)(_t81 + 1)) - 0x26;
					if( *((char*)(_t81 + 1)) != 0x26) {
						_t90 = _t90 & _t77;
						_t87 = _t87 & _v12;
						goto L59;
					}
					__eflags = _t90 | _t87;
					if((_t90 | _t87) == 0) {
						goto L56;
					}
					__eflags = _t77 | _v12;
					if((_t77 | _v12) == 0) {
						goto L56;
					}
					goto L49;
				}
				_t70 = _t69 - 4;
				if(_t70 == 0) {
					_t48 = E72DD2D40(_t90, _t87, _t77, _v12);
					goto L58;
				} else {
					_t71 = _t70 - 1;
					if(_t71 == 0) {
						_t90 = _t90 + _t77;
						asm("adc edi, [ebp-0x8]");
					} else {
						if(_t71 == 0) {
							_t90 = _t90 - _t77;
							asm("sbb edi, [ebp-0x8]");
						}
					}
					goto L59;
				}
			}

0x72dd1837
0x72dd1841
0x72dd184a
0x72dd184d
0x72dd1852
0x72dd185b
0x72dd1864
0x72dd1866
0x72dd186d
0x72dd186f
0x72dd1872
0x72dd1876
0x72dd1882
0x72dd188b
0x72dd1890
0x72dd1893
0x72dd1899
0x72dd1899
0x72dd189c
0x72dd189f
0x72dd18a2
0x72dd1968
0x72dd1968
0x72dd196b
0x72dd19e5
0x72dd19e9
0x72dd19f8
0x72dd19fb
0x72dd1a03
0x72dd1a03
0x72dd1a03
0x72dd1a05
0x72dd1a05
0x72dd1a06
0x72dd1a06
0x72dd1a08
0x72dd1a0a
0x72dd1a10
0x72dd1a19
0x72dd1a2a
0x72dd1a35
0x72dd1a35
0x72dd19fd
0x72dd19e0
0x72dd19e0
0x72dd19e2
0x72dd19e2
0x00000000
0x72dd19e2
0x72dd19ff
0x72dd1a01
0x00000000
0x00000000
0x00000000
0x72dd1a01
0x72dd19ed
0x72dd19f1
0x00000000
0x72dd19f1
0x72dd196d
0x72dd196d
0x72dd196e
0x72dd19d7
0x72dd19d9
0x00000000
0x00000000
0x72dd19db
0x72dd19de
0x00000000
0x00000000
0x00000000
0x72dd19de
0x72dd1970
0x72dd1970
0x72dd1971
0x72dd19aa
0x72dd19ae
0x72dd19ca
0x72dd19cd
0x00000000
0x00000000
0x72dd19cf
0x00000000
0x00000000
0x72dd19d1
0x72dd19d3
0x00000000
0x00000000
0x00000000
0x72dd19d5
0x72dd19b0
0x72dd19b4
0x72dd19b6
0x72dd19b8
0x72dd19ba
0x72dd19c3
0x72dd19bc
0x72dd19bc
0x72dd19bc
0x00000000
0x72dd19ba
0x72dd1973
0x72dd1973
0x72dd1976
0x72dd19a3
0x72dd19a5
0x00000000
0x72dd19a5
0x72dd1978
0x72dd1978
0x72dd197b
0x72dd198b
0x72dd198f
0x72dd199c
0x72dd199e
0x00000000
0x72dd199e
0x72dd1991
0x72dd1993
0x00000000
0x00000000
0x72dd1995
0x72dd1998
0x00000000
0x00000000
0x00000000
0x72dd199a
0x72dd197e
0x72dd197f
0x72dd1985
0x72dd1987
0x72dd1987
0x00000000
0x72dd197f
0x72dd18a8
0x72dd1920
0x72dd1922
0x72dd1925
0x72dd1943
0x72dd1946
0x72dd194c
0x72dd1951
0x72dd1927
0x72dd1927
0x72dd192b
0x72dd192f
0x72dd1931
0x72dd1931
0x72dd1954
0x72dd1957
0x00000000
0x72dd195d
0x72dd195d
0x72dd1960
0x00000000
0x72dd1960
0x72dd1957
0x72dd18aa
0x72dd18ad
0x72dd1911
0x72dd1913
0x72dd1915
0x00000000
0x00000000
0x00000000
0x72dd191b
0x72dd18af
0x72dd18b2
0x00000000
0x00000000
0x72dd18b4
0x72dd18b5
0x72dd18eb
0x72dd18ef
0x72dd1907
0x72dd1909
0x00000000
0x72dd1909
0x72dd18f1
0x72dd18f3
0x00000000
0x00000000
0x72dd18f9
0x72dd18fc
0x00000000
0x00000000
0x00000000
0x72dd1902
0x72dd18b7
0x72dd18ba
0x72dd18e1
0x00000000
0x72dd18bc
0x72dd18bc
0x72dd18bd
0x72dd18d1
0x72dd18d3
0x72dd18bf
0x72dd18c1
0x72dd18c7
0x72dd18c9
0x72dd18c9
0x72dd18c1
0x00000000
0x72dd18bd

APIs

GlobalFree.KERNEL32 ref: 72DD1893
GlobalFree.KERNEL32 ref: 72DD1A2A
GlobalFree.KERNEL32 ref: 72DD1A2F

Memory Dump Source

Source File: 00000000.00000002.843796267.0000000072DD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 72DD0000, based on PE: true

Associated: 00000000.00000002.843788448.0000000072DD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.843803253.0000000072DD3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.843809174.0000000072DD5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72dd0000_DHLIN00178.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: bdab011152f4f9da4d0d02dabf172867c46f9be37b131998747d2559ebd27d89
Instruction ID: c08623171ac3754b3e08f165dcd3cfc56269a51c0f6df11ad4aecefa68ae7f7f
Opcode Fuzzy Hash: bdab011152f4f9da4d0d02dabf172867c46f9be37b131998747d2559ebd27d89
Instruction Fuzzy Hash: 4451C072988D56AEDB128BFCC8447AEBEB6EB44269F14705BD452B3308C235DA42C771

Uniqueness

Uniqueness Score: -1.00%

Function 00401D41 Relevance: 7.6, APIs: 5, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00401D41(int __edx) {
				struct HWND__* _t24;
				CHAR* _t30;
				void* _t40;
				void* _t44;
				signed int _t46;
				int _t50;
				signed int _t53;
				void* _t57;

				_t48 = __edx;
				if(( *(_t57 - 0x2b) & 0x00000001) == 0) {
					_t24 = GetDlgItem( *(_t57 - 8), __edx);
				} else {
					_t24 = E00402B0A(1);
					 *(_t57 - 0x10) = _t48;
				}
				_t46 =  *(_t57 - 0x2c);
				 *(_t57 + 8) = _t24;
				 *(_t57 - 8) = _t46 >> 0x1f;
				_t50 = _t46 & 0x00000003;
				_t53 = _t46 & 0x00000004;
				 *(_t57 - 0x1c) = _t46 >> 0x0000001e & 0x00000001;
				if((_t46 & 0x00010000) == 0) {
					_t30 =  *(_t57 - 0x34) & 0x0000ffff;
				} else {
					_t30 = E00402B2C(_t44);
				}
				 *(_t57 - 0xc) = _t30;
				GetClientRect( *(_t57 + 8), _t57 - 0x58);
				asm("sbb esi, esi");
				_t40 = SendMessageA( *(_t57 + 8), 0x172, _t50, LoadImageA( ~_t53 &  *0x423700,  *(_t57 - 0xc), _t50,  *(_t57 - 0x50) *  *(_t57 - 8),  *(_t57 - 0x4c) *  *(_t57 - 0x1c),  *(_t57 - 0x2c) & 0x0000fef0));
				if(_t40 != _t44 && _t50 == _t44) {
					DeleteObject(_t40);
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t57 - 4));
				return 0;
			}

0x00401d41
0x00401d45
0x00401d58
0x00401d47
0x00401d49
0x00401d4f
0x00401d4f
0x00401d5e
0x00401d61
0x00401d6b
0x00401d72
0x00401d78
0x00401d84
0x00401d87
0x00401d91
0x00401d89
0x00401d8a
0x00401d8a
0x00401d95
0x00401d9f
0x00401dc4
0x00401ddd
0x00401de5
0x00401df4
0x00401df4
0x004029bb
0x004029c7

APIs

GetDlgItem.USER32 ref: 00401D58
GetClientRect.USER32 ref: 00401D9F
LoadImageA.USER32 ref: 00401DCD
SendMessageA.USER32(?,00000172,?,00000000), ref: 00401DDD
DeleteObject.GDI32(00000000), ref: 00401DF4

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 7dc78e60c32ccc3c09c595abe6c2c4ca27936b49c459a2d12d3c5fdfefad9d6b
Instruction ID: 879b8917e8c3c9b7c2a93b5436fc05cb0971dbd0d1073f8587bede8dddcc77ec
Opcode Fuzzy Hash: 7dc78e60c32ccc3c09c595abe6c2c4ca27936b49c459a2d12d3c5fdfefad9d6b
Instruction Fuzzy Hash: CC2196B2E04109AFDB01DF98DD44AEE7BB5FB48300F10803AF905F6290C7789941CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00401DFF Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00401DFF(intOrPtr __edx) {
				void* __esi;
				int _t9;
				signed char _t15;
				struct HFONT__* _t18;
				intOrPtr _t30;
				struct HDC__* _t31;
				void* _t33;
				void* _t35;

				_t30 = __edx;
				_t31 = GetDC( *(_t35 - 8));
				_t9 = E00402B0A(2);
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				0x40a7e8->lfHeight =  ~(MulDiv(_t9, GetDeviceCaps(_t31, 0x5a), 0x48));
				ReleaseDC( *(_t35 - 8), _t31);
				 *0x40a7f8 = E00402B0A(3);
				_t15 =  *((intOrPtr*)(_t35 - 0x24));
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				 *0x40a7ff = 1;
				 *0x40a7fc = _t15 & 0x00000001;
				 *0x40a7fd = _t15 & 0x00000002;
				 *0x40a7fe = _t15 & 0x00000004;
				E00405FFC(_t9, _t31, _t33, 0x40a804,  *((intOrPtr*)(_t35 - 0x30)));
				_t18 = CreateFontIndirectA(0x40a7e8);
				_push(_t18);
				_push(_t33);
				E00405F38();
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00401dff
0x00401e0a
0x00401e0c
0x00401e19
0x00401e30
0x00401e35
0x00401e42
0x00401e47
0x00401e4b
0x00401e56
0x00401e5d
0x00401e6f
0x00401e75
0x00401e7a
0x00401e84
0x004025e4
0x00401569
0x00402960
0x004029bb
0x004029c7

APIs

GetDC.USER32(?), ref: 00401E02
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E1C
MulDiv.KERNEL32(00000000,00000000), ref: 00401E24
ReleaseDC.USER32 ref: 00401E35
CreateFontIndirectA.GDI32(0040A7E8), ref: 00401E84

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 02699fb8e5746cd42e9bc81a7398f0b4a801f797f07dd38d0fd2bed2daf6de53
Instruction ID: f74e6b169c59b5c86824efe7ff79e827475fcd3c365d9a6f340974a330803a43
Opcode Fuzzy Hash: 02699fb8e5746cd42e9bc81a7398f0b4a801f797f07dd38d0fd2bed2daf6de53
Instruction Fuzzy Hash: 6001B571948341AFE7019BB0AE49F9A7FB4EB15304F108479F201B72E2C6B851509B2F

Uniqueness

Uniqueness Score: -1.00%

Function 00401C0A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401C0A(intOrPtr __edx) {
				int _t29;
				long _t30;
				signed int _t32;
				CHAR* _t35;
				long _t36;
				int _t41;
				signed int _t42;
				int _t46;
				int _t56;
				intOrPtr _t57;
				struct HWND__* _t61;
				void* _t64;

				_t57 = __edx;
				_t29 = E00402B0A(3);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 - 8) = _t29;
				_t30 = E00402B0A(4);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 + 8) = _t30;
				if(( *(_t64 - 0x20) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 8)) = E00402B2C(0x33);
				}
				__eflags =  *(_t64 - 0x20) & 0x00000002;
				if(( *(_t64 - 0x20) & 0x00000002) != 0) {
					 *(_t64 + 8) = E00402B2C(0x44);
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x38)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t59 = E00402B2C();
					_t32 = E00402B2C();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t35 =  ~( *_t31) & _t59;
					__eflags = _t35;
					_t36 = FindWindowExA( *(_t64 - 8),  *(_t64 + 8), _t35,  ~( *_t32) & _t32);
					goto L10;
				} else {
					_t61 = E00402B0A();
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t41 = E00402B0A(2);
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t56 =  *(_t64 - 0x20) >> 2;
					if(__eflags == 0) {
						_t36 = SendMessageA(_t61, _t41,  *(_t64 - 8),  *(_t64 + 8));
						L10:
						 *(_t64 - 0xc) = _t36;
					} else {
						_t42 = SendMessageTimeoutA(_t61, _t41,  *(_t64 - 8),  *(_t64 + 8), _t46, _t56, _t64 - 0xc);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t64 - 4)) =  ~_t42 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x34)) - _t46;
				if( *((intOrPtr*)(_t64 - 0x34)) >= _t46) {
					_push( *(_t64 - 0xc));
					E00405F38();
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t64 - 4));
				return 0;
			}

0x00401c0a
0x00401c0c
0x00401c13
0x00401c16
0x00401c19
0x00401c23
0x00401c27
0x00401c2a
0x00401c33
0x00401c33
0x00401c36
0x00401c3a
0x00401c43
0x00401c43
0x00401c46
0x00401c4a
0x00401c4c
0x00401ca1
0x00401ca3
0x00401cac
0x00401cb4
0x00401cb7
0x00401cb7
0x00401cc0
0x00000000
0x00401c4e
0x00401c55
0x00401c57
0x00401c5a
0x00401c60
0x00401c67
0x00401c6a
0x00401c92
0x00401cc6
0x00401cc6
0x00401c6c
0x00401c7a
0x00401c82
0x00401c85
0x00401c85
0x00401c6a
0x00401cc9
0x00401ccc
0x00401cd2
0x00402960
0x00402960
0x004029bb
0x004029c7

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C7A
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C92

Strings

!, xrefs: 00401C46

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e636c23a318330d9371fb32b1eb0c44089503781878c3c5c4e956135cb08f77e
Instruction ID: 5540d85999f992b2d0d9c3d63f09df6deeece4c427f082cd61f041684b2cd5b6
Opcode Fuzzy Hash: e636c23a318330d9371fb32b1eb0c44089503781878c3c5c4e956135cb08f77e
Instruction Fuzzy Hash: 6E216BB1D48208BEEF06AFB4D98AAAD7FB5EB44304F10447EF501B61D1C7B89640DB18

Uniqueness

Uniqueness Score: -1.00%

Function 00405A60 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00405A60(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr* _t21;
				void* _t22;

				E00405FDA(0x421110, _a4);
				_t21 = E00405A0B(0x421110);
				if(_t21 != 0) {
					E00406244(_t21);
					if(( *0x42371c & 0x00000080) == 0) {
						L5:
						_t22 = _t21 - 0x421110;
						while(1) {
							_t11 = lstrlenA(0x421110);
							_push(0x421110);
							if(_t11 <= _t22) {
								break;
							}
							_t12 = E004062DD();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E004059B9(0x421110);
								continue;
							} else {
								goto L1;
							}
						}
						E00405972();
						return 0 | GetFileAttributesA(??) != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x00405a6c
0x00405a77
0x00405a7b
0x00405a82
0x00405a8e
0x00405a9a
0x00405a9a
0x00405ab2
0x00405ab3
0x00405aba
0x00405abb
0x00000000
0x00000000
0x00405a9e
0x00405aa5
0x00405aad
0x00000000
0x00000000
0x00000000
0x00000000
0x00405aa5
0x00405abd
0x00000000
0x00405ad1
0x00405a90
0x00405a94
0x00000000
0x00000000
0x00000000
0x00000000
0x00405a94
0x00405a7d
0x00000000

APIs

Part of subcall function 00405FDA: lstrcpynA.KERNEL32(?,?,00000400,00403307,00422F00,NSIS Error,?,00000006,00000008,0000000A), ref: 00405FE7

Part of subcall function 00405A0B: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,?,00405A77,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,766DFA90,?,C:\Users\user\AppData\Local\Temp\,004057C2,?,766DFA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A19
Part of subcall function 00405A0B: CharNextA.USER32(00000000), ref: 00405A1E
Part of subcall function 00405A0B: CharNextA.USER32(00000000), ref: 00405A32

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,766DFA90,?,C:\Users\user\AppData\Local\Temp\,004057C2,?,766DFA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405AB3
GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,766DFA90,?,C:\Users\user\AppData\Local\Temp\,004057C2,?,766DFA90,C:\Users\user\AppData\Local\Temp\), ref: 00405AC3

Strings

C:\Users\user\AppData\Local\Temp\nsb19E8.tmp, xrefs: 00405A66, 00405A6B, 00405A71, 00405AAC, 00405AB2, 00405ABA, 00405AC2
C:\Users\user\AppData\Local\Temp\, xrefs: 00405A60

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsb19E8.tmp
API String ID: 3248276644-3538340477
Opcode ID: 3d72b69990c89283bdec6022929649575e9d0056fbfb1b91cb3bf573b4946918
Instruction ID: fa13fd96d81fd76c8fc81ec80775158a1daeec84e0c55be597840f6fdc29cec0
Opcode Fuzzy Hash: 3d72b69990c89283bdec6022929649575e9d0056fbfb1b91cb3bf573b4946918
Instruction Fuzzy Hash: D5F0C825305D6616D62233361C85EAF1649CE82364715473FF851B12D3DB3C8943DE7E

Uniqueness

Uniqueness Score: -1.00%

Function 00403762 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403762() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x41eccc; // 0x656a38
				_t3 = E00403747(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8));
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x41eccc =  *0x41eccc & 0x00000000;
				return _t3;
			}

0x00403763
0x0040376b
0x00403772
0x00403775
0x00403775
0x00403777
0x0040377c
0x00403783
0x00403789
0x0040378d
0x0040378e
0x00403796

APIs

FreeLibrary.KERNEL32(?,766DFA90,00000000,C:\Users\user\AppData\Local\Temp\,0040373A,00403554,?,?,00000006,00000008,0000000A), ref: 0040377C
GlobalFree.KERNEL32 ref: 00403783

Strings

8je, xrefs: 00403763, 0040378E
C:\Users\user\AppData\Local\Temp\, xrefs: 00403762

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: 8je$C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3517778399
Opcode ID: c8d1562c69e49bacb52193c1b129ec66577e910d0a26dd744afe86c7ae1d1dec
Instruction ID: ee514f1fc3f324b596d41214b75e1b85a5e4a54197580a2dff82031d974a72f0
Opcode Fuzzy Hash: c8d1562c69e49bacb52193c1b129ec66577e910d0a26dd744afe86c7ae1d1dec
Instruction Fuzzy Hash: 40E0C27380112097C7251F07EC04B5A776CAF45B22F01C02AEC007B3A0C7742C418BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00405972 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405972(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x409014);
				}
				return _t7;
			}

0x00405973
0x0040598a
0x00405992
0x00405992
0x0040599a

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403222,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 00405978
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403222,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 00405981
lstrcatA.KERNEL32(?,00409014,?,00000006,00000008,0000000A), ref: 00405992

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405972

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: 76b30c2e26840082170464c0c63912d3f8204d685d5b784281808f5f32aeb92b
Instruction ID: 0da8bf888325795cdd0c5347214511d48edcf337a1f8d4df24ff951c9a6f7455
Opcode Fuzzy Hash: 76b30c2e26840082170464c0c63912d3f8204d685d5b784281808f5f32aeb92b
Instruction Fuzzy Hash: C7D0A9A2605A716AD21223199C09EDB2A0CCF02314B080063F600B22A3CA3C1D018BFE

Uniqueness

Uniqueness Score: -1.00%

Function 00402C2E Relevance: 6.1, APIs: 4, Instructions: 63
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402C2E(void* __eflags, void* _a4, char* _a8, signed int _a12) {
				void* _v8;
				char _v272;
				void* _t19;
				signed int _t25;
				intOrPtr* _t27;
				signed int _t32;
				signed int _t33;
				signed int _t34;

				_t33 = _a12;
				_t34 = _t33 & 0x00000300;
				_t32 = _t33 & 0x00000001;
				_t19 = E00405E60(__eflags, _a4, _a8, _t34 | 0x00000008,  &_v8);
				if(_t19 == 0) {
					while(RegEnumKeyA(_v8, 0,  &_v272, 0x105) == 0) {
						__eflags = _t32;
						if(__eflags != 0) {
							RegCloseKey(_v8);
							return 0x3eb;
						}
						_t25 = E00402C2E(__eflags, _v8,  &_v272, _a12);
						__eflags = _t25;
						if(_t25 != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E00406372(3);
					if(_t27 == 0) {
						return RegDeleteKeyA(_a4, _a8);
					}
					return  *_t27(_a4, _a8, _t34, 0);
				}
				return _t19;
			}

0x00402c39
0x00402c42
0x00402c4b
0x00402c57
0x00402c5e
0x00402c82
0x00402c68
0x00402c6a
0x00402cbd
0x00000000
0x00402cc3
0x00402c79
0x00402c7e
0x00402c80
0x00000000
0x00000000
0x00402c80
0x00402c9c
0x00402ca4
0x00402cab
0x00000000
0x00402cd0
0x00000000
0x00402cb6
0x00402cda

APIs

RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402C93
RegCloseKey.ADVAPI32(?,?,?), ref: 00402C9C
RegCloseKey.ADVAPI32(?,?,?), ref: 00402CBD

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 73c9fb611972138edc71e9406aca9b8622a65655cc86fec515c5851ee22221db
Instruction ID: a6da729fb9552a58d385ec1c0953cf8d4b7f97d7084d0a629d1ed2eab5a533bf
Opcode Fuzzy Hash: 73c9fb611972138edc71e9406aca9b8622a65655cc86fec515c5851ee22221db
Instruction Fuzzy Hash: 8E115B32904109BBEF129F50DE09B9E7B6DEB54380F104072BE05B51E0E7B59E11AAA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405A0B Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405A0B(CHAR* _a4) {
				CHAR* _t5;
				char* _t7;
				CHAR* _t9;
				char _t10;
				CHAR* _t11;
				void* _t13;

				_t11 = _a4;
				_t9 = CharNextA(_t11);
				_t5 = CharNextA(_t9);
				_t10 =  *_t11;
				if(_t10 == 0 ||  *_t9 != 0x3a || _t9[1] != 0x5c) {
					if(_t10 != 0x5c || _t11[1] != _t10) {
						L10:
						return 0;
					} else {
						_t13 = 2;
						while(1) {
							_t13 = _t13 - 1;
							_t7 = E0040599D(_t5, 0x5c);
							if( *_t7 == 0) {
								goto L10;
							}
							_t5 = _t7 + 1;
							if(_t13 != 0) {
								continue;
							}
							return _t5;
						}
						goto L10;
					}
				} else {
					return CharNextA(_t5);
				}
			}

0x00405a14
0x00405a1b
0x00405a1e
0x00405a20
0x00405a24
0x00405a39
0x00405a58
0x00000000
0x00405a40
0x00405a42
0x00405a43
0x00405a46
0x00405a47
0x00405a4f
0x00000000
0x00000000
0x00405a51
0x00405a54
0x00000000
0x00000000
0x00000000
0x00405a54
0x00000000
0x00405a43
0x00405a31
0x00000000
0x00405a32

APIs

CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,?,00405A77,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,C:\Users\user\AppData\Local\Temp\nsb19E8.tmp,766DFA90,?,C:\Users\user\AppData\Local\Temp\,004057C2,?,766DFA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A19
CharNextA.USER32(00000000), ref: 00405A1E
CharNextA.USER32(00000000), ref: 00405A32

Strings

C:\Users\user\AppData\Local\Temp\nsb19E8.tmp, xrefs: 00405A0C

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nsb19E8.tmp
API String ID: 3213498283-3314497343
Opcode ID: 41ff5f2e282a09e2b8c2dcc033aaaa44e3aa2c06707c210a0f189d2452b315e7
Instruction ID: a4ce128402f48f1feafc2c55b1118e7c053650975221e3f5fcc16cd8d0856992
Opcode Fuzzy Hash: 41ff5f2e282a09e2b8c2dcc033aaaa44e3aa2c06707c210a0f189d2452b315e7
Instruction Fuzzy Hash: 13F0C251B04F916BFB32A2280CD4F6B5B88CB55365F145267E280672C2C27C88408F9A

Uniqueness

Uniqueness Score: -1.00%

Function 00402D60 Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402D60(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x41e8c0; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x423710;
						if(_t2 >  *0x423710) {
							_t3 = CreateDialogParamA( *0x423700, 0x6f, 0, E00402CDD, 0);
							 *0x41e8c0 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E004063AE(0);
					}
				} else {
					_t6 =  *0x41e8c0; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x41e8c0 = 0;
					return _t6;
				}
			}

0x00402d67
0x00402d81
0x00402d87
0x00402d91
0x00402d97
0x00402d9d
0x00402dae
0x00402db7
0x00000000
0x00402dbc
0x00402dc3
0x00402d89
0x00402d90
0x00402d90
0x00402d69
0x00402d69
0x00402d70
0x00402d73
0x00402d73
0x00402d79
0x00402d80
0x00402d80

APIs

DestroyWindow.USER32(00000000,00000000,00402F3E,00000001), ref: 00402D73
GetTickCount.KERNEL32 ref: 00402D91
CreateDialogParamA.USER32(0000006F,00000000,00402CDD,00000000), ref: 00402DAE
ShowWindow.USER32(00000000,00000005), ref: 00402DBC

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 840a75d409b371d7b77b67c1e1f99b2f4b28fbc1840826de4c71681516a351cc
Instruction ID: 88e2776c24fdb891b0502b3cf10dbd42b902845c03a9ebe61091678d0ea3e225
Opcode Fuzzy Hash: 840a75d409b371d7b77b67c1e1f99b2f4b28fbc1840826de4c71681516a351cc
Instruction Fuzzy Hash: E0F05E75905221ABCA207B62BE4CACA7BA4FB42B527014976F845B31E4C3784C868BDD

Uniqueness

Uniqueness Score: -1.00%

Function 00405075 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00405075(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t11;
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					__eflags = _t15 - 0x200;
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						__eflags = _t15 - 0x419;
						if(_t15 == 0x419) {
							__eflags =  *0x41fcf4 - _t16; // 0x0
							if(__eflags != 0) {
								_push(_t16);
								_push(6);
								 *0x41fcf4 = _t16;
								E00404A3B();
							}
						}
						L11:
						return CallWindowProcA( *0x41fcfc, _a4, _t15, _a12, _t16);
					}
					_t11 = IsWindowVisible(_a4);
					__eflags = _t11;
					if(_t11 == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E004049BB(_a4, 1);
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 == 0x20) {
					E004040B4(0x413);
					return 0;
				}
				goto L10;
			}

0x00405079
0x00405083
0x00405099
0x0040509f
0x004050c1
0x004050c4
0x004050c4
0x004050ca
0x004050cc
0x004050d2
0x004050d4
0x004050d5
0x004050d7
0x004050dd
0x004050dd
0x004050d2
0x004050e7
0x00000000
0x004050f5
0x004050a4
0x004050aa
0x004050ac
0x004050e4
0x004050e4
0x00000000
0x004050e4
0x004050b8
0x004050ba
0x00000000
0x004050ba
0x00405089
0x00405090
0x00000000
0x00405095
0x00000000

APIs

IsWindowVisible.USER32 ref: 004050A4
CallWindowProcA.USER32 ref: 004050F5

Part of subcall function 004040B4: SendMessageA.USER32(0001043E,00000000,00000000,00000000), ref: 004040C6

Strings

, xrefs: 00405085

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: add97a0a6925bc22265a7304b998d918bb161013fa4103ebff122d1b57fa8f8b
Instruction ID: 69794148541a1a4d8d7be296dba567d41b1ee09d4c6a2f8e6d5670bc2f98cc64
Opcode Fuzzy Hash: add97a0a6925bc22265a7304b998d918bb161013fa4103ebff122d1b57fa8f8b
Instruction Fuzzy Hash: 3F017171100649ABDF219F11DD80A9F7A65EB84314F208037FA017A2D1D77A9C51DEEA

Uniqueness

Uniqueness Score: -1.00%

Function 00405679 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405679(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x421510->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x421510,  &_v20);
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405682
0x004056a2
0x004056aa
0x004056af
0x00000000
0x004056b5
0x004056b9

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421510,Error launching installer), ref: 004056A2
CloseHandle.KERNEL32(?), ref: 004056AF

Strings

Error launching installer, xrefs: 0040568C

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 0a67d81f0dbc2c48957f366610cafbe47269508c26dde6c53db592e432081f5d
Instruction ID: 7ab3ce879d7da258620b5dd87dc6aa02706b67d8cc8a7f981bd8ed1ee31a9d30
Opcode Fuzzy Hash: 0a67d81f0dbc2c48957f366610cafbe47269508c26dde6c53db592e432081f5d
Instruction Fuzzy Hash: 46E046F0A00209BFEB009B60EC09F7B7AACEB10748F404861BD11F32A0E374A9108A79

Uniqueness

Uniqueness Score: -1.00%

Function 004059B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004059B9(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}

0x004059ba
0x004059c4
0x004059c6
0x004059cd
0x004059d5
0x00000000
0x00000000
0x00000000
0x004059d5
0x004059d7
0x004059dc

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402E30,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\DHLIN00178.exe,C:\Users\user\Desktop\DHLIN00178.exe,80000000,00000003), ref: 004059BF
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E30,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\DHLIN00178.exe,C:\Users\user\Desktop\DHLIN00178.exe,80000000,00000003), ref: 004059CD

Strings

C:\Users\user\Desktop, xrefs: 004059B9

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1246513382
Opcode ID: 1c4ce1fe46e37373cead662465a4f3eb2a6c0bdf31f922d28b251b51ad992424
Instruction ID: a086819795abd80aa1ad59fb022c9920fa60cb9da26d6d2253466900a8022463
Opcode Fuzzy Hash: 1c4ce1fe46e37373cead662465a4f3eb2a6c0bdf31f922d28b251b51ad992424
Instruction Fuzzy Hash: 3FD0A7E3408DB05EE70353149C04B9F6A48CF12310F0900A3F180A21A6C67C1C414BFE

Uniqueness

Uniqueness Score: -1.00%

Function 72DD10E0 Relevance: 5.1, APIs: 4, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E72DD10E0(void* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char* _t17;
				char _t19;
				void* _t20;
				void* _t24;
				void* _t27;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				signed int _t43;
				void* _t52;
				char* _t53;
				char* _t55;
				void* _t56;
				void* _t58;

				 *0x72dd405c = _a8;
				 *0x72dd4060 = _a16;
				 *0x72dd4064 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x72dd4038, E72DD1556, _t52);
				_t43 =  *0x72dd405c +  *0x72dd405c * 4 << 2;
				_t17 = E72DD123B();
				_a8 = _t17;
				_t53 = _t17;
				if( *_t17 == 0) {
					L16:
					return GlobalFree(_a8);
				} else {
					do {
						_t19 =  *_t53;
						_t55 = _t53 + 1;
						_t58 = _t19 - 0x6c;
						if(_t58 > 0) {
							_t20 = _t19 - 0x70;
							if(_t20 == 0) {
								L12:
								_t53 = _t55 + 1;
								_t24 = E72DD1266(E72DD12AD( *_t55 - 0x30));
								L13:
								GlobalFree(_t24);
								goto L14;
							}
							_t27 = _t20;
							if(_t27 == 0) {
								L10:
								_t53 = _t55 + 1;
								_t24 = E72DD12D1( *_t55 - 0x30, E72DD123B());
								goto L13;
							}
							L7:
							if(_t27 == 1) {
								_t31 = GlobalAlloc(0x40, _t43 + 4);
								 *_t31 =  *0x72dd4030;
								 *0x72dd4030 = _t31;
								E72DD1508(_t31 + 4,  *0x72dd4064, _t43);
								_t56 = _t56 + 0xc;
							}
							goto L14;
						}
						if(_t58 == 0) {
							L17:
							_t34 =  *0x72dd4030;
							if( *0x72dd4030 != 0) {
								E72DD1508( *0x72dd4064, _t34 + 4, _t43);
								_t37 =  *0x72dd4030;
								_t56 = _t56 + 0xc;
								GlobalFree(_t37);
								 *0x72dd4030 =  *_t37;
							}
							goto L14;
						}
						_t39 = _t19 - 0x4c;
						if(_t39 == 0) {
							goto L17;
						}
						_t40 = _t39 - 4;
						if(_t40 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L12;
						}
						_t27 = _t40;
						if(_t27 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L10;
						}
						goto L7;
						L14:
					} while ( *_t53 != 0);
					goto L16;
				}
			}

0x72dd10e7
0x72dd10ef
0x72dd1103
0x72dd110b
0x72dd1116
0x72dd1119
0x72dd1121
0x72dd1124
0x72dd1126
0x72dd11c4
0x72dd11d0
0x72dd112c
0x72dd112d
0x72dd112d
0x72dd1130
0x72dd1131
0x72dd1134
0x72dd1203
0x72dd1206
0x72dd119e
0x72dd11a4
0x72dd11ac
0x72dd11b1
0x72dd11b4
0x00000000
0x72dd11b4
0x72dd1209
0x72dd120a
0x72dd1186
0x72dd118c
0x72dd1194
0x00000000
0x72dd1194
0x72dd1152
0x72dd1153
0x72dd115b
0x72dd1168
0x72dd1170
0x72dd1179
0x72dd117e
0x72dd117e
0x00000000
0x72dd1153
0x72dd113a
0x72dd11d1
0x72dd11d1
0x72dd11d8
0x72dd11e5
0x72dd11ea
0x72dd11ef
0x72dd11f5
0x72dd11fb
0x72dd11fb
0x00000000
0x72dd11d8
0x72dd1140
0x72dd1143
0x00000000
0x00000000
0x72dd1149
0x72dd114c
0x72dd119b
0x00000000
0x72dd119b
0x72dd114f
0x72dd1150
0x72dd1183
0x00000000
0x72dd1183
0x00000000
0x72dd11ba
0x72dd11ba
0x00000000
0x72dd11c3

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 72DD115B
GlobalFree.KERNEL32 ref: 72DD11B4
GlobalFree.KERNEL32 ref: 72DD11C7
GlobalFree.KERNEL32 ref: 72DD11F5

Memory Dump Source

Source File: 00000000.00000002.843796267.0000000072DD1000.00000020.00000001.01000000.00000004.sdmp, Offset: 72DD0000, based on PE: true

Associated: 00000000.00000002.843788448.0000000072DD0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.843803253.0000000072DD3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.843809174.0000000072DD5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72dd0000_DHLIN00178.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 6afd1d4e0b8bb5e637b3ea9a206e3dc5c999926cdb919b3c726236e52e556c13
Instruction ID: 0ab73cff39af7ebd878b62b4c04598d9e271cb7f3f554e523cb89674437f7675
Opcode Fuzzy Hash: 6afd1d4e0b8bb5e637b3ea9a206e3dc5c999926cdb919b3c726236e52e556c13
Instruction Fuzzy Hash: BF31AEB2944A45AFE7118F7DD949B257FB8EB05260B74995BE846E6310D634D800CF28

Uniqueness

Uniqueness Score: -1.00%

Function 00405AD8 Relevance: 5.0, APIs: 4, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405AD8(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}

0x00405ae8
0x00405aea
0x00405aed
0x00405b19
0x00405af2
0x00405afb
0x00405b00
0x00405b0b
0x00405b0e
0x00405b2a
0x00405b10
0x00405b17
0x00000000
0x00405b17
0x00405b23
0x00405b27
0x00405b27
0x00405b21
0x00000000

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D33,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405AE8
lstrcmpiA.KERNEL32(00000000,00000000,?,00000000,00405D33,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B00
CharNextA.USER32(00000000,?,00000000,00405D33,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B11
lstrlenA.KERNEL32(00000000,?,00000000,00405D33,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B1A

Memory Dump Source

Source File: 00000000.00000002.821538784.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.821534093.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821545078.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821549997.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.821587087.0000000000469000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DHLIN00178.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: c17fcd1cf7dd52c707961598001fbe9307a221727c523cbd792ccb3aa3d95fe1
Instruction ID: 2cbfd0870324320007afb9b70b5ca04d8eb3af27e3ea935175830c0dc6d3898b
Opcode Fuzzy Hash: c17fcd1cf7dd52c707961598001fbe9307a221727c523cbd792ccb3aa3d95fe1
Instruction Fuzzy Hash: 50F0C231604414BFC702DBA9DC40D9EBBB8EF46250B2540A6E800F7251D274FE01ABA9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DHLIN00178.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Maattet\Dystonia.Fis116

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Maattet\Skrddersjlenes.Nou

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Maattet\SolutionExplorerCLI.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Maattet\System.Security.Cryptography.X509Certificates.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Mandslinien\Characterizable\Senilitetstegnet\percentile.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Pointberegningernes241\Chaiselongs\Whatchamacallits76\querciflorae\System.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Pointberegningernes241\Chaiselongs\Whatchamacallits76\querciflorae\libdatrie-1.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Stingily\Nebularise\stormagasiners\libpkcs11-helper-1.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Stingily\Nebularise\stormagasiners\maintenanceservice2.exe

C:\Users\user\AppData\Local\Temp\nsb19E8.tmp\System.dll

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
DHLIN00178.exe

Function 00403235 Relevance: 87.9, APIs: 32, Strings: 18, Instructions: 366
stringcomfileCOMMON

Function 0040523F Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Function 72DD1A98 Relevance: 25.1, APIs: 13, Strings: 1, Instructions: 591
stringlibrarymemoryCOMMONCrypto

Function 004057A2 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Function 00402138 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139
comCOMMON

Function 00406666 Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Function 004062DD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Function 00403B94 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Function 004037F7 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Function 00402DC4 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181
memoryCOMMON

Function 00405FFC Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 199
stringCOMMON

Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 00405101 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Function 004055C7 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Function 00406304 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00402FFB Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Function 00405BA2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Function 72DD16DB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 0040243D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Function 0040206A Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Function 00405EC1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
registryCOMMON

Function 00406A9B Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Function 00406C9C Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Function 004069B2 Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Function 004064B7 Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Function 00406905 Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Function 00406A23 Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Function 0040696F Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Function 0040254C Relevance: 4.5, APIs: 3, Instructions: 47
registryCOMMON

Function 72DD2921 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21
memoryCOMMON

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Function 0040156F Relevance: 3.0, APIs: 2, Instructions: 23
COMMON

Function 00406372 Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Function 00405B73 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Function 00405B4E Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Function 00405644 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON