Edit tour

Windows Analysis Report
Quotation.exe

Overview

General Information

Sample Name:	Quotation.exe
Analysis ID:	830618
MD5:	8a81948116d2ea79bee1d261733dba89
SHA1:	5cf4113debe6d37bd770d8d3870647b8bac082a3
SHA256:	5a64a3fd65f7176b7ad623893e3cb573af13eb51850f8243a1951884eee757a9
Tags:	exeguloader
Infos:

Detection

GuLoader

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Yara detected Generic Downloader

Initial sample is a PE file and has a suspicious name

Tries to detect virtualization through RDTSC time measurements

Uses 32bit PE files

PE file does not import any functions

Sample file is different than original file name gathered from version info

Drops PE files

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Binary contains a suspicious time stamp

Detected potential crypto function

PE / OLE file has an invalid certificate

PE file contains more sections than normal

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64

Quotation.exe (PID: 2684 cmdline: C:\Users\user\Desktop\Quotation.exe MD5: 8A81948116D2EA79BEE1D261733DBA89)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://blog.malwarebytes.com/scams/2020/08/sba-phishing-scams-from-malware-to-advanced-social-usering/ https://blog.morphisec.com/guloader-the-rat-downloader https://blog.vincss.net/2020/05/re014-guloader-antivm-techniques.html https://cert-agid.gov.it/news/malware/tecniche-per-semplificare-lanalisi-del-malware-guloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Delforliget\Melotragedy\Lindhardt\System.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.773629937.0000000005789000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Quotation.exe	Virustotal: Detection: 18%			Perma Link
Source: Quotation.exe	ReversingLabs: Detection: 25%

Source: Quotation.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: Quotation.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: /_/artifacts/obj/manual.System/net6.0-Release/System.pdbSHA256n source: Quotation.exe, 00000000.00000003.253157391.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, System.dll.0.dr
Source:	Binary string: maintenanceservice.pdb@ 0%P% source: Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Cryptography.X509Certificates\net6.0-windows-Release\System.Security.Cryptography.X509Certificates.pdb source: Quotation.exe, 00000000.00000003.252894237.00000000027AA000.00000004.00000020.00020000.00000000.sdmp, System.Security.Cryptography.X509Certificates.dll.0.dr
Source:	Binary string: /_/artifacts/obj/manual.System/net6.0-Release/System.pdb source: Quotation.exe, 00000000.00000003.253157391.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, System.dll.0.dr
Source:	Binary string: System.Security.Cryptography.X509Certificates.ni.pdb source: Quotation.exe, 00000000.00000003.252894237.00000000027AA000.00000004.00000020.00020000.00000000.sdmp, System.Security.Cryptography.X509Certificates.dll.0.dr
Source:	Binary string: E:\Builds\221\N2\HO_SE_g_2016_r_0\Sources\SolutionExplorer\target\nar\bin\x86-Windows-msvc\release\SolutionExplorerCLI.pdb source: Quotation.exe, 00000000.00000003.252069193.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr
Source:	Binary string: maintenanceservice.pdb source: Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr

Source: C:\Users\user\Desktop\Quotation.exe	Code function: 0_2_004062DD FindFirstFileA,FindClose,	0_2_004062DD
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 0_2_004057A2 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004057A2
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 0_2_00402765 FindFirstFileA,	0_2_00402765

Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache	Jump to behavior

Networking

Yara detected Generic Downloader

Source: Yara match

File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Delforliget\Melotragedy\Lindhardt\System.dll, type: DROPPED

Source: Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000000.00000003.253605612.00000000027AD000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000000.00000003.253605612.00000000027AD000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000000.00000003.253605612.00000000027AD000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Quotation.exe, 00000000.00000003.252069193.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000000.00000003.253605612.00000000027AD000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000000.00000003.253605612.00000000027AD000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000000.00000003.253605612.00000000027AD000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000000.00000003.253605612.00000000027AD000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000000.00000003.253605612.00000000027AD000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: Quotation.exe, 00000000.00000003.253605612.00000000027AD000.00000004.00000020.00020000.00000000.sdmp, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000000.00000003.253605612.00000000027AD000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Quotation.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: Quotation.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000000.00000003.253605612.00000000027AD000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000000.00000003.253605612.00000000027AD000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000000.00000003.253605612.00000000027AD000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: Quotation.exe, 00000000.00000003.252069193.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: Quotation.exe	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: Quotation.exe	String found in binary or memory: http://s.symcd.com06
Source: Quotation.exe, 00000000.00000003.252069193.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: Quotation.exe, 00000000.00000003.252069193.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://s2.symcb.com0
Source: Quotation.exe, 00000000.00000003.252069193.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: Quotation.exe, 00000000.00000003.252069193.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: Quotation.exe, 00000000.00000003.252069193.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://sv.symcd.com0&
Source: Quotation.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: Quotation.exe, 00000000.00000003.252069193.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: Quotation.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: Quotation.exe, 00000000.00000003.252069193.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: Quotation.exe, 00000000.00000003.252069193.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: Quotation.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000000.00000003.253605612.00000000027AD000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: Quotation.exe, 00000000.00000003.252069193.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://www.nero.com
Source: Quotation.exe, 00000000.00000003.252069193.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: Quotation.exe, 00000000.00000003.252069193.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: Quotation.exe, 00000000.00000003.252894237.00000000027AA000.00000004.00000020.00020000.00000000.sdmp, System.Security.Cryptography.X509Certificates.dll.0.dr	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: Quotation.exe, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: Quotation.exe, SolutionExplorerCLI.dll.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: Quotation.exe	String found in binary or memory: https://d.symcb.com/rpa0.
Source: Quotation.exe, 00000000.00000003.253157391.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000000.00000003.252894237.00000000027AA000.00000004.00000020.00020000.00000000.sdmp, System.Security.Cryptography.X509Certificates.dll.0.dr, System.dll.0.dr	String found in binary or memory: https://github.com/dotnet/runtime
Source: Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr	String found in binary or memory: https://mozilla.org0
Source: Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000000.00000003.253605612.00000000027AD000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr, libpkcs11-helper-1.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0

Source: C:\Users\user\Desktop\Quotation.exe

Code function: 0_2_0040523F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040523F

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Quotation.exe

Source: Quotation.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: System.Security.Cryptography.X509Certificates.dll.0.dr

Static PE information: No import functions for PE file found

Source: Quotation.exe, 00000000.00000003.252069193.00000000027A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSolutionExplorerCLI.dll vs Quotation.exe
Source: Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemaintenanceservice.exe0 vs Quotation.exe
Source: Quotation.exe, 00000000.00000003.253157391.00000000027A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.dll@ vs Quotation.exe
Source: Quotation.exe, 00000000.00000000.249142987.0000000000436000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBrankningens.exeDVarFileInfo$ vs Quotation.exe
Source: Quotation.exe, 00000000.00000003.253605612.00000000027AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepkcs11-helper-1.dll" vs Quotation.exe
Source: Quotation.exe, 00000000.00000003.252894237.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Cryptography.X509Certificates.dll@ vs Quotation.exe
Source: Quotation.exe	Binary or memory string: OriginalFilenameBrankningens.exeDVarFileInfo$ vs Quotation.exe

Source: C:\Users\user\Desktop\Quotation.exe

Code function: 0_2_00403235 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403235

Source: C:\Users\user\Desktop\Quotation.exe	Code function: 0_2_00406666		0_2_00406666
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 0_2_6D011A98		0_2_6D011A98

Source: Quotation.exe

Static PE information: invalid certificate

Source: percentile.dll.0.dr	Static PE information: Number of sections : 19 > 10
Source: libdatrie-1.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: libpkcs11-helper-1.dll.0.dr	Static PE information: Number of sections : 12 > 10

Source: System.dll.0.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: C:\Users\user\Desktop\Quotation.exe

Process Stats: CPU usage > 98%

Source: Quotation.exe	Virustotal: Detection: 18%
Source: Quotation.exe	ReversingLabs: Detection: 25%

Source: C:\Users\user\Desktop\Quotation.exe

File read: C:\Users\user\Desktop\Quotation.exe

Jump to behavior

Source: Quotation.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Quotation.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

0_2_00403235

Source: C:\Users\user\Desktop\Quotation.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

File created: C:\Users\user\AppData\Local\Temp\nsr50D7.tmp

Jump to behavior

Source: classification engine

Classification label: mal68.troj.evad.winEXE@1/10@0/0

Source: C:\Users\user\Desktop\Quotation.exe

Code function: 0_2_00402138 CoCreateInstance,MultiByteToWideChar,

0_2_00402138

Source: C:\Users\user\Desktop\Quotation.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Code function: 0_2_004044FA GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_004044FA

Source: Quotation.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: /_/artifacts/obj/manual.System/net6.0-Release/System.pdbSHA256n source: Quotation.exe, 00000000.00000003.253157391.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, System.dll.0.dr
Source:	Binary string: maintenanceservice.pdb@ 0%P% source: Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Cryptography.X509Certificates\net6.0-windows-Release\System.Security.Cryptography.X509Certificates.pdb source: Quotation.exe, 00000000.00000003.252894237.00000000027AA000.00000004.00000020.00020000.00000000.sdmp, System.Security.Cryptography.X509Certificates.dll.0.dr
Source:	Binary string: /_/artifacts/obj/manual.System/net6.0-Release/System.pdb source: Quotation.exe, 00000000.00000003.253157391.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, System.dll.0.dr
Source:	Binary string: System.Security.Cryptography.X509Certificates.ni.pdb source: Quotation.exe, 00000000.00000003.252894237.00000000027AA000.00000004.00000020.00020000.00000000.sdmp, System.Security.Cryptography.X509Certificates.dll.0.dr
Source:	Binary string: E:\Builds\221\N2\HO_SE_g_2016_r_0\Sources\SolutionExplorer\target\nar\bin\x86-Windows-msvc\release\SolutionExplorerCLI.pdb source: Quotation.exe, 00000000.00000003.252069193.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr
Source:	Binary string: maintenanceservice.pdb source: Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.773629937.0000000005789000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Quotation.exe

Code function: 0_2_6D012F60 push eax; ret

0_2_6D012F8E

Source: libdatrie-1.dll.0.dr	Static PE information: section name: .xdata
Source: libpkcs11-helper-1.dll.0.dr	Static PE information: section name: .xdata
Source: maintenanceservice2.exe.0.dr	Static PE information: section name: .00cfg
Source: percentile.dll.0.dr	Static PE information: section name: .xdata
Source: percentile.dll.0.dr	Static PE information: section name: /4
Source: percentile.dll.0.dr	Static PE information: section name: /19
Source: percentile.dll.0.dr	Static PE information: section name: /31
Source: percentile.dll.0.dr	Static PE information: section name: /45
Source: percentile.dll.0.dr	Static PE information: section name: /57
Source: percentile.dll.0.dr	Static PE information: section name: /70
Source: percentile.dll.0.dr	Static PE information: section name: /81
Source: percentile.dll.0.dr	Static PE information: section name: /92

Source: System.Security.Cryptography.X509Certificates.dll.0.dr

Static PE information: 0xF15766E0 [Tue Apr 22 20:30:24 2098 UTC]

Source: C:\Users\user\Desktop\Quotation.exe	File created: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Quotation.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard\maintenanceservice2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Quotation.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Cohesion\Quakily\SolutionExplorerCLI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Quotation.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Delforliget\Melotragedy\Lindhardt\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Quotation.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard\percentile.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Quotation.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Cohesion\Quakily\System.Security.Cryptography.X509Certificates.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Quotation.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard\libpkcs11-helper-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Quotation.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Delforliget\Melotragedy\Lindhardt\libdatrie-1.dll	Jump to dropped file

Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Quotation.exe

RDTSC instruction interceptor: First address: 0000000005992E4C second address: 0000000005992E4C instructions: 0x00000000 rdtsc 0x00000002 cmp dx, ax 0x00000005 cmp ebx, ecx 0x00000007 jc 00007FD5E8D07313h 0x00000009 test ah, bh 0x0000000b inc ebp 0x0000000c inc ebx 0x0000000d test eax, eax 0x0000000f rdtsc

Source: C:\Users\user\Desktop\Quotation.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard\maintenanceservice2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Quotation.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Cohesion\Quakily\SolutionExplorerCLI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Quotation.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard\percentile.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Quotation.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Cohesion\Quakily\System.Security.Cryptography.X509Certificates.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Quotation.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard\libpkcs11-helper-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Quotation.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Delforliget\Melotragedy\Lindhardt\libdatrie-1.dll	Jump to dropped file

Source: C:\Users\user\Desktop\Quotation.exe	Code function: 0_2_004062DD FindFirstFileA,FindClose,	0_2_004062DD
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 0_2_004057A2 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004057A2
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 0_2_00402765 FindFirstFileA,	0_2_00402765

Source: C:\Users\user\Desktop\Quotation.exe	API call chain: ExitProcess graph end node			graph_0-4668
Source: C:\Users\user\Desktop\Quotation.exe	API call chain: ExitProcess graph end node			graph_0-4829

Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

0_2_00403235

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Access Token Manipulation	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Clipboard Data	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Timestomp	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Quotation.exe	19%	Virustotal		Browse
Quotation.exe	26%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Cohesion\Quakily\SolutionExplorerCLI.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Cohesion\Quakily\System.Security.Cryptography.X509Certificates.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Delforliget\Melotragedy\Lindhardt\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Delforliget\Melotragedy\Lindhardt\libdatrie-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard\libpkcs11-helper-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard\maintenanceservice2.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard\percentile.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.0.Quotation.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223491		Download File
0.2.Quotation.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223491		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://mozilla.org0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nsis.sf.net/NSIS_Error	Quotation.exe	false		high
http://nsis.sf.net/NSIS_ErrorError	Quotation.exe	false		high
https://aka.ms/dotnet-warnings/	Quotation.exe, 00000000.00000003.252894237.00000000027AA000.00000004.00000020.00020000.00000000.sdmp, System.Security.Cryptography.X509Certificates.dll.0.dr	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	Quotation.exe, 00000000.00000003.252069193.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	false		high
http://www.symauth.com/cps0(	Quotation.exe, 00000000.00000003.252069193.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	false		high
http://www.symauth.com/rpa00	Quotation.exe, 00000000.00000003.252069193.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	false		high
https://mozilla.org0	Quotation.exe, 00000000.00000003.253899222.00000000027A4000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.0.dr	false	URL Reputation: safe	unknown
http://ocsp.thawte.com0	Quotation.exe, 00000000.00000003.252069193.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.nero.com	Quotation.exe, 00000000.00000003.252069193.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.0.dr	false		high
https://github.com/dotnet/runtime	Quotation.exe, 00000000.00000003.253157391.00000000027A3000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000000.00000003.252894237.00000000027AA000.00000004.00000020.00020000.00000000.sdmp, System.Security.Cryptography.X509Certificates.dll.0.dr, System.dll.0.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	830618
Start date and time:	2023-03-20 14:46:25 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Quotation.exe
Detection:	MAL
Classification:	mal68.troj.evad.winEXE@1/10@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 63.5% (good quality ratio 62.2%) Quality average: 89% Quality standard deviation: 21.4%
HCA Information:	Successful, ratio: 100% Number of executed functions: 52 Number of non-executed functions: 30
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
14:47:24	API Interceptor	1x Sleep call for process: Quotation.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Cohesion\Quakily\SolutionExplorerCLI.dll	DHLINV000156.exe	Get hash	malicious	FormBook, GuLoader	Browse
	DHLINV000156.exe	Get hash	malicious	GuLoader	Browse
	DHLIN00178.exe	Get hash	malicious	FormBook, GuLoader	Browse
	DHLIN00178.exe	Get hash	malicious	GuLoader	Browse
	EXFZCd3tg9.exe	Get hash	malicious	FormBook, GuLoader	Browse
	EXFZCd3tg9.exe	Get hash	malicious	GuLoader	Browse
	Company Profile.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Company Profile.exe	Get hash	malicious	GuLoader	Browse
	Company Profile.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Company Profile.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Blegnbbetheden\Telegrammers.Non

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	261995
Entropy (8bit):	7.29610483044462
Encrypted:	false
SSDEEP:	6144:od+8r4FkVd2EInntyLURcXLFL4t5qbHGSIBb:WRrHOnntQrXLN+qSSIZ
MD5:	258AEA53C2D4917537DC6E160ED83890
SHA1:	1E9D937187DA27F205D2E7052C4F875374564410
SHA-256:	078ABD959945A2DE0905D4FF7B7288291B19603BFE6EDA64986BE47313F2D26D
SHA-512:	254A5CAEC00C6A72CEAF83E1C7FDF6BCBB8B3B599EC679C4869FF93D91C06B6C6857A8BF7F450E2A984145DC2E70BA0F687E51A19A26A98C4D9360CD2797E7E5
Malicious:	false
Reputation:	low
Preview:	++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Cohesion\Quakily\Privileger.Fla

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	ASCII text, with very long lines (55032), with no line terminators
Category:	dropped
Size (bytes):	55032
Entropy (8bit):	2.669891427410196
Encrypted:	false
SSDEEP:	768:iplrX/Vcn0/T7ADSEsfSKcFpWDAlJAhCieRTN3stuby6VVAkXnCrsiKmdQy7UElT:sTQnJCndT7SpBHC
MD5:	6E31A03A1B956DF431E66A4360494661
SHA1:	0236923F575AF0C82263CAD2C260859433C91E93
SHA-256:	944E9D3BA3195866EA449AAAA1B10912847058836D4CE7D40FA321A926E5FA2E
SHA-512:	12FF3A92BB2EE101B25455196D78EE7493594E9C68A6F781395FF69531D5F7BEEE915660E012E42107E8995F5C3AE6913471CF020F42F912437EC207D94EE9F7
Malicious:	false
Reputation:	low
Preview:	00000000000000B900D20058580000CB002B0000BC00000808005A0000000000000000000071000057000000000500BCBCBC00000000000012000300C0C0000000B1000000A3A3A300DBDB000000000600440000000000310000FFFF001500EB00000000710000EBEB0000D4000000979700000000E300000000000000E80000008F00CE0000C7C7C700FFFFFFFF006E6E004200AFAFAF00580000F0F0F0F0000000F7F7F7001F1F0051000F0000006D00B8B80029290000898900424242009A0050505000000000B7B700000B0B0B0B0B0000000000D20064646400000004000000696969000000000000808000C0C000004100000F006400B4000000D0D0D0D0D0D0003A3A000000008700002F2F0000F10094005E005E5E002A2A000000009F9F9F004B4B0000585858000000181800005700E2E2000000007C0045000000D1008484848484000000007D00002525000000000032323200000000000000008500000041414141414100009B00B4002B2B2B0000D80000F5F5F5F5F5F5F5F5F5F5F50000191919002A000A0000003131313100D8D8D80000404000007D7D009999999999999900A4A4A4A4A40000000000000000AD00B0B0B00000CFCFCFCFCFCF00F3F3F3F3F3000093000000EFEFEF00E6E6002C2C2C00350000005B000E0E0E000000EFEF000000000025000000009E0000

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Cohesion\Quakily\SolutionExplorerCLI.dll

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75248
Entropy (8bit):	6.149004775364808
Encrypted:	false
SSDEEP:	1536:GmY7dQU8l75gS4SqQR27YZW1cwvbTxUd6Rw:GmacliS49QR27YZW1vn2dWw
MD5:	3A03B61FA01DCDFF3E595D279F159D6E
SHA1:	94900C28C23AD01D311C389A0813277CFB30345C
SHA-256:	4F4D6511BEC955B4E8A30371ED743EA5EBC87CEB0BF93FE21F0A378AA2C05A01
SHA-512:	0D04D3486911DFE0439449554E90FB68B4D85EEE025A9B89910C306DE33CBFDBBEF1ABCAC5D4CD3B3CC1B1F445B7C67DC341C9363C9B127810ABD0498EC94AC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: DHLINV000156.exe, Detection: malicious, Browse Filename: DHLINV000156.exe, Detection: malicious, Browse Filename: DHLIN00178.exe, Detection: malicious, Browse Filename: DHLIN00178.exe, Detection: malicious, Browse Filename: EXFZCd3tg9.exe, Detection: malicious, Browse Filename: EXFZCd3tg9.exe, Detection: malicious, Browse Filename: Company Profile.exe, Detection: malicious, Browse Filename: Company Profile.exe, Detection: malicious, Browse Filename: Company Profile.exe, Detection: malicious, Browse Filename: Company Profile.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........T..:..:..:....:.....:..;..:..]..:..]...:..]..:..]...:..u...:..u..:....:..u...:.Rich.:.........PE..L...w..U...........!.....:..........dG.......P...............................@.......p....@.................................<...P.... .......................0.......P..8............................R..@............P..............(Q..H............text...!8.......:.................. ..`.rdata......P.......>..............@..@.data...............................@....rsrc........ ......................@..@.reloc.. ....0......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Cohesion\Quakily\System.Security.Cryptography.X509Certificates.dll

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	485488
Entropy (8bit):	6.710350474742332
Encrypted:	false
SSDEEP:	6144:1E5AW+0VyAaOKxFf8r6S2rGjF0KAmdHCKsCZcufvh7OzxQxQ5JVIRVrk:KGWlaOKC2a0tmFChCOFeqLIRpk
MD5:	84D7B1FB924AEEFCF4A2C7A687FE2EF1
SHA1:	A2C2C7DE9096328A3FEF0C7FCEA262A294C0807B
SHA-256:	32A54C24B18B3C087E06F4F19885FB410304AB4AF2263154020D3F5CDCE36D99
SHA-512:	E75F91DA415B15CA0B19519179021FD88C0FC68FE4EF2A68B899B121BD511C04AECCB58101318C86CB0458D7310208C358DBB9155A02D62DE73C04128ECC5934
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....fW..........." .........................................................`............`...@......@............... ...........................................1...D..p$...P.......0..T...............................................................H............text.............................. ..`.data...wy.......z..................@....reloc.......P.......:..............@..B............................................0...........................T.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...................y.........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Delforliget\Melotragedy\Lindhardt\System.dll

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49768
Entropy (8bit):	5.650496280667822
Encrypted:	false
SSDEEP:	768:4vuoy1c6A2ZX8TRNH5JVbOd502zq1TntV5fljM:4vuoO3ZX8Q5jzC35NjM
MD5:	BCC32F5B608C99F89508921B6333B329
SHA1:	5F70BB4A3A812C399D8D2A2954C9A715574CFF61
SHA-256:	5D4FF9A8E3B3CA26F53CD2CC4C557C5F2074A431B9CD029AE7F7A7B8902FA3C1
SHA-512:	99C7623BCA873C75A3B804C815DF178ACC88E043A36473C785216CD26DC73F0525FE336F17F0F2C8CA6473FBD407A953D4650D093C52440D93ECF07C1440FAB6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Delforliget\Melotragedy\Lindhardt\System.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ....................................`.....................................O.......................h$.............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......P ......................`.......................................BSJB............v4.0.30319......l...$;..#~...;...R..#Strings....4.......#US.8.......#GUID...H.......#Blob............T.........3................................/......................=.....=....J=...=......V...}.....h.. ..... ..... ..J.. ..... ..... ..... ..1.. ..j.. .., AF..a.AF.....R..e..=.................;.....;.....;..)..;..1..;..9..;..A..;..I..;..Q..;..Y..;..a..;..i..;..q..;..y..;.....; ....;.....;..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Delforliget\Melotragedy\Lindhardt\libdatrie-1.dll

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	36029
Entropy (8bit):	5.699900454607003
Encrypted:	false
SSDEEP:	768:Hm5z53y6m/LHlM6GnPGUvMrsztd/sLLhF3VI:a53y6Gy6GuU5d/OhF3G
MD5:	8A54723090530190EB11AFCD5B702B1B
SHA1:	DFA923EC796A754BD21C4F9E504305848A4CB1B2
SHA-256:	738F67F45FAA07CC387BAF390604EE4CE709CBE7C223D9A043EE06F7CB360D5B
SHA-512:	E0D310458C8259112E07B153EDC86FDFF29E1B09648FED8D163D44DEB3BEE1545E7AD37BB00E9255DF6514844B21A829750848DA42F85FA77BEF376CE09750CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...........<.....&".....R..........0..........h.....................................^........ .................................................................................`...............................(....................................................text...HP.......R..................`.P`.data........p.......V..............@.P..rdata...............X..............@.`@.pdata...............b..............@.0@.xdata...............j..............@.0@.bss.... .............................`..edata...............r..............@.0@.idata...............v..............@.0..CRT....X............~..............@.@..tls................................@.@..reloc..`...........................@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard\libpkcs11-helper-1.dll

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	130344
Entropy (8bit):	6.2622011397185
Encrypted:	false
SSDEEP:	3072:tKInqqVjbm+1Vi5R6QQU7k1TAH1OobTrWHEE+jFpCOx:tVzjvi5R6QQU7k1TAH1OobTrWHExFpdx
MD5:	2455841538BA8A502398C18781CC3CEB
SHA1:	86CFD513FEE46EBC2C35225B27372679BE6ADA91
SHA-256:	F37BE7BD8C46D58CA931810536C8A2BEC36D06FF3281740FE0AD177F022AC781
SHA-512:	BC1DCDDE074150616DED7EAACC3FC44BDD2487EB5E550172F5EA46432AA76F19443A9FD6CEF61577B7803C1B083FFCBCEAF9ADC3114A97B547A78C2654F757E3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................&"....."....................\d.............................P......z.....`... .................................................X....0..................x....@.............................. ..(.......................P............................text...8!......."..................`.P`.data........@.......&..............@.`..rdata...^...P...`...(..............@.`@.pdata..............................@.0@.xdata..............................@.0@.bss..................................`..edata..............................@.0@.idata..X...........................@.0..CRT....X...........................@.@..tls....h.... ......................@.`..rsrc........0......................@.0..reloc.......@......................@.0B................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard\maintenanceservice2.exe

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	227256
Entropy (8bit):	6.388677533277947
Encrypted:	false
SSDEEP:	6144:ue/rKQgYva3o4vj272BNvIJuQlf2qIHL2:uYrK4a3PvKw7ufg2
MD5:	49A2E97304EF8E044EEBD7ACCAD37E11
SHA1:	7D0F26591C8BD4CAB1718E323B65706CBEA5DE7A
SHA-256:	83EAFBF165642C563CD468D12BC85E3A9BAEDE084E5B18F99466E071149FD15F
SHA-512:	AC206C5EF6F373A0005902D09110A95A7F5FB4F524653D30C3A65182717272FE244694A6698D40884BEA243B2CA00D7741CED796DF7AE8C633F513B8C6FCD6C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...J..b.........."......:.....................@....................................Y.....`..................................................................`..h....X..........................................(....P..............(...h............................text....9.......:.................. ..`.rdata.......P.......>..............@..@.data....!...0......................@....pdata..h....`.......*..............@..@.00cfg...............D..............@..@.tls.................F..............@....rsrc................H..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard\percentile.dll

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	102577
Entropy (8bit):	5.075179901575448
Encrypted:	false
SSDEEP:	768:t9H5uXFjJeEoPsznZgkZNhFdS2E0fVnSdNPfZ5+uKIu7aQzTgp37CtHRMX6NX0:tJ5wJeEoU9g0Nhav09nahfYxDRx0
MD5:	3144FDFEC817D0AC6FE3F4642B70328B
SHA1:	756C3513DC10CF00B517C72B2D3AB3E20895A46C
SHA-256:	BF17F5B38DCF35B55B1E0FAD462D4095ABAAA4CD8F1EDBDC8657C0249EF5D4D3
SHA-512:	012D9A3B88BA5D5090E8B47B49FE50E518489AB05FAAC6A1A0743F29A369B7D67F39B8E113B34740607137F2D67D75116DBE2A76E8E1DBE699BA4973F8037684
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...rL.`.<........& ...$.....6......P................................................U....`... .........................................Y....................P..................`............................A..(....................................................text...............................`.P`.data...p....0....... ..............@.P..rdata..p....@......."..............@.`@.pdata.......P.......*..............@.0@.xdata..l....`......................@.0@.bss.........p........................`..edata..Y............0..............@.0@.idata...............2..............@.0..CRT....X............6..............@.@..tls.................8..............@.@..reloc..`............:..............@.0B/4...................<..............@.PB/19.....C............@..............@..B/31..........`......................@..B/45.............. ..................@..B/57.....

C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.854901984552606
Encrypted:	false
SSDEEP:	192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
MD5:	0063D48AFE5A0CDC02833145667B6641
SHA1:	E7EB614805D183ECB1127C62DECB1A6BE1B4F7A8
SHA-256:	AC9DFE3B35EA4B8932536ED7406C29A432976B685CC5322F94EF93DF920FEDE7
SHA-512:	71CBBCAEB345E09306E368717EA0503FE8DF485BE2E95200FEBC61BCD8BA74FB4211CD263C232F148C0123F6C6F2E3FD4EA20BDECC4070F5208C35C6920240F0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ir.-.D.-.D.-.D...J..D.-.E.>.D......D.y0t.).D.N1n.,.D..3@.,.D.Rich-.D.........PE..L......]...........!..... ..........!).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...h....@.......(..............@....reloc..\|....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.974128626441633
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Quotation.exe
File size:	693360
MD5:	8a81948116d2ea79bee1d261733dba89
SHA1:	5cf4113debe6d37bd770d8d3870647b8bac082a3
SHA256:	5a64a3fd65f7176b7ad623893e3cb573af13eb51850f8243a1951884eee757a9
SHA512:	bc5707d66c79d3f01e29227514bc1fa938e0165b000b94efefdb3c8d2849e2ede859c037b103b9f85365cd178c179171e8e7dec071c71ba61b6e919d1eba8841
SSDEEP:	12288:QV5CSEuHKGQYpovMKcZnY4UKwp7hVOZCbgjvwf:QV51qFMccUNEZCbgjY
TLSH:	7BE42317B19382C3D5E749F53E698B3683B33F570D22878FF2AA37B19974914812A427
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.w.F......F...v...F...@...F.Rich..F.........PE..L......].................`..........52.......p....@

File Icon


Icon Hash:	84c8c888cac88800

Static PE Info

General

Entrypoint:	0x403235
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5DF6D4E3 [Mon Dec 16 00:50:43 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e9c0657252137ac61c1eeeba4c021000

Authenticode Signature

Signature Valid:	false
Signature Issuer:	E=Hjertecenteret@Brahminee.Sta, OU="Slewingslews Styrborde Nadines ", O=Demystify, L=Parlier, S=California, C=US
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	8/14/2022 6:11:02 PM 8/13/2025 6:11:02 PM
Subject Chain	E=Hjertecenteret@Brahminee.Sta, OU="Slewingslews Styrborde Nadines ", O=Demystify, L=Parlier, S=California, C=US
Version:	3
Thumbprint MD5:	62DE8C7E9FEEF9C1BE32A539EE8C3042
Thumbprint SHA-1:	3D54D8A3F7094698631D99D96688154B999E2C8B
Thumbprint SHA-256:	A645406AC892515D81FC329AB84ADDF8C558F2770665B05F23CFC9F4C322D1DC
Serial:	3F5567173D0043C048AB0658FB8124DCFF6DDE12

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004070A0h]
call dword ptr [0040709Ch]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042370Ch], eax
je 00007FD5E8C59E63h
push ebx
call 00007FD5E8C5CF4Bh
cmp eax, ebx
je 00007FD5E8C59E59h
push 00000C00h
call eax
mov esi, 00407298h
push esi
call 00007FD5E8C5CEC7h
push esi
call dword ptr [00407098h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007FD5E8C59E3Dh
push 0000000Ah
call 00007FD5E8C5CF1Fh
push 00000008h
call 00007FD5E8C5CF18h
push 00000006h
mov dword ptr [00423704h], eax
call 00007FD5E8C5CF0Ch
cmp eax, ebx
je 00007FD5E8C59E61h
push 0000001Eh
call eax
test eax, eax
je 00007FD5E8C59E59h
or byte ptr [0042370Fh], 00000040h
push ebp
call dword ptr [00407040h]
push ebx
call dword ptr [00407284h]
mov dword ptr [004237D8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041ECC8h
call dword ptr [00407178h]
push 00409188h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7430	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x36000	0x4568	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xa7228	0x2248
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x294	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5f7d	0x6000	False	0.6680094401041666	data	6.466064816043304	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x123e	0x1400	False	0.4275390625	data	4.989734782278587	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1a818	0x400	False	0.638671875	data	5.130817636118804	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x24000	0x12000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x36000	0x4568	0x4600	False	0.42265625	data	5.512282206254712	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x36268	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States
RT_ICON	0x38810	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States
RT_ICON	0x398b8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States
RT_DIALOG	0x39d20	0x100	data	English	United States
RT_DIALOG	0x39e20	0x11c	data	English	United States
RT_DIALOG	0x39f40	0xc4	data	English	United States
RT_DIALOG	0x3a008	0x60	data	English	United States
RT_GROUP_ICON	0x3a068	0x30	data	English	United States
RT_VERSION	0x3a098	0x190	data	English	United States
RT_MANIFEST	0x3a228	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	GetTempPathA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetEnvironmentVariableA, Sleep, GetTickCount, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GetWindowsDirectoryA, SetFileAttributesA, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, GetExitCodeProcess, WaitForSingleObject, CompareFileTime, SetFileTime, GetFileAttributesA, SetCurrentDirectoryA, MoveFileA, GetFullPathNameA, GetShortPathNameA, SearchPathA, CloseHandle, lstrcmpiA, CreateThread, GlobalLock, lstrcmpA, DeleteFileA, FindFirstFileA, FindNextFileA, FindClose, SetFilePointer, GetPrivateProfileStringA, WritePrivateProfileStringA, MulDiv, MultiByteToWideChar, FreeLibrary, LoadLibraryExA, GetModuleHandleA, GlobalAlloc, GlobalFree, ExpandEnvironmentStringsA
USER32.dll	GetSystemMenu, SetClassLongA, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, LoadImageA, CreateDialogParamA, SetTimer, SetWindowTextA, SetForegroundWindow, ShowWindow, SetWindowLongA, SendMessageTimeoutA, FindWindowExA, IsWindow, AppendMenuA, TrackPopupMenu, CreatePopupMenu, DrawTextA, EndPaint, DestroyWindow, wsprintfA, PostQuitMessage
GDI32.dll	SelectObject, SetTextColor, SetBkMode, CreateFontIndirectA, CreateBrushIndirect, DeleteObject, GetDeviceCaps, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExA, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, SHFileOperationA
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExA, RegOpenKeyExA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, RegEnumValueA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Report size exceeds maximum size, go to the download page of this report and download PCAP to see all network behavior.

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: Quotation.exePID: 2684, Parent PID: 3452

General

Target ID:	0
Start time:	14:47:23
Start date:	20/03/2023
Path:	C:\Users\user\Desktop\Quotation.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Quotation.exe
Imagebase:	0x400000
File size:	693360 bytes
MD5 hash:	8A81948116D2EA79BEE1D261733DBA89
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.773629937.0000000005789000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: Quotation.exePID: 2684, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	20.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17%
Total number of Nodes:	1527
Total number of Limit Nodes:	42

Executed Functions

Function 00403235 Relevance: 87.9, APIs: 32, Strings: 18, Instructions: 366
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			_entry_() {
				signed int _t42;
				intOrPtr* _t47;
				CHAR* _t51;
				char* _t53;
				CHAR* _t55;
				void* _t59;
				intOrPtr _t61;
				int _t63;
				int _t66;
				signed int _t67;
				int _t68;
				signed int _t70;
				void* _t94;
				signed int _t110;
				void* _t113;
				void* _t118;
				intOrPtr* _t119;
				char _t122;
				signed int _t141;
				signed int _t142;
				int _t150;
				void* _t151;
				intOrPtr* _t153;
				CHAR* _t156;
				CHAR* _t157;
				void* _t159;
				char* _t160;
				void* _t163;
				void* _t164;
				char _t189;

				 *(_t164 + 0x18) = 0;
				 *((intOrPtr*)(_t164 + 0x10)) = "Error writing temporary file. Make sure your temp folder is valid.";
				 *(_t164 + 0x20) = 0;
				 *(_t164 + 0x14) = 0x20;
				SetErrorMode(0x8001); // executed
				_t42 = GetVersion() & 0xbfffffff;
				 *0x42370c = _t42;
				if(_t42 != 6) {
					_t119 = E00406372(0);
					if(_t119 != 0) {
						 *_t119(0xc00);
					}
				}
				_t156 = "UXTHEME";
				do {
					E00406304(_t156); // executed
					_t156 =  &(_t156[lstrlenA(_t156) + 1]);
				} while ( *_t156 != 0);
				E00406372(0xa);
				 *0x423704 = E00406372(8);
				_t47 = E00406372(6);
				if(_t47 != 0) {
					_t47 =  *_t47(0x1e);
					if(_t47 != 0) {
						 *0x42370f =  *0x42370f | 0x00000040;
					}
				}
				__imp__#17(_t159);
				__imp__OleInitialize(0); // executed
				 *0x4237d8 = _t47;
				SHGetFileInfoA(0x41ecc8, 0, _t164 + 0x38, 0x160, 0); // executed
				E00405FDA(0x422f00, "NSIS Error");
				_t51 = GetCommandLineA();
				_t160 = "\"C:\\Users\\engineer\\Desktop\\Quotation.exe\"";
				E00405FDA(_t160, _t51);
				 *0x423700 = 0x400000;
				_t53 = _t160;
				if("\"C:\\Users\\engineer\\Desktop\\Quotation.exe\"" == 0x22) {
					 *(_t164 + 0x14) = 0x22;
					_t53 =  &M00429001;
				}
				_t55 = CharNextA(E0040599D(_t53,  *(_t164 + 0x14)));
				 *(_t164 + 0x1c) = _t55;
				while(1) {
					_t122 =  *_t55;
					_t172 = _t122;
					if(_t122 == 0) {
						break;
					}
					__eflags = _t122 - 0x20;
					if(_t122 != 0x20) {
						L13:
						__eflags =  *_t55 - 0x22;
						 *(_t164 + 0x14) = 0x20;
						if( *_t55 == 0x22) {
							_t55 =  &(_t55[1]);
							__eflags = _t55;
							 *(_t164 + 0x14) = 0x22;
						}
						__eflags =  *_t55 - 0x2f;
						if( *_t55 != 0x2f) {
							L25:
							_t55 = E0040599D(_t55,  *(_t164 + 0x14));
							__eflags =  *_t55 - 0x22;
							if(__eflags == 0) {
								_t55 =  &(_t55[1]);
								__eflags = _t55;
							}
							continue;
						} else {
							_t55 =  &(_t55[1]);
							__eflags =  *_t55 - 0x53;
							if( *_t55 != 0x53) {
								L20:
								__eflags =  *_t55 - ((( *0x409183 << 0x00000008 |  *0x409182) << 0x00000008 |  *0x409181) << 0x00000008 | "NCRC");
								if( *_t55 != ((( *0x409183 << 0x00000008 |  *0x409182) << 0x00000008 |  *0x409181) << 0x00000008 | "NCRC")) {
									L24:
									__eflags =  *((intOrPtr*)(_t55 - 2)) - ((( *0x40917b << 0x00000008 |  *0x40917a) << 0x00000008 |  *0x409179) << 0x00000008 | " /D=");
									if( *((intOrPtr*)(_t55 - 2)) == ((( *0x40917b << 0x00000008 |  *0x40917a) << 0x00000008 |  *0x409179) << 0x00000008 | " /D=")) {
										 *((char*)(_t55 - 2)) = 0;
										__eflags =  &(_t55[2]);
										E00405FDA("C:\\Users\\engineer\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto",  &(_t55[2]));
										L30:
										_t157 = "C:\\Users\\engineer\\AppData\\Local\\Temp\\";
										GetTempPathA(0x400, _t157);
										_t59 = E00403204(_t172);
										_t173 = _t59;
										if(_t59 != 0) {
											L33:
											DeleteFileA("1033"); // executed
											_t61 = E00402DC4(_t175,  *(_t164 + 0x20)); // executed
											 *((intOrPtr*)(_t164 + 0x10)) = _t61;
											if(_t61 != 0) {
												L43:
												E0040371D();
												__imp__OleUninitialize();
												_t185 =  *((intOrPtr*)(_t164 + 0x10));
												if( *((intOrPtr*)(_t164 + 0x10)) == 0) {
													__eflags =  *0x4237b4;
													if( *0x4237b4 == 0) {
														L67:
														_t63 =  *0x4237cc;
														__eflags = _t63 - 0xffffffff;
														if(_t63 != 0xffffffff) {
															 *(_t164 + 0x14) = _t63;
														}
														ExitProcess( *(_t164 + 0x14));
													}
													_t66 = OpenProcessToken(GetCurrentProcess(), 0x28, _t164 + 0x18);
													__eflags = _t66;
													_t150 = 2;
													if(_t66 != 0) {
														LookupPrivilegeValueA(0, "SeShutdownPrivilege", _t164 + 0x24);
														 *(_t164 + 0x38) = 1;
														 *(_t164 + 0x44) = _t150;
														AdjustTokenPrivileges( *(_t164 + 0x2c), 0, _t164 + 0x28, 0, 0, 0);
													}
													_t67 = E00406372(4);
													__eflags = _t67;
													if(_t67 == 0) {
														L65:
														_t68 = ExitWindowsEx(_t150, 0x80040002);
														__eflags = _t68;
														if(_t68 != 0) {
															goto L67;
														}
														goto L66;
													} else {
														_t70 =  *_t67(0, 0, 0, 0x25, 0x80040002);
														__eflags = _t70;
														if(_t70 == 0) {
															L66:
															E0040140B(9);
															goto L67;
														}
														goto L65;
													}
												}
												E004056F6( *((intOrPtr*)(_t164 + 0x10)), 0x200010);
												ExitProcess(2);
											}
											if( *0x423720 == 0) {
												L42:
												 *0x4237cc =  *0x4237cc | 0xffffffff;
												 *(_t164 + 0x18) = E004037F7( *0x4237cc);
												goto L43;
											}
											_t153 = E0040599D(_t160, 0);
											if(_t153 < _t160) {
												L39:
												_t182 = _t153 - _t160;
												 *((intOrPtr*)(_t164 + 0x10)) = "Error launching installer";
												if(_t153 < _t160) {
													_t151 = E00405661(_t185);
													lstrcatA(_t157, "~nsu");
													if(_t151 != 0) {
														lstrcatA(_t157, "A");
													}
													lstrcatA(_t157, ".tmp");
													_t162 = "C:\\Users\\engineer\\Desktop";
													if(lstrcmpiA(_t157, "C:\\Users\\engineer\\Desktop") != 0) {
														_push(_t157);
														if(_t151 == 0) {
															E00405644();
														} else {
															E004055C7();
														}
														SetCurrentDirectoryA(_t157);
														_t189 = "C:\\Users\\engineer\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto"; // 0x43
														if(_t189 == 0) {
															E00405FDA("C:\\Users\\engineer\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto", _t162);
														}
														E00405FDA(0x424000,  *(_t164 + 0x1c));
														_t137 = "A";
														_t163 = 0x1a;
														 *0x424400 = "A";
														do {
															E00405FFC(0, 0x41e8c8, _t157, 0x41e8c8,  *((intOrPtr*)( *0x423714 + 0x120)));
															DeleteFileA(0x41e8c8);
															if( *((intOrPtr*)(_t164 + 0x10)) != 0 && CopyFileA("C:\\Users\\engineer\\Desktop\\Quotation.exe", 0x41e8c8, 1) != 0) {
																E00405DB9(_t137, 0x41e8c8, 0);
																E00405FFC(0, 0x41e8c8, _t157, 0x41e8c8,  *((intOrPtr*)( *0x423714 + 0x124)));
																_t94 = E00405679(0x41e8c8);
																if(_t94 != 0) {
																	CloseHandle(_t94);
																	 *((intOrPtr*)(_t164 + 0x10)) = 0;
																}
															}
															 *0x424400 =  *0x424400 + 1;
															_t163 = _t163 - 1;
														} while (_t163 != 0);
														E00405DB9(_t137, _t157, 0);
													}
													goto L43;
												}
												 *_t153 = 0;
												_t154 = _t153 + 4;
												if(E00405A60(_t182, _t153 + 4) == 0) {
													goto L43;
												}
												E00405FDA("C:\\Users\\engineer\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto", _t154);
												E00405FDA("C:\\Users\\engineer\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto\\Forureningsforebygget\\Pegboard", _t154);
												 *((intOrPtr*)(_t164 + 0x10)) = 0;
												goto L42;
											}
											_t110 = (( *0x40915b << 0x00000008 |  *0x40915a) << 0x00000008 |  *0x409159) << 0x00000008 | " _?=";
											while( *_t153 != _t110) {
												_t153 = _t153 - 1;
												if(_t153 >= _t160) {
													continue;
												}
												goto L39;
											}
											goto L39;
										}
										GetWindowsDirectoryA(_t157, 0x3fb);
										lstrcatA(_t157, "\\Temp");
										_t113 = E00403204(_t173);
										_t174 = _t113;
										if(_t113 != 0) {
											goto L33;
										}
										GetTempPathA(0x3fc, _t157);
										lstrcatA(_t157, "Low");
										SetEnvironmentVariableA("TEMP", _t157);
										SetEnvironmentVariableA("TMP", _t157);
										_t118 = E00403204(_t174);
										_t175 = _t118;
										if(_t118 == 0) {
											goto L43;
										}
										goto L33;
									}
									goto L25;
								}
								_t141 = _t55[4];
								__eflags = _t141 - 0x20;
								if(_t141 == 0x20) {
									L23:
									_t15 = _t164 + 0x20;
									 *_t15 =  *(_t164 + 0x20) | 0x00000004;
									__eflags =  *_t15;
									goto L24;
								}
								__eflags = _t141;
								if(_t141 != 0) {
									goto L24;
								}
								goto L23;
							}
							_t142 = _t55[1];
							__eflags = _t142 - 0x20;
							if(_t142 == 0x20) {
								L19:
								 *0x4237c0 = 1;
								goto L20;
							}
							__eflags = _t142;
							if(_t142 != 0) {
								goto L20;
							}
							goto L19;
						}
					} else {
						goto L12;
					}
					do {
						L12:
						_t55 =  &(_t55[1]);
						__eflags =  *_t55 - 0x20;
					} while ( *_t55 == 0x20);
					goto L13;
				}
				goto L30;
			}

0x00403245
0x00403249
0x00403251
0x00403255
0x0040325a
0x00403266
0x0040326f
0x00403274
0x00403277
0x0040327e
0x00403285
0x00403285
0x0040327e
0x00403287
0x0040328c
0x0040328d
0x00403299
0x0040329d
0x004032a3
0x004032b1
0x004032b6
0x004032bd
0x004032c1
0x004032c5
0x004032c7
0x004032c7
0x004032c5
0x004032cf
0x004032d6
0x004032dc
0x004032f2
0x00403302
0x00403307
0x0040330d
0x00403314
0x00403320
0x0040332a
0x0040332c
0x0040332e
0x00403333
0x00403333
0x00403343
0x00403349
0x00403412
0x00403412
0x00403414
0x00403416
0x00000000
0x00000000
0x00403352
0x00403355
0x0040335d
0x0040335d
0x00403360
0x00403365
0x00403367
0x00403367
0x00403368
0x00403368
0x0040336d
0x00403370
0x00403402
0x00403407
0x0040340c
0x0040340f
0x00403411
0x00403411
0x00403411
0x00000000
0x00403376
0x00403376
0x00403377
0x0040337a
0x00403392
0x004033bd
0x004033bf
0x004033d2
0x004033fd
0x00403400
0x0040341e
0x00403421
0x0040342a
0x0040342f
0x00403435
0x00403440
0x00403442
0x00403447
0x00403449
0x004034a1
0x004034a6
0x004034b0
0x004034b7
0x004034bb
0x0040354f
0x0040354f
0x00403554
0x0040355a
0x0040355f
0x00403683
0x00403689
0x00403705
0x00403705
0x0040370a
0x0040370d
0x0040370f
0x0040370f
0x00403717
0x00403717
0x00403699
0x004036a1
0x004036a3
0x004036a4
0x004036b1
0x004036c4
0x004036cc
0x004036d0
0x004036d0
0x004036d8
0x004036dd
0x004036e4
0x004036f2
0x004036f4
0x004036fa
0x004036fc
0x00000000
0x00000000
0x00000000
0x004036e6
0x004036ec
0x004036ee
0x004036f0
0x004036fe
0x00403700
0x00000000
0x00403700
0x00000000
0x004036f0
0x004036e4
0x0040356e
0x00403575
0x00403575
0x004034c7
0x0040353f
0x0040353f
0x0040354b
0x00000000
0x0040354b
0x004034d0
0x004034d4
0x0040350a
0x0040350a
0x0040350c
0x00403514
0x00403586
0x00403588
0x0040358f
0x00403597
0x00403597
0x004035a2
0x004035a7
0x004035b6
0x004035ba
0x004035bb
0x004035c4
0x004035bd
0x004035bd
0x004035bd
0x004035ca
0x004035d0
0x004035d6
0x004035de
0x004035de
0x004035ec
0x004035f1
0x00403603
0x0040360b
0x00403611
0x0040361d
0x00403623
0x0040362d
0x00403643
0x00403654
0x0040365a
0x00403661
0x00403664
0x0040366a
0x0040366a
0x00403661
0x0040366e
0x00403674
0x00403674
0x00403679
0x00403679
0x00000000
0x004035b6
0x00403516
0x00403518
0x00403523
0x00000000
0x00000000
0x0040352b
0x00403536
0x0040353b
0x00000000
0x0040353b
0x004034ff
0x00403501
0x00403505
0x00403508
0x00000000
0x00000000
0x00000000
0x00403508
0x00000000
0x00403501
0x00403451
0x0040345d
0x00403462
0x00403467
0x00403469
0x00000000
0x00000000
0x00403471
0x00403479
0x0040348a
0x00403492
0x00403494
0x00403499
0x0040349b
0x00000000
0x00000000
0x00000000
0x0040349b
0x00000000
0x00403400
0x004033c1
0x004033c4
0x004033c7
0x004033cd
0x004033cd
0x004033cd
0x004033cd
0x00000000
0x004033cd
0x004033c9
0x004033cb
0x00000000
0x00000000
0x00000000
0x004033cb
0x0040337c
0x0040337f
0x00403382
0x00403388
0x00403388
0x00000000
0x00403388
0x00403384
0x00403386
0x00000000
0x00000000
0x00000000
0x00403386
0x00000000
0x00000000
0x00000000
0x00403357
0x00403357
0x00403357
0x00403358
0x00403358
0x00000000
0x00403357
0x00000000

APIs

SetErrorMode.KERNELBASE ref: 0040325A
GetVersion.KERNEL32 ref: 00403260
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403293
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 004032CF
OleInitialize.OLE32(00000000), ref: 004032D6
SHGetFileInfoA.SHELL32(0041ECC8,00000000,?,00000160,00000000,?,00000006,00000008,0000000A), ref: 004032F2
GetCommandLineA.KERNEL32(00422F00,NSIS Error,?,00000006,00000008,0000000A), ref: 00403307
CharNextA.USER32(00000000,"C:\Users\user\Desktop\Quotation.exe",00000020,"C:\Users\user\Desktop\Quotation.exe",00000000,?,00000006,00000008,0000000A), ref: 00403343
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000006,00000008,0000000A), ref: 00403440
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 00403451
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 0040345D
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403471
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403479
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 0040348A
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 00403492
DeleteFileA.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 004034A6

Part of subcall function 00406372: GetModuleHandleA.KERNEL32(?,?,?,004032A8,0000000A), ref: 00406384
Part of subcall function 00406372: GetProcAddress.KERNEL32(00000000,?), ref: 0040639F

Part of subcall function 004037F7: lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto,1033,Sepad149: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Sepad149: Installing,00000000,00000002,746AFA90), ref: 004038E7
Part of subcall function 004037F7: lstrcmpiA.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto,1033,Sepad149: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Sepad149: Installing,00000000), ref: 004038FA
Part of subcall function 004037F7: GetFileAttributesA.KERNEL32(Call), ref: 00403905
Part of subcall function 004037F7: LoadImageA.USER32 ref: 0040394E
Part of subcall function 004037F7: RegisterClassA.USER32 ref: 0040398B

Part of subcall function 0040371D: CloseHandle.KERNEL32(00000284,00403554,?,?,00000006,00000008,0000000A), ref: 00403728

OleUninitialize.OLE32(?,?,00000006,00000008,0000000A), ref: 00403554
ExitProcess.KERNEL32 ref: 00403575
GetCurrentProcess.KERNEL32(00000028,?,00000006,00000008,0000000A), ref: 00403692
OpenProcessToken.ADVAPI32(00000000), ref: 00403699
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004036B1
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 004036D0
ExitWindowsEx.USER32(00000002,80040002), ref: 004036F4
ExitProcess.KERNEL32 ref: 00403717

Part of subcall function 004056F6: MessageBoxIndirectA.USER32 ref: 00405751

Strings

1033, xrefs: 004034A1
"C:\Users\user\Desktop\Quotation.exe", xrefs: 0040330D, 00403313, 004034CA
.tmp, xrefs: 0040359C
Low, xrefs: 00403473
SeShutdownPrivilege, xrefs: 004036AB
UXTHEME, xrefs: 00403287, 0040328C, 00403292
C:\Users\user\AppData\Local\Temp\, xrefs: 00403435, 0040343A, 00403450, 0040345C, 0040346B, 00403478, 00403484, 0040348C, 00403585, 00403596, 004035A1, 004035AD, 004035BA, 004035C9, 00403678
C:\Users\user\Desktop, xrefs: 004035A7, 004035AC, 004035D8
TEMP, xrefs: 00403485
\Temp, xrefs: 00403457
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard, xrefs: 00403531
NSIS Error, xrefs: 004032F8
C:\Users\user\Desktop\Quotation.exe, xrefs: 00403632
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto, xrefs: 00403425, 00403526, 004035D0, 004035D9
~nsu, xrefs: 00403580
", xrefs: 00403368
TMP, xrefs: 0040348D
Error launching installer, xrefs: 0040350C

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Process$ExitFile$EnvironmentHandlePathTempTokenVariableWindowslstrcatlstrlen$AddressAdjustAttributesCharClassCloseCommandCurrentDeleteDirectoryErrorImageIndirectInfoInitializeLineLoadLookupMessageModeModuleNextOpenPrivilegePrivilegesProcRegisterUninitializeValueVersionlstrcmpi
String ID: "$"C:\Users\user\Desktop\Quotation.exe"$.tmp$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Quotation.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3776617018-2131484203
Opcode ID: 47f0f4bfed41ce18027c3f7b4cd283128f530326f184dcc79bdceb26c856a261
Instruction ID: 70de6b230954929a2c0fab4aa6e61a8dc1a32ac2bd4530e0982157a086cffda4
Opcode Fuzzy Hash: 47f0f4bfed41ce18027c3f7b4cd283128f530326f184dcc79bdceb26c856a261
Instruction Fuzzy Hash: 62C1F6706086526AE7216F759D49B2F3EA8EB81706F04453FF541B61E2CB7C8E05CB2E

Uniqueness

Uniqueness Score: -1.00%

Function 0040523F Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E0040523F(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				struct tagRECT _v24;
				void* _v32;
				signed int _v36;
				int _v40;
				int _v44;
				signed int _v48;
				int _v52;
				void* _v56;
				void* _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t87;
				struct HWND__* _t89;
				long _t90;
				int _t95;
				int _t96;
				long _t99;
				void* _t102;
				intOrPtr _t113;
				void* _t121;
				intOrPtr _t124;
				struct HWND__* _t128;
				int _t150;
				int _t153;
				long _t157;
				struct HWND__* _t161;
				struct HMENU__* _t163;
				long _t165;
				void* _t166;
				char* _t167;
				char* _t168;
				int _t169;

				_t87 =  *0x422ee4; // 0x10446
				_t157 = _a8;
				_t150 = 0;
				_v8 = _t87;
				if(_t157 != 0x110) {
					__eflags = _t157 - 0x405;
					if(_t157 == 0x405) {
						_t121 = CreateThread(0, 0, E004051D3, GetDlgItem(_a4, 0x3ec), 0,  &_a8); // executed
						FindCloseChangeNotification(_t121);
					}
					__eflags = _t157 - 0x111;
					if(_t157 != 0x111) {
						L17:
						__eflags = _t157 - 0x404;
						if(_t157 != 0x404) {
							L25:
							__eflags = _t157 - 0x7b;
							if(_t157 != 0x7b) {
								goto L20;
							}
							_t89 = _v8;
							__eflags = _a12 - _t89;
							if(_a12 != _t89) {
								goto L20;
							}
							_t90 = SendMessageA(_t89, 0x1004, _t150, _t150);
							__eflags = _t90 - _t150;
							_a12 = _t90;
							if(_t90 <= _t150) {
								L36:
								return 0;
							}
							_t163 = CreatePopupMenu();
							AppendMenuA(_t163, _t150, 1, E00405FFC(_t150, _t157, _t163, _t150, 0xffffffe1));
							_t95 = _a16;
							__eflags = _a16 - 0xffffffff;
							_t153 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v24);
								_t95 = _v24.left;
								_t153 = _v24.top;
							}
							_t96 = TrackPopupMenu(_t163, 0x180, _t95, _t153, _t150, _a4, _t150);
							__eflags = _t96 - 1;
							if(_t96 == 1) {
								_t165 = 1;
								__eflags = 1;
								_v56 = _t150;
								_v44 = 0x41fd08;
								_v40 = 0x1000;
								_a4 = _a12;
								do {
									_a4 = _a4 - 1;
									_t99 = SendMessageA(_v8, 0x102d, _a4,  &_v64);
									__eflags = _a4 - _t150;
									_t165 = _t165 + _t99 + 2;
								} while (_a4 != _t150);
								OpenClipboard(_t150);
								EmptyClipboard();
								_t102 = GlobalAlloc(0x42, _t165);
								_a4 = _t102;
								_t166 = GlobalLock(_t102);
								do {
									_v44 = _t166;
									_t167 = _t166 + SendMessageA(_v8, 0x102d, _t150,  &_v64);
									 *_t167 = 0xd;
									_t168 = _t167 + 1;
									 *_t168 = 0xa;
									_t166 = _t168 + 1;
									_t150 = _t150 + 1;
									__eflags = _t150 - _a12;
								} while (_t150 < _a12);
								GlobalUnlock(_a4);
								SetClipboardData(1, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						__eflags =  *0x422ecc - _t150; // 0x0
						if(__eflags == 0) {
							ShowWindow( *0x423708, 8);
							__eflags =  *0x4237ac - _t150;
							if( *0x4237ac == _t150) {
								_t113 =  *0x41f4e0; // 0x7eb2d4
								E00405101( *((intOrPtr*)(_t113 + 0x34)), _t150);
							}
							E00404041(1);
							goto L25;
						}
						 *0x41f0d8 = 2;
						E00404041(0x78);
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E004040CF(_t157, _a12, _a16);
						}
						ShowWindow( *0x422ed0, _t150);
						ShowWindow(_v8, 8);
						E0040409D(_v8);
						goto L17;
					}
				}
				_v48 = _v48 | 0xffffffff;
				_v36 = _v36 | 0xffffffff;
				_t169 = 2;
				_v56 = _t169;
				_v52 = 0;
				_v44 = 0;
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				_t124 =  *0x423714;
				_a12 =  *((intOrPtr*)(_t124 + 0x5c));
				_a8 =  *((intOrPtr*)(_t124 + 0x60));
				 *0x422ed0 = GetDlgItem(_a4, 0x403);
				 *0x422ec8 = GetDlgItem(_a4, 0x3ee);
				_t128 = GetDlgItem(_a4, 0x3f8);
				 *0x422ee4 = _t128;
				_v8 = _t128;
				E0040409D( *0x422ed0);
				 *0x422ed4 = E0040498E(4);
				 *0x422eec = 0;
				GetClientRect(_v8,  &_v24);
				_v48 = _v24.right - GetSystemMetrics(_t169);
				SendMessageA(_v8, 0x101b, 0,  &_v56); // executed
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000); // executed
				if(_a12 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a12);
					SendMessageA(_v8, 0x1026, 0, _a12);
				}
				if(_a8 >= _t150) {
					SendMessageA(_v8, 0x1024, _t150, _a8);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00404068(_a4);
				if(( *0x42371c & 0x00000003) != 0) {
					ShowWindow( *0x422ed0, _t150);
					if(( *0x42371c & 0x00000002) != 0) {
						 *0x422ed0 = _t150;
					} else {
						ShowWindow(_v8, 8);
					}
					E0040409D( *0x422ec8);
				}
				_t161 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t161, 0x401, _t150, 0x75300000);
				if(( *0x42371c & 0x00000004) != 0) {
					SendMessageA(_t161, 0x409, _t150, _a8);
					SendMessageA(_t161, 0x2001, _t150, _a12);
				}
				goto L36;
			}

0x00405245
0x0040524d
0x00405250
0x00405258
0x0040525b
0x004053ea
0x004053f0
0x0040540d
0x00405414
0x00405414
0x00405420
0x00405426
0x00405448
0x00405448
0x0040544e
0x004054a3
0x004054a3
0x004054a6
0x00000000
0x00000000
0x004054a8
0x004054ab
0x004054ae
0x00000000
0x00000000
0x004054b8
0x004054be
0x004054c0
0x004054c3
0x004055c0
0x00000000
0x004055c0
0x004054d2
0x004054de
0x004054e7
0x004054ee
0x004054f2
0x004054f5
0x004054fe
0x00405504
0x00405507
0x00405507
0x00405517
0x0040551d
0x00405520
0x0040552b
0x0040552b
0x0040552c
0x0040552f
0x00405536
0x0040553d
0x00405545
0x00405545
0x00405553
0x00405559
0x0040555c
0x0040555c
0x00405563
0x00405569
0x00405572
0x00405579
0x00405582
0x00405584
0x00405587
0x00405596
0x00405598
0x0040559b
0x0040559c
0x0040559f
0x004055a0
0x004055a1
0x004055a1
0x004055a9
0x004055b4
0x004055ba
0x004055ba
0x00000000
0x00405520
0x00405450
0x00405456
0x00405484
0x00405486
0x0040548c
0x0040548e
0x00405497
0x00405497
0x0040549e
0x00000000
0x0040549e
0x0040545a
0x00405464
0x00000000
0x00405428
0x00405428
0x0040542e
0x00405469
0x00000000
0x00405470
0x00405437
0x0040543e
0x00405443
0x00000000
0x00405443
0x00405426
0x00405261
0x00405265
0x0040526d
0x00405271
0x00405274
0x00405277
0x0040527a
0x0040527d
0x0040527e
0x0040527f
0x00405298
0x0040529b
0x004052a5
0x004052b4
0x004052bc
0x004052c4
0x004052c9
0x004052cc
0x004052d8
0x004052e1
0x004052ea
0x0040530c
0x00405312
0x00405323
0x00405328
0x00405336
0x00405344
0x00405344
0x00405349
0x00405357
0x00405357
0x0040535c
0x0040535f
0x00405364
0x00405370
0x00405379
0x00405386
0x00405395
0x00405388
0x0040538d
0x0040538d
0x004053a1
0x004053a1
0x004053b5
0x004053be
0x004053c7
0x004053d7
0x004053e3
0x004053e3
0x00000000

APIs

GetDlgItem.USER32 ref: 0040529E
GetDlgItem.USER32 ref: 004052AD
GetClientRect.USER32 ref: 004052EA
GetSystemMetrics.USER32 ref: 004052F1
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405312
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405323
SendMessageA.USER32(?,00001001,00000000,?), ref: 00405336
SendMessageA.USER32(?,00001026,00000000,?), ref: 00405344
SendMessageA.USER32(?,00001024,00000000,?), ref: 00405357
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405379
ShowWindow.USER32(?,00000008), ref: 0040538D
GetDlgItem.USER32 ref: 004053AE
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004053BE
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004053D7
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004053E3
GetDlgItem.USER32 ref: 004052BC

Part of subcall function 0040409D: SendMessageA.USER32(00000028,?,00000001,00403ECD), ref: 004040AB

GetDlgItem.USER32 ref: 004053FF
CreateThread.KERNELBASE ref: 0040540D
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00405414
ShowWindow.USER32(00000000), ref: 00405437
ShowWindow.USER32(?,00000008), ref: 0040543E
ShowWindow.USER32(00000008), ref: 00405484
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004054B8
CreatePopupMenu.USER32 ref: 004054C9
AppendMenuA.USER32 ref: 004054DE
GetWindowRect.USER32 ref: 004054FE
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405517
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405553
OpenClipboard.USER32(00000000), ref: 00405563
EmptyClipboard.USER32 ref: 00405569
GlobalAlloc.KERNEL32(00000042,?), ref: 00405572
GlobalLock.KERNEL32 ref: 0040557C
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405590
GlobalUnlock.KERNEL32(00000000), ref: 004055A9
SetClipboardData.USER32 ref: 004055B4
CloseClipboard.USER32 ref: 004055BA

Strings

Sepad149: Installing, xrefs: 0040552F

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendChangeClientDataEmptyFindLockMetricsNotificationOpenSystemThreadTrackUnlock
String ID: Sepad149: Installing
API String ID: 4154960007-2190826614
Opcode ID: 5e248db37e798cb99e868fa2efa30f8b142e25c36e83f8749ee739c671aa7136
Instruction ID: b9a96890980d2d8b9797d0de0d5ce2eab2fec2a682b8a0b11cb6d69254f0e8d6
Opcode Fuzzy Hash: 5e248db37e798cb99e868fa2efa30f8b142e25c36e83f8749ee739c671aa7136
Instruction Fuzzy Hash: C4A15CB1900208BFDB119FA0DD89AAE7FB9FB48355F00403AFA05B61A0C7B55E51DF69

Uniqueness

Uniqueness Score: -1.00%

Function 6D011A98 Relevance: 18.6, APIs: 12, Instructions: 585
stringmemorylibraryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E6D011A98() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				CHAR* _v24;
				CHAR* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				CHAR* _v48;
				signed int _v52;
				void* _v56;
				intOrPtr _v60;
				CHAR* _t207;
				signed int _t210;
				void* _t212;
				void* _t214;
				CHAR* _t216;
				void* _t224;
				struct HINSTANCE__* _t225;
				signed int _t226;
				signed int _t228;
				signed int _t230;
				struct HINSTANCE__* _t233;
				signed int _t235;
				void* _t236;
				char* _t237;
				void* _t248;
				signed char _t249;
				signed int _t250;
				void* _t254;
				signed int _t256;
				void* _t257;
				signed int _t259;
				intOrPtr _t260;
				char* _t263;
				signed int _t268;
				signed int _t271;
				signed int _t273;
				void* _t276;
				void* _t280;
				signed int _t282;
				intOrPtr _t285;
				void _t286;
				signed int _t287;
				signed int _t299;
				signed int _t300;
				intOrPtr _t303;
				void* _t304;
				signed int _t308;
				signed int _t311;
				signed int _t314;
				signed int _t315;
				signed int _t316;
				intOrPtr _t319;
				intOrPtr* _t320;
				CHAR* _t321;
				CHAR* _t323;
				CHAR* _t324;
				struct HINSTANCE__* _t325;
				void* _t327;
				signed int _t328;
				void* _t329;

				_t282 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				_v8 = 0;
				_v40 = 0;
				_t329 = 0;
				_v52 = 0;
				_v44 = 0;
				_t207 = E6D011215();
				_v24 = _t207;
				_v28 = _t207;
				_v48 = E6D011215();
				_t320 = E6D01123B();
				_v56 = _t320;
				_v12 = _t320;
				while(1) {
					_t210 = _v32;
					_v60 = _t210;
					if(_t210 != _t282 && _t329 == _t282) {
						break;
					}
					_t319 =  *_t320;
					_t285 = _t319;
					_t212 = _t285 - _t282;
					if(_t212 == 0) {
						_t37 =  &_v32;
						 *_t37 = _v32 | 0xffffffff;
						__eflags =  *_t37;
						L20:
						_t214 = _v60 - _t282;
						if(_t214 == 0) {
							 *_v28 =  *_v28 & 0x00000000;
							__eflags = _t329 - _t282;
							if(_t329 == _t282) {
								_t254 = GlobalAlloc(0x40, 0x14a4); // executed
								_t329 = _t254;
								 *(_t329 + 0x810) = _t282;
								 *(_t329 + 0x814) = _t282;
							}
							_t286 = _v36;
							_t47 = _t329 + 8; // 0x8
							_t216 = _t47;
							_t48 = _t329 + 0x408; // 0x408
							_t321 = _t48;
							 *_t329 = _t286;
							 *_t216 =  *_t216 & 0x00000000;
							 *(_t329 + 0x808) = _t282;
							 *_t321 =  *_t321 & 0x00000000;
							_t287 = _t286 - _t282;
							__eflags = _t287;
							 *(_t329 + 0x80c) = _t282;
							 *(_t329 + 4) = _t282;
							if(_t287 == 0) {
								__eflags = _v28 - _v24;
								if(_v28 == _v24) {
									goto L42;
								}
								_t327 = 0;
								GlobalFree(_t329);
								_t329 = E6D0112FE(_v24);
								__eflags = _t329 - _t282;
								if(_t329 == _t282) {
									goto L42;
								} else {
									goto L35;
								}
								while(1) {
									L35:
									_t248 =  *(_t329 + 0x14a0);
									__eflags = _t248 - _t282;
									if(_t248 == _t282) {
										break;
									}
									_t327 = _t329;
									_t329 = _t248;
									__eflags = _t329 - _t282;
									if(_t329 != _t282) {
										continue;
									}
									break;
								}
								__eflags = _t327 - _t282;
								if(_t327 != _t282) {
									 *(_t327 + 0x14a0) = _t282;
								}
								_t249 =  *(_t329 + 0x810);
								__eflags = _t249 & 0x00000008;
								if((_t249 & 0x00000008) == 0) {
									_t250 = _t249 | 0x00000002;
									__eflags = _t250;
									 *(_t329 + 0x810) = _t250;
								} else {
									_t329 = E6D011534(_t329);
									 *(_t329 + 0x810) =  *(_t329 + 0x810) & 0xfffffff5;
								}
								goto L42;
							} else {
								_t299 = _t287 - 1;
								__eflags = _t299;
								if(_t299 == 0) {
									L31:
									lstrcpyA(_t216, _v48);
									L32:
									lstrcpyA(_t321, _v24);
									L42:
									_v12 = _v12 + 1;
									_v28 = _v24;
									L59:
									if(_v32 != 0xffffffff) {
										_t320 = _v12;
										continue;
									}
									break;
								}
								_t300 = _t299 - 1;
								__eflags = _t300;
								if(_t300 == 0) {
									goto L32;
								}
								__eflags = _t300 != 1;
								if(_t300 != 1) {
									goto L42;
								}
								goto L31;
							}
						}
						if(_t214 == 1) {
							_t256 = _v16;
							if(_v40 == _t282) {
								_t256 = _t256 - 1;
							}
							 *(_t329 + 0x814) = _t256;
						}
						goto L42;
					}
					_t257 = _t212 - 0x23;
					if(_t257 == 0) {
						__eflags = _t320 - _v56;
						if(_t320 <= _v56) {
							L17:
							__eflags = _v44 - _t282;
							if(_v44 != _t282) {
								L43:
								_t259 = _v32 - _t282;
								__eflags = _t259;
								if(_t259 == 0) {
									_t260 = _t319;
									while(1) {
										__eflags = _t260 - 0x22;
										if(_t260 != 0x22) {
											break;
										}
										_t320 = _t320 + 1;
										__eflags = _v44 - _t282;
										_v12 = _t320;
										if(_v44 == _t282) {
											_v44 = 1;
											L162:
											_v28 =  &(_v28[1]);
											 *_v28 =  *_t320;
											L58:
											_t328 = _t320 + 1;
											__eflags = _t328;
											_v12 = _t328;
											goto L59;
										}
										_t260 =  *_t320;
										_v44 = _t282;
									}
									__eflags = _t260 - 0x2a;
									if(_t260 == 0x2a) {
										_v36 = 2;
										L57:
										_t320 = _v12;
										_v28 = _v24;
										_t282 = 0;
										__eflags = 0;
										goto L58;
									}
									__eflags = _t260 - 0x2d;
									if(_t260 == 0x2d) {
										L151:
										_t303 =  *_t320;
										__eflags = _t303 - 0x2d;
										if(_t303 != 0x2d) {
											L154:
											_t263 = _t320 + 1;
											__eflags =  *_t263 - 0x3a;
											if( *_t263 != 0x3a) {
												goto L162;
											}
											__eflags = _t303 - 0x2d;
											if(_t303 == 0x2d) {
												goto L162;
											}
											_v36 = 1;
											L157:
											_v12 = _t263;
											__eflags = _v28 - _v24;
											if(_v28 <= _v24) {
												 *_v48 =  *_v48 & 0x00000000;
											} else {
												 *_v28 =  *_v28 & 0x00000000;
												lstrcpyA(_v48, _v24);
											}
											goto L57;
										}
										_t263 = _t320 + 1;
										__eflags =  *_t263 - 0x3e;
										if( *_t263 != 0x3e) {
											goto L154;
										}
										_v36 = 3;
										goto L157;
									}
									__eflags = _t260 - 0x3a;
									if(_t260 != 0x3a) {
										goto L162;
									}
									goto L151;
								}
								_t268 = _t259 - 1;
								__eflags = _t268;
								if(_t268 == 0) {
									L80:
									_t304 = _t285 + 0xffffffde;
									__eflags = _t304 - 0x55;
									if(_t304 > 0x55) {
										goto L57;
									}
									switch( *((intOrPtr*)(( *(_t304 + 0x6d012259) & 0x000000ff) * 4 +  &M6D0121CD))) {
										case 0:
											__eax = _v24;
											__edi = _v12;
											while(1) {
												__edi = __edi + 1;
												_v12 = __edi;
												__cl =  *__edi;
												__eflags = __cl - __dl;
												if(__cl != __dl) {
													goto L132;
												}
												L131:
												__eflags =  *(__edi + 1) - __dl;
												if( *(__edi + 1) != __dl) {
													L136:
													 *__eax =  *__eax & 0x00000000;
													__eax = E6D011224(_v24);
													__ebx = __eax;
													goto L97;
												}
												L132:
												__eflags = __cl;
												if(__cl == 0) {
													goto L136;
												}
												__eflags = __cl - __dl;
												if(__cl == __dl) {
													__edi = __edi + 1;
													__eflags = __edi;
												}
												__cl =  *__edi;
												 *__eax =  *__edi;
												__eax = __eax + 1;
												__edi = __edi + 1;
												_v12 = __edi;
												__cl =  *__edi;
												__eflags = __cl - __dl;
												if(__cl != __dl) {
													goto L132;
												}
												goto L131;
											}
										case 1:
											_v8 = 1;
											goto L57;
										case 2:
											_v8 = _v8 | 0xffffffff;
											goto L57;
										case 3:
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v16 = _v16 + 1;
											goto L85;
										case 4:
											__eflags = _v20;
											if(_v20 != 0) {
												goto L57;
											}
											_v12 = _v12 - 1;
											__ebx = E6D011215();
											 &_v12 = E6D011A36( &_v12);
											__eax = E6D011429(__edx, __eax, __edx, __ebx);
											goto L97;
										case 5:
											L105:
											_v20 = _v20 + 1;
											goto L57;
										case 6:
											_push(7);
											goto L123;
										case 7:
											_push(0x19);
											goto L143;
										case 8:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L107;
										case 9:
											_push(0x15);
											goto L143;
										case 0xa:
											_push(0x16);
											goto L143;
										case 0xb:
											_push(0x18);
											goto L143;
										case 0xc:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L118;
										case 0xd:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L109;
										case 0xe:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L111;
										case 0xf:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L122;
										case 0x10:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L113;
										case 0x11:
											_push(3);
											goto L123;
										case 0x12:
											_push(0x17);
											L143:
											_pop(__ebx);
											goto L98;
										case 0x13:
											__eax =  &_v12;
											__eax = E6D011A36( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											__eflags = __ebx - 0xb;
											if(__ebx < 0xb) {
												__ebx = __ebx + 0xa;
											}
											goto L97;
										case 0x14:
											__ebx = 0xffffffff;
											goto L98;
										case 0x15:
											__eax = 0;
											__eflags = 0;
											goto L116;
										case 0x16:
											__ecx = 0;
											__eflags = 0;
											goto L91;
										case 0x17:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L120;
										case 0x18:
											_t270 =  *(_t329 + 0x814);
											__eflags = _t270 - _v16;
											if(_t270 > _v16) {
												_v16 = _t270;
											}
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v36 - 3 = _t270 - (_v36 == 3);
											if(_t270 != _v36 == 3) {
												L85:
												_v40 = 1;
											}
											goto L57;
										case 0x19:
											L107:
											__ecx = 0;
											_v8 = 2;
											__ecx = 1;
											goto L91;
										case 0x1a:
											L118:
											_push(5);
											goto L123;
										case 0x1b:
											L109:
											__ecx = 0;
											_v8 = 3;
											__ecx = 1;
											goto L91;
										case 0x1c:
											L111:
											__ecx = 0;
											__ecx = 1;
											goto L91;
										case 0x1d:
											L122:
											_push(6);
											goto L123;
										case 0x1e:
											L113:
											_push(2);
											goto L123;
										case 0x1f:
											__eax =  &_v12;
											__eax = E6D011A36( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											goto L97;
										case 0x20:
											L116:
											_v52 = _v52 + 1;
											_push(3);
											_pop(__ecx);
											goto L91;
										case 0x21:
											L120:
											_push(4);
											L123:
											_pop(__ecx);
											L91:
											__edi = _v16;
											__edx =  *(0x6d01305c + __ecx * 4);
											__eax =  ~__eax;
											asm("sbb eax, eax");
											_v40 = 1;
											__edi = _v16 << 5;
											__eax = __eax & 0x00008000;
											__edi = (_v16 << 5) + __esi;
											__eax = __eax | __ecx;
											__eflags = _v8;
											 *(__edi + 0x818) = __eax;
											if(_v8 < 0) {
												L93:
												__edx = 0;
												__edx = 1;
												__eflags = 1;
												L94:
												__eflags = _v8 - 1;
												 *(__edi + 0x828) = __edx;
												if(_v8 == 1) {
													__eax =  &_v12;
													__eax = E6D011A36( &_v12);
													__eax = __eax + 1;
													__eflags = __eax;
													_v8 = __eax;
												}
												__eax = _v8;
												 *((intOrPtr*)(__edi + 0x81c)) = _v8;
												_t136 = _v16 + 0x41; // 0x41
												_t136 = _t136 << 5;
												__eax = 0;
												__eflags = 0;
												 *((intOrPtr*)((_t136 << 5) + __esi)) = 0;
												 *((intOrPtr*)(__edi + 0x830)) = 0;
												 *((intOrPtr*)(__edi + 0x82c)) = 0;
												L97:
												__eflags = __ebx;
												if(__ebx == 0) {
													goto L57;
												}
												L98:
												__eflags = _v20;
												_v40 = 1;
												if(_v20 != 0) {
													L103:
													__eflags = _v20 - 1;
													if(_v20 == 1) {
														__eax = _v16;
														__eax = _v16 << 5;
														__eflags = __eax;
														 *(__eax + __esi + 0x82c) = __ebx;
													}
													goto L105;
												}
												_v16 = _v16 << 5;
												_t144 = __esi + 0x830; // 0x830
												__edi = (_v16 << 5) + _t144;
												__eax =  *__edi;
												__eflags = __eax - 0xffffffff;
												if(__eax <= 0xffffffff) {
													L101:
													__eax = GlobalFree(__eax);
													L102:
													 *__edi = __ebx;
													goto L103;
												}
												__eflags = __eax - 0x19;
												if(__eax <= 0x19) {
													goto L102;
												}
												goto L101;
											}
											__eflags = __edx;
											if(__edx > 0) {
												goto L94;
											}
											goto L93;
										case 0x22:
											goto L57;
									}
								}
								_t271 = _t268 - 1;
								__eflags = _t271;
								if(_t271 == 0) {
									_v16 = _t282;
									goto L80;
								}
								__eflags = _t271 != 1;
								if(_t271 != 1) {
									goto L162;
								}
								__eflags = _t285 - 0x6e;
								if(__eflags > 0) {
									_t308 = _t285 - 0x72;
									__eflags = _t308;
									if(_t308 == 0) {
										_push(4);
										L74:
										_pop(_t273);
										L75:
										__eflags = _v8 - 1;
										if(_v8 != 1) {
											_t96 = _t329 + 0x810;
											 *_t96 =  *(_t329 + 0x810) &  !_t273;
											__eflags =  *_t96;
										} else {
											 *(_t329 + 0x810) =  *(_t329 + 0x810) | _t273;
										}
										_v8 = 1;
										goto L57;
									}
									_t311 = _t308 - 1;
									__eflags = _t311;
									if(_t311 == 0) {
										_push(0x10);
										goto L74;
									}
									__eflags = _t311 != 0;
									if(_t311 != 0) {
										goto L57;
									}
									_push(0x40);
									goto L74;
								}
								if(__eflags == 0) {
									_push(8);
									goto L74;
								}
								_t314 = _t285 - 0x21;
								__eflags = _t314;
								if(_t314 == 0) {
									_v8 =  ~_v8;
									goto L57;
								}
								_t315 = _t314 - 0x11;
								__eflags = _t315;
								if(_t315 == 0) {
									_t273 = 0x100;
									goto L75;
								}
								_t316 = _t315 - 0x31;
								__eflags = _t316;
								if(_t316 == 0) {
									_t273 = 1;
									goto L75;
								}
								__eflags = _t316 != 0;
								if(_t316 != 0) {
									goto L57;
								}
								_push(0x20);
								goto L74;
							}
							_v32 = _t282;
							_v36 = _t282;
							goto L20;
						}
						__eflags =  *((char*)(_t320 - 1)) - 0x3a;
						if( *((char*)(_t320 - 1)) != 0x3a) {
							goto L17;
						}
						__eflags = _v32 - _t282;
						if(_v32 == _t282) {
							goto L43;
						}
						goto L17;
					}
					_t276 = _t257 - 5;
					if(_t276 == 0) {
						__eflags = _v44 - _t282;
						if(_v44 != _t282) {
							goto L43;
						}
						__eflags = _v36 - 3;
						_v32 = 1;
						_v8 = _t282;
						_v20 = _t282;
						_v16 = (0 | _v36 == 0x00000003) + 1;
						_v40 = _t282;
						goto L20;
					}
					_t280 = _t276 - 1;
					if(_t280 == 0) {
						__eflags = _v44 - _t282;
						if(_v44 != _t282) {
							goto L43;
						} else {
							_v32 = 2;
							_v8 = _t282;
							_v20 = _t282;
							goto L20;
						}
					}
					if(_t280 != 0x16) {
						goto L43;
					} else {
						_v32 = 3;
						_v8 = 1;
						goto L20;
					}
				}
				GlobalFree(_v56);
				GlobalFree(_v24);
				GlobalFree(_v48);
				if(_t329 == _t282 ||  *(_t329 + 0x80c) != _t282) {
					L183:
					return _t329;
				} else {
					_t224 =  *_t329 - 1;
					if(_t224 == 0) {
						_t187 = _t329 + 8; // 0x8
						_t323 = _t187;
						__eflags =  *_t323;
						if( *_t323 != 0) {
							_t225 = GetModuleHandleA(_t323);
							__eflags = _t225 - _t282;
							 *(_t329 + 0x808) = _t225;
							if(_t225 != _t282) {
								L171:
								_t192 = _t329 + 0x408; // 0x408
								_t324 = _t192;
								_t226 = E6D0115C2( *(_t329 + 0x808), _t324);
								__eflags = _t226 - _t282;
								 *(_t329 + 0x80c) = _t226;
								if(_t226 != _t282) {
									L177:
									__eflags = _v52 - _t282;
									if(_v52 != _t282) {
										L179:
										_t324[lstrlenA(_t324)] = 0x41;
										_t228 = E6D0115C2( *(_t329 + 0x808), _t324);
										__eflags = _t228 - _t282;
										if(_t228 != _t282) {
											L166:
											 *(_t329 + 0x80c) = _t228;
											goto L183;
										}
										__eflags =  *(_t329 + 0x80c) - _t282;
										L181:
										if(__eflags != 0) {
											goto L183;
										}
										L182:
										_t205 = _t329 + 4;
										 *_t205 =  *(_t329 + 4) | 0xffffffff;
										__eflags =  *_t205;
										goto L183;
									}
									__eflags =  *(_t329 + 0x80c) - _t282;
									if( *(_t329 + 0x80c) != _t282) {
										goto L183;
									}
									goto L179;
								}
								__eflags =  *_t324 - 0x23;
								if( *_t324 != 0x23) {
									goto L177;
								}
								_t195 = _t329 + 0x409; // 0x409
								_t230 = E6D0112FE(_t195);
								__eflags = _t230 - _t282;
								if(_t230 == _t282) {
									goto L177;
								}
								__eflags = _t230 & 0xffff0000;
								if ((_t230 & 0xffff0000) != 0) goto L177;
								_push(ss);
							}
							_t233 = LoadLibraryA(_t323);
							__eflags = _t233 - _t282;
							 *(_t329 + 0x808) = _t233;
							if(_t233 == _t282) {
								goto L182;
							}
							goto L171;
						}
						_t188 = _t329 + 0x408; // 0x408
						_t235 = E6D0112FE(_t188);
						 *(_t329 + 0x80c) = _t235;
						__eflags = _t235 - _t282;
						goto L181;
					}
					_t236 = _t224 - 1;
					if(_t236 == 0) {
						_t185 = _t329 + 0x408; // 0x408
						_t237 = _t185;
						__eflags =  *_t237;
						if( *_t237 == 0) {
							goto L183;
						}
						_t228 = E6D0112FE(_t237);
						L165:
						goto L166;
					}
					if(_t236 != 1) {
						goto L183;
					}
					_t81 = _t329 + 8; // 0x8
					_t283 = _t81;
					_t325 = E6D0112FE(_t81);
					 *(_t329 + 0x808) = _t325;
					if(_t325 == 0) {
						goto L182;
					}
					 *(_t329 + 0x84c) =  *(_t329 + 0x84c) & 0x00000000;
					 *((intOrPtr*)(_t329 + 0x850)) = E6D011224(_t283);
					 *(_t329 + 0x83c) =  *(_t329 + 0x83c) & 0x00000000;
					 *((intOrPtr*)(_t329 + 0x848)) = 1;
					 *((intOrPtr*)(_t329 + 0x838)) = 1;
					_t90 = _t329 + 0x408; // 0x408
					_t228 =  *(_t325->i + E6D0112FE(_t90) * 4);
					goto L165;
				}
			}

0x6d011aa0
0x6d011aa3
0x6d011aa6
0x6d011aa9
0x6d011aac
0x6d011aaf
0x6d011ab2
0x6d011ab4
0x6d011ab7
0x6d011aba
0x6d011abf
0x6d011ac2
0x6d011aca
0x6d011ad2
0x6d011ad4
0x6d011ad7
0x6d011adf
0x6d011adf
0x6d011ae4
0x6d011ae7
0x00000000
0x00000000
0x6d011af1
0x6d011af3
0x6d011af8
0x6d011afa
0x6d011b8b
0x6d011b8b
0x6d011b8b
0x6d011b8f
0x6d011b92
0x6d011b94
0x6d011bb6
0x6d011bb9
0x6d011bbb
0x6d011bc4
0x6d011bca
0x6d011bcc
0x6d011bd2
0x6d011bd2
0x6d011bd8
0x6d011bdb
0x6d011bdb
0x6d011bde
0x6d011bde
0x6d011be4
0x6d011be6
0x6d011be9
0x6d011bef
0x6d011bf2
0x6d011bf2
0x6d011bf4
0x6d011bfa
0x6d011bfd
0x6d011c21
0x6d011c24
0x00000000
0x00000000
0x6d011c27
0x6d011c29
0x6d011c37
0x6d011c3a
0x6d011c3c
0x00000000
0x00000000
0x00000000
0x00000000
0x6d011c3e
0x6d011c3e
0x6d011c3e
0x6d011c44
0x6d011c46
0x00000000
0x00000000
0x6d011c48
0x6d011c4a
0x6d011c4c
0x6d011c4e
0x00000000
0x00000000
0x00000000
0x6d011c4e
0x6d011c50
0x6d011c52
0x6d011c54
0x6d011c54
0x6d011c5a
0x6d011c60
0x6d011c62
0x6d011c76
0x6d011c76
0x6d011c78
0x6d011c64
0x6d011c6a
0x6d011c6d
0x6d011c6d
0x00000000
0x6d011bff
0x6d011bff
0x6d011bff
0x6d011c00
0x6d011c08
0x6d011c0c
0x6d011c12
0x6d011c16
0x6d011c7e
0x6d011c81
0x6d011c84
0x6d011cf6
0x6d011cfa
0x6d011adc
0x00000000
0x6d011adc
0x00000000
0x6d011cfa
0x6d011c02
0x6d011c02
0x6d011c03
0x00000000
0x00000000
0x6d011c05
0x6d011c06
0x00000000
0x00000000
0x00000000
0x6d011c06
0x6d011bfd
0x6d011b97
0x6d011ba0
0x6d011ba3
0x6d011bb0
0x6d011bb0
0x6d011ba5
0x6d011ba5
0x00000000
0x6d011b97
0x6d011b00
0x6d011b03
0x6d011b66
0x6d011b69
0x6d011b7a
0x6d011b7a
0x6d011b7d
0x6d011c89
0x6d011c8c
0x6d011c8c
0x6d011c8e
0x6d012033
0x6d012045
0x6d012045
0x6d012047
0x00000000
0x00000000
0x6d012037
0x6d012038
0x6d01203b
0x6d01203e
0x6d0120ba
0x6d0120c1
0x6d0120c6
0x6d0120c9
0x6d011cf2
0x6d011cf2
0x6d011cf2
0x6d011cf3
0x00000000
0x6d011cf3
0x6d012040
0x6d012042
0x6d012042
0x6d012049
0x6d01204b
0x6d0120ae
0x6d011ce7
0x6d011cea
0x6d011ced
0x6d011cf0
0x6d011cf0
0x00000000
0x6d011cf0
0x6d01204d
0x6d01204f
0x6d012055
0x6d012055
0x6d012057
0x6d01205a
0x6d01206d
0x6d01206d
0x6d012070
0x6d012073
0x00000000
0x00000000
0x6d012075
0x6d012078
0x00000000
0x00000000
0x6d01207a
0x6d012081
0x6d012081
0x6d012087
0x6d01208a
0x6d0120a6
0x6d01208c
0x6d012095
0x6d012098
0x6d012098
0x00000000
0x6d01208a
0x6d01205c
0x6d01205f
0x6d012062
0x00000000
0x00000000
0x6d012064
0x00000000
0x6d012064
0x6d012051
0x6d012053
0x00000000
0x00000000
0x00000000
0x6d012053
0x6d011c94
0x6d011c94
0x6d011c95
0x6d011dde
0x6d011dde
0x6d011de5
0x6d011de8
0x00000000
0x00000000
0x6d011df5
0x00000000
0x6d011fdb
0x6d011fde
0x6d011fe1
0x6d011fe1
0x6d011fe2
0x6d011fe5
0x6d011fe7
0x6d011fe9
0x00000000
0x00000000
0x6d011feb
0x6d011feb
0x6d011fee
0x6d012000
0x6d012003
0x6d012006
0x6d01200c
0x00000000
0x6d01200c
0x6d011ff0
0x6d011ff0
0x6d011ff2
0x00000000
0x00000000
0x6d011ff4
0x6d011ff6
0x6d011ff8
0x6d011ff8
0x6d011ff8
0x6d011ff9
0x6d011ffb
0x6d011ffd
0x6d011fe1
0x6d011fe2
0x6d011fe5
0x6d011fe7
0x6d011fe9
0x00000000
0x00000000
0x00000000
0x6d011fe9
0x00000000
0x6d011e3c
0x00000000
0x00000000
0x6d011e48
0x00000000
0x00000000
0x6d011e2f
0x6d011e33
0x6d011e37
0x00000000
0x00000000
0x6d011fad
0x6d011fb1
0x00000000
0x00000000
0x6d011fb7
0x6d011fbf
0x6d011fc6
0x6d011fce
0x00000000
0x00000000
0x6d011f15
0x6d011f15
0x00000000
0x00000000
0x6d011e51
0x00000000
0x00000000
0x6d01202b
0x00000000
0x00000000
0x6d011f1d
0x6d011f1f
0x6d011f1f
0x00000000
0x00000000
0x6d01201b
0x00000000
0x00000000
0x6d01201f
0x00000000
0x00000000
0x6d012027
0x00000000
0x00000000
0x6d011f64
0x6d011f66
0x6d011f66
0x00000000
0x00000000
0x6d011f2f
0x6d011f31
0x6d011f31
0x00000000
0x00000000
0x6d011f41
0x6d011f43
0x6d011f43
0x00000000
0x00000000
0x6d011f72
0x6d011f74
0x6d011f74
0x00000000
0x00000000
0x6d011f4c
0x6d011f4e
0x6d011f4e
0x00000000
0x00000000
0x6d011f53
0x00000000
0x00000000
0x6d012023
0x6d01202d
0x6d01202d
0x00000000
0x00000000
0x6d011f7d
0x6d011f81
0x6d011f86
0x6d011f89
0x6d011f8a
0x6d011f8d
0x6d011f93
0x6d011f93
0x00000000
0x00000000
0x6d012013
0x00000000
0x00000000
0x6d011f57
0x6d011f57
0x00000000
0x00000000
0x6d011e58
0x6d011e58
0x00000000
0x00000000
0x6d011f6b
0x6d011f6d
0x6d011f6d
0x00000000
0x00000000
0x6d011dfc
0x6d011e02
0x6d011e05
0x6d011e07
0x6d011e07
0x6d011e0a
0x6d011e0e
0x6d011e1b
0x6d011e1d
0x6d011e23
0x6d011e23
0x6d011e23
0x00000000
0x00000000
0x6d011f20
0x6d011f20
0x6d011f22
0x6d011f29
0x00000000
0x00000000
0x6d011f67
0x6d011f67
0x00000000
0x00000000
0x6d011f32
0x6d011f32
0x6d011f34
0x6d011f3b
0x00000000
0x00000000
0x6d011f44
0x6d011f44
0x6d011f46
0x00000000
0x00000000
0x6d011f75
0x6d011f75
0x00000000
0x00000000
0x6d011f4f
0x6d011f4f
0x00000000
0x00000000
0x6d011f9b
0x6d011f9f
0x6d011fa4
0x6d011fa7
0x00000000
0x00000000
0x6d011f59
0x6d011f59
0x6d011f5c
0x6d011f5e
0x00000000
0x00000000
0x6d011f6e
0x6d011f6e
0x6d011f77
0x6d011f77
0x6d011e5a
0x6d011e5a
0x6d011e5d
0x6d011e64
0x6d011e66
0x6d011e68
0x6d011e6f
0x6d011e72
0x6d011e77
0x6d011e79
0x6d011e7b
0x6d011e7f
0x6d011e85
0x6d011e8b
0x6d011e8b
0x6d011e8d
0x6d011e8d
0x6d011e8e
0x6d011e8e
0x6d011e92
0x6d011e98
0x6d011e9a
0x6d011e9e
0x6d011ea3
0x6d011ea3
0x6d011ea5
0x6d011ea5
0x6d011ea8
0x6d011eab
0x6d011eb4
0x6d011eb7
0x6d011eba
0x6d011eba
0x6d011ebc
0x6d011ebf
0x6d011ec5
0x6d011ecb
0x6d011ecb
0x6d011ecd
0x00000000
0x00000000
0x6d011ed3
0x6d011ed3
0x6d011ed7
0x6d011ede
0x6d011f02
0x6d011f02
0x6d011f06
0x6d011f08
0x6d011f0b
0x6d011f0b
0x6d011f0e
0x6d011f0e
0x00000000
0x6d011f06
0x6d011ee3
0x6d011ee6
0x6d011ee6
0x6d011eed
0x6d011eef
0x6d011ef2
0x6d011ef9
0x6d011efa
0x6d011f00
0x6d011f00
0x00000000
0x6d011f00
0x6d011ef4
0x6d011ef7
0x00000000
0x00000000
0x00000000
0x6d011ef7
0x6d011e87
0x6d011e89
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6d011df5
0x6d011c9b
0x6d011c9b
0x6d011c9c
0x6d011ddb
0x00000000
0x6d011ddb
0x6d011ca2
0x6d011ca3
0x00000000
0x00000000
0x6d011ca9
0x6d011cac
0x6d011da0
0x6d011da0
0x6d011da3
0x6d011db8
0x6d011dba
0x6d011dba
0x6d011dbb
0x6d011dbe
0x6d011dc1
0x6d011dcd
0x6d011dcd
0x6d011dcd
0x6d011dc3
0x6d011dc3
0x6d011dc3
0x6d011dd3
0x00000000
0x6d011dd3
0x6d011da5
0x6d011da5
0x6d011da6
0x6d011db4
0x00000000
0x6d011db4
0x6d011da9
0x6d011daa
0x00000000
0x00000000
0x6d011db0
0x00000000
0x6d011db0
0x6d011cb2
0x6d011d9c
0x00000000
0x6d011d9c
0x6d011cb8
0x6d011cb8
0x6d011cbb
0x6d011ce4
0x00000000
0x6d011ce4
0x6d011cbd
0x6d011cbd
0x6d011cc0
0x6d011cda
0x00000000
0x6d011cda
0x6d011cc2
0x6d011cc2
0x6d011cc5
0x6d011cd4
0x00000000
0x6d011cd4
0x6d011cc8
0x6d011cc9
0x00000000
0x00000000
0x6d011ccb
0x00000000
0x6d011ccb
0x6d011b83
0x6d011b86
0x00000000
0x6d011b86
0x6d011b6b
0x6d011b6f
0x00000000
0x00000000
0x6d011b71
0x6d011b74
0x00000000
0x00000000
0x00000000
0x6d011b74
0x6d011b05
0x6d011b08
0x6d011b3e
0x6d011b41
0x00000000
0x00000000
0x6d011b49
0x6d011b4d
0x6d011b54
0x6d011b5b
0x6d011b5e
0x6d011b61
0x00000000
0x6d011b61
0x6d011b0a
0x6d011b0b
0x6d011b26
0x6d011b29
0x00000000
0x6d011b2f
0x6d011b2f
0x6d011b36
0x6d011b39
0x00000000
0x6d011b39
0x6d011b29
0x6d011b10
0x00000000
0x6d011b16
0x6d011b16
0x6d011b1d
0x00000000
0x6d011b1d
0x6d011b10
0x6d011d09
0x6d011d0e
0x6d011d13
0x6d011d17
0x6d0121c6
0x6d0121cc
0x6d011d29
0x6d011d2b
0x6d011d2c
0x6d0120f1
0x6d0120f1
0x6d0120f4
0x6d0120f7
0x6d012114
0x6d01211a
0x6d01211c
0x6d012122
0x6d012139
0x6d012139
0x6d012139
0x6d012146
0x6d01214c
0x6d01214f
0x6d012155
0x6d01218a
0x6d01218a
0x6d01218d
0x6d012197
0x6d01219f
0x6d0121ab
0x6d0121b1
0x6d0121b4
0x6d0120e6
0x6d0120e6
0x00000000
0x6d0120e6
0x6d0121ba
0x6d0121c0
0x6d0121c0
0x00000000
0x00000000
0x6d0121c2
0x6d0121c2
0x6d0121c2
0x6d0121c2
0x00000000
0x6d0121c2
0x6d01218f
0x6d012195
0x00000000
0x00000000
0x00000000
0x6d012195
0x6d012157
0x6d01215a
0x00000000
0x00000000
0x6d01215c
0x6d012163
0x6d012168
0x6d01216b
0x00000000
0x00000000
0x6d01216d
0x6d012172
0x6d012173
0x6d012173
0x6d012125
0x6d01212b
0x6d01212d
0x6d012133
0x00000000
0x00000000
0x00000000
0x6d012133
0x6d0120f9
0x6d012100
0x6d012106
0x6d01210c
0x00000000
0x6d01210c
0x6d011d32
0x6d011d33
0x6d0120d0
0x6d0120d0
0x6d0120d6
0x6d0120d9
0x00000000
0x00000000
0x6d0120e0
0x6d0120e5
0x00000000
0x6d0120e5
0x6d011d3a
0x00000000
0x00000000
0x6d011d40
0x6d011d40
0x6d011d49
0x6d011d4e
0x6d011d54
0x00000000
0x00000000
0x6d011d5a
0x6d011d67
0x6d011d6d
0x6d011d77
0x6d011d7d
0x6d011d85
0x6d011d95
0x00000000
0x6d011d95

APIs

Part of subcall function 6D011215: GlobalAlloc.KERNEL32(00000040,6D011233,?,6D0112CF,-6D01404B,6D0111AB,-000000A0), ref: 6D01121D

GlobalAlloc.KERNELBASE(00000040,000014A4), ref: 6D011BC4
lstrcpyA.KERNEL32(00000008,?), ref: 6D011C0C
lstrcpyA.KERNEL32(00000408,?), ref: 6D011C16
GlobalFree.KERNEL32 ref: 6D011C29
GlobalFree.KERNEL32 ref: 6D011D09
GlobalFree.KERNEL32 ref: 6D011D0E
GlobalFree.KERNEL32 ref: 6D011D13
GlobalFree.KERNEL32 ref: 6D011EFA
lstrcpyA.KERNEL32(?,?), ref: 6D012098
GetModuleHandleA.KERNEL32(00000008), ref: 6D012114
LoadLibraryA.KERNEL32(00000008), ref: 6D012125

Memory Dump Source

Source File: 00000000.00000002.779239899.000000006D011000.00000020.00000001.01000000.00000004.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000000.00000002.779220127.000000006D010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.779251763.000000006D013000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.779269562.000000006D015000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d010000_Quotation.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$HandleLibraryLoadModule
String ID:
API String ID: 1962388997-0
Opcode ID: fae8ea7e4dc05ecd17121ad9a2742b0db8b2aa3a3de6eb409988264afb04ec61
Instruction ID: 431fb9df1273591f5ea47adf4bb33422475909409abb59f66c1ec38c07096be1
Opcode Fuzzy Hash: fae8ea7e4dc05ecd17121ad9a2742b0db8b2aa3a3de6eb409988264afb04ec61
Instruction Fuzzy Hash: 8D229A71D5C60ADEEB29CFE88C813ADBBF0BB16305F50852ED1A5A3180D7745681CB92

Uniqueness

Uniqueness Score: -1.00%

Function 004057A2 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E004057A2(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				signed int _v16;
				struct _WIN32_FIND_DATAA _v336;
				signed int _t40;
				char* _t53;
				signed int _t55;
				signed int _t58;
				signed int _t64;
				signed int _t66;
				void* _t68;
				signed char _t69;
				CHAR* _t71;
				void* _t72;
				CHAR* _t73;
				char* _t76;

				_t69 = _a8;
				_t73 = _a4;
				_v8 = _t69 & 0x00000004;
				_t40 = E00405A60(__eflags, _t73);
				_v16 = _t40;
				if((_t69 & 0x00000008) != 0) {
					_t66 = DeleteFileA(_t73); // executed
					asm("sbb eax, eax");
					_t68 =  ~_t66 + 1;
					 *0x4237a8 =  *0x4237a8 + _t68;
					return _t68;
				}
				_a4 = _t69;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E00405FDA(0x420d10, _t73);
					__eflags = _a4;
					if(_a4 == 0) {
						E004059B9(_t73);
					} else {
						lstrcatA(0x420d10, "\*.*");
					}
					__eflags =  *_t73;
					if( *_t73 != 0) {
						L10:
						lstrcatA(_t73, 0x409014);
						L11:
						_t71 =  &(_t73[lstrlenA(_t73)]);
						_t40 = FindFirstFileA(0x420d10,  &_v336);
						__eflags = _t40 - 0xffffffff;
						_v12 = _t40;
						if(_t40 == 0xffffffff) {
							L29:
							__eflags = _a4;
							if(_a4 != 0) {
								_t32 = _t71 - 1;
								 *_t32 =  *(_t71 - 1) & 0x00000000;
								__eflags =  *_t32;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t76 =  &(_v336.cFileName);
							_t53 = E0040599D( &(_v336.cFileName), 0x3f);
							__eflags =  *_t53;
							if( *_t53 != 0) {
								__eflags = _v336.cAlternateFileName;
								if(_v336.cAlternateFileName != 0) {
									_t76 =  &(_v336.cAlternateFileName);
								}
							}
							__eflags =  *_t76 - 0x2e;
							if( *_t76 != 0x2e) {
								L19:
								E00405FDA(_t71, _t76);
								__eflags = _v336.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t55 = E0040575A(__eflags, _t73, _v8);
									__eflags = _t55;
									if(_t55 != 0) {
										E00405101(0xfffffff2, _t73);
									} else {
										__eflags = _v8 - _t55;
										if(_v8 == _t55) {
											 *0x4237a8 =  *0x4237a8 + 1;
										} else {
											E00405101(0xfffffff1, _t73);
											E00405DB9(_t72, _t73, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E004057A2(__eflags, _t73, _a8);
									}
								}
								goto L27;
							}
							_t64 =  *((intOrPtr*)(_t76 + 1));
							__eflags = _t64;
							if(_t64 == 0) {
								goto L27;
							}
							__eflags = _t64 - 0x2e;
							if(_t64 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t76 + 2));
							if( *((char*)(_t76 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t58 = FindNextFileA(_v12,  &_v336);
							__eflags = _t58;
						} while (_t58 != 0);
						_t40 = FindClose(_v12);
						goto L29;
					}
					__eflags =  *0x420d10 - 0x5c;
					if( *0x420d10 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t40;
					if(_t40 == 0) {
						L31:
						__eflags = _a4;
						if(_a4 == 0) {
							L39:
							return _t40;
						}
						__eflags = _v16;
						if(_v16 != 0) {
							_t40 = E004062DD(_t73);
							__eflags = _t40;
							if(_t40 == 0) {
								goto L39;
							}
							E00405972(_t73);
							_t40 = E0040575A(__eflags, _t73, _v8 | 0x00000001);
							__eflags = _t40;
							if(_t40 != 0) {
								return E00405101(0xffffffe5, _t73);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L33;
							}
							E00405101(0xfffffff1, _t73);
							return E00405DB9(_t72, _t73, 0);
						}
						L33:
						 *0x4237a8 =  *0x4237a8 + 1;
						return _t40;
					}
					__eflags = _t69 & 0x00000002;
					if((_t69 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}

0x004057ac
0x004057b1
0x004057ba
0x004057bd
0x004057c5
0x004057c8
0x004057cb
0x004057d3
0x004057d5
0x004057d6
0x00000000
0x004057d6
0x004057e1
0x004057e4
0x004057e4
0x004057e4
0x004057e8
0x004057fb
0x00405802
0x00405807
0x0040580b
0x0040581b
0x0040580d
0x00405813
0x00405813
0x00405820
0x00405823
0x0040582e
0x00405834
0x00405839
0x00405849
0x0040584b
0x00405851
0x00405854
0x00405857
0x0040590f
0x0040590f
0x00405913
0x00405915
0x00405915
0x00405915
0x00405915
0x00000000
0x00000000
0x00000000
0x00000000
0x0040585d
0x0040585d
0x00405866
0x0040586c
0x00405871
0x00405874
0x00405876
0x0040587a
0x0040587c
0x0040587c
0x0040587a
0x0040587f
0x00405882
0x00405895
0x00405897
0x0040589c
0x004058a3
0x004058be
0x004058c3
0x004058c5
0x004058e9
0x004058c7
0x004058c7
0x004058ca
0x004058de
0x004058cc
0x004058cf
0x004058d7
0x004058d7
0x004058ca
0x004058a5
0x004058ab
0x004058ad
0x004058b3
0x004058b3
0x004058ad
0x00000000
0x004058a3
0x00405884
0x00405887
0x00405889
0x00000000
0x00000000
0x0040588b
0x0040588d
0x00000000
0x00000000
0x0040588f
0x00405893
0x00000000
0x00000000
0x00000000
0x004058ee
0x004058f8
0x004058fe
0x004058fe
0x00405909
0x00000000
0x00405909
0x00405825
0x0040582c
0x00000000
0x00000000
0x00000000
0x004057ea
0x004057ea
0x004057ec
0x00405919
0x0040591b
0x0040591e
0x0040596f
0x0040596f
0x0040596f
0x00405920
0x00405923
0x0040592e
0x00405933
0x00405935
0x00000000
0x00000000
0x00405938
0x00405944
0x00405949
0x0040594b
0x00000000
0x00405966
0x0040594d
0x00405950
0x00000000
0x00000000
0x00405955
0x00000000
0x0040595c
0x00405925
0x00405925
0x00000000
0x00405925
0x004057f2
0x004057f5
0x00000000
0x00000000
0x00000000
0x004057f5

APIs

DeleteFileA.KERNELBASE(?,?,746AFA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004057CB
lstrcatA.KERNEL32(00420D10,\*.*,00420D10,?,?,746AFA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405813
lstrcatA.KERNEL32(?,00409014,?,00420D10,?,?,746AFA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405834
lstrlenA.KERNEL32(?,?,00409014,?,00420D10,?,?,746AFA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040583A
FindFirstFileA.KERNEL32(00420D10,?,?,?,00409014,?,00420D10,?,?,746AFA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040584B
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004058F8
FindClose.KERNEL32(00000000), ref: 00405909

Strings

\*.*, xrefs: 0040580D
"C:\Users\user\Desktop\Quotation.exe", xrefs: 004057A2
C:\Users\user\AppData\Local\Temp\, xrefs: 004057AF

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\Quotation.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3534435454
Opcode ID: 9534ed492e479d78e2508825cc8aff22a23d0aad2da830bd7208bf437f0dd8c3
Instruction ID: d5f8e1a5a2f38c4268bcbec4acbb3c578bb2518a62eabdffbc14051f19ad4651
Opcode Fuzzy Hash: 9534ed492e479d78e2508825cc8aff22a23d0aad2da830bd7208bf437f0dd8c3
Instruction Fuzzy Hash: F251E171900A18BADB21BB228C45BAF7A79DF42724F14807BF841B51D2D77C8942DEAD

Uniqueness

Uniqueness Score: -1.00%

Function 00402138 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139
comCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00402138() {
				signed int _t55;
				void* _t59;
				intOrPtr* _t63;
				intOrPtr _t64;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t73;
				intOrPtr* _t75;
				intOrPtr* _t78;
				intOrPtr* _t80;
				intOrPtr* _t82;
				intOrPtr* _t84;
				int _t87;
				intOrPtr* _t95;
				signed int _t105;
				signed int _t109;
				void* _t111;

				 *(_t111 - 0x10) = E00402B2C(0xfffffff0);
				 *(_t111 - 0xc) = E00402B2C(0xffffffdf);
				 *((intOrPtr*)(_t111 - 0x44)) = E00402B2C(2);
				 *((intOrPtr*)(_t111 - 0x40)) = E00402B2C(0xffffffcd);
				 *((intOrPtr*)(_t111 - 0x4c)) = E00402B2C(0x45);
				_t55 =  *(_t111 - 0x24);
				 *(_t111 - 0x88) = _t55 & 0x00000fff;
				_t105 = _t55 & 0x00008000;
				_t109 = _t55 >> 0x0000000c & 0x00000007;
				 *(_t111 - 0x3c) = _t55 >> 0x00000010 & 0x0000ffff;
				if(E004059DF( *(_t111 - 0xc)) == 0) {
					E00402B2C(0x21);
				}
				_t59 = _t111 + 8;
				__imp__CoCreateInstance(0x407410, _t87, 1, 0x407400, _t59); // executed
				if(_t59 < _t87) {
					L15:
					 *((intOrPtr*)(_t111 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t63 =  *((intOrPtr*)(_t111 + 8));
					_t64 =  *((intOrPtr*)( *_t63))(_t63, 0x407420, _t111 - 0x1c);
					 *((intOrPtr*)(_t111 - 8)) = _t64;
					if(_t64 >= _t87) {
						_t67 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)(_t111 - 8)) =  *((intOrPtr*)( *_t67 + 0x50))(_t67,  *(_t111 - 0xc));
						if(_t105 == _t87) {
							_t84 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t84 + 0x24))(_t84, "C:\\Users\\engineer\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto\\Forureningsforebygget\\Pegboard");
						}
						if(_t109 != _t87) {
							_t82 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t82 + 0x3c))(_t82, _t109);
						}
						_t69 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t69 + 0x34))(_t69,  *(_t111 - 0x3c));
						_t95 =  *((intOrPtr*)(_t111 - 0x40));
						if( *_t95 != _t87) {
							_t80 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t80 + 0x44))(_t80, _t95,  *(_t111 - 0x88));
						}
						_t71 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t71 + 0x2c))(_t71,  *((intOrPtr*)(_t111 - 0x44)));
						_t73 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t73 + 0x1c))(_t73,  *((intOrPtr*)(_t111 - 0x4c)));
						if( *((intOrPtr*)(_t111 - 8)) >= _t87) {
							 *((intOrPtr*)(_t111 - 8)) = 0x80004005;
							if(MultiByteToWideChar(_t87, _t87,  *(_t111 - 0x10), 0xffffffff,  *(_t111 - 0xc), 0x400) != 0) {
								_t78 =  *((intOrPtr*)(_t111 - 0x1c));
								 *((intOrPtr*)(_t111 - 8)) =  *((intOrPtr*)( *_t78 + 0x18))(_t78,  *(_t111 - 0xc), 1);
							}
						}
						_t75 =  *((intOrPtr*)(_t111 - 0x1c));
						 *((intOrPtr*)( *_t75 + 8))(_t75);
					}
					_t65 =  *((intOrPtr*)(_t111 + 8));
					 *((intOrPtr*)( *_t65 + 8))(_t65);
					if( *((intOrPtr*)(_t111 - 8)) >= _t87) {
						_push(0xfffffff4);
					} else {
						goto L15;
					}
				}
				E00401423();
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t111 - 4));
				return 0;
			}

0x00402141
0x0040214b
0x00402155
0x0040215f
0x0040216a
0x0040216d
0x00402187
0x0040218d
0x00402193
0x00402196
0x004021a0
0x004021a4
0x004021a4
0x004021a9
0x004021ba
0x004021c2
0x0040229b
0x0040229b
0x004022a2
0x004021c8
0x004021c8
0x004021d7
0x004021db
0x004021de
0x004021e4
0x004021f2
0x004021f5
0x004021f7
0x00402202
0x00402202
0x00402207
0x00402209
0x00402210
0x00402210
0x00402213
0x0040221c
0x0040221f
0x00402224
0x00402226
0x00402233
0x00402233
0x00402236
0x0040223f
0x00402242
0x0040224b
0x00402251
0x00402258
0x00402271
0x00402273
0x00402281
0x00402281
0x00402271
0x00402284
0x0040228a
0x0040228a
0x0040228d
0x00402293
0x00402299
0x004022ae
0x00000000
0x00000000
0x00000000
0x00402299
0x004022a4
0x004029bb
0x004029c7

APIs

CoCreateInstance.OLE32(00407410,?,00000001,00407400,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021BA
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00407400,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402269

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard, xrefs: 004021FA

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard
API String ID: 123533781-2002230202
Opcode ID: 99e8bc42a3757380f2283ffcafc7e5a6c536564db9f2e77a1d72e4738346444a
Instruction ID: 364dec1ee03e4b34996bd20462589a1769652030a90c2beac7f749610b7a86d9
Opcode Fuzzy Hash: 99e8bc42a3757380f2283ffcafc7e5a6c536564db9f2e77a1d72e4738346444a
Instruction Fuzzy Hash: 30511871E00209AFCB00DFE4C988A9D7BB5FF48314F2085AAF515EB2D1DB799941CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00406666 Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00406666() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M00406F09))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4)); // executed
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8)); // executed
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406666
0x00406666
0x0040666b
0x004066e2
0x004066e9
0x004066f3
0x00406cd2
0x00406cd2
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00406d48
0x00406d48
0x00406d4e
0x00406d4e
0x00000000
0x00406d23
0x00406d23
0x00406d27
0x00406ed6
0x00000000
0x00406ed6
0x00406d33
0x00406d3a
0x00406d42
0x00406d45
0x00000000
0x00406d45
0x0040666d
0x0040666d
0x00406671
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x00406692
0x00406699
0x0040669c
0x004066a7
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b6
0x004066d4
0x004066d6
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068fb
0x004068fe
0x004068a1
0x004068a7
0x00000000
0x00000000
0x00000000
0x00406900
0x0040687c
0x00406880
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689e
0x00000000
0x0040689e
0x004066b8
0x004066b8
0x004066bb
0x004066c1
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067aa
0x004067ad
0x00406724
0x00406724
0x0040672a
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406837
0x0040683a
0x004067b8
0x004067bc
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067da
0x004067da
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406845
0x00406845
0x00406848
0x0040684b
0x0040684f
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00406a11
0x00406a11
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00406736
0x00000000
0x00000000
0x00000000
0x004067b3
0x004066ff
0x00406703
0x00406e70
0x00406eec
0x00406ef4
0x00406efb
0x00406efd
0x00406f04
0x00406f08
0x00406f08
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x00406721
0x00000000
0x00406721
0x004067ad
0x004066b6
0x004064ea
0x004064ea
0x004064f3
0x00406f01
0x00406f01
0x00000000
0x00406f01
0x004064f9
0x00000000
0x00406504
0x00000000
0x00000000
0x0040650d
0x00406510
0x00406513
0x00406517
0x00000000
0x00000000
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406563
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00000000
0x00406e55
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00000000
0x00406e64
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406905
0x00406909
0x00406927
0x0040692a
0x00406931
0x00406934
0x00406937
0x0040693a
0x0040693d
0x00406940
0x00406942
0x00406949
0x0040694a
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406955
0x0040695a
0x00000000
0x0040695a
0x0040690b
0x0040690e
0x00406911
0x0040691b
0x00000000
0x00000000
0x0040696f
0x00406973
0x00406996
0x00406999
0x0040699c
0x004069a6
0x00406975
0x00406975
0x00406978
0x0040697b
0x0040697e
0x0040698b
0x0040698e
0x0040698e
0x00000000
0x00000000
0x004069b2
0x004069b6
0x00000000
0x00000000
0x004069bc
0x004069c0
0x00000000
0x00000000
0x004069c6
0x004069c8
0x004069cc
0x004069cc
0x004069cf
0x004069d3
0x00000000
0x00000000
0x00406a23
0x00406a27
0x00406a2e
0x00406a31
0x00406a34
0x00406a3e
0x00000000
0x00406a3e
0x00406a29
0x00000000
0x00000000
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00406a64
0x00406a64
0x00406a67
0x00406a6a
0x00406a6d
0x00406a6d
0x00406a70
0x00406a77
0x00406a7c
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x0040695d
0x0040695d
0x00406960
0x00000000
0x00000000
0x00406c9c
0x00406ca0
0x00406cc2
0x00406cc5
0x00406ccf
0x00000000
0x00406ccf
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00000000
0x00000000
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00406d90
0x00406d90
0x00000000
0x00406d90
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00406cb3
0x00406cb3
0x00406cb6
0x00000000
0x00000000
0x00406e4a
0x00406e4d
0x00000000
0x00000000
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aa6
0x00406aa9
0x00406ab0
0x00406ab3
0x00406ac1
0x00000000
0x00000000
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00000000
0x00406da6
0x00406da6
0x00406daa
0x00406ee2
0x00000000
0x00406ee2
0x00406db0
0x00406db3
0x00406db6
0x00406dba
0x00406dbd
0x00406dc3
0x00406dc5
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dce
0x00406dce
0x00406dd2
0x00406e32
0x00406e35
0x00406e3a
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e42
0x00000000
0x00406e42
0x00406dd4
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406e0e
0x00406e11
0x00406e14
0x00406e17
0x00406e1b
0x00406e1d
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406dff
0x00406e04
0x00406e06
0x00406e09
0x00406e09
0x00406e24
0x00406e2b
0x00000000
0x00406e2d
0x00000000
0x00406e2d
0x00000000
0x00406ac9
0x00406acc
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x00000000
0x00000000
0x004069d6
0x004069d6
0x004069da
0x00406ea0
0x00000000
0x00406ea0
0x004069e0
0x004069e3
0x004069e6
0x004069e9
0x004069eb
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0c
0x00406a0f
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00000000
0x00406c97
0x00406c95
0x00406eca
0x00000000
0x00000000
0x004064f9

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42b921e85d89c0e117f5f9f4e0d0c16e752254418a7148ec341c06b29f841c9
Instruction ID: 4f714145f5a313d6319dbd2ae6a602097e3dd159542c3e152d0bb7460fb66c8d
Opcode Fuzzy Hash: b42b921e85d89c0e117f5f9f4e0d0c16e752254418a7148ec341c06b29f841c9
Instruction Fuzzy Hash: 25F17571D00229CBDF28CFA8C8946ADBBB0FF44305F25856ED856BB281D7395A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 004062DD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004062DD(CHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileA(_a4, 0x421558); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x421558;
			}

0x004062e8
0x004062f1
0x00000000
0x004062fe
0x004062f4
0x00000000

APIs

FindFirstFileA.KERNELBASE(746AFA90,00421558,C:\Users\user\AppData\Local\Temp\nst891E.tmp,00405AA3,C:\Users\user\AppData\Local\Temp\nst891E.tmp,C:\Users\user\AppData\Local\Temp\nst891E.tmp,00000000,C:\Users\user\AppData\Local\Temp\nst891E.tmp,C:\Users\user\AppData\Local\Temp\nst891E.tmp,746AFA90,?,C:\Users\user\AppData\Local\Temp\,004057C2,?,746AFA90,C:\Users\user\AppData\Local\Temp\), ref: 004062E8
FindClose.KERNEL32(00000000), ref: 004062F4

Strings

C:\Users\user\AppData\Local\Temp\nst891E.tmp, xrefs: 004062DD

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\nst891E.tmp
API String ID: 2295610775-3303754261
Opcode ID: 78efce08eb58f860d58d9cc4337d862744689776f4b13788d4bc070c197dd51e
Instruction ID: 9f0851c2fc9ceccd35e24d87c19841e9ead441a619ffea6187f1505ec1ede2b7
Opcode Fuzzy Hash: 78efce08eb58f860d58d9cc4337d862744689776f4b13788d4bc070c197dd51e
Instruction Fuzzy Hash: B1D012319090207BC30117386E0C85B7A599B553317228A77F967F12F0C7388C7696E9

Uniqueness

Uniqueness Score: -1.00%

Function 00403B94 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00403B94(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				signed int _t39;
				struct HWND__* _t49;
				signed int _t68;
				struct HWND__* _t74;
				signed int _t87;
				struct HWND__* _t92;
				signed int _t100;
				int _t104;
				signed int _t116;
				signed int _t117;
				int _t118;
				signed int _t123;
				struct HWND__* _t126;
				struct HWND__* _t127;
				int _t128;
				long _t131;
				int _t133;
				int _t134;
				void* _t135;
				void* _t143;

				_t116 = _a8;
				if(_t116 == 0x110 || _t116 == 0x408) {
					_t35 = _a12;
					_t126 = _a4;
					__eflags = _t116 - 0x110;
					 *0x41fcf0 = _t35;
					if(_t116 == 0x110) {
						 *0x423708 = _t126;
						 *0x41fd04 = GetDlgItem(_t126, 1);
						_t92 = GetDlgItem(_t126, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x41ecd0 = _t92;
						E00404068(_t126);
						SetClassLongA(_t126, 0xfffffff2,  *0x422ee8); // executed
						 *0x422ecc = E0040140B(4);
						_t35 = 1;
						__eflags = 1;
						 *0x41fcf0 = 1;
					}
					_t123 =  *0x4091dc; // 0x0
					_t134 = 0;
					_t131 = (_t123 << 6) +  *0x423740;
					__eflags = _t123;
					if(_t123 < 0) {
						L34:
						E004040B4(0x40b);
						while(1) {
							_t37 =  *0x41fcf0; // 0x1
							 *0x4091dc =  *0x4091dc + _t37;
							_t131 = _t131 + (_t37 << 6);
							_t39 =  *0x4091dc; // 0x0
							__eflags = _t39 -  *0x423744;
							if(_t39 ==  *0x423744) {
								E0040140B(1);
							}
							__eflags =  *0x422ecc - _t134; // 0x0
							if(__eflags != 0) {
								break;
							}
							__eflags =  *0x4091dc -  *0x423744; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t117 =  *(_t131 + 0x14);
							E00405FFC(_t117, _t126, _t131, 0x42b800,  *((intOrPtr*)(_t131 + 0x24)));
							_push( *((intOrPtr*)(_t131 + 0x20)));
							_push(0xfffffc19);
							E00404068(_t126);
							_push( *((intOrPtr*)(_t131 + 0x1c)));
							_push(0xfffffc1b);
							E00404068(_t126);
							_push( *((intOrPtr*)(_t131 + 0x28)));
							_push(0xfffffc1a);
							E00404068(_t126);
							_t49 = GetDlgItem(_t126, 3);
							__eflags =  *0x4237ac - _t134;
							_v32 = _t49;
							if( *0x4237ac != _t134) {
								_t117 = _t117 & 0x0000fefd | 0x00000004;
								__eflags = _t117;
							}
							ShowWindow(_t49, _t117 & 0x00000008); // executed
							EnableWindow( *(_t135 + 0x30), _t117 & 0x00000100); // executed
							E0040408A(_t117 & 0x00000002);
							_t118 = _t117 & 0x00000004;
							EnableWindow( *0x41ecd0, _t118);
							__eflags = _t118 - _t134;
							if(_t118 == _t134) {
								_push(1);
							} else {
								_push(_t134);
							}
							EnableMenuItem(GetSystemMenu(_t126, _t134), 0xf060, ??);
							SendMessageA( *(_t135 + 0x38), 0xf4, _t134, 1);
							__eflags =  *0x4237ac - _t134;
							if( *0x4237ac == _t134) {
								_push( *0x41fd04);
							} else {
								SendMessageA(_t126, 0x401, 2, _t134);
								_push( *0x41ecd0);
							}
							E0040409D();
							E00405FDA(0x41fd08, E00403B75());
							E00405FFC(0x41fd08, _t126, _t131,  &(0x41fd08[lstrlenA(0x41fd08)]),  *((intOrPtr*)(_t131 + 0x18)));
							SetWindowTextA(_t126, 0x41fd08); // executed
							_push(_t134);
							_t68 = E00401389( *((intOrPtr*)(_t131 + 8)));
							__eflags = _t68;
							if(_t68 != 0) {
								continue;
							} else {
								__eflags =  *_t131 - _t134;
								if( *_t131 == _t134) {
									continue;
								}
								__eflags =  *(_t131 + 4) - 5;
								if( *(_t131 + 4) != 5) {
									DestroyWindow( *0x422ed8); // executed
									 *0x41f4e0 = _t131;
									__eflags =  *_t131 - _t134;
									if( *_t131 <= _t134) {
										goto L58;
									}
									_t74 = CreateDialogParamA( *0x423700,  *_t131 +  *0x422ee0 & 0x0000ffff, _t126,  *(0x4091e0 +  *(_t131 + 4) * 4), _t131); // executed
									__eflags = _t74 - _t134;
									 *0x422ed8 = _t74;
									if(_t74 == _t134) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t131 + 0x2c)));
									_push(6);
									E00404068(_t74);
									GetWindowRect(GetDlgItem(_t126, 0x3fa), _t135 + 0x10);
									ScreenToClient(_t126, _t135 + 0x10);
									SetWindowPos( *0x422ed8, _t134,  *(_t135 + 0x20),  *(_t135 + 0x20), _t134, _t134, 0x15);
									_push(_t134);
									E00401389( *((intOrPtr*)(_t131 + 0xc)));
									__eflags =  *0x422ecc - _t134; // 0x0
									if(__eflags != 0) {
										goto L61;
									}
									ShowWindow( *0x422ed8, 8); // executed
									E004040B4(0x405);
									goto L58;
								}
								__eflags =  *0x4237ac - _t134;
								if( *0x4237ac != _t134) {
									goto L61;
								}
								__eflags =  *0x4237a0 - _t134;
								if( *0x4237a0 != _t134) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x422ed8);
						 *0x423708 = _t134;
						EndDialog(_t126,  *0x41f0d8);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t131 - _t134;
							if( *_t131 == _t134) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t87 = E00401389( *((intOrPtr*)(_t131 + 0x10)));
						__eflags = _t87;
						if(_t87 == 0) {
							goto L33;
						}
						SendMessageA( *0x422ed8, 0x40f, 0, 1);
						__eflags =  *0x422ecc - _t134; // 0x0
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t126 = _a4;
					_t134 = 0;
					if(_t116 == 0x47) {
						SetWindowPos( *0x41fce8, _t126, 0, 0, 0, 0, 0x13);
					}
					if(_t116 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x41fce8,  ~(_a12 - 1) & _t116);
					}
					if(_t116 != 0x40d) {
						__eflags = _t116 - 0x11;
						if(_t116 != 0x11) {
							__eflags = _t116 - 0x111;
							if(_t116 != 0x111) {
								L26:
								return E004040CF(_t116, _a12, _a16);
							}
							_t133 = _a12 & 0x0000ffff;
							_t127 = GetDlgItem(_t126, _t133);
							__eflags = _t127 - _t134;
							if(_t127 == _t134) {
								L13:
								__eflags = _t133 - 1;
								if(_t133 != 1) {
									__eflags = _t133 - 3;
									if(_t133 != 3) {
										_t128 = 2;
										__eflags = _t133 - _t128;
										if(_t133 != _t128) {
											L25:
											SendMessageA( *0x422ed8, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x4237ac - _t134;
										if( *0x4237ac == _t134) {
											_t100 = E0040140B(3);
											__eflags = _t100;
											if(_t100 != 0) {
												goto L26;
											}
											 *0x41f0d8 = 1;
											L21:
											_push(0x78);
											L22:
											E00404041();
											goto L26;
										}
										E0040140B(_t128);
										 *0x41f0d8 = _t128;
										goto L21;
									}
									__eflags =  *0x4091dc - _t134; // 0x0
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t133);
								goto L22;
							}
							SendMessageA(_t127, 0xf3, _t134, _t134);
							_t104 = IsWindowEnabled(_t127);
							__eflags = _t104;
							if(_t104 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t126, _t134, _t134);
						return 1;
					} else {
						DestroyWindow( *0x422ed8);
						 *0x422ed8 = _a12;
						L58:
						if( *0x420d08 == _t134) {
							_t143 =  *0x422ed8 - _t134; // 0x10440
							if(_t143 != 0) {
								ShowWindow(_t126, 0xa); // executed
								 *0x420d08 = 1;
							}
						}
						L61:
						return 0;
					}
				}
			}

0x00403b9d
0x00403ba6
0x00403ce7
0x00403ceb
0x00403cef
0x00403cf1
0x00403cf6
0x00403d01
0x00403d0c
0x00403d11
0x00403d13
0x00403d15
0x00403d18
0x00403d1d
0x00403d2b
0x00403d38
0x00403d3f
0x00403d3f
0x00403d40
0x00403d40
0x00403d45
0x00403d4b
0x00403d52
0x00403d58
0x00403d5a
0x00403d9a
0x00403d9f
0x00403da4
0x00403da4
0x00403da9
0x00403db2
0x00403db4
0x00403db9
0x00403dbf
0x00403dc3
0x00403dc3
0x00403dc8
0x00403dce
0x00000000
0x00000000
0x00403dd9
0x00403ddf
0x00000000
0x00000000
0x00403de8
0x00403df0
0x00403df5
0x00403df8
0x00403dfe
0x00403e03
0x00403e06
0x00403e0c
0x00403e11
0x00403e14
0x00403e1a
0x00403e22
0x00403e28
0x00403e2e
0x00403e32
0x00403e39
0x00403e39
0x00403e39
0x00403e43
0x00403e55
0x00403e61
0x00403e66
0x00403e70
0x00403e76
0x00403e78
0x00403e7d
0x00403e7a
0x00403e7a
0x00403e7a
0x00403e8d
0x00403ea5
0x00403ea7
0x00403ead
0x00403ec2
0x00403eaf
0x00403eb8
0x00403eba
0x00403eba
0x00403ec8
0x00403ed9
0x00403eea
0x00403ef1
0x00403ef7
0x00403efb
0x00403f00
0x00403f02
0x00000000
0x00403f08
0x00403f08
0x00403f0a
0x00000000
0x00000000
0x00403f10
0x00403f14
0x00403f39
0x00403f3f
0x00403f45
0x00403f47
0x00000000
0x00000000
0x00403f6d
0x00403f73
0x00403f75
0x00403f7a
0x00000000
0x00000000
0x00403f80
0x00403f83
0x00403f86
0x00403f9d
0x00403fa9
0x00403fc2
0x00403fc8
0x00403fcc
0x00403fd1
0x00403fd7
0x00000000
0x00000000
0x00403fe1
0x00403fec
0x00000000
0x00403fec
0x00403f16
0x00403f1c
0x00000000
0x00000000
0x00403f22
0x00403f28
0x00000000
0x00000000
0x00000000
0x00403f2e
0x00403f02
0x00403ff9
0x00404005
0x0040400c
0x00000000
0x00403d5c
0x00403d5c
0x00403d5f
0x00403d92
0x00403d92
0x00403d94
0x00000000
0x00000000
0x00000000
0x00403d94
0x00403d61
0x00403d65
0x00403d6a
0x00403d6c
0x00000000
0x00000000
0x00403d7c
0x00403d84
0x00000000
0x00403d8a
0x00403bb8
0x00403bb8
0x00403bbc
0x00403bc1
0x00403bd0
0x00403bd0
0x00403bd9
0x00403be2
0x00403bed
0x00403bed
0x00403bf9
0x00403c15
0x00403c18
0x00403c2b
0x00403c31
0x00403cd4
0x00000000
0x00403cdd
0x00403c37
0x00403c44
0x00403c46
0x00403c48
0x00403c67
0x00403c67
0x00403c6a
0x00403c6f
0x00403c72
0x00403c82
0x00403c83
0x00403c85
0x00403cbb
0x00403cce
0x00000000
0x00403cce
0x00403c87
0x00403c8d
0x00403ca6
0x00403cab
0x00403cad
0x00000000
0x00000000
0x00403caf
0x00403c9b
0x00403c9b
0x00403c9d
0x00403c9d
0x00000000
0x00403c9d
0x00403c90
0x00403c95
0x00000000
0x00403c95
0x00403c74
0x00403c7a
0x00000000
0x00000000
0x00403c7c
0x00000000
0x00403c7c
0x00403c6c
0x00000000
0x00403c6c
0x00403c52
0x00403c59
0x00403c5f
0x00403c61
0x00000000
0x00000000
0x00000000
0x00403c61
0x00403c1d
0x00000000
0x00403bfb
0x00403c01
0x00403c0b
0x00404012
0x00404018
0x0040401a
0x00404020
0x00404025
0x0040402b
0x0040402b
0x00404020
0x00404035
0x00000000
0x00404035
0x00403bf9

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403BD0
ShowWindow.USER32(?), ref: 00403BED
DestroyWindow.USER32 ref: 00403C01
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403C1D
GetDlgItem.USER32 ref: 00403C3E
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403C52
IsWindowEnabled.USER32(00000000), ref: 00403C59
GetDlgItem.USER32 ref: 00403D07
GetDlgItem.USER32 ref: 00403D11
KiUserCallbackDispatcher.NTDLL(?,000000F2,?,0000001C,000000FF), ref: 00403D2B
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403D7C
GetDlgItem.USER32 ref: 00403E22
ShowWindow.USER32(00000000,?), ref: 00403E43
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403E55
EnableWindow.USER32(?,?), ref: 00403E70
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403E86
EnableMenuItem.USER32 ref: 00403E8D
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403EA5
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403EB8
lstrlenA.KERNEL32(Sepad149: Installing,?,Sepad149: Installing,00000000), ref: 00403EE2
SetWindowTextA.USER32(?,Sepad149: Installing), ref: 00403EF1
ShowWindow.USER32(?,0000000A), ref: 00404025

Strings

Sepad149: Installing, xrefs: 00403ED2, 00403ED8, 00403EEF

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$CallbackDispatcherEnableMenuUser$DestroyEnabledLongSystemTextlstrlen
String ID: Sepad149: Installing
API String ID: 3906175533-2190826614
Opcode ID: e57483be0e8f0953cc8724a3e8c8ea21599a840bb85b0af5ee6d9011d8646a3c
Instruction ID: ba3e3afbb1df49eb3663f2526bbc67ab17a8ece20d2805bf2467eb782e73bce3
Opcode Fuzzy Hash: e57483be0e8f0953cc8724a3e8c8ea21599a840bb85b0af5ee6d9011d8646a3c
Instruction Fuzzy Hash: FEC1AEB2604205BBDB206F61ED49D2B7A6CFB85706F40443EF641B11F1C779A942EB2E

Uniqueness

Uniqueness Score: -1.00%

Function 004037F7 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E004037F7(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t17;
				void* _t25;
				void* _t27;
				int _t28;
				void* _t31;
				int _t34;
				int _t35;
				intOrPtr _t36;
				int _t39;
				char _t57;
				CHAR* _t59;
				signed char _t63;
				CHAR* _t74;
				intOrPtr _t76;
				CHAR* _t81;

				_t76 =  *0x423714;
				_t17 = E00406372(2);
				_t84 = _t17;
				if(_t17 == 0) {
					_t74 = 0x41fd08;
					"1033" = 0x30;
					 *0x42a001 = 0x78;
					 *0x42a002 = 0;
					E00405EC1(_t71, __eflags, 0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x41fd08, 0);
					__eflags =  *0x41fd08; // 0x53
					if(__eflags == 0) {
						E00405EC1(_t71, __eflags, 0x80000003, ".DEFAULT\\Control Panel\\International",  &M00407362, 0x41fd08, 0);
					}
					lstrcatA("1033", _t74);
				} else {
					E00405F38("1033",  *_t17() & 0x0000ffff);
				}
				E00403ABC(_t71, _t84);
				_t80 = "C:\\Users\\engineer\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto";
				 *0x4237a0 =  *0x42371c & 0x00000020;
				 *0x4237bc = 0x10000;
				if(E00405A60(_t84, "C:\\Users\\engineer\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto") != 0) {
					L16:
					if(E00405A60(_t92, _t80) == 0) {
						E00405FFC(0, _t74, _t76, _t80,  *((intOrPtr*)(_t76 + 0x118))); // executed
					}
					_t25 = LoadImageA( *0x423700, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x422ee8 = _t25;
					if( *((intOrPtr*)(_t76 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t27 = E00403ABC(_t71, __eflags);
							__eflags =  *0x4237c0;
							if( *0x4237c0 != 0) {
								_t28 = E004051D3(_t27, 0);
								__eflags = _t28;
								if(_t28 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x422ecc; // 0x0
								if(__eflags == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x41fce8, 5); // executed
							_t34 = E00406304("RichEd20"); // executed
							__eflags = _t34;
							if(_t34 == 0) {
								E00406304("RichEd32");
							}
							_t81 = "RichEdit20A";
							_t35 = GetClassInfoA(0, _t81, 0x422ea0);
							__eflags = _t35;
							if(_t35 == 0) {
								GetClassInfoA(0, "RichEdit", 0x422ea0);
								 *0x422ec4 = _t81;
								RegisterClassA(0x422ea0);
							}
							_t36 =  *0x422ee0; // 0x0
							_t39 = DialogBoxParamA( *0x423700, _t36 + 0x00000069 & 0x0000ffff, 0, E00403B94, 0); // executed
							E00403747(E0040140B(5), 1);
							return _t39;
						}
						L22:
						_t31 = 2;
						return _t31;
					} else {
						_t71 =  *0x423700;
						 *0x422ea4 = E00401000;
						 *0x422eb0 =  *0x423700;
						 *0x422eb4 = _t25;
						 *0x422ec4 = 0x4091f4;
						if(RegisterClassA(0x422ea0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoA(0x30, 0,  &_v16, 0);
						 *0x41fce8 = CreateWindowExA(0x80, 0x4091f4, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x423700, 0);
						goto L21;
					}
				} else {
					_t71 =  *(_t76 + 0x48);
					_t86 = _t71;
					if(_t71 == 0) {
						goto L16;
					}
					_t74 = 0x4226a0;
					E00405EC1(_t71, _t86,  *((intOrPtr*)(_t76 + 0x44)), _t71,  *((intOrPtr*)(_t76 + 0x4c)) +  *0x423758, 0x4226a0, 0);
					_t57 =  *0x4226a0; // 0x43
					if(_t57 == 0) {
						goto L16;
					}
					if(_t57 == 0x22) {
						_t74 = 0x4226a1;
						 *((char*)(E0040599D(0x4226a1, 0x22))) = 0;
					}
					_t59 = lstrlenA(_t74) + _t74 - 4;
					if(_t59 <= _t74 || lstrcmpiA(_t59, ?str?) != 0) {
						L15:
						E00405FDA(_t80, E00405972(_t74));
						goto L16;
					} else {
						_t63 = GetFileAttributesA(_t74);
						if(_t63 == 0xffffffff) {
							L14:
							E004059B9(_t74);
							goto L15;
						}
						_t92 = _t63 & 0x00000010;
						if((_t63 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x004037fd
0x00403806
0x0040380d
0x0040380f
0x00403823
0x00403835
0x0040383c
0x00403843
0x00403849
0x0040384e
0x00403854
0x00403867
0x00403867
0x00403872
0x00403811
0x0040381c
0x0040381c
0x00403877
0x00403881
0x0040388a
0x0040388f
0x004038a0
0x00403927
0x0040392f
0x00403938
0x00403938
0x0040394e
0x00403954
0x00403962
0x004039e3
0x004039eb
0x004039f5
0x004039fa
0x00403a00
0x00403a8a
0x00403a8f
0x00403a91
0x00403aad
0x00000000
0x00403aad
0x00403a93
0x00403a99
0x00403aa1
0x00403aa1
0x00000000
0x00403a99
0x00403a0e
0x00403a19
0x00403a1e
0x00403a20
0x00403a27
0x00403a27
0x00403a32
0x00403a3a
0x00403a3c
0x00403a3e
0x00403a47
0x00403a4a
0x00403a50
0x00403a50
0x00403a56
0x00403a6f
0x00403a80
0x00000000
0x00403a85
0x004039ed
0x004039ef
0x00000000
0x00403964
0x00403964
0x00403970
0x0040397a
0x00403980
0x00403985
0x00403994
0x00403ab2
0x00403ab2
0x00000000
0x00403ab2
0x004039a3
0x004039de
0x00000000
0x004039de
0x004038a6
0x004038a6
0x004038a9
0x004038ab
0x00000000
0x00000000
0x004038b5
0x004038c5
0x004038ca
0x004038d1
0x00000000
0x00000000
0x004038d5
0x004038d7
0x004038e4
0x004038e4
0x004038ec
0x004038f2
0x0040391a
0x00403922
0x00000000
0x00403904
0x00403905
0x0040390e
0x00403914
0x00403915
0x00000000
0x00403915
0x00403910
0x00403912
0x00000000
0x00000000
0x00000000
0x00403912
0x004038f2

APIs

Part of subcall function 00406372: GetModuleHandleA.KERNEL32(?,?,?,004032A8,0000000A), ref: 00406384
Part of subcall function 00406372: GetProcAddress.KERNEL32(00000000,?), ref: 0040639F

lstrcatA.KERNEL32(1033,Sepad149: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Sepad149: Installing,00000000,00000002,746AFA90,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Quotation.exe",00000000), ref: 00403872
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto,1033,Sepad149: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Sepad149: Installing,00000000,00000002,746AFA90), ref: 004038E7
lstrcmpiA.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto,1033,Sepad149: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Sepad149: Installing,00000000), ref: 004038FA
GetFileAttributesA.KERNEL32(Call), ref: 00403905
LoadImageA.USER32 ref: 0040394E

Part of subcall function 00405F38: wsprintfA.USER32 ref: 00405F45

RegisterClassA.USER32 ref: 0040398B
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 004039A3
CreateWindowExA.USER32 ref: 004039D8
ShowWindow.USER32(00000005,00000000), ref: 00403A0E
GetClassInfoA.USER32 ref: 00403A3A
GetClassInfoA.USER32 ref: 00403A47
RegisterClassA.USER32 ref: 00403A50
DialogBoxParamA.USER32 ref: 00403A6F

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 0040382B
1033, xrefs: 00403817, 0040386D
"C:\Users\user\Desktop\Quotation.exe", xrefs: 004037FB
.exe, xrefs: 004038F4
Sepad149: Installing, xrefs: 00403823, 00403829, 0040384E, 00403857, 0040386C
.DEFAULT\Control Panel\International, xrefs: 0040385D
_Nb, xrefs: 0040396A, 004039D2
C:\Users\user\AppData\Local\Temp\, xrefs: 004037FC
Call, xrefs: 004038B5, 004038BD, 004038CA, 00403914, 0040391A
RichEd20, xrefs: 00403A14
RichEdit, xrefs: 00403A41
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto, xrefs: 00403881, 00403889, 00403921, 00403927, 00403937
RichEdit20A, xrefs: 00403A32, 00403A38
RichEd32, xrefs: 00403A22

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\Quotation.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$Sepad149: Installing$_Nb
API String ID: 1975747703-3279057022
Opcode ID: a2a89361b445a099ea431d97f26b4be8e8633abf330fc856fce069af7e92bfea
Instruction ID: cc9ff768997195dfc6b08b7ed0d0e3ca7810037f4103f2fdd35eeb1d807c43ce
Opcode Fuzzy Hash: a2a89361b445a099ea431d97f26b4be8e8633abf330fc856fce069af7e92bfea
Instruction Fuzzy Hash: 1961C4B07442007EE620AF659D45F2B3AACEB4475AB40447EF941B22E2D7BC9D02DA2D

Uniqueness

Uniqueness Score: -1.00%

Function 00402DC4 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E00402DC4(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				signed int _t50;
				void* _t53;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				signed int _t65;
				signed int _t70;
				signed int _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				signed int _t85;
				signed int _t87;
				void* _t89;
				signed int _t90;
				signed int _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = "C:\\Users\\engineer\\Desktop\\Quotation.exe";
				 *0x423710 = _t43 + 0x3e8;
				GetModuleFileNameA(0, "C:\\Users\\engineer\\Desktop\\Quotation.exe", 0x400);
				_t89 = E00405B73(_t91, 0x80000000, 3);
				_v16 = _t89;
				 *0x409018 = _t89;
				if(_t89 == 0xffffffff) {
					return "Error launching installer";
				}
				_t92 = "C:\\Users\\engineer\\Desktop";
				E00405FDA("C:\\Users\\engineer\\Desktop", _t91);
				E00405FDA(0x42b000, E004059B9(_t92));
				_t50 = GetFileSize(_t89, 0);
				__eflags = _t50;
				 *0x41e8c4 = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00402D60(1);
					__eflags =  *0x423718 - _t82;
					if( *0x423718 == _t82) {
						goto L29;
					}
					__eflags = _v8 - _t82;
					if(_v8 == _t82) {
						L28:
						_t53 = GlobalAlloc(0x40, _v24); // executed
						_t94 = _t53;
						E004031ED( *0x423718 + 0x1c);
						_push(_v24);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff); // executed
						_t57 = E00402FFB(); // executed
						__eflags = _t57 - _v24;
						if(_t57 == _v24) {
							__eflags = _v44 & 0x00000001;
							 *0x423714 = _t94;
							 *0x42371c =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x423720 =  *0x423720 + 1;
								__eflags =  *0x423720;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
								__eflags = _t85;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
							 *(_t94 + 0x3c) = _t60;
							E00405B2E(0x423740, _t94 + 4, 0x40);
							__eflags = 0;
							return 0;
						}
						goto L29;
					}
					E004031ED( *0x4128b8);
					_t65 = E004031D7( &_a4, 4);
					__eflags = _t65;
					if(_t65 == 0) {
						goto L29;
					}
					__eflags = _v12 - _a4;
					if(_v12 != _a4) {
						goto L29;
					}
					goto L28;
				} else {
					do {
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~( *0x423718) & 0x00007e00) + 0x200;
						__eflags = _t93 - _t70;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E004031D7(0x40a8b8, _t90);
						__eflags = _t71;
						if(_t71 == 0) {
							E00402D60(1);
							L29:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x423718;
						if( *0x423718 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402D60(0);
							}
							goto L20;
						}
						E00405B2E( &_v44, 0x40a8b8, 0x1c);
						_t77 = _v44;
						__eflags = _t77 & 0xfffffff0;
						if((_t77 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v40 - 0xdeadbeef;
						if(_v40 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v28 - 0x74736e49;
						if(_v28 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v32 - 0x74666f73;
						if(_v32 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v36 - 0x6c6c754e;
						if(_v36 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t77;
						_t87 =  *0x4128b8; // 0xa7221
						 *0x4237c0 =  *0x4237c0 | _a4 & 0x00000002;
						_t80 = _v20;
						__eflags = _t80 - _t93;
						 *0x423718 = _t87;
						if(_t80 > _t93) {
							goto L29;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v8 = _v8 + 1;
							_t24 = _t80 - 4; // 0x409194
							_t93 = _t24;
							__eflags = _t90 - _t93;
							if(_t90 > _t93) {
								_t90 = _t93;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t93 -  *0x41e8c4; // 0xa9470
						if(__eflags < 0) {
							_v12 = E00406429(_v12, 0x40a8b8, _t90);
						}
						 *0x4128b8 =  *0x4128b8 + _t90;
						_t93 = _t93 - _t90;
						__eflags = _t93;
					} while (_t93 != 0);
					_t82 = 0;
					__eflags = 0;
					goto L24;
				}
			}

0x00402dcc
0x00402dcf
0x00402dd2
0x00402dd5
0x00402ddb
0x00402dec
0x00402df1
0x00402e04
0x00402e09
0x00402e0c
0x00402e12
0x00000000
0x00402e14
0x00402e1f
0x00402e25
0x00402e36
0x00402e3d
0x00402e43
0x00402e45
0x00402e4a
0x00402e4c
0x00402f37
0x00402f39
0x00402f3e
0x00402f45
0x00000000
0x00000000
0x00402f47
0x00402f4a
0x00402f6e
0x00402f73
0x00402f79
0x00402f84
0x00402f89
0x00402f8c
0x00402f8d
0x00402f8e
0x00402f90
0x00402f95
0x00402f98
0x00402fab
0x00402faf
0x00402fb7
0x00402fbc
0x00402fbe
0x00402fbe
0x00402fbe
0x00402fc6
0x00402fc6
0x00402fc9
0x00402fca
0x00402fca
0x00402fcd
0x00402fcf
0x00402fcf
0x00402fcf
0x00402fd9
0x00402fdf
0x00402fed
0x00402ff2
0x00000000
0x00402ff2
0x00000000
0x00402f98
0x00402f52
0x00402f5d
0x00402f62
0x00402f64
0x00000000
0x00000000
0x00402f69
0x00402f6c
0x00000000
0x00000000
0x00000000
0x00402e52
0x00402e57
0x00402e5c
0x00402e60
0x00402e67
0x00402e6c
0x00402e6e
0x00402e70
0x00402e70
0x00402e74
0x00402e79
0x00402e7b
0x00402fa3
0x00402f9a
0x00000000
0x00402f9a
0x00402e81
0x00402e88
0x00402f04
0x00402f08
0x00402f0c
0x00402f11
0x00000000
0x00402f08
0x00402e91
0x00402e96
0x00402e99
0x00402e9e
0x00000000
0x00000000
0x00402ea0
0x00402ea7
0x00000000
0x00000000
0x00402ea9
0x00402eb0
0x00000000
0x00000000
0x00402eb2
0x00402eb9
0x00000000
0x00000000
0x00402ebb
0x00402ec2
0x00000000
0x00000000
0x00402ec4
0x00402eca
0x00402ed3
0x00402ed9
0x00402edc
0x00402ede
0x00402ee4
0x00000000
0x00000000
0x00402eea
0x00402eee
0x00402ef6
0x00402ef6
0x00402ef9
0x00402ef9
0x00402efc
0x00402efe
0x00402f00
0x00402f00
0x00000000
0x00402efe
0x00402ef0
0x00402ef4
0x00000000
0x00000000
0x00000000
0x00402f12
0x00402f12
0x00402f18
0x00402f24
0x00402f24
0x00402f27
0x00402f2d
0x00402f2d
0x00402f2d
0x00402f35
0x00402f35
0x00000000
0x00402f35

APIs

GetTickCount.KERNEL32 ref: 00402DD5
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Quotation.exe,00000400), ref: 00402DF1

Part of subcall function 00405B73: GetFileAttributesA.KERNELBASE(00000003,00402E04,C:\Users\user\Desktop\Quotation.exe,80000000,00000003), ref: 00405B77
Part of subcall function 00405B73: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B99

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Quotation.exe,C:\Users\user\Desktop\Quotation.exe,80000000,00000003), ref: 00402E3D
GlobalAlloc.KERNELBASE(00000040,00000020), ref: 00402F73

Strings

!r, xrefs: 00402ECA, 00402F27
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402F9A
"C:\Users\user\Desktop\Quotation.exe", xrefs: 00402DC4
C:\Users\user\Desktop\Quotation.exe, xrefs: 00402DDB, 00402DEA, 00402DFE, 00402E1E
Inst, xrefs: 00402EA9
Error launching installer, xrefs: 00402E14
Null, xrefs: 00402EBB
C:\Users\user\AppData\Local\Temp\, xrefs: 00402DCB
C:\Users\user\Desktop, xrefs: 00402E1F, 00402E24, 00402E2A
soft, xrefs: 00402EB2

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: !r$"C:\Users\user\Desktop\Quotation.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Quotation.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-1904685821
Opcode ID: 52488c0a69c855c3c7aeff43e56c4eb2efc08dbfe116725fd41c71e14f125889
Instruction ID: 90621c4e807be281ea96420bab05d42ad29c2ea1f6fd119d4e9c070f99f8684f
Opcode Fuzzy Hash: 52488c0a69c855c3c7aeff43e56c4eb2efc08dbfe116725fd41c71e14f125889
Instruction Fuzzy Hash: 1A51F771A00216ABDF209F61DE89B9E7BB8EB54355F50403BF900B72C1C6BC9E4197AD

Uniqueness

Uniqueness Score: -1.00%

Function 00405FFC Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E00405FFC(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				struct _ITEMIDLIST* _v8;
				char _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				signed char _v28;
				signed int _t38;
				CHAR* _t39;
				signed int _t41;
				char _t52;
				char _t53;
				char _t55;
				char _t57;
				void* _t65;
				char* _t66;
				signed int _t80;
				intOrPtr _t86;
				char _t88;
				void* _t89;
				CHAR* _t90;
				void* _t92;
				signed int _t97;
				signed int _t99;
				void* _t100;

				_t92 = __esi;
				_t89 = __edi;
				_t65 = __ebx;
				_t38 = _a8;
				if(_t38 < 0) {
					_t86 =  *0x422edc; // 0x7ecce0
					_t38 =  *(_t86 - 4 + _t38 * 4);
				}
				_push(_t65);
				_push(_t92);
				_push(_t89);
				_t66 = _t38 +  *0x423758;
				_t39 = 0x4226a0;
				_t90 = 0x4226a0;
				if(_a4 >= 0x4226a0 && _a4 - 0x4226a0 < 0x800) {
					_t90 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t88 =  *_t66;
					if(_t88 == 0) {
						break;
					}
					__eflags = _t90 - _t39 - 0x400;
					if(_t90 - _t39 >= 0x400) {
						break;
					}
					_t66 = _t66 + 1;
					__eflags = _t88 - 4;
					_a8 = _t66;
					if(__eflags >= 0) {
						if(__eflags != 0) {
							 *_t90 = _t88;
							_t90 =  &(_t90[1]);
							__eflags = _t90;
						} else {
							 *_t90 =  *_t66;
							_t90 =  &(_t90[1]);
							_t66 = _t66 + 1;
						}
						continue;
					}
					_t41 =  *((char*)(_t66 + 1));
					_t80 =  *_t66;
					_t97 = (_t41 & 0x0000007f) << 0x00000007 | _t80 & 0x0000007f;
					_v24 = _t80;
					_v28 = _t80 | 0x00000080;
					_v16 = _t41;
					_v20 = _t41 | 0x00000080;
					_t66 = _a8 + 2;
					__eflags = _t88 - 2;
					if(_t88 != 2) {
						__eflags = _t88 - 3;
						if(_t88 != 3) {
							__eflags = _t88 - 1;
							if(_t88 == 1) {
								__eflags = (_t41 | 0xffffffff) - _t97;
								E00405FFC(_t66, _t90, _t97, _t90, (_t41 | 0xffffffff) - _t97);
							}
							L42:
							_t90 =  &(_t90[lstrlenA(_t90)]);
							_t39 = 0x4226a0;
							continue;
						}
						__eflags = _t97 - 0x1d;
						if(_t97 != 0x1d) {
							__eflags = (_t97 << 0xa) + 0x424000;
							E00405FDA(_t90, (_t97 << 0xa) + 0x424000);
						} else {
							E00405F38(_t90,  *0x423708);
						}
						__eflags = _t97 + 0xffffffeb - 7;
						if(_t97 + 0xffffffeb < 7) {
							L33:
							E00406244(_t90);
						}
						goto L42;
					}
					_t52 =  *0x42370c;
					__eflags = _t52;
					_t99 = 2;
					if(_t52 >= 0) {
						L13:
						_a8 = 1;
						L14:
						__eflags =  *0x4237a4;
						if( *0x4237a4 != 0) {
							_t99 = 4;
						}
						__eflags = _t80;
						if(__eflags >= 0) {
							__eflags = _t80 - 0x25;
							if(_t80 != 0x25) {
								__eflags = _t80 - 0x24;
								if(_t80 == 0x24) {
									GetWindowsDirectoryA(_t90, 0x400);
									_t99 = 0;
								}
								while(1) {
									__eflags = _t99;
									if(_t99 == 0) {
										goto L30;
									}
									_t53 =  *0x423704;
									_t99 = _t99 - 1;
									__eflags = _t53;
									if(_t53 == 0) {
										L26:
										_t55 = SHGetSpecialFolderLocation( *0x423708,  *(_t100 + _t99 * 4 - 0x18),  &_v8);
										__eflags = _t55;
										if(_t55 != 0) {
											L28:
											 *_t90 =  *_t90 & 0x00000000;
											__eflags =  *_t90;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v8, _t90);
										_v12 = _t55;
										__imp__CoTaskMemFree(_v8);
										__eflags = _v12;
										if(_v12 != 0) {
											goto L30;
										}
										goto L28;
									}
									__eflags = _a8;
									if(_a8 == 0) {
										goto L26;
									}
									_t57 =  *_t53( *0x423708,  *(_t100 + _t99 * 4 - 0x18), 0, 0, _t90); // executed
									__eflags = _t57;
									if(_t57 == 0) {
										goto L30;
									}
									goto L26;
								}
								goto L30;
							}
							GetSystemDirectoryA(_t90, 0x400);
							goto L30;
						} else {
							E00405EC1((_t80 & 0x0000003f) +  *0x423758, __eflags, 0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t80 & 0x0000003f) +  *0x423758, _t90, _t80 & 0x00000040); // executed
							__eflags =  *_t90;
							if( *_t90 != 0) {
								L31:
								__eflags = _v16 - 0x1a;
								if(_v16 == 0x1a) {
									lstrcatA(_t90, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L33;
							}
							E00405FFC(_t66, _t90, _t99, _t90, _v16);
							L30:
							__eflags =  *_t90;
							if( *_t90 == 0) {
								goto L33;
							}
							goto L31;
						}
					}
					__eflags = _t52 - 0x5a04;
					if(_t52 == 0x5a04) {
						goto L13;
					}
					__eflags = _v16 - 0x23;
					if(_v16 == 0x23) {
						goto L13;
					}
					__eflags = _v16 - 0x2e;
					if(_v16 == 0x2e) {
						goto L13;
					} else {
						_a8 = _a8 & 0x00000000;
						goto L14;
					}
				}
				 *_t90 =  *_t90 & 0x00000000;
				if(_a4 == 0) {
					return _t39;
				}
				return E00405FDA(_a4, _t39);
			}

0x00405ffc
0x00405ffc
0x00405ffc
0x00406002
0x00406007
0x00406009
0x00406018
0x00406018
0x00406020
0x00406021
0x00406022
0x00406023
0x00406026
0x0040602e
0x00406030
0x00406047
0x0040604a
0x0040604a
0x00406221
0x00406221
0x00406225
0x00000000
0x00000000
0x00406057
0x0040605d
0x00000000
0x00000000
0x00406063
0x00406064
0x00406067
0x0040606a
0x00406214
0x0040621e
0x00406220
0x00406220
0x00406216
0x00406218
0x0040621a
0x0040621b
0x0040621b
0x00000000
0x00406214
0x00406070
0x00406074
0x00406084
0x0040608b
0x0040608e
0x00406096
0x00406099
0x004060a0
0x004060a1
0x004060a4
0x004061c1
0x004061c4
0x004061f4
0x004061f7
0x004061fc
0x00406200
0x00406200
0x00406205
0x0040620b
0x0040620d
0x00000000
0x0040620d
0x004061c6
0x004061c9
0x004061de
0x004061e5
0x004061cb
0x004061d2
0x004061d2
0x004061ed
0x004061f0
0x004061b9
0x004061ba
0x004061ba
0x00000000
0x004061f0
0x004060aa
0x004060b1
0x004060b3
0x004060b4
0x004060ce
0x004060ce
0x004060d5
0x004060d5
0x004060dc
0x004060e0
0x004060e0
0x004060e1
0x004060e3
0x0040611c
0x0040611f
0x0040612f
0x00406132
0x0040613a
0x00406140
0x00406140
0x0040619f
0x0040619f
0x004061a1
0x00000000
0x00000000
0x00406144
0x0040614b
0x0040614c
0x0040614e
0x00406168
0x00406176
0x0040617c
0x0040617e
0x0040619c
0x0040619c
0x0040619c
0x00000000
0x0040619c
0x00406184
0x0040618d
0x00406190
0x00406196
0x0040619a
0x00000000
0x00000000
0x00000000
0x0040619a
0x00406150
0x00406153
0x00000000
0x00000000
0x00406162
0x00406164
0x00406166
0x00000000
0x00000000
0x00000000
0x00406166
0x00000000
0x0040619f
0x00406127
0x00000000
0x004060e5
0x00406100
0x00406105
0x00406108
0x004061a8
0x004061a8
0x004061ac
0x004061b4
0x004061b4
0x00000000
0x004061ac
0x00406112
0x004061a3
0x004061a3
0x004061a6
0x00000000
0x00000000
0x00000000
0x004061a6
0x004060e3
0x004060b6
0x004060ba
0x00000000
0x00000000
0x004060bc
0x004060c0
0x00000000
0x00000000
0x004060c2
0x004060c6
0x00000000
0x004060c8
0x004060c8
0x00000000
0x004060c8
0x004060c6
0x0040622b
0x00406235
0x00406241
0x00406241
0x00000000

APIs

GetSystemDirectoryA.KERNEL32 ref: 00406127
GetWindowsDirectoryA.KERNEL32(Call,00000400,?,Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll,00000000,00405139,Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll,00000000), ref: 0040613A
SHGetSpecialFolderLocation.SHELL32(00405139,00000000,?,Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll,00000000,00405139,Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll,00000000), ref: 00406176
SHGetPathFromIDListA.SHELL32(00000000,Call), ref: 00406184
CoTaskMemFree.OLE32(00000000), ref: 00406190
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004061B4
lstrlenA.KERNEL32(Call,?,Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll,00000000,00405139,Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll,00000000,00000000,004168C0,00000000), ref: 00406206

Strings

Call, xrefs: 00406026, 004060F3, 004060F4, 004060F5, 00406111, 00406126, 00406139, 00406155, 00406180, 004061B3, 004061B9, 004061D1, 004061E4, 004061FF, 00406205, 0040620D, 00406237
Software\Microsoft\Windows\CurrentVersion, xrefs: 004060F6
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004061AE
Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll, xrefs: 00406021

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-2328429118
Opcode ID: f9d0b1cf2701d91d5acd79df49d905e61aa9589697f689ea0562d06cd488d680
Instruction ID: f6f0e3a74e6b455581cb0d86726a6c3d239f08f65b325d122068a3aaf356d786
Opcode Fuzzy Hash: f9d0b1cf2701d91d5acd79df49d905e61aa9589697f689ea0562d06cd488d680
Instruction Fuzzy Hash: F4610571A00115ABEF20AF64DC84B7A3BA4DB55314F12417FEA03BA2D2C23C4962DB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E00401759(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				CHAR* _t83;
				void* _t85;

				_t75 = __ebx;
				_t82 = E00402B2C(0x31);
				 *(_t85 - 8) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x34) & 0x00000007;
				_t33 = E004059DF(_t82);
				_push(_t82);
				_t83 = "Call";
				if(_t33 == 0) {
					lstrcatA(E00405972(E00405FDA(_t83, "C:\\Users\\engineer\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto\\Forureningsforebygget\\Pegboard")), ??);
				} else {
					E00405FDA();
				}
				E00406244(_t83);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E004062DD(_t83);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x28);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E00405B4E(_t83);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E00405B73(_t83, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 0xc) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E00405101(0xffffffe2,  *(_t85 - 8));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x4237a8;
						goto L32;
					} else {
						E00405FDA(0x409be8, 0x424000);
						E00405FDA(0x424000, _t83);
						E00405FFC(_t75, 0x409be8, _t83, "C:\Users\engineer\AppData\Local\Temp\nst891E.tmp\System.dll",  *((intOrPtr*)(_t85 - 0x20)));
						E00405FDA(0x424000, 0x409be8);
						_t62 = E004056F6("C:\Users\engineer\AppData\Local\Temp\nst891E.tmp\System.dll",  *(_t85 - 0x34) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x4237a8 =  &( *0x4237a8->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(_t83);
								_push(0xfffffffa);
								E00405101();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E00405101(0xffffffea,  *(_t85 - 8)); // executed
				 *0x4237d4 =  *0x4237d4 + 1;
				_push(_t75);
				_push(_t75);
				_push( *(_t85 - 0xc));
				_push( *((intOrPtr*)(_t85 - 0x2c)));
				_t43 = E00402FFB(); // executed
				 *0x4237d4 =  *0x4237d4 - 1;
				__eflags =  *(_t85 - 0x28) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x28) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 0xc), _t85 - 0x28, _t75, _t85 - 0x28); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x24)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x24)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t85 - 0xc)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E00405FFC(_t75, _t80, _t83, _t83, 0xffffffee);
					} else {
						E00405FFC(_t75, _t80, _t83, _t83, 0xffffffe9);
						lstrcatA(_t83,  *(_t85 - 8));
					}
					_push(0x200010);
					_push(_t83);
					E004056F6();
					goto L29;
				}
				goto L33;
			}

0x00401759
0x00401760
0x00401769
0x0040176c
0x0040176f
0x00401774
0x00401775
0x0040177c
0x00401798
0x0040177e
0x0040177f
0x0040177f
0x0040179e
0x004017a8
0x004017a8
0x004017ac
0x004017af
0x004017b4
0x004017b6
0x004017b8
0x004017bd
0x004017bd
0x004017c8
0x004017c8
0x004017d9
0x004017db
0x004017db
0x004017dc
0x004017dc
0x004017df
0x004017e2
0x004017e5
0x004017e5
0x004017ec
0x004017fb
0x00401800
0x00401803
0x00401806
0x00000000
0x00000000
0x00401808
0x0040180b
0x00401865
0x0040186a
0x004015b0
0x00402783
0x00402783
0x004029b8
0x004029bb
0x004029bb
0x00000000
0x0040180d
0x00401813
0x0040181e
0x0040182b
0x00401836
0x0040184c
0x0040184c
0x0040184f
0x00000000
0x00401855
0x00401855
0x00401856
0x00401873
0x004029c1
0x004029c1
0x004029c1
0x00401858
0x00401858
0x00401859
0x00401492
0x0040234e
0x0040234e
0x0040234e
0x00401856
0x0040184f
0x004029c3
0x004029c7
0x004029c7
0x00401883
0x00401888
0x0040188e
0x0040188f
0x00401890
0x00401893
0x00401896
0x0040189b
0x004018a1
0x004018a5
0x004018a7
0x004018af
0x004018bb
0x004018a9
0x004018a9
0x004018ad
0x00000000
0x00000000
0x004018ad
0x004018c4
0x004018ca
0x004018cc
0x00000000
0x004018d2
0x004018d2
0x004018d5
0x004018ed
0x004018d7
0x004018da
0x004018e3
0x004018e3
0x004018f2
0x004018f7
0x00402349
0x00000000
0x00402349
0x00000000

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00405FDA: lstrcpynA.KERNEL32(?,?,00000400,00403307,00422F00,NSIS Error,?,00000006,00000008,0000000A), ref: 00405FE7

Part of subcall function 00405101: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll,00000000,004168C0,00000000,?,?,?,?,?,?,?,?,?,0040312B,00000000,?), ref: 0040513A
Part of subcall function 00405101: lstrlenA.KERNEL32(0040312B,Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll,00000000,004168C0,00000000,?,?,?,?,?,?,?,?,?,0040312B,00000000), ref: 0040514A
Part of subcall function 00405101: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll,0040312B,0040312B,Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll,00000000,004168C0,00000000), ref: 0040515D
Part of subcall function 00405101: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll), ref: 0040516F
Part of subcall function 00405101: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405195
Part of subcall function 00405101: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051AF
Part of subcall function 00405101: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051BD

Strings

Call, xrefs: 00401775, 0040177E, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard, xrefs: 00401786
C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll, xrefs: 00401826, 00401842
C:\Users\user\AppData\Local\Temp\nst891E.tmp, xrefs: 004017A3, 00401812, 00401830

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard$C:\Users\user\AppData\Local\Temp\nst891E.tmp$C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll$Call
API String ID: 1941528284-2056328324
Opcode ID: 3398521465f4744d5abe34836e8d3ca427fef63b03b80e7ecba10af39f1564d3
Instruction ID: a8f8d2e71aafd7953ecb4fd9af401e61999b8e286ce35665580707d8cc6a98aa
Opcode Fuzzy Hash: 3398521465f4744d5abe34836e8d3ca427fef63b03b80e7ecba10af39f1564d3
Instruction Fuzzy Hash: BC41D371A0451ABACB107FA5DC45D9F3AB9EF05329B20823BF411F10E1C63C8A419B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405101 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405101(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x422ee4; // 0x10446
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x4237d4;
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E00405FFC(0, _t39, 0x41f4e8, 0x41f4e8, _a4);
					}
					_t26 = lstrlenA(0x41f4e8);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x422ec8, 0x41f4e8); // executed
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x41f4e8;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0); // executed
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52); // executed
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0); // executed
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x41f4e8)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x41f4e8, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

0x00405107
0x00405113
0x00405116
0x0040511c
0x00405128
0x0040512b
0x0040512e
0x00405134
0x00405134
0x0040513a
0x00405142
0x00405145
0x00405162
0x00405166
0x0040516f
0x0040516f
0x00405179
0x00405182
0x0040518e
0x00405195
0x00405199
0x0040519c
0x004051af
0x004051bd
0x004051bd
0x004051c1
0x004051c3
0x004051c6
0x00000000
0x004051c6
0x00405147
0x0040514f
0x00405157
0x0040515d
0x00000000
0x0040515d
0x00405157
0x00405145
0x004051d0

APIs

lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll,00000000,004168C0,00000000,?,?,?,?,?,?,?,?,?,0040312B,00000000,?), ref: 0040513A
lstrlenA.KERNEL32(0040312B,Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll,00000000,004168C0,00000000,?,?,?,?,?,?,?,?,?,0040312B,00000000), ref: 0040514A
lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll,0040312B,0040312B,Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll,00000000,004168C0,00000000), ref: 0040515D
SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll), ref: 0040516F
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405195
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051AF
SendMessageA.USER32(?,00001013,?,00000000), ref: 004051BD

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll, xrefs: 00405121, 00405133, 00405139, 0040515C, 00405168

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll
API String ID: 2531174081-2767078796
Opcode ID: 624fe4a610ab20420a1f4b6733ac8ea3133b8c284db2b2603e432234c565fffb
Instruction ID: da75402713979d4bf34db42cde910fb2485d85a1008762fbb7bcbbad6d42931f
Opcode Fuzzy Hash: 624fe4a610ab20420a1f4b6733ac8ea3133b8c284db2b2603e432234c565fffb
Instruction Fuzzy Hash: BB219A71E00108BADF119FA4CD84ADFBFB9EF05354F04807AF404A6291C6798E419FA8

Uniqueness

Uniqueness Score: -1.00%

Function 004055C7 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004055C7(CHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x40737c;
				_v36.Group = 0x40737c;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x40736c;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryA(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityA(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x004055d2
0x004055d6
0x004055d9
0x004055df
0x004055e3
0x004055e7
0x004055ef
0x004055f6
0x004055fc
0x00405603
0x0040560a
0x00405612
0x00405614
0x00000000
0x00405614
0x0040561e
0x00405625
0x0040563b
0x00000000
0x00000000
0x00000000
0x0040563d
0x00405641

APIs

CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040560A
GetLastError.KERNEL32 ref: 0040561E
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405633
GetLastError.KERNEL32 ref: 0040563D

Strings

ls@, xrefs: 004055FC
|s@, xrefs: 004055CD
C:\Users\user\Desktop, xrefs: 004055C7
C:\Users\user\AppData\Local\Temp\, xrefs: 004055ED

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$ls@$|s@
API String ID: 3449924974-4220564055
Opcode ID: 6494dcf4892d125dd91232f43a5d02422eac6eb6da40cea13db3a7c62baa9568
Instruction ID: d76da5e920ef4cf84c76b5f8b6eadacb43d526ba9f765b2b55af8eda6d007f2e
Opcode Fuzzy Hash: 6494dcf4892d125dd91232f43a5d02422eac6eb6da40cea13db3a7c62baa9568
Instruction Fuzzy Hash: 90010871C04219EAEF019BA1CC447EFBBB8EB14355F00853AD905B6290E779A605CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00406304 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406304(intOrPtr _a4) {
				char _v292;
				int _t10;
				struct HINSTANCE__* _t14;
				void* _t16;
				void* _t21;

				_t10 = GetSystemDirectoryA( &_v292, 0x104);
				if(_t10 > 0x104) {
					_t10 = 0;
				}
				if(_t10 == 0 ||  *((char*)(_t21 + _t10 - 0x121)) == 0x5c) {
					_t16 = 1;
				} else {
					_t16 = 0;
				}
				_t5 = _t16 + 0x409014; // 0x5c
				wsprintfA(_t21 + _t10 - 0x120, "%s%s.dll", _t5, _a4);
				_t14 = LoadLibraryExA( &_v292, 0, 8); // executed
				return _t14;
			}

0x0040631b
0x00406324
0x00406326
0x00406326
0x0040632a
0x0040633c
0x00406336
0x00406336
0x00406336
0x00406340
0x00406354
0x00406368
0x0040636f

APIs

GetSystemDirectoryA.KERNEL32 ref: 0040631B
wsprintfA.USER32 ref: 00406354
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406368

Strings

%s%s.dll, xrefs: 0040634E
\, xrefs: 0040632C
UXTHEME, xrefs: 0040630D

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: c1c6f81e5f0925475fc46656834228b64d6aad10adaabf52e6c46f27d1be3297
Instruction ID: 15cbb93803340843acffe9ced60e7e2f3372dd006ff9664fb566d465880257e2
Opcode Fuzzy Hash: c1c6f81e5f0925475fc46656834228b64d6aad10adaabf52e6c46f27d1be3297
Instruction Fuzzy Hash: C8F09C30900116ABDB159768DD0DFFB365CEB08309F14057AB986E11D1D574E9258B99

Uniqueness

Uniqueness Score: -1.00%

Function 00402FFB Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00402FFB(int _a4, intOrPtr _a8, intOrPtr _a12, int _a16, signed char _a19) {
				signed int _v8;
				int _v12;
				long _v16;
				intOrPtr _v20;
				char _v84;
				void* _t59;
				intOrPtr _t69;
				long _t70;
				void* _t71;
				intOrPtr _t81;
				intOrPtr _t86;
				long _t89;
				signed int _t90;
				int _t91;
				int _t92;
				intOrPtr _t93;
				void* _t94;
				void* _t95;

				_t90 = _a16;
				_t86 = _a12;
				_v12 = _t90;
				if(_t86 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_t81 = _t86;
				if(_t86 == 0) {
					_t81 = 0x4168c0;
				}
				_t56 = _a4;
				if(_a4 >= 0) {
					E004031ED( *0x423778 + _t56);
				}
				if(E004031D7( &_a16, 4) == 0) {
					L33:
					_push(0xfffffffd);
					goto L34;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t86 == 0) {
							while(_a16 > 0) {
								_t91 = _v12;
								if(_a16 < _t91) {
									_t91 = _a16;
								}
								if(E004031D7(0x4128c0, _t91) == 0) {
									goto L33;
								} else {
									if(E00405C1A(_a8, 0x4128c0, _t91) == 0) {
										L28:
										_push(0xfffffffe);
										L34:
										_pop(_t59);
										return _t59;
									}
									_v8 = _v8 + _t91;
									_a16 = _a16 - _t91;
									continue;
								}
							}
							L43:
							return _v8;
						}
						if(_a16 < _t90) {
							_t90 = _a16;
						}
						if(E004031D7(_t86, _t90) != 0) {
							_v8 = _t90;
							goto L43;
						} else {
							goto L33;
						}
					}
					_v16 = GetTickCount();
					E00406497(0x40a830);
					_t13 =  &_a16;
					 *_t13 = _a16 & 0x7fffffff;
					_a4 = _a16;
					if( *_t13 <= 0) {
						goto L43;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t92 = 0x4000;
						if(_a16 < 0x4000) {
							_t92 = _a16;
						}
						if(E004031D7(0x4128c0, _t92) == 0) {
							goto L33;
						}
						_a16 = _a16 - _t92;
						 *0x40a848 = 0x4128c0;
						 *0x40a84c = _t92;
						while(1) {
							 *0x40a850 = _t81;
							 *0x40a854 = _v12; // executed
							_t69 = E004064B7(0x40a830); // executed
							_v20 = _t69;
							if(_t69 < 0) {
								break;
							}
							_t93 =  *0x40a850; // 0x4168c0
							_t94 = _t93 - _t81;
							_t70 = GetTickCount();
							_t89 = _t70;
							if(( *0x4237d4 & 0x00000001) != 0 && (_t70 - _v16 > 0xc8 || _a16 == 0)) {
								wsprintfA( &_v84, "... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t95 = _t95 + 0xc;
								E00405101(0,  &_v84); // executed
								_v16 = _t89;
							}
							if(_t94 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L43;
							} else {
								if(_a12 != 0) {
									_v8 = _v8 + _t94;
									_v12 = _v12 - _t94;
									_t81 =  *0x40a850; // 0x4168c0
									L23:
									if(_v20 != 1) {
										continue;
									}
									goto L43;
								}
								_t71 = E00405C1A(_a8, _t81, _t94); // executed
								if(_t71 == 0) {
									goto L28;
								}
								_v8 = _v8 + _t94;
								goto L23;
							}
						}
						_push(0xfffffffc);
						goto L34;
					}
					goto L33;
				}
			}

0x00403003
0x00403007
0x0040300a
0x0040300f
0x00403011
0x00403011
0x00403018
0x0040301c
0x00403020
0x00403022
0x00403022
0x00403027
0x0040302c
0x00403037
0x00403037
0x00403049
0x0040318e
0x0040318e
0x00000000
0x0040304f
0x00403053
0x00403179
0x004031c2
0x00403193
0x00403199
0x0040319b
0x0040319b
0x004031ac
0x00000000
0x004031ae
0x004031ba
0x00403173
0x00403173
0x00403190
0x00403190
0x00000000
0x00403190
0x004031bc
0x004031bf
0x00000000
0x004031bf
0x004031ac
0x004031cd
0x00000000
0x004031cd
0x0040317e
0x00403180
0x00403180
0x0040318c
0x004031ca
0x00000000
0x00000000
0x00000000
0x00000000
0x0040318c
0x00403064
0x00403067
0x0040306c
0x0040306c
0x00403076
0x00403079
0x00000000
0x00000000
0x00000000
0x00000000
0x0040307f
0x0040307f
0x0040307f
0x00403087
0x00403089
0x00403089
0x0040309a
0x00000000
0x00000000
0x004030a0
0x004030a3
0x004030a9
0x004030af
0x004030b7
0x004030bd
0x004030c2
0x004030c9
0x004030cc
0x00000000
0x00000000
0x004030d2
0x004030d8
0x004030da
0x004030e7
0x004030e9
0x00403117
0x0040311d
0x00403126
0x0040312b
0x0040312b
0x00403130
0x00403167
0x00000000
0x00000000
0x00000000
0x00403132
0x00403136
0x0040314b
0x0040314e
0x00403151
0x00403157
0x0040315b
0x00000000
0x00000000
0x00000000
0x00403161
0x0040313d
0x00403144
0x00000000
0x00000000
0x00403146
0x00000000
0x00403146
0x00403130
0x0040316f
0x00000000
0x0040316f
0x00000000
0x0040307f

APIs

GetTickCount.KERNEL32 ref: 00403059
GetTickCount.KERNEL32 ref: 004030DA
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00403107
wsprintfA.USER32 ref: 00403117

Strings

... %d%%, xrefs: 00403111

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: 28484a559e18d06ed43ef22bfdd21feadbb4bbad1a21b96adf7a711402a84214
Instruction ID: eed10709806649b2ce9ecdbe6bed08e8f554dc741dea3641cf9b2fc180d08aa2
Opcode Fuzzy Hash: 28484a559e18d06ed43ef22bfdd21feadbb4bbad1a21b96adf7a711402a84214
Instruction Fuzzy Hash: A7515E71901219ABDB10EF65D904A9F3BB8AF48756F14413BFD10BB2C0C7789E51CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00405BA2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405BA2(char _a4, intOrPtr _a6, CHAR* _a8) {
				char _t11;
				signed int _t12;
				int _t15;
				signed int _t17;
				void* _t20;
				CHAR* _t21;

				_t21 = _a4;
				_t20 = 0x64;
				while(1) {
					_t11 =  *0x4093b4; // 0x61736e
					_t20 = _t20 - 1;
					_a4 = _t11;
					_t12 = GetTickCount();
					_t17 = 0x1a;
					_a6 = _a6 + _t12 % _t17;
					_t15 = GetTempFileNameA(_a8,  &_a4, 0, _t21); // executed
					if(_t15 != 0) {
						break;
					}
					if(_t20 != 0) {
						continue;
					}
					 *_t21 =  *_t21 & 0x00000000;
					return _t15;
				}
				return _t21;
			}

0x00405ba6
0x00405bac
0x00405bad
0x00405bad
0x00405bb2
0x00405bb3
0x00405bb6
0x00405bc0
0x00405bcd
0x00405bd0
0x00405bd8
0x00000000
0x00000000
0x00405bdc
0x00000000
0x00000000
0x00405bde
0x00000000
0x00405bde
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00405BB6
GetTempFileNameA.KERNELBASE(?,?,00000000,?,?,00000006,00000008,0000000A), ref: 00405BD0

Strings

"C:\Users\user\Desktop\Quotation.exe", xrefs: 00405BA2
nsa, xrefs: 00405BAD
C:\Users\user\AppData\Local\Temp\, xrefs: 00405BA5

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\Quotation.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-53377224
Opcode ID: 4f71c4811bd2189c67125445424a5cfd250d6f6759894b34be1bee502b12972b
Instruction ID: 2f7af396f84d097035df83fe1d719984909df90e6a6ed76a9758152acb097983
Opcode Fuzzy Hash: 4f71c4811bd2189c67125445424a5cfd250d6f6759894b34be1bee502b12972b
Instruction Fuzzy Hash: B9F082367082086BEB108F5ADC04B9B7BA8DF91750F14803BFA08DA291D6B4B9548B69

Uniqueness

Uniqueness Score: -1.00%

Function 6D0116DB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E6D0116DB(void* __edx, void* __edi, void* __esi, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void _v36;
				char _v88;
				struct HINSTANCE__* _t37;
				intOrPtr _t42;
				void* _t48;
				void* _t49;
				void* _t50;
				void* _t54;
				intOrPtr _t57;
				signed int _t61;
				signed int _t63;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t76;

				_t76 = __esi;
				_t68 = __edi;
				_t67 = __edx;
				 *0x6d01405c = _a8;
				 *0x6d014060 = _a16;
				 *0x6d014064 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x6d014038, E6D011556);
				_push(1); // executed
				_t37 = E6D011A98(); // executed
				_t54 = _t37;
				if(_t54 == 0) {
					L28:
					return _t37;
				} else {
					if( *((intOrPtr*)(_t54 + 4)) != 1) {
						E6D0122AF(_t54);
					}
					E6D0122F1(_t67, _t54);
					_t57 =  *((intOrPtr*)(_t54 + 4));
					if(_t57 == 0xffffffff) {
						L14:
						if(( *(_t54 + 0x810) & 0x00000004) == 0) {
							if( *((intOrPtr*)(_t54 + 4)) == 0) {
								_t37 = E6D0124D8(_t54);
							} else {
								_push(_t76);
								_push(_t68);
								_t61 = 8;
								_t13 = _t54 + 0x818; // 0x818
								memcpy( &_v36, _t13, _t61 << 2);
								_t42 = E6D01156B(_t54,  &_v88);
								 *(_t54 + 0x834) =  *(_t54 + 0x834) & 0x00000000;
								_t18 = _t54 + 0x818; // 0x818
								_t72 = _t18;
								 *((intOrPtr*)(_t54 + 0x820)) = _t42;
								 *_t72 = 3;
								E6D0124D8(_t54);
								_t63 = 8;
								_t37 = memcpy(_t72,  &_v36, _t63 << 2);
							}
						} else {
							E6D0124D8(_t54);
							_t37 = GlobalFree(E6D011266(E6D011559(_t54)));
						}
						if( *((intOrPtr*)(_t54 + 4)) != 1) {
							_t37 = E6D01249E(_t54);
							if(( *(_t54 + 0x810) & 0x00000040) != 0 &&  *_t54 == 1) {
								_t37 =  *(_t54 + 0x808);
								if(_t37 != 0) {
									_t37 = FreeLibrary(_t37);
								}
							}
							if(( *(_t54 + 0x810) & 0x00000020) != 0) {
								_t37 = E6D0114E2( *0x6d014058);
							}
						}
						if(( *(_t54 + 0x810) & 0x00000002) != 0) {
							goto L28;
						} else {
							return GlobalFree(_t54);
						}
					}
					_t48 =  *_t54;
					if(_t48 == 0) {
						if(_t57 != 1) {
							goto L14;
						}
						E6D012CC3(_t54);
						L12:
						_t54 = _t48;
						L13:
						goto L14;
					}
					_t49 = _t48 - 1;
					if(_t49 == 0) {
						L8:
						_t48 = E6D012A38(_t57, _t54); // executed
						goto L12;
					}
					_t50 = _t49 - 1;
					if(_t50 == 0) {
						E6D0126B2(_t54);
						goto L13;
					}
					if(_t50 != 1) {
						goto L14;
					}
					goto L8;
				}
			}

0x6d0116db
0x6d0116db
0x6d0116db
0x6d0116e5
0x6d0116ed
0x6d0116fa
0x6d011708
0x6d01170b
0x6d01170d
0x6d011712
0x6d011717
0x6d011836
0x6d011836
0x6d01171d
0x6d011721
0x6d011724
0x6d011729
0x6d01172b
0x6d011731
0x6d011737
0x6d011767
0x6d01176e
0x6d011792
0x6d0117dd
0x6d011794
0x6d011794
0x6d011795
0x6d01179b
0x6d01179c
0x6d0117a6
0x6d0117a9
0x6d0117ae
0x6d0117b5
0x6d0117b5
0x6d0117bc
0x6d0117c2
0x6d0117c8
0x6d0117d5
0x6d0117d6
0x6d0117d9
0x6d011770
0x6d011771
0x6d011786
0x6d011786
0x6d0117e7
0x6d0117ea
0x6d0117f7
0x6d0117fe
0x6d011806
0x6d011809
0x6d011809
0x6d011806
0x6d011816
0x6d01181e
0x6d011823
0x6d011816
0x6d01182b
0x00000000
0x6d01182d
0x00000000
0x6d01182e
0x6d01182b
0x6d01173b
0x6d01173e
0x6d01175c
0x00000000
0x00000000
0x6d01175f
0x6d011764
0x6d011764
0x6d011766
0x00000000
0x6d011766
0x6d011740
0x6d011741
0x6d011749
0x6d01174a
0x00000000
0x6d01174a
0x6d011743
0x6d011744
0x6d011752
0x00000000
0x6d011752
0x6d011747
0x00000000
0x00000000
0x00000000
0x6d011747

APIs

Part of subcall function 6D011A98: GlobalFree.KERNEL32 ref: 6D011D09
Part of subcall function 6D011A98: GlobalFree.KERNEL32 ref: 6D011D0E
Part of subcall function 6D011A98: GlobalFree.KERNEL32 ref: 6D011D13

GlobalFree.KERNEL32 ref: 6D011786
FreeLibrary.KERNEL32(?), ref: 6D011809
GlobalFree.KERNEL32 ref: 6D01182E

Part of subcall function 6D0122AF: GlobalAlloc.KERNEL32(00000040,?), ref: 6D0122E0

Part of subcall function 6D0126B2: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,6D011757,00000000), ref: 6D012782

Part of subcall function 6D01156B: wsprintfA.USER32 ref: 6D011599

Strings

, xrefs: 6D01180F

Memory Dump Source

Source File: 00000000.00000002.779239899.000000006D011000.00000020.00000001.01000000.00000004.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000000.00000002.779220127.000000006D010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.779251763.000000006D013000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.779269562.000000006D015000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d010000_Quotation.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: ccd3a4867686a551c536661ab04dcb8f0256d73c96f570c1dd74313c3d29c982
Instruction ID: 8458c11e3b20baa1d5b3cf033120370375280c9ba7bad087dad19050927bff93
Opcode Fuzzy Hash: ccd3a4867686a551c536661ab04dcb8f0256d73c96f570c1dd74313c3d29c982
Instruction Fuzzy Hash: 6941937110C20A9BFB099FF4DC85BA937F8FF26318F058565EA199B182DB74C145CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0040243D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040243D(void* __eax, int __ebx, intOrPtr __edx) {
				void* _t18;
				void* _t19;
				int _t22;
				long _t23;
				int _t28;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t35;
				void* _t37;
				void* _t40;

				_t31 = __edx;
				_t28 = __ebx;
				_t35 =  *((intOrPtr*)(_t37 - 0x24));
				_t32 = __eax;
				 *(_t37 - 0x10) =  *(_t37 - 0x20);
				 *(_t37 - 0x4c) = E00402B2C(2);
				_t18 = E00402B2C(0x11);
				 *(_t37 - 4) = 1;
				_t19 = E00402BBC(_t40, _t32, _t18, 2); // executed
				 *(_t37 + 8) = _t19;
				if(_t19 != __ebx) {
					_t22 = 0;
					if(_t35 == 1) {
						E00402B2C(0x23);
						_t22 = lstrlenA(0x409be8) + 1;
					}
					if(_t35 == 4) {
						 *0x409be8 = E00402B0A(3);
						 *((intOrPtr*)(_t37 - 0x44)) = _t31;
						_t22 = _t35;
					}
					if(_t35 == 3) {
						_t22 = E00402FFB( *((intOrPtr*)(_t37 - 0x28)), _t28, 0x409be8, 0xc00); // executed
					}
					_t23 = RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x4c), _t28,  *(_t37 - 0x10), 0x409be8, _t22); // executed
					if(_t23 == 0) {
						 *(_t37 - 4) = _t28;
					}
					_push( *(_t37 + 8));
					RegCloseKey();
				}
				 *0x4237a8 =  *0x4237a8 +  *(_t37 - 4);
				return 0;
			}

0x0040243d
0x0040243d
0x0040243d
0x00402440
0x00402447
0x00402451
0x00402454
0x0040245d
0x00402464
0x0040246b
0x0040246e
0x00402474
0x0040247e
0x00402482
0x0040248d
0x0040248d
0x00402491
0x0040249b
0x004024a1
0x004024a4
0x004024a4
0x004024a8
0x004024b4
0x004024b4
0x004024c5
0x004024cd
0x004024cf
0x004024cf
0x004024d2
0x004025a9
0x004025a9
0x004029bb
0x004029c7

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nst891E.tmp,00000023,00000011,00000002), ref: 00402488
RegSetValueExA.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nst891E.tmp,00000000,00000011,00000002), ref: 004024C5
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nst891E.tmp,00000000,00000011,00000002), ref: 004025A9

Strings

C:\Users\user\AppData\Local\Temp\nst891E.tmp, xrefs: 00402479, 0040249B, 004024AF, 004024BA

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nst891E.tmp
API String ID: 2655323295-3303754261
Opcode ID: edd33fe483ba84759b99ae37b3b6bbb98728847c3150981f6fed721a845609ff
Instruction ID: 8e9ea0cf859de5a6fe7672b5a81e2234dbec8cc7450cb22075f11fbb1059ccd6
Opcode Fuzzy Hash: edd33fe483ba84759b99ae37b3b6bbb98728847c3150981f6fed721a845609ff
Instruction Fuzzy Hash: 42119072E00218BEEB01AFA58E49EAE7BB8FB48314F20443BF504B71C1C6B85D419B58

Uniqueness

Uniqueness Score: -1.00%

Function 0040206A Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E0040206A(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t26;
				void* _t27;
				struct HINSTANCE__* _t30;
				CHAR* _t32;
				intOrPtr* _t33;
				void* _t34;

				_t27 = __ebx;
				asm("sbb eax, 0x4237d8");
				 *(_t34 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x4237a8 =  *0x4237a8 +  *(_t34 - 4);
					return 0;
				}
				_t32 = E00402B2C(0xfffffff0);
				 *(_t34 + 8) = E00402B2C(1);
				if( *((intOrPtr*)(_t34 - 0x24)) == __ebx) {
					L3:
					_t18 = LoadLibraryExA(_t32, _t27, 8); // executed
					_t30 = _t18;
					if(_t30 == _t27) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t33 = GetProcAddress(_t30,  *(_t34 + 8));
					if(_t33 == _t27) {
						E00405101(0xfffffff7,  *(_t34 + 8));
					} else {
						 *(_t34 - 4) = _t27;
						if( *((intOrPtr*)(_t34 - 0x2c)) == _t27) {
							 *_t33( *((intOrPtr*)(_t34 - 8)), 0x400, 0x424000, 0x40a828, 0x409000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t34 - 0x2c)));
							if( *_t33() != 0) {
								 *(_t34 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t34 - 0x28)) == _t27 && E00403797(_t30) != 0) {
						FreeLibrary(_t30);
					}
					goto L16;
				}
				_t26 = GetModuleHandleA(_t32); // executed
				_t30 = _t26;
				if(_t30 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x0040206a
0x0040206a
0x0040206f
0x00402076
0x00402131
0x004022a4
0x004022a4
0x004029b8
0x004029bb
0x004029c7
0x004029c7
0x00402085
0x0040208f
0x00402092
0x004020a1
0x004020a5
0x004020ab
0x004020af
0x0040212a
0x00000000
0x0040212a
0x004020b1
0x004020ba
0x004020be
0x00402102
0x004020c0
0x004020c3
0x004020c6
0x004020f6
0x004020c8
0x004020cb
0x004020d4
0x004020d6
0x004020d6
0x004020d4
0x004020c6
0x0040210a
0x0040211f
0x0040211f
0x00000000
0x0040210a
0x00402095
0x0040209b
0x0040209f
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00402095

Part of subcall function 00405101: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll,00000000,004168C0,00000000,?,?,?,?,?,?,?,?,?,0040312B,00000000,?), ref: 0040513A
Part of subcall function 00405101: lstrlenA.KERNEL32(0040312B,Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll,00000000,004168C0,00000000,?,?,?,?,?,?,?,?,?,0040312B,00000000), ref: 0040514A
Part of subcall function 00405101: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll,0040312B,0040312B,Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll,00000000,004168C0,00000000), ref: 0040515D
Part of subcall function 00405101: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll), ref: 0040516F
Part of subcall function 00405101: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405195
Part of subcall function 00405101: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051AF
Part of subcall function 00405101: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051BD

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 004020A5
GetProcAddress.KERNEL32(00000000,?), ref: 004020B5
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040211F

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 9df56e7d61f173b7ce09018b28e1b31a2cbc0ab7774ce8c4a93682e38e80f95d
Instruction ID: 97d835e61fc7e0b97890b4be7664cc53dce4a02014942e479506a03d8351e840
Opcode Fuzzy Hash: 9df56e7d61f173b7ce09018b28e1b31a2cbc0ab7774ce8c4a93682e38e80f95d
Instruction Fuzzy Hash: 4521D871A00214BBCF117FA4CE8DAAE79B4AB44319F20413BFA01B62D0C6FD9981D65E

Uniqueness

Uniqueness Score: -1.00%

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E004015BB(char __ebx, void* __eflags) {
				void* _t13;
				int _t19;
				char _t21;
				void* _t22;
				char _t23;
				signed char _t24;
				char _t26;
				CHAR* _t28;
				char* _t32;
				void* _t33;

				_t26 = __ebx;
				_t28 = E00402B2C(0xfffffff0);
				_t13 = E00405A0B(_t28);
				_t30 = _t13;
				if(_t13 != __ebx) {
					do {
						_t32 = E0040599D(_t30, 0x5c);
						_t21 =  *_t32;
						 *_t32 = _t26;
						 *((char*)(_t33 + 0xb)) = _t21;
						if(_t21 != _t26) {
							L5:
							_t22 = E00405644(_t28);
						} else {
							_t39 =  *((intOrPtr*)(_t33 - 0x2c)) - _t26;
							if( *((intOrPtr*)(_t33 - 0x2c)) == _t26 || E00405661(_t39) == 0) {
								goto L5;
							} else {
								_t22 = E004055C7(_t28); // executed
							}
						}
						if(_t22 != _t26) {
							if(_t22 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
							} else {
								_t24 = GetFileAttributesA(_t28); // executed
								if((_t24 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						_t23 =  *((intOrPtr*)(_t33 + 0xb));
						 *_t32 = _t23;
						_t30 = _t32 + 1;
					} while (_t23 != _t26);
				}
				if( *((intOrPtr*)(_t33 - 0x30)) == _t26) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00405FDA("C:\\Users\\engineer\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto\\Forureningsforebygget\\Pegboard", _t28);
					_t19 = SetCurrentDirectoryA(_t28); // executed
					if(_t19 == 0) {
						 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
					}
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t33 - 4));
				return 0;
			}

0x004015bb
0x004015c2
0x004015c5
0x004015ca
0x004015ce
0x004015d0
0x004015d8
0x004015da
0x004015dc
0x004015e0
0x004015e3
0x004015fb
0x004015fc
0x004015e5
0x004015e5
0x004015e8
0x00000000
0x004015f3
0x004015f4
0x004015f4
0x004015e8
0x00401603
0x0040160a
0x00401617
0x00401617
0x0040160c
0x0040160d
0x00401615
0x00000000
0x00000000
0x00401615
0x0040160a
0x0040161a
0x0040161d
0x0040161f
0x00401620
0x004015d0
0x00401627
0x00401652
0x004022a4
0x00401629
0x0040162b
0x00401636
0x0040163c
0x00401644
0x0040164a
0x0040164a
0x00401644
0x004029bb
0x004029c7

APIs

Part of subcall function 00405A0B: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nst891E.tmp,?,00405A77,C:\Users\user\AppData\Local\Temp\nst891E.tmp,C:\Users\user\AppData\Local\Temp\nst891E.tmp,746AFA90,?,C:\Users\user\AppData\Local\Temp\,004057C2,?,746AFA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A19
Part of subcall function 00405A0B: CharNextA.USER32(00000000), ref: 00405A1E
Part of subcall function 00405A0B: CharNextA.USER32(00000000), ref: 00405A32

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D

Part of subcall function 004055C7: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040560A

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard,00000000,00000000,000000F0), ref: 0040163C

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard, xrefs: 00401631

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard
API String ID: 1892508949-2002230202
Opcode ID: 5cfa9deb3d8257745ad8f4e180157ca1595cadb6213feee14bfc4c3bdc9c1bf4
Instruction ID: 3a09c20382928311ba1d31a626229d1df209b5e1cddac7105c79dbf72218ebe6
Opcode Fuzzy Hash: 5cfa9deb3d8257745ad8f4e180157ca1595cadb6213feee14bfc4c3bdc9c1bf4
Instruction Fuzzy Hash: B4112731508141EBCB212FB94D4197F36B0EA96325F28453FE4D2B23E2D63D49429A3F

Uniqueness

Uniqueness Score: -1.00%

Function 00405EC1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00405EC1(void* __ecx, void* __eflags, intOrPtr _a4, int _a8, char* _a12, char* _a16, signed int _a20) {
				int _v8;
				long _t21;
				long _t24;
				char* _t30;

				asm("sbb eax, eax");
				_v8 = 0x400;
				_t21 = E00405E60(__eflags, _a4, _a8,  ~_a20 & 0x00000100 | 0x00020019,  &_a20); // executed
				_t30 = _a16;
				if(_t21 != 0) {
					L4:
					 *_t30 =  *_t30 & 0x00000000;
				} else {
					_t24 = RegQueryValueExA(_a20, _a12, 0,  &_a8, _t30,  &_v8); // executed
					_t21 = RegCloseKey(_a20); // executed
					_t30[0x3ff] = _t30[0x3ff] & 0x00000000;
					if(_t24 != 0 || _a8 != 1 && _a8 != 2) {
						goto L4;
					}
				}
				return _t21;
			}

0x00405ecf
0x00405ed1
0x00405ee9
0x00405eee
0x00405ef3
0x00405f30
0x00405f30
0x00405ef5
0x00405f07
0x00405f12
0x00405f18
0x00405f22
0x00000000
0x00000000
0x00405f22
0x00405f35

APIs

RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,00000400,Call,?,?,?,?,00000002,Call,?,00406105,80000002), ref: 00405F07
RegCloseKey.KERNELBASE(?,?,00406105,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,?,Skipped: C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll), ref: 00405F12

Strings

Call, xrefs: 00405EC4, 00405EF8

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: abfb1157869b45efbda80eaac2ce6d2ce1cd77193e8e6ff114ced4d7fd94e931
Instruction ID: 897067c620da28adabf34c96f4b8630bfa599ba4fb7ce992f063a5310404d611
Opcode Fuzzy Hash: abfb1157869b45efbda80eaac2ce6d2ce1cd77193e8e6ff114ced4d7fd94e931
Instruction Fuzzy Hash: 6D015A7251020AABEF22CF61CC09FDB3BACEF55364F004026FA55A2190D278DA54CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00406A9B Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E00406A9B() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M00406F09))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4)); // executed
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8)); // executed
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00406a9b
0x00406a9b
0x00406a9b
0x00406a9b
0x00406aa1
0x00406aa5
0x00406aa9
0x00406ab3
0x00406ac1
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00406dce
0x00406dce
0x00406dd2
0x00000000
0x00000000
0x00406dd4
0x00406ddd
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df5
0x00406e0e
0x00406e11
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406e06
0x00406e09
0x00406e09
0x00406e2b
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dce
0x00406dd2
0x00000000
0x00000000
0x00000000
0x00406e2d
0x00406e2d
0x00406da6
0x00406daa
0x00406ee2
0x00406ee2
0x00406eec
0x00406ef4
0x00406efb
0x00406efd
0x00406f04
0x00406f08
0x00406f08
0x00406db0
0x00406db6
0x00406dbd
0x00406dc5
0x00406dc5
0x00406dc8
0x00000000
0x00406dc8
0x00406e32
0x00406e3f
0x00406e42
0x00406d4e
0x00406d4e
0x00406d4e
0x004064ea
0x004064ea
0x004064ea
0x004064f3
0x00000000
0x00000000
0x004064f9
0x004064f9
0x00000000
0x00406500
0x00406504
0x00000000
0x00000000
0x0040650a
0x0040650d
0x00406510
0x00406513
0x00406517
0x00000000
0x00000000
0x0040651d
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406563
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406565
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00406e55
0x00000000
0x00406e55
0x004065af
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d1
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065d9
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00406e64
0x00000000
0x00406e64
0x0040661f
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d23
0x00406d27
0x00406ed6
0x00406ed6
0x00000000
0x00406ed6
0x00406d2d
0x00406d33
0x00406d3a
0x00406d42
0x00406d45
0x00406d48
0x00406d48
0x00406d4e
0x00406d4e
0x00000000
0x00000000
0x00406666
0x00406666
0x00406668
0x0040666b
0x004066dc
0x004066dc
0x004066df
0x004066e2
0x004066e9
0x004066f3
0x00000000
0x004066f3
0x0040666d
0x0040666d
0x00406671
0x00406674
0x00406676
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x0040668e
0x00406692
0x00406699
0x0040669c
0x004066a3
0x004066a7
0x004066af
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b3
0x004066b6
0x004066d4
0x004066d4
0x004066d6
0x00000000
0x004066b8
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c3
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x00000000
0x004066cf
0x00000000
0x00406905
0x00406905
0x00406909
0x00406927
0x00406927
0x0040692a
0x00406931
0x00406934
0x00406937
0x0040693a
0x0040693d
0x00406940
0x00406942
0x00406949
0x0040694a
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406955
0x0040695a
0x00000000
0x0040695a
0x0040690b
0x0040690b
0x0040690e
0x00406911
0x0040691b
0x00000000
0x00000000
0x0040696f
0x0040696f
0x00406973
0x00406996
0x00406999
0x0040699c
0x004069a6
0x00406975
0x00406975
0x00406978
0x0040697b
0x0040697e
0x0040698b
0x0040698e
0x0040698e
0x00000000
0x00000000
0x004069b2
0x004069b2
0x004069b6
0x00000000
0x00000000
0x004069bc
0x004069bc
0x004069c0
0x00000000
0x00000000
0x004069c6
0x004069c6
0x004069c8
0x004069cc
0x004069cc
0x004069cf
0x004069d3
0x00000000
0x00000000
0x00406a23
0x00406a23
0x00406a27
0x00406a2e
0x00406a2e
0x00406a31
0x00406a34
0x00406a3e
0x00000000
0x00406a3e
0x00406a29
0x00406a29
0x00000000
0x00000000
0x00406a4a
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00406a64
0x00406a64
0x00406a67
0x00406a6a
0x00406a6d
0x00406a6d
0x00406a70
0x00406a77
0x00406a7c
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406703
0x00406e70
0x00406e70
0x00000000
0x00406e70
0x00406709
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x0040671e
0x00406721
0x00406724
0x00406724
0x00406727
0x0040672a
0x00000000
0x00000000
0x00406730
0x00406730
0x00406736
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406767
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679a
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067a3
0x004067aa
0x004067ad
0x00000000
0x004067b3
0x004067b3
0x00000000
0x004067b3
0x00000000
0x004067b8
0x004067b8
0x004067bc
0x00406e7c
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067d7
0x004067da
0x004067dd
0x004067dd
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406800
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682b
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406830
0x00406837
0x0040683a
0x00000000
0x0040683c
0x0040683c
0x00000000
0x0040683c
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406841
0x00000000
0x00000000
0x0040687c
0x0040687c
0x00406880
0x00406e88
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689b
0x0040689e
0x004068a1
0x004068a1
0x004068a7
0x00406845
0x00406845
0x00406848
0x00000000
0x00406848
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c4
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068ef
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068f4
0x004068fb
0x004068fe
0x00000000
0x00406900
0x00406900
0x00000000
0x00406900
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x0040695d
0x0040695d
0x00406960
0x00000000
0x00000000
0x00406c9c
0x00406c9c
0x00406ca0
0x00406cc2
0x00406cc2
0x00406cc5
0x00406ccf
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406ca2
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00000000
0x00000000
0x00406d59
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00406d90
0x00406d90
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00406da4
0x00406d5f
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00406cb3
0x00406cb3
0x00406cb6
0x00000000
0x00000000
0x00406e4a
0x00406e4a
0x00406e4d
0x00406d4e
0x00406d4e
0x00406d4e
0x00000000
0x00406d54
0x00000000
0x00406a84
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00406da4
0x00000000
0x00000000
0x00000000
0x00406ac9
0x00406ac9
0x00406acc
0x00406b02
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b62
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x0040684b
0x0040684b
0x0040684f
0x00406e94
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00000000
0x00000000
0x004069d6
0x004069d6
0x004069da
0x00406ea0
0x00406ea0
0x00000000
0x00406ea0
0x004069e0
0x004069e0
0x004069e3
0x004069e6
0x004069e9
0x004069eb
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0c
0x00406a0f
0x00406a11
0x00406a11
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00406c97
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00406c95
0x00406eca
0x00406eca
0x00000000
0x00000000
0x004064f9
0x00406f01
0x00406f01
0x00000000
0x00406f01
0x00406d4e
0x00406dce
0x00406d97

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03e86151e03bba78afe16222fe9d5ebe1cb7bbef763218a955a86232309b7881
Instruction ID: 81ce818a04e0c3cc04ce684d9a2a9ddfd009c22adec174195ca66df60ea86fc9
Opcode Fuzzy Hash: 03e86151e03bba78afe16222fe9d5ebe1cb7bbef763218a955a86232309b7881
Instruction Fuzzy Hash: 69A14271E00229DBDF28CFA8C8446ADBBB1FF44305F15842AD916BB281C7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406C9C Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406C9C() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00406F09))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4)); // executed
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406c9c
0x00406c9c
0x00406ca0
0x00406cc5
0x00406ccf
0x00000000
0x00406ca2
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406caf
0x00406cb3
0x00406cb3
0x00406cb6
0x00406d90
0x00406d90
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00406dce
0x00406dd2
0x00406e32
0x00406e35
0x00406e3a
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e42
0x00406d4e
0x00406d4e
0x00406d4e
0x004064ea
0x004064ea
0x004064ea
0x004064f3
0x00000000
0x00000000
0x004064f9
0x00000000
0x00406504
0x00000000
0x00000000
0x0040650d
0x00406510
0x00406513
0x00406517
0x00000000
0x00000000
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406563
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00000000
0x00406e55
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00000000
0x00406e64
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d23
0x00406d27
0x00406ed6
0x00000000
0x00406ed6
0x00406d33
0x00406d3a
0x00406d42
0x00406d45
0x00406d48
0x00406d48
0x00000000
0x00000000
0x00406666
0x00406668
0x0040666b
0x004066dc
0x004066df
0x004066e2
0x004066e9
0x004066f3
0x00000000
0x004066f3
0x0040666d
0x00406671
0x00406674
0x00406676
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x0040668e
0x00406692
0x00406699
0x0040669c
0x004066a3
0x004066a7
0x004066af
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b3
0x004066b6
0x004066d4
0x004066d6
0x00000000
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c3
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x00000000
0x004066cf
0x00000000
0x00406905
0x00406909
0x00406927
0x0040692a
0x00406931
0x00406934
0x00406937
0x0040693a
0x0040693d
0x00406940
0x00406942
0x00406949
0x0040694a
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406955
0x0040695a
0x00000000
0x0040695a
0x0040690b
0x0040690e
0x00406911
0x0040691b
0x00000000
0x00000000
0x0040696f
0x00406973
0x00406996
0x00406999
0x0040699c
0x004069a6
0x00406975
0x00406975
0x00406978
0x0040697b
0x0040697e
0x0040698b
0x0040698e
0x0040698e
0x00000000
0x00000000
0x004069b2
0x004069b6
0x00000000
0x00000000
0x004069bc
0x004069c0
0x00000000
0x00000000
0x004069c6
0x004069c8
0x004069cc
0x004069cc
0x004069cf
0x004069d3
0x00000000
0x00000000
0x00406a23
0x00406a27
0x00406a2e
0x00406a31
0x00406a34
0x00406a3e
0x00000000
0x00406a3e
0x00406a29
0x00000000
0x00000000
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00406a64
0x00406a64
0x00406a67
0x00406a6a
0x00406a6d
0x00406a6d
0x00406a70
0x00406a77
0x00406a7c
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406703
0x00406e70
0x00000000
0x00406e70
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x0040671e
0x00406721
0x00406724
0x00406724
0x00406727
0x0040672a
0x00000000
0x00000000
0x00406730
0x00406736
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406767
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679a
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067a3
0x004067aa
0x004067ad
0x00000000
0x004067b3
0x00000000
0x004067b3
0x00000000
0x004067b8
0x004067b8
0x004067bc
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067d7
0x004067da
0x004067dd
0x004067dd
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406800
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682b
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406830
0x00406837
0x0040683a
0x00000000
0x0040683c
0x00000000
0x0040683c
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406841
0x00000000
0x00000000
0x0040687c
0x0040687c
0x00406880
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689b
0x0040689e
0x004068a1
0x004068a1
0x004068a7
0x00406845
0x00406845
0x00406848
0x00000000
0x00406848
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c4
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068ef
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068f4
0x004068fb
0x004068fe
0x00000000
0x00406900
0x00000000
0x00406900
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x0040695d
0x0040695d
0x00406960
0x00406cd2
0x00406cd2
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00000000
0x00406d89
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00000000
0x00000000
0x00406e4a
0x00406e4d
0x00406d4e
0x00406d4e
0x00000000
0x00000000
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aa6
0x00406aa9
0x00406ab0
0x00406ab3
0x00406ac1
0x00000000
0x00000000
0x00000000
0x00000000
0x00406da6
0x00406da6
0x00406daa
0x00406ee2
0x00000000
0x00406ee2
0x00406db0
0x00406db3
0x00406db6
0x00406dba
0x00406dbd
0x00406dc3
0x00406dc5
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dcb
0x00000000
0x00000000
0x00406ac9
0x00406acc
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x0040684b
0x0040684b
0x0040684f
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00000000
0x00000000
0x004069d6
0x004069d6
0x004069da
0x00406ea0
0x00000000
0x00406ea0
0x004069e0
0x004069e3
0x004069e6
0x004069e9
0x004069eb
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0c
0x00406a0f
0x00406a11
0x00406a11
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00406c95
0x00406eca
0x00406eec
0x00406ef2
0x00406ef4
0x00406efb
0x00406efd
0x00406f04
0x00406f08
0x00000000
0x004064f9
0x00406f01
0x00406f01
0x00000000
0x00406f01
0x00406d4e
0x00406dd4
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df5
0x00406e0e
0x00406e11
0x00406e14
0x00406e17
0x00406e1b
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406dff
0x00406e04
0x00406e06
0x00406e09
0x00406e09
0x00406e2b
0x00000000
0x00406e2d
0x00000000
0x00406e2d
0x00406e2b
0x00000000
0x00406ca0

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48eeb96149e0d88395d78aa931bb38ded32ae5716a52e0a7ec155fc571e56ba0
Instruction ID: 08e1f0bd3e012b2653e952fb076f5459688999f8fa16d8000732ef154d800f7e
Opcode Fuzzy Hash: 48eeb96149e0d88395d78aa931bb38ded32ae5716a52e0a7ec155fc571e56ba0
Instruction Fuzzy Hash: 53912370E00229CBEF28CF98C8547ADBBB1FF44305F15816AD956BB281C7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004069B2 Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004069B2() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M00406F09))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4)); // executed
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8)); // executed
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x004069b2
0x004069b2
0x004069b6
0x00406a6d
0x00406a70
0x00406a7c
0x0040695d
0x0040695d
0x00406960
0x00406cd2
0x00406cd2
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00406d48
0x00406d48
0x00406d4e
0x00406d4e
0x00000000
0x00406d23
0x00406d23
0x00406d27
0x00406ed6
0x00000000
0x00406ed6
0x00406d33
0x00406d3a
0x00406d42
0x00406d45
0x00000000
0x00406d45
0x004069bc
0x004069c0
0x00406f01
0x00406f01
0x00406f04
0x00406f08
0x00406f08
0x004069c6
0x004069cc
0x004069cf
0x004069d3
0x004069d6
0x004069da
0x00406ea0
0x00406eec
0x00406ef4
0x00406efb
0x00406efd
0x00000000
0x00406efd
0x004069e0
0x004069e3
0x004069e9
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0f
0x00406a11
0x00406a11
0x00406a14
0x00406a14
0x00406a14
0x004064ea
0x004064ea
0x004064f3
0x00000000
0x00000000
0x004064f9
0x00000000
0x00406504
0x00000000
0x00000000
0x0040650d
0x00406510
0x00406513
0x00406517
0x00000000
0x00000000
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406563
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00000000
0x00406e55
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00000000
0x00406e64
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406666
0x00406668
0x0040666b
0x004066dc
0x004066df
0x004066e2
0x004066e9
0x004066f3
0x00000000
0x004066f3
0x0040666d
0x00406671
0x00406674
0x00406676
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x0040668e
0x00406692
0x00406699
0x0040669c
0x004066a3
0x004066a7
0x004066af
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b3
0x004066b6
0x004066d4
0x004066d6
0x00000000
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c3
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x00000000
0x004066cf
0x00000000
0x00406905
0x00406909
0x00406927
0x0040692a
0x00406931
0x00406934
0x00406937
0x0040693a
0x0040693d
0x00406940
0x00406942
0x00406949
0x0040694a
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406955
0x0040695a
0x00000000
0x0040695a
0x0040690b
0x0040690e
0x00406911
0x0040691b
0x00000000
0x00000000
0x0040696f
0x00406973
0x00406996
0x00406999
0x0040699c
0x004069a6
0x00406975
0x00406975
0x00406978
0x0040697b
0x0040697e
0x0040698b
0x0040698e
0x0040698e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a23
0x00406a27
0x00406a2e
0x00406a31
0x00406a34
0x00406a3e
0x00000000
0x00406a3e
0x00406a29
0x00000000
0x00000000
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00406a64
0x00406a64
0x00406a67
0x00406a6a
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406703
0x00406e70
0x00000000
0x00406e70
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x0040671e
0x00406721
0x00406724
0x00406724
0x00406727
0x0040672a
0x00000000
0x00000000
0x00406730
0x00406736
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406767
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679a
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067a3
0x004067aa
0x004067ad
0x00000000
0x004067b3
0x00000000
0x004067b3
0x00000000
0x004067b8
0x004067b8
0x004067bc
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067d7
0x004067da
0x004067dd
0x004067dd
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406800
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682b
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406830
0x00406837
0x0040683a
0x00000000
0x0040683c
0x00000000
0x0040683c
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406841
0x00000000
0x00000000
0x0040687c
0x0040687c
0x00406880
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689b
0x0040689e
0x004068a1
0x004068a1
0x004068a7
0x00406845
0x00406845
0x00406848
0x00000000
0x00406848
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c4
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068ef
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068f4
0x004068fb
0x004068fe
0x00000000
0x00406900
0x00000000
0x00406900
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c9c
0x00406ca0
0x00406cc2
0x00406cc5
0x00406ccf
0x00000000
0x00406ccf
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00000000
0x00000000
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00406d90
0x00406d90
0x00000000
0x00406d90
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00406cb3
0x00406cb3
0x00406cb6
0x00000000
0x00000000
0x00406e4a
0x00406e4d
0x00000000
0x00000000
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aa6
0x00406aa9
0x00406ab0
0x00406ab3
0x00406ac1
0x00000000
0x00000000
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00000000
0x00406da6
0x00406da6
0x00406daa
0x00406ee2
0x00000000
0x00406ee2
0x00406db0
0x00406db3
0x00406db6
0x00406dba
0x00406dbd
0x00406dc3
0x00406dc5
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dce
0x00406dce
0x00406dd2
0x00406e32
0x00406e35
0x00406e3a
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e42
0x00000000
0x00406e42
0x00406dd4
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406e0e
0x00406e11
0x00406e14
0x00406e17
0x00406e1b
0x00406e1d
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406dff
0x00406e04
0x00406e06
0x00406e09
0x00406e09
0x00406e24
0x00406e2b
0x00000000
0x00406e2d
0x00000000
0x00406e2d
0x00000000
0x00406ac9
0x00406acc
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x0040684b
0x0040684b
0x0040684f
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00000000
0x00406c97
0x00406c95
0x00406eca
0x00000000
0x00000000
0x004064f9

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a29bcf112b88c1b93ae01eb1cff818f8e5d0edf1da40eda35da1d05f3be857d
Instruction ID: f9b0e14a80994b8e3cce9b061f2e265d206a391058c15f1564a8a9ac8da356b6
Opcode Fuzzy Hash: 1a29bcf112b88c1b93ae01eb1cff818f8e5d0edf1da40eda35da1d05f3be857d
Instruction Fuzzy Hash: 80814571D04229DFDF24CFA8C8847ADBBB1FB44305F25816AD816BB281C7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004064B7 Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004064B7(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M00406F09))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8); // executed
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12); // executed
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

0x004064c7
0x004064ce
0x004064d4
0x004064da
0x00000000
0x004064de
0x004064ea
0x004064ea
0x004064ea
0x004064f3
0x00000000
0x00000000
0x004064f9
0x00000000
0x00406500
0x00406504
0x00000000
0x00000000
0x0040650d
0x00406510
0x00406513
0x00406515
0x00406517
0x00000000
0x00000000
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406560
0x00406563
0x0040658b
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406565
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657d
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00000000
0x00406e55
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d4
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065d9
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f6
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00000000
0x00406e64
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663c
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce4
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d1a
0x00406d21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d23
0x00406d23
0x00406d27
0x00406ed6
0x00000000
0x00406ed6
0x00406d33
0x00406d3a
0x00406d42
0x00406d42
0x00406d42
0x00406d45
0x00406d48
0x00406d48
0x00000000
0x00000000
0x00406666
0x00406668
0x0040666b
0x004066dc
0x004066df
0x004066e2
0x004066e9
0x004066f3
0x00000000
0x004066f3
0x0040666d
0x00406671
0x00406674
0x00406676
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x0040668e
0x00406692
0x00406699
0x0040669c
0x004066a3
0x004066a7
0x004066af
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b3
0x004066b6
0x004066d4
0x004066d6
0x00000000
0x004066d6
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c3
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x00000000
0x00000000
0x00406905
0x00406909
0x00406927
0x0040692a
0x00406931
0x00406934
0x00406937
0x0040693a
0x0040693d
0x00406940
0x00406942
0x00406949
0x0040694a
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406955
0x0040695a
0x00000000
0x0040695a
0x0040690b
0x0040690e
0x00406911
0x0040691b
0x00000000
0x00000000
0x0040696f
0x00406973
0x00406996
0x00406999
0x0040699c
0x004069a6
0x00406975
0x00406975
0x00406978
0x0040697b
0x0040697e
0x0040698b
0x0040698e
0x0040698e
0x00000000
0x00000000
0x004069b2
0x004069b6
0x00000000
0x00000000
0x004069bc
0x004069c0
0x00000000
0x00000000
0x004069c6
0x004069c8
0x004069cc
0x004069cc
0x004069cf
0x004069d3
0x00000000
0x00000000
0x00406a23
0x00406a27
0x00406a2e
0x00406a31
0x00406a34
0x00406a3e
0x00000000
0x00406a3e
0x00406a29
0x00000000
0x00000000
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00406a64
0x00406a64
0x00406a67
0x00406a6a
0x00406a6d
0x00406a6d
0x00406a70
0x00406a77
0x00406a7c
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406703
0x00406e70
0x00000000
0x00406e70
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x0040671e
0x00406721
0x00406724
0x00406724
0x00406727
0x0040672a
0x00000000
0x00000000
0x00406730
0x00406736
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406767
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679a
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067a3
0x004067aa
0x004067ad
0x00000000
0x004067b3
0x00000000
0x004067b3
0x00000000
0x004067b8
0x004067b8
0x004067bc
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067d7
0x004067da
0x004067dd
0x004067dd
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406800
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682b
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406830
0x00406837
0x0040683a
0x00000000
0x0040683c
0x00000000
0x0040683c
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406841
0x00000000
0x00000000
0x0040687c
0x0040687c
0x00406880
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689b
0x0040689e
0x004068a1
0x004068a1
0x004068a7
0x00406845
0x00406845
0x00406848
0x00000000
0x00406848
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c4
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068ef
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068f4
0x004068fb
0x004068fe
0x00000000
0x00406900
0x00000000
0x00406900
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x0040695d
0x0040695d
0x00406960
0x00000000
0x00000000
0x00406c9c
0x00406ca0
0x00406cc2
0x00406cc5
0x00406ccf
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00000000
0x00000000
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00406d90
0x00406d90
0x00000000
0x00406d90
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00406cb3
0x00406cb3
0x00406cb6
0x00000000
0x00000000
0x00406e4a
0x00406e4d
0x00000000
0x00000000
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aa6
0x00406aa9
0x00406ab0
0x00406ab3
0x00406ac1
0x00000000
0x00000000
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00000000
0x00406da6
0x00406da6
0x00406daa
0x00406ee2
0x00000000
0x00406ee2
0x00406db0
0x00406db3
0x00406db6
0x00406dba
0x00406dbd
0x00406dc3
0x00406dc5
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dce
0x00406dce
0x00406dd2
0x00406e32
0x00406e35
0x00406e3a
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e42
0x00406d4e
0x00406d4e
0x00000000
0x00406d4e
0x00406dd4
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406e0e
0x00406e11
0x00406e14
0x00406e17
0x00406e1b
0x00406e1d
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406dff
0x00406e04
0x00406e06
0x00406e09
0x00406e09
0x00406e24
0x00406e2b
0x00000000
0x00406e2d
0x00000000
0x00406e2d
0x00000000
0x00406ac9
0x00406acc
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x0040684b
0x0040684b
0x0040684f
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00000000
0x00000000
0x004069d6
0x004069d6
0x004069da
0x00406ea0
0x00000000
0x00406ea0
0x004069e0
0x004069e3
0x004069e6
0x004069e9
0x004069eb
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0c
0x00406a0f
0x00406a11
0x00406a11
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00406c95
0x00406eca
0x00406eec
0x00406ef2
0x00406ef4
0x00406efb
0x00000000
0x00000000
0x004064f9
0x00406f01
0x00406f01
0x00000000

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec6a1127f337a9cd102a75f31ecac58d5a9bcb7082b0f725788ddd98255f1a75
Instruction ID: 64fae73fcf261b5a29c0697abf595a3f572636c651b32177eb72ec05398ad39b
Opcode Fuzzy Hash: ec6a1127f337a9cd102a75f31ecac58d5a9bcb7082b0f725788ddd98255f1a75
Instruction Fuzzy Hash: 39817831D04229DBEF24CFA8D8447ADBBB0FB44305F21816AD856BB2C1C7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406905 Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406905() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M00406F09))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4)); // executed
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8)); // executed
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406905
0x00406905
0x00406909
0x0040692a
0x00406931
0x00406937
0x0040693d
0x0040694f
0x00406955
0x0040695a
0x00000000
0x0040690b
0x00406911
0x00406cd2
0x00406cd2
0x00406cd2
0x00406cd5
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00406d23
0x00406d27
0x00406ed6
0x00406eec
0x00406ef4
0x00406efb
0x00406efd
0x00406f04
0x00406f08
0x00406f08
0x00406d33
0x00406d3a
0x00406d42
0x00406d45
0x00406d48
0x00406d48
0x00406d4e
0x00406d4e
0x004064ea
0x004064ea
0x004064ea
0x004064f3
0x00000000
0x00000000
0x004064f9
0x00000000
0x00406504
0x00000000
0x00000000
0x0040650d
0x00406510
0x00406513
0x00406517
0x00000000
0x00000000
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406563
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00000000
0x00406e55
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00000000
0x00406e64
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406666
0x00406668
0x0040666b
0x004066dc
0x004066df
0x004066e2
0x004066e9
0x004066f3
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x0040666d
0x00406671
0x00406674
0x00406676
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x0040668e
0x00406692
0x00406699
0x0040669c
0x004066a3
0x004066a7
0x004066af
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b3
0x004066b6
0x004066d4
0x004066d6
0x00000000
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c3
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x00000000
0x004066cf
0x00000000
0x00000000
0x00000000
0x0040696f
0x00406973
0x00406996
0x00406999
0x0040699c
0x004069a6
0x00406975
0x00406975
0x00406978
0x0040697b
0x0040697e
0x0040698b
0x0040698e
0x0040698e
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00000000
0x004069b2
0x004069b6
0x00000000
0x00000000
0x004069bc
0x004069c0
0x00000000
0x00000000
0x004069c6
0x004069c8
0x004069cc
0x004069cc
0x004069cf
0x004069d3
0x00000000
0x00000000
0x00406a23
0x00406a27
0x00406a2e
0x00406a31
0x00406a34
0x00406a3e
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406cd2
0x00406a29
0x00000000
0x00000000
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00406a64
0x00406a64
0x00406a67
0x00406a6a
0x00406a6d
0x00406a6d
0x00406a70
0x00406a77
0x00406a7c
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406703
0x00406e70
0x00000000
0x00406e70
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x0040671e
0x00406721
0x00406724
0x00406724
0x00406727
0x0040672a
0x00000000
0x00000000
0x00406730
0x00406736
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406767
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679a
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067a3
0x004067aa
0x004067ad
0x00000000
0x004067b3
0x00000000
0x004067b3
0x00000000
0x004067b8
0x004067b8
0x004067bc
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067d7
0x004067da
0x004067dd
0x004067dd
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406800
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682b
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406830
0x00406837
0x0040683a
0x00000000
0x0040683c
0x00000000
0x0040683c
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406841
0x00000000
0x00000000
0x0040687c
0x0040687c
0x00406880
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689b
0x0040689e
0x004068a1
0x004068a1
0x004068a7
0x00406845
0x00406845
0x00406848
0x00000000
0x00406848
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c4
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068ef
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068f4
0x004068fb
0x004068fe
0x00000000
0x00406900
0x00000000
0x00406900
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x0040695d
0x0040695d
0x00406960
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00000000
0x00406c9c
0x00406ca0
0x00406cc2
0x00406cc5
0x00406ccf
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406cd2
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00000000
0x00000000
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00406d90
0x00406d90
0x00000000
0x00406d90
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00406cb3
0x00406cb3
0x00406cb6
0x00000000
0x00000000
0x00406e4a
0x00406e4d
0x00406d4e
0x00000000
0x00000000
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aa6
0x00406aa9
0x00406ab0
0x00406ab3
0x00406ac1
0x00000000
0x00000000
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00000000
0x00406da6
0x00406da6
0x00406daa
0x00406ee2
0x00000000
0x00406ee2
0x00406db0
0x00406db3
0x00406db6
0x00406dba
0x00406dbd
0x00406dc3
0x00406dc5
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dce
0x00406dce
0x00406dd2
0x00406e32
0x00406e35
0x00406e3a
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e42
0x00406d4e
0x00406d4e
0x00000000
0x00406d54
0x00406d4e
0x00406dd4
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406e0e
0x00406e11
0x00406e14
0x00406e17
0x00406e1b
0x00406e1d
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406dff
0x00406e04
0x00406e06
0x00406e09
0x00406e09
0x00406e24
0x00406e2b
0x00000000
0x00406e2d
0x00000000
0x00406e2d
0x00000000
0x00406ac9
0x00406acc
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x0040684b
0x0040684b
0x0040684f
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00000000
0x00000000
0x004069d6
0x004069d6
0x004069da
0x00406ea0
0x00000000
0x00406ea0
0x004069e0
0x004069e3
0x004069e6
0x004069e9
0x004069eb
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0c
0x00406a0f
0x00406a11
0x00406a11
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00406c95
0x00406eca
0x00000000
0x00000000
0x004064f9
0x00406f01
0x00406f01
0x00000000
0x00406f01
0x00406d4e
0x00406cd5
0x00406cd2
0x00000000
0x00406909

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ab0f5182b65f417a428d3e5ace57518a098f994e057f816ecf8909cd511bbd
Instruction ID: 51e77fe0f08f8d7ba03d7e1561fc41eb13955110d3fdee4e61b85cd17e52ee3e
Opcode Fuzzy Hash: e7ab0f5182b65f417a428d3e5ace57518a098f994e057f816ecf8909cd511bbd
Instruction Fuzzy Hash: C4712371D04229DBEF28CF98C8447ADBBB1FB44305F15806AD806BB281D7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406A23 Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406A23() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M00406F09))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4)); // executed
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8)); // executed
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406a23
0x00406a23
0x00406a27
0x00406a34
0x00406a3e
0x00000000
0x00406a29
0x00406a29
0x00406a64
0x00406a67
0x00406a6a
0x00406a6d
0x00406a6d
0x00406a70
0x00406a77
0x00406a7c
0x0040695d
0x00406960
0x00406cd2
0x00406cd2
0x00406cd2
0x00406cd5
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00406d23
0x00406d27
0x00406ed6
0x00406eec
0x00406ef4
0x00406efb
0x00406efd
0x00406f04
0x00406f08
0x00406f08
0x00406d33
0x00406d3a
0x00406d42
0x00406d45
0x00406d48
0x00406d48
0x00406d4e
0x00406d4e
0x004064ea
0x004064ea
0x004064ea
0x004064f3
0x00000000
0x00000000
0x004064f9
0x00000000
0x00406504
0x00000000
0x00000000
0x0040650d
0x00406510
0x00406513
0x00406517
0x00000000
0x00000000
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406563
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00000000
0x00406e55
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00406cd2
0x00406cd2
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00000000
0x00406e64
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406666
0x00406668
0x0040666b
0x004066dc
0x004066df
0x004066e2
0x004066e9
0x004066f3
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406cd2
0x0040666d
0x00406671
0x00406674
0x00406676
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x0040668e
0x00406692
0x00406699
0x0040669c
0x004066a3
0x004066a7
0x004066af
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b3
0x004066b6
0x004066d4
0x004066d6
0x00000000
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c3
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x00000000
0x004066cf
0x00000000
0x00406905
0x00406909
0x00406927
0x0040692a
0x00406931
0x00406934
0x00406937
0x0040693a
0x0040693d
0x00406940
0x00406942
0x00406949
0x0040694a
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406955
0x0040695a
0x00000000
0x0040695a
0x0040690b
0x0040690e
0x00406911
0x0040691b
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00000000
0x0040696f
0x00406973
0x00406996
0x00406999
0x0040699c
0x004069a6
0x00406975
0x00406975
0x00406978
0x0040697b
0x0040697e
0x0040698b
0x0040698e
0x0040698e
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00000000
0x004069b2
0x004069b6
0x00000000
0x00000000
0x004069bc
0x004069c0
0x00000000
0x00000000
0x004069c6
0x004069c8
0x004069cc
0x004069cc
0x004069cf
0x004069d3
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406703
0x00406e70
0x00000000
0x00406e70
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x0040671e
0x00406721
0x00406724
0x00406724
0x00406727
0x0040672a
0x00000000
0x00000000
0x00406730
0x00406736
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406767
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679a
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067a3
0x004067aa
0x004067ad
0x00000000
0x004067b3
0x00000000
0x004067b3
0x00000000
0x004067b8
0x004067b8
0x004067bc
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067d7
0x004067da
0x004067dd
0x004067dd
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406800
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682b
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406830
0x00406837
0x0040683a
0x00000000
0x0040683c
0x00000000
0x0040683c
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406841
0x00000000
0x00000000
0x0040687c
0x0040687c
0x00406880
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689b
0x0040689e
0x004068a1
0x004068a1
0x004068a7
0x00406845
0x00406845
0x00406848
0x00000000
0x00406848
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c4
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068ef
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068f4
0x004068fb
0x004068fe
0x00000000
0x00406900
0x00000000
0x00406900
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c9c
0x00406ca0
0x00406cc2
0x00406cc5
0x00406ccf
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406cd2
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00000000
0x00000000
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00406d90
0x00406d90
0x00000000
0x00406d90
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00406cb3
0x00406cb3
0x00406cb6
0x00000000
0x00000000
0x00406e4a
0x00406e4d
0x00406d4e
0x00000000
0x00000000
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aa6
0x00406aa9
0x00406ab0
0x00406ab3
0x00406ac1
0x00000000
0x00000000
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00000000
0x00406da6
0x00406da6
0x00406daa
0x00406ee2
0x00000000
0x00406ee2
0x00406db0
0x00406db3
0x00406db6
0x00406dba
0x00406dbd
0x00406dc3
0x00406dc5
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dce
0x00406dce
0x00406dd2
0x00406e32
0x00406e35
0x00406e3a
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e42
0x00406d4e
0x00406d4e
0x00000000
0x00406d54
0x00406d4e
0x00406dd4
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406e0e
0x00406e11
0x00406e14
0x00406e17
0x00406e1b
0x00406e1d
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406dff
0x00406e04
0x00406e06
0x00406e09
0x00406e09
0x00406e24
0x00406e2b
0x00000000
0x00406e2d
0x00000000
0x00406e2d
0x00000000
0x00406ac9
0x00406acc
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x0040684b
0x0040684b
0x0040684f
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00000000
0x00000000
0x004069d6
0x004069d6
0x004069da
0x00406ea0
0x00000000
0x00406ea0
0x004069e0
0x004069e3
0x004069e6
0x004069e9
0x004069eb
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0c
0x00406a0f
0x00406a11
0x00406a11
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00406c95
0x00406eca
0x00000000
0x00000000
0x004064f9
0x00406f01
0x00406f01
0x00000000
0x00406f01
0x00406d4e
0x00406cd5
0x00406cd2
0x00000000
0x00406a27

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d154c6f6c8b8bff782c781b6862f01632ca8036cc5e59350156e3961b0956316
Instruction ID: 3517892101dd69bd75e64738494877d03a8317e446f0652336487a17687a2cae
Opcode Fuzzy Hash: d154c6f6c8b8bff782c781b6862f01632ca8036cc5e59350156e3961b0956316
Instruction Fuzzy Hash: 53712571E04229DFEF28CF98C844BADBBB1FB44305F15806AD816BB281D7789996DF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040696F Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040696F() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00406F09))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4)); // executed
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00000000
0x0040696f
0x0040696f
0x00406973
0x0040699c
0x004069a6
0x00406975
0x0040697e
0x0040698b
0x0040698e
0x00406cd2
0x00406cd2
0x00406cd5
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00406d23
0x00406d27
0x00406ed6
0x00406eec
0x00406ef4
0x00406efb
0x00406efd
0x00406f04
0x00406f08
0x00406f08
0x00406d33
0x00406d3a
0x00406d42
0x00406d45
0x00406d48
0x00406d48
0x00406d4e
0x00406d4e
0x004064ea
0x004064ea
0x004064ea
0x004064f3
0x00000000
0x00000000
0x004064f9
0x00000000
0x00406504
0x00000000
0x00000000
0x0040650d
0x00406510
0x00406513
0x00406517
0x00000000
0x00000000
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406563
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00000000
0x00406e55
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00406cd2
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00000000
0x00406e64
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406666
0x00406668
0x0040666b
0x004066dc
0x004066df
0x004066e2
0x004066e9
0x004066f3
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406cd2
0x0040666d
0x00406671
0x00406674
0x00406676
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x0040668e
0x00406692
0x00406699
0x0040669c
0x004066a3
0x004066a7
0x004066af
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b3
0x004066b6
0x004066d4
0x004066d6
0x00000000
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c3
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x00000000
0x004066cf
0x00000000
0x00406905
0x00406909
0x00406927
0x0040692a
0x00406931
0x00406934
0x00406937
0x0040693a
0x0040693d
0x00406940
0x00406942
0x00406949
0x0040694a
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406955
0x0040695a
0x00000000
0x0040695a
0x0040690b
0x0040690e
0x00406911
0x0040691b
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00000000
0x00000000
0x00000000
0x004069b2
0x004069b6
0x00000000
0x00000000
0x004069bc
0x004069c0
0x00000000
0x00000000
0x004069c6
0x004069c8
0x004069cc
0x004069cc
0x004069cf
0x004069d3
0x00000000
0x00000000
0x00406a23
0x00406a27
0x00406a2e
0x00406a31
0x00406a34
0x00406a3e
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406cd2
0x00406a29
0x00000000
0x00000000
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00406a64
0x00406a64
0x00406a67
0x00406a6a
0x00406a6d
0x00406a6d
0x00406a70
0x00406a77
0x00406a7c
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406703
0x00406e70
0x00000000
0x00406e70
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x0040671e
0x00406721
0x00406724
0x00406724
0x00406727
0x0040672a
0x00000000
0x00000000
0x00406730
0x00406736
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406767
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679a
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067a3
0x004067aa
0x004067ad
0x00000000
0x004067b3
0x00000000
0x004067b3
0x00000000
0x004067b8
0x004067b8
0x004067bc
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067d7
0x004067da
0x004067dd
0x004067dd
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406800
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682b
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406830
0x00406837
0x0040683a
0x00000000
0x0040683c
0x00000000
0x0040683c
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406841
0x00000000
0x00000000
0x0040687c
0x0040687c
0x00406880
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689b
0x0040689e
0x004068a1
0x004068a1
0x004068a7
0x00406845
0x00406845
0x00406848
0x00000000
0x00406848
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c4
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068ef
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068f4
0x004068fb
0x004068fe
0x00000000
0x00406900
0x00000000
0x00406900
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x0040695d
0x0040695d
0x00406960
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00000000
0x00406c9c
0x00406ca0
0x00406cc2
0x00406cc5
0x00406ccf
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406cd2
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00000000
0x00000000
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00406d90
0x00406d90
0x00000000
0x00406d90
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00406cb3
0x00406cb3
0x00406cb6
0x00000000
0x00000000
0x00406e4a
0x00406e4d
0x00406d4e
0x00000000
0x00000000
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aa6
0x00406aa9
0x00406ab0
0x00406ab3
0x00406ac1
0x00000000
0x00000000
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00000000
0x00406da6
0x00406da6
0x00406daa
0x00406ee2
0x00000000
0x00406ee2
0x00406db0
0x00406db3
0x00406db6
0x00406dba
0x00406dbd
0x00406dc3
0x00406dc5
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dce
0x00406dce
0x00406dd2
0x00406e32
0x00406e35
0x00406e3a
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e42
0x00406d4e
0x00406d4e
0x00000000
0x00406d54
0x00406d4e
0x00406dd4
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406e0e
0x00406e11
0x00406e14
0x00406e17
0x00406e1b
0x00406e1d
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406dff
0x00406e04
0x00406e06
0x00406e09
0x00406e09
0x00406e24
0x00406e2b
0x00000000
0x00406e2d
0x00000000
0x00406e2d
0x00000000
0x00406ac9
0x00406acc
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x0040684b
0x0040684b
0x0040684f
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00000000
0x00000000
0x004069d6
0x004069d6
0x004069da
0x00406ea0
0x00000000
0x00406ea0
0x004069e0
0x004069e3
0x004069e6
0x004069e9
0x004069eb
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0c
0x00406a0f
0x00406a11
0x00406a11
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00406c95
0x00406eca
0x00000000
0x00000000
0x004064f9
0x00406f01
0x00406f01
0x00000000
0x00406f01
0x00406d4e
0x00406cd5
0x00406cd2

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90803f23476dcfb414c0400bb9d8b7cdb0b3ca45f440242c86af8c4d62fdd6e9
Instruction ID: 34c5161cf4e4322df4c522de15ced9ded486b5ca7425d8c28145854c0c0886a7
Opcode Fuzzy Hash: 90803f23476dcfb414c0400bb9d8b7cdb0b3ca45f440242c86af8c4d62fdd6e9
Instruction Fuzzy Hash: 29714571D04229DBEF28CF98C844BADBBB1FB44305F15806AD816BB281C7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040254C Relevance: 4.5, APIs: 3, Instructions: 47
registryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040254C(int* __ebx, intOrPtr __edx, char* __esi) {
				void* _t9;
				int _t10;
				long _t13;
				int* _t16;
				intOrPtr _t21;
				void* _t22;
				char* _t24;
				void* _t26;
				void* _t29;

				_t24 = __esi;
				_t21 = __edx;
				_t16 = __ebx;
				_t9 = E00402B6C(_t29, 0x20019); // executed
				_t22 = _t9;
				_t10 = E00402B0A(3);
				 *((intOrPtr*)(_t26 - 0x10)) = _t21;
				 *__esi = __ebx;
				if(_t22 == __ebx) {
					 *((intOrPtr*)(_t26 - 4)) = 1;
				} else {
					 *(_t26 + 8) = 0x3ff;
					if( *((intOrPtr*)(_t26 - 0x24)) == __ebx) {
						_t13 = RegEnumValueA(_t22, _t10, __esi, _t26 + 8, __ebx, __ebx, __ebx, __ebx);
						__eflags = _t13;
						if(_t13 != 0) {
							 *((intOrPtr*)(_t26 - 4)) = 1;
						}
					} else {
						RegEnumKeyA(_t22, _t10, __esi, 0x3ff);
					}
					_t24[0x3ff] = _t16;
					_push(_t22);
					RegCloseKey();
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t26 - 4));
				return 0;
			}

0x0040254c
0x0040254c
0x0040254c
0x00402551
0x00402558
0x0040255a
0x00402562
0x00402565
0x00402567
0x00402783
0x0040256d
0x00402575
0x00402578
0x00402591
0x00402597
0x00402599
0x0040259b
0x0040259b
0x0040257a
0x0040257e
0x0040257e
0x004025a2
0x004025a8
0x004025a9
0x004025a9
0x004029bb
0x004029c7

APIs

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 0040257E
RegEnumValueA.ADVAPI32(00000000,00000000,?,?), ref: 00402591
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nst891E.tmp,00000000,00000011,00000002), ref: 004025A9

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 095019f322b6c40d92cef5b4465a19737fb82d48870a7b4a86778a7d8ee6d3d7
Instruction ID: 35fd857a3e442691b1a787247be78dd7b49a46040516f967143c2ea575d22cfd
Opcode Fuzzy Hash: 095019f322b6c40d92cef5b4465a19737fb82d48870a7b4a86778a7d8ee6d3d7
Instruction Fuzzy Hash: 5801B1B1905204FFE7119F659E89ABF7ABCEB40344F10443EF402B62C0D6B85E019669

Uniqueness

Uniqueness Score: -1.00%

Function 6D012921 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {

				 *0x6d014038 = _a4;
				if(_a8 == 1) {
					VirtualProtect(0x6d01404c, 4, 0x40, 0x6d01403c); // executed
					 *0x6d01404c = 0xc2;
					 *0x6d01403c = 0;
					 *0x6d014044 = 0;
					 *0x6d014058 = 0;
					 *0x6d014048 = 0;
					 *0x6d014040 = 0;
					 *0x6d014050 = 0;
					 *0x6d01404e = 0;
				}
				return 1;
			}

0x6d01292a
0x6d01292f
0x6d01293f
0x6d012947
0x6d01294e
0x6d012953
0x6d012958
0x6d01295d
0x6d012962
0x6d012967
0x6d01296c
0x6d01296c
0x6d012974

APIs

VirtualProtect.KERNELBASE(6D01404C,00000004,00000040,6D01403C), ref: 6D01293F

Strings

`get@Met, xrefs: 6D01293F

Memory Dump Source

Source File: 00000000.00000002.779239899.000000006D011000.00000020.00000001.01000000.00000004.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000000.00000002.779220127.000000006D010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.779251763.000000006D013000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.779269562.000000006D015000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d010000_Quotation.jbxd

Similarity

API ID: ProtectVirtual
String ID: `get@Met
API String ID: 544645111-50837814
Opcode ID: 803a2958f6966589b5b1f26c9b580883ce221a1b902f701f7cab60f22d9c044c
Instruction ID: 33be24d8b8878b99b141bd4518068c0635f422218688bdd17ae8e40b26e0c308
Opcode Fuzzy Hash: 803a2958f6966589b5b1f26c9b580883ce221a1b902f701f7cab60f22d9c044c
Instruction Fuzzy Hash: F1F07FB1508282FEDB62CFEACC467093EF0A31E258B06452AE268D62A1E37481448B11

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x423750;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x422eec =  *0x422eec + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x422eec, 0x7530,  *0x422ed4), 0); // executed
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 42208f6ee167e53754ec85f902deef064f05172097489c9424a2864a03bb7ea4
Instruction ID: 3754a530b6758dc8908f2ef617aa9c280200ea706ec51d0fb7e67c491179f4d9
Opcode Fuzzy Hash: 42208f6ee167e53754ec85f902deef064f05172097489c9424a2864a03bb7ea4
Instruction Fuzzy Hash: A3012831724210ABE7294B389D04B2A369CE710328F11823BF811F72F1D6B8DC02DB4D

Uniqueness

Uniqueness Score: -1.00%

Function 00401E8F Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401EAD
EnableWindow.USER32(00000000,00000000), ref: 00401EB8

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: a913115b0b618877984699264344b8a1880e6ceeac658a5775d41212f4eb71b2
Instruction ID: ea2ebfb6392eb1d35c1d77cf7a204b1acfca181ccf64587d83a13520139c7bad
Opcode Fuzzy Hash: a913115b0b618877984699264344b8a1880e6ceeac658a5775d41212f4eb71b2
Instruction Fuzzy Hash: C8E012B2A08210DFD715DFA8AA859AE77B4FB84325F10493BE102F12D1D7B85940965D

Uniqueness

Uniqueness Score: -1.00%

Function 0040156F Relevance: 3.0, APIs: 2, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040156F(void* __ebx, int __edx) {
				int _t3;
				void* _t8;
				struct HWND__* _t10;
				struct HWND__* _t11;
				void* _t16;

				_t8 = __ebx;
				_t10 =  *0x422ed0; // 0x1044c
				if(_t10 != __ebx) {
					ShowWindow(_t10, __edx); // executed
					_t3 =  *(_t16 - 0x34);
				}
				_t11 =  *0x422ee4; // 0x10446
				if(_t11 != _t8) {
					ShowWindow(_t11, _t3); // executed
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t16 - 4));
				return 0;
			}

0x0040156f
0x0040156f
0x0040157d
0x00401581
0x00401583
0x00401583
0x00401586
0x0040158e
0x00401596
0x00401596
0x004029bb
0x004029c7

APIs

ShowWindow.USER32(0001044C), ref: 00401581
ShowWindow.USER32(00010446), ref: 00401596

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 01b8f08c91b687540e8bb59e961ce2b0c28ac7e6e5880a628e7803932cc216c7
Instruction ID: 9b4c08dd34b2d0c6cc2545b51cfcf00afa42d444c9e8f3eecf44a84becef43f7
Opcode Fuzzy Hash: 01b8f08c91b687540e8bb59e961ce2b0c28ac7e6e5880a628e7803932cc216c7
Instruction Fuzzy Hash: 7BE086B6B10100BBCB24CF54EE8087E73AAEB84310750053FE502F3290C2B49D418B58

Uniqueness

Uniqueness Score: -1.00%

Function 00406372 Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406372(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x409240);
				_t5 = GetModuleHandleA( *(_t10 + 0x409240));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x409244));
				}
				_t5 = E00406304(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x0040637a
0x0040637d
0x00406384
0x0040638c
0x00406398
0x00000000
0x0040639f
0x0040638f
0x00406396
0x00000000
0x004063a7
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,?,?,004032A8,0000000A), ref: 00406384
GetProcAddress.KERNEL32(00000000,?), ref: 0040639F

Part of subcall function 00406304: GetSystemDirectoryA.KERNEL32 ref: 0040631B
Part of subcall function 00406304: wsprintfA.USER32 ref: 00406354
Part of subcall function 00406304: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406368

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: b4adfc3f0f4b19c213d1a711131d711d9af4f575b66eeead30b066e316f5e6c0
Instruction ID: 5c1bd2d9329a739c8a877d318ed38f6c7ac4115b407851283e1fe7e546b0050a
Opcode Fuzzy Hash: b4adfc3f0f4b19c213d1a711131d711d9af4f575b66eeead30b066e316f5e6c0
Instruction Fuzzy Hash: 85E08C32A08210ABD7106B709D0493B72E89B85700302483EFE0AF2191D738EC21AAA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405B73 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00405B73(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x00405b77
0x00405b84
0x00405b99
0x00405b9f

APIs

GetFileAttributesA.KERNELBASE(00000003,00402E04,C:\Users\user\Desktop\Quotation.exe,80000000,00000003), ref: 00405B77
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B99

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 3bf94be8ffed2da7c2b8ff60cd5efa52f63dfdc5f5010c3a9122643b4e997265
Instruction ID: 2f873e3f3c43f12a3908621a4267836d753c9203ad123c8b10a06e7f93ada197
Opcode Fuzzy Hash: 3bf94be8ffed2da7c2b8ff60cd5efa52f63dfdc5f5010c3a9122643b4e997265
Instruction Fuzzy Hash: C7D09E31658201EFEF098F20DD16F2EBBA2EB84B00F10962CB642944E0D6715815AB16

Uniqueness

Uniqueness Score: -1.00%

Function 00405B4E Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405B4E(CHAR* _a4) {
				signed char _t3;
				signed char _t7;

				_t3 = GetFileAttributesA(_a4); // executed
				_t7 = _t3;
				if(_t7 != 0xffffffff) {
					SetFileAttributesA(_a4, _t3 & 0x000000fe);
				}
				return _t7;
			}

0x00405b53
0x00405b59
0x00405b5e
0x00405b67
0x00405b67
0x00405b70

APIs

GetFileAttributesA.KERNELBASE(?,?,00405766,?,?,00000000,00405949,?,?,?,?), ref: 00405B53
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405B67

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 724933c4db900905a8c2715ee946fd38794509a16b0cd5d1c9e98f984372ebec
Instruction ID: bc9e1bfcb83978c8760ec7414183e34ad4d98f7a4e3f8d166b670055928ff6f8
Opcode Fuzzy Hash: 724933c4db900905a8c2715ee946fd38794509a16b0cd5d1c9e98f984372ebec
Instruction Fuzzy Hash: BCD01272908025AFC2102728EE0C89BBFA5DB543B17058B71FD65A22F0D7305C529AAA

Uniqueness

Uniqueness Score: -1.00%

Function 00405644 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405644(CHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryA(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x0040564a
0x00405652
0x00000000
0x00405658
0x00000000

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00403228,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 0040564A
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 00405658

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 6853200a5fdab59dd982fbc96a9ce2e8b021ac935e945b0af5f1b11de4538164
Instruction ID: fc3bbe6b068c7ca676e2af9f6a434936c7df2cd1c21a2d5f2b74ac8b5b27fed5
Opcode Fuzzy Hash: 6853200a5fdab59dd982fbc96a9ce2e8b021ac935e945b0af5f1b11de4538164
Instruction Fuzzy Hash: 0BC08C30688101AADA002B308D08B073A55AB20340F608836600AE00F0CA32A600DD3F

Uniqueness

Uniqueness Score: -1.00%

Function 6D012A38 Relevance: 1.6, APIs: 1, Instructions: 143
fileCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E6D012A38(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				void* _t28;
				void* _t29;
				void* _t33;
				void* _t37;
				void* _t40;
				void* _t45;
				void* _t49;
				signed int _t56;
				void* _t61;
				void* _t70;
				intOrPtr _t72;
				signed int _t77;
				intOrPtr _t79;
				intOrPtr _t80;
				void* _t81;
				void* _t87;
				void* _t88;
				void* _t89;
				void* _t90;
				intOrPtr _t93;
				intOrPtr _t94;

				if( *0x6d014040 != 0 && E6D01297D(_a4) == 0) {
					 *0x6d014044 = _t93;
					if( *0x6d01403c != 0) {
						_t93 =  *0x6d01403c;
					} else {
						E6D012F60(E6D012977(), __ecx);
						 *0x6d01403c = _t93;
					}
				}
				_t28 = E6D0129AB(_a4);
				_t94 = _t93 + 4;
				if(_t28 <= 0) {
					L9:
					_t29 = E6D01299F();
					_t72 = _a4;
					_t79 =  *0x6d014048;
					 *((intOrPtr*)(_t29 + _t72)) = _t79;
					 *0x6d014048 = _t72;
					E6D012999();
					_t33 = CreateFileA(??, ??, ??, ??, ??, ??, ??); // executed
					 *0x6d01401c = _t33;
					 *0x6d014020 = _t79;
					if( *0x6d014040 != 0 && E6D01297D( *0x6d014048) == 0) {
						 *0x6d01403c = _t94;
						_t94 =  *0x6d014044;
					}
					_t80 =  *0x6d014048;
					_a4 = _t80;
					 *0x6d014048 =  *((intOrPtr*)(E6D01299F() + _t80));
					_t37 = E6D01298B(_t80);
					_pop(_t81);
					if(_t37 != 0) {
						_t40 = E6D0129AB(_t81);
						if(_t40 > 0) {
							_push(_t40);
							_push(E6D0129B6() + _a4 + _v8);
							_push(E6D0129C0());
							if( *0x6d014040 <= 0 || E6D01297D(_a4) != 0) {
								_pop(_t88);
								_pop(_t45);
								__eflags =  *((intOrPtr*)(_t88 + _t45)) - 2;
								if(__eflags == 0) {
								}
								asm("loop 0xfffffff5");
							} else {
								_pop(_t89);
								_pop(_t49);
								 *0x6d01403c =  *0x6d01403c +  *(_t89 + _t49) * 4;
								asm("loop 0xffffffeb");
							}
						}
					}
					_t107 =  *0x6d014048;
					if( *0x6d014048 == 0) {
						 *0x6d01403c = 0;
					}
					E6D0129E4(_t107, _a4,  *0x6d01401c,  *0x6d014020);
					return _a4;
				}
				_push(E6D0129B6() + _a4);
				_t56 = E6D0129BC();
				_v8 = _t56;
				_t77 = _t28;
				_push(_t68 + _t56 * _t77);
				_t70 = E6D0129C8();
				_t87 = E6D0129C4();
				_t90 = E6D0129C0();
				_t61 = _t77;
				if( *((intOrPtr*)(_t90 + _t61)) == 2) {
					_push( *((intOrPtr*)(_t70 + _t61)));
				}
				_push( *((intOrPtr*)(_t87 + _t61)));
				asm("loop 0xfffffff1");
				goto L9;
			}

0x6d012a48
0x6d012a59
0x6d012a66
0x6d012a7a
0x6d012a68
0x6d012a6d
0x6d012a72
0x6d012a72
0x6d012a66
0x6d012a83
0x6d012a88
0x6d012a8e
0x6d012ad2
0x6d012ad2
0x6d012ad7
0x6d012adc
0x6d012ae2
0x6d012ae4
0x6d012aea
0x6d012af7
0x6d012af9
0x6d012afe
0x6d012b0b
0x6d012b1e
0x6d012b24
0x6d012b2a
0x6d012b2b
0x6d012b31
0x6d012b3d
0x6d012b43
0x6d012b4b
0x6d012b4c
0x6d012b4f
0x6d012b5a
0x6d012b5c
0x6d012b68
0x6d012b6e
0x6d012b76
0x6d012ba2
0x6d012ba3
0x6d012ba5
0x6d012ba9
0x6d012ba9
0x6d012bb0
0x6d012b86
0x6d012b86
0x6d012b87
0x6d012b95
0x6d012b9e
0x6d012b9e
0x6d012b76
0x6d012b5a
0x6d012bb2
0x6d012bb9
0x6d012bbb
0x6d012bbb
0x6d012bd4
0x6d012be2
0x6d012be2
0x6d012a99
0x6d012a9a
0x6d012a9f
0x6d012aa3
0x6d012aa8
0x6d012abc
0x6d012abd
0x6d012abe
0x6d012ac0
0x6d012ac5
0x6d012ac7
0x6d012ac7
0x6d012aca
0x6d012ad0
0x00000000

APIs

CreateFileA.KERNELBASE(00000000), ref: 6D012AF7

Memory Dump Source

Source File: 00000000.00000002.779239899.000000006D011000.00000020.00000001.01000000.00000004.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000000.00000002.779220127.000000006D010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.779251763.000000006D013000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.779269562.000000006D015000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d010000_Quotation.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bd37e4df7e2651f3c9244c8d7a484dedfa58bce9a876bd1c04431eae84b9c5c3
Instruction ID: cf66436b926ff81606c34d7e4c8f71513617c55365ecae510c54c106b1d75460
Opcode Fuzzy Hash: bd37e4df7e2651f3c9244c8d7a484dedfa58bce9a876bd1c04431eae84b9c5c3
Instruction Fuzzy Hash: EA41177250C206AFEB319FFADC83B6D37B4EB4B318F158429E61487260D774D5918AA1

Uniqueness

Uniqueness Score: -1.00%

Function 00402631 Relevance: 1.6, APIs: 1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402631(intOrPtr __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				intOrPtr _t27;
				intOrPtr _t33;
				void* _t38;
				void* _t41;

				_t33 = __edx;
				 *((intOrPtr*)(_t38 - 8)) = __ebx;
				_t27 = E00402B0A(2);
				_t41 = _t27 - 1;
				 *((intOrPtr*)(_t38 - 0x10)) = _t33;
				 *((intOrPtr*)(_t38 - 0xc)) = _t27;
				if(_t41 < 0) {
					L24:
					 *0x4237a8 =  *0x4237a8 +  *(_t38 - 4);
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *((intOrPtr*)(__ebp - 0xc)) = 0x3ff;
					}
					if( *__esi == __bl) {
						L21:
						__esi =  *((intOrPtr*)(__ebp - 8));
						goto L22;
					} else {
						 *((char*)(__ebp + 0xb)) = __bl;
						 *(__ebp - 0x1c) = E00405F51(__ecx, __esi);
						if( *((intOrPtr*)(__ebp - 0xc)) <= __ebx) {
							goto L21;
						} else {
							__esi =  *((intOrPtr*)(__ebp - 8));
							while(1) {
								__eax = __ebp - 0x15;
								__eax = E00405BEB( *(__ebp - 0x1c), __ebp - 0x15, 1); // executed
								if(__eax == 0) {
									break;
								}
								if( *((intOrPtr*)(__ebp - 0x28)) != __ebx) {
									 *(__ebp - 0x15) & 0x000000ff = E00405F38(__edi,  *(__ebp - 0x15) & 0x000000ff);
								} else {
									if( *((char*)(__ebp + 0xb)) == 0xd ||  *((char*)(__ebp + 0xb)) == 0xa) {
										__al =  *(__ebp - 0x15);
										if( *((intOrPtr*)(__ebp + 0xb)) == __al || __al != 0xd && __al != 0xa) {
											__eax = SetFilePointer( *(__ebp - 0x1c), 0xffffffff, __ebx, 1);
										} else {
											 *((char*)(__esi + __edi)) = __al;
											__esi = __esi + 1;
										}
										break;
									} else {
										__al =  *(__ebp - 0x15);
										 *((char*)(__esi + __edi)) = __al;
										__esi = __esi + 1;
										 *((char*)(__ebp + 0xb)) = __al;
										if(__al == __bl) {
											break;
										} else {
											if(__esi <  *((intOrPtr*)(__ebp - 0xc))) {
												continue;
											} else {
												break;
											}
										}
									}
								}
								goto L25;
							}
							L22:
							 *((char*)(__esi + __edi)) = __bl;
							if(_t41 == 0) {
								 *(_t38 - 4) = 1;
							}
							goto L24;
						}
					}
				}
				L25:
				return 0;
			}

0x00402631
0x00402633
0x00402636
0x0040263b
0x0040263f
0x00402642
0x00402645
0x004029b8
0x004029bb
0x0040264b
0x0040264b
0x00402652
0x00402654
0x00402654
0x00402659
0x004026e1
0x004026e1
0x00000000
0x0040265f
0x00402660
0x0040266b
0x0040266e
0x00000000
0x00402670
0x00402670
0x00402673
0x00402673
0x0040267c
0x00402683
0x00000000
0x00000000
0x00402688
0x004026b1
0x0040268a
0x0040268e
0x004026bb
0x004026c1
0x004026d9
0x004026cb
0x004026cb
0x004026ce
0x004026ce
0x00000000
0x00402696
0x00402696
0x00402699
0x0040269c
0x0040269f
0x004026a2
0x00000000
0x004026a4
0x004026a7
0x00000000
0x004026a9
0x00000000
0x004026a9
0x004026a7
0x004026a2
0x0040268e
0x00000000
0x00402688
0x004026e4
0x004026e4
0x004015b0
0x00402783
0x00402783
0x00000000
0x004015b0
0x0040266e
0x00402659
0x004029c1
0x004029c7

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: wsprintf
String ID:
API String ID: 2111968516-0
Opcode ID: 366e3e88ed94c459e0a2c565d96ad95acb986587cc084f2d6ef043885af1d26a
Instruction ID: 3a2c95f3f261f3e7b92da62a1208cffd6d7f8b014e901ac2ca999815bcbce589
Opcode Fuzzy Hash: 366e3e88ed94c459e0a2c565d96ad95acb986587cc084f2d6ef043885af1d26a
Instruction Fuzzy Hash: 2D21C770C0428AAADF219F644A456BFBB709B11318F14447FE891B63D1C1BD9981CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040166A Relevance: 1.5, APIs: 1, Instructions: 38
fileCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E0040166A() {
				int _t7;
				void* _t13;
				void* _t15;
				void* _t20;

				_t18 = E00402B2C(0xffffffd0);
				_t16 = E00402B2C(0xffffffdf);
				E00402B2C(0x13);
				_t7 = MoveFileA(_t4, _t5); // executed
				if(_t7 == 0) {
					if( *((intOrPtr*)(_t20 - 0x2c)) == _t13 || E004062DD(_t18) == 0) {
						 *((intOrPtr*)(_t20 - 4)) = 1;
					} else {
						E00405DB9(_t15, _t18, _t16);
						_push(0xffffffe4);
						goto L5;
					}
				} else {
					_push(0xffffffe3);
					L5:
					E00401423();
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t20 - 4));
				return 0;
			}

0x00401673
0x0040167c
0x0040167e
0x00401685
0x0040168d
0x00401699
0x00402783
0x004016ad
0x004016af
0x004016b4
0x00000000
0x004016b4
0x0040168f
0x0040168f
0x004022a4
0x004022a4
0x004022a4
0x004029bb
0x004029c7

APIs

MoveFileA.KERNEL32 ref: 00401685

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 72a301eb428ce366fab0a6ba72113071e0df53c1d82ea09ee4a171c26df99c33
Instruction ID: 640e453824712c844145895a5cc0ad612f484d8213667f841ebeaca416f2c8de
Opcode Fuzzy Hash: 72a301eb428ce366fab0a6ba72113071e0df53c1d82ea09ee4a171c26df99c33
Instruction Fuzzy Hash: 81F09031A08210A7CB117FBA9E4DD9F2AA49F42328B20027BB511B22D1D6BC850186AF

Uniqueness

Uniqueness Score: -1.00%

Function 004026EF Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E004026EF(intOrPtr __edx, void* __eflags) {
				long _t7;
				long _t9;
				LONG* _t11;
				void* _t13;
				intOrPtr _t14;
				void* _t17;
				void* _t19;

				_t14 = __edx;
				_push(ds);
				if(__eflags != 0) {
					_t7 = E00402B0A(2);
					_pop(_t13);
					 *((intOrPtr*)(_t19 - 0x10)) = _t14;
					_t9 = SetFilePointer(E00405F51(_t13, _t17), _t7, _t11,  *(_t19 - 0x28)); // executed
					if( *((intOrPtr*)(_t19 - 0x30)) >= _t11) {
						_push(_t9);
						E00405F38();
					}
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x004026ef
0x004026ef
0x004026f0
0x004026f8
0x004026fd
0x004026fe
0x0040270d
0x00402716
0x0040295e
0x00402960
0x00402960
0x00402716
0x004029bb
0x004029c7

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 0040270D

Part of subcall function 00405F38: wsprintfA.USER32 ref: 00405F45

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: a9d8ee2bd697c9ca0f2ad565d07bdf8e6e2528e0a7b3e3f739defcc45e62caf5
Instruction ID: f53dea761aa5693b03f4aeaa9096613f160725ff62c28ab2a383c2bfee997f34
Opcode Fuzzy Hash: a9d8ee2bd697c9ca0f2ad565d07bdf8e6e2528e0a7b3e3f739defcc45e62caf5
Instruction Fuzzy Hash: 5AE0EDB1A04215BBD702AB95AE89DBE776CEB44315F10043BF201F11C1C67D4941966E

Uniqueness

Uniqueness Score: -1.00%

Function 00405E8E Relevance: 1.5, APIs: 1, Instructions: 24
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E8E(void* __eflags, intOrPtr _a4, char* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E00405DE5(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegCreateKeyExA(_t7, _a8, 0, 0, 0, _a12, 0, _a16, 0); // executed
					return _t8;
				}
				_t9 = 6;
				return _t9;
			}

0x00405e98
0x00405ea1
0x00405eb7
0x00000000
0x00405eb7
0x00405ea5
0x00000000

APIs

RegCreateKeyExA.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402BDD,00000000,?,?), ref: 00405EB7

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c5562a190e42d8950a0f575b3a357be24d756bd6a7e1ac790deddfd4386432da
Instruction ID: 95beb03159e1ed36dc188c03c0911f4594c5194c551a9f11594fd4679c6f4357
Opcode Fuzzy Hash: c5562a190e42d8950a0f575b3a357be24d756bd6a7e1ac790deddfd4386432da
Instruction Fuzzy Hash: 23E0ECB2014109BEEF095F90ED0ADBB371DEB04315F00492EFA06E4090E7B5A920AA75

Uniqueness

Uniqueness Score: -1.00%

Function 00405C1A Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C1A(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405c1e
0x00405c2e
0x00405c36
0x00000000
0x00405c3d
0x00000000
0x00405c3f

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,00000020,?,004031B8,00000000,004128C0,00000020,004128C0,00000020,000000FF,00000004,00000000), ref: 00405C2E

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: c136fe23a15198738cdde8d9ae5bd390bad499becbb6fab094427491a2b8e812
Instruction ID: 28dd51bc99cbbe9e43bc3b4155210361b58306b45153a5fd00399a3e640b4bcc
Opcode Fuzzy Hash: c136fe23a15198738cdde8d9ae5bd390bad499becbb6fab094427491a2b8e812
Instruction Fuzzy Hash: 3AE0EC3261835AABEF249E559C01EEB7B6CEB05360F044472FD15E6150D231E8219FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405BEB Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405BEB(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405bef
0x00405bff
0x00405c07
0x00000000
0x00405c0e
0x00000000
0x00405c10

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004031EA,00000000,00000000,00403047,000000FF,00000004,00000000,00000000,00000000), ref: 00405BFF

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1302354f14da4ac18fdfad316f10263800e98e90a47707ba9ec6b51f8bbd6d6c
Instruction ID: 7d11c2845e787d99b8eae26fbbcce04266139d1862b3a193897eab19ac9c5e73
Opcode Fuzzy Hash: 1302354f14da4ac18fdfad316f10263800e98e90a47707ba9ec6b51f8bbd6d6c
Instruction Fuzzy Hash: 72E0E632558759ABDF106E559C00AEB775CEB45754F004832FE15E3150D231E8519BE9

Uniqueness

Uniqueness Score: -1.00%

Function 00405E60 Relevance: 1.5, APIs: 1, Instructions: 19
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E60(void* __eflags, intOrPtr _a4, char* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E00405DE5(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegOpenKeyExA(_t7, _a8, 0, _a12, _a16); // executed
					return _t8;
				}
				_t9 = 6;
				return _t9;
			}

0x00405e6a
0x00405e71
0x00405e84
0x00000000
0x00405e84
0x00405e75
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(00000000,?,00000000,?,?,?,?,?,00405EEE,?,?,?,?,00000002,Call), ref: 00405E84

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 688c0e3dac6200a4dcf5f70578aed2939ff3afbafb421f65443b8838c7a2b092
Instruction ID: 31d842323d9a2f535784a2c12e989c9eb1b9f9f44251d53ba3eec0f14c414acf
Opcode Fuzzy Hash: 688c0e3dac6200a4dcf5f70578aed2939ff3afbafb421f65443b8838c7a2b092
Instruction Fuzzy Hash: 75D0EC3204420DBADF115F90ED05FAB371DEB14355F004522FE05A4090D2769520AA55

Uniqueness

Uniqueness Score: -1.00%

Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040159D() {
				int _t5;
				void* _t11;
				int _t14;

				_t5 = SetFileAttributesA(E00402B2C(0xfffffff0),  *(_t11 - 0x30)); // executed
				_t14 = _t5;
				if(_t14 == 0) {
					 *((intOrPtr*)(_t11 - 4)) = 1;
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t11 - 4));
				return 0;
			}

0x004015a8
0x004015ae
0x004015b0
0x00402783
0x00402783
0x004029bb
0x004029c7

APIs

SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A8

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 52ed5338fe7084c51df6a432a079bc0890c4fcb1f0414dd7c874e83e8d0644f6
Instruction ID: d5005c83e4bc13d794db0995845c4037c46dc405a88debeb1123cd551caf7fcc
Opcode Fuzzy Hash: 52ed5338fe7084c51df6a432a079bc0890c4fcb1f0414dd7c874e83e8d0644f6
Instruction Fuzzy Hash: F5D05BB2B08200EBCB11DFE8EF08A5E77B5EB54325F204577E101F21D1D2B88641975A

Uniqueness

Uniqueness Score: -1.00%

Function 004040B4 Relevance: 1.5, APIs: 1, Instructions: 9
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004040B4(int _a4) {
				struct HWND__* _t2;
				long _t3;

				_t2 =  *0x422ed8; // 0x10440
				if(_t2 != 0) {
					_t3 = SendMessageA(_t2, _a4, 0, 0); // executed
					return _t3;
				}
				return _t2;
			}

0x004040b4
0x004040bb
0x004040c6
0x00000000
0x004040c6
0x004040cc

APIs

SendMessageA.USER32(00010440,00000000,00000000,00000000), ref: 004040C6

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 875450fc840247aea6e73403ee44149e02d5474b467ece0a28835bfda1230da9
Instruction ID: d19a9dbcf4508c1e9b2ca47d0762ffb16ec5c10abf7e35186d5f4f0c6b5da105
Opcode Fuzzy Hash: 875450fc840247aea6e73403ee44149e02d5474b467ece0a28835bfda1230da9
Instruction Fuzzy Hash: F9C04C71754201BAEA319B50DD49F0777586750B00F5584257314F60D1C6B4E451D62D

Uniqueness

Uniqueness Score: -1.00%

Function 004031ED Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004031ED(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x409018, _a4, 0, 0); // executed
				return _t2;
			}

0x004031fb
0x00403201

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402F89,?), ref: 004031FB

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 5ff25966693df5c3ccda7a99ea4025cbe7cf73b83d997e6322396513365c8623
Instruction ID: 8831d3de15784b4579c3d7b303db9b45d0c358e109056f74ce618eb3ecc3c243
Opcode Fuzzy Hash: 5ff25966693df5c3ccda7a99ea4025cbe7cf73b83d997e6322396513365c8623
Instruction Fuzzy Hash: 74B01231544200BFDB214F00DE05F057B21A790700F10C030B344780F082712460EB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040409D Relevance: 1.5, APIs: 1, Instructions: 6
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040409D(int _a4) {
				long _t2;

				_t2 = SendMessageA( *0x423708, 0x28, _a4, 1); // executed
				return _t2;
			}

0x004040ab
0x004040b1

APIs

SendMessageA.USER32(00000028,?,00000001,00403ECD), ref: 004040AB

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3bdb3c033a7d800f3f5983e71921b41162ac414239058931643885a1338ef954
Instruction ID: 7b5ccc39adf6f72de5191684d4495c6b43ffe58f78915606d69c4a7e6f44d702
Opcode Fuzzy Hash: 3bdb3c033a7d800f3f5983e71921b41162ac414239058931643885a1338ef954
Instruction Fuzzy Hash: F3B092B5684200BAEE224B40DD09F457EA2E7A4702F008024B300240B0C6B200A1DB19

Uniqueness

Uniqueness Score: -1.00%

Function 0040408A Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040408A(int _a4) {
				int _t2;

				_t2 = EnableWindow( *0x41fd04, _a4); // executed
				return _t2;
			}

0x00404094
0x0040409a

APIs

KiUserCallbackDispatcher.NTDLL(?,00403E66), ref: 00404094

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 12c11760972377b051275edfb0549e2da63da5a0a3d5c66f9a0e944dd115ee42
Instruction ID: 627edf876ec6fe827e8ded8b6e0f84c3e1bff33d3b07c91bc4a796ca35ff40dd
Opcode Fuzzy Hash: 12c11760972377b051275edfb0549e2da63da5a0a3d5c66f9a0e944dd115ee42
Instruction Fuzzy Hash: CAA00176808101ABCB029B50FF09D9ABF62ABA5705B028435E65694174C7325865FF1A

Uniqueness

Uniqueness Score: -1.00%

Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 19
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004014D6(intOrPtr __edx) {
				long _t3;
				void* _t7;
				intOrPtr _t10;
				void* _t13;

				_t10 = __edx;
				_t3 = E00402B0A(_t7);
				 *((intOrPtr*)(_t13 - 0x10)) = _t10;
				if(_t3 <= 1) {
					_t3 = 1;
				}
				Sleep(_t3); // executed
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t13 - 4));
				return 0;
			}

0x004014d6
0x004014d7
0x004014e0
0x004014e3
0x004014e7
0x004014e7
0x004014e9
0x004029bb
0x004029c7

APIs

Sleep.KERNELBASE(00000000), ref: 004014E9

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d9f52a12c88ee283977d5920e0d6ef8e8d30f27bfac36a8745942db4e2d1bc55
Instruction ID: 7b2de1959f7787123af4a7ca0670908521d01be6578697f59b2e727061aca9c4
Opcode Fuzzy Hash: d9f52a12c88ee283977d5920e0d6ef8e8d30f27bfac36a8745942db4e2d1bc55
Instruction Fuzzy Hash: CAD05EB3B142019BDB10DFB8AE8445F73F8E7503157604837D502F2191E2B8D9028668

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004044FA Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E004044FA(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				CHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				CHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				signed char* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed char _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				CHAR* _t146;
				intOrPtr _t147;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed char* _t160;
				struct HWND__* _t165;
				struct HWND__* _t166;
				int _t168;
				unsigned int _t197;
				void* _t205;

				_t156 = __edx;
				_t82 =  *0x41f4e0; // 0x7eb2d4
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xa) + 0x424000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E004056DA(0x3fb, _t146);
					E00406244(_t146);
				}
				_t166 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E004056DA(0x3fb, _t146);
							if(E00405A60(_t185, _t146) == 0) {
								_v8 = 1;
							}
							E00405FDA(0x41ecd8, _t146);
							_t87 = E00406372(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E00405FDA(0x41ecd8, _t146);
								_t89 = E00405A0B(0x41ecd8);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 =  *_t89 & 0x00000000;
								}
								if(GetDiskFreeSpaceA(0x41ecd8,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t168 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x41ecd8) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x41ecd8,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E004059B9(0x41ecd8);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160 - 1;
									 *_t159 = 0x5c;
									if(_t159 != 0x41ecd8) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t168 = 0x400;
								L36:
								_t95 = E0040498E(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								_t147 =  *0x422edc; // 0x7ecce0
								if( *((intOrPtr*)(_t147 + 0x10)) != _t158) {
									E00404976(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextA(_a4, _t168, 0x41ecc8);
									} else {
										E004048B1(_t168, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x4237c4 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t168) != 0) {
									_v8 = _t158;
								}
								E0040408A(0 | _v8 == _t158);
								if(_v8 == _t158) {
									_t205 =  *0x41fcf8 - _t158; // 0x0
									if(_t205 == 0) {
										E00404453();
									}
								}
								 *0x41fcf8 = _t158;
								goto L53;
							}
						}
						_t185 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t166;
							_v72 = 0x41fd08;
							_v60 = E0040484B;
							_v56 = _t146;
							_v68 = E00405FFC(_t146, 0x41fd08, _t166, 0x41f0e0, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderA(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405972(_t146);
								_t125 =  *((intOrPtr*)( *0x423714 + 0x11c));
								if( *((intOrPtr*)( *0x423714 + 0x11c)) != 0 && _t146 == "C:\\Users\\engineer\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto") {
									E00405FFC(_t146, 0x41fd08, _t166, 0, _t125);
									if(lstrcmpiA(0x4226a0, 0x41fd08) != 0) {
										lstrcatA(_t146, 0x4226a0);
									}
								}
								 *0x41fcf8 =  *0x41fcf8 + 1;
								SetDlgItemTextA(_t166, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					} else {
						_a8 = 0x40f;
						goto L12;
					}
				} else {
					_t165 = GetDlgItem(_t166, 0x3fb);
					if(E004059DF(_t146) != 0 && E00405A0B(_t146) == 0) {
						E00405972(_t146);
					}
					 *0x422ed8 = _t166;
					SetWindowTextA(_t165, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00404068(_t166);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00404068(_t166);
					E0040409D(_t165);
					_t138 = E00406372(7);
					if(_t138 == 0) {
						L53:
						return E004040CF(_a8, _a12, _a16);
					} else {
						 *_t138(_t165, 1);
						goto L8;
					}
				}
			}

0x004044fa
0x00404500
0x00404506
0x00404513
0x00404521
0x00404524
0x0040452c
0x00404532
0x00404532
0x0040453e
0x00404541
0x004045af
0x004045b6
0x0040468d
0x00404694
0x004046a3
0x004046a3
0x004046a7
0x004046b1
0x004046be
0x004046c0
0x004046c0
0x004046ce
0x004046d5
0x004046dc
0x004046df
0x00404716
0x00404718
0x0040471e
0x00404723
0x00404727
0x00404729
0x00404729
0x00404745
0x00000000
0x00404747
0x0040474a
0x00404758
0x0040475e
0x0040475f
0x00404762
0x00404765
0x00000000
0x00404765
0x004046e1
0x004046e3
0x004046e7
0x00000000
0x00000000
0x00000000
0x00000000
0x004046e9
0x004046e9
0x004046f6
0x004046fb
0x00000000
0x00000000
0x004046ff
0x00404701
0x00404701
0x00404709
0x0040470b
0x0040470e
0x00404711
0x00404714
0x00000000
0x00000000
0x00000000
0x00000000
0x00404714
0x00404771
0x0040477b
0x0040477e
0x00404781
0x00404788
0x00404788
0x0040478a
0x0040478a
0x0040478f
0x00404791
0x00404799
0x004047a0
0x004047a2
0x004047ad
0x004047ad
0x004047a2
0x004047b4
0x004047bd
0x004047c7
0x004047cf
0x004047ea
0x004047d1
0x004047da
0x004047da
0x004047cf
0x004047ef
0x004047f4
0x004047f9
0x00404802
0x00404802
0x0040480b
0x0040480d
0x0040480d
0x00404819
0x00404821
0x00404823
0x00404829
0x0040482b
0x0040482b
0x00404829
0x00404830
0x00000000
0x00404830
0x004046df
0x00404696
0x0040469d
0x00000000
0x00000000
0x00000000
0x0040469d
0x004045bc
0x004045c5
0x004045df
0x004045e4
0x004045ee
0x004045f5
0x00404601
0x00404604
0x00404607
0x0040460e
0x00404616
0x00404619
0x0040461d
0x00404624
0x0040462c
0x00404686
0x0040462e
0x0040462f
0x00404636
0x00404640
0x00404648
0x00404655
0x00404669
0x0040466d
0x0040466d
0x00404669
0x00404672
0x0040467f
0x0040467f
0x0040462c
0x00000000
0x004045e4
0x004045d2
0x00000000
0x004045d8
0x004045d8
0x00000000
0x004045d8
0x00404543
0x00404550
0x00404559
0x00404566
0x00404566
0x0040456d
0x00404573
0x0040457c
0x0040457f
0x00404582
0x0040458a
0x0040458d
0x00404590
0x00404596
0x0040459d
0x004045a4
0x00404836
0x00404848
0x004045aa
0x004045ad
0x00000000
0x004045ad
0x004045a4

APIs

GetDlgItem.USER32 ref: 00404549
SetWindowTextA.USER32(00000000,?), ref: 00404573
SHBrowseForFolderA.SHELL32(?,0041F0E0,?), ref: 00404624
CoTaskMemFree.OLE32(00000000), ref: 0040462F
lstrcmpiA.KERNEL32(Call,Sepad149: Installing,00000000,?,?), ref: 00404661
lstrcatA.KERNEL32(?,Call), ref: 0040466D
SetDlgItemTextA.USER32 ref: 0040467F

Part of subcall function 004056DA: GetDlgItemTextA.USER32 ref: 004056ED

Part of subcall function 00406244: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Quotation.exe",746AFA90,C:\Users\user\AppData\Local\Temp\,00000000,00403210,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 0040629C
Part of subcall function 00406244: CharNextA.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004062A9
Part of subcall function 00406244: CharNextA.USER32(?,"C:\Users\user\Desktop\Quotation.exe",746AFA90,C:\Users\user\AppData\Local\Temp\,00000000,00403210,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 004062AE
Part of subcall function 00406244: CharPrevA.USER32(?,?,746AFA90,C:\Users\user\AppData\Local\Temp\,00000000,00403210,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 004062BE

GetDiskFreeSpaceA.KERNEL32(0041ECD8,?,?,0000040F,?,0041ECD8,0041ECD8,?,00000001,0041ECD8,?,?,000003FB,?), ref: 0040473D
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404758

Part of subcall function 004048B1: lstrlenA.KERNEL32(Sepad149: Installing,Sepad149: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004047CC,000000DF,00000000,00000400,?), ref: 0040494F
Part of subcall function 004048B1: wsprintfA.USER32 ref: 00404957
Part of subcall function 004048B1: SetDlgItemTextA.USER32 ref: 0040496A

Strings

Call, xrefs: 0040465B, 00404660, 0040466B
Sepad149: Installing, xrefs: 004045F7, 0040465A
A, xrefs: 0040461D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto, xrefs: 0040464A

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto$Call$Sepad149: Installing
API String ID: 2624150263-1888685195
Opcode ID: 0f165c49e2d917f5e6a894268aac4f35a0a20fd2ca942178d6907e18a15d5205
Instruction ID: a574bab901635a86c0a25b0ea1efcbf713871747dcedb108b051a9d89a4042ab
Opcode Fuzzy Hash: 0f165c49e2d917f5e6a894268aac4f35a0a20fd2ca942178d6907e18a15d5205
Instruction Fuzzy Hash: E9A16FB1900219ABDB11EFA5CD41AAFB7B8EF85315F10843BF601B62D1D77C8A418F69

Uniqueness

Uniqueness Score: -1.00%

Function 00402765 Relevance: 1.5, APIs: 1, Instructions: 29
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E00402765(char __ebx, char* __edi, char* __esi) {
				void* _t19;

				if(FindFirstFileA(E00402B2C(2), _t19 - 0x1c8) != 0xffffffff) {
					E00405F38(__edi, _t6);
					_push(_t19 - 0x19c);
					_push(__esi);
					E00405FDA();
				} else {
					 *__edi = __ebx;
					 *__esi = __ebx;
					 *((intOrPtr*)(_t19 - 4)) = 1;
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x0040277d
0x00402791
0x0040279c
0x0040279d
0x004028d6
0x0040277f
0x0040277f
0x00402781
0x00402783
0x00402783
0x004029bb
0x004029c7

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402774

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 7aadfe7274229bb714756b7137abee653a08c846199b04a25fb503983604493c
Instruction ID: 2655497eb84a062ae037f6c25fa5e5de2408fe63ae01e39025771dd9bbe68540
Opcode Fuzzy Hash: 7aadfe7274229bb714756b7137abee653a08c846199b04a25fb503983604493c
Instruction Fuzzy Hash: 3BF0A0B2644101AAD701EBB49A49AEEB768EB11324F60417BE241F21C1D2BC89459B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00404A6D Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489
windowmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00404A6D(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				long _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed char* _v32;
				int _v36;
				signed int _v44;
				int _v48;
				signed int* _v60;
				signed char* _v64;
				signed int _v68;
				long _v72;
				void* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t203;
				void* _t205;
				intOrPtr _t206;
				intOrPtr _t208;
				long _t212;
				signed int _t216;
				signed int _t227;
				void* _t230;
				void* _t231;
				int _t237;
				long _t242;
				long _t243;
				signed int _t244;
				signed int _t250;
				signed int _t252;
				signed char _t253;
				signed char _t259;
				void* _t264;
				void* _t266;
				signed char* _t284;
				signed char _t285;
				long _t287;
				long _t290;
				void* _t291;
				signed int _t300;
				signed int _t308;
				void* _t309;
				void* _t310;
				signed char* _t316;
				int _t320;
				int _t321;
				signed int* _t322;
				int _t323;
				long _t324;
				signed int _t325;
				long _t327;
				int _t328;
				signed int _t329;
				void* _t331;

				_v12 = GetDlgItem(_a4, 0x3f9);
				_v8 = GetDlgItem(_a4, 0x408);
				_t331 = SendMessageA;
				_v24 =  *0x423748;
				_v28 =  *0x423714 + 0x94;
				_t320 = 0x10;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t298 = _a16;
					} else {
						_a12 = 0;
						_t298 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t298;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t298 + 4)) == 0x408) {
							if(( *0x42371d & 0x00000002) != 0) {
								L41:
								if(_v16 != 0) {
									_t242 = _v16;
									if( *((intOrPtr*)(_t242 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, 0,  *(_t242 + 0x5c));
									}
									_t243 = _v16;
									if( *((intOrPtr*)(_t243 + 8)) == 0xfffffe6a) {
										_t298 = _v24;
										_t244 =  *(_t243 + 0x5c);
										if( *((intOrPtr*)(_t243 + 0xc)) != 2) {
											 *(_t244 * 0x418 + _t298 + 8) =  *(_t244 * 0x418 + _t298 + 8) & 0xffffffdf;
										} else {
											 *(_t244 * 0x418 + _t298 + 8) =  *(_t244 * 0x418 + _t298 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t298 = 0 | _a8 != 0x00000413;
								_t250 = E004049BB(_v8, _a8 != 0x413);
								_t325 = _t250;
								if(_t325 >= 0) {
									_t99 = _v24 + 8; // 0x8
									_t298 = _t250 * 0x418 + _t99;
									_t252 =  *_t298;
									if((_t252 & 0x00000010) == 0) {
										if((_t252 & 0x00000040) == 0) {
											_t253 = _t252 ^ 0x00000001;
										} else {
											_t259 = _t252 ^ 0x00000080;
											if(_t259 >= 0) {
												_t253 = _t259 & 0x000000fe;
											} else {
												_t253 = _t259 | 0x00000001;
											}
										}
										 *_t298 = _t253;
										E0040117D(_t325);
										_a12 = _t325 + 1;
										_a16 =  !( *0x42371c) >> 0x00000008 & 0x00000001;
										_a8 = 0x40f;
									}
								}
								goto L41;
							}
							_t298 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageA(_v8, 0x200, 0, 0);
							}
							if(_a8 == 0x40b) {
								_t230 =  *0x41fcec; // 0x0
								if(_t230 != 0) {
									ImageList_Destroy(_t230);
								}
								_t231 =  *0x41fd00; // 0x0
								if(_t231 != 0) {
									GlobalFree(_t231);
								}
								 *0x41fcec = 0;
								 *0x41fd00 = 0;
								 *0x423780 = 0;
							}
							if(_a8 != 0x40f) {
								L88:
								if(_a8 == 0x420 && ( *0x42371d & 0x00000001) != 0) {
									_t321 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t321);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t321);
								}
								goto L91;
							} else {
								E004011EF(_t298, 0, 0);
								_t203 = _a12;
								if(_t203 != 0) {
									if(_t203 != 0xffffffff) {
										_t203 = _t203 - 1;
									}
									_push(_t203);
									_push(8);
									E00404A3B();
								}
								if(_a16 == 0) {
									L75:
									E004011EF(_t298, 0, 0);
									_t205 =  *0x41fd00; // 0x0
									_v36 = _t205;
									_t206 =  *0x423748;
									_v64 = 0xf030;
									_v24 = 0;
									if( *0x42374c <= 0) {
										L86:
										InvalidateRect(_v8, 0, 1);
										_t208 =  *0x422edc; // 0x7ecce0
										if( *((intOrPtr*)(_t208 + 0x10)) != 0) {
											E00404976(0x3ff, 0xfffffffb, E0040498E(5));
										}
										goto L88;
									}
									_t322 = _t206 + 8;
									do {
										_t212 =  *((intOrPtr*)(_v36 + _v24 * 4));
										if(_t212 != 0) {
											_t300 =  *_t322;
											_v72 = _t212;
											_v76 = 8;
											if((_t300 & 0x00000001) != 0) {
												_v76 = 9;
												_v60 =  &(_t322[4]);
												_t322[0] = _t322[0] & 0x000000fe;
											}
											if((_t300 & 0x00000040) == 0) {
												_t216 = (_t300 & 0x00000001) + 1;
												if((_t300 & 0x00000010) != 0) {
													_t216 = _t216 + 3;
												}
											} else {
												_t216 = 3;
											}
											_v68 = (_t216 << 0x0000000b | _t300 & 0x00000008) + (_t216 << 0x0000000b | _t300 & 0x00000008) | _t300 & 0x00000020;
											SendMessageA(_v8, 0x1102, (_t300 >> 0x00000005 & 0x00000001) + 1, _v72);
											SendMessageA(_v8, 0x110d, 0,  &_v76);
										}
										_v24 = _v24 + 1;
										_t322 =  &(_t322[0x106]);
									} while (_v24 <  *0x42374c);
									goto L86;
								} else {
									_t323 = E004012E2( *0x41fd00);
									E00401299(_t323);
									_t227 = 0;
									_t298 = 0;
									if(_t323 <= 0) {
										L74:
										SendMessageA(_v12, 0x14e, _t298, 0);
										_a16 = _t323;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v28 + _t227 * 4)) != 0) {
											_t298 = _t298 + 1;
										}
										_t227 = _t227 + 1;
									} while (_t227 < _t323);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L91;
						} else {
							_t237 = SendMessageA(_v12, 0x147, 0, 0);
							if(_t237 == 0xffffffff) {
								goto L91;
							}
							_t324 = SendMessageA(_v12, 0x150, _t237, 0);
							if(_t324 == 0xffffffff ||  *((intOrPtr*)(_v28 + _t324 * 4)) == 0) {
								_t324 = 0x20;
							}
							E00401299(_t324);
							SendMessageA(_a4, 0x420, 0, _t324);
							_a12 = _a12 | 0xffffffff;
							_a16 = 0;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					_v36 = 0;
					 *0x423780 = _a4;
					_v20 = 2;
					 *0x41fd00 = GlobalAlloc(0x40,  *0x42374c << 2);
					_t264 = LoadImageA( *0x423700, 0x6e, 0, 0, 0, 0);
					 *0x41fcf4 =  *0x41fcf4 | 0xffffffff;
					_v16 = _t264;
					 *0x41fcfc = SetWindowLongA(_v8, 0xfffffffc, E00405075);
					_t266 = ImageList_Create(_t320, _t320, 0x21, 6, 0);
					 *0x41fcec = _t266;
					ImageList_AddMasked(_t266, _v16, 0xff00ff);
					SendMessageA(_v8, 0x1109, 2,  *0x41fcec);
					if(SendMessageA(_v8, 0x111c, 0, 0) < _t320) {
						SendMessageA(_v8, 0x111b, _t320, 0);
					}
					DeleteObject(_v16);
					_t327 = 0;
					do {
						_t272 =  *((intOrPtr*)(_v28 + _t327 * 4));
						if( *((intOrPtr*)(_v28 + _t327 * 4)) != 0) {
							if(_t327 != 0x20) {
								_v20 = 0;
							}
							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, 0, E00405FFC(0, _t327, _t331, 0, _t272)), _t327);
						}
						_t327 = _t327 + 1;
					} while (_t327 < 0x21);
					_t328 = _a16;
					_push( *((intOrPtr*)(_t328 + 0x30 + _v20 * 4)));
					_push(0x15);
					E00404068(_a4);
					_push( *((intOrPtr*)(_t328 + 0x34 + _v20 * 4)));
					_push(0x16);
					E00404068(_a4);
					_t329 = 0;
					_v16 = 0;
					if( *0x42374c <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t316 = _v24 + 8;
						_v32 = _t316;
						do {
							_t284 =  &(_t316[0x10]);
							if( *_t284 != 0) {
								_v64 = _t284;
								_t285 =  *_t316;
								_v88 = _v16;
								_t308 = 0x20;
								_v84 = 0xffff0002;
								_v80 = 0xd;
								_v68 = _t308;
								_v44 = _t329;
								_v72 = _t285 & _t308;
								if((_t285 & 0x00000002) == 0) {
									if((_t285 & 0x00000004) == 0) {
										_t287 = SendMessageA(_v8, 0x1100, 0,  &_v88);
										_t309 =  *0x41fd00; // 0x0
										 *(_t309 + _t329 * 4) = _t287;
									} else {
										_v16 = SendMessageA(_v8, 0x110a, 3, _v16);
									}
								} else {
									_v80 = 0x4d;
									_v48 = 1;
									_t290 = SendMessageA(_v8, 0x1100, 0,  &_v88);
									_t310 =  *0x41fd00; // 0x0
									_v36 = 1;
									 *(_t310 + _t329 * 4) = _t290;
									_t291 =  *0x41fd00; // 0x0
									_v16 =  *(_t291 + _t329 * 4);
								}
							}
							_t329 = _t329 + 1;
							_t316 =  &(_v32[0x418]);
							_v32 = _t316;
						} while (_t329 <  *0x42374c);
						if(_v36 != 0) {
							L20:
							if(_v20 != 0) {
								E0040409D(_v8);
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E0040409D(_v12);
								L91:
								return E004040CF(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x00404a8b
0x00404a93
0x00404a9b
0x00404aa1
0x00404ab9
0x00404abc
0x00404abd
0x00404cea
0x00404cf1
0x00404d05
0x00404cf3
0x00404cf5
0x00404cf8
0x00404cf9
0x00404d00
0x00404d00
0x00404d11
0x00404d1f
0x00404d22
0x00404d38
0x00404dad
0x00404db0
0x00404db2
0x00404dbc
0x00404dca
0x00404dca
0x00404dcc
0x00404dd6
0x00404ddc
0x00404ddf
0x00404de2
0x00404dfd
0x00404de4
0x00404dee
0x00404dee
0x00404de2
0x00404dd6
0x00000000
0x00404db0
0x00404d3d
0x00404d48
0x00404d4d
0x00404d54
0x00404d59
0x00404d5d
0x00404d68
0x00404d68
0x00404d6c
0x00404d70
0x00404d74
0x00404d87
0x00404d76
0x00404d76
0x00404d7d
0x00404d83
0x00404d7f
0x00404d7f
0x00404d7f
0x00404d7d
0x00404d8b
0x00404d8d
0x00404da0
0x00404da3
0x00404da6
0x00404da6
0x00404d70
0x00000000
0x00404d5d
0x00404d3f
0x00404d46
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404e00
0x00404e00
0x00404e07
0x00404e78
0x00404e80
0x00404e88
0x00404e88
0x00404e91
0x00404e93
0x00404e9a
0x00404e9d
0x00404e9d
0x00404ea3
0x00404eaa
0x00404ead
0x00404ead
0x00404eb3
0x00404eb9
0x00404ebf
0x00404ebf
0x00404ecc
0x00405022
0x00405029
0x00405046
0x0040504c
0x0040505e
0x0040505e
0x00000000
0x00404ed2
0x00404ed4
0x00404ed9
0x00404ede
0x00404ee3
0x00404ee5
0x00404ee5
0x00404ee6
0x00404ee7
0x00404ee9
0x00404ee9
0x00404ef1
0x00404f32
0x00404f34
0x00404f39
0x00404f44
0x00404f47
0x00404f4c
0x00404f53
0x00404f56
0x00404ff8
0x00404ffe
0x00405004
0x0040500c
0x0040501d
0x0040501d
0x00000000
0x0040500c
0x00404f5c
0x00404f5f
0x00404f65
0x00404f6a
0x00404f6c
0x00404f6e
0x00404f74
0x00404f7b
0x00404f80
0x00404f87
0x00404f8a
0x00404f8a
0x00404f91
0x00404f9d
0x00404fa1
0x00404fa3
0x00404fa3
0x00404f93
0x00404f95
0x00404f95
0x00404fc3
0x00404fcf
0x00404fde
0x00404fde
0x00404fe0
0x00404fe3
0x00404fec
0x00000000
0x00404ef3
0x00404efe
0x00404f01
0x00404f06
0x00404f08
0x00404f0c
0x00404f1c
0x00404f26
0x00404f28
0x00404f2b
0x00000000
0x00000000
0x00000000
0x00000000
0x00404f0e
0x00404f0e
0x00404f14
0x00404f16
0x00404f16
0x00404f17
0x00404f18
0x00000000
0x00404f0e
0x00404ef1
0x00404ecc
0x00404e0f
0x00000000
0x00404e25
0x00404e2f
0x00404e34
0x00000000
0x00000000
0x00404e46
0x00404e4b
0x00404e57
0x00404e57
0x00404e59
0x00404e68
0x00404e6a
0x00404e6e
0x00404e71
0x00000000
0x00404e71
0x00404e0f
0x00404ac3
0x00404ac6
0x00404ac9
0x00404ad9
0x00404aec
0x00404af7
0x00404afd
0x00404b0b
0x00404b1e
0x00404b23
0x00404b2e
0x00404b37
0x00404b4d
0x00404b5d
0x00404b69
0x00404b69
0x00404b6e
0x00404b74
0x00404b76
0x00404b79
0x00404b7e
0x00404b83
0x00404b85
0x00404b85
0x00404ba5
0x00404ba5
0x00404ba7
0x00404ba8
0x00404bad
0x00404bb3
0x00404bb7
0x00404bbc
0x00404bc4
0x00404bc8
0x00404bcd
0x00404bd2
0x00404bda
0x00404bdd
0x00404cac
0x00404cbf
0x00000000
0x00404be3
0x00404be6
0x00404be9
0x00404bec
0x00404bec
0x00404bf1
0x00404bfa
0x00404bfd
0x00404c01
0x00404c04
0x00404c07
0x00404c10
0x00404c19
0x00404c1c
0x00404c1f
0x00404c22
0x00404c60
0x00404c83
0x00404c85
0x00404c8b
0x00404c62
0x00404c71
0x00404c71
0x00404c24
0x00404c27
0x00404c35
0x00404c3f
0x00404c41
0x00404c47
0x00404c4e
0x00404c51
0x00404c59
0x00404c59
0x00404c22
0x00404c91
0x00404c92
0x00404c9e
0x00404c9e
0x00404caa
0x00404cc5
0x00404cc8
0x00404ce5
0x00000000
0x00404cca
0x00404ccf
0x00404cd8
0x00405060
0x00405072
0x00405072
0x00404cc8
0x00000000
0x00404caa
0x00404bdd

APIs

GetDlgItem.USER32 ref: 00404A84
GetDlgItem.USER32 ref: 00404A91
GlobalAlloc.KERNEL32(00000040,?), ref: 00404AE0
LoadImageA.USER32 ref: 00404AF7
SetWindowLongA.USER32(?,000000FC,00405075), ref: 00404B11
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404B23
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404B37
SendMessageA.USER32(?,00001109,00000002), ref: 00404B4D
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404B59
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404B69
DeleteObject.GDI32(00000110), ref: 00404B6E
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404B99
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404BA5
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C3F
SendMessageA.USER32(?,0000110A,00000003,00000110), ref: 00404C6F

Part of subcall function 0040409D: SendMessageA.USER32(00000028,?,00000001,00403ECD), ref: 004040AB

SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C83
GetWindowLongA.USER32 ref: 00404CB1
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404CBF
ShowWindow.USER32(?,00000005), ref: 00404CCF
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404DCA
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404E2F
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404E44
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404E68
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404E88
ImageList_Destroy.COMCTL32(00000000), ref: 00404E9D
GlobalFree.KERNEL32 ref: 00404EAD
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404F26
SendMessageA.USER32(?,00001102,?,?), ref: 00404FCF
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404FDE
InvalidateRect.USER32(?,00000000,00000001), ref: 00404FFE
ShowWindow.USER32(?,00000000), ref: 0040504C
GetDlgItem.USER32 ref: 00405057
ShowWindow.USER32(00000000), ref: 0040505E

Strings

N, xrefs: 00404D08
M, xrefs: 00404C27
, xrefs: 00405036

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 6c91a6865aeac2cc1bc81da0427ec232e576c845fbda25fe1dd31a6c378936cd
Instruction ID: 966653e8360bab3e2fc21879108ab338c3bc3285e0cd99f232f5bc98bb3d6c0f
Opcode Fuzzy Hash: 6c91a6865aeac2cc1bc81da0427ec232e576c845fbda25fe1dd31a6c378936cd
Instruction Fuzzy Hash: 86025CB0900209AFDB10DF64DC45AAE7BB9FB84314F10813AFA15BA2E0D7799E41DF58

Uniqueness

Uniqueness Score: -1.00%

Function 004041D3 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004041D3(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				intOrPtr _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t103;
				signed int _t106;
				intOrPtr _t107;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L11:
						__eflags = _a8 - 0x4e;
						if(_a8 != 0x4e) {
							__eflags = _a8 - 0x40b;
							if(_a8 == 0x40b) {
								 *0x41ecd4 =  *0x41ecd4 + 1;
								__eflags =  *0x41ecd4;
							}
							L25:
							_t110 = _a16;
							L26:
							return E004040CF(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						__eflags =  *((intOrPtr*)(_t110 + 8)) - 0x70b;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b) {
							__eflags =  *((intOrPtr*)(_t110 + 0xc)) - 0x201;
							if( *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
								_t100 =  *((intOrPtr*)(_t110 + 0x1c));
								_t109 =  *((intOrPtr*)(_t110 + 0x18));
								_v12 = _t100;
								__eflags = _t100 - _t109 - 0x800;
								_v16 = _t109;
								_v8 = 0x4226a0;
								if(_t100 - _t109 < 0x800) {
									SendMessageA(_t52, 0x44b, 0,  &_v16);
									SetCursor(LoadCursorA(0, 0x7f02));
									_push(1);
									E00404477(_a4, _v8);
									SetCursor(LoadCursorA(0, 0x7f00));
									_t110 = _a16;
								}
							}
						}
						__eflags =  *((intOrPtr*)(_t110 + 8)) - 0x700;
						if( *((intOrPtr*)(_t110 + 8)) != 0x700) {
							goto L26;
						} else {
							__eflags =  *((intOrPtr*)(_t110 + 0xc)) - 0x100;
							if( *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
								goto L26;
							}
							__eflags =  *((intOrPtr*)(_t110 + 0x10)) - 0xd;
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x423708, 0x111, 1, 0);
							}
							__eflags =  *((intOrPtr*)(_t110 + 0x10)) - 0x1b;
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x423708, 0x10, 0, 0);
							}
							return 1;
						}
					}
					__eflags = _a12 >> 0x10;
					if(_a12 >> 0x10 != 0) {
						goto L25;
					}
					__eflags =  *0x41ecd4; // 0x0
					if(__eflags != 0) {
						goto L25;
					}
					_t103 =  *0x41f4e0; // 0x7eb2d4
					_t25 = _t103 + 0x14; // 0x7eb2e8
					_t112 = _t25;
					__eflags =  *_t112 & 0x00000020;
					if(( *_t112 & 0x00000020) == 0) {
						goto L25;
					}
					_t106 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
					__eflags = _t106;
					 *_t112 = _t106;
					E0040408A(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
					E00404453();
					goto L11;
				} else {
					_t98 = _a16;
					_t113 =  *(_t98 + 0x30);
					if(_t113 < 0) {
						_t107 =  *0x422edc; // 0x7ecce0
						_t113 =  *(_t107 - 4 + _t113 * 4);
					}
					_push( *((intOrPtr*)(_t98 + 0x34)));
					_t114 = _t113 +  *0x423758;
					_push(0x22);
					_a16 =  *_t114;
					_v12 = _v12 & 0x00000000;
					_t115 = _t114 + 1;
					_v16 = _t115;
					_v8 = E0040419E;
					E00404068(_a4);
					_push( *((intOrPtr*)(_t98 + 0x38)));
					_push(0x23);
					E00404068(_a4);
					CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
					E0040408A( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
					_t99 = GetDlgItem(_a4, 0x3e8);
					E0040409D(_t99);
					SendMessageA(_t99, 0x45b, 1, 0);
					_t86 =  *( *0x423714 + 0x68);
					if(_t86 < 0) {
						_t86 = GetSysColor( ~_t86);
					}
					SendMessageA(_t99, 0x443, 0, _t86);
					SendMessageA(_t99, 0x445, 0, 0x4010000);
					SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
					 *0x41ecd4 = 0;
					SendMessageA(_t99, 0x449, _a16,  &_v16);
					 *0x41ecd4 = 0;
					return 0;
				}
			}

0x004041e3
0x004042f5
0x00404308
0x00404364
0x00404364
0x00404368
0x0040442e
0x00404435
0x00404437
0x00404437
0x00404437
0x0040443d
0x0040443d
0x00404440
0x00000000
0x00404447
0x00404376
0x00404378
0x0040437b
0x00404382
0x00404384
0x0040438b
0x0040438d
0x00404390
0x00404393
0x00404398
0x0040439e
0x004043a1
0x004043a8
0x004043b6
0x004043ce
0x004043d0
0x004043d8
0x004043e7
0x004043e9
0x004043e9
0x004043a8
0x0040438b
0x004043ec
0x004043f3
0x00000000
0x004043f5
0x004043f5
0x004043fc
0x00000000
0x00000000
0x004043fe
0x00404402
0x00404413
0x00404413
0x00404415
0x00404419
0x00404427
0x00404427
0x00000000
0x0040442b
0x004043f3
0x00404310
0x00404313
0x00000000
0x00000000
0x0040431b
0x00404321
0x00000000
0x00000000
0x00404327
0x0040432d
0x0040432d
0x00404330
0x00404333
0x00000000
0x00000000
0x00404356
0x00404356
0x00404358
0x0040435a
0x0040435f
0x00000000
0x004041e9
0x004041e9
0x004041ec
0x004041f1
0x004041f3
0x00404202
0x00404202
0x00404209
0x0040420c
0x0040420e
0x00404213
0x0040421c
0x00404222
0x0040422e
0x00404231
0x0040423a
0x0040423f
0x00404242
0x00404247
0x0040425e
0x00404265
0x00404278
0x0040427b
0x00404290
0x00404297
0x0040429c
0x004042a1
0x004042a1
0x004042b0
0x004042bf
0x004042d1
0x004042d6
0x004042e6
0x004042e8
0x00000000
0x004042ee

APIs

CheckDlgButton.USER32 ref: 0040425E
GetDlgItem.USER32 ref: 00404272
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 00404290
GetSysColor.USER32(?), ref: 004042A1
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 004042B0
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 004042BF
lstrlenA.KERNEL32(?), ref: 004042C2
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004042D1
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004042E6
GetDlgItem.USER32 ref: 00404348
SendMessageA.USER32(00000000), ref: 0040434B
GetDlgItem.USER32 ref: 00404376
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004043B6
LoadCursorA.USER32 ref: 004043C5
SetCursor.USER32(00000000), ref: 004043CE
LoadCursorA.USER32 ref: 004043E4
SetCursor.USER32(00000000), ref: 004043E7
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404413
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404427

Strings

Call, xrefs: 004043A1
N, xrefs: 00404364

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: aedf8a6b2f60594d9aa2a20867b53785746c99fe12f07fbfb1ee765dbd043f7e
Instruction ID: a86fe1b261e308fa50e110e5a31abfd90c360c5de8850f7aae14d0f145b03158
Opcode Fuzzy Hash: aedf8a6b2f60594d9aa2a20867b53785746c99fe12f07fbfb1ee765dbd043f7e
Instruction Fuzzy Hash: 1561A0B1A00209BBEB109F61DD45F6A7B69FB84705F008036FB01BA2D1C7B8A951CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x423714;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, 0x422f00, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x423708;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00422F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a5e12e9d17b50a3f423cea0afacbb368398e6ec861f9ad0eaee1311db9104a5d
Instruction ID: e0713781b635691343a74aeb4589e3ea90c77733c460a74728c978b7faf409cc
Opcode Fuzzy Hash: a5e12e9d17b50a3f423cea0afacbb368398e6ec861f9ad0eaee1311db9104a5d
Instruction Fuzzy Hash: A7419C71804249AFCF058FA4CD459BFBFB9FF44310F00812AF561AA2A0C738AA50DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405C49 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 129
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C49(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t12;
				long _t24;
				char* _t31;
				int _t37;
				void* _t38;
				intOrPtr* _t39;
				long _t42;
				CHAR* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t52;
				void* _t53;

				_t38 = __ecx;
				_t44 =  *(_t52 + 0x14);
				 *0x421a98 = 0x4c554e;
				if(_t44 == 0) {
					L3:
					_t12 = GetShortPathNameA( *(_t52 + 0x1c), 0x421e98, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						_t37 = wsprintfA(0x421698, "%s=%s\r\n", 0x421a98, 0x421e98);
						_t53 = _t52 + 0x10;
						E00405FFC(_t37, 0x400, 0x421e98, 0x421e98,  *((intOrPtr*)( *0x423714 + 0x128)));
						_t12 = E00405B73(0x421e98, 0xc0000000, 4);
						_t48 = _t12;
						 *(_t53 + 0x18) = _t48;
						if(_t48 != 0xffffffff) {
							_t42 = GetFileSize(_t48, 0);
							_t6 = _t37 + 0xa; // 0xa
							_t46 = GlobalAlloc(0x40, _t42 + _t6);
							if(_t46 == 0 || E00405BEB(_t48, _t46, _t42) == 0) {
								L18:
								return CloseHandle(_t48);
							} else {
								if(E00405AD8(_t38, _t46, "[Rename]\r\n") != 0) {
									_t49 = E00405AD8(_t38, _t21 + 0xa, 0x4093b8);
									if(_t49 == 0) {
										_t48 =  *(_t53 + 0x18);
										L16:
										_t24 = _t42;
										L17:
										E00405B2E(_t24 + _t46, 0x421698, _t37);
										SetFilePointer(_t48, 0, 0, 0);
										E00405C1A(_t48, _t46, _t42 + _t37);
										GlobalFree(_t46);
										goto L18;
									}
									_t39 = _t46 + _t42;
									_t31 = _t39 + _t37;
									while(_t39 > _t49) {
										 *_t31 =  *_t39;
										_t31 = _t31 - 1;
										_t39 = _t39 - 1;
									}
									_t24 = _t49 - _t46 + 1;
									_t48 =  *(_t53 + 0x18);
									goto L17;
								}
								lstrcpyA(_t46 + _t42, "[Rename]\r\n");
								_t42 = _t42 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E00405B73(_t44, 0, 1));
					_t12 = GetShortPathNameA(_t44, 0x421a98, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						goto L3;
					}
				}
				return _t12;
			}

0x00405c49
0x00405c52
0x00405c59
0x00405c6d
0x00405c95
0x00405ca0
0x00405ca4
0x00405cc4
0x00405ccb
0x00405cd5
0x00405ce2
0x00405ce7
0x00405cec
0x00405cf0
0x00405cff
0x00405d01
0x00405d0e
0x00405d12
0x00405dad
0x00000000
0x00405d28
0x00405d35
0x00405d59
0x00405d5d
0x00405d7c
0x00405d80
0x00405d80
0x00405d82
0x00405d8b
0x00405d96
0x00405da1
0x00405da7
0x00000000
0x00405da7
0x00405d5f
0x00405d62
0x00405d6d
0x00405d69
0x00405d6b
0x00405d6c
0x00405d6c
0x00405d74
0x00405d76
0x00000000
0x00405d76
0x00405d40
0x00405d46
0x00000000
0x00405d46
0x00405d12
0x00405cf0
0x00405c6f
0x00405c7a
0x00405c83
0x00405c87
0x00000000
0x00000000
0x00405c87
0x00405db8

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00405DDA,?,?), ref: 00405C7A
GetShortPathNameA.KERNEL32 ref: 00405C83

Part of subcall function 00405AD8: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D33,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405AE8
Part of subcall function 00405AD8: lstrlenA.KERNEL32(00000000,?,00000000,00405D33,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B1A

GetShortPathNameA.KERNEL32 ref: 00405CA0
wsprintfA.USER32 ref: 00405CBE
GetFileSize.KERNEL32(00000000,00000000,00421E98,C0000000,00000004,00421E98,?,?,?,?,?), ref: 00405CF9
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405D08
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D40
SetFilePointer.KERNEL32(004093B8,00000000,00000000,00000000,00000000,00421698,00000000,-0000000A,004093B8,00000000,[Rename],00000000,00000000,00000000), ref: 00405D96
GlobalFree.KERNEL32 ref: 00405DA7
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405DAE

Part of subcall function 00405B73: GetFileAttributesA.KERNELBASE(00000003,00402E04,C:\Users\user\Desktop\Quotation.exe,80000000,00000003), ref: 00405B77
Part of subcall function 00405B73: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B99

Strings

[Rename], xrefs: 00405D28, 00405D3A
%s=%s, xrefs: 00405CB4

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %s=%s$[Rename]
API String ID: 2171350718-1727408572
Opcode ID: 442663d250bfdbc290f8e971c6720eb5308fb07ccd41dbdaaacc117d0e8b41e7
Instruction ID: 6ce2b9c5035192946699426d8eaee961ce023100f281e1c8236941499ee81097
Opcode Fuzzy Hash: 442663d250bfdbc290f8e971c6720eb5308fb07ccd41dbdaaacc117d0e8b41e7
Instruction Fuzzy Hash: 19311331605B19ABD6207B659C4CFAB3A6CDF45714F14003BFA01FA2D2E67CA8018EBD

Uniqueness

Uniqueness Score: -1.00%

Function 6D0124D8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6D0124D8(intOrPtr* _a4) {
				char _v80;
				int _v84;
				intOrPtr _v88;
				short _v92;
				intOrPtr* _t28;
				void* _t30;
				intOrPtr _t31;
				signed int _t43;
				void* _t44;
				intOrPtr _t45;
				void* _t48;

				_t44 = E6D011215();
				_t28 = _a4;
				_t45 =  *((intOrPtr*)(_t28 + 0x814));
				_v88 = _t45;
				_t48 = (_t45 + 0x41 << 5) + _t28;
				do {
					if( *((intOrPtr*)(_t48 - 4)) >= 0) {
					}
					_t43 =  *(_t48 - 8) & 0x000000ff;
					if(_t43 <= 7) {
						switch( *((intOrPtr*)(_t43 * 4 +  &M6D012626))) {
							case 0:
								 *_t44 = 0;
								goto L17;
							case 1:
								__eax =  *__eax;
								if(__ecx > __ebx) {
									_v84 = __ecx;
									__ecx =  *(0x6d01307c + __edx * 4);
									__edx = _v84;
									__ecx = __ecx * __edx;
									asm("sbb edx, edx");
									__edx = __edx & __ecx;
									__eax = __eax &  *(0x6d01309c + __edx * 4);
								}
								_push(__eax);
								goto L15;
							case 2:
								__eax = E6D011429(__edx,  *__eax,  *((intOrPtr*)(__eax + 4)), __edi);
								goto L16;
							case 3:
								__eax = lstrcpynA(__edi,  *__eax,  *0x6d01405c);
								goto L17;
							case 4:
								__ecx =  *0x6d01405c;
								__edx = __ecx - 1;
								__eax = WideCharToMultiByte(__ebx, __ebx,  *__eax, __ecx, __edi, __edx, __ebx, __ebx);
								__eax =  *0x6d01405c;
								 *((char*)(__eax + __edi - 1)) = __bl;
								goto L17;
							case 5:
								__ecx =  &_v80;
								_push(0x27);
								_push(__ecx);
								_push( *__eax);
								" {3v@u3v"();
								__eax =  &_v92;
								__eax = WideCharToMultiByte(__ebx, __ebx,  &_v92,  &_v92, __edi,  *0x6d01405c, __ebx, __ebx);
								goto L17;
							case 6:
								_push( *__esi);
								L15:
								__eax = wsprintfA(__edi, 0x6d014000);
								L16:
								__esp = __esp + 0xc;
								goto L17;
						}
					}
					L17:
					_t30 =  *(_t48 + 0x14);
					if(_t30 != 0 && ( *_a4 != 2 ||  *((intOrPtr*)(_t48 - 4)) > 0)) {
						GlobalFree(_t30);
					}
					_t31 =  *((intOrPtr*)(_t48 + 0xc));
					if(_t31 != 0) {
						if(_t31 != 0xffffffff) {
							if(_t31 > 0) {
								E6D0112D1(_t31 - 1, _t44);
								goto L26;
							}
						} else {
							E6D011266(_t44);
							L26:
						}
					}
					_v88 = _v88 - 1;
					_t48 = _t48 - 0x20;
				} while (_v88 >= 0);
				return GlobalFree(_t44);
			}

0x6d0124e4
0x6d0124e6
0x6d0124f0
0x6d0124f6
0x6d012500
0x6d012504
0x6d012509
0x6d012509
0x6d012511
0x6d012518
0x6d01251e
0x00000000
0x6d012525
0x00000000
0x00000000
0x6d01252c
0x6d012530
0x6d012533
0x6d012537
0x6d01253e
0x6d012542
0x6d012548
0x6d01254a
0x6d01254c
0x6d01254c
0x6d012553
0x00000000
0x00000000
0x6d01255c
0x00000000
0x00000000
0x6d01256c
0x00000000
0x00000000
0x6d012598
0x6d0125a0
0x6d0125aa
0x6d0125ac
0x6d0125b1
0x00000000
0x00000000
0x6d012574
0x6d012578
0x6d01257a
0x6d01257b
0x6d01257d
0x6d01258d
0x6d012594
0x00000000
0x00000000
0x6d0125b7
0x6d0125b9
0x6d0125bf
0x6d0125c5
0x6d0125c5
0x00000000
0x00000000
0x6d01251e
0x6d0125c8
0x6d0125c8
0x6d0125cd
0x6d0125de
0x6d0125de
0x6d0125e4
0x6d0125e9
0x6d0125ee
0x6d0125fa
0x6d0125ff
0x00000000
0x6d012604
0x6d0125f0
0x6d0125f1
0x6d012605
0x6d012605
0x6d0125ee
0x6d012606
0x6d01260a
0x6d01260d
0x6d012625

APIs

Part of subcall function 6D011215: GlobalAlloc.KERNEL32(00000040,6D011233,?,6D0112CF,-6D01404B,6D0111AB,-000000A0), ref: 6D01121D

GlobalFree.KERNEL32 ref: 6D0125DE
GlobalFree.KERNEL32 ref: 6D012618

Strings

{3v@u3v, xrefs: 6D01257D

Memory Dump Source

Source File: 00000000.00000002.779239899.000000006D011000.00000020.00000001.01000000.00000004.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000000.00000002.779220127.000000006D010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.779251763.000000006D013000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.779269562.000000006D015000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d010000_Quotation.jbxd

Similarity

API ID: Global$Free$Alloc
String ID: {3v@u3v
API String ID: 1780285237-40114749
Opcode ID: 597e02b0c6941178b9fdd443cde185eab3a45fde8ce2d04518787d8f782d57ea
Instruction ID: b4271ef90cf43c97f2a48b1280a1635f319d04d16568da6c56ab3c1840a243c5
Opcode Fuzzy Hash: 597e02b0c6941178b9fdd443cde185eab3a45fde8ce2d04518787d8f782d57ea
Instruction Fuzzy Hash: B3417C7110C202AFEB268FE4CCE6E2E7BFAFB8B308B504529F65197150D73199148B62

Uniqueness

Uniqueness Score: -1.00%

Function 6D0122F1 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6D0122F1(void* __edx, intOrPtr _a4) {
				signed int _v4;
				signed int _v8;
				void* _t38;
				signed int _t39;
				void* _t40;
				void* _t43;
				void* _t48;
				signed int* _t50;
				signed char* _t51;

				_v8 = 0 |  *((intOrPtr*)(_a4 + 0x814)) > 0x00000000;
				while(1) {
					_t9 = _a4 + 0x818; // 0x818
					_t51 = (_v8 << 5) + _t9;
					_t38 = _t51[0x18];
					if(_t38 == 0) {
						goto L9;
					}
					_t48 = 0x1a;
					if(_t38 == _t48) {
						goto L9;
					}
					if(_t38 != 0xffffffff) {
						if(_t38 <= 0 || _t38 > 0x19) {
							_t51[0x18] = _t48;
						} else {
							_t38 = E6D0112AD(_t38 - 1);
							L10:
						}
						goto L11;
					} else {
						_t38 = E6D01123B();
						L11:
						_t43 = _t38;
						_t13 =  &(_t51[8]); // 0x820
						_t50 = _t13;
						if(_t51[4] >= 0) {
						}
						_t39 =  *_t51 & 0x000000ff;
						_t51[0x1c] = _t51[0x1c] & 0x00000000;
						_v4 = _t39;
						if(_t39 > 7) {
							L27:
							_t40 = GlobalFree(_t43);
							if(_v8 == 0) {
								return _t40;
							}
							if(_v8 !=  *((intOrPtr*)(_a4 + 0x814))) {
								_v8 = _v8 + 1;
							} else {
								_v8 = _v8 & 0x00000000;
							}
							continue;
						} else {
							switch( *((intOrPtr*)(_t39 * 4 +  &M6D01247E))) {
								case 0:
									 *_t50 =  *_t50 & 0x00000000;
									goto L27;
								case 1:
									__eax = E6D0112FE(__ebx);
									goto L20;
								case 2:
									 *__ebp = E6D0112FE(__ebx);
									_a4 = __edx;
									goto L27;
								case 3:
									__eax = E6D011224(__ebx);
									 *(__esi + 0x1c) = __eax;
									L20:
									 *__ebp = __eax;
									goto L27;
								case 4:
									 *0x6d01405c =  *0x6d01405c +  *0x6d01405c;
									__edi = GlobalAlloc(0x40,  *0x6d01405c +  *0x6d01405c);
									 *0x6d01405c = MultiByteToWideChar(0, 0, __ebx,  *0x6d01405c, __edi,  *0x6d01405c);
									if(_v4 != 5) {
										 *(__esi + 0x1c) = __edi;
										 *__ebp = __edi;
									} else {
										__eax = GlobalAlloc(0x40, 0x10);
										_push(__eax);
										 *(__esi + 0x1c) = __eax;
										_push(__edi);
										 *__ebp = __eax;
										__imp__CLSIDFromString();
										__eax = GlobalFree(__edi);
									}
									goto L27;
								case 5:
									if( *__ebx != 0) {
										__eax = E6D0112FE(__ebx);
										 *__edi = __eax;
									}
									goto L27;
								case 6:
									__esi =  *(__esi + 0x18);
									__esi = __esi - 1;
									__esi = __esi *  *0x6d01405c;
									__esi = __esi +  *0x6d014064;
									__eax = __esi + 0xc;
									 *__edi = __esi + 0xc;
									asm("cdq");
									__eax = E6D011429(__edx, __esi + 0xc, __edx, __esi);
									goto L27;
							}
						}
					}
					L9:
					_t38 = E6D011224(0x6d014034);
					goto L10;
				}
			}

0x6d012306
0x6d01230a
0x6d012315
0x6d012315
0x6d01231c
0x6d012321
0x00000000
0x00000000
0x6d012325
0x6d012328
0x00000000
0x00000000
0x6d01232d
0x6d012338
0x6d012348
0x6d01233f
0x6d012341
0x6d012357
0x6d012357
0x00000000
0x6d01232f
0x6d01232f
0x6d012358
0x6d01235c
0x6d01235e
0x6d01235e
0x6d012361
0x6d012361
0x6d012369
0x6d01236c
0x6d012373
0x6d012377
0x6d012446
0x6d012447
0x6d012452
0x6d01247d
0x6d01247d
0x6d012462
0x6d01246e
0x6d012464
0x6d012464
0x6d012464
0x00000000
0x6d01237d
0x6d01237d
0x00000000
0x6d012384
0x00000000
0x00000000
0x6d01238d
0x00000000
0x00000000
0x6d01239b
0x6d01239e
0x00000000
0x00000000
0x6d0123a7
0x6d0123ac
0x6d0123af
0x6d0123b0
0x00000000
0x00000000
0x6d0123bd
0x6d0123c8
0x6d0123d7
0x6d0123e2
0x6d012405
0x6d012408
0x6d0123e4
0x6d0123e8
0x6d0123ee
0x6d0123ef
0x6d0123f2
0x6d0123f3
0x6d0123f6
0x6d0123fd
0x6d0123fd
0x00000000
0x00000000
0x6d012410
0x6d012413
0x6d01241f
0x6d012421
0x00000000
0x00000000
0x6d012424
0x6d012427
0x6d012428
0x6d01242f
0x6d012436
0x6d012439
0x6d01243b
0x6d01243e
0x00000000
0x00000000
0x6d01237d
0x6d012377
0x6d01234d
0x6d012352
0x00000000
0x6d012352

APIs

GlobalFree.KERNEL32 ref: 6D012447

Part of subcall function 6D011224: lstrcpynA.KERNEL32(00000000,?,6D0112CF,-6D01404B,6D0111AB,-000000A0), ref: 6D011234

GlobalAlloc.KERNEL32(00000040,?), ref: 6D0123C2
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 6D0123D7
GlobalAlloc.KERNEL32(00000040,00000010), ref: 6D0123E8
CLSIDFromString.OLE32(00000000,00000000), ref: 6D0123F6
GlobalFree.KERNEL32 ref: 6D0123FD

Strings

@u3v, xrefs: 6D0123F6

Memory Dump Source

Source File: 00000000.00000002.779239899.000000006D011000.00000020.00000001.01000000.00000004.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000000.00000002.779220127.000000006D010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.779251763.000000006D013000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.779269562.000000006D015000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d010000_Quotation.jbxd

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
String ID: @u3v
API String ID: 3730416702-2775030947
Opcode ID: 40468429976543ae1c58f7449a3d3135966906a06d15ab51c9fc43349785599a
Instruction ID: 63c8252e4aa7cb55bf368e39c8f04837ef7bf4630ca903b83c47689bd0098b2c
Opcode Fuzzy Hash: 40468429976543ae1c58f7449a3d3135966906a06d15ab51c9fc43349785599a
Instruction Fuzzy Hash: 064185B150C342EFE725DFB89C46B2AB7F8FB47315F00892AE565CA190D73099048B62

Uniqueness

Uniqueness Score: -1.00%

Function 00406244 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406244(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E004059DF(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E0040599D("*?|<>/\":", _t5))) == 0) {
							E00405B2E(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x00406246
0x0040624e
0x00406262
0x00406262
0x00406268
0x00406275
0x00406275
0x00406276
0x00406278
0x0040627c
0x0040627e
0x00406287
0x00406289
0x004062a3
0x004062ab
0x004062ab
0x004062b0
0x004062b2
0x004062b4
0x004062b8
0x004062b9
0x004062bc
0x004062c4
0x004062c6
0x004062ca
0x00000000
0x00000000
0x004062d0
0x004062d5
0x00000000
0x00000000
0x00000000
0x004062d5
0x004062da

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Quotation.exe",746AFA90,C:\Users\user\AppData\Local\Temp\,00000000,00403210,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 0040629C
CharNextA.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004062A9
CharNextA.USER32(?,"C:\Users\user\Desktop\Quotation.exe",746AFA90,C:\Users\user\AppData\Local\Temp\,00000000,00403210,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 004062AE
CharPrevA.USER32(?,?,746AFA90,C:\Users\user\AppData\Local\Temp\,00000000,00403210,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 004062BE

Strings

"C:\Users\user\Desktop\Quotation.exe", xrefs: 00406280
*?|<>/":, xrefs: 0040628C
C:\Users\user\AppData\Local\Temp\, xrefs: 00406245

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\Quotation.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-357083138
Opcode ID: 6ae2be844214803d006e8a2b4c6c3a53132e84b4cb1e19317121ab57d6ea06c4
Instruction ID: 98a55a52ac5494643caf5fd5857683424a9a77f1076ac2e6562e20d377716777
Opcode Fuzzy Hash: 6ae2be844214803d006e8a2b4c6c3a53132e84b4cb1e19317121ab57d6ea06c4
Instruction Fuzzy Hash: EE11E25180879029EB3226344C40B7B7F988F5B760F2904FFE9D6722C2D67C5C52876E

Uniqueness

Uniqueness Score: -1.00%

Function 00402CDD Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402CDD(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x4128b8; // 0xa7221
					_t11 =  *0x41e8c4; // 0xa9470
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfA( &_v68, "verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}

0x00402cea
0x00402cf8
0x00402cfe
0x00402cfe
0x00402d0c
0x00402d0e
0x00402d14
0x00402d1b
0x00402d1d
0x00402d1d
0x00402d33
0x00402d43
0x00402d55
0x00402d55
0x00402d5d

APIs

SetTimer.USER32 ref: 00402CF8
MulDiv.KERNEL32(000A7221,00000064,000A9470), ref: 00402D23
wsprintfA.USER32 ref: 00402D33
SetWindowTextA.USER32(?,?), ref: 00402D43
SetDlgItemTextA.USER32 ref: 00402D55

Strings

!r, xrefs: 00402D0E
verifying installer: %d%%, xrefs: 00402D2D

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: !r$verifying installer: %d%%
API String ID: 1451636040-2864131204
Opcode ID: be9cfeef7a30176cc4b43e70d30b18a0c7ce5305aee0f330691da59d71d99e6c
Instruction ID: 989b2dafafbc5add767bef13d928cf85595003a1ad1b8b7172a09c7de12a9e27
Opcode Fuzzy Hash: be9cfeef7a30176cc4b43e70d30b18a0c7ce5305aee0f330691da59d71d99e6c
Instruction Fuzzy Hash: 3801EC71A40209ABEF20AF60DD49FAE3769EB04305F008039FA06AA1D0D7B599558F59

Uniqueness

Uniqueness Score: -1.00%

Function 004040CF Relevance: 12.1, APIs: 8, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004040CF(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t39;
				long _t41;
				void* _t44;
				signed char _t50;
				long* _t54;

				if(_a4 + 0xfffffecd > 5) {
					L18:
					return 0;
				}
				_t54 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t54 == 0 || _t54[2] > 1 || _t54[4] > 2) {
					goto L18;
				} else {
					_t50 = _t54[5];
					if((_t50 & 0xffffffe0) != 0) {
						goto L18;
					}
					_t39 =  *_t54;
					if((_t50 & 0x00000002) != 0) {
						_t39 = GetSysColor(_t39);
					}
					if((_t54[5] & 0x00000001) != 0) {
						SetTextColor(_a8, _t39);
					}
					SetBkMode(_a8, _t54[4]);
					_t41 = _t54[1];
					_v16.lbColor = _t41;
					if((_t54[5] & 0x00000008) != 0) {
						_t41 = GetSysColor(_t41);
						_v16.lbColor = _t41;
					}
					if((_t54[5] & 0x00000004) != 0) {
						SetBkColor(_a8, _t41);
					}
					if((_t54[5] & 0x00000010) != 0) {
						_v16.lbStyle = _t54[2];
						_t44 = _t54[3];
						if(_t44 != 0) {
							DeleteObject(_t44);
						}
						_t54[3] = CreateBrushIndirect( &_v16);
					}
					return _t54[3];
				}
			}

0x004040e1
0x00404197
0x00000000
0x00404197
0x004040f2
0x004040f6
0x00000000
0x00404110
0x00404110
0x00404119
0x00000000
0x00000000
0x0040411b
0x00404127
0x0040412a
0x0040412a
0x00404130
0x00404136
0x00404136
0x00404142
0x00404148
0x0040414f
0x00404152
0x00404155
0x00404157
0x00404157
0x0040415f
0x00404165
0x00404165
0x0040416f
0x00404174
0x00404177
0x0040417c
0x0040417f
0x0040417f
0x0040418f
0x0040418f
0x00000000
0x00404192

APIs

GetWindowLongA.USER32 ref: 004040EC
GetSysColor.USER32(00000000), ref: 0040412A
SetTextColor.GDI32(?,00000000), ref: 00404136
SetBkMode.GDI32(?,?), ref: 00404142
GetSysColor.USER32(?), ref: 00404155
SetBkColor.GDI32(?,?), ref: 00404165
DeleteObject.GDI32(?), ref: 0040417F
CreateBrushIndirect.GDI32(?), ref: 00404189

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 85c1166dd3296ad08f2f8f2b617086cce748397ee5d912704cef396037712cfd
Instruction ID: 778babcb3f3cb4702814cedc7f3687c69535c8aec6342fb1ab2b401637f1774e
Opcode Fuzzy Hash: 85c1166dd3296ad08f2f8f2b617086cce748397ee5d912704cef396037712cfd
Instruction Fuzzy Hash: 8A21C7715047049BC7309F78DC4CB5BBBF8AF91710B048A2AEA96A62E0D334E884CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004049BB Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004049BB(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x004049c9
0x004049d6
0x004049dc
0x00404a1a
0x00404a1a
0x00404a29
0x00404a30
0x00000000
0x00404a32
0x004049de
0x004049ed
0x004049f5
0x004049f8
0x00404a0a
0x00404a10
0x00404a17
0x00000000
0x00404a17
0x00000000

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004049D6
GetMessagePos.USER32 ref: 004049DE
ScreenToClient.USER32 ref: 004049F8
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404A0A
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404A30

Strings

f, xrefs: 00404A0C

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b655f89ca4bb62ef2ecf269f26a72b4f16410e1a4a94cceed0b0bba942de31e0
Instruction ID: 78e79842b3afbaa1123eb4bc953d8a824fe30bd623f786c3032228cde2642f29
Opcode Fuzzy Hash: b655f89ca4bb62ef2ecf269f26a72b4f16410e1a4a94cceed0b0bba942de31e0
Instruction Fuzzy Hash: DA018071D40218BAEB00DB94DC81BFEBBB8AB45B11F10412BBA00B61D0C7B469418BA5

Uniqueness

Uniqueness Score: -1.00%

Function 004027A3 Relevance: 9.1, APIs: 6, Instructions: 86
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E004027A3(void* __ebx) {
				void* _t26;
				long _t31;
				void* _t45;
				void* _t49;
				void* _t51;
				void* _t54;
				void* _t55;
				void* _t56;

				_t45 = __ebx;
				 *((intOrPtr*)(_t56 - 0xc)) = 0xfffffd66;
				_t50 = E00402B2C(0xfffffff0);
				 *(_t56 - 0x4c) = _t23;
				if(E004059DF(_t50) == 0) {
					E00402B2C(0xffffffed);
				}
				E00405B4E(_t50);
				_t26 = E00405B73(_t50, 0x40000000, 2);
				 *(_t56 + 8) = _t26;
				if(_t26 != 0xffffffff) {
					_t31 =  *0x423718;
					 *(_t56 - 0x1c) = _t31;
					_t49 = GlobalAlloc(0x40, _t31);
					if(_t49 != _t45) {
						E004031ED(_t45);
						E004031D7(_t49,  *(_t56 - 0x1c));
						_t54 = GlobalAlloc(0x40,  *(_t56 - 0x2c));
						 *(_t56 - 0x10) = _t54;
						if(_t54 != _t45) {
							_push( *(_t56 - 0x2c));
							_push(_t54);
							_push(_t45);
							_push( *((intOrPtr*)(_t56 - 0x30)));
							E00402FFB();
							while( *_t54 != _t45) {
								_t47 =  *_t54;
								_t55 = _t54 + 8;
								 *(_t56 - 0x48) =  *_t54;
								E00405B2E( *((intOrPtr*)(_t54 + 4)) + _t49, _t55, _t47);
								_t54 = _t55 +  *(_t56 - 0x48);
							}
							GlobalFree( *(_t56 - 0x10));
						}
						E00405C1A( *(_t56 + 8), _t49,  *(_t56 - 0x1c));
						GlobalFree(_t49);
						_push(_t45);
						_push(_t45);
						_push( *(_t56 + 8));
						_push(0xffffffff);
						 *((intOrPtr*)(_t56 - 0xc)) = E00402FFB();
					}
					CloseHandle( *(_t56 + 8));
				}
				_t51 = 0xfffffff3;
				if( *((intOrPtr*)(_t56 - 0xc)) < _t45) {
					_t51 = 0xffffffef;
					DeleteFileA( *(_t56 - 0x4c));
					 *((intOrPtr*)(_t56 - 4)) = 1;
				}
				_push(_t51);
				E00401423();
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t56 - 4));
				return 0;
			}

0x004027a3
0x004027a5
0x004027b1
0x004027b4
0x004027be
0x004027c2
0x004027c2
0x004027c8
0x004027d5
0x004027dd
0x004027e0
0x004027e6
0x004027f4
0x004027f9
0x004027fd
0x00402800
0x00402809
0x00402815
0x00402819
0x0040281c
0x0040281e
0x00402821
0x00402822
0x00402823
0x00402826
0x00402845
0x0040282d
0x00402832
0x0040283a
0x0040283d
0x00402842
0x00402842
0x0040284c
0x0040284c
0x00402859
0x0040285f
0x00402865
0x00402866
0x00402867
0x0040286a
0x00402871
0x00402871
0x00402877
0x00402877
0x00402882
0x00402883
0x00402887
0x0040288b
0x00402891
0x00402891
0x00402898
0x004022a4
0x004029bb
0x004029c7

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004027F7
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 00402813
GlobalFree.KERNEL32 ref: 0040284C
GlobalFree.KERNEL32 ref: 0040285F
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 00402877
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040288B

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: d8962bc5da80a952d71843fdd2bcaf86795e36f6a6ef68a6a5081b931e868eb5
Instruction ID: ec0d33f595d451752a188c19515fdbd8f87975fde9c964b970e1a5072f162152
Opcode Fuzzy Hash: d8962bc5da80a952d71843fdd2bcaf86795e36f6a6ef68a6a5081b931e868eb5
Instruction Fuzzy Hash: 7D219C72C00124BBCF213FA5CD49DAE7F79EF09364B10823AF520762E0C67959419FA9

Uniqueness

Uniqueness Score: -1.00%

Function 004048B1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E004048B1(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				signed int _t22;
				void* _t29;
				void* _t31;
				void* _t32;
				void* _t41;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				signed int _t51;
				signed int _t53;

				_t21 = _a16;
				_t51 = _a12;
				_t41 = 0xffffffdc;
				if(_t21 == 0) {
					_push(0x14);
					_pop(0);
					_t22 = _t51;
					if(_t51 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t41 = 0xffffffdd;
					}
					if(_t51 < 0x400) {
						_t41 = 0xffffffde;
					}
					if(_t51 < 0xffff3333) {
						_t50 = 0x14;
						asm("cdq");
						_t22 = 1 / _t50 + _t51;
					}
					_t23 = _t22 & 0x00ffffff;
					_t53 = _t22 >> 0;
					_t43 = 0xa;
					_t47 = ((_t22 & 0x00ffffff) + _t23 * 4 + (_t22 & 0x00ffffff) + _t23 * 4 >> 0) % _t43;
				} else {
					_t53 = (_t21 << 0x00000020 | _t51) >> 0x14;
					_t47 = 0;
				}
				_t29 = E00405FFC(_t41, _t47, _t53,  &_v36, 0xffffffdf);
				_t31 = E00405FFC(_t41, _t47, _t53,  &_v68, _t41);
				_t32 = E00405FFC(_t41, _t47, 0x41fd08, 0x41fd08, _a8);
				wsprintfA(_t32 + lstrlenA(0x41fd08), "%u.%u%s%s", _t53, _t47, _t31, _t29);
				return SetDlgItemTextA( *0x422ed8, _a4, 0x41fd08);
			}

0x004048b7
0x004048bc
0x004048c4
0x004048c5
0x004048d2
0x004048da
0x004048db
0x004048dd
0x004048df
0x004048e1
0x004048e4
0x004048e4
0x004048eb
0x004048f1
0x004048f1
0x004048f8
0x004048ff
0x00404902
0x00404905
0x00404905
0x00404909
0x00404919
0x0040491b
0x0040491e
0x004048c7
0x004048c7
0x004048ce
0x004048ce
0x00404926
0x00404931
0x00404947
0x00404957
0x00404973

APIs

lstrlenA.KERNEL32(Sepad149: Installing,Sepad149: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004047CC,000000DF,00000000,00000400,?), ref: 0040494F
wsprintfA.USER32 ref: 00404957
SetDlgItemTextA.USER32 ref: 0040496A

Strings

Sepad149: Installing, xrefs: 00404941, 00404946, 0040494C, 00404960
%u.%u%s%s, xrefs: 00404939

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$Sepad149: Installing
API String ID: 3540041739-3440464719
Opcode ID: 12f6fa3731befb5ff2bd286decedb689321e5faf0d4acc7877b9e8059f00797d
Instruction ID: 99a67daf6c97d227f7cf07030b4f4762c36886faa54bbd44db56b2f9a5a008fd
Opcode Fuzzy Hash: 12f6fa3731befb5ff2bd286decedb689321e5faf0d4acc7877b9e8059f00797d
Instruction Fuzzy Hash: 4F110D7350812937DB00656D9C45EEF328CDF85374F254637FA25F21D1EA78DC1252A8

Uniqueness

Uniqueness Score: -1.00%

Function 6D011837 Relevance: 7.7, APIs: 5, Instructions: 194
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E6D011837(signed int __edx, void* __eflags, void* _a8, void* _a16) {
				void* _v8;
				signed int _v12;
				signed int _v20;
				signed int _v24;
				char _v52;
				void _t45;
				void _t46;
				signed int _t47;
				signed int _t48;
				signed int _t57;
				signed int _t58;
				signed int _t59;
				signed int _t60;
				signed int _t61;
				void* _t67;
				void* _t68;
				void* _t69;
				void* _t70;
				void* _t71;
				signed int _t77;
				void* _t81;
				signed int _t83;
				signed int _t85;
				signed int _t87;
				signed int _t90;
				void* _t101;

				_t85 = __edx;
				 *0x6d01405c = _a8;
				_t77 = 0;
				 *0x6d014060 = _a16;
				_v12 = 0;
				_v8 = E6D01123B();
				_t90 = E6D0112FE(_t42);
				_t87 = _t85;
				_t81 = E6D01123B();
				_a8 = _t81;
				_t45 =  *_t81;
				if(_t45 != 0x7e && _t45 != 0x21) {
					_a16 = E6D01123B();
					_t77 = E6D0112FE(_t74);
					_v12 = _t85;
					GlobalFree(_a16);
					_t81 = _a8;
				}
				_t46 =  *_t81;
				_t101 = _t46 - 0x2f;
				if(_t101 > 0) {
					_t47 = _t46 - 0x3c;
					__eflags = _t47;
					if(_t47 == 0) {
						__eflags =  *((char*)(_t81 + 1)) - 0x3c;
						if( *((char*)(_t81 + 1)) != 0x3c) {
							__eflags = _t87 - _v12;
							if(__eflags > 0) {
								L56:
								_t48 = 0;
								__eflags = 0;
								L57:
								asm("cdq");
								L58:
								_t90 = _t48;
								_t87 = _t85;
								L59:
								E6D011429(_t85, _t90, _t87,  &_v52);
								E6D011266( &_v52);
								GlobalFree(_v8);
								return GlobalFree(_a8);
							}
							if(__eflags < 0) {
								L49:
								__eflags = 0;
								L50:
								_t48 = 1;
								goto L57;
							}
							__eflags = _t90 - _t77;
							if(_t90 < _t77) {
								goto L49;
							}
							goto L56;
						}
						_t85 = _t87;
						_t48 = E6D012EF0(_t90, _t77, _t85);
						goto L58;
					}
					_t57 = _t47 - 1;
					__eflags = _t57;
					if(_t57 == 0) {
						__eflags = _t90 - _t77;
						if(_t90 != _t77) {
							goto L56;
						}
						__eflags = _t87 - _v12;
						if(_t87 != _v12) {
							goto L56;
						}
						goto L49;
					}
					_t58 = _t57 - 1;
					__eflags = _t58;
					if(_t58 == 0) {
						__eflags =  *((char*)(_t81 + 1)) - 0x3e;
						if( *((char*)(_t81 + 1)) != 0x3e) {
							__eflags = _t87 - _v12;
							if(__eflags < 0) {
								goto L56;
							}
							if(__eflags > 0) {
								goto L49;
							}
							__eflags = _t90 - _t77;
							if(_t90 <= _t77) {
								goto L56;
							}
							goto L49;
						}
						__eflags =  *((char*)(_t81 + 2)) - 0x3e;
						_t85 = _t87;
						_t59 = _t90;
						_t83 = _t77;
						if( *((char*)(_t81 + 2)) != 0x3e) {
							_t48 = E6D012F10(_t59, _t83, _t85);
						} else {
							_t48 = E6D012F40(_t59, _t83, _t85);
						}
						goto L58;
					}
					_t60 = _t58 - 0x20;
					__eflags = _t60;
					if(_t60 == 0) {
						_t90 = _t90 ^ _t77;
						_t87 = _t87 ^ _v12;
						goto L59;
					}
					_t61 = _t60 - 0x1e;
					__eflags = _t61;
					if(_t61 == 0) {
						__eflags =  *((char*)(_t81 + 1)) - 0x7c;
						if( *((char*)(_t81 + 1)) != 0x7c) {
							_t90 = _t90 | _t77;
							_t87 = _t87 | _v12;
							goto L59;
						}
						__eflags = _t90 | _t87;
						if((_t90 | _t87) != 0) {
							goto L49;
						}
						__eflags = _t77 | _v12;
						if((_t77 | _v12) != 0) {
							goto L49;
						}
						goto L56;
					}
					__eflags = _t61 == 0;
					if(_t61 == 0) {
						_t90 =  !_t90;
						_t87 =  !_t87;
					}
					goto L59;
				}
				if(_t101 == 0) {
					L21:
					__eflags = _t77 | _v12;
					if((_t77 | _v12) != 0) {
						_v24 = E6D012D80(_t90, _t87, _t77, _v12);
						_v20 = _t85;
						_t48 = E6D012E30(_t90, _t87, _t77, _v12);
						_t81 = _a8;
					} else {
						_v24 = _v24 & 0x00000000;
						_v20 = _v20 & 0x00000000;
						_t48 = _t90;
						_t85 = _t87;
					}
					__eflags =  *_t81 - 0x2f;
					if( *_t81 != 0x2f) {
						goto L58;
					} else {
						_t90 = _v24;
						_t87 = _v20;
						goto L59;
					}
				}
				_t67 = _t46 - 0x21;
				if(_t67 == 0) {
					_t48 = 0;
					__eflags = _t90 | _t87;
					if((_t90 | _t87) != 0) {
						goto L57;
					}
					goto L50;
				}
				_t68 = _t67 - 4;
				if(_t68 == 0) {
					goto L21;
				}
				_t69 = _t68 - 1;
				if(_t69 == 0) {
					__eflags =  *((char*)(_t81 + 1)) - 0x26;
					if( *((char*)(_t81 + 1)) != 0x26) {
						_t90 = _t90 & _t77;
						_t87 = _t87 & _v12;
						goto L59;
					}
					__eflags = _t90 | _t87;
					if((_t90 | _t87) == 0) {
						goto L56;
					}
					__eflags = _t77 | _v12;
					if((_t77 | _v12) == 0) {
						goto L56;
					}
					goto L49;
				}
				_t70 = _t69 - 4;
				if(_t70 == 0) {
					_t48 = E6D012D40(_t90, _t87, _t77, _v12);
					goto L58;
				} else {
					_t71 = _t70 - 1;
					if(_t71 == 0) {
						_t90 = _t90 + _t77;
						asm("adc edi, [ebp-0x8]");
					} else {
						if(_t71 == 0) {
							_t90 = _t90 - _t77;
							asm("sbb edi, [ebp-0x8]");
						}
					}
					goto L59;
				}
			}

0x6d011837
0x6d011841
0x6d01184a
0x6d01184d
0x6d011852
0x6d01185b
0x6d011864
0x6d011866
0x6d01186d
0x6d01186f
0x6d011872
0x6d011876
0x6d011882
0x6d01188b
0x6d011890
0x6d011893
0x6d011899
0x6d011899
0x6d01189c
0x6d01189f
0x6d0118a2
0x6d011968
0x6d011968
0x6d01196b
0x6d0119e5
0x6d0119e9
0x6d0119f8
0x6d0119fb
0x6d011a03
0x6d011a03
0x6d011a03
0x6d011a05
0x6d011a05
0x6d011a06
0x6d011a06
0x6d011a08
0x6d011a0a
0x6d011a10
0x6d011a19
0x6d011a2a
0x6d011a35
0x6d011a35
0x6d0119fd
0x6d0119e0
0x6d0119e0
0x6d0119e2
0x6d0119e2
0x00000000
0x6d0119e2
0x6d0119ff
0x6d011a01
0x00000000
0x00000000
0x00000000
0x6d011a01
0x6d0119ed
0x6d0119f1
0x00000000
0x6d0119f1
0x6d01196d
0x6d01196d
0x6d01196e
0x6d0119d7
0x6d0119d9
0x00000000
0x00000000
0x6d0119db
0x6d0119de
0x00000000
0x00000000
0x00000000
0x6d0119de
0x6d011970
0x6d011970
0x6d011971
0x6d0119aa
0x6d0119ae
0x6d0119ca
0x6d0119cd
0x00000000
0x00000000
0x6d0119cf
0x00000000
0x00000000
0x6d0119d1
0x6d0119d3
0x00000000
0x00000000
0x00000000
0x6d0119d5
0x6d0119b0
0x6d0119b4
0x6d0119b6
0x6d0119b8
0x6d0119ba
0x6d0119c3
0x6d0119bc
0x6d0119bc
0x6d0119bc
0x00000000
0x6d0119ba
0x6d011973
0x6d011973
0x6d011976
0x6d0119a3
0x6d0119a5
0x00000000
0x6d0119a5
0x6d011978
0x6d011978
0x6d01197b
0x6d01198b
0x6d01198f
0x6d01199c
0x6d01199e
0x00000000
0x6d01199e
0x6d011991
0x6d011993
0x00000000
0x00000000
0x6d011995
0x6d011998
0x00000000
0x00000000
0x00000000
0x6d01199a
0x6d01197e
0x6d01197f
0x6d011985
0x6d011987
0x6d011987
0x00000000
0x6d01197f
0x6d0118a8
0x6d011920
0x6d011922
0x6d011925
0x6d011943
0x6d011946
0x6d01194c
0x6d011951
0x6d011927
0x6d011927
0x6d01192b
0x6d01192f
0x6d011931
0x6d011931
0x6d011954
0x6d011957
0x00000000
0x6d01195d
0x6d01195d
0x6d011960
0x00000000
0x6d011960
0x6d011957
0x6d0118aa
0x6d0118ad
0x6d011911
0x6d011913
0x6d011915
0x00000000
0x00000000
0x00000000
0x6d01191b
0x6d0118af
0x6d0118b2
0x00000000
0x00000000
0x6d0118b4
0x6d0118b5
0x6d0118eb
0x6d0118ef
0x6d011907
0x6d011909
0x00000000
0x6d011909
0x6d0118f1
0x6d0118f3
0x00000000
0x00000000
0x6d0118f9
0x6d0118fc
0x00000000
0x00000000
0x00000000
0x6d011902
0x6d0118b7
0x6d0118ba
0x6d0118e1
0x00000000
0x6d0118bc
0x6d0118bc
0x6d0118bd
0x6d0118d1
0x6d0118d3
0x6d0118bf
0x6d0118c1
0x6d0118c7
0x6d0118c9
0x6d0118c9
0x6d0118c1
0x00000000
0x6d0118bd

APIs

GlobalFree.KERNEL32 ref: 6D011893
GlobalFree.KERNEL32 ref: 6D011A2A
GlobalFree.KERNEL32 ref: 6D011A2F

Memory Dump Source

Source File: 00000000.00000002.779239899.000000006D011000.00000020.00000001.01000000.00000004.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000000.00000002.779220127.000000006D010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.779251763.000000006D013000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.779269562.000000006D015000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d010000_Quotation.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 22844d86dd5ec6073062bdc6aaa1e70188de4272eb63fa99186cabb218f1c218
Instruction ID: 09ba56c145bd5d1edbefe9c74839a1e487cf14972890c790d73e945cd46b13e4
Opcode Fuzzy Hash: 22844d86dd5ec6073062bdc6aaa1e70188de4272eb63fa99186cabb218f1c218
Instruction Fuzzy Hash: 4251D231D1C15AAEFB1D8FE8CC407BEBEF5BB6A349F95415AE420A3100C2B199458753

Uniqueness

Uniqueness Score: -1.00%

Function 00401D41 Relevance: 7.6, APIs: 5, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00401D41(int __edx) {
				struct HWND__* _t24;
				CHAR* _t30;
				void* _t40;
				void* _t44;
				signed int _t46;
				int _t50;
				signed int _t53;
				void* _t57;

				_t48 = __edx;
				if(( *(_t57 - 0x2b) & 0x00000001) == 0) {
					_t24 = GetDlgItem( *(_t57 - 8), __edx);
				} else {
					_t24 = E00402B0A(1);
					 *(_t57 - 0x10) = _t48;
				}
				_t46 =  *(_t57 - 0x2c);
				 *(_t57 + 8) = _t24;
				 *(_t57 - 8) = _t46 >> 0x1f;
				_t50 = _t46 & 0x00000003;
				_t53 = _t46 & 0x00000004;
				 *(_t57 - 0x1c) = _t46 >> 0x0000001e & 0x00000001;
				if((_t46 & 0x00010000) == 0) {
					_t30 =  *(_t57 - 0x34) & 0x0000ffff;
				} else {
					_t30 = E00402B2C(_t44);
				}
				 *(_t57 - 0xc) = _t30;
				GetClientRect( *(_t57 + 8), _t57 - 0x58);
				asm("sbb esi, esi");
				_t40 = SendMessageA( *(_t57 + 8), 0x172, _t50, LoadImageA( ~_t53 &  *0x423700,  *(_t57 - 0xc), _t50,  *(_t57 - 0x50) *  *(_t57 - 8),  *(_t57 - 0x4c) *  *(_t57 - 0x1c),  *(_t57 - 0x2c) & 0x0000fef0));
				if(_t40 != _t44 && _t50 == _t44) {
					DeleteObject(_t40);
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t57 - 4));
				return 0;
			}

0x00401d41
0x00401d45
0x00401d58
0x00401d47
0x00401d49
0x00401d4f
0x00401d4f
0x00401d5e
0x00401d61
0x00401d6b
0x00401d72
0x00401d78
0x00401d84
0x00401d87
0x00401d91
0x00401d89
0x00401d8a
0x00401d8a
0x00401d95
0x00401d9f
0x00401dc4
0x00401ddd
0x00401de5
0x00401df4
0x00401df4
0x004029bb
0x004029c7

APIs

GetDlgItem.USER32 ref: 00401D58
GetClientRect.USER32 ref: 00401D9F
LoadImageA.USER32 ref: 00401DCD
SendMessageA.USER32(?,00000172,?,00000000), ref: 00401DDD
DeleteObject.GDI32(00000000), ref: 00401DF4

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 7dc78e60c32ccc3c09c595abe6c2c4ca27936b49c459a2d12d3c5fdfefad9d6b
Instruction ID: 879b8917e8c3c9b7c2a93b5436fc05cb0971dbd0d1073f8587bede8dddcc77ec
Opcode Fuzzy Hash: 7dc78e60c32ccc3c09c595abe6c2c4ca27936b49c459a2d12d3c5fdfefad9d6b
Instruction Fuzzy Hash: CC2196B2E04109AFDB01DF98DD44AEE7BB5FB48300F10803AF905F6290C7789941CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00401DFF Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00401DFF(intOrPtr __edx) {
				void* __esi;
				int _t9;
				signed char _t15;
				struct HFONT__* _t18;
				intOrPtr _t30;
				struct HDC__* _t31;
				void* _t33;
				void* _t35;

				_t30 = __edx;
				_t31 = GetDC( *(_t35 - 8));
				_t9 = E00402B0A(2);
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				0x40a7e8->lfHeight =  ~(MulDiv(_t9, GetDeviceCaps(_t31, 0x5a), 0x48));
				ReleaseDC( *(_t35 - 8), _t31);
				 *0x40a7f8 = E00402B0A(3);
				_t15 =  *((intOrPtr*)(_t35 - 0x24));
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				 *0x40a7ff = 1;
				 *0x40a7fc = _t15 & 0x00000001;
				 *0x40a7fd = _t15 & 0x00000002;
				 *0x40a7fe = _t15 & 0x00000004;
				E00405FFC(_t9, _t31, _t33, 0x40a804,  *((intOrPtr*)(_t35 - 0x30)));
				_t18 = CreateFontIndirectA(0x40a7e8);
				_push(_t18);
				_push(_t33);
				E00405F38();
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00401dff
0x00401e0a
0x00401e0c
0x00401e19
0x00401e30
0x00401e35
0x00401e42
0x00401e47
0x00401e4b
0x00401e56
0x00401e5d
0x00401e6f
0x00401e75
0x00401e7a
0x00401e84
0x004025e4
0x00401569
0x00402960
0x004029bb
0x004029c7

APIs

GetDC.USER32(?), ref: 00401E02
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E1C
MulDiv.KERNEL32(00000000,00000000), ref: 00401E24
ReleaseDC.USER32 ref: 00401E35
CreateFontIndirectA.GDI32(0040A7E8), ref: 00401E84

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 02699fb8e5746cd42e9bc81a7398f0b4a801f797f07dd38d0fd2bed2daf6de53
Instruction ID: f74e6b169c59b5c86824efe7ff79e827475fcd3c365d9a6f340974a330803a43
Opcode Fuzzy Hash: 02699fb8e5746cd42e9bc81a7398f0b4a801f797f07dd38d0fd2bed2daf6de53
Instruction Fuzzy Hash: 6001B571948341AFE7019BB0AE49F9A7FB4EB15304F108479F201B72E2C6B851509B2F

Uniqueness

Uniqueness Score: -1.00%

Function 00401C0A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401C0A(intOrPtr __edx) {
				int _t29;
				long _t30;
				signed int _t32;
				CHAR* _t35;
				long _t36;
				int _t41;
				signed int _t42;
				int _t46;
				int _t56;
				intOrPtr _t57;
				struct HWND__* _t61;
				void* _t64;

				_t57 = __edx;
				_t29 = E00402B0A(3);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 - 8) = _t29;
				_t30 = E00402B0A(4);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 + 8) = _t30;
				if(( *(_t64 - 0x20) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 8)) = E00402B2C(0x33);
				}
				__eflags =  *(_t64 - 0x20) & 0x00000002;
				if(( *(_t64 - 0x20) & 0x00000002) != 0) {
					 *(_t64 + 8) = E00402B2C(0x44);
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x38)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t59 = E00402B2C();
					_t32 = E00402B2C();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t35 =  ~( *_t31) & _t59;
					__eflags = _t35;
					_t36 = FindWindowExA( *(_t64 - 8),  *(_t64 + 8), _t35,  ~( *_t32) & _t32);
					goto L10;
				} else {
					_t61 = E00402B0A();
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t41 = E00402B0A(2);
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t56 =  *(_t64 - 0x20) >> 2;
					if(__eflags == 0) {
						_t36 = SendMessageA(_t61, _t41,  *(_t64 - 8),  *(_t64 + 8));
						L10:
						 *(_t64 - 0xc) = _t36;
					} else {
						_t42 = SendMessageTimeoutA(_t61, _t41,  *(_t64 - 8),  *(_t64 + 8), _t46, _t56, _t64 - 0xc);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t64 - 4)) =  ~_t42 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x34)) - _t46;
				if( *((intOrPtr*)(_t64 - 0x34)) >= _t46) {
					_push( *(_t64 - 0xc));
					E00405F38();
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t64 - 4));
				return 0;
			}

0x00401c0a
0x00401c0c
0x00401c13
0x00401c16
0x00401c19
0x00401c23
0x00401c27
0x00401c2a
0x00401c33
0x00401c33
0x00401c36
0x00401c3a
0x00401c43
0x00401c43
0x00401c46
0x00401c4a
0x00401c4c
0x00401ca1
0x00401ca3
0x00401cac
0x00401cb4
0x00401cb7
0x00401cb7
0x00401cc0
0x00000000
0x00401c4e
0x00401c55
0x00401c57
0x00401c5a
0x00401c60
0x00401c67
0x00401c6a
0x00401c92
0x00401cc6
0x00401cc6
0x00401c6c
0x00401c7a
0x00401c82
0x00401c85
0x00401c85
0x00401c6a
0x00401cc9
0x00401ccc
0x00401cd2
0x00402960
0x00402960
0x004029bb
0x004029c7

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C7A
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C92

Strings

!, xrefs: 00401C46

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e636c23a318330d9371fb32b1eb0c44089503781878c3c5c4e956135cb08f77e
Instruction ID: 5540d85999f992b2d0d9c3d63f09df6deeece4c427f082cd61f041684b2cd5b6
Opcode Fuzzy Hash: e636c23a318330d9371fb32b1eb0c44089503781878c3c5c4e956135cb08f77e
Instruction Fuzzy Hash: 6E216BB1D48208BEEF06AFB4D98AAAD7FB5EB44304F10447EF501B61D1C7B89640DB18

Uniqueness

Uniqueness Score: -1.00%

Function 00405A60 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00405A60(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr* _t21;
				void* _t22;

				E00405FDA(0x421110, _a4);
				_t21 = E00405A0B(0x421110);
				if(_t21 != 0) {
					E00406244(_t21);
					if(( *0x42371c & 0x00000080) == 0) {
						L5:
						_t22 = _t21 - 0x421110;
						while(1) {
							_t11 = lstrlenA(0x421110);
							_push(0x421110);
							if(_t11 <= _t22) {
								break;
							}
							_t12 = E004062DD();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E004059B9(0x421110);
								continue;
							} else {
								goto L1;
							}
						}
						E00405972();
						return 0 | GetFileAttributesA(??) != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x00405a6c
0x00405a77
0x00405a7b
0x00405a82
0x00405a8e
0x00405a9a
0x00405a9a
0x00405ab2
0x00405ab3
0x00405aba
0x00405abb
0x00000000
0x00000000
0x00405a9e
0x00405aa5
0x00405aad
0x00000000
0x00000000
0x00000000
0x00000000
0x00405aa5
0x00405abd
0x00000000
0x00405ad1
0x00405a90
0x00405a94
0x00000000
0x00000000
0x00000000
0x00000000
0x00405a94
0x00405a7d
0x00000000

APIs

Part of subcall function 00405FDA: lstrcpynA.KERNEL32(?,?,00000400,00403307,00422F00,NSIS Error,?,00000006,00000008,0000000A), ref: 00405FE7

Part of subcall function 00405A0B: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nst891E.tmp,?,00405A77,C:\Users\user\AppData\Local\Temp\nst891E.tmp,C:\Users\user\AppData\Local\Temp\nst891E.tmp,746AFA90,?,C:\Users\user\AppData\Local\Temp\,004057C2,?,746AFA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A19
Part of subcall function 00405A0B: CharNextA.USER32(00000000), ref: 00405A1E
Part of subcall function 00405A0B: CharNextA.USER32(00000000), ref: 00405A32

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nst891E.tmp,00000000,C:\Users\user\AppData\Local\Temp\nst891E.tmp,C:\Users\user\AppData\Local\Temp\nst891E.tmp,746AFA90,?,C:\Users\user\AppData\Local\Temp\,004057C2,?,746AFA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405AB3
GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Local\Temp\nst891E.tmp,C:\Users\user\AppData\Local\Temp\nst891E.tmp,C:\Users\user\AppData\Local\Temp\nst891E.tmp,C:\Users\user\AppData\Local\Temp\nst891E.tmp,C:\Users\user\AppData\Local\Temp\nst891E.tmp,C:\Users\user\AppData\Local\Temp\nst891E.tmp,00000000,C:\Users\user\AppData\Local\Temp\nst891E.tmp,C:\Users\user\AppData\Local\Temp\nst891E.tmp,746AFA90,?,C:\Users\user\AppData\Local\Temp\,004057C2,?,746AFA90,C:\Users\user\AppData\Local\Temp\), ref: 00405AC3

Strings

C:\Users\user\AppData\Local\Temp\nst891E.tmp, xrefs: 00405A66, 00405A6B, 00405A71, 00405AAC, 00405AB2, 00405ABA, 00405AC2
C:\Users\user\AppData\Local\Temp\, xrefs: 00405A60

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nst891E.tmp
API String ID: 3248276644-1062076934
Opcode ID: 3d72b69990c89283bdec6022929649575e9d0056fbfb1b91cb3bf573b4946918
Instruction ID: fa13fd96d81fd76c8fc81ec80775158a1daeec84e0c55be597840f6fdc29cec0
Opcode Fuzzy Hash: 3d72b69990c89283bdec6022929649575e9d0056fbfb1b91cb3bf573b4946918
Instruction Fuzzy Hash: D5F0C825305D6616D62233361C85EAF1649CE82364715473FF851B12D3DB3C8943DE7E

Uniqueness

Uniqueness Score: -1.00%

Function 00405972 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405972(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x409014);
				}
				return _t7;
			}

0x00405973
0x0040598a
0x00405992
0x00405992
0x0040599a

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403222,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 00405978
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403222,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 00405981
lstrcatA.KERNEL32(?,00409014,?,00000006,00000008,0000000A), ref: 00405992

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405972

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3936084776
Opcode ID: 76b30c2e26840082170464c0c63912d3f8204d685d5b784281808f5f32aeb92b
Instruction ID: 0da8bf888325795cdd0c5347214511d48edcf337a1f8d4df24ff951c9a6f7455
Opcode Fuzzy Hash: 76b30c2e26840082170464c0c63912d3f8204d685d5b784281808f5f32aeb92b
Instruction Fuzzy Hash: C7D0A9A2605A716AD21223199C09EDB2A0CCF02314B080063F600B22A3CA3C1D018BFE

Uniqueness

Uniqueness Score: -1.00%

Function 00402C2E Relevance: 6.1, APIs: 4, Instructions: 63
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402C2E(void* __eflags, void* _a4, char* _a8, signed int _a12) {
				void* _v8;
				char _v272;
				void* _t19;
				signed int _t25;
				intOrPtr* _t27;
				signed int _t32;
				signed int _t33;
				signed int _t34;

				_t33 = _a12;
				_t34 = _t33 & 0x00000300;
				_t32 = _t33 & 0x00000001;
				_t19 = E00405E60(__eflags, _a4, _a8, _t34 | 0x00000008,  &_v8);
				if(_t19 == 0) {
					while(RegEnumKeyA(_v8, 0,  &_v272, 0x105) == 0) {
						__eflags = _t32;
						if(__eflags != 0) {
							RegCloseKey(_v8);
							return 0x3eb;
						}
						_t25 = E00402C2E(__eflags, _v8,  &_v272, _a12);
						__eflags = _t25;
						if(_t25 != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E00406372(3);
					if(_t27 == 0) {
						return RegDeleteKeyA(_a4, _a8);
					}
					return  *_t27(_a4, _a8, _t34, 0);
				}
				return _t19;
			}

0x00402c39
0x00402c42
0x00402c4b
0x00402c57
0x00402c5e
0x00402c82
0x00402c68
0x00402c6a
0x00402cbd
0x00000000
0x00402cc3
0x00402c79
0x00402c7e
0x00402c80
0x00000000
0x00000000
0x00402c80
0x00402c9c
0x00402ca4
0x00402cab
0x00000000
0x00402cd0
0x00000000
0x00402cb6
0x00402cda

APIs

RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402C93
RegCloseKey.ADVAPI32(?,?,?), ref: 00402C9C
RegCloseKey.ADVAPI32(?,?,?), ref: 00402CBD

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 73c9fb611972138edc71e9406aca9b8622a65655cc86fec515c5851ee22221db
Instruction ID: a6da729fb9552a58d385ec1c0953cf8d4b7f97d7084d0a629d1ed2eab5a533bf
Opcode Fuzzy Hash: 73c9fb611972138edc71e9406aca9b8622a65655cc86fec515c5851ee22221db
Instruction Fuzzy Hash: 8E115B32904109BBEF129F50DE09B9E7B6DEB54380F104072BE05B51E0E7B59E11AAA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405A0B Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405A0B(CHAR* _a4) {
				CHAR* _t5;
				char* _t7;
				CHAR* _t9;
				char _t10;
				CHAR* _t11;
				void* _t13;

				_t11 = _a4;
				_t9 = CharNextA(_t11);
				_t5 = CharNextA(_t9);
				_t10 =  *_t11;
				if(_t10 == 0 ||  *_t9 != 0x3a || _t9[1] != 0x5c) {
					if(_t10 != 0x5c || _t11[1] != _t10) {
						L10:
						return 0;
					} else {
						_t13 = 2;
						while(1) {
							_t13 = _t13 - 1;
							_t7 = E0040599D(_t5, 0x5c);
							if( *_t7 == 0) {
								goto L10;
							}
							_t5 = _t7 + 1;
							if(_t13 != 0) {
								continue;
							}
							return _t5;
						}
						goto L10;
					}
				} else {
					return CharNextA(_t5);
				}
			}

0x00405a14
0x00405a1b
0x00405a1e
0x00405a20
0x00405a24
0x00405a39
0x00405a58
0x00000000
0x00405a40
0x00405a42
0x00405a43
0x00405a46
0x00405a47
0x00405a4f
0x00000000
0x00000000
0x00405a51
0x00405a54
0x00000000
0x00000000
0x00000000
0x00405a54
0x00000000
0x00405a43
0x00405a31
0x00000000
0x00405a32

APIs

CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nst891E.tmp,?,00405A77,C:\Users\user\AppData\Local\Temp\nst891E.tmp,C:\Users\user\AppData\Local\Temp\nst891E.tmp,746AFA90,?,C:\Users\user\AppData\Local\Temp\,004057C2,?,746AFA90,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A19
CharNextA.USER32(00000000), ref: 00405A1E
CharNextA.USER32(00000000), ref: 00405A32

Strings

C:\Users\user\AppData\Local\Temp\nst891E.tmp, xrefs: 00405A0C

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nst891E.tmp
API String ID: 3213498283-3303754261
Opcode ID: 41ff5f2e282a09e2b8c2dcc033aaaa44e3aa2c06707c210a0f189d2452b315e7
Instruction ID: a4ce128402f48f1feafc2c55b1118e7c053650975221e3f5fcc16cd8d0856992
Opcode Fuzzy Hash: 41ff5f2e282a09e2b8c2dcc033aaaa44e3aa2c06707c210a0f189d2452b315e7
Instruction Fuzzy Hash: 13F0C251B04F916BFB32A2280CD4F6B5B88CB55365F145267E280672C2C27C88408F9A

Uniqueness

Uniqueness Score: -1.00%

Function 00402D60 Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402D60(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x41e8c0; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x423710;
						if(_t2 >  *0x423710) {
							_t3 = CreateDialogParamA( *0x423700, 0x6f, 0, E00402CDD, 0);
							 *0x41e8c0 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E004063AE(0);
					}
				} else {
					_t6 =  *0x41e8c0; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x41e8c0 = 0;
					return _t6;
				}
			}

0x00402d67
0x00402d81
0x00402d87
0x00402d91
0x00402d97
0x00402d9d
0x00402dae
0x00402db7
0x00000000
0x00402dbc
0x00402dc3
0x00402d89
0x00402d90
0x00402d90
0x00402d69
0x00402d69
0x00402d70
0x00402d73
0x00402d73
0x00402d79
0x00402d80
0x00402d80

APIs

DestroyWindow.USER32(00000000,00000000,00402F3E,00000001), ref: 00402D73
GetTickCount.KERNEL32 ref: 00402D91
CreateDialogParamA.USER32(0000006F,00000000,00402CDD,00000000), ref: 00402DAE
ShowWindow.USER32(00000000,00000005), ref: 00402DBC

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 840a75d409b371d7b77b67c1e1f99b2f4b28fbc1840826de4c71681516a351cc
Instruction ID: 88e2776c24fdb891b0502b3cf10dbd42b902845c03a9ebe61091678d0ea3e225
Opcode Fuzzy Hash: 840a75d409b371d7b77b67c1e1f99b2f4b28fbc1840826de4c71681516a351cc
Instruction Fuzzy Hash: E0F05E75905221ABCA207B62BE4CACA7BA4FB42B527014976F845B31E4C3784C868BDD

Uniqueness

Uniqueness Score: -1.00%

Function 00405075 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00405075(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t11;
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					__eflags = _t15 - 0x200;
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						__eflags = _t15 - 0x419;
						if(_t15 == 0x419) {
							__eflags =  *0x41fcf4 - _t16; // 0x0
							if(__eflags != 0) {
								_push(_t16);
								_push(6);
								 *0x41fcf4 = _t16;
								E00404A3B();
							}
						}
						L11:
						return CallWindowProcA( *0x41fcfc, _a4, _t15, _a12, _t16);
					}
					_t11 = IsWindowVisible(_a4);
					__eflags = _t11;
					if(_t11 == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E004049BB(_a4, 1);
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 == 0x20) {
					E004040B4(0x413);
					return 0;
				}
				goto L10;
			}

0x00405079
0x00405083
0x00405099
0x0040509f
0x004050c1
0x004050c4
0x004050c4
0x004050ca
0x004050cc
0x004050d2
0x004050d4
0x004050d5
0x004050d7
0x004050dd
0x004050dd
0x004050d2
0x004050e7
0x00000000
0x004050f5
0x004050a4
0x004050aa
0x004050ac
0x004050e4
0x004050e4
0x00000000
0x004050e4
0x004050b8
0x004050ba
0x00000000
0x004050ba
0x00405089
0x00405090
0x00000000
0x00405095
0x00000000

APIs

IsWindowVisible.USER32 ref: 004050A4
CallWindowProcA.USER32 ref: 004050F5

Part of subcall function 004040B4: SendMessageA.USER32(00010440,00000000,00000000,00000000), ref: 004040C6

Strings

, xrefs: 00405085

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: add97a0a6925bc22265a7304b998d918bb161013fa4103ebff122d1b57fa8f8b
Instruction ID: 69794148541a1a4d8d7be296dba567d41b1ee09d4c6a2f8e6d5670bc2f98cc64
Opcode Fuzzy Hash: add97a0a6925bc22265a7304b998d918bb161013fa4103ebff122d1b57fa8f8b
Instruction Fuzzy Hash: 3F017171100649ABDF219F11DD80A9F7A65EB84314F208037FA017A2D1D77A9C51DEEA

Uniqueness

Uniqueness Score: -1.00%

Function 6D012173 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29
librarystringloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6D012173(void* __eax, void* __ebx, void* __esi) {
				void* _t11;
				void* _t16;

				_t16 = __esi;
				_t11 = __eax;
				_push(ss);
			}

0x6d012173
0x6d012173
0x6d012173

APIs

GetProcAddress.KERNEL32(?), ref: 6D01217E
lstrlenA.KERNEL32(00000408), ref: 6D012198

Strings

Net, xrefs: 6D01217E

Memory Dump Source

Source File: 00000000.00000002.779239899.000000006D011000.00000020.00000001.01000000.00000004.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000000.00000002.779220127.000000006D010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.779251763.000000006D013000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.779269562.000000006D015000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d010000_Quotation.jbxd

Similarity

API ID: AddressProclstrlen
String ID: Net
API String ID: 2233632393-515476347
Opcode ID: c7ebf1656614f51148c42927b8f312f5aab991456fced90829bfa6ddb0dbfcb9
Instruction ID: 886a92e9673f52282d2ac3d59a0a1fa09cd44c28bcf227fbfc1bfd01a1425d9f
Opcode Fuzzy Hash: c7ebf1656614f51148c42927b8f312f5aab991456fced90829bfa6ddb0dbfcb9
Instruction Fuzzy Hash: 1AF08275508702DEDB715FB49C4566AB7F0FB41319B00CA3FE2E681060DB3490858B50

Uniqueness

Uniqueness Score: -1.00%

Function 00405679 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405679(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x421510->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x421510,  &_v20);
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405682
0x004056a2
0x004056aa
0x004056af
0x00000000
0x004056b5
0x004056b9

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421510,Error launching installer), ref: 004056A2
CloseHandle.KERNEL32(?), ref: 004056AF

Strings

Error launching installer, xrefs: 0040568C

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 0a67d81f0dbc2c48957f366610cafbe47269508c26dde6c53db592e432081f5d
Instruction ID: 7ab3ce879d7da258620b5dd87dc6aa02706b67d8cc8a7f981bd8ed1ee31a9d30
Opcode Fuzzy Hash: 0a67d81f0dbc2c48957f366610cafbe47269508c26dde6c53db592e432081f5d
Instruction Fuzzy Hash: 46E046F0A00209BFEB009B60EC09F7B7AACEB10748F404861BD11F32A0E374A9108A79

Uniqueness

Uniqueness Score: -1.00%

Function 00403762 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403762() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x41eccc; // 0x807660
				_t3 = E00403747(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8));
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x41eccc =  *0x41eccc & 0x00000000;
				return _t3;
			}

0x00403763
0x0040376b
0x00403772
0x00403775
0x00403775
0x00403777
0x0040377c
0x00403783
0x00403789
0x0040378d
0x0040378e
0x00403796

APIs

FreeLibrary.KERNEL32(?,746AFA90,00000000,C:\Users\user\AppData\Local\Temp\,0040373A,00403554,?,?,00000006,00000008,0000000A), ref: 0040377C
GlobalFree.KERNEL32 ref: 00403783

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403762

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3936084776
Opcode ID: c8d1562c69e49bacb52193c1b129ec66577e910d0a26dd744afe86c7ae1d1dec
Instruction ID: ee514f1fc3f324b596d41214b75e1b85a5e4a54197580a2dff82031d974a72f0
Opcode Fuzzy Hash: c8d1562c69e49bacb52193c1b129ec66577e910d0a26dd744afe86c7ae1d1dec
Instruction Fuzzy Hash: 40E0C27380112097C7251F07EC04B5A776CAF45B22F01C02AEC007B3A0C7742C418BD9

Uniqueness

Uniqueness Score: -1.00%

Function 004059B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004059B9(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}

0x004059ba
0x004059c4
0x004059c6
0x004059cd
0x004059d5
0x00000000
0x00000000
0x00000000
0x004059d5
0x004059d7
0x004059dc

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402E30,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Quotation.exe,C:\Users\user\Desktop\Quotation.exe,80000000,00000003), ref: 004059BF
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E30,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Quotation.exe,C:\Users\user\Desktop\Quotation.exe,80000000,00000003), ref: 004059CD

Strings

C:\Users\user\Desktop, xrefs: 004059B9

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3125694417
Opcode ID: 1c4ce1fe46e37373cead662465a4f3eb2a6c0bdf31f922d28b251b51ad992424
Instruction ID: a086819795abd80aa1ad59fb022c9920fa60cb9da26d6d2253466900a8022463
Opcode Fuzzy Hash: 1c4ce1fe46e37373cead662465a4f3eb2a6c0bdf31f922d28b251b51ad992424
Instruction Fuzzy Hash: 3FD0A7E3408DB05EE70353149C04B9F6A48CF12310F0900A3F180A21A6C67C1C414BFE

Uniqueness

Uniqueness Score: -1.00%

Function 6D0110E0 Relevance: 5.1, APIs: 4, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D0110E0(void* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char* _t17;
				char _t19;
				void* _t20;
				void* _t24;
				void* _t27;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				signed int _t43;
				void* _t52;
				char* _t53;
				char* _t55;
				void* _t56;
				void* _t58;

				 *0x6d01405c = _a8;
				 *0x6d014060 = _a16;
				 *0x6d014064 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x6d014038, E6D011556, _t52);
				_t43 =  *0x6d01405c +  *0x6d01405c * 4 << 2;
				_t17 = E6D01123B();
				_a8 = _t17;
				_t53 = _t17;
				if( *_t17 == 0) {
					L16:
					return GlobalFree(_a8);
				} else {
					do {
						_t19 =  *_t53;
						_t55 = _t53 + 1;
						_t58 = _t19 - 0x6c;
						if(_t58 > 0) {
							_t20 = _t19 - 0x70;
							if(_t20 == 0) {
								L12:
								_t53 = _t55 + 1;
								_t24 = E6D011266(E6D0112AD( *_t55 - 0x30));
								L13:
								GlobalFree(_t24);
								goto L14;
							}
							_t27 = _t20;
							if(_t27 == 0) {
								L10:
								_t53 = _t55 + 1;
								_t24 = E6D0112D1( *_t55 - 0x30, E6D01123B());
								goto L13;
							}
							L7:
							if(_t27 == 1) {
								_t31 = GlobalAlloc(0x40, _t43 + 4);
								 *_t31 =  *0x6d014030;
								 *0x6d014030 = _t31;
								E6D011508(_t31 + 4,  *0x6d014064, _t43);
								_t56 = _t56 + 0xc;
							}
							goto L14;
						}
						if(_t58 == 0) {
							L17:
							_t34 =  *0x6d014030;
							if( *0x6d014030 != 0) {
								E6D011508( *0x6d014064, _t34 + 4, _t43);
								_t37 =  *0x6d014030;
								_t56 = _t56 + 0xc;
								GlobalFree(_t37);
								 *0x6d014030 =  *_t37;
							}
							goto L14;
						}
						_t39 = _t19 - 0x4c;
						if(_t39 == 0) {
							goto L17;
						}
						_t40 = _t39 - 4;
						if(_t40 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L12;
						}
						_t27 = _t40;
						if(_t27 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L10;
						}
						goto L7;
						L14:
					} while ( *_t53 != 0);
					goto L16;
				}
			}

0x6d0110e7
0x6d0110ef
0x6d011103
0x6d01110b
0x6d011116
0x6d011119
0x6d011121
0x6d011124
0x6d011126
0x6d0111c4
0x6d0111d0
0x6d01112c
0x6d01112d
0x6d01112d
0x6d011130
0x6d011131
0x6d011134
0x6d011203
0x6d011206
0x6d01119e
0x6d0111a4
0x6d0111ac
0x6d0111b1
0x6d0111b4
0x00000000
0x6d0111b4
0x6d011209
0x6d01120a
0x6d011186
0x6d01118c
0x6d011194
0x00000000
0x6d011194
0x6d011152
0x6d011153
0x6d01115b
0x6d011168
0x6d011170
0x6d011179
0x6d01117e
0x6d01117e
0x00000000
0x6d011153
0x6d01113a
0x6d0111d1
0x6d0111d1
0x6d0111d8
0x6d0111e5
0x6d0111ea
0x6d0111ef
0x6d0111f5
0x6d0111fb
0x6d0111fb
0x00000000
0x6d0111d8
0x6d011140
0x6d011143
0x00000000
0x00000000
0x6d011149
0x6d01114c
0x6d01119b
0x00000000
0x6d01119b
0x6d01114f
0x6d011150
0x6d011183
0x00000000
0x6d011183
0x00000000
0x6d0111ba
0x6d0111ba
0x00000000
0x6d0111c3

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 6D01115B
GlobalFree.KERNEL32 ref: 6D0111B4
GlobalFree.KERNEL32 ref: 6D0111C7
GlobalFree.KERNEL32 ref: 6D0111F5

Memory Dump Source

Source File: 00000000.00000002.779239899.000000006D011000.00000020.00000001.01000000.00000004.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000000.00000002.779220127.000000006D010000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.779251763.000000006D013000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.779269562.000000006D015000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d010000_Quotation.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: a26b914386466852eac3ccd3b040c367268bd2edc66e5da0f5416efe88b81728
Instruction ID: 11a8266d679c77c8bf711e312117ece70ad005659f0046f1cdaf63dbcb6761b6
Opcode Fuzzy Hash: a26b914386466852eac3ccd3b040c367268bd2edc66e5da0f5416efe88b81728
Instruction Fuzzy Hash: 243181B140C146AFFB0A8FE9DC4AB2DBFF9FB1A248B154515E964C7160D734D810CB26

Uniqueness

Uniqueness Score: -1.00%

Function 00405AD8 Relevance: 5.0, APIs: 4, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405AD8(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}

0x00405ae8
0x00405aea
0x00405aed
0x00405b19
0x00405af2
0x00405afb
0x00405b00
0x00405b0b
0x00405b0e
0x00405b2a
0x00405b10
0x00405b17
0x00000000
0x00405b17
0x00405b23
0x00405b27
0x00405b27
0x00405b21
0x00000000

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D33,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405AE8
lstrcmpiA.KERNEL32(00000000,00000000,?,00000000,00405D33,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B00
CharNextA.USER32(00000000,?,00000000,00405D33,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B11
lstrlenA.KERNEL32(00000000,?,00000000,00405D33,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B1A

Memory Dump Source

Source File: 00000000.00000002.772489425.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.772463227.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772553874.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772590975.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.772743486.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: c17fcd1cf7dd52c707961598001fbe9307a221727c523cbd792ccb3aa3d95fe1
Instruction ID: 2cbfd0870324320007afb9b70b5ca04d8eb3af27e3ea935175830c0dc6d3898b
Opcode Fuzzy Hash: c17fcd1cf7dd52c707961598001fbe9307a221727c523cbd792ccb3aa3d95fe1
Instruction Fuzzy Hash: 50F0C231604414BFC702DBA9DC40D9EBBB8EF46250B2540A6E800F7251D274FE01ABA9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Quotation.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Blegnbbetheden\Telegrammers.Non

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Cohesion\Quakily\Privileger.Fla

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Cohesion\Quakily\SolutionExplorerCLI.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Cohesion\Quakily\System.Security.Cryptography.X509Certificates.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Delforliget\Melotragedy\Lindhardt\System.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Delforliget\Melotragedy\Lindhardt\libdatrie-1.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard\libpkcs11-helper-1.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard\maintenanceservice2.exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Forureningsforebygget\Pegboard\percentile.dll

C:\Users\user\AppData\Local\Temp\nst891E.tmp\System.dll

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
Quotation.exe

Function 00403235 Relevance: 87.9, APIs: 32, Strings: 18, Instructions: 366
stringcomfileCOMMON

Function 0040523F Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Function 6D011A98 Relevance: 18.6, APIs: 12, Instructions: 585
stringmemorylibraryCOMMONCrypto

Function 004057A2 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Function 00402138 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139
comCOMMON

Function 00406666 Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Function 004062DD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Function 00403B94 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Function 004037F7 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Function 00402DC4 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 181
memoryCOMMON

Function 00405FFC Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 199
stringCOMMON

Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 00405101 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Function 004055C7 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Function 00406304 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00402FFB Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Function 00405BA2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Function 6D0116DB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 0040243D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Function 0040206A Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Function 00405EC1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
registryCOMMON

Function 00406A9B Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Function 00406C9C Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Function 004069B2 Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Function 004064B7 Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Function 00406905 Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Function 00406A23 Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Function 0040696F Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Function 0040254C Relevance: 4.5, APIs: 3, Instructions: 47
registryCOMMON

Function 6D012921 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21
memoryCOMMON

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Function 0040156F Relevance: 3.0, APIs: 2, Instructions: 23
COMMON

Function 00406372 Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Function 00405B73 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Function 00405B4E Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Function 00405644 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Function 6D012A38 Relevance: 1.6, APIs: 1, Instructions: 143
fileCOMMON